1/* SPDX-License-Identifier: GPL-2.0 */ 2#ifndef _LINUX_MINMAX_H 3#define _LINUX_MINMAX_H 4 5#include <linux/build_bug.h> 6#include <linux/compiler.h> 7#include <linux/const.h> 8#include <linux/types.h> 9 10/* 11 * min()/max()/clamp() macros must accomplish three things: 12 * 13 * - Avoid multiple evaluations of the arguments (so side-effects like 14 * "x++" happen only once) when non-constant. 15 * - Retain result as a constant expressions when called with only 16 * constant expressions (to avoid tripping VLA warnings in stack 17 * allocation usage). 18 * - Perform signed v unsigned type-checking (to generate compile 19 * errors instead of nasty runtime surprises). 20 * - Unsigned char/short are always promoted to signed int and can be 21 * compared against signed or unsigned arguments. 22 * - Unsigned arguments can be compared against non-negative signed constants. 23 * - Comparison of a signed argument against an unsigned constant fails 24 * even if the constant is below __INT_MAX__ and could be cast to int. 25 */ 26#define __typecheck(x, y) \ 27 (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) 28 29/* is_signed_type() isn't a constexpr for pointer types */ 30#define __is_signed(x) \ 31 __builtin_choose_expr(__is_constexpr(is_signed_type(typeof(x))), \ 32 is_signed_type(typeof(x)), 0) 33 34/* True for a non-negative signed int constant */ 35#define __is_noneg_int(x) \ 36 (__builtin_choose_expr(__is_constexpr(x) && __is_signed(x), x, -1) >= 0) 37 38#define __types_ok(x, y) \ 39 (__is_signed(x) == __is_signed(y) || \ 40 __is_signed((x) + 0) == __is_signed((y) + 0) || \ 41 __is_noneg_int(x) || __is_noneg_int(y)) 42 43#define __cmp_op_min < 44#define __cmp_op_max > 45 46#define __cmp(op, x, y) ((x) __cmp_op_##op (y) ? (x) : (y)) 47 48#define __cmp_once(op, x, y, unique_x, unique_y) ({ \ 49 typeof(x) unique_x = (x); \ 50 typeof(y) unique_y = (y); \ 51 static_assert(__types_ok(x, y), \ 52 #op "(" #x ", " #y ") signedness error, fix types or consider u" #op "() before " #op "_t()"); \ 53 __cmp(op, unique_x, unique_y); }) 54 55#define __careful_cmp(op, x, y) \ 56 __builtin_choose_expr(__is_constexpr((x) - (y)), \ 57 __cmp(op, x, y), \ 58 __cmp_once(op, x, y, __UNIQUE_ID(__x), __UNIQUE_ID(__y))) 59 60#define __clamp(val, lo, hi) \ 61 ((val) >= (hi) ? (hi) : ((val) <= (lo) ? (lo) : (val))) 62 63#define __clamp_once(val, lo, hi, unique_val, unique_lo, unique_hi) ({ \ 64 typeof(val) unique_val = (val); \ 65 typeof(lo) unique_lo = (lo); \ 66 typeof(hi) unique_hi = (hi); \ 67 static_assert(__builtin_choose_expr(__is_constexpr((lo) > (hi)), \ 68 (lo) <= (hi), true), \ 69 "clamp() low limit " #lo " greater than high limit " #hi); \ 70 static_assert(__types_ok(val, lo), "clamp() 'lo' signedness error"); \ 71 static_assert(__types_ok(val, hi), "clamp() 'hi' signedness error"); \ 72 __clamp(unique_val, unique_lo, unique_hi); }) 73 74#define __careful_clamp(val, lo, hi) ({ \ 75 __builtin_choose_expr(__is_constexpr((val) - (lo) + (hi)), \ 76 __clamp(val, lo, hi), \ 77 __clamp_once(val, lo, hi, __UNIQUE_ID(__val), \ 78 __UNIQUE_ID(__lo), __UNIQUE_ID(__hi))); }) 79 80/** 81 * min - return minimum of two values of the same or compatible types 82 * @x: first value 83 * @y: second value 84 */ 85#define min(x, y) __careful_cmp(min, x, y) 86 87/** 88 * max - return maximum of two values of the same or compatible types 89 * @x: first value 90 * @y: second value 91 */ 92#define max(x, y) __careful_cmp(max, x, y) 93 94/** 95 * umin - return minimum of two non-negative values 96 * Signed types are zero extended to match a larger unsigned type. 97 * @x: first value 98 * @y: second value 99 */ 100#define umin(x, y) \ 101 __careful_cmp(min, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) 102 103/** 104 * umax - return maximum of two non-negative values 105 * @x: first value 106 * @y: second value 107 */ 108#define umax(x, y) \ 109 __careful_cmp(max, (x) + 0u + 0ul + 0ull, (y) + 0u + 0ul + 0ull) 110 111/** 112 * min3 - return minimum of three values 113 * @x: first value 114 * @y: second value 115 * @z: third value 116 */ 117#define min3(x, y, z) min((typeof(x))min(x, y), z) 118 119/** 120 * max3 - return maximum of three values 121 * @x: first value 122 * @y: second value 123 * @z: third value 124 */ 125#define max3(x, y, z) max((typeof(x))max(x, y), z) 126 127/** 128 * min_not_zero - return the minimum that is _not_ zero, unless both are zero 129 * @x: value1 130 * @y: value2 131 */ 132#define min_not_zero(x, y) ({ \ 133 typeof(x) __x = (x); \ 134 typeof(y) __y = (y); \ 135 __x == 0 ? __y : ((__y == 0) ? __x : min(__x, __y)); }) 136 137/** 138 * clamp - return a value clamped to a given range with strict typechecking 139 * @val: current value 140 * @lo: lowest allowable value 141 * @hi: highest allowable value 142 * 143 * This macro does strict typechecking of @lo/@hi to make sure they are of the 144 * same type as @val. See the unnecessary pointer comparisons. 145 */ 146#define clamp(val, lo, hi) __careful_clamp(val, lo, hi) 147 148/* 149 * ..and if you can't take the strict 150 * types, you can specify one yourself. 151 * 152 * Or not use min/max/clamp at all, of course. 153 */ 154 155/** 156 * min_t - return minimum of two values, using the specified type 157 * @type: data type to use 158 * @x: first value 159 * @y: second value 160 */ 161#define min_t(type, x, y) __careful_cmp(min, (type)(x), (type)(y)) 162 163/** 164 * max_t - return maximum of two values, using the specified type 165 * @type: data type to use 166 * @x: first value 167 * @y: second value 168 */ 169#define max_t(type, x, y) __careful_cmp(max, (type)(x), (type)(y)) 170 171/* 172 * Do not check the array parameter using __must_be_array(). 173 * In the following legit use-case where the "array" passed is a simple pointer, 174 * __must_be_array() will return a failure. 175 * --- 8< --- 176 * int *buff 177 * ... 178 * min = min_array(buff, nb_items); 179 * --- 8< --- 180 * 181 * The first typeof(&(array)[0]) is needed in order to support arrays of both 182 * 'int *buff' and 'int buff[N]' types. 183 * 184 * The array can be an array of const items. 185 * typeof() keeps the const qualifier. Use __unqual_scalar_typeof() in order 186 * to discard the const qualifier for the __element variable. 187 */ 188#define __minmax_array(op, array, len) ({ \ 189 typeof(&(array)[0]) __array = (array); \ 190 typeof(len) __len = (len); \ 191 __unqual_scalar_typeof(__array[0]) __element = __array[--__len];\ 192 while (__len--) \ 193 __element = op(__element, __array[__len]); \ 194 __element; }) 195 196/** 197 * min_array - return minimum of values present in an array 198 * @array: array 199 * @len: array length 200 * 201 * Note that @len must not be zero (empty array). 202 */ 203#define min_array(array, len) __minmax_array(min, array, len) 204 205/** 206 * max_array - return maximum of values present in an array 207 * @array: array 208 * @len: array length 209 * 210 * Note that @len must not be zero (empty array). 211 */ 212#define max_array(array, len) __minmax_array(max, array, len) 213 214/** 215 * clamp_t - return a value clamped to a given range using a given type 216 * @type: the type of variable to use 217 * @val: current value 218 * @lo: minimum allowable value 219 * @hi: maximum allowable value 220 * 221 * This macro does no typechecking and uses temporary variables of type 222 * @type to make all the comparisons. 223 */ 224#define clamp_t(type, val, lo, hi) __careful_clamp((type)(val), (type)(lo), (type)(hi)) 225 226/** 227 * clamp_val - return a value clamped to a given range using val's type 228 * @val: current value 229 * @lo: minimum allowable value 230 * @hi: maximum allowable value 231 * 232 * This macro does no typechecking and uses temporary variables of whatever 233 * type the input argument @val is. This is useful when @val is an unsigned 234 * type and @lo and @hi are literals that will otherwise be assigned a signed 235 * integer type. 236 */ 237#define clamp_val(val, lo, hi) clamp_t(typeof(val), val, lo, hi) 238 239static inline bool in_range64(u64 val, u64 start, u64 len) 240{ 241 return (val - start) < len; 242} 243 244static inline bool in_range32(u32 val, u32 start, u32 len) 245{ 246 return (val - start) < len; 247} 248 249/** 250 * in_range - Determine if a value lies within a range. 251 * @val: Value to test. 252 * @start: First value in range. 253 * @len: Number of values in range. 254 * 255 * This is more efficient than "if (start <= val && val < (start + len))". 256 * It also gives a different answer if @start + @len overflows the size of 257 * the type by a sufficient amount to encompass @val. Decide for yourself 258 * which behaviour you want, or prove that start + len never overflow. 259 * Do not blindly replace one form with the other. 260 */ 261#define in_range(val, start, len) \ 262 ((sizeof(start) | sizeof(len) | sizeof(val)) <= sizeof(u32) ? \ 263 in_range32(val, start, len) : in_range64(val, start, len)) 264 265/** 266 * swap - swap values of @a and @b 267 * @a: first value 268 * @b: second value 269 */ 270#define swap(a, b) \ 271 do { typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; } while (0) 272 273#endif /* _LINUX_MINMAX_H */ 274