APC Asynchronous procedure call An APC is a Kernel-defined control object representing a procedure that is called asynchronously. APCs are thread-context dependent; that is, they are queued to a particular thread for execution. There are three different kinds of APCs in NT: User APCs are used by certain asynchronous NT system services to allow user-mode applications or protected subsystems to synchronize the execution of a thread with the completion of an operation or the occurrence of an event such as a timers expiration. User APCs are, by default, disabled. That is, they are queued to the user-mode thread, but they are not executed except at well-defined points in the program. Specifically, they can only be executed when an application or protected subsystem has called a wait service and has enabled alerts to occur, or if it has called the test-alert service. Kernel APCs are normal kernel-mode APCs. They are much like a normal user APC except that they are executable by default. That is, they are enabled except when the thread is already executing a Kernel APC. (Note that a special Kernel APC always preempts these.) Special Kernel APCs cannot be blocked except by running at a raised IRQL. They are executed at APC_LEVEL IRQL (see IDT), in kernel mode. These types of APCs are used by the system to force a thread to execute a procedure in the threads context. An example of this is I/O completion: the I/O Manager needs to get back into the context of the original requestor of the I/O operation so that it can copy buffers, and so forth. In order to do this, the I/O Manager must be able to access the virtual address space of the thread/process, and the most efficient way to complete the operation is to be in the calling threads context.