linux-kernel - Re: [PATCH v9 03/15] gpu: nova-core: num: add functions to safely convert a const value to a smaller type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <DE88ALG15C8T.4ASPEWD120P3@nvidia.com>
Date: Fri, 14 Nov 2025 16:10:46 +0900
From: "Alexandre Courbot" <acourbot@...dia.com>
To: "Mikko Perttunen" <mperttunen@...dia.com>, "Danilo Krummrich"
 <dakr@...nel.org>, "Alice Ryhl" <aliceryhl@...gle.com>, "David Airlie"
 <airlied@...il.com>, "Simona Vetter" <simona@...ll.ch>, "Benno Lossin"
 <lossin@...nel.org>, "Miguel Ojeda" <ojeda@...nel.org>, "Boqun Feng"
 <boqun.feng@...il.com>, "Gary Guo" <gary@...yguo.net>,
 Björn Roy Baron <bjorn3_gh@...tonmail.com>, "Andreas
 Hindborg" <a.hindborg@...nel.org>, "Trevor Gross" <tmgross@...ch.edu>,
 "Alexandre Courbot" <acourbot@...dia.com>
Cc: "John Hubbard" <jhubbard@...dia.com>, "Alistair Popple"
 <apopple@...dia.com>, "Joel Fernandes" <joelagnelf@...dia.com>, "Timur
 Tabi" <ttabi@...dia.com>, "Edwin Peer" <epeer@...dia.com>,
 <nouveau@...ts.freedesktop.org>, <dri-devel@...ts.freedesktop.org>,
 <linux-kernel@...r.kernel.org>, <rust-for-linux@...r.kernel.org>, "Nouveau"
 <nouveau-bounces@...ts.freedesktop.org>
Subject: Re: [PATCH v9 03/15] gpu: nova-core: num: add functions to safely
 convert a const value to a smaller type

On Fri Nov 14, 2025 at 3:49 PM JST, Mikko Perttunen wrote:
> On Monday, November 10, 2025 10:34 PM Alexandre Courbot wrote:
>> There are times where we need to store a constant value defined as a
>> larger type (e.g. through a binding) into a smaller type, knowing
>> that the value will fit. Rust, unfortunately, only provides us with the
>> `as` operator for that purpose, the use of which is discouraged as it
>> silently strips data.
>> 
>> Extend the `num` module with functions allowing to perform the
>> conversion infallibly, at compile time.
>> 
>> Example:
>> 
>>     const FOO_VALUE: u32 = 1;
>> 
>>     // `FOO_VALUE` fits into a `u8`, so the conversion is valid.
>>     let foo = num::u32_to_u8::<{ FOO_VALUE }>();
>> 
>> We are going to use this feature extensively in Nova.
>> 
>> Signed-off-by: Alexandre Courbot <acourbot@...dia.com>
>> ---
>>  drivers/gpu/nova-core/num.rs | 51 ++++++++++++++++++++++++++++++++++++++++++++
>>  1 file changed, 51 insertions(+)
>> 
>> diff --git a/drivers/gpu/nova-core/num.rs b/drivers/gpu/nova-core/num.rs
>> index 92a91b9e30de..f3740ab6cb9d 100644
>> --- a/drivers/gpu/nova-core/num.rs
>> +++ b/drivers/gpu/nova-core/num.rs
>> @@ -163,3 +163,54 @@ fn into_safe_cast(self) -> T {
>>          T::from_safe_cast(self)
>>      }
>>  }
>> +
>> +macro_rules! impl_const_into {
>> +    ($from:ty => { $($into:ty),* }) => {
>> +        $(
>> +        paste! {
>> +            #[doc = ::core::concat!(
>> +                "Performs a build-time safe conversion of a [`",
>> +                ::core::stringify!($from),
>> +                "`] constant value into a [`",
>> +                ::core::stringify!($into),
>> +                "`].")]
>> +            ///
>> +            /// This checks at compile-time that the conversion is lossless, and triggers a build
>> +            /// error if it isn't.
>> +            ///
>> +            /// # Examples
>> +            ///
>> +            /// ```
>> +            /// use kernel::num;
>> +            ///
>> +            /// // Succeeds because the value of the source fits into the destination's type.
>> +            #[doc = ::core::concat!(
>> +                "assert_eq!(num::",
>> +                ::core::stringify!($from),
>> +                "_into_",
>> +                ::core::stringify!($into),
>> +                "(1",
>> +                ::core::stringify!($from),
>> +                "), 1",
>> +                ::core::stringify!($into),
>> +                ");")]
>
> This expands to e.g. assert_eq!(num::u32_to_u8(1u32), 1u8), i.e. not with a generic parameter.

Ah, nice catch, thanks! I missed that because the doccomments are not
built yet for code outside of `kernel`.

Fixing it by taking the example from the non-Nova RFC [1] of this patch.

[1] https://lore.kernel.org/all/20251104-as_casts-v1-1-0a0e95bd2a9f@nvidia.com/