[PATCH v5 0/3] rust: time: fix Delta arithmetic and add math helpers

[chenhan <chenhan0017.work@gmail.com>]

This series fixes the architecture-dependent handling of invalid Delta
division and remainder inputs, then moves the integer operations into a
math module with Delta as its initial user.

V5 addresses Andreas's review [2] of v4 [1]:
- In patch 2, make the SAFETY comments cite the preceding zero-divisor
  check as establishing the non-zero divisor required by the C call.
- Keep the remainder output-pointer explanation and carry the same
  comments into the math helpers in patch 3.

The MIN/-1 checks remain for Rust's panic semantics. There are no changes
to executable code, public APIs or panic conditions relative to v4.
Patch 1 is unchanged and retains Tomonori's Reviewed-by. Patch 3 still
awaits review of the tuple-returning interface introduced in v4.
A range-diff against v4 follows below.

Patches 1 and 2 form the stable candidate pair: the parameter rename is
a prerequisite for the behavior fix. Patch 3 introduces the math module
separately and is not intended for stable.

The base remains timekeeping-next at
2ea0119f72dba597aa8a98cbdb72c564bfc5cb38, unchanged on October 31.
On rust-next at d89e1d186ec9271bf78e62771779e9fc03bf0fc3,
patches 1 and 2 apply unchanged; patch 3 needs its lib.rs registration
placed between maple_tree and mem. This was checked for application
only; the runtime validation below used the declared base.

Tomonori's PWM series [3] also introduces rust/kernel/math.rs, with
unsigned helpers. The module header is shared, and the signed and
unsigned helpers are complementary. Whichever series is applied later
will need a small rebase to keep one module declaration and header.
Neither series is present in the above branch tips as of this posting.

V5 passes rustfmt and whitespace checks. Applying the exported patches
reproduces each commit tree; the affected source at each series prefix
is identical to v4 after excluding comments. QEMU was not rerun for
this comment-only revision. V4 validation on x86-64 and ARMv7, with
Rust overflow checks enabled and disabled, passed all 36 boots,
400 valid calls, 496 scalar comparisons and 32 expected panics. V4 also
passed rustdoc generation on both architectures. Those results are
unchanged evidence from v4, not new v5 runs; details are in [1].

[1] https://lore.kernel.org/rust-for-linux/20261023130413.178487-1-chenhan0017.work@gmail.com/
[2] https://lore.kernel.org/rust-for-linux/87bj8goc6x.fsf@t14s.mail-host-address-is-not-set/
[3] https://lore.kernel.org/rust-for-linux/20261030020209.3833766-1-tomo@flapping.org/

chenhan (3):
  rust: time: rename the rem_nanos() divisor
  rust: time: make Delta division and remainder fail consistently
  rust: math: add signed division and remainder helpers

 rust/kernel/lib.rs  |  1 +
 rust/kernel/math.rs | 71 +++++++++++++++++++++++++++++++++++++++++++++
 rust/kernel/time.rs | 47 ++++++++++--------------------
 3 files changed, 88 insertions(+), 31 deletions(-)
 create mode 100644 rust/kernel/math.rs


base-commit: 2ea0119f72dba597aa8a98cbdb72c564bfc5cb38

Range-diff against v4:
1:  ed93030078ac = 1:  ed93030078ac rust: time: rename the rem_nanos() divisor
2:  ff344561eebb ! 2:  fdbb042d5743 rust: time: make Delta division and remainder fail consistently
    @@ rust/kernel/time.rs: fn div(self, rhs: Self) -> Self::Output {
              #[cfg(not(CONFIG_64BIT))]
              {
     -            // SAFETY: This function is always safe to call regardless of the input values
    -+            // SAFETY: The checks above exclude a zero divisor and `i64::MIN / -1`.
    ++            // SAFETY: `rhs.value` is non-zero due to the check above.
                  unsafe { bindings::div64_s64(self.value, rhs.value) }
              }
          }
    @@ rust/kernel/time.rs: pub fn rem_nanos(self, divisor: i32) -> Self {
                  let mut rem = 0;
      
     -            // SAFETY: `rem` is in the stack, so we can always provide a valid pointer to it.
    -+            // SAFETY: The checks above exclude a zero divisor and `i64::MIN / -1`.
    ++            // SAFETY: `divisor` is non-zero due to the check above.
     +            // `&mut rem` provides a valid, aligned, writable pointer for this call.
                  unsafe { bindings::div_s64_rem(self.as_nanos(), divisor, &mut rem) };
      
3:  63d7f5dd76f7 ! 3:  79891109d486 rust: math: add signed division and remainder helpers
    @@ rust/kernel/math.rs (new)
     +
     +    #[cfg(not(CONFIG_64BIT))]
     +    {
    -+        // SAFETY: The checks above exclude a zero divisor and `i64::MIN / -1`.
    ++        // SAFETY: `divisor` is non-zero due to the check above.
     +        unsafe { bindings::div64_s64(dividend, divisor) }
     +    }
     +}
    @@ rust/kernel/math.rs (new)
     +    {
     +        let mut remainder = 0;
     +
    -+        // SAFETY: The checks above exclude a zero divisor and `i64::MIN / -1`.
    ++        // SAFETY: `divisor` is non-zero due to the check above.
     +        // `&mut remainder` provides a valid, aligned, writable pointer for this call.
     +        let quotient = unsafe { bindings::div_s64_rem(dividend, divisor, &mut remainder) };
     +
    @@ rust/kernel/time.rs: impl ops::Div for Delta {
     -
     -        #[cfg(not(CONFIG_64BIT))]
     -        {
    --            // SAFETY: The checks above exclude a zero divisor and `i64::MIN / -1`.
    +-            // SAFETY: `rhs.value` is non-zero due to the check above.
     -            unsafe { bindings::div64_s64(self.value, rhs.value) }
     -        }
     +        math::div64_s64(self.value, rhs.value)
    @@ rust/kernel/time.rs: pub fn to_jiffies_timeout(self) -> Delta<Jiffy> {
     -        {
     -            let mut rem = 0;
     -
    --            // SAFETY: The checks above exclude a zero divisor and `i64::MIN / -1`.
    +-            // SAFETY: `divisor` is non-zero due to the check above.
     -            // `&mut rem` provides a valid, aligned, writable pointer for this call.
     -            unsafe { bindings::div_s64_rem(self.as_nanos(), divisor, &mut rem) };
     -
-- 
2.34.1