How Linux typically starts up on a PC
you switch on the computer
BIOS is shown and the devices are checked.
the master boot record is executed
The BIOS will then load the first sector of the first hard disk and execute it. The first sector is part of the bootloader and loads more sectors, for the grub bootloader this looks like this:
You can look what's in your harddisk's first sector using the command
dd if=/dev/sda count=1 | hexdump -C
You can disassemble the master boot record using the command
dd if=/dev/sda count=1 > mbr.bin; objdump -D -b binary -mi386 -Maddr16,data16 mbr.bin
For me it calls int18h, then int13h, function ah=41h (check extensions).
the boot loader is executed
The boot loader is typically grub, and there is an older and smaller called lilo. The grub bootloader displaying the boot menu can look like this:
the Linux kernel is loaded
The boot loader loads the kernel using BIOS routines. There is not yet a driver loaded for the harddisk to boot from.
the initrd is loaded
The initrd is the initial RAM disk. It will be loaded by the boot loader using only BIOS routines. Those BIOS routines have a special way of addressing devices. This is why the first partition on the first disk will be called hd0,0 while the Linux routines call it /dev/sda1. Also the BIOS routines work in 16 bit mode which is why the operating system will not use them. Now initrd has the drivers the kernel needs to mount the harddisk where the kernel will start the program init on.
the Linux kernel is executed
Now the Linux kernel can start. It will execute the program init on the initial ram disk.
the init program is started
The program init on the initial ram disk will mount the harddisk and run /sbin/init there. If the init process quits, the Linux kernel panics. Init is responsible for all further services and programs that are started.
the init scripts are executed
This can be SysV init scripts or upstart or systemd. These init scripts typically start services. Services are grouped into runlevels. Find out your current runlevel with the command
Change your runlevel, in this case to 3, with the command
E.g. in SUSE the runlevels are defines as
- 0: reboot
- 1: rescue system, single user
- 2: all services that run in (1) plus services needed for multi-user login
- 3: all services that run in (2) plus network services
- 4: undefined
- 5: all services that run in (3) plus graphical display
Some notable services are:
- Used for the alsa sound system
- Used for printing, it is the common Unix printing system
- Used to call public functions in running programs. Should be abstracted to users.
- Used for enlightenment sound system
- Network Time Protocol to keep your clock in sync with the real time via the network
- To automount devices as soon as they are plugged in, e.g. USB disks and CD ROMs
- The udev services have a lot of names, e.g. boot.udev under SUSE. They create the device handles in the /dev folder, e.g. when you plug in a USB disk or attach a web cam
- The x display manager shows a graphical login screen and starts a session when you log in. It keeps running during the session so when you end your session, you will be able to log in again.
- mounts all cifs network drives
- manages X fonts
- Cron executes jobs in given time intervals according to /etc/crontab
- provides information like login names, home directories and so on over the network
- Makes sure to throttle down your computer's speed if there is nothing to do, it can save power and it is configured to do so.
- The network service makes sure you have an IP address and your network card is active.
- Service that allows to control a computer via the network
Virtual Terminals are started
Init will also create virtual terminals. You can typically reach them by pressing CTRL_ALT_F1 or CTRL_ALT with another function key. They are text-only consoles that look like this:
X Windowing system is started
login manager is started
Computer waits for user login
Now the boot process has finished and the computer waits for a user to log in. While waiting it will execute the cron jobs as of /etc/crontab.
user session incl. Desktop environment is started
user starts a shell
The user can start several shells: bash, zsh, csh, ksh, tcsh and a lot more. We will assume the user starts bash. He can either start it as a non-login-shell (by logging in graphically and clicking on the terminal symbol) or he can start it as a login shell (by logging in with a password, authorized key or by starting su - or bash - or bash -login).
For a login bash shell the following will be done:
- /bin/login will be called
- login will output last login based on /var/log/lastlog
- login will output /etc/motd, configurable in /etc/pam.d
- login will find out which shell to run for the user from the file /etc/passwd. We assume here the shell is bash.
- login will start bash and source /etc/profile.d/*.sh and .bash_profile
- bash will source /etc/bash.bashrc and .bashrc. You can use strace to find this out.
- Scheduling Tasks