|
|
Subscribe / Log in / New account

Bounded integers

Bounded integers

Posted Sep 6, 2025 10:40 UTC (Sat) by tialaramex (subscriber, #21167)
In reply to: Different kinds of validation? by Cyberax
Parent article: Tracking trust with Rust in the kernel

I disagree that bounded integers aren't useful, but then I would since I'm the person who really wants BalancedI8 and similar types (in that case, the signed 8-bit integer minus its most negative value, thus conveniently balanced, given a niche so that Option<BalancedI8> is also a single byte, and yet in practical terms just as useful as the existing i8 for almost any purpose)

Firstly, bounded integers give us a niche and Rust knows how to use the niche, with built-in types such as Option<T> as well as any user types being allowed to consume a niche - so now our data structures are smaller, yet our software is more correct, that's a win-win deal.

But also - this isn't a thing Rust is expected to do in the foreseeable future but it's certainly reasonable for Linux to be thinking about it in this context, bounded integers mean you can use mechanical proofs to ensure you can't write certain crucial types of bug. This is why WUFFS gets to have no bound misses despite not explicitly emitting bounds checks. It has verified that your code doesn't use any values which would cause a miss, ensuring that you meet these mathematical criteria is your problem and so you might need to write bounds checks, but often your algorithm can prove it doesn't miss anyway and WUFFS checks the proof.


to post comments


Copyright © 2025, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds