1.1 Loading the System

System initialization occurs in eight phases:

Phase 1 Firmware

This phase is platform-specific.

• In x86-based platforms, the hardware boot ROM loads a boot sector, which loads the NTLDR.

• In most RISC-based platforms, the firmware loads necessary ARC drivers, acquires hardware configuration data, and loads the OSLOADER.

Phase 2 OS Loader

This phase sets up memory, captures hardware configuration data, constructs a description of the machine hardware in memory, and puts a pointer to this description into the loader block. NTLDR or OSLOADER then loads and relocates the kernel image, the HAL, and the driver(s) for the device and file system for the volume from which the system is booted. Any other device drivers that have a Start value of 0 are loaded at this time. For more information on Start values, see Section 1.2.3.

• In x86-based platforms, a hardware recognizer called Ntdetect queries the ROMs, probes the hardware, and collects as much information as possible about the I/O buses and peripheral devices in the machine.

• In RISC-based platforms, the ARC Query Config functions are called to accomplish the same thing.

Phase 3 Kernel Startup

This phase calls a routine to fetch load-control information from the registry, such as the default or user-set size of resident system-space memory (nonpaged pool) and of the registry quota.

Phase 4 CmInitSystem

The Configuration Manager initializes two subtrees under the \Registry\Machine tree in the registry, enables the registry API, and creates the CurrentControlSet symbolic link in preparation for loading device drivers. At the end of this phase, the registry namespaces under \Registry\Machine\Hardware and \Registry\Machine\System can be both read and written.

Phase 5 IoInitSystem

This phase initializes and loads the rest of the Windows NT Executive, including certain kernel-mode drivers, according to the CurrentControlSet. First, the drivers loaded into memory in Phase 2 are initialized from the boot driver list. Next, other base drivers are loaded and initialized. At the end of this phase, the system’s core drivers are all active, unless a critical driver fails its initialization and the machine is rebooted.

Phase 6 MmFreeLoaderBlock

This phase releases the loader block, some of configuration data that was collected in Phase 2, and the initial copy of the \Registry\Machine\System hive. However, the \Registry\Machine\Hardware configuration information is retained.

Phase 7 Session Manager

This phase runs certain programs (such as autocheck), calls the Windows NT Executive to open paging files so files can be written, and initializes the remainder of the registry. Before this phase, certain registry I/O requests have been cached, such as information core drivers might have written to the registry for use by still higher-level drivers that load later. At the end of this phase, all configuration information under \Registry\Machine is available.

Phase 8 Service Controller

This phase loads remaining drivers according to the CurrentControlSet and creates the LastKnownGood tree in the registry.