Firmware, Boot, and Initramfs

Firmware which is used to load an operating system is an instruction program stored in non-volatile memory chip hardwired into the motherboard. Modern systems has UEFI Firmware extended features of BIOS for better performance and security. CPU has fixed memory address called reset vector hardcoded in hardware and CPU executes the instructions mapped with that address first. Obviously, that reset vector is mapped to the memory address of the firmware.

Once the system is powered on, CPU initially executes the firmware instructions. CPU, Chips and RAM are initialised, find the bootable devices inserted into the system and start executing the boot program in the process of executing firmware. Bootable devices are usually hard drives, solid state drives and optical devices. In legacy systems, those boot devices store Master Boot Record called MBR at the first sector the drive, each sector has 512 bytes of storage.

Drive stores boot program, usually GRUB or could be something else, at the first 446 bytes of the drive, partition table is stored for the 64 bytes and last 2 bytes store the signature of the drive which is used to detect if the drive is executable. 446 bytes is not enough for the boot program to be stored so that the booting process is divided into three stages, stage 1, 1.5 and 2. Stage 1 is stored entirely on the first 446 bytes which only has the ability to locate the location of the stage 1.5 to load. Stage 1.5 stores location address of the stage 2 which resides on the actual disk and modules to load the stage 2. When stage 2 is loaded, boot loader displays the menu and allows users to select which kernel to boot for the system.

Once the kernel is selected, boot loader loads the kernel image and initramfs into the memory RAM. Initramfs is not only a minimum filesystem but also a self-contained environment in which device modules, other kernel modules and init program needed to actually mount the root filesystem are stored. The root filesystem is stored on the actual disk. kernel image itself only knows the location address of the filesystem but may not know how to actually access it. Kernel needs driver modules to actually access the filesystem but driver modules need the file system to be stored and mounted also. That would cause circular dependencies. The solution kernel implements is using temporary filesystem called initramfs in which all the necessary modules are built. Once the kernel and initramfs are loaded into memory, boot loader passes control to the kernel. Kernel initializes and configures hardware components and unpacks the initramfs came as compressed to the temporary folder, usually tmpfs which allows kernel modules to be loaded. Then kernel starts running init program from the initramfs. Init program loads all the necessary drivers required to access the root file system and mounts the actual root fil system. Once the real root filesystem is mounted, the root filesystem is switched from initd to the real root filesystem using switch_root or pivot_root commands.