What are ARM exception levels EL0 to EL3?

In 64-bit ARM (AArch64) privilege is organised into four exception levels. EL0 is unprivileged and runs applications. EL1 runs the operating-system kernel. EL2 runs a hypervisor for virtualization. EL3 runs the secure monitor that switches between the normal and secure worlds. Higher numbers mean more privilege, and code traps up to a higher level to handle exceptions.

What is the difference between privileged and unprivileged mode?

Unprivileged code (applications) can only touch its own resources and cannot change critical system settings. Privileged code (the OS kernel and exception handlers) can access system control registers, configure memory protection and manage the whole machine. This separation protects the system from buggy or malicious applications.

What modes does AArch32 have?

Classic 32-bit ARM has several processor modes: User (unprivileged, for applications), plus privileged modes FIQ, IRQ, Supervisor (SVC), Abort, Undefined and System, and on some cores Monitor and Hyp. The processor switches mode automatically when an exception or interrupt occurs, and several modes have their own banked registers.

How are Cortex-M modes different?

Cortex-M does not use the classic AArch32 mode set. Instead it has just two modes: Thread mode, where normal application code runs, and Handler mode, entered automatically to run exception and interrupt handlers. Code can additionally run privileged or unprivileged, giving a simple, deterministic model suited to microcontrollers.

DAY 5 · FOUNDATIONS

Operating Modes & Exception Levels

By EcrioniX · Updated Jun 6, 2026

Why can't your app just reformat the disk or read another app's memory? Because the CPU runs code at different privilege levels. Today we learn how ARM separates "trusted system code" from "ordinary apps" — the foundation of every OS, hypervisor and security feature.

1. Why privilege exists

Imagine if any app could reprogram the interrupt controller, disable memory protection, or peek at your banking app's memory. Chaos. So the CPU runs code at two broad trust levels:

Unprivileged — applications. Limited; can only touch their own stuff.
Privileged — the OS kernel and exception handlers. Can configure the whole machine: system registers, memory protection, interrupts.

An app that wants something powerful (open a file, allocate memory) must ask the OS via a system call, which traps up into privileged code. The CPU enforces this in hardware — an app literally cannot execute privileged operations.

💡 Analogy

A hotel. Guests (apps) can enter their own room. Staff (the OS) have master keys to every room and the control systems. A guest who needs something restricted calls the front desk (a system call) — they don't get a master key.

2. AArch64: four Exception Levels (EL0–EL3)

Modern 64-bit ARM organises privilege into four clean Exception Levels. Higher number = more privilege. Code "traps up" to a higher level to handle exceptions:

EL3

Secure Monitor — switches between Normal & Secure worlds (TrustZone). Most privileged.

EL2

Hypervisor — runs virtual machines; hosts multiple OSes.

EL1

OS Kernel — Linux, Android, an RTOS. Manages memory, drivers, scheduling.

EL0

Applications — your apps. Unprivileged. The least-trusted level.

A typical phone uses EL0 (apps) → EL1 (the OS kernel) → and EL3 for secure-world switching. EL2 appears when virtualization is in play. Not every system uses all four — but the ladder is always there.

3. AArch32: the classic processor modes

Older 32-bit ARM expresses privilege as named modes instead of numbered levels. The CPU switches mode automatically when an exception happens:

Mode	Entered when…	Privilege
User (USR)	normal application code	Unprivileged
Supervisor (SVC)	a system call (SVC) / on reset	Privileged
IRQ	a normal interrupt fires	Privileged
FIQ	a fast interrupt fires	Privileged
Abort (ABT)	a memory access fault	Privileged
Undefined (UND)	an illegal instruction	Privileged
System (SYS)	privileged code sharing User registers	Privileged

Banked registers: several modes get their own private copies of some registers (notably SP and LR, and FIQ gets extra). That's why an interrupt handler has its own stack pointer without clobbering the app's — the hardware swaps in the banked copy on entry. (Remember the CPSR mode bits from Day 3? They record which mode you're in.)

4. Cortex-M is refreshingly simple

Microcontrollers don't need that whole ladder, so Cortex-M (M-profile) drops it for just two modes:

Thread mode — where your normal application code runs.
Handler mode — entered automatically to run exception/interrupt handlers.

Code can additionally be privileged or unprivileged, and there are two stack pointers (MSP/PSP). That's it — simple, fast and deterministic, exactly what a microcontroller wants. (The interrupt machinery, the NVIC, is Day 18.)

✅ The mental model

Privilege is a ladder of trust. Apps sit at the bottom (EL0 / User / Thread). The OS and handlers sit higher. The CPU automatically climbs the ladder when an exception or system call happens, runs the trusted handler, then climbs back down. This single mechanism powers multitasking, security and virtualization.

🎯 Day 5 takeaways

CPUs separate unprivileged (apps) from privileged (OS/handlers) to protect the system.
AArch64: four exception levels — EL0 apps, EL1 kernel, EL2 hypervisor, EL3 secure monitor.
AArch32: named modes (User, SVC, IRQ, FIQ, Abort, Undef, System) entered automatically on exceptions, with banked registers.
Cortex-M: just Thread and Handler modes, plus privileged/unprivileged.
The CPU traps up to a higher privilege to handle events, then returns.

Quick check

Which exception level runs the Linux kernel — EL0 or EL1?
Why does an interrupt handler need its own (banked) stack pointer?
What two modes does a Cortex-M switch between?

FAQ

What are EL0–EL3?

AArch64 exception levels: EL0 apps, EL1 OS kernel, EL2 hypervisor, EL3 secure monitor. Higher = more privileged.

Privileged vs unprivileged?

Unprivileged (apps) can only touch their own resources; privileged (kernel/handlers) can configure the whole machine.

How is Cortex-M different?

It uses just Thread and Handler modes (plus privileged/unprivileged), not the classic AArch32 mode set.

← Back to the full course roadmap