一：皮毛

每个线程都会维护一个线程apc队列，通过 QueueUserAPC把一个apc函数添加到指定线程的apc队列

DWORD WINAPI QueueUserAPC(

  _In_   PAPCFUNC pfnAPC,

  _In_   HANDLE hThread,

  _In_   ULONG_PTR dwData

);

VOID CALLBACK APCProc(

  _In_   ULONG_PTR dwParam

);

Each thread has its own APC queue. The queuing of an APC is a request for the thread to call the APC function. The operating system issues a software interrupt to direct the thread to call the APC function.

每个线程都由她自己的APC队列，这个APC队列纪录了要求线程去执行的一些APC函数。 OS发出一个软中断去执行这些APC函数。

When a user-mode APC is queued, the thread is not directed to call the APC function unless it is in an alertable state.

对于用户模式下是APC队列，当线程处在alertable状态时才去执行这些APC函数。

 

  A thread enters an alertable state by using SleepEx, SignalObjectAndWait, WaitForSingleObjectEx, WaitForMultipleObjectsEx , or MsgWaitForMultipleObject sEx to perform an alertable wait operation.

一个线程内部使用SleepEx, SignalObjectAndWait, WaitForSingleObjectEx, WaitForMultipleObjectsEx , or MsgWaitForMultipleObject sEx 等函数把自己挂起时就是进入alertable状态，此时执行APC队列的函数。

*Ex(..,TRUE)最后一个参数为TRUE才进入alertable状态，不带Ex的这些函数默认FALSE掉用相应的*Ex不进入alertable状态。

 

After the thread is in an alertable state, the thread handles all pending APCs in first in, first out (FIFO) order, and the wait operation returns WAIT_IO_COMPLETION. 

线程在alertable状态时按先进先出执行apc,

线程等待的内核对象触发后相应*Ex函数返回值为WAIT_IO_COMPLETION，线程被激活。

If an application queues an APC before the thread begins running, the thread begins by calling the APC function. After the thread calls an APC function, it calls the APC functions for all APCs in its APC queue.(没看明白)

 

When the thread is terminated using the ExitThread or TerminateThread function, the APCs in its APC queue are lost. The APC functions are not called.

 

It is possible to sleep or wait for an object within the APC.（在apc之内去sleep或wait一个对象是可以的）

 

  If you perform an alertable wait inside an APC, it will recursively dispatch the APCs. This can cause a stack overflow.（如果你在APC里执行一个alertable，他将按APC路径递归。这可能引起堆栈溢出）

 

二：apc过程分析

#include "stdafx.h"

#include <iostream> #include <windows.h> #include <process.h> using namespace std;

VOID WINAPI APCFunc(ULONG_PTR dwParam) {       cout<<"APCFunc：处理APC函数ing"<<endl;   Sleep(2000);   cout<<"APCFunc：Sleep了2000,处理APC函数ing"<<endl; }

VOID WINAPI APCFunc2(ULONG_PTR dwParam) {       cout<<"APCFunc2：处理APC函数2ing"<<endl;   Sleep(100);   cout<<"APCFunc2：处理APC函数2ing"<<endl;   }

DWORD WINAPI ThreadFun(PVOID pvParam) {       HANDLE hEvent  = (HANDLE)pvParam;   Sleep(100);   cout<<"ThreadFun：WaitForSingleObjectEx(hEvent,INFINITE,TRUE);"<<endl;       DWORD dw = WaitForSingleObjectEx(hEvent,INFINITE,TRUE);

//*Ex函数把线程设置为alertable状态       if(dw == WAIT_OBJECT_0)       {               cout<<"ThreadFun：事件触发"<<endl;       }

      if(dw == WAIT_IO_COMPLETION)       {               //如果线程至少处理了APC队列中的一项               cout<<"ThreadFun：APC队列中APC函数执行完，等待函数返回WAIT_IO_COMPLETION激活该线程继续执行"<<endl;                     }       return 0; }

int main(int argc, char* argv[]) {   HANDLE hEvent = CreateEvent(NULL,TRUE,FALSE,NULL);   HANDLE hThread = (HANDLE)_beginthreadex(NULL,0,(unsigned int (__stdcall *)(void *))ThreadFun,(PVOID)hEvent,0,NULL);   //执行一些其他代码   cout<<"main：开始"<<endl;   //此时用户想要终止子线程   Sleep(1000); //留出时间先让子线程进入alertable状态。   cout<<"main：主程Sleep(1000)此时线程调用WaitForSingleObjectEx处于alertable状态"<<endl;   QueueUserAPC(APCFunc,hThread,NULL);   cout<<"main：QueueUserAPC(APCFunc,hThread,NULL);"<<endl;   Sleep(1500);   cout<<"main：主程Sleep了1500时间比APCFunc的2000短，让线程在执行完APC函数前往其中添加新的APCFunc2"<<endl;   QueueUserAPC(APCFunc2,hThread,NULL);   cout<<"QueueUserAPC(APCFunc2,hThread,NULL);"<<endl;   WaitForSingleObject(hThread,INFINITE);   cout<<"main：WaitForSingleObject(hThread,INFINITE);"<<endl;   system("pause");   return 0; }

main()在Sleep(1000); 的时候确保新线程调WaitForSingleObjectEx进入alertable状态以执行APC函数。应为返回dw的不是WAIT_OBJECT_0所以不是hEvent被激活触发，而是APC队列中函数执行完毕触发的。