@@ -178,6 +178,26 @@ With `--network=host`, host sockets cannot be saved, so:
 -   Network configuration visible inside the sandbox (interface statistics, TCP
     buffer sizes) reflects the host the sandbox was restored on.
 
+## Clocks
+
+The clocks behave across checkpoint and restore as they do across a Linux system
+suspend and resume:
+
+-   `CLOCK_MONOTONIC` does not count the time that the sandbox spends
+    checkpointed, or restoring. When the restored application resumes, it
+    continues from its value at checkpoint time. Timers and timeouts based on
+    it, such as `sleep(3)`, `poll(2)` and `epoll_wait(2)` timeouts, and
+    `CLOCK_MONOTONIC` timers, keep at least the time that they had left at
+    checkpoint time. They do not all expire at once on restore.
+-   `CLOCK_BOOTTIME` counts the time that the sandbox spends checkpointed. After
+    restore, it jumps forward by that time. `CLOCK_BOOTTIME` timers that became
+    due during that time expire on restore.
+-   `CLOCK_REALTIME` is the time of day on the host that the sandbox was
+    restored on, so it also jumps forward by the time that the sandbox spent
+    checkpointed. Timers set for an absolute `CLOCK_REALTIME` time that passed
+    during that time expire on restore. As on Linux, relative `CLOCK_REALTIME`
+    sleeps and timers measure their duration with `CLOCK_MONOTONIC`.
+
 ## Checkpoint & Restore with different CPU features
 
 When restoring a state file, gVisor verifies that the target host machine
 
@@ -38,7 +38,12 @@ type TimerFileDescription struct {
 	vfs.NoLockFD
 
 	events waiter.Queue
-	timer  ktime.Timer
+	timer  *ktime.SampledTimer
+
+	// clock is the clock that the timer fd was created with. timer runs on
+	// clock, except when it is armed with a relative CLOCK_REALTIME time (see
+	// SetTime). clock is immutable.
+	clock ktime.SampledClock
 
 	// val is the number of timer expirations since the last successful
 	// call to PRead, or SetTime. val must be accessed using atomic memory
@@ -50,11 +55,11 @@ var _ vfs.FileDescriptionImpl = (*TimerFileDescription)(nil)
 var _ ktime.Listener = (*TimerFileDescription)(nil)
 
 // New returns a new timer fd.
-func New(ctx context.Context, vfsObj *vfs.VirtualFilesystem, clock ktime.Clock, flags uint32) (*vfs.FileDescription, error) {
+func New(ctx context.Context, vfsObj *vfs.VirtualFilesystem, clock ktime.SampledClock, flags uint32) (*vfs.FileDescription, error) {
 	vd := vfsObj.NewAnonVirtualDentry("[timerfd]")
 	defer vd.DecRef(ctx)
-	tfd := &TimerFileDescription{}
-	tfd.timer = clock.NewTimer(tfd)
+	tfd := &TimerFileDescription{clock: clock}
+	tfd.timer = ktime.NewSampledTimer(clock, tfd)
 	if err := tfd.vfsfd.Init(tfd, flags, auth.CredentialsFromContext(ctx), vd.Mount(), vd.Dentry(), &vfs.FileDescriptionOptions{
 		UseDentryMetadata: true,
 		DenyPRead:         true,
@@ -84,9 +89,9 @@ func (tfd *TimerFileDescription) Read(ctx context.Context, dst usermem.IOSequenc
 	return 0, linuxerr.ErrWouldBlock
 }
 
-// Clock returns the timer fd's Clock.
-func (tfd *TimerFileDescription) Clock() ktime.Clock {
-	return tfd.timer.Clock()
+// Clock returns the Clock that the timer fd was created with.
+func (tfd *TimerFileDescription) Clock() ktime.SampledClock {
+	return tfd.clock
 }
 
 // GetTime returns the associated Timer's setting and the time at which it was
@@ -95,11 +100,11 @@ func (tfd *TimerFileDescription) GetTime() (ktime.Time, ktime.Setting) {
 	return tfd.timer.Get()
 }
 
-// SetTime atomically changes the associated Timer's setting, resets the number
-// of expirations to 0, and returns the previous setting and the time at which
-// it was observed.
-func (tfd *TimerFileDescription) SetTime(s ktime.Setting) (ktime.Time, ktime.Setting) {
-	return tfd.timer.Set(s, func() { tfd.val.Store(0) })
+// SetTime atomically changes the associated Timer's setting, and the clock it
+// runs on to c, resets the number of expirations to 0, and returns the
+// previous setting and the time at which it was observed.
+func (tfd *TimerFileDescription) SetTime(c ktime.SampledClock, s ktime.Setting) (ktime.Time, ktime.Setting) {
+	return tfd.timer.SetWithClock(c, s, func() { tfd.val.Store(0) })
 }
 
 // Readiness implements waiter.Waitable.Readiness.
 
@@ -454,6 +454,7 @@ go_test(
         "//pkg/context",
         "//pkg/errors/linuxerr",
         "//pkg/hostarch",
+        "//pkg/safemem",
         "//pkg/sentry/arch",
         "//pkg/sentry/checkpoint",
         "//pkg/sentry/contexttest",
 
@@ -2209,6 +2209,11 @@ func (k *Kernel) MonotonicClock() ktime.SampledClock {
 	return k.timekeeper.monotonicClock
 }
 
+// BoottimeClock returns the application CLOCK_BOOTTIME clock.
+func (k *Kernel) BoottimeClock() ktime.SampledClock {
+	return k.timekeeper.boottimeClock
+}
+
 // MonotonicRawClock returns the system CLOCK_MONOTONIC_RAW clock. When it is
 // not enabled as a distinct clock this is the same as MonotonicClock.
 func (k *Kernel) MonotonicRawClock() ktime.SampledClock {
 
@@ -29,6 +29,11 @@ import (
 type IntervalTimer struct {
 	timer ktime.Timer
 
+	// clock is the clock that the timer was created with. timer runs on
+	// clock, except when it is armed with a relative CLOCK_REALTIME time (see
+	// Task.IntervalTimerSettime). clock is immutable.
+	clock ktime.Clock
+
 	// If target is not nil, it receives signo from timer expirations. If group
 	// is true, these signals are thread-group-directed. These fields are
 	// immutable.
@@ -189,6 +194,7 @@ func (t *Task) IntervalTimerCreate(c ktime.Clock, sigev *linux.Sigevent) (linux.
 
 	// Construct the timer.
 	it := &IntervalTimer{
+		clock:  c,
 		id:     id,
 		sigval: sigev.Value,
 	}
@@ -246,11 +252,28 @@ func (t *Task) IntervalTimerSettime(id linux.TimerID, its linux.Itimerspec, abs
 		return linux.Itimerspec{}, linuxerr.EINVAL
 	}
 
-	newS, err := ktime.SettingFromItimerspec(its, abs, it.timer.Clock())
+	// As on Linux, relative CLOCK_REALTIME timers run on CLOCK_MONOTONIC, so
+	// that discontinuous changes to the realtime clock, such as its jump
+	// forward on restore, do not change their duration.
+	c := it.clock
+	if !abs && c == t.k.RealtimeClock() {
+		c = t.k.MonotonicClock()
+	}
+	newS, err := ktime.SettingFromItimerspec(its, abs, c)
 	if err != nil {
 		return linux.Itimerspec{}, err
 	}
-	tm, oldS := it.timer.Set(newS, it.timerSettingChanged)
+	var (
+		tm   ktime.Time
+		oldS ktime.Setting
+	)
+	if c == it.timer.Clock() {
+		tm, oldS = it.timer.Set(newS, it.timerSettingChanged)
+	} else {
+		// Only CLOCK_REALTIME timers change clocks, and timers on the
+		// Timekeeper's clocks are SampledTimers.
+		tm, oldS = it.timer.(*ktime.SampledTimer).SetWithClock(c.(ktime.SampledClock), newS, it.timerSettingChanged)
+	}
 	its = ktime.ItimerspecFromSetting(tm, oldS)
 	return its, nil
 }