APC interrupts!

NTDEV
1

Hi,
I am troubled with the APC Interrupts mechanism recently. Now I have three
questions.

  1. When is the APC Interrupt issued? Which routine
    issues the APC software interrupt? It is when the calling thread calls
    the function QueueUserAPC?

2 . I have learned from Max(special thanks to Max!)that:
(a)“User APC is executed on returning from kernel mode to user mode, one
by one.”
(b) “Kernel APC is executed at the first moment after it is
scheduled,provided the IRQL is PASSIVE_LEVEL and KeEnterCriticalRegion was
not called.”
But why I can not see the action of APC interrupt?
Concerning the execution of APC routine ,what is the role of the APC
interrupt in it?

  1. Generally,what does the APC level interrupt handler routine do ?
    Or its internal mechanism?

Thanks a million!!

Best regards,
Andy

2

Hello,

The APC and Dispatch Level software interrupts are issued by HalRequestSoftwareInterrupt. Because of NT’s IRQL-based interrupt priority mechanism, an interrupt request may not be inmediately satisfied because a higher priority interrupt may be excecuting. In this case, the interrupt request is marked in the “pending interrupt mask”. Later, when the current IRQL drops by invoking KfLowerIrql, this routine checks the “pending interrupt mask” for the highest-priority pending interrupt and “CALLs” its kernel-defined handler. The APC Level software interrupt handler is HalpApcInterrupt. Essentially, this routines invokes the NT’s APC dispatcher routine KiDeliverApc to deliver any pending kernel-mode APCs.

KiInsertQueueApc, which places an APC object in its corresponding queue, issues the APC Level software interrupt (HalRequestSoftwareInterrupt) only if the following two conditions hold:

  1. The APC is directed at the calling thread.

  2. It’s a normal or special kernel-mode APC.

Best regards,

Albert Almeida

PD: This information is based on thorough analysis of NT4 (uniprocessor HAL) behavior.