minmax.h

  1/* SPDX-License-Identifier: GPL-2.0 */
  2#ifndef _LINUX_MINMAX_H
  3#define _LINUX_MINMAX_H
  4
  5#include <linux/build_bug.h>
  6#include <linux/compiler.h>
  7#include <linux/const.h>
  8#include <linux/types.h>
  9
 10/*
 11 * min()/max()/clamp() macros must accomplish several things:
 12 *
 13 * - Avoid multiple evaluations of the arguments (so side-effects like
 14 *   "x++" happen only once) when non-constant.
 15 * - Perform signed v unsigned type-checking (to generate compile
 16 *   errors instead of nasty runtime surprises).
 17 * - Unsigned char/short are always promoted to signed int and can be
 18 *   compared against signed or unsigned arguments.
 19 * - Unsigned arguments can be compared against non-negative signed constants.
 20 * - Comparison of a signed argument against an unsigned constant fails
 21 *   even if the constant is below __INT_MAX__ and could be cast to int.
 22 */
 23#define __typecheck(x, y) \
 24	(!!(sizeof((typeof(x) *)1 == (typeof(y) *)1)))
 25
 26/*
 27 * __sign_use for integer expressions:
 28 *   bit #0 set if ok for unsigned comparisons
 29 *   bit #1 set if ok for signed comparisons
 30 *
 31 * In particular, statically non-negative signed integer expressions
 32 * are ok for both.
 33 *
 34 * NOTE! Unsigned types smaller than 'int' are implicitly converted to 'int'
 35 * in expressions, and are accepted for signed conversions for now.
 36 * This is debatable.
 37 *
 38 * Note that 'x' is the original expression, and 'ux' is the unique variable
 39 * that contains the value.
 40 *
 41 * We use 'ux' for pure type checking, and 'x' for when we need to look at the
 42 * value (but without evaluating it for side effects!
 43 * Careful to only ever evaluate it with sizeof() or __builtin_constant_p() etc).
 44 *
 45 * Pointers end up being checked by the normal C type rules at the actual
 46 * comparison, and these expressions only need to be careful to not cause
 47 * warnings for pointer use.
 48 */
 49#define __sign_use(ux) (is_signed_type(typeof(ux)) ? \
 50	(2 + __is_nonneg(ux)) : (1 + 2 * (sizeof(ux) < 4)))
 51
 52/*
 53 * Check whether a signed value is always non-negative.
 54 *
 55 * A cast is needed to avoid any warnings from values that aren't signed
 56 * integer types (in which case the result doesn't matter).
 57 *
 58 * On 64-bit any integer or pointer type can safely be cast to 'long long'.
 59 * But on 32-bit we need to avoid warnings about casting pointers to integers
 60 * of different sizes without truncating 64-bit values so 'long' or 'long long'
 61 * must be used depending on the size of the value.
 62 *
 63 * This does not work for 128-bit signed integers since the cast would truncate
 64 * them, but we do not use s128 types in the kernel (we do use 'u128',
 65 * but they are handled by the !is_signed_type() case).
 66 */
 67#if __SIZEOF_POINTER__ == __SIZEOF_LONG_LONG__
 68#define __is_nonneg(ux) statically_true((long long)(ux) >= 0)
 69#else
 70#define __is_nonneg(ux) statically_true( \
 71	(typeof(__builtin_choose_expr(sizeof(ux) > 4, 1LL, 1L)))(ux) >= 0)
 72#endif
 73
 74#define __types_ok(ux, uy) \
 75	(__sign_use(ux) & __sign_use(uy))
 76
 77#define __types_ok3(ux, uy, uz) \
 78	(__sign_use(ux) & __sign_use(uy) & __sign_use(uz))
 79
 80#define __cmp_op_min <
 81#define __cmp_op_max >
 82
 83#define __cmp(op, x, y)	((x) __cmp_op_##op (y) ? (x) : (y))
 84
 85#define __cmp_once_unique(op, type, x, y, ux, uy) \
 86	({ type ux = (x); type uy = (y); __cmp(op, ux, uy); })
 87
 88#define __cmp_once(op, type, x, y) \
 89	__cmp_once_unique(op, type, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
 90
 91#define __careful_cmp_once(op, x, y, ux, uy) ({		\
 92	auto ux = (x); auto uy = (y);			\
 93	BUILD_BUG_ON_MSG(!__types_ok(ux, uy),		\
 94		#op"("#x", "#y") signedness error");	\
 95	__cmp(op, ux, uy); })
 96
 97#define __careful_cmp(op, x, y) \
 98	__careful_cmp_once(op, x, y, __UNIQUE_ID(x_), __UNIQUE_ID(y_))
 99
100/**
101 * min - return minimum of two values of the same or compatible types
102 * @x: first value
103 * @y: second value
104 */
105#define min(x, y)	__careful_cmp(min, x, y)
106
107/**
108 * max - return maximum of two values of the same or compatible types
109 * @x: first value
110 * @y: second value
111 */
112#define max(x, y)	__careful_cmp(max, x, y)
113
114/**
115 * umin - return minimum of two non-negative values
116 *   Signed types are zero extended to match a larger unsigned type.
117 * @x: first value
118 * @y: second value
119 */
120#define umin(x, y)	\
121	__careful_cmp(min, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull)
122
123/**
124 * umax - return maximum of two non-negative values
125 * @x: first value
126 * @y: second value
127 */
128#define umax(x, y)	\
129	__careful_cmp(max, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull)
130
131#define __careful_op3(op, x, y, z, ux, uy, uz) ({			\
132	auto ux = (x); auto uy = (y); auto uz = (z);			\
133	BUILD_BUG_ON_MSG(!__types_ok3(ux, uy, uz),			\
134		#op"3("#x", "#y", "#z") signedness error");		\
135	__cmp(op, ux, __cmp(op, uy, uz)); })
136
137/**
138 * min3 - return minimum of three values
139 * @x: first value
140 * @y: second value
141 * @z: third value
142 */
143#define min3(x, y, z) \
144	__careful_op3(min, x, y, z, __UNIQUE_ID(x_), __UNIQUE_ID(y_), __UNIQUE_ID(z_))
145
146/**
147 * max3 - return maximum of three values
148 * @x: first value
149 * @y: second value
150 * @z: third value
151 */
152#define max3(x, y, z) \
153	__careful_op3(max, x, y, z, __UNIQUE_ID(x_), __UNIQUE_ID(y_), __UNIQUE_ID(z_))
154
155/**
156 * min_t - return minimum of two values, using the specified type
157 * @type: data type to use
158 * @x: first value
159 * @y: second value
160 */
161#define min_t(type, x, y) __cmp_once(min, type, x, y)
162
163/**
164 * max_t - return maximum of two values, using the specified type
165 * @type: data type to use
166 * @x: first value
167 * @y: second value
168 */
169#define max_t(type, x, y) __cmp_once(max, type, x, y)
170
171/**
172 * min_not_zero - return the minimum that is _not_ zero, unless both are zero
173 * @x: value1
174 * @y: value2
175 */
176#define min_not_zero(x, y) ({			\
177	typeof(x) __x = (x);			\
178	typeof(y) __y = (y);			\
179	__x == 0 ? __y : ((__y == 0) ? __x : min(__x, __y)); })
180
181#define __clamp(val, lo, hi)	\
182	((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val)))
183
184#define __clamp_once(type, val, lo, hi, uval, ulo, uhi) ({			\
185	type uval = (val);							\
186	type ulo = (lo);							\
187	type uhi = (hi);							\
188	BUILD_BUG_ON_MSG(statically_true(ulo > uhi),				\
189		"clamp() low limit " #lo " greater than high limit " #hi);	\
190	BUILD_BUG_ON_MSG(!__types_ok3(uval, ulo, uhi),				\
191		"clamp("#val", "#lo", "#hi") signedness error");		\
192	__clamp(uval, ulo, uhi); })
193
194#define __careful_clamp(type, val, lo, hi) \
195	__clamp_once(type, val, lo, hi, __UNIQUE_ID(v_), __UNIQUE_ID(l_), __UNIQUE_ID(h_))
196
197/**
198 * clamp - return a value clamped to a given range with typechecking
199 * @val: current value
200 * @lo: lowest allowable value
201 * @hi: highest allowable value
202 *
203 * This macro checks @val/@lo/@hi to make sure they have compatible
204 * signedness.
205 */
206#define clamp(val, lo, hi) __careful_clamp(auto, val, lo, hi)
207
208/**
209 * clamp_t - return a value clamped to a given range using a given type
210 * @type: the type of variable to use
211 * @val: current value
212 * @lo: minimum allowable value
213 * @hi: maximum allowable value
214 *
215 * This macro does no typechecking and uses temporary variables of type
216 * @type to make all the comparisons.
217 */
218#define clamp_t(type, val, lo, hi) __careful_clamp(type, val, lo, hi)
219
220/**
221 * clamp_val - return a value clamped to a given range using val's type
222 * @val: current value
223 * @lo: minimum allowable value
224 * @hi: maximum allowable value
225 *
226 * This macro does no typechecking and uses temporary variables of whatever
227 * type the input argument @val is.  This is useful when @val is an unsigned
228 * type and @lo and @hi are literals that will otherwise be assigned a signed
229 * integer type.
230 */
231#define clamp_val(val, lo, hi) __careful_clamp(typeof(val), val, lo, hi)
232
233/*
234 * Do not check the array parameter using __must_be_array().
235 * In the following legit use-case where the "array" passed is a simple pointer,
236 * __must_be_array() will return a failure.
237 * --- 8< ---
238 * int *buff
239 * ...
240 * min = min_array(buff, nb_items);
241 * --- 8< ---
242 *
243 * The first typeof(&(array)[0]) is needed in order to support arrays of both
244 * 'int *buff' and 'int buff[N]' types.
245 *
246 * The array can be an array of const items.
247 * typeof() keeps the const qualifier. Use __unqual_scalar_typeof() in order
248 * to discard the const qualifier for the __element variable.
249 */
250#define __minmax_array(op, array, len) ({				\
251	typeof(&(array)[0]) __array = (array);				\
252	typeof(len) __len = (len);					\
253	__unqual_scalar_typeof(__array[0]) __element = __array[--__len];\
254	while (__len--)							\
255		__element = op(__element, __array[__len]);		\
256	__element; })
257
258/**
259 * min_array - return minimum of values present in an array
260 * @array: array
261 * @len: array length
262 *
263 * Note that @len must not be zero (empty array).
264 */
265#define min_array(array, len) __minmax_array(min, array, len)
266
267/**
268 * max_array - return maximum of values present in an array
269 * @array: array
270 * @len: array length
271 *
272 * Note that @len must not be zero (empty array).
273 */
274#define max_array(array, len) __minmax_array(max, array, len)
275
276static inline bool in_range64(u64 val, u64 start, u64 len)
277{
278	return (val - start) < len;
279}
280
281static inline bool in_range32(u32 val, u32 start, u32 len)
282{
283	return (val - start) < len;
284}
285
286/**
287 * in_range - Determine if a value lies within a range.
288 * @val: Value to test.
289 * @start: First value in range.
290 * @len: Number of values in range.
291 *
292 * This is more efficient than "if (start <= val && val < (start + len))".
293 * It also gives a different answer if @start + @len overflows the size of
294 * the type by a sufficient amount to encompass @val.  Decide for yourself
295 * which behaviour you want, or prove that start + len never overflow.
296 * Do not blindly replace one form with the other.
297 */
298#define in_range(val, start, len)					\
299	((sizeof(start) | sizeof(len) | sizeof(val)) <= sizeof(u32) ?	\
300		in_range32(val, start, len) : in_range64(val, start, len))
301
302/**
303 * swap - swap values of @a and @b
304 * @a: first value
305 * @b: second value
306 */
307#define swap(a, b) \
308	do { typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; } while (0)
309
310/*
311 * Use these carefully: no type checking, and uses the arguments
312 * multiple times. Use for obvious constants only.
313 */
314#define MIN(a, b) __cmp(min, a, b)
315#define MAX(a, b) __cmp(max, a, b)
316#define MIN_T(type, a, b) __cmp(min, (type)(a), (type)(b))
317#define MAX_T(type, a, b) __cmp(max, (type)(a), (type)(b))
318
319#endif	/* _LINUX_MINMAX_H */