Hi everyone,

For those filtering by subject line may have noticed a new hashtag. The #BackstageTour tag will be used for posts that contain technical information or giving behind the scenes tour of various Windows components, hardware standards and so on. I believe that, as we are united under Windows 10, you should not be left in the dark as to how stuff works and Windows 10 development (things that will interest you and are important to know when it comes to accessibility). I also believe that it is beneficial sometimes to post technical info (more so on a technology-oriented list), especially on a list where we do have Microsoft reps.

Now let’s get started with our tour of the day: booting…

When you turn on your computer, you’ll be greeted with various informational (and sometimes not helpful) screens. The very first screen is a sign-on message from your computer’s firmware, telling you how to access the firmware. After a few moments, Windows will display its logo, then comes sign-in screen and/or desktop (or whichever program you were using last).

After seeing the discussion on UEFI/BIOS and fast startup, I felt it would be beneficial to let you know how booting works – or at least, give you a high-level overview of this process.

The process is as follows:

1.      Booting begins when you install Windows. One of the key things Windows Setup does is to find out what kind of firmware you’ve got. Due to differences between BIOS and UEFI, Windows needs to know where to store boot code, boot programs and other helpers.

2.      When your computer powers on, the central processing unit (CPU, more commonly called the processor) looks at instruction stored on a specific address. This varies by processor in use:

·        For x86/x64: The boot instruction (technically, a jump instruction) is stored on the address 0xfffffff0.

·        For ARM: the processor will start from address 0.

3.      The processor is told to run in a specific mode at power on. For x86/x64, this will be real address mode (commonly called “real mode”), the mode used in DOS and other old operating systems; for ARM, this will be supervisor mode where the processor can do anything.

4.      The firmware, once loaded, will perform one of the following:

·        BIOS (Basic Input/Output System): Probes various storage devices looking for boot code. For hard disks, BIOS will look for code on master boot record (MBR) with a specific boot signature; for CD’s and DVD’s, it’ll look at an embedded floppy disk image containing essential boot instructions.

·        UEFI (Unified Extensible Firmware Interface): Switches the processor to the desired mode (protected mode on x86, long mode on x64, continues on supervisor mode on ARM) and will probe a hidden partition on a hard disk (called EFI system partition) looking for bootloaders and programs, presenting a boot menu (via EFI boot manager).

·        UEFI with CSM (Compatibility Support Module): if BIOS-based boot program is detected, switches to BIOS emulation routine and boots using BIOS routine as noted earlier.

5.      Once a bootable device/bootloader is found, the firmware will pass control to it. For Windows, it’ll be Windows Boot Manager (bootmgr on BIOS, bootmgfw.efi on UEFI).

6.      If multiple boot entries are defined, Windows Boot Manager will present a boot selection menu. On UEFI systems, because UEFI requires a boot manager (a boot menu), you’ll see boot menu displayed twice.

7.      If booting Windows, Windows Boot Manager will check if Windows is hibernating by probing for a specific key in Boot Configuration Data (BCD). If so, a dedicated program for resuming Windows called WinResume (winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume’s operation differs depending on whether Windows is truly hibernating or if fast startup is in effect:

·        If truly hibernating: Reads hiberfil.sys (a disk-based hibernation snapshot), passing control to Windows kernel (ntoskrnl.exe), asking it to resume your computer.

·        Fast startup: Windows kernel will resume from where it left off, with users asked to log in. For this to work, Windows keeps an eye on sessions (a collection of programs and user profile one is using). When shutting down with fast startup enabled, users are logged off yet kernel side of Windows hibernates.

8.      If you are starting from scratch, Windows Boot Manager will use the full boot routines via Windows Loader (winload.exe on BIOS, winload.efi on UEFI). This program will perform the following:

·        If Secure Boot is active, checks cryptographic keys to make sure this information is correct.

·        Looks for boot drivers.

·        Displays Windows logo.

·        Checks licensing information.

·        Loads crucial Windows components, including subsystem support, security and others (I’ll devote a thread on subsystems once Redstone discussion is allowed).

·        Prepares Windows to allow users to log in (this process is performed by three programs: wininit.exe (Windows init process), winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

·        On ARM systems, switches the processor to user mode.

9.      Boot process is considered complete when Windows is ready to allow users to log in.

10.   When you choose to shut down your computer, Windows will save your settings, tells drivers it is time to put the hardware to rest, and then turns off your computer. If fast startup is enabled, after you are logged off, Windows will hibernate.

References:

·        Windows Internals, Sixth Edition (Microsoft Press)

·        Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

·        UEFI boot: how does that actually work, then: https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/

Hope this helps.

Cheers,

Joseph

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Brian Vogel
Sent: Thursday, May 12, 2016 8:40 AM
To: win10@win10.groups.io
Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

Joseph,

          I also happen to disagree with point number 1 in the original post because it makes the implication that the booting process has something to do with Windows at a stage in the game when it does not.

          The early stages of the boot process are completely independent of the OS that is loaded (or may not be loaded) on a given piece of hardware.  Those steps are to locate the OS, if one has been installed, and then turn over the rest of the booting process to the OS once it's been found.  This is the reason that these early stages of booting are not, and as far as I can tell barring some major technological change will not be, accessible via screen readers because screen readers are application programs and an OS must be loaded before they can be brought into the picture.

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Brian Vogel
Sent: Thursday, May 12, 2016 9:20 AM
To: win10@win10.groups.io
Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

Joseph,

          But Windows Setup, unless we're talking about two different things, is Windows Install Setup, not "boot for everyday use" setup.

          I'm not saying that you said what's listed, but I still maintain that it is incorrect because the UEFI (or BIOS) boot steps on any hardware take place before there is any OS involvement whatsoever.  That's their purpose, to lead to the actual loading of the OS (or OS choice, in the case of dual or tri, or X boot systems) in question.  Those OSes are not, in any way, involved until UEFI (or BIOS) gets to the hand-off point.

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow

From: win10@win10.groups.io [mailto:win10@win10.groups.io] On Behalf Of Brian Vogel
Sent: Thursday, May 12, 2016 9:42 AM
To: win10@win10.groups.io
Subject: Re: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

Joseph,

         I presumed that you knew exactly what was referred to, but what concerns me is that the "random reader" might not.  That was the only reason I brought it up to begin with.  What any OS's actual install routines do has to interact with the firmware, otherwise they wouldn't know how to install.  That's different than what I think most people think of when they hear the phrase setup as in what happens for every boot after the install, which is very different.

         I'm not trying to give you a hard time at all.  I just want the readership to be aware of exactly what's happening when and under what circumstances.

Brian
-- 
     To think is to differ.
           ~ Clarence Darrow

----- Original Message -----

From: Joseph Lee

To: win10@win10.groups.io

Sent: Thursday, May 12, 2016 10:44 AM

Subject: [win10] Behind the scenes (for informational purposes): How does BIOS/UEFI/CSM booting work, Windows boot process, fast startup #BackstageTour

Hi everyone,

 

For those filtering by subject line may have noticed a new hashtag. The #BackstageTour tag will be used for posts that contain technical information or giving behind the scenes tour of various Windows components, hardware standards and so on. I believe that, as we are united under Windows 10, you should not be left in the dark as to how stuff works and Windows 10 development (things that will interest you and are important to know when it comes to accessibility). I also believe that it is beneficial sometimes to post technical info (more so on a technology-oriented list), especially on a list where we do have Microsoft reps.

 

Now let’s get started with our tour of the day: booting…

 

When you turn on your computer, you’ll be greeted with various informational (and sometimes not helpful) screens. The very first screen is a sign-on message from your computer’s firmware, telling you how to access the firmware. After a few moments, Windows will display its logo, then comes sign-in screen and/or desktop (or whichever program you were using last).

 

After seeing the discussion on UEFI/BIOS and fast startup, I felt it would be beneficial to let you know how booting works – or at least, give you a high-level overview of this process.

 

The process is as follows:

1.      Booting begins when you install Windows. One of the key things Windows Setup does is to find out what kind of firmware you’ve got. Due to differences between BIOS and UEFI, Windows needs to know where to store boot code, boot programs and other helpers.

2.      When your computer powers on, the central processing unit (CPU, more commonly called the processor) looks at instruction stored on a specific address. This varies by processor in use:

·        For x86/x64: The boot instruction (technically, a jump instruction) is stored on the address 0xfffffff0.

·        For ARM: the processor will start from address 0.

3.      The processor is told to run in a specific mode at power on. For x86/x64, this will be real address mode (commonly called “real mode”), the mode used in DOS and other old operating systems; for ARM, this will be supervisor mode where the processor can do anything.

4.      The firmware, once loaded, will perform one of the following:

·        BIOS (Basic Input/Output System): Probes various storage devices looking for boot code. For hard disks, BIOS will look for code on master boot record (MBR) with a specific boot signature; for CD’s and DVD’s, it’ll look at an embedded floppy disk image containing essential boot instructions.

·        UEFI (Unified Extensible Firmware Interface): Switches the processor to the desired mode (protected mode on x86, long mode on x64, continues on supervisor mode on ARM) and will probe a hidden partition on a hard disk (called EFI system partition) looking for bootloaders and programs, presenting a boot menu (via EFI boot manager).

·        UEFI with CSM (Compatibility Support Module): if BIOS-based boot program is detected, switches to BIOS emulation routine and boots using BIOS routine as noted earlier.

5.      Once a bootable device/bootloader is found, the firmware will pass control to it. For Windows, it’ll be Windows Boot Manager (bootmgr on BIOS, bootmgfw.efi on UEFI).

6.      If multiple boot entries are defined, Windows Boot Manager will present a boot selection menu. On UEFI systems, because UEFI requires a boot manager (a boot menu), you’ll see boot menu displayed twice.

7.      If booting Windows, Windows Boot Manager will check if Windows is hibernating by probing for a specific key in Boot Configuration Data (BCD). If so, a dedicated program for resuming Windows called WinResume (winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume’s operation differs depending on whether Windows is truly hibernating or if fast startup is in effect:

·        If truly hibernating: Reads hiberfil.sys (a disk-based hibernation snapshot), passing control to Windows kernel (ntoskrnl.exe), asking it to resume your computer.

·        Fast startup: Windows kernel will resume from where it left off, with users asked to log in. For this to work, Windows keeps an eye on sessions (a collection of programs and user profile one is using). When shutting down with fast startup enabled, users are logged off yet kernel side of Windows hibernates.

8.      If you are starting from scratch, Windows Boot Manager will use the full boot routines via Windows Loader (winload.exe on BIOS, winload.efi on UEFI). This program will perform the following:

·        If Secure Boot is active, checks cryptographic keys to make sure this information is correct.

·        Looks for boot drivers.

·        Displays Windows logo.

·        Checks licensing information.

·        Loads crucial Windows components, including subsystem support, security and others (I’ll devote a thread on subsystems once Redstone discussion is allowed).

·        Prepares Windows to allow users to log in (this process is performed by three programs: wininit.exe (Windows init process), winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

·        On ARM systems, switches the processor to user mode.

9.      Boot process is considered complete when Windows is ready to allow users to log in.

10.   When you choose to shut down your computer, Windows will save your settings, tells drivers it is time to put the hardware to rest, and then turns off your computer. If fast startup is enabled, after you are logged off, Windows will hibernate.

 

References:

·        Windows Internals, Sixth Edition (Microsoft Press)

·        Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

·        UEFI boot: how does that actually work, then: https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/

Hope this helps.

Cheers,

Joseph

God dang! This is incredible! Thank you for such a detailed explanation.
This is truly very fascinating.
---
Christopher Gilland
JAWS Certified, 2016.
Training Instructor.

clgilland07@gmail.com
Phone: (704) 256-8010.
----- Original Message -----
From: Joseph Lee
To: win10@win10.groups.io
Sent: Thursday, May 12, 2016 10:44 AM
Subject: [win10] Behind the scenes (for informational purposes): How does
BIOS/UEFI/CSM booting work, Windows boot process, fast startup
#BackstageTour


Hi everyone,



For those filtering by subject line may have noticed a new hashtag. The
#BackstageTour tag will be used for posts that contain technical information
or giving behind the scenes tour of various Windows components, hardware
standards and so on. I believe that, as we are united under Windows 10, you
should not be left in the dark as to how stuff works and Windows 10
development (things that will interest you and are important to know when it
comes to accessibility). I also believe that it is beneficial sometimes to
post technical info (more so on a technology-oriented list), especially on a
list where we do have Microsoft reps.



Now let's get started with our tour of the day: booting.



When you turn on your computer, you'll be greeted with various
informational (and sometimes not helpful) screens. The very first screen is
a sign-on message from your computer's firmware, telling you how to access
the firmware. After a few moments, Windows will display its logo, then comes
sign-in screen and/or desktop (or whichever program you were using last).



After seeing the discussion on UEFI/BIOS and fast startup, I felt it would
be beneficial to let you know how booting works - or at least, give you a
high-level overview of this process.



The process is as follows:

1. Booting begins when you install Windows. One of the key things
Windows Setup does is to find out what kind of firmware you've got. Due to
differences between BIOS and UEFI, Windows needs to know where to store boot
code, boot programs and other helpers.

2. When your computer powers on, the central processing unit (CPU,
more commonly called the processor) looks at instruction stored on a
specific address. This varies by processor in use:

· For x86/x64: The boot instruction (technically, a jump
instruction) is stored on the address 0xfffffff0.

· For ARM: the processor will start from address 0.

3. The processor is told to run in a specific mode at power on. For
x86/x64, this will be real address mode (commonly called "real mode"), the
mode used in DOS and other old operating systems; for ARM, this will be
supervisor mode where the processor can do anything.

4. The firmware, once loaded, will perform one of the following:

· BIOS (Basic Input/Output System): Probes various storage devices
looking for boot code. For hard disks, BIOS will look for code on master
boot record (MBR) with a specific boot signature; for CD's and DVD's, it'll
look at an embedded floppy disk image containing essential boot
instructions.

· UEFI (Unified Extensible Firmware Interface): Switches the
processor to the desired mode (protected mode on x86, long mode on x64,
continues on supervisor mode on ARM) and will probe a hidden partition on a
hard disk (called EFI system partition) looking for bootloaders and
programs, presenting a boot menu (via EFI boot manager).

· UEFI with CSM (Compatibility Support Module): if BIOS-based boot
program is detected, switches to BIOS emulation routine and boots using BIOS
routine as noted earlier.

5. Once a bootable device/bootloader is found, the firmware will pass
control to it. For Windows, it'll be Windows Boot Manager (bootmgr on BIOS,
bootmgfw.efi on UEFI).

6. If multiple boot entries are defined, Windows Boot Manager will
present a boot selection menu. On UEFI systems, because UEFI requires a boot
manager (a boot menu), you'll see boot menu displayed twice.

7. If booting Windows, Windows Boot Manager will check if Windows is
hibernating by probing for a specific key in Boot Configuration Data (BCD).
If so, a dedicated program for resuming Windows called WinResume
(winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume's
operation differs depending on whether Windows is truly hibernating or if
fast startup is in effect:

· If truly hibernating: Reads hiberfil.sys (a disk-based
hibernation snapshot), passing control to Windows kernel (ntoskrnl.exe),
asking it to resume your computer.

· Fast startup: Windows kernel will resume from where it left off,
with users asked to log in. For this to work, Windows keeps an eye on
sessions (a collection of programs and user profile one is using). When
shutting down with fast startup enabled, users are logged off yet kernel
side of Windows hibernates.

8. If you are starting from scratch, Windows Boot Manager will use
the full boot routines via Windows Loader (winload.exe on BIOS, winload.efi
on UEFI). This program will perform the following:

· If Secure Boot is active, checks cryptographic keys to make sure
this information is correct.

· Looks for boot drivers.

· Displays Windows logo.

· Checks licensing information.

· Loads crucial Windows components, including subsystem support,
security and others (I'll devote a thread on subsystems once Redstone
discussion is allowed).

· Prepares Windows to allow users to log in (this process is
performed by three programs: wininit.exe (Windows init process),
winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

· On ARM systems, switches the processor to user mode.

9. Boot process is considered complete when Windows is ready to allow
users to log in.

10. When you choose to shut down your computer, Windows will save your
settings, tells drivers it is time to put the hardware to rest, and then
turns off your computer. If fast startup is enabled, after you are logged
off, Windows will hibernate.



References:

· Windows Internals, Sixth Edition (Microsoft Press)

· Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

· UEFI boot: how does that actually work, then:
https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actually-work-then/

Hope this helps.

Cheers,

Joseph

God dang! This is incredible! Thank you for such a detailed explanation.
This is truly very fascinating.
---
Christopher Gilland
JAWS Certified, 2016.
Training Instructor.

clgilland07@gmail.com
Phone: (704) 256-8010.
----- Original Message -----
From: Joseph Lee
To: win10@win10.groups.io
Sent: Thursday, May 12, 2016 10:44 AM
Subject: [win10] Behind the scenes (for informational purposes): How
does BIOS/UEFI/CSM booting work, Windows boot process, fast startup
#BackstageTour


Hi everyone,



For those filtering by subject line may have noticed a new hashtag.
The #BackstageTour tag will be used for posts that contain technical
information or giving behind the scenes tour of various Windows
components, hardware standards and so on. I believe that, as we are
united under Windows 10, you should not be left in the dark as to how
stuff works and Windows 10 development (things that will interest you
and are important to know when it comes to accessibility). I also
believe that it is beneficial sometimes to post technical info (more
so on a technology-oriented list), especially on a list where we do have Microsoft reps.



Now let's get started with our tour of the day: booting.



When you turn on your computer, you'll be greeted with various
informational (and sometimes not helpful) screens. The very first
screen is a sign-on message from your computer's firmware, telling you
how to access the firmware. After a few moments, Windows will display
its logo, then comes sign-in screen and/or desktop (or whichever program you were using last).



After seeing the discussion on UEFI/BIOS and fast startup, I felt it
would be beneficial to let you know how booting works - or at least,
give you a high-level overview of this process.



The process is as follows:

1. Booting begins when you install Windows. One of the key things
Windows Setup does is to find out what kind of firmware you've got.
Due to differences between BIOS and UEFI, Windows needs to know where
to store boot code, boot programs and other helpers.

2. When your computer powers on, the central processing unit (CPU,
more commonly called the processor) looks at instruction stored on a
specific address. This varies by processor in use:

· For x86/x64: The boot instruction (technically, a jump
instruction) is stored on the address 0xfffffff0.

· For ARM: the processor will start from address 0.

3. The processor is told to run in a specific mode at power on. For
x86/x64, this will be real address mode (commonly called "real mode"),
the mode used in DOS and other old operating systems; for ARM, this
will be supervisor mode where the processor can do anything.

4. The firmware, once loaded, will perform one of the following:

· BIOS (Basic Input/Output System): Probes various storage devices
looking for boot code. For hard disks, BIOS will look for code on
master boot record (MBR) with a specific boot signature; for CD's and
DVD's, it'll look at an embedded floppy disk image containing
essential boot instructions.

· UEFI (Unified Extensible Firmware Interface): Switches the
processor to the desired mode (protected mode on x86, long mode on
x64, continues on supervisor mode on ARM) and will probe a hidden
partition on a hard disk (called EFI system partition) looking for
bootloaders and programs, presenting a boot menu (via EFI boot manager).

· UEFI with CSM (Compatibility Support Module): if BIOS-based boot
program is detected, switches to BIOS emulation routine and boots
using BIOS routine as noted earlier.

5. Once a bootable device/bootloader is found, the firmware will pass
control to it. For Windows, it'll be Windows Boot Manager (bootmgr on
BIOS, bootmgfw.efi on UEFI).

6. If multiple boot entries are defined, Windows Boot Manager will
present a boot selection menu. On UEFI systems, because UEFI requires
a boot manager (a boot menu), you'll see boot menu displayed twice.

7. If booting Windows, Windows Boot Manager will check if Windows is
hibernating by probing for a specific key in Boot Configuration Data (BCD).
If so, a dedicated program for resuming Windows called WinResume
(winresume.exe on BIOS, winresume.efi on UEFI) will start. WinResume's
operation differs depending on whether Windows is truly hibernating or
if fast startup is in effect:

· If truly hibernating: Reads hiberfil.sys (a disk-based
hibernation snapshot), passing control to Windows kernel
(ntoskrnl.exe), asking it to resume your computer.

· Fast startup: Windows kernel will resume from where it left off,
with users asked to log in. For this to work, Windows keeps an eye on
sessions (a collection of programs and user profile one is using).
When shutting down with fast startup enabled, users are logged off yet
kernel side of Windows hibernates.

8. If you are starting from scratch, Windows Boot Manager will use
the full boot routines via Windows Loader (winload.exe on BIOS,
winload.efi on UEFI). This program will perform the following:

· If Secure Boot is active, checks cryptographic keys to make sure
this information is correct.

· Looks for boot drivers.

· Displays Windows logo.

· Checks licensing information.

· Loads crucial Windows components, including subsystem support,
security and others (I'll devote a thread on subsystems once Redstone
discussion is allowed).

· Prepares Windows to allow users to log in (this process is
performed by three programs: wininit.exe (Windows init process),
winlogon.exe (Log-on manager), logonui.exe (Log-on user interface)).

· On ARM systems, switches the processor to user mode.

9. Boot process is considered complete when Windows is ready to allow
users to log in.

10. When you choose to shut down your computer, Windows will save your
settings, tells drivers it is time to put the hardware to rest, and
then turns off your computer. If fast startup is enabled, after you
are logged off, Windows will hibernate.



References:

· Windows Internals, Sixth Edition (Microsoft Press)

· Booting (Wikipedia): https://en.wikipedia.org/wiki/Booting

· UEFI boot: how does that actually work, then:
https://www.happyassassin.net/2014/01/25/uefi-boot-how-does-that-actua
lly-work-then/

Hope this helps.

Cheers,

Joseph

One of the reasons I recommend that anyone who buys a new computer promptly visit their manufacturer's support website is because it is not at all uncommon for hardware to sit on a shelf for months before being sold and, as a result any number of drivers, firmware, etc., can be out of date. This can be true even if something was built and shipped a week ago if, by chance, an update was issued six days ago.

For the same reason, I never use the software provided on optical media for things like printers or the like. I always download "the latest and greatest" from the manufacturer's support site to install.
Brian
--
To think is to differ.
~ Clarence Darrow