DeferredProcedureCall

Deferred Procedure Call (DPC) is a kernel mechanism used by Windows NT-based operating systems to defer work that should not be performed at interrupt time to a later point when the system is at a lower interrupt level. DPCs are executed at DISPATCH_LEVEL, a non-blocking IRQL, and are serviced by a per-processor DPC dispatcher. By moving work out of the interrupt context, DPCs help minimize interrupt latency while allowing time-consuming tasks to proceed safely.

A DPC is represented by a KDPC object and a routine pointer. Developers initialize the KDPC with KeInitializeDpc, optionally target it to a specific processor with KeSetTargetProcessorDpc, and enqueue it with KeInsertQueueDpc. The DPC routine has the standard prototype void DeferredProcedureCall(PKDPC Dpc, PVOID DeferredContext, PVOID SystemArgument1, PVOID SystemArgument2); The DeferredContext carries application-defined data, while the SystemArgument1/2 fields may be used to pass additional parameters. A queued DPC can be canceled before execution using KeRemoveQueueDpc. When its turn arrives, the kernel invokes the DPC routine on the selected processor.

Best practices emphasize keeping DPC routines short and non-blocking. They should not touch pageable memory, perform operations that may block, or acquire locks that could lead to deadlocks. If substantial work is required, a DPC should schedule work to a thread pool or a work item to complete it at a safer IRQL context. DPCs can be queued frequently during high interrupt rates; excessive DPC processing can impact system responsiveness, so tuning and monitoring are important.