Implement standard clock safely

Previously, tcpip.StdClock depended on linking with the unexposed method
time.now to implement tcpip.Clock using the time package. This change
updates the standard clock to not require manually linking to this
unexported method and use publicly documented functions from the time
package.

PiperOrigin-RevId: 371805101

8 files changed, 177 insertions, 95 deletions

diff --git a/pkg/tcpip/BUILD b/pkg/tcpip/BUILD
index aa30cfc85..e96ba50ae 100644
--- a/pkg/tcpip/BUILD
+++ b/pkg/tcpip/BUILD
@@ -22,8 +22,9 @@ go_library(
         "errors.go",
         "sock_err_list.go",
         "socketops.go",
+        "stdclock.go",
+        "stdclock_state.go",
         "tcpip.go",
-        "time_unsafe.go",
         "timer.go",
     ],
     visibility = ["//visibility:public"],
diff --git a/pkg/tcpip/stack/neighbor_cache_test.go b/pkg/tcpip/stack/neighbor_cache_test.go
index 48bb75e2f..9821a18d3 100644
--- a/pkg/tcpip/stack/neighbor_cache_test.go
+++ b/pkg/tcpip/stack/neighbor_cache_test.go
@@ -1556,7 +1556,7 @@ func TestNeighborCacheRetryResolution(t *testing.T) {
 func BenchmarkCacheClear(b *testing.B) {
 	b.StopTimer()
 	config := DefaultNUDConfigurations()
-	clock := &tcpip.StdClock{}
+	clock := tcpip.NewStdClock()
 	linkRes := newTestNeighborResolver(nil, config, clock)
 	linkRes.delay = 0
 
diff --git a/pkg/tcpip/stack/stack.go b/pkg/tcpip/stack/stack.go
index 843118b13..436392f23 100644
--- a/pkg/tcpip/stack/stack.go
+++ b/pkg/tcpip/stack/stack.go
@@ -322,7 +322,7 @@ func (*TransportEndpointInfo) IsEndpointInfo() {}
 func New(opts Options) *Stack {
 	clock := opts.Clock
 	if clock == nil {
-		clock = &tcpip.StdClock{}
+		clock = tcpip.NewStdClock()
 	}
 
 	if opts.UniqueID == nil {
diff --git a/pkg/tcpip/stdclock.go b/pkg/tcpip/stdclock.go
new file mode 100644
index 000000000..7ce43a68e
--- /dev/null
+++ b/pkg/tcpip/stdclock.go
@@ -0,0 +1,130 @@
+// Copyright 2018 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tcpip
+
+import (
+	"fmt"
+	"time"
+
+	"gvisor.dev/gvisor/pkg/sync"
+)
+
+// stdClock implements Clock with the time package.
+//
+// +stateify savable
+type stdClock struct {
+	// baseTime holds the time when the clock was constructed.
+	//
+	// This value is used to calculate the monotonic time from the time package.
+	// As per https://golang.org/pkg/time/#hdr-Monotonic_Clocks,
+	//
+	//   Operating systems provide both a “wall clock,” which is subject to
+	//   changes for clock synchronization, and a “monotonic clock,” which is not.
+	//   The general rule is that the wall clock is for telling time and the
+	//   monotonic clock is for measuring time. Rather than split the API, in this
+	//   package the Time returned by time.Now contains both a wall clock reading
+	//   and a monotonic clock reading; later time-telling operations use the wall
+	//   clock reading, but later time-measuring operations, specifically
+	//   comparisons and subtractions, use the monotonic clock reading.
+	//
+	//   ...
+	//
+	//   If Times t and u both contain monotonic clock readings, the operations
+	//   t.After(u), t.Before(u), t.Equal(u), and t.Sub(u) are carried out using
+	//   the monotonic clock readings alone, ignoring the wall clock readings. If
+	//   either t or u contains no monotonic clock reading, these operations fall
+	//   back to using the wall clock readings.
+	//
+	// Given the above, we can safely conclude that time.Since(baseTime) will
+	// return monotonically increasing values if we use time.Now() to set baseTime
+	// at the time of clock construction.
+	//
+	// Note that time.Since(t) is shorthand for time.Now().Sub(t), as per
+	// https://golang.org/pkg/time/#Since.
+	baseTime time.Time `state:"nosave"`
+
+	// monotonicOffset is the offset applied to the calculated monotonic time.
+	//
+	// monotonicOffset is assigned maxMonotonic after restore so that the
+	// monotonic time will continue from where it "left off" before saving as part
+	// of S/R.
+	monotonicOffset int64 `state:"nosave"`
+
+	// monotonicMU protects maxMonotonic.
+	monotonicMU  sync.Mutex `state:"nosave"`
+	maxMonotonic int64
+}
+
+// NewStdClock returns an instance of a clock that uses the time package.
+func NewStdClock() Clock {
+	return &stdClock{
+		baseTime: time.Now(),
+	}
+}
+
+var _ Clock = (*stdClock)(nil)
+
+// NowNanoseconds implements Clock.NowNanoseconds.
+func (*stdClock) NowNanoseconds() int64 {
+	return time.Now().UnixNano()
+}
+
+// NowMonotonic implements Clock.NowMonotonic.
+func (s *stdClock) NowMonotonic() int64 {
+	sinceBase := time.Since(s.baseTime)
+	if sinceBase < 0 {
+		panic(fmt.Sprintf("got negative duration = %s since base time = %s", sinceBase, s.baseTime))
+	}
+
+	monotonicValue := sinceBase.Nanoseconds() + s.monotonicOffset
+
+	s.monotonicMU.Lock()
+	defer s.monotonicMU.Unlock()
+
+	// Monotonic time values must never decrease.
+	if monotonicValue > s.maxMonotonic {
+		s.maxMonotonic = monotonicValue
+	}
+
+	return s.maxMonotonic
+}
+
+// AfterFunc implements Clock.AfterFunc.
+func (*stdClock) AfterFunc(d time.Duration, f func()) Timer {
+	return &stdTimer{
+		t: time.AfterFunc(d, f),
+	}
+}
+
+type stdTimer struct {
+	t *time.Timer
+}
+
+var _ Timer = (*stdTimer)(nil)
+
+// Stop implements Timer.Stop.
+func (st *stdTimer) Stop() bool {
+	return st.t.Stop()
+}
+
+// Reset implements Timer.Reset.
+func (st *stdTimer) Reset(d time.Duration) {
+	st.t.Reset(d)
+}
+
+// NewStdTimer returns a Timer implemented with the time package.
+func NewStdTimer(t *time.Timer) Timer {
+	return &stdTimer{t: t}
+}
diff --git a/pkg/tcpip/stdclock_state.go b/pkg/tcpip/stdclock_state.go
new file mode 100644
index 000000000..795db9181
--- /dev/null
+++ b/pkg/tcpip/stdclock_state.go
@@ -0,0 +1,26 @@
+// Copyright 2021 The gVisor Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tcpip
+
+import "time"
+
+// afterLoad is invoked by stateify.
+func (s *stdClock) afterLoad() {
+	s.baseTime = time.Now()
+
+	s.monotonicMU.Lock()
+	defer s.monotonicMU.Unlock()
+	s.monotonicOffset = s.maxMonotonic
+}
diff --git a/pkg/tcpip/tcpip.go b/pkg/tcpip/tcpip.go
index 2e426ffe7..d8a10065d 100644
--- a/pkg/tcpip/tcpip.go
+++ b/pkg/tcpip/tcpip.go
@@ -73,7 +73,7 @@ type Clock interface {
 	// nanoseconds since the Unix epoch.
 	NowNanoseconds() int64
 
-	// NowMonotonic returns a monotonic time value.
+	// NowMonotonic returns a monotonic time value at nanosecond resolution.
 	NowMonotonic() int64
 
 	// AfterFunc waits for the duration to elapse and then calls f in its own
diff --git a/pkg/tcpip/time_unsafe.go b/pkg/tcpip/time_unsafe.go
deleted file mode 100644
index eeea97b12..000000000
--- a/pkg/tcpip/time_unsafe.go
+++ /dev/null
@@ -1,75 +0,0 @@
-// Copyright 2018 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-// +build go1.9
-// +build !go1.18
-
-// Check go:linkname function signatures when updating Go version.
-
-package tcpip
-
-import (
-	"time"     // Used with go:linkname.
-	_ "unsafe" // Required for go:linkname.
-)
-
-// StdClock implements Clock with the time package.
-//
-// +stateify savable
-type StdClock struct{}
-
-var _ Clock = (*StdClock)(nil)
-
-//go:linkname now time.now
-func now() (sec int64, nsec int32, mono int64)
-
-// NowNanoseconds implements Clock.NowNanoseconds.
-func (*StdClock) NowNanoseconds() int64 {
-	sec, nsec, _ := now()
-	return sec*1e9 + int64(nsec)
-}
-
-// NowMonotonic implements Clock.NowMonotonic.
-func (*StdClock) NowMonotonic() int64 {
-	_, _, mono := now()
-	return mono
-}
-
-// AfterFunc implements Clock.AfterFunc.
-func (*StdClock) AfterFunc(d time.Duration, f func()) Timer {
-	return &stdTimer{
-		t: time.AfterFunc(d, f),
-	}
-}
-
-type stdTimer struct {
-	t *time.Timer
-}
-
-var _ Timer = (*stdTimer)(nil)
-
-// Stop implements Timer.Stop.
-func (st *stdTimer) Stop() bool {
-	return st.t.Stop()
-}
-
-// Reset implements Timer.Reset.
-func (st *stdTimer) Reset(d time.Duration) {
-	st.t.Reset(d)
-}
-
-// NewStdTimer returns a Timer implemented with the time package.
-func NewStdTimer(t *time.Timer) Timer {
-	return &stdTimer{t: t}
-}
diff --git a/pkg/tcpip/timer_test.go b/pkg/tcpip/timer_test.go
index a82384c49..1633d0aeb 100644
--- a/pkg/tcpip/timer_test.go
+++ b/pkg/tcpip/timer_test.go
@@ -29,7 +29,7 @@ const (
 )
 
 func TestJobReschedule(t *testing.T) {
-	var clock tcpip.StdClock
+	clock := tcpip.NewStdClock()
 	var wg sync.WaitGroup
 	var lock sync.Mutex
 
@@ -43,7 +43,7 @@ func TestJobReschedule(t *testing.T) {
 			// that has an active timer (even if it has been stopped as a stopped
 			// timer may be blocked on a lock before it can check if it has been
 			// stopped while another goroutine holds the same lock).
-			job := tcpip.NewJob(&clock, &lock, func() {
+			job := tcpip.NewJob(clock, &lock, func() {
 				wg.Done()
 			})
 			job.Schedule(shortDuration)
@@ -56,11 +56,11 @@ func TestJobReschedule(t *testing.T) {
 func TestJobExecution(t *testing.T) {
 	t.Parallel()
 
-	var clock tcpip.StdClock
+	clock := tcpip.NewStdClock()
 	var lock sync.Mutex
 	ch := make(chan struct{})
 
-	job := tcpip.NewJob(&clock, &lock, func() {
+	job := tcpip.NewJob(clock, &lock, func() {
 		ch <- struct{}{}
 	})
 	job.Schedule(shortDuration)
@@ -83,11 +83,11 @@ func TestJobExecution(t *testing.T) {
 func TestCancellableTimerResetFromLongDuration(t *testing.T) {
 	t.Parallel()
 
-	var clock tcpip.StdClock
+	clock := tcpip.NewStdClock()
 	var lock sync.Mutex
 	ch := make(chan struct{})
 
-	job := tcpip.NewJob(&clock, &lock, func() { ch <- struct{}{} })
+	job := tcpip.NewJob(clock, &lock, func() { ch <- struct{}{} })
 	job.Schedule(middleDuration)
 
 	lock.Lock()
@@ -114,12 +114,12 @@ func TestCancellableTimerResetFromLongDuration(t *testing.T) {
 func TestJobRescheduleFromShortDuration(t *testing.T) {
 	t.Parallel()
 
-	var clock tcpip.StdClock
+	clock := tcpip.NewStdClock()
 	var lock sync.Mutex
 	ch := make(chan struct{})
 
 	lock.Lock()
-	job := tcpip.NewJob(&clock, &lock, func() { ch <- struct{}{} })
+	job := tcpip.NewJob(clock, &lock, func() { ch <- struct{}{} })
 	job.Schedule(shortDuration)
 	job.Cancel()
 	lock.Unlock()
@@ -151,13 +151,13 @@ func TestJobRescheduleFromShortDuration(t *testing.T) {
 func TestJobImmediatelyCancel(t *testing.T) {
 	t.Parallel()
 
-	var clock tcpip.StdClock
+	clock := tcpip.NewStdClock()
 	var lock sync.Mutex
 	ch := make(chan struct{})
 
 	for i := 0; i < 1000; i++ {
 		lock.Lock()
-		job := tcpip.NewJob(&clock, &lock, func() { ch <- struct{}{} })
+		job := tcpip.NewJob(clock, &lock, func() { ch <- struct{}{} })
 		job.Schedule(shortDuration)
 		job.Cancel()
 		lock.Unlock()
@@ -174,12 +174,12 @@ func TestJobImmediatelyCancel(t *testing.T) {
 func TestJobCancelledRescheduleWithoutLock(t *testing.T) {
 	t.Parallel()
 
-	var clock tcpip.StdClock
+	clock := tcpip.NewStdClock()
 	var lock sync.Mutex
 	ch := make(chan struct{})
 
 	lock.Lock()
-	job := tcpip.NewJob(&clock, &lock, func() { ch <- struct{}{} })
+	job := tcpip.NewJob(clock, &lock, func() { ch <- struct{}{} })
 	job.Schedule(shortDuration)
 	job.Cancel()
 	lock.Unlock()
@@ -206,12 +206,12 @@ func TestJobCancelledRescheduleWithoutLock(t *testing.T) {
 func TestManyCancellableTimerResetAfterBlockedOnLock(t *testing.T) {
 	t.Parallel()
 
-	var clock tcpip.StdClock
+	clock := tcpip.NewStdClock()
 	var lock sync.Mutex
 	ch := make(chan struct{})
 
 	lock.Lock()
-	job := tcpip.NewJob(&clock, &lock, func() { ch <- struct{}{} })
+	job := tcpip.NewJob(clock, &lock, func() { ch <- struct{}{} })
 	job.Schedule(shortDuration)
 	for i := 0; i < 10; i++ {
 		// Sleep until the timer fires and gets blocked trying to take the lock.
@@ -239,12 +239,12 @@ func TestManyCancellableTimerResetAfterBlockedOnLock(t *testing.T) {
 func TestManyJobReschedulesUnderLock(t *testing.T) {
 	t.Parallel()
 
-	var clock tcpip.StdClock
+	clock := tcpip.NewStdClock()
 	var lock sync.Mutex
 	ch := make(chan struct{})
 
 	lock.Lock()
-	job := tcpip.NewJob(&clock, &lock, func() { ch <- struct{}{} })
+	job := tcpip.NewJob(clock, &lock, func() { ch <- struct{}{} })
 	job.Schedule(shortDuration)
 	for i := 0; i < 10; i++ {
 		job.Cancel()