The Linux Boot Process

Kernel:

• The part of the OS that always remains running when the system is up.
• The kernel interacts directly with the hardware and services the user programs.
• The compiled kernel resides in the file: /boot/vmlinuz on your Linux machines
• This is probably a symbolic link (pointer to a file) to the long version of the kernel name.

Services provided by the OS and Kernel:

• Program Execution: scheduling, loading, running and terminating
• I/O operation
• File System Management
• Error Detection
• Resource Allocation: access to devices while avoiding deadlock
• Accounting: usage statistics
• Protection: Multiuser system / Multiprogramming environment, preserves state of each process

Boot Process

This is the process of bringing a portion of the OS into main memory and then having the processor execute it.

• Called boot-strapping the system because the computer must "pull itself up by its own bootstraps."

Why? Because the Operating System is not available or running yet.

Overview of Steps to boot the system:

• Loading and initializing the kernel
• Detecting and configuring devices
• Starting initial system processes
• kernel threads: kflushd, kupdate, kpiod, kswapd
• init: the first process to run after the system boots
• Executing start-up scripts
• Multiuser operation, most system services are up and running
• Start getty process for accepting logins 

The first step in the boot process: Loading and initializing the kernel

• PCs are different from proprietary hardware such as Sun's Ultra 3 or HP's C240.
• On a machines built for UNIX, there exists code specific to the hardware devices supported by that vendor.
• The code lives in ROM (Read Only Memory), also called firmware
• It knows precisely how to boot the system and initialize the devices 
• disk, network, video, etc 
• and where to look for the kernel
• On a PC the boot code lives in the BIOS
• not as sophisticated as the firmware on a UNIX machine

Turning on the computer: The BIOS

• After the system is reset, code found in the BIOS (Basic Input/Output System) is executed
•  Self-tests performed on the computer hardware
• Initializes the hardware devices.
• checking for IRQ and I/O port conflicts
• Searches for an operating system to boot
• depending on the BIOS boot order setting, the first sector (Boot Sector) on the system
• first disk hard disk, floppy, or CD-ROM
• NOTE: The BIOS typically will select an IDE disk over a SCSI disk
• The BIOS copies the contents of this first sector into RAM then exectues the code it has just loaded. (512 bytes)
• Note: LILO or Grub can either be installed into the MBR of the disk or it can be installed into the boot record of the Linux root (/) partition.

---

Note: The boot sector is the first sector on a floppy disk.  On a hard disk it is the first sector of a partition.

Using the Windows or OS/2 boot loader

• The MBR boot code has access to the system's partition table
• It loads the first sector of code on the active DOS partition
• The role of the boot-sector code is to give the system information about the structure and format of a partition
• The boot-sector loads NTLDR into memory and executes it
• Virtual memory is setup, initial file system drivers are loaded
• The boot.ini file is read giving the user a menu of operating systems
• ...

Booting Linux using the Windows 2000 or NT boot loader -- This works with NTFS filesystem.

• Install lilo or grub to the Linux root partition (not the MBR)
• NOTE: If you have a separate /boot partition, point lilo at that partition!

      # cd /etc
      # cp lilo.conf.anaconda lilo.conf
      # vi lilo.conf
      

modify this line from

      boot=/dev/hda
      

to

      boot=/dev/hda2
      

Execute the lilo command to write your changes

 
      # lilo
      

Grab the first 512 bytes of the root partition and save it to a file. (If you have a /boot partition, dd the first 512 bytes of that partition)

      # dd if=/dev/hda2 of=bootsect.lnx bs=512 count=1
      

copy the file to a floppy so you can eventually move it to your Windows system partition (containing ntldr and ntdetect.com).

      # mount -t msdos /dev/fd0 /mnt/floppy
      # cp bootsect.lnx /mnt/floppy
      # umount /mnt/floppy
      

Boot your Windows partition and modify the Windows boot.ini by adding a line at the bottom of that file for Linux.

      C:\bootsect.lnx="Linux"
      

Copy the bootsect.lnx file off the floppy to the Windows system partition, reboot and choose your OS.

LILO (LInux LOader) boot loader

• The LILO boot loader is broken into two parts since it would be too large to fit into the MBR.
• The first part of LILO executes and locates the map file (in the /boot file system)
• Which it finds based on device IDs and file sector locations
• lilo has no knowledge of the filesystem and must locate files based on disk sector locations
• It executes the map file, which allows lilo to locate the files it needs on the disk
• Using the map file it displays a menu of available Operating Systems
• If the user chooses a Windows OS, the boot sector of the Windows partition is loaded into RAM and executed
• If the user chooses Linux, lilo copies the Linux kernel image into RAM.

Other LILO details

• Can be installed into the MBR or the boot record of the root (or /boot) partition
  
• config file: /etc/lilo.conf
• To install lilo you must execute the lilo command: /sbin/lilo
• If you change the config file you must re-run /sbin/lilo

Grub

• Grub is a more sophisticated boot loader
• Understands the layout of a filesystem
• Similar to Sun's OpenBoot firmware
• Can retrieve kernels from a server using TFTP
• Doesn't require that you reinstall it to the boot record or MBR every time you change the config file
  • /boot/grub/grub.conf

  Booting Single-User Mode in Grub

  1. If you have a GRUB password configured, type p and enter the password.

  2. Select the version of the kernel that you wish to boot and type e for edit. You will be presented with a list of items in the configuration file for the title you just selected.

  3. Select the line that starts with kernel and type e to edit the line.

  4. Go to the end of the line and type single as a separate word (press the [Spacebar] and then type single). Press [Enter] to exit edit mode.

  5. Back at the GRUB screen, type b to boot into single user mode.

Kernel Initialization

• Lilo executes the kernel, which knows where to find the root filesystem

Initial ramdisk (initrd)

• Only required for booting kernels located on SCSI disks
• because the additional drivers require too much space for a floppy
• a root filesystem that is unpacked from a compressed file
• allows the drivers to be loaded as modules
• the boot loader loads the compressed file into memory, the kernel uncompresses it and mounts it as the root filesystem

Back to the kernel

• with or without the ramdisk, the kernel begins to initialize itself
• CPU is detected
• Probe PCI bus and attached devices, builds table of resources used
• Virtual memory management initialized, kswapd
• Initialized devices compiled into the kernel
• Particularly those needed to mount the root filesystem
• These must be compiled into the kernel in order to mount the root filesystem
• ext3, or NFS and TCP/IP if it is NFS mounted
• Mount the root filesystem
• The last thing the kernel does during boot is to start the init process -- PID 1.
• init is the parent of all processes
• Although other processes have been started before init, these are kernel threads
• by convention they have higher process IDs than init

The second step in the boot process: Init

• Init then continues the boot process by reading its configuration file, /etc/inittab, and performing the following tasks:
• Determine which runlevel to entered at startup

 

id:5:initdefault:

 

• Execute basic initialization script

si::sysinit:/etc/rc.d/rc.sysinit

• verify the integrity of the file systems
• mounting the /proc filesystem
• Setup swap space
•  mounting the local file systems -- by looking at the /etc/fstab file
• run depmod to build a table of module dependencies
• configure network interfaces
• typically the network drivers are loaded as modules
• load USB, PCMCIA modules, etc
•   Starting system daemons

l0:0:wait:/etc/rc.d/rc 0
l1:1:wait:/etc/rc.d/rc 1
l2:2:wait:/etc/rc.d/rc 2
l3:3:wait:/etc/rc.d/rc 3
l4:4:wait:/etc/rc.d/rc 4
l5:5:wait:/etc/rc.d/rc 5
l6:6:wait:/etc/rc.d/rc 6

•  If you default run-level is 5, the script rc is passed the argument 5
• Next, if the run-level is 5, run the script prefdm which launches the X display manager

l5:5:wait:/etc/rc.d/rc 5
x:5:respawn:/etc/X11/prefdm -nodaemon
 

• Based on your default run-level, the scripts located in /etc/rc.d/rcN.d are executed
• Assuming your default run-level is 5 all the scripts beginning with 'S' are executed
• In ascending order based on the 2 digit number following the 'S' which is followed in ascending order
• The scripts beginning with a 'K' are executed in descending order on exit (typically shutdown)
• Enabling user logins

ps -ef | grep mingetty

init -- Process Id 

System Initialization Scripts:

• Shell programs stored in /etc/rc.d/init.d on your system
• System V UNIX and LINUX have similar structure

• Symbolic links in the run-level directories point at these scripts

 
$ ls -l /etc/rc.d/rc3.d
lrwxrwxrwx  1 root  root  16   Jan 9  09:35 syslog -> ../init.d/syslog
$ ls -l /etc/rc.d/init.d/syslog
-rwxr-xr-x  1 root  root  1369 Jun 23 /etc/rc.d/init.d/syslog
 

• They are given either 'stop' or 'start' as an argument depending on whether the symobolic link begins with an 'S' or a 'K'
• Started by the init process based on your run-level

Init config file: /etc/inittab

• Defines what init should do when system enters a different run-level, typically by running shell scripts.
• Entries in the inittab file have 4 fields: (more on this later)

id:runlevel:action:process

The scripts are found in /etc/rc.d/rcN.d where N is the run level number.

• run-level 0: when the system goes down and powers off
• run-level 1: single-user mode, root only
• run level 2 - 5: booting to mulituser mode
• run-level 5: X is started at boot time
• run-level 6: Reboot

To Deactivate Starting X on Boot

Why deactivate X logon?

• Monitors can be damaged if they run at the wrong sync rate for a small period of time.
• This is more a good habit to get into since you may be installing Linux at home or elsewhere.
• The X process is "respawed" when it dies which put you in an infinite login loop unable to troubleshoot the login process affectively

How to deactivate the X login screen

• Change your default run level to 3 instead of 5 in the /etc/inittab file.
• This involves editing the /etc/inittab file -- be careful
•  To temporarily get around a hung X session you can Use <Ctrl> <Alt> F2 to escape to a non-GUI login
• <Ctrl> <Alt> F7 will take you back to your X desktop
•  To kill the X session type <Ctrl><Alt><Backspace>

NOTE: Always shutdown your computer before powering off!

• Prevents damaging your filesystems and loss of data

init: The Finer Points

init reads the file /etc/inittab, which tells it what to do. To examine the inittab man page type:

% man 5 inittab

The inittab file contains entries with four fields:

----------------------------id
|  -------------------------run-level
|  |   ---------------------action
|  |   |       -------------process
|  |   |       |
l3:3:wait:/etc/rc.d/rc 3

1: id field

• A unique identifier for an entry in the inittab

  l3:3:wait:/etc/rc.d/rc 3
      

• The run-level(s) that the action takes place

3:2345:respawn:/sbin/mingetty tty3
  

3:2345:respawn:/sbin/mingetty tty3
  

initdefault	defines the run-level to enter after the system has booted.
wait	the init process will wait for this process to terminate.
boot	executed at boot time, run-level is ignored
bootwait	executed at boot time, init waits for the process to finish before continuing.
sysinit	executed at system boot before any boot or bootwait inittab processes.
respawn	the process will be restarted whenever it terminates, ie, getty
once	the process will be executed once when the specified run-level is entered
ctrlaltdel	executed when init receives the SIGINT signal -- someone has pressed CTRL-ALT-DEL

4: process Field

• The process or script that gets executed and its aguments

3:2345:respawn:/sbin/mingetty tty3

What happens when init starts: review

• First it identifies the initdefault entry, which is the default run-level.

id:3:initdefault:

• Next, the sysinit entries are executed which do the following:

si::sysinit:/etc/rc.d/rc.sysinit

• local filesystems get checked (fsck) and mounted (mount -a),
• the clock set,
• swap space enabled
• depmod is run to create module dependency table
• hostname gets set
• Then the init process spawns all processes whose run-level field matches the initdefault run-level field.

l3:3:wait:/etc/rc.d/rc 3

• Init executes the script /etc/rc.d/rc 3 because that is the default run-level.
• Init will wait until /etc/rc.d/rc terminates
• 3 is an argument to the rc script (corresponds to run-level 3)
• This script will execute all the scripts in /etc/rc.d/rc3.d at begin with an 'S'

The run-level scripts

• Assuming our default run-level is 3
• the scripts in /etc/rc.d/rc3.d that start with `S' (for start) are executed.
• These files are symbolic links to the scripts that live in /etc/rc.d/init.d.

# ls -l /etc/rc.d/rc3.d | grep S

lrwxrwxrwx 1 root root 17 Aug 10 06:50 S10network -> ../init.d/network
lrwxrwxrwx 1 root root 17 Aug 10 06:55 S11portmap -> ../init.d/portmap
lrwxrwxrwx 1 root root 16 Sep 26 11:19 S18autofs -> ../init.d/autofs
lrwxrwxrwx 1 root root 16 Aug 10 06:50 S30syslog -> ../init.d/syslog

Lets examine the file S10network:

• The number 10 designates what order the run-level script will run.
• They are executed in ascending order
  
• If there were no scripts starting with S00 ... S09, then S10 will get executed first.
• S10network  is really a link to /etc/rc.d/init.d/network
• a script to start and stop the network interfaces.
• Because the link starts with an `S', the run-level script knows to execute the syslog script with a ``start'' argument.

/etc/rc.d/init.d/network start

• There are corresponding links starting with `K'  for "kill" which specify what to stop 
• These scripts are executed in descending order when the system is shutdown

Configuring LILO

• The LILO configuration file is /etc/lilo.conf.
• The lilo command (/sbin/lilo)  reads the config file and installs the lilo accordingly

$ cat /etc/lilo.conf

prompt
timeout=50            # time for user to interrupt
default=linux         # if no interrupt boot linux
boot=/dev/sda         # hard drive containing lilo 
map=/boot/map         # used by LILO to locate kernel
install=/boot/boot.b  # bootstrap code to start system
message=/boot/message # user message after timeout

image=/boot/vmlinuz-2.4.7-10      # the kernel to boot
label=linux.old                   # label to refer to this kernel
initrd=/boot/initrd-2.4.7-10.img  # see below
read-only                         # initially mount root as RO
root=/dev/sda1                    # specify the root partition

image=/boot/vmlinuz-2.4.18-10
label=linux.bak
initrd=/boot/initrd-2.4.18-10.img
read-only
root=/dev/sda1

image=/boot/vmlinuz-2.4.18-17.7.x
label=linux
root=/dev/sda1
read-only
initrd=/boot/initrd-2.4.18-17.7.x.img

 

*The initrd entry is needed for systems with SCSI disks. The SCSI device drivers must be installed in order for the kernel to read the disk!

The /etc/lilo.conf on a dual-boot system is identical except for the following three lines appended to the bottom of the file:

other=/dev/sda2
    optional
    label=win2k

Configuring GRUB

• The GRUB configuration file is /boot/grub/grub.conf

$ cat /boot/grub/grub.conf

# grub.conf generated by anaconda
#
# Note that you do not have to rerun grub after making changes to this file
# NOTICE:  You do not have a /boot partition.  This means that
#          all kernel and initrd paths are relative to /, eg.
#          root (hd0,0)
#          kernel /boot/vmlinuz-version ro root=/dev/hda1
#          initrd /boot/initrd-version.img
#boot=/dev/hda
default=0
timeout=10
# hd0,0 is the device used for the rest of the boot process
# It is the first partition on the first hard disk detected by your BIOS
# This line says the kernel is on /dev/hda1 on this machine
splashimage=(hd0,0)/boot/grub/splash.xpm.gz
title Red Hat Linux (2.4.20-20.8)
        root (hd0,0)
# kernel image and root filesystem location
        kernel /boot/vmlinuz-2.4.20-20.8 ro root=LABEL=/
        initrd /boot/initrd-2.4.20-20.8.img
title Red Hat Linux (2.4.20-19.8)
        root (hd0,0)
        kernel /boot/vmlinuz-2.4.20-19.8 ro root=LABEL=/
        initrd /boot/initrd-2.4.20-19.8.img
title Windows XP
# (hd1,4) refers to the second hard disk detected by the BIOS, the 5th partition
        rootnoverify (hd0,4)
# boot from the first sector of (hd0,1)
        chainloader +1

If you forgot to install grub on the MBR or told it to look at the wrong boot drive ...

• Boot into rescue mode which loads the OS from the CD into memory
• Chroot your system so that your hard drive OS is mounted at /
  

chroot /mnt/sysimage

• Install grub on the MBR pointing at the correct boot device

grub-install /dev/sda

• Exit out of rescue mode

exit exit

• The machine should boot properly

Booting Single-User

At the LILO prompt:

LILO: linux single
or
LILO: linux -s

From GRUB splash screen:

• The kernels you have installed (and their options) will be displayed on the grub splash screen
• Highlight the kernel you want to boot
• type e to edit that line
• add an s to the end of the line for single user (you could add a 1 for run level 1)
• Hit <Enter>
  
• You have modified that stanza for just this instance
• Type b to boot
  

What is single user mode anyway?

• the network is not up
• all the filesystems are typically not mounted
• the system consults the /etc/fstab file when booting the system
• RedHat for some reason does mount all the filesystems which I find very annoying!
• single user mode gives the administrator a chance to work on the system without user intervention
• Gives opportunity to fsck the partitions by hand (instead of being run by the system)
• perform disk consistency check and repair filesystems
• In a SysV environment (RedHat, Solaris, HP-UX) single-user is run-level 1

Multiuser operation

• all filesystems mounted
• initialization scripts have run
• networking and other system daemons are up and running
• the getty process (started by init) is listening for login sessions
• xdm (also started by init if default run-level is 5
• graphical login system

BSD versus Sys V systems

• BSD: init has only two states
• single user and multiuser
• Sys V: init has one single-user and several mutiuser run-levels
• init 1 on RedHat machines takes you from multi-level to single user

Shutdown of your machine

There are a number of ways to shutdown you Linux machine. Here is a sampling:

• Halts and powers off the system.

In older versions of Unix/Linux this was not the best way to shutdown a machine because processes were not allowed to exit cleanly.

	# /sbin/halt

	# /sbin/poweroff

• Brings system down with more cleanly

Users are notified, processes are notified (and sent a SIGTERM), logins are blocked

	# /sbin/shutdown -h now

• Poweroff in 5 minutes, send a message to logged in users

	# /sbin/shutdown -h +5 "going down for maintenance in 5 minutes... "

• Reboot in 5 minutes, send message

	# /sbin/shutdown -r +5 "rebooting to clear hung mounts in 5 minutes... "

• Poweroff by executing scripts in run-level 0

	# /sbin/init 0	

• Reboot by exectuing scripts in run-level 6

	# /sbin/init 6

	# /sbin/reboot

Note:

• shutdown -h, init 0, or halt will execute the scripts in run-level 0
• reboot, init 6, or shutdown -r  will execute the scripts in run-level 6