[PATCH v4 0/2] Add Delta::to_jiffies_timeout()

[PATCH v4 0/2] Add Delta::to_jiffies_timeout()

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

The first patch makes bindings::HZ resolve to CONFIG_HZ.

The second patch was previously posted as patch 4 of [1]; patches 1-3
of that series have been applied. It has been reworked.

[1] https://lore.kernel.org/rust-for-linux/20260808062839.1159990-1-tomo@flapping.org/

---
v4:
- Use i64::max() and u64::min() instead of the method call syntax (Gary)
- Add Reviewed-by from Gary
v3: https://lore.kernel.org/rust-for-linux/20260908230445.2430296-1-tomo@flapping.org/
- Add the first patch to set bindings::HZ to CONFIG_HZ.
- Drop the CONFIG_HZ workaround.
v2: https://lore.kernel.org/rust-for-linux/20260907123524.2332118-1-tomo@flapping.org/
- Use mul_u64_add_u64_div_u64() instead of __msecs_to_jiffies().
- Dropped the as_millis_ceil() example and KUnit test patch; the conversion
  no longer uses as_millis_ceil(). Will send it separately.
v1: https://lore.kernel.org/rust-for-linux/20260811150147.1360102-1-tomo@flapping.org/

FUJITA Tomonori (2):
  rust: bindings: set HZ to CONFIG_HZ
  rust: time: add Delta::to_jiffies_timeout() for timeout conversion

 rust/bindings/lib.rs     |   5 ++
 rust/helpers/helpers.c   |   1 +
 rust/helpers/math.c      |   8 +++
 rust/kernel/Kconfig.test |  10 ++++
 rust/kernel/time.rs      | 105 +++++++++++++++++++++++++++++++++++++++
 5 files changed, 129 insertions(+)
 create mode 100644 rust/helpers/math.c


base-commit: 93f51579e7df248780214094418f205253383cc5
-- 
2.43.0

[PATCH v4 1/2] rust: bindings: set HZ to CONFIG_HZ

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

include/uapi/asm-generic/param.h defines HZ as __USER_HZ and
include/asm-generic/param.h then sets it to CONFIG_HZ. bindgen keeps the
first definition of a macro and ignores a later #undef, so the generated
binding is __USER_HZ.

Redefine HZ in rust/bindings/lib.rs, the same way compat_ptr_ioctl is
redefined there. Nothing in the tree reads bindings::HZ today, so this
prevents accidental misuse rather than fixing a bug.

Suggested-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
---
 rust/bindings/lib.rs | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/rust/bindings/lib.rs b/rust/bindings/lib.rs
index 439ab88a5da1..98313fc31024 100644
--- a/rust/bindings/lib.rs
+++ b/rust/bindings/lib.rs
@@ -83,3 +83,8 @@ mod bindings_helper {
         None
     }
 };
+
+// `bindgen` keeps the first definition of a macro and ignores a later `#undef`.
+// The generated `HZ` is therefore `__USER_HZ` from
+// `include/uapi/asm-generic/param.h`, not `CONFIG_HZ`.
+pub const HZ: u32 = CONFIG_HZ;
-- 
2.43.0

[PATCH v4 2/2] rust: time: add Delta::to_jiffies_timeout() for timeout conversion

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

The boundaries of __msecs_to_jiffies() and nsecs_to_jiffies64() depend
on which HZ branch is compiled. With CONFIG_HZ_300
nsecs_to_jiffies64() overflows after 64.99 years, which is less than
the 292 years a Delta can hold. With HZ=1000 a jiffy is a millisecond,
so __msecs_to_jiffies() returns its argument unchanged and never caps
it at MAX_JIFFY_OFFSET.

Compute the conversion in Rust with mul_u64_add_u64_div_u64() instead. It
returns (a * b + c) / d, computing a * b internally in 128 bits, so
ceil(nanos * HZ / NSEC_PER_SEC) needs no input clamp and rounds once. The
bound then follows from the arithmetic: with HZ <= NSEC_PER_SEC, which a
static_assert() checks, the result is at most the nanosecond count.

Unless the result saturates, the value is rounded up, so the timeout is
never shorter than the requested span. It saturates at zero jiffies for a
negative span, i.e. an immediate timeout, and at MAX_JIFFY_OFFSET, the
upper bound the kernel uses for a jiffies span. Since MAX_JIFFY_OFFSET is
derived from long, only 32 bit can reach it, and a saturated timeout there
is finite, so it can be shorter than the requested span.

Reviewed-by: Gary Guo <gary@garyguo.net>
Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
---
 rust/helpers/helpers.c   |   1 +
 rust/helpers/math.c      |   8 +++
 rust/kernel/Kconfig.test |  10 ++++
 rust/kernel/time.rs      | 105 +++++++++++++++++++++++++++++++++++++++
 4 files changed, 124 insertions(+)
 create mode 100644 rust/helpers/math.c

diff --git a/rust/helpers/helpers.c b/rust/helpers/helpers.c
index 440fb7638e3c..08374b163774 100644
--- a/rust/helpers/helpers.c
+++ b/rust/helpers/helpers.c
@@ -73,6 +73,7 @@
 #include "kunit.c"
 #include "list.c"
 #include "maple_tree.c"
+#include "math.c"
 #include "mm.c"
 #include "mutex.c"
 #include "net/genetlink.c"
diff --git a/rust/helpers/math.c b/rust/helpers/math.c
new file mode 100644
index 000000000000..e2ee29bcce0f
--- /dev/null
+++ b/rust/helpers/math.c
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0
+
+#include <linux/math64.h>
+
+__rust_helper u64 rust_helper_mul_u64_add_u64_div_u64(u64 a, u64 b, u64 c, u64 d)
+{
+	return mul_u64_add_u64_div_u64(a, b, c, d);
+}
diff --git a/rust/kernel/Kconfig.test b/rust/kernel/Kconfig.test
index e6a5c7a795f0..0087749995d2 100644
--- a/rust/kernel/Kconfig.test
+++ b/rust/kernel/Kconfig.test
@@ -83,4 +83,14 @@ config RUST_BITFIELD_KUNIT_TEST
 
 	  If unsure, say N.
 
+config RUST_TIME_KUNIT_TEST
+	bool "KUnit tests for the Rust time API" if !KUNIT_ALL_TESTS
+	default KUNIT_ALL_TESTS
+	help
+	  This option enables KUnit tests for the Rust time API.
+	  These are only for development and testing, not for regular
+	  kernel use cases.
+
+	  If unsure, say N.
+
 endif
diff --git a/rust/kernel/time.rs b/rust/kernel/time.rs
index 6c0a5e8090d0..6f50a1ec680e 100644
--- a/rust/kernel/time.rs
+++ b/rust/kernel/time.rs
@@ -39,6 +39,10 @@
 /// The number of nanoseconds per second.
 pub const NSEC_PER_SEC: i64 = bindings::NSEC_PER_SEC as i64;
 
+/// The C side `MAX_JIFFY_OFFSET`, i.e. `((LONG_MAX >> 1) - 1)`. It is the upper
+/// bound the kernel uses for a jiffies span, not a wait-forever value.
+const MAX_JIFFY_OFFSET: isize = (isize::MAX >> 1) - 1;
+
 /// The time unit of Linux kernel. One jiffy equals (1/HZ) second.
 pub type Jiffies = crate::ffi::c_ulong;
 
@@ -554,6 +558,62 @@ pub fn as_millis_ceil(self) -> i64 {
         }
     }
 
+    /// Convert this span to a [`Delta<Jiffy>`] suitable for use as a timeout.
+    ///
+    /// Unless the result saturates, the value is rounded up to the next whole
+    /// jiffy, so the resulting timeout is never shorter than `self`.
+    ///
+    /// A negative span saturates at zero jiffies, i.e. an immediate timeout.
+    ///
+    /// A span that does not fit saturates at the kernel's [`MAX_JIFFY_OFFSET`],
+    /// the upper bound for a jiffies span. That is a finite timeout, so a
+    /// saturated result can be shorter than the requested span. It is derived
+    /// from `long`, so only 32 bit can reach it, at about 12 days with `HZ=1000`.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use kernel::time::Delta;
+    ///
+    /// // A negative span is an immediate timeout.
+    /// assert_eq!(Delta::from_millis(-1).to_jiffies_timeout().as_jiffies(), 0);
+    ///
+    /// // A span shorter than a jiffy still waits, i.e. the timeout is never
+    /// // shorter than the span.
+    /// assert!(Delta::from_nanos(1).to_jiffies_timeout().as_jiffies() >= 1);
+    /// ```
+    ///
+    /// [`MAX_JIFFY_OFFSET`]: srctree/include/linux/jiffies.h
+    #[inline]
+    pub fn to_jiffies_timeout(self) -> Delta<Jiffy> {
+        const HZ: u64 = bindings::HZ as u64;
+
+        // The quotient `(nsecs * HZ + NSEC_PER_SEC - 1) / NSEC_PER_SEC` has to fit in
+        // `u64`; `nsecs * HZ` does not. With `HZ <= NSEC_PER_SEC` the numerator is at
+        // most `(nsecs + 1) * NSEC_PER_SEC - 1`, so the quotient is at most `nsecs`.
+        crate::static_assert!(HZ <= NSEC_PER_SEC as u64);
+
+        // CAST: `i64::max()` makes the value non-negative, so the cast keeps it.
+        let nsecs = i64::max(self.as_nanos(), 0) as u64;
+
+        // SAFETY: `mul_u64_add_u64_div_u64()` must not be called with a zero divisor,
+        // and its result must fit in `u64`. `NSEC_PER_SEC` is a non-zero constant, and
+        // the assertion above bounds the quotient by `nsecs`.
+        let jiffies = unsafe {
+            bindings::mul_u64_add_u64_div_u64(
+                nsecs,
+                HZ,
+                (NSEC_PER_SEC - 1) as u64,
+                NSEC_PER_SEC as u64,
+            )
+        };
+
+        // CAST: `jiffies` is clamped to `MAX_JIFFY_OFFSET`, which is `<= isize::MAX`.
+        let jiffies = u64::min(jiffies, MAX_JIFFY_OFFSET as u64) as isize;
+
+        Delta::<Jiffy>::from_jiffies(jiffies)
+    }
+
     /// Return `self % dividend` where `dividend` is in nanoseconds.
     ///
     /// The kernel doesn't have any emulation for `s64 % s64` on 32 bit platforms, so this is
@@ -580,3 +640,48 @@ pub fn rem_nanos(self, dividend: i32) -> Self {
         }
     }
 }
+
+#[cfg(CONFIG_RUST_TIME_KUNIT_TEST)]
+#[macros::kunit_tests(rust_kernel_time)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn to_jiffies_timeout_converts() {
+        const HZ: isize = bindings::HZ as isize;
+
+        // One second is exactly `HZ` jiffies, and the round-up must not add one.
+        assert_eq!(Delta::from_secs(1).to_jiffies_timeout().as_jiffies(), HZ);
+
+        // One nanosecond more has to round up to the next whole jiffy.
+        assert_eq!(
+            Delta::from_nanos(NSEC_PER_SEC + 1)
+                .to_jiffies_timeout()
+                .as_jiffies(),
+            HZ + 1
+        );
+    }
+
+    #[test]
+    fn to_jiffies_timeout_saturates() {
+        // The result never exceeds `MAX_JIFFY_OFFSET`. On 32 bit with `HZ=1000` this
+        // span is 2147483647 jiffies, so the clamp is what keeps it in range; on 64
+        // bit it fits and the check holds for every possible return value.
+        let clamped = Delta::from_millis(i64::from(i32::MAX)).to_jiffies_timeout();
+        assert!(clamped.as_jiffies() <= MAX_JIFFY_OFFSET);
+
+        // `MAX_JIFFY_OFFSET` is derived from `long`, so only 32 bit can reach it. On
+        // 64 bit `i64::MAX` nanoseconds is about 292 years, which is 9223372036855
+        // jiffies with `HZ=1000`, far below the limit.
+        #[cfg(not(CONFIG_64BIT))]
+        {
+            // An overlong span is clamped to `MAX_JIFFY_OFFSET`.
+            let overlong = Delta::from_nanos(i64::MAX).to_jiffies_timeout();
+            assert_eq!(overlong.as_jiffies(), MAX_JIFFY_OFFSET);
+        }
+
+        // A negative span is an immediate timeout, however long it is.
+        let negative = Delta::from_nanos(i64::MIN).to_jiffies_timeout();
+        assert_eq!(negative.as_jiffies(), 0);
+    }
+}
-- 
2.43.0

Re: [PATCH v4 2/2] rust: time: add Delta::to_jiffies_timeout() for timeout conversion

[Andreas Hindborg]

"FUJITA Tomonori" <tomo@flapping.org> writes:

> From: FUJITA Tomonori <fujita.tomonori@gmail.com>
>
> The boundaries of __msecs_to_jiffies() and nsecs_to_jiffies64() depend
> on which HZ branch is compiled. With CONFIG_HZ_300
> nsecs_to_jiffies64() overflows after 64.99 years, which is less than
> the 292 years a Delta can hold. With HZ=1000 a jiffy is a millisecond,
> so __msecs_to_jiffies() returns its argument unchanged and never caps
> it at MAX_JIFFY_OFFSET.
>
> Compute the conversion in Rust with mul_u64_add_u64_div_u64() instead. It
> returns (a * b + c) / d, computing a * b internally in 128 bits, so
> ceil(nanos * HZ / NSEC_PER_SEC) needs no input clamp and rounds once. The
> bound then follows from the arithmetic: with HZ <= NSEC_PER_SEC, which a
> static_assert() checks, the result is at most the nanosecond count.
>
> Unless the result saturates, the value is rounded up, so the timeout is
> never shorter than the requested span. It saturates at zero jiffies for a
> negative span, i.e. an immediate timeout, and at MAX_JIFFY_OFFSET, the
> upper bound the kernel uses for a jiffies span. Since MAX_JIFFY_OFFSET is
> derived from long, only 32 bit can reach it, and a saturated timeout there
> is finite, so it can be shorter than the requested span.
>
> Reviewed-by: Gary Guo <gary@garyguo.net>
> Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
> ---
>  rust/helpers/helpers.c   |   1 +
>  rust/helpers/math.c      |   8 +++
>  rust/kernel/Kconfig.test |  10 ++++
>  rust/kernel/time.rs      | 105 +++++++++++++++++++++++++++++++++++++++
>  4 files changed, 124 insertions(+)
>  create mode 100644 rust/helpers/math.c
>
> diff --git a/rust/helpers/helpers.c b/rust/helpers/helpers.c
> index 440fb7638e3c..08374b163774 100644
> --- a/rust/helpers/helpers.c
> +++ b/rust/helpers/helpers.c
> @@ -73,6 +73,7 @@
>  #include "kunit.c"
>  #include "list.c"
>  #include "maple_tree.c"
> +#include "math.c"
>  #include "mm.c"
>  #include "mutex.c"
>  #include "net/genetlink.c"
> diff --git a/rust/helpers/math.c b/rust/helpers/math.c
> new file mode 100644
> index 000000000000..e2ee29bcce0f
> --- /dev/null
> +++ b/rust/helpers/math.c
> @@ -0,0 +1,8 @@
> +// SPDX-License-Identifier: GPL-2.0
> +
> +#include <linux/math64.h>
> +
> +__rust_helper u64 rust_helper_mul_u64_add_u64_div_u64(u64 a, u64 b, u64 c, u64 d)
> +{
> +	return mul_u64_add_u64_div_u64(a, b, c, d);
> +}
> diff --git a/rust/kernel/Kconfig.test b/rust/kernel/Kconfig.test
> index e6a5c7a795f0..0087749995d2 100644
> --- a/rust/kernel/Kconfig.test
> +++ b/rust/kernel/Kconfig.test
> @@ -83,4 +83,14 @@ config RUST_BITFIELD_KUNIT_TEST
>
>  	  If unsure, say N.
>
> +config RUST_TIME_KUNIT_TEST
> +	bool "KUnit tests for the Rust time API" if !KUNIT_ALL_TESTS
> +	default KUNIT_ALL_TESTS
> +	help
> +	  This option enables KUnit tests for the Rust time API.
> +	  These are only for development and testing, not for regular
> +	  kernel use cases.
> +
> +	  If unsure, say N.

Why would you gate out the tests? They do not look like they take long
to run or anything.


Best regards,
Andreas Hindborg

Re: [PATCH v4 2/2] rust: time: add Delta::to_jiffies_timeout() for timeout conversion

[FUJITA Tomonori]

On Fri, 25 Sep 2026 10:00:19 +0200
Andreas Hindborg <a.hindborg@kernel.org> wrote:

>> diff --git a/rust/kernel/Kconfig.test b/rust/kernel/Kconfig.test
>> index e6a5c7a795f0..0087749995d2 100644
>> --- a/rust/kernel/Kconfig.test
>> +++ b/rust/kernel/Kconfig.test
>> @@ -83,4 +83,14 @@ config RUST_BITFIELD_KUNIT_TEST
>>
>>  	  If unsure, say N.
>>
>> +config RUST_TIME_KUNIT_TEST
>> +	bool "KUnit tests for the Rust time API" if !KUNIT_ALL_TESTS
>> +	default KUNIT_ALL_TESTS
>> +	help
>> +	  This option enables KUnit tests for the Rust time API.
>> +	  These are only for development and testing, not for regular
>> +	  kernel use cases.
>> +
>> +	  If unsure, say N.
> 
> Why would you gate out the tests? They do not look like they take long
> to run or anything.

Documentation/rust/testing.rst says:

  Each test suite should be guarded by a Kconfig option in
  ``rust/kernel/Kconfig.test``.

I think that the reason is the kernel image size. From commit
e74b7a3f5aee ("rust: tests: add Kconfig for KUnit test"):

  All the tests are compiled unconditionally now, which adds ~200 kB to
  the kernel image for me on x86_64. As Rust matures, this bloating will
  inevitably grow.

Re: [PATCH v4 2/2] rust: time: add Delta::to_jiffies_timeout() for timeout conversion

[Miguel Ojeda]

On Fri, Sep 25, 2026 at 11:39 AM FUJITA Tomonori <tomo@flapping.org> wrote:
>
> I think that the reason is the kernel image size. From commit
> e74b7a3f5aee ("rust: tests: add Kconfig for KUnit test"):
>
>   All the tests are compiled unconditionally now, which adds ~200 kB to
>   the kernel image for me on x86_64. As Rust matures, this bloating will
>   inevitably grow.

Quick note on that commit: it wasn't really "unconditional", i.e. one
could still disable KUnit or make it `m` (I should have probably added
a note to that commit message...). But some maintainers prefer
fine-grained options, which is reasonable (though overdoing it may
mean a lot of Kconfig options that most users do not care about).

Cheers,
Miguel

Re: [PATCH v4 2/2] rust: time: add Delta::to_jiffies_timeout() for timeout conversion

[Andreas Hindborg]

Miguel Ojeda <miguel.ojeda.sandonis@gmail.com> writes:

> On Fri, Sep 25, 2026 at 11:39 AM FUJITA Tomonori <tomo@flapping.org> wrote:
>>
>> I think that the reason is the kernel image size. From commit
>> e74b7a3f5aee ("rust: tests: add Kconfig for KUnit test"):
>>
>>   All the tests are compiled unconditionally now, which adds ~200 kB to
>>   the kernel image for me on x86_64. As Rust matures, this bloating will
>>   inevitably grow.
>
> Quick note on that commit: it wasn't really "unconditional", i.e. one
> could still disable KUnit or make it `m` (I should have probably added
> a note to that commit message...). But some maintainers prefer
> fine-grained options, which is reasonable (though overdoing it may
> mean a lot of Kconfig options that most users do not care about).

I would prefer to just enable the tests as soon as kunit is enabled if
that is OK.

Best regards,
Andreas Hindborg

Re: [PATCH v4 2/2] rust: time: add Delta::to_jiffies_timeout() for timeout conversion

[Miguel Ojeda]

On Mon, Sep 28, 2026 at 11:37 AM Andreas Hindborg <a.hindborg@kernel.org> wrote:
>
> I would prefer to just enable the tests as soon as kunit is enabled if
> that is OK.

Let me Cc David (and Yury) to see what he thinks -- the kernel
probably wants to have at least a Kconfig for each test rather than
having a default set that gets always enabled as soon as KUnit test, I
think the question is mostly about how "wide" to make those Kconfigs.

Cheers,
Miguel

Re: [PATCH v4 2/2] rust: time: add Delta::to_jiffies_timeout() for timeout conversion

[Andreas Hindborg]

"Miguel Ojeda" <miguel.ojeda.sandonis@gmail.com> writes:

> On Mon, Sep 28, 2026 at 11:37 AM Andreas Hindborg <a.hindborg@kernel.org> wrote:
>>
>> I would prefer to just enable the tests as soon as kunit is enabled if
>> that is OK.
>
> Let me Cc David (and Yury) to see what he thinks -- the kernel
> probably wants to have at least a Kconfig for each test rather than
> having a default set that gets always enabled as soon as KUnit test, I
> think the question is mostly about how "wide" to make those Kconfigs.

I'm used to having all the rust tests enabled when I hack on rust stuff.
I would rather not have to go flick a ton of switches to enable all the
stuff.

I think that most users that enable rust+kunit will be fine with
enabling all rust kunit tests. I understand that there may be
environments like embedded platforms where this is not feasible. Could
we invert the situation so that we have one toggle to enable all our
tests but make it possible to opt out of this behavior?

RUST=y
KUNIT=y
RUST_ALL_KUNIT_TESTS=y

That would be great.

Best regards,
Andreas Hindborg

Re: [PATCH v4 0/2] Add Delta::to_jiffies_timeout()

[Andreas Hindborg]

On Fri, 25 Sep 2026 08:25:28 +0900, FUJITA Tomonori wrote:
> From: FUJITA Tomonori <fujita.tomonori@gmail.com>
> 
> The first patch makes bindings::HZ resolve to CONFIG_HZ.
> 
> The second patch was previously posted as patch 4 of [1]; patches 1-3
> of that series have been applied. It has been reworked.
> 
> [...]

Applied, thanks!

[1/2] rust: bindings: set HZ to CONFIG_HZ
      commit: 4ebfdb2c8b28eb8ef85b4e4ce65e55bd5a4df8d5
[2/2] rust: time: add Delta::to_jiffies_timeout() for timeout conversion
      commit: a9aba476d42df2537403f97f185a2b1979d0dd97

Best regards,
-- 
Andreas Hindborg <a.hindborg@kernel.org>