Boot Process: Kernel

After control reaches the Linux kernel, it initializes memory management, scheduling, interrupts, built-in drivers, security frameworks, and other core subsystems. It parses the command line and prepares to start the first user-space process.

Why Early User Space Exists

A simple root filesystem can sometimes be mounted using drivers built into the kernel. More complex systems need modules and tools before the real root can be reached. Examples include:

• storage-controller or filesystem modules
• encrypted root unlocking
• LVM or RAID assembly
• network configuration for a network root
• device discovery and persistent identifier resolution

An initramfs packages these components into an early user-space environment supplied alongside the kernel.

Initramfs and Legacy Initrd

A modern initramfs is usually one or more cpio archives, often compressed, that the kernel unpacks into its initial root filesystem. The kernel executes an early /init program from that environment.

A legacy initrd is conceptually a filesystem image loaded into a RAM-backed block device and mounted. The terms are often used loosely in filenames and boot-loader commands, so inspect the actual tooling rather than inferring format from the word alone.

The initramfs must match the kernel and boot design. Missing modules, stale device identifiers, or omitted cryptographic and LVM tooling can make a newly installed kernel unbootable even when the kernel image itself is valid.

Reaching the Real Root

Early user space interprets parameters such as root=, waits for the necessary devices, activates storage layers, and mounts the intended root filesystem. It then uses a root-switch operation to make that filesystem the new / and release the temporary early environment where possible.

The initial ro command-line request can support consistency checks and controlled startup, but the exact sequence is distribution-specific. Filesystem checks are user-space operations, and the initramfs or later init system can remount the root read-write when policy permits.

Starting PID 1

The kernel executes the configured init program, normally reached through a path such as /sbin/init or selected with init=. That process receives PID 1 and takes responsibility for the main user-space service environment.

If no usable init program can be executed, the kernel cannot proceed to a normal user-space system and typically reports a boot failure or panic. Debug the earliest failing layer: kernel and command line, initramfs content, root discovery, root mount, or PID 1 execution.

Summary

You can now trace kernel boot through early user space to PID 1.

1. Separate built-in kernel initialization from loadable early modules.
2. Relate initramfs to a cpio-based temporary root and /init.
3. Follow storage assembly and the switch to the real root.
4. Identify execution of PID 1 as the user-space handoff.