Explantion for CSRSS.EXE using the GPU

This is a follow up question to conhost.exe and csrss.exe questions

I am currently on a Windows 7 x64 machine, using a relatively high end GPU (GTX 970 4 GB). Windows Aero is enabled. I am using Process Explorer to examine this case.

I have two csrss.exe processes running, both as SYSTEM, one under session 0 and one under session 1. I have csrss.exe files, both in the correct directories. Using Process Explorer, I can see my GPU is being used only by csrss.exe. The session 1 csrss.exe is using it. Closer examination of the process’s threads reveals these .dll files:

Cdd.dll
Winsrv.dll
Csrsrv.dll

Cdd.dll – the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.

Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer.

So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article: instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel. So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.

So dwm.exe, which I would have presumed would have been using the GPU, is instead someway showing through csrss.exe.

So that at least explains the story partly. When idle at the desktop, GPU usage is > 0.01%. However, if I interact with certain UI elements of a program, for example hovering over the GPU graphs to bring up stock-like windows UI, or hovering over parts of Steams UI (Steamworks is a video game drm client) the GPU usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over Process Explorer graphs, it can go to 15-20%.

I selected the csrss.exe process in question and pressed Ctrl+H. I found threads related to procexp64.exe, steamwebhelper.exe (displays web API for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock UI elements.

I tried Safe Mode and creating a new standard user account, but the same activity occurs.

My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing GPU usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle GPU usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with Aero enabled, but I’m wondering if this is normal activity for a high end machine.

Should csrss.exe be using the GPU like this when calling on things like cdd.dll and winsrv.dll?

Specs:

• I5 3570k
• GTX 970 4 GB
• 8 GB RAM
• Windows 7, 64-bit

2 Answers

I was just having the same issue. I was going to terminate csrss.exe, but then noticed one thing in Task Manager. The Video Encoder part of the GPU was in use.

So the problem was that my AMD Radeon Crimson ReLive was doing this thing called 'Instant Replay' in which the gameplay of last few minutes is continuously captured. Even though I had disabled 'Record Desktop' in settings, it was still recording. So this was just a bug which was using GPU.

TL;DR: Disable Instant Replay. How to disable it? It depends on what recording/streaming software does your PC has. Just Google it.

Note: If disabling Instant Replay does not solve the issue, or it is already OFF or you don't have streaming software, your PC might be infected by a virus or something.

So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.

On Windows 7, csrss does not link to cdd.dll on my VMMap. gdi32.dll still hooks into win32k.sys SSDT, which directs the calls to functions in CDD kernel driver (cdd.dll), which calls functions in dxgkrnl.sys and hence the kernel mode miniport display driver for hardware acceleration. The output is a texture in VRAM whose address is then sent by the application's directx runtime .dll (via ALPC?) to DWM for shading the fragments with the textures and composition and rendering to the back buffer, which it does at the next vsync

Im assuming that cdd.dll is in csrss on Vista and seemingly win32k.sys attaches a thread to it to perform the rendering to a window bitmap in system memory without hardware acceleration, which then gets converted to a directx texture in VRAM, which gets applied to the window primitive by DWM/MIL using calls to dxgkrnl.sys directly and rendered to the back buffer in VRAM in reverse order of the composition tree.