[PATCH v2 0/2] rust: re-export `unsafe_precondition_assert!` and use in cpu module

[PATCH v2 0/2] rust: re-export `unsafe_precondition_assert!` and use in cpu module

[Ritvik Gupta]

This series consists of two patches that together re-export `unsafe_precondition_assert!` 
macro from the prelude and use it in the `cpu` module.

---

Changes in v2:
- Split into two patches
- Add new patch to re-export `unsafe_precondition_assert!` from the prelude.
- Fix message formatting and copy-paste error.
- Link to v1: https://lore.kernel.org/rust-for-linux/20260518174414.204573-1-ritvikfoss@gmail.com/

---

Ritvik Gupta (2):
  rust: prelude: re-export `unsafe_precondition_assert!`
  rust: cpu: use `unsafe_precondition_assert!`

 rust/kernel/cpu.rs     | 22 +++++++++++++++++-----
 rust/kernel/prelude.rs |  1 +
 2 files changed, 18 insertions(+), 5 deletions(-)

-- 
2.54.0

[PATCH v2 1/2] rust: prelude: re-export `unsafe_precondition_assert!`

[Ritvik Gupta]

Re-export `unsafe_precondition_assert!` so the users can
import the macro directly via `kernel::prelude::*`
instead of `kernel::safety::unsafe_precondition_assert`.

Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://lore.kernel.org/rust-for-linux/CANiq72=5PUubJDYD57yhEC117tzNo9h6d=7f8OiengaExmGnyQ@mail.gmail.com/
Signed-off-by: Ritvik Gupta <ritvikfoss@gmail.com>
---
 rust/kernel/prelude.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rust/kernel/prelude.rs b/rust/kernel/prelude.rs
index 44edf72a4a24..dabacb5be332 100644
--- a/rust/kernel/prelude.rs
+++ b/rust/kernel/prelude.rs
@@ -101,6 +101,7 @@
     try_init,
     try_pin_init,
     uaccess::UserPtr,
+    unsafe_precondition_assert,
     ThisModule, //
 };
 
-- 
2.54.0

[PATCH v2 2/2] rust: cpu: use `unsafe_precondition_assert!`

[Ritvik Gupta]

Replace `debug_assert!` invocations with
`unsafe_precondition_assert!` in `from_i32_unchecked`
and `from_u32_unchecked` unsafe functions.

Suggested-by: Miguel Ojeda <ojeda@kernel.org>
Link: https://github.com/Rust-for-Linux/linux/issues/1232
Signed-off-by: Ritvik Gupta <ritvikfoss@gmail.com>
---
 rust/kernel/cpu.rs | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/rust/kernel/cpu.rs b/rust/kernel/cpu.rs
index cb6c0338ef5a..57bad2d8c788 100644
--- a/rust/kernel/cpu.rs
+++ b/rust/kernel/cpu.rs
@@ -4,7 +4,7 @@
 //!
 //! C header: [`include/linux/cpu.h`](srctree/include/linux/cpu.h)
 
-use crate::{bindings, device::Device, error::Result, prelude::ENODEV};
+use crate::{bindings, device::Device, error::Result, prelude::*};
 
 /// Returns the maximum number of possible CPUs in the current system configuration.
 #[inline]
@@ -54,8 +54,14 @@ impl CpuId {
     /// The caller must ensure that `id` is a valid CPU ID (i.e., `0 <= id < nr_cpu_ids()`).
     #[inline]
     pub unsafe fn from_i32_unchecked(id: i32) -> Self {
-        debug_assert!(id >= 0);
-        debug_assert!((id as u32) < nr_cpu_ids());
+        unsafe_precondition_assert!(
+            id >= 0,
+            "`CpuId::from_i32_unchecked` requires a non-negative `id`"
+        );
+        unsafe_precondition_assert!(
+            (id as u32) < nr_cpu_ids(),
+            "`CpuId::from_i32_unchecked` requires a valid `id` (i.e., `0 <= id < nr_cpu_ids()`)"
+        );
 
         // INVARIANT: The function safety guarantees `id` is a valid CPU id.
         Self(id as u32)
@@ -78,10 +84,16 @@ pub fn from_i32(id: i32) -> Option<Self> {
     /// The caller must ensure that `id` is a valid CPU ID (i.e., `0 <= id < nr_cpu_ids()`).
     #[inline]
     pub unsafe fn from_u32_unchecked(id: u32) -> Self {
-        debug_assert!(id < nr_cpu_ids());
+        unsafe_precondition_assert!(
+            id < nr_cpu_ids(),
+            "`CpuId::from_u32_unchecked` requires a valid `id` (i.e., `0 <= id < nr_cpu_ids()`)"
+        );
 
         // Ensure the `id` fits in an [`i32`] as it's also representable that way.
-        debug_assert!(id <= i32::MAX as u32);
+        unsafe_precondition_assert!(
+            id <= i32::MAX as u32,
+            "`CpuId::from_u32_unchecked` requires the `id` to not overflow `i32::MAX`"
+        );
 
         // INVARIANT: The function safety guarantees `id` is a valid CPU id.
         Self(id)
-- 
2.54.0

Re: [PATCH v2 2/2] rust: cpu: use `unsafe_precondition_assert!`

[Miguel Ojeda]

On Tue, May 19, 2026 at 12:57 AM Ritvik Gupta <ritvikfoss@gmail.com> wrote:
>
> Replace `debug_assert!` invocations with
> `unsafe_precondition_assert!` in `from_i32_unchecked`
> and `from_u32_unchecked` unsafe functions.

The commit message doesn't mention why the messages were added -- I
asked for it because I am not sure if it is worth providing a message
for each assertion, especially since the original code decided to
avoid it, i.e. the change to the new macro is good on its own,
regardless of the messages.

> -use crate::{bindings, device::Device, error::Result, prelude::ENODEV};
> +use crate::{bindings, device::Device, error::Result, prelude::*};

By the way, we could remove `error::Result` from the list since we
have the entire prelude now, and also take the chance to use the new
style:

  https://docs.kernel.org/rust/coding-guidelines.html#imports

But maybe wait to see if the maintainers have other feedback before v3.

Thanks!

Cheers,
Miguel

Re: [PATCH v2 2/2] rust: cpu: use `unsafe_precondition_assert!`

[Ritvik Gupta]

On Tue, May 19, 2026 at 07:41:59AM +0200, Miguel Ojeda wrote:
> On Tue, May 19, 2026 at 12:57 AM Ritvik Gupta <ritvikfoss@gmail.com> wrote:
> >
> > Replace `debug_assert!` invocations with
> > `unsafe_precondition_assert!` in `from_i32_unchecked`
> > and `from_u32_unchecked` unsafe functions.
> 
> The commit message doesn't mention why the messages were added -- I
> asked for it because I am not sure if it is worth providing a message
> for each assertion, especially since the original code decided to
> avoid it, i.e. the change to the new macro is good on its own,
> regardless of the messages.
> 

Actually, I added messages from UX standpoint, as having explicit
failure reason is helpful for debugging, when an assertion is hit.

I can update the commit message to clarify this, or remove it if
maintainers prefer keeping it as is.

> > -use crate::{bindings, device::Device, error::Result, prelude::ENODEV};
> > +use crate::{bindings, device::Device, error::Result, prelude::*};
> 
> By the way, we could remove `error::Result` from the list since we
> have the entire prelude now, and also take the chance to use the new
> style:
> 
>   https://docs.kernel.org/rust/coding-guidelines.html#imports
> 

Sure, will remove `error::Result` and use vertical-import style.

> But maybe wait to see if the maintainers have other feedback before v3.
> 
> Thanks!
> 
> Cheers,
> Miguel

Yeah, will wait for some time.
Thanks for your feedback :)