Booting Process of Smart phones Anjali Gavendra and Manisha Sharma

M.Tech, Mobile and Pervasive Computing (MPC)

IGDTUW, Kashmere Gate, Delhi

Abstract--With change in time, luxury

becomes requirement and so is the case with

mobiles.Today having a smart phone is no

longer a luxury but a necessity.There has

been development in the all the sphere of

mobile be it hardware(camera, processor,

memory)or software(operating system, apps)

but the general booting process of all smart

phones remains same. This paper deals with

the booting process of Smart phones which

describes how a Smart phones works when it

is turned on. Today with different variety of

mobile platforms coming up every day such

as Android, Symbian, Blackberry etc. are

associated with different booting procedures.

In this paper we will cover up the boot

process in general term for Smart phones.

We have also discussed the booting process

of some widely used operating systems in

Smart phones named as Windows, Android,

Symbian, ioS OS.

Index Terms -- Booting, Operating System ,

Android, WP

I. INTRODUCTION

Booting Definition:-

Booting ,also known as bootstrap, is the initial

set of operations that a system performs when

the Smart phoness are switched on or are re-

energized after being turned off or when it is

reset or when it starts up while running it, and

ends when the mobile is ready to perform its

normal operations then the control has been

transferred to the user.[1]

Booting is also defined as the starting-up of a

computer, which involves loading the

operating system and other basic softwares[2]

Booting Process

In the Booting process, System will check all

the hardware’s and Software’s those are

installed or attached with the System and this

will also load all the Files those are needed for

running a system from ROM [3]

Booting typically takes few seconds and

typically involves hardwired test, locating and

initializing peripheral devices, and then

finding, loading and starting an operating

system[1]

Time required by different smartphones for

booting is as follows:

Model Name Booting Time

SamsungDUOS

S5222

54 Seconds

Karbonn A1+ 58 Seconds

Samsung GALAXY

Y GT-S5360

49 Seconds

Every operating system has a different booting

procedure of its own.The examples of various

operating systems used in Smart phoness are

Nokia's Symbian OS, Apple's IOS, RIM's

BlackBerry OS, Microsoft's Windows Phone

OS, Linux, Palm WebOS, Google's Android,

Samsung's Bada (operating system) and

Nokia's Maemo.

II. BOOTING OF A SMART

PHONES

Booting is used to load the first piece

of software that starts a smart phone.Because the

operating system is essential for running all

other programs, it is usually the first piece of

software loaded during the boot process. Different

operating systems is having different steps for

booting in Smart phoness, but in general terms

steps which are common in all booting processes

of mobiles are illustrated as follows:

Figure 1: Steps for booting of a Smart

phones[4]

Bootstrap

As soon as the power button is pressed, it

leads to a reset of CPU(registers values are set

to predefined value). The code which executes

the task at the initial stages of booting is

hardwired and is stored at a fixed location.

Hardwired Refers to elements of

a program or device that cannot be changed.

As the hardware connected to mobile is

always fixed, so the preliminary task is very

basic which includes checking of all chip

components working properly[5]. Then next is

the job of boot loader, whose job is to locate

and load the kernel.

Kernel

Kernel manages input/outut requests

from software and translates them into data

processing instructions for the central

processing unit and other electronic

components of a Smart phones. The kernel is

the first part of the operating system to load

into memory by boot loader

during booting (i.e., system start up),kernel

remains in memory for the entire duration of

the mobile session because its services are

required continuously[6][7].

Thus it is important for it to be as small as

possible while still providing all the essential

services needed by the other parts of the

operating system and by the various

application programs, typically including

Figure 2 : Kernel[7]

memory management, process management,

file management and I/O (input/output)

management (i.e., accessing the peripheral

devices). These services are requested by other

parts of the operating system or by application

programs.

Kernel stage can also be broken in few stages.

But the preliminary stage is BSP-Board

Support Packages, which is the code specific

to hardware/chip. BSP is responsible for the

assigning of the various functionality

operations to the controllers and pins of the

chip. After this, operations such as

initialization of interrupt controllers, setting up

of memory protections, caches and scheduling,

memory management occur.

File system

Generally speaking file system is way of

organizing data. This is very basic definition,

but the tasks performed by file system are

itself very vast. This stage is loaded by the

boot loader and is called in the middle of the

Kernel stage. All the data present in the Smart

phones is organized, stored and updated

because of file system.

System startup

As the kernel and file system are up, then the

system start up process can began. From this

stage all the processes that occur are related

directly with the user space applications. From

the libraries to the framework, all the work

takes place in this layer. Web manager, Sound

manager, Graphics manager etc. all are

brought to life in this phase. At the end of this

phase applications are launched.

Graphic user interface(GUI)

This is the final and apparent stage, which is

seen by everyone. This leads to the display of

the user defined settings and the applications

launching. GUI is graphic user interface that is

a way of communicating with the mobile by

its user.

III. BOOTING PROCESS OF

ANDROID

Android is a Linux-based operating

system designed primarily

for touchscreen Smart phoness such

as smartphones and tablet computers. Initially

developed by Android, Inc.,

which Google backed financially.it is

Google's open and free software stack that

includes an operating system, middleware and

also key applications for use on Smart

phones[8]. The booting process of a Android

Smart phones is as follows:

Figure 3.1 Android Booting process[20]

Step1: Power on and boot rom code

execution

At power on the CPU will be in a state where

no initializations have been done. Internal

clocks are not set up and the only memory

available is the internal RAM. When power

supplies are stable the execution will start with

the Boot ROM code. This is a small piece of

code that is hardwired in the CPU

ASIC( application-specific integrated circuit)

for this particular use.

Figure 3: Loading Boot Rom to physical

memory[9]

The Boot ROM code will detect the

boot media using a system register that

maps to some physical balls on the

asic. This is to determine where to find

the first stage of the boot loader.

Once the boot media sequence is

established the boot ROM will try to

load the first stage boot loader to

internal RAM as shown in figure 3.

Once the boot loader is in place the

boot ROM code will perform a jump

and execution continues in the boot

loader.

Step 2: The boot loader

The boot loader is a special program separate

from the Linux kernel that is used to set up

initial memories and load the kernel to RAM

as shown in figure 4.

The first boot loader stage will detect

and set up external RAM.

Once external RAM is available and

the system is ready the to run

something more significant the first

stage will load the main boot loader

and place it in external RAM.

Figure 4: loading boot loader to external RAM

The second stage of the boot loader is

the first major program that will run.

This may contain code to set up file

systems, additional memory, network

support and other things. On a Smart

phones it may also be responsible for

loading code for the modem CPU and

setting up low level memory

protections and security options.

Once the boot loader is done with any

special tasks it will look for a Linux

kernel to boot. It will load this from the

boot media (or some other source

depending on system configuration)

and place it in the RAM. It will also

place some boot parameters in memory

for the kernel to read when it starts up.

Once the boot loader is done it will

perform a jump to the Linux kernel,

usually some decompression routine,

and the kernel assumes system

responsibility.

Step3: The Android kernel

The Android kernel starts up in a similar way

on Android as on other systems. It will set up

everything that is needed for the system to run.

Initialize interrupt controllers, set up memory

protections, caches and scheduling as shown

in figure 5.

Figure 5:loading kernel

Once the memory management units

and caches have been initialized the

system will be able to use virtual

memory and launch user space

processes.

The kernel will look in the root file

system for the init process and launch

it as the initial user space process.

Step4: The init process

The init process is the "grandmother" of all

system processes. Every other process in the

system will be launched from this process or

one of its descendants as shown in figure 6.

The init process in Android will look

for a file called init.rc. This is a script

that describes the system services, file

system and other parameters that need

to be set up.

The init process will parse the init

script and launch the system service

processes.

Figure 6: init process

Step5: Zygote and dalvik

Android does not run directly on top of the

kernel since it has been coded in Java and

therefore needs to be run on top of a Virtual

Machine - Java being marketed as “write

once, run anywhere”.The Zygote is launched

by the init process and will basically just start

executing and and initialize the Dalvik Virtual

Machine(VM). In a Java, separate Virtual

Machine instance will popup in memory for

separate per app, In case of Android app

should launch as quick as possible, If Android

os launch different instance of Dalvik VM for

every app then it consume lots of memory and

time. Also the memory foot print of the VM is

required to be minimal.so, to overcome this

problem Android introduced a concept called

Zygote as shown in figure 7.

Figure 7: Zygote and dalvik

Zygote enable shared code across Dalvik VM,

lower memory footprint and minimal startup

time. Zygote is a VM process that starts at

system boot time. The Zygote process

initializes one Dalvik VM, which preloads and

preinitializes code library classes.Normally

there core classes are read-only and part of

Android SDK or Core frameworks. Once the

Zygote has initialized, it will sit and wait for

socket requests coming from the runtime

process indicating that it should fork newVM

instances based on the ZygoteVMinstanceAs

Zygotes has to be run before Android core

processes can be executed, it is launched by

the kernel, as part of the init sequence,

already in the user space.[10]

Step6: The system server

The system server is the first java component

to run in the system. It will start all the

Android services such as telephony manager

and bluetooth. Start up of each service is

currently written directly into the run method

of the system server as shown in figure 8.

figure 8: System Server process

Step7: Boot completed

Once the System Server is up and running and

the system boot has completed there is a

standard broadcast action called

ACTION_BOOT_COMPLETED

IV. BOOTING PROCESS OF

WINDOWS PHONE 7

Boot Process Overview

Fast OS startup performance is critical for a

good user experience. The time required to

boot the operating system on a given Smart

phones to the point where the user can start

working is one of the most important

benchmarks for Windows client performance.

The Windows boot process consists of several

phases which are explained in more detail by

the picture and supporting text below

BIOS Initialization

During the BIOS Initialization phase, the

platform firmware identifies and initializes

hardware devices, and then runs a power-on

self-test (POST). The POST process ends

when the BIOS detects a valid system disk,

reads the master boot record (MBR), and starts

figure 9: booting process of windows phone 7

Bootmgr.exe. Bootmgr.exe finds and starts

Winload.exe on the Windows boot partition,

which begins the OSLoaderphase.The BIOS

version, the BIOS configuration and the

firmware of the computer hardware

components can have an impact on the overall

boot performance .We should check the BIOS

configuration (device boot order, PXE boot-

enabled, Quick/Fast boot (POST check)

enabled, AHCI settings).

OS Loader

During the OSLoader phase, the Windows

loader binary (Winload.exe) loads essential

system drivers that are required to read

minimal data from the disk and initializes the

system to the point where the Windows kernel

can begin execution. When the kernel starts to

run, the OSloader loads the system registry

hive and additional drivers that are marked as

BOOT_START into memory. This phase is

mainly impacted by boot start drivers. While a

delay caused by a dual boot menu would be

easy to fix, make sure that all boot start drivers

are signed and up-to-date.

OS Initialization

During the OS Initialization phase, most of the

operating system work occurs. This phase

involves kernel initialization, Plug and Play

activity, service start, logon, and Explorer

(desktop) initialization. The OS Initialization

can be divided into four subphases. Each

subphase has unique characteristics and

performance vulnerabilities. After we have

taken a boot trace the different subphases are

shown as follows :

Sub phase 1- PreSMSS: Kernel

Initialization

The PreSMSSsubphase begins when the

kernel is invoked. During this subphase, the

kernel initializes data structures and

components. It also starts the PnP manager,

which initializes the BOOT_START drivers

that were loaded during the OSLoader phase.

Sub phase 2 - SMSSInit : Session

Initialization

The SMSSInitsubphase begins when the

kernel passes control to the session manager

process (Smss.exe). During this subphase, the

system initializes the registry, loads and starts

the devices and drivers that are not marked

BOOT_START, and starts the subsystem

processes. SMSSInit ends when control is

passed to Winlogon.exe.

Sub phase 3 - WinLogonInit: Winlogon

Initialization

The WinLogonInitsubphase begins when

SMSSInit completes and starts Winlogon.exe.

During WinLogonInit, the user logon screen

appears, the service control manager starts

services, and Group Policy scripts run.

WinLogonInit ends when the Explorer process

starts.

Sub phase 4 – ExplorerInit: Explorer

Initialization

The ExplorerInitsubphase begins when

Explorer.exe starts. During ExplorerInit, the

system creates the desktop window manager

(DWM) process, which initializes the desktop

and displays it for the first time.

Figure 10: windows booting

V. BOOTING IN SYMBIAN

OPERATING SYSTEM

Following is the description about how the

Symbian takes the hardware from an

uninitialized, powered-off state to one in

which the system is fully ready for action. To

successfully initialize the hardware and OS, it

is important to know what state the hardware

will be in immediately after it has been

switched on or reset. For the most part, the OS

has to assume that hardware is in an unknown

state because the boot process may arise from

several causes.[11]

Switching on the phone triggers the CPU and

MMU to reset. This disables the MMU and

causes the CPU to jump to a well-known

location to execute the reset code. On ARM

CPUs, this is address 0x00000000, which is

usually referred to as the reset vector.

Obviously there must be some code at

physical address zero for this to work and

hence some hardware - usually this will be

some masked ROM or XIP

Flash.Smartphoness typically use some form

of Flash memory to store the OS image and

built-in software.[11]Although this is

significantly more expensive (and slower) than

masked ROM, there are two substantial

advantages:

1) Smart phonessare complex products and

often require an update during their lifetime.

Flash memory enables the OS to be over-

written or upgraded (reflashed) .

2) Masked ROM takes time to manufacture.

This introduces a delay of several weeks

between the software being ready and the

production of the phone.

Some types of non-volatile memory, such as

NOR Flash, can be treated by the memory

controller as directly accessed, read-only

memory. This allows program code to execute

directly from Flash memory, which makes

initial system startup much simpler. It is

interesting to compare this to desktop systems

where the operating system resides on hard

disk and must be loaded into RAM before it is

possible to start executing any of the code.

There are some Flash technologies, such as

NAND Flash, that cannot support execute- in-

place and thus require a boot process that more

closely resembles that of a desktop OS.

Brief discussion on the Symbian booting is as

follows :

A. Switching the phone on triggers a hardware

reset. The first software that is executed after

this is known as the bootstrap. On entry to the

bootstrap, the execution environment is very

primitive, and the bootstrap is tasked with

providing a basic execution environment for

the kernel process

B. On entry to the kernel, the CPU is now

running at full speed and an execution stack

allows typical C++ code to be run. However,

there is still only a primitive memory

environment and only one execution path.

Static data is now initialized and interrupts are

masked. Once kernel and base support

package (BSP) initialization is complete, there

is full management of CPU, memory, power

and peripherals and the second OS process is

started .

C. At this stage in the boot there is a fully

functional micro-kernel that supports multiple

multi-threaded, protected user- mode

processes. However, the OS has not yet

provided the means to instantiate new

processes, to extract file-based data from the

Flash or to persist data in read/write Flash

memory. The process of establishing all of

these services falls to EFILE.EXE and its

supporting process, ESTART.EXE

D. All of the kernel, user library and file

server services are now fully initialized ready

for the rest of the OS to begin its boot process

- a job that is given to the system starter

process. The system starter manages the

initialization of the rest of the OS system

services in an ordered manner, and can also

provide monitoring and restart for those which

terminate unexpectedly. The precise order in

which the persistence, communications,

multimedia, security and other services are

started is controlled by a script and is phone-

specific

E. Once enough of the system services are

running, the primary GUI service, the window

server, can be started. This now allows

initialization of the other UI services and the

applications that make up the aspect of the OS

that is most evident to the user. This is a

standard sequence for booting the phone.

This is a standard sequence for booting the

phone. According to this process, the OS

services for displaying images or animations,

or playing audio become available quite late

in the boot. This does not reconcile with the

typical experience of using a Symbian OS

phone - in practice phones often use lower

level graphics services to display images

during boot without demanding that the full

screen-sharing capabilities of the window

server are available.

VI. iOS BOOTING PROCESS

iOS uses a secure boot chain. That is each

stage of the boot process verifies the digital

signature of the next before executing it.

When the iPhone device is powered on, the

BOOT ROM, which is hard-wired during chip

fabrication, is loaded into VROM (Virtual

ROM) and executed. Inside the BOOT ROM

is the Apple’s Root Certificate Authority (CA)

public key. It uses the public key to verify the

digital signature of the LLB (low level

bootloader) before executing it. The LLB is

similar to the Stage1 bootloader on Android.

The LLB loads iBoot, which is similar to the

Android Stage2 bootloader, and then runs the

iOS kernel and then the System Software.

This completes the boot process for iOS.

In iOS, each step of the boot-up process

contains components that are

cryptographically signed by Apple to ensure

integrity, and proceeds only after verifying the

chain of trust. This includes the bootloaders,

kernel, kernel extensions, and baseband

firmware.

iPhone boot process consists of multiple boot

stages which are only loaded if the current

stage is able to successfully verify the integrity

and authenticity of the next stage to be loaded .

When an iOS device is turned on, its

application processor immediately executes

code from read-only memory known as the

Boot ROM. This immutable code is laid down

during chip fabrication, and is implicitly

trusted[13].The Boot ROM code contains the

Apple Root CA public key, which is used to

verify that the Low-Level Bootloader (LLB) is

signed by Apple before allowing it to load.

This is the first step in the chain of trust where

each step ensures that the next is signed by

Apple. When the LLB finishes its tasks, it

verifies and runs the next-stage bootloader,

iBoot, which in turn verifies and runs the iOS

kernel and NAND Flash.

This secure boot chain ensures that the lowest

levels of software are not tampered with, and

allows iOS to run only on validated Apple

devices. Due to built-in chain of trust

mechanism, it is really difficult for an

investigator to gain lower level access during

normal booting sequence. That requires

iPhone’s special purpose boot mode, known

as Device FirmwareUpgrade( DFU ) mode.

This mode is designed to perform firmware

upgrade for iPhone. This mode has an

alternate boot sequence. This mode loads

BootROM. BootROM loads second stage boot

loaders iBSS and IBEC. iBEC checks the

integrity of Kernel. Kernel checks the

RamDisk and loads the contents of RamDisk

into memory.

figure 11: normal mode boot sequence

An investigator can design a custom toolkit

and load it on custom RamDisk. This custom

toolkit consists of tools required for forensic

acquisition and basic UNIX tools like

OpenSSH, netcat, md5sum etc. This custom

RamDisk can be loaded into iPhone’s memory

to perform forensic activities.

figure 12:Dfu mode boot sequence

The different parts of the process are:

DFU: Device Firmware Update.it is state

when you can put your iPhone into where it

can interface with iTunes but donotload the

iphoneos or bootloader.

iBSS: Independent basic service wifi ad hoc

mode

VII. CONCLUSION

The Smart phoness have become an

indispensible part of our lives. Now-a-days,

there is neck to neck competition in the

manufacturing of Smart phoness in the market.

Every vendor yearns to provide a better

operating system and thus features than its

competitors. Although Booting of all OS is

almost same. All OS includes mainly boot

loaders, kernel, file server, system start up,

GUI steps in their booting process like

Symbian. But different OS has some

additional or different steps too such as

Android has Zygote and dalvik as an

additional step. While ioS uses a secure boot

chain and windows phone booting process is

some likely similar to windows.

VIII.FUTURE WORK

We will evaluate and try to find out the merits

and demerits of different smartphones booting

processes.Generally it is difficult to obtain

quick boot time (under 5 seconds) using the

fast boot techniques, and many parts of the

software platform require additional

optimization. An intuitive way to obtain

instant boot times is to boot directly from

hibernation. We apply hibernation-based

techniques to a smartphones, and thereby

overcome two major obstacles: long loading

times for snapshot image and maintenance

costs related to hardware change.[19]

REFERENCES

[1] Boot definition [online] Available:

http://en.wikipedia.org/wiki/Booting [2]Boot definition [online] Available:

www.webopedia.com/TERM/B/boot.html

[3] Booting Process,IBM, [online] Available:

http://pic.dhe.ibm.com/infocenter/aix/v6r1/ind

ex.jsp?topic=%2Fcom.ibm.aix.baseadmn%2F

doc%2Fbaseadmndita%2Fbootproc.htm

[4] Mobile Boot Straping, EngineersGarage...

inspiring creation, [online] Available:

http://www.engineersgarage.com/mygarage/ho

w-mobile-phone-boots

[5] Hardwired definition, Webopedia, [online]

Available:

http://www.webopedia.com/TERM/H/hardwir

ed.html

[6] Kernel definition, LINFO, [online]

Available:

http://www.linfo.org/kernel.html

[7] Kernel definition, wikipedia, [online]

Available:

http://en.wikipedia.org/wiki/Kernel_(computin

g)

[8] About Android,Wikipedia, [online]

Available:

http://en.wikipedia.org/wiki/Android_(operati

ng_system)

[9] Android blog, The Android boot process from

power on,Xdin, An Alten Company.

[10] Android Boot Seqence, javigon, my cellar

door [Online] Available:

http://javigon.com/2012/08/24/from-poweron-

to-android-the-boot-sequence/

[11] Symbian OS Internals Book , Nokia

Developer,

http://developer.nokia.com/Community/Wiki/File:

SymbianOSInternalsBook_16.1.png#

[12] Apple"-iOS security" October 2012 [Online]

Available:

http://images.apple.com/iphone/business/docs/iOS

_Security_Oct12.pdf

[13] Wikipedia-The free Encylopedia. Available:

http://en.wikipedia.org/wiki/Booting

[14]“Mobile handset with symbianos and update

agent”, Iyadqumel, Hunt1ngton Beach, CA(US),

Patent No.: US 8,046,753 B1

[15]“Smart phone system and booting publication

classification Method thereof” ,Zheng-weiZheng,

Huizhou Zhhingchen,Huizhou (CN)

[16] Wikipedia-The free Encylopedia. Available:

http://en.wikipedia.org/wiki/

[17] The Google website. [Online]. Available:

https://www.google.com.

[18] The IEEE website. [Online]. Available:

http://www.ieee.org

[19]Future Work Initiative proposed [Online].

Available:

https://www.kernel.org/doc/ols/2010/ols2010-

pages-9-18.pdf

[20] General Android Boot Process:

http://www.diva-

portal.org/smash/get/diva2:235591/ATTACHMEN

T01