This is a follow up question to conhost.exe and csrss.exe questions
I am currently on a Windows 7 x64 machine, using a relatively high end GPU (GTX 970 4 GB). Windows Aero is enabled. I am using Process Explorer to examine this case.
I have two
csrss.exe processes running, both as SYSTEM, one under session 0 and one under session 1. I have
csrss.exe files, both in the correct directories. Using Process Explorer, I can see my GPU is being used only by
csrss.exe. The session 1
csrss.exe is using it. Closer examination of the process’s threads reveals these
Cdd.dll Winsrv.dll Csrsrv.dll
Cdd.dll – the canonical display driver is particularly important here, as described below in some helpful info below a kind user was able to provide for me.
Under DWM, GDI calls are redirected to use the Canonical Display Driver (cdd.dll), a software renderer.
So perhaps it's something in
csrss.exe actually redirecting calls to
cdd.dll. Confirmed further by going back to the first Wikipedia article:
instead of issuing a system call, the Win32 libraries (kernel32.dll, user32.dll, gdi32.dll) send an inter-process call to the CSRSS process which does most of the actual work without compromising the kernel.
So application calls to
gdi32.dll (which would be anything that renders any Windows GUI component like buttons, scrollbars, text, etc.) end up making their way to
csrss.exe via IPC, which
csrss.exe redirects to
dwm.exe, which I would have presumed would have been using the GPU, is instead someway showing through
So that at least explains the story partly. When idle at the desktop, GPU usage is > 0.01%. However, if I interact with certain UI elements of a program, for example hovering over the GPU graphs to bring up stock-like windows UI, or hovering over parts of Steams UI (Steamworks is a video game drm client) the GPU usage for
csrss.exe rises, maybe a few percent, and depending on what is going on, such as rapidly hovering over Process Explorer graphs, it can go to 15-20%.
I selected the
csrss.exe process in question and pressed Ctrl+H. I found threads related to
steamwebhelper.exe (displays web API for
steam.exe, which is also under this
dwm.exe, and anything that seemed that would create windows/stock UI elements.
I tried Safe Mode and creating a new standard user account, but the same activity occurs.
My question is, is this activity normal? Csrss.exe seems to increase its cycle delta when moving the mouse, and when I hover over auch ui. Is the reason hovering over certain aero elements, or programs like steam that may use certain windows elements causing GPU usage to rise under
csrss.exe because that is the process calling
cdd.dll? As I said, on idle GPU usage is negligible, which I guess confirms no malicious activity. I suffer no performance issues running high end games with Aero enabled, but I’m wondering if this is normal activity for a high end machine.
csrss.exe be using the GPU like this when calling on things
- I5 3570k
- GTX 970 4 GB
- 8 GB RAM
- Windows 7, 64-bit