fix(timekeeping): restore monotonic clock and clocksource semantics (#2145)

* fix(timekeeping): restore monotonic clock and clocksource semantics

DragonOS used the realtime epoch as the basis for monotonic clocks and
spread clocksource cycle state across multiple owners.  The resulting
updates could lose elapsed time, recurse through the timekeeper lock, and
make timeout consumers depend on wall-clock adjustments.  KVM clock CPU
bring-up and interrupt-context locking also lacked transactional failure
handling.

Rework the timekeeping core around independently maintained monotonic and
raw read bases, with realtime and boottime represented as offsets.  Keep
clocksource selection, watchdog state, switching, and rollback under a
single control transaction, and preserve elapsed time and fractional state
when a source changes.

Make KVM clock setup per-CPU and transactional, including AP failure
rollback.  Add writer-preferred RwLock progress and explicit interrupt
context tracking so timekeeper writers cannot deadlock behind continuous
readers or acquire blocking paths from hardirq/softirq context.

Align POSIX clock reads, nanosleep restart handling, signal waits, and futex
timeouts with their Linux clock domains.  Add kernel selftests, dunitest
coverage, a guest calibration workload, and a fail-closed host calibration
harness for KVM and TCG evidence.

Validation:
- x86_64 kernel build and link
- RISC-V Rust build and kernel ELF link
- 31 host calibration unit tests
- guest calibration workload static build
- QEMU runner and Python syntax checks
- KVM 2-vCPU timekeeping/restart suite: 19/19 relevant tests passed
- fixed-CPU and migrating 10,000,000-read monotonicity tests passed

Signed-off-by: longjin <longjin@dragonos.org>

* fix(timekeeping): address CI and review regressions

Serialize watchdog cleanup with clocksource registration and fully roll back partially published watchdog state. Keep hardirq nesting counters cache-line isolated and avoid the CAS loop on interrupt entry and exit.

Match Linux's settimeofday boundary after suspend, expose clocksource selftests through debugfs, and bound normal guest semantic loops while retaining the opt-in ten-million-read stress gates.

Make QEMU argv evidence fail closed, release partially initialized serial transport resources, and resolve the formatting regressions reported by CI.

Validated with make fmt, make kernel, host calibration tests, the calibration host build, and DragonOS guest timekeeping selftest and semantics suites.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(timekeeping): preserve selftest execution state

Restore preemption when an already-registered rwlock writer acquisition fails, and cover the failure path in the debugfs selftest. Consolidate all selftest-only registered writer attempts behind the balanced helper.

Also preserve the underlying serial socket error in calibration diagnostics and verify both the reported detail and resource cleanup.

Validated with format and Clippy checks, the kernel build, calibration unit and host tests, and DragonOS guest timekeeping selftests.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(net): snapshot bound sockets before notification

Network polling walked the bound-socket vector by index while dropping the lock around every notification. Concurrent socket teardown could remove an earlier entry, shift the vector, and make the next index skip a poll waiter entirely.

Take one coherent Arc snapshot and reuse the shared notification path for regular polling, NAPI polling, and listener teardown. Notifications still run outside the bounds lock, preserving the required lock order, while a single read-side acquisition avoids writer-fair reacquisition stalls under close-heavy workloads.

This prevents tcp_close_semantics poll timeouts during concurrent IPv4 and dual-stack reset/close stress.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(process): serialize kernel stack allocation safely

Kernel stack allocation and reclamation used try_lock_irqsave().unwrap() on their shared mapper lock. Concurrent fork and exit activity therefore converted ordinary lock contention into a kernel panic, as observed when tcp_socket_test created processes on both CPUs.

Acquire KSTACK_LOCK with the blocking irqsave spin-lock operation in both paths. This preserves the existing mapper serialization and interrupt exclusion while allowing the contending CPU to wait for the current stack operation to finish.

The gVisor tcp_socket_test now completes all 184 tests without triggering the allocation race.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(kernel): avoid poll allocation and TTY lock recursion

Make the network interface's bound-socket table copy-on-write. Poll and notification paths now clone only the outer Arc while interrupts are disabled, while the less frequent bind and unbind paths perform any required Vec clone. This preserves a coherent notification snapshot without O(n) IRQ-off allocation or the index-shift race fixed earlier.

Use one by-value termios snapshot for each N_TTY receive batch and pass it through the nested input helpers. The previous receive path recursively acquired the same read lock; once a termios writer queued, writer-fair admission blocked the recursive reader and deadlocked both CPUs. A value snapshot preserves consistent per-batch input semantics and removes the recursive locking dependency.

Validated with make kernel, all 27 CubeSandbox PTY exec-chain tests, and all 6 TCP close semantics tests.

Signed-off-by: longjin <longjin@dragonos.org>

* style(kernel): format N_TTY snapshot changes

Apply the repository rustfmt output required by the architecture format-check jobs. No behavior changes.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(x86_64): roll back failed HPET enablement

Treat HPET enablement as a hardware transaction. If any validation, counter check, timer lookup, or IRQ registration step fails, restore the firmware general configuration instead of relying on the enabled flag, which is intentionally published only after IRQ setup succeeds.

Snapshot and restore each timer comparator together with its configuration. Restore timer state while the counter is disabled, then write the complete firmware general configuration last so a firmware-enabled counter resumes only after all timer registers are coherent. Normal HPET disable now reuses the same restoration path.

Validated with the repository format and Clippy checks, make kernel, and a DragonOS x86_64 fallback boot with HPET unavailable.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(tty,time): eliminate PTY input hangs

Use a persistent waiter notification for nanosleep timers, preserve deadline semantics across signal and restart races, and avoid recursive N_TTY termios, flow, and line-discipline wakeup locking during input processing.

This fixes the ByteStream PTY deadlocks observed in CI while keeping absolute sleeps from returning before their POSIX clock deadline.

Signed-off-by: longjin <longjin@dragonos.org>

* fix(tty): satisfy clippy auto-deref lint

Signed-off-by: longjin <longjin@dragonos.org>

* fix(dunitest): synchronize reparent wait test

Signed-off-by: longjin <longjin@dragonos.org>

* fix(time): return EOPNOTSUPP for thread CPU nanosleep

Signed-off-by: longjin <longjin@dragonos.org>

---------

Signed-off-by: longjin <longjin@dragonos.org>

Author: fslongjin

kernel/src/arch/riscv64/interrupt/handle.rs

@@ -57,6 +57,7 @@ fn try_fixup_kernel_user_access(trap_frame: &mut TrapFrame) -> bool {
 #[no_mangle]
 unsafe extern "C" fn riscv64_do_irq(trap_frame: &mut TrapFrame) {
     if trap_frame.cause.is_interrupt() {
+        let hardirq_guard = crate::exception::enter_hardirq();
         crate::rcu::irq_enter();
         riscv64_do_interrupt(trap_frame);
         let irq_outermost = crate::rcu::irq_is_outermost();
@@ -69,6 +70,7 @@ unsafe extern "C" fn riscv64_do_irq(trap_frame: &mut TrapFrame) {
         let resume_idle_eqs = !should_schedule
             && ProcessManager::current_pcb().sched_info().policy() == SchedPolicy::IDLE;
         let irq_exited_outermost = crate::rcu::irq_exit(resume_idle_eqs);
+        drop(hardirq_guard);
 
         if should_schedule && irq_exited_outermost {
             __schedule(SchedMode::SM_PREEMPT);

kernel/src/arch/x86_64/driver/hpet.rs

@@ -79,6 +79,8 @@ struct InnerHpet {
     timer_registers_ptr: NonNull<HpetTimerRegisters>,
     /// 定时器启动时配置
     timer_boot_cfg: Vec<u64>,
+    /// 定时器启动时比较器值
+    timer_boot_comparator: Vec<u64>,
 }
 
 impl Hpet {
@@ -127,10 +129,12 @@ impl Hpet {
         .unwrap();
         // 记录hpet定时器启动时配置
         let mut timer_boot_cfg = Vec::with_capacity(tm_num as usize);
+        let mut timer_boot_comparator = Vec::with_capacity(tm_num as usize);
         for i in 0..tm_num {
             let timer_reg = unsafe { timer_ptr.as_ptr().add(i).as_ref().unwrap() };
             let cfg = timer_reg.config();
             timer_boot_cfg.push(cfg);
+            timer_boot_comparator.push(timer_reg.comparator_value());
         }
 
         let hpet = Hpet {
@@ -140,6 +144,7 @@ impl Hpet {
                 registers_ptr: ptr,
                 timer_registers_ptr: timer_ptr,
                 timer_boot_cfg,
+                timer_boot_comparator,
             }),
             enabled: AtomicBool::new(false),
             boot_cfg,
@@ -156,6 +161,21 @@ impl Hpet {
     pub fn hpet_enable(&self) -> Result<(), SystemError> {
         let irq_guard = unsafe { CurrentIrqArch::save_and_disable_irq() };
 
+        let result = self.try_hpet_enable();
+        if result.is_err() {
+            // Hpet::new() disables the device, and try_hpet_enable() may also
+            // restart the counter or program timer 0 before reporting an
+            // error. Restore the firmware state even though `enabled` was
+            // never published, so fallback clocks cannot inherit a partially
+            // configured HPET.
+            self.restore_boot_configuration();
+        }
+
+        drop(irq_guard);
+        return result;
+    }
+
+    fn try_hpet_enable(&self) -> Result<(), SystemError> {
         // ！！！这里是临时糊代码的，需要在apic重构的时候修改！！！
         let (inner_guard, regs) = unsafe { self.hpet_regs_mut() };
         let freq = regs.frequency();
@@ -204,8 +224,6 @@ impl Hpet {
         drop(inner_guard);
 
         info!("HPET enabled");
-
-        drop(irq_guard);
         return Ok(());
     }
 
@@ -350,13 +368,10 @@ impl Hpet {
         unsafe { regs.write_general_config(cfg) };
     }
 
-    /// 关闭hpet
-    pub fn hpet_disable(&self) {
-        debug!("HPET disable");
-        if !is_hpet_enabled() {
-            return;
-        }
-
+    /// Restore every HPET register modified during initialization or enable.
+    /// This intentionally does not consult `enabled`: failed enable attempts
+    /// must be rolled back before that flag is set.
+    fn restore_boot_configuration(&self) {
         // 恢复启动时的配置
         let mut cfg = self.boot_cfg;
         cfg &= !HPET_CFG_ENABLE;
@@ -368,18 +383,28 @@ impl Hpet {
             let (inner_guard, timer_reg) = unsafe { self.timer_mut(i).unwrap() };
             unsafe {
                 timer_reg.write_config(inner_guard.timer_boot_cfg[i as usize]);
+                timer_reg.write_comparator_value(inner_guard.timer_boot_comparator[i as usize]);
             }
             drop(inner_guard);
         }
 
-        // 如果HPET在启动时已经启用了，重新启用它
-        if (self.boot_cfg & HPET_CFG_ENABLE) != 0 {
-            let (_, regs) = unsafe { self.hpet_regs_mut() };
-            unsafe { regs.write_general_config(self.boot_cfg) };
-        }
+        // Restore the complete firmware configuration last. This also
+        // restarts a counter that firmware left enabled.
+        let (_, regs) = unsafe { self.hpet_regs_mut() };
+        unsafe { regs.write_general_config(self.boot_cfg) };
 
         self.enabled.store(false, Ordering::SeqCst);
     }
+
+    /// 关闭hpet
+    pub fn hpet_disable(&self) {
+        debug!("HPET disable");
+        if !is_hpet_enabled() {
+            return;
+        }
+
+        self.restore_boot_configuration();
+    }
 }
 
 pub fn hpet_init() -> Result<(), SystemError> {

kernel/src/arch/x86_64/init/mod.rs

@@ -3,7 +3,7 @@ use core::{
     sync::atomic::{compiler_fence, Ordering},
 };
 
-use log::debug;
+use log::{debug, warn};
 use system_error::SystemError;
 use x86::dtables::DescriptorTablePointer;
 
@@ -115,13 +115,45 @@ pub fn setup_arch_post() -> Result<(), SystemError> {
     // 3.如果 kvm-clock 和 HPET 都不可用，则回退到 ACPI PM Timer
     // 4.最后初始化 TSC 管理器 （既可以通过 kvm-clock 提供的 pvclock 确定 TSC 频率，也可以通过其他方法确定 TSC 频率）
     let kvmclock_ok = kvm_clock::kvmclock_init();
-    let ret = hpet_init();
-    if ret.is_ok() {
-        hpet_instance().hpet_enable().expect("hpet enable failed");
-    } else if !kvmclock_ok {
-        init_acpi_pm_clocksource().expect("acpi_pm_timer inits failed");
+    let hpet_ok = match hpet_init() {
+        Ok(()) => match hpet_instance().hpet_enable() {
+            Ok(_) => true,
+            Err(error) => {
+                warn!(
+                    "HPET enable failed, retaining fallback clocksource: {:?}",
+                    error
+                );
+                false
+            }
+        },
+        Err(error) => {
+            warn!(
+                "HPET init failed, retaining fallback clocksource: {:?}",
+                error
+            );
+            false
+        }
+    };
+    if !kvmclock_ok && !hpet_ok {
+        if let Err(error) = init_acpi_pm_clocksource() {
+            // jiffies is already registered and installed by timekeeping_init.
+            warn!(
+                "ACPI PM timer unavailable, continuing with jiffies: {:?}",
+                error
+            );
+        }
+    }
+    if let Err(error) = TSCManager::init() {
+        if TSCManager::cpu_khz() == 0 {
+            // The scheduler clock and APIC timer still require CPU_KHZ even
+            // when POSIX timekeeping can remain on jiffies.
+            return Err(error);
+        }
+        warn!(
+            "TSC clocksource unavailable, continuing with registered clocksource: {:?}",
+            error
+        );
     }
-    TSCManager::init().expect("tsc init failed");
 
     return Ok(());
 }

kernel/src/arch/x86_64/interrupt/handle.rs

@@ -17,6 +17,7 @@ unsafe extern "C" fn x86_64_do_irq(trap_frame: &mut TrapFrame, vector: u32) {
         x86_64::registers::segmentation::GS::swap();
     }
 
+    let hardirq_guard = crate::exception::enter_hardirq();
     crate::rcu::irq_enter();
 
     // 由于x86上面，虚拟中断号与物理中断号是一一对应的，所以这里直接使用vector作为中断号来查询irqdesc
@@ -46,6 +47,7 @@ unsafe extern "C" fn x86_64_do_irq(trap_frame: &mut TrapFrame, vector: u32) {
     let resume_idle_eqs = !should_schedule
         && ProcessManager::current_pcb().sched_info().policy() == SchedPolicy::IDLE;
     let irq_exited_outermost = crate::rcu::irq_exit(resume_idle_eqs);
+    drop(hardirq_guard);
 
     if should_schedule && irq_exited_outermost {
         __schedule(SchedMode::SM_PREEMPT);

kernel/src/debug/mod.rs

@@ -10,5 +10,6 @@ pub mod page_cache;
 pub mod panic;
 pub mod rcu;
 pub mod sysfs;
+pub mod timekeeping;
 pub mod traceback;
 pub mod tracing;

kernel/src/debug/sysfs/mod.rs

@@ -28,6 +28,7 @@ fn debugfs_init() -> Result<(), SystemError> {
     super::fuse::init_debugfs_fuse()?;
     super::kthread::init_debugfs_kthread()?;
     super::page_cache::init_debugfs_page_cache()?;
+    super::timekeeping::init_debugfs_timekeeping()?;
     return Ok(());
 }
 

kernel/src/debug/timekeeping.rs

@@ -0,0 +1,126 @@
+use alloc::{format, string::String, string::ToString};
+
+use system_error::SystemError;
+
+use crate::{
+    debug::sysfs::debugfs_kobj,
+    driver::base::kobject::KObject,
+    filesystem::{
+        kernfs::callback::{KernCallbackData, KernFSCallback, KernFilePrivateData},
+        vfs::{InodeMode, PollStatus},
+    },
+    libs::rwlock::run_rwlock_selftests,
+    time::{clocksource::run_clocksource_selftests, timekeeping::run_timekeeping_selftests},
+};
+
+#[cfg(target_arch = "x86_64")]
+use crate::driver::clocksource::kvm_clock::run_kvm_clock_allocator_selftests;
+
+#[derive(Debug)]
+struct TimekeepingDirCallback;
+
+impl KernFSCallback for TimekeepingDirCallback {
+    fn open(&self, _data: KernCallbackData) -> Result<(), SystemError> {
+        Ok(())
+    }
+
+    fn read(
+        &self,
+        _data: KernCallbackData,
+        _buf: &mut [u8],
+        _offset: usize,
+    ) -> Result<usize, SystemError> {
+        Err(SystemError::EISDIR)
+    }
+
+    fn write(
+        &self,
+        _data: KernCallbackData,
+        _buf: &[u8],
+        _offset: usize,
+    ) -> Result<usize, SystemError> {
+        Err(SystemError::EISDIR)
+    }
+
+    fn poll(&self, _data: KernCallbackData) -> Result<PollStatus, SystemError> {
+        Err(SystemError::EISDIR)
+    }
+}
+
+#[derive(Debug)]
+struct TimekeepingSelftestCallback;
+
+impl KernFSCallback for TimekeepingSelftestCallback {
+    fn open(&self, mut data: KernCallbackData) -> Result<(), SystemError> {
+        data.file_private_data_mut()
+            .replace(KernFilePrivateData::DebugTextSnapshot(run_selftests()));
+        Ok(())
+    }
+
+    fn read(
+        &self,
+        data: KernCallbackData,
+        buf: &mut [u8],
+        offset: usize,
+    ) -> Result<usize, SystemError> {
+        let report = match data.file_private_data() {
+            Some(KernFilePrivateData::DebugTextSnapshot(report)) => report,
+            _ => return Err(SystemError::EINVAL),
+        };
+        let bytes = report.as_bytes();
+        if offset >= bytes.len() {
+            return Ok(0);
+        }
+        let len = buf.len().min(bytes.len() - offset);
+        buf[..len].copy_from_slice(&bytes[offset..offset + len]);
+        Ok(len)
+    }
+
+    fn write(
+        &self,
+        _data: KernCallbackData,
+        _buf: &[u8],
+        _offset: usize,
+    ) -> Result<usize, SystemError> {
+        Err(SystemError::EPERM)
+    }
+
+    fn poll(&self, _data: KernCallbackData) -> Result<PollStatus, SystemError> {
+        Ok(PollStatus::READ)
+    }
+}
+
+fn run_selftests() -> String {
+    let (timekeeping_passed, timekeeping_failed, timekeeping_body) = run_timekeeping_selftests();
+    let (clocksource_passed, clocksource_failed, clocksource_body) = run_clocksource_selftests();
+    let (rwlock_passed, rwlock_failed, rwlock_body) = run_rwlock_selftests();
+    #[cfg(target_arch = "x86_64")]
+    let (kvm_passed, kvm_failed, kvm_body) = run_kvm_clock_allocator_selftests();
+    #[cfg(not(target_arch = "x86_64"))]
+    let (kvm_passed, kvm_failed, kvm_body) = (0, 0, String::new());
+    let passed = timekeeping_passed + clocksource_passed + rwlock_passed + kvm_passed;
+    let failed = timekeeping_failed + clocksource_failed + rwlock_failed + kvm_failed;
+    let status = if failed == 0 { "ok" } else { "fail" };
+    format!(
+        "status={status}\n{timekeeping_body}{clocksource_body}{rwlock_body}{kvm_body}summary_pass={passed}\nsummary_fail={failed}\n"
+    )
+}
+
+pub fn init_debugfs_timekeeping() -> Result<(), SystemError> {
+    let debugfs = debugfs_kobj();
+    let root_dir = debugfs.inode().ok_or(SystemError::ENOENT)?;
+    let timekeeping_root = root_dir.add_dir(
+        "timekeeping".to_string(),
+        InodeMode::from_bits_truncate(0o500),
+        None,
+        Some(&TimekeepingDirCallback),
+    )?;
+    timekeeping_root.add_file(
+        "selftest".to_string(),
+        InodeMode::S_IRUSR,
+        Some(16 * 1024),
+        None,
+        Some(&TimekeepingSelftestCallback),
+    )?;
+    Ok(())
+}

kernel/src/driver/clocksource/acpi_pm.rs

@@ -7,7 +7,10 @@ use crate::{
     },
     libs::spinlock::SpinLock,
     time::{
-        clocksource::{Clocksource, ClocksourceData, ClocksourceFlags, ClocksourceMask, CycleNum},
+        clocksource::{
+            Clocksource, ClocksourceData, ClocksourceFlags, ClocksourceMask, ClocksourceUpdate,
+            CycleNum,
+        },
         PIT_TICK_RATE,
     },
 };
@@ -85,13 +88,13 @@ impl Acpipm {
             mask: ClocksourceMask::new(ACPI_PM_MASK),
             mult: 0,
             shift: 0,
+            max_cycles: Default::default(),
             max_idle_ns: Default::default(),
             flags: ClocksourceFlags::CLOCK_SOURCE_IS_CONTINUOUS,
             watchdog_last: CycleNum::new(0),
             cs_last: CycleNum::new(0),
             uncertainty_margin: 0,
             maxadj: 0,
-            cycle_last: CycleNum::new(0),
         };
         let acpi_pm = Arc::new(Acpipm(SpinLock::new(InnerAcpipm {
             data,
@@ -117,20 +120,8 @@ impl Clocksource for Acpipm {
         return self.0.lock_irqsave().self_reaf.upgrade().unwrap();
     }
 
-    fn update_clocksource_data(&self, data: ClocksourceData) -> Result<(), SystemError> {
-        let d = &mut self.0.lock_irqsave().data;
-        d.set_name(data.name);
-        d.set_rating(data.rating);
-        d.set_mask(data.mask);
-        d.set_mult(data.mult);
-        d.set_shift(data.shift);
-        d.set_max_idle_ns(data.max_idle_ns);
-        d.set_flags(data.flags);
-        d.watchdog_last = data.watchdog_last;
-        d.cs_last = data.cs_last;
-        d.set_uncertainty_margin(data.uncertainty_margin);
-        d.set_maxadj(data.maxadj);
-        d.cycle_last = data.cycle_last;
+    fn update_clocksource_data(&self, update: ClocksourceUpdate) -> Result<(), SystemError> {
+        update.apply(&mut self.0.lock_irqsave().data);
         return Ok(());
     }
 }