From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 240BE27F017 for ; Mon, 13 Jul 2026 20:52:27 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783975949; cv=none; b=MRqOR0Do/6GL7EA+ySMFrLk/XeIVpp0yhtGScMppM3d3b1YpLyhNVTBwWXSeurI0G56CcpM7sF1WKb0Kp2ZM39/rbQtELh2wlTgWwAhMLw16unv79Me7iKGmUBA2G0rEJMA5Cxu2oc7SSX3Qy1zWgXqRH0CF97NXBEBLHeKMgDM= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783975949; c=relaxed/simple; bh=HR3aLGNrJ617Z3NTBzE8EYjFYJoACocQHfgXovml0SU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=OLUmlQaaECWq+Un/J6QhwZXddNYdDrb6M43mFJ+5mOCM3cyKRQbthZJ5WglfdqkZ46VkLYk1WSP/1L5XBdYAcmTlY69xPvAzxIOWEC/472luDk/tKkgLcPr8oM+VVsK5nPbElbebsNDtj+Op5ICfE9AMvS0ydHmhD6y+jtq3aXI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=AKsT7cv6; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="AKsT7cv6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 80F821F00A3A; Mon, 13 Jul 2026 20:52:27 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1783975947; bh=O//KfDC0M4shhfyX1LLpcreHey2JDXMUVgzUoqlMH5E=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=AKsT7cv6sCUPDIryFduoTd9EL5INtCxHMXaHQArW9qdRAdh/s5OIPYzJbTPLKarZH TeYV/0IMAQ5AsPKUUBzzG5/X7+HWWsqlvqljmUHLrYC4me0lgSRBaokEjj4rET15oR 6nx6l5h5hsZQ1D5+uvvueCXXIKthoubfcy0KxLZmoPvWb0mGSnT5PmLfE/vwVJ13k/ 7yR5jTHlG2v1cqJLYKjYNotG3zwDQR2TD0H9CGLcxqKr6e42l+qw7CSQKDmldzyxNS ZK4+ieehKkSTX6rPwZC8eCEE5BMSBZ1WWicHFQYWV48R2P11p77yyJCWYzv94bic87 ZLqJuqMV3tyMw== Date: Mon, 13 Jul 2026 14:52:26 -0600 From: Keith Busch To: Daniel Colascione Cc: Jens Axboe , Christoph Hellwig , Sagi Grimberg , linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] nvme: make sending wall-clock time to NVMe opt-in Message-ID: References: <20260713203443.322748-1-dancol@dancol.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260713203443.322748-1-dancol@dancol.org> On Mon, Jul 13, 2026 at 04:34:43PM -0400, Daniel Colascione wrote: > Some NVMe devices maintain a persistent log, the PEL, of events like > power-on and thermal excursions. The NVMe Set Features (Timestamp) > command allows an operating system to inform the NVMe of the current > wall-clock time. Wall-clock timestamp updates are logged to the PEL > alongside other events. By correlating PEL records, an attacker can > infer a user's usage patterns and even guess at time zone changes. How does an attacker come to acquire PEL records if the system isn't already compromised? > The nvme_core.timestamps_enabled_default module parameter supplies the > default value of the per-controller flag. Default it to false as the > privacy-preserving choice. Users who want to provide controllers with > real-world time can set the module parameter to true or enable > the per-controller sysfs flag, perhaps via udev. > > As an alternative, we could also get the timestamp updates out of the > kernel entirely and have interested users run nvme(1) to > update timestamps. The use cases for the timestamp feature are outside the specification. But I know of at least one implementation that uses it to determine how long it has been powered off so it can better apply correction to media drift. Yeah yeah, depending on the host for something so critical is pretty fragile, but it apparently worked out well enough. This proposal would break them.