How does hibernate work

[njem]

I have a question on the details of how hibernate works. I know it's
saving everything in memory to the hiber file. Since power seems to be
truly off at hibernation I assumed the flag to tell the PC to resume
from the hiber file rather than normal booting must be either saved on
disk or flashed to a bit of bios rom space, or maybe in space
maintained by the clock battery. But the cure for a laptop that is
stuck in a loop of constantly resuming from hibernating is to unplug
it and take the battery out for a while so where actually is the flag
to signal the system that it's in hibernation?

Thanks,
Tom

 

[M.I.5¾]

I have a question on the details of how hibernate works. I know it's
saving everything in memory to the hiber file. Since power seems to be
truly off at hibernation I assumed the flag to tell the PC to resume
from the hiber file rather than normal booting must be either saved on
disk or flashed to a bit of bios rom space, or maybe in space
maintained by the clock battery. But the cure for a laptop that is
stuck in a loop of constantly resuming from hibernating is to unplug
it and take the battery out for a while so where actually is the flag
to signal the system that it's in hibernation?

How the machine knows to resume from hibernate is BIOS dependant. There are
two schemes.

In both schemes the RAM contents are written to a file called hiberfil.sys.

In the first scheme, the BIOS checks for the presence of the hiberfil.sys
file on the hard disc and if it finds it, loads it into RAM and then
proceeds as though recovering from STANDBY. Once recovered the file is
deleted.

In the second scheme, the BIOS sets an internal flag that it has hibernated,
and thus loads hiberfil.sys if the flag is set, otherwise it just boots
normally even if the file is present. Some BIOSes report an error if they
can't find the hiberfil.sys file. Once recovered the file is not
necessarily deleted.

The first scheme has the feature that it will recover from hibernate if the
system disc is replaced by another that was hibernated before it was removed
even if the original was not.

 

[njem]

In the first scheme, ...once recovered the file is
deleted.

I've never seen the hiberfile deleted so I guess this must be less
common. Although win must maintain a hiberfile for some reason even
before it has hibernated. On a system that has not had hibernating
enabled, if you enable it in win, a hiberfile is immediately created.
Maybe if the bios deletes it on coming out of hibernation win just
immediately creates a new one?

In the second scheme, the BIOS sets an internal flag that it has hibernated,

That, (or a flag on disk, which you didn't mention so I guess is not
done) is what I expected. But if it's in bios you would think it would
be either flashed in (non-volatile) or maintained by the clock battery
along with things like the time. So the fact that removing a laptop
battery can clear the hibernating flag is surprising.

Thanks,
Tom

 

[SC Tom]

How the machine knows to resume from hibernate is BIOS dependant. There
are two schemes.

In both schemes the RAM contents are written to a file called
hiberfil.sys.
In the first scheme, the BIOS checks for the presence of the
hiberfil.sys file on the hard disc and if it finds it, loads it into
RAM and then proceeds as though recovering from STANDBY. Once
recovered the file is deleted.

In the second scheme, the BIOS sets an internal flag that it has
hibernated, and thus loads hiberfil.sys if the flag is set, otherwise
it just boots normally even if the file is present. Some BIOSes
report an error if they can't find the hiberfil.sys file. Once
recovered the file is not necessarily deleted.

The first scheme has the feature that it will recover from hibernate
if the system disc is replaced by another that was hibernated before
it was removed even if the original was not.

I don't think that anything is written to BIOS on hibernation. It's just a
flag that is set in the OS startup to bring the system back to where
hiberfil.sys saved it. If Windows (or any other OS) had the ability to write
to BIOS, imagine what a field day the malware authors of the world would
have

 

[John John - MVP]

I have a question on the details of how hibernate works. I know it's
saving everything in memory to the hiber file. Since power seems to be
truly off at hibernation I assumed the flag to tell the PC to resume
from the hiber file rather than normal booting must be either saved on
disk or flashed to a bit of bios rom space, or maybe in space
maintained by the clock battery. But the cure for a laptop that is
stuck in a loop of constantly resuming from hibernating is to unplug
it and take the battery out for a while so where actually is the flag
to signal the system that it's in hibernation?

Ntldr looks for and parses the hiberfil.sys file, if the file is
found to be valid it is loaded into memory and the Windows kernel takes
control of the session. Any changes that you make to the computer after
it is shut down can potentially prevent the computer from resuming from
hibernation, undocking a laptop or something as simple as
plugging/unplugging USB devices can prevent the computer from
sucessfully resuming from hibernation. I suspect that removing your
battery for an extended period resets certain settings in the BIOS and
this prevents the computer from resuming from hibernation. When the
computer successfully resumes the hyberfil.sys file is marked as
inactive, this prevents ntldr from loading a stale hiberfil.sys file.

John

 

[njem]

I don't think that anything is written to BIOS on hibernation. It's just a
flag that is set in the OS startup to bring the system back to where
hiberfil.sys saved it. If Windows (or any other OS) had the ability to write
to BIOS, imagine what a field day the malware authors of the world would
have

It may be something the OS does within its own files but it could
certainly be in bios space. The bios could have a service call to set
a hibernation flag without opening access. And bios flash utilities,
some of which run right in win, right to bios. And years ago I
remember there were hacker utilities to read bios (even though it was
supposed to be protected) let you modify it (if yours had become
corrupted) and rewrite it. Also if I'm not mistaken hinernation only
works with bios that support it. That would be one advantage to what
you're describing. Bios wouldn't matter.

 

[njem]

Ntldr looks for and parses the hiberfil.sys file, if the file is
found to be valid it is loaded into memory and the Windows kernel takes
control of the session.  Any changes that you make to the computer after
it is shut down can potentially prevent the computer from resuming from
hibernation, undocking a laptop or something as simple as
plugging/unplugging USB devices can prevent the computer from
sucessfully resuming from hibernation.  I suspect that removing your
battery for an extended period resets certain settings in the BIOS and
this prevents the computer from resuming from hibernation.  When the
computer successfully resumes the hyberfil.sys file is marked as
inactive, this prevents ntldr from loading a stale hiberfil.sys file.

John

I think we're all working in the dark. As noted to SC Tom, if it were
strictly an OS function then bios wouldn't have to support it. And I
had one case that would conflict with the scheme you described. I had
a desktop that was stuck in a resume from hibernation loop. I thought
I would be clever and take the drive out, put it in another system,
delete the hiberfile, put it back and was sure it would be fine.
Instead it still tried to resume from hibernation but immediately
complained about an error in resuming. Also when I"ve taken a laptop
battery out then restart it doesn't try to resume, fail, and then boot
from scratch, it goes straight to normal boot. It's really not that
important but I wanted to better understand so when I have cases like
the stuck desktop I know what's going on and how to get out of it.

Thanks,
Tom

 

[SC Tom]

I think we're all working in the dark. As noted to SC Tom, if it were
strictly an OS function then bios wouldn't have to support it. And I
had one case that would conflict with the scheme you described. I had
a desktop that was stuck in a resume from hibernation loop. I thought
I would be clever and take the drive out, put it in another system,
delete the hiberfile, put it back and was sure it would be fine.
Instead it still tried to resume from hibernation but immediately
complained about an error in resuming. Also when I"ve taken a laptop
battery out then restart it doesn't try to resume, fail, and then boot
from scratch, it goes straight to normal boot. It's really not that
important but I wanted to better understand so when I have cases like
the stuck desktop I know what's going on and how to get out of it.

Thanks,
Tom

Yes, the BIOS has to support the function. I guess I was mixing up BIOS and
CMOS. After further research, I think I found out what was confusing me (and
believe me, I can be easily confused ). Since the bootstrap loader is
handled by BIOS, I would bet that's where the information to access the
hibernation file is loaded. Sorry for any confusion I may have caused. It's
all clear as mud to me now.

 

[John John - MVP]

Since the bootstrap
loader is handled by BIOS, I would bet that's where the information to
access the hibernation file is loaded.

No, the information to load the hiberfil.sys file is contained in ntldr.

John

 

[John John - MVP]

I think we're all working in the dark. As noted to SC Tom, if it were
strictly an OS function then bios wouldn't have to support it.

The computer has to be ACPI compliant so that the operating system can
tell it to shut itself off. The devices also need to be Plug and Play
compliant, Plug and Play also requires that the computer be ACPI compliant.

http://blogs.msdn.com/ntdebugging/archive/2007/06/28/how-windows-starts-up-part-the-second.aspx
Ntdebugging Blog : How Windows Starts Up (Part the second)

http://www.tar.hu/wininternals/ch05lev1sec1.html
Boot Process

John

 

[Yousuf Khan]

How the machine knows to resume from hibernate is BIOS dependant. There are
two schemes.

In both schemes the RAM contents are written to a file called hiberfil.sys.

This much is true.

In the first scheme, the BIOS checks for the presence of the hiberfil.sys
file on the hard disc and if it finds it, loads it into RAM and then
proceeds as though recovering from STANDBY. Once recovered the file is
deleted.

In the second scheme, the BIOS sets an internal flag that it has hibernated,
and thus loads hiberfil.sys if the flag is set, otherwise it just boots
normally even if the file is present. Some BIOSes report an error if they
can't find the hiberfil.sys file. Once recovered the file is not
necessarily deleted.

Neither of these can be true. If a hibernate flag were set in the NVRAM
of the BIOS, then if you had Linux installed on the same machine, it too
would be hibernated. You can hibernate Linux and it won't affect
Windows, and vice-versa. It's just a flag that's set in the filesystem
of each operating system's boot drive.

Yousuf Khan

 

[Yousuf Khan]

I think we're all working in the dark. As noted to SC Tom, if it were
strictly an OS function then bios wouldn't have to support it. And I
had one case that would conflict with the scheme you described. I had

The BIOS has to support hibernate to the extent that it needs to be an
ACPI-compliant BIOS. ACPI contains internal processor information that
is needed to get it to hibernate or go into standby.

But the BIOS' CMOS doesn't store any flags that tell it to go into
hibernate.

Yousuf Khan

 

[njem]

http://blogs.msdn.com/ntdebugging/archive/2007/06/28/how-windows-star...
Ntdebugging Blog : How Windows Starts Up (Part the second)

http://www.tar.hu/wininternals/ch05lev1sec1.html
Boot Process

Well I read the references, but it leaves me wondering why that time I
deleted the hiberfile it still tried to resume. Oh well. At least on
laptops I know the battery trick works.

Thanks,
Tom

 

[Pavel A.]

... If a hibernate flag were set in the NVRAM of the BIOS, then if you had
Linux installed on the same machine, it too would be hibernated. You can
hibernate Linux and it won't affect Windows, and vice-versa. It's just a
flag that's set in the filesystem of each operating system's boot drive.

What would be the desired user experience?
Suppose you have OS A and OS B on same machine, and hibernated OS A.
Would you then prefer OS A to resume automatically, or have a choice to boot
OS B?

The "new" boot datbase of NT6 has a Resume object parameter,
maybe exactly for this purpose - let to choose what happens on resume ?

Regards,
-- pa

 

[John John - MVP]

Well I read the references, but it leaves me wondering why that time I
deleted the hiberfile it still tried to resume. Oh well. At least on
laptops I know the battery trick works.

Boot to the Recovery Console and delete the hiberfil.sys file.

What happens when you hit the Spacebar or F8 key before Windows loads?
Hibernation is a pretty finicky thing at best of times. Buggy drivers
and marginal hardware can put a kybosh on all of it in a hurry.

John

 

[Yousuf Khan]

What would be the desired user experience?
Suppose you have OS A and OS B on same machine, and hibernated OS A.
Would you then prefer OS A to resume automatically, or have a choice to
boot OS B?

OS A would resume automatically if you put it on standby, you would have
no choice on that one. But if you put it on hibernate, then it would go
through the initial boot and then you can choose to go into either A or
B; if you went back to A, then it would resume from a hibernate, unless
you told it to ignore the resume file (you could do that by pressing F8
key during initial part of the Windows booting).

Yousuf Khan

 

[SC Tom]

The computer has to be ACPI compliant so that the operating system can
tell it to shut itself off. The devices also need to be Plug and Play
compliant, Plug and Play also requires that the computer be ACPI
compliant.
http://blogs.msdn.com/ntdebugging/archive/2007/06/28/how-windows-starts-up-part-the-second.aspx
Ntdebugging Blog : How Windows Starts Up (Part the second)

http://www.tar.hu/wininternals/ch05lev1sec1.html
Boot Process

John

Thanks, John, good stuff! I hadn't gone through anything like that since
upgrading from NT3.51 to NT4.0 LOL!

 

[M.I.5¾]

This much is true.


Neither of these can be true. If a hibernate flag were set in the NVRAM of
the BIOS, then if you had Linux installed on the same machine, it too
would be hibernated. You can hibernate Linux and it won't affect Windows,
and vice-versa. It's just a flag that's set in the filesystem of each
operating system's boot drive.

Somebody suggested that the flag is set on the hard disc (somewhere).
Either is a possibility.

My desktop machine will reawaken from hibernate if the hiberfil.sys file
exists on the hard disc (I've even experimented with saving hiberfil.sys
files to awaken the machine to different states.

My laptop won't, as it uses a flag (and indeed it doesn't delete the last
hiberfil.sys file).