Transcript Volume boot sector

Lecture 5 Startup and Shutdown
xlanchen@03/18/2005
计算机系•信息处理实验室
Contents
Boot Process
Safe Mode
Recovery Console
Shutdown
System Crashes
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 2
信息处理实验室
Background
BIOS (Basic Input/Output System)
Typically placed on a ROM chip of the computer
Low-level routines specific to the hardware
supplied with the motherboard
POST (Power On Self Test) routines
Boot up the system
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 3
信息处理实验室
Boot from power-on
Power-on or reset
The processor is pre-programmed, the value in IP register
is 0xFFFFFFF0
The instruction tells the processor:
“jump to the real BIOS startup program at XXXXX”
POST
…
Search for a boot device
For disk, MBR (Master Boot Record)
The code in MBR controls the processor
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 4
信息处理实验室
MBR (Master Boot Record)
The first sector on the disk:
cylinder 0, head 0, sector 1
Master partition table (only 4 entries)
Primary partitions
Active (primary) partitions, only one
Extended partitions
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 5
信息处理实验室
Hard disk layout
MBR
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 6
信息处理实验室
Master Boot Code
Find an active partition, and boot
Volume/partition boot sector
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 7
信息处理实验室
Volume boot sector
Disk parameter block
Size
Sector numbers
Label name
Sectors per cluster
…
Volume boot code
Boot an operating system or a boot manager
This is operating specific
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 8
信息处理实验室
Windows setup
Writes MBR
Formats the boot partition with user specified
file system format (FAT, FAT32, or NTFS )
Writes volume boot sector
Copies files including two boot files: Ntldr and
Ntdetect.com
Create a boot menu file, Boot.ini, in the root
directory of the boot partition
…
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 9
信息处理实验室
Boot.ini
Contains options for starting the version of
Windows 2000 and any preexisting Windows
2000 installations
Example:
[boot loader]
timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINNT
[operating systems]
multi(0)disk(0)rdisk(0)partition(1)
\WINNT=“Microsoft windows 2000 professional“ /fastdetect
C:\="Microsoft燱indows"
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 10
信息处理实验室
Windows 2000 boot sector
The content depends on the file system format
FAT, FAT32 or NTFS
The role of the boot-sector code
To give Windows 2000 information about the
structure and format of a logical disk drive
to read in Ntldr
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 11
信息处理实验室
Ntldr
Real mode protected mode
20bits memory access  32bits memory access
creating enough page tables to make memory
below 16 MB accessible
enables paging
Read Boot.ini
loads and executes Ntdetect.com
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 12
信息处理实验室
Background
Real mode vs. protected mode
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 13
信息处理实验室
Ntldr
Loading the files needed to start the kernel
initialization
Ntoskrnl.exe, Hal.dll
Determine, locate, and load the necessary boot
device drivers
May need to adds the necessary file system driver
for those boot device drivers
Prepares CPU registers for Ntoskrnl.exe
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 14
信息处理实验室
Call Ntoskrnl
Ntldr passes the following parameters:
The selected menu option
The memory tables
The in-memory copy of the HARDWARE and
SYSTEM registry hives
The list of loaded boot drivers
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 15
信息处理实验室
Ntoskrnl
Initializing the Kernel and Executive Subsystems
Phase0
To build the rudimentary structures required to
allow the services needed in phase 1 to be invoked.
phase1
Initialize
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 16
信息处理实验室
Smss
Smss
start the Win32 subsystem
Csrss
Winlogon
THE END
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 17
信息处理实验室
Boot Process
Boot Process Components
Master boot record (MBR) code
Boot sector
Ntldr
Ntoskrnl.exe
Smss
Winlogon
Service control manager (SCM)
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 18
信息处理实验室
Safe Mode
Safe mode is a concept Windows 2000 borrows from
Consumer Windows—a boot configuration that consists of
the minimal set of device drivers and services.
By relying on only the drivers and services that are
necessary for booting, Windows 2000 avoids loading thirdparty and other nonessential drivers that might crash.
Key “F8”
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 19
信息处理实验室
Recovery Console
In some situations a safe-mode boot won't help
the system boot
The Recovery Console allows you to boot into a
limited command-line shell from the Windows
2000 CD or boot disks to repair an installation
without having to boot the installation.
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 20
信息处理实验室
Shutdown
ExitWindowsEx
Winlogin
Csrss
NtSetSystemPowerState
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 21
信息处理实验室
System Crashes
Why ?
unhandled exception in kernel mode
reschedule when IRQL is DPC/dispatch level or higher.
A page fault on memory backed by data in a paging file or a
memory mapped file occurs at an IRQL of DPC/dispatch level
or above
explicitly crash after detecting an internal error condition
hardware error
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 22
信息处理实验室
The Blue Screen
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 23
信息处理实验室
Crash Dump Files
Default option
Three levels of information can be recorded on a
system crash
Complete memory dump
Kernel memory dump
Small memory dump
xlanchen@03/18/2005
Understanding the Inside of
Windows2000
计算机系 24
信息处理实验室