Operating System Startup Process Analysis (taking Linux as an example)

Operating System Startup Process Analysis (taking Linux as an example)

To purchase a computer, we need to learn about the Linux system. First, we have installed a Centos6.5 system. From the moment you press the power key to the desktop or character interface. What happened during this period?

Stage 1:

To clarify this, we should first look at the hardware from the hardware to the software, and look at the composition of the computer motherboard, North-South Bridge:

The North bridge connects high-speed devices such as CPU, memory, and PCI. Nanqiao connects disks, NICS, USB, PS/2, and other low-speed devices.

When we press the power supply, we first read data from the BIOS chip. This BIOS chip is generally EEROM, but from the Intel Pentium series, the motherboard uses NorFlash as the BIOS chip, located in the South Bridge of the motherboard, its location is generally around the motherboard button battery, the position of the BIOS chip on the next motherboard is as follows:

What is BIOS chip mainly used? First, the BIOS chip is a storage chip that mainly stores the following programs:

1. system parameter setup program. The configuration of microcomputer components is placed in a read/write cmos ram chip, which stores information about the CPU, hard drive, display, keyboard, and other components of the system. After shutdown, the system uses a backup battery to supply CMOS power to keep the information. If the configuration information about the Microcomputer in CMOS is incorrect, the system performance will be degraded, the parts cannot be identified, and a series of hardware and software faults will be caused. The system setup program in the BIOS chip is used to set parameters in cmos ram. This program can be entered by pressing one or more keys at startup. It provides a good interface for users to use. This process of setting CMOS parameters is also known as "BIOS Settings ". BIOS settings are required for newly purchased computers or systems with new components.

2. Add the self-check program (POST) to the system ). After the microcomputer is powered On, the system will have a process of checking each internal device, which is done by a program called POST (Power On Self Test, Power-On Self-check. This is also a feature of BIOS. The complete POST self-check will include CPU, memory, ROM, motherboard, CMOS storage device, serial port, display card, hard disk subsystem, and keyboard testing. If any problem is found during self-check, the system will give a prompt or a warning. For example, the most common case is loose memory. If an error is reported during BIOS self-check, the system cannot start up.

3. the system starts the UDF program. After successful self-check, the boot program on the disk MBR is loaded into the memory, so that it runs to load the Operating System Boot Program (grub/lilo, NTLDR );

4. Main I/O drivers and interrupt handling programs. The BIOS Interrupt Routine is the BIOS interrupt service program. It is a programmable interface between the software and hardware of the microcomputer system and is used for linking the functions of the program software with the implementation of the microcomputer hardware. The DOS/Windows operating system manages peripheral devices such as floppy disks, hard disks, optical drives, keyboards, and displays based on the system BIOS. Programmers can also directly call BIOS interrupt routines through access to interrupt such as INT 5 and INT 13.

The first phase of operating system startup is to read and execute programs in the BIOS chip, mainly POST-> read the content on MBR (Master Boot Record) to the memory, next, let's take a look at the specific location of MBR on the disk:

From the figure above, we can see that MBR is located in the hard disk's 0 cylinder, 0 head, and 1 sector. It consists of three parts: the Main Boot Program, the Disk Partition table, and the Partition effective identifier. In the MBR with a total of 512 bytes, the Main boot loader occupies 446 bytes, and the second part is DPT, which occupies 64 bytes, the number of partitions and the size of each partition are recorded in the hard disk. The third part is magic number, which occupies 2 bytes and is fixed to 0xAA55 or 0x55AA, depending on the processor type. If it is a small-end mode processor (such as the Intel series), the value is 0xAA55; this value is 0x55AA if it is a large-end mode processor (such as ipvla6800. (Ps: note that the maximum addressable storage space for MBR partition tables is only 2 Tb (232 × 512 bytes ). As a result, the MBR partition method is gradually replaced by the GUID partition table)

The Bootloader program in MBR reads into the memory and completes the first phase of operating system startup. Next, start the second stage of Bootloader.

Through this small program, we can initialize hardware devices and build a map of memory space to bring the system's hardware and software environment to a suitable state, in order to make all preparations for the final call to the operating system kernel.

Linux Bootloader mainly includes grub or Lilo, and most Linux operating systems are grub. Here we mainly use grub.

After the operating system boot program enters the memory, it starts from 0x7c00 and first reads the disk 0-header 0-Channel 2-sector (stage1) into the memory, the 512-byte program is the entry for subsequent execution. Specifically, the content of the hard disk with 0 heads and 0 channels and 2 sectors is loaded into the memory 0x7000, and copy_buffer is called to transfer it to the memory 0x8000. When locating 0-header 0-Channel 2-sector, there are usually two addressing modes: LBA and CHS.

This code is the LBA fan area number 2 (0 cylinder, 0 track, 3 sectors), and starts copying several sectors to the memory, we can find that there are many * _ stage_1_5 files under the/boot/grub directory. Here we are concerned with the e2fs_stage1_5 file, which is used to identify the ext3 file system. We know that GRUB does not have an OS or a file system. So when does GRUB have the file system function. This is what stage1.5 does. After stage1.5, GRUB will be able to identify the file system and identify the file to be loaded on the disk. In this way, the stage2 file can be correctly loaded through the corresponding stage1.5 file. Why is there a stage1.5 stage? This is mainly when stage2 is not continuous or requires special processing on the file system before stage2. Without such a requirement, stage1.5 can be avoided completely.

The stage2 file is the most important Loading Code. Because stage1.5 already supports the file system, stage2 can be large, allowing you to load the operating system, add parameters, and modify options in the menu mode. When stage2 is loaded into the memory for execution, it first parses the grub configuration file/boot/grub. conf, then loads the kernel image to the memory, and transfers the control to the kernel. The kernel will immediately initialize various devices in the system and perform related configuration work, including CPU, I/O, and storage devices.

The above completes the second stage of system startup, and then enters the third stage.

We can see grub. the conf file specifies the location of the kernel image. In the/boot directory, two files about the kernel image are displayed, one file starting with initramfs and the other file starting with vmlinuz. Why are there two files? Due to the loading of Linux Device Drivers, some drivers are directly compiled into the kernel image, while others are placed in ramdisk as modules.

First, copy the kernel image vmlinuz to decompress the memory. The system places the decompressed kernel in the memory and calls the start_kernel () function to start a series of initialization functions and initialize various devices, complete the establishment of the Linux core environment.

Then, the Linux kernel is started.

Next, go to step 4 and initialize the kernel.

If you decompress the initramfs file, you will find that the image contains an init script. After the Linux kernel is started, we load the initramfs image into the memory and release the content to the memory. Then, the kernel executes the init script in initramfs, at this time, the kernel gives control to the init file for processing. If you check the content of the init script, you can find that it mainly loads device drivers related to various storage media. After the required driver is loaded, a root device is created and then the root file system rootfs is mounted as read-only. After this step is completed, release unused memory, convert it to the real root file system, run the/sbin/init program at the same time, and execute the system's process 1. After that, the control of the system will be handed over to the/sbin/init process.

Then, perform Step 5 to initialize the system.

After the/sbin/init program is run in Step 4, the program first reads the/etc/inittab file and initializes it based on the file.
In fact, the main function of the/etc/inittab file is to set the Linux running level. The setting format is ": id: 5: initdefault :", this indicates that Linux needs to run on level 5. The Linux operating level is set as follows:
0: Shutdown
1: single-user mode
2: multi-user mode without network support
3: multi-user mode with network support
4: reserved, not used
5. Multi-user mode with network support and X-Window support
6. reboot the system.

After the running level is set, the system is initialized.

The first is to execute the system initialization script (/etc/rc. d/rc. sysinit) to configure the system, including setting the PATH, setting the network configuration (/etc/sysconfig/network), starting the swap partition, and setting/proc. The content is too large, so I won't talk about it here.

The second is to start the kernel module. The kernel module is loaded Based on the/etc/modules. conf file or the file in the/etc/modules. d directory.

The third is to execute the/etc/rc. d/rc Script. This file defines the order in which the service is started first K and then S, and the specific service status at each running level is put in/etc/rc. d/rc *. d (* = 0 ~ 6) All files under the directory are symbolic links to the corresponding files under/etc/init. d. Rc. sysinit determines the system startup level by analyzing the/etc/inittab file, and then executes the file under/etc/rc. d/rc *. d. For example, if we set the running level to 3, execute the content in the rc3.d directory. S indicates the service content that needs to be started at startup, and K indicates the service content that needs to be closed at shutdown. /Etc/rc. d/rc *. the system service in d will be started in the system background. If you want to customize the service at a running level, run the chkconfig command to operate it, you can also customize the settings through setup, ntsys, and system-config-services. If you need to add the startup content by yourself, you can add the relevant shell script in the init. d directory, and then create a link file in the rc *. d directory to point to the shell script. The starting or ending sequence of these shell scripts is determined by the number after the S or K letters, and the script with smaller numbers is executed first. For example,/etc/rc. d/rc3.d/S01sysstat is executed first than/etc/rc. d/rc3.d/S99local.

The fourth step is to execute the User-Defined Bootstrap program/etc/rc. d/rc. local. In fact, when/etc/rc. d/rc3.d/S99local is executed, it is executing/etc/rc. d/rc. local. S99local is a symbolic link pointing to rc. local. In general, the User-Defined program does not need to execute the tedious steps mentioned above to create a shell to add a link file. Instead, you only need to put the command in rc. in local, the shell script is reserved for user-defined startup content.

Fifth, establish terminal Login

After the above rc Initialization is complete, the init process then opens the terminal for the user to log on.

Tty1, tty2, tty3... this indicates that "/sbin/mingetty" will be executed at the runtime Level 1, 2, 4, and 4, and six are executed, so there will be six plain text terminals in linux, mingetty is the command to start the terminal.

In addition to these six, the "/etc/X11/preofdm-nodaemon" command will be executed to start X-Window and display the graphical logon interface.

Last step:

After Initialization is complete, open the terminal and prompt the user to enter the user name. After the getty program obtains the user name, start the/bin/login program and pass the user name parameter to the program. This program prompts the user to enter the password, after the user enters the password, the/bin/login program checks the user name and password, here, the file that matches the user account's storage is/etc/passwd and the file that stores the user name and password is/etc/shadow, the file storing the user account contains the corresponding shell of the user. The/bin/login program starts the shell process, and then starts the/etc/profile and $ Home /. bashrc and other environment variables. If you log on to the character interface, a $ symbol will appear waiting for the user to enter the command.

So far, the operating system has been started. You can understand the following figure:

Note that before login is used in the Linux Account Verification Program,ChrootProgram (change root directory) to change the path of the root directory. After chroot, the old root directory structure and files cannot be accessed under the new root, and a system directory structure isolated from the original root is established to facilitate user development and improve system security. If a system is damaged, we can use chroot to switch to another system. From this point, the effect of chroot is a bit sandbox.

(Ps: sandbox is an environment for testing programs with untrusted sources, destructive power, or inability to determine program intentions. However, all changes in the sandbox do not cause any loss to the operating system. Generally, this technology is widely used by computer technicians, especially in the computer antivirus software industry. sandbox is an important environment for observing computer viruses .)

After the chroot is complete, login then executes the subsequent process.