[PATCH] nvme: make sending wall-clock time to NVMe opt-in

[Keith Busch]

On Mon, Jul 13, 2026 at 04:34:43PM -0400, Daniel Colascione wrote:
> Some NVMe devices maintain a persistent log, the PEL, of events like
> power-on and thermal excursions. The NVMe Set Features (Timestamp)
> command allows an operating system to inform the NVMe of the current
> wall-clock time. Wall-clock timestamp updates are logged to the PEL
> alongside other events. By correlating PEL records, an attacker can
> infer a user's usage patterns and even guess at time zone changes.

How does an attacker come to acquire PEL records if the system isn't
already compromised?
 
> The nvme_core.timestamps_enabled_default module parameter supplies the
> default value of the per-controller flag. Default it to false as the
> privacy-preserving choice. Users who want to provide controllers with
> real-world time can set the module parameter to true or enable
> the per-controller sysfs flag, perhaps via udev.
> 
> As an alternative, we could also get the timestamp updates out of the
> kernel entirely and have interested users run nvme(1) to
> update timestamps.

The use cases for the timestamp feature are outside the specification.
But I know of at least one implementation that uses it to determine how
long it has been powered off so it can better apply correction to media
drift. Yeah yeah, depending on the host for something so critical is
pretty fragile, but it apparently worked out well enough. This proposal
would break them.