Should Linux set the new constant-time mode CPU flags?

[Eric Biggers]

Hi,

Intel and ARM recently published documentation that says that no instructions
are guaranteed to be constant-time with respect to their data operands, unless a
"data independent timing" flag in the IA32_UARCH_MISC_CTL register (Intel) or
DIT register (arm64) is set:

* https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/data-operand-independent-timing-isa-guidance.html
* https://developer.arm.com/documentation/ddi0595/2021-06/AArch64-Registers/DIT--Data-Independent-Timing

This is a major problem for crypto code, which needs to be constant-time,
especially with respect to keys.  And since this is a CPU issue, it affects all
code running on the CPU.  While neither company is treating this as a security
disclosure, to me this looks exactly like a CPU vulnerability.

For Intel, given that the mitigation is to set an MSR flag, it seems that the
kernel will need to do that -- similar to the MSR flags that enable mitigations
for speculative execution vulnerabilities.

For arm64, it's not clear to me whether the DIT flag is privileged or not.  If
privileged, I expect it would need to be set by the kernel just like the Intel
flag.  If unprivileged, I expect there will still be work to do in the kernel,
as the flag will need to be set when running any crypto code in the kernel.

I'm wondering if people are aware of this issue, and whether anyone has any
thoughts on whether/where the kernel should be setting these new CPU flags.
There don't appear to have been any prior discussions about this.  (Thanks to
Adam Langley, who maintains BoringSSL, for bringing this to my attention.)

- Eric