6

OK, so DPC_WATCHDOG_VIOLATION is a common Error code after a BSOD. I'd like to know -

  1. What is a DPC Watchdog? I mean, what is meant by that?
  2. What does it do in the Windows system? And how does it get Violated?

Can anybody help?

EDIT : I sure have googled it. But all I find is "What causes DPC_WATCHDOG_VIOLATION?" or "How to fix DPC_WATCHDOG_VIOLATION issue".

Just to make my query clear, I'm mainly interested to know what the "DPC Watchdog" is, and it's functionality in the system.

atiyar
  • 229
  • 2
  • 10

1 Answers1

9

what is the "DPC Watchdog"?

Summary:

Deferred Procedure Calls (DPCs) are monitored by a DPC Watchdog Timer.

When the DPC Watchdog Timer detects that a DPC is running for too long it generates a DPC_WATCHDOG_VIOLATION error.

Detailed explanation

First of all you need to understand what a DPC is. A simplified explanation is:

A Deferred Procedure Call (DPC) is a Microsoft Windows operating system mechanism which allows high-priority tasks (e.g. an interrupt handler) to defer required but lower-priority tasks for later execution.

This permits device drivers and other low-level event consumers to perform the high-priority part of their processing quickly, and schedule non-critical additional processing for execution at a lower priority.

Source Deferred Procedure Call

Windows needs a mechanism to determine when something goes wrong with these Deferred Procedure Calls (they are taking too long to execute, and so degrading system responsiveness).

That mechanism is the DPC Watchdog Timer:

The operating system implements a DPC watchdog timer to detect when a single DPC routine runs for too long, or when a series of queued DPC routines runs back-to-back for too long.

If DPC time-out errors are enabled, and if either a DPC routine exceeds the time limit for a single routine, or a series of DPC routines exceeds the aggregate time limit, a DPC_WATCHDOG_VIOLATION (0x133) bug check occurs.

...

DPC routines should run only for brief periods, and should delegate as much processing as possible to worker threads. To avoid degrading system responsiveness, a typical DPC routine should run for no more than 100 microseconds each time it is called.

Source KeQueryDpcWatchdogInformation routine

Bug Check 0x133 DPC_WATCHDOG_VIOLATION

This bug check indicates that the DPC watchdog executed, either because it detected a single long-running deferred procedure call (DPC), or because the system spent a prolonged time at an interrupt request level (IRQL) of DISPATCH_LEVEL or above. The value of Parameter 1 indicates whether a single DPC exceeded a timeout, or whether the system cumulatively spent an extended period of time at IRQL DISPATCH_LEVEL or above.

DPCs should not run longer than 100 microseconds and ISRs should not run longer than 25 microseconds, however the actual timeout values on the system are set much higher.

Source Bug Check 0x133 DPC_WATCHDOG_VIOLATION

Community
  • 1
DavidPostill
  • 153,128
  • 77
  • 353
  • 394
  • Ok, so this is related to CPU-thread scheduling as I get from your answer. I think it got clear to me now. Thanks a lot David :) – atiyar Oct 07 '16 at 13:31
  • 1
    @NerotheZero No, it isn't related to thread scheduling, except in that DPCs _interfere with_ that. DPCs are not threads, so they do not have a "priority". Like interrupt service routines, they can barge into the CPU regardless of the priority of the current thread. That is why, if they take too much time, they "degrade system responsiveness". They do run at a lower "interrupt request level" (IRQL) than interrupt service routines, so ISRs will run before DPCs on any particular CPU. (The WP article DP quoted is misleading in its use of the word "priority".) – Jamie Hanrahan Oct 08 '16 at 11:41
  • @DavidPostill does the system thread or idle thread or something regularly call KeQueryDpcWatchdogInformation? What timer does it implement, HPET? – Lewis Kelsey Mar 28 '19 at 21:04
  • @LewisKelsey No idea :( – DavidPostill Mar 28 '19 at 23:58
  • @DavidPostill it appears that it only returns info on the 'current DPC' which suggests it is for the current core so it sounds like it is run by the DPC itself or whatever interrupts the DPC so the clock interrupt or device interrupt generic dispatch routine – Lewis Kelsey Mar 31 '19 at 12:18