[MagicAndre1981]

How to get the cause of high CPU usage by DPC (Deferred Procedure Call) and interrupts?

Ok, you found this guide, because you see this:

 ProcessExplorer_DPC_1.png (37.7K)
Number of downloads: 832

in Process Explorer/Hacker or you run the DPC Latency Checker tool an see this:



(Attention: If you use Windows 8, don't use the "DPC Latency Checker tool". Due to internal Kernel changes in Windows 8, the "DPC Latency Checker tool" shows DPC spikes of over 1000µs all other the time. Those VALUES are not correct!)

The developers of the tool try to create a Windows 8 compatible version.


Here I will tell you a ) to see which driver causes the high CPU usage and b ) which driver causes the spikes.

To get started you need the Windows Performance Tools Kit. Read here how to install it:

http://www.msfn.org/...howtopic=146919

Now open a command prompt with admin rights (http://windows.micro...or-access-token), go to C:\temp (cd\temp) and run the following commands:

xperf -on latency -stackwalk profile

now wait a time while the high DPC and Interrupt usage occurs.

to stop the trace run the following command:

xperf -d DPC_Interrupt.etl

This closes the trace and writes the result to the file DPC_Interrupt.etl.

In the next step, make a double click on the etl file to run the Viewer.

Now wait until the 2 passes are over.

Go to "Trace"->"Configure Symbol Paths" and type in the following:

srv*C:\symbols*http://msdl.microsoft.com/download/symbols

Click ok, to close the dialog.

Now go to the graphs "DPC CPU Usage" or "Interrupt CPU Usage" (depending where you high CPU usage) and select the intervall, make a right click and select "Load Symbols" and next click summary table.

 DPC_Trace_Section.png (42.58K)
Number of downloads: 1731

Now, you have to accept the license agreement to download the public debugging symbols.

(NOTE, THE PDBs ARE SOMETIME VERY HUGE. BE AWARE THAT IT MAY TAKE SOME TIME IF YOU HAVE A SLOW INTERNET CONNECTION)

Here you'll see summary of the calls

 DPC_Trace_Summary.png (60.14K)
Number of downloads: 2358

For me the cause is the NDIS.sys. This is a part of the networking system. The usage comes for me, when I have nearly 100% network speed usage on my 100MBit LAN adapter of my notebook.

In your case, you should see the driver which causes the issues.

An alternative way is to use the xperf commandline tool to dump the values into a text file:

xperf -I DPC_Interrupt.etl -a dpcisr > dpc.txt

Open the generated dpc.txt with notepad. Under CPU Usage Summing By Module For the Whole Trace you can see a summary of all DPC usage for each CPU core. Look here which driver is causing the high CPU usage.

Look in the dumped text files for µsec values which are over 256µsec. They can be critical.

An alternativ to xperf is the tool LatencyMon



It shows you the same statistic you see in the text file, but it shows you the values in realtime. So you can see which driver is the cause.

You can download this tool from here:

http://www.resplendence.com/downloads

If the NDIS.sys driver is shown as possible cause, check your (W)LAN drivers for updates. For usbport.sys, check your chipset and USB device drivers for updates. if you see ACPI/HAL you may run into power saving feature issues. So update the BIOS and change the Power Plan in Windows.

To see which driver versions you use run this command:

xperf -I DPC_Interrupt.etl -a fileversion > fileversion.txt

Now open the fileversion.txt and look for the driver version you use. Do a Bing/google search if you can find updated drivers.

If you see UNKNOWN as cause you run drivers which use dynamic code. 1 known driver which uses such dynamic code is the DuplexSecure SPTD driver which is used in tools like DAEMON-Tools. If you see the UNKNOWN as a possible cause look if you have the SPTD driver installed. If yes, download the latest installer, run the installer and select "Uninstall" and reboot. Now run the xperf commands again and look if you see the real driver.

Ok, I hope, this helps you to determine which driver is causing high DPC, interrupt usage and spikes which causes sound glitches.

This post has been edited by MagicAndre1981: 01 September 2012 - 02:53 PM

[tpgchina]

MagicAndre:

Thank you very much for this post. I had a very similar problem and used your instructions to identify the problem.

In my case, Win7 automatically updated a driver for an I/O card and there were conflicts with the IRQ's. I had suspected the driver update as it occurred about the same time that I noticed the high (30%) CPU usage. But I had no idea how to check or confirm until reading your post.

Vielen Dank!

Tim

[MagicAndre1981]

Hi Tim,

great to hear this

Have fun now with Windows 7 now

André

[Ogiwan]

MagicAndre, excellent tutorial. However, when I got the table, the module that was eating up all my CPU was "Unknown", and the function was "0xfffffa80076e15a0". This was in the Interrupt CPU Usage Table.

In the DCP CPU Usage table, the big boy was a very similar process; Module "Unknown", and function "0xfffffa80076e10a0".

Do you have any insight? I would attach the ELT, but it's 54 megs...

[MagicAndre1981]

please select "Load Symbols" before opening the Summary Table.

You can also compress the file to a 7z or RAR archive and upload it to your SkyDrive. Send me the link to the file as a Personal Message.

[MagicAndre1981]

Do you have Deamon Tools installed? If yes, remove them and make a new trace if you still have the issue.

[fobkid]

Hello Andre,

First of all, thanks so much for your help.

Here is my problem:

I am running a Core 2 Duo E6300 on a Intel DG965WH motherboard, I recently switched up some components and move the computer over to a new case and the high CPU usage started happening.

I've ran everything you have suggested and found out that my high CPU usage was caused by a module called intelppm.sys with a function called C1Halt.

I searched it up and it seems like the intelppm.sys is the processor driver, I know I can't disable that. So what should I do at this point?

Thanks,
Mike

[Ogiwan]

MagicAndre1981, on Feb 13 2010, 05:51 PM, said:

Do you have Deamon Tools installed? If yes, remove them and make a new trace if you still have the issue.

I had Deamon Tools, but I removed it when I read that some people found that DT was slowing their computers. In any event, my computer was sluggish before I installed DT, so I can only infer that its not a result of DT. In fact, when I first installed Windows 7, I only had 3 gigs of RAM in, and I was so sick of the sluggishness that I upped it to 8 gigs (all new chips).

This post has been edited by Ogiwan: 13 February 2010 - 08:28 PM

[MagicAndre1981]

fobkid, on Feb 14 2010, 01:47 AM, said:

I've ran everything you have suggested and found out that my high CPU usage was caused by a module called intelppm.sys with a function called C1Halt.

is the C1Halt function called from the Idle process? If yes, this nothing you should worry about. This is a powersaving feature of CPUs (http://en.wikipedia....Power_Interface).

Ogiwan, on Feb 14 2010, 03:27 AM, said:

I had Deamon Tools, but I removed it when I read that some people found that DT was slowing their computers.

ok, because I can't see which driver is causing this you must use the old "try and look" way be running a clean boot:

http://support.microsoft.com/kb/929135

Does a Clean boot help? If yes, a driver from your application is causing it.

This post has been edited by MagicAndre1981: 14 February 2010 - 07:15 AM

[Ogiwan]

A clean boot doesn't seem to help; function "0xfffffa80077005a0" is still 30% in the "Actual Duration" column, and it still doesn't know what it is.

I'm not reading that wrong, am I? It's not the "system idle" process under a cunningly concealed name, right? The next greatest usage is hal.dll, but that only comes in at a palty .09 "% Actual Duration". I can't see how that would affect performance.

[MagicAndre1981]

Could you please upload the trace file? Compress it as Zip or RAR first, please.

[preisl]

Thanks for this brilliant article! It helped us tracking down high CPU usage on HP 6930p and HP 2530p series notebooks. In our case, the driver was

dxgkrnl.sys

which indicates outdated graphic card driver. For all HP 6930p / 2530p users with Intel graphic chip-sets: It's a good idea to use the original Intel drivers and not the HP branded ones - the latter ones are outdated and my cause this high CPU usage behavior (at least on Vista 64 bit)

best regards,

Martin

This post has been edited by preisl: 24 February 2010 - 05:40 AM

[MagicAndre1981]

Hi Martin,

great to hear that my guide helped you to solve your issue

greetings from Germany to Austria.

André

[CanPCUser]

MagicAndre,

I have followed your guide in an attempt to solve a similar issue on my PC. I am running Windows 7 (x64) with an AMD Phenom 8450 Triple-Core Processor. After going through the steps you have outlined, I have discovered that my issue is with usbport.sys.

In your guide you mention to update the chipset drivers to solve this problem. I must admit that I am not entirely sure how to do this. In the meantime, I have gone into Device Manager and checked for driver updates on every hardware component listed and the problem has still not been alleviated. Any assistance that you can provide in leading towards a solution to this problem would be greatly appreciated.


CanPCUser

[sounds]

Hi Andre, I got to say that you wrote a pretty easy to follow article. I'm not expert computer tech but I need to understand certain things in case things go wrong as I work with pro audio. I actually started my thread over at http://social.answer...85-50611921c011 . To make a long question short, I use a DAW called Sonar8 and I get the occasional dropout, but with my system specs it doesn't make much sense, the frequency is way to often.

I followed you're instruction on how to find the cause of high cpu usage. i completed it but I would like to also know where does the DPC_Interrupt.etl get saved I found mine in '' C:\ '' and it was named Kernel not DPC_Interrupt.etl. Is there a way to name it something else? or put it on the desktop initially during it's creation?

I don't understand the stats very well, it seems like under Interrupt CPU usage- Module -'' Wdf01000.sys '' is to blame the odd thing is that it goes to about 11% actual Duration, but the audio dropout happens 50 seconds later.

I saved what I believe to be a representation of the issue, can you have a look and confirm there is a problem with DPC or anything else. Thanks. Also Im sorry if im posting in the wrong forum.

im not able to upload my file so i post it here for upload , thanks http://www.sendspace.com/file/t5eaaa

This post has been edited by sounds: 03 March 2010 - 06:53 PM

[MagicAndre1981]

CanPCUser, on 03 March 2010 - 06:24 PM, said:

I have discovered that my issue is with usbport.sys.

Hi,

with chipset drivers I mean the Southbridge/USB drivers from your mainboard. Which Mainboard do you have? Go to the homepage and look look for the latest drivers and install them.

You can also try to install the Update KB976972, which updates the microsoft USB drivers.

[MagicAndre1981]

sounds, on 03 March 2010 - 06:37 PM, said:

I followed you're instruction on how to find the cause of high cpu usage. i completed it but I would like to also know where does the DPC_Interrupt.etl get saved I found mine in '' C:\ '' and it was named Kernel not DPC_Interrupt.etl. Is there a way to name it something else? or put it on the desktop initially during it's creation?

@sounds,

you did not run

xperf -d

to merge the trace to a new etl.

The Wdf01000.sys is a kernel driver framework provided by MS to simplify the coding of kernel drivers.

Are you running the latest drivers for your Pro Sonus device?

Download the latest drivers and install them:
http://www.presonus....ivers-software/

André

[CanPCUser]

MagicAndre1981, on 03 March 2010 - 07:25 PM, said:

Hi,

with chipset drivers I mean the Southbridge/USB drivers from your mainboard. Which Mainboard do you have? Go to the homepage and look look for the latest drivers and install them.

You can also try to install the Update KB976972, which updates the microsoft USB drivers.

Andre,

Thank you for the timely response. How do I determine which Mainboard I have?


CanPCUser

[MagicAndre1981]

Download Diagnostic Tools like Everest Ultimate or SIW to see which mainboard do you have. Everest also provides links to the driver page.

[sounds]

MagicAndre1981, on 03 March 2010 - 07:43 PM, said:

sounds, on 03 March 2010 - 06:37 PM, said:

I followed you're instruction on how to find the cause of high cpu usage. i completed it but I would like to also know where does the DPC_Interrupt.etl get saved I found mine in '' C:\ '' and it was named Kernel not DPC_Interrupt.etl. Is there a way to name it something else? or put it on the desktop initially during it's creation?

@sounds,

you did not run

xperf -d

to merge the trace to a new etl.

The Wdf01000.sys is a kernel driver framework provided by MS to simplify the coding of kernel drivers.

Are you running the latest drivers for your Pro Sonus device?

Download the latest drivers and install them:
http://www.presonus....ivers-software/

André

Thanks for taking the time to look into this, I ran xperf -d DPC_Interrupt.etl in a elevated CMD. I just edited my message I realize how to store the test else were on my drive.

Does it make sense that Wdf01000.sys is causing a function 0xfffff88000eb07f0 and the actual duration is 795.243263. I think this could be causing my dropout, but i don't understand this stuff to well.

As for the Presonus Firestudio drivers they are up to date for W7.

Any suggestion?

This post has been edited by sounds: 05 March 2010 - 12:31 AM