System Startup Process

System Startup Process
1. Pre-boot phase
2. Pilot phase
3. kernel Loading
4. initialize the kernel
5. User Logon
A) work in various processes of the system
Pre-boot phase
First, let's understand some basic concepts. First, we are very familiar with BIOS (Basic Input and Output Systems). BIOS is the underlying Code that deals directly with hardware. It provides the basic functions for the operating system to control hardware devices. BiOS includes the BIOS of the system BIOS (commonly referred to as the motherboard BIOS), the video card bios, and other devices (such as the IDE controller, scsicard, or Nic, the system BIOS is the main character of this article, because the Startup Process of a computer is under its control. The BIOS is generally stored in the ROM (read-only storage chip), and the Code will not disappear even after it is shut down or powers down.

The second basic concept is the memory address, which is usually installed on our machines with MB or larger memory. Each byte of the memory is assigned an address, so that the CPU can access the memory. The 32 MB address range is expressed as 0 ~ in hexadecimal notation ~ 1 ffffffh, where 0 ~ Fffffh's low-end 1 MB memory is very special, because the first 8086 processor can access a maximum of 1 MB of memory, which is known as the basic memory at the low end of 1 MB 640kb, while a0000h ~ Bffffh must be retained for the display card. c0000h ~ Fffffh is reserved for the BIOS. The system BIOS usually occupies 64kb or more space ~ At c7fffh, the BIOS of the IDE controller is in c8000h ~ Cbfffh.
Step 1: When we press the power switch, the power supply starts to power the motherboard and other devices. The voltage is not stable yet, the control chipset on the motherboard sends a reset signal to the CPU and enables the CPU to automatically return to the initial state. However, the CPU does not execute commands immediately at this moment. When the chipset detects that the power supply has begun to stabilize the power supply (of course, the process from unstable to stable is only a matter of an instant ), it removes the reset signal (if you manually press the reset button on the computer panel to restart the machine, the chipset removes the reset signal when the button is released ), the CPU immediately starts executing commands from the address ffff0h. From the previous introduction, we can see that this address is actually within the system BIOS address range, whether it is award
BiOS or AMI bios. Here, only a jump command is put to jump to the real startup code in the system BIOS.
Step 2: The first thing to do with the startup code of the system BIOS is to perform post (power-on self test, self-check after power-on ), the main task of post is to detect the existence and normal operation of some key devices in the system, such as memory and video card devices. Since post is the earliest detection process, the video card has not been initialized yet. If the system BIOS finds some fatal errors during the post process, for example, if the memory is not found or the memory is faulty (only KB of general memory will be checked at this time), the system BIOS will directly control the speaker voice to report the error, the length and number of sounds indicate the type of errors. Under normal circumstances, the post process is very fast and we can hardly feel its existence. After the post process is completed, other code will be called for more complete hardware detection.

Step 3: The system BIOS will look for the BIOS of the video card. As mentioned above, the starting address of the ROM chip storing the video card BIOS is usually located at c0000h, after the system BIOS finds the video card bios, it calls its initialization code. The video card BIOS initializes the video card. At this time, most video cards will display some initialization information on the screen, introduce the manufacturer, graphics chip type and other content, but this picture is almost a flash. The system BIOS then looks for the BIOS program of another device. After finding the program, you also need to call the initialization code in the BIOS to initialize the relevant device.

Step 4: after finding the BIOS of all other devices, the system BIOS displays its own boot screen, including the type, serial number, and version number of the system BIOS.
Step 5: The system BIOS detects and displays the CPU type and operating frequency, starts testing all ram, and displays the Memory Test Progress on the screen, we can choose to use a simple and time-consuming or detailed testing method in the CMOS settings.

Step 6: After the memory test is passed, the system BIOS will start to detect some standard hardware devices installed in the system, including hard disks, CD-Rom, serial ports, parallel ports, and soft drives, in addition, the vast majority of newer versions of the system BIOS also need to automatically detect and set the memory timing parameters, hard disk parameters and access mode.

Step 7: After the standard device is detected, the plug-and-play code in the system BIOS starts to detect and configure the plug-and-play devices installed in the system, after a device is found, the system BIOS displays the device name, model, and other information on the screen, and allocates resources such as interrupt, DMA channel, and I/O port to the device.

Step 8: by now, all hardware has been tested and configured. Most system BIOS will be refreshed and a table is displayed on the top of the screen, it roughly lists the various standard hardware devices installed in the system, the resources they use, and some related working parameters.

Step 9: The system BIOS will update the escd (extended system configuration data, extended system configuration data ). The escd is a means for the system BIOS to exchange hardware configuration information with the operating system. The data is stored in CMOS (a small block of special ram, powered by a battery on the motherboard.
Generally, the escd data is updated only after the hardware configuration of the system is changed. Therefore, we do not see "Update escd... Success ", however, the BIOS of some motherboard uses a different data format than that of windows when saving escd data, therefore, Windows will change the escd data to its own format during its own startup, but even if the hardware configuration does not change during the next startup, the system BIOS will also change the escd data format back, so that the loop will cause the system BIOS to update the escd every time the machine is started, this is why some machines will display relevant information each time they are started.

Step 10: After the escd is updated, the startup code of the system BIOS performs its last task, that is, starting from a floppy disk, hard disk, or optical drive according to the boot sequence specified by the user.
Step 2: Take starting from a hard disk as an example,
1. The system BIOS loads the first physical sector of the disk to the memory, reads and executes the MBR in the first physical sector of the hard disk.
2. Control the system to MBR.
3. After the MBR is run, search for the partition table in the MBR and find the starting position of the active partition.
4. MBR loads the Boot Sector-Partition Boot Record in the first sector of the active partition into the memory.
5. MBR checks whether the currently used file system is available.
Step 1: load the system starter (Windows loader) with the Master Boot Record)
1. Find the ntldr file in MBR, initialize the ntldr file, and start it-the initiator of the NT kernel Operating System (Windows loader ). [I] Note: Win98 boot is in this phase. If only the Win98 system is installed on the hard disk, partition Boot records of Win98 that have been loaded (unlike the Operating System Based on the NT kernel such as Win2k, the system Starter of DOS and Win9x -- Windows loader is the Partition Boot Record) read and execute Io. sys, which is the most basic system file for DOS and Windows 9X. Windows 9x Io. sys first needs to initialize some important system data, and then shows the familiar blue sky and white clouds. In this picture, Windows will continue to perform dos and Gui (graphic user interface) partial boot and initialization work. [/I]
2. MBR transfers control to ntldr, and ntldr continues to start the operating system.
MBR (Master Boot Record)-The Master Boot Record, which is located in the first sector of the boot disk. It mainly contains Boot Code and partition table data. The guiding code is mainly used to guide the system. Partition tables are mainly used to identify basic partitions and extended partitions.
This entire process is the various initialization work that the computer will complete when the power switch (or press the reset key) is turned on for cold start, if we press CTRL + ALT + DEL in DOS to perform Hot Start (or restart the computer from Windows), the post process will jump over and start directly from step 3, in addition, the CPU and memory test in step 5 will not be performed. We can see that both cold start and hot start, the system BIOS repeats these things that we do not pay too much attention to at ordinary times, however, it is these monotonous hardware detection steps that provide us with the Foundation for normal use of computers.
Guiding phase (take the XP system as an example, 2000 and 2003 are roughly the same)
During the boot phase, Windows XP will go through four phases in sequence: initial Boot Loader phase, operating system selection phase, hardware detection phase, and configuration selection phase.
Initial Boot Loader stage
1. Set the memory usage mode: In the initial Boot Loader phase, ntldr converts the computer's microprocessor from the real mode to the 32-bit flat memory mode for the Windows NT System.
For x86cpu-based computers, the so-called real mode is always entered during the first startup ). Some features of the CPU in real mode cannot be fully utilized, because it must be compatible with 8-bit or 16-bit CPUs (such as 8086 and 8088. At this time, the system will reserve a 640kb memory space for a 16-bit system like MS-DOS or win 9x, and the rest of the memory is seen as extended memory.
In real-world mode, due to system specification restrictions, large-capacity memory cannot be directly accessed, but must be completed in segments. For 32-bit Windows NT systems, 8-bit or 16-bit CPUs are obviously useless. For a 32-bit Windows NT, ntldr first switches the CPU to the 32-Bit mode to ensure the normal operation of Windows XP, and then sets the 32-bit flat memory mode for CPU running.
In 32-bit CPU mode, large-capacity memory can be directly accessed, and all memory can be considered as available memory, however, it completely discards the inconvenience of block-based memory access in the original 8-bit or 16-Bit mode. This is why the 32-Bit mode is called flat memory mode.
2. Start the file system: ntldr executes the appropriate small file system driver (ntldr contains the corresponding code to help Windows XP complete the read and write of the NTFS or fat format disk. To read, access, and copy files .), At this time, ntldr can identify every file system partition in NTFS or fat format, and the initial Boot Loader stage ends.
Upload at, 2011-9-26

Download Attachment
(9.05 KB)

Operating system selection stage
After the initial Boot Loader stage ends, the operating system is selected. ntldr searches for and loads the boot. ini file in the root directory of the active partition. (Oh, Here I paste the boot. ini on my machine. The Boot. ini in the collected information is only one item in XP, So I paste it to o0_0o for more information)

My boot. ini contains the following content:
[Boot loader]
Timeout = 5
Default = multi (0) disk (0) RDISK (0) Partition (4) \ WINDOWS
[Operating systems]
Multi (0) disk (0) RDISK (0) Partition (4) \ Windows = "Windows XP Media Center edition"/noexecute = optin/fastdetect
Multi (0) disk (0) RDISK (0) Partition (3) \ WINNT = "Microsoft Windows 2000 Advanced Server"/fastdetect
C: \ bootsect. Dos = "Windows 98 SE"
C: \ chain0 = "Mac OS X 86 PC"
C: \ ghldr = "one-click ghost v2006.03.12"
Here, multi (0) indicates the disk controller, disk (0) RDISK (0) indicates the disk, and partition (x) indicates the partition. Ntldr is used to find the location of the system files of Windows XP Professional. (* This article will not explain in detail the structure of boot. ini, because it has little to do with this topic. If you want to know, you can go to some special websites to query relevant information .)
If more than one operating system (that is, multiple systems) is installed on the computer, and the boot is correctly set. INI, boot. the INI file contains two or more startup options. If there is only one operating system. there is only one operating system startup option in the INI file. When there is only one startup option in Boot. ini or the timeout value is 0, no menu screen for selecting the operating system will appear. Otherwise ntldr will boot. all startup items in ini are displayed on the screen. This requires you to select the multi-OS boot menu for the operating system. In this case, ntldr suspends the system boot and follows the boot command. the time-out value in the INI file starts to read in seconds, waiting for the user to select a startup option until it times out. The timeout value is determined by boot. ini.
Set the timeout value.
After the second-time reading times out, ntldr reads the information after default in Boot. ini and obtains the path of the Windows directory corresponding to the default startup Item to execute the subsequent startup process.
After selecting the OS to be started, ntldr reads the location information of the corresponding startup Item in Boot. ini and obtains the path of the Windows directory corresponding to the startup Item to execute the subsequent startup process.
If the selected startup option is an NT kernel system, ntldr will load the ntdetect. com file running in the same directory.
If you choose to start an old Microsoft operating system, such as MS-DOS and Windows 9x/Me, ntldr will follow the boot. the information of this startup Item in INI is loaded with bootsect. dos, then ntldr will start from bootsect. read the MBR code in the DOS file, and give the control to bootsect. MBR (bootsect. DOS is generated by the installation program of the NT kernel operating system by reading the Partition Boot records of the DOS or Win9x System in the active partition when installing the operating system ).
If another operating system is selected, ntldr loads the boot item according to the boot configuration in Boot. ini (for example, c: \ chain0 in my boot. ini file)
If the boot. ini file is invalid or does not exist, ntldr tries to start the system from the default system volume.
Note
Here I will explain my boot. ini. C: \ bootsect. Dos = "Windows 98 SE", everyone knows! C: \ chain0 = "Mac OS X 86 PC", which is the apple tiger 10.4.5 operating system installed on my host. chain0 is like the bootsect mentioned above. like Dos, it is also a boot dump file. C: \ ghldr = "one-click ghost v2006.03.12", "one-click recovery ghost" of the installed dos home. Like above, ghldr is also a pilot startup dump file of this tool. Here, you should understand a little bit?
For example, if you have installed Linux, use the tool to make the Linux boot sector record into a dump file, place it in the root directory of the partition where ntldr is located, and then in Boot. add the corresponding startup Item in ini, and select this option in the Multi-boot menu of the boot. Like ntldr, Linux can be started successfully.
My first partition is an active partition (primary partition) with 98 installed. The second partition is a primary partition in MAC format and installed with Mac tiger 10.4.5; 2000 Advanced Server is installed in the first logical partition in the extended partition; XP Media Center edition is installed in the second logical partition in the extended partition.
In fact, there are many boot programs, but we often use Windows loader. Grub is commonly used in Linux, and other common third-party tools include system commander and bootmanager bootstar.
Note:
1. After ntldr is started, if hiberfil is found in the root directory of the system. if the Sys File is valid, ntldr reads hiberfil. information in the SYS file and restore the system to the state before hibernation. At this time, boot is not processed. INI file. The hiberfil. SYS file is a memory dump file generated when the XP system enables sleep.
2. bootsect. Dos: OS or Windows 9x system startup sector dump file. The file is created by the Windows NT installer, generally 512 bytes.
3. Windows NT operating system: it refers to the operating system developed on Windows NT operating system. Currently, the mainstream operating systems include Windows 2000, Windows XP, and Windows Server 2003.
4. ntldr compatibility: ntldr provides downward compatibility. A later version of ntldr can start a later version of Windows NT. Currently, the latest ntldr version is included in Windows Server 2003. Therefore, when installing multiple systems, you must follow the order of versions from low to high. For example, after XP is installed, and will use their own ntldr to overwrite the existing XP ntldr, in this case, XP cannot start -- 2000 ntldr cannot boot XP and systems later than XP.
5. from Windows XP with Service Pack 2, the operating system installer detects ntldr and ntdetect in the active partition on the hard disk during installation. com version. If you find that the current version is newer than the version on the installation source, the current version is used instead of the version on the installation source.
Hardware phase
If you choose to start the NT kernel operating system, the hardware detection phase starts after the ntdetect. com file is loaded.
After the boot. ini file is processed, ntldr starts the ntdetect.com program. In x86 systems, ntdetect.com collects installed hardware information by calling the system firmware program. ntdetect.com then lists the collected computer hardware information and returns the list to ntldr. In this way, you can add the hardware information to the hardware in the Registry HKEY_LOCAL_MACHINE.
Ntdetect.com collects the following types of hardware information:
& System firmware information, such as time and date
& Type of bus adapter
& Graphics adapter type
& Keyboard
& Communication Port
& Disk
& Floppy disk
& Enter a device, such as a mouse
& Parallel Port
& ISA device installed in the ISA slot
Configuration selection phase
After the hardware detection is complete, enter the configuration selection stage. Ntldr obtains the hardware configuration file in the system. If the computer contains a list of multiple hardware configuration files, you can click the up or down button to select. If there is only one hardware configuration file, the computer does not display this screen and directly uses the local configuration file named "program ntoskrnl.exe"-Windows XP kernel. Hardware Detection and configuration completion
So far, the entire boot phase has ended.
In the boot phase, the system will use a total of Files: ntldr, boot.ini, ntdetect.com, ntokrnl.exe, ntbootdd. sys, bootsect. DOS (optional, if any), these files are stored in the root directory of the active partition by default.
Note: If you press F8 at startup, you will see a variety of startup modes in the Startup menu. At this time, ntldr will use the startup parameters to load the NT kernel based on your selections, you can also. set the startup parameters in the INI file.
Kernel loading stage
Ntldr obtains the information sent from ntdetect.com, organizes the information into an internal structure, and then runs the ntldr Kernel Program-Windows XP kernel.
1. Load the internal kernel (ntoskrnl.exe) and Hardware Abstraction Layer (Hal. dll) to the memory.
In the internal kernel stage, ntldr.exe is called ntokrnl.exe, but it is not initialized. Then, ntldr loads the hardware abstraction layer (Hal, Hal. dll ).
2. Load Control Set Information
In this process, ntldr reads the select key from the HKEY_LOCAL_MACHINE \ SYSTEM position in the registry to determine which control set information will be loaded, and determine the device driver to be loaded during the startup process. The control set contains the driver of the device and the services to be loaded.
3. load device drivers and services
In this step, the system starts to load the device driver and services with the help of BIOS.
Device Driver. ntldr will load the underlying device driver with the START key value of 0 under HKEY_LOCAL_MACHINE \ SYSTEM \ service.
When the current control set of the image used as the control set is loaded, ntldr will pass the control to the Windows XP kernel ntoskrnl. EXE.
The kernel loading stage ends, followed by the kernel initialization stage.
Initialize the kernel
At the beginning of the kernel initialization stage, the color Windows XP logo and progress bar are displayed in the center of the screen. At this stage, the system has completed the following four tasks:
1. the kernel uses the data collected during hardware detection to create the HKEY_LOCAL_MACHINE \ hardware key.
2. the kernel creates the clone control set by referencing the default value of HKEY_LOCAL_MACHINE \ SYSTEM \ current. The clone control set configuration is a backup of computer data, and does not include changes during startup.

3. system initialization and Device Driver Loading
The kernel initializes the underlying drivers that are loaded during kernel loading, and then the kernel scans the device drivers with the START key value of 1 under HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ service. These device drivers are initialized when they are loaded. If an error occurs, the kernel uses the errorcontrol key value to determine how to handle the problem.
When the START key value is 3, the error is marked as crisis/critical. When the system encounters an error for the first time, it restarts with lastknowngood control set. If it is started with lastknowngood control set, an error still occurs, the system reports that startup failed. The error message is displayed and the system stops the startup;
If the value is 2, the error is serious. The system fails to start and restarts with lastknowngood control set. If the system is already started with the value of lastknowngood, the system ignores the error and continues to start;
When the value is 1, the error is normal. The system will generate an error message, but it will still ignore this error and continue to start; when the value is 0, it will be ignored, the system does not display any error information and continues running.
4. Start Session Manager
The kernel starts Session Manager (Session manager.exe), which is a program named smss.exe. Its function is as follows:
(1) Create System Environment Variables
(2) create a virtual memory page file
(3) started the Windows XP advanced subsystem and services
(4) control all input and output devices and Win32 sub-systems for accessing the display screen
Kernel Initialization is complete.
User Logon phase
In this process, Windows sub-system starts winlogon.exe, which is a system service used to support logon and logout of Windows users. Winlogon.exe can do the following:

1、start the service subsystem (services.exe), also known as Service Control Manager (SCM ).
2. Start local security authorization (lsa)process (lsass.exe), and display the Windows XP Professional welcome screen or Login Dialog Box. At this time, the system may still initialize the driver that has not been completed in the background.

3. analyze and process the crtl + ALT + DEL key combination when you start the logon prompt.
4. Call a graphical identification and authentication component to prompt you to enter a valid user name or password, collect the user's account and password, and then securely transmit the information to LSA for authentication. If the information provided by the user is correct and passes authentication, the user is allowed to access the system. Then, the user successfully logs on to the operating system.
Note that if you only have the administrator user on your computer, the administrator user item will be displayed on the welcome screen. If your computer has not only administrator users, but also other users who can log on to the computer, you are welcome to display only users other than administrator, rather than administrator users.

What if you want to log on as an administrator user? The actual situation is very simple. Press the crtl + ALT + DEL key combination twice on the welcome screen to open the standard Logon window, and then enter the administrator user name and password, to log on as the highest administrator.
B service controller final execution and Scanning
HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ servives to check whether there are services to be loaded. Service controller searches for services with the START key value of 2 or higher, the service is loaded according to the value of START and the value of dependongroup and depandonservice.
Plug-and-play device detection process
The plug-and-play device detection is actually asynchronous with the login process. The system firmware, hardware, device drivers, and system features determine how Windows XP detects and enumerates new devices. When the plug-and-play component works properly, Windows XP detects new devices, allocates system resources to them, and does not provide users with a selection whenever possible, install a proper driver version for the new device.
Startup complete
The startup of Windows XP is considered complete only after the user successfully logs on to the computer. After Successful Logon, the system copies the clone control set to the lastknowngood control set. After this step is completed, the system is successful.