From: Sean Christopherson <[email protected]> Sent: Wednesday, July 1, 2026 12:32 PM > > Silently ignore attempts to switch to a paravirt sched_clock when running > as a CoCo guest with trusted TSC. In hand-wavy theory, a misbehaving > hypervisor could attack the guest by manipulating the PV clock to affect > guest scheduling in some weird and/or predictable way. More importantly, > reading TSC on such platforms is faster than any PV clock, and sched_clock > is all about speed. > > Reviewed-by: David Woodhouse <[email protected]> > Signed-off-by: Sean Christopherson <[email protected]> > --- > arch/x86/kernel/tsc.c | 9 +++++++++ > 1 file changed, 9 insertions(+) > > diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c > index 012321fed5e5..a146fc7b5e74 100644 > --- a/arch/x86/kernel/tsc.c > +++ b/arch/x86/kernel/tsc.c > @@ -283,6 +283,15 @@ bool using_native_sched_clock(void) > int __init __paravirt_set_sched_clock(u64 (*func)(void), bool stable, > void (*save)(void), void (*restore)(void)) > { > + /* > + * Don't replace TSC with a PV clock when running as a CoCo guest and > + * the TSC is secure/trusted; PV clocks are emulated by the hypervisor, > + * which isn't in the guest's TCB. > + */ > + if (cc_platform_has(CC_ATTR_GUEST_SNP_SECURE_TSC) || > + boot_cpu_has(X86_FEATURE_TDX_GUEST)) > + return -EPERM;
Do a pr_warn() in the error case? Your commit message says to do the ignore silently, but I wonder if that's a good idea. At least for Hyper-V, the error case shouldn't happen. Michael > + > if (!stable) > clear_sched_clock_stable(); > > -- > 2.55.0.rc0.799.gd6f94ed593-goog >
