Linux Boot Process: From BIOS to Login Prompt

Understanding the Linux boot process is essential for troubleshooting startup failures, optimizing boot times, and configuring system behavior. This guide walks through every stage of the boot sequence, from the moment you press the power button to the login prompt, covering BIOS, UEFI, GRUB2, the kernel, initramfs, and systemd targets.

Part of the Linux System Administration guide. See also: Kernel Tuning | Systemd Guide

Stage 1: Firmware (BIOS vs UEFI)

The first code that runs when a computer powers on is the firmware, which initializes hardware and hands off control to the bootloader.

BIOS (Basic Input/Output System)

The legacy firmware standard. BIOS looks for a bootloader in the Master Boot Record (MBR), the first 512 bytes of the boot disk. Limitations include a maximum bootable disk size of 2 TB and only four primary partitions. BIOS boots in 16-bit real mode and relies on interrupt-based hardware access.

UEFI (Unified Extensible Firmware Interface)

The modern replacement for BIOS. UEFI reads bootloaders from an EFI System Partition (ESP), a FAT32-formatted partition typically mounted at /boot/efi. UEFI supports GPT partition tables (disks over 2 TB, up to 128 partitions), Secure Boot (cryptographic verification of bootloaders), faster boot times through parallel initialization, and a built-in boot manager that can select bootloaders directly.

# Check if your system uses UEFI or BIOS
$ ls /sys/firmware/efi
# If the directory exists, you are booted in UEFI mode
# If it does not exist, you are in BIOS/legacy mode

# List UEFI boot entries
efibootmgr -v

Stage 2: GRUB2 (Grand Unified Bootloader)

GRUB2 is the standard bootloader on most Linux distributions. It presents a boot menu, loads the kernel and initramfs into memory, and passes control to the kernel.

GRUB2 Configuration

GRUB2's configuration is generated from templates, not edited directly. The main configuration file is /boot/grub/grub.cfg (or /boot/grub2/grub.cfg on RHEL-based systems), but you should never edit this file by hand. Instead, modify the settings in /etc/default/grub and the scripts in /etc/grub.d/.

# Key settings in /etc/default/grub:
GRUB_TIMEOUT=5                        # Seconds to show menu before booting default
GRUB_DEFAULT=0                        # Default menu entry (0 = first)
GRUB_CMDLINE_LINUX_DEFAULT="quiet splash"  # Kernel parameters for normal boot
GRUB_CMDLINE_LINUX=""                 # Kernel parameters for all entries
GRUB_DISABLE_RECOVERY="false"         # Show recovery mode entries

Common kernel parameters you might add to GRUB_CMDLINE_LINUX: - net.ifnames=0 to use classic network interface names (eth0, eth1) - crashkernel=auto to reserve memory for kernel crash dumps - rd.lvm.lv=vg_root/lv_root to specify the root LVM volume - console=ttyS0,115200 for serial console access on headless servers

Regenerating GRUB Configuration

After modifying /etc/default/grub, regenerate the configuration:

# Debian/Ubuntu
update-grub
# which is equivalent to:
grub-mkconfig -o /boot/grub/grub.cfg

# RHEL/CentOS/Fedora
grub2-mkconfig -o /boot/grub2/grub.cfg

Installing GRUB

If GRUB is corrupted or you need to install it on a new disk:

# BIOS systems: install to the MBR of the boot disk
grub-install /dev/sda

# UEFI systems: install to the EFI System Partition
grub-install --target=x86_64-efi --efi-directory=/boot/efi --bootloader-id=ubuntu

# Verify installation
grub-install --recheck /dev/sda

Stage 3: Kernel Loading

Once GRUB selects a boot entry, it loads two files into memory: the kernel image (typically /boot/vmlinuz-<version>) and the initial RAM filesystem (/boot/initramfs-<version>.img or /boot/initrd.img-<version>).

The kernel decompresses itself, initializes core subsystems (memory management, CPU scheduler, interrupt handlers), detects hardware, and mounts the initramfs as a temporary root filesystem.

# View installed kernels
ls /boot/vmlinuz-*

# View kernel version
uname -r

# View kernel boot messages
dmesg | head -50

Stage 4: initramfs / initrd

The initial RAM filesystem (initramfs) is a compressed archive containing a minimal filesystem with essential drivers and scripts. Its purpose is to prepare the system to mount the real root filesystem. This is necessary because the kernel might need modules that are not compiled in (like filesystem drivers, LVM tools, RAID support, or encryption utilities) to access the root partition.

The initramfs: 1. Loads necessary kernel modules (disk controller drivers, filesystem modules, device mapper for LVM) 2. Assembles RAID arrays if applicable 3. Activates LVM volume groups 4. Decrypts LUKS-encrypted volumes if applicable 5. Mounts the real root filesystem 6. Executes switch_root to pivot from the initramfs to the real root

# View contents of an initramfs
lsinitramfs /boot/initrd.img-$(uname -r)     # Debian/Ubuntu
lsinitrd /boot/initramfs-$(uname -r).img      # RHEL/CentOS

# Rebuild initramfs (after adding drivers or changing configuration)
update-initramfs -u                            # Debian/Ubuntu
dracut --force                                 # RHEL/CentOS/Fedora

# Rebuild for a specific kernel version
update-initramfs -u -k 5.15.0-91-generic
dracut --force /boot/initramfs-5.14.0-362.el9.x86_64.img 5.14.0-362.el9.x86_64

Stage 5: Systemd and Targets

After the real root filesystem is mounted, the kernel executes /sbin/init, which on modern distributions is a symlink to systemd (PID 1). Systemd takes over and brings the system to the desired target (the systemd equivalent of SysVinit runlevels).

Systemd Targets

Target	Purpose	Legacy Runlevel
poweroff.target	System halt	0
rescue.target	Single-user rescue mode	1
multi-user.target	Multi-user, text mode, networking	3
graphical.target	Multi-user with graphical desktop	5
reboot.target	System reboot	6

# View the current default target
systemctl get-default

# Set the default target
systemctl set-default multi-user.target    # Server (no GUI)
systemctl set-default graphical.target     # Desktop

# Switch targets at runtime (without reboot)
systemctl isolate multi-user.target
systemctl isolate rescue.target

# View the boot process timeline
systemd-analyze
systemd-analyze blame    # Show time taken by each unit
systemd-analyze critical-chain    # Show the critical path

Legacy Runlevels

On older systems using SysVinit (or for backward compatibility), runlevels are numeric:

# Check current runlevel (works on systemd systems too)
runlevel
who -r

# The telinit command still works on systemd systems
telinit 3    # Switch to multi-user text mode

Rescue and Emergency Mode

When a system fails to boot normally, rescue and emergency modes provide minimal environments for troubleshooting.

Entering Rescue Mode from GRUB

At the GRUB menu, press e to edit the default boot entry
Find the line starting with linux (the kernel command line)
Append systemd.unit=rescue.target (or single or 1)
Press Ctrl+X or F10 to boot with the modified parameters

Rescue mode mounts all filesystems and starts minimal services. Emergency mode (systemd.unit=emergency.target) mounts only the root filesystem in read-only mode and starts almost nothing, useful when rescue mode itself fails.

# Once in rescue mode, common recovery tasks:

# Remount root filesystem as read-write
mount -o remount,rw /

# Check and repair a filesystem
fsck /dev/vg_root/lv_root

# Rebuild GRUB
grub-install /dev/sda
grub-mkconfig -o /boot/grub/grub.cfg

# Reset a forgotten root password
passwd root

# Restore SELinux contexts after manual file edits
touch /.autorelabel
reboot

Analyzing Boot Problems

# View logs from the current boot
journalctl -b

# View logs from the previous boot (if journal persistence is enabled)
journalctl -b -1

# Check for failed units
systemctl --failed

# View boot timing to identify slow units
systemd-analyze blame | head -20

Boot Process Summary

The complete sequence: Firmware (BIOS/UEFI) initializes hardware and locates the bootloader. GRUB2 presents a menu, loads the kernel and initramfs. The kernel initializes, mounts initramfs, and loads essential drivers. initramfs prepares and mounts the real root filesystem. systemd (PID 1) starts services according to the default target, bringing the system to a usable state. Understanding each stage gives you the ability to diagnose and recover from failures at any point in the chain.

Linux Boot Process: From Firmware to Login Prompt