linux-kernel - Re: [PATCH v9 03/15] gpu: nova-core: num: add functions to safely convert a const value to a smaller type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <13485409.nUPlyArG6x@senjougahara>
Date: Fri, 14 Nov 2025 15:49:21 +0900
From: Mikko Perttunen <mperttunen@...dia.com>
To: Danilo Krummrich <dakr@...nel.org>, Alice Ryhl <aliceryhl@...gle.com>,
 David Airlie <airlied@...il.com>, Simona Vetter <simona@...ll.ch>,
 Benno Lossin <lossin@...nel.org>, Miguel Ojeda <ojeda@...nel.org>,
 Boqun Feng <boqun.feng@...il.com>, Gary Guo <gary@...yguo.net>,
 Björn Roy Baron <bjorn3_gh@...tonmail.com>,
 Andreas Hindborg <a.hindborg@...nel.org>, Trevor Gross <tmgross@...ch.edu>,
 Alexandre Courbot <acourbot@...dia.com>
Cc: John Hubbard <jhubbard@...dia.com>, Alistair Popple <apopple@...dia.com>,
 Joel Fernandes <joelagnelf@...dia.com>, Timur Tabi <ttabi@...dia.com>,
 Edwin Peer <epeer@...dia.com>, nouveau@...ts.freedesktop.org,
 dri-devel@...ts.freedesktop.org, linux-kernel@...r.kernel.org,
 rust-for-linux@...r.kernel.org, Alexandre Courbot <acourbot@...dia.com>
Subject:
 Re: [PATCH v9 03/15] gpu: nova-core: num: add functions to safely convert a
 const value to a smaller type

On Monday, November 10, 2025 10:34 PM Alexandre Courbot wrote:
> There are times where we need to store a constant value defined as a
> larger type (e.g. through a binding) into a smaller type, knowing
> that the value will fit. Rust, unfortunately, only provides us with the
> `as` operator for that purpose, the use of which is discouraged as it
> silently strips data.
> 
> Extend the `num` module with functions allowing to perform the
> conversion infallibly, at compile time.
> 
> Example:
> 
>     const FOO_VALUE: u32 = 1;
> 
>     // `FOO_VALUE` fits into a `u8`, so the conversion is valid.
>     let foo = num::u32_to_u8::<{ FOO_VALUE }>();
> 
> We are going to use this feature extensively in Nova.
> 
> Signed-off-by: Alexandre Courbot <acourbot@...dia.com>
> ---
>  drivers/gpu/nova-core/num.rs | 51 ++++++++++++++++++++++++++++++++++++++++++++
>  1 file changed, 51 insertions(+)
> 
> diff --git a/drivers/gpu/nova-core/num.rs b/drivers/gpu/nova-core/num.rs
> index 92a91b9e30de..f3740ab6cb9d 100644
> --- a/drivers/gpu/nova-core/num.rs
> +++ b/drivers/gpu/nova-core/num.rs
> @@ -163,3 +163,54 @@ fn into_safe_cast(self) -> T {
>          T::from_safe_cast(self)
>      }
>  }
> +
> +macro_rules! impl_const_into {
> +    ($from:ty => { $($into:ty),* }) => {
> +        $(
> +        paste! {
> +            #[doc = ::core::concat!(
> +                "Performs a build-time safe conversion of a [`",
> +                ::core::stringify!($from),
> +                "`] constant value into a [`",
> +                ::core::stringify!($into),
> +                "`].")]
> +            ///
> +            /// This checks at compile-time that the conversion is lossless, and triggers a build
> +            /// error if it isn't.
> +            ///
> +            /// # Examples
> +            ///
> +            /// ```
> +            /// use kernel::num;
> +            ///
> +            /// // Succeeds because the value of the source fits into the destination's type.
> +            #[doc = ::core::concat!(
> +                "assert_eq!(num::",
> +                ::core::stringify!($from),
> +                "_into_",
> +                ::core::stringify!($into),
> +                "(1",
> +                ::core::stringify!($from),
> +                "), 1",
> +                ::core::stringify!($into),
> +                ");")]

This expands to e.g. assert_eq!(num::u32_to_u8(1u32), 1u8), i.e. not with a generic parameter.

With that fixed,

Reviewed-by: Mikko Perttunen <mperttunen@...dia.com>

> +            /// ```
> +            #[allow(unused)]
> +            pub(crate) const fn [<$from _into_ $into>]<const N: $from>() -> $into {
> +                // Make sure that the target type is smaller than the source one.
> +                static_assert!($from::BITS >= $into::BITS);
> +                // CAST: we statically enforced above that `$from` is larger than `$into`, so the
> +                // `as` conversion will be lossless.
> +                build_assert!(N >= $into::MIN as $from && N <= $into::MAX as $from);
> +
> +                N as $into
> +            }
> +        }
> +        )*
> +    };
> +}
> +
> +impl_const_into!(usize => { u8, u16, u32 });
> +impl_const_into!(u64 => { u8, u16, u32 });
> +impl_const_into!(u32 => { u8, u16 });
> +impl_const_into!(u16 => { u8 });
> 
>