Section 10: Interrupts and Driver Handling

The Big Picture: The Doorbell and the Follow-Up

In Chapter 4 (Section 3) you learned that a device taps the CPU on the shoulder with an interrupt. The hardware side was covered there: IRQ numbers, the APIC, MSI and the IDT table. This section covers the software side: what the driver does when the tap arrives. (Chapter 2 also explained how the CPU saves its place and jumps to a handler.)

Windows splits the work into two steps:

1. ISR (Interrupt Service Routine): the urgent part, done at once, in a very short time.
2. DPC (Deferred Procedure Call): the follow-up, done a moment later, with a little more room.

Analogy: a doorbell. You run to the door (ISR), see it is the delivery driver and say "wait a moment" (quick acknowledgement). Then, a minute later, you sign for the parcel and unpack it (DPC).

 Device ──interrupt──► CPU ──► looks up IDT ──► driver's ISR   (very short)
                                                    │ "I'll finish later"
                                                    ▼
                                              queues a DPC
                                                    │
 CPU finishes the ISR, returns to what it was doing │
                                                    ▼
                                    DPC runs shortly after (a bit longer, but still brief)
                                                    │
                                                    ▼
                                    complete the IRP  (Section 9)

A Quick Look at IRQL (Why the Order Matters)

What it is: Windows uses IRQL (Interrupt Request Level): a number the CPU core is "at." The rule: only something with a higher level can interrupt something with a lower level. It is like a priority ladder.

Why does this matter? At DISPATCH_LEVEL and above, the system cannot handle a page fault (a request to bring swapped-out memory back from disk, Chapter 3). If a driver touches memory that has been paged out at this level, Windows has no way to fetch it, so it stops with a blue screen such as IRQL_NOT_LESS_OR_EQUAL or DRIVER_IRQL_NOT_LESS_OR_EQUAL (Section 14). It is one of the most famous driver bugs.

10.1 Interrupt Service Routine (ISR)

What it is: The ISR is the function inside a driver that the CPU runs first when the device's interrupt arrives. The driver registers it when the device starts (Section 6.5): "when interrupt number N fires, call this function." For MSI devices (Chapter 4), a driver can register several.

Rules for an ISR:

What an ISR typically does:

1. Asks the device: "was it you?" (Some interrupt lines are shared. If the device did not call, return "not mine" so Windows asks the next driver.)
2. Reads the status register to learn why the device called.
3. Turns off ("acknowledges") the interrupt so the device stops shouting.
4. Saves any key facts (for example, a key code or the byte count).
5. Queues a DPC to do the rest.
6. Returns.

10.2 Deferred Procedure Call (DPC)

What it is: A DPC is a function that the ISR schedules to run soon after, at DISPATCH_LEVEL. By then the CPU has left the high interrupt level, so other devices can be served again. There is room for more work.

What a DPC does:

DPCs run on the core where they were queued, and Windows runs them before returning to normal thread work. They are still supposed to be short (well under a millisecond is a typical goal). A DPC that runs too long makes the PC feel slow: mouse stutter, audio crackles and dropped network packets.

Longer jobs go further down. If the work is long, the DPC can hand it to a worker thread running at PASSIVE_LEVEL (a normal thread inside the kernel), where waiting is allowed.

10.3 ISR vs DPC Division of Labor

What it is: The art of a good driver is to put each piece of work on the right rung of the ladder.

   time ───────────────────────────────────────────────────────────►

   IRQL  high │   ┌─┐ ISR
                │   │ │
   DISPATCH 2 │   │ └───────┐ DPC
                │   │         │
   PASSIVE  0 │───┘         └─────────────── normal thread resumes
                      ▲
                      the interrupt arrives here

A full example: a network packet arrives

1. The NIC (network card) writes the packet into RAM by DMA (Section 11) and raises an interrupt (via MSI-X).
2. ISR: "Yes, that was my card." Turns off the interrupt. Queues a DPC. (Microseconds.)
3. DPC: Takes the received packet(s) and passes them up to the network stack. Gives the card fresh buffers for the next packets.
4. A normal thread (your browser) wakes and reads the data.

Modern network drivers can batch many packets in one DPC, and use MSI-X (Chapter 4) so each CPU core handles its own queue.

When this goes wrong:

Hardware ↔ software map (to keep it tidy):

Summary