Arch boot process
To run Arch Linux various software is run which is called "booting". When switching on hardware its firmware is run. It executes a boot loader which then executes the linux kernel. The kernel starts an init process which runs userspace programs depending on how the system is configured. Two main types of firmware exist, Unified Extensible Firmware Interface (UEFI) and Basic Input/Output Systeme (BIOS).
A BIOS or Basic Input-Output System is the very first program (firmware) that is executed once the system is switched on. In most cases it is stored in a flash memory in the motherboard itself and independent of the system storage.
The BIOS loads the beginning 512 bytes (Master Boot Record) of the first valid disk in the BIOS disk order. Of these 512 bytes, the first 440 contains the first stage of a boot loader like GRUB, Syslinux or LILO. Since very little can be achieved by a program of this size, the second stage (residing on the next disk sectors) is loaded from here and looks up a file stored on the partition itself (the actual bootloader). This then loads an operating system by either chain-loading or directly loading the operating system kernel.
UEFI has support for reading both the partition table as well as understanding filesystems. Hence it is not limited by 440 byte code limitation (MBR boot code) as in BIOS systems. It does not use the MBR boot code at all.
The commonly used UEFI firmwares support both MBR and GPT partition table. EFI in Apple-Intel Macs are known to also support Apple Partition Map besides MBR and GPT. Most UEFI firmwares have support for accessing FAT12 (floppy disks), FAT16 and FAT32 filesystems in HDDs and ISO9660 (and UDF) in CD/DVDs. EFI in Intel Macs can also access HFS/HFS+ filesystems, in addition to the mentioned ones.
UEFI does not launch any boot code in the MBR whether it exists or not. Instead it uses a special partition in the partition table called EFI System Partition in which files required to be launched by the firmware are stored. Each vendor can store its files under
<EFI SYSTEM PARTITION>/EFI/<VENDOR NAME>/ folder and can use the firmware or its shell (UEFI shell) to launch the boot program. An EFI System Partition is usually formatted as FAT32 or (less commonly) FAT16.
- System switched on - Power-on self-test or POST process.
- After POST, BIOS initializes the necessary system hardware for booting (disk, keyboard controllers etc.).
- BIOS launches the first 440 bytes (Master Boot Record) of the first disk in the BIOS disk order.
- The MBR boot code then takes control from BIOS and launches its next stage code (if any) (mostly boot loader code).
- The actual boot loader, such as GRUB or Syslinux, is launched.
- System switched on. The Power On Self Test (POST) is executed.
- UEFI firmware is loaded. Firmware initializes the hardware required for booting.
- Firmware reads the boot entries in the firmware's boot manager to determine which UEFI application to be launched and from where (i.e. from which disk and partition). A boot entry could simply be a disk. In this case the firmware looks for an EFI System Partition on that disk and tries to find the fallback UEFI application
BOOTIA32.EFIon 32-bit EFI systems). This is how UEFI bootable thumb drives work.
- Firmware launches the UEFI application.
If Secure Boot is enabled, the boot process will verify authenticity of the EFI binary by signature.
Multibooting in UEFI
Since each OS or vendor can maintain its own files within the EFI System Partition without affecting the other, multi-booting using UEFI is just a matter of launching a different UEFI application corresponding to the particular OS's bootloader. This removes the need for relying on chainloading mechanisms of one boot loader to load another OS.
See also Dual boot with Windows.
The kernel is the core of an operating system. It functions on a low level (kernelspace) interacting between the hardware of the machine and the programs which use the hardware to run. To make efficient use of the CPU, the kernel uses a scheduler to arbitrate which tasks take priority at any given moment, creating the illusion of many tasks being executed simultaneously.
After the kernel is loaded, it unpacks the initramfs (initial RAM filesystem), which becomes the initial root filesystem. The kernel then executes
/init as the first process. The early userspace starts.
The purpose of the initramfs is to bootstrap the system to the point where it can access the root filesystem (see FHS for details). This means that any modules that are required for devices like IDE, SCSI, SATA, USB/FW (if booting from an external drive) must be loadable from the initramfs if not built into the kernel; once the proper modules are loaded (either explicitly via a program or script, or implicitly via udev), the boot process continues. For this reason, the initramfs only needs to contain the modules necessary to access the root filesystem; it does not need to contain every module one would ever want to use. The majority of modules will be loaded later on by udev, during the init process.
At the final stage of early userspace, the real root is mounted, and then replaces the initial root filesystem.
/sbin/init is executed, replacing the
/init process. Arch uses systemd as the default init.
init calls getty once for each virtual terminal (typically six of them), which initializes each tty and asks for a username and password. Once the username and password are provided, getty checks them against
/etc/shadow, then calls login. Alternatively, getty may start a display manager if one is present on the system.
A display manager can be configured to replace the getty login prompt on a tty.
The login program begins a session for the user by setting environment variables and starting the user's shell, based on
The login program displays the contents of /etc/motd (message of the day) after a successful login, just before it executes the login shell. It is a good place to display your Terms of Service to remind users of your local policies or anything you wish to tell them.
Once the user's shell is started, it will typically run a runtime configuration file, such as bashrc, before presenting a prompt to the user. If the account is configured to Start X at login, the runtime configuration file will call startx or xinit.
GUI, xinit or wayland
xinit runs the user's xinitrc runtime configuration file, which normally starts a window manager. When the user is finished and exits the window manager, xinit, startx, the shell, and login will terminate in that order, returning to getty.