A KVM guest's clock after the host suspends

Paravirtualised timekeeping mostly works. A Linux guest on KVM uses kvm-clock, reads time from a page the host maintains, and survives live migration and host suspend without the drift that plagued full emulation. You can confirm it is in use:

cat /sys/devices/system/clocksource/clocksource0/current_clocksource

If that prints kvm-clock, the steady state is fine. The problem is not the steady state.

The boot window

Between the kernel taking its initial time reading and the time daemon getting its first answer from the network, the guest is running on whatever the hardware clock said. On a VM that has been shut down for a week, or whose host was suspended, that value can be badly wrong. The window is small — a few seconds on a fast boot — but it is not empty, and several things run in it.

The one that hurts is TLS. Any unit that makes an HTTPS connection early and is ordered before time-sync.target can fail certificate validation against a clock that is days off. The failure is transient, it does not reproduce when you retry by hand, and the error text talks about certificates.

Order the units that care

[Unit]
After=time-sync.target
Wants=time-sync.target

Note that time-sync.target is only meaningful if something actually implements it. systemd-timesyncd provides systemd-time-wait-sync.service for this, and it is not enabled by default on Debian:

systemctl enable systemd-time-wait-sync.service

Without that, time-sync.target is reached almost immediately at boot and ordering against it buys you nothing. This is the detail that makes the whole thing look like it should work while doing nothing.

Save the clock across reboots

A guest with no RTC battery semantics to rely on should still not boot into 1970. systemd-timesyncd keeps a timestamp file and will refuse to set the clock earlier than it:

ls -la /var/lib/systemd/timesync/clock

The mtime of that file is the floor. chrony does the equivalent with rtcsync and its driftfile. Either is enough to keep the boot window bounded, which is all you can ask for — the window cannot be closed, only made small enough that nothing important happens inside it.