kernel: timeout: add Pugh skip list timeout backend

doc/kernel/services/timing/clocks.rst

@@ -201,7 +201,7 @@ The default, :kconfig:option:`CONFIG_TIMEOUT_BACKEND_DLIST`, stores
 events in a doubly linked list sorted by expiry, each holding a delta
 count in ticks from its predecessor.  Insertion is O(N) in the number of
 pending timeouts: inexpensive for the handful a typical system has
-pending, but it scales poorly when many are outstanding.  The three
+pending, but it scales poorly when many are outstanding.  The four
 alternative backends, all currently experimental, trade extra memory or
 behaviour for faster insertion at scale:
 
@@ -228,6 +228,13 @@ behaviour for faster insertion at scale:
   unlike the wheel it preserves same-tick firing order and adds no
   idle-wakeup cost.
 
+* :kconfig:option:`CONFIG_TIMEOUT_BACKEND_SKIPLIST` is a Pugh skip list
+  keyed on absolute expiry.  Expected insertion and removal are O(log N)
+  with no capacity limit, and same-tick firing order is FIFO.  It
+  requires 64-bit ticks.  Each event stores
+  :kconfig:option:`CONFIG_TIMEOUT_SKIPLIST_MAX_LEVEL` forward pointers,
+  so per-event RAM is higher than the delta list or min-heap.
+
 The non-default backends target systems that hold many concurrent
 timeouts, especially ones clustered in the near future.  For most
 applications the delta list remains the appropriate default.

include/zephyr/kernel_structs.h

@@ -314,12 +314,21 @@ struct _timeout {
 	 */
 	int64_t abs_ticks;
 	struct min_heap_handle heap_handle;
+#elif defined(CONFIG_TIMEOUT_BACKEND_SKIPLIST)
+	/*
+	 * Skip-list backend: absolute expiry tick plus a geometric-height
+	 * tower of forward pointers. height == 0 means the timeout is not
+	 * queued (idle, popped for announcing, or aborted).
+	 */
+	int64_t abs_ticks;
+	uint8_t height;
+	struct _timeout *forward[CONFIG_TIMEOUT_SKIPLIST_MAX_LEVEL];
 #else
 	/*
-	 * Delta-list and timer-wheel backends: a list node plus dticks (a
-	 * delta to the predecessor for the delta list; an encoded slot
-	 * position for the wheel). The wheel adds a flags field recording
-	 * which wheel tier the timeout currently occupies.
+	 * Delta-list, bucket, and timer-wheel backends: a list node plus
+	 * dticks (a delta to the predecessor for the delta list; an encoded
+	 * slot position for the wheel or bucket). The wheel adds a flags
+	 * field recording which wheel tier the timeout currently occupies.
 	 */
 	sys_dnode_t node;
 #if defined(CONFIG_TIMEOUT_BACKEND_WHEEL)

kernel/Kconfig

@@ -819,6 +819,22 @@ config TIMEOUT_BACKEND_BUCKET
 	  is on demand against the actual next event, so it imposes no
 	  tickless-idle floor. Requires 64-bit timeouts.
 
+config TIMEOUT_BACKEND_SKIPLIST
+	bool "Skip list [EXPERIMENTAL]"
+	depends on TIMEOUT_64BIT
+	select EXPERIMENTAL
+	help
+	  A Pugh skip list keyed on absolute expiry tick. Expected insertion
+	  and arbitrary removal are O(log n), the earliest timeout is O(1),
+	  and there is no capacity limit. Same-tick firing order is FIFO.
+	  Each pending timeout carries CONFIG_TIMEOUT_SKIPLIST_MAX_LEVEL
+	  forward pointers, sized for the worst case although the expected
+	  height is 2. At the default 8 levels struct _timeout is 88 bytes
+	  on a 64-bit target, against 32 for the delta list and 24 for the
+	  min-heap, and every k_thread, k_timer and delayable work item
+	  pays it. Requires 64-bit timeouts. Consider this when many
+	  timeouts are pending and a bounded heap is undesirable.
+
 endchoice # TIMEOUT_BACKEND
 
 config TIMEOUT_BUCKET_LISTS
@@ -834,6 +850,19 @@ config TIMEOUT_BUCKET_LISTS
 	  Below 8 the plain delta-list backend is likely the better choice. The
 	  occupancy bitmap is a uint32_t for up to 32 buckets, a uint64_t beyond.
 
+config TIMEOUT_SKIPLIST_MAX_LEVEL
+	int "Maximum skip-list height"
+	depends on TIMEOUT_BACKEND_SKIPLIST
+	default 8
+	range 4 16
+	help
+	  Maximum number of forward-pointer levels in each timeout node.
+	  Height is drawn from a geometric(1/2) distribution, so expected
+	  search cost is O(log n) as long as this is at least log2 of the
+	  peak number of pending timeouts. Each extra level adds one pointer
+	  to every struct _timeout (k_timer, k_thread, delayable work, ...).
+	  8 levels cover a few hundred concurrent timeouts comfortably.
+
 config TIMEOUT_HEAP_MAX_ENTRIES
 	int "Maximum simultaneous pending timeouts in the heap"
 	depends on TIMEOUT_BACKEND_MINHEAP

kernel/include/timeout_q.h

@@ -59,6 +59,19 @@ static inline bool z_is_inactive_timeout(const struct _timeout *to)
 	return !sys_dnode_is_linked(&to->node);
 }
 
+#elif defined(CONFIG_TIMEOUT_BACKEND_SKIPLIST)
+
+static inline void z_init_timeout(struct _timeout *to)
+{
+	to->height = 0;
+	to->abs_ticks = 0;
+}
+
+static inline bool z_is_inactive_timeout(const struct _timeout *to)
+{
+	return to->height == 0;
+}
+
 #else /* CONFIG_TIMEOUT_BACKEND_DLIST or _BUCKET */
 
 static inline void z_init_timeout(struct _timeout *to)

kernel/timeout.c

@@ -111,6 +111,8 @@ static uint32_t elapsed(void)
 #include "timeout_wheel.h"
 #elif defined(CONFIG_TIMEOUT_BACKEND_BUCKET)
 #include "timeout_bucket.h"
+#elif defined(CONFIG_TIMEOUT_BACKEND_SKIPLIST)
+#include "timeout_skiplist.h"
 #else /* CONFIG_TIMEOUT_BACKEND_DLIST */
 #include "timeout_list.h"
 #endif

kernel/timeout_skiplist.h

@@ -0,0 +1,231 @@
+/*
+ * Copyright (c) 2026 The Zephyr Project Contributors
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+#ifndef ZEPHYR_KERNEL_TIMEOUT_SKIPLIST_H_
+#define ZEPHYR_KERNEL_TIMEOUT_SKIPLIST_H_
+
+/**
+ * @file
+ * @brief Skip-list timeout backend (implementation).
+ *
+ * Pending timeouts are kept in a Pugh skip list keyed on absolute expiry
+ * tick (struct _timeout's abs_ticks). Expected insertion and arbitrary
+ * removal are O(log n); the earliest timeout is always the level-0 successor
+ * of the sentinel. A timeout that is not queued has height == 0.
+ *
+ * Same-tick firing order is FIFO: a new node is inserted after every node
+ * that already has the same abs_ticks.
+ *
+ * Node height is drawn from a geometric(1/2) distribution using a private
+ * xorshift32, so the announce/add/abort paths never call the entropy driver.
+ * There is no capacity limit (unlike the min-heap backend).
+ */
+
+#define SKIPLIST_LEVELS CONFIG_TIMEOUT_SKIPLIST_MAX_LEVEL
+
+BUILD_ASSERT(SKIPLIST_LEVELS >= 4 && SKIPLIST_LEVELS <= 16,
+	     "CONFIG_TIMEOUT_SKIPLIST_MAX_LEVEL must be in [4, 16]");
+
+/* Sentinel: never expires, participates in every level, never fired. */
+static struct _timeout sl_head = {
+	.height = SKIPLIST_LEVELS,
+	.forward = { NULL },
+};
+
+/* Highest height of any currently queued node; 0 when the list is empty. */
+static uint8_t sl_top;
+
+/* Marsaglia xorshift32 state; period 2^32-1, must stay non-zero. */
+static uint32_t sl_rng = 2463534242U;
+
+static uint8_t skiplist_random_height(void)
+{
+	uint32_t r = sl_rng;
+
+	r ^= r << 13;
+	r ^= r >> 17;
+	r ^= r << 5;
+	sl_rng = r;
+
+	/* p = 1/2: height is 1 + the run of low 1-bits, capped at SKIPLIST_LEVELS. */
+	return 1 + MIN(u32_count_trailing_zeros(~r), SKIPLIST_LEVELS - 1);
+}
+
+static inline struct _timeout *skiplist_first(void)
+{
+	return sl_head.forward[0];
+}
+
+static void skiplist_drop_top(void)
+{
+	while (sl_top > 0 && sl_head.forward[sl_top - 1] == NULL) {
+		sl_top--;
+	}
+}
+
+static void skiplist_update_init(struct _timeout **update)
+{
+	uint8_t i;
+
+	for (i = 0; i < SKIPLIST_LEVELS; i++) {
+		update[i] = &sl_head;
+	}
+}
+
+/* Splice @to out at every level it occupies. */
+static void skiplist_unlink(struct _timeout *to, struct _timeout **update)
+{
+	uint8_t i;
+	uint8_t height = to->height;
+
+	for (i = 0; i < height; i++) {
+		__ASSERT_NO_MSG(update[i]->forward[i] == to);
+		update[i]->forward[i] = to->forward[i];
+	}
+
+	to->height = 0;
+	skiplist_drop_top();
+}
+
+/* Equal keys are skipped so a later insert lands after them (same-tick FIFO). */
+static void skiplist_predecessors_after(int64_t abs_ticks, struct _timeout **update)
+{
+	struct _timeout *x = &sl_head;
+	int i;
+
+	for (i = (int)sl_top - 1; i >= 0; i--) {
+		while (x->forward[i] != NULL && x->forward[i]->abs_ticks <= abs_ticks) {
+			x = x->forward[i];
+		}
+		update[i] = x;
+	}
+}
+
+/* Walk equal-key nodes so identity, not just expiry, selects the splice points. */
+static void skiplist_predecessors_of(struct _timeout *to, struct _timeout **update)
+{
+	struct _timeout *x = &sl_head;
+	int i;
+
+	for (i = (int)sl_top - 1; i >= 0; i--) {
+		while (x->forward[i] != NULL && x->forward[i]->abs_ticks < to->abs_ticks) {
+			x = x->forward[i];
+		}
+		update[i] = x;
+	}
+
+	for (i = 0; i < to->height; i++) {
+		while (update[i]->forward[i] != NULL &&
+		       update[i]->forward[i] != to &&
+		       update[i]->forward[i]->abs_ticks == to->abs_ticks) {
+			update[i] = update[i]->forward[i];
+		}
+	}
+}
+
+static inline bool z_timeout_q_insert(struct _timeout *to, k_ticks_t dticks)
+{
+	struct _timeout *update[SKIPLIST_LEVELS];
+	uint8_t i;
+	uint8_t height;
+
+	to->abs_ticks = (int64_t)curr_tick + dticks;
+	height = skiplist_random_height();
+	to->height = height;
+
+	skiplist_update_init(update);
+	skiplist_predecessors_after(to->abs_ticks, update);
+
+	if (height > sl_top) {
+		sl_top = height;
+	}
+
+	for (i = 0; i < height; i++) {
+		to->forward[i] = update[i]->forward[i];
+		update[i]->forward[i] = to;
+	}
+
+	return skiplist_first() == to;
+}
+
+static inline bool z_timeout_q_remove(struct _timeout *to)
+{
+	struct _timeout *update[SKIPLIST_LEVELS];
+	bool was_first = (skiplist_first() == to);
+
+	__ASSERT_NO_MSG(to->height > 0);
+
+	skiplist_update_init(update);
+	skiplist_predecessors_of(to, update);
+
+	skiplist_unlink(to, update);
+
+	return was_first;
+}
+
+static inline k_ticks_t z_timeout_q_remainder(const struct _timeout *to)
+{
+	return (k_ticks_t)(to->abs_ticks - (int64_t)curr_tick);
+}
+
+static inline k_ticks_t z_timeout_q_next_expiry(void)
+{
+	struct _timeout *t = skiplist_first();
+	int64_t gap;
+
+	if (t == NULL) {
+		return K_TICKS_FOREVER;
+	}
+
+	gap = t->abs_ticks - (int64_t)curr_tick;
+	return (gap < 0) ? 0 : (k_ticks_t)gap;
+}
+
+static inline int32_t z_timeout_q_next_gap(void)
+{
+	struct _timeout *t = skiplist_first();
+	int64_t gap;
+
+	if (t == NULL) {
+		return INT32_MAX;
+	}
+
+	/* Overdue must be 0: announce casts dt to uint32_t. */
+	gap = t->abs_ticks - (int64_t)curr_tick;
+	if (gap <= 0) {
+		return 0;
+	}
+
+	return (int32_t)MIN(gap, (int64_t)INT32_MAX);
+}
+
+static inline void z_timeout_q_advance(int32_t dt)
+{
+	ARG_UNUSED(dt);
+}
+
+/* Earliest node, so it is the head's successor at every level it occupies. */
+static inline struct _timeout *z_timeout_q_pop_due(void)
+{
+	struct _timeout *t = skiplist_first();
+	uint8_t i;
+
+	if ((t == NULL) || (t->abs_ticks > (int64_t)curr_tick)) {
+		return NULL;
+	}
+
+	for (i = 0; i < t->height; i++) {
+		__ASSERT_NO_MSG(sl_head.forward[i] == t);
+		sl_head.forward[i] = t->forward[i];
+	}
+
+	t->height = 0;
+	skiplist_drop_top();
+
+	return t;
+}
+
+#endif /* ZEPHYR_KERNEL_TIMEOUT_SKIPLIST_H_ */

tests/kernel/timeout/tests.yaml

@@ -21,3 +21,9 @@ tests:
     tags:
       - kernel
       - timer
+  kernel.timer.timeout.skiplist:
+    extra_configs:
+      - CONFIG_TIMEOUT_BACKEND_SKIPLIST=y
+    tags:
+      - kernel
+      - timer