title: How does the ARM linker know where the exception table stops?
body: <p>I have come across something very similar to the following when looking for basic, bare-metal Cortex-M3 programming information (referred to in a great answer right here, that I'll attempt to locate later).</p>
  
  <pre><code>/* vectors.s */
  .cpu cortex-m3
  .thumb
  
  .word   0x20002000  /* stack top address */
  .word   _start      /* 1 Reset */
  .word   hang        /* 2 NMI */
  .word   hang        /* 3 HardFault */
  .word   hang        /* 4 MemManage */
  .word   hang        /* 5 BusFault */
  .word   hang        /* 6 UsageFault */
  .word   hang        /* 7 RESERVED */
  .word   hang        /* 8 RESERVED */
  .word   hang        /* 9 RESERVED*/
  .word   hang        /* 10 RESERVED */
  .word   hang        /* 11 SVCall */
  .word   hang        /* 12 Debug Monitor */
  .word   hang        /* 13 RESERVED */
  .word   hang        /* 14 PendSV */
  .word   hang        /* 15 SysTick */
  .word   hang        /* 16 External Interrupt(0) */
  .word   hang        /* 17 External Interrupt(1) */
  .word   hang        /* 18 External Interrupt(2) */
  .word   hang        /* 19 ...   */
  
  .thumb_func
  .global _start
  _start:
      bl notmain
      b hang
  
  .thumb_func
  hang:   b .
  </code></pre>
  
  <p>This makes sense to me, I understand what it does, but what does not make sense to me is how the linker (or CPU, I'm not sure which...) knows where the exception table ends and actual code begins. It seems to me from the Cortex-M3 documentation that there can be an arbitrary number of external interrupts in the table.</p>
  
  <p>How does this work, and what should I have read to learn?</p>