In computing, rebooting is the process by which a running computer system is restarted, either intentionally or unintentionally. Reboots can be either a cold reboot (alternatively known as a hard reboot) in which the power to the system is physically turned off and back on again (causing an initial boot of the machine); or a warm reboot (or soft reboot) in which the system restarts while still powered up. The term restart (as a system command) is used to refer to a reboot when the operating system closes all programs and finalizes all pending input and output operations before initiating a soft reboot.
Terminology
Etymology
Early electronic computers (like the IBM 1401) had no operating system and little internal memory. The input was often a stack of punch cards or via a Switch Register. On systems with cards, the computer was initiated by pressing a start button that performed a single command - "read a card". This first card then instructed the machine to read more cards that eventually loaded a user program. This process was likened to an old saying, "picking yourself up by the bootstraps", referring to a horseman who lifts himself off the ground by pulling on the straps of his boots. This set of initiating punch cards was called "bootstrap cards". Thus a cold start was called booting the computer up. If the computer crashed, it was rebooted. The boot reference carried over to all subsequent types of computers.
Cold versus warm reboot
For IBM PC compatible computers, a cold boot is a boot process in which the computer starts from a powerless state, in which the system performs a power-on self-test (POST). Both the operating system and third-party software can initiate a cold boot; the restart command in Windows 9x initiates a cold reboot, unless Shift key is held.
A 'warm boot is initiated by the BIOS, either as a result of the Control-Alt-Delete key combination or directly through BIOS interrupt INT 19h. It does not perform a POST. Malware may prevent or subvert a warm boot by intercepting the Ctrl + Alt + Delete key combination and prevent it from reaching BIOS. The Windows NT family of operating systems also does the same and reserves the key combination for its own use.
The Linux family of operating systems supports an alternative to warm boot; the Linux kernel has optional support for kexec, a system call which transfers execution to a new kernel and skips hardware or firmware reset. The entire process occurs independently of the system firmware. The kernel being executed does not have to be a Linux kernel.
Outside the domain of IBM PC compatible computers, the types of boot may not be as clear. According to Sue Loh of Windows CE Base Team, Windows CE devices support three types of boots: Warm, cold and clean. A warm boot discards program memory. A cold boot additionally discards storage memory (also known as the "object store"), while a clean boot erases all forms of memory storage from the device. However, since these areas do not exist on all Windows CE devices, users are only concerned with two forms of reboot: one that resets the volatile memory and one that wipes the device clean and restores factory settings. For example, for a Windows Mobile 5.0 device, the former is a cold boot and the latter is a clean boot.
Hard reboot
A hard reboot means that the system is not shut down in an orderly
manner, skipping file system synchronisation and other activities that
would occur on an orderly shutdown. This can be achieved by either
applying a reset, by cycling power, by issuing the halt -q command in most Unix-like systems, or by triggering a kernel panic.
Hard reboots are used in the cold boot attack.
Restart
The term "restart" is used by the Microsoft Windows and Linux families of operating systems to denote an operating system-assisted reboot. In a restart, the operating system ensures that all pending I/O operations are gracefully ended before commencing a reboot.
Causes
Deliberate
.jpg)
Users may deliberately initiate a reboot. Rationale for such action may include:
- Troubleshooting: Rebooting may be used by users, support staff or system administrators as a technique to work around bugs in software, for example memory leaks or processes that hog resources to the detriment of the overall system, or to terminate malware. While this approach does not address the root cause of the issue, resetting a system back to a good, known state may allow it to be used again for some period until the issue next occurs.
- Switching operating systems: On a multi-boot system without a hypervisor, a reboot is required to switch between installed operating systems.
- Offensive: As stated earlier, components lose power during a cold reboot; therefore, components such as RAM that require power lose the data they hold. However, in a cold boot attack, special configurations may allow for part of the system state, like a RAM disk, to be preserved through the reboot.
The means of performing a deliberate reboot also vary and may include:
- Manual, hardware-based: A power switch or reset button can cause the system to reboot. Doing so, however, may cause the loss of all unsaved data.
- Manual, software-based: Computer software and operating system can trigger a reboot as well; more specifically, Microsoft Windows operating systems are outfitted with a restart command that closes open programs and eliminates data loss due to reboot.
- Automated: Software can be scheduled to run at a certain time and date; therefore, it is possible to schedule a reboot.
Power failure
Unexpected loss of power for any reason (including power outage, power supply failure or depletion of battery on a mobile device) forces the system user to perform a cold boot once the power is restored. Some BIOSes have an option to automatically boot the system after a power failure. An uninterruptible power supply (UPS), backup battery or redundant power supply can prevent such circumstances.
Random reboot
"Random reboot" is a non-technical term referring to an unintended (and often undesired) reboot following a system crash, whose root cause may not immediately be evident to the user. Such crashes may occur due to a multitude of software and hardware problems, such as triple faults. They are generally symptomatic of an error in ring 0 that is not trapped by an error handler in an operating system or a hardware-triggered non-maskable interrupt.
Systems may be configured to reboot automatically after a power failure, or a fatal system error or kernel panic. The method by which this is done varies depending on whether the reboot can be handled via software or must be handled at the firmware or hardware level. Operating systems in the Windows NT family (from Windows NT 3.1 through Windows 7) have an option to modify the behavior of the error handler so that a computer immediately restarts rather than displaying a Blue Screen of Death (BSOD) error message. This option is enabled by default in some editions.
Hibernation
The introduction of advanced power management allowed operating systems greater control of hardware power management features. With Advanced Configuration and Power Interface (ACPI), newer operating systems are able to manage different power states and thereby sleep and/or hibernate. While hibernation also involves turning a system off then subsequently back on again, the operating system does not start from scratch, thereby differentiating this process from rebooting.
Simulated reboot
A reboot may be simulated by software running on an operating system. For example: the Sysinternals BlueScreen utility, which is used for pranking; or some modes of the bsod XScreenSaver "hack", for entertainment (albeit possibly concerning at first glance). Malware may also simulate a reboot, and thereby deceive a computer user for some nefarious purpose.
Microsoft App-V sequencing tool captures all the file system operations of an installer in order to create a virtualized software package for users. As part of the sequencing process, it will detect when an installer requires a reboot, interrupt the triggered reboot, and instead simulate the required reboot by restarting services and loading/unloading libraries.
