Hardware interrupts and DPC's high CPU,sound gargled on boot
Posted: Wed Oct 10, 2012 11:18 pm
You find that your system is running slow but the general task manager does not show the faulty process, but if you run process explorer by sysinternals you notice that interupts is hogging your CPU. THen following the steps below to determine the offending part.
I think generally its the network drivers
Install the Windows Performance Toolkit from the Windows SDK for Windows 7 and .Net Framework 4.
http://www.microsoft.com/download/en/de ... px?id=8279
Now open a CMD window with admin rights, go to a folder like C:\temp and run this:
xperf -on latency -stackwalk profile -buffersize 1024 && timeout -1 && xperf -d DPC.etl
Now run
xperf -I DPC.etl -a dpcisr > dpc.txt and open the DPC.txt. Look which driver has spikes over 1000µs.
if you require to run on XP then you can do the following
also -stackwalk is not supported in XP
From a Win7 Vista or WS2008 installation copy xperf.exe and perfctrl.dll to the target system. This is all xperf needs to support trace control.
After you have generated an ETL file, you can then copy it to a Vista or WS2008 system for trace decoding
SO for XP (tried and tested)
install above to Win7 machine
extracted the files from the C:\Program Files\Microsoft SDKs\Windows\v7.0\Bin\wpt_x86.msi
coppied this to the XP machine
then run
created a temp dir same level as the dir that contains the xperf.exe (also rename that dir to toolkit)
cd 'ed into the temp dir
..\toolkit\xperf -on latency -buffersize 1024
waited a while
..\toolkit\xperf -d DPC.etl
get the message
Merged Etl: DPC.etl
The trace you have just captured "DPC.etl" may contain personally identifiable i
nformation, including but not necessarily limited to paths to files accessed, pa
ths to registry accessed and process names. Exact information depends on the eve
nts that were logged. Please be aware of this when sharing out this trace with o
ther people.
then copy the DPC.etl file back to Win7
and run
..\toolkit\xperf -I DPC.etl -a dpcisr > dpc.txt (as yopu can see i created the same directory structure as XP for ease )
then examine the file dpc.txt (see example below)
from that it looks like the atapi.sys is at fault
possible fixes
Atapi.sys is the Microsoft-supplied IDE/ATAPI Port Driver. check IDE drives are running in DMA mode rather than PIO?
IF stuck in PIO mode, uninstall the drivers and reboot, it should re-install as DMA
--------------------------
DPC Info
--------------------------
CPU Usage Summing By Module For the Whole Trace
CPU Usage from 0 us to 52546875 us:
CPU 0 Usage
usec % Module
3 0.00 ACPI.sys
9 0.00 Fastfat.sys
6 0.00 HTTP.sys
544 0.00 NDIS.sys
151 0.00 RtkHDAud.sys
421 0.00 TDI.SYS
1349 0.00 USBPORT.SYS
228 0.00 afd.sys
422108 0.80 atapi.sys
2 0.00 avgidsshimx.sys
5 0.00 fltmgr.sys
21 0.00 i8042prt.sys
9 0.00 ipnat.sys
6 0.00 ipsec.sys
I think generally its the network drivers
Install the Windows Performance Toolkit from the Windows SDK for Windows 7 and .Net Framework 4.
http://www.microsoft.com/download/en/de ... px?id=8279
Now open a CMD window with admin rights, go to a folder like C:\temp and run this:
xperf -on latency -stackwalk profile -buffersize 1024 && timeout -1 && xperf -d DPC.etl
Now run
xperf -I DPC.etl -a dpcisr > dpc.txt and open the DPC.txt. Look which driver has spikes over 1000µs.
if you require to run on XP then you can do the following
also -stackwalk is not supported in XP
From a Win7 Vista or WS2008 installation copy xperf.exe and perfctrl.dll to the target system. This is all xperf needs to support trace control.
After you have generated an ETL file, you can then copy it to a Vista or WS2008 system for trace decoding
SO for XP (tried and tested)
install above to Win7 machine
extracted the files from the C:\Program Files\Microsoft SDKs\Windows\v7.0\Bin\wpt_x86.msi
coppied this to the XP machine
then run
created a temp dir same level as the dir that contains the xperf.exe (also rename that dir to toolkit)
cd 'ed into the temp dir
..\toolkit\xperf -on latency -buffersize 1024
waited a while
..\toolkit\xperf -d DPC.etl
get the message
Merged Etl: DPC.etl
The trace you have just captured "DPC.etl" may contain personally identifiable i
nformation, including but not necessarily limited to paths to files accessed, pa
ths to registry accessed and process names. Exact information depends on the eve
nts that were logged. Please be aware of this when sharing out this trace with o
ther people.
then copy the DPC.etl file back to Win7
and run
..\toolkit\xperf -I DPC.etl -a dpcisr > dpc.txt (as yopu can see i created the same directory structure as XP for ease
)then examine the file dpc.txt (see example below)
from that it looks like the atapi.sys is at fault
possible fixes
Atapi.sys is the Microsoft-supplied IDE/ATAPI Port Driver. check IDE drives are running in DMA mode rather than PIO?
IF stuck in PIO mode, uninstall the drivers and reboot, it should re-install as DMA
--------------------------
DPC Info
--------------------------
CPU Usage Summing By Module For the Whole Trace
CPU Usage from 0 us to 52546875 us:
CPU 0 Usage
usec % Module
3 0.00 ACPI.sys
9 0.00 Fastfat.sys
6 0.00 HTTP.sys
544 0.00 NDIS.sys
151 0.00 RtkHDAud.sys
421 0.00 TDI.SYS
1349 0.00 USBPORT.SYS
228 0.00 afd.sys
422108 0.80 atapi.sys
2 0.00 avgidsshimx.sys
5 0.00 fltmgr.sys
21 0.00 i8042prt.sys
9 0.00 ipnat.sys
6 0.00 ipsec.sys