Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #backstagetour


 

Hi everyone,

 

For those filtering by subject line may have noticed a new hashtag. The #BackstageTour tag will be used for posts that contain technical information or giving behind the scenes tour of various Windows components, hardware standards and so on. I believe that, as we are united under Windows 10, you should not be left in the dark as to how stuff works and Windows 10 development (things that will interest you and are important to know when it comes to accessibility). I also believe that it is beneficial sometimes to post technical info (more so on a technology-oriented list), especially on a list where we do have Microsoft reps.

 

Now let’s get started with our tour of the day: booting…

 

When you turn on your computer, you’ll be greeted with various informational (and sometimes not helpful) screens. The very first screen is a sign-on message from your computer’s firmware, telling you how to access the firmware. After a few moments, Windows will display its logo, then comes sign-in screen and/or desktop (or whichever program you were using last).

 

After seeing the discussion on UEFI/BIOS and fast startup, I felt it would be beneficial to let you know how booting works – or at least, give you a high-level overview of this process.

 

The process is as follows:

1.      Booting begins when you install Windows. One of the key things Windows Setup does is to find out what kind of firmware you’ve got. Due to differences between BIOS and UEFI, Windows needs to know where to store boot code, boot programs and other helpers.

2.      When your computer powers on, the central processing unit (CPU, more commonly called the processor) looks at instruction stored on a specific address. This varies by processor in use:

·        For x86/x64: The boot instruction (technically, a jump instruction) is stored on the address 0xfffffff0.

·        For ARM: the processor will start from address 0.

3.      The processor is told to run in a specific mode at power on. For x86/x64, this will be real address mode (commonly called “real mode”), the mode used in DOS and other old operating systems; for ARM, this will be supervisor mode where the processor can do anything.

4.      The firmware, once loaded, will perform one of the following:

·        BIOS (Basic Input/Output System): Probes various storage devices looking for boot code. For hard disks, BIOS will look for code on master boot record (MBR) with a specific boot signature; for CD’s and DVD’s, it’ll look at an embedded floppy disk image containing essential boot instructions.

·        UEFI (Unified Extensible Firmware Interface): Switches the processor to the desired mode (protected mode on x86, long mode on x64, continues on supervisor mode on ARM) and will probe a hidden partition on a hard disk (called EFI system partition) looking for bootloaders and programs, presenting a boot menu (via EFI boot manager).

·        UEFI with CSM (Compatibility Support Module): if BIOS-based boot program is detected, switches to BIOS emulation routine and boots using BIOS routine as noted earlier.

5.      Once a bootable device/bootloader is found, the firmware will pass control to it. For Windows, it’ll be Windows Boot Manager (bootmgr on BIOS, bootmgfw.efi on UEFI).

6.      If multiple boot entries are defined, Windows Boot Manager will present a boot selection menu. On UEFI systems, because UEFI requires a boot manager (a boot menu), you’ll see boot menu displayed twice.

7.      If booting Windows, Windows Boot Manager will check if Windows is hibernating by probing for a specific key in Boot Configuration Data (BCD). If so, a dedicated program for resuming Windows called WinResume (winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume’s operation differs depending on whether Windows is truly hibernating or if fast startup is in effect:

·        If truly hibernating: Reads hiberfil.sys (a disk-based hibernation snapshot), passing control to Windows kernel (ntoskrnl.exe), asking it to resume your computer.

·        Fast startup: Windows kernel will resume from where it left off, with users asked to log in. For this to work, Windows keeps an eye on sessions (a collection of programs and user profile one is using). When shutting down with fast startup enabled, users are logged off yet kernel side of Windows hibernates.

8.      If you are starting from scratch, Windows Boot Manager will use the full boot routines via Windows Loader (winload.exe on BIOS, winload.efi on UEFI). This program will perform the following:

·        If Secure Boot is active, checks cryptographic keys to make sure this information is correct.

·        Looks for boot drivers.

·        Displays Windows logo.

·        Checks licensing information.

·        Loads crucial Windows components, including subsystem support, security and others (I’ll devote a thread on subsystems once Redstone discussion is allowed).

·        Prepares Windows to allow users to log in (this process is performed by three programs: wininit.exe (Windows init process), winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

·        On ARM systems, switches the processor to user mode.

9.      Boot process is considered complete when Windows is ready to allow users to log in.

10.   When you choose to shut down your computer, Windows will save your settings, tells drivers it is time to put the hardware to rest, and then turns off your computer. If fast startup is enabled, after you are logged off, Windows will hibernate.

 

References:

·        Windows Internals, Sixth Edition (Microsoft Press)

·        Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

·        UEFI boot: how does that actually work, then: https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/

Hope this helps.

Cheers,

Joseph


 

Hi,

One crucial clarification: in the process of booting (after Winload is selected), secure Boot routine will be performed by WinLoad/bootmgr. The rest is performed by Windows kernel (ntoskrnl.exe).

Cheers,

Joseph

 

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Joseph Lee
Sent: Thursday, May 12, 2016 7:44 AM
To: win10@win10.groups.io
Subject: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

 

Hi everyone,

 

For those filtering by subject line may have noticed a new hashtag. The #BackstageTour tag will be used for posts that contain technical information or giving behind the scenes tour of various Windows components, hardware standards and so on. I believe that, as we are united under Windows 10, you should not be left in the dark as to how stuff works and Windows 10 development (things that will interest you and are important to know when it comes to accessibility). I also believe that it is beneficial sometimes to post technical info (more so on a technology-oriented list), especially on a list where we do have Microsoft reps.

 

Now let’s get started with our tour of the day: booting…

 

When you turn on your computer, you’ll be greeted with various informational (and sometimes not helpful) screens. The very first screen is a sign-on message from your computer’s firmware, telling you how to access the firmware. After a few moments, Windows will display its logo, then comes sign-in screen and/or desktop (or whichever program you were using last).

 

After seeing the discussion on UEFI/BIOS and fast startup, I felt it would be beneficial to let you know how booting works – or at least, give you a high-level overview of this process.

 

The process is as follows:

1.      Booting begins when you install Windows. One of the key things Windows Setup does is to find out what kind of firmware you’ve got. Due to differences between BIOS and UEFI, Windows needs to know where to store boot code, boot programs and other helpers.

2.      When your computer powers on, the central processing unit (CPU, more commonly called the processor) looks at instruction stored on a specific address. This varies by processor in use:

·        For x86/x64: The boot instruction (technically, a jump instruction) is stored on the address 0xfffffff0.

·        For ARM: the processor will start from address 0.

3.      The processor is told to run in a specific mode at power on. For x86/x64, this will be real address mode (commonly called “real mode”), the mode used in DOS and other old operating systems; for ARM, this will be supervisor mode where the processor can do anything.

4.      The firmware, once loaded, will perform one of the following:

·        BIOS (Basic Input/Output System): Probes various storage devices looking for boot code. For hard disks, BIOS will look for code on master boot record (MBR) with a specific boot signature; for CD’s and DVD’s, it’ll look at an embedded floppy disk image containing essential boot instructions.

·        UEFI (Unified Extensible Firmware Interface): Switches the processor to the desired mode (protected mode on x86, long mode on x64, continues on supervisor mode on ARM) and will probe a hidden partition on a hard disk (called EFI system partition) looking for bootloaders and programs, presenting a boot menu (via EFI boot manager).

·        UEFI with CSM (Compatibility Support Module): if BIOS-based boot program is detected, switches to BIOS emulation routine and boots using BIOS routine as noted earlier.

5.      Once a bootable device/bootloader is found, the firmware will pass control to it. For Windows, it’ll be Windows Boot Manager (bootmgr on BIOS, bootmgfw.efi on UEFI).

6.      If multiple boot entries are defined, Windows Boot Manager will present a boot selection menu. On UEFI systems, because UEFI requires a boot manager (a boot menu), you’ll see boot menu displayed twice.

7.      If booting Windows, Windows Boot Manager will check if Windows is hibernating by probing for a specific key in Boot Configuration Data (BCD). If so, a dedicated program for resuming Windows called WinResume (winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume’s operation differs depending on whether Windows is truly hibernating or if fast startup is in effect:

·        If truly hibernating: Reads hiberfil.sys (a disk-based hibernation snapshot), passing control to Windows kernel (ntoskrnl.exe), asking it to resume your computer.

·        Fast startup: Windows kernel will resume from where it left off, with users asked to log in. For this to work, Windows keeps an eye on sessions (a collection of programs and user profile one is using). When shutting down with fast startup enabled, users are logged off yet kernel side of Windows hibernates.

8.      If you are starting from scratch, Windows Boot Manager will use the full boot routines via Windows Loader (winload.exe on BIOS, winload.efi on UEFI). This program will perform the following:

·        If Secure Boot is active, checks cryptographic keys to make sure this information is correct.

·        Looks for boot drivers.

·        Displays Windows logo.

·        Checks licensing information.

·        Loads crucial Windows components, including subsystem support, security and others (I’ll devote a thread on subsystems once Redstone discussion is allowed).

·        Prepares Windows to allow users to log in (this process is performed by three programs: wininit.exe (Windows init process), winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

·        On ARM systems, switches the processor to user mode.

9.      Boot process is considered complete when Windows is ready to allow users to log in.

10.   When you choose to shut down your computer, Windows will save your settings, tells drivers it is time to put the hardware to rest, and then turns off your computer. If fast startup is enabled, after you are logged off, Windows will hibernate.

 

References:

·        Windows Internals, Sixth Edition (Microsoft Press)

·        Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

·        UEFI boot: how does that actually work, then: https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/

Hope this helps.

Cheers,

Joseph


Brian Vogel <britechguy@...>
 

Joseph,

          I also happen to disagree with point number 1 in the original post because it makes the implication that the booting process has something to do with Windows at a stage in the game when it does not.

          The early stages of the boot process are completely independent of the OS that is loaded (or may not be loaded) on a given piece of hardware.  Those steps are to locate the OS, if one has been installed, and then turn over the rest of the booting process to the OS once it's been found.  This is the reason that these early stages of booting are not, and as far as I can tell barring some major technological change will not be, accessible via screen readers because screen readers are application programs and an OS must be loaded before they can be brought into the picture.

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow


 

Hi,

Actually, Windows Setup is intimately tied into the boot process – it sort of solves ‘chicken and the egg” problem in that it determines where to place boot files depending on the firmware in use. Note that the list I gave comes from Wiindows Internals and other sources.

Cheers,

Joseph

 

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Brian Vogel
Sent: Thursday, May 12, 2016 8:40 AM
To: win10@win10.groups.io
Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

 

Joseph,

          I also happen to disagree with point number 1 in the original post because it makes the implication that the booting process has something to do with Windows at a stage in the game when it does not.

          The early stages of the boot process are completely independent of the OS that is loaded (or may not be loaded) on a given piece of hardware.  Those steps are to locate the OS, if one has been installed, and then turn over the rest of the booting process to the OS once it's been found.  This is the reason that these early stages of booting are not, and as far as I can tell barring some major technological change will not be, accessible via screen readers because screen readers are application programs and an OS must be loaded before they can be brought into the picture.

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow


Brian Vogel <britechguy@...>
 

Joseph,

          But Windows Setup, unless we're talking about two different things, is Windows Install Setup, not "boot for everyday use" setup.

          I'm not saying that you said what's listed, but I still maintain that it is incorrect because the UEFI (or BIOS) boot steps on any hardware take place before there is any OS involvement whatsoever.  That's their purpose, to lead to the actual loading of the OS (or OS choice, in the case of dual or tri, or X boot systems) in question.  Those OSes are not, in any way, involved until UEFI (or BIOS) gets to the hand-off point.

 

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow


 

Hi Brian,

When I talk about Windows Setup, I refer to installation routines (my apologies for not making that distinction clear).
Cheers,

Joseph

 

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Brian Vogel
Sent: Thursday, May 12, 2016 9:20 AM
To: win10@win10.groups.io
Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

 

Joseph,

          But Windows Setup, unless we're talking about two different things, is Windows Install Setup, not "boot for everyday use" setup.

          I'm not saying that you said what's listed, but I still maintain that it is incorrect because the UEFI (or BIOS) boot steps on any hardware take place before there is any OS involvement whatsoever.  That's their purpose, to lead to the actual loading of the OS (or OS choice, in the case of dual or tri, or X boot systems) in question.  Those OSes are not, in any way, involved until UEFI (or BIOS) gets to the hand-off point.

 

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow


Brian Vogel <britechguy@...>
 

Joseph,

         I presumed that you knew exactly what was referred to, but what concerns me is that the "random reader" might not.  That was the only reason I brought it up to begin with.  What any OS's actual install routines do has to interact with the firmware, otherwise they wouldn't know how to install.  That's different than what I think most people think of when they hear the phrase setup as in what happens for every boot after the install, which is very different.

         I'm not trying to give you a hard time at all.  I just want the readership to be aware of exactly what's happening when and under what circumstances.

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow


 

Hi Brian,

Ah yes, I need a reminder to slow down at times… Thanks for serving in this capacity (I really appreciate this).

Cheers,

Joseph

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Brian Vogel
Sent: Thursday, May 12, 2016 9:42 AM
To: win10@win10.groups.io
Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

 

Joseph,

         I presumed that you knew exactly what was referred to, but what concerns me is that the "random reader" might not.  That was the only reason I brought it up to begin with.  What any OS's actual install routines do has to interact with the firmware, otherwise they wouldn't know how to install.  That's different than what I think most people think of when they hear the phrase setup as in what happens for every boot after the install, which is very different.

         I'm not trying to give you a hard time at all.  I just want the readership to be aware of exactly what's happening when and under what circumstances.

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow


Christopher-Mark Gilland <clgilland07@...>
 

God dang!  This is incredible!  Thank you for such a detailed explanation.  This is truly very fascinating.
---
Christopher Gilland
JAWS Certified, 2016.
Training Instructor.
 
clgilland07@...
Phone: (704) 256-8010.

----- Original Message -----
From: Joseph Lee
Sent: Thursday, May 12, 2016 10:44 AM
Subject: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

Hi everyone,

 

For those filtering by subject line may have noticed a new hashtag. The #BackstageTour tag will be used for posts that contain technical information or giving behind the scenes tour of various Windows components, hardware standards and so on. I believe that, as we are united under Windows 10, you should not be left in the dark as to how stuff works and Windows 10 development (things that will interest you and are important to know when it comes to accessibility). I also believe that it is beneficial sometimes to post technical info (more so on a technology-oriented list), especially on a list where we do have Microsoft reps.

 

Now let’s get started with our tour of the day: booting…

 

When you turn on your computer, you’ll be greeted with various informational (and sometimes not helpful) screens. The very first screen is a sign-on message from your computer’s firmware, telling you how to access the firmware. After a few moments, Windows will display its logo, then comes sign-in screen and/or desktop (or whichever program you were using last).

 

After seeing the discussion on UEFI/BIOS and fast startup, I felt it would be beneficial to let you know how booting works – or at least, give you a high-level overview of this process.

 

The process is as follows:

1.      Booting begins when you install Windows. One of the key things Windows Setup does is to find out what kind of firmware you’ve got. Due to differences between BIOS and UEFI, Windows needs to know where to store boot code, boot programs and other helpers.

2.      When your computer powers on, the central processing unit (CPU, more commonly called the processor) looks at instruction stored on a specific address. This varies by processor in use:

·        For x86/x64: The boot instruction (technically, a jump instruction) is stored on the address 0xfffffff0.

·        For ARM: the processor will start from address 0.

3.      The processor is told to run in a specific mode at power on. For x86/x64, this will be real address mode (commonly called “real mode”), the mode used in DOS and other old operating systems; for ARM, this will be supervisor mode where the processor can do anything.

4.      The firmware, once loaded, will perform one of the following:

·        BIOS (Basic Input/Output System): Probes various storage devices looking for boot code. For hard disks, BIOS will look for code on master boot record (MBR) with a specific boot signature; for CD’s and DVD’s, it’ll look at an embedded floppy disk image containing essential boot instructions.

·        UEFI (Unified Extensible Firmware Interface): Switches the processor to the desired mode (protected mode on x86, long mode on x64, continues on supervisor mode on ARM) and will probe a hidden partition on a hard disk (called EFI system partition) looking for bootloaders and programs, presenting a boot menu (via EFI boot manager).

·        UEFI with CSM (Compatibility Support Module): if BIOS-based boot program is detected, switches to BIOS emulation routine and boots using BIOS routine as noted earlier.

5.      Once a bootable device/bootloader is found, the firmware will pass control to it. For Windows, it’ll be Windows Boot Manager (bootmgr on BIOS, bootmgfw.efi on UEFI).

6.      If multiple boot entries are defined, Windows Boot Manager will present a boot selection menu. On UEFI systems, because UEFI requires a boot manager (a boot menu), you’ll see boot menu displayed twice.

7.      If booting Windows, Windows Boot Manager will check if Windows is hibernating by probing for a specific key in Boot Configuration Data (BCD). If so, a dedicated program for resuming Windows called WinResume (winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume’s operation differs depending on whether Windows is truly hibernating or if fast startup is in effect:

·        If truly hibernating: Reads hiberfil.sys (a disk-based hibernation snapshot), passing control to Windows kernel (ntoskrnl.exe), asking it to resume your computer.

·        Fast startup: Windows kernel will resume from where it left off, with users asked to log in. For this to work, Windows keeps an eye on sessions (a collection of programs and user profile one is using). When shutting down with fast startup enabled, users are logged off yet kernel side of Windows hibernates.

8.      If you are starting from scratch, Windows Boot Manager will use the full boot routines via Windows Loader (winload.exe on BIOS, winload.efi on UEFI). This program will perform the following:

·        If Secure Boot is active, checks cryptographic keys to make sure this information is correct.

·        Looks for boot drivers.

·        Displays Windows logo.

·        Checks licensing information.

·        Loads crucial Windows components, including subsystem support, security and others (I’ll devote a thread on subsystems once Redstone discussion is allowed).

·        Prepares Windows to allow users to log in (this process is performed by three programs: wininit.exe (Windows init process), winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

·        On ARM systems, switches the processor to user mode.

9.      Boot process is considered complete when Windows is ready to allow users to log in.

10.   When you choose to shut down your computer, Windows will save your settings, tells drivers it is time to put the hardware to rest, and then turns off your computer. If fast startup is enabled, after you are logged off, Windows will hibernate.

 

References:

·        Windows Internals, Sixth Edition (Microsoft Press)

·        Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

·        UEFI boot: how does that actually work, then: https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/

Hope this helps.

Cheers,

Joseph


 

can you make another post on shutdown? what hapends from the time we
press the shutdown button to the time the computer is fully turned of

On 5/13/16, Christopher-Mark Gilland <clgilland07@gmail.com> wrote:
God dang! This is incredible! Thank you for such a detailed explanation.
This is truly very fascinating.
---
Christopher Gilland
JAWS Certified, 2016.
Training Instructor.

clgilland07@gmail.com
Phone: (704) 256-8010.
----- Original Message -----
From: Joseph Lee
To: win10@win10.groups.io
Sent: Thursday, May 12, 2016 10:44 AM
Subject: [win10] Behind the scenes (for informational purposes): How does
BIOS/UEFI/CSM booting work, Windows boot process, fast startup
#BackstageTour


Hi everyone,



For those filtering by subject line may have noticed a new hashtag. The
#BackstageTour tag will be used for posts that contain technical information
or giving behind the scenes tour of various Windows components, hardware
standards and so on. I believe that, as we are united under Windows 10, you
should not be left in the dark as to how stuff works and Windows 10
development (things that will interest you and are important to know when it
comes to accessibility). I also believe that it is beneficial sometimes to
post technical info (more so on a technology-oriented list), especially on a
list where we do have Microsoft reps.



Now let's get started with our tour of the day: booting.



When you turn on your computer, you'll be greeted with various
informational (and sometimes not helpful) screens. The very first screen is
a sign-on message from your computer's firmware, telling you how to access
the firmware. After a few moments, Windows will display its logo, then comes
sign-in screen and/or desktop (or whichever program you were using last).



After seeing the discussion on UEFI/BIOS and fast startup, I felt it would
be beneficial to let you know how booting works - or at least, give you a
high-level overview of this process.



The process is as follows:

1. Booting begins when you install Windows. One of the key things
Windows Setup does is to find out what kind of firmware you've got. Due to
differences between BIOS and UEFI, Windows needs to know where to store boot
code, boot programs and other helpers.

2. When your computer powers on, the central processing unit (CPU,
more commonly called the processor) looks at instruction stored on a
specific address. This varies by processor in use:

· For x86/x64: The boot instruction (technically, a jump
instruction) is stored on the address 0xfffffff0.

· For ARM: the processor will start from address 0.

3. The processor is told to run in a specific mode at power on. For
x86/x64, this will be real address mode (commonly called "real mode"), the
mode used in DOS and other old operating systems; for ARM, this will be
supervisor mode where the processor can do anything.

4. The firmware, once loaded, will perform one of the following:

· BIOS (Basic Input/Output System): Probes various storage devices
looking for boot code. For hard disks, BIOS will look for code on master
boot record (MBR) with a specific boot signature; for CD's and DVD's, it'll
look at an embedded floppy disk image containing essential boot
instructions.

· UEFI (Unified Extensible Firmware Interface): Switches the
processor to the desired mode (protected mode on x86, long mode on x64,
continues on supervisor mode on ARM) and will probe a hidden partition on a
hard disk (called EFI system partition) looking for bootloaders and
programs, presenting a boot menu (via EFI boot manager).

· UEFI with CSM (Compatibility Support Module): if BIOS-based boot
program is detected, switches to BIOS emulation routine and boots using BIOS
routine as noted earlier.

5. Once a bootable device/bootloader is found, the firmware will pass
control to it. For Windows, it'll be Windows Boot Manager (bootmgr on BIOS,
bootmgfw.efi on UEFI).

6. If multiple boot entries are defined, Windows Boot Manager will
present a boot selection menu. On UEFI systems, because UEFI requires a boot
manager (a boot menu), you'll see boot menu displayed twice.

7. If booting Windows, Windows Boot Manager will check if Windows is
hibernating by probing for a specific key in Boot Configuration Data (BCD).
If so, a dedicated program for resuming Windows called WinResume
(winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume's
operation differs depending on whether Windows is truly hibernating or if
fast startup is in effect:

· If truly hibernating: Reads hiberfil.sys (a disk-based
hibernation snapshot), passing control to Windows kernel (ntoskrnl.exe),
asking it to resume your computer.

· Fast startup: Windows kernel will resume from where it left off,
with users asked to log in. For this to work, Windows keeps an eye on
sessions (a collection of programs and user profile one is using). When
shutting down with fast startup enabled, users are logged off yet kernel
side of Windows hibernates.

8. If you are starting from scratch, Windows Boot Manager will use
the full boot routines via Windows Loader (winload.exe on BIOS, winload.efi
on UEFI). This program will perform the following:

· If Secure Boot is active, checks cryptographic keys to make sure
this information is correct.

· Looks for boot drivers.

· Displays Windows logo.

· Checks licensing information.

· Loads crucial Windows components, including subsystem support,
security and others (I'll devote a thread on subsystems once Redstone
discussion is allowed).

· Prepares Windows to allow users to log in (this process is
performed by three programs: wininit.exe (Windows init process),
winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

· On ARM systems, switches the processor to user mode.

9. Boot process is considered complete when Windows is ready to allow
users to log in.

10. When you choose to shut down your computer, Windows will save your
settings, tells drivers it is time to put the hardware to rest, and then
turns off your computer. If fast startup is enabled, after you are logged
off, Windows will hibernate.



References:

· Windows Internals, Sixth Edition (Microsoft Press)

· Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

· UEFI boot: how does that actually work, then:
https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/

Hope this helps.

Cheers,

Joseph


--
search for me on facebook, google+, orkut..
austinpinto.xaviers@gmail.com
follow me on twitter.
austinmpinto
contact me on skype.
austin.pinto3


Ron Kolesar
 

Hey Joe, I love your behind the sean tours of the computer.
One thingthat would be nice to see is this.
When one has to restore one’s computer like I had to do last night to roll back one’s computer a sighted person can  look at the screen and get a status report on how much longer it will take tocomplete the roll back  and your computer will reboot itself for you.
It would be nice to see a screen reader to let us know of the status while rolling back as well.
My second question is this.
Microsoft disabiltiy help desk the other day stated that my bio’s were not up to date.
Now this is a new system that was purchase a few days just before thanks giving last year.
So you would think that the bio’s would be up to date.
But ist there a way to check and his there a way to up date them to the latest updates?
I don’t like messing with the ferm ware and bios because if you’re not careful, you’ll end up with a expensive paperweight instead of a computer.
So many Thanks.
 

From: Joseph Lee
Sent: Thursday, May 12, 2016 10:49 AM
Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour
 

Hi,

One crucial clarification: in the process of booting (after Winload is selected), secure Boot routine will be performed by WinLoad/bootmgr. The rest is performed by Windows kernel (ntoskrnl.exe).

Cheers,

Joseph

 

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Joseph Lee
Sent: Thursday, May 12, 2016 7:44 AM
To: win10@win10.groups.io
Subject: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

 

Hi everyone,

 

For those filtering by subject line may have noticed a new hashtag. The #BackstageTour tag will be used for posts that contain technical information or giving behind the scenes tour of various Windows components, hardware standards and so on. I believe that, as we are united under Windows 10, you should not be left in the dark as to how stuff works and Windows 10 development (things that will interest you and are important to know when it comes to accessibility). I also believe that it is beneficial sometimes to post technical info (more so on a technology-oriented list), especially on a list where we do have Microsoft reps.

 

Now let’s get started with our tour of the day: booting…

 

When you turn on your computer, you’ll be greeted with various informational (and sometimes not helpful) screens. The very first screen is a sign-on message from your computer’s firmware, telling you how to access the firmware. After a few moments, Windows will display its logo, then comes sign-in screen and/or desktop (or whichever program you were using last).

 

After seeing the discussion on UEFI/BIOS and fast startup, I felt it would be beneficial to let you know how booting works – or at least, give you a high-level overview of this process.

 

The process is as follows:

1.      Booting begins when you install Windows. One of the key things Windows Setup does is to find out what kind of firmware you’ve got. Due to differences between BIOS and UEFI, Windows needs to know where to store boot code, boot programs and other helpers.

2.      When your computer powers on, the central processing unit (CPU, more commonly called the processor) looks at instruction stored on a specific address. This varies by processor in use:

·        For x86/x64: The boot instruction (technically, a jump instruction) is stored on the address 0xfffffff0.

·        For ARM: the processor will start from address 0.

3.      The processor is told to run in a specific mode at power on. For x86/x64, this will be real address mode (commonly called “real mode”), the mode used in DOS and other old operating systems; for ARM, this will be supervisor mode where the processor can do anything.

4.      The firmware, once loaded, will perform one of the following:

·        BIOS (Basic Input/Output System): Probes various storage devices looking for boot code. For hard disks, BIOS will look for code on master boot record (MBR) with a specific boot signature; for CD’s and DVD’s, it’ll look at an embedded floppy disk image containing essential boot instructions.

·        UEFI (Unified Extensible Firmware Interface): Switches the processor to the desired mode (protected mode on x86, long mode on x64, continues on supervisor mode on ARM) and will probe a hidden partition on a hard disk (called EFI system partition) looking for bootloaders and programs, presenting a boot menu (via EFI boot manager).

·        UEFI with CSM (Compatibility Support Module): if BIOS-based boot program is detected, switches to BIOS emulation routine and boots using BIOS routine as noted earlier.

5.      Once a bootable device/bootloader is found, the firmware will pass control to it. For Windows, it’ll be Windows Boot Manager (bootmgr on BIOS, bootmgfw.efi on UEFI).

6.      If multiple boot entries are defined, Windows Boot Manager will present a boot selection menu. On UEFI systems, because UEFI requires a boot manager (a boot menu), you’ll see boot menu displayed twice.

7.      If booting Windows, Windows Boot Manager will check if Windows is hibernating by probing for a specific key in Boot Configuration Data (BCD). If so, a dedicated program for resuming Windows called WinResume (winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume’s operation differs depending on whether Windows is truly hibernating or if fast startup is in effect:

·        If truly hibernating: Reads hiberfil.sys (a disk-based hibernation snapshot), passing control to Windows kernel (ntoskrnl.exe), asking it to resume your computer.

·        Fast startup: Windows kernel will resume from where it left off, with users asked to log in. For this to work, Windows keeps an eye on sessions (a collection of programs and user profile one is using). When shutting down with fast startup enabled, users are logged off yet kernel side of Windows hibernates.

8.      If you are starting from scratch, Windows Boot Manager will use the full boot routines via Windows Loader (winload.exe on BIOS, winload.efi on UEFI). This program will perform the following:

·        If Secure Boot is active, checks cryptographic keys to make sure this information is correct.

·        Looks for boot drivers.

·        Displays Windows logo.

·        Checks licensing information.

·        Loads crucial Windows components, including subsystem support, security and others (I’ll devote a thread on subsystems once Redstone discussion is allowed).

·        Prepares Windows to allow users to log in (this process is performed by three programs: wininit.exe (Windows init process), winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

·        On ARM systems, switches the processor to user mode.

9.      Boot process is considered complete when Windows is ready to allow users to log in.

10.   When you choose to shut down your computer, Windows will save your settings, tells drivers it is time to put the hardware to rest, and then turns off your computer. If fast startup is enabled, after you are logged off, Windows will hibernate.

 

References:

·        Windows Internals, Sixth Edition (Microsoft Press)

·        Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

·        UEFI boot: how does that actually work, then: https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/

Hope this helps.

Cheers,

Joseph


 

Hi,
I've already covered this briefly at the end of the original post.
Cheers,
Joseph

-----Original Message-----
From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Austin Pinto
Sent: Friday, May 13, 2016 1:59 AM
To: win10@win10.groups.io
Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

can you make another post on shutdown? what hapends from the time we press the shutdown button to the time the computer is fully turned of

On 5/13/16, Christopher-Mark Gilland <clgilland07@gmail.com> wrote:
God dang! This is incredible! Thank you for such a detailed explanation.
This is truly very fascinating.
---
Christopher Gilland
JAWS Certified, 2016.
Training Instructor.

clgilland07@gmail.com
Phone: (704) 256-8010.
----- Original Message -----
From: Joseph Lee
To: win10@win10.groups.io
Sent: Thursday, May 12, 2016 10:44 AM
Subject: [win10] Behind the scenes (for informational purposes): How
does BIOS/UEFI/CSM booting work, Windows boot process, fast startup
#BackstageTour


Hi everyone,



For those filtering by subject line may have noticed a new hashtag.
The #BackstageTour tag will be used for posts that contain technical
information or giving behind the scenes tour of various Windows
components, hardware standards and so on. I believe that, as we are
united under Windows 10, you should not be left in the dark as to how
stuff works and Windows 10 development (things that will interest you
and are important to know when it comes to accessibility). I also
believe that it is beneficial sometimes to post technical info (more
so on a technology-oriented list), especially on a list where we do have Microsoft reps.



Now let's get started with our tour of the day: booting.



When you turn on your computer, you'll be greeted with various
informational (and sometimes not helpful) screens. The very first
screen is a sign-on message from your computer's firmware, telling you
how to access the firmware. After a few moments, Windows will display
its logo, then comes sign-in screen and/or desktop (or whichever program you were using last).



After seeing the discussion on UEFI/BIOS and fast startup, I felt it
would be beneficial to let you know how booting works - or at least,
give you a high-level overview of this process.



The process is as follows:

1. Booting begins when you install Windows. One of the key things
Windows Setup does is to find out what kind of firmware you've got.
Due to differences between BIOS and UEFI, Windows needs to know where
to store boot code, boot programs and other helpers.

2. When your computer powers on, the central processing unit (CPU,
more commonly called the processor) looks at instruction stored on a
specific address. This varies by processor in use:

· For x86/x64: The boot instruction (technically, a jump
instruction) is stored on the address 0xfffffff0.

· For ARM: the processor will start from address 0.

3. The processor is told to run in a specific mode at power on. For
x86/x64, this will be real address mode (commonly called "real mode"),
the mode used in DOS and other old operating systems; for ARM, this
will be supervisor mode where the processor can do anything.

4. The firmware, once loaded, will perform one of the following:

· BIOS (Basic Input/Output System): Probes various storage devices
looking for boot code. For hard disks, BIOS will look for code on
master boot record (MBR) with a specific boot signature; for CD's and
DVD's, it'll look at an embedded floppy disk image containing
essential boot instructions.

· UEFI (Unified Extensible Firmware Interface): Switches the
processor to the desired mode (protected mode on x86, long mode on
x64, continues on supervisor mode on ARM) and will probe a hidden
partition on a hard disk (called EFI system partition) looking for
bootloaders and programs, presenting a boot menu (via EFI boot manager).

· UEFI with CSM (Compatibility Support Module): if BIOS-based boot
program is detected, switches to BIOS emulation routine and boots
using BIOS routine as noted earlier.

5. Once a bootable device/bootloader is found, the firmware will pass
control to it. For Windows, it'll be Windows Boot Manager (bootmgr on
BIOS, bootmgfw.efi on UEFI).

6. If multiple boot entries are defined, Windows Boot Manager will
present a boot selection menu. On UEFI systems, because UEFI requires
a boot manager (a boot menu), you'll see boot menu displayed twice.

7. If booting Windows, Windows Boot Manager will check if Windows is
hibernating by probing for a specific key in Boot Configuration Data (BCD).
If so, a dedicated program for resuming Windows called WinResume
(winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume's
operation differs depending on whether Windows is truly hibernating or
if fast startup is in effect:

· If truly hibernating: Reads hiberfil.sys (a disk-based
hibernation snapshot), passing control to Windows kernel
(ntoskrnl.exe), asking it to resume your computer.

· Fast startup: Windows kernel will resume from where it left off,
with users asked to log in. For this to work, Windows keeps an eye on
sessions (a collection of programs and user profile one is using).
When shutting down with fast startup enabled, users are logged off yet
kernel side of Windows hibernates.

8. If you are starting from scratch, Windows Boot Manager will use
the full boot routines via Windows Loader (winload.exe on BIOS,
winload.efi on UEFI). This program will perform the following:

· If Secure Boot is active, checks cryptographic keys to make sure
this information is correct.

· Looks for boot drivers.

· Displays Windows logo.

· Checks licensing information.

· Loads crucial Windows components, including subsystem support,
security and others (I'll devote a thread on subsystems once Redstone
discussion is allowed).

· Prepares Windows to allow users to log in (this process is
performed by three programs: wininit.exe (Windows init process),
winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

· On ARM systems, switches the processor to user mode.

9. Boot process is considered complete when Windows is ready to allow
users to log in.

10. When you choose to shut down your computer, Windows will save your
settings, tells drivers it is time to put the hardware to rest, and
then turns off your computer. If fast startup is enabled, after you
are logged off, Windows will hibernate.



References:

· Windows Internals, Sixth Edition (Microsoft Press)

· Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

· UEFI boot: how does that actually work, then:
https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actua
lly-work-then/

Hope this helps.

Cheers,

Joseph



--
search for me on facebook, google+, orkut..
austinpinto.xaviers@gmail.com
follow me on twitter.
austinmpinto
contact me on skype.
austin.pinto3


 

Hi Ron,

1.       Reset: No, this screen pops up before the point where Narrator can tell you what’s going on (I’ll talk about this later).

2.       Firmware updates: some manufacturers such as Gigabyte, Toshiba and others provide a Window-based utility to update the firmware. If not, you’ll need to use firmware-based utility where no screen reader is present 9you need to be careful, as the firmware must match the motherboard for which it is intended).

Cheers,

Joseph

 

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Ron Kolesar
Sent: Friday, May 13, 2016 10:29 AM
To: win10@win10.groups.io
Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

 

Hey Joe, I love your behind the sean tours of the computer.

One thingthat would be nice to see is this.

When one has to restore one’s computer like I had to do last night to roll back one’s computer a sighted person can  look at the screen and get a status report on how much longer it will take tocomplete the roll back  and your computer will reboot itself for you.

It would be nice to see a screen reader to let us know of the status while rolling back as well.

My second question is this.

Microsoft disabiltiy help desk the other day stated that my bio’s were not up to date.

Now this is a new system that was purchase a few days just before thanks giving last year.

So you would think that the bio’s would be up to date.

But ist there a way to check and his there a way to up date them to the latest updates?

I don’t like messing with the ferm ware and bios because if you’re not careful, you’ll end up with a expensive paperweight instead of a computer.

So many Thanks.

 

From: Joseph Lee

Sent: Thursday, May 12, 2016 10:49 AM

Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

 

Hi,

One crucial clarification: in the process of booting (after Winload is selected), secure Boot routine will be performed by WinLoad/bootmgr. The rest is performed by Windows kernel (ntoskrnl.exe).

Cheers,

Joseph

 

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Joseph Lee
Sent: Thursday, May 12, 2016 7:44 AM
To: win10@win10.groups.io
Subject: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

 

Hi everyone,

 

For those filtering by subject line may have noticed a new hashtag. The #BackstageTour tag will be used for posts that contain technical information or giving behind the scenes tour of various Windows components, hardware standards and so on. I believe that, as we are united under Windows 10, you should not be left in the dark as to how stuff works and Windows 10 development (things that will interest you and are important to know when it comes to accessibility). I also believe that it is beneficial sometimes to post technical info (more so on a technology-oriented list), especially on a list where we do have Microsoft reps.

 

Now let’s get started with our tour of the day: booting…

 

When you turn on your computer, you’ll be greeted with various informational (and sometimes not helpful) screens. The very first screen is a sign-on message from your computer’s firmware, telling you how to access the firmware. After a few moments, Windows will display its logo, then comes sign-in screen and/or desktop (or whichever program you were using last).

 

After seeing the discussion on UEFI/BIOS and fast startup, I felt it would be beneficial to let you know how booting works – or at least, give you a high-level overview of this process.

 

The process is as follows:

1.       Booting begins when you install Windows. One of the key things Windows Setup does is to find out what kind of firmware you’ve got. Due to differences between BIOS and UEFI, Windows needs to know where to store boot code, boot programs and other helpers.

2.       When your computer powers on, the central processing unit (CPU, more commonly called the processor) looks at instruction stored on a specific address. This varies by processor in use:

·         For x86/x64: The boot instruction (technically, a jump instruction) is stored on the address 0xfffffff0.

·         For ARM: the processor will start from address 0.

3.       The processor is told to run in a specific mode at power on. For x86/x64, this will be real address mode (commonly called “real mode”), the mode used in DOS and other old operating systems; for ARM, this will be supervisor mode where the processor can do anything.

4.       The firmware, once loaded, will perform one of the following:

·         BIOS (Basic Input/Output System): Probes various storage devices looking for boot code. For hard disks, BIOS will look for code on master boot record (MBR) with a specific boot signature; for CD’s and DVD’s, it’ll look at an embedded floppy disk image containing essential boot instructions.

·         UEFI (Unified Extensible Firmware Interface): Switches the processor to the desired mode (protected mode on x86, long mode on x64, continues on supervisor mode on ARM) and will probe a hidden partition on a hard disk (called EFI system partition) looking for bootloaders and programs, presenting a boot menu (via EFI boot manager).

·         UEFI with CSM (Compatibility Support Module): if BIOS-based boot program is detected, switches to BIOS emulation routine and boots using BIOS routine as noted earlier.

5.       Once a bootable device/bootloader is found, the firmware will pass control to it. For Windows, it’ll be Windows Boot Manager (bootmgr on BIOS, bootmgfw.efi on UEFI).

6.       If multiple boot entries are defined, Windows Boot Manager will present a boot selection menu. On UEFI systems, because UEFI requires a boot manager (a boot menu), you’ll see boot menu displayed twice.

7.       If booting Windows, Windows Boot Manager will check if Windows is hibernating by probing for a specific key in Boot Configuration Data (BCD). If so, a dedicated program for resuming Windows called WinResume (winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume’s operation differs depending on whether Windows is truly hibernating or if fast startup is in effect:

·         If truly hibernating: Reads hiberfil.sys (a disk-based hibernation snapshot), passing control to Windows kernel (ntoskrnl.exe), asking it to resume your computer.

·         Fast startup: Windows kernel will resume from where it left off, with users asked to log in. For this to work, Windows keeps an eye on sessions (a collection of programs and user profile one is using). When shutting down with fast startup enabled, users are logged off yet kernel side of Windows hibernates.

8.       If you are starting from scratch, Windows Boot Manager will use the full boot routines via Windows Loader (winload.exe on BIOS, winload.efi on UEFI). This program will perform the following:

·         If Secure Boot is active, checks cryptographic keys to make sure this information is correct.

·         Looks for boot drivers.

·         Displays Windows logo.

·         Checks licensing information.

·         Loads crucial Windows components, including subsystem support, security and others (I’ll devote a thread on subsystems once Redstone discussion is allowed).

·         Prepares Windows to allow users to log in (this process is performed by three programs: wininit.exe (Windows init process), winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

·         On ARM systems, switches the processor to user mode.

9.       Boot process is considered complete when Windows is ready to allow users to log in.

10.   When you choose to shut down your computer, Windows will save your settings, tells drivers it is time to put the hardware to rest, and then turns off your computer. If fast startup is enabled, after you are logged off, Windows will hibernate.

 

References:

·         Windows Internals, Sixth Edition (Microsoft Press)

·         Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

·         UEFI boot: how does that actually work, then: https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/

Hope this helps.

Cheers,

Joseph


Brian Vogel <britechguy@...>
 

One of the reasons I recommend that anyone who buys a new computer promptly visit their manufacturer's support website is because it is not at all uncommon for hardware to sit on a shelf for months before being sold and, as a result any number of drivers, firmware, etc., can be out of date.  This can be true even if something was built and shipped a week ago if, by chance, an update was issued six days ago.

For the same reason, I never use the software provided on optical media for things like printers or the like.  I always download "the latest and greatest" from the manufacturer's support site to install.

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow


 

I agree, I always update the bios and other drivers from the websites of manufacturers.
Ofcause when manufacturers use stuff not spaciffically designed for them I often go to the manufacturers of the hardware, intel and amd have some passable driver update software.
I also remove most of the bloat.
I have a new keyboard I got last year and its just got a firmware update.

On 14/05/2016 1:37 p.m., Brian Vogel wrote:
One of the reasons I recommend that anyone who buys a new computer promptly visit their manufacturer's support website is because it is not at all uncommon for hardware to sit on a shelf for months before being sold and, as a result any number of drivers, firmware, etc., can be out of date. This can be true even if something was built and shipped a week ago if, by chance, an update was issued six days ago.

For the same reason, I never use the software provided on optical media for things like printers or the like. I always download "the latest and greatest" from the manufacturer's support site to install.
Brian
--
To think is to differ.
~ Clarence Darrow