Merge release-20210518.0-45-gfcad6f91a (automated)

26 files changed, 192 insertions, 399 deletions

diff --git a/pkg/tcpip/network/ipv6/ndp.go b/pkg/tcpip/network/ipv6/ndp.go
index 7af5e6975..851cd6e75 100644
--- a/pkg/tcpip/network/ipv6/ndp.go
+++ b/pkg/tcpip/network/ipv6/ndp.go
@@ -548,7 +548,7 @@ type tempSLAACAddrState struct {
 	// Must not be nil.
 	regenJob *tcpip.Job
 
-	createdAt time.Time
+	createdAt tcpip.MonotonicTime
 
 	// The address's endpoint.
 	//
@@ -572,10 +572,10 @@ type slaacPrefixState struct {
 	invalidationJob *tcpip.Job
 
 	// Nonzero only when the address is not valid forever.
-	validUntil time.Time
+	validUntil tcpip.MonotonicTime
 
 	// Nonzero only when the address is not preferred forever.
-	preferredUntil time.Time
+	preferredUntil tcpip.MonotonicTime
 
 	// State associated with the stable address generated for the prefix.
 	stableAddr struct {
@@ -1050,7 +1050,7 @@ func (ndp *ndpState) doSLAAC(prefix tcpip.Subnet, pl, vl time.Duration) {
 		maxGenerationAttempts: ndp.configs.AutoGenAddressConflictRetries + 1,
 	}
 
-	now := time.Now()
+	now := ndp.ep.protocol.stack.Clock().NowMonotonic()
 
 	// The time an address is preferred until is needed to properly generate the
 	// address.
@@ -1181,7 +1181,7 @@ func (ndp *ndpState) generateSLAACAddr(prefix tcpip.Subnet, state *slaacPrefixSt
 		state.stableAddr.localGenerationFailures++
 	}
 
-	if addressEndpoint := ndp.addAndAcquireSLAACAddr(generatedAddr, stack.AddressConfigSlaac, time.Since(state.preferredUntil) >= 0 /* deprecated */); addressEndpoint != nil {
+	if addressEndpoint := ndp.addAndAcquireSLAACAddr(generatedAddr, stack.AddressConfigSlaac, ndp.ep.protocol.stack.Clock().NowMonotonic().Sub(state.preferredUntil) >= 0 /* deprecated */); addressEndpoint != nil {
 		state.stableAddr.addressEndpoint = addressEndpoint
 		state.generationAttempts++
 		return true
@@ -1236,13 +1236,13 @@ func (ndp *ndpState) generateTempSLAACAddr(prefix tcpip.Subnet, prefixState *sla
 	}
 
 	stableAddr := prefixState.stableAddr.addressEndpoint.AddressWithPrefix().Address
-	now := time.Now()
+	now := ndp.ep.protocol.stack.Clock().NowMonotonic()
 
 	// As per RFC 4941 section 3.3 step 4, the valid lifetime of a temporary
 	// address is the lower of the valid lifetime of the stable address or the
 	// maximum temporary address valid lifetime.
 	vl := ndp.configs.MaxTempAddrValidLifetime
-	if prefixState.validUntil != (time.Time{}) {
+	if prefixState.validUntil != (tcpip.MonotonicTime{}) {
 		if prefixVL := prefixState.validUntil.Sub(now); vl > prefixVL {
 			vl = prefixVL
 		}
@@ -1258,7 +1258,7 @@ func (ndp *ndpState) generateTempSLAACAddr(prefix tcpip.Subnet, prefixState *sla
 	// maximum temporary address preferred lifetime - the temporary address desync
 	// factor.
 	pl := ndp.configs.MaxTempAddrPreferredLifetime - ndp.temporaryAddressDesyncFactor
-	if prefixState.preferredUntil != (time.Time{}) {
+	if prefixState.preferredUntil != (tcpip.MonotonicTime{}) {
 		if prefixPL := prefixState.preferredUntil.Sub(now); pl > prefixPL {
 			// Respect the preferred lifetime of the prefix, as per RFC 4941 section
 			// 3.3 step 4.
@@ -1393,7 +1393,7 @@ func (ndp *ndpState) refreshSLAACPrefixLifetimes(prefix tcpip.Subnet, prefixStat
 	// deprecation job so it can be reset.
 	prefixState.deprecationJob.Cancel()
 
-	now := time.Now()
+	now := ndp.ep.protocol.stack.Clock().NowMonotonic()
 
 	// Schedule the deprecation job if prefix has a finite preferred lifetime.
 	if pl < header.NDPInfiniteLifetime {
@@ -1402,7 +1402,7 @@ func (ndp *ndpState) refreshSLAACPrefixLifetimes(prefix tcpip.Subnet, prefixStat
 		}
 		prefixState.preferredUntil = now.Add(pl)
 	} else {
-		prefixState.preferredUntil = time.Time{}
+		prefixState.preferredUntil = tcpip.MonotonicTime{}
 	}
 
 	// As per RFC 4862 section 5.5.3.e, update the valid lifetime for prefix:
@@ -1420,17 +1420,17 @@ func (ndp *ndpState) refreshSLAACPrefixLifetimes(prefix tcpip.Subnet, prefixStat
 		// Handle the infinite valid lifetime separately as we do not schedule a
 		// job in this case.
 		prefixState.invalidationJob.Cancel()
-		prefixState.validUntil = time.Time{}
+		prefixState.validUntil = tcpip.MonotonicTime{}
 	} else {
 		var effectiveVl time.Duration
 		var rl time.Duration
 
 		// If the prefix was originally set to be valid forever, assume the
 		// remaining time to be the maximum possible value.
-		if prefixState.validUntil == (time.Time{}) {
+		if prefixState.validUntil == (tcpip.MonotonicTime{}) {
 			rl = header.NDPInfiniteLifetime
 		} else {
-			rl = time.Until(prefixState.validUntil)
+			rl = prefixState.validUntil.Sub(now)
 		}
 
 		if vl > MinPrefixInformationValidLifetimeForUpdate || vl > rl {
@@ -1462,7 +1462,7 @@ func (ndp *ndpState) refreshSLAACPrefixLifetimes(prefix tcpip.Subnet, prefixStat
 		// maximum temporary address valid lifetime. Note, the valid lifetime of a
 		// temporary address is relative to the address's creation time.
 		validUntil := tempAddrState.createdAt.Add(ndp.configs.MaxTempAddrValidLifetime)
-		if prefixState.validUntil != (time.Time{}) && validUntil.Sub(prefixState.validUntil) > 0 {
+		if prefixState.validUntil != (tcpip.MonotonicTime{}) && validUntil.Sub(prefixState.validUntil) > 0 {
 			validUntil = prefixState.validUntil
 		}
 
@@ -1482,7 +1482,7 @@ func (ndp *ndpState) refreshSLAACPrefixLifetimes(prefix tcpip.Subnet, prefixStat
 		// desync factor. Note, the preferred lifetime of a temporary address is
 		// relative to the address's creation time.
 		preferredUntil := tempAddrState.createdAt.Add(ndp.configs.MaxTempAddrPreferredLifetime - ndp.temporaryAddressDesyncFactor)
-		if prefixState.preferredUntil != (time.Time{}) && preferredUntil.Sub(prefixState.preferredUntil) > 0 {
+		if prefixState.preferredUntil != (tcpip.MonotonicTime{}) && preferredUntil.Sub(prefixState.preferredUntil) > 0 {
 			preferredUntil = prefixState.preferredUntil
 		}
 
diff --git a/pkg/tcpip/stack/conntrack.go b/pkg/tcpip/stack/conntrack.go
index 5720e7543..f7fbcbaa7 100644
--- a/pkg/tcpip/stack/conntrack.go
+++ b/pkg/tcpip/stack/conntrack.go
@@ -125,6 +125,8 @@ type conn struct {
 	tcb tcpconntrack.TCB
 	// lastUsed is the last time the connection saw a relevant packet, and
 	// is updated by each packet on the connection. It is protected by mu.
+	//
+	// TODO(gvisor.dev/issue/5939): do not use the ambient clock.
 	lastUsed time.Time `state:".(unixTime)"`
 }
 
diff --git a/pkg/tcpip/stack/iptables.go b/pkg/tcpip/stack/iptables.go
index 3670d5995..d2f666c09 100644
--- a/pkg/tcpip/stack/iptables.go
+++ b/pkg/tcpip/stack/iptables.go
@@ -371,6 +371,7 @@ func (it *IPTables) startReaper(interval time.Duration) {
 			select {
 			case <-it.reaperDone:
 				return
+				// TODO(gvisor.dev/issue/5939): do not use the ambient clock.
 			case <-time.After(interval):
 				bucket, interval = it.connections.reapUnused(bucket, interval)
 			}
diff --git a/pkg/tcpip/stack/neighbor_cache.go b/pkg/tcpip/stack/neighbor_cache.go
index 509f5ce5c..08857e1a9 100644
--- a/pkg/tcpip/stack/neighbor_cache.go
+++ b/pkg/tcpip/stack/neighbor_cache.go
@@ -310,7 +310,7 @@ func (n *neighborCache) handleUpperLevelConfirmation(addr tcpip.Address) {
 func (n *neighborCache) init(nic *nic, r LinkAddressResolver) {
 	*n = neighborCache{
 		nic:     nic,
-		state:   NewNUDState(nic.stack.nudConfigs, nic.stack.randomGenerator),
+		state:   NewNUDState(nic.stack.nudConfigs, nic.stack.clock, nic.stack.randomGenerator),
 		linkRes: r,
 	}
 	n.mu.Lock()
diff --git a/pkg/tcpip/stack/nud.go b/pkg/tcpip/stack/nud.go
index dac94cbe4..ca9822bca 100644
--- a/pkg/tcpip/stack/nud.go
+++ b/pkg/tcpip/stack/nud.go
@@ -316,7 +316,8 @@ func calcMaxRandomFactor(minRandomFactor float32) float32 {
 
 // NUDState stores states needed for calculating reachable time.
 type NUDState struct {
-	rng *rand.Rand
+	clock tcpip.Clock
+	rng   *rand.Rand
 
 	mu struct {
 		sync.RWMutex
@@ -337,9 +338,10 @@ type NUDState struct {
 
 // NewNUDState returns new NUDState using c as configuration and the specified
 // random number generator for use in recomputing ReachableTime.
-func NewNUDState(c NUDConfigurations, rng *rand.Rand) *NUDState {
+func NewNUDState(c NUDConfigurations, clock tcpip.Clock, rng *rand.Rand) *NUDState {
 	s := &NUDState{
-		rng: rng,
+		clock: clock,
+		rng:   rng,
 	}
 	s.mu.config = c
 	return s
@@ -367,7 +369,7 @@ func (s *NUDState) ReachableTime() time.Duration {
 	s.mu.Lock()
 	defer s.mu.Unlock()
 
-	if time.Now().After(s.mu.expiration) ||
+	if s.clock.Now().After(s.mu.expiration) ||
 		s.mu.config.BaseReachableTime != s.mu.prevBaseReachableTime ||
 		s.mu.config.MinRandomFactor != s.mu.prevMinRandomFactor ||
 		s.mu.config.MaxRandomFactor != s.mu.prevMaxRandomFactor {
@@ -416,5 +418,5 @@ func (s *NUDState) recomputeReachableTimeLocked() {
 		s.mu.reachableTime = time.Duration(reachableTime)
 	}
 
-	s.mu.expiration = time.Now().Add(2 * time.Hour)
+	s.mu.expiration = s.clock.Now().Add(2 * time.Hour)
 }
diff --git a/pkg/tcpip/stack/stack_global_state.go b/pkg/tcpip/stack/stack_global_state.go
index 33824afd0..dfec4258a 100644
--- a/pkg/tcpip/stack/stack_global_state.go
+++ b/pkg/tcpip/stack/stack_global_state.go
@@ -14,78 +14,6 @@
 
 package stack
 
-import "time"
-
 // StackFromEnv is the global stack created in restore run.
 // FIXME(b/36201077)
 var StackFromEnv *Stack
-
-// saveT is invoked by stateify.
-func (t *TCPCubicState) saveT() unixTime {
-	return unixTime{t.T.Unix(), t.T.UnixNano()}
-}
-
-// loadT is invoked by stateify.
-func (t *TCPCubicState) loadT(unix unixTime) {
-	t.T = time.Unix(unix.second, unix.nano)
-}
-
-// saveXmitTime is invoked by stateify.
-func (t *TCPRACKState) saveXmitTime() unixTime {
-	return unixTime{t.XmitTime.Unix(), t.XmitTime.UnixNano()}
-}
-
-// loadXmitTime is invoked by stateify.
-func (t *TCPRACKState) loadXmitTime(unix unixTime) {
-	t.XmitTime = time.Unix(unix.second, unix.nano)
-}
-
-// saveLastSendTime is invoked by stateify.
-func (t *TCPSenderState) saveLastSendTime() unixTime {
-	return unixTime{t.LastSendTime.Unix(), t.LastSendTime.UnixNano()}
-}
-
-// loadLastSendTime is invoked by stateify.
-func (t *TCPSenderState) loadLastSendTime(unix unixTime) {
-	t.LastSendTime = time.Unix(unix.second, unix.nano)
-}
-
-// saveRTTMeasureTime is invoked by stateify.
-func (t *TCPSenderState) saveRTTMeasureTime() unixTime {
-	return unixTime{t.RTTMeasureTime.Unix(), t.RTTMeasureTime.UnixNano()}
-}
-
-// loadRTTMeasureTime is invoked by stateify.
-func (t *TCPSenderState) loadRTTMeasureTime(unix unixTime) {
-	t.RTTMeasureTime = time.Unix(unix.second, unix.nano)
-}
-
-// saveMeasureTime is invoked by stateify.
-func (r *RcvBufAutoTuneParams) saveMeasureTime() unixTime {
-	return unixTime{r.MeasureTime.Unix(), r.MeasureTime.UnixNano()}
-}
-
-// loadMeasureTime is invoked by stateify.
-func (r *RcvBufAutoTuneParams) loadMeasureTime(unix unixTime) {
-	r.MeasureTime = time.Unix(unix.second, unix.nano)
-}
-
-// saveRTTMeasureTime is invoked by stateify.
-func (r *RcvBufAutoTuneParams) saveRTTMeasureTime() unixTime {
-	return unixTime{r.RTTMeasureTime.Unix(), r.RTTMeasureTime.UnixNano()}
-}
-
-// loadRTTMeasureTime is invoked by stateify.
-func (r *RcvBufAutoTuneParams) loadRTTMeasureTime(unix unixTime) {
-	r.RTTMeasureTime = time.Unix(unix.second, unix.nano)
-}
-
-// saveSegTime is invoked by stateify.
-func (t *TCPEndpointState) saveSegTime() unixTime {
-	return unixTime{t.SegTime.Unix(), t.SegTime.UnixNano()}
-}
-
-// loadSegTime is invoked by stateify.
-func (t *TCPEndpointState) loadSegTime(unix unixTime) {
-	t.SegTime = time.Unix(unix.second, unix.nano)
-}
diff --git a/pkg/tcpip/stack/stack_state_autogen.go b/pkg/tcpip/stack/stack_state_autogen.go
index a803f9992..b287f64c3 100644
--- a/pkg/tcpip/stack/stack_state_autogen.go
+++ b/pkg/tcpip/stack/stack_state_autogen.go
@@ -623,10 +623,9 @@ func (t *TCPCubicState) beforeSave() {}
 // +checklocksignore
 func (t *TCPCubicState) StateSave(stateSinkObject state.Sink) {
 	t.beforeSave()
-	var TValue unixTime = t.saveT()
-	stateSinkObject.SaveValue(2, TValue)
 	stateSinkObject.Save(0, &t.WLastMax)
 	stateSinkObject.Save(1, &t.WMax)
+	stateSinkObject.Save(2, &t.T)
 	stateSinkObject.Save(3, &t.TimeSinceLastCongestion)
 	stateSinkObject.Save(4, &t.C)
 	stateSinkObject.Save(5, &t.K)
@@ -641,13 +640,13 @@ func (t *TCPCubicState) afterLoad() {}
 func (t *TCPCubicState) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(0, &t.WLastMax)
 	stateSourceObject.Load(1, &t.WMax)
+	stateSourceObject.Load(2, &t.T)
 	stateSourceObject.Load(3, &t.TimeSinceLastCongestion)
 	stateSourceObject.Load(4, &t.C)
 	stateSourceObject.Load(5, &t.K)
 	stateSourceObject.Load(6, &t.Beta)
 	stateSourceObject.Load(7, &t.WC)
 	stateSourceObject.Load(8, &t.WEst)
-	stateSourceObject.LoadValue(2, new(unixTime), func(y interface{}) { t.loadT(y.(unixTime)) })
 }
 
 func (t *TCPRACKState) StateTypeName() string {
@@ -674,8 +673,7 @@ func (t *TCPRACKState) beforeSave() {}
 // +checklocksignore
 func (t *TCPRACKState) StateSave(stateSinkObject state.Sink) {
 	t.beforeSave()
-	var XmitTimeValue unixTime = t.saveXmitTime()
-	stateSinkObject.SaveValue(0, XmitTimeValue)
+	stateSinkObject.Save(0, &t.XmitTime)
 	stateSinkObject.Save(1, &t.EndSequence)
 	stateSinkObject.Save(2, &t.FACK)
 	stateSinkObject.Save(3, &t.RTT)
@@ -691,6 +689,7 @@ func (t *TCPRACKState) afterLoad() {}
 
 // +checklocksignore
 func (t *TCPRACKState) StateLoad(stateSourceObject state.Source) {
+	stateSourceObject.Load(0, &t.XmitTime)
 	stateSourceObject.Load(1, &t.EndSequence)
 	stateSourceObject.Load(2, &t.FACK)
 	stateSourceObject.Load(3, &t.RTT)
@@ -700,7 +699,6 @@ func (t *TCPRACKState) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(7, &t.ReoWndIncr)
 	stateSourceObject.Load(8, &t.ReoWndPersist)
 	stateSourceObject.Load(9, &t.RTTSeq)
-	stateSourceObject.LoadValue(0, new(unixTime), func(y interface{}) { t.loadXmitTime(y.(unixTime)) })
 }
 
 func (t *TCPEndpointID) StateTypeName() string {
@@ -877,10 +875,7 @@ func (t *TCPSenderState) beforeSave() {}
 // +checklocksignore
 func (t *TCPSenderState) StateSave(stateSinkObject state.Sink) {
 	t.beforeSave()
-	var LastSendTimeValue unixTime = t.saveLastSendTime()
-	stateSinkObject.SaveValue(0, LastSendTimeValue)
-	var RTTMeasureTimeValue unixTime = t.saveRTTMeasureTime()
-	stateSinkObject.SaveValue(11, RTTMeasureTimeValue)
+	stateSinkObject.Save(0, &t.LastSendTime)
 	stateSinkObject.Save(1, &t.DupAckCount)
 	stateSinkObject.Save(2, &t.SndCwnd)
 	stateSinkObject.Save(3, &t.Ssthresh)
@@ -891,6 +886,7 @@ func (t *TCPSenderState) StateSave(stateSinkObject state.Sink) {
 	stateSinkObject.Save(8, &t.SndUna)
 	stateSinkObject.Save(9, &t.SndNxt)
 	stateSinkObject.Save(10, &t.RTTMeasureSeqNum)
+	stateSinkObject.Save(11, &t.RTTMeasureTime)
 	stateSinkObject.Save(12, &t.Closed)
 	stateSinkObject.Save(13, &t.RTO)
 	stateSinkObject.Save(14, &t.RTTState)
@@ -906,6 +902,7 @@ func (t *TCPSenderState) afterLoad() {}
 
 // +checklocksignore
 func (t *TCPSenderState) StateLoad(stateSourceObject state.Source) {
+	stateSourceObject.Load(0, &t.LastSendTime)
 	stateSourceObject.Load(1, &t.DupAckCount)
 	stateSourceObject.Load(2, &t.SndCwnd)
 	stateSourceObject.Load(3, &t.Ssthresh)
@@ -916,6 +913,7 @@ func (t *TCPSenderState) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(8, &t.SndUna)
 	stateSourceObject.Load(9, &t.SndNxt)
 	stateSourceObject.Load(10, &t.RTTMeasureSeqNum)
+	stateSourceObject.Load(11, &t.RTTMeasureTime)
 	stateSourceObject.Load(12, &t.Closed)
 	stateSourceObject.Load(13, &t.RTO)
 	stateSourceObject.Load(14, &t.RTTState)
@@ -925,8 +923,6 @@ func (t *TCPSenderState) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(18, &t.FastRecovery)
 	stateSourceObject.Load(19, &t.Cubic)
 	stateSourceObject.Load(20, &t.RACKState)
-	stateSourceObject.LoadValue(0, new(unixTime), func(y interface{}) { t.loadLastSendTime(y.(unixTime)) })
-	stateSourceObject.LoadValue(11, new(unixTime), func(y interface{}) { t.loadRTTMeasureTime(y.(unixTime)) })
 }
 
 func (t *TCPSACKInfo) StateTypeName() string {
@@ -983,16 +979,14 @@ func (r *RcvBufAutoTuneParams) beforeSave() {}
 // +checklocksignore
 func (r *RcvBufAutoTuneParams) StateSave(stateSinkObject state.Sink) {
 	r.beforeSave()
-	var MeasureTimeValue unixTime = r.saveMeasureTime()
-	stateSinkObject.SaveValue(0, MeasureTimeValue)
-	var RTTMeasureTimeValue unixTime = r.saveRTTMeasureTime()
-	stateSinkObject.SaveValue(7, RTTMeasureTimeValue)
+	stateSinkObject.Save(0, &r.MeasureTime)
 	stateSinkObject.Save(1, &r.CopiedBytes)
 	stateSinkObject.Save(2, &r.PrevCopiedBytes)
 	stateSinkObject.Save(3, &r.RcvBufSize)
 	stateSinkObject.Save(4, &r.RTT)
 	stateSinkObject.Save(5, &r.RTTVar)
 	stateSinkObject.Save(6, &r.RTTMeasureSeqNumber)
+	stateSinkObject.Save(7, &r.RTTMeasureTime)
 	stateSinkObject.Save(8, &r.Disabled)
 }
 
@@ -1000,15 +994,15 @@ func (r *RcvBufAutoTuneParams) afterLoad() {}
 
 // +checklocksignore
 func (r *RcvBufAutoTuneParams) StateLoad(stateSourceObject state.Source) {
+	stateSourceObject.Load(0, &r.MeasureTime)
 	stateSourceObject.Load(1, &r.CopiedBytes)
 	stateSourceObject.Load(2, &r.PrevCopiedBytes)
 	stateSourceObject.Load(3, &r.RcvBufSize)
 	stateSourceObject.Load(4, &r.RTT)
 	stateSourceObject.Load(5, &r.RTTVar)
 	stateSourceObject.Load(6, &r.RTTMeasureSeqNumber)
+	stateSourceObject.Load(7, &r.RTTMeasureTime)
 	stateSourceObject.Load(8, &r.Disabled)
-	stateSourceObject.LoadValue(0, new(unixTime), func(y interface{}) { r.loadMeasureTime(y.(unixTime)) })
-	stateSourceObject.LoadValue(7, new(unixTime), func(y interface{}) { r.loadRTTMeasureTime(y.(unixTime)) })
 }
 
 func (t *TCPRcvBufState) StateTypeName() string {
@@ -1138,10 +1132,9 @@ func (t *TCPEndpointState) beforeSave() {}
 // +checklocksignore
 func (t *TCPEndpointState) StateSave(stateSinkObject state.Sink) {
 	t.beforeSave()
-	var SegTimeValue unixTime = t.saveSegTime()
-	stateSinkObject.SaveValue(2, SegTimeValue)
 	stateSinkObject.Save(0, &t.TCPEndpointStateInner)
 	stateSinkObject.Save(1, &t.ID)
+	stateSinkObject.Save(2, &t.SegTime)
 	stateSinkObject.Save(3, &t.RcvBufState)
 	stateSinkObject.Save(4, &t.SndBufState)
 	stateSinkObject.Save(5, &t.SACK)
@@ -1155,12 +1148,12 @@ func (t *TCPEndpointState) afterLoad() {}
 func (t *TCPEndpointState) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(0, &t.TCPEndpointStateInner)
 	stateSourceObject.Load(1, &t.ID)
+	stateSourceObject.Load(2, &t.SegTime)
 	stateSourceObject.Load(3, &t.RcvBufState)
 	stateSourceObject.Load(4, &t.SndBufState)
 	stateSourceObject.Load(5, &t.SACK)
 	stateSourceObject.Load(6, &t.Receiver)
 	stateSourceObject.Load(7, &t.Sender)
-	stateSourceObject.LoadValue(2, new(unixTime), func(y interface{}) { t.loadSegTime(y.(unixTime)) })
 }
 
 func (ep *multiPortEndpoint) StateTypeName() string {
diff --git a/pkg/tcpip/stack/tcp.go b/pkg/tcpip/stack/tcp.go
index ddff6e2d6..e90c1a770 100644
--- a/pkg/tcpip/stack/tcp.go
+++ b/pkg/tcpip/stack/tcp.go
@@ -39,7 +39,7 @@ type TCPCubicState struct {
 	WMax float64
 
 	// T is the time when the current congestion avoidance was entered.
-	T time.Time `state:".(unixTime)"`
+	T tcpip.MonotonicTime
 
 	// TimeSinceLastCongestion denotes the time since the current
 	// congestion avoidance was entered.
@@ -78,7 +78,7 @@ type TCPCubicState struct {
 type TCPRACKState struct {
 	// XmitTime is the transmission timestamp of the most recent
 	// acknowledged segment.
-	XmitTime time.Time `state:".(unixTime)"`
+	XmitTime tcpip.MonotonicTime
 
 	// EndSequence is the ending TCP sequence number of the most recent
 	// acknowledged segment.
@@ -216,7 +216,7 @@ type TCPRTTState struct {
 // +stateify savable
 type TCPSenderState struct {
 	// LastSendTime is the timestamp at which we sent the last segment.
-	LastSendTime time.Time `state:".(unixTime)"`
+	LastSendTime tcpip.MonotonicTime
 
 	// DupAckCount is the number of Duplicate ACKs received. It is used for
 	// fast retransmit.
@@ -256,7 +256,7 @@ type TCPSenderState struct {
 	RTTMeasureSeqNum seqnum.Value
 
 	// RTTMeasureTime is the time when the RTTMeasureSeqNum was sent.
-	RTTMeasureTime time.Time `state:".(unixTime)"`
+	RTTMeasureTime tcpip.MonotonicTime
 
 	// Closed indicates that the caller has closed the endpoint for
 	// sending.
@@ -313,7 +313,7 @@ type TCPSACKInfo struct {
 type RcvBufAutoTuneParams struct {
 	// MeasureTime is the time at which the current measurement was
 	// started.
-	MeasureTime time.Time `state:".(unixTime)"`
+	MeasureTime tcpip.MonotonicTime
 
 	// CopiedBytes is the number of bytes copied to user space since this
 	// measure began.
@@ -341,7 +341,7 @@ type RcvBufAutoTuneParams struct {
 
 	// RTTMeasureTime is the absolute time at which the current RTT
 	// measurement period began.
-	RTTMeasureTime time.Time `state:".(unixTime)"`
+	RTTMeasureTime tcpip.MonotonicTime
 
 	// Disabled is true if an explicit receive buffer is set for the
 	// endpoint.
@@ -429,7 +429,7 @@ type TCPEndpointState struct {
 	ID TCPEndpointID
 
 	// SegTime denotes the absolute time when this segment was received.
-	SegTime time.Time `state:".(unixTime)"`
+	SegTime tcpip.MonotonicTime
 
 	// RcvBufState contains information about the state of the endpoint's
 	// receive socket buffer.
diff --git a/pkg/tcpip/tcpip.go b/pkg/tcpip/tcpip.go
index ca98da847..91622fa4c 100644
--- a/pkg/tcpip/tcpip.go
+++ b/pkg/tcpip/tcpip.go
@@ -76,6 +76,11 @@ func (mt MonotonicTime) Before(u MonotonicTime) bool {
 	return mt.nanoseconds < u.nanoseconds
 }
 
+// After reports whether the monotonic clock reading mt is after u.
+func (mt MonotonicTime) After(u MonotonicTime) bool {
+	return mt.nanoseconds > u.nanoseconds
+}
+
 // Add returns the monotonic clock reading mt+d.
 func (mt MonotonicTime) Add(d time.Duration) MonotonicTime {
 	return MonotonicTime{
diff --git a/pkg/tcpip/transport/tcp/accept.go b/pkg/tcpip/transport/tcp/accept.go
index d4bd4e80e..4a33fbc24 100644
--- a/pkg/tcpip/transport/tcp/accept.go
+++ b/pkg/tcpip/transport/tcp/accept.go
@@ -114,8 +114,8 @@ type listenContext struct {
 }
 
 // timeStamp returns an 8-bit timestamp with a granularity of 64 seconds.
-func timeStamp() uint32 {
-	return uint32(time.Now().Unix()>>6) & tsMask
+func timeStamp(clock tcpip.Clock) uint32 {
+	return uint32(clock.NowMonotonic().Sub(tcpip.MonotonicTime{}).Seconds()) >> 6 & tsMask
 }
 
 // newListenContext creates a new listen context.
@@ -171,7 +171,7 @@ func (l *listenContext) cookieHash(id stack.TransportEndpointID, ts uint32, nonc
 // createCookie creates a SYN cookie for the given id and incoming sequence
 // number.
 func (l *listenContext) createCookie(id stack.TransportEndpointID, seq seqnum.Value, data uint32) seqnum.Value {
-	ts := timeStamp()
+	ts := timeStamp(l.stack.Clock())
 	v := l.cookieHash(id, 0, 0) + uint32(seq) + (ts << tsOffset)
 	v += (l.cookieHash(id, ts, 1) + data) & hashMask
 	return seqnum.Value(v)
@@ -181,7 +181,7 @@ func (l *listenContext) createCookie(id stack.TransportEndpointID, seq seqnum.Va
 // sequence number. If it is, it also returns the data originally encoded in the
 // cookie when createCookie was called.
 func (l *listenContext) isCookieValid(id stack.TransportEndpointID, cookie seqnum.Value, seq seqnum.Value) (uint32, bool) {
-	ts := timeStamp()
+	ts := timeStamp(l.stack.Clock())
 	v := uint32(cookie) - l.cookieHash(id, 0, 0) - uint32(seq)
 	cookieTS := v >> tsOffset
 	if ((ts - cookieTS) & tsMask) > maxTSDiff {
@@ -247,7 +247,7 @@ func (l *listenContext) createConnectingEndpoint(s *segment, rcvdSynOpts *header
 func (l *listenContext) startHandshake(s *segment, opts *header.TCPSynOptions, queue *waiter.Queue, owner tcpip.PacketOwner) (*handshake, tcpip.Error) {
 	// Create new endpoint.
 	irs := s.sequenceNumber
-	isn := generateSecureISN(s.id, l.stack.Seed())
+	isn := generateSecureISN(s.id, l.stack.Clock(), l.stack.Seed())
 	ep, err := l.createConnectingEndpoint(s, opts, queue)
 	if err != nil {
 		return nil, err
@@ -591,7 +591,7 @@ func (e *endpoint) handleListenSegment(ctx *listenContext, s *segment) tcpip.Err
 		synOpts := header.TCPSynOptions{
 			WS:    -1,
 			TS:    opts.TS,
-			TSVal: tcpTimeStamp(time.Now(), timeStampOffset()),
+			TSVal: tcpTimeStamp(e.stack.Clock().NowMonotonic(), timeStampOffset()),
 			TSEcr: opts.TSVal,
 			MSS:   calculateAdvertisedMSS(e.userMSS, route),
 		}
diff --git a/pkg/tcpip/transport/tcp/connect.go b/pkg/tcpip/transport/tcp/connect.go
index 05b41e0f8..2fcdf1cda 100644
--- a/pkg/tcpip/transport/tcp/connect.go
+++ b/pkg/tcpip/transport/tcp/connect.go
@@ -92,7 +92,7 @@ type handshake struct {
 	rcvWndScale int
 
 	// startTime is the time at which the first SYN/SYN-ACK was sent.
-	startTime time.Time
+	startTime tcpip.MonotonicTime
 
 	// deferAccept if non-zero will drop the final ACK for a passive
 	// handshake till an ACK segment with data is received or the timeout is
@@ -156,12 +156,12 @@ func (h *handshake) resetState() {
 	h.flags = header.TCPFlagSyn
 	h.ackNum = 0
 	h.mss = 0
-	h.iss = generateSecureISN(h.ep.TransportEndpointInfo.ID, h.ep.stack.Seed())
+	h.iss = generateSecureISN(h.ep.TransportEndpointInfo.ID, h.ep.stack.Clock(), h.ep.stack.Seed())
 }
 
 // generateSecureISN generates a secure Initial Sequence number based on the
 // recommendation here https://tools.ietf.org/html/rfc6528#page-3.
-func generateSecureISN(id stack.TransportEndpointID, seed uint32) seqnum.Value {
+func generateSecureISN(id stack.TransportEndpointID, clock tcpip.Clock, seed uint32) seqnum.Value {
 	isnHasher := jenkins.Sum32(seed)
 	isnHasher.Write([]byte(id.LocalAddress))
 	isnHasher.Write([]byte(id.RemoteAddress))
@@ -180,7 +180,7 @@ func generateSecureISN(id stack.TransportEndpointID, seed uint32) seqnum.Value {
 	//
 	// Which sort of guarantees that we won't reuse the ISN for a new
 	// connection for the same tuple for at least 274s.
-	isn := isnHasher.Sum32() + uint32(time.Now().UnixNano()>>6)
+	isn := isnHasher.Sum32() + uint32(clock.NowMonotonic().Sub(tcpip.MonotonicTime{}).Nanoseconds()>>6)
 	return seqnum.Value(isn)
 }
 
@@ -381,7 +381,7 @@ func (h *handshake) synRcvdState(s *segment) tcpip.Error {
 	if s.flagIsSet(header.TCPFlagAck) {
 		// If deferAccept is not zero and this is a bare ACK and the
 		// timeout is not hit then drop the ACK.
-		if h.deferAccept != 0 && s.data.Size() == 0 && time.Since(h.startTime) < h.deferAccept {
+		if h.deferAccept != 0 && s.data.Size() == 0 && h.ep.stack.Clock().NowMonotonic().Sub(h.startTime) < h.deferAccept {
 			h.acked = true
 			h.ep.stack.Stats().DroppedPackets.Increment()
 			return nil
@@ -474,7 +474,7 @@ func (h *handshake) processSegments() tcpip.Error {
 // start sends the first SYN/SYN-ACK. It does not block, even if link address
 // resolution is required.
 func (h *handshake) start() {
-	h.startTime = time.Now()
+	h.startTime = h.ep.stack.Clock().NowMonotonic()
 	h.ep.amss = calculateAdvertisedMSS(h.ep.userMSS, h.ep.route)
 	var sackEnabled tcpip.TCPSACKEnabled
 	if err := h.ep.stack.TransportProtocolOption(ProtocolNumber, &sackEnabled); err != nil {
@@ -527,7 +527,7 @@ func (h *handshake) complete() tcpip.Error {
 	defer s.Done()
 
 	// Initialize the resend timer.
-	timer, err := newBackoffTimer(time.Second, MaxRTO, resendWaker.Assert)
+	timer, err := newBackoffTimer(h.ep.stack.Clock(), time.Second, MaxRTO, resendWaker.Assert)
 	if err != nil {
 		return err
 	}
@@ -552,7 +552,7 @@ func (h *handshake) complete() tcpip.Error {
 			// The last is required to provide a way for the peer to complete
 			// the connection with another ACK or data (as ACKs are never
 			// retransmitted on their own).
-			if h.active || !h.acked || h.deferAccept != 0 && time.Since(h.startTime) > h.deferAccept {
+			if h.active || !h.acked || h.deferAccept != 0 && h.ep.stack.Clock().NowMonotonic().Sub(h.startTime) > h.deferAccept {
 				h.ep.sendSynTCP(h.ep.route, tcpFields{
 					id:     h.ep.TransportEndpointInfo.ID,
 					ttl:    h.ep.ttl,
@@ -608,15 +608,15 @@ func (h *handshake) complete() tcpip.Error {
 type backoffTimer struct {
 	timeout    time.Duration
 	maxTimeout time.Duration
-	t          *time.Timer
+	t          tcpip.Timer
 }
 
-func newBackoffTimer(timeout, maxTimeout time.Duration, f func()) (*backoffTimer, tcpip.Error) {
+func newBackoffTimer(clock tcpip.Clock, timeout, maxTimeout time.Duration, f func()) (*backoffTimer, tcpip.Error) {
 	if timeout > maxTimeout {
 		return nil, &tcpip.ErrTimeout{}
 	}
 	bt := &backoffTimer{timeout: timeout, maxTimeout: maxTimeout}
-	bt.t = time.AfterFunc(timeout, f)
+	bt.t = clock.AfterFunc(timeout, f)
 	return bt, nil
 }
 
@@ -1267,7 +1267,7 @@ func (e *endpoint) keepaliveTimerExpired() tcpip.Error {
 
 	// If a userTimeout is set then abort the connection if it is
 	// exceeded.
-	if userTimeout != 0 && time.Since(e.rcv.lastRcvdAckTime) >= userTimeout && e.keepalive.unacked > 0 {
+	if userTimeout != 0 && e.stack.Clock().NowMonotonic().Sub(e.rcv.lastRcvdAckTime) >= userTimeout && e.keepalive.unacked > 0 {
 		e.keepalive.Unlock()
 		e.stack.Stats().TCP.EstablishedTimedout.Increment()
 		return &tcpip.ErrTimeout{}
@@ -1322,7 +1322,7 @@ func (e *endpoint) disableKeepaliveTimer() {
 // segments.
 func (e *endpoint) protocolMainLoop(handshake bool, wakerInitDone chan<- struct{}) tcpip.Error {
 	e.mu.Lock()
-	var closeTimer *time.Timer
+	var closeTimer tcpip.Timer
 	var closeWaker sleep.Waker
 
 	epilogue := func() {
@@ -1484,7 +1484,7 @@ func (e *endpoint) protocolMainLoop(handshake bool, wakerInitDone chan<- struct{
 					if e.EndpointState() == StateFinWait2 && e.closed {
 						// The socket has been closed and we are in FIN_WAIT2
 						// so start the FIN_WAIT2 timer.
-						closeTimer = time.AfterFunc(e.tcpLingerTimeout, closeWaker.Assert)
+						closeTimer = e.stack.Clock().AfterFunc(e.tcpLingerTimeout, closeWaker.Assert)
 					}
 				}
 
@@ -1721,7 +1721,7 @@ func (e *endpoint) doTimeWait() (twReuse func()) {
 
 	var timeWaitWaker sleep.Waker
 	s.AddWaker(&timeWaitWaker, timeWaitDone)
-	timeWaitTimer := time.AfterFunc(timeWaitDuration, timeWaitWaker.Assert)
+	timeWaitTimer := e.stack.Clock().AfterFunc(timeWaitDuration, timeWaitWaker.Assert)
 	defer timeWaitTimer.Stop()
 
 	for {
diff --git a/pkg/tcpip/transport/tcp/cubic.go b/pkg/tcpip/transport/tcp/cubic.go
index 962f1d687..6985194bb 100644
--- a/pkg/tcpip/transport/tcp/cubic.go
+++ b/pkg/tcpip/transport/tcp/cubic.go
@@ -41,7 +41,7 @@ type cubicState struct {
 func newCubicCC(s *sender) *cubicState {
 	return &cubicState{
 		TCPCubicState: stack.TCPCubicState{
-			T:    time.Now(),
+			T:    s.ep.stack.Clock().NowMonotonic(),
 			Beta: 0.7,
 			C:    0.4,
 		},
@@ -60,7 +60,7 @@ func (c *cubicState) enterCongestionAvoidance() {
 	// https://tools.ietf.org/html/rfc8312#section-4.8
 	if c.numCongestionEvents == 0 {
 		c.K = 0
-		c.T = time.Now()
+		c.T = c.s.ep.stack.Clock().NowMonotonic()
 		c.WLastMax = c.WMax
 		c.WMax = float64(c.s.SndCwnd)
 	}
@@ -115,14 +115,15 @@ func (c *cubicState) cubicCwnd(t float64) float64 {
 // getCwnd returns the current congestion window as computed by CUBIC.
 // Refer: https://tools.ietf.org/html/rfc8312#section-4
 func (c *cubicState) getCwnd(packetsAcked, sndCwnd int, srtt time.Duration) int {
-	elapsed := time.Since(c.T).Seconds()
+	elapsed := c.s.ep.stack.Clock().NowMonotonic().Sub(c.T)
+	elapsedSeconds := elapsed.Seconds()
 
 	// Compute the window as per Cubic after 'elapsed' time
 	// since last congestion event.
-	c.WC = c.cubicCwnd(elapsed - c.K)
+	c.WC = c.cubicCwnd(elapsedSeconds - c.K)
 
 	// Compute the TCP friendly estimate of the congestion window.
-	c.WEst = c.WMax*c.Beta + (3.0*((1.0-c.Beta)/(1.0+c.Beta)))*(elapsed/srtt.Seconds())
+	c.WEst = c.WMax*c.Beta + (3.0*((1.0-c.Beta)/(1.0+c.Beta)))*(elapsedSeconds/srtt.Seconds())
 
 	// Make sure in the TCP friendly region CUBIC performs at least
 	// as well as Reno.
@@ -134,7 +135,7 @@ func (c *cubicState) getCwnd(packetsAcked, sndCwnd int, srtt time.Duration) int
 	// In Concave/Convex region of CUBIC, calculate what CUBIC window
 	// will be after 1 RTT and use that to grow congestion window
 	// for every ack.
-	tEst := (time.Since(c.T) + srtt).Seconds()
+	tEst := (elapsed + srtt).Seconds()
 	wtRtt := c.cubicCwnd(tEst - c.K)
 	// As per 4.3 for each received ACK cwnd must be incremented
 	// by (w_cubic(t+RTT) - cwnd/cwnd.
@@ -151,7 +152,7 @@ func (c *cubicState) getCwnd(packetsAcked, sndCwnd int, srtt time.Duration) int
 func (c *cubicState) HandleLossDetected() {
 	// See: https://tools.ietf.org/html/rfc8312#section-4.5
 	c.numCongestionEvents++
-	c.T = time.Now()
+	c.T = c.s.ep.stack.Clock().NowMonotonic()
 	c.WLastMax = c.WMax
 	c.WMax = float64(c.s.SndCwnd)
 
@@ -162,7 +163,7 @@ func (c *cubicState) HandleLossDetected() {
 // HandleRTOExpired implements congestionContrl.HandleRTOExpired.
 func (c *cubicState) HandleRTOExpired() {
 	// See: https://tools.ietf.org/html/rfc8312#section-4.6
-	c.T = time.Now()
+	c.T = c.s.ep.stack.Clock().NowMonotonic()
 	c.numCongestionEvents = 0
 	c.WLastMax = c.WMax
 	c.WMax = float64(c.s.SndCwnd)
@@ -193,7 +194,7 @@ func (c *cubicState) fastConvergence() {
 
 // PostRecovery implemements congestionControl.PostRecovery.
 func (c *cubicState) PostRecovery() {
-	c.T = time.Now()
+	c.T = c.s.ep.stack.Clock().NowMonotonic()
 }
 
 // reduceSlowStartThreshold returns new SsThresh as described in
diff --git a/pkg/tcpip/transport/tcp/dispatcher.go b/pkg/tcpip/transport/tcp/dispatcher.go
index 0ca986512..5963a169c 100644
--- a/pkg/tcpip/transport/tcp/dispatcher.go
+++ b/pkg/tcpip/transport/tcp/dispatcher.go
@@ -20,6 +20,7 @@ import (
 	"gvisor.dev/gvisor/pkg/rand"
 	"gvisor.dev/gvisor/pkg/sleep"
 	"gvisor.dev/gvisor/pkg/sync"
+	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/hash/jenkins"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
 	"gvisor.dev/gvisor/pkg/tcpip/stack"
@@ -172,10 +173,10 @@ func (d *dispatcher) wait() {
 	d.wg.Wait()
 }
 
-func (d *dispatcher) queuePacket(stackEP stack.TransportEndpoint, id stack.TransportEndpointID, pkt *stack.PacketBuffer) {
+func (d *dispatcher) queuePacket(stackEP stack.TransportEndpoint, id stack.TransportEndpointID, clock tcpip.Clock, pkt *stack.PacketBuffer) {
 	ep := stackEP.(*endpoint)
 
-	s := newIncomingSegment(id, pkt)
+	s := newIncomingSegment(id, clock, pkt)
 	if !s.parse(pkt.RXTransportChecksumValidated) {
 		ep.stack.Stats().TCP.InvalidSegmentsReceived.Increment()
 		ep.stats.ReceiveErrors.MalformedPacketsReceived.Increment()
diff --git a/pkg/tcpip/transport/tcp/endpoint.go b/pkg/tcpip/transport/tcp/endpoint.go
index fb7670adb..d44f480ab 100644
--- a/pkg/tcpip/transport/tcp/endpoint.go
+++ b/pkg/tcpip/transport/tcp/endpoint.go
@@ -480,7 +480,7 @@ type endpoint struct {
 
 	// recentTSTime is the unix time when we last updated
 	// TCPEndpointStateInner.RecentTS.
-	recentTSTime time.Time `state:".(unixTime)"`
+	recentTSTime tcpip.MonotonicTime
 
 	// shutdownFlags represent the current shutdown state of the endpoint.
 	shutdownFlags tcpip.ShutdownFlags
@@ -638,7 +638,7 @@ type endpoint struct {
 
 	// lastOutOfWindowAckTime is the time at which the an ACK was sent in response
 	// to an out of window segment being received by this endpoint.
-	lastOutOfWindowAckTime time.Time `state:".(unixTime)"`
+	lastOutOfWindowAckTime tcpip.MonotonicTime
 }
 
 // UniqueID implements stack.TransportEndpoint.UniqueID.
@@ -787,7 +787,7 @@ func (e *endpoint) EndpointState() EndpointState {
 // setRecentTimestamp sets the recentTS field to the provided value.
 func (e *endpoint) setRecentTimestamp(recentTS uint32) {
 	e.RecentTS = recentTS
-	e.recentTSTime = time.Now()
+	e.recentTSTime = e.stack.Clock().NowMonotonic()
 }
 
 // recentTimestamp returns the value of the recentTS field.
@@ -884,7 +884,7 @@ func newEndpoint(s *stack.Stack, netProto tcpip.NetworkProtocolNumber, waiterQue
 	e.segmentQueue.ep = e
 	e.TSOffset = timeStampOffset()
 	e.acceptCond = sync.NewCond(&e.acceptMu)
-	e.keepalive.timer.init(&e.keepalive.waker)
+	e.keepalive.timer.init(e.stack.Clock(), &e.keepalive.waker)
 
 	return e
 }
@@ -1201,7 +1201,7 @@ func (e *endpoint) ModerateRecvBuf(copied int) {
 		e.rcvQueueInfo.rcvQueueMu.Unlock()
 		return
 	}
-	now := time.Now()
+	now := e.stack.Clock().NowMonotonic()
 	if rtt := e.rcvQueueInfo.RcvAutoParams.RTT; rtt == 0 || now.Sub(e.rcvQueueInfo.RcvAutoParams.MeasureTime) < rtt {
 		e.rcvQueueInfo.RcvAutoParams.CopiedBytes += copied
 		e.rcvQueueInfo.rcvQueueMu.Unlock()
@@ -1556,7 +1556,7 @@ func (e *endpoint) Write(p tcpip.Payloader, opts tcpip.WriteOptions) (int64, tcp
 		}
 
 		// Add data to the send queue.
-		s := newOutgoingSegment(e.TransportEndpointInfo.ID, v)
+		s := newOutgoingSegment(e.TransportEndpointInfo.ID, e.stack.Clock(), v)
 		e.sndQueueInfo.SndBufUsed += len(v)
 		e.sndQueueInfo.SndBufInQueue += seqnum.Size(len(v))
 		e.sndQueueInfo.sndQueue.PushBack(s)
@@ -2241,7 +2241,7 @@ func (e *endpoint) connect(addr tcpip.FullAddress, handshake bool, run bool) tcp
 				// If the endpoint is not in TIME-WAIT or if it is in TIME-WAIT but
 				// less than 1 second has elapsed since its recentTS was updated then
 				// we cannot reuse the port.
-				if tcpEP.EndpointState() != StateTimeWait || time.Since(tcpEP.recentTSTime) < 1*time.Second {
+				if tcpEP.EndpointState() != StateTimeWait || e.stack.Clock().NowMonotonic().Sub(tcpEP.recentTSTime) < 1*time.Second {
 					tcpEP.UnlockUser()
 					return false, nil
 				}
@@ -2387,7 +2387,7 @@ func (e *endpoint) shutdownLocked(flags tcpip.ShutdownFlags) tcpip.Error {
 			}
 
 			// Queue fin segment.
-			s := newOutgoingSegment(e.TransportEndpointInfo.ID, nil)
+			s := newOutgoingSegment(e.TransportEndpointInfo.ID, e.stack.Clock(), nil)
 			e.sndQueueInfo.sndQueue.PushBack(s)
 			e.sndQueueInfo.SndBufInQueue++
 			// Mark endpoint as closed.
@@ -2865,14 +2865,15 @@ func (e *endpoint) maybeEnableTimestamp(synOpts *header.TCPSynOptions) {
 // timestamp returns the timestamp value to be used in the TSVal field of the
 // timestamp option for outgoing TCP segments for a given endpoint.
 func (e *endpoint) timestamp() uint32 {
-	return tcpTimeStamp(time.Now(), e.TSOffset)
+	return tcpTimeStamp(e.stack.Clock().NowMonotonic(), e.TSOffset)
 }
 
 // tcpTimeStamp returns a timestamp offset by the provided offset. This is
 // not inlined above as it's used when SYN cookies are in use and endpoint
 // is not created at the time when the SYN cookie is sent.
-func tcpTimeStamp(curTime time.Time, offset uint32) uint32 {
-	return uint32(curTime.Unix()*1000+int64(curTime.Nanosecond()/1e6)) + offset
+func tcpTimeStamp(curTime tcpip.MonotonicTime, offset uint32) uint32 {
+	d := curTime.Sub(tcpip.MonotonicTime{})
+	return uint32(d.Milliseconds()) + offset
 }
 
 // timeStampOffset returns a randomized timestamp offset to be used when sending
@@ -2926,7 +2927,7 @@ func (e *endpoint) completeStateLocked() stack.TCPEndpointState {
 	s := stack.TCPEndpointState{
 		TCPEndpointStateInner: e.TCPEndpointStateInner,
 		ID:                    stack.TCPEndpointID(e.TransportEndpointInfo.ID),
-		SegTime:               time.Now(),
+		SegTime:               e.stack.Clock().NowMonotonic(),
 		Receiver:              e.rcv.TCPReceiverState,
 		Sender:                e.snd.TCPSenderState,
 	}
@@ -2954,7 +2955,7 @@ func (e *endpoint) completeStateLocked() stack.TCPEndpointState {
 
 	if cubic, ok := e.snd.cc.(*cubicState); ok {
 		s.Sender.Cubic = cubic.TCPCubicState
-		s.Sender.Cubic.TimeSinceLastCongestion = time.Since(s.Sender.Cubic.T)
+		s.Sender.Cubic.TimeSinceLastCongestion = e.stack.Clock().NowMonotonic().Sub(s.Sender.Cubic.T)
 	}
 
 	s.Sender.RACKState = e.snd.rc.TCPRACKState
@@ -3046,14 +3047,16 @@ func GetTCPSendBufferLimits(s tcpip.StackHandler) tcpip.SendBufferSizeOption {
 
 // allowOutOfWindowAck returns true if an out-of-window ACK can be sent now.
 func (e *endpoint) allowOutOfWindowAck() bool {
-	var limit stack.TCPInvalidRateLimitOption
-	if err := e.stack.Option(&limit); err != nil {
-		panic(fmt.Sprintf("e.stack.Option(%+v) failed with error: %s", limit, err))
-	}
+	now := e.stack.Clock().NowMonotonic()
 
-	now := time.Now()
-	if now.Sub(e.lastOutOfWindowAckTime) < time.Duration(limit) {
-		return false
+	if e.lastOutOfWindowAckTime != (tcpip.MonotonicTime{}) {
+		var limit stack.TCPInvalidRateLimitOption
+		if err := e.stack.Option(&limit); err != nil {
+			panic(fmt.Sprintf("e.stack.Option(%+v) failed with error: %s", limit, err))
+		}
+		if now.Sub(e.lastOutOfWindowAckTime) < time.Duration(limit) {
+			return false
+		}
 	}
 
 	e.lastOutOfWindowAckTime = now
diff --git a/pkg/tcpip/transport/tcp/endpoint_state.go b/pkg/tcpip/transport/tcp/endpoint_state.go
index a56d34dc5..952ccacdd 100644
--- a/pkg/tcpip/transport/tcp/endpoint_state.go
+++ b/pkg/tcpip/transport/tcp/endpoint_state.go
@@ -158,12 +158,17 @@ func (e *endpoint) afterLoad() {
 	// Condition variables and mutexs are not S/R'ed so reinitialize
 	// acceptCond with e.acceptMu.
 	e.acceptCond = sync.NewCond(&e.acceptMu)
-	e.keepalive.timer.init(&e.keepalive.waker)
 	stack.StackFromEnv.RegisterRestoredEndpoint(e)
 }
 
 // Resume implements tcpip.ResumableEndpoint.Resume.
 func (e *endpoint) Resume(s *stack.Stack) {
+	e.keepalive.timer.init(s.Clock(), &e.keepalive.waker)
+	if snd := e.snd; snd != nil {
+		snd.resendTimer.init(s.Clock(), &snd.resendWaker)
+		snd.reorderTimer.init(s.Clock(), &snd.reorderWaker)
+		snd.probeTimer.init(s.Clock(), &snd.probeWaker)
+	}
 	e.stack = s
 	e.ops.InitHandler(e, e.stack, GetTCPSendBufferLimits, GetTCPReceiveBufferLimits)
 	e.segmentQueue.thaw()
@@ -290,23 +295,3 @@ func (e *endpoint) Resume(s *stack.Stack) {
 		tcpip.DeleteDanglingEndpoint(e)
 	}
 }
-
-// saveRecentTSTime is invoked by stateify.
-func (e *endpoint) saveRecentTSTime() unixTime {
-	return unixTime{e.recentTSTime.Unix(), e.recentTSTime.UnixNano()}
-}
-
-// loadRecentTSTime is invoked by stateify.
-func (e *endpoint) loadRecentTSTime(unix unixTime) {
-	e.recentTSTime = time.Unix(unix.second, unix.nano)
-}
-
-// saveLastOutOfWindowAckTime is invoked by stateify.
-func (e *endpoint) saveLastOutOfWindowAckTime() unixTime {
-	return unixTime{e.lastOutOfWindowAckTime.Unix(), e.lastOutOfWindowAckTime.UnixNano()}
-}
-
-// loadLastOutOfWindowAckTime is invoked by stateify.
-func (e *endpoint) loadLastOutOfWindowAckTime(unix unixTime) {
-	e.lastOutOfWindowAckTime = time.Unix(unix.second, unix.nano)
-}
diff --git a/pkg/tcpip/transport/tcp/forwarder.go b/pkg/tcpip/transport/tcp/forwarder.go
index 2f9fe7ee0..65c86823a 100644
--- a/pkg/tcpip/transport/tcp/forwarder.go
+++ b/pkg/tcpip/transport/tcp/forwarder.go
@@ -65,7 +65,7 @@ func NewForwarder(s *stack.Stack, rcvWnd, maxInFlight int, handler func(*Forward
 // This function is expected to be passed as an argument to the
 // stack.SetTransportProtocolHandler function.
 func (f *Forwarder) HandlePacket(id stack.TransportEndpointID, pkt *stack.PacketBuffer) bool {
-	s := newIncomingSegment(id, pkt)
+	s := newIncomingSegment(id, f.stack.Clock(), pkt)
 	defer s.decRef()
 
 	// We only care about well-formed SYN packets.
diff --git a/pkg/tcpip/transport/tcp/protocol.go b/pkg/tcpip/transport/tcp/protocol.go
index d43e21426..c970dcecc 100644
--- a/pkg/tcpip/transport/tcp/protocol.go
+++ b/pkg/tcpip/transport/tcp/protocol.go
@@ -131,7 +131,7 @@ func (*protocol) ParsePorts(v buffer.View) (src, dst uint16, err tcpip.Error) {
 // goroutine which is responsible for dequeuing and doing full TCP dispatch of
 // the packet.
 func (p *protocol) QueuePacket(ep stack.TransportEndpoint, id stack.TransportEndpointID, pkt *stack.PacketBuffer) {
-	p.dispatcher.queuePacket(ep, id, pkt)
+	p.dispatcher.queuePacket(ep, id, p.stack.Clock(), pkt)
 }
 
 // HandleUnknownDestinationPacket handles packets targeted at this protocol but
@@ -142,7 +142,7 @@ func (p *protocol) QueuePacket(ep stack.TransportEndpoint, id stack.TransportEnd
 // particular, SYNs addressed to a non-existent connection are rejected by this
 // means."
 func (p *protocol) HandleUnknownDestinationPacket(id stack.TransportEndpointID, pkt *stack.PacketBuffer) stack.UnknownDestinationPacketDisposition {
-	s := newIncomingSegment(id, pkt)
+	s := newIncomingSegment(id, p.stack.Clock(), pkt)
 	defer s.decRef()
 
 	if !s.parse(pkt.RXTransportChecksumValidated) || !s.csumValid {
diff --git a/pkg/tcpip/transport/tcp/rack.go b/pkg/tcpip/transport/tcp/rack.go
index 813a6dffd..0da4eafaa 100644
--- a/pkg/tcpip/transport/tcp/rack.go
+++ b/pkg/tcpip/transport/tcp/rack.go
@@ -79,7 +79,7 @@ func (rc *rackControl) init(snd *sender, iss seqnum.Value) {
 // update will update the RACK related fields when an ACK has been received.
 // See: https://tools.ietf.org/html/draft-ietf-tcpm-rack-09#section-6.2
 func (rc *rackControl) update(seg *segment, ackSeg *segment) {
-	rtt := time.Now().Sub(seg.xmitTime)
+	rtt := rc.snd.ep.stack.Clock().NowMonotonic().Sub(seg.xmitTime)
 	tsOffset := rc.snd.ep.TSOffset
 
 	// If the ACK is for a retransmitted packet, do not update if it is a
@@ -115,7 +115,7 @@ func (rc *rackControl) update(seg *segment, ackSeg *segment) {
 	// ending sequence number of the packet which has been acknowledged
 	// most recently.
 	endSeq := seg.sequenceNumber.Add(seqnum.Size(seg.data.Size()))
-	if rc.XmitTime.Before(seg.xmitTime) || (seg.xmitTime.Equal(rc.XmitTime) && rc.EndSequence.LessThan(endSeq)) {
+	if rc.XmitTime.Before(seg.xmitTime) || (seg.xmitTime == rc.XmitTime && rc.EndSequence.LessThan(endSeq)) {
 		rc.XmitTime = seg.xmitTime
 		rc.EndSequence = endSeq
 	}
@@ -174,7 +174,7 @@ func (s *sender) schedulePTO() {
 	}
 	s.rtt.Unlock()
 
-	now := time.Now()
+	now := s.ep.stack.Clock().NowMonotonic()
 	if s.resendTimer.enabled() {
 		if now.Add(pto).After(s.resendTimer.target) {
 			pto = s.resendTimer.target.Sub(now)
@@ -352,7 +352,7 @@ func (rc *rackControl) exitRecovery() {
 // detectLoss marks the segment as lost if the reordering window has elapsed
 // and the ACK is not received. It will also arm the reorder timer.
 // See: https://tools.ietf.org/html/draft-ietf-tcpm-rack-08#section-7.2 Step 5.
-func (rc *rackControl) detectLoss(rcvTime time.Time) int {
+func (rc *rackControl) detectLoss(rcvTime tcpip.MonotonicTime) int {
 	var timeout time.Duration
 	numLost := 0
 	for seg := rc.snd.writeList.Front(); seg != nil && seg.xmitCount != 0; seg = seg.Next() {
@@ -366,7 +366,7 @@ func (rc *rackControl) detectLoss(rcvTime time.Time) int {
 		}
 
 		endSeq := seg.sequenceNumber.Add(seqnum.Size(seg.data.Size()))
-		if seg.xmitTime.Before(rc.XmitTime) || (seg.xmitTime.Equal(rc.XmitTime) && rc.EndSequence.LessThan(endSeq)) {
+		if seg.xmitTime.Before(rc.XmitTime) || (seg.xmitTime == rc.XmitTime && rc.EndSequence.LessThan(endSeq)) {
 			timeRemaining := seg.xmitTime.Sub(rcvTime) + rc.RTT + rc.ReoWnd
 			if timeRemaining <= 0 {
 				seg.lost = true
@@ -392,7 +392,7 @@ func (rc *rackControl) reorderTimerExpired() tcpip.Error {
 		return nil
 	}
 
-	numLost := rc.detectLoss(time.Now())
+	numLost := rc.detectLoss(rc.snd.ep.stack.Clock().NowMonotonic())
 	if numLost == 0 {
 		return nil
 	}
diff --git a/pkg/tcpip/transport/tcp/rcv.go b/pkg/tcpip/transport/tcp/rcv.go
index 4fd8a0624..b46f8320e 100644
--- a/pkg/tcpip/transport/tcp/rcv.go
+++ b/pkg/tcpip/transport/tcp/rcv.go
@@ -17,7 +17,6 @@ package tcp
 import (
 	"container/heap"
 	"math"
-	"time"
 
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/header"
@@ -50,7 +49,7 @@ type receiver struct {
 	pendingRcvdSegments segmentHeap
 
 	// Time when the last ack was received.
-	lastRcvdAckTime time.Time `state:".(unixTime)"`
+	lastRcvdAckTime tcpip.MonotonicTime
 }
 
 func newReceiver(ep *endpoint, irs seqnum.Value, rcvWnd seqnum.Size, rcvWndScale uint8) *receiver {
@@ -63,7 +62,7 @@ func newReceiver(ep *endpoint, irs seqnum.Value, rcvWnd seqnum.Size, rcvWndScale
 		},
 		rcvWnd:          rcvWnd,
 		rcvWUP:          irs + 1,
-		lastRcvdAckTime: time.Now(),
+		lastRcvdAckTime: ep.stack.Clock().NowMonotonic(),
 	}
 }
 
@@ -325,9 +324,9 @@ func (r *receiver) updateRTT() {
 	// is first acknowledged and the receipt of data that is at least one
 	// window beyond the sequence number that was acknowledged.
 	r.ep.rcvQueueInfo.rcvQueueMu.Lock()
-	if r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureTime.IsZero() {
+	if r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureTime == (tcpip.MonotonicTime{}) {
 		// New measurement.
-		r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureTime = time.Now()
+		r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureTime = r.ep.stack.Clock().NowMonotonic()
 		r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureSeqNumber = r.RcvNxt.Add(r.rcvWnd)
 		r.ep.rcvQueueInfo.rcvQueueMu.Unlock()
 		return
@@ -336,14 +335,14 @@ func (r *receiver) updateRTT() {
 		r.ep.rcvQueueInfo.rcvQueueMu.Unlock()
 		return
 	}
-	rtt := time.Since(r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureTime)
+	rtt := r.ep.stack.Clock().NowMonotonic().Sub(r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureTime)
 	// We only store the minimum observed RTT here as this is only used in
 	// absence of a SRTT available from either timestamps or a sender
 	// measurement of RTT.
 	if r.ep.rcvQueueInfo.RcvAutoParams.RTT == 0 || rtt < r.ep.rcvQueueInfo.RcvAutoParams.RTT {
 		r.ep.rcvQueueInfo.RcvAutoParams.RTT = rtt
 	}
-	r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureTime = time.Now()
+	r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureTime = r.ep.stack.Clock().NowMonotonic()
 	r.ep.rcvQueueInfo.RcvAutoParams.RTTMeasureSeqNumber = r.RcvNxt.Add(r.rcvWnd)
 	r.ep.rcvQueueInfo.rcvQueueMu.Unlock()
 }
@@ -467,7 +466,7 @@ func (r *receiver) handleRcvdSegment(s *segment) (drop bool, err tcpip.Error) {
 	}
 
 	// Store the time of the last ack.
-	r.lastRcvdAckTime = time.Now()
+	r.lastRcvdAckTime = r.ep.stack.Clock().NowMonotonic()
 
 	// Defer segment processing if it can't be consumed now.
 	if !r.consumeSegment(s, segSeq, segLen) {
diff --git a/pkg/tcpip/transport/tcp/rcv_state.go b/pkg/tcpip/transport/tcp/rcv_state.go
deleted file mode 100644
index 2bf21a2e7..000000000
--- a/pkg/tcpip/transport/tcp/rcv_state.go
+++ /dev/null
@@ -1,29 +0,0 @@
-// Copyright 2019 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package tcp
-
-import (
-	"time"
-)
-
-// saveLastRcvdAckTime is invoked by stateify.
-func (r *receiver) saveLastRcvdAckTime() unixTime {
-	return unixTime{r.lastRcvdAckTime.Unix(), r.lastRcvdAckTime.UnixNano()}
-}
-
-// loadLastRcvdAckTime is invoked by stateify.
-func (r *receiver) loadLastRcvdAckTime(unix unixTime) {
-	r.lastRcvdAckTime = time.Unix(unix.second, unix.nano)
-}
diff --git a/pkg/tcpip/transport/tcp/segment.go b/pkg/tcpip/transport/tcp/segment.go
index 61754de29..e5c0d52fa 100644
--- a/pkg/tcpip/transport/tcp/segment.go
+++ b/pkg/tcpip/transport/tcp/segment.go
@@ -17,7 +17,6 @@ package tcp
 import (
 	"fmt"
 	"sync/atomic"
-	"time"
 
 	"gvisor.dev/gvisor/pkg/tcpip"
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
@@ -73,9 +72,9 @@ type segment struct {
 	parsedOptions  header.TCPOptions
 	options        []byte `state:".([]byte)"`
 	hasNewSACKInfo bool
-	rcvdTime       time.Time `state:".(unixTime)"`
+	rcvdTime       tcpip.MonotonicTime
 	// xmitTime is the last transmit time of this segment.
-	xmitTime  time.Time `state:".(unixTime)"`
+	xmitTime  tcpip.MonotonicTime
 	xmitCount uint32
 
 	// acked indicates if the segment has already been SACKed.
@@ -88,7 +87,7 @@ type segment struct {
 	lost bool
 }
 
-func newIncomingSegment(id stack.TransportEndpointID, pkt *stack.PacketBuffer) *segment {
+func newIncomingSegment(id stack.TransportEndpointID, clock tcpip.Clock, pkt *stack.PacketBuffer) *segment {
 	netHdr := pkt.Network()
 	s := &segment{
 		refCnt:   1,
@@ -100,17 +99,17 @@ func newIncomingSegment(id stack.TransportEndpointID, pkt *stack.PacketBuffer) *
 	}
 	s.data = pkt.Data().ExtractVV().Clone(s.views[:])
 	s.hdr = header.TCP(pkt.TransportHeader().View())
-	s.rcvdTime = time.Now()
+	s.rcvdTime = clock.NowMonotonic()
 	s.dataMemSize = s.data.Size()
 	return s
 }
 
-func newOutgoingSegment(id stack.TransportEndpointID, v buffer.View) *segment {
+func newOutgoingSegment(id stack.TransportEndpointID, clock tcpip.Clock, v buffer.View) *segment {
 	s := &segment{
 		refCnt: 1,
 		id:     id,
 	}
-	s.rcvdTime = time.Now()
+	s.rcvdTime = clock.NowMonotonic()
 	if len(v) != 0 {
 		s.views[0] = v
 		s.data = buffer.NewVectorisedView(len(v), s.views[:1])
diff --git a/pkg/tcpip/transport/tcp/segment_state.go b/pkg/tcpip/transport/tcp/segment_state.go
index 7422d8c02..dcfa80f95 100644
--- a/pkg/tcpip/transport/tcp/segment_state.go
+++ b/pkg/tcpip/transport/tcp/segment_state.go
@@ -15,8 +15,6 @@
 package tcp
 
 import (
-	"time"
-
 	"gvisor.dev/gvisor/pkg/tcpip/buffer"
 )
 
@@ -55,23 +53,3 @@ func (s *segment) loadOptions(options []byte) {
 	// allocated so there is no cost here.
 	s.options = options
 }
-
-// saveRcvdTime is invoked by stateify.
-func (s *segment) saveRcvdTime() unixTime {
-	return unixTime{s.rcvdTime.Unix(), s.rcvdTime.UnixNano()}
-}
-
-// loadRcvdTime is invoked by stateify.
-func (s *segment) loadRcvdTime(unix unixTime) {
-	s.rcvdTime = time.Unix(unix.second, unix.nano)
-}
-
-// saveXmitTime is invoked by stateify.
-func (s *segment) saveXmitTime() unixTime {
-	return unixTime{s.rcvdTime.Unix(), s.rcvdTime.UnixNano()}
-}
-
-// loadXmitTime is invoked by stateify.
-func (s *segment) loadXmitTime(unix unixTime) {
-	s.rcvdTime = time.Unix(unix.second, unix.nano)
-}
diff --git a/pkg/tcpip/transport/tcp/snd.go b/pkg/tcpip/transport/tcp/snd.go
index 6b7293755..ccff9ca8d 100644
--- a/pkg/tcpip/transport/tcp/snd.go
+++ b/pkg/tcpip/transport/tcp/snd.go
@@ -94,7 +94,7 @@ type sender struct {
 
 	// firstRetransmittedSegXmitTime is the original transmit time of
 	// the first segment that was retransmitted due to RTO expiration.
-	firstRetransmittedSegXmitTime time.Time `state:".(unixTime)"`
+	firstRetransmittedSegXmitTime tcpip.MonotonicTime
 
 	// zeroWindowProbing is set if the sender is currently probing
 	// for zero receive window.
@@ -169,7 +169,7 @@ func newSender(ep *endpoint, iss, irs seqnum.Value, sndWnd seqnum.Size, mss uint
 			SndUna:           iss + 1,
 			SndNxt:           iss + 1,
 			RTTMeasureSeqNum: iss + 1,
-			LastSendTime:     time.Now(),
+			LastSendTime:     ep.stack.Clock().NowMonotonic(),
 			MaxPayloadSize:   maxPayloadSize,
 			MaxSentAck:       irs + 1,
 			FastRecovery: stack.TCPFastRecoveryState{
@@ -197,9 +197,9 @@ func newSender(ep *endpoint, iss, irs seqnum.Value, sndWnd seqnum.Size, mss uint
 		s.SndWndScale = uint8(sndWndScale)
 	}
 
-	s.resendTimer.init(&s.resendWaker)
-	s.reorderTimer.init(&s.reorderWaker)
-	s.probeTimer.init(&s.probeWaker)
+	s.resendTimer.init(s.ep.stack.Clock(), &s.resendWaker)
+	s.reorderTimer.init(s.ep.stack.Clock(), &s.reorderWaker)
+	s.probeTimer.init(s.ep.stack.Clock(), &s.probeWaker)
 
 	s.updateMaxPayloadSize(int(ep.route.MTU()), 0)
 
@@ -441,7 +441,7 @@ func (s *sender) retransmitTimerExpired() bool {
 	// timeout since the first retransmission.
 	uto := s.ep.userTimeout
 
-	if s.firstRetransmittedSegXmitTime.IsZero() {
+	if s.firstRetransmittedSegXmitTime == (tcpip.MonotonicTime{}) {
 		// We store the original xmitTime of the segment that we are
 		// about to retransmit as the retransmission time. This is
 		// required as by the time the retransmitTimer has expired the
@@ -450,7 +450,7 @@ func (s *sender) retransmitTimerExpired() bool {
 		s.firstRetransmittedSegXmitTime = s.writeList.Front().xmitTime
 	}
 
-	elapsed := time.Since(s.firstRetransmittedSegXmitTime)
+	elapsed := s.ep.stack.Clock().NowMonotonic().Sub(s.firstRetransmittedSegXmitTime)
 	remaining := s.maxRTO
 	if uto != 0 {
 		// Cap to the user specified timeout if one is specified.
@@ -866,8 +866,8 @@ func (s *sender) enableZeroWindowProbing() {
 	// We piggyback the probing on the retransmit timer with the
 	// current retranmission interval, as we may start probing while
 	// segment retransmissions.
-	if s.firstRetransmittedSegXmitTime.IsZero() {
-		s.firstRetransmittedSegXmitTime = time.Now()
+	if s.firstRetransmittedSegXmitTime == (tcpip.MonotonicTime{}) {
+		s.firstRetransmittedSegXmitTime = s.ep.stack.Clock().NowMonotonic()
 	}
 	s.resendTimer.enable(s.RTO)
 }
@@ -875,7 +875,7 @@ func (s *sender) enableZeroWindowProbing() {
 func (s *sender) disableZeroWindowProbing() {
 	s.zeroWindowProbing = false
 	s.unackZeroWindowProbes = 0
-	s.firstRetransmittedSegXmitTime = time.Time{}
+	s.firstRetransmittedSegXmitTime = tcpip.MonotonicTime{}
 	s.resendTimer.disable()
 }
 
@@ -925,7 +925,7 @@ func (s *sender) sendData() {
 	// "A TCP SHOULD set cwnd to no more than RW before beginning
 	// transmission if the TCP has not sent data in the interval exceeding
 	// the retrasmission timeout."
-	if !s.FastRecovery.Active && s.state != tcpip.RTORecovery && time.Now().Sub(s.LastSendTime) > s.RTO {
+	if !s.FastRecovery.Active && s.state != tcpip.RTORecovery && s.ep.stack.Clock().NowMonotonic().Sub(s.LastSendTime) > s.RTO {
 		if s.SndCwnd > InitialCwnd {
 			s.SndCwnd = InitialCwnd
 		}
@@ -1234,7 +1234,7 @@ func checkDSACK(rcvdSeg *segment) bool {
 func (s *sender) handleRcvdSegment(rcvdSeg *segment) {
 	// Check if we can extract an RTT measurement from this ack.
 	if !rcvdSeg.parsedOptions.TS && s.RTTMeasureSeqNum.LessThan(rcvdSeg.ackNumber) {
-		s.updateRTO(time.Now().Sub(s.RTTMeasureTime))
+		s.updateRTO(s.ep.stack.Clock().NowMonotonic().Sub(s.RTTMeasureTime))
 		s.RTTMeasureSeqNum = s.SndNxt
 	}
 
@@ -1444,7 +1444,7 @@ func (s *sender) handleRcvdSegment(rcvdSeg *segment) {
 		if s.SndUna == s.SndNxt {
 			s.Outstanding = 0
 			// Reset firstRetransmittedSegXmitTime to the zero value.
-			s.firstRetransmittedSegXmitTime = time.Time{}
+			s.firstRetransmittedSegXmitTime = tcpip.MonotonicTime{}
 			s.resendTimer.disable()
 			s.probeTimer.disable()
 		}
@@ -1502,7 +1502,7 @@ func (s *sender) sendSegment(seg *segment) tcpip.Error {
 			s.ep.stack.Stats().TCP.SlowStartRetransmits.Increment()
 		}
 	}
-	seg.xmitTime = time.Now()
+	seg.xmitTime = s.ep.stack.Clock().NowMonotonic()
 	seg.xmitCount++
 	seg.lost = false
 	err := s.sendSegmentFromView(seg.data, seg.flags, seg.sequenceNumber)
@@ -1527,7 +1527,7 @@ func (s *sender) sendSegment(seg *segment) tcpip.Error {
 // sendSegmentFromView sends a new segment containing the given payload, flags
 // and sequence number.
 func (s *sender) sendSegmentFromView(data buffer.VectorisedView, flags header.TCPFlags, seq seqnum.Value) tcpip.Error {
-	s.LastSendTime = time.Now()
+	s.LastSendTime = s.ep.stack.Clock().NowMonotonic()
 	if seq == s.RTTMeasureSeqNum {
 		s.RTTMeasureTime = s.LastSendTime
 	}
diff --git a/pkg/tcpip/transport/tcp/snd_state.go b/pkg/tcpip/transport/tcp/snd_state.go
deleted file mode 100644
index 2f805d8ce..000000000
--- a/pkg/tcpip/transport/tcp/snd_state.go
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2018 The gVisor Authors.
-//
-// Licensed under the Apache License, Version 2.0 (the "License");
-// you may not use this file except in compliance with the License.
-// You may obtain a copy of the License at
-//
-//     http://www.apache.org/licenses/LICENSE-2.0
-//
-// Unless required by applicable law or agreed to in writing, software
-// distributed under the License is distributed on an "AS IS" BASIS,
-// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-// See the License for the specific language governing permissions and
-// limitations under the License.
-
-package tcp
-
-import (
-	"time"
-)
-
-// +stateify savable
-type unixTime struct {
-	second int64
-	nano   int64
-}
-
-// afterLoad is invoked by stateify.
-func (s *sender) afterLoad() {
-	s.resendTimer.init(&s.resendWaker)
-	s.reorderTimer.init(&s.reorderWaker)
-	s.probeTimer.init(&s.probeWaker)
-}
-
-// saveFirstRetransmittedSegXmitTime is invoked by stateify.
-func (s *sender) saveFirstRetransmittedSegXmitTime() unixTime {
-	return unixTime{s.firstRetransmittedSegXmitTime.Unix(), s.firstRetransmittedSegXmitTime.UnixNano()}
-}
-
-// loadFirstRetransmittedSegXmitTime is invoked by stateify.
-func (s *sender) loadFirstRetransmittedSegXmitTime(unix unixTime) {
-	s.firstRetransmittedSegXmitTime = time.Unix(unix.second, unix.nano)
-}
diff --git a/pkg/tcpip/transport/tcp/tcp_state_autogen.go b/pkg/tcpip/transport/tcp/tcp_state_autogen.go
index 139b1c796..18efbcc3a 100644
--- a/pkg/tcpip/transport/tcp/tcp_state_autogen.go
+++ b/pkg/tcpip/transport/tcp/tcp_state_autogen.go
@@ -215,10 +215,6 @@ func (e *endpoint) StateSave(stateSinkObject state.Sink) {
 	e.beforeSave()
 	var stateValue EndpointState = e.saveState()
 	stateSinkObject.SaveValue(10, stateValue)
-	var recentTSTimeValue unixTime = e.saveRecentTSTime()
-	stateSinkObject.SaveValue(21, recentTSTimeValue)
-	var lastOutOfWindowAckTimeValue unixTime = e.saveLastOutOfWindowAckTime()
-	stateSinkObject.SaveValue(49, lastOutOfWindowAckTimeValue)
 	stateSinkObject.Save(0, &e.TCPEndpointStateInner)
 	stateSinkObject.Save(1, &e.TransportEndpointInfo)
 	stateSinkObject.Save(2, &e.DefaultSocketOptionsHandler)
@@ -239,6 +235,7 @@ func (e *endpoint) StateSave(stateSinkObject state.Sink) {
 	stateSinkObject.Save(18, &e.effectiveNetProtos)
 	stateSinkObject.Save(19, &e.workerRunning)
 	stateSinkObject.Save(20, &e.workerCleanup)
+	stateSinkObject.Save(21, &e.recentTSTime)
 	stateSinkObject.Save(22, &e.shutdownFlags)
 	stateSinkObject.Save(23, &e.tcpRecovery)
 	stateSinkObject.Save(24, &e.sack)
@@ -266,6 +263,7 @@ func (e *endpoint) StateSave(stateSinkObject state.Sink) {
 	stateSinkObject.Save(46, &e.txHash)
 	stateSinkObject.Save(47, &e.owner)
 	stateSinkObject.Save(48, &e.ops)
+	stateSinkObject.Save(49, &e.lastOutOfWindowAckTime)
 }
 
 // +checklocksignore
@@ -290,6 +288,7 @@ func (e *endpoint) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(18, &e.effectiveNetProtos)
 	stateSourceObject.Load(19, &e.workerRunning)
 	stateSourceObject.Load(20, &e.workerCleanup)
+	stateSourceObject.Load(21, &e.recentTSTime)
 	stateSourceObject.Load(22, &e.shutdownFlags)
 	stateSourceObject.Load(23, &e.tcpRecovery)
 	stateSourceObject.Load(24, &e.sack)
@@ -317,9 +316,8 @@ func (e *endpoint) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(46, &e.txHash)
 	stateSourceObject.Load(47, &e.owner)
 	stateSourceObject.Load(48, &e.ops)
+	stateSourceObject.Load(49, &e.lastOutOfWindowAckTime)
 	stateSourceObject.LoadValue(10, new(EndpointState), func(y interface{}) { e.loadState(y.(EndpointState)) })
-	stateSourceObject.LoadValue(21, new(unixTime), func(y interface{}) { e.loadRecentTSTime(y.(unixTime)) })
-	stateSourceObject.LoadValue(49, new(unixTime), func(y interface{}) { e.loadLastOutOfWindowAckTime(y.(unixTime)) })
 	stateSourceObject.AfterLoad(e.afterLoad)
 }
 
@@ -419,8 +417,6 @@ func (r *receiver) beforeSave() {}
 // +checklocksignore
 func (r *receiver) StateSave(stateSinkObject state.Sink) {
 	r.beforeSave()
-	var lastRcvdAckTimeValue unixTime = r.saveLastRcvdAckTime()
-	stateSinkObject.SaveValue(7, lastRcvdAckTimeValue)
 	stateSinkObject.Save(0, &r.TCPReceiverState)
 	stateSinkObject.Save(1, &r.ep)
 	stateSinkObject.Save(2, &r.rcvWnd)
@@ -428,6 +424,7 @@ func (r *receiver) StateSave(stateSinkObject state.Sink) {
 	stateSinkObject.Save(4, &r.prevBufUsed)
 	stateSinkObject.Save(5, &r.closed)
 	stateSinkObject.Save(6, &r.pendingRcvdSegments)
+	stateSinkObject.Save(7, &r.lastRcvdAckTime)
 }
 
 func (r *receiver) afterLoad() {}
@@ -441,7 +438,7 @@ func (r *receiver) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(4, &r.prevBufUsed)
 	stateSourceObject.Load(5, &r.closed)
 	stateSourceObject.Load(6, &r.pendingRcvdSegments)
-	stateSourceObject.LoadValue(7, new(unixTime), func(y interface{}) { r.loadLastRcvdAckTime(y.(unixTime)) })
+	stateSourceObject.Load(7, &r.lastRcvdAckTime)
 }
 
 func (r *renoState) StateTypeName() string {
@@ -590,10 +587,6 @@ func (s *segment) StateSave(stateSinkObject state.Sink) {
 	stateSinkObject.SaveValue(8, dataValue)
 	var optionsValue []byte = s.saveOptions()
 	stateSinkObject.SaveValue(17, optionsValue)
-	var rcvdTimeValue unixTime = s.saveRcvdTime()
-	stateSinkObject.SaveValue(19, rcvdTimeValue)
-	var xmitTimeValue unixTime = s.saveXmitTime()
-	stateSinkObject.SaveValue(20, xmitTimeValue)
 	stateSinkObject.Save(0, &s.segmentEntry)
 	stateSinkObject.Save(1, &s.refCnt)
 	stateSinkObject.Save(2, &s.ep)
@@ -611,6 +604,8 @@ func (s *segment) StateSave(stateSinkObject state.Sink) {
 	stateSinkObject.Save(15, &s.csumValid)
 	stateSinkObject.Save(16, &s.parsedOptions)
 	stateSinkObject.Save(18, &s.hasNewSACKInfo)
+	stateSinkObject.Save(19, &s.rcvdTime)
+	stateSinkObject.Save(20, &s.xmitTime)
 	stateSinkObject.Save(21, &s.xmitCount)
 	stateSinkObject.Save(22, &s.acked)
 	stateSinkObject.Save(23, &s.dataMemSize)
@@ -638,14 +633,14 @@ func (s *segment) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(15, &s.csumValid)
 	stateSourceObject.Load(16, &s.parsedOptions)
 	stateSourceObject.Load(18, &s.hasNewSACKInfo)
+	stateSourceObject.Load(19, &s.rcvdTime)
+	stateSourceObject.Load(20, &s.xmitTime)
 	stateSourceObject.Load(21, &s.xmitCount)
 	stateSourceObject.Load(22, &s.acked)
 	stateSourceObject.Load(23, &s.dataMemSize)
 	stateSourceObject.Load(24, &s.lost)
 	stateSourceObject.LoadValue(8, new(buffer.VectorisedView), func(y interface{}) { s.loadData(y.(buffer.VectorisedView)) })
 	stateSourceObject.LoadValue(17, new([]byte), func(y interface{}) { s.loadOptions(y.([]byte)) })
-	stateSourceObject.LoadValue(19, new(unixTime), func(y interface{}) { s.loadRcvdTime(y.(unixTime)) })
-	stateSourceObject.LoadValue(20, new(unixTime), func(y interface{}) { s.loadXmitTime(y.(unixTime)) })
 }
 
 func (q *segmentQueue) StateTypeName() string {
@@ -707,11 +702,10 @@ func (s *sender) beforeSave() {}
 // +checklocksignore
 func (s *sender) StateSave(stateSinkObject state.Sink) {
 	s.beforeSave()
-	var firstRetransmittedSegXmitTimeValue unixTime = s.saveFirstRetransmittedSegXmitTime()
-	stateSinkObject.SaveValue(3, firstRetransmittedSegXmitTimeValue)
 	stateSinkObject.Save(0, &s.TCPSenderState)
 	stateSinkObject.Save(1, &s.ep)
 	stateSinkObject.Save(2, &s.lr)
+	stateSinkObject.Save(3, &s.firstRetransmittedSegXmitTime)
 	stateSinkObject.Save(4, &s.writeNext)
 	stateSinkObject.Save(5, &s.writeList)
 	stateSinkObject.Save(6, &s.rtt)
@@ -724,11 +718,14 @@ func (s *sender) StateSave(stateSinkObject state.Sink) {
 	stateSinkObject.Save(13, &s.rc)
 }
 
+func (s *sender) afterLoad() {}
+
 // +checklocksignore
 func (s *sender) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(0, &s.TCPSenderState)
 	stateSourceObject.Load(1, &s.ep)
 	stateSourceObject.Load(2, &s.lr)
+	stateSourceObject.Load(3, &s.firstRetransmittedSegXmitTime)
 	stateSourceObject.Load(4, &s.writeNext)
 	stateSourceObject.Load(5, &s.writeList)
 	stateSourceObject.Load(6, &s.rtt)
@@ -739,8 +736,6 @@ func (s *sender) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(11, &s.state)
 	stateSourceObject.Load(12, &s.cc)
 	stateSourceObject.Load(13, &s.rc)
-	stateSourceObject.LoadValue(3, new(unixTime), func(y interface{}) { s.loadFirstRetransmittedSegXmitTime(y.(unixTime)) })
-	stateSourceObject.AfterLoad(s.afterLoad)
 }
 
 func (r *rtt) StateTypeName() string {
@@ -768,34 +763,6 @@ func (r *rtt) StateLoad(stateSourceObject state.Source) {
 	stateSourceObject.Load(0, &r.TCPRTTState)
 }
 
-func (u *unixTime) StateTypeName() string {
-	return "pkg/tcpip/transport/tcp.unixTime"
-}
-
-func (u *unixTime) StateFields() []string {
-	return []string{
-		"second",
-		"nano",
-	}
-}
-
-func (u *unixTime) beforeSave() {}
-
-// +checklocksignore
-func (u *unixTime) StateSave(stateSinkObject state.Sink) {
-	u.beforeSave()
-	stateSinkObject.Save(0, &u.second)
-	stateSinkObject.Save(1, &u.nano)
-}
-
-func (u *unixTime) afterLoad() {}
-
-// +checklocksignore
-func (u *unixTime) StateLoad(stateSourceObject state.Source) {
-	stateSourceObject.Load(0, &u.second)
-	stateSourceObject.Load(1, &u.nano)
-}
-
 func (l *endpointList) StateTypeName() string {
 	return "pkg/tcpip/transport/tcp.endpointList"
 }
@@ -926,7 +893,6 @@ func init() {
 	state.Register((*segmentQueue)(nil))
 	state.Register((*sender)(nil))
 	state.Register((*rtt)(nil))
-	state.Register((*unixTime)(nil))
 	state.Register((*endpointList)(nil))
 	state.Register((*endpointEntry)(nil))
 	state.Register((*segmentList)(nil))
diff --git a/pkg/tcpip/transport/tcp/timer.go b/pkg/tcpip/transport/tcp/timer.go
index 38a335840..5645c772e 100644
--- a/pkg/tcpip/transport/tcp/timer.go
+++ b/pkg/tcpip/transport/tcp/timer.go
@@ -15,21 +15,29 @@
 package tcp
 
 import (
+	"math"
 	"time"
 
 	"gvisor.dev/gvisor/pkg/sleep"
+	"gvisor.dev/gvisor/pkg/tcpip"
 )
 
 type timerState int
 
 const (
+	// The timer is disabled.
 	timerStateDisabled timerState = iota
+	// The timer is enabled, but the clock timer may be set to an earlier
+	// expiration time due to a previous orphaned state.
 	timerStateEnabled
+	// The timer is disabled, but the clock timer is enabled, which means that
+	// it will cause a spurious wakeup unless the timer is enabled before the
+	// clock timer fires.
 	timerStateOrphaned
 )
 
 // timer is a timer implementation that reduces the interactions with the
-// runtime timer infrastructure by letting timers run (and potentially
+// clock timer infrastructure by letting timers run (and potentially
 // eventually expire) even if they are stopped. It makes it cheaper to
 // disable/reenable timers at the expense of spurious wakes. This is useful for
 // cases when the same timer is disabled/reenabled repeatedly with relatively
@@ -39,44 +47,37 @@ const (
 // (currently at least 200ms), and get disabled when acks are received, and
 // reenabled when new pending segments are sent.
 //
-// It is advantageous to avoid interacting with the runtime because it acquires
+// It is advantageous to avoid interacting with the clock because it acquires
 // a global mutex and performs O(log n) operations, where n is the global number
 // of timers, whenever a timer is enabled or disabled, and may make a syscall.
 //
 // This struct is thread-compatible.
 type timer struct {
-	// state is the current state of the timer, it can be one of the
-	// following values:
-	//     disabled - the timer is disabled.
-	//     orphaned - the timer is disabled, but the runtime timer is
-	//                enabled, which means that it will evetually cause a
-	//                spurious wake (unless it gets enabled again before
-	//                then).
-	//     enabled  - the timer is enabled, but the runtime timer may be set
-	//                to an earlier expiration time due to a previous
-	//                orphaned state.
 	state timerState
 
+	clock tcpip.Clock
+
 	// target is the expiration time of the current timer. It is only
 	// meaningful in the enabled state.
-	target time.Time
+	target tcpip.MonotonicTime
 
-	// runtimeTarget is the expiration time of the runtime timer. It is
+	// clockTarget is the expiration time of the clock timer. It is
 	// meaningful in the enabled and orphaned states.
-	runtimeTarget time.Time
+	clockTarget tcpip.MonotonicTime
 
-	// timer is the runtime timer used to wait on.
-	timer *time.Timer
+	// timer is the clock timer used to wait on.
+	timer tcpip.Timer
 }
 
 // init initializes the timer. Once it expires, it the given waker will be
 // asserted.
-func (t *timer) init(w *sleep.Waker) {
+func (t *timer) init(clock tcpip.Clock, w *sleep.Waker) {
 	t.state = timerStateDisabled
+	t.clock = clock
 
-	// Initialize a runtime timer that will assert the waker, then
+	// Initialize a clock timer that will assert the waker, then
 	// immediately stop it.
-	t.timer = time.AfterFunc(time.Hour, func() {
+	t.timer = t.clock.AfterFunc(math.MaxInt64, func() {
 		w.Assert()
 	})
 	t.timer.Stop()
@@ -106,9 +107,9 @@ func (t *timer) checkExpiration() bool {
 
 	// The timer is enabled, but it may have expired early. Check if that's
 	// the case, and if so, reset the runtime timer to the correct time.
-	now := time.Now()
+	now := t.clock.NowMonotonic()
 	if now.Before(t.target) {
-		t.runtimeTarget = t.target
+		t.clockTarget = t.target
 		t.timer.Reset(t.target.Sub(now))
 		return false
 	}
@@ -134,11 +135,11 @@ func (t *timer) enabled() bool {
 
 // enable enables the timer, programming the runtime timer if necessary.
 func (t *timer) enable(d time.Duration) {
-	t.target = time.Now().Add(d)
+	t.target = t.clock.NowMonotonic().Add(d)
 
 	// Check if we need to set the runtime timer.
-	if t.state == timerStateDisabled || t.target.Before(t.runtimeTarget) {
-		t.runtimeTarget = t.target
+	if t.state == timerStateDisabled || t.target.Before(t.clockTarget) {
+		t.clockTarget = t.target
 		t.timer.Reset(d)
 	}