| 47f27155 | 06-Aug-2026 |
Alexandre Courbot <acourbot@nvidia.com> |
rust: add functions and traits for lossless integer conversions
The core library's `From` implementations do not cover conversions that
are not portable or future-proof. For instance, even though it
rust: add functions and traits for lossless integer conversions
The core library's `From` implementations do not cover conversions that
are not portable or future-proof. For instance, even though it is safe
today, `From<usize>` is not implemented for `u64` because of the
possibility of supporting larger-than-64bit architectures in the future.
However, the kernel supports a narrower set of architectures, with a
considerable amount of code that is architecture-specific. This makes it
helpful and desirable to provide more infallible conversions, lest we
rely on the `as` keyword and carry the risk of silently losing data.
Thus, introduce a new module `num::casts` that provides safe const
functions performing more conversions allowed by the build target, as
well as `FromSafeCast` and `IntoSafeCast` traits that are just
extensions of `From` and `Into` to conversions that are known to be
lossless.
Some conversions are architecture-specific: for instance, converting a
`u64` to a `usize` is only lossless on 64-bit platforms. These
conversions are made available via a dedicated `arch` sub-module.
Suggested-by: Danilo Krummrich <dakr@kernel.org>
Link: https://lore.kernel.org/rust-for-linux/DDK4KADWJHMG.1FUPL3SDR26XF@kernel.org/
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20260806-as_casts-v2-1-cb76a4d3a6ef@nvidia.com
[ Added a few more intra-doc links. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
show more ...
|
| 8fe5e5f6 | 10-Aug-2026 |
Eliot Courtney <ecourtney@nvidia.com> |
rust: num: add Bounded::shr_exact
Add `shr_exact` in the vein of `try_shrink` which shifts a bounded right
only if it loses no set bits. This is useful for getting a shifted down
integer while simul
rust: num: add Bounded::shr_exact
Add `shr_exact` in the vein of `try_shrink` which shifts a bounded right
only if it loses no set bits. This is useful for getting a shifted down
integer while simultaneously checking that it's aligned.
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Link: https://patch.msgid.link/20260810-pramin-split-v2-3-65a00b3c7309@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
show more ...
|
| 223aa25a | 10-Aug-2026 |
Eliot Courtney <ecourtney@nvidia.com> |
rust: num: reject Bounded::shr overshifts at build time
Make `shr` reject shifts of at least the type's bit width at build
time, instead of panicking or masking the shift amount at runtime.
[ This
rust: num: reject Bounded::shr overshifts at build time
Make `shr` reject shifts of at least the type's bit width at build
time, instead of panicking or masking the shift amount at runtime.
[ This implies we can break the type invariant, which in turn means
we can trigger UB via `Deref`, e.g.:
rust_kernel: panicked at rust/kernel/num/bounded.rs:528:22:
unsafe precondition(s) violated: hint::unreachable_unchecked must never be reached
- Miguel ]
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Danilo Krummrich <dakr@kernel.org>
Cc: stable@vger.kernel.org
Fixes: c59a2d14cd24 ("rust: num: add `shr` and `shl` methods to `Bounded`")
Link: https://patch.msgid.link/20260810-pramin-split-v2-2-65a00b3c7309@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
show more ...
|
| 7836ec76 | 14-Mar-2026 |
Alexandre Courbot <acourbot@nvidia.com> |
rust: num: make Bounded::get const
There is a need to access the inner value of a `Bounded` in const
context, notably for bitfields and registers. Remove the invariant check
of `Bounded::get`, which
rust: num: make Bounded::get const
There is a need to access the inner value of a `Bounded` in const
context, notably for bitfields and registers. Remove the invariant check
of `Bounded::get`, which allows us to make it const.
Reviewed-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260314-register-v9-4-86805b2f7e9d@nvidia.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
show more ...
|
| 164f8634 | 14-Mar-2026 |
Alexandre Courbot <acourbot@nvidia.com> |
rust: num: add `into_bool` method to `Bounded`
Single-bit numbers are typically treated as booleans. There is an
`Into<bool>` implementation for those, but invoking it from contexts
that lack type e
rust: num: add `into_bool` method to `Bounded`
Single-bit numbers are typically treated as booleans. There is an
`Into<bool>` implementation for those, but invoking it from contexts
that lack type expectations is not always convenient.
Add an `into_bool` method as a simpler shortcut.
Reviewed-by: Alice Ryhl <aliceryhl@google.com>
Reviewed-by: Gary Guo <gary@garyguo.net>
Reviewed-by: Daniel Almeida <daniel.almeida@collabora.com>
Reviewed-by: Yury Norov <yury.norov@gmail.com>
Tested-by: Dirk Behme <dirk.behme@de.bosch.com>
Acked-by: Miguel Ojeda <ojeda@kernel.org>
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260314-register-v9-3-86805b2f7e9d@nvidia.com
Signed-off-by: Danilo Krummrich <dakr@kernel.org>
show more ...
|
| 5016cae9 | 23-Jan-2026 |
Shivam Kalra <shivamklr@cock.li> |
rust: num: bounded: clean __new documentation and comments
Following commit 3a1ec424dd9c ("rust: num: bounded: mark __new as
unsafe"), remove the redundant paragraph in the documentation of __new no
rust: num: bounded: clean __new documentation and comments
Following commit 3a1ec424dd9c ("rust: num: bounded: mark __new as
unsafe"), remove the redundant paragraph in the documentation of __new now
that the Safety section explicitly covers the requirement.
Additionally, add an INVARIANT comment inside the function body where
the Bounded instance is actually constructed to document that the type
invariant is upheld.
Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://lore.kernel.org/rust-for-linux/CANiq72mUCUh72BWP4eD1PTDpwdb1ML+Xgfom-Ys6thJooqQPwQ@mail.gmail.com/
Signed-off-by: Shivam Kalra <shivamklr@cock.li>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20260123132132.53854-1-shivamklr@cock.li
[ Reworded slightly. - Miguel ]
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
show more ...
|
| 3a1ec424 | 04-Dec-2025 |
Hsiu Che Yu <yu.whisper.personal@gmail.com> |
rust: num: bounded: mark __new as unsafe
The `Bounded::__new()` constructor relies on the caller to ensure the
value can be represented within N bits. Failing to uphold this
requirement breaks the t
rust: num: bounded: mark __new as unsafe
The `Bounded::__new()` constructor relies on the caller to ensure the
value can be represented within N bits. Failing to uphold this
requirement breaks the type invariant. Mark it as unsafe and document
this requirement in a Safety section to make the contract explicit.
Update all call sites to use unsafe blocks and change their comments
from `INVARIANT:` to `SAFETY:`, as they are now justifying unsafe
operations rather than establishing type invariants.
Fixes: 01e345e82ec3a ("rust: num: add Bounded integer wrapping type")
Link: https://lore.kernel.org/all/aS1qC_ol2XEpZ44b@google.com/
Reported-by: Miguel Ojeda <ojeda@kernel.org>
Closes: https://github.com/Rust-for-Linux/linux/issues/1211
Signed-off-by: Hsiu Che Yu <yu.whisper.personal@gmail.com>
Acked-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20251204033849.23480-1-yu.whisper.personal@gmail.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
show more ...
|
| 841f31d2 | 24-Nov-2025 |
Alexandre Courbot <acourbot@nvidia.com> |
rust: num: bounded: rename `try_into_bitint` to `try_into_bounded`
This is a remnant from when `Bounded` was called `BitInt` which I didn't
rename. Fix this.
Fixes: 01e345e82ec3 ("rust: num: add Bo
rust: num: bounded: rename `try_into_bitint` to `try_into_bounded`
This is a remnant from when `Bounded` was called `BitInt` which I didn't
rename. Fix this.
Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type")
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20251124-bounded_fix-v1-1-d8e34e1c727f@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
show more ...
|
| bc197e24 | 22-Nov-2025 |
Alexandre Courbot <acourbot@nvidia.com> |
rust: num: bounded: Always inline fits_within and from_expr
`from_expr` relies on `build_assert` to infer that the passed expression
fits the type's boundaries at build time. That inference can only
rust: num: bounded: Always inline fits_within and from_expr
`from_expr` relies on `build_assert` to infer that the passed expression
fits the type's boundaries at build time. That inference can only be
successful its code (and that of `fits_within`, which performs the
check) is inlined, as a dedicated function would need to work with a
variable and cannot verify that property.
While inlining happens as expected in most cases, it is not guaranteed.
In particular, kernel options that optimize for size like
`CONFIG_CC_OPTIMIZE_FOR_SIZE` can result in `from_expr` not being
inlined.
Add `#[inline(always)]` attributes to both `fits_within` and `from_expr`
to make the compiler inline these functions more aggressively, as it
does not make sense to use them non-inlined anyway.
[ For reference, the errors look like:
ld.lld: error: undefined symbol: rust_build_error
>>> referenced by build_assert.rs:83 (rust/kernel/build_assert.rs:83)
>>> rust/doctests_kernel_generated.o:(<kernel::num::bounded::Bounded<u8, 1>>::from_expr) in archive vmlinux.a
- Miguel ]
Fixes: 01e345e82ec3 ("rust: num: add Bounded integer wrapping type")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202511210055.RUsFNku1-lkp@intel.com/
Suggested-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Alexandre Courbot <acourbot@nvidia.com>
Link: https://patch.msgid.link/20251122-bounded_ints_fix-v1-1-1e07589d4955@nvidia.com
Signed-off-by: Miguel Ojeda <ojeda@kernel.org>
show more ...
|