Lecture 5 Startup and Shutdown

Lecture 5 Startup and Shutdown xlanchen@03/18/2005

Contents • Boot Process • Safe Mode • Recovery Console • Shutdown • System Crashes Understanding the Inside of Windows2000

Background • BIOS (Basic Input/Output System) • Typically placed on a ROM chip of the computer • Low-level routines specific to the hardware supplied with the motherboard • POST (Power On Self Test) routines • Boot up the system Understanding the Inside of Windows2000

Boot from power-on • Power-on or reset • The processor is pre-programmed, the value in IP register is 0xFFFFFFF0 • The instruction tells the processor: “jump to the real BIOS startup program at XXXXX” • POST • … • Search for a boot device • For disk, MBR (Master Boot Record) • The code in MBR controls the processor Understanding the Inside of Windows2000

MBR (Master Boot Record) • The first sector on the disk: cylinder 0, head 0, sector 1 • Master partition table (only 4 entries) • Primary partitions • Active (primary) partitions, only one • Extended partitions Understanding the Inside of Windows2000

Hard disk layout MBR Understanding the Inside of Windows2000

Master Boot Code • Find an active partition, and boot • Volume/partition boot sector Understanding the Inside of Windows2000

Volume boot sector • Disk parameter block • Size • Sector numbers • Label name • Sectors per cluster • … • Volume boot code • Boot an operating system or a boot manager • This is operating specific Understanding the Inside of Windows2000

Windows setup • Writes MBR • Formats the boot partition with user specified file system format (FAT, FAT32, or NTFS ) • Writes volume boot sector • Copies files including two boot files: Ntldr and Ntdetect.com • Create a boot menu file, Boot.ini, in the root directory of the boot partition • … Understanding the Inside of Windows2000

Boot.ini • Contains options for starting the version of Windows 2000 and any preexisting Windows 2000 installations • Example: [bootloader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINNT [operatingsystems]multi(0)disk(0)rdisk(0)partition(1)\WINNT=“Microsoftwindows 2000professional“ /fastdetectC:\="Microsoft燱indows" Understanding the Inside of Windows2000

Windows 2000 boot sector • The content depends on the file system format • FAT, FAT32 or NTFS • The role of the boot-sector code • To give Windows 2000 information about the structure and format of a logical disk drive • to read in Ntldr Understanding the Inside of Windows2000

Ntldr • Real mode protected mode • 20bits memory access  32bits memory access • creating enough page tables to make memory below 16 MB accessible • enables paging • Read Boot.ini • loads and executes Ntdetect.com Understanding the Inside of Windows2000

Background • Real mode vs. protected mode Understanding the Inside of Windows2000

Ntldr • Loading the files needed to start the kernel initialization • Ntoskrnl.exe, Hal.dll • Determine, locate, and load the necessary boot device drivers • May need to adds the necessary file system driver for those boot device drivers • Prepares CPU registers for Ntoskrnl.exe Understanding the Inside of Windows2000

Call Ntoskrnl • Ntldr passes the following parameters: • The selected menu option • The memory tables • The in-memory copy of the HARDWARE and SYSTEM registry hives • The list of loaded boot drivers Understanding the Inside of Windows2000

Ntoskrnl • Initializing the Kernel and Executive Subsystems • Phase0 • To build the rudimentary structures required to allow the services needed in phase 1 to be invoked. • phase1 • Initialize Understanding the Inside of Windows2000

Smss • Smss • start the Win32 subsystem • Csrss • Winlogon • THE END Understanding the Inside of Windows2000

Boot Process • Boot Process Components • Master boot record (MBR) code • Boot sector • Ntldr • Ntoskrnl.exe • Smss • Winlogon • Service control manager (SCM) Understanding the Inside of Windows2000

Safe Mode • Safe mode is a concept Windows 2000 borrows from Consumer Windows—a boot configuration that consists of the minimal set of device drivers and services. • By relying on only the drivers and services that are necessary for booting, Windows 2000 avoids loading third-party and other nonessential drivers that might crash. • Key “F8” Understanding the Inside of Windows2000

Recovery Console • In some situations a safe-mode boot won't help the system boot • The Recovery Console allows you to boot into a limited command-line shell from the Windows 2000 CD or boot disks to repair an installation without having to boot the installation. Understanding the Inside of Windows2000

Shutdown • ExitWindowsEx • Winlogin • Csrss • NtSetSystemPowerState Understanding the Inside of Windows2000

System Crashes • Why ? • unhandled exception in kernel mode • reschedule when IRQL is DPC/dispatch level or higher. • A page fault on memory backed by data in a paging file or a memory mapped file occurs at an IRQL of DPC/dispatch level or above • explicitly crash after detecting an internal error condition • hardware error Understanding the Inside of Windows2000

The Blue Screen Understanding the Inside of Windows2000

Crash Dump Files • Default option • Three levels of information can be recorded on a system crash • Complete memory dump • Kernel memory dump • Small memory dump Understanding the Inside of Windows2000

Lecture 5 Startup and Shutdown