Explantion for CSRSS.EXE using the GPU












4















This is a follow up question to conhost.exe and csrss.exe questions



I am currently on a Windows 7 x64 machine, using a relatively high end GPU (GTX 970 4 GB). Windows Aero is enabled. I am using Process Explorer to examine this case.



I have two csrss.exe processes running, both as SYSTEM, one under session 0 and one under session 1. I have csrss.exe files, both in the correct directories. Using Process Explorer, I can see my GPU is being used only by csrss.exe. The session 1 csrss.exe is using it. Closer examination of the process’s threads reveals these .dll files:



Cdd.dll
Winsrv.dll
Csrsrv.dll


Cdd.dll – the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.




Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer.




So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article:
instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.
So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.



So dwm.exe, which I would have presumed would have been using the GPU, is instead someway showing through csrss.exe.



So that at least explains the story partly. When idle at the desktop, GPU usage is > 0.01%. However, if I interact with certain UI elements of a program, for example hovering over the GPU graphs to bring up stock-like windows UI, or hovering over parts of Steams UI (Steamworks is a video game drm client) the GPU usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over Process Explorer graphs, it can go to 15-20%.



I selected the csrss.exe process in question and pressed Ctrl+H. I found threads related to procexp64.exe, steamwebhelper.exe (displays web API for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock UI elements.



I tried Safe Mode and creating a new standard user account, but the same activity occurs.



My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing GPU usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle GPU usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with Aero enabled, but I’m wondering if this is normal activity for a high end machine.



Should csrss.exe be using the GPU like this when calling on things
like cdd.dll and winsrv.dll?



Specs:




  • I5 3570k

  • GTX 970 4 GB

  • 8 GB RAM

  • Windows 7, 64-bit










share|improve this question

























  • You seem to be saying that you have two csrss.exe files — can you elaborate on that?

    – G-Man
    Jan 20 '18 at 17:03
















4















This is a follow up question to conhost.exe and csrss.exe questions



I am currently on a Windows 7 x64 machine, using a relatively high end GPU (GTX 970 4 GB). Windows Aero is enabled. I am using Process Explorer to examine this case.



I have two csrss.exe processes running, both as SYSTEM, one under session 0 and one under session 1. I have csrss.exe files, both in the correct directories. Using Process Explorer, I can see my GPU is being used only by csrss.exe. The session 1 csrss.exe is using it. Closer examination of the process’s threads reveals these .dll files:



Cdd.dll
Winsrv.dll
Csrsrv.dll


Cdd.dll – the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.




Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer.




So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article:
instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.
So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.



So dwm.exe, which I would have presumed would have been using the GPU, is instead someway showing through csrss.exe.



So that at least explains the story partly. When idle at the desktop, GPU usage is > 0.01%. However, if I interact with certain UI elements of a program, for example hovering over the GPU graphs to bring up stock-like windows UI, or hovering over parts of Steams UI (Steamworks is a video game drm client) the GPU usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over Process Explorer graphs, it can go to 15-20%.



I selected the csrss.exe process in question and pressed Ctrl+H. I found threads related to procexp64.exe, steamwebhelper.exe (displays web API for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock UI elements.



I tried Safe Mode and creating a new standard user account, but the same activity occurs.



My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing GPU usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle GPU usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with Aero enabled, but I’m wondering if this is normal activity for a high end machine.



Should csrss.exe be using the GPU like this when calling on things
like cdd.dll and winsrv.dll?



Specs:




  • I5 3570k

  • GTX 970 4 GB

  • 8 GB RAM

  • Windows 7, 64-bit










share|improve this question

























  • You seem to be saying that you have two csrss.exe files — can you elaborate on that?

    – G-Man
    Jan 20 '18 at 17:03














4












4








4








This is a follow up question to conhost.exe and csrss.exe questions



I am currently on a Windows 7 x64 machine, using a relatively high end GPU (GTX 970 4 GB). Windows Aero is enabled. I am using Process Explorer to examine this case.



I have two csrss.exe processes running, both as SYSTEM, one under session 0 and one under session 1. I have csrss.exe files, both in the correct directories. Using Process Explorer, I can see my GPU is being used only by csrss.exe. The session 1 csrss.exe is using it. Closer examination of the process’s threads reveals these .dll files:



Cdd.dll
Winsrv.dll
Csrsrv.dll


Cdd.dll – the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.




Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer.




So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article:
instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.
So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.



So dwm.exe, which I would have presumed would have been using the GPU, is instead someway showing through csrss.exe.



So that at least explains the story partly. When idle at the desktop, GPU usage is > 0.01%. However, if I interact with certain UI elements of a program, for example hovering over the GPU graphs to bring up stock-like windows UI, or hovering over parts of Steams UI (Steamworks is a video game drm client) the GPU usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over Process Explorer graphs, it can go to 15-20%.



I selected the csrss.exe process in question and pressed Ctrl+H. I found threads related to procexp64.exe, steamwebhelper.exe (displays web API for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock UI elements.



I tried Safe Mode and creating a new standard user account, but the same activity occurs.



My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing GPU usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle GPU usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with Aero enabled, but I’m wondering if this is normal activity for a high end machine.



Should csrss.exe be using the GPU like this when calling on things
like cdd.dll and winsrv.dll?



Specs:




  • I5 3570k

  • GTX 970 4 GB

  • 8 GB RAM

  • Windows 7, 64-bit










share|improve this question
















This is a follow up question to conhost.exe and csrss.exe questions



I am currently on a Windows 7 x64 machine, using a relatively high end GPU (GTX 970 4 GB). Windows Aero is enabled. I am using Process Explorer to examine this case.



I have two csrss.exe processes running, both as SYSTEM, one under session 0 and one under session 1. I have csrss.exe files, both in the correct directories. Using Process Explorer, I can see my GPU is being used only by csrss.exe. The session 1 csrss.exe is using it. Closer examination of the process’s threads reveals these .dll files:



Cdd.dll
Winsrv.dll
Csrsrv.dll


Cdd.dll – the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.




Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer.




So perhaps it's something in csrss.exe actually redirecting calls to cdd.dll. Confirmed further by going back to the first Wikipedia article:
instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.
So application calls to gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to csrss.exe via IPC, which csrss.exe redirects to cdd.dll.



So dwm.exe, which I would have presumed would have been using the GPU, is instead someway showing through csrss.exe.



So that at least explains the story partly. When idle at the desktop, GPU usage is > 0.01%. However, if I interact with certain UI elements of a program, for example hovering over the GPU graphs to bring up stock-like windows UI, or hovering over parts of Steams UI (Steamworks is a video game drm client) the GPU usage for csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over Process Explorer graphs, it can go to 15-20%.



I selected the csrss.exe process in question and pressed Ctrl+H. I found threads related to procexp64.exe, steamwebhelper.exe (displays web API for steam.exe, which is also under this csrss.exe), explorer.exe, dwm.exe, and anything that seemed that would create windows/stock UI elements.



I tried Safe Mode and creating a new standard user account, but the same activity occurs.



My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing GPU usage to rise under csrss.exe because that is the process calling cdd.dll? As I said, on idle GPU usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with Aero enabled, but I’m wondering if this is normal activity for a high end machine.



Should csrss.exe be using the GPU like this when calling on things
like cdd.dll and winsrv.dll?



Specs:




  • I5 3570k

  • GTX 970 4 GB

  • 8 GB RAM

  • Windows 7, 64-bit







windows-7 windows gpu aero






share|improve this question















share|improve this question













share|improve this question




share|improve this question








edited Jan 20 '18 at 17:00









G-Man

5,647112359




5,647112359










asked Dec 29 '14 at 16:56









KeyesKeyes

911311




911311













  • You seem to be saying that you have two csrss.exe files — can you elaborate on that?

    – G-Man
    Jan 20 '18 at 17:03



















  • You seem to be saying that you have two csrss.exe files — can you elaborate on that?

    – G-Man
    Jan 20 '18 at 17:03

















You seem to be saying that you have two csrss.exe files — can you elaborate on that?

– G-Man
Jan 20 '18 at 17:03





You seem to be saying that you have two csrss.exe files — can you elaborate on that?

– G-Man
Jan 20 '18 at 17:03










1 Answer
1






active

oldest

votes


















0














I was just having the same issue. I was going to terminate csrss.exe, but then noticed one thing in Task Manager. The Video Encoder part of the GPU was in use.



So the problem was that my AMD Radeon Crimson ReLive was doing this thing called 'Instant Replay' in which the gameplay of last few minutes is continuously captured.
Even though I had disabled 'Record Desktop' in settings, it was still recording. So this was just a bug which was using GPU.



TL;DR:
Disable Instant Replay. How to disable it? It depends on what recording/streaming software does your PC has. Just Google it.



Note:
If disabling Instant Replay does not solve the issue, or it is already OFF or you don't have streaming software, your PC might be infected by a virus or something.






share|improve this answer

























    Your Answer








    StackExchange.ready(function() {
    var channelOptions = {
    tags: "".split(" "),
    id: "3"
    };
    initTagRenderer("".split(" "), "".split(" "), channelOptions);

    StackExchange.using("externalEditor", function() {
    // Have to fire editor after snippets, if snippets enabled
    if (StackExchange.settings.snippets.snippetsEnabled) {
    StackExchange.using("snippets", function() {
    createEditor();
    });
    }
    else {
    createEditor();
    }
    });

    function createEditor() {
    StackExchange.prepareEditor({
    heartbeatType: 'answer',
    autoActivateHeartbeat: false,
    convertImagesToLinks: true,
    noModals: true,
    showLowRepImageUploadWarning: true,
    reputationToPostImages: 10,
    bindNavPrevention: true,
    postfix: "",
    imageUploader: {
    brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
    contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
    allowUrls: true
    },
    onDemand: true,
    discardSelector: ".discard-answer"
    ,immediatelyShowMarkdownHelp:true
    });


    }
    });














    draft saved

    draft discarded


















    StackExchange.ready(
    function () {
    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f858140%2fexplantion-for-csrss-exe-using-the-gpu%23new-answer', 'question_page');
    }
    );

    Post as a guest















    Required, but never shown

























    1 Answer
    1






    active

    oldest

    votes








    1 Answer
    1






    active

    oldest

    votes









    active

    oldest

    votes






    active

    oldest

    votes









    0














    I was just having the same issue. I was going to terminate csrss.exe, but then noticed one thing in Task Manager. The Video Encoder part of the GPU was in use.



    So the problem was that my AMD Radeon Crimson ReLive was doing this thing called 'Instant Replay' in which the gameplay of last few minutes is continuously captured.
    Even though I had disabled 'Record Desktop' in settings, it was still recording. So this was just a bug which was using GPU.



    TL;DR:
    Disable Instant Replay. How to disable it? It depends on what recording/streaming software does your PC has. Just Google it.



    Note:
    If disabling Instant Replay does not solve the issue, or it is already OFF or you don't have streaming software, your PC might be infected by a virus or something.






    share|improve this answer






























      0














      I was just having the same issue. I was going to terminate csrss.exe, but then noticed one thing in Task Manager. The Video Encoder part of the GPU was in use.



      So the problem was that my AMD Radeon Crimson ReLive was doing this thing called 'Instant Replay' in which the gameplay of last few minutes is continuously captured.
      Even though I had disabled 'Record Desktop' in settings, it was still recording. So this was just a bug which was using GPU.



      TL;DR:
      Disable Instant Replay. How to disable it? It depends on what recording/streaming software does your PC has. Just Google it.



      Note:
      If disabling Instant Replay does not solve the issue, or it is already OFF or you don't have streaming software, your PC might be infected by a virus or something.






      share|improve this answer




























        0












        0








        0







        I was just having the same issue. I was going to terminate csrss.exe, but then noticed one thing in Task Manager. The Video Encoder part of the GPU was in use.



        So the problem was that my AMD Radeon Crimson ReLive was doing this thing called 'Instant Replay' in which the gameplay of last few minutes is continuously captured.
        Even though I had disabled 'Record Desktop' in settings, it was still recording. So this was just a bug which was using GPU.



        TL;DR:
        Disable Instant Replay. How to disable it? It depends on what recording/streaming software does your PC has. Just Google it.



        Note:
        If disabling Instant Replay does not solve the issue, or it is already OFF or you don't have streaming software, your PC might be infected by a virus or something.






        share|improve this answer















        I was just having the same issue. I was going to terminate csrss.exe, but then noticed one thing in Task Manager. The Video Encoder part of the GPU was in use.



        So the problem was that my AMD Radeon Crimson ReLive was doing this thing called 'Instant Replay' in which the gameplay of last few minutes is continuously captured.
        Even though I had disabled 'Record Desktop' in settings, it was still recording. So this was just a bug which was using GPU.



        TL;DR:
        Disable Instant Replay. How to disable it? It depends on what recording/streaming software does your PC has. Just Google it.



        Note:
        If disabling Instant Replay does not solve the issue, or it is already OFF or you don't have streaming software, your PC might be infected by a virus or something.







        share|improve this answer














        share|improve this answer



        share|improve this answer








        edited Jan 20 '18 at 16:28









        G-Man

        5,647112359




        5,647112359










        answered Jan 20 '18 at 15:57









        Zaif SenpaiZaif Senpai

        1




        1






























            draft saved

            draft discarded




















































            Thanks for contributing an answer to Super User!


            • Please be sure to answer the question. Provide details and share your research!

            But avoid



            • Asking for help, clarification, or responding to other answers.

            • Making statements based on opinion; back them up with references or personal experience.


            To learn more, see our tips on writing great answers.




            draft saved


            draft discarded














            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f858140%2fexplantion-for-csrss-exe-using-the-gpu%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown





















































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown

































            Required, but never shown














            Required, but never shown












            Required, but never shown







            Required, but never shown







            Popular posts from this blog

            Plaza Victoria

            Puebla de Zaragoza

            Musa