On Thu, Jul 02, 2026, Michael Kelley wrote: > From: Sean Christopherson <[email protected]> Sent: Wednesday, July 1, 2026 > 12:32 PM > > > > Silently ignore attempts to switch to a paravirt sched_clock when running > > as a CoCo guest with trusted TSC. In hand-wavy theory, a misbehaving > > hypervisor could attack the guest by manipulating the PV clock to affect > > guest scheduling in some weird and/or predictable way. More importantly, > > reading TSC on such platforms is faster than any PV clock, and sched_clock > > is all about speed. > > > > Reviewed-by: David Woodhouse <[email protected]> > > Signed-off-by: Sean Christopherson <[email protected]> > > --- > > arch/x86/kernel/tsc.c | 9 +++++++++ > > 1 file changed, 9 insertions(+) > > > > diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c > > index 012321fed5e5..a146fc7b5e74 100644 > > --- a/arch/x86/kernel/tsc.c > > +++ b/arch/x86/kernel/tsc.c > > @@ -283,6 +283,15 @@ bool using_native_sched_clock(void) > > int __init __paravirt_set_sched_clock(u64 (*func)(void), bool stable, > > void (*save)(void), void (*restore)(void)) > > { > > + /* > > + * Don't replace TSC with a PV clock when running as a CoCo guest and > > + * the TSC is secure/trusted; PV clocks are emulated by the hypervisor, > > + * which isn't in the guest's TCB. > > + */ > > + if (cc_platform_has(CC_ATTR_GUEST_SNP_SECURE_TSC) || > > + boot_cpu_has(X86_FEATURE_TDX_GUEST)) > > + return -EPERM; > > Do a pr_warn() in the error case? Your commit message says to do the ignore > silently, but I wonder if that's a good idea. At least for Hyper-V, the error > case shouldn't happen.
I agree it's not a great idea, but unfortunately it's pretty much guaranteed to fire on KVM-based setups. The KVM world hasn't been anywhere near as aggressive as Hyper-V in terms of killing off PV features when running SNP/TDX guests (which is largely how this series came to be in the first place). So while I'm conceptually not opposed to the idea of printing an error message, in practice I'm pretty strong against it because odds are very good I'll end up dealing with "bug" reports due to less-than-awesome setups.
