[RFC] All functions must be safe

[japaric]

Summary

Functions marked with any of these attributes: exception, idle, init,
interrupt and task must be safe fns and not unsafe fns.

Motivation

Put us in line with rust-lang/rfcs#2585. All the functions inside the app
block can only be called by the hardware and are safe to call by the hardware
(the DSL ensures that's the case) -- this should be reflected in the signature.

If a user wants to use unsafe code inside any of these functions they should
explicitly use an unsafe block instead of using unsafe fn as a short-hand
for unsafe fn() { unsafe { .. } }.

Design

The DSL will reject unsafe fns. For example:

#[rtfm::app(..)]
const APP: () = {
    #[init]
    fn init() { .. } // OK

    #[idle]
    unsafe fn idle() -> ! { .. } //~ ERROR: `idle` must have signature `fn() -> !`
};

Drawbacks

Unsafe code will suffer from (even more) rightward drift.

#[rtfm::app(..)]
const APP: () = {
    #[init]
    fn init() {
        unsafe {
            // unsafe stuff
        }

        // safe stuff
    }
};

[TeXitoi]

That's almost a safety bug, as the framework have no way of knowing the contract to allow calling these function.

[japaric]

That's almost a safety bug

Can you elaborate on what you mean by "that"? Do you mean the current state or something else? (Today, the framework won't let call any of these functions from software; that's not going to change)

[TeXitoi]

I mean if your interrupt handler is unsafe, RTFM has no way of knowing in which context this function can be called.

[korken89]

I would say that this is a good addition, and to be in line with rust-lang/rfcs#2585, makes sense.

[japaric]

I think this seems uncontroversial so let's vote for approving this RFC:

• @japaric
• @korken89
• @TeXitoi

[japaric]

This has enough approvals and no concerns have been raised over the course of several weeks so this RFC is now officially accepted. 🎉