Skip to content

Commit a6703e8

Browse files
rcseacordPLeVasseur
authored andcommitted
Update guidelines for unsafe attributes in Rust
Removed exceptions section and added safety notes for unsafe attributes.
1 parent eb5bdad commit a6703e8

1 file changed

Lines changed: 24 additions & 31 deletions

File tree

src/coding-guidelines/attributes/gui_ZDLZzjeOwLSU.rst.inc

Lines changed: 24 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@
8181
8282
fn main() {
8383
// Call the unmangled function
84-
convert();
84+
convert()
8585
}
8686
8787
.. compliant_example::
@@ -100,7 +100,7 @@
100100
101101
fn main() {
102102
// Call the no_mangle function (safe to call)
103-
convert();
103+
convert()
104104
}
105105
106106
.. non_compliant_example::
@@ -194,13 +194,17 @@
194194
.. rust-example::
195195
:compile_fail:
196196

197-
// Missing unsafe marker - noncompliant in Rust 2024
198-
#[export_name = "custom_symbol"] // error: unsafe attribute used without unsafe
199-
pub fn my_function() {}
197+
// Collides with the C library 'printf' function
198+
#[export_name = "printf"] // noncompliant
200199

201200
// Missing unsafe marker - noncompliant in Rust 2024
202-
#[link_section = ".custom_section"] // error: unsafe attribute used without unsafe
203-
static DATA: u32 = 42;
201+
#[unsafe(link_section = ".init_array")] // noncompliant
202+
static DATA: u32 = 42; // Corrupts initialization table!
203+
204+
fn main() {
205+
printf("Hello, World");
206+
println!("DATA = {DATA}");
207+
}
204208

205209
.. compliant_example::
206210
:id: compl_ex_xY2zAb3cDe4f
@@ -211,11 +215,22 @@
211215

212216
.. rust-example::
213217

218+
// SAFETY: 'custom_symbol' does not conflict with any other symbol
214219
#[unsafe(export_name = "custom_symbol")]
215220
pub fn my_function() {}
216221

217-
#[unsafe(link_section = ".custom_section")]
218-
static DATA: u32 = 42;
222+
// SAFETY: Placing data in a specific section for embedded systems
223+
#[unsafe(link_section = ".noinit")]
224+
static mut PERSISTENT_DATA: [u8; 256] = [0; 256];
225+
226+
// SAFETY: Custom section for shared memory
227+
#[unsafe(link_section = ".shared")]
228+
static SHARED_BUFFER: [u8; 4096] = [0; 4096];
229+
230+
fn main() {
231+
my_function();
232+
println!("DATA = {DATA}");
233+
}
219234

220235
.. enforcement::
221236
:id: enf_pQ8rSt9uVw0x
@@ -241,28 +256,6 @@
241256
* **Code Review**: Manual review of all code containing ``unsafe`` tokens should be
242257
part of the development process, with documented justification for each usage.
243258

244-
.. exceptions::
245-
:id: exc_yZ1aAb2cDe3f
246-
:status: draft
247-
248-
Deviations from this guideline may be permitted under the following conditions:
249-
250-
* **Legacy Code Migration**: When migrating pre-2024 code, a documented migration plan
251-
with timeline for compliance is acceptable.
252-
253-
* **Third-Party Dependencies**: Dependencies not under project control that violate this
254-
guideline must be documented in the safety case with risk assessment.
255-
256-
* **Performance-Critical Sections**: Where the ``unsafe`` wrapper syntax causes measurable
257-
compilation overhead, document the deviation with benchmarks.
258-
259-
All deviations require:
260-
261-
1. Written justification documenting why the deviation is necessary
262-
2. Risk assessment of the safety implications
263-
3. Approval from the project's safety authority
264-
4. Tracking in the project's deviation log
265-
266259
.. related_guidelines::
267260
:id: rel_gH4iJk5lMn6o
268261
:status: draft

0 commit comments

Comments
 (0)