System Boot Process
The system boot process is the controlled handoff from firmware to an operating system. Each stage prepares enough hardware and software state for the next stage, ending when the system can start services and accept users or workloads.
itOperating systems | OpenSkills.info
Course pathWalk it in order
Look it upDip in anytime
Go furtherLeaves this page
Don't Panic
Don't Panic — System Boot Process
Every computer you have ever watched lie down and refuse to wake up is running the same long chain of decisions, and the interesting bit is that the chain is the point. The boot process is the controlled handoff of control from firmware, the low-level code baked into the machine that checks the hardware and picks something to run, through a boot loader that finds and prepares an operating system kernel, to an init system like systemd that finally brings up the services you actually use.
Before this settled into agreed shapes, machines booted in whatever way their particular firmware insisted on. Traditional PC firmware, BIOS, had strong opinions. Modern systems standardise on UEFI, which defines how firmware hands off to an operating-system loader, and the loader to the kernel, so the same mental map works across machines and even across operating systems. Windows keeps the same stages, just with different names.
Three ideas hold the whole thing together. First, boot is a chain of handoffs, not one program running start to finish. Second, each stage can only report failures that occur after it begins, which quietly changes how you read an error. Third, Linux bridges an awkward gap where the kernel needs its root file system before ordinary programs can run, so it loads an initramfs, a temporary root environment in memory that loads storage drivers, unlocks disks, and mounts the real root before handing control onward.
Here is the one that will cost you an afternoon. Because control has already moved past a stage by the time its problems surface, the visible failure usually appears downstream of the actual fault. A kernel that cannot mount its root device does not announce that; it dumps you into a minimal rescue shell or a panic after the component that should have been the problem already finished its job. The loudest symptom on the screen is a boundary telling you where you got to, not a confession from the part that broke.
So when something refuses to boot, resist the urge to change the first thing that looks wrong. Work out which stage produced the last trustworthy evidence, the firmware output or a loader menu or kernel messages, and repair that boundary rather than a later one. Fixing a service will not help a kernel that cannot find its root.
Start with the Intro for the full map of stages and handoffs. Keep the Cheatsheet nearby for the failure-localization table the moment something actually breaks. And when you inherit a machine that boots in install but not in life, or find Secure Boot switched off "just to get it booting", the Field Notes tab has the receipts.
Where this skill leads
Relevant careers
See how this topic contributes to broader role-level skill maps.
Sources
- https://uefi.org/specs/UEFI/2.11/02_Overview.html
Supports
- UEFI defines an interface between platform firmware and operating-system loaders
- UEFI provides boot and runtime services and includes a firmware boot manager
- UEFI boot variables can identify EFI applications and device paths
- https://uefi.org/specs/UEFI/2.11/03_Boot_Manager.html
Supports
- BootOrder and Boot-number variables express firmware boot policy
- The UEFI boot manager loads EFI images through file-system or load-file protocols
- Removable media can use architecture-specific fallback names under EFI slash BOOT
- A firmware boot manager and an operating-system loader are separate stages
- https://uefi.org/specs/UEFI/2.11/08_Services_Runtime_Services.html
Supports
- UEFI distinguishes boot services from runtime services
- Reset services define platform reset behavior and reset types
- https://uefi.org/specs/UEFI/2.11/32_Secure_Boot_and_Driver_Signing.html
Supports
- Secure Boot authenticates EFI images against configured trust data
- Firmware can reject an image that fails verification policy
- Image verification does not validate later operating-system configuration
- https://uefi.org/specifications
Supports
- UEFI 2.0 was released in January 2006
- UEFI 2.3.1 was released in April 2011
- UEFI 2.11 was released in December 2024
- https://uefi.org/sites/default/files/resources/UEFI_on_Dell%20BizClient_Platforms.pdf
Supports
- The UEFI Forum was created in 2005 from work based on Intel EFI
- https://www.gnu.org/software/grub/manual/grub/grub.html
Supports
- A boot loader loads an operating-system kernel and transfers control
- GRUB can read supported file systems, load kernels, pass parameters, and chain-load other loaders
- GRUB configuration and loaded images form separate boot artifacts
- GRUB 2 adoption history includes limited distribution use around 2007 and major defaults by the end of 2009
- https://www.gnu.org/software/grub/manual/grub/html_node/History.html
Supports
- GRUB originated in 1995 alongside work on the Multiboot specification
- GRUB became an official GNU package in 1999
- Work on the GRUB 2 rewrite began around 2002
- https://docs.kernel.org/arch/x86/boot.html
Supports
- The x86 Linux boot protocol defines loader-supplied setup data, command-line data, and kernel entry requirements
- The loader-to-kernel handoff includes a memory layout and boot parameters
- https://docs.kernel.org/filesystems/ramfs-rootfs-initramfs.html
Supports
- The kernel unpacks initramfs into a root file-system environment
- Early user space can prepare and switch to the real root file system
- https://cdn.kernel.org/doc/html/latest/admin-guide/initrd.html
Supports
- An initial RAM disk supports two-stage startup
- A loader can load a kernel and initial RAM disk before early user space mounts the real root
- Root-storage drivers and setup tools can run before the root transition
- https://www.freedesktop.org/software/systemd/man/latest/bootup.html
Supports
- systemd describes separate initrd and normal system-manager boot phases
- Targets and units form synchronization points and dependency-driven startup
- Independent boot work can proceed according to ordering constraints
- https://www.freedesktop.org/software/systemd/man/latest/systemd.unit.html
Supports
- Unit requirement and ordering dependencies are separate concepts
- Units can be activated through dependency and activation relationships
- https://www.freedesktop.org/software/systemd/man/latest/systemd-analyze.html
Supports
- systemd-analyze can report boot timing, critical chains, and unit dependency information
- User-space timing is only one portion of the full boot path
- https://learn.microsoft.com/en-us/troubleshoot/windows-client/performance/windows-boot-issues-troubleshooting
Supports
- Windows startup can be divided into PreBoot, Boot Manager, OS Loader, and kernel phases
- On UEFI systems firmware loads the Windows Boot Manager EFI application
- Stage-specific evidence helps localize a Windows startup failure
- https://learn.microsoft.com/en-us/windows/security/operating-system-security/system-security/secure-the-windows-10-boot-process
Supports
- Windows uses Secure Boot, Trusted Boot, early anti-malware, and measured boot as distinct protections
- Windows 8-era systems connected UEFI Secure Boot policy with operating-system startup
- https://man7.org/linux/man-pages/man5/proc_cmdline.5.html
Supports
- /proc/cmdline exposes the kernel command line supplied by the boot loader
- The root parameter on that line selects the file system the kernel mounts as root
- https://docs.kernel.org/filesystems/efivarfs.html
Supports
- EFI variables are exposed to user space through efivarfs under /sys/firmware/efi
- EFI variables are firmware state and can be damaged by careless writes
- https://www.freedesktop.org/software/systemd/man/latest/systemctl.html
Supports
- systemctl get-default reports the default target of the system
- systemctl can list active units by type and report units that failed to start
- https://www.freedesktop.org/software/systemd/man/latest/journalctl.html
Supports
- journalctl can restrict output to the current boot and to kernel messages
- https://github.com/sindresorhus/awesome
Supports
- The Awesome catalog was checked for a focused system-boot list
- Its Linux listings do not provide a focused boot-process ecosystem suitable for this course
- https://github.com/kahun/awesome-sysadmin
Supports
- The Awesome Sysadmin list was checked for boot-process tooling
- It has no focused boot or firmware section suitable for a non-duplicate course tab
- https://www.gnu.org/software/grub/manual/grub/html_node/Root-Identification-Heuristics.html
Supports
- grub-mkconfig writes root=UUID=... and delegates the root mount to the initrd, so a stale UUID surfaces as a root-mount failure
- https://nvd.nist.gov/vuln/detail/CVE-2020-10713
Supports
- A flaw in GRUB2 prior to 2.06 allows the Secure Boot verification process to be bypassed
- https://access.redhat.com/security/vulnerabilities/grub2bootloader
Supports
- The previous Secure Boot signature is revoked into the DBX database and a new signature is used
- https://ubuntu.com/blog/mitigating-boothole-theres-a-hole-in-the-boot-cve-2020-10713-and-related-vulnerabilities
Supports
- DBX revocation lists have limited UEFI storage space; machines that never receive the repudiation keep trusting a known-vulnerable bootloader
- https://wiki.archlinux.org/title/Improving_performance/Boot_process
Supports
- systemd-analyze exposes boot timing; serialized userspace services and firmware handshakes dominate boot time, not the kernel
