Friday, February 29, 2008

Fragmentation

File fragmentation occurs when files can no longer be placed next to each other or contiguously on a disk. Whey you purchase a PC, usually it contains an operating system and some additional files loaded at the factory. These files are mostly loaded one at a time and are fairly contiguous. Over time as you install and uninstall programs and data files, blank spaces appear between files that can be used for storage operations or new programs that you install. If these files are not exactly the same size as the free space, which most are not, the system places them in spaces anywhere on the disk that there is room. This means that files can be spread all over the disk slowing the system down because the seek time increases. This used to be called checker boarding, but I haven't heard that term used for a hundred years.
Since our hard drives have increased in size every 6 hours, the amount of fragmentation has also increased. Data files and program files can be scattered literally from one end of the disk to the other. Defragmenting the drive is an absolute necessity especially when your storage capacity increases. Just because you have more room doesn't mean your system will continue to run quickly forever. It just means you have more room for fragmented files.
Check your drive(s) frequently to see how much space is being underutilized. This can be done in the System or Administrator Tools menus. Select Disk Defragment and click on the analyze button. This will tell you is you need to defragment your drive or not. If you see mostly red lines, you have a mostly fragmented drive.

ATTRIB

The ATTRIB command can be used to make files hidden, read-only, system, and archive. To change a file that is visible to a hidden file, you would enter ATTRIB +H and the filename with it's extension at the C:\ prompt in the directory that contains the file. Such as C:\ATTRIB +H visible.doc. To make a file read-only prevents any unwanted changes from occurring. At the C:\ prompt you would enter C:\ATTRIB +R readme.doc. This command will deny access to anyone trying to make changes or delete the file. To remove the read-only attribute from the file, enter C:\ATTRIB -R readme.doc.
Some of the switches associated with the ATTRIB command are:
+H to hide a file in a directory
-H to view a previously hidden file
+A to set a file flag so it can be archived during a backup or XCOPY
-A to remove the archive flag
+S to set a file as a system command
-S to remove the flag for a system command file
+R to set the file up for read-only
-R to remove the read-only attribute

You can also use multiple switches with the ATTRIB command. For instance, if you wanted to set a file up as a system file that is hidden. You would enter the ATTRIB command: C:\ATTRIB +S +H helloworld.exe. To reverse these settings you would substitute the +S +H with the -S -H switches.

Batch Files

Batch files can be created, edited, and run from the command prompt window. You can also run a batch file from the RUN command by entering the location and filename. As the name implies, you can run several executable files from a filename you have created with the .bat extension. These files will be run in the order that they appear and can also have more batch files nested within the original batch file. This command originated in DOS and has several lines of test you can enter for a variety of tasks.
As previously mentioned, if you would like to run a batch file from a batch file, you would use the CALL command with the second batch filename directly after. You can also enter some limited logic such as the IF function to check for a condition. These functions may direct the system to a different batch file or to exit depending on the result of the condition. After the secondary function is complete, except for an exit command, the system will return to the next line of the batch program until it's completed. This would be a good tool if you have several files that need to run repeatedly.
There is also an option for creating an executable file from you batch file. This requires you to purchase a separate compiler program.

Clusters (Lost and Cross-linked)

The easiest way to describe cross-linked clusters is: two or more clusters that the File Allocation Table (FAT) or the Master File Table (MFT) points to that belong to more than one file. The clusters or allocations units are all the same size across the disk. The File Allocation Table has the same number of entries as there are clusters on the disk. This is how the FAT keeps the information on where the clusters are physically located on the disk. The FAT also stores the filename, date, time, size, file attributes, where the beginning of the file is located, and whether the cluster is at the end of the file (EOF) or what the next cluster number is.
Lost clusters are usually caused by files that are not completely deleted or files that have cross-linked clusters that are completely deleted taking the cross-linked cluster with it. This causes the remaining file that the cluster was cross-linked with to be missing that data. Also, corrupted data in the File Allocation Table itself can cause clusters to become lost. If this occurs you have a major problem. There are no provisions in the FAT system to help you recover data errors.
The recommended cure for clusters that are cross-linked, however, is to delete the files that both require the same cluster. Removing one file will not cure the problem as mentioned above.

Task Manager

The easiest way to open Task Manager from Windows XP Home Edition, is to press the Ctrl + Alt + Del keys which will open the Windows Security window. Select Task manager and a window opens showing Windows Task Manager. Depending on the operating system you are using, you will see folder tabs that will show Applications, Processes, and Performance. On my system it also shows a tab for Networking and Users.
Starting with the first tab, Applications, you will see any programs that you have selected to run from you windows desktop. This screen is useful when you have launched a program and it seems to be stalled. You can open the Task Manager Applications tab and see if the program is actually running or shows "not responding". If the program is locked up, you can select the End Task option and Windows will close the program and return you to the desktop. You can also see the some additional information at the bottom of the window showing Processes currently running, percentage of CPU usage, and Commit Charge which shows the virtual memory size and the Peak amount of virtual memory you are using.
The Processes tab shows the complete list of processes that are running on your system. This is useful if you suspect a virus or other unwanted programs may be running on you system.
The third tab is Performance. This is a technicians best friend as far as live system feedback. This will display a running graphical image of the system. You can also select from the View option, the Show Kernel Times and this will be added in red to the graph of CUP usage. The lower graph shows the Page File Usage History and at the bottom there are summaries of the different Handles, Threads, and processes as they run. There are also statistics on the memory and cache totals and availability of each type. This information can be particularly useful if you're running at maximum capacities in any of these areas. You may want to make changes or add memory based on how much you're using.
The next tab is Networking. This shows the network utilization in percentages on the graph. If the Options are set with a check next to Always on Top, you can log on to the TMCC website and view your network usage. This is not as useful a tool for a single user but if you're a network administrator with several workstations accessing the Internet through a server, it can become a useful screen for checking access peaks. It can show if your system is responding slowly or if the Internet service provider is returning data slowly.
The last tab is Users. This screen shows who is currently logged onto the system. This is also useful is you are running a system backup and one of your employees has forgotten to log off before going home. You can disconnect this user and continue with system maintenance. This has happened several times to me and I do enjoy disconnecting people

The Registry

You can find the Windows XP and 2000 registry editor by typing "regedit" from the Run command line or opening the Command Prompt window and typing "regedit.exe". What is displayed is all hardware, users, preferences, operating system programs, and PC settings in a tree format. Windows 2000 and XP Pro for instance displays the following Keys under My Computer:

+ HKEY_CLASSES_ROOT
+ HKEY_CURRENT_USER
+ HKEY_LOCAL_MACHINE
+ HKEY_USERS
+ HKEY_CURRENT_CONFIG

These keys contain subkeys, where there is a "+", and yet more subkeys can be nested within these subkeys. The data stored in each key are called values which consists of names and the associated information. Each group is split into Hives which are labeled with "HKEY" which simply stands for Hive Key and a filename indicating what information is stored there. For instance HKEY_LOCAL_MACHINE has the settings for Hardware, SAM, Security, Software, and System. These contain information about the settings for Windows and hardware device drivers to name a few. Some of this data is changed each time the system in booted and is not stored in the files permanently but by each session.
The information stored in the registry files can be edit manually. Unless you are intimately familiar with these files and their contents, it would be advisable to backup each file before editing. These files can easily become corrupted and cause your system to crash. If on the other hand, you venture into editing these files, after backing them up, you can easily delete leftover portions of uninstalled programs that left files behind. This can slow your system down considerably over many months of adding and deleting programs. Some older uninstall programs will leave data in the registry without the use knowing it. Several companies now offer registry cleanup programs and I would recommend visiting a trusted website like Consumer-Review.org obtain a legitimate program to delete unwanted data.

Event Viewer

The Event Viewer window can be accessed through Start, Programs, Administrative Tools, Event Viewer. There are three categories of logs that you can view. The first is Application, which shows all the events for the Windows applications. These log entries will indicate errors if an application did not start correctly or if it ended abruptly.
The second log is the Security events. This log is useful for log in errors if you're a network administrator. it can show failed attempts to log on and how many times they happened. This could indicate someone is attempting to discover passwords or you may just need to re-train an employee in the use of log in names and password security. The only program that has access to write to this file is the lsass.exe also known as the Local Security Authority Subsystem Service.
The last log is the System events. This file is an event list the operating system uses. Some of the information written to this file references operating system information and errors that may have occurred. It also displays general information on programs as they enter running states such as Windows Firewall.
Occasionally you will want to view these events to verify your system is running correctly without errors. If you do see an error, you can highlight the error and right click the mouse button. When the menu appears, click on Properties and it will give you a description of the error. This will show information on the file or device that generated the event. You can also select the "more information" web link to Microsoft and it can give you a more detailed description and possible actions to take to correct the error.

Friday, February 22, 2008

Multithreading

The thread part of multithreading goes back to the kernel which is the heart of the operating system. The kernel controls the interaction between the hardware and the software. Keeping this in mind, processes are also included in the kernel. The operating system assigns the resources to the processes and they include the device handles, memory, file handles, and windows.
Threads are contained in each process. There can be as few a one or as many as the system needs to complete a required task. These threads can be run in parallel on some systems and as single operations on other systems. It's all considered multithreading. On single processor systems, threads are run one at a time but are sun so quickly the user is unaware of this fact. With the new dual core and quad core processors, threads can be run simultaneously on each core.
Multithreaded programs can run faster on systems with these new CPU's since the programs can be divided into several tasks running at the same time. Unfortunately, programs written to take advantage of this capability have to be constructed in such a way that the threads do not attempt to use the same resources at the same time. This can result in bus contentions or deadlock issues.
Several types of multithreading are in use today. Block multithreading consists of a single thread running until it's blocked. If a call to a memory location that is not in the cache is to be made, it may take several CPU cycles to retrieve the data. In this case, that thread is blocked and the thread processor could allow another thread to run in its place until the memory fetch is complete. This causes the hardware to switch register sets and adds time to the execution of the thread.
Interleaved multithreading reduces the number of CPU cycles down to one thread switch per CPU cycle. In this case the thread processing time is considerably less and each thread is executed separately from on another.
Simultaneous multithreading goes one step further. Each thread consists of multiple instructions per CPU cycle. These threads still contain program counters and are used in superscaler processors.
Hardware and software designers are always attempting to take advantage of the thread scheduler capabilities. The most efficient design would achieve the most thread instructions issued in the least number of CPU cycles while avoiding thread blocking altogether.

HAL Hardware Abstraction Layer

A hardware abstraction layer (HAL) is embedded in software between the computer hardware and the operating system. HAL enables several different computer systems to access programs such as Window NT without having to write a separate operating system for each brand.

The hardware abstraction layers communicate directly with hardware devices such as motherboards. It serves as an interpreter for high level languages to enable them to interact with the lower level component hardware.

Abstraction layers are better visualized by graphics programs. They translate simple program commands into complex screen graphics. Another example of abstraction layers has to do with an older networking process called the OSI (Open Systems Interconnection) model. Seven abstraction layers make up the OSI model; Application, Presentation, Session, Transport, Network, Data Link, and Physical.

The application layer consists of the applications software which is what we use to initiate the communications process. The presentation layer will convert the data to code, compress the data, and encrypt the data. The session layer handles the information exchanges. The transport layer controls the flow and any errors that may occur. It can also retransmit segments that fail. The network layer receives the data from the transport layer with the sequence numbers identifying the segment data. It will address the data with Internet Protocol (IP) addresses, encapsulate the data, routes the data, and decapsulates data as it returns.

The data link layer allows data exchanges between devices. It converts the data into frames. The final layer in the process is the physical layer. This encodes the data into binary signals that are then transmitted to the receiving device.

We obviously do not see these steps as they occur but the next time you use email keep in mind that without hardware abstraction layers to handle the task required, the data would be meaningless.

ACPI Advanced Configuration and Power Interface

ACPI consists of several components that are designed to manage power usage in you PC. For something that seems fairly minor in theory, it is very complicated in its application. There consists several elements such as the ACPI register set, ACPI BIOS, ACPI table, and two operating system elements; the OSPM system code, and the ACPI driver with the AML interpreter. The following chart indicates each of the elements of the ACPI. Courtesy of the ACPI specification Revision 3.0a.



Before Windows 98, the power management system relies on BIOS to control it. Since the release of Windows 98, more control has been granted to the operating system by way of the AML or ACPI Machine Language embedded in the BIOS firmware. This gives the operating system the means to control the low-level information relating to the hardware thus giving it more control over the various states devices can be placed in to control power usage. Older systems had no way to interpret the AML and had no clue how to handle the ACPI registers. ACPI specifications outline standards to which manufacturers must conform to insure that all devices including motherboard chipsets, operating systems, and CPU's can support current ACPI designs. The current ACPI specifications that I've based some of this outline on are from Revision 3.0a.

There are several states of power management described as global states, processor states, device states, and performance states. There are also several layers within each state that the computer system can be placed in.

Global state G0 is the working state. The software is running, there is no latency (delay in response) and the power consumption is at its highest. The computer should not be disassembled in this state due to the risk of electrical shock and system damage.

The G1 state is considered sleeping which is further divided into modes S1 to S4. In S1 mode the CPU stops running and all unnecessary devices are shut down. S2 mode goes a little further than S1 in that the CPU is completely powered down. S3 also called SUSPEND to RAM (STR) or standby in Windows. The only ting powered in this mode is RAM. The system will still maintain all data and will resume without rebooting. S4 or Hibernation by Windows, the data in the main memory is saved. This means that if the computer looses power the only loss of data would be any unsaved documents.

The G2 also known as S5 Soft off, are almost the same as the next state G3, except the system is still using a minimum amount of power. The system must go through a restart and there is a long latency. The computer should not be disassembled in this state.

The G3 state is achieved by powering down the system and no power is being consumed except for the real-time clock. A hard boot is required to return the system to working mode. This is the only state that the computer can safely be disassembled after removing the power cord.

The next set of states are the Device states. There are only four levels D0 through D3. D0 is the state when the device is operating and consuming power as it needs to. D1 and D2 are entered as required by each of the different devices. D3 requires no power and will no communicate with the system. This level requires the device to be reinitialized in order to be used.

Processor states have only four levels as well. They range from C0 to C3. C0 is full operation. C1 also called HALT, the CPU is not executing any instructions and can be returned to working mode in the shortest amount of time. C2 also known as Stop-clock, takes longer to wake up than C1 and uses less power than C1. C3 is known as Sleep and takes the longest to return to working mode and uses the least amount of power.

Performance states are mostly defined by the manufacturers of processors. They range from P0 to P16. In the P0 state, the processor or device is at its highest level and will use the most power. The remaining states are all lesser levels then P0 and will vary by processor.

The complete ACPI specification can be obtained online and contains over 600 pages of additional information including specific syntax requirements for device designers. If you have the time, it's well worth a look and a copy can be downloaded at www.acpi.info/.

Friday, February 15, 2008

Blog 2 Assignment ESD

ESD events occur naturally when two materials with different electrical potentials attempt to balance out. Human skin is one of the most easily charged materials second only to air. The charge is derived from an excess of electrons being stored. When we come into contact, or proximity, with a device or substance with a fewer number of electrons the balancing process can be seen as an arc. These static events can range in voltage from a few millivolts to several thousand volts. This voltage is not necessarily responsible for curcuit damage rather the current and how quickly the current passes defines the extent of the damage done.
Large amounts of current can cause complete component failure or a partial failure that gets worse over time. Complete failure is fairly easy to diagnose. Partial failure can cause odd component reactions intermittently which are never easy to diagnose. See photos below courtesy of SRI, Source Research Inc.

As indicated by the photos, an ESD event has damaged a board trace and a capacitor. The trace should fail more quickly than the pit showing on the cap. This could cause a slow failure over time.

Components can be damaged even before they are populated on the board. Proper ESD prevention can reduce the number and severity of these events. Never take a part from someone without touching them first to equal the potential voltage between you. Preferrably, touch the hand that does not contain the part, or use and anti-static bag or foam to transport parts. Grounding bracelets, mats and anti-static bags are the most popular preventative devices.

ESD can be destructive to high speed digital circuits even if you can't feel a shock. Keeping this in mind will keep you from adding more problems than you are trying to fix.

Blog 2 Assignment POST

I have selected the POST and ESD items from our list. Please drink lots of coffee before viewing.

Power On Self Test better known as POST, is the first sequence in the pre-boot routine. This self test program is run from the BIOS and verifies, through diagnostics, that all the systems in the computer are functioning properly. If a system passes POST depending on the type of system, you will hear one or two beeps as the boot program continues to run.
On a hard boot, the first system checked is the power supply. This check verifies the correct voltages are present by way of the power good signal. Some systems use a reset instead of a power good signal. Either way, the condition of this signal tells the system to continue or hold. The next check is the BIOS itself. It must report a valid checksum to indicate that it does not contain corrupt data. From here, different systems may alter the following sequence but the checks must all be done.
The CPU must indicate that it has completed its power on reset and is capable of initializing communications with memory. Read and write tests are done to the first 64KB to verify bus, module and controller function. The CMOS must also pass a checksum test to insure there is no corrupt data. The last series of tests check the I/O functions are working properly including the video. Again, a series of read and write operations are preformed.
The soft boot routines are not quite so extensive. Much of the information from the hard boot are saved and do not need to be re-run. After for POST has run the operating system takes control and finished initializing the hardware with the installed device drivers.
I won't bore you with each beep code and description since they will be different depending on the type of BIOS driving the system. They will show the obvious errors such as BIOS and CMOS checksum errors and some not-so-obvious errors like errors with the system clock, PCI bus communications errors, coprocessor erros and configuration errors. I have seen these errors personally and wouldn't wish them on any repair technician.
POST does not perform all the startup routines though. During startup, it may pass the initialization of certain devices off to other programs. In summary, the POST is not only a necessity for the computer to become operational, but is also the best tool you can use to troubleshoot a system.