The existing FIELD_{GET,PREP}() macros are limited to compile-time
constants. However, it is very common to prepare or extract bitfield
elements where the bitfield mask is not a compile-time constant.
To avoid this limitation, the AT91 clock driver and several other
drivers already have their own non-const field_{prep,get}() macros.
Make them available for general use by consolidating them in
<linux/bitfield.h>, and improve them slightly:
1. Avoid evaluating macro parameters more than once,
2. Replace "ffs() - 1" by "__ffs()",
3. Support 64-bit use on 32-bit architectures.
This is deliberately not merged into the existing FIELD_{GET,PREP}()
macros, as people expressed the desire to keep stricter variants for
increased safety, or for performance critical paths.
Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Crt Mori <cmo@melexis.com>
---
v4:
- Add Acked-by,
- Rebase on top of commit 7c68005a46108ffa ("crypto: qat - relocate
power management debugfs helper APIs") in v6.17-rc1,
- Convert more recently introduced upstream copies:
- drivers/edac/ie31200_edac.c
- drivers/iio/dac/ad3530r.c
v3:
- Add Acked-by,
- Drop underscores from macro parameters,
- Use __auto_type where possible,
- Correctly cast reg to the mask type,
- Introduces __val and __reg intermediates to simplify the actual
operation,
- Drop unneeded parentheses,
- Clarify having both FIELD_{GET,PREP}() and field_{get,prep}(),
v2:
- Cast val resp. reg to the mask type,
- Fix 64-bit use on 32-bit architectures,
- Convert new upstream users:
- drivers/crypto/intel/qat/qat_common/adf_gen4_pm_debugfs.c
- drivers/gpio/gpio-aspeed.c
- drivers/iio/temperature/mlx90614.c
- drivers/pinctrl/nuvoton/pinctrl-ma35.c
- sound/usb/mixer_quirks.c
- Convert new user queued in renesas-devel for v6.15:
- drivers/soc/renesas/rz-sysc.c
---
drivers/clk/at91/clk-peripheral.c | 1 +
drivers/clk/at91/pmc.h | 3 --
.../intel/qat/qat_common/adf_pm_dbgfs_utils.c | 8 +----
drivers/edac/ie31200_edac.c | 4 +--
drivers/gpio/gpio-aspeed.c | 5 +--
drivers/iio/dac/ad3530r.c | 3 --
drivers/iio/temperature/mlx90614.c | 5 +--
drivers/pinctrl/nuvoton/pinctrl-ma35.c | 4 ---
drivers/soc/renesas/rz-sysc.c | 3 +-
include/linux/bitfield.h | 36 +++++++++++++++++++
sound/usb/mixer_quirks.c | 4 ---
11 files changed, 42 insertions(+), 34 deletions(-)
diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-peripheral.c
index e700f40fd87f9327..e7208c47268b6397 100644
--- a/drivers/clk/at91/clk-peripheral.c
+++ b/drivers/clk/at91/clk-peripheral.c
@@ -3,6 +3,7 @@
* Copyright (C) 2013 Boris BREZILLON <b.brezillon@overkiz.com>
*/
+#include <linux/bitfield.h>
#include <linux/bitops.h>
#include <linux/clk-provider.h>
#include <linux/clkdev.h>
diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h
index 5daa32c4cf2540d7..543d7aee8d248cdb 100644
--- a/drivers/clk/at91/pmc.h
+++ b/drivers/clk/at91/pmc.h
@@ -117,9 +117,6 @@ struct at91_clk_pms {
unsigned int parent;
};
-#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
-#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
-
#define ndck(a, s) (a[s - 1].id + 1)
#define nck(a) (a[ARRAY_SIZE(a) - 1].id + 1)
diff --git a/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c b/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
index 69295a9ddf0ac92f..4ccc94ed9493a64c 100644
--- a/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
+++ b/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
@@ -1,18 +1,12 @@
// SPDX-License-Identifier: GPL-2.0-only
/* Copyright(c) 2025 Intel Corporation */
+#include <linux/bitfield.h>
#include <linux/bitops.h>
#include <linux/sprintf.h>
#include <linux/string_helpers.h>
#include "adf_pm_dbgfs_utils.h"
-/*
- * This is needed because a variable is used to index the mask at
- * pm_scnprint_table(), making it not compile time constant, so the compile
- * asserts from FIELD_GET() or u32_get_bits() won't be fulfilled.
- */
-#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
-
#define PM_INFO_MAX_KEY_LEN 21
static int pm_scnprint_table(char *buff, const struct pm_status_row *table,
diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
index 5a080ab65476dacf..dfc9a9cecd74207d 100644
--- a/drivers/edac/ie31200_edac.c
+++ b/drivers/edac/ie31200_edac.c
@@ -44,6 +44,7 @@
* but lo_hi_readq() ensures that we are safe across all e3-1200 processors.
*/
+#include <linux/bitfield.h>
#include <linux/module.h>
#include <linux/init.h>
#include <linux/pci.h>
@@ -139,9 +140,6 @@
#define IE31200_CAPID0_DDPCD BIT(6)
#define IE31200_CAPID0_ECC BIT(1)
-/* Non-constant mask variant of FIELD_GET() */
-#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
-
static int nr_channels;
static struct pci_dev *mci_pdev;
static int ie31200_registered = 1;
diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
index 7953a9c4e36d7550..3da999334971d501 100644
--- a/drivers/gpio/gpio-aspeed.c
+++ b/drivers/gpio/gpio-aspeed.c
@@ -5,6 +5,7 @@
* Joel Stanley <joel@jms.id.au>
*/
+#include <linux/bitfield.h>
#include <linux/cleanup.h>
#include <linux/clk.h>
#include <linux/gpio/aspeed.h>
@@ -31,10 +32,6 @@
#include <linux/gpio/consumer.h>
#include "gpiolib.h"
-/* Non-constant mask variant of FIELD_GET() and FIELD_PREP() */
-#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
-#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
-
#define GPIO_G7_IRQ_STS_BASE 0x100
#define GPIO_G7_IRQ_STS_OFFSET(x) (GPIO_G7_IRQ_STS_BASE + (x) * 0x4)
#define GPIO_G7_CTRL_REG_BASE 0x180
diff --git a/drivers/iio/dac/ad3530r.c b/drivers/iio/dac/ad3530r.c
index 6134613777b8e1d4..b97b46090d808ee7 100644
--- a/drivers/iio/dac/ad3530r.c
+++ b/drivers/iio/dac/ad3530r.c
@@ -53,9 +53,6 @@
#define AD3530R_MAX_CHANNELS 8
#define AD3531R_MAX_CHANNELS 4
-/* Non-constant mask variant of FIELD_PREP() */
-#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
-
enum ad3530r_mode {
AD3530R_NORMAL_OP,
AD3530R_POWERDOWN_1K,
diff --git a/drivers/iio/temperature/mlx90614.c b/drivers/iio/temperature/mlx90614.c
index 8a44a00bfd5ece38..1ad21b73e1b44cb0 100644
--- a/drivers/iio/temperature/mlx90614.c
+++ b/drivers/iio/temperature/mlx90614.c
@@ -22,6 +22,7 @@
* the "wakeup" GPIO is not given, power management will be disabled.
*/
+#include <linux/bitfield.h>
#include <linux/delay.h>
#include <linux/err.h>
#include <linux/gpio/consumer.h>
@@ -68,10 +69,6 @@
#define MLX90614_CONST_SCALE 20 /* Scale in milliKelvin (0.02 * 1000) */
#define MLX90614_CONST_FIR 0x7 /* Fixed value for FIR part of low pass filter */
-/* Non-constant mask variant of FIELD_GET() and FIELD_PREP() */
-#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
-#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
-
struct mlx_chip_info {
/* EEPROM offsets with 16-bit data, MSB first */
/* emissivity correction coefficient */
diff --git a/drivers/pinctrl/nuvoton/pinctrl-ma35.c b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
index cdad01d68a37e365..8d71dc53cc1de1f8 100644
--- a/drivers/pinctrl/nuvoton/pinctrl-ma35.c
+++ b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
@@ -81,10 +81,6 @@
#define MVOLT_1800 0
#define MVOLT_3300 1
-/* Non-constant mask variant of FIELD_GET() and FIELD_PREP() */
-#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
-#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
-
static const char * const gpio_group_name[] = {
"gpioa", "gpiob", "gpioc", "gpiod", "gpioe", "gpiof", "gpiog",
"gpioh", "gpioi", "gpioj", "gpiok", "gpiol", "gpiom", "gpion",
diff --git a/drivers/soc/renesas/rz-sysc.c b/drivers/soc/renesas/rz-sysc.c
index 9f79e299e6f41641..73eaf8b9d69f7208 100644
--- a/drivers/soc/renesas/rz-sysc.c
+++ b/drivers/soc/renesas/rz-sysc.c
@@ -5,6 +5,7 @@
* Copyright (C) 2024 Renesas Electronics Corp.
*/
+#include <linux/bitfield.h>
#include <linux/cleanup.h>
#include <linux/io.h>
#include <linux/mfd/syscon.h>
@@ -16,8 +17,6 @@
#include "rz-sysc.h"
-#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
-
/**
* struct rz_sysc - RZ SYSC private data structure
* @base: SYSC base address
diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
index 7ff817bdae19b468..c999fe70076f6684 100644
--- a/include/linux/bitfield.h
+++ b/include/linux/bitfield.h
@@ -220,4 +220,40 @@ __MAKE_OP(64)
#undef __MAKE_OP
#undef ____MAKE_OP
+/**
+ * field_prep() - prepare a bitfield element
+ * @mask: shifted mask defining the field's length and position
+ * @val: value to put in the field
+ *
+ * field_prep() masks and shifts up the value. The result should be
+ * combined with other fields of the bitfield using logical OR.
+ * Unlike FIELD_PREP(), @mask is not limited to a compile-time constant.
+ */
+#define field_prep(mask, val) \
+ ({ \
+ __auto_type __mask = (mask); \
+ typeof(mask) __val = (val); \
+ unsigned int __shift = sizeof(mask) <= 4 ? \
+ __ffs(__mask) : __ffs64(__mask); \
+ (__val << __shift) & __mask; \
+ })
+
+/**
+ * field_get() - extract a bitfield element
+ * @mask: shifted mask defining the field's length and position
+ * @reg: value of entire bitfield
+ *
+ * field_get() extracts the field specified by @mask from the
+ * bitfield passed in as @reg by masking and shifting it down.
+ * Unlike FIELD_GET(), @mask is not limited to a compile-time constant.
+ */
+#define field_get(mask, reg) \
+ ({ \
+ __auto_type __mask = (mask); \
+ typeof(mask) __reg = (reg); \
+ unsigned int __shift = sizeof(mask) <= 4 ? \
+ __ffs(__mask) : __ffs64(__mask); \
+ (__reg & __mask) >> __shift; \
+ })
+
#endif
diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index 828af3095b86ee0a..6eee89cbc0867f2b 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -3311,10 +3311,6 @@ static int snd_bbfpro_controls_create(struct usb_mixer_interface *mixer)
#define RME_DIGIFACE_REGISTER(reg, mask) (((reg) << 16) | (mask))
#define RME_DIGIFACE_INVERT BIT(31)
-/* Nonconst helpers */
-#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
-#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
-
static int snd_rme_digiface_write_reg(struct snd_kcontrol *kcontrol, int item, u16 mask, u16 val)
{
struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
--
2.43.0On Fri, Oct 17, 2025 at 12:54:10PM +0200, Geert Uytterhoeven wrote:
> The existing FIELD_{GET,PREP}() macros are limited to compile-time
> constants. However, it is very common to prepare or extract bitfield
> elements where the bitfield mask is not a compile-time constant.
>
> To avoid this limitation, the AT91 clock driver and several other
> drivers already have their own non-const field_{prep,get}() macros.
> Make them available for general use by consolidating them in
> <linux/bitfield.h>, and improve them slightly:
> 1. Avoid evaluating macro parameters more than once,
> 2. Replace "ffs() - 1" by "__ffs()",
> 3. Support 64-bit use on 32-bit architectures.
>
> This is deliberately not merged into the existing FIELD_{GET,PREP}()
> macros, as people expressed the desire to keep stricter variants for
> increased safety, or for performance critical paths.
>
> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
> Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> Acked-by: Crt Mori <cmo@melexis.com>
> ---
> v4:
> - Add Acked-by,
> - Rebase on top of commit 7c68005a46108ffa ("crypto: qat - relocate
> power management debugfs helper APIs") in v6.17-rc1,
> - Convert more recently introduced upstream copies:
> - drivers/edac/ie31200_edac.c
> - drivers/iio/dac/ad3530r.c
Can you split out the part that actually introduces the new API?
...
> diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
> index 7ff817bdae19b468..c999fe70076f6684 100644
> --- a/include/linux/bitfield.h
> +++ b/include/linux/bitfield.h
> @@ -220,4 +220,40 @@ __MAKE_OP(64)
> #undef __MAKE_OP
> #undef ____MAKE_OP
>
> +/**
> + * field_prep() - prepare a bitfield element
> + * @mask: shifted mask defining the field's length and position
> + * @val: value to put in the field
> + *
> + * field_prep() masks and shifts up the value. The result should be
> + * combined with other fields of the bitfield using logical OR.
> + * Unlike FIELD_PREP(), @mask is not limited to a compile-time constant.
> + */
> +#define field_prep(mask, val) \
> + ({ \
> + __auto_type __mask = (mask); \
> + typeof(mask) __val = (val); \
> + unsigned int __shift = sizeof(mask) <= 4 ? \
> + __ffs(__mask) : __ffs64(__mask); \
> + (__val << __shift) & __mask; \
__ffs(0) is undef. The corresponding comment in
include/asm-generic/bitops/__ffs.h explicitly says: "code should check
against 0 first".
I think mask = 0 is a sign of error here. Can you add a code catching
it at compile time, and maybe at runtime too? Something like:
#define __field_prep(mask, val)
({
unsigned __shift = sizeof(mask) <= 4 ? __ffs(mask) : __ffs64(mask);
(val << __shift) & mask;
})
#define field_prep(mask, val)
({
unsigned int __shift;
__auto_type __mask = (mask), __ret = 0;
typeof(mask) __val = (val);
BUILD_BUG_ON_ZERO(const_true(mask == 0));
if (WARN_ON_ONCE(mask == 0))
goto out;
__ret = __field_prep(__mask, __val);
out:
ret;
})
> +
> +/**
> + * field_get() - extract a bitfield element
> + * @mask: shifted mask defining the field's length and position
> + * @reg: value of entire bitfield
> + *
> + * field_get() extracts the field specified by @mask from the
> + * bitfield passed in as @reg by masking and shifting it down.
> + * Unlike FIELD_GET(), @mask is not limited to a compile-time constant.
> + */
> +#define field_get(mask, reg) \
> + ({ \
> + __auto_type __mask = (mask); \
> + typeof(mask) __reg = (reg); \
This would trigger Wconversion warning. Consider
unsigned reg = 0xfff;
field_get(0xf, reg);
<source>:6:26: warning: conversion to 'int' from 'unsigned int' may change the sign of the result [-Wsign-conversion]
6 | typeof(mask) __reg = reg;
| ^~~
Notice, the __auto_type makes the __mask to be int, while the reg is
unsigned int. You need to do:
typeof(mask) __reg = (typeof(mask))(reg);
Please enable higher warning levels for the next round.
Also, because for numerals __auto_type is int, when char is enough - are
you sure that the macro generates the optimal code? User can workaround it
with:
field_get((u8)0xf, reg)
but it may not be trivial. Can you add an example and explanation please?
> + unsigned int __shift = sizeof(mask) <= 4 ? \
> + __ffs(__mask) : __ffs64(__mask); \
Can you use BITS_PER_TYPE() here?
> + (__reg & __mask) >> __shift; \
> + })
> +
When mask == 0, we shouldn't touch 'val' at all. Consider
field_get(0, get_user(ptr))
In this case, evaluating 'reg' is an error, similarly to memcpy().
Thanks,
Yury
> #endif
> diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
> index 828af3095b86ee0a..6eee89cbc0867f2b 100644
> --- a/sound/usb/mixer_quirks.c
> +++ b/sound/usb/mixer_quirks.c
> @@ -3311,10 +3311,6 @@ static int snd_bbfpro_controls_create(struct usb_mixer_interface *mixer)
> #define RME_DIGIFACE_REGISTER(reg, mask) (((reg) << 16) | (mask))
> #define RME_DIGIFACE_INVERT BIT(31)
>
> -/* Nonconst helpers */
> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
> -
> static int snd_rme_digiface_write_reg(struct snd_kcontrol *kcontrol, int item, u16 mask, u16 val)
> {
> struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
> --
> 2.43.0
Hi Yury,
On Fri, 17 Oct 2025 at 20:51, Yury Norov <yury.norov@gmail.com> wrote:
> On Fri, Oct 17, 2025 at 12:54:10PM +0200, Geert Uytterhoeven wrote:
> > The existing FIELD_{GET,PREP}() macros are limited to compile-time
> > constants. However, it is very common to prepare or extract bitfield
> > elements where the bitfield mask is not a compile-time constant.
> >
> > To avoid this limitation, the AT91 clock driver and several other
> > drivers already have their own non-const field_{prep,get}() macros.
> > Make them available for general use by consolidating them in
> > <linux/bitfield.h>, and improve them slightly:
> > 1. Avoid evaluating macro parameters more than once,
> > 2. Replace "ffs() - 1" by "__ffs()",
> > 3. Support 64-bit use on 32-bit architectures.
> >
> > This is deliberately not merged into the existing FIELD_{GET,PREP}()
> > macros, as people expressed the desire to keep stricter variants for
> > increased safety, or for performance critical paths.
> >
> > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
> > Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> > Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > Acked-by: Crt Mori <cmo@melexis.com>
> > ---
> > v4:
> > - Add Acked-by,
> > - Rebase on top of commit 7c68005a46108ffa ("crypto: qat - relocate
> > power management debugfs helper APIs") in v6.17-rc1,
> > - Convert more recently introduced upstream copies:
> > - drivers/edac/ie31200_edac.c
> > - drivers/iio/dac/ad3530r.c
>
> Can you split out the part that actually introduces the new API?
Unfortunately not, as that would cause build warnings/failures due
to conflicting redefinitions.
That is a reason why I want to apply this patch ASAP: new copies show
up all the time.
> > --- a/include/linux/bitfield.h
> > +++ b/include/linux/bitfield.h
> > @@ -220,4 +220,40 @@ __MAKE_OP(64)
> > #undef __MAKE_OP
> > #undef ____MAKE_OP
> >
> > +/**
> > + * field_prep() - prepare a bitfield element
> > + * @mask: shifted mask defining the field's length and position
> > + * @val: value to put in the field
> > + *
> > + * field_prep() masks and shifts up the value. The result should be
> > + * combined with other fields of the bitfield using logical OR.
> > + * Unlike FIELD_PREP(), @mask is not limited to a compile-time constant.
> > + */
> > +#define field_prep(mask, val) \
> > + ({ \
> > + __auto_type __mask = (mask); \
> > + typeof(mask) __val = (val); \
> > + unsigned int __shift = sizeof(mask) <= 4 ? \
> > + __ffs(__mask) : __ffs64(__mask); \
> > + (__val << __shift) & __mask; \
>
> __ffs(0) is undef. The corresponding comment in
> include/asm-generic/bitops/__ffs.h explicitly says: "code should check
> against 0 first".
An all zeroes mask is a bug in the code that calls field_{get,prep}().
> I think mask = 0 is a sign of error here. Can you add a code catching
> it at compile time, and maybe at runtime too? Something like:
>
> #define __field_prep(mask, val)
> ({
> unsigned __shift = sizeof(mask) <= 4 ? __ffs(mask) : __ffs64(mask);
> (val << __shift) & mask;
> })
>
> #define field_prep(mask, val)
> ({
> unsigned int __shift;
> __auto_type __mask = (mask), __ret = 0;
> typeof(mask) __val = (val);
>
> BUILD_BUG_ON_ZERO(const_true(mask == 0));
Futile, as code with a constant mask should use FIELD_PREP() instead.
>
> if (WARN_ON_ONCE(mask == 0))
> goto out;
>
> __ret = __field_prep(__mask, __val);
> out:
> ret;
> })
Should we penalize all users (this is a macro, thus inlined everywhere)
to protect against something that is clearly a bug in the caller?
E.g. do_div() does not check for a zero divisor either.
> > +
> > +/**
> > + * field_get() - extract a bitfield element
> > + * @mask: shifted mask defining the field's length and position
> > + * @reg: value of entire bitfield
> > + *
> > + * field_get() extracts the field specified by @mask from the
> > + * bitfield passed in as @reg by masking and shifting it down.
> > + * Unlike FIELD_GET(), @mask is not limited to a compile-time constant.
> > + */
> > +#define field_get(mask, reg) \
> > + ({ \
> > + __auto_type __mask = (mask); \
> > + typeof(mask) __reg = (reg); \
>
> This would trigger Wconversion warning. Consider
> unsigned reg = 0xfff;
> field_get(0xf, reg);
>
> <source>:6:26: warning: conversion to 'int' from 'unsigned int' may change the sign of the result [-Wsign-conversion]
> 6 | typeof(mask) __reg = reg;
> | ^~~
>
> Notice, the __auto_type makes the __mask to be int, while the reg is
Apparently using typeof(mask) has the same "issue"...
> unsigned int. You need to do:
>
> typeof(mask) __reg = (typeof(mask))(reg);
... so the cast is just hiding the issue? Worse, the cast may prevent the
compiler from flagging other issues, e.g. when accidentally passing
a pointer for reg.
>
> Please enable higher warning levels for the next round.
Enabling -Wsign-conversion gives lots of other (false positive?)
warnings.
> Also, because for numerals __auto_type is int, when char is enough - are
> you sure that the macro generates the optimal code? User can workaround it
> with:
>
> field_get((u8)0xf, reg)
>
> but it may not be trivial. Can you add an example and explanation please?
These new macros are intended for the case where mask is not a constant.
So typically it is a variable of type u32 or u64.
> > + unsigned int __shift = sizeof(mask) <= 4 ? \
> > + __ffs(__mask) : __ffs64(__mask); \
>
> Can you use BITS_PER_TYPE() here?
Yes, I could use BITS_PER_TYPE(unsigned long) here, to match the
parameter type of __ffs() (on 64-bit platforms, __ffs() can be used
unconditionally anyway), at the expense of making the line much longer
so it has to be split. Is that worthwhile?
>
> > + (__reg & __mask) >> __shift; \
> > + })
> > +
>
> When mask == 0, we shouldn't touch 'val' at all. Consider
>
> field_get(0, get_user(ptr))
>
> In this case, evaluating 'reg' is an error, similarly to memcpy().
Again, a zero mask is a bug.
Thanks!
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Mon, Oct 20, 2025 at 03:00:24PM +0200, Geert Uytterhoeven wrote:
> Hi Yury,
>
> On Fri, 17 Oct 2025 at 20:51, Yury Norov <yury.norov@gmail.com> wrote:
> > On Fri, Oct 17, 2025 at 12:54:10PM +0200, Geert Uytterhoeven wrote:
> > > The existing FIELD_{GET,PREP}() macros are limited to compile-time
> > > constants. However, it is very common to prepare or extract bitfield
> > > elements where the bitfield mask is not a compile-time constant.
> > >
> > > To avoid this limitation, the AT91 clock driver and several other
> > > drivers already have their own non-const field_{prep,get}() macros.
> > > Make them available for general use by consolidating them in
> > > <linux/bitfield.h>, and improve them slightly:
> > > 1. Avoid evaluating macro parameters more than once,
> > > 2. Replace "ffs() - 1" by "__ffs()",
> > > 3. Support 64-bit use on 32-bit architectures.
> > >
> > > This is deliberately not merged into the existing FIELD_{GET,PREP}()
> > > macros, as people expressed the desire to keep stricter variants for
> > > increased safety, or for performance critical paths.
> > >
> > > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
> > > Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> > > Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > > Acked-by: Crt Mori <cmo@melexis.com>
> > > ---
> > > v4:
> > > - Add Acked-by,
> > > - Rebase on top of commit 7c68005a46108ffa ("crypto: qat - relocate
> > > power management debugfs helper APIs") in v6.17-rc1,
> > > - Convert more recently introduced upstream copies:
> > > - drivers/edac/ie31200_edac.c
> > > - drivers/iio/dac/ad3530r.c
> >
> > Can you split out the part that actually introduces the new API?
>
> Unfortunately not, as that would cause build warnings/failures due
> to conflicting redefinitions.
> That is a reason why I want to apply this patch ASAP: new copies show
> up all the time.
In a preparation patch, for each driver:
+#ifndef field_prep
#define field_prep() ...
+#endif
Or simply
+#undef field_prep
#define field_prep() ...
Then add the generic field_prep() in a separate patch. Then you can drop
ifdefery in the drivers.
Yeah, more patches, but the result is cleaner.
> > > --- a/include/linux/bitfield.h
> > > +++ b/include/linux/bitfield.h
> > > @@ -220,4 +220,40 @@ __MAKE_OP(64)
> > > #undef __MAKE_OP
> > > #undef ____MAKE_OP
> > >
> > > +/**
> > > + * field_prep() - prepare a bitfield element
> > > + * @mask: shifted mask defining the field's length and position
> > > + * @val: value to put in the field
> > > + *
> > > + * field_prep() masks and shifts up the value. The result should be
> > > + * combined with other fields of the bitfield using logical OR.
> > > + * Unlike FIELD_PREP(), @mask is not limited to a compile-time constant.
> > > + */
> > > +#define field_prep(mask, val) \
> > > + ({ \
> > > + __auto_type __mask = (mask); \
> > > + typeof(mask) __val = (val); \
> > > + unsigned int __shift = sizeof(mask) <= 4 ? \
> > > + __ffs(__mask) : __ffs64(__mask); \
> > > + (__val << __shift) & __mask; \
> >
> > __ffs(0) is undef. The corresponding comment in
> > include/asm-generic/bitops/__ffs.h explicitly says: "code should check
> > against 0 first".
>
> An all zeroes mask is a bug in the code that calls field_{get,prep}().
It's a bug in FIELD_GET() - for sure. Because it's enforced in
__BF_FIELD_CHECK(). field_get() doesn't enforce it, doesn't even
mention that in the comment.
I'm not fully convinced that empty runtime mask should be a bug.
Consider memcpy(dst, src, 0). This is a no-op, but not a bug as
soon as the pointers are valid. If you _think_ it's a bug - please
enforce it.
> > I think mask = 0 is a sign of error here. Can you add a code catching
> > it at compile time, and maybe at runtime too? Something like:
> >
> > #define __field_prep(mask, val)
> > ({
> > unsigned __shift = sizeof(mask) <= 4 ? __ffs(mask) : __ffs64(mask);
> > (val << __shift) & mask;
> > })
> >
> > #define field_prep(mask, val)
> > ({
> > unsigned int __shift;
> > __auto_type __mask = (mask), __ret = 0;
> > typeof(mask) __val = (val);
> >
> > BUILD_BUG_ON_ZERO(const_true(mask == 0));
>
> Futile, as code with a constant mask should use FIELD_PREP() instead.
It's a weak argument. Sometimes compiler is smart enough to realize
that something is a constant, while people won't. Sometimes code gets
refactored. Sometimes people build complex expressions that should
work both in run-time and compile time cases. Sometimes variables are
compile- or run-time depending on config (nr_cpu_ids is an example).
The field_prep() must handle const case just as good as capitalized
version does.
> > if (WARN_ON_ONCE(mask == 0))
> > goto out;
> >
> > __ret = __field_prep(__mask, __val);
> > out:
> > ret;
> > })
>
> Should we penalize all users (this is a macro, thus inlined everywhere)
> to protect against something that is clearly a bug in the caller?
No. But we can wrap it with a config:
#ifdef CONFIG_BITFIELD_HARDENING
if (WARN_ON_ONCE(mask == 0))
goto out;
#endif
The real question here: do you want to help people to catch their bugs,
or you want them to fight it alone?
The _BF_FIELD_CHECK() authors are nice people and provide helpful guides.
(I don't insist, it's up to you.)
> E.g. do_div() does not check for a zero divisor either.
>
> > > +/**
> > > + * field_get() - extract a bitfield element
> > > + * @mask: shifted mask defining the field's length and position
> > > + * @reg: value of entire bitfield
> > > + *
> > > + * field_get() extracts the field specified by @mask from the
> > > + * bitfield passed in as @reg by masking and shifting it down.
> > > + * Unlike FIELD_GET(), @mask is not limited to a compile-time constant.
> > > + */
> > > +#define field_get(mask, reg) \
> > > + ({ \
> > > + __auto_type __mask = (mask); \
> > > + typeof(mask) __reg = (reg); \
> >
> > This would trigger Wconversion warning. Consider
> > unsigned reg = 0xfff;
> > field_get(0xf, reg);
> >
> > <source>:6:26: warning: conversion to 'int' from 'unsigned int' may change the sign of the result [-Wsign-conversion]
> > 6 | typeof(mask) __reg = reg;
> > | ^~~
> >
> > Notice, the __auto_type makes the __mask to be int, while the reg is
>
> Apparently using typeof(mask) has the same "issue"...
>
> > unsigned int. You need to do:
> >
> > typeof(mask) __reg = (typeof(mask))(reg);
>
> ... so the cast is just hiding the issue? Worse, the cast may prevent the
> compiler from flagging other issues, e.g. when accidentally passing
> a pointer for reg.
Ok, makes sense.
> > Please enable higher warning levels for the next round.
>
> Enabling -Wsign-conversion gives lots of other (false positive?)
> warnings.
>
> > Also, because for numerals __auto_type is int, when char is enough - are
> > you sure that the macro generates the optimal code? User can workaround it
> > with:
> >
> > field_get((u8)0xf, reg)
> >
> > but it may not be trivial. Can you add an example and explanation please?
>
> These new macros are intended for the case where mask is not a constant.
> So typically it is a variable of type u32 or u64.
You never mentioned that. Anyways, it's again a weak argument.
> > > + unsigned int __shift = sizeof(mask) <= 4 ? \
> > > + __ffs(__mask) : __ffs64(__mask); \
> >
> > Can you use BITS_PER_TYPE() here?
>
> Yes, I could use BITS_PER_TYPE(unsigned long) here, to match the
> parameter type of __ffs() (on 64-bit platforms, __ffs() can be used
> unconditionally anyway), at the expense of making the line much longer
> so it has to be split. Is that worthwhile?
Not sure I understand... The
"unsigned int __shift = BITS_PER_TYPE(mask) < 64 ?"
is 49 chars long vs 42 in your version. Even if you add two tabs, it's
still way below limits. And yes,
unsigned int __shift = sizeof(mask) <= 4 ? \
__ffs(__mask) : __ffs64(__mask); \
is worse than
unsigned int __shift = BITS_PER_TYPE(mask) < 64 ? \
__ffs(__mask) : __ffs64(__mask); \
> > > + (__reg & __mask) >> __shift; \
> > > + })
> > > +
> >
> > When mask == 0, we shouldn't touch 'val' at all. Consider
> >
> > field_get(0, get_user(ptr))
> >
> > In this case, evaluating 'reg' is an error, similarly to memcpy().
>
> Again, a zero mask is a bug.
>
> Thanks!
>
> Gr{oetje,eeting}s,
>
> Geert
>
> --
> Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
>
> In personal conversations with technical people, I call myself a hacker. But
> when I'm talking to journalists I just say "programmer" or something like that.
> -- Linus Torvalds
Hi Yury,
On Wed, 22 Oct 2025 at 06:20, Yury Norov <yury.norov@gmail.com> wrote:
> On Mon, Oct 20, 2025 at 03:00:24PM +0200, Geert Uytterhoeven wrote:
> > On Fri, 17 Oct 2025 at 20:51, Yury Norov <yury.norov@gmail.com> wrote:
> > > On Fri, Oct 17, 2025 at 12:54:10PM +0200, Geert Uytterhoeven wrote:
> > > > The existing FIELD_{GET,PREP}() macros are limited to compile-time
> > > > constants. However, it is very common to prepare or extract bitfield
> > > > elements where the bitfield mask is not a compile-time constant.
> > > >
> > > > To avoid this limitation, the AT91 clock driver and several other
> > > > drivers already have their own non-const field_{prep,get}() macros.
> > > > Make them available for general use by consolidating them in
> > > > <linux/bitfield.h>, and improve them slightly:
> > > > 1. Avoid evaluating macro parameters more than once,
> > > > 2. Replace "ffs() - 1" by "__ffs()",
> > > > 3. Support 64-bit use on 32-bit architectures.
> > > >
> > > > This is deliberately not merged into the existing FIELD_{GET,PREP}()
> > > > macros, as people expressed the desire to keep stricter variants for
> > > > increased safety, or for performance critical paths.
> > > >
> > > > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
> > > > Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> > > > Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > > > Acked-by: Crt Mori <cmo@melexis.com>
> > > > ---
> > > > v4:
> > > > - Add Acked-by,
> > > > - Rebase on top of commit 7c68005a46108ffa ("crypto: qat - relocate
> > > > power management debugfs helper APIs") in v6.17-rc1,
> > > > - Convert more recently introduced upstream copies:
> > > > - drivers/edac/ie31200_edac.c
> > > > - drivers/iio/dac/ad3530r.c
> > >
> > > Can you split out the part that actually introduces the new API?
> >
> > Unfortunately not, as that would cause build warnings/failures due
> > to conflicting redefinitions.
> > That is a reason why I want to apply this patch ASAP: new copies show
> > up all the time.
>
> In a preparation patch, for each driver:
>
> +#ifndef field_prep
> #define field_prep() ...
> +#endif
>
> Or simply
>
> +#undef field_prep
> #define field_prep() ...
>
> Then add the generic field_prep() in a separate patch. Then you can drop
> ifdefery in the drivers.
>
> Yeah, more patches, but the result is cleaner.
And we need 3 kernel releases, as the addition of the macros to
the header file now has a hard dependency on adding the #undefs?
Unless I still apply all of them to an immutable branch, but then what
is the point?
> > > > --- a/include/linux/bitfield.h
> > > > +++ b/include/linux/bitfield.h
> > > > @@ -220,4 +220,40 @@ __MAKE_OP(64)
> > > > #undef __MAKE_OP
> > > > #undef ____MAKE_OP
> > > >
> > > > +/**
> > > > + * field_prep() - prepare a bitfield element
> > > > + * @mask: shifted mask defining the field's length and position
> > > > + * @val: value to put in the field
> > > > + *
> > > > + * field_prep() masks and shifts up the value. The result should be
> > > > + * combined with other fields of the bitfield using logical OR.
> > > > + * Unlike FIELD_PREP(), @mask is not limited to a compile-time constant.
> > > > + */
> > > > +#define field_prep(mask, val) \
> > > > + ({ \
> > > > + __auto_type __mask = (mask); \
> > > > + typeof(mask) __val = (val); \
> > > > + unsigned int __shift = sizeof(mask) <= 4 ? \
> > > > + __ffs(__mask) : __ffs64(__mask); \
> > > > + (__val << __shift) & __mask; \
> > >
> > > __ffs(0) is undef. The corresponding comment in
> > > include/asm-generic/bitops/__ffs.h explicitly says: "code should check
> > > against 0 first".
> >
> > An all zeroes mask is a bug in the code that calls field_{get,prep}().
>
> It's a bug in FIELD_GET() - for sure. Because it's enforced in
> __BF_FIELD_CHECK(). field_get() doesn't enforce it, doesn't even
> mention that in the comment.
>
> I'm not fully convinced that empty runtime mask should be a bug.
Getting (and using) data from nowhere is a bug.
Storing data where there is no space to store is also a bug.
I will add a comment.
> Consider memcpy(dst, src, 0). This is a no-op, but not a bug as
> soon as the pointers are valid. If you _think_ it's a bug - please
> enforce it.
memcpy() with a fixed size of zero is probably a bug.
memcpy() with a variable size is usually used to copy "as much as is
needed", so zero is usually not a bug.
> > > I think mask = 0 is a sign of error here. Can you add a code catching
> > > it at compile time, and maybe at runtime too? Something like:
> > >
> > > #define __field_prep(mask, val)
> > > ({
> > > unsigned __shift = sizeof(mask) <= 4 ? __ffs(mask) : __ffs64(mask);
> > > (val << __shift) & mask;
> > > })
> > >
> > > #define field_prep(mask, val)
> > > ({
> > > unsigned int __shift;
> > > __auto_type __mask = (mask), __ret = 0;
> > > typeof(mask) __val = (val);
> > >
> > > BUILD_BUG_ON_ZERO(const_true(mask == 0));
> >
> > Futile, as code with a constant mask should use FIELD_PREP() instead.
>
> It's a weak argument. Sometimes compiler is smart enough to realize
> that something is a constant, while people won't. Sometimes code gets
> refactored. Sometimes people build complex expressions that should
> work both in run-time and compile time cases. Sometimes variables are
> compile- or run-time depending on config (nr_cpu_ids is an example).
>
> The field_prep() must handle const case just as good as capitalized
> version does.
OK, I will add the (build-time) check.
> > > if (WARN_ON_ONCE(mask == 0))
> > > goto out;
> > >
> > > __ret = __field_prep(__mask, __val);
> > > out:
> > > ret;
> > > })
> >
> > Should we penalize all users (this is a macro, thus inlined everywhere)
> > to protect against something that is clearly a bug in the caller?
>
> No. But we can wrap it with a config:
>
> #ifdef CONFIG_BITFIELD_HARDENING
> if (WARN_ON_ONCE(mask == 0))
> goto out;
> #endif
That can be done later, when hardening other bitfield functions
and macros.
> > These new macros are intended for the case where mask is not a constant.
> > So typically it is a variable of type u32 or u64.
>
> You never mentioned that. Anyways, it's again a weak argument.
I'll add more comments ;-)
> > > > + unsigned int __shift = sizeof(mask) <= 4 ? \
> > > > + __ffs(__mask) : __ffs64(__mask); \
> > >
> > > Can you use BITS_PER_TYPE() here?
> >
> > Yes, I could use BITS_PER_TYPE(unsigned long) here, to match the
> > parameter type of __ffs() (on 64-bit platforms, __ffs() can be used
> > unconditionally anyway), at the expense of making the line much longer
> > so it has to be split. Is that worthwhile?
>
> Not sure I understand... The
>
> "unsigned int __shift = BITS_PER_TYPE(mask) < 64 ?"
>
> is 49 chars long vs 42 in your version. Even if you add two tabs, it's
> still way below limits. And yes,
Oh, you meant instead of the size check.
I thought you objected to the hardcoded number 4.
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Wed, Oct 22, 2025 at 12:01:37PM +0200, Geert Uytterhoeven wrote:
> Hi Yury,
>
> On Wed, 22 Oct 2025 at 06:20, Yury Norov <yury.norov@gmail.com> wrote:
> > On Mon, Oct 20, 2025 at 03:00:24PM +0200, Geert Uytterhoeven wrote:
> > > On Fri, 17 Oct 2025 at 20:51, Yury Norov <yury.norov@gmail.com> wrote:
> > > > On Fri, Oct 17, 2025 at 12:54:10PM +0200, Geert Uytterhoeven wrote:
> > > > > The existing FIELD_{GET,PREP}() macros are limited to compile-time
> > > > > constants. However, it is very common to prepare or extract bitfield
> > > > > elements where the bitfield mask is not a compile-time constant.
> > > > >
> > > > > To avoid this limitation, the AT91 clock driver and several other
> > > > > drivers already have their own non-const field_{prep,get}() macros.
> > > > > Make them available for general use by consolidating them in
> > > > > <linux/bitfield.h>, and improve them slightly:
> > > > > 1. Avoid evaluating macro parameters more than once,
> > > > > 2. Replace "ffs() - 1" by "__ffs()",
> > > > > 3. Support 64-bit use on 32-bit architectures.
> > > > >
> > > > > This is deliberately not merged into the existing FIELD_{GET,PREP}()
> > > > > macros, as people expressed the desire to keep stricter variants for
> > > > > increased safety, or for performance critical paths.
> > > > >
> > > > > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
> > > > > Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> > > > > Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > > > > Acked-by: Crt Mori <cmo@melexis.com>
> > > > > ---
> > > > > v4:
> > > > > - Add Acked-by,
> > > > > - Rebase on top of commit 7c68005a46108ffa ("crypto: qat - relocate
> > > > > power management debugfs helper APIs") in v6.17-rc1,
> > > > > - Convert more recently introduced upstream copies:
> > > > > - drivers/edac/ie31200_edac.c
> > > > > - drivers/iio/dac/ad3530r.c
> > > >
> > > > Can you split out the part that actually introduces the new API?
> > >
> > > Unfortunately not, as that would cause build warnings/failures due
> > > to conflicting redefinitions.
> > > That is a reason why I want to apply this patch ASAP: new copies show
> > > up all the time.
> >
> > In a preparation patch, for each driver:
> >
> > +#ifndef field_prep
> > #define field_prep() ...
> > +#endif
> >
> > Or simply
> >
> > +#undef field_prep
> > #define field_prep() ...
> >
> > Then add the generic field_prep() in a separate patch. Then you can drop
> > ifdefery in the drivers.
> >
> > Yeah, more patches, but the result is cleaner.
>
> And we need 3 kernel releases, as the addition of the macros to
> the header file now has a hard dependency on adding the #undefs?
> Unless I still apply all of them to an immutable branch, but then what
> is the point?
Not sure what do you mean. You can do it in a single series, and you
don't need and should not split the series across releases. Consider
my recent cpumask_next_wrap() rework as an example:
https://lore.kernel.org/all/20250128164646.4009-1-yury.norov@gmail.com/
1. #1-4 switch kernel users to alternative functions;
2. #5 deprecates cpumask_next_wrap(), making sure it's a pure renaming,
i.e. no-op.
3. #6 introduces the new nice implementation. It's the core-only patch,
no drivers are touched.
4. #7-12 switch the rest of codebase from old version to new.
5. #13 drops deprecated old function.
This is the most common scheme. In you case you can cut the corners.
The goals here are:
- keep core patches free of non-core code;
- switch drivers to the new functionality one-by-one in sake of
bisectability.
> > > > > --- a/include/linux/bitfield.h
> > > > > +++ b/include/linux/bitfield.h
> > > > > @@ -220,4 +220,40 @@ __MAKE_OP(64)
> > > > > #undef __MAKE_OP
> > > > > #undef ____MAKE_OP
> > > > >
> > > > > +/**
> > > > > + * field_prep() - prepare a bitfield element
> > > > > + * @mask: shifted mask defining the field's length and position
> > > > > + * @val: value to put in the field
> > > > > + *
> > > > > + * field_prep() masks and shifts up the value. The result should be
> > > > > + * combined with other fields of the bitfield using logical OR.
> > > > > + * Unlike FIELD_PREP(), @mask is not limited to a compile-time constant.
> > > > > + */
> > > > > +#define field_prep(mask, val) \
> > > > > + ({ \
> > > > > + __auto_type __mask = (mask); \
> > > > > + typeof(mask) __val = (val); \
> > > > > + unsigned int __shift = sizeof(mask) <= 4 ? \
> > > > > + __ffs(__mask) : __ffs64(__mask); \
> > > > > + (__val << __shift) & __mask; \
> > > >
> > > > __ffs(0) is undef. The corresponding comment in
> > > > include/asm-generic/bitops/__ffs.h explicitly says: "code should check
> > > > against 0 first".
> > >
> > > An all zeroes mask is a bug in the code that calls field_{get,prep}().
> >
> > It's a bug in FIELD_GET() - for sure. Because it's enforced in
> > __BF_FIELD_CHECK(). field_get() doesn't enforce it, doesn't even
> > mention that in the comment.
> >
> > I'm not fully convinced that empty runtime mask should be a bug.
>
> Getting (and using) data from nowhere is a bug.
> Storing data where there is no space to store is also a bug.
>
> I will add a comment.
>
> > Consider memcpy(dst, src, 0). This is a no-op, but not a bug as
> > soon as the pointers are valid. If you _think_ it's a bug - please
> > enforce it.
>
> memcpy() with a fixed size of zero is probably a bug.
> memcpy() with a variable size is usually used to copy "as much as is
> needed", so zero is usually not a bug.
5 lines above you say: "Getting (and using) data from nowhere is a bug".
Now you're saying: "so zero is usually not a bug". So, is it a bug or
not?
Consider this example:
unsigned a = field_get(mask, get_user(ptr));
Conceptually it's the same as per-bit copy_from_user().
The copy_from_user
1. allows size == 0;
2. does not dereference pointers in that case, i.e. doesn't call
get_user().
Can we make sure that field_get() provides the same guarantees?
> > > > I think mask = 0 is a sign of error here. Can you add a code catching
> > > > it at compile time, and maybe at runtime too? Something like:
> > > >
> > > > #define __field_prep(mask, val)
> > > > ({
> > > > unsigned __shift = sizeof(mask) <= 4 ? __ffs(mask) : __ffs64(mask);
> > > > (val << __shift) & mask;
> > > > })
> > > >
> > > > #define field_prep(mask, val)
> > > > ({
> > > > unsigned int __shift;
> > > > __auto_type __mask = (mask), __ret = 0;
> > > > typeof(mask) __val = (val);
> > > >
> > > > BUILD_BUG_ON_ZERO(const_true(mask == 0));
> > >
> > > Futile, as code with a constant mask should use FIELD_PREP() instead.
> >
> > It's a weak argument. Sometimes compiler is smart enough to realize
> > that something is a constant, while people won't. Sometimes code gets
> > refactored. Sometimes people build complex expressions that should
> > work both in run-time and compile time cases. Sometimes variables are
> > compile- or run-time depending on config (nr_cpu_ids is an example).
> >
> > The field_prep() must handle const case just as good as capitalized
> > version does.
>
> OK, I will add the (build-time) check.
If mask is compile-time, you can wire field_prep() to FIELD_PREP(), so
it will do the work for you.
Thanks,
Yury
Hi Yury,
On Wed, 22 Oct 2025 at 17:50, Yury Norov <yury.norov@gmail.com> wrote:
> On Wed, Oct 22, 2025 at 12:01:37PM +0200, Geert Uytterhoeven wrote:
> > On Wed, 22 Oct 2025 at 06:20, Yury Norov <yury.norov@gmail.com> wrote:
> > > On Mon, Oct 20, 2025 at 03:00:24PM +0200, Geert Uytterhoeven wrote:
> > > > On Fri, 17 Oct 2025 at 20:51, Yury Norov <yury.norov@gmail.com> wrote:
> > > > > On Fri, Oct 17, 2025 at 12:54:10PM +0200, Geert Uytterhoeven wrote:
> > > > > > The existing FIELD_{GET,PREP}() macros are limited to compile-time
> > > > > > constants. However, it is very common to prepare or extract bitfield
> > > > > > elements where the bitfield mask is not a compile-time constant.
> > > > > >
> > > > > > To avoid this limitation, the AT91 clock driver and several other
> > > > > > drivers already have their own non-const field_{prep,get}() macros.
> > > > > > Make them available for general use by consolidating them in
> > > > > > <linux/bitfield.h>, and improve them slightly:
> > > > > > 1. Avoid evaluating macro parameters more than once,
> > > > > > 2. Replace "ffs() - 1" by "__ffs()",
> > > > > > 3. Support 64-bit use on 32-bit architectures.
> > > > > >
> > > > > > This is deliberately not merged into the existing FIELD_{GET,PREP}()
> > > > > > macros, as people expressed the desire to keep stricter variants for
> > > > > > increased safety, or for performance critical paths.
> > > > > >
> > > > > > Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
> > > > > > Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> > > > > > Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> > > > > > Acked-by: Crt Mori <cmo@melexis.com>
> > > > > > ---
> > > > > > v4:
> > > > > > - Add Acked-by,
> > > > > > - Rebase on top of commit 7c68005a46108ffa ("crypto: qat - relocate
> > > > > > power management debugfs helper APIs") in v6.17-rc1,
> > > > > > - Convert more recently introduced upstream copies:
> > > > > > - drivers/edac/ie31200_edac.c
> > > > > > - drivers/iio/dac/ad3530r.c
> > > > >
> > > > > Can you split out the part that actually introduces the new API?
> > > >
> > > > Unfortunately not, as that would cause build warnings/failures due
> > > > to conflicting redefinitions.
> > > > That is a reason why I want to apply this patch ASAP: new copies show
> > > > up all the time.
> > >
> > > In a preparation patch, for each driver:
> > >
> > > +#ifndef field_prep
> > > #define field_prep() ...
> > > +#endif
> > >
> > > Or simply
> > >
> > > +#undef field_prep
> > > #define field_prep() ...
> > >
> > > Then add the generic field_prep() in a separate patch. Then you can drop
> > > ifdefery in the drivers.
> > >
> > > Yeah, more patches, but the result is cleaner.
> >
> > And we need 3 kernel releases, as the addition of the macros to
> > the header file now has a hard dependency on adding the #undefs?
> > Unless I still apply all of them to an immutable branch, but then what
> > is the point?
>
> Not sure what do you mean. You can do it in a single series, and you
> don't need and should not split the series across releases. Consider
> my recent cpumask_next_wrap() rework as an example:
>
> https://lore.kernel.org/all/20250128164646.4009-1-yury.norov@gmail.com/
>
> 1. #1-4 switch kernel users to alternative functions;
> 2. #5 deprecates cpumask_next_wrap(), making sure it's a pure renaming,
> i.e. no-op.
> 3. #6 introduces the new nice implementation. It's the core-only patch,
> no drivers are touched.
> 4. #7-12 switch the rest of codebase from old version to new.
> 5. #13 drops deprecated old function.
>
> This is the most common scheme. In you case you can cut the corners.
>
> The goals here are:
>
> - keep core patches free of non-core code;
> - switch drivers to the new functionality one-by-one in sake of
> bisectability.
OK, I'll make it so...
> > > > > > --- a/include/linux/bitfield.h
> > > > > > +++ b/include/linux/bitfield.h
> > > > > > @@ -220,4 +220,40 @@ __MAKE_OP(64)
> > > > > > #undef __MAKE_OP
> > > > > > #undef ____MAKE_OP
> > > > > >
> > > > > > +/**
> > > > > > + * field_prep() - prepare a bitfield element
> > > > > > + * @mask: shifted mask defining the field's length and position
> > > > > > + * @val: value to put in the field
> > > > > > + *
> > > > > > + * field_prep() masks and shifts up the value. The result should be
> > > > > > + * combined with other fields of the bitfield using logical OR.
> > > > > > + * Unlike FIELD_PREP(), @mask is not limited to a compile-time constant.
> > > > > > + */
> > > > > > +#define field_prep(mask, val) \
> > > > > > + ({ \
> > > > > > + __auto_type __mask = (mask); \
> > > > > > + typeof(mask) __val = (val); \
> > > > > > + unsigned int __shift = sizeof(mask) <= 4 ? \
> > > > > > + __ffs(__mask) : __ffs64(__mask); \
> > > > > > + (__val << __shift) & __mask; \
> > > > >
> > > > > __ffs(0) is undef. The corresponding comment in
> > > > > include/asm-generic/bitops/__ffs.h explicitly says: "code should check
> > > > > against 0 first".
> > > >
> > > > An all zeroes mask is a bug in the code that calls field_{get,prep}().
> > >
> > > It's a bug in FIELD_GET() - for sure. Because it's enforced in
> > > __BF_FIELD_CHECK(). field_get() doesn't enforce it, doesn't even
> > > mention that in the comment.
> > >
> > > I'm not fully convinced that empty runtime mask should be a bug.
> >
> > Getting (and using) data from nowhere is a bug.
^^^ This is about field_get().
> > Storing data where there is no space to store is also a bug.
^^^ This is about field_prep().
> > I will add a comment.
> >
> > > Consider memcpy(dst, src, 0). This is a no-op, but not a bug as
> > > soon as the pointers are valid. If you _think_ it's a bug - please
> > > enforce it.
> >
> > memcpy() with a fixed size of zero is probably a bug.
> > memcpy() with a variable size is usually used to copy "as much as is
> > needed", so zero is usually not a bug.
^^^ These 3 lines are about memcpy().
> 5 lines above you say: "Getting (and using) data from nowhere is a bug".
> Now you're saying: "so zero is usually not a bug". So, is it a bug or
> not?
> > > > > I think mask = 0 is a sign of error here. Can you add a code catching
> > > > > it at compile time, and maybe at runtime too? Something like:
> > > > >
> > > > > #define __field_prep(mask, val)
> > > > > ({
> > > > > unsigned __shift = sizeof(mask) <= 4 ? __ffs(mask) : __ffs64(mask);
> > > > > (val << __shift) & mask;
> > > > > })
> > > > >
> > > > > #define field_prep(mask, val)
> > > > > ({
> > > > > unsigned int __shift;
> > > > > __auto_type __mask = (mask), __ret = 0;
> > > > > typeof(mask) __val = (val);
> > > > >
> > > > > BUILD_BUG_ON_ZERO(const_true(mask == 0));
> > > >
> > > > Futile, as code with a constant mask should use FIELD_PREP() instead.
> > >
> > > It's a weak argument. Sometimes compiler is smart enough to realize
> > > that something is a constant, while people won't. Sometimes code gets
> > > refactored. Sometimes people build complex expressions that should
> > > work both in run-time and compile time cases. Sometimes variables are
> > > compile- or run-time depending on config (nr_cpu_ids is an example).
> > >
> > > The field_prep() must handle const case just as good as capitalized
> > > version does.
> >
> > OK, I will add the (build-time) check.
>
> If mask is compile-time, you can wire field_prep() to FIELD_PREP(), so
> it will do the work for you.
OK, I will look into it.
Thanks!
Gr{oetje,eeting}s,
Geert
--
Geert Uytterhoeven -- There's lots of Linux beyond ia32 -- geert@linux-m68k.org
In personal conversations with technical people, I call myself a hacker. But
when I'm talking to journalists I just say "programmer" or something like that.
-- Linus Torvalds
On Fri, 2025-10-17 at 12:54 +0200, Geert Uytterhoeven wrote:
> The existing FIELD_{GET,PREP}() macros are limited to compile-time
> constants. However, it is very common to prepare or extract bitfield
> elements where the bitfield mask is not a compile-time constant.
>
> To avoid this limitation, the AT91 clock driver and several other
> drivers already have their own non-const field_{prep,get}() macros.
> Make them available for general use by consolidating them in
> <linux/bitfield.h>, and improve them slightly:
> 1. Avoid evaluating macro parameters more than once,
> 2. Replace "ffs() - 1" by "__ffs()",
> 3. Support 64-bit use on 32-bit architectures.
>
> This is deliberately not merged into the existing FIELD_{GET,PREP}()
> macros, as people expressed the desire to keep stricter variants for
> increased safety, or for performance critical paths.
>
> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
> Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
> Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
> Acked-by: Crt Mori <cmo@melexis.com>
> ---
Hopefully this gets merged soon. About time to have these variants (I do have a
driver submitted - in review - which is adding yet another variant of this)
Acked-by: Nuno Sá <nuno.sa@analog.com>
> v4:
> - Add Acked-by,
> - Rebase on top of commit 7c68005a46108ffa ("crypto: qat - relocate
> power management debugfs helper APIs") in v6.17-rc1,
> - Convert more recently introduced upstream copies:
> - drivers/edac/ie31200_edac.c
> - drivers/iio/dac/ad3530r.c
>
> v3:
> - Add Acked-by,
> - Drop underscores from macro parameters,
> - Use __auto_type where possible,
> - Correctly cast reg to the mask type,
> - Introduces __val and __reg intermediates to simplify the actual
> operation,
> - Drop unneeded parentheses,
> - Clarify having both FIELD_{GET,PREP}() and field_{get,prep}(),
>
> v2:
> - Cast val resp. reg to the mask type,
> - Fix 64-bit use on 32-bit architectures,
> - Convert new upstream users:
> - drivers/crypto/intel/qat/qat_common/adf_gen4_pm_debugfs.c
> - drivers/gpio/gpio-aspeed.c
> - drivers/iio/temperature/mlx90614.c
> - drivers/pinctrl/nuvoton/pinctrl-ma35.c
> - sound/usb/mixer_quirks.c
> - Convert new user queued in renesas-devel for v6.15:
> - drivers/soc/renesas/rz-sysc.c
> ---
> drivers/clk/at91/clk-peripheral.c | 1 +
> drivers/clk/at91/pmc.h | 3 --
> .../intel/qat/qat_common/adf_pm_dbgfs_utils.c | 8 +----
> drivers/edac/ie31200_edac.c | 4 +--
> drivers/gpio/gpio-aspeed.c | 5 +--
> drivers/iio/dac/ad3530r.c | 3 --
> drivers/iio/temperature/mlx90614.c | 5 +--
> drivers/pinctrl/nuvoton/pinctrl-ma35.c | 4 ---
> drivers/soc/renesas/rz-sysc.c | 3 +-
> include/linux/bitfield.h | 36 +++++++++++++++++++
> sound/usb/mixer_quirks.c | 4 ---
> 11 files changed, 42 insertions(+), 34 deletions(-)
>
> diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-
> peripheral.c
> index e700f40fd87f9327..e7208c47268b6397 100644
> --- a/drivers/clk/at91/clk-peripheral.c
> +++ b/drivers/clk/at91/clk-peripheral.c
> @@ -3,6 +3,7 @@
> * Copyright (C) 2013 Boris BREZILLON <b.brezillon@overkiz.com>
> */
>
> +#include <linux/bitfield.h>
> #include <linux/bitops.h>
> #include <linux/clk-provider.h>
> #include <linux/clkdev.h>
> diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h
> index 5daa32c4cf2540d7..543d7aee8d248cdb 100644
> --- a/drivers/clk/at91/pmc.h
> +++ b/drivers/clk/at91/pmc.h
> @@ -117,9 +117,6 @@ struct at91_clk_pms {
> unsigned int parent;
> };
>
> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
> -
> #define ndck(a, s) (a[s - 1].id + 1)
> #define nck(a) (a[ARRAY_SIZE(a) - 1].id + 1)
>
> diff --git a/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
> b/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
> index 69295a9ddf0ac92f..4ccc94ed9493a64c 100644
> --- a/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
> +++ b/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
> @@ -1,18 +1,12 @@
> // SPDX-License-Identifier: GPL-2.0-only
> /* Copyright(c) 2025 Intel Corporation */
> +#include <linux/bitfield.h>
> #include <linux/bitops.h>
> #include <linux/sprintf.h>
> #include <linux/string_helpers.h>
>
> #include "adf_pm_dbgfs_utils.h"
>
> -/*
> - * This is needed because a variable is used to index the mask at
> - * pm_scnprint_table(), making it not compile time constant, so the compile
> - * asserts from FIELD_GET() or u32_get_bits() won't be fulfilled.
> - */
> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
> -
> #define PM_INFO_MAX_KEY_LEN 21
>
> static int pm_scnprint_table(char *buff, const struct pm_status_row *table,
> diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
> index 5a080ab65476dacf..dfc9a9cecd74207d 100644
> --- a/drivers/edac/ie31200_edac.c
> +++ b/drivers/edac/ie31200_edac.c
> @@ -44,6 +44,7 @@
> * but lo_hi_readq() ensures that we are safe across all e3-1200 processors.
> */
>
> +#include <linux/bitfield.h>
> #include <linux/module.h>
> #include <linux/init.h>
> #include <linux/pci.h>
> @@ -139,9 +140,6 @@
> #define IE31200_CAPID0_DDPCD BIT(6)
> #define IE31200_CAPID0_ECC BIT(1)
>
> -/* Non-constant mask variant of FIELD_GET() */
> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
> -
> static int nr_channels;
> static struct pci_dev *mci_pdev;
> static int ie31200_registered = 1;
> diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
> index 7953a9c4e36d7550..3da999334971d501 100644
> --- a/drivers/gpio/gpio-aspeed.c
> +++ b/drivers/gpio/gpio-aspeed.c
> @@ -5,6 +5,7 @@
> * Joel Stanley <joel@jms.id.au>
> */
>
> +#include <linux/bitfield.h>
> #include <linux/cleanup.h>
> #include <linux/clk.h>
> #include <linux/gpio/aspeed.h>
> @@ -31,10 +32,6 @@
> #include <linux/gpio/consumer.h>
> #include "gpiolib.h"
>
> -/* Non-constant mask variant of FIELD_GET() and FIELD_PREP() */
> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) &
> (_mask))
> -
> #define GPIO_G7_IRQ_STS_BASE 0x100
> #define GPIO_G7_IRQ_STS_OFFSET(x) (GPIO_G7_IRQ_STS_BASE + (x) * 0x4)
> #define GPIO_G7_CTRL_REG_BASE 0x180
> diff --git a/drivers/iio/dac/ad3530r.c b/drivers/iio/dac/ad3530r.c
> index 6134613777b8e1d4..b97b46090d808ee7 100644
> --- a/drivers/iio/dac/ad3530r.c
> +++ b/drivers/iio/dac/ad3530r.c
> @@ -53,9 +53,6 @@
> #define AD3530R_MAX_CHANNELS 8
> #define AD3531R_MAX_CHANNELS 4
>
> -/* Non-constant mask variant of FIELD_PREP() */
> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) &
> (_mask))
> -
> enum ad3530r_mode {
> AD3530R_NORMAL_OP,
> AD3530R_POWERDOWN_1K,
> diff --git a/drivers/iio/temperature/mlx90614.c
> b/drivers/iio/temperature/mlx90614.c
> index 8a44a00bfd5ece38..1ad21b73e1b44cb0 100644
> --- a/drivers/iio/temperature/mlx90614.c
> +++ b/drivers/iio/temperature/mlx90614.c
> @@ -22,6 +22,7 @@
> * the "wakeup" GPIO is not given, power management will be disabled.
> */
>
> +#include <linux/bitfield.h>
> #include <linux/delay.h>
> #include <linux/err.h>
> #include <linux/gpio/consumer.h>
> @@ -68,10 +69,6 @@
> #define MLX90614_CONST_SCALE 20 /* Scale in milliKelvin (0.02 * 1000) */
> #define MLX90614_CONST_FIR 0x7 /* Fixed value for FIR part of low pass filter
> */
>
> -/* Non-constant mask variant of FIELD_GET() and FIELD_PREP() */
> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) &
> (_mask))
> -
> struct mlx_chip_info {
> /* EEPROM offsets with 16-bit data, MSB first */
> /* emissivity correction coefficient */
> diff --git a/drivers/pinctrl/nuvoton/pinctrl-ma35.c
> b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
> index cdad01d68a37e365..8d71dc53cc1de1f8 100644
> --- a/drivers/pinctrl/nuvoton/pinctrl-ma35.c
> +++ b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
> @@ -81,10 +81,6 @@
> #define MVOLT_1800 0
> #define MVOLT_3300 1
>
> -/* Non-constant mask variant of FIELD_GET() and FIELD_PREP() */
> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) &
> (_mask))
> -
> static const char * const gpio_group_name[] = {
> "gpioa", "gpiob", "gpioc", "gpiod", "gpioe", "gpiof", "gpiog",
> "gpioh", "gpioi", "gpioj", "gpiok", "gpiol", "gpiom", "gpion",
> diff --git a/drivers/soc/renesas/rz-sysc.c b/drivers/soc/renesas/rz-sysc.c
> index 9f79e299e6f41641..73eaf8b9d69f7208 100644
> --- a/drivers/soc/renesas/rz-sysc.c
> +++ b/drivers/soc/renesas/rz-sysc.c
> @@ -5,6 +5,7 @@
> * Copyright (C) 2024 Renesas Electronics Corp.
> */
>
> +#include <linux/bitfield.h>
> #include <linux/cleanup.h>
> #include <linux/io.h>
> #include <linux/mfd/syscon.h>
> @@ -16,8 +17,6 @@
>
> #include "rz-sysc.h"
>
> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
> -
> /**
> * struct rz_sysc - RZ SYSC private data structure
> * @base: SYSC base address
> diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
> index 7ff817bdae19b468..c999fe70076f6684 100644
> --- a/include/linux/bitfield.h
> +++ b/include/linux/bitfield.h
> @@ -220,4 +220,40 @@ __MAKE_OP(64)
> #undef __MAKE_OP
> #undef ____MAKE_OP
>
> +/**
> + * field_prep() - prepare a bitfield element
> + * @mask: shifted mask defining the field's length and position
> + * @val: value to put in the field
> + *
> + * field_prep() masks and shifts up the value. The result should be
> + * combined with other fields of the bitfield using logical OR.
> + * Unlike FIELD_PREP(), @mask is not limited to a compile-time constant.
> + */
> +#define field_prep(mask, val) \
> + ({ \
> + __auto_type __mask = (mask); \
> + typeof(mask) __val = (val); \
> + unsigned int __shift = sizeof(mask) <= 4 ? \
> + __ffs(__mask) :
> __ffs64(__mask); \
> + (__val << __shift) & __mask; \
> + })
> +
> +/**
> + * field_get() - extract a bitfield element
> + * @mask: shifted mask defining the field's length and position
> + * @reg: value of entire bitfield
> + *
> + * field_get() extracts the field specified by @mask from the
> + * bitfield passed in as @reg by masking and shifting it down.
> + * Unlike FIELD_GET(), @mask is not limited to a compile-time constant.
> + */
> +#define field_get(mask, reg) \
> + ({ \
> + __auto_type __mask = (mask); \
> + typeof(mask) __reg = (reg); \
> + unsigned int __shift = sizeof(mask) <= 4 ? \
> + __ffs(__mask) :
> __ffs64(__mask); \
> + (__reg & __mask) >> __shift; \
> + })
> +
> #endif
> diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
> index 828af3095b86ee0a..6eee89cbc0867f2b 100644
> --- a/sound/usb/mixer_quirks.c
> +++ b/sound/usb/mixer_quirks.c
> @@ -3311,10 +3311,6 @@ static int snd_bbfpro_controls_create(struct
> usb_mixer_interface *mixer)
> #define RME_DIGIFACE_REGISTER(reg, mask) (((reg) << 16) | (mask))
> #define RME_DIGIFACE_INVERT BIT(31)
>
> -/* Nonconst helpers */
> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
> -
> static int snd_rme_digiface_write_reg(struct snd_kcontrol *kcontrol, int
> item, u16 mask, u16 val)
> {
> struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
Le 17/10/2025 à 14:33, Nuno Sá a écrit :
> On Fri, 2025-10-17 at 12:54 +0200, Geert Uytterhoeven wrote:
>> The existing FIELD_{GET,PREP}() macros are limited to compile-time
>> constants. However, it is very common to prepare or extract bitfield
>> elements where the bitfield mask is not a compile-time constant.
>>
>> To avoid this limitation, the AT91 clock driver and several other
>> drivers already have their own non-const field_{prep,get}() macros.
>> Make them available for general use by consolidating them in
>> <linux/bitfield.h>, and improve them slightly:
>> 1. Avoid evaluating macro parameters more than once,
>> 2. Replace "ffs() - 1" by "__ffs()",
>> 3. Support 64-bit use on 32-bit architectures.
>>
>> This is deliberately not merged into the existing FIELD_{GET,PREP}()
>> macros, as people expressed the desire to keep stricter variants for
>> increased safety, or for performance critical paths.
>>
>> Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
>> Acked-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
>> Acked-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
>> Acked-by: Crt Mori <cmo@melexis.com>
>> ---
>
> Hopefully this gets merged soon. About time to have these variants (I do have a
> driver submitted - in review - which is adding yet another variant of this)
>
> Acked-by: Nuno Sá <nuno.sa@analog.com>
Same here, I would happily drop field_{get,set} from my series under
review to include bitfield.h
Thanks Geert!
Acked-by: Richard Genoud <richard.genoud@bootlin.com>
>
>> v4:
>> - Add Acked-by,
>> - Rebase on top of commit 7c68005a46108ffa ("crypto: qat - relocate
>> power management debugfs helper APIs") in v6.17-rc1,
>> - Convert more recently introduced upstream copies:
>> - drivers/edac/ie31200_edac.c
>> - drivers/iio/dac/ad3530r.c
>>
>> v3:
>> - Add Acked-by,
>> - Drop underscores from macro parameters,
>> - Use __auto_type where possible,
>> - Correctly cast reg to the mask type,
>> - Introduces __val and __reg intermediates to simplify the actual
>> operation,
>> - Drop unneeded parentheses,
>> - Clarify having both FIELD_{GET,PREP}() and field_{get,prep}(),
>>
>> v2:
>> - Cast val resp. reg to the mask type,
>> - Fix 64-bit use on 32-bit architectures,
>> - Convert new upstream users:
>> - drivers/crypto/intel/qat/qat_common/adf_gen4_pm_debugfs.c
>> - drivers/gpio/gpio-aspeed.c
>> - drivers/iio/temperature/mlx90614.c
>> - drivers/pinctrl/nuvoton/pinctrl-ma35.c
>> - sound/usb/mixer_quirks.c
>> - Convert new user queued in renesas-devel for v6.15:
>> - drivers/soc/renesas/rz-sysc.c
>> ---
>> drivers/clk/at91/clk-peripheral.c | 1 +
>> drivers/clk/at91/pmc.h | 3 --
>> .../intel/qat/qat_common/adf_pm_dbgfs_utils.c | 8 +----
>> drivers/edac/ie31200_edac.c | 4 +--
>> drivers/gpio/gpio-aspeed.c | 5 +--
>> drivers/iio/dac/ad3530r.c | 3 --
>> drivers/iio/temperature/mlx90614.c | 5 +--
>> drivers/pinctrl/nuvoton/pinctrl-ma35.c | 4 ---
>> drivers/soc/renesas/rz-sysc.c | 3 +-
>> include/linux/bitfield.h | 36 +++++++++++++++++++
>> sound/usb/mixer_quirks.c | 4 ---
>> 11 files changed, 42 insertions(+), 34 deletions(-)
>>
>> diff --git a/drivers/clk/at91/clk-peripheral.c b/drivers/clk/at91/clk-
>> peripheral.c
>> index e700f40fd87f9327..e7208c47268b6397 100644
>> --- a/drivers/clk/at91/clk-peripheral.c
>> +++ b/drivers/clk/at91/clk-peripheral.c
>> @@ -3,6 +3,7 @@
>> * Copyright (C) 2013 Boris BREZILLON <b.brezillon@overkiz.com>
>> */
>>
>> +#include <linux/bitfield.h>
>> #include <linux/bitops.h>
>> #include <linux/clk-provider.h>
>> #include <linux/clkdev.h>
>> diff --git a/drivers/clk/at91/pmc.h b/drivers/clk/at91/pmc.h
>> index 5daa32c4cf2540d7..543d7aee8d248cdb 100644
>> --- a/drivers/clk/at91/pmc.h
>> +++ b/drivers/clk/at91/pmc.h
>> @@ -117,9 +117,6 @@ struct at91_clk_pms {
>> unsigned int parent;
>> };
>>
>> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
>> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
>> -
>> #define ndck(a, s) (a[s - 1].id + 1)
>> #define nck(a) (a[ARRAY_SIZE(a) - 1].id + 1)
>>
>> diff --git a/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
>> b/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
>> index 69295a9ddf0ac92f..4ccc94ed9493a64c 100644
>> --- a/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
>> +++ b/drivers/crypto/intel/qat/qat_common/adf_pm_dbgfs_utils.c
>> @@ -1,18 +1,12 @@
>> // SPDX-License-Identifier: GPL-2.0-only
>> /* Copyright(c) 2025 Intel Corporation */
>> +#include <linux/bitfield.h>
>> #include <linux/bitops.h>
>> #include <linux/sprintf.h>
>> #include <linux/string_helpers.h>
>>
>> #include "adf_pm_dbgfs_utils.h"
>>
>> -/*
>> - * This is needed because a variable is used to index the mask at
>> - * pm_scnprint_table(), making it not compile time constant, so the compile
>> - * asserts from FIELD_GET() or u32_get_bits() won't be fulfilled.
>> - */
>> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
>> -
>> #define PM_INFO_MAX_KEY_LEN 21
>>
>> static int pm_scnprint_table(char *buff, const struct pm_status_row *table,
>> diff --git a/drivers/edac/ie31200_edac.c b/drivers/edac/ie31200_edac.c
>> index 5a080ab65476dacf..dfc9a9cecd74207d 100644
>> --- a/drivers/edac/ie31200_edac.c
>> +++ b/drivers/edac/ie31200_edac.c
>> @@ -44,6 +44,7 @@
>> * but lo_hi_readq() ensures that we are safe across all e3-1200 processors.
>> */
>>
>> +#include <linux/bitfield.h>
>> #include <linux/module.h>
>> #include <linux/init.h>
>> #include <linux/pci.h>
>> @@ -139,9 +140,6 @@
>> #define IE31200_CAPID0_DDPCD BIT(6)
>> #define IE31200_CAPID0_ECC BIT(1)
>>
>> -/* Non-constant mask variant of FIELD_GET() */
>> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
>> -
>> static int nr_channels;
>> static struct pci_dev *mci_pdev;
>> static int ie31200_registered = 1;
>> diff --git a/drivers/gpio/gpio-aspeed.c b/drivers/gpio/gpio-aspeed.c
>> index 7953a9c4e36d7550..3da999334971d501 100644
>> --- a/drivers/gpio/gpio-aspeed.c
>> +++ b/drivers/gpio/gpio-aspeed.c
>> @@ -5,6 +5,7 @@
>> * Joel Stanley <joel@jms.id.au>
>> */
>>
>> +#include <linux/bitfield.h>
>> #include <linux/cleanup.h>
>> #include <linux/clk.h>
>> #include <linux/gpio/aspeed.h>
>> @@ -31,10 +32,6 @@
>> #include <linux/gpio/consumer.h>
>> #include "gpiolib.h"
>>
>> -/* Non-constant mask variant of FIELD_GET() and FIELD_PREP() */
>> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
>> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) &
>> (_mask))
>> -
>> #define GPIO_G7_IRQ_STS_BASE 0x100
>> #define GPIO_G7_IRQ_STS_OFFSET(x) (GPIO_G7_IRQ_STS_BASE + (x) * 0x4)
>> #define GPIO_G7_CTRL_REG_BASE 0x180
>> diff --git a/drivers/iio/dac/ad3530r.c b/drivers/iio/dac/ad3530r.c
>> index 6134613777b8e1d4..b97b46090d808ee7 100644
>> --- a/drivers/iio/dac/ad3530r.c
>> +++ b/drivers/iio/dac/ad3530r.c
>> @@ -53,9 +53,6 @@
>> #define AD3530R_MAX_CHANNELS 8
>> #define AD3531R_MAX_CHANNELS 4
>>
>> -/* Non-constant mask variant of FIELD_PREP() */
>> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) &
>> (_mask))
>> -
>> enum ad3530r_mode {
>> AD3530R_NORMAL_OP,
>> AD3530R_POWERDOWN_1K,
>> diff --git a/drivers/iio/temperature/mlx90614.c
>> b/drivers/iio/temperature/mlx90614.c
>> index 8a44a00bfd5ece38..1ad21b73e1b44cb0 100644
>> --- a/drivers/iio/temperature/mlx90614.c
>> +++ b/drivers/iio/temperature/mlx90614.c
>> @@ -22,6 +22,7 @@
>> * the "wakeup" GPIO is not given, power management will be disabled.
>> */
>>
>> +#include <linux/bitfield.h>
>> #include <linux/delay.h>
>> #include <linux/err.h>
>> #include <linux/gpio/consumer.h>
>> @@ -68,10 +69,6 @@
>> #define MLX90614_CONST_SCALE 20 /* Scale in milliKelvin (0.02 * 1000) */
>> #define MLX90614_CONST_FIR 0x7 /* Fixed value for FIR part of low pass filter
>> */
>>
>> -/* Non-constant mask variant of FIELD_GET() and FIELD_PREP() */
>> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
>> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) &
>> (_mask))
>> -
>> struct mlx_chip_info {
>> /* EEPROM offsets with 16-bit data, MSB first */
>> /* emissivity correction coefficient */
>> diff --git a/drivers/pinctrl/nuvoton/pinctrl-ma35.c
>> b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
>> index cdad01d68a37e365..8d71dc53cc1de1f8 100644
>> --- a/drivers/pinctrl/nuvoton/pinctrl-ma35.c
>> +++ b/drivers/pinctrl/nuvoton/pinctrl-ma35.c
>> @@ -81,10 +81,6 @@
>> #define MVOLT_1800 0
>> #define MVOLT_3300 1
>>
>> -/* Non-constant mask variant of FIELD_GET() and FIELD_PREP() */
>> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
>> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) &
>> (_mask))
>> -
>> static const char * const gpio_group_name[] = {
>> "gpioa", "gpiob", "gpioc", "gpiod", "gpioe", "gpiof", "gpiog",
>> "gpioh", "gpioi", "gpioj", "gpiok", "gpiol", "gpiom", "gpion",
>> diff --git a/drivers/soc/renesas/rz-sysc.c b/drivers/soc/renesas/rz-sysc.c
>> index 9f79e299e6f41641..73eaf8b9d69f7208 100644
>> --- a/drivers/soc/renesas/rz-sysc.c
>> +++ b/drivers/soc/renesas/rz-sysc.c
>> @@ -5,6 +5,7 @@
>> * Copyright (C) 2024 Renesas Electronics Corp.
>> */
>>
>> +#include <linux/bitfield.h>
>> #include <linux/cleanup.h>
>> #include <linux/io.h>
>> #include <linux/mfd/syscon.h>
>> @@ -16,8 +17,6 @@
>>
>> #include "rz-sysc.h"
>>
>> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
>> -
>> /**
>> * struct rz_sysc - RZ SYSC private data structure
>> * @base: SYSC base address
>> diff --git a/include/linux/bitfield.h b/include/linux/bitfield.h
>> index 7ff817bdae19b468..c999fe70076f6684 100644
>> --- a/include/linux/bitfield.h
>> +++ b/include/linux/bitfield.h
>> @@ -220,4 +220,40 @@ __MAKE_OP(64)
>> #undef __MAKE_OP
>> #undef ____MAKE_OP
>>
>> +/**
>> + * field_prep() - prepare a bitfield element
>> + * @mask: shifted mask defining the field's length and position
>> + * @val: value to put in the field
>> + *
>> + * field_prep() masks and shifts up the value. The result should be
>> + * combined with other fields of the bitfield using logical OR.
>> + * Unlike FIELD_PREP(), @mask is not limited to a compile-time constant.
>> + */
>> +#define field_prep(mask, val) \
>> + ({ \
>> + __auto_type __mask = (mask); \
>> + typeof(mask) __val = (val); \
>> + unsigned int __shift = sizeof(mask) <= 4 ? \
>> + __ffs(__mask) :
>> __ffs64(__mask); \
>> + (__val << __shift) & __mask; \
>> + })
>> +
>> +/**
>> + * field_get() - extract a bitfield element
>> + * @mask: shifted mask defining the field's length and position
>> + * @reg: value of entire bitfield
>> + *
>> + * field_get() extracts the field specified by @mask from the
>> + * bitfield passed in as @reg by masking and shifting it down.
>> + * Unlike FIELD_GET(), @mask is not limited to a compile-time constant.
>> + */
>> +#define field_get(mask, reg) \
>> + ({ \
>> + __auto_type __mask = (mask); \
>> + typeof(mask) __reg = (reg); \
>> + unsigned int __shift = sizeof(mask) <= 4 ? \
>> + __ffs(__mask) :
>> __ffs64(__mask); \
>> + (__reg & __mask) >> __shift; \
>> + })
>> +
>> #endif
>> diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
>> index 828af3095b86ee0a..6eee89cbc0867f2b 100644
>> --- a/sound/usb/mixer_quirks.c
>> +++ b/sound/usb/mixer_quirks.c
>> @@ -3311,10 +3311,6 @@ static int snd_bbfpro_controls_create(struct
>> usb_mixer_interface *mixer)
>> #define RME_DIGIFACE_REGISTER(reg, mask) (((reg) << 16) | (mask))
>> #define RME_DIGIFACE_INVERT BIT(31)
>>
>> -/* Nonconst helpers */
>> -#define field_get(_mask, _reg) (((_reg) & (_mask)) >> (ffs(_mask) - 1))
>> -#define field_prep(_mask, _val) (((_val) << (ffs(_mask) - 1)) & (_mask))
>> -
>> static int snd_rme_digiface_write_reg(struct snd_kcontrol *kcontrol, int
>> item, u16 mask, u16 val)
>> {
>> struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
--
Richard Genoud, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
© 2016 - 2026 Red Hat, Inc.