Merge branch 'feature/deny-unsafe_op_in_unsafe_fn' into 'master'

Use unsafe blocks in some more unsafe functions, deny unsafe_op_in_unsafe_fn on crate level

See merge request redox-os/relibc!899

src/c_str.rs

@@ -1,8 +1,5 @@
 //! Nul-terminated byte strings.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{marker::PhantomData, ptr::NonNull, str::Utf8Error};
 
 use alloc::{

src/c_vec.rs

@@ -1,8 +1,5 @@
 //! Equivalent of Rust's `Vec<T>`, but using relibc's own allocator.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     io::{self, Write},
     platform::{self, WriteByte, types::*},

src/header/arpa_inet/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/arpa_inet.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{
     ptr, slice,
     str::{self, FromStr},

src/header/assert/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/assert.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     c_str::CStr,
     platform::types::{c_char, c_int},

src/header/crypt/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/crypt.3.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use ::scrypt::password_hash::{Salt, SaltString};
 use alloc::{
     ffi::CString,

src/header/ctype/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/ctype.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 // TODO: *_l functions
 
 use crate::platform::types::c_int;

src/header/dirent/mod.rs

@@ -2,8 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/dirent.h.html>.
 
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::{boxed::Box, vec::Vec};
 use core::{mem, ptr, slice};
 

src/header/dl-tls/mod.rs

@@ -1,6 +1,5 @@
 //! dl-tls implementation for Redox
 
-#![deny(unsafe_op_in_unsafe_fn)]
 // FIXME(andypython): remove this when #![allow(warnings, unused_variables)] is
 // dropped from src/lib.rs.
 #![warn(warnings, unused_variables)]

src/header/dlfcn/mod.rs

@@ -2,7 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/dlfcn.h.html>.
 
-#![deny(unsafe_op_in_unsafe_fn)]
 // FIXME(andypython): remove this when #![allow(warnings, unused_variables)] is
 // dropped from src/lib.rs.
 #![warn(warnings, unused_variables)]

src/header/errno/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/errno.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::platform::{
     self,
     types::{c_char, c_int},

src/header/fcntl/mod.rs

@@ -2,8 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/fcntl.h.html>.
 
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::num::NonZeroU64;
 
 use crate::{

src/header/float/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/float.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::_fenv::{FE_TONEAREST, fegetround},
     platform::types::c_int,

src/header/fnmatch/mod.rs

@@ -2,8 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/fnmatch.h.html>.
 
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::{borrow::Cow, vec::Vec};
 use core::slice;
 

src/header/getopt/mod.rs

@@ -2,8 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getopt.html>.
 
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::{
         stdio, string,

src/header/glob/mod.rs

@@ -2,8 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/glob.h.html>.
 
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::ptr;
 
 use alloc::{boxed::Box, vec::Vec};

src/header/grp/mod.rs

@@ -2,8 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/grp.h.html>.
 
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{
     cell::SyncUnsafeCell,
     convert::{TryFrom, TryInto},

src/header/ifaddrs/mod.rs

@@ -1,8 +1,5 @@
 //! `ifaddrs.h` implementation
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::ptr;
 
 use crate::{

src/header/inttypes/mod.rs

@@ -2,8 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/inttypes.h.html>.
 
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::{ctype, errno::*, stdlib::*},
     platform::{

src/header/libgen/mod.rs

@@ -2,8 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/libgen.h.html>.
 
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::platform::types::c_char;
 
 use crate::header::string::strlen;

src/header/locale/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/locale.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::{boxed::Box, ffi::CString, string::String};
 use core::{ptr, str::FromStr};
 

src/header/malloc/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! Non-POSIX, see <https://man7.org/linux/man-pages/man3/posix_memalign.3.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::errno::ENOMEM,
     platform::{

src/header/monetary/mod.rs

@@ -13,7 +13,6 @@ use libm::{fabs, floor, pow, round, trunc};
 extern crate alloc;
 
 mod strfmon;
-#[deny(unsafe_op_in_unsafe_fn)]
 #[repr(C)]
 struct LocaleMonetaryInfo {
     int_curr_symbol: &'static str,

src/header/net_if/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/net_if.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::ptr::null;
 
 use alloc::ffi::CString;

src/header/netdb/host.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::{boxed::Box, str::SplitWhitespace, vec::Vec};
 use core::{mem, ptr};
 

src/header/netdb/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/netdb.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 mod dns;
 
 use core::{

src/header/poll/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/poll.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{mem, ptr, slice};
 
 use crate::{

src/header/pthread/attr.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{ptr, sync::atomic::Ordering};
 
 use super::*;

src/header/pthread/barrier.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::header::errno::*;
 
 use core::num::NonZeroU32;

src/header/pthread/cond.rs

@@ -1,8 +1,5 @@
 // Used design from https://www.remlab.net/op/futex-condvar.shtml
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::header::time::CLOCK_REALTIME;
 
 use super::*;

src/header/pthread/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/pthread.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::collections::LinkedList;
 use core::{cell::Cell, ptr::NonNull};
 

src/header/pthread/mutex.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use super::*;
 
 use crate::{

src/header/pthread/once.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use super::*;
 
 // PTHREAD_ONCE_INIT

src/header/pthread/rwlock.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use super::*;
 
 use crate::header::errno::EBUSY;

src/header/pthread/spin.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::sync::atomic::{AtomicI32 as AtomicInt, Ordering};
 
 use crate::header::errno::EBUSY;

src/header/pthread/tls.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use super::*;
 
 // TODO: Hashmap?

src/header/pty/linux.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::{fcntl, sys_ioctl, unistd},
     io::{Cursor, Write},

src/header/pty/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/openpty.3.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{mem, ptr, slice};
 
 use crate::{

src/header/pwd/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/pwd.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::{boxed::Box, vec::Vec};
 use core::{
     ops::{Deref, DerefMut},

src/header/regex/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/regex.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::string::strlen,
     platform::types::{c_char, c_int, c_void, size_t},

src/header/semaphore/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/semaphore.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::time::{CLOCK_MONOTONIC, CLOCK_REALTIME, timespec},
     platform::types::{c_char, c_int, c_long, c_uint, clockid_t},

src/header/shadow/mod.rs

@@ -1,5 +1,3 @@
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{
     cell::SyncUnsafeCell,
     convert::TryInto,

src/header/signal/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/signal.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{arch::global_asm, mem, ptr};
 
 use cbitset::BitSet;

src/header/stdio/getdelim.rs

@@ -1,8 +1,5 @@
 // https://pubs.opengroup.org/onlinepubs/9699919799/functions/getline.html
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::{string::String, vec::Vec};
 use core::{fmt::Write, intrinsics::unlikely, ops::Deref, ptr};
 

src/header/stdio/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/stdio.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::{
     borrow::{Borrow, BorrowMut},
     boxed::Box,

src/header/stdio/printf.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 // TODO: reuse more code with the wide printf impl
 use crate::{
     c_str::{self, CStr, NulStr},

src/header/stdlib/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/stdlib.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{convert::TryFrom, intrinsics, iter, mem, ptr, slice};
 use rand::{
     Rng, SeedableRng,

src/header/stdlib/random.rs

@@ -1,9 +1,6 @@
 //! Helper functions for random() and friends, see https://pubs.opengroup.org/onlinepubs/7908799/xsh/initstate.html
 // Ported from musl's implementation (src/prng/random.c)
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     platform::types::c_uint,
     sync::{Mutex, MutexGuard},

src/header/stdlib/sort.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::platform::types::{c_char, c_int, c_void, size_t};
 
 pub unsafe fn introsort(

src/header/string/mod.rs

@@ -304,7 +304,7 @@ pub unsafe extern "C" fn strcoll_l(s1: *const c_char, s2: *const c_char, _loc: l
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcoll.html>.
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn strcoll(s1: *const c_char, s2: *const c_char) -> c_int {
-    strcoll_l(s1, s2, THREAD_LOCALE as locale_t)
+    unsafe { strcoll_l(s1, s2, THREAD_LOCALE as locale_t) }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strcpy.html>.
@@ -379,7 +379,7 @@ pub unsafe extern "C" fn strerror_l(errnum: c_int, _loc: locale_t) -> *mut c_cha
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strerror.html>.
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn strerror(errnum: c_int) -> *mut c_char {
-    strerror_l(errnum, THREAD_LOCALE as locale_t)
+    unsafe { strerror_l(errnum, THREAD_LOCALE as locale_t) }
 }
 
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strerror_r.html>.
@@ -669,5 +669,5 @@ pub unsafe extern "C" fn strxfrm_l(
 /// See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strxfrm.html>.
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn strxfrm(s1: *mut c_char, s2: *const c_char, n: size_t) -> size_t {
-    strxfrm_l(s1, s2, n, THREAD_LOCALE as locale_t)
+    unsafe { strxfrm_l(s1, s2, n, THREAD_LOCALE as locale_t) }
 }

src/header/strings/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/strings.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{
     arch,
     iter::{once, zip},

src/header/sys_epoll/mod.rs

@@ -1,8 +1,5 @@
 //! sys/epoll.h implementation for Redox, following http://man7.org/linux/man-pages/man7/epoll.7.html
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::ptr;
 
 use crate::{

src/header/sys_ioctl/linux.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     error::ResultExt,
     platform::{Sys, types::*},

src/header/sys_ioctl/redox/drm.rs

@@ -41,7 +41,7 @@ fn plane_id(i: u32) -> u32 {
 }
 
 unsafe fn copy_array<T: Copy>(src: &[T], dst_ptr: *mut T, dst_len: usize) -> usize {
-    let dst = slice::from_raw_parts_mut(dst_ptr, dst_len);
+    let dst = unsafe { slice::from_raw_parts_mut(dst_ptr, dst_len) };
     dst.copy_from_slice(&src[..src.len().min(dst_len)]);
     src.len()
 }
@@ -61,22 +61,22 @@ impl Dev {
         mut buf: IoctlBuffer,
         func: u64,
     ) -> Result<c_int> {
-        let mut data = buf.read::<T>()?;
-        let mut wire = data.write();
+        let mut data = unsafe { buf.read::<T>() }?;
+        let mut wire = unsafe { data.write() };
         let res = redox_rt::sys::sys_call(
             self.fd as usize,
             &mut wire,
             syscall::CallFlags::empty(),
             &[func],
         )?;
-        data.read_from(&wire);
-        buf.write(data)?;
+        unsafe { data.read_from(&wire) };
+        (unsafe { buf.write(data) })?;
         Ok(res as c_int)
     }
 
     unsafe fn write_ioctl<T: IoctlData>(&self, mut buf: IoctlBuffer, func: u64) -> Result<c_int> {
-        let mut data = buf.read::<T>()?;
-        let mut wire = data.write();
+        let mut data = unsafe { buf.read::<T>() }?;
+        let mut wire = unsafe { data.write() };
         let res = redox_rt::sys::sys_call(
             self.fd as usize,
             &mut wire,
@@ -90,26 +90,30 @@ impl Dev {
 pub(super) unsafe fn ioctl(fd: c_int, func: u8, buf: IoctlBuffer) -> Result<c_int> {
     let dev = Dev::new(fd)?;
     match func {
-        0x00 => dev.read_write_ioctl::<drm_version>(buf, VERSION),
-        0x0C => dev.read_write_ioctl::<drm_get_cap>(buf, GET_CAP),
-        0x0D => dev.write_ioctl::<drm_set_client_cap>(buf, SET_CLIENT_CAP),
-        0xA0 => dev.read_write_ioctl::<drm_mode_card_res>(buf, MODE_CARD_RES),
-        0xA1 => dev.read_write_ioctl::<drm_mode_crtc>(buf, MODE_GET_CRTC),
-        0xA6 => dev.read_write_ioctl::<drm_mode_get_encoder>(buf, MODE_GET_ENCODER),
-        0xA7 => dev.read_write_ioctl::<drm_mode_get_connector>(buf, MODE_GET_CONNECTOR),
-        0xAA => dev.read_write_ioctl::<drm_mode_get_property>(buf, MODE_GET_PROPERTY),
-        0xAB => dev.read_write_ioctl::<drm_mode_connector_set_property>(buf, MODE_SET_PROPERTY),
-        0xAC => dev.read_write_ioctl::<drm_mode_get_blob>(buf, MODE_GET_PROP_BLOB),
-        0xAD => dev.read_write_ioctl::<drm_mode_fb_cmd>(buf, MODE_GET_FB),
-        0xAE => dev.read_write_ioctl::<drm_mode_fb_cmd>(buf, MODE_ADD_FB),
-        0xAF => dev.read_write_ioctl::<standin_for_uint>(buf, MODE_RM_FB),
-        0xB2 => dev.read_write_ioctl::<drm_mode_create_dumb>(buf, MODE_CREATE_DUMB),
-        0xB3 => dev.read_write_ioctl::<drm_mode_map_dumb>(buf, MODE_MAP_DUMB),
-        0xB4 => dev.read_write_ioctl::<drm_mode_destroy_dumb>(buf, MODE_DESTROY_DUMB),
-        0xB5 => dev.read_write_ioctl::<drm_mode_get_plane_res>(buf, MODE_GET_PLANE_RES),
-        0xB6 => dev.read_write_ioctl::<drm_mode_get_plane>(buf, MODE_GET_PLANE),
-        0xB9 => dev.read_write_ioctl::<drm_mode_obj_get_properties>(buf, MODE_OBJ_GET_PROPERTIES),
-        0xCE => dev.read_write_ioctl::<drm_mode_fb_cmd2>(buf, MODE_GET_FB2),
+        0x00 => unsafe { dev.read_write_ioctl::<drm_version>(buf, VERSION) },
+        0x0C => unsafe { dev.read_write_ioctl::<drm_get_cap>(buf, GET_CAP) },
+        0x0D => unsafe { dev.write_ioctl::<drm_set_client_cap>(buf, SET_CLIENT_CAP) },
+        0xA0 => unsafe { dev.read_write_ioctl::<drm_mode_card_res>(buf, MODE_CARD_RES) },
+        0xA1 => unsafe { dev.read_write_ioctl::<drm_mode_crtc>(buf, MODE_GET_CRTC) },
+        0xA6 => unsafe { dev.read_write_ioctl::<drm_mode_get_encoder>(buf, MODE_GET_ENCODER) },
+        0xA7 => unsafe { dev.read_write_ioctl::<drm_mode_get_connector>(buf, MODE_GET_CONNECTOR) },
+        0xAA => unsafe { dev.read_write_ioctl::<drm_mode_get_property>(buf, MODE_GET_PROPERTY) },
+        0xAB => unsafe {
+            dev.read_write_ioctl::<drm_mode_connector_set_property>(buf, MODE_SET_PROPERTY)
+        },
+        0xAC => unsafe { dev.read_write_ioctl::<drm_mode_get_blob>(buf, MODE_GET_PROP_BLOB) },
+        0xAD => unsafe { dev.read_write_ioctl::<drm_mode_fb_cmd>(buf, MODE_GET_FB) },
+        0xAE => unsafe { dev.read_write_ioctl::<drm_mode_fb_cmd>(buf, MODE_ADD_FB) },
+        0xAF => unsafe { dev.read_write_ioctl::<standin_for_uint>(buf, MODE_RM_FB) },
+        0xB2 => unsafe { dev.read_write_ioctl::<drm_mode_create_dumb>(buf, MODE_CREATE_DUMB) },
+        0xB3 => unsafe { dev.read_write_ioctl::<drm_mode_map_dumb>(buf, MODE_MAP_DUMB) },
+        0xB4 => unsafe { dev.read_write_ioctl::<drm_mode_destroy_dumb>(buf, MODE_DESTROY_DUMB) },
+        0xB5 => unsafe { dev.read_write_ioctl::<drm_mode_get_plane_res>(buf, MODE_GET_PLANE_RES) },
+        0xB6 => unsafe { dev.read_write_ioctl::<drm_mode_get_plane>(buf, MODE_GET_PLANE) },
+        0xB9 => unsafe {
+            dev.read_write_ioctl::<drm_mode_obj_get_properties>(buf, MODE_OBJ_GET_PROPERTIES)
+        },
+        0xCE => unsafe { dev.read_write_ioctl::<drm_mode_fb_cmd2>(buf, MODE_GET_FB2) },
         _ => {
             eprintln!("unimplemented DRM ioctl({}, 0x{:02x}, {:?})", fd, func, buf);
             Err(Errno(EINVAL))

src/header/sys_ioctl/redox/mod.rs

@@ -111,7 +111,7 @@ unsafe fn ioctl_inner(fd: c_int, request: c_ulong, out: *mut c_void) -> Result<c
     match request {
         FIONBIO => {
             let mut flags = Sys::fcntl(fd, fcntl::F_GETFL, 0)?;
-            flags = if *(out as *mut c_int) == 0 {
+            flags = if unsafe { *(out as *mut c_int) } == 0 {
                 flags & !fcntl::O_NONBLOCK
             } else {
                 flags | fcntl::O_NONBLOCK
@@ -119,12 +119,12 @@ unsafe fn ioctl_inner(fd: c_int, request: c_ulong, out: *mut c_void) -> Result<c
             Sys::fcntl(fd, fcntl::F_SETFL, flags as c_ulonglong)?;
         }
         TCGETS => {
-            let termios = &mut *(out as *mut termios::termios);
+            let termios = unsafe { &mut *(out as *mut termios::termios) };
             dup_read(fd, "termios", termios)?;
         }
         // TODO: give these different behaviors
         TCSETS | TCSETSW | TCSETSF => {
-            let termios = &*(out as *const termios::termios);
+            let termios = unsafe { &*(out as *const termios::termios) };
             dup_write(fd, "termios", termios)?;
         }
         TCFLSH => {
@@ -135,19 +135,19 @@ unsafe fn ioctl_inner(fd: c_int, request: c_ulong, out: *mut c_void) -> Result<c
             eprintln!("TODO: ioctl TIOCSCTTY");
         }
         TIOCGPGRP => {
-            let pgrp = &mut *(out as *mut pid_t);
+            let pgrp = unsafe { &mut *(out as *mut pid_t) };
             dup_read(fd, "pgrp", pgrp)?;
         }
         TIOCSPGRP => {
-            let pgrp = &*(out as *const pid_t);
+            let pgrp = unsafe { &*(out as *const pid_t) };
             dup_write(fd, "pgrp", pgrp)?;
         }
         TIOCGWINSZ => {
-            let winsize = &mut *(out as *mut winsize);
+            let winsize = unsafe { &mut *(out as *mut winsize) };
             dup_read(fd, "winsize", winsize)?;
         }
         TIOCSWINSZ => {
-            let winsize = &*(out as *const winsize);
+            let winsize = unsafe { &*(out as *const winsize) };
             dup_write(fd, "winsize", winsize)?;
         }
         TIOCGPTLCK => {
@@ -179,7 +179,7 @@ unsafe fn ioctl_inner(fd: c_int, request: c_ulong, out: *mut c_void) -> Result<c
                         0b11 => IoctlBuffer::ReadWrite(out, size),
                         _ => IoctlBuffer::None,
                     };
-                    return drm::ioctl(fd, func, buf);
+                    return unsafe { drm::ioctl(fd, func, buf) };
                 }
                 _ => {
                     return Err(Errno(EINVAL));
@@ -192,5 +192,5 @@ unsafe fn ioctl_inner(fd: c_int, request: c_ulong, out: *mut c_void) -> Result<c
 
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn ioctl(fd: c_int, request: c_ulong, out: *mut c_void) -> c_int {
-    ioctl_inner(fd, request, out).or_minus_one_errno()
+    unsafe { ioctl_inner(fd, request, out) }.or_minus_one_errno()
 }

src/header/sys_mman/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_mman.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     c_str::{CStr, CString},
     error::{Errno, ResultExt},

src/header/sys_ptrace/mod.rs

@@ -1,8 +1,5 @@
 //! ptrace compatibility layer for Redox OS
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     error::ResultExt,
     platform::{PalPtrace, Sys, types::*},

src/header/sys_random/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! Non-POSIX, see <https://www.man7.org/linux/man-pages/man2/getrandom.2.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::slice;
 
 use crate::{

src/header/sys_resource/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_resource.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     error::ResultExt,
     header::sys_time::timeval,

src/header/sys_select/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_select.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::mem;
 
 use cbitset::BitSet;

src/header/sys_socket/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_socket.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{mem, ptr};
 
 use crate::{

src/header/sys_statvfs/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_statvfs.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     c_str::CStr,
     error::ResultExt,

src/header/sys_syslog/mod.rs

@@ -4,9 +4,6 @@
 
 // Exported as both syslog.h and sys/syslog.h.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 #[cfg(target_os = "redox")]
 #[path = "redox.rs"]
 pub mod sys;

src/header/sys_time/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_time.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     c_str::CStr,
     error::ResultExt,

src/header/sys_timeb/mod.rs

@@ -7,9 +7,6 @@
 //! Specifications Issue 6, and the entire `sys/timeb.h` header was removed in
 //! Issue 7.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::ptr::NonNull;
 
 use crate::{

src/header/sys_uio/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_uio.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::vec::Vec;
 use core::slice;
 

src/header/sys_utsname/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_utsname.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     error::ResultExt,
     out::Out,

src/header/sys_wait/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/sys_wait.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     error::ResultExt,
     out::Out,

src/header/termios/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/termios.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::{
         errno,

src/header/time/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/time.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     c_str::{CStr, CString},
     error::{Errno, ResultExt},

src/header/time/strftime.rs

@@ -2,9 +2,6 @@
 //
 // See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/strftime.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::string::String;
 
 use super::{get_offset, tm};

src/header/unistd/brk.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::ptr;
 
 use crate::{

src/header/unistd/getopt.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/functions/getopt.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::ptr;
 
 use crate::{

src/header/unistd/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/unistd.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{
     convert::TryFrom,
     ffi::VaListImpl,

src/header/utime/mod.rs

@@ -5,9 +5,6 @@
 //! The `utime.h` header was marked obsolescent in the Open Group Base
 //! Specifications Issue 7, and removed in Issue 8.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     c_str::CStr,
     error::ResultExt,

src/header/utmp/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! Non-POSIX, see <https://www.man7.org/linux/man-pages/man3/openpty.3.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::{sys_ioctl, unistd},
     platform::types::{c_int, c_void},

src/header/wchar/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/wchar.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{char, ffi::VaList as va_list, mem, ptr, slice, usize};
 
 use crate::{

src/header/wchar/utf8.rs

@@ -1,9 +1,6 @@
 //UTF implementation parts for wchar.h.
 //Partially ported from the Sortix libc
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{char, slice, str, usize};
 
 use crate::{

src/header/wchar/wprintf.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 // TODO: reuse more code with the thin printf impl
 use crate::{
     c_str::{self, WStr},

src/header/wchar/wscanf.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use super::lookaheadreader::LookAheadReader;
 use crate::platform::types::*;
 use alloc::{string::String, vec::Vec};

src/header/wctype/mod.rs

@@ -2,9 +2,6 @@
 //!
 //! See <https://pubs.opengroup.org/onlinepubs/9799919799/basedefs/wctype.h.html>.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 // TODO: *_l functions
 
 use self::casecmp::casemap;

src/io/buffered.rs

@@ -10,9 +10,6 @@
 
 //! Buffering wrappers for I/O traits
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{cmp, fmt};
 
 use crate::io::{

src/io/cursor.rs

@@ -8,9 +8,6 @@
 // option. This file may not be copied, modified, or distributed
 // except according to those terms.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::cmp;
 
 use crate::io::{self, Error, ErrorKind, Initializer, SeekFrom, prelude::*};

src/io/impls.rs

@@ -8,9 +8,6 @@
 // option. This file may not be copied, modified, or distributed
 // except according to those terms.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::string::String;
 use core::{cmp, fmt, mem};
 

src/io/mod.rs

@@ -267,9 +267,6 @@
 //! [`Result`]: ../result/enum.Result.html
 //! [`.unwrap()`]: ../result/enum.Result.html#method.unwrap
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 pub mod buffered;
 pub mod cursor;
 pub mod error;

src/ld_so/mod.rs

@@ -3,7 +3,6 @@
 // FIXME(andypython): remove this when #![allow(warnings, unused_variables)] is
 // dropped from src/lib.rs.
 #![warn(warnings, unused_variables)]
-#![deny(unsafe_op_in_unsafe_fn)]
 
 use core::{mem, ptr};
 use object::{

src/ld_so/start.rs

@@ -1,7 +1,5 @@
 // Start code adapted from https://gitlab.redox-os.org/redox-os/relibc/blob/master/src/start.rs
 
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::{
     borrow::ToOwned,
     boxed::Box,

src/ld_so/tcb.rs

@@ -1,5 +1,3 @@
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use alloc::vec::Vec;
 use core::{
     cell::UnsafeCell,

src/lib.rs

@@ -35,6 +35,7 @@
 #![allow(clippy::derive_hash_xor_eq)]
 #![allow(clippy::eval_order_dependence)]
 #![allow(clippy::mut_from_ref)]
+#![deny(unsafe_op_in_unsafe_fn)]
 // TODO: fix these
 #![warn(unaligned_references)]
 

src/macros.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 /// Print to stdout
 #[macro_export]
 macro_rules! print {

src/out.rs

@@ -9,9 +9,6 @@
 //! requirement that `&mut` references are never aliased, which can typically not be assumed when
 //! getting pointers from C.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{cell::UnsafeCell, fmt, marker::PhantomData, mem::MaybeUninit, ptr::NonNull};
 
 /// Wrapper for write-only "out pointers" that are safe to write to

src/platform/allocator/mod.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{
     alloc::{GlobalAlloc, Layout},
     cell::SyncUnsafeCell,

src/platform/allocator/sys.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     header::{
         sys_mman::{self, MAP_FAILED, MREMAP_MAYMOVE},

src/platform/linux/mod.rs

@@ -1,6 +1,3 @@
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use core::{arch::asm, num::NonZeroU64, ptr};
 
 use super::{ERRNO, Pal, types::*};

src/platform/mod.rs

@@ -1,8 +1,5 @@
 //! Platform abstractions and environment.
 
-// TODO: set this for entire crate when possible
-#![deny(unsafe_op_in_unsafe_fn)]
-
 use crate::{
     error::{Errno, ResultExt},
     io::{self, Read, Write},

src/platform/redox/epoll.rs

@@ -144,7 +144,7 @@ impl PalEpoll for Sys {
             callback()
         } else {
             // Allowset is inverse of sigset mask
-            let allowset = !*sigset;
+            let allowset = !unsafe { *sigset };
             redox_rt::signal::callback_or_signal_async(allowset, callback)
         }?;
 

src/platform/redox/event.rs

@@ -40,11 +40,13 @@ pub unsafe extern "C" fn redox_event_queue_get_events_v1(
             size_of::<syscall::Event>(),
             "EOF not yet defined for event queue reads"
         );
-        buf.write(event::raw::RawEventV1 {
-            fd: event.id,
-            flags: event::raw::EventFlags::from(event.flags).bits(),
-            user_data: event.data,
-        });
+        unsafe {
+            buf.write(event::raw::RawEventV1 {
+                fd: event.id,
+                flags: event::raw::EventFlags::from(event.flags).bits(),
+                user_data: event.data,
+            })
+        };
 
         Ok(1)
     })())

src/platform/redox/extra.rs

@@ -10,10 +10,9 @@ pub use redox_rt::proc::FdGuard;
 
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fpath(fd: c_int, buf: *mut c_void, count: size_t) -> ssize_t {
-    syscall::fpath(
-        fd as usize,
-        slice::from_raw_parts_mut(buf as *mut u8, count),
-    )
+    syscall::fpath(fd as usize, unsafe {
+        slice::from_raw_parts_mut(buf as *mut u8, count)
+    })
     .map_err(Errno::from)
     .map(|l| l as ssize_t)
     .or_minus_one_errno()

src/platform/redox/libredox.rs

@@ -40,7 +40,7 @@ pub unsafe fn fstat(fd: usize, buf: *mut crate::header::sys_stat::stat) -> sysca
     let mut redox_buf: syscall::Stat = Default::default();
     syscall::fstat(fd, &mut redox_buf)?;
 
-    if let Some(buf) = buf.as_mut() {
+    if let Some(buf) = unsafe { buf.as_mut() } {
         buf.st_dev = redox_buf.st_dev as dev_t;
         buf.st_ino = redox_buf.st_ino as ino_t;
         buf.st_nlink = redox_buf.st_nlink as nlink_t;
@@ -75,18 +75,20 @@ pub unsafe fn fstatvfs(
     syscall::fstatvfs(fd, &mut kbuf)?;
 
     if !buf.is_null() {
-        (*buf).f_bsize = kbuf.f_bsize as c_ulong;
-        (*buf).f_frsize = kbuf.f_bsize as c_ulong;
-        (*buf).f_blocks = kbuf.f_blocks as c_ulong;
-        (*buf).f_bfree = kbuf.f_bfree as c_ulong;
-        (*buf).f_bavail = kbuf.f_bavail as c_ulong;
-        //TODO
-        (*buf).f_files = 0;
-        (*buf).f_ffree = 0;
-        (*buf).f_favail = 0;
-        (*buf).f_fsid = 0;
-        (*buf).f_flag = 0;
-        (*buf).f_namemax = 0;
+        unsafe {
+            (*buf).f_bsize = kbuf.f_bsize as c_ulong;
+            (*buf).f_frsize = kbuf.f_bsize as c_ulong;
+            (*buf).f_blocks = kbuf.f_blocks as c_ulong;
+            (*buf).f_bfree = kbuf.f_bfree as c_ulong;
+            (*buf).f_bavail = kbuf.f_bavail as c_ulong;
+            //TODO
+            (*buf).f_files = 0;
+            (*buf).f_ffree = 0;
+            (*buf).f_favail = 0;
+            (*buf).f_fsid = 0;
+            (*buf).f_flag = 0;
+            (*buf).f_namemax = 0;
+        }
     }
     Ok(())
 }
@@ -104,10 +106,7 @@ pub unsafe fn futimens(fd: usize, times: *const timespec) -> syscall::Result<()>
             },
         ]
     } else {
-        times
-            .cast::<[timespec; 2]>()
-            .read()
-            .map(|ts| syscall::TimeSpec::from(&ts))
+        unsafe { times.cast::<[timespec; 2]>().read() }.map(|ts| syscall::TimeSpec::from(&ts))
     };
     syscall::futimens(fd as usize, &times)?;
     Ok(())
@@ -130,7 +129,7 @@ pub unsafe extern "C" fn redox_open_v1(
     mode: u16,
 ) -> RawResult {
     Error::mux(open(
-        str::from_utf8_unchecked(slice::from_raw_parts(path_base, path_len)),
+        unsafe { str::from_utf8_unchecked(slice::from_raw_parts(path_base, path_len)) },
         flags as c_int,
         mode as mode_t,
     ))
@@ -144,14 +143,16 @@ pub unsafe extern "C" fn redox_openat_v1(
 ) -> RawResult {
     Error::mux(syscall::openat(
         fd,
-        str::from_utf8_unchecked(slice::from_raw_parts(path_base, path_len)),
+        unsafe { str::from_utf8_unchecked(slice::from_raw_parts(path_base, path_len)) },
         flags as usize,
         0, //TODO: openat fcntl_flags
     ))
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_dup_v1(fd: usize, buf: *const u8, len: usize) -> RawResult {
-    Error::mux(syscall::dup(fd, core::slice::from_raw_parts(buf, len)))
+    Error::mux(syscall::dup(fd, unsafe {
+        core::slice::from_raw_parts(buf, len)
+    }))
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_dup2_v1(
@@ -160,15 +161,15 @@ pub unsafe extern "C" fn redox_dup2_v1(
     buf: *const u8,
     len: usize,
 ) -> RawResult {
-    Error::mux(syscall::dup2(
-        old_fd,
-        new_fd,
-        core::slice::from_raw_parts(buf, len),
-    ))
+    Error::mux(syscall::dup2(old_fd, new_fd, unsafe {
+        core::slice::from_raw_parts(buf, len)
+    }))
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_read_v1(fd: usize, dst_base: *mut u8, dst_len: usize) -> RawResult {
-    Error::mux(posix_read(fd, slice::from_raw_parts_mut(dst_base, dst_len)))
+    Error::mux(posix_read(fd, unsafe {
+        slice::from_raw_parts_mut(dst_base, dst_len)
+    }))
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_write_v1(
@@ -176,7 +177,9 @@ pub unsafe extern "C" fn redox_write_v1(
     src_base: *const u8,
     src_len: usize,
 ) -> RawResult {
-    Error::mux(posix_write(fd, slice::from_raw_parts(src_base, src_len)))
+    Error::mux(posix_write(fd, unsafe {
+        slice::from_raw_parts(src_base, src_len)
+    }))
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fsync_v1(fd: usize) -> RawResult {
@@ -197,28 +200,27 @@ pub unsafe extern "C" fn redox_fchown_v1(fd: usize, new_uid: u32, new_gid: u32)
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fpath_v1(fd: usize, dst_base: *mut u8, dst_len: usize) -> RawResult {
-    Error::mux(syscall::fpath(
-        fd,
-        core::slice::from_raw_parts_mut(dst_base, dst_len),
-    ))
+    Error::mux(syscall::fpath(fd, unsafe {
+        core::slice::from_raw_parts_mut(dst_base, dst_len)
+    }))
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fstat_v1(
     fd: usize,
     stat: *mut crate::header::sys_stat::stat,
 ) -> RawResult {
-    Error::mux(fstat(fd, stat).map(|()| 0))
+    Error::mux(unsafe { fstat(fd, stat) }.map(|()| 0))
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_fstatvfs_v1(
     fd: usize,
     stat: *mut crate::header::sys_statvfs::statvfs,
 ) -> RawResult {
-    Error::mux(fstatvfs(fd, stat).map(|()| 0))
+    Error::mux(unsafe { fstatvfs(fd, stat) }.map(|()| 0))
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_futimens_v1(fd: usize, times: *const timespec) -> RawResult {
-    Error::mux(futimens(fd, times).map(|()| 0))
+    Error::mux(unsafe { futimens(fd, times) }.map(|()| 0))
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_close_v1(fd: usize) -> RawResult {
@@ -271,7 +273,7 @@ pub unsafe extern "C" fn redox_waitpid_v1(pid: usize, status: *mut i32, options:
         &mut sts,
         WaitFlags::from_bits_truncate(options as usize),
     ));
-    status.write(sts as i32);
+    unsafe { status.write(sts as i32) };
     res
 }
 
@@ -289,9 +291,11 @@ pub unsafe extern "C" fn redox_sigaction_v1(
     old: *mut sigaction,
 ) -> RawResult {
     Error::mux(
-        Sys::sigaction(signal as c_int, new.as_ref(), old.as_mut())
-            .map(|()| 0)
-            .map_err(Into::into),
+        Sys::sigaction(signal as c_int, unsafe { new.as_ref() }, unsafe {
+            old.as_mut()
+        })
+        .map(|()| 0)
+        .map_err(Into::into),
     )
 }
 
@@ -302,9 +306,11 @@ pub unsafe extern "C" fn redox_sigprocmask_v1(
     old: *mut u64,
 ) -> RawResult {
     Error::mux(
-        Sys::sigprocmask(how as c_int, new.as_ref(), old.as_mut())
-            .map(|()| 0)
-            .map_err(Into::into),
+        Sys::sigprocmask(how as c_int, unsafe { new.as_ref() }, unsafe {
+            old.as_mut()
+        })
+        .map(|()| 0)
+        .map_err(Into::into),
     )
 }
 #[unsafe(no_mangle)]
@@ -316,26 +322,28 @@ pub unsafe extern "C" fn redox_mmap_v1(
     fd: usize,
     offset: u64,
 ) -> RawResult {
-    Error::mux(syscall::fmap(
-        fd,
-        &syscall::Map {
-            address: addr as usize,
-            offset: offset as usize,
-            size: unaligned_len,
-            flags: syscall::MapFlags::from_bits_truncate(
-                ((prot << 16) | (flags & 0xffff)) as usize,
-            ),
-        },
-    ))
+    Error::mux(unsafe {
+        syscall::fmap(
+            fd,
+            &syscall::Map {
+                address: addr as usize,
+                offset: offset as usize,
+                size: unaligned_len,
+                flags: syscall::MapFlags::from_bits_truncate(
+                    ((prot << 16) | (flags & 0xffff)) as usize,
+                ),
+            },
+        )
+    })
 }
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_munmap_v1(addr: *mut (), unaligned_len: usize) -> RawResult {
-    Error::mux(syscall::funmap(addr as usize, unaligned_len))
+    Error::mux(unsafe { syscall::funmap(addr as usize, unaligned_len) })
 }
 
 #[unsafe(no_mangle)]
 pub unsafe extern "C" fn redox_clock_gettime_v1(clock: usize, ts: *mut timespec) -> RawResult {
-    Error::mux(clock_gettime(clock, Out::nonnull(ts)).map(|()| 0))
+    Error::mux(clock_gettime(clock, unsafe { Out::nonnull(ts) }).map(|()| 0))
 }
 
 #[unsafe(no_mangle)]
@@ -344,7 +352,7 @@ pub unsafe extern "C" fn redox_strerror_v1(
     buflen: *mut usize,
     error: u32,
 ) -> RawResult {
-    let dst = core::slice::from_raw_parts_mut(buf, buflen.read());
+    let dst = unsafe { core::slice::from_raw_parts_mut(buf, buflen.read()) };
 
     Error::mux((|| {
         // TODO: Merge syscall::error::STR_ERROR into crate::header::error::?
@@ -356,7 +364,7 @@ pub unsafe extern "C" fn redox_strerror_v1(
         // This API ensures that the returned buffer is proper UTF-8. Thus, it returns both the
         // copied length and the actual length.
 
-        buflen.write(src.len());
+        unsafe { buflen.write(src.len()) };
 
         let raw_len = core::cmp::min(dst.len(), src.len());
         let len = match core::str::from_utf8(&src.as_bytes()[..raw_len]) {
@@ -380,7 +388,7 @@ pub unsafe extern "C" fn redox_mkns_v1(
             return Err(Error::new(EINVAL));
         }
         // Kernel does the UTF-8 validation.
-        syscall::mkns(core::slice::from_raw_parts(names.cast(), num_names))
+        syscall::mkns(unsafe { core::slice::from_raw_parts(names.cast(), num_names) })
     })())
 }
 
@@ -406,9 +414,9 @@ pub unsafe extern "C" fn redox_sys_call_v0(
 ) -> RawResult {
     Error::mux(redox_rt::sys::sys_call(
         fd,
-        slice::from_raw_parts_mut(payload, payload_len),
+        unsafe { slice::from_raw_parts_mut(payload, payload_len) },
         syscall::CallFlags::from_bits_retain(flags),
-        slice::from_raw_parts(metadata, metadata_len),
+        unsafe { slice::from_raw_parts(metadata, metadata_len) },
     ))
 }
 
@@ -421,7 +429,7 @@ pub unsafe extern "C" fn redox_get_socket_token_v0(
     let metadata = [SocketCall::GetToken as u64];
     Error::mux(redox_rt::sys::sys_call(
         fd,
-        slice::from_raw_parts_mut(payload, payload_len),
+        unsafe { slice::from_raw_parts_mut(payload, payload_len) },
         syscall::CallFlags::empty(),
         &metadata,
     ))

src/platform/redox/mod.rs

@@ -1,5 +1,3 @@
-#![allow(unsafe_op_in_unsafe_fn)]
-
 use core::{
     convert::TryFrom,
     mem::{self, MaybeUninit, size_of},
@@ -140,29 +138,33 @@ impl Pal for Sys {
 
     unsafe fn brk(addr: *mut c_void) -> Result<*mut c_void> {
         // On first invocation, allocate a buffer for brk
-        if BRK_CUR.is_null() {
+        if unsafe { BRK_CUR }.is_null() {
             // 4 megabytes of RAM ought to be enough for anybody
             const BRK_MAX_SIZE: usize = 4 * 1024 * 1024;
 
-            let allocated = Self::mmap(
-                ptr::null_mut(),
-                BRK_MAX_SIZE,
-                PROT_READ | PROT_WRITE,
-                MAP_ANONYMOUS,
-                0,
-                0,
-            )?;
+            let allocated = unsafe {
+                Self::mmap(
+                    ptr::null_mut(),
+                    BRK_MAX_SIZE,
+                    PROT_READ | PROT_WRITE,
+                    MAP_ANONYMOUS,
+                    0,
+                    0,
+                )
+            }?;
 
-            BRK_CUR = allocated;
-            BRK_END = (allocated as *mut u8).add(BRK_MAX_SIZE) as *mut c_void;
+            unsafe {
+                BRK_CUR = allocated;
+                BRK_END = (allocated as *mut u8).add(BRK_MAX_SIZE) as *mut c_void
+            };
         }
 
         if addr.is_null() {
             // Lookup what previous brk() invocations have set the address to
-            Ok(BRK_CUR)
-        } else if BRK_CUR <= addr && addr < BRK_END {
+            Ok(unsafe { BRK_CUR })
+        } else if unsafe { BRK_CUR } <= addr && addr < unsafe { BRK_END } {
             // It's inside buffer, return
-            BRK_CUR = addr;
+            unsafe { BRK_CUR = addr };
             Ok(addr)
         } else {
             // It was outside of valid range
@@ -258,7 +260,7 @@ impl Pal for Sys {
         self::exec::execve(
             Executable::InFd {
                 file: File::new(fildes),
-                arg0: CStr::from_ptr(argv.read()).to_bytes(),
+                arg0: unsafe { CStr::from_ptr(argv.read()) }.to_bytes(),
             },
             self::exec::ArgEnv::C { argv, envp },
             None,
@@ -395,22 +397,22 @@ impl Pal for Sys {
             tv_sec: d.tv_sec,
             tv_nsec: d.tv_nsec as i32,
         });
-        redox_rt::sys::sys_futex_wait(addr, val, deadline.as_ref())?;
+        (unsafe { redox_rt::sys::sys_futex_wait(addr, val, deadline.as_ref()) })?;
         Ok(())
     }
     #[inline]
     unsafe fn futex_wake(addr: *mut u32, num: u32) -> Result<u32> {
-        Ok(redox_rt::sys::sys_futex_wake(addr, num)?)
+        Ok(unsafe { redox_rt::sys::sys_futex_wake(addr, num) }?)
     }
 
     unsafe fn futimens(fd: c_int, times: *const timespec) -> Result<()> {
-        libredox::futimens(fd as usize, times)?;
+        (unsafe { libredox::futimens(fd as usize, times) })?;
         Ok(())
     }
 
     unsafe fn utimens(path: CStr, times: *const timespec) -> Result<()> {
         let file = File::open(path, fcntl::O_PATH | fcntl::O_CLOEXEC)?;
-        Self::futimens(*file, times)
+        unsafe { Self::futimens(*file, times) }
     }
 
     fn getcwd(buf: Out<[u8]>) -> Result<()> {
@@ -791,9 +793,9 @@ impl Pal for Sys {
         };
 
         Ok(if flags & MAP_ANONYMOUS == MAP_ANONYMOUS {
-            syscall::fmap(!0, &map)?
+            (unsafe { syscall::fmap(!0, &map) })?
         } else {
-            syscall::fmap(fildes as usize, &map)?
+            (unsafe { syscall::fmap(fildes as usize, &map) })?
         } as *mut c_void)
     }
 
@@ -811,12 +813,14 @@ impl Pal for Sys {
         let Some(len) = round_up_to_page_size(len) else {
             return Err(Errno(ENOMEM));
         };
-        syscall::mprotect(
-            addr as usize,
-            len,
-            syscall::MapFlags::from_bits((prot as usize) << 16)
-                .expect("mprotect: invalid bit pattern"),
-        )?;
+        (unsafe {
+            syscall::mprotect(
+                addr as usize,
+                len,
+                syscall::MapFlags::from_bits((prot as usize) << 16)
+                    .expect("mprotect: invalid bit pattern"),
+            )
+        })?;
         Ok(())
     }
 
@@ -853,7 +857,7 @@ impl Pal for Sys {
         let Some(len) = round_up_to_page_size(len) else {
             return Err(Errno(ENOMEM));
         };
-        syscall::funmap(addr as usize, len)?;
+        (unsafe { syscall::funmap(addr as usize, len) })?;
         Ok(())
     }
 
@@ -969,7 +973,7 @@ impl Pal for Sys {
         os_specific: &mut OsSpecific,
     ) -> Result<crate::pthread::OsTid> {
         let _guard = CLONE_LOCK.read();
-        let res = clone::rlct_clone_impl(stack, os_specific);
+        let res = unsafe { clone::rlct_clone_impl(stack, os_specific) };
 
         res.map(|thread_fd| crate::pthread::OsTid { thread_fd })
             .map_err(|error| Errno(error.errno))
@@ -1504,6 +1508,6 @@ impl Pal for Sys {
     }
 
     unsafe fn exit_thread(stack_base: *mut (), stack_size: usize) -> ! {
-        redox_rt::thread::exit_this_thread(stack_base, stack_size)
+        unsafe { redox_rt::thread::exit_this_thread(stack_base, stack_size) }
     }
 }

src/platform/redox/ptrace.rs

@@ -276,7 +276,7 @@ impl PalPtrace for Sys {
         addr: *mut c_void,
         data: *mut c_void,
     ) -> Result<c_int, Errno> {
-        inner_ptrace(request, pid, addr, data)
+        unsafe { inner_ptrace(request, pid, addr, data) }
             .map_err(|err| Errno(err.raw_os_error().unwrap_or(EIO)))
     }
 }