Why Do Interrupts Have a Top Half and Bottom Half? Exploring Linux’s Split ISR Design

What Is an Interrupt?

An interrupt temporarily suspends the CPU’s current execution flow so that a dedicated service routine can handle an external or internal event. After the routine finishes, the CPU restores the saved context and resumes the interrupted program.

Top Half (Interrupt Service Routine)

The top half, also called the Interrupt Service Routine (ISR), runs in interrupt context and must complete quickly. Typical actions are:

Save the current processor state (registers, stack pointer).

Acknowledge the interrupt source (e.g., clear hardware flags).

Schedule any longer‑running work for later execution.

Restore the saved state and return from the interrupt.

Because the ISR executes at a high priority, it must not perform blocking operations such as sleeping, waiting for I/O, or lengthy loops; otherwise system responsiveness degrades.

Why Split an Interrupt Into Two Halves?

Handling the entire event in the ISR would keep the CPU in interrupt context for the duration of the work, preventing other tasks—including higher‑priority interrupts—from running. By deferring non‑critical processing to a bottom‑half context, the system maintains real‑time responsiveness while still being able to perform complex operations.

Bottom Half Mechanisms

Linux provides several mechanisms to execute deferred work outside the ISR. Each mechanism runs in a context where sleeping and blocking are allowed.

Soft interrupt (softirq) : A lightweight, per‑CPU mechanism used mainly for networking, timer, and block I/O processing. The ISR raises a softirq flag; the kernel later invokes the softirq handler.

Tasklet : Built on top of softirqs, a tasklet is a single‑function callback that runs in softirq context. It is useful for small, independent pieces of work such as packet processing.

Workqueue : Creates a kernel thread (or pool of threads) that executes queued work items. Because it runs in a process context, the work can sleep, allocate memory, and perform I/O.

Timer : Schedules a function to run after a specified delay. Timers can be one‑shot or periodic and are often used to trigger deferred processing.

Delayed work : A wrapper around workqueues that adds a timer; the work item is queued only after the timer expires.

Example: Using a Workqueue

// Define a work structure
static DECLARE_WORK(my_work, my_work_handler);

// ISR (top half)
irqreturn_t my_isr(int irq, void *dev_id)
{
    // Acknowledge interrupt quickly
    acknowledge_hw_irq(irq);
    // Defer the heavy processing
    schedule_work(&my_work);
    return IRQ_HANDLED;
}

// Bottom‑half handler executed in a kernel thread
static void my_work_handler(struct work_struct *work)
{
    // Safe to sleep, allocate memory, perform I/O, etc.
    process_received_data();
    save_to_disk();
}

In this pattern the ISR only queues the work item, which typically takes a few microseconds. The actual data processing runs later in the workqueue thread, freeing the CPU to handle other interrupts.

Efficiency Gains

Separating urgent, minimal work (top half) from extensive processing (bottom half) yields two main benefits:

Reduced latency: Other high‑priority interrupts can be serviced promptly because the CPU spends minimal time in interrupt context.

Better CPU utilization: Deferred work runs in normal process context, allowing the scheduler to balance load across CPUs and to preempt other tasks if needed.

This design is fundamental to real‑time and high‑throughput systems such as networking stacks, storage drivers, and embedded controllers.