Make #[naked] an unsafe attribute

Author: folkertdev

compiler/rustc_codegen_cranelift/example/mini_core_hello_world.rs

@@ -389,9 +389,7 @@ global_asm! {
 #[cfg(all(not(jit), target_arch = "x86_64"))]
 #[naked]
 extern "C" fn naked_test() {
-    unsafe {
-        naked_asm!("ret");
-    }
+    unsafe { naked_asm!("ret") }
 }
 
 #[repr(C)]

compiler/rustc_error_codes/src/error_codes/E0736.md

@@ -11,7 +11,7 @@ Erroneous code example:
 
 ```compile_fail,E0736
 #[inline]
-#[naked]
+#[unsafe(naked)]
 fn foo() {}
 ```
 

compiler/rustc_error_codes/src/error_codes/E0787.md

@@ -5,7 +5,7 @@ Erroneous code example:
 ```compile_fail,E0787
 #![feature(naked_functions)]
 
-#[naked]
+#[unsafe(naked)]
 pub extern "C" fn f() -> u32 {
     42
 }

compiler/rustc_feature/src/builtin_attrs.rs

@@ -516,10 +516,16 @@ pub static BUILTIN_ATTRIBUTES: &[BuiltinAttribute] = &[
     // ==========================================================================
 
     // Linking:
+    #[cfg(bootstrap)]
     gated!(
         naked, Normal, template!(Word), WarnFollowing, EncodeCrossCrate::No,
         naked_functions, experimental!(naked)
     ),
+    #[cfg(not(bootstrap))]
+    gated!(
+        unsafe naked, Normal, template!(Word), WarnFollowing, EncodeCrossCrate::No,
+        naked_functions, experimental!(naked)
+    ),
 
     // Testing:
     gated!(

compiler/rustc_mir_build/src/check_unsafety.rs

@@ -564,13 +564,17 @@ impl<'a, 'tcx> Visitor<'a, 'tcx> for UnsafetyVisitor<'a, 'tcx> {
                 }
             }
             ExprKind::InlineAsm(box InlineAsmExpr {
-                asm_macro: AsmMacro::Asm | AsmMacro::NakedAsm,
+                asm_macro: asm_macro @ (AsmMacro::Asm | AsmMacro::NakedAsm),
                 ref operands,
                 template: _,
                 options: _,
                 line_spans: _,
             }) => {
-                self.requires_unsafe(expr.span, UseOfInlineAssembly);
+                // The `naked` attribute and the `naked_asm!` block form one atomic unit of
+                // unsafety, and `naked_asm!` does not itself need to be wrapped in an unsafe block.
+                if let AsmMacro::Asm = asm_macro {
+                    self.requires_unsafe(expr.span, UseOfInlineAssembly);
+                }
 
                 // For inline asm, do not use `walk_expr`, since we want to handle the label block
                 // specially.

src/doc/unstable-book/src/compiler-flags/sanitizer.md

@@ -247,34 +247,31 @@ See the [Clang ControlFlowIntegrity documentation][clang-cfi] for more details.
 ```rust,ignore (making doc tests pass cross-platform is hard)
 #![feature(naked_functions)]
 
-use std::arch::asm;
+use std::arch::naked_asm;
 use std::mem;
 
 fn add_one(x: i32) -> i32 {
     x + 1
 }
 
-#[naked]
+#[unsafe(naked)]
 pub extern "C" fn add_two(x: i32) {
     // x + 2 preceded by a landing pad/nop block
-    unsafe {
-        asm!(
-            "
-             nop
-             nop
-             nop
-             nop
-             nop
-             nop
-             nop
-             nop
-             nop
-             lea eax, [rdi+2]
-             ret
-        ",
-            options(noreturn)
-        );
-    }
+    naked_asm!(
+        "
+         nop
+         nop
+         nop
+         nop
+         nop
+         nop
+         nop
+         nop
+         nop
+         lea eax, [rdi+2]
+         ret
+        "
+    );
 }
 
 fn do_twice(f: fn(i32) -> i32, arg: i32) -> i32 {

tests/assembly/naked-functions/aarch64-naked-fn-no-bti-prolog.rs

@@ -13,8 +13,8 @@ use std::arch::naked_asm;
 // LLVM implements this via making sure of that, even for functions with the naked attribute.
 // So, we must emit an appropriate instruction instead!
 #[no_mangle]
-#[naked]
-pub unsafe extern "C" fn _hlt() -> ! {
+#[unsafe(naked)]
+pub extern "C" fn _hlt() -> ! {
     // CHECK-NOT: hint #34
     // CHECK: hlt #0x1
     naked_asm!("hlt #1")

tests/assembly/naked-functions/aix.rs

@@ -29,7 +29,7 @@ use minicore::*;
 // CHECK-LABEL: blr:
 // CHECK: blr
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn blr() {
+#[unsafe(naked)]
+extern "C" fn blr() {
     naked_asm!("blr")
 }

tests/assembly/naked-functions/wasm32.rs

@@ -22,8 +22,8 @@ use minicore::*;
 // CHECK-NOT: .size
 // CHECK: end_function
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn nop() {
+#[unsafe(naked)]
+extern "C" fn nop() {
     naked_asm!("nop")
 }
 
@@ -34,11 +34,11 @@ unsafe extern "C" fn nop() {
 // CHECK-NOT: .size
 // CHECK: end_function
 #[no_mangle]
-#[naked]
+#[unsafe(naked)]
 #[linkage = "weak"]
 // wasm functions cannot be aligned, so this has no effect
 #[repr(align(32))]
-unsafe extern "C" fn weak_aligned_nop() {
+extern "C" fn weak_aligned_nop() {
     naked_asm!("nop")
 }
 
@@ -51,48 +51,48 @@ unsafe extern "C" fn weak_aligned_nop() {
 //
 // CHECK-NEXT: end_function
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_i8_i8(num: i8) -> i8 {
+#[unsafe(naked)]
+extern "C" fn fn_i8_i8(num: i8) -> i8 {
     naked_asm!("local.get 0", "local.get 0", "i32.mul")
 }
 
 // CHECK-LABEL: fn_i8_i8_i8:
 // CHECK: .functype fn_i8_i8_i8 (i32, i32) -> (i32)
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_i8_i8_i8(a: i8, b: i8) -> i8 {
+#[unsafe(naked)]
+extern "C" fn fn_i8_i8_i8(a: i8, b: i8) -> i8 {
     naked_asm!("local.get 1", "local.get 0", "i32.mul")
 }
 
 // CHECK-LABEL: fn_unit_i8:
 // CHECK: .functype fn_unit_i8 () -> (i32)
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_unit_i8() -> i8 {
+#[unsafe(naked)]
+extern "C" fn fn_unit_i8() -> i8 {
     naked_asm!("i32.const 42")
 }
 
 // CHECK-LABEL: fn_i8_unit:
 // CHECK: .functype fn_i8_unit (i32) -> ()
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_i8_unit(_: i8) {
+#[unsafe(naked)]
+extern "C" fn fn_i8_unit(_: i8) {
     naked_asm!("nop")
 }
 
 // CHECK-LABEL: fn_i32_i32:
 // CHECK: .functype fn_i32_i32 (i32) -> (i32)
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_i32_i32(num: i32) -> i32 {
+#[unsafe(naked)]
+extern "C" fn fn_i32_i32(num: i32) -> i32 {
     naked_asm!("local.get 0", "local.get 0", "i32.mul")
 }
 
 // CHECK-LABEL: fn_i64_i64:
 // CHECK: .functype fn_i64_i64 (i64) -> (i64)
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_i64_i64(num: i64) -> i64 {
+#[unsafe(naked)]
+extern "C" fn fn_i64_i64(num: i64) -> i64 {
     naked_asm!("local.get 0", "local.get 0", "i64.mul")
 }
 
@@ -101,8 +101,8 @@ unsafe extern "C" fn fn_i64_i64(num: i64) -> i64 {
 // wasm64-unknown: .functype fn_i128_i128 (i64, i64, i64) -> ()
 #[allow(improper_ctypes_definitions)]
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_i128_i128(num: i128) -> i128 {
+#[unsafe(naked)]
+extern "C" fn fn_i128_i128(num: i128) -> i128 {
     naked_asm!(
         "local.get       0",
         "local.get       2",
@@ -117,8 +117,8 @@ unsafe extern "C" fn fn_i128_i128(num: i128) -> i128 {
 // wasm32-wasip1: .functype fn_f128_f128 (i32, i64, i64) -> ()
 // wasm64-unknown: .functype fn_f128_f128 (i64, i64, i64) -> ()
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_f128_f128(num: f128) -> f128 {
+#[unsafe(naked)]
+extern "C" fn fn_f128_f128(num: f128) -> f128 {
     naked_asm!(
         "local.get       0",
         "local.get       2",
@@ -139,8 +139,8 @@ struct Compound {
 // wasm32-wasip1: .functype fn_compound_compound (i32, i32) -> ()
 // wasm64-unknown: .functype fn_compound_compound (i64, i64) -> ()
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_compound_compound(_: Compound) -> Compound {
+#[unsafe(naked)]
+extern "C" fn fn_compound_compound(_: Compound) -> Compound {
     // this is the wasm32-wasip1 assembly
     naked_asm!(
         "local.get       0",
@@ -160,8 +160,8 @@ struct WrapperI32(i32);
 // CHECK-LABEL: fn_wrapperi32_wrapperi32:
 // CHECK: .functype fn_wrapperi32_wrapperi32 (i32) -> (i32)
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_wrapperi32_wrapperi32(_: WrapperI32) -> WrapperI32 {
+#[unsafe(naked)]
+extern "C" fn fn_wrapperi32_wrapperi32(_: WrapperI32) -> WrapperI32 {
     naked_asm!("local.get       0")
 }
 
@@ -171,8 +171,8 @@ struct WrapperI64(i64);
 // CHECK-LABEL: fn_wrapperi64_wrapperi64:
 // CHECK: .functype fn_wrapperi64_wrapperi64 (i64) -> (i64)
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_wrapperi64_wrapperi64(_: WrapperI64) -> WrapperI64 {
+#[unsafe(naked)]
+extern "C" fn fn_wrapperi64_wrapperi64(_: WrapperI64) -> WrapperI64 {
     naked_asm!("local.get       0")
 }
 
@@ -182,8 +182,8 @@ struct WrapperF32(f32);
 // CHECK-LABEL: fn_wrapperf32_wrapperf32:
 // CHECK: .functype fn_wrapperf32_wrapperf32 (f32) -> (f32)
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_wrapperf32_wrapperf32(_: WrapperF32) -> WrapperF32 {
+#[unsafe(naked)]
+extern "C" fn fn_wrapperf32_wrapperf32(_: WrapperF32) -> WrapperF32 {
     naked_asm!("local.get       0")
 }
 
@@ -193,7 +193,7 @@ struct WrapperF64(f64);
 // CHECK-LABEL: fn_wrapperf64_wrapperf64:
 // CHECK: .functype fn_wrapperf64_wrapperf64 (f64) -> (f64)
 #[no_mangle]
-#[naked]
-unsafe extern "C" fn fn_wrapperf64_wrapperf64(_: WrapperF64) -> WrapperF64 {
+#[unsafe(naked)]
+extern "C" fn fn_wrapperf64_wrapperf64(_: WrapperF64) -> WrapperF64 {
     naked_asm!("local.get       0")
 }

tests/assembly/naked-functions/x86_64-naked-fn-no-cet-prolog.rs

@@ -13,8 +13,8 @@ use std::arch::naked_asm;
 // works by using an instruction for each possible landing site,
 // and LLVM implements this via making sure of that.
 #[no_mangle]
-#[naked]
-pub unsafe extern "sysv64" fn will_halt() -> ! {
+#[unsafe(naked)]
+pub extern "sysv64" fn will_halt() -> ! {
     // CHECK-NOT: endbr{{32|64}}
     // CHECK: hlt
     naked_asm!("hlt")