Windows98 and XP boot process

First, Windows98

The first step: when we press the power switch, the power supply began to power the motherboard and other equipment, at this time the voltage is not stable, the motherboard control chipset will be issued to the CPU and maintain a reset (reset) signal, let the CPU initialization. When the power supply starts to stabilize the power supply (of course, from unstable to stable process is only a brief moment), the chipset will remove the reset signal (if it is manually press the reset button on the computer panel to restart the machine, then the chipset will remove the reset signal when the button is released), the CPU Immediately start the execution of the instructions from the address ffff0h, which is in the address range of the system BIOS, whether it's a award BIOS or an AMI bios, just a jump command to jump to the real boot code in the system BIOS.

The second step: the system BIOS boot code First thing to do is to post (power On Self test, the self-test), the main task of post is to detect the existence of some key devices in the system and can work properly, such as memory and graphics. Since Post's detection process is preceded by a display card initialization, it is not visible on the screen if a fatal error is found in the post self-test, if no memory is found or if there is a memory problem (the Post procedure checks only 640K conventional memory). In this case, the system PIOs can be audible to the speaker to report error conditions, the length and number of sounds represent the wrong type. Under normal circumstances, the post process went very fast and we could hardly feel the process.

Step three: The next system Biso will look for the BIOS of the display card, the initial address of the ROM chip that holds the BIOS of the display card is usually at c0000h, the system BIOS calls its initialization code after it finds the video card bios, and the video card BIOS is used to complete the initialization of the display cards. Most display cards in this process usually display some information about the cards on the screen, such as manufacturers, graphics chip types, video memory capacity, and so on, this is the first screen we see, but this screen is almost a flash, but also some graphics card bios using the delay function, So that the user can see the displayed information. The system BIOS then looks for the BIOS program for the other device, and after that, the initialization code inside the BIOS will be invoked to initialize the devices.

Step Fourth: After you find the BIOS for all other devices, the system BIOS displays its own splash screen, which includes the type, serial number, and version number of the system BIOS. The motherboard information code will appear at the bottom left corner of the screen, including the date of the BIOS, the motherboard chipset model, the identification code of the motherboard, and the vendor code.

Fifth: Then the system BIOS will detect the type of CPU and operating frequency, and the test results displayed on the screen, this is the CPU type and frequency that we see on the boot. The system BIOS then begins to test all the memory capacity of the host and displays the value of the memory test on the screen at the same time, which is the fast-moving memory counter that is familiar to the upper half of the screen. This process allows us to select a less time-consuming "fast detection" or a more time-consuming "full detection" approach in the BIOS setup.

Sixth step: After the memory test passes, the system BIOS will begin to detect some of the standard hardware devices installed in the system, including: Hard disk, CD-ROM, floppy drive, serial interface and parallel interface and other connected devices. In addition, most new versions of the system BIOS in this process also need to automatically detect and set the memory timing parameters, hard disk parameters and access mode.

Seventh step: After the standard equipment has been detected, the system BIOS support Plug and Play code will begin to detect and configure the Plug and Play devices installed in the system, every time a device is found, the system BIOS will display the device name and model information on the screen, and assign interrupts, DMA channels and i/to the device. O Port and other resources.

Eighth step: By the end of this step, all hardware has been detected and configured, the system BIOS will clear the screen and display a list of system configuration above the screen, which outlines the various standard hardware devices installed in the system, as well as the resources they use and some related working parameters.

Step Nineth: Press down the system BIOS will update ESCD (Extended system Configuration data, extending the configuration of systems). ESCD is the data that the system BIOS uses to Exchange hardware configuration information with the operating system, which is stored in a CMOS (a small piece of special ram, powered by a battery on the motherboard). Usually ESCD data is updated only after the system hardware configuration has changed, so we are not able to see update ESCD every time the machine is started. Success, however, the system BIOS for some motherboards uses data formats that are not the same as Windows 9x when saving ESCD data, so Windows 9x converts the ESCD data into its own format during its own startup, but the next time the machine is started, Even if the hardware configuration does not change, the system BIOS will change the ESCD data format back, so the cycle, will cause every time the machine is started, the system BIOS will be updated ESCD, which is why some computers at each boot will show "Update ESCD ... Success "The reason for the information.

Tenth step: After the ESCD data is updated, the system BIOS boot code will do its last job, that is, boot from a floppy disk, hard disk, or optical drive according to the user-specified boot sequence. For example, starting with the C disk, the system BIOS reads and executes the master boot record on the hard disk, the master boot record then finds the first active partition from the partition table, and then reads and executes the partition boot record for this active partition, and the partition boot record reads and executes Io.sys, which is DOS and Windows 9x the most basic system files. Windows 9x Io.sys First initializes some important system data and then displays our familiar blue sky and white clouds, under which Windows will continue to boot and initialize the DOS section and GUI (graphical user interface) section. If the system is equipped with tool software that guides a variety of operating systems, typically, the master boot record will be replaced with the boot code for the software, which will allow the user to select an operating system and then read and execute the operating system's basic boot code (DOS and Windows basic boot code is the partition boot record).

The above is the computer in turn on the power switch (or press reset key) to do a cold start to complete the various initialization work, if we in DOS Press CTRL +alt+del key combination (or select the computer from Windows) to the hot boot, then the post process will be skipped , starting with step three, and the fifth step of testing the CPU and memory test will not be done. Whether it's a cold start or a hot boot, the system BIOS will repeat the hardware detection and boot process, which ensures that we can start and use the computer normally.

Second, Windows XP

Pre-boot phase
When we turn on the computer, the pre boot process starts running. In this process, the computer hardware first completes the Power self-test (power-on self test,post), which detects the hardware of the processor, memory, and so on that is installed in the computer, and continues the following procedure if everything is OK.
If your computer BIOS (some of the programs that are in the chip on your computer's motherboard) supports Plug and Play (basically, computers and hardware that can be purchased at this stage are supported by this standard, and all hardware devices are automatically identified and configured, and the computer will then locate the boot device (for example, the first hard drive , the boot order of the device can be modified in the computer's BIOS setup, and the Master boot record (master boot record,mbr) is read and run from the boot device. At this point, the pre-boot phase completes successfully.

Boot Phase
The boot phase can be divided into: initialization boot loader, operating system selection, hardware detection, hardware configuration file selection of the four steps. The files that need to be used in this process include: Ntldr, Boot.ini, Ntdetect.com, Ntoskrnl.exe, Ntbootdd.sys, Bootsect.dos (not required).
Initializing boot loader
At this stage, the first exit is NTLDR, which switches the processor from real mode to 32-bit flat memory mode (32-bit Flat Memory mode). The main reason for not using real mode is that in real mode, the first 640 KB in memory is reserved for MS-DOS, while the remaining memory is used as extended memory so that Windows XP will not be able to use all of the physical memory. and 32-bit flat memory mode is much better, Windows XP itself will be able to use all the memory installed on the computer (in fact, can only use up to 2 GB, this is a 32-bit operating system design defects.) The problem with large memory is that it is not related to the content of this article, so there is no chance of writing it separately in the future.

Next, NTLDR will look for a miniature file system drive from the system. As you know, DOS and Windows 9x operating systems are unable to read and write to NTFS file system partitions, so why does Windows XP installer read and write to NTFS partitions. In fact, this is the micro-file system driven by the credit. Only after this driver is loaded can NTLDR find the partition on your hard disk that is formatted as NTFS or FAT/FAT32 file system. If this drive is damaged, even if there are partitions on your hard drive, NTLDR will not recognize it.

After reading the file system driver and successfully locating the partitions on the hard drive, the boot loader initialization process is complete, and then we proceed to the next step.
Operating System Selection
This step is not necessary and will only appear if you have more than one Windows operating system installed on your computer. However, regardless of how many windows are installed on your computer, this step is run as designed by the computer during startup, and only when you do have multiple systems installed will the system display a list that allows you to select the system you want to boot. But if you have only one system, the bootstrapper will go straight to the next stage after you have judged it.

If you already have more than one Windows operating system installed (which generally refers to newer systems such as Windows 2000/xp/2003, excluding Windows 9x systems), all records are saved in a file named Boot.ini in the system's packing directory. The NTLDR program reads the Boot.ini file from the hard disk after the initialization is completed, and according to its contents, installs several Windows on the computer, which are installed on the first partition of the first few hard drives. If only one is installed, skip this step directly. However, if more than one is installed, NTLDR displays an operating system selection list based on the records in the file and lasts 30 seconds by default. As soon as you make a choice, NTLDR will automatically start loading the selected system. If you do not have a choice, the NTLDR will start loading the default operating system after 30 seconds. This step of the operating system selection has been completed successfully.

Small knowledge: What is the difference between the system disk and the boot disk (boot Volume)? Volume
This is two very easy to confuse concept, because according to Microsoft's definition of these two nouns, it is easy to misleading. According to Microsoft's definition, the system disk refers to the files that have been saved for booting Windows (as we have already made clear, these files refer to the hard disk partitions/volumes of NTLDR, Boot.ini, etc.), and the boot disk is the hard disk partition/volume that holds the Windows system files. If there is only one operating system, we usually install it on the first primary partition of the first physical hard disk (usually recognized as C disk), then the system disk and boot disk belong to the same partition. However, if you install your Windows to a different partition, for example, in D, the system disk is still your C disk (because although Windows is installed to a different disk, the files used by the boot system will still be saved in the root of C disk), but your boot disk will turn into a D disk. Oddly enough, the partition that holds the required files for the boot system is called the "system disk," and instead the partition that holds the operating system file is called the "boot Disk", just upside down. But that's what Microsoft does.
Hardware detection
In this process, the main need to use Ntdetect.com and NTLDR. After we selected the Windows system we wanted to load in the previous operating system selection phase, Ntdetect.com first gather all the hardware information that is installed on the current computer, and then hand it to NTLDR (the table's information is later used to create the key to the hardware in the registry). The types of hardware that need to be collected here include: Bus/adapter Type, video card, communication port, serial port, floating-point operator (CPU), Removable Storage, keyboard, indicator (mouse). At this point, the hardware detection operation has completed successfully.
Configuration file Selection
This step is also not necessary. This step is only required when multiple hardware profiles are created in a computer (often used in a portable computer).

Little knowledge: What is a hardware profile. Why do you use it?
This feature is more suitable for notebook users. If you have a laptop that is primarily used in your office and home, you may use a network card to connect it to your company's local area network when you are in the office, and the company uses a DHCP server to assign IP addresses to clients, but when you get home, you don't have a DHCP server. When you start the system, it will take a long time to find the Non-existent DHCP server, which will prolong the system startup time. In this case, you can use different hardware profiles in your office and home, and we can decide which hardware to use in a profile and what hardware to use in a configuration file. For example, we can create separate profiles for laptops at home and in the office, and the network card will be disabled in the home configuration file. In this way, the home after the use of the configuration file, the system will be started to disable the network card directly, but also to avoid looking for a non-existent DHCP server to extend the system start time.

If NTLDR detects that multiple hardware profiles have been created in the system, it will then display all available profile lists for users to choose from. In fact, this is similar to the choice of operating system, regardless of whether there are many configuration files in the system, NTLDR will do this step, but only if you do detect multiple hardware profiles will display the file list.
Load Kernel phase
At this stage, NTLDR will load the Windows XP kernel file: Ntoskrnl.exe, but this is only loaded and the kernel is not initialized at this time. The hardware abstraction layer (Hal.dll) is then loaded.

The hardware abstraction layer is actually a program running in memory, a program that bridges the Windows XP kernel and the physical hardware. Normally, operating systems and applications cannot deal directly with physical hardware, only the Windows kernel and a few kernel-mode system services can interact directly with the hardware. Most other system services and applications, if they want to interact with the hardware, must be done through the hardware abstraction layer.

Small knowledge: Why use the hardware abstraction layer
The hardware abstraction layer is used for two main reasons: 1, ignoring invalid or even faulty hardware calls. Without a hardware abstraction layer, any calls or even errors that occur on the hardware will be fed back to the operating system, which may cause the system to become unstable. The hardware abstraction layer, like a filter that works between the physical hardware and the operating system kernel, filters out all calls and errors that can be considered harmful to the operating system, thus directly improving the stability of the system; 2. Translation between multiple platforms. This can be cited as an example of an image where each physical hardware uses a different language, and each operating system component or application uses the same language, and communication between different physical hardware and systems can be confusing and inefficient. If you have a hardware abstraction layer, it is equal to a translation between the software and hardware, the translator understands all the hardware language and will convey the hardware words to the operating system or software in a language that can be understood by systems or software. Through this mechanism, the support of the operating system to hardware can be greatly improved.

After the hardware abstraction layer is loaded, the Hkey_local_machine/system registry key is then loaded into the kernel. NTLDR determines which control set registry keys are to be loaded according to the contents of the loaded Select key (Figure 2), which determines which device drivers will then be loaded and which services are started. When the contents of these registry keys are loaded, the system will enter the initialization kernel phase, at which point Ntldr will give control of the system to the operating system kernel.


Initializing kernel phase
When you enter this stage, the Windows XP logo is displayed on the computer screen, and a scrolling progress bar is displayed, which may scroll several loops (Figure 3). From this step we can get a visual impression from the start of the screen Team System. These four tasks are primarily accomplished during this phase: creating the Hardware registry key, copying the control set registry key, loading and initializing device drivers, and starting the service.


Create hardware registry keys
To first create the hardware key in the registry, the Windows kernel uses the hardware information gathered in the previous hardware detection phase to create the Hkey_local_machine/hardware key, which means that the contents of the key in the registry are not fixed. Instead, it is updated dynamically based on the hardware configuration in the current system.
Copying the control Set registry key
If the hardware registry key is created successfully, the system kernel creates a backup of the contents of the control set key. This backup will be used for the "Last Known Good Configuration" option in the advanced Boot menu of the system. For example, if we install a new video card driver, the system has crashed after the hardware registry key has not been created after restarting the system, and if the last Known Good Configuration option is selected, the system will automatically use the previous control The backup content of the Set registry key regenerates the hardware key so that you can undo the changes that were made to the system by installing a new video card driver.
Load and initialize device drivers
In this phase, the operating system kernel first initializes the underlying device drivers that were loaded in the kernel phase before loading, and then the kernel hkey_local_machine/system/currentcontrolset/the registry The Services key finds all device drivers with the start key value of "1" (Figure 4). These device drivers will be initialized immediately after loading, and if any errors occur in this process, the system kernel will automatically be processed according to the value of the device-driven "ErrorControl" key. The "ErrorControl" key has a total of four key values, each with the following meanings:

0, ignore, continue booting, do not display error messages.
1, normal, continue booting, display error message.
2, resume, stop booting, and reboot the system with the last Known Good Configuration option. This error is ignored if there is still an error.
3, critical, stop booting, reboot the system with the last Known Good Configuration option. If the error persists, the boot is stopped and an error message is displayed.


Start a service
Once the system kernel is successfully loaded and all of the underlying device drivers are successfully initialized, the session Manager starts to start the high-level subsystem and service and then initiates the WIN32 subsystem. The role of the WIN32 subsystem is to control all input/output devices and access display devices. When all of this is done, the graphical interface of Windows can be displayed, and we will also be able to use the keyboard and other I/O devices.

The session manager then starts the Winlogon process, so that the initialization kernel phase has completed successfully, and the user can begin logging in.
Logon phase
At this stage, the Winlogon.exe process, initiated by the session manager, will start the Local Security Authority (Authority,lsass.exe) subsystem. After this step, the Windows XP Welcome interface (Figure 5) or the login interface will be displayed, which is where you can successfully log in. At the same time, however, the startup of the system has not been completely completed, and the background may still be loading some non-critical device drivers.



The system then scans the Hkey_local_machine/system/currentcontrolset/services registry key again (remember that the first scan was done at the start of the step). And look for all the start keys with a value of "2" or a larger number of services. These services are non-critical services, and the system does not start loading these services until the user successfully logs on.

Little knowledge: Why Windows XP starts faster than Windows 2000
Windows 2000 may start at the slowest rate in all Windows operating systems today, not because the computer hardware is not performing enough, but because the Windows 2000 design is "congenitally deficient." To make up for this, Microsoft has come up with a new way to develop Windows XP, which is that all of the less important device drivers and services will be loaded and run after the user logs on to the system. In other words, in the system startup process, loading and running of the program are all necessary to run the system, so as to use the shortest time to display the login interface for users to log in. When the user logs on, the system starts loading non-critical components. It can be said that the speed of Windows XP startup is actually an "opportunistic" approach, but this practice is indeed quite effective. However, this design also brings some problems, such as some friends reflect why their own system has been successfully logged on, but it will be several minutes before the desktop to display the taskbar and desktop icons and so on. In fact, this is because the system is busy dealing with unimportant services and components during the waiting minutes. This behavior can occur if there is too much to deal with, or if the computer's hardware configuration is not strong enough.

Small knowledge: How to control the startup order for Non-critical Services
As you know, non-critical services are loaded only after the user has successfully logged on, so we can control the order in which these services are loaded. This is actually very simple. The start order of the services is also determined by the number of the respective start registry keys and by the dependencies between each service, assuming that service a runs on service B, then service a fails to start successfully until service B is properly started. Assuming that service C's Start key value is 3, and service D's Start key value is 6, then service C will take precedence over service D (the smaller the number, the higher the priority).

Here, the Windows XP startup process is complete.