[PATCH v2 0/3] rust: introduce cv! macro for safe const conversions of integer-like types

[PATCH v2 0/3] rust: introduce cv! macro for safe const conversions of integer-like types

[Eliot Courtney]

This series introduces the cv! ("const value") macro for safe compile
time conversions of integer-like types. The syntax is `cv!(literal or
expression)`, or `cv!(literal or expression => type)` when it needs some
help with type inference. The result is that many expressions can be
rewritten into a compile time safe (no `as`) and less visually busy
style, for example:

```
- const DMA_LEN: u32 = casts::usize_into_u32::<{ MEM_BLOCK_ALIGNMENT }>();
+ const DMA_LEN: u32 = cv!(MEM_BLOCK_ALIGNMENT);

- .with_const_msg_type::<{ casts::u8_as_u32(MSG_TYPE_VENDOR_PCI) }>()
+ .with_const_msg_type(cv!(MSG_TYPE_VENDOR_PCI))

- data: [[u8; GSP_PAGE_SIZE]; casts::u32_as_usize(MSGQ_NUM_PAGES)],
+ data: [[u8; GSP_PAGE_SIZE]; cv!(MSGQ_NUM_PAGES)],

-pub const NSEC_PER_SEC: i64 = bindings::NSEC_PER_SEC as i64;
+pub const NSEC_PER_SEC: i64 = cv!(bindings::NSEC_PER_SEC);

-//! let b = Bounded::<u16, 5>::new::<0x18>();
+//! let b: Bounded<u16, 5> = cv!(0x18);
```

This works by defining a trait `FromConst<const V: i128>` with an
associated constant `VALUE`. Then each implementor sets `VALUE` to a
constant expression. This works around not having const traits. An
alternative idea from Gary defined a FromLiteral::from_literal<V>
function [1]. This version essentially moves the implementation of that
function to the const block of the associated constant (since it has to
be executable at compile time anyway).

This is based on ideas from Gary Guo [1], Alice Ryhl [2], and Alexandre
Courbot [3].

One (potential) limitation is that const generic types or values can't
be used with cv!, because it requires the const generic expressions
feature. The const_as! [3] macro did not have this limitation. This is
worked around by special casing conversions to language integral types
in the cv! macro (essentially subsuming const_as!). This special casing
can be removed when const generic expressions can be used.

Some code is taken with permission from Alex's const_as! series.

The structure of this series is as follows:

1. cv! macro
2. updates to nova-core to use cv!

For a follow up series (I've already written this, but to avoid spamming
a ton while we iterate on cv!, I'd send this after):

3. updates to various other code to use cv!
4. misc updates to other code to remove usages of `as`

We have multiple ways of converting - T::from(),
FromSafeCast/IntoSafeCast, cv!, *_as_*. This series uses them in that
order of priority, based on Alex's suggestion [4].

This is based on rust-next.

[1] https://lore.kernel.org/all/DKT6WNPI2OA5.3RCBNYHHAFAD9@garyguo.net/
[2] https://lore.kernel.org/all/CAH5fLgiGcOn+HQLj4w9yDc31V54PbqNUQv8cUFRoEuFzQrAAZA@mail.gmail.com/
[3] https://lore.kernel.org/all/20260825-const_as-v1-0-1ce712225fe2@nvidia.com/
[4] https://lore.kernel.org/all/DKYTZNAX6ON6.1K1372FFAQOF7@nvidia.com/

Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
---
Changes in v2:
- Improve error messages (Gary)
- Remove pre-req for Alex's nova-core num->kernel series.
- Link to v1: https://patch.msgid.link/20260828-cv-v1-0-48a180dfc4c8@nvidia.com

---
Eliot Courtney (3):
      rust: num: add cv! macro to create values from constant expressions
      rust: prelude: add `num::cv`
      gpu: nova-core: use cv! for constant casts

 drivers/gpu/nova-core/falcon.rs                    |   9 +-
 drivers/gpu/nova-core/fb/hal/gb100.rs              |   4 +-
 drivers/gpu/nova-core/firmware/fwsec/bootloader.rs |   7 +-
 drivers/gpu/nova-core/fsp.rs                       |   3 +-
 drivers/gpu/nova-core/gsp/cmdq.rs                  |   6 +-
 drivers/gpu/nova-core/gsp/fw.rs                    |  38 +++---
 drivers/gpu/nova-core/gsp/fw/commands.rs           |   2 +-
 drivers/gpu/nova-core/num.rs                       |  55 +--------
 rust/kernel/num.rs                                 | 132 +++++++++++++++++++++
 rust/kernel/num/bounded.rs                         |  19 +++
 rust/kernel/prelude.rs                             |   1 +
 rust/kernel/ptr.rs                                 |  14 +++
 12 files changed, 194 insertions(+), 96 deletions(-)
---
base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
change-id: 20260828-cv-8d4e952fc14c

Best regards,
--  
Eliot Courtney <ecourtney@nvidia.com>

[PATCH v2 1/3] rust: num: add cv! macro to create values from constant expressions

[Eliot Courtney]

Currently, using NonZero/Bounded constants is quite verbose. It's
unfortunate because it disincentivizes using it in interface boundaries.
Introduce a macro to make it nicer to use. The macro `cv!` (for constant
value) takes a const integer expression and widens it to i128 (at build
time only) before passing it as a const generic value to a new trait
`FromConst`. The value is then converted and appears in the
associated constant `FromConst::VALUE`. The trait is implemented by
NonZero, Bounded, and Alignment and lets values of each be constructed
from constants without a verbose turbofish syntax.
For example, `const { NonZero::new(1).unwrap() }` can be written as
`cv!(1)`.

Suggested-by: Gary Guo <gary@garyguo.net>
Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
---
 rust/kernel/num.rs         | 133 +++++++++++++++++++++++++++++++++++++++++++++
 rust/kernel/num/bounded.rs |  19 +++++++
 rust/kernel/ptr.rs         |  14 +++++
 3 files changed, 166 insertions(+)

diff --git a/rust/kernel/num.rs b/rust/kernel/num.rs
index dbe848e30efe..01ae2538b3e4 100644
--- a/rust/kernel/num.rs
+++ b/rust/kernel/num.rs
@@ -2,6 +2,7 @@
 
 //! Additional numerical features for the kernel.
 
+use crate::const_assert;
 use core::ops;
 
 pub mod bounded;
@@ -9,6 +10,138 @@
 
 pub use bounded::*;
 
+/// Creates a value from an integer constant expression, with validity checked at build time.
+///
+/// This works for any type that implements [`FromConst`], with the target type inferred from
+/// the context, or named explicitly with `cv!(value => Type)`.
+///
+/// # Examples
+///
+/// ```
+/// use core::num::NonZero;
+/// use kernel::num::Bounded;
+/// use kernel::num::cv;
+/// use kernel::ptr::Alignment;
+///
+/// let v: NonZero<usize> = cv!(8);
+/// assert_eq!(v.get(), 8);
+///
+/// // Any integer constant expression works, not only literals.
+/// let m: NonZero<usize> = cv!(usize::MAX);
+/// assert_eq!(m.get(), usize::MAX);
+///
+/// let b: Bounded<u32, 4> = cv!(15);
+/// assert_eq!(b.get(), 15);
+///
+/// let a: Alignment = cv!(4096);
+/// assert_eq!(a.as_usize(), 4096);
+///
+/// // Checked narrowing of integer constants, including in `const` items.
+/// const SMALL: u8 = cv!(200u32);
+/// assert_eq!(SMALL, 200);
+///
+/// const N: NonZero<u8> = cv!(5);
+/// assert_eq!(N.get(), 5);
+///
+/// // The target type can be given explicitly.
+/// let e = cv!(200u32 => u8);
+/// assert_eq!(e, 200);
+///
+/// // With an explicit primitive target, the expression can use generic parameters.
+/// const fn as_u64<const KEY: u16>() -> u64 {
+///     cv!(KEY => u64)
+/// }
+/// assert_eq!(as_u64::<0x40>(), 0x40);
+/// ```
+#[macro_export]
+#[doc(hidden)]
+macro_rules! cv {
+    (@cast $v:expr => $t:ty) => {
+        const {
+            #[allow(unused_comparisons, unused_assignments, clippy::as_underscore)]
+            {
+                let v = $v;
+                let r = v as $t;
+                // Pin `back` to `v`'s type so `as _` casts back to the source type.
+                let mut back = v;
+                back = r as _;
+
+                ::core::assert!(
+                    back == v && (v < 0) == (r < 0),
+                    "value does not fit into the target type"
+                );
+
+                r
+            }
+        }
+    };
+    ($v:expr => u8) => { $crate::cv!(@cast $v => u8) };
+    ($v:expr => u16) => { $crate::cv!(@cast $v => u16) };
+    ($v:expr => u32) => { $crate::cv!(@cast $v => u32) };
+    ($v:expr => u64) => { $crate::cv!(@cast $v => u64) };
+    ($v:expr => u128) => { $crate::cv!(@cast $v => u128) };
+    ($v:expr => usize) => { $crate::cv!(@cast $v => usize) };
+    ($v:expr => i8) => { $crate::cv!(@cast $v => i8) };
+    ($v:expr => i16) => { $crate::cv!(@cast $v => i16) };
+    ($v:expr => i32) => { $crate::cv!(@cast $v => i32) };
+    ($v:expr => i64) => { $crate::cv!(@cast $v => i64) };
+    ($v:expr => i128) => { $crate::cv!(@cast $v => i128) };
+    ($v:expr => isize) => { $crate::cv!(@cast $v => isize) };
+    ($v:expr => $t:ty) => {
+        <$t as $crate::num::FromConst<{ $crate::cv!(@cast $v => i128) }>>::VALUE
+    };
+    ($v:expr) => {
+        <_ as $crate::num::FromConst<{ $crate::cv!(@cast $v => i128) }>>::VALUE
+    };
+}
+#[doc(inline)]
+pub use cv;
+
+/// Types that can be created from an integer constant expression validated at build time.
+#[diagnostic::on_unimplemented(message = "`{Self}` cannot be converted from a constant")]
+pub trait FromConst<const V: i128>: Sized {
+    /// The value that corresponds to the constant `V`.
+    ///
+    /// Fails the build if `V` is not a valid value for `Self`.
+    const VALUE: Self;
+}
+
+/// Implements [`FromConst`] for primitive integer types and their [`NonZero`](core::num::NonZero)
+/// versions.
+macro_rules! impl_from_const {
+    ($($type:ty)*) => {
+        $(
+        impl<const V: i128> FromConst<V> for $type {
+            const VALUE: Self = {
+                const_assert!(
+                    V >= <$type>::MIN as i128 && V <= <$type>::MAX as i128,
+                    "Constant cannot be represented by the target type."
+                );
+
+                V as $type
+            };
+        }
+
+        impl<const V: i128> FromConst<V> for core::num::NonZero<$type> {
+            const VALUE: Self = {
+                const_assert!(V != 0, "Constant cannot be zero.");
+                const_assert!(
+                    V >= <$type>::MIN as i128 && V <= <$type>::MAX as i128,
+                    "Constant cannot be represented by the underlying type."
+                );
+
+                core::num::NonZero::new(V as $type).unwrap()
+            };
+        }
+        )*
+    };
+}
+
+impl_from_const!(
+    u8 u16 u32 u64 usize
+    i8 i16 i32 i64 isize
+);
+
 /// Designates unsigned primitive types.
 pub enum Unsigned {}
 
diff --git a/rust/kernel/num/bounded.rs b/rust/kernel/num/bounded.rs
index 2a2b0a4bca5e..0cfb3ef16a6d 100644
--- a/rust/kernel/num/bounded.rs
+++ b/rust/kernel/num/bounded.rs
@@ -14,6 +14,7 @@
 
 use kernel::{
     num::{
+        FromConst,
         Integer,
         Unsigned, //
     },
@@ -272,6 +273,24 @@ pub const fn new<const VALUE: $type>() -> Self {
                 unsafe { Self::__new(VALUE) }
             }
         }
+
+        impl<const N: u32, const V: i128> FromConst<V> for Bounded<$type, N> {
+            const VALUE: Self = {
+                const_assert!(
+                    V >= <$type>::MIN as i128 && V <= <$type>::MAX as i128,
+                    "Constant cannot be represented by the underlying type."
+                );
+                // Statically assert that `V` fits within the set number of bits.
+                const_assert!(
+                    fits_within!(V as $type, $type, N),
+                    "Constant cannot be represented within the given number of bits."
+                );
+
+                // SAFETY: the asserts above confirmed that `V` can be represented within `N`
+                // bits.
+                unsafe { Self::__new(V as $type) }
+            };
+        }
         )*
     };
 }
diff --git a/rust/kernel/ptr.rs b/rust/kernel/ptr.rs
index 82acb531b17b..ecb73bdb0c5f 100644
--- a/rust/kernel/ptr.rs
+++ b/rust/kernel/ptr.rs
@@ -166,6 +166,20 @@ pub const fn mask(self) -> usize {
     }
 }
 
+impl<const V: i128> crate::num::FromConst<V> for Alignment {
+    const VALUE: Self = {
+        const_assert!(
+            V > 0 && V <= usize::MAX as i128,
+            "Constant cannot be represented as an Alignment."
+        );
+
+        match Alignment::new_checked(V as usize) {
+            Some(alignment) => alignment,
+            None => panic!("Constant is not a power of two."),
+        }
+    };
+}
+
 /// Trait for items that can be aligned against an [`Alignment`].
 pub trait Alignable: Sized {
     /// Aligns `self` down to `alignment`.

-- 
2.55.0

Re: [PATCH v2 1/3] rust: num: add cv! macro to create values from constant expressions

[Gary Guo]

On Tue Sep 1, 2026 at 6:06 AM BST, Eliot Courtney wrote:
> Currently, using NonZero/Bounded constants is quite verbose. It's
> unfortunate because it disincentivizes using it in interface boundaries.
> Introduce a macro to make it nicer to use. The macro `cv!` (for constant
> value) takes a const integer expression and widens it to i128 (at build
> time only) before passing it as a const generic value to a new trait
> `FromConst`. The value is then converted and appears in the
> associated constant `FromConst::VALUE`. The trait is implemented by
> NonZero, Bounded, and Alignment and lets values of each be constructed
> from constants without a verbose turbofish syntax.
> For example, `const { NonZero::new(1).unwrap() }` can be written as
> `cv!(1)`.
>
> Suggested-by: Gary Guo <gary@garyguo.net>
> Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
> ---
>  rust/kernel/num.rs         | 133 +++++++++++++++++++++++++++++++++++++++++++++
>  rust/kernel/num/bounded.rs |  19 +++++++
>  rust/kernel/ptr.rs         |  14 +++++
>  3 files changed, 166 insertions(+)
>
> diff --git a/rust/kernel/num.rs b/rust/kernel/num.rs
> index dbe848e30efe..01ae2538b3e4 100644
> --- a/rust/kernel/num.rs
> +++ b/rust/kernel/num.rs
> @@ -2,6 +2,7 @@
>  
>  //! Additional numerical features for the kernel.
>  
> +use crate::const_assert;
>  use core::ops;
>  
>  pub mod bounded;
> @@ -9,6 +10,138 @@
>  
>  pub use bounded::*;
>  
> +/// Creates a value from an integer constant expression, with validity checked at build time.
> +///
> +/// This works for any type that implements [`FromConst`], with the target type inferred from
> +/// the context, or named explicitly with `cv!(value => Type)`.
> +///
> +/// # Examples
> +///
> +/// ```
> +/// use core::num::NonZero;
> +/// use kernel::num::Bounded;
> +/// use kernel::num::cv;
> +/// use kernel::ptr::Alignment;
> +///
> +/// let v: NonZero<usize> = cv!(8);
> +/// assert_eq!(v.get(), 8);
> +///
> +/// // Any integer constant expression works, not only literals.
> +/// let m: NonZero<usize> = cv!(usize::MAX);
> +/// assert_eq!(m.get(), usize::MAX);
> +///
> +/// let b: Bounded<u32, 4> = cv!(15);
> +/// assert_eq!(b.get(), 15);
> +///
> +/// let a: Alignment = cv!(4096);
> +/// assert_eq!(a.as_usize(), 4096);
> +///
> +/// // Checked narrowing of integer constants, including in `const` items.
> +/// const SMALL: u8 = cv!(200u32);
> +/// assert_eq!(SMALL, 200);
> +///
> +/// const N: NonZero<u8> = cv!(5);
> +/// assert_eq!(N.get(), 5);
> +///
> +/// // The target type can be given explicitly.
> +/// let e = cv!(200u32 => u8);
> +/// assert_eq!(e, 200);
> +///
> +/// // With an explicit primitive target, the expression can use generic parameters.
> +/// const fn as_u64<const KEY: u16>() -> u64 {
> +///     cv!(KEY => u64)
> +/// }
> +/// assert_eq!(as_u64::<0x40>(), 0x40);
> +/// ```
> +#[macro_export]
> +#[doc(hidden)]
> +macro_rules! cv {
> +    (@cast $v:expr => $t:ty) => {
> +        const {
> +            #[allow(unused_comparisons, unused_assignments, clippy::as_underscore)]
> +            {
> +                let v = $v;
> +                let r = v as $t;
> +                // Pin `back` to `v`'s type so `as _` casts back to the source type.
> +                let mut back = v;
> +                back = r as _;
> +
> +                ::core::assert!(
> +                    back == v && (v < 0) == (r < 0),
> +                    "value does not fit into the target type"
> +                );
> +
> +                r
> +            }
> +        }
> +    };
> +    ($v:expr => u8) => { $crate::cv!(@cast $v => u8) };
> +    ($v:expr => u16) => { $crate::cv!(@cast $v => u16) };
> +    ($v:expr => u32) => { $crate::cv!(@cast $v => u32) };
> +    ($v:expr => u64) => { $crate::cv!(@cast $v => u64) };
> +    ($v:expr => u128) => { $crate::cv!(@cast $v => u128) };
> +    ($v:expr => usize) => { $crate::cv!(@cast $v => usize) };
> +    ($v:expr => i8) => { $crate::cv!(@cast $v => i8) };
> +    ($v:expr => i16) => { $crate::cv!(@cast $v => i16) };
> +    ($v:expr => i32) => { $crate::cv!(@cast $v => i32) };
> +    ($v:expr => i64) => { $crate::cv!(@cast $v => i64) };
> +    ($v:expr => i128) => { $crate::cv!(@cast $v => i128) };
> +    ($v:expr => isize) => { $crate::cv!(@cast $v => isize) };
> +    ($v:expr => $t:ty) => {
> +        <$t as $crate::num::FromConst<{ $crate::cv!(@cast $v => i128) }>>::VALUE
> +    };
> +    ($v:expr) => {
> +        <_ as $crate::num::FromConst<{ $crate::cv!(@cast $v => i128) }>>::VALUE
> +    };
> +}
> +#[doc(inline)]
> +pub use cv;
> +
> +/// Types that can be created from an integer constant expression validated at build time.

Can you add a comment referencing the `cv!` macro and advice against using this
directly?

> +#[diagnostic::on_unimplemented(message = "`{Self}` cannot be converted from a constant")]
> +pub trait FromConst<const V: i128>: Sized {
> +    /// The value that corresponds to the constant `V`.
> +    ///
> +    /// Fails the build if `V` is not a valid value for `Self`.
> +    const VALUE: Self;
> +}
> +
> +/// Implements [`FromConst`] for primitive integer types and their [`NonZero`](core::num::NonZero)
> +/// versions.
> +macro_rules! impl_from_const {
> +    ($($type:ty)*) => {
> +        $(
> +        impl<const V: i128> FromConst<V> for $type {
> +            const VALUE: Self = {
> +                const_assert!(
> +                    V >= <$type>::MIN as i128 && V <= <$type>::MAX as i128,
> +                    "Constant cannot be represented by the target type."
> +                );

nit: as this forms part of compiler error message, this should start with lower case and
not have ending with period, to be consistent with other Rust error messages. I
probably should have mentioned why I made the change in my alt version.

Also, `const_assert!` would have an additional `const {}` wrapping which won't
be necessary because we're already in a definitively const context. Probably not
matter though.

> +
> +                V as $type
> +            };
> +        }
> +
> +        impl<const V: i128> FromConst<V> for core::num::NonZero<$type> {
> +            const VALUE: Self = {
> +                const_assert!(V != 0, "Constant cannot be zero.");
> +                const_assert!(
> +                    V >= <$type>::MIN as i128 && V <= <$type>::MAX as i128,
> +                    "Constant cannot be represented by the underlying type."
> +                );
> +
> +                core::num::NonZero::new(V as $type).unwrap()

This unwrap duplicates the zero check, which is why my alt version does a match
here instead.

Best,
Gary

> +            };
> +        }
> +        )*
> +    };
> +}
> +
> +impl_from_const!(
> +    u8 u16 u32 u64 usize
> +    i8 i16 i32 i64 isize
> +);
> +
>  /// Designates unsigned primitive types.
>  pub enum Unsigned {}
>  
> diff --git a/rust/kernel/num/bounded.rs b/rust/kernel/num/bounded.rs
> index 2a2b0a4bca5e..0cfb3ef16a6d 100644
> --- a/rust/kernel/num/bounded.rs
> +++ b/rust/kernel/num/bounded.rs
> @@ -14,6 +14,7 @@
>  
>  use kernel::{
>      num::{
> +        FromConst,
>          Integer,
>          Unsigned, //
>      },
> @@ -272,6 +273,24 @@ pub const fn new<const VALUE: $type>() -> Self {
>                  unsafe { Self::__new(VALUE) }
>              }
>          }
> +
> +        impl<const N: u32, const V: i128> FromConst<V> for Bounded<$type, N> {
> +            const VALUE: Self = {
> +                const_assert!(
> +                    V >= <$type>::MIN as i128 && V <= <$type>::MAX as i128,
> +                    "Constant cannot be represented by the underlying type."
> +                );
> +                // Statically assert that `V` fits within the set number of bits.
> +                const_assert!(
> +                    fits_within!(V as $type, $type, N),
> +                    "Constant cannot be represented within the given number of bits."
> +                );
> +
> +                // SAFETY: the asserts above confirmed that `V` can be represented within `N`
> +                // bits.
> +                unsafe { Self::__new(V as $type) }
> +            };
> +        }
>          )*
>      };
>  }
> diff --git a/rust/kernel/ptr.rs b/rust/kernel/ptr.rs
> index 82acb531b17b..ecb73bdb0c5f 100644
> --- a/rust/kernel/ptr.rs
> +++ b/rust/kernel/ptr.rs
> @@ -166,6 +166,20 @@ pub const fn mask(self) -> usize {
>      }
>  }
>  
> +impl<const V: i128> crate::num::FromConst<V> for Alignment {
> +    const VALUE: Self = {
> +        const_assert!(
> +            V > 0 && V <= usize::MAX as i128,
> +            "Constant cannot be represented as an Alignment."
> +        );
> +
> +        match Alignment::new_checked(V as usize) {
> +            Some(alignment) => alignment,
> +            None => panic!("Constant is not a power of two."),
> +        }
> +    };
> +}
> +
>  /// Trait for items that can be aligned against an [`Alignment`].
>  pub trait Alignable: Sized {
>      /// Aligns `self` down to `alignment`.

Re: [PATCH v2 1/3] rust: num: add cv! macro to create values from constant expressions

[John Hubbard]

On 8/31/26 10:06 PM, Eliot Courtney wrote:
> Currently, using NonZero/Bounded constants is quite verbose. It's
> unfortunate because it disincentivizes using it in interface boundaries.
> Introduce a macro to make it nicer to use. The macro `cv!` (for constant
> value) takes a const integer expression and widens it to i128 (at build
> time only) before passing it as a const generic value to a new trait
> `FromConst`. The value is then converted and appears in the
> associated constant `FromConst::VALUE`. The trait is implemented by
> NonZero, Bounded, and Alignment and lets values of each be constructed
> from constants without a verbose turbofish syntax.
> For example, `const { NonZero::new(1).unwrap() }` can be written as
> `cv!(1)`.

Remarkable, in the sense that it seems like an oversight at the Rust
language level.

Alex, Miguel, is this worth mentioning at Kangrejos?

thanks,
-- 
John Hubbard

Re: [PATCH v2 1/3] rust: num: add cv! macro to create values from constant expressions

[Miguel Ojeda]

On Tue, Sep 1, 2026 at 10:19 PM John Hubbard <jhubbard@nvidia.com> wrote:
>
> Remarkable, in the sense that it seems like an oversight at the Rust
> language level.
>
> Alex, Miguel, is this worth mentioning at Kangrejos?

Yeah, it wouldn't hurt to discuss it if we have time, since we will
want an improvement here one way or another.

I raised it to upstream Rust in our last meeting last week (we also
discussed integer casts), i.e. they are aware and they agree some of
this can definitely be improved. It is of course not a new thing for
them, e.g. this issue:

  https://github.com/rust-lang/rust/issues/69329

I also have it in our usual lists ("Better `NonZero` ergonomics
(`f(1)` integer literal coercion, `1nz` literals or other
solutions)"):

  https://github.com/Rust-for-Linux/linux/issues/354

I hope that helps!

Cheers,
Miguel

[PATCH v2 2/3] rust: prelude: add `num::cv`

[Eliot Courtney]

Add the `cv!` macro to the prelude so it doesn't need to be imported
explicitly to use it.

Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
---
 rust/kernel/num.rs     | 1 -
 rust/kernel/prelude.rs | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/kernel/num.rs b/rust/kernel/num.rs
index 01ae2538b3e4..2207088dfb65 100644
--- a/rust/kernel/num.rs
+++ b/rust/kernel/num.rs
@@ -20,7 +20,6 @@
 /// ```
 /// use core::num::NonZero;
 /// use kernel::num::Bounded;
-/// use kernel::num::cv;
 /// use kernel::ptr::Alignment;
 ///
 /// let v: NonZero<usize> = cv!(8);
diff --git a/rust/kernel/prelude.rs b/rust/kernel/prelude.rs
index ca396f1f78a6..5facf8f7af90 100644
--- a/rust/kernel/prelude.rs
+++ b/rust/kernel/prelude.rs
@@ -106,6 +106,7 @@
         Result, //
     },
     init::InPlaceInit,
+    num::cv,
     pr_alert,
     pr_crit,
     pr_debug,

-- 
2.55.0

Re: [PATCH v2 2/3] rust: prelude: add `num::cv`

[Gary Guo]

On Tue Sep 1, 2026 at 6:06 AM BST, Eliot Courtney wrote:
> Add the `cv!` macro to the prelude so it doesn't need to be imported
> explicitly to use it.
> 
> Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>

Reviewed-by: Gary Guo <gary@garyguo.net>

> ---
>  rust/kernel/num.rs     | 1 -
>  rust/kernel/prelude.rs | 1 +
>  2 files changed, 1 insertion(+), 1 deletion(-)

[PATCH v2 3/3] gpu: nova-core: use cv! for constant casts

[Eliot Courtney]

The new `cv!` macro allows safe casting of constant expressions in a
const context. Update code in nova-core to use it.

Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
---
 drivers/gpu/nova-core/falcon.rs                    |  9 ++--
 drivers/gpu/nova-core/fb/hal/gb100.rs              |  4 +-
 drivers/gpu/nova-core/firmware/fwsec/bootloader.rs |  7 +--
 drivers/gpu/nova-core/fsp.rs                       |  3 +-
 drivers/gpu/nova-core/gsp/cmdq.rs                  |  6 +--
 drivers/gpu/nova-core/gsp/fw.rs                    | 38 +++++++--------
 drivers/gpu/nova-core/gsp/fw/commands.rs           |  2 +-
 drivers/gpu/nova-core/num.rs                       | 55 +---------------------
 8 files changed, 28 insertions(+), 96 deletions(-)

diff --git a/drivers/gpu/nova-core/falcon.rs b/drivers/gpu/nova-core/falcon.rs
index 65cb12d26e2b..0e0383331f42 100644
--- a/drivers/gpu/nova-core/falcon.rs
+++ b/drivers/gpu/nova-core/falcon.rs
@@ -29,11 +29,8 @@
     driver::Bar0,
     falcon::hal::LoadMethod,
     gpu::Chipset,
-    num::{
-        self,
-        FromSafeCast, //
-    },
-    regs,
+    num::FromSafeCast,
+    regs, //
 };
 
 pub(crate) mod fsp;
@@ -510,7 +507,7 @@ fn dma_wr(
         target_mem: FalconMem,
         load_offsets: FalconDmaLoadTarget,
     ) -> Result {
-        const DMA_LEN: u32 = num::usize_into_u32::<{ MEM_BLOCK_ALIGNMENT }>();
+        const DMA_LEN: u32 = cv!(MEM_BLOCK_ALIGNMENT);
 
         // DMA transfers can only be done in units of 256 bytes. Compute how many such transfers we
         // need to perform.
diff --git a/drivers/gpu/nova-core/fb/hal/gb100.rs b/drivers/gpu/nova-core/fb/hal/gb100.rs
index d9e4d62ae632..0bf00d381607 100644
--- a/drivers/gpu/nova-core/fb/hal/gb100.rs
+++ b/drivers/gpu/nova-core/fb/hal/gb100.rs
@@ -26,7 +26,6 @@
         hal::FbHal,
         regs, //
     },
-    num::usize_into_u32,
 };
 
 struct Gb100;
@@ -82,8 +81,7 @@ fn write_sysmem_flush_page_gb100(bar: Bar0<'_>, addr: Bounded<u64, 52>) {
 
 // This PMU reservation size is r570-specific.
 pub(super) const fn pmu_reserved_size_gb100() -> u32 {
-    usize_into_u32::<{ const_align_up(SZ_8M + SZ_16M + SZ_4K, Alignment::new::<SZ_128K>()).unwrap() }>(
-    )
+    cv!(const_align_up(SZ_8M + SZ_16M + SZ_4K, Alignment::new::<SZ_128K>()).unwrap())
 }
 
 impl FbHal for Gb100 {
diff --git a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
index ec4d92317a93..b51aca619a8c 100644
--- a/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
+++ b/drivers/gpu/nova-core/firmware/fwsec/bootloader.rs
@@ -14,10 +14,7 @@
     dma::Coherent,
     io::{register::WithBase, Io},
     prelude::*,
-    ptr::{
-        Alignable,
-        Alignment, //
-    },
+    ptr::Alignable,
     sizes,
     transmute::AsBytes,
 };
@@ -134,7 +131,7 @@ pub(crate) fn new(
             let code_size = usize::from_safe_cast(tlv.get_u32(b"CDSZ")?);
             let code = blob.get(..code_size).ok_or(EINVAL)?;
             let aligned_code_size = code_size
-                .align_up(Alignment::new::<{ falcon::MEM_BLOCK_ALIGNMENT }>())
+                .align_up(cv!(falcon::MEM_BLOCK_ALIGNMENT))
                 .ok_or(EINVAL)?;
 
             let mut ucode = KVec::with_capacity(aligned_code_size, GFP_KERNEL)?;
diff --git a/drivers/gpu/nova-core/fsp.rs b/drivers/gpu/nova-core/fsp.rs
index ab685fb4168f..e15d0af95499 100644
--- a/drivers/gpu/nova-core/fsp.rs
+++ b/drivers/gpu/nova-core/fsp.rs
@@ -47,7 +47,6 @@
         NvdmHeader,
         NvdmType, //
     },
-    num,
     regs, //
 };
 
@@ -285,7 +284,7 @@ fn new<'a>(
         };
 
         let version = hal.cot_version();
-        let size = num::usize_into_u16::<{ core::mem::size_of::<NvdmPayloadCot>() }>();
+        let size = cv!(core::mem::size_of::<NvdmPayloadCot>() => u16);
 
         Ok(init!(Self {
             header: FspMessageHeader::new(NvdmType::Cot),
diff --git a/drivers/gpu/nova-core/gsp/cmdq.rs b/drivers/gpu/nova-core/gsp/cmdq.rs
index 6da728201281..bf8ade55b304 100644
--- a/drivers/gpu/nova-core/gsp/cmdq.rs
+++ b/drivers/gpu/nova-core/gsp/cmdq.rs
@@ -162,7 +162,7 @@ fn read(
 #[repr(C, align(0x1000))]
 #[derive(Debug)]
 struct MsgqData {
-    data: [[u8; GSP_PAGE_SIZE]; num::u32_as_usize(MSGQ_NUM_PAGES)],
+    data: [[u8; GSP_PAGE_SIZE]; cv!(MSGQ_NUM_PAGES)],
 }
 
 // Annoyingly we are forced to use a literal to specify the alignment of
@@ -235,8 +235,8 @@ unsafe impl FromBytes for GspMem {}
 impl DmaGspMem {
     /// Allocate a new instance and map it for `dev`.
     fn new(dev: &device::Device<device::Bound>) -> Result<Self> {
-        const MSGQ_SIZE: u32 = num::usize_into_u32::<{ size_of::<Msgq>() }>();
-        const RX_HDR_OFF: u32 = num::usize_into_u32::<{ mem::offset_of!(Msgq, rx) }>();
+        const MSGQ_SIZE: u32 = cv!(size_of::<Msgq>());
+        const RX_HDR_OFF: u32 = cv!(mem::offset_of!(Msgq, rx));
 
         let mut gsp_mem = CoherentBox::<GspMem>::zeroed(dev, GFP_KERNEL)?;
         gsp_mem.cpuq.tx = MsgqTxHeader::new(MSGQ_SIZE, RX_HDR_OFF, MSGQ_NUM_PAGES);
diff --git a/drivers/gpu/nova-core/gsp/fw.rs b/drivers/gpu/nova-core/gsp/fw.rs
index 05f54fee6186..33ec3d983c08 100644
--- a/drivers/gpu/nova-core/gsp/fw.rs
+++ b/drivers/gpu/nova-core/gsp/fw.rs
@@ -57,7 +57,7 @@
 
 /// Maximum size of a single GSP message queue element in bytes.
 pub(crate) const GSP_MSG_QUEUE_ELEMENT_SIZE_MAX: usize =
-    num::u32_as_usize(bindings::GSP_MSG_QUEUE_ELEMENT_SIZE_MAX);
+    cv!(bindings::GSP_MSG_QUEUE_ELEMENT_SIZE_MAX);
 
 /// Empty type to group methods related to heap parameters for running the GSP firmware.
 enum GspFwHeapParams {}
@@ -110,20 +110,18 @@ pub(crate) struct LibosParams {
 impl LibosParams {
     /// Version 2 of the GSP LIBOS (Turing and GA100)
     const LIBOS2: LibosParams = LibosParams {
-        carveout_size: num::u32_as_u64(bindings::GSP_FW_HEAP_PARAM_OS_SIZE_LIBOS2),
-        allowed_heap_size: num::u32_as_u64(bindings::GSP_FW_HEAP_SIZE_OVERRIDE_LIBOS2_MIN_MB)
+        carveout_size: cv!(bindings::GSP_FW_HEAP_PARAM_OS_SIZE_LIBOS2),
+        allowed_heap_size: cv!(bindings::GSP_FW_HEAP_SIZE_OVERRIDE_LIBOS2_MIN_MB => u64)
             * u64::SZ_1M
-            ..num::u32_as_u64(bindings::GSP_FW_HEAP_SIZE_OVERRIDE_LIBOS2_MAX_MB) * u64::SZ_1M,
+            ..cv!(bindings::GSP_FW_HEAP_SIZE_OVERRIDE_LIBOS2_MAX_MB => u64) * u64::SZ_1M,
     };
 
     /// Version 3 of the GSP LIBOS (GA102+)
     const LIBOS3: LibosParams = LibosParams {
-        carveout_size: num::u32_as_u64(bindings::GSP_FW_HEAP_PARAM_OS_SIZE_LIBOS3_BAREMETAL),
-        allowed_heap_size: num::u32_as_u64(
-            bindings::GSP_FW_HEAP_SIZE_OVERRIDE_LIBOS3_BAREMETAL_MIN_MB,
-        ) * u64::SZ_1M
-            ..num::u32_as_u64(bindings::GSP_FW_HEAP_SIZE_OVERRIDE_LIBOS3_BAREMETAL_MAX_MB)
-                * u64::SZ_1M,
+        carveout_size: cv!(bindings::GSP_FW_HEAP_PARAM_OS_SIZE_LIBOS3_BAREMETAL),
+        allowed_heap_size: cv!(bindings::GSP_FW_HEAP_SIZE_OVERRIDE_LIBOS3_BAREMETAL_MIN_MB => u64)
+            * u64::SZ_1M
+            ..cv!(bindings::GSP_FW_HEAP_SIZE_OVERRIDE_LIBOS3_BAREMETAL_MAX_MB => u64) * u64::SZ_1M,
     };
 
     /// Returns the libos parameters corresponding to `chipset`.
@@ -682,12 +680,8 @@ fn id8(name: &str) -> u64 {
             id8: id8(name),
             pa: obj.dma_address(),
             size: num::usize_as_u64(obj.size()),
-            kind: num::u32_into_u8::<
-                { bindings::LibosMemoryRegionKind_LIBOS_MEMORY_REGION_CONTIGUOUS },
-            >(),
-            loc: num::u32_into_u8::<
-                { bindings::LibosMemoryRegionLoc_LIBOS_MEMORY_REGION_LOC_SYSMEM },
-            >(),
+            kind: cv!(bindings::LibosMemoryRegionKind_LIBOS_MEMORY_REGION_CONTIGUOUS),
+            loc: cv!(bindings::LibosMemoryRegionLoc_LIBOS_MEMORY_REGION_LOC_SYSMEM),
             ..Zeroable::init_zeroed()
         });
 
@@ -715,12 +709,12 @@ pub(crate) fn new(msgq_size: u32, rx_hdr_offset: u32, msg_count: u32) -> Self {
         Self(bindings::msgqTxHeader {
             version: 0,
             size: msgq_size,
-            msgSize: num::usize_into_u32::<GSP_PAGE_SIZE>(),
+            msgSize: cv!(GSP_PAGE_SIZE),
             msgCount: msg_count,
             writePtr: 0,
             flags: 1,
             rxHdrOff: rx_hdr_offset,
-            entryOff: num::usize_into_u32::<GSP_PAGE_SIZE>(),
+            entryOff: cv!(GSP_PAGE_SIZE),
         })
     }
 
@@ -947,9 +941,9 @@ impl MessageQueueInitArguments {
     fn new(cmdq: &Cmdq) -> impl Init<Self> + '_ {
         init!(MessageQueueInitArguments {
             sharedMemPhysAddr: cmdq.dma_addr,
-            pageTableEntryCount: num::usize_into_u32::<{ Cmdq::NUM_PTES }>(),
-            cmdQueueOffset: num::usize_as_u64(Cmdq::CMDQ_OFFSET),
-            statQueueOffset: num::usize_as_u64(Cmdq::STATQ_OFFSET),
+            pageTableEntryCount: cv!(Cmdq::NUM_PTES),
+            cmdQueueOffset: u64::from_safe_cast(Cmdq::CMDQ_OFFSET),
+            statQueueOffset: u64::from_safe_cast(Cmdq::STATQ_OFFSET),
             ..Zeroable::init_zeroed()
         })
     }
@@ -969,7 +963,7 @@ impl GspAcrBootGspRmParams {
     fn new(target: GspDmaTarget, wpr_meta_addr: u64) -> impl Init<Self> {
         let params = init!(Self {
             target: target as u32,
-            gspRmDescSize: num::usize_into_u32::<{ size_of::<GspFwWprMeta>() }>(),
+            gspRmDescSize: cv!(size_of::<GspFwWprMeta>()),
             gspRmDescOffset: wpr_meta_addr,
             bIsGspRmBoot: 1,
             wprCarveoutOffset: 0,
diff --git a/drivers/gpu/nova-core/gsp/fw/commands.rs b/drivers/gpu/nova-core/gsp/fw/commands.rs
index 6dc31d1bf5ae..384eccf3c44a 100644
--- a/drivers/gpu/nova-core/gsp/fw/commands.rs
+++ b/drivers/gpu/nova-core/gsp/fw/commands.rs
@@ -82,7 +82,7 @@ pub(crate) fn new(offset: u32, value: u32) -> Self {
 
                 // We only support DWORD types for now. Support for other types
                 // will come later if required.
-                type_: bindings::REGISTRY_TABLE_ENTRY_TYPE_DWORD as u8,
+                type_: cv!(bindings::REGISTRY_TABLE_ENTRY_TYPE_DWORD),
                 __bindgen_padding_0: Default::default(),
                 data: value,
                 length: 0,
diff --git a/drivers/gpu/nova-core/num.rs b/drivers/gpu/nova-core/num.rs
index 6eb174d136ab..2e5c9937b3a6 100644
--- a/drivers/gpu/nova-core/num.rs
+++ b/drivers/gpu/nova-core/num.rs
@@ -96,8 +96,7 @@ pub(crate) const fn [<$from _as_ $into>](value: $from) -> $into {
 ///
 /// Prefer this over the `as` keyword to ensure no lossy casts are performed.
 ///
-/// If you need to perform a conversion in `const` context, use [`u64_as_usize`], [`u32_as_usize`],
-/// [`usize_as_u64`], etc.
+/// If you need to perform a conversion in `const` context, use [`cv!`](kernel::num::cv).
 ///
 /// # Examples
 ///
@@ -164,58 +163,6 @@ fn into_safe_cast(self) -> T {
     }
 }
 
-/// Implements lossless conversion of a constant from a larger type into a smaller one.
-macro_rules! impl_const_into {
-    ($from:ty => { $($into:ty),* }) => {
-        $(
-        paste! {
-            #[doc = ::core::concat!(
-                "Performs a build-time safe conversion of a [`",
-                ::core::stringify!($from),
-                "`] constant value into a [`",
-                ::core::stringify!($into),
-                "`].")]
-            ///
-            /// This checks at compile-time that the conversion is lossless, and triggers a build
-            /// error if it isn't.
-            ///
-            /// # Examples
-            ///
-            /// ```
-            /// use crate::num;
-            ///
-            /// // Succeeds because the value of the source fits into the destination's type.
-            #[doc = ::core::concat!(
-                "assert_eq!(num::",
-                ::core::stringify!($from),
-                "_into_",
-                ::core::stringify!($into),
-                "::<1",
-                ::core::stringify!($from),
-                ">(), 1",
-                ::core::stringify!($into),
-                ");")]
-            /// ```
-            #[allow(unused)]
-            pub(crate) const fn [<$from _into_ $into>]<const N: $from>() -> $into {
-                // Make sure that the target type is smaller than the source one.
-                static_assert!($from::BITS >= $into::BITS);
-                // CAST: we statically enforced above that `$from` is larger than `$into`, so the
-                // `as` conversion will be lossless.
-                build_assert!(N >= $into::MIN as $from && N <= $into::MAX as $from);
-
-                N as $into
-            }
-        }
-        )*
-    };
-}
-
-impl_const_into!(usize => { u8, u16, u32 });
-impl_const_into!(u64 => { u8, u16, u32 });
-impl_const_into!(u32 => { u8, u16 });
-impl_const_into!(u16 => { u8 });
-
 /// Creates an enum type associated to a [`Bounded`](kernel::num::Bounded), with a [`From`]
 /// conversion to the associated `Bounded` and either a [`TryFrom`] or `From` conversion from the
 /// associated `Bounded`.

-- 
2.55.0

Re: [PATCH v2 3/3] gpu: nova-core: use cv! for constant casts

[Gary Guo]

On Tue Sep 1, 2026 at 6:06 AM BST, Eliot Courtney wrote:
> The new `cv!` macro allows safe casting of constant expressions in a
> const context. Update code in nova-core to use it.
> 
> Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>

I like the ergnomics improvement :)

Reviewed-by: Gary Guo <gary@garyguo.net>

> ---
>  drivers/gpu/nova-core/falcon.rs                    |  9 ++--
>  drivers/gpu/nova-core/fb/hal/gb100.rs              |  4 +-
>  drivers/gpu/nova-core/firmware/fwsec/bootloader.rs |  7 +--
>  drivers/gpu/nova-core/fsp.rs                       |  3 +-
>  drivers/gpu/nova-core/gsp/cmdq.rs                  |  6 +--
>  drivers/gpu/nova-core/gsp/fw.rs                    | 38 +++++++--------
>  drivers/gpu/nova-core/gsp/fw/commands.rs           |  2 +-
>  drivers/gpu/nova-core/num.rs                       | 55 +---------------------
>  8 files changed, 28 insertions(+), 96 deletions(-)

Re: [PATCH v2 3/3] gpu: nova-core: use cv! for constant casts

[Eliot Courtney]

On Tue Sep 1, 2026 at 8:52 PM JST, Gary Guo wrote:
> On Tue Sep 1, 2026 at 6:06 AM BST, Eliot Courtney wrote:
>> The new `cv!` macro allows safe casting of constant expressions in a
>> const context. Update code in nova-core to use it.
>> 
>> Signed-off-by: Eliot Courtney <ecourtney@nvidia.com>
>
> I like the ergnomics improvement :)
>
> Reviewed-by: Gary Guo <gary@garyguo.net>
>
>> ---
>>  drivers/gpu/nova-core/falcon.rs                    |  9 ++--
>>  drivers/gpu/nova-core/fb/hal/gb100.rs              |  4 +-
>>  drivers/gpu/nova-core/firmware/fwsec/bootloader.rs |  7 +--
>>  drivers/gpu/nova-core/fsp.rs                       |  3 +-
>>  drivers/gpu/nova-core/gsp/cmdq.rs                  |  6 +--
>>  drivers/gpu/nova-core/gsp/fw.rs                    | 38 +++++++--------
>>  drivers/gpu/nova-core/gsp/fw/commands.rs           |  2 +-
>>  drivers/gpu/nova-core/num.rs                       | 55 +---------------------
>>  8 files changed, 28 insertions(+), 96 deletions(-)

Thanks for the reviews!