Make #[naked] an unsafe attribute

Author: folkertdev

compiler/rustc_builtin_macros/messages.ftl

@@ -247,9 +247,9 @@ builtin_macros_multiple_defaults = multiple declared defaults
     .suggestion = make `{$ident}` default
 
 builtin_macros_naked_functions_testing_attribute =
-    cannot use `#[naked]` with testing attributes
+    cannot use `#[unsafe(naked)]` with testing attributes
     .label = function marked with testing attribute here
-    .naked_attribute = `#[naked]` is incompatible with testing attributes
+    .naked_attribute = `#[unsafe(naked)]` is incompatible with testing attributes
 
 builtin_macros_no_default_variant = `#[derive(Default)]` on enum with no `#[default]`
     .label = this enum needs a unit variant marked with `#[default]`

compiler/rustc_codegen_cranelift/example/mini_core_hello_world.rs

@@ -387,11 +387,9 @@ global_asm! {
 }
 
 #[cfg(all(not(jit), target_arch = "x86_64"))]
-#[naked]
+#[unsafe(naked)]
 extern "C" fn naked_test() {
-    unsafe {
-        naked_asm!("ret");
-    }
+    naked_asm!("ret")
 }
 
 #[repr(C)]

compiler/rustc_error_codes/src/error_codes/E0736.md

@@ -11,7 +11,7 @@ Erroneous code example:
 
 ```compile_fail,E0736
 #[inline]
-#[naked]
+#[unsafe(naked)]
 fn foo() {}
 ```
 

compiler/rustc_error_codes/src/error_codes/E0787.md

@@ -5,7 +5,7 @@ Erroneous code example:
 ```compile_fail,E0787
 #![feature(naked_functions)]
 
-#[naked]
+#[unsafe(naked)]
 pub extern "C" fn f() -> u32 {
     42
 }

compiler/rustc_feature/src/builtin_attrs.rs

@@ -517,7 +517,7 @@ pub static BUILTIN_ATTRIBUTES: &[BuiltinAttribute] = &[
 
     // Linking:
     gated!(
-        naked, Normal, template!(Word), WarnFollowing, EncodeCrossCrate::No,
+        unsafe naked, Normal, template!(Word), WarnFollowing, EncodeCrossCrate::No,
         naked_functions, experimental!(naked)
     ),
 

compiler/rustc_mir_build/src/check_unsafety.rs

@@ -564,13 +564,17 @@ impl<'a, 'tcx> Visitor<'a, 'tcx> for UnsafetyVisitor<'a, 'tcx> {
                 }
             }
             ExprKind::InlineAsm(box InlineAsmExpr {
-                asm_macro: AsmMacro::Asm | AsmMacro::NakedAsm,
+                asm_macro: asm_macro @ (AsmMacro::Asm | AsmMacro::NakedAsm),
                 ref operands,
                 template: _,
                 options: _,
                 line_spans: _,
             }) => {
-                self.requires_unsafe(expr.span, UseOfInlineAssembly);
+                // The `naked` attribute and the `naked_asm!` block form one atomic unit of
+                // unsafety, and `naked_asm!` does not itself need to be wrapped in an unsafe block.
+                if let AsmMacro::Asm = asm_macro {
+                    self.requires_unsafe(expr.span, UseOfInlineAssembly);
+                }
 
                 // For inline asm, do not use `walk_expr`, since we want to handle the label block
                 // specially.

compiler/rustc_parse/src/validate_attr.rs

@@ -194,12 +194,6 @@ pub fn check_attribute_safety(psess: &ParseSess, safety: AttributeSafety, attr:
             }
         }
     } else if let Safety::Unsafe(unsafe_span) = attr_item.unsafety {
-        // Allow (but don't require) `#[unsafe(naked)]` so that compiler-builtins can upgrade to it.
-        // FIXME(#139797): remove this special case when compiler-builtins has upgraded.
-        if attr.has_name(sym::naked) {
-            return;
-        }
-
         psess.dcx().emit_err(errors::InvalidAttrUnsafe {
             span: unsafe_span,
             name: attr_item.path.clone(),

compiler/rustc_passes/messages.ftl

@@ -508,17 +508,17 @@ passes_must_use_no_effect =
     `#[must_use]` has no effect when applied to {$article} {$target}
 
 passes_naked_asm_outside_naked_fn =
-    the `naked_asm!` macro can only be used in functions marked with `#[naked]`
+    the `naked_asm!` macro can only be used in functions marked with `#[unsafe(naked)]`
 
 passes_naked_functions_asm_block =
     naked functions must contain a single `naked_asm!` invocation
     .label_multiple_asm = multiple `naked_asm!` invocations are not allowed in naked functions
     .label_non_asm = not allowed in naked functions
 
 passes_naked_functions_incompatible_attribute =
-    attribute incompatible with `#[naked]`
-    .label = the `{$attr}` attribute is incompatible with `#[naked]`
-    .naked_attribute = function marked with `#[naked]` here
+    attribute incompatible with `#[unsafe(naked)]`
+    .label = the `{$attr}` attribute is incompatible with `#[unafe(naked)]`
+    .naked_attribute = function marked with `#[unsafe(naked)]` here
 
 passes_naked_functions_must_naked_asm =
     the `asm!` macro is not allowed in naked functions

src/doc/unstable-book/src/compiler-flags/sanitizer.md

@@ -247,34 +247,31 @@ See the [Clang ControlFlowIntegrity documentation][clang-cfi] for more details.
 ```rust,ignore (making doc tests pass cross-platform is hard)
 #![feature(naked_functions)]
 
-use std::arch::asm;
+use std::arch::naked_asm;
 use std::mem;
 
 fn add_one(x: i32) -> i32 {
     x + 1
 }
 
-#[naked]
+#[unsafe(naked)]
 pub extern "C" fn add_two(x: i32) {
     // x + 2 preceded by a landing pad/nop block
-    unsafe {
-        asm!(
-            "
-             nop
-             nop
-             nop
-             nop
-             nop
-             nop
-             nop
-             nop
-             nop
-             lea eax, [rdi+2]
-             ret
-        ",
-            options(noreturn)
-        );
-    }
+    naked_asm!(
+        "
+         nop
+         nop
+         nop
+         nop
+         nop
+         nop
+         nop
+         nop
+         nop
+         lea eax, [rdi+2]
+         ret
+        "
+    );
 }
 
 fn do_twice(f: fn(i32) -> i32, arg: i32) -> i32 {

tests/assembly/naked-functions/aarch64-naked-fn-no-bti-prolog.rs

@@ -13,8 +13,8 @@ use std::arch::naked_asm;
 // LLVM implements this via making sure of that, even for functions with the naked attribute.
 // So, we must emit an appropriate instruction instead!
 #[no_mangle]
-#[naked]
-pub unsafe extern "C" fn _hlt() -> ! {
+#[unsafe(naked)]
+pub extern "C" fn _hlt() -> ! {
     // CHECK-NOT: hint #34
     // CHECK: hlt #0x1
     naked_asm!("hlt #1")