kernel: improve tcpip.Timer implementation

- Move ktime.VariableTimer to kernel.timekeeperTcpipTimer, its only use case.
  This allows timekeeperTcpipTimer to use concrete types kernel.timekeeperClock
  and ktime.SampledTimer instead of ktime.Clock and ktime.Timer, saving a tiny
  amount of memory (interface values consist of two pointers) and CPU (for
  interface method calls).

- Fix a bug where timekeeperTcpipTimer expiration can cancel a racing call to
  timekeeperTcpipTimer.Reset() (see use of new field
  timekeeperTcpipTimer.resets).

- Define Listener.NotifyTimer directly on timekeeperTcpipTimer (dropping
  ktime.functionNotifier), and move goroutine spawning from the anonymous
  function in ktime.AfterFunc() into timekeeperTcpipTimer.NotifyTimer(). This
  slightly simplifies the control flow and saves an allocation for the
  anonymous function object.

- Use monotonicClock rather than realtimeClock. It doesn't make sense for
  time-of-day clock adjustments to affect netstack timeouts, and this is
  consistent with tcpip.stdClock => time.AfterFunc => runtime.timer.

PiperOrigin-RevId: 695504159

Author: nixprime

pkg/sentry/kernel/BUILD

@@ -105,6 +105,13 @@ declare_mutex(
     prefix = "threadGroupTimer",
 )
 
+declare_mutex(
+    name = "timekeeper_tcpip_timer_mutex",
+    out = "timekeeper_tcpip_timer_mutex.go",
+    package = "kernel",
+    prefix = "timekeeperTcpipTimer",
+)
+
 declare_mutex(
     name = "cgroup_mounts_mutex",
     out = "cgroup_mounts_mutex.go",
@@ -290,6 +297,7 @@ go_library(
         "threads_impl.go",
         "timekeeper.go",
         "timekeeper_state.go",
+        "timekeeper_tcpip_timer_mutex.go",
         "tty.go",
         "user_counters_mutex.go",
         "uts_namespace.go",

pkg/sentry/kernel/kernel.go

@@ -20,6 +20,7 @@
 //
 //	Kernel.extMu
 //	  TTY.mu
+//	  timekeeperTcpipTimer.mu
 //	  ThreadGroup.timerMu
 //	    Locks acquired by ktime.Timer methods
 //	      TaskSet.mu

pkg/sentry/kernel/timekeeper.go

@@ -170,32 +170,6 @@ func (t *Timekeeper) SetClocks(c sentrytime.Clocks, params *VDSOParamPage) {
 	}
 }
 
-var _ tcpip.Clock = (*Timekeeper)(nil)
-
-// Now implements tcpip.Clock.
-func (t *Timekeeper) Now() time.Time {
-	nsec, err := t.GetTime(sentrytime.Realtime)
-	if err != nil {
-		panic("timekeeper.GetTime(sentrytime.Realtime): " + err.Error())
-	}
-	return time.Unix(0, nsec)
-}
-
-// NowMonotonic implements tcpip.Clock.
-func (t *Timekeeper) NowMonotonic() tcpip.MonotonicTime {
-	nsec, err := t.GetTime(sentrytime.Monotonic)
-	if err != nil {
-		panic("timekeeper.GetTime(sentrytime.Monotonic): " + err.Error())
-	}
-	var mt tcpip.MonotonicTime
-	return mt.Add(time.Duration(nsec) * time.Nanosecond)
-}
-
-// AfterFunc implements tcpip.Clock.
-func (t *Timekeeper) AfterFunc(d time.Duration, f func()) tcpip.Timer {
-	return ktime.AfterFunc(t.realtimeClock, d, f)
-}
-
 // startUpdater starts an update goroutine that keeps the clocks updated.
 //
 // mu must be held.
@@ -354,3 +328,116 @@ func (tc *timekeeperClock) Now() ktime.Time {
 func (tc *timekeeperClock) NewTimer(l ktime.Listener) ktime.Timer {
 	return ktime.NewSampledTimer(tc, l)
 }
+
+var _ tcpip.Clock = (*Timekeeper)(nil)
+
+// Now implements tcpip.Clock.
+func (t *Timekeeper) Now() time.Time {
+	nsec, err := t.GetTime(sentrytime.Realtime)
+	if err != nil {
+		panic("timekeeper.GetTime(sentrytime.Realtime): " + err.Error())
+	}
+	return time.Unix(0, nsec)
+}
+
+// NowMonotonic implements tcpip.Clock.
+func (t *Timekeeper) NowMonotonic() tcpip.MonotonicTime {
+	nsec, err := t.GetTime(sentrytime.Monotonic)
+	if err != nil {
+		panic("timekeeper.GetTime(sentrytime.Monotonic): " + err.Error())
+	}
+	var mt tcpip.MonotonicTime
+	return mt.Add(time.Duration(nsec) * time.Nanosecond)
+}
+
+// AfterFunc implements tcpip.Clock.
+func (t *Timekeeper) AfterFunc(d time.Duration, f func()) tcpip.Timer {
+	timer := &timekeeperTcpipTimer{
+		clock: t.monotonicClock,
+		fn:    f,
+	}
+	timer.Reset(d)
+	return timer
+}
+
+// timekeeperTcpipTimer implements tcpip.Timer by wrapping a ktime.SampledTimer.
+// tcpip.Timer does not define a Destroy method, so each timer expiration and
+// each call to Timer.Stop() must release all resources by calling
+// ktime.SampledTimer.Destroy().
+type timekeeperTcpipTimer struct {
+	// immutable
+	clock *timekeeperClock
+	fn    func()
+
+	// mu protects t.
+	mu timekeeperTcpipTimerMutex
+
+	// t stores the latest running Timer. This is replaced whenever Reset is
+	// called since Timer cannot be restarted once it has been Destroyed by Stop.
+	//
+	// This field is nil iff Stop has been called.
+	t *ktime.SampledTimer
+
+	// resets is the number of times Reset has been called. resets is written
+	// with both mu and ktime.SampledTimer locks held, so it may be read with
+	// either or both locks held.
+	resets int
+}
+
+// Stop implements tcpip.Timer.Stop.
+func (r *timekeeperTcpipTimer) Stop() bool {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if r.t == nil {
+		return false
+	}
+	_, lastSetting := r.t.Set(ktime.Setting{}, nil)
+	r.t.Destroy()
+	r.t = nil
+	return lastSetting.Enabled
+}
+
+// stopExpired is equivalent to Stop, but is called when the timer expires.
+func (r *timekeeperTcpipTimer) stopExpired(reset int) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if r.t == nil || r.resets != reset {
+		return
+	}
+	r.t.Destroy()
+	r.t = nil
+}
+
+// Reset implements tcpip.Timer.Reset.
+func (r *timekeeperTcpipTimer) Reset(d time.Duration) {
+	r.mu.Lock()
+	defer r.mu.Unlock()
+
+	if r.t == nil {
+		r.t = ktime.NewSampledTimer(r.clock, r)
+	}
+	r.t.Set(ktime.Setting{
+		Enabled: true,
+		Next:    r.clock.Now().Add(d),
+	}, r.incResets)
+}
+
+func (r *timekeeperTcpipTimer) incResets() {
+	r.resets++
+}
+
+// NotifyTimer implements ktime.Listener.NotifyTimer.
+func (r *timekeeperTcpipTimer) NotifyTimer(exp uint64) {
+	// Implementations of ktime.Listener.NotifyTimer() can't call Timer methods
+	// due to lock ordering, so we must call r.t.Destroy() from another
+	// goroutine. We also must call r.stopExpired() rather than r.Stop(), since
+	// the latter might cancel an unrelated call to r.Reset() that happens
+	// between now and when this goroutine runs.
+	thisReset := r.resets
+	go func() {
+		r.stopExpired(thisReset)
+		r.fn()
+	}()
+}

pkg/sentry/ktime/BUILD

@@ -65,7 +65,6 @@ go_library(
         "synthetic_timer_list.go",
         "synthetic_timer_set.go",
         "uint64_range.go",
-        "util.go",
     ],
     visibility = ["//pkg/sentry:internal"],
     deps = [