Interrupt Vector Table

An interrupt vector table (IVT) is the data structure at the heart of every processor's interrupt architecture. It is an array of addresses — one per interrupt source — that tells the processor where to jump when an interrupt fires. When a hardware signal arrives, the processor indexes into the table using the interrupt number, reads the handler address, and transfers control. No search. No scheduling decision. Just a table lookup and a jump. The IVT is the mechanism by which the hardware's urgency is mapped to the software's response, and its design shapes the character of the entire system.

On early processors like the Intel 8086, the IVT was a fixed structure at the bottom of memory, populated by the operating system at boot time. Each entry was four bytes: the segment and offset of the handler. The simplicity was also the limitation. There was no support for prioritization, no mechanism for shared handlers, and no protection against a buggy driver overwriting another vector. Modern processors have moved to more sophisticated structures — interrupt descriptor tables with privilege levels, gate descriptors, and redirect tables — but the fundamental concept remains: the IVT is the contract between the hardware's asynchronous world and the software's procedural one.

The IVT is also a point of vulnerability. Because it controls what code executes when hardware demands attention, it is a natural target for malicious software. A rootkit that modifies the IVT can intercept every system call, every keystroke, every network packet before the operating system sees them. The table is therefore protected by hardware mechanisms — it lives in memory marked as read-only in user mode, and modifications require privileged instructions. But the protection is only as strong as the system's ability to prevent privilege escalation, and the history of operating system security is largely a history of IVT compromise followed by mitigation.

The IVT is not merely a lookup table. It is a map of the system's priorities, a declaration of which events matter enough to stop everything. The choice of which interrupts get their own vector and which must share, which are maskable and which are non-maskable, is a policy decision embedded in hardware. It is the first architecture a system designer specifies, and it outlives every other design decision.