cygrunsrv.exe with csrss.exe cause 100% system load with API-Call

Alexander J. Herrmann
Mon Apr 10 15:18:00 GMT 2006

I don't get the 100% ...
The example is with slight modifications the same as the one "Taking a 
Snapshot and Viewing Processes" in BorlandC++ 6.0 from the M$ SDK. But 
everytime I try it all the processes within the Snapshot seem to be 
I found another Example from Borland getting all the processes with a 
WindowHandle. As a virus or trojan may not have a window handle it's 
kind of useless. But when getting the list (in the borland example) the 
put a lock on a global semaphore which is released after the list is 
processed. The 100% can be caused in your case by a continious reloading 
of the list, imo.
Why csrss goes wild could be the fast pid changeing inside cygwin and 
then continiously refreshing the windows internal list triggered by 
GetProcessModule which as a side effect refreshes windoze internal list 
(because they seen to loose messages in there system all the time) 
without altering the snap. The effect can best seen by monitoring the 
windoze internal messages. GetProcessModule triggers something else 
inside the Windoze kernel (imo the update of the process list) as a side 
effect. Cygwin on the other hand depending on the threads and programms 
uses a lot of pids. Before Windoze got it's list updated it's outdated 
resulting in a new update request.
Sorry, that's a real Micro$oft issue. The problem worsens because if the 
first windoze internal message isn't done before a certain timeout 
another internal windoze kernel messages is created. From my observation 
up to three messages. So one call of of the kernel triggers up to three 
side messages.
Locking the table by issuing a semaphore on it like borland does may 
help because other processes have to wait for a new pid until the 
semaphore is cleared. Anyway thanks to that I can understand why so many 
people complain about 100% csrss.
It's not a cygwin problem as cygwin depends on the underlying windoze 
system and windoze seem not to be able to handle fast pid changing for 
short running processes well.

Patrick Lichtner wrote:

>Hash: SHA1
>Hi Alex,
>yes, of course you are allowed to forward the files in cygwin mailinglist.
>Thanks for your feedback in advance.
>>>Hello Patrick,
>>>I got the files. I'am allowed to forward them to the cygwin
>>>mailinglist so that people with more expierience can take a look at
>>>them. Like I said the 100% csrrs did come up a couple of times.
>>>I try to compile them now WindozeXP SP2 current Cygwin.
>- --
>Patrick Lichtner, Teamleader Second Level Support - Avira GmbH
>Tel.: +49 (0) 7542-500 172
>Fax.: +49 (0) 7542-952 061
>PGP Key-ID: 0x01690413
>PGP Fingerprint: 2D51 EB40 C4AF 8717 FBF3  1FFC 0D05 7914 0169 0413
>Avira GmbH
>Lindauer Str. 21, D-88069 Tettnang, Germany
>Telefon: +49 (0) 7542-500 0
>Telefax: +49 (0) 7542-525 10
>- -------------------------------------------------------------------
>Hinweis: Die H+BEDV Datentechnik GmbH hat ihren Firmennamen geaendert
>und heisst ab sofort Avira GmbH. Infos unter
>- --------------------------------------------------------------------
>Es gelten unsere Allgemeinen Geschaeftsbedingungen (AGB). Sie finden
>sie in der jeweils gueltigen Fassung unter
>- --------------------------------------------------------------------
>Version: GnuPG v1.4.1 (GNU/Linux)
>Comment: Using GnuPG with Thunderbird -

And God said"Let there be light."But then the program crashed because he was trying to access the 'light' property of a NULL universe pointer.

Alexander J. Herrmann

Unsubscribe info:
Problem reports:

More information about the Cygwin-xfree mailing list