IRQL

IRQL, or Interrupt Request Level, is a priority value used by the Windows NT family kernel to manage interrupt handling and synchronization on each processor. Each processor tracks a current IRQL, and code running at a given IRQL can preempt code running at a lower IRQL but cannot run when the system is at a higher IRQL. IRQL also constrains what operations are safe to perform and what kernel objects can be accessed.

Common IRQL values include PASSIVE_LEVEL, which represents normal thread execution, APC_LEVEL for asynchronous procedure calls, and DISPATCH_LEVEL for Deferred Procedure Calls. Higher IRQLs are used by hardware interrupts and internal kernel activities. The exact numeric values beyond these basics are architecture-dependent, and Windows defines a range of levels above DISPATCH_LEVEL for various purposes.

IRQL has a strong influence on synchronization and timing. To protect shared kernel data, drivers and the kernel may raise IRQL (for example, when acquiring spin locks), which prevents preemption by lower-priority code. While at DISPATCH_LEVEL or higher, code must be non-blocking and cannot perform operations that may sleep or wait for resources. pageable memory must not be touched at IRQLs above PASSIVE_LEVEL, as accessing it can cause faults.

In practice, IRQL management is a central concern for driver developers. The kernel provides primitives such as KeRaiseIrqlToDpcLevel, KeLowerIrql, and spin-lock routines to control IRQL and synchronize access to data structures. Improper IRQL handling can lead to deadlocks, priority inversion, or system instability.

See also: interrupt handling, Deferred Procedure Call, APC, spin lock.