How Linux Boots

Motivation

Nothing is more frustrating then not being able to boot into your system. If it hangs a boot with a cryptic message, then what do you do? People running other Operating Systems then tend to try to re-install their OS at this point. Once you know how Linux boots then it is almost always possible to boot into your system again as long as your hard-drive is not damaged.

Stages of Booting Linux

Simplified:

1. your PC boots (BIOS from EEPROM chips on your motherboard. e.g when you press F12 during boot this is handled by the BIOS)
2. loads the first ca 300 bytes from block 0 of your hard drive
3. loads the rest of GRUB boot loader
4. GRUB can readonly mount most filesystems and load kernel (vmlinuz) and initial-ramdisk (initrd)
5. kernel unpacks itself and intializes hardware
6. kernel unpacks initial ramdisk and starts script there (e.g. /init )
7. initial ramdisk scripts loads additional modules and mount real /
8. starts init process. (today usually systemd)
9. systemd runs boot scripts for all configured items. (e.g. ssh, X11, ..) and mounts additional filesystems, ..

A few notes to the above:

• The BIOS is specific to PCs and this looks different on other hardware. E.g. Raspberry Pi and other ARM systems, etc..
• The initial boot blocks can also be loaded via network (PXE network boot).
• you can also directly boot a kernel without an initial ram-disk but that means that the kernel needs to have all necessary drives compiled in that are needed for at least reading the harddisk.
• systemd is still a bit controversial and there are distributions out there that try to avoid it. e.g. devuan.
• newer PCs support "UEFI/secure boot". Which does not offer much security but was intended to force the lock-in into proprietary operating systems. Most modern Linux Distributions can deal with UEFI-Boot but if you can turn this off in your BIOS settings it will make installing Linux much easier. For an overview of how the UEFI/SecureBoot works see: wiki.debian.org/SecureBoot
• when booting from CDrom there is a special syslinux bootloader used.

What can you do if your Linux does not Boot?

BIOS

When you do not even get to the Grub bootscreen then you have to check your BIOS. If you have more then 1 Harddrive you can select which one to use for boot and you can allow booting from CDrom or USB drive there. In some BIOS versions you can press F12 to select your boot device

GRUB

When the GRUB boot-loader is working it will show you a menu for booting into all your installed OSs and will allow you to boot with an older kernel. When GRUB fails to load it will drop you into a prompt where you can try various commands, yet it is usually easier to fix your GRUB by booting with a Live-CD or USB-Stick.

When GRUB is working one can also "edit" the arguments that are passed to the kernel. This is often useful. (see below)

GRUB can be protected with a password so that one can only boot the default option and one is not able to pass different arguments to the kernel.

Kernel command-line

When you boot with grub you can specify arguments that are passed to the kernel. Those are usually of the form NAME=value or just some flag.

useful here are:

root=/dev/sdb7 --- would try to use partition 7 of /dev/sdb as your root partition.
init=/bin/bash --- instead of loading sytemd it will directly boot into just a shell.

See: kernel parameters for more.

Booting into Shell

Assume you have an unusual video-card and installed some buggy driver from the vender and now, each time you try to boot your system freezes. Or you start at a new job and you are told to fix an old Linux Server where no one even has a root-password. In this cases you might want to change the boot process so that you can fix that. One way would be to interrupt the normal boot process:

1. on the GRUB screen press Ctrl-e to edit the command line
2. go to the part where the kernel parameters are listed and add init=/bin/bash (your changes are just for this boot and not permanent)
3. press Ctrl-x to boot with this settings.
4. you will be dropped in a shell where you are root but the filesystem is mounted readonly
5. in order to change something you need to mount it read write: mount -o remount -rw -n /
6. now you could change the root password (beware of the keyboard layout!) by typing passwd
7. or you could edit config files etc...
8. after you are done: mount readonly again: mount -o remount -r -n /
9. type: sync and then reboot or halt or you can also just turn the machine off since the file-system is mounted readonly anayways.