시간과 공간 그리고 진실의 방

Disk partitioning or disk slicing[1] is the creation of one or more regions on secondary storage, so that each region can be managed separately.[2] These regions are called partitions. It is typically the first step of preparing a newly installed disk, before any file system is created. The disk stores the information about the partitions' locations and sizes in an area known as the partition table that the operating system reads before any other part of the disk. Each partition then appears to the operating system as a distinct "logical" disk that uses part of the actual disk. System administrators use a program called a partition editor to create, resize, delete, and manipulate the partitions.[3]

Partitioning allows the use of different filesystems to be installed for different kinds of files. Separating user data from system data can prevent the system partition from becoming full and rendering the system unusable. Partitioning can also make backing up easier. A disadvantage is that it can be difficult to properly size partitions, resulting in having one partition with too much free space and another nearly totally allocated.

Pros

1. allows the use of different file systems to be installed for different kinds of files.
2. Separating user data from system data can prevent the system partition from becoming full and rendering the system unusable.
3. can also make backing up easier.

Cons

1. it can be difficult to properly size partitions, resulting in having one partition with too much free space and another nearly totally allocated.

(Free Disk space or totally allocated → non effective)

History

IBM in its 1983 release of PC DOS version 2.0 was an early if not first use of the term partition to describe dividing a block storage device such as an HDD into physical segments. The term's usage is now ubiquitous. Other terms used in the art have included logical disk,[4] minidisk,[5] portions,[6] pseudo-disk,[6] section,[6] slice[7] and virtual drive.[8]

1. IBM 1983 release of PC DOS version 2.0 was an early, to describe (Not First)

One of the earliest such segmentation of a disk drive was IBM's 1966[9] usage in its CP-67 operating system of minidisk as a separate segment of a hard disk drive.[5]

Partitioning schemes

DOS, Windows, and OS/2

With DOS, Microsoft Windows, and OS/2, a common practice is to use one primary partition for the active file system that will contain the operating system, the page/swap file, all utilities, applications, and user data. On most Windows consumer computers, the drive letter C: is routinely assigned to this primary partition. Other partitions may exist on the HDD that may or may not be visible as drives, such as recovery partitions or partitions with diagnostic tools or data. (Windows drive letters do not correspond to partitions in a one-to-one fashion, so there may be more or fewer drive letters than partitions.)

Common practice → One primary partition and Other partitions (recovery or diagnostic tools or data)

Microsoft Windows 2000, XP, Vista, and Windows 7 include a 'Disk Management' program which allows for the creation, deletion and resizing of FAT and NTFS partitions. The Windows Disk Manager in Windows Vista and Windows 7 utilizes a 1 MB partition alignment scheme which is fundamentally incompatible with Windows 2000, XP, OS/2, DOS as well as many other operating systems.

Windows Vista and Windows 7 → a 1MB partition alignment scheme ↔ incompatible with Windows 2000, XP, OS/2, DOS

Unix-like systems

On Unix-based and Unix-like operating systems such as Linux, macOS, BSD, and Solaris, it is possible to use multiple partitions on a disk device. Each partition can be formatted with a file system or as a swap partition.

Multiple partitions allow directories such as /boot, /tmp, /usr, /var, or /home to be allocated their own filesystems. Such a scheme has a number of advantages:

• If one file system gets corrupted, the data outside that filesystem/partition may stay intact, minimizing data loss. (distributed and dedicated file system operation)
• Specific file systems can be mounted with different parameters, e.g., read-only, or with the execution of setuid files disabled.
• A runaway program that uses up all available space on a non-system filesystem does not fill up critical filesystems. (Preventing file system critical issue)
• Keeping user data such as documents separate from system files allows the system to be updated with lessened risk of disturbing the data. (Data integrity)

A common minimal configuration for Linux systems is to use three partitions: one holding the system files mounted on "/" (the root directory), one holding user configuration files and data mounted on /home (home directory), and a swap partition.

By default, macOS systems also use a single partition for the entire filesystem and use a swap file inside the file system (like Windows) rather than a swap partition.

In Solaris, partitions are sometimes known as slices. This is a conceptual reference to the slicing of a cake into several pieces.

The term "slice" is used in the FreeBSD operating system to refer to Master Boot Record partitions, to avoid confusion with FreeBSD's own disklabel-based partitioning scheme. However, GUID Partition Table partitions are referred to as "partition" worldwide.

→ FreeBSD oprating system used “slice” to refer to MBR partitions

Multi-boot systems

Main article: Multi-boot

A GRUB startup menu showing Ubuntu Linux (with three different boot modes) and Windows Vista options

Multi-boot systems are computers where the user can boot into more than one distinct operating system (OS) stored in separate storage devices or in separate partitions of the same storage device. In such systems a menu at startup gives a choice of which OS to boot/start (and only one OS at a time is loaded).

This is distinct from virtual operating systems, in which one operating system is run as a self-contained virtual "program" within another already-running operating system. (An example is a Windows OS "virtual machine" running from within a Linux OS.)

Multi-boot systems recognize computers from each other operating systems.

Virtual Operating System recognize a self-contained virtual “program”

GUID Partition Table

Main article: GUID Partition Table

The GUID Partition Table (**G**lobally Unique IDentifier) is a part of the Unified Extensible Firmware Interface (UEFI) standard for the layout of the partition table on a physical hard disk. Many operating systems now support this standard. However, Windows doesn't support this on BIOS based computers.

Partition recovery

When a partition is deleted, its entry is removed from a table and the data is no longer accessible. The data remains on the disk until it is overwritten. Specialized recovery utilities may be able to locate lost file systems and recreate a partition table which includes entries for these recovered file systems. Some disk utilities may overwrite a number of beginning sectors of a partition they delete. For example, if Windows Disk Management (Windows 2000/XP, etc.) is used to delete a partition, it will overwrite the first sector (relative sector 0) of the partition before removing it. It still may be possible to restore a FAT or NTFS partition if a backup boot sector is available.

1. The data will be overwritten by time.

Overwritten First Sector |          Data              |

Compressed disks

HDDs can be compressed to create additional space. In DOS and early Microsoft Windows, programs such as Stacker (DR-DOS except 6.0), SuperStor (DR DOS 6.0), DoubleSpace (MS-DOS 6.0–6.2), or DriveSpace (MS-DOS 6.22, Windows 9x) were used. This compression was done by creating a very large file on the partition, then storing the disk's data in this file. At startup, device drivers opened this file and assigned it a separate letter. Frequently, to avoid confusion, the original partition and the compressed drive had their letters swapped, so that the compressed disk is C:, and the uncompressed area (often containing system files) is given a higher name. → In early, Compressed disk give another higher name separated disk.

Versions of Windows using the NT kernel, including the most recent version, Windows 10, contain intrinsic disk compression capability. The use of separate disk compression utilities has declined sharply.

Partition table

A partition table is a table maintained on a disk by the operating system that outlines and describes the partitions on that disk.[11] The terms partition table and partition map are similar terms and can be used interchangeably. The term is most commonly associated with the MBR partition table of a Master Boot Record (MBR) in PCs, but it may be used generically to refer to other formats that divide a disk drive into partitions, such as: GUID Partition Table (GPT), Apple partition map (APM),[12] or BSD disklabel.[13]

PC partition types

MBR

See also: Partition type

This section describes the master boot record (MBR) partitioning scheme, as used historically in DOS, Microsoft Windows and Linux (among others) on PC-compatible computer systems. As of the mid-2010s, most new computers use the GUID Partition Table (GPT) partitioning scheme instead. For examples of other partitioning schemes, see the general article on partition tables.

The total data storage space of a PC HDD on which MBR partitioning is implemented can contain at most four primary partitions, or alternatively three primary partitions and an extended partition. The Partition Table, located in the master boot record, contains 16-byte entries, each of which describes a partition.

In MBR, Partition Table → contains 16 byte entries → each of which describes a partition.

The partition type is identified by a 1-byte code found in its partition table entry. Some of these codes (such as 0x05 and 0x0F) may be used to indicate the presence of an extended partition. Most are used by an operating system's bootloader (that examines partition tables) to decide if a partition contains a file system that can be mounted / accessed for reading or writing data.

1 byte code → an operating system’s bootloader to decide

Primary partition

Further information: Partition type

A primary partition contains one file system. In DOS and all early versions of Microsoft Windows systems, Microsoft required what it called the system partition to be the first partition. All Windows operating systems from Windows 95 onwards can be located on (almost) any partition, but the boot files (io.sys, bootmgr, ntldr, etc.) must reside on a primary partition. However, other factors, such as a PC's BIOS (see Boot sequence on standard PC) may also impose specific requirements as to which partition must contain the primary OS.

DOS and all early version microsoft systems System partition → Only possible to be first partition

from Windoews 95 onwards don’t care where is located (almost), but Boot files → must reside a primary partition

The partition type code for a primary partition can either correspond to a file system contained within (e.g., 0x07 means either an NTFS or an OS/2 HPFS file system) or indicate that the partition has a special use (e.g., code 0x82 usually indicates a Linux swap partition). The FAT16 and FAT32 file systems have made use of a number of partition type codes due to the limits of various DOS and Windows OS versions. Though a Linux operating system may recognize a number of different file systems (ext4, ext3, ext2, ReiserFS, etc.), they have all consistently used the same partition type code: 0x83 (Linux native file system).

Extended partition

Further information: Extended boot record

An HDD may contain only one extended partition, but that extended partition can be subdivided into multiple logical partitions. DOS/Windows systems may then assign a unique drive letter to each logical partition. GUID partition table (GPT) only has the primary partition, doesn't have the extended partition and the logical partition.

1. DOS/Windows → assign a unique drive letter
2. GPT only possible Primary partition → No! extended or logical partition

Boot partitions

See also: System partition and boot partition

BIOS boot partition

BIOS boot partition (BIOS BP) is a share of the storage device used to keep software that boots the operating system, a bootloader. It may be an operating system kernel image or bootloader or a completely separate piece of software.

EFI system partition

EFI system partition is the same as BIOS BP, but is loaded by EFI firmware instead of BIOS.

EFI system partition → Boot Loader

See also[edit]

!https://s3-us-west-2.amazonaws.com/secure.notion-static.com/d7471184-719b-4e04-8ff9-26d6fdc9b33d/80px-Wikibooks-logo-en-noslogan.svg.png

The Wikibook Guide to Unix has a page on the topic of: Partitioning Disks

• Amiga rigid disk block
• Disk formatting
• Filesystem Hierarchy Standard
• List of disk partitioning software
• LVM
• Master boot record covers the partition table layout
• Partition alignment
• RAID
• JBOD

[edit]

Further reading[edit]

• Stéphane Martineau; Jens Olsson; Nick Roberts (2002-11-02). "The Alt-OS-Development Partition Specification (AODPS)". 0.4. Archived from the original on 2004-02-13.{{[cite web](<https://en.wikipedia.org/wiki/Template:Cite_web>)}}: CS1 maint: unfit URL (link)
• Andries Brouwer (1995–2004). "List of partition identifiers for PCs".
• Andries Brouwer (1999-09-16). "Minimal Partition Table Specification".
• "partitioning primer". Ranish. 1998-08-05. Archived from the original on 2004-08-04. Retrieved 2004-08-15.
• Allen Smith. "ATA (EIDE) Drive Capacity and Addressing".
• Microsoft (2005-06-03). "Using GPT Drives". Microsoft. Archived from the original on 2005-07-06.
• "What are system partition and boot partition?". www.easyuefi.com. Retrieved 2021-12-07.{{[cite web](<https://en.wikipedia.org/wiki/Template:Cite_web>)}}: CS1 maint: url-status (link)

1.BIOS(Basic Input/Output System)

1. When we power on, BIOS performs a Power-On Self-Test (POST) for all of the different hardware components in the system to make sure everything is working properly.
2. Also it checks for whether the computer is being started from an off position (cold boot) or from a restart (warm boot) is stored at this location.
3. Retrieves information from CMOS (Complementary Metal-Oxide Semiconductor), a battery operated memory chip on the motherboard that stores time, date, and critical system information.
4. Once BIOS sees everything is fine, it will begin searching for an operating system Boot Sector on a valid master boot sector on all available drives like hard disks, CD-ROM drive etc.
5. Once BIOS finds a valid MBR, it will give the instructions to boot and executes the first 512-byte boot sector that is the first sector (“Sector 0″) of a partitioned data storage device such as hard disk or CD-ROM etc.
   BIOS find a valid MBR → boot and executes MBR

2.MBR(Master Boot Record)

1. Normally we use multi-level boot loader. Here MBR means I am referencing to DOS MBR.
2. Afer BIOS executes a valid DOS MBR, the DOS MBR will search for a valid primary partition marked as bootable on the hard disk.
   MBR → valid primary partition (Bootable)
3. If MBR finds a valid bootable primary partition then it executes the first 512-bytes of that partition which is second level MBR.
   MBR → valid bootable primary partition → execute first 512 bytes (Boot Loader)
4. In linux we have two types of the above mentioned second level MBR known as LILO and GRUB

3.LILO or GRUB

LILO - LInux LOader

1. LILO is a linux boot loader which is too big to fit into single sector of 512-bytes.
2. so it is divided into two parts an installer and a runtime module.
3. The installer module places the runtime module on MBR. The runtime module has the info about all operating systems installed.
   (installer module → runtime module → MBR)
4. When the runtime module is executed, it selects the operating system to load and transfers the control to kernel. (runtime module → select operating system to load → transfer control → kernel)
5. LILO does not understand file systems and boot images to be loaded and treats them as raw disk offsets

GRUB - GRand Unified Bootloader

1. GRUB MBR consists of 446 bytes of primary boot loader code and 64 bytes of the partition table.
2. GRUB locates all the operating systems installed and gives a GUI to select the operating system need to be loaded.
3. Once user selects the operating system, GRUB will pass control to the kernel of that operating system.see below what is the difference between LILO and GRUB

Select operating system → grub will pass control → the kernel that operating system

4.Kernel

1. Once GRUB or LILO transfers the control to Kernel, the Kernels does the following tasks

• initializes devices and loads initrd module
• mounts root file system

5.init

1. The kernel, once it is loaded, finds init in sbin(/sbin/init) and executes it.
2. Hence the first process which is started in linux is init process.
3. This init process reads /etc/inittab file and sets the path, starts swapping, checks the file systems, and so on.
4. it runs all the boot scripts(/etc/rc.d/*, /etc/rc.boot/*)
5. starts the system on specified run-level in the file /etc/inittab

6.Run Levels

1. There are 7 run levels in which the linux OS runs and different run levels serves for different purpose. The descriptions are given below.

• 0 – halt
• 1 – Single user mode
• 2 – Multi-user, without NFS (The same as 3, if you don’t have networking)
• 3 – Full multi-user mode
• 4 – unused
• 5 – X11
• 6 – Reboot

1. We can set in which run-level we want to run our operating system by defining it on /etc/inittab file.

In ancient times, the kernel was hard coded to know the device major/minor number of the root fs and mounted that device after initializing all device drivers, which were built into the kernel. The rdev utility could be used to modify the root device number in the kernel image without having to recompile it.

Eventually boot loaders came along and could pass a command line to the kernel. If the root= argument was passed, that told the kernel where the root fs was instead of the built in value. The drivers needed to access that still had to be built into the kernel. While the argument looks like a normal device node in the /dev directory, there obviously is no /dev directory before the root fs is mounted, so the kernel can not look up a dev node there. Instead, certain well known device names are hard coded into the kernel so the string can be translated to the device number. Because of this, the kernel can recognize things like /dev/sda1, but not more exotic things like /dev/mapper/vg0-root or a volume UUID.

Summary

Boot Loader → pass root= argument → kernel → root fs location

Problem 1.

The driver needed to access that still had to be built into the kernel.

Transition Period

Later, the initrd came into the picture. Along with the kernel, the boot loader would load the initrd image, which was some kind of compressed filesystem image (gzipped ext2 image, gzipped romfs image, squashfs finally became dominant). The kernel would decompress this image into a ramdisk and mount the ramdisk as the root fs. This image contained some additional drivers and boot scripts instead of a real init. These boot scripts performed various tasks to recognize hardware, activate things like raid arrays and LVM, detect UUIDs, and parse the kernel command line to find the real root, which could now be specified by UUID, volume label and other advanced things. It then mounted the real root fs in /initrd, then executed the pivot_root system call to have the kernel swap / and /initrd, then exec /sbin/init on the real root, which would then unmount /initrd and free the ramdisk.

Kernel, Boot Loader load → initrd image (compressed image) → was decompressed into a ramdisk → mount root fs → mounted real root fs in /initrd → pivot system calll → swap / and /initrd → exec /sbin/init

Finally, today we have the initramfs. This is similar to the initrd, but instead of being a compressed filesystem image that is loaded into a ramdisk, it is a compressed cpio archive. A tmpfs is mounted as the root, and the archive is extracted there. Instead of using pivot_root, which was regarded as a dirty hack, the initramfs boot scripts mount the real root in /root, delete all files in the tmpfs root, then chroot into /root, and exec /sbin/init.

One of the most remarkable achievement in the history of mankind is computers. Another amazing fact about this remarkable achievement called computers is that its a collection of different electronic components, and they work together in coordination to give you a meaningful output. We in our day to day lives use this complex system in one or the other way. But not many of us know how these things work together.

In this tutorial, we will be discussing how a computer boots. I must say how a computer with Linux operating system boots. A couple of days back one of our reader requested us to put this up, as this is a common question asked in interviews. I hope this will be helpful to other readers as well.

Understanding the boot process, will help you understand how the hardware and software is working together, and also will give you the required information to begin troubleshooting a booting problem you have.

Linux booting process can be divided to multiple stages. The below shown diagram explains the different stages. We will be discussing each of these stages in detail, in their respective sections.

Step 1: Power Supply & SMPS

One of the main component of a computer is SMPS(Switching Mode Power Supply). The primary objective of this component is to provide the perfect required voltage level to the motherboard and other computer components. Computer internals work in DC, however the power supply we have at home and other places are AC. SMPS converts AC to DC and maintain the required voltage level so that the computer can work flawlessly.

But the main task performed by SMPS, is to inform about the good power supply. As I told if the voltage is more/ or is less, in both the conditions a computer cannot work. As soon as you supply power to the computer, the SMPS checks the voltage level's its providing to the motherboard. If the power signal level is perfect, then SMPS will send a POWER GOOD signal to the motherboard timer.

On receiving this POWER GOOD signal from SMPS, the motherboard timer will stop sending reset signal to the CPU. Which means the power level is good and the computer can boot.

SMPS (Switching Mode Power Supply) → Convert AC to DC → maintain voltage level → request Signal as Good → Motherboard receiving → Reset signal to CPU → Boot Possible stage

Step 2: Bootstrapping

Something has to be programmed by default, so that the CPU knows where to search for instructions. → an address in the ROM

This is an address location in the ROM. This address location is almost always constant in X86 based computers. The address location is FFFF:0000h.

This address location is the last region of the ROM. It only contains one instruction. The instruction is to jump to another memory address location. This JUMP command, will tell the location of the BIOS program in the ROM.

This is how the computer will come to know where the BIOS program is located.

CPU → instruction → an Address in the ROM → FFFF:0000h (last region of the ROM) → one instruction → JUMP → BIOS

Step 3: The Role of BIOS in booting process

The word booting comes from another word called bootstrapping. The computer knows how to bring itself up, when you press the start button, because of the instructions that are fed to a program called as BIOS. BIOS stands for Basic Input Output System. The most important use of BIOS during the booting process is POST. POST stands for Power on Self Test. Its a series of tests conducted by the bios, which confirms the proper functioning of different hardware components attached to the computer.

POST is very important thing to have before the Operating system is loaded. Just imagine if you have a faulty hard drive or faulty memory, sometimes these things can cause data loss. POST checks and confirms the integrity of the following hardware components.

• Timer IC's
• DMA controllers
• CPU
• Video ROM

A full POST check will confirm the integrity of the following devices as well.

• Motherboard
• Keyboard
• Printer port
• Hard Drive etc

If you are doing a warm start (which means you did a reset of a running machine, most of the times reset button is the small one near the power button on the CPU), a full POST check will not be conducted by the BIOS. However if you are doing a Cold Start, which means you have applied the power now, it will conduct a full POST.

Warm Start → a full POST check not be conducted

Cold Start → conduct a full POST

BIOS determines whether its a cold or warm start, by looking at a flag in a predefined memory location. Once the POST completes, the BIOS will inform you about any problems it found with the help of beep codes (through system speaker). Different number of beep codes have different meaning.

There are two things that people often get confused with. Its CMOS & BIOS. CMOS & BIOS are two completely different things in the computer motherboard. CMOS is a small memory RAM chip that's present in the motherboard. This RAM is different from the computers main RAM chip (which are replaceable memory chips.

These days RAM chips are available in the range of Gigabytes.). Unlike the main RAM chip, CMOS RAM does not flush its memory when a computer is turned off. It remembers all the configuration with the help of a battery called CMOS battery.

Removing a CMOS battery will make the CMOS to forget all the configuration you have saved previously.

• This is the reason you can unlock a computer that's protected with a CMOS password, by simply removing the CMOS battery.
• Also removing the CMOS battery will make the operating system to show you wrong time. Because system time consistency is maintained in CMOS settings.

So its always advisable to replace your CMOS battery at regular intervals, for proper functioning of the computer.

Normally people say that we have modified BIOS settings. But its completely wrong. What they modified is in fact CMOS settings. CMOS settings is the place where you modify the boot order etc.

Bios settings cannot be altered by the user. It requires a flash program provided by the manufacturer.

So Let's get back to our booting process. Once the POST check is completed successfully, BIOS will look CMOS settings to know what is the boot order. Boot order is nothing but a user defined order which tells where to look for the operating system.

The order will be something like the below.

1. CD ROM
2. HARD DISK
3. USB
4. Floppy DISK

The above shown order means that the BIOS will look at CD ROM first to check whether an OS can be loaded from there, if it does not find a bootable disk in the CD ROM, it will look check whether a bootable OS is there in the hard disk, then USB and then Floppy disk.

Let's assume that you don’t have a bootable CD in your CD ROM drive, then the BIOS will turn to HARD disk.

CMOS → CMOS Ram not flush, remember all the configuration with help of a battery called CMOS battery

BIOS → Basic Input Ouput System, POST(Power on Self Test) → a full POST Check or POST Check

Step 4: MBR and GRUB

Now as you don't have any bootable CD in your CD ROM Drive, the bios will look at the second device from the boot order settings. The second device is your Hard Disk.

BIOS is programmed to look at a permanent location on the hard disk to complete its task. This location is called a Boot sector. This is nothing but the first sector of your hard disk. This area is sometimes called as MBR (Master Boot Record). This is the location that contains the program that will help our computer to load the operating system. As soon as bios finds a valid MBR, it will load the entire content of MBR to RAM, and then further execution is done by the content of MBR.

BIOS →

Boot Sector (MBR) → help our computer to load the operating system

→ MBR → RAM → futher content is done by the content of MBR

This first sector of the hard disk is only of 512 bytes. Yeah its too small an area for an entire boot loader program to fit in. Hence most of the operating system store only the first stage of their boot loader program in here. Only the first 440 bytes from the total of 512 bytes is used by the first stage boot loader, the remaining part is used to store partition table information.

Read: What is MBR and GPT Partition Table

As the title of this article says "Linux Booting process", we will be having grub stage one in the first 440 bytes of the MBR. I would suggest to read the below artcle to understand grub and its details.

Read: Grub tutorial

You can take an entire dump/backup of your MBR in linux with the help of the following command.

root@ubuntu-dev:~# dd if=/dev/sda of=mbr bs=512 count=1
1+0 records in
1+0 records out
512 bytes (512 B) copied, 0.000134061 s, 3.8 MB/s

What the above command does is to simply dump the contents of your first sector which of 512 bytes to a file named mbr. bs in the above command stands for block size. And count means to dump only the first sector (the dump will start from the beginning of the hard disk, and the size is 512 bytes)

The MBR contains the first stage of the grub, and partition table information. You can see the partition table information from our MBR backup file as shown below.

root@ubuntu-dev:~# file mbr.bin
mbr.bin: x86 boot sector; partition 1: ID=0x83, active, starthead 32, startsector 2048, 19451904 sectors; partition 2: ID=0x5, starthead 254, startsector 19455998, 2093058 sectors, code offset 0x63

I have only two partition on the system, that's why its showing partition 1 & partition 2. The MBR contains of the following things to summarize. From the partition table shown in the above mbr dump output, Grub stage 1 in the MBR will look for a partition with active flag set on it. Please remember the fact that there can only be one active partition from the 4. If you see my partition table output above, partition 1 is having an active flag.

1. First stage grub
2. Partition table information
3. Error messages
4. Magic Number

The fourth point is a Magic Number of 2 bytes. This magic number serves as a method of verification for the MBR. This 2 byte magic number will contain values that will be something like AA55. A different magic number indicates a corrupted MBR or invalid MBR.

The primary job of the stage 1 bootloader is to load the second stage boot loader. The second stage boot loader is the stage 2 grub, that actually does the job of loading the kernel and other initrd image files (we will come to that part in some time). GRUB (Grand Unified Boot Loader) is the combined name given to different stages of grub.

Now there is a little surprise that am going to reveal. There are not two stages of grub. But there are three stages of grub in total. I will explain you the reason behind this. The three stages are mentioned below.

1. GRUB Stage 1 (MBR)
2. GRUB Stage 1.5 (MBR GAP, contains file system drivers)
3. Grub Stage 2 (First Partition)

Now from where does this stage 1.5 came. The hard disk sectors are counted form 0 to the last sector. As explained previously the first sector (sector 0) contains the GRUB stage 1. Normally partititons will not start before sector 63. So partitions will start form sector number 63. Hence we have sectors form 1-63 free. This space is used for storing GRUB stage 1.5. This free space between MBR and the beginning of the partitions is called as MBR GAP.

Now you might think what is the requirement of an additional stage in grub. If you are a linux guy, you might have already configured grub configuration file. If you remember the configuration, it contains the kernel file location and name, its partition. Now how will the grub access those kernel files without the file system drivers?

Grub Stage 1.5 located in the MBR GAP (sector 1 to 63 before the beginning of the first partition) basically contains the drivers for reading file systems. So grub stage 1 will load grub stage 1.5 to the RAM, and will pass the control to it.

Now grub stage 1.5 will load the file system drivers and once the file system drivers are loaded, it can now access /boot/grub/grub.conf file which contains other details about kernel path and initrd path etc.

Now this is the point where you are presented with a beautiful TUI (Terminal user interface), where you can select your operating system kernal and press enter to boot it.

Step 5 Loading The kernel Image

Similar to GRUB, kernel is also loaded in stages. A linux kernel is responsible for handling Process management, Memory Management, Users, Inter process communication etc. I must say kernel is never used by a user. What the kernel does is to maintain a good environment for programs to run. Yeah we use kernel thrugh different programs.

Kernel is a compressed image file. The location of this compressed kernel image is specified in the grub 2 configuration file. Its basically an executable bzImage file.

Now you need to have a lot of drivers and modules to access underlying hardware and other stuff. For example, if you have RAID configured on your / partition how will you mount it without knowing the programs, or think how will you include a kernal module or how to remove a kernel module. All these things required different set of programs and code. Including all these codes inside the kernel will make it a larger file image.

But our kernel image file needs to be smaller, that's the reason its compressed image file. So most of these drivers and tools along with a small similar root file system feel is given by initrd. Initrd is sometimes called as initial root file system. This is used by the kernel before the real root file system is mounted.  Initrd is available in the form of an image similar to the kernel image file. Let's see what's the content of this initrd image file. You can find the initrd image file and the kernel image file in the /boot directory.

[root@localhost initrd]# mv initramfs-2.6.32-358.14.1.el6.x86_64.img initramfs-2.6.32-358.14.1.el6.x86_64.gz
 
[root@localhost initrd]# gunzip initramfs-2.6.32-358.14.1.el6.x86_64.gz
 
[root@localhost initrd]# cpio -id < initramfs-2.6.32-358.14.1.el6.x86_64
90587 blocks
[root@localhost initrd]# ls
bin                 initqueue                             mount        sysroot
cmdline             initqueue-finished                    pre-pivot    tmp
dev                 initqueue-settled                     pre-trigger  usr
dracut-004-303.el6  initqueue-timeout                     pre-udev     var
emergency           initramfs-2.6.32-358.14.1.el6.x86_64  proc
etc                 lib                                   sbin
init                lib64                                 sys

If you see the above commands, we have first uncompressed the initrd image file, then we can view the contents of that file with the help of cpio command.

Now you can see the contents of initrd image file. There are folders that are very much similar to our linux directory strucutre. There is /etc/, /lib, and some necessary commands in /sbin etc. Its a small root file system that the kernel loads as a temporary root file system before the real root file system is loaded.

Temporary root file system (initrd, initial root file system) → load real root file system

Loading and unloading of kernel modules is done with the help of programs like insmod, and rmmod present in the initrd image.

Now as the kernel is loaded into the memory, the execution begins by checking the processor family and architecture. The kernel conducts a lot of hard ware specific operations and the first user space program it executes is /sbin/init.

Kernel → conducts a lot of hardware specific operation and first user space program (init) → got process id 1 → /etc/inittab (run level)

As this is the first program executed by the kernel, it has got a process id number of 1. The process id number 1 for init was not kept intentionally, but it was  due to the fact that it is the first process executed by the kernel. Now as soon as the kernel executes the init process, it will look at the /etc/inittab configuration file to see the default run level.

There are different run level's in linux.

Run-Level Usage

The /etc/inittab file contains the default run level like the one shown below.

id:3:initdefault:

Now that means, we have a run level 3 as the default run level. Once this is identified, then run level specific programs are started by the kernel. This is the reason you have the following directories.

[root@localhost]# cd /etc/rc.d/
[root@localhost rc.d]# ll
drwxr-xr-x. 2 root root  4096 Oct  8 00:50 init.d
-rwxr-xr-x. 1 root root  2617 Jul 24 08:53 rc
drwxr-xr-x. 2 root root  4096 Oct  8 00:50 rc0.d
drwxr-xr-x. 2 root root  4096 Oct  8 00:50 rc1.d
drwxr-xr-x. 2 root root  4096 Oct  8 00:50 rc2.d
drwxr-xr-x. 2 root root  4096 Oct  8 00:50 rc3.d
drwxr-xr-x. 2 root root  4096 Oct  8 00:50 rc4.d
drwxr-xr-x. 2 root root  4096 Oct  8 00:50 rc5.d
drwxr-xr-x. 2 root root  4096 Oct  8 00:50 rc6.d
-rwxr-xr-x. 1 root root   499 Aug 13 10:55 rc.local
-rwxr-xr-x. 1 root root 19216 Jul 24 08:53 rc.sysinit

The folders rc0.d, rc1.d, rc2.d etc contains run level specific programs that will be executed depending upon the default run level you have in your inittab configuration file.

Let's see what are the contents inside these run level folders.

[root@localhost rc3.d]# ls
K01numad       K80kdump               S13cpuspeed          S28autofs
K01smartd      K84wpa_supplicant      S13irqbalance        S50choose_repo
K02oddjobd     K86cgred               S13rpcbind           S50cloud-init-local
K10psacct      K87restorecond         S15mdmonitor         S50mcelogd

If you see the files inside these run level specific folders, they either begin with S or they begin with K. The files are also numbered. Now files with an S at starting will be executed during the startup process, and files that begins with K, will be killed during shutdown process.

The number after either S or K is the sequence with which these will be executed.

Once the kernel has started all programs in your desired run level directory. You will get a login screen to log inside your booted system. Hope this article was helpful and easy to understand. Please let us know in case anybody finds a mistake in this article, so that we can correct it.