PBL = Primary Boot Loader
SBL = Secondary Boot Loader
SBL1 - Secondary Bootloader 1
SBL2 - Secondary Bootloader 2
SBL3 - Secondary Bootloader 3
RPM = (Resource/Power Management) or Primary BootLoader (PBL); controls power to radio, modem etc.
TZ = Trust Zone
SDI = - trust zone storage partition. Data that is used by Trust Zone.
ABOOT= - Android Bootloader
DBL = Device Boot Loader (loads OSBL)
OSBL = Operating System Boot Loader (loads AMSS)
AMSS = Advanced Mobile Subscriber Software (Qualcomm CP FW)
EMMCBOOT= Embedded MMC (eMMC) boot (loads EMMCBOOT)
ADSP = AP (Application Processor) DSP (Qualcomm DSP FW)
LK = little kernel
QCSBL = and /osbl (Operating System Boot Loader; /tz) etc.
APPSBL = Applications processor Secondary Boot Loader
SSD - = Secure Software Download
modem - = the phone's radio FIRMAWARE (CP Binary)
RIL = Radio Interface Layer
SD3 = Security Domain 3
MODEMST1 -= Modem Storage 1 (NV data)
MODEMST2- = Modem Storage 2 (NV data)
FSG - = Modem Storage "Golden Copy"
BOOT - = Kernel + Ramdisk
PARAM - = Parameter Block
SYSTEM - = Android Platform
USERDATA -= Application & User Data
persist = tombstones (ext4, contains very little data
efs = ext4, mounts at /efs, has device info like IMEI and MEID
misc = Reserved.This partition can be used for internal purpose
QFIT = (Qualcomm Factory Image Tools)
DSP = (Digital Signal Processor) by Qualcomm to assist in things like smooth video playback.
FOTA - = firmware over the air. fota is an unofficial mode for loading Android
HDLC = High-level Data Link Control
MSM = Mobile Station Modem
DMSS = Dual-Mode Subscriber Station
QDL = Qualcomm Download
QHSUSB_DLOAD = Qualcomm High Speed USB Download
EhostDL = Emergency Host Download
DCN = Document Control Number, used by Qualcomm to track their thousands of documents
OEM (Original Equipment Manufacturer
CID (Carrier or Region ID),
EBI2 (External Bus Interface 2) f
EFI Extensible Firmware Interface
///////////////////////////////////////////
PIT - Partition Information Table
GPT - GUID Partition Table
APQ :Application Processor Qualcomm
ARM :Advanced RISC Machines
CAF :Code Aurora Foundation codeaurora.org
CDP Code Development Platform
CPU Central Processing Unit
DTS Digital Test Sequence
eMMC Embedded Multimedia Card
HLOS High Level Operating System
ID Identification
LK Little Kernel
MMC Multimedia Card
MMU Memory Management Unit
MSM Mobile Station Modem
MTP Modem Test Platform
PMIC Power Management Integrated Circuit
RAM Random Access Memory
SBC Single Board Computer
SD Secure Digital
SDC Secure Digital Controller
SDHCI Secure Digital Host Controller Interface
SMEM System Memory
SOC System on a Chip
SPMI System Power Management Interface
USB Universal Serial Bus
////////
1. BOOT SEQUENCE
There might be a single or multiple bootloaders (to give directions how to boot). For a typical android device (most common Qualcomm SoC / ARM processor), boot sequence is as follows:
BootROM (like BIOS on PC). It's integrated with SoC.
Processors, bootloaders
SBL
Parallel loading some other stuff from different partitions.
Application BootLoader
Primary Boot Mode (if no Kernel detected or if bootloader/download mode key combination applied)
Bootloader/Download Mode
Secondary boot
Kernel (basically hardware detection and listing in /sys, /proc and /dev directories) and initramfs (creating rootfs and other pseudo filesystems on rootfs)
Init (first process with PID "1". It initiates further loading of processes and scripts)
***Some other stuff***
System / OS (ROM)
Recovery (if recovery mode key combination applied. It's a kernel with UI to perform basic troubleshooting operations)
2. BRIEF INTRO
The Phone's Internal Memory eMMC (not the SD card) is solid-state (flash) memory, aka NAND. Raw NAND, as it's called, is basically a pure flash memory dependent on CPU to control it. But in order to use flash memory just like a traditional hard drive (block device), NAND is equipped with a controller. It's called eMMC.
eMMC can be partitioned much like a hard drive on PC. Contents of android partitions can be partially or completely modified by flashing an image (filesystem .img or executable binary .mbn or a flashable zip) to them. But we never need to modify most of them and whatever manufacturer wrote on them, resides there unmodified (read-only) for the whole device life. A user uses only one partition /data/media/ to save personal data like photos, music etc. All the other are for device to run. There are typically in the range of 20 to 40 partitions on an android device but only a few partitions are modified for the purpose of adding new features or upgrading the device. A custom ROM or minor upgrade is also limited to modify /boot, /system and /data partitions usually. /cache is used by OS for routine operation. So, RECOVERY, BOOT, SYSTEM, DATA and CACHE being the core ANDROID, the rest of partitions are almost intact, containing bootloaders, firmwares, settings etc. Here is a "summarized" detail to these partitions which matter to a common but interested user.
On most devices /system and /data are larger partitions (on some devices /custom too) covering almost 90% of eMMC. All others are smaller ones of a few KB's or MB's.
(The SD Card can also be partitioned to include a section dedicated to storing user apps (Link2SD) or to create partitions for secondary or tertiary OS on android device using some multiboot kernel and recovery system). Even we can put whole OS/ROM on an SD card.
3. DETAIL
Primary / Secondary Bootloaders
Bootloader(s) facilitate the the initial starting up of device by taking control from CPU, performing necessary checks, loading required components and then hand over the charge of booting to kernel. RAM is detected at first stage to start loading configuration of other hardware (like keypad, display etc.) in it.
There might be numerous bootloaders which are executed by different processors, on different devices with different (partition) names like hyp (also called firmware-update), /pbl, /rpm (APPSBL), /dbl (Device Boot Loader; CFG_DATA or /sbl1), /sbl2, /sbl3 (QCSBL) and /osbl (Operating System Boot Loader; /tz) etc.
Examples of final bootloaders are /aboot (Application BL; predecessor of Little Kernel), uboot (traditional Linux bootloader for embedded devices) or manufacturers' developed BL's like /hboot (used by HTC) and redboot etc.
As a norm, all of these stage-1,2,3... bootloaders are simply called BOOTLOADER. While on some devices there is no bootloader partition at all and bootloader resides on SoC. System on Chip is an integrated chip containing multiple things e.g. CPU, GPU, modem, wifi etc. It varies for device manufacturers and SoC vendors (chipset plus processor).
modem, (a)dsp are also executed at this stage.
TZ (TrustZone) technology used by ARM processors as an additional lock to security features. Like, an encrypted key of full disk encryption password is saved in this partition. It combines user's encryption key with a hardware specific key generated by encryption processor (like TPM on Windows) to make security breaching more difficult.
RPM (Resource/Power Management) or Primary BootLoader (PBL); controls power to radio, modem etc.
DSP (Digital Signal Processor) by Qualcomm to assist in things like smooth video playback.
Ultimately SBL calls the final bootloader (aboot or hboot or whatever) after self testing the device. It also verifies integrity of bootloader so that to avoid loading of unsigned images (custom kernel or custom recovery) for security.
/aboot (bootloader.img or aboot.mbn)
Bootloader, after initializing boot process, checks the integrity of kernel (normal boot) or recovery (recovery boot) and loads them in RAM. Unsigned kernel or recovery cannot be loaded unless bootloader is unlocked.
It also provides a minimal UI through commandline (fastboot / odin etc.) to interact with device in case of failure or to modify / flash partitions.
Manufacturers put their limitations (say of network carrier i.e. SIM lock and others) at this stage. USB protocol isn't enough and communication with bootloader to hack such restrictions require special devices (called Flashing Box or Service Box in common language), even sometimes a protocol like JTAG.
Bootloader Mode
Likewise BL, on every device there might be a single or multiple BL modes with different names like bootloader mode, fastboot mode, download mode, emergency mode (EDL), ODIN etc. Some devices have none. It's up to the discretion of mobile phone vendor.
Fastboot mode is used to perform operations through commands when device is connected to PC through USB. It works even when phone is not switched on in Recovery or ROM or even if android isn't installed on phone. You can read here what operations we can perform through fastboot mode.
When we boot in BL mode, device is stuck on boot logo or blank screen.
Download Mode
Download Mode (certain button combination while powering on device; usually Vol. Up + Vol. Down or Vol. Down for longer duration + Power) is an official way to flash factory firmware / updates using Flasher (software). Emergency Download Mode (EDL) as it's called on XIAOMI Devices, can also be accessed through fastboot or ADB commands. However, to ensure more security, EDL is disabled on some newer devices.
Download Mode is primary to bootloader mode and can be used without unlocking bootloader.
Unlocking Bootloader
Read here to know about the risks of BL unlocking.
To make any modification to OS, a critical piece of process is disabling a security system built into the Android's own application bootloader (aboot) that protects the read-only partitions from accidental (or intentional) modification. This is what's referred to as "unlocking NAND" or "unlocking bootloader." You have to firstly unlock bootloader to gain root access and to modify partitions /boot or /recovery. If bootloader is locked, you only have write access to /cache and /data partitions. Everything else is read-only on device and bootloader will prevent unsigned images from being flashed to the phone. Unlocked bootloader ignores signature verification check which was initiated by BootROM and then transferred to "sbl" and then to "aboot" while loading kernel or recovery.
Some newer devices don't allow unlocking of bootloader directly without permission from manufacturer to ensure more security. After having permission, an official method is provided to unlock BL using PC.
Bootloader or Download Mode is accessible even if device is soft bricked i.e. if Recovery and/or ROM isn't accessible.
Coming back to the booting process, bootloaders transfer control to kernel offering it with a compressed (cpio, gzipped) initramfs.
/boot(.img) - Kernel and initramfs (modern form of of ramdisk and ramfs/tmpfs)
A kernel is a layer of code that allows the OS and applications to interface with your phone's hardware. The degree to which you can access your phone's hardware features depends on the quality of code in the kernel. Several kernel code improvements give us additional features from our hardware that the stock kernel does not. When you flash a custom ROM, you automatically get a kernel. But you can also flash a standalone kernel on top of the existing one, effectively overwriting it. These days, the difference in custom kernels is less about new features and more about alternate configurations. Choosing a custom kernel is basically choosing one that works best with your ROM.
Once the kernel is loaded and extracted in RAM, it extracts compressed initramfs in rootfs (which itself is ramfs or tmpfs) and executes /init binary which subsequently reads its configuration files /init.rc and other /*.rc files written in Android specific init language. Analogous of Android's init in Linux are sysV (traditional) upstart (Ubuntu's initiative) and systemD (the latest widely accepted). With the help of kernel, init mounts pseudo filesystems /sys and /proc and populates /dev directory containing device node files. Then it mounts /system and all other partitions including /data (also decrypts it if encrypted) and sets properties and environment variables (PATH, EXTERNAL_STORAGE etc.). Additionally init also look after any hardware changes (ueventd) and started services changes (watchdog) occurring dynamically. Finally init starts the runtime located on the system partition. One of the major last processes started by init is Zygote (Java virtual machine) which compiles apps to run for specific architecture (mostly arm / arm64).
/system(.img) - ROM / OS
Contains system applications and libraries that have AOSP source code. During normal operation, this partition is mounted read-only; its contents change only during an OTA update or when flashing a new OS. Most ROM's don't allow root level (Admin rights in Windows) access by default. So, "rooting" is required to modify the contents of this partition. This is the actual User Interface we use on our phone i.e. system apps are installed on this partition on /system/app directory. Another important directory is /system/bin which contains executable binaries to perform each and every action by OS in background (as daemons) or by user in shell (bash) scripts or CLI (command line interface). These are native binaries (developed in C++ mostly) as opposed to Android apps which are developed in Java. A minimal form of Linux commands is also included in AOSP as toolbox or toybox (or user can add busybox or individual static binaries). /system/lib directory contains native libraries (shared by applications commonly) with .so extensions just like .dll on Windows.
/vendor
This partition is replaced with a shortcut (symbolic link in fact) to /system/vendor directory. It contains system applications and libraries that do not have source code available on AOSP but added by (SoC) vendor. During normal operation, this partition is mounted read-only; its contents change only during an OTA update.
/custom(.img) - also /cust or / preload on some devices, it's used by stock ROM's, holding some preloaded system apps and regional settings which are installed on first use.
/data (userdata.img)
User applications are installed in different folders under /data., Apps data (user and system) is stored in /data/data. User personal data and some apps data is stored in /data/media. Personalized and apps settings are also stored in this partition. A folder /data/dalvik contains, in simple words, extracted (compiles using Java VM called zygote on Android) apps to boost loading process.
This partition is not normally touched by the OTA update process. A Factory Reset wipes this partition, normally excluding /data/media i.e. personal data.
When you do a factory reset (AKA: wipe, hard reset, factory wipe, etc.), you are erasing the /data and /cache partitions. Note that a factory reset does NOT put your phone back to its factory state from an OS standpoint. OS upgrades will stay because the OS lives in /system, and that is not touched during a factory reset. So it's not a factory reset. It's a factory DATA reset actually.
/recovery(.img)
Holds the recovery program. It contains a second complete Linux system i.e. independent OS, including a user-interface application, kernel and the special recovery binary that reads a package and uses its contents to update i.e. flash or wipe itself or any other partition. The recovery partition can be considered as an alternative boot partition, that lets the device boot into a recovery console for performing advanced recovery and maintenance operations on it.
Recovery is the most commonly used method to flash custom ROM's.
ADB sideload mode through PC is a replacement of flashing files (usually .zip) through Recovery. ADB works when phone is switched on in Recovery (or ROM). ADB/fastboot setup is to be made on PC to use this mode.
/misc - also /FOTA on older devices
It's a tiny partition used by recovery to store away some information about what it's doing in case the device is restarted while the OTA package is being applied.
It is a boot mode selector used to pass data among various stages of the boot chain (boot into recovery mode, fastboot etc.). e.g. if it is empty (all zero), system boots normally. If it contains recovery command, system boots into recovery mode.
It may also carry some other information in form of switches to control hardware or settings related tasks.
/cache(.img) - cached (frequently accessed) data from OS usage and particularly during OTA update. Temporary holding area used by a few applications with the expectation that files can disappear at any time.
/persist - DRM related files, sensor reg file (sns.reg), wifi and bluetooth mac addresses are stored here.
/radio or /modem - the phone's radio FIRMAWARE
Also called baseband, it is responsible for signals and on older devices may control wifi, bluetooth, and GPS (on most newer devices, these are handled by the kernel and ROM). Upgrades are country dependent and may improve or diminish battery performance, network signal strength, and roaming capability. It is also sometimes required to have a minimum Baseband version to use a ROM so that the RIL will play nice with the Baseband.
This is not an android-specific partition. It is tied to the hardware of the phone, but the kernel has a code allowing Android to interact with the hardware.
Modem firmware is a mini-OS for the cellular radio chip which has its own processor. Firmware is a general term, firmware exists for a lot of things on your phone. The wireless chip for WiFi, GPS, and Bluetooth often has a firmware as can the GPU core among other things. These firmware files are usually located inside the system partition image. The modem firmware is special because it is its own separate processor so the modem firmware is left out of the system image in its own partition.
RIL/Radio Interface Layer
This is part of the ROM and is like a driver for the Radio. There is a matching RIL for each Baseband version and you can flash it to match your Baseband after flashing a ROM. Having mismatched RIL and Baseband can range from having no effect at all, slight battery drain, loss of roaming, or even no connection to the cell network. Many ROMs keep their RIL updated to the latest.
/efs, /modemst1, /modemst2, /fsg, /backup - these all are related to IMEI; a unique number used by GSM networks to identify and trace a mobile phone. /efs may contain hardware info like /persist. /efs and /modemst1 may be a single partition on some phones. /fsg and /backup are backups of /modemst1 and /modemst2 respectively. If /modemst1 or /modemst2 are erased (by factory flashing say) and phone notices an invalid partition it will copy /fsg to /modemst1 and /backup to /modemst2.
/modemst1 and /modemst2 also contains modem firmware files.
/oem - like /vendor, it incorporates OEM (Original Equipment Manufacturer i.e. hardware manufacturer or Mobile Phone brand) customization (modifications) to original Android (AOSP).
DDR, fsc, ssd (secure software download) and pad are also sub-partitions.
/splash - splash image or boot logo which appears when device boots.
/chglogo - charging screen that appears when charger is connected to powered off device.
4. Flashing ROMs:
When you flash a custom ROM, that ROM typically includes a kernel and an OS. That means the /boot and /system partitions will be modified at a minimum. Some ROMs require a clean install, so a format of the /data and /cache partitions is sometimes built into the .zip that you flash. This is essentially doing a Factory Reset.
Read here to know more about flashing partitions.
Credit - MofadalGsm
No comments:
Post a Comment