title: Why is the IRQ latency in my ARM interrupt handler always the same, regardless of the instruction that is being interrupted?
body: <p>I am trying to apply a type of side channel attack I read about in <a href="https://people.cs.kuleuven.be/%7Ejo.vanbulck/ccs18.pdf" rel="nofollow noreferrer">this paper</a> that tries to infer execution state from differences in IRQ latencies on a MCU with a cortex M4 processor. The attack carefully interrupts instructions that occur right after a branch and measures the interrupt latency. When different branches have instructions of different lengths, you can look at the interrupt latency to determine in which of these branches the interrupt occurred and leak some of the program state.</p>
  <p>I wrote a simple function that I want to attack in the way described above. I am using the SysTick timer to generate the interrupt at the correct point in time. To get an initial good value for the interrupt timer I used GDB to stop the program at the target line to see the SysTick value at that time.</p>
  <p>I implemented a very simple interrupt handler that</p>
  <ol>
  <li>loads the SysTick timer value from memory</li>
  <li>subtracts this value from the reload value to get the elapsed time since interrupt (i.e. the IRQ latency)</li>
  <li>clears the interrupt and</li>
  </ol>
  <pre><code>void __attribute__((interrupt(&quot;IRQ&quot;))) SysTick_Handler(void)
  {
    /* USER CODE BEGIN SysTick_IRQn 0 */
      SysTick-&gt;CTRL &amp;= 0xfffffffe;                                // disable SysTick (~SysTick_CTRL_ENABLE_Msk)
      *timer_value = SysTick-&gt;VAL;                                // capture counter value (as quickly as possible)
      *timer_value = SysTick-&gt;LOAD - *timer_value;                    // subtract it from reload value to get IRQ latency
      SysTick-&gt;VAL = 0;                                           // reset initial value
  }   
  </code></pre>
  <p>However I find that I always get the same IRQ latency, regardless of the instruction that was interrupted. I expect the interrupt latency to be longer when a longer instruction is interrupted.</p>
  <p>This is the function I wrote to test the attack</p>
  <pre><code>extern uint32_t *timer_value;
  int sample_function(int *a, int *b){
      /*
       * function description -- store the smallest of the two value in a, if MEASURE_CYCLESS defined return the number
       * of clock cycles that have been elapsed since the timer has been started
       * r0 contains pointer to a
       * r1 contains pointer to b
       */
  
      __asm volatile(
          /*  push working registers */
          &quot;PUSH {r4-r8} \n&quot;
          /* move counter into r8 */
          &quot;MOV r8, #10 \n&quot;
          /* begin loop */
          &quot;begin_loop: \n&quot;
          /* decrement counter variable*/
          &quot;SUB r8, r8, #1 \n&quot;
          /* if counter variable not equal to 0, jump back to start of loop */
          &quot;CMP r8, #0 \n&quot;
          /* if r8 not equal to 0, jump back to begin of loop*/
          &quot;BNE begin_loop \n&quot;
          /* load a into r2 */
          &quot;LDR r2, [r0] \n&quot;
          /* load b into r3 */
          &quot;LDR r3, [r1] \n&quot;
          /*  store a-b in r4, setting status flags -- if result is 0 Z flag is set */
          &quot;SUBS r4, r2, r3 \n&quot;
          /* if a-b positive, a is larger  otherwise, b is larger (assuming a not equal to b)  */
          &quot;BPL a_larger \n&quot;
  #ifdef SPY
          /* load address of (*timer_value) into r4 -- use of LDR pseudo-instruction places constant in a literal pool*/
          &quot;LDR r4, =timer_value \n&quot;
          /* Load (*timer_value) into r4 */
          &quot;LDR r4, [r4] \n&quot;
          /* load address of Systick VAL into r5 */
          &quot;LDR r5, =0xe000e018 \n&quot;
          /* Load value at address stored in R5 (= Systick Val) */
          &quot;LDR r5, [r5] \n&quot;
          /* Move Systick Val into adress stored at r4 (= *timer_value = address of timer_value)*/
          &quot;STR r5, [r4] \n&quot;
  #endif
          &quot;NOP \n&quot;
          /*instruction that gets interrupted -- swap value*/
          &quot;STR r2, [r1] \n&quot;
          /* load value at this address into r0 (return value) */
          &quot;STR r3, [r0] \n&quot;
          &quot;B end \n&quot;
          &quot;a_larger: \n&quot;
          &quot;MOV r0, #0 \n&quot;              // instruction that gets interrupted
          &quot;end: POP    {r4-r8}&quot;
              );     // pop working registers
  }
  
  </code></pre>
  <p>Note, the section of code in the <code>#define</code> block is used to automatically determine a good timer reload value (instead of using GDB), but I'm currently not using the value I obtained this way.
  I also have an empty loop in there to delay the instruction that is meant to be interrupted a bit.</p>
  <p>The instruction that gets interrupted is the instruction right after the <code>#define</code> block. When I remove the <code>NOP</code> instruction I still get the same interrupt latency. When I increase or decrease the timer value (to interrupt some cycles earlier or later) I also still get the same IRQ latency.</p>
  <p>Am I missing something here? Is there some behavior I do not know about?
  Also, is it important to use the attribute <code>__attribute__((interrupt(&quot;IRQ&quot;))</code> for an interrupt handler?</p>