[PATCH v2 0/4] rust: use Delta instead of raw jiffies for timeouts and delays

[PATCH v2 0/4] rust: use Delta instead of raw jiffies for timeouts and delays

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

CondVar::wait_interruptible_timeout() and Queue::enqueue_delayed() use
a raw jiffies count (a plain c_ulong alias with no type
safety). Callers have to know on their own that the value meant
jiffies and convert to/from it themselves, which is easy to get wrong
(e.g. passing a millisecond value where a jiffies value is expected).

Both APIs just take a span of time so, they can use the Delta type
instead. Jiffies are just another time unit, like milliseconds or
nanoseconds.

This series adds jiffies conversion helpers to Delta, switches
CondVar and Queue to use Delta instead of raw jiffies (updating
binder's ioctl_freeze(), the only caller of
wait_interruptible_timeout()), and then removes the now-unused
Jiffies and Msecs type aliases.

v2:
- Fix potential overflow in from_jiffies()
- Fix inflating bug in as_jiffies_ceil()
- Add a patch to convert enqueue_delayed()
- Add a patch to remove Jiffies/Msecs aliases
v1: https://lore.kernel.org/rust-for-linux/20260704132558.2253275-1-tomo@aliasing.net/

FUJITA Tomonori (4):
  rust: time: add jiffies conversion helpers to Delta
  rust: sync: use Delta for CondVar timeout API
  rust: workqueue: use Delta for enqueue_delayed's delay parameter
  rust: time: remove unused Jiffies/Msecs helpers

 drivers/android/binder/process.rs | 12 ++++-----
 rust/kernel/sync/condvar.rs       | 20 ++++++++------
 rust/kernel/time.rs               | 44 +++++++++++++++++++++----------
 rust/kernel/workqueue.rs          |  6 ++---
 4 files changed, 51 insertions(+), 31 deletions(-)


base-commit: 0e35b9b6ec0ffcc5e23cbdec09f5c622ad532b53
-- 
2.43.0

[PATCH v2 1/4] rust: time: add jiffies conversion helpers to Delta

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

Callers that hand a timeout to some C APIs need conversion between
Delta and jiffies.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
---
 rust/kernel/time.rs | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/rust/kernel/time.rs b/rust/kernel/time.rs
index 363e93cbb139..cd054ea5df02 100644
--- a/rust/kernel/time.rs
+++ b/rust/kernel/time.rs
@@ -377,6 +377,20 @@ impl Delta {
     /// A span of time equal to zero.
     pub const ZERO: Self = Self { nanos: 0 };
 
+    /// Create a new [`Delta`] from a number of jiffies.
+    ///
+    /// If `jiffies` is large enough that the corresponding number of nanoseconds
+    /// would overflow an `i64`, the result saturates to `i64::MAX` nanoseconds.
+    /// The exact threshold depends on `CONFIG_HZ`.
+    #[inline]
+    pub fn from_jiffies(jiffies: u64) -> Self {
+        let nanos = (u128::from(jiffies) * NSEC_PER_SEC as u128 / u128::from(bindings::HZ))
+            .min(i64::MAX as u128);
+        Self {
+            nanos: nanos as i64,
+        }
+    }
+
     /// Create a new [`Delta`] from a number of nanoseconds.
     #[inline]
     pub const fn from_nanos(nanos: i64) -> Self {
@@ -431,6 +445,22 @@ pub fn is_negative(self) -> bool {
         self.as_nanos() < 0
     }
 
+    /// Return the smallest number of jiffies greater than or equal
+    /// to the value in the [`Delta`].
+    ///
+    /// If the value is negative, `0` is returned.
+    #[inline]
+    pub fn as_jiffies_ceil(self) -> crate::ffi::c_ulong {
+        // Mirrors `MAX_JIFFY_OFFSET` in C side. bindgen doesn't generate a constant for it
+        // since it's a compound expression rather than a plain integer literal.
+        const MAX_JIFFY_OFFSET: u128 = ((crate::ffi::c_long::MAX >> 1) - 1) as u128;
+
+        let nanos = self.as_nanos().max(0) as u128;
+        let jiffies = (nanos * u128::from(bindings::HZ)).div_ceil(NSEC_PER_SEC as u128);
+
+        jiffies.min(MAX_JIFFY_OFFSET) as crate::ffi::c_ulong
+    }
+
     /// Return the number of nanoseconds in the [`Delta`].
     #[inline]
     pub const fn as_nanos(self) -> i64 {
-- 
2.43.0

[PATCH v2 2/4] rust: sync: use Delta for CondVar timeout API

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

wait_interruptible_timeout() and CondVarTimeoutResult take/return a
raw jiffies count (a plain c_ulong alias with no type safety). Callers
have to know on their own that the value meant jiffies and convert
to/from it themselves, which is easy to get wrong (e.g. passing a
millisecond value where a jiffies value is expected).

Switch to Delta, the duration type already used elsewhere, so the unit
is part of the type instead of a caller convention.

Use as_jiffies_ceil() rather than a plain truncating conversion: a
caller that passes a nonzero Delta expects the call to actually sleep
for roughly that long (or return earlier via a wakeup or signal).

Update binder's ioctl_freeze(), the only caller, accordingly.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
---
 drivers/android/binder/process.rs | 12 ++++++------
 rust/kernel/sync/condvar.rs       | 20 ++++++++++++--------
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/drivers/android/binder/process.rs b/drivers/android/binder/process.rs
index 96b8440ceac6..cc693484489a 100644
--- a/drivers/android/binder/process.rs
+++ b/drivers/android/binder/process.rs
@@ -1468,25 +1468,25 @@ pub(crate) fn ioctl_freeze(&self, info: &BinderFreezeInfo) -> Result {
         inner.is_frozen = IsFrozen::InProgress;
 
         if info.timeout_ms > 0 {
-            let mut jiffies = kernel::time::msecs_to_jiffies(info.timeout_ms);
-            while jiffies > 0 {
+            let mut delta = kernel::time::Delta::from_millis(info.timeout_ms.into());
+            while !delta.is_zero() {
                 if inner.outstanding_txns == 0 {
                     break;
                 }
 
                 match self
                     .freeze_wait
-                    .wait_interruptible_timeout(&mut inner, jiffies)
+                    .wait_interruptible_timeout(&mut inner, delta)
                 {
                     CondVarTimeoutResult::Signal { .. } => {
                         inner.is_frozen = IsFrozen::No;
                         return Err(ERESTARTSYS);
                     }
-                    CondVarTimeoutResult::Woken { jiffies: remaining } => {
-                        jiffies = remaining;
+                    CondVarTimeoutResult::Woken { delta: remaining } => {
+                        delta = remaining;
                     }
                     CondVarTimeoutResult::Timeout => {
-                        jiffies = 0;
+                        delta = kernel::time::Delta::ZERO;
                     }
                 }
             }
diff --git a/rust/kernel/sync/condvar.rs b/rust/kernel/sync/condvar.rs
index 69d58dfbad7b..c94ae83a583f 100644
--- a/rust/kernel/sync/condvar.rs
+++ b/rust/kernel/sync/condvar.rs
@@ -12,7 +12,7 @@
     task::{
         MAX_SCHEDULE_TIMEOUT, TASK_FREEZABLE, TASK_INTERRUPTIBLE, TASK_NORMAL, TASK_UNINTERRUPTIBLE,
     },
-    time::Jiffies,
+    time::Delta,
     types::Opaque,
 };
 use core::{marker::PhantomPinned, pin::Pin, ptr};
@@ -186,15 +186,19 @@ pub fn wait_interruptible_freezable<T: ?Sized, B: Backend>(
     pub fn wait_interruptible_timeout<T: ?Sized, B: Backend>(
         &self,
         guard: &mut Guard<'_, T, B>,
-        jiffies: Jiffies,
+        delta: Delta,
     ) -> CondVarTimeoutResult {
-        let jiffies = jiffies.try_into().unwrap_or(MAX_SCHEDULE_TIMEOUT);
+        let jiffies = c_long::try_from(delta.as_jiffies_ceil()).unwrap_or(MAX_SCHEDULE_TIMEOUT);
         let res = self.wait_internal(TASK_INTERRUPTIBLE, guard, jiffies);
 
-        match (res as Jiffies, crate::current!().signal_pending()) {
-            (jiffies, true) => CondVarTimeoutResult::Signal { jiffies },
+        match (res, crate::current!().signal_pending()) {
+            (jiffies, true) => CondVarTimeoutResult::Signal {
+                delta: Delta::from_jiffies(jiffies as u64),
+            },
             (0, false) => CondVarTimeoutResult::Timeout,
-            (jiffies, false) => CondVarTimeoutResult::Woken { jiffies },
+            (jiffies, false) => CondVarTimeoutResult::Woken {
+                delta: Delta::from_jiffies(jiffies as u64),
+            },
         }
     }
 
@@ -248,11 +252,11 @@ pub enum CondVarTimeoutResult {
     /// Somebody woke us up.
     Woken {
         /// Remaining sleep duration.
-        jiffies: Jiffies,
+        delta: Delta,
     },
     /// A signal occurred.
     Signal {
         /// Remaining sleep duration.
-        jiffies: Jiffies,
+        delta: Delta,
     },
 }
-- 
2.43.0

[PATCH v2 3/4] rust: workqueue: use Delta for enqueue_delayed's delay parameter

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

enqueue_delayed() took a raw jiffies count (a plain c_ulong alias with
no type safety), so callers had to know on their own that the value
meant jiffies and convert to/from it themselves. This mirrors the
issue already fixed for CondVar's wait_interruptible_timeout().

Switch to Delta, the duration type already used elsewhere, so the
unit is part of the type instead of a caller convention.

Use as_jiffies_ceil() rather than a plain truncating conversion:
queue_delayed_work_on() treats a delay of 0 jiffies as "enqueue
immediately", so truncating a small nonzero Delta down to 0 would
silently turn a requested delay into no delay at all.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
---
 rust/kernel/workqueue.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/rust/kernel/workqueue.rs b/rust/kernel/workqueue.rs
index 7e253b6f299c..9022b22a83be 100644
--- a/rust/kernel/workqueue.rs
+++ b/rust/kernel/workqueue.rs
@@ -197,7 +197,7 @@
         Arc,
         LockClassKey, //
     },
-    time::Jiffies,
+    time::Delta,
     types::Opaque,
 };
 use core::{marker::PhantomData, ptr::NonNull};
@@ -303,7 +303,7 @@ pub fn enqueue<W, const ID: u64>(&self, w: W) -> W::EnqueueOutput
     /// This may fail if the work item is already enqueued in a workqueue.
     ///
     /// The work item will be submitted using `WORK_CPU_UNBOUND`.
-    pub fn enqueue_delayed<W, const ID: u64>(&self, w: W, delay: Jiffies) -> W::EnqueueOutput
+    pub fn enqueue_delayed<W, const ID: u64>(&self, w: W, delay: Delta) -> W::EnqueueOutput
     where
         W: RawDelayedWorkItem<ID> + Send + 'static,
     {
@@ -328,7 +328,7 @@ pub fn enqueue_delayed<W, const ID: u64>(&self, w: W, delay: Jiffies) -> W::Enqu
                     bindings::wq_misc_consts_WORK_CPU_UNBOUND as ffi::c_int,
                     queue_ptr,
                     container_of!(work_ptr, bindings::delayed_work, work),
-                    delay,
+                    delay.as_jiffies_ceil(),
                 )
             })
         }
-- 
2.43.0

Re: [PATCH v2 3/4] rust: workqueue: use Delta for enqueue_delayed's delay parameter

[Alice Ryhl]

On Mon, Jul 13, 2026 at 08:52:45AM +0900, FUJITA Tomonori wrote:
> From: FUJITA Tomonori <fujita.tomonori@gmail.com>
> 
> enqueue_delayed() took a raw jiffies count (a plain c_ulong alias with
> no type safety), so callers had to know on their own that the value
> meant jiffies and convert to/from it themselves. This mirrors the
> issue already fixed for CondVar's wait_interruptible_timeout().
> 
> Switch to Delta, the duration type already used elsewhere, so the
> unit is part of the type instead of a caller convention.
> 
> Use as_jiffies_ceil() rather than a plain truncating conversion:
> queue_delayed_work_on() treats a delay of 0 jiffies as "enqueue
> immediately", so truncating a small nonzero Delta down to 0 would
> silently turn a requested delay into no delay at all.
> 
> Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>

It seems unfortunate that a caller might be forced to convert jiffies ->
nanos -> jiffies if they already have the value in jiffies.

Alice

Re: [PATCH v2 3/4] rust: workqueue: use Delta for enqueue_delayed's delay parameter

[Onur Özkan]

On Mon, 13 Jul 2026 08:59:56 +0000
Alice Ryhl <aliceryhl@google.com> wrote:

> On Mon, Jul 13, 2026 at 08:52:45AM +0900, FUJITA Tomonori wrote:
> > From: FUJITA Tomonori <fujita.tomonori@gmail.com>
> > 
> > enqueue_delayed() took a raw jiffies count (a plain c_ulong alias with
> > no type safety), so callers had to know on their own that the value
> > meant jiffies and convert to/from it themselves. This mirrors the
> > issue already fixed for CondVar's wait_interruptible_timeout().
> > 
> > Switch to Delta, the duration type already used elsewhere, so the
> > unit is part of the type instead of a caller convention.
> > 
> > Use as_jiffies_ceil() rather than a plain truncating conversion:
> > queue_delayed_work_on() treats a delay of 0 jiffies as "enqueue
> > immediately", so truncating a small nonzero Delta down to 0 would
> > silently turn a requested delay into no delay at all.
> > 
> > Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
> 
> It seems unfortunate that a caller might be forced to convert jiffies ->
> nanos -> jiffies if they already have the value in jiffies.
> 
> Alice

Yeah that's not ideal. We can solve this by making the argument something like
`impl Into<Delta>`, right?

Regards,
Onur

Re: [PATCH v2 3/4] rust: workqueue: use Delta for enqueue_delayed's delay parameter

[FUJITA Tomonori]

On Mon, 13 Jul 2026 12:07:30 +0300
Onur Özkan <work@onurozkan.dev> wrote:

> On Mon, 13 Jul 2026 08:59:56 +0000
> Alice Ryhl <aliceryhl@google.com> wrote:
> 
>> On Mon, Jul 13, 2026 at 08:52:45AM +0900, FUJITA Tomonori wrote:
>> > From: FUJITA Tomonori <fujita.tomonori@gmail.com>
>> > 
>> > enqueue_delayed() took a raw jiffies count (a plain c_ulong alias with
>> > no type safety), so callers had to know on their own that the value
>> > meant jiffies and convert to/from it themselves. This mirrors the
>> > issue already fixed for CondVar's wait_interruptible_timeout().
>> > 
>> > Switch to Delta, the duration type already used elsewhere, so the
>> > unit is part of the type instead of a caller convention.
>> > 
>> > Use as_jiffies_ceil() rather than a plain truncating conversion:
>> > queue_delayed_work_on() treats a delay of 0 jiffies as "enqueue
>> > immediately", so truncating a small nonzero Delta down to 0 would
>> > silently turn a requested delay into no delay at all.
>> > 
>> > Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
>> 
>> It seems unfortunate that a caller might be forced to convert jiffies ->
>> nanos -> jiffies if they already have the value in jiffies.
>> 
>> Alice
> 
> Yeah that's not ideal. We can solve this by making the argument something like
> `impl Into<Delta>`, right?

With impl Into<Delta>, the argument type changes, but if Delta's
internal representation stays a plain nanosecond count, then .into()
still performs the jiffies -> nanos conversion. Then enqueue_delayed()
still calls as_jiffies_ceil() to convert back to jiffies afterwards.

#[derive(Copy, Clone)]
enum Repr {
    Nanos(i64),
    Jiffies(u64),
}

#[derive(Copy, Clone)]
pub struct Delta {
    repr: Repr,
}

The enum representation like above works? Delta::from_jiffies() just
stores the jiffies count. APIs like enqueue_delayed() that uses
jiffies time-unit don't need to do any conversion.

The downside is that it makes the Add/Sub/PartialEq methods
complicated.

Re: [PATCH v2 3/4] rust: workqueue: use Delta for enqueue_delayed's delay parameter

[Gary Guo]

On Mon Jul 13, 2026 at 10:40 AM BST, FUJITA Tomonori wrote:
> On Mon, 13 Jul 2026 12:07:30 +0300
> Onur Özkan <work@onurozkan.dev> wrote:
>
>> On Mon, 13 Jul 2026 08:59:56 +0000
>> Alice Ryhl <aliceryhl@google.com> wrote:
>> 
>>> On Mon, Jul 13, 2026 at 08:52:45AM +0900, FUJITA Tomonori wrote:
>>> > From: FUJITA Tomonori <fujita.tomonori@gmail.com>
>>> > 
>>> > enqueue_delayed() took a raw jiffies count (a plain c_ulong alias with
>>> > no type safety), so callers had to know on their own that the value
>>> > meant jiffies and convert to/from it themselves. This mirrors the
>>> > issue already fixed for CondVar's wait_interruptible_timeout().
>>> > 
>>> > Switch to Delta, the duration type already used elsewhere, so the
>>> > unit is part of the type instead of a caller convention.
>>> > 
>>> > Use as_jiffies_ceil() rather than a plain truncating conversion:
>>> > queue_delayed_work_on() treats a delay of 0 jiffies as "enqueue
>>> > immediately", so truncating a small nonzero Delta down to 0 would
>>> > silently turn a requested delay into no delay at all.
>>> > 
>>> > Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
>>> 
>>> It seems unfortunate that a caller might be forced to convert jiffies ->
>>> nanos -> jiffies if they already have the value in jiffies.
>>> 
>>> Alice
>> 
>> Yeah that's not ideal. We can solve this by making the argument something like
>> `impl Into<Delta>`, right?
>
> With impl Into<Delta>, the argument type changes, but if Delta's
> internal representation stays a plain nanosecond count, then .into()
> still performs the jiffies -> nanos conversion. Then enqueue_delayed()
> still calls as_jiffies_ceil() to convert back to jiffies afterwards.
>
> #[derive(Copy, Clone)]
> enum Repr {
>     Nanos(i64),
>     Jiffies(u64),
> }
>
> #[derive(Copy, Clone)]
> pub struct Delta {
>     repr: Repr,
> }
>
> The enum representation like above works? Delta::from_jiffies() just
> stores the jiffies count. APIs like enqueue_delayed() that uses
> jiffies time-unit don't need to do any conversion.

I don't think using enums is the correct approach.

Why can't we make Jiffies a new type as well? Then we can implement
`From<Jiffies>` for `Delta` and `From<Delta>` for `Jiffies`, and then the API
can just have `Into<WhatEverTimeReprItNeed>`?

Best,
Gary

Re: [PATCH v2 3/4] rust: workqueue: use Delta for enqueue_delayed's delay parameter

[FUJITA Tomonori]

On Mon, 13 Jul 2026 12:55:36 +0100
"Gary Guo" <gary@garyguo.net> wrote:

> On Mon Jul 13, 2026 at 10:40 AM BST, FUJITA Tomonori wrote:
>> On Mon, 13 Jul 2026 12:07:30 +0300
>> Onur Özkan <work@onurozkan.dev> wrote:
>>
>>> On Mon, 13 Jul 2026 08:59:56 +0000
>>> Alice Ryhl <aliceryhl@google.com> wrote:
>>> 
>>>> On Mon, Jul 13, 2026 at 08:52:45AM +0900, FUJITA Tomonori wrote:
>>>> > From: FUJITA Tomonori <fujita.tomonori@gmail.com>
>>>> > 
>>>> > enqueue_delayed() took a raw jiffies count (a plain c_ulong alias with
>>>> > no type safety), so callers had to know on their own that the value
>>>> > meant jiffies and convert to/from it themselves. This mirrors the
>>>> > issue already fixed for CondVar's wait_interruptible_timeout().
>>>> > 
>>>> > Switch to Delta, the duration type already used elsewhere, so the
>>>> > unit is part of the type instead of a caller convention.
>>>> > 
>>>> > Use as_jiffies_ceil() rather than a plain truncating conversion:
>>>> > queue_delayed_work_on() treats a delay of 0 jiffies as "enqueue
>>>> > immediately", so truncating a small nonzero Delta down to 0 would
>>>> > silently turn a requested delay into no delay at all.
>>>> > 
>>>> > Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
>>>> 
>>>> It seems unfortunate that a caller might be forced to convert jiffies ->
>>>> nanos -> jiffies if they already have the value in jiffies.
>>>> 
>>>> Alice
>>> 
>>> Yeah that's not ideal. We can solve this by making the argument something like
>>> `impl Into<Delta>`, right?
>>
>> With impl Into<Delta>, the argument type changes, but if Delta's
>> internal representation stays a plain nanosecond count, then .into()
>> still performs the jiffies -> nanos conversion. Then enqueue_delayed()
>> still calls as_jiffies_ceil() to convert back to jiffies afterwards.
>>
>> #[derive(Copy, Clone)]
>> enum Repr {
>>     Nanos(i64),
>>     Jiffies(u64),
>> }
>>
>> #[derive(Copy, Clone)]
>> pub struct Delta {
>>     repr: Repr,
>> }
>>
>> The enum representation like above works? Delta::from_jiffies() just
>> stores the jiffies count. APIs like enqueue_delayed() that uses
>> jiffies time-unit don't need to do any conversion.
> 
> I don't think using enums is the correct approach.
> 
> Why can't we make Jiffies a new type as well? Then we can implement
> `From<Jiffies>` for `Delta` and `From<Delta>` for `Jiffies`, and then the API
> can just have `Into<WhatEverTimeReprItNeed>`?

If the principle is "each API should accept whatever type matches the
C function's native time unit", does that mean we'd also introduce
other time units as types — e.g. a Micros type so that
fsleep()/udelay() take impl Into<Micros>?

Or is Jiffies meant to be a special case here, distinct from those?

[PATCH v2 4/4] rust: time: remove unused Jiffies/Msecs helpers

[FUJITA Tomonori]

From: FUJITA Tomonori <fujita.tomonori@gmail.com>

CondVar's wait_interruptible_timeout() and workqueue's
enqueue_delayed() have both moved from raw jiffies counts to Delta, so
nothing in the tree calls msecs_to_jiffies() or uses the Jiffies and
Msecs aliases anymore.

Signed-off-by: FUJITA Tomonori <fujita.tomonori@gmail.com>
---
 rust/kernel/time.rs | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/rust/kernel/time.rs b/rust/kernel/time.rs
index cd054ea5df02..184ae7755f1b 100644
--- a/rust/kernel/time.rs
+++ b/rust/kernel/time.rs
@@ -39,20 +39,6 @@
 /// The number of nanoseconds per second.
 pub const NSEC_PER_SEC: i64 = bindings::NSEC_PER_SEC as i64;
 
-/// The time unit of Linux kernel. One jiffy equals (1/HZ) second.
-pub type Jiffies = crate::ffi::c_ulong;
-
-/// The millisecond time unit.
-pub type Msecs = crate::ffi::c_uint;
-
-/// Converts milliseconds to jiffies.
-#[inline]
-pub fn msecs_to_jiffies(msecs: Msecs) -> Jiffies {
-    // SAFETY: The `__msecs_to_jiffies` function is always safe to call no
-    // matter what the argument is.
-    unsafe { bindings::__msecs_to_jiffies(msecs) }
-}
-
 /// Trait for clock sources.
 ///
 /// Selection of the clock source depends on the use case. In some cases the usage of a
-- 
2.43.0