17 files changed, 59 insertions, 38 deletions

diff --git a/embassy-executor/src/arch/avr.rs b/embassy-executor/src/arch/avr.rs
index 70085d04d..a841afe15 100644
--- a/embassy-executor/src/arch/avr.rs
+++ b/embassy-executor/src/arch/avr.rs
@@ -10,11 +10,11 @@ mod thread {
     pub use embassy_executor_macros::main_avr as main;
     use portable_atomic::{AtomicBool, Ordering};
 
-    use crate::{raw, Spawner};
+    use crate::{Spawner, raw};
 
     static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
 
-    #[export_name = "__pender"]
+    #[unsafe(export_name = "__pender")]
     fn __pender(_context: *mut ()) {
         SIGNAL_WORK_THREAD_MODE.store(true, Ordering::SeqCst);
     }
diff --git a/embassy-executor/src/arch/cortex_ar.rs b/embassy-executor/src/arch/cortex_ar.rs
index f9e2f3f7c..ce572738a 100644
--- a/embassy-executor/src/arch/cortex_ar.rs
+++ b/embassy-executor/src/arch/cortex_ar.rs
@@ -1,7 +1,10 @@
+#[cfg(arm_profile = "legacy")]
+compile_error!("`arch-cortex-ar` does not support the legacy ARM profile, WFE/SEV are not available.");
+
 #[cfg(feature = "executor-interrupt")]
 compile_error!("`executor-interrupt` is not supported with `arch-cortex-ar`.");
 
-#[export_name = "__pender"]
+#[unsafe(export_name = "__pender")]
 #[cfg(any(feature = "executor-thread", feature = "executor-interrupt"))]
 fn __pender(context: *mut ()) {
     // `context` is always `usize::MAX` created by `Executor::run`.
@@ -10,7 +13,7 @@ fn __pender(context: *mut ()) {
     #[cfg(feature = "executor-thread")]
     // Try to make Rust optimize the branching away if we only use thread mode.
     if !cfg!(feature = "executor-interrupt") || context == THREAD_PENDER {
-        cortex_ar::asm::sev();
+        aarch32_cpu::asm::sev();
         return;
     }
 }
@@ -23,10 +26,10 @@ mod thread {
 
     use core::marker::PhantomData;
 
-    use cortex_ar::asm::wfe;
+    use aarch32_cpu::asm::wfe;
     pub use embassy_executor_macros::main_cortex_ar as main;
 
-    use crate::{raw, Spawner};
+    use crate::{Spawner, raw};
 
     /// Thread mode executor, using WFE/SEV.
     ///
diff --git a/embassy-executor/src/arch/cortex_m.rs b/embassy-executor/src/arch/cortex_m.rs
index 1c9ddd8a0..1ce96d1d5 100644
--- a/embassy-executor/src/arch/cortex_m.rs
+++ b/embassy-executor/src/arch/cortex_m.rs
@@ -1,4 +1,4 @@
-#[export_name = "__pender"]
+#[unsafe(export_name = "__pender")]
 #[cfg(any(feature = "executor-thread", feature = "executor-interrupt"))]
 fn __pender(context: *mut ()) {
     unsafe {
@@ -53,7 +53,7 @@ mod thread {
 
     pub use embassy_executor_macros::main_cortex_m as main;
 
-    use crate::{raw, Spawner};
+    use crate::{Spawner, raw};
 
     /// Thread mode executor, using WFE/SEV.
     ///
diff --git a/embassy-executor/src/arch/riscv32.rs b/embassy-executor/src/arch/riscv32.rs
index 01e63a9fd..c70c1344a 100644
--- a/embassy-executor/src/arch/riscv32.rs
+++ b/embassy-executor/src/arch/riscv32.rs
@@ -10,12 +10,12 @@ mod thread {
 
     pub use embassy_executor_macros::main_riscv as main;
 
-    use crate::{raw, Spawner};
+    use crate::{Spawner, raw};
 
     /// global atomic used to keep track of whether there is work to do since sev() is not available on RISCV
     static SIGNAL_WORK_THREAD_MODE: AtomicBool = AtomicBool::new(false);
 
-    #[export_name = "__pender"]
+    #[unsafe(export_name = "__pender")]
     fn __pender(_context: *mut ()) {
         SIGNAL_WORK_THREAD_MODE.store(true, Ordering::SeqCst);
     }
diff --git a/embassy-executor/src/arch/spin.rs b/embassy-executor/src/arch/spin.rs
index 340023620..49f3356a6 100644
--- a/embassy-executor/src/arch/spin.rs
+++ b/embassy-executor/src/arch/spin.rs
@@ -9,9 +9,9 @@ mod thread {
 
     pub use embassy_executor_macros::main_spin as main;
 
-    use crate::{raw, Spawner};
+    use crate::{Spawner, raw};
 
-    #[export_name = "__pender"]
+    #[unsafe(export_name = "__pender")]
     fn __pender(_context: *mut ()) {}
 
     /// Spin Executor
diff --git a/embassy-executor/src/arch/std.rs b/embassy-executor/src/arch/std.rs
index b02b15988..d4057144e 100644
--- a/embassy-executor/src/arch/std.rs
+++ b/embassy-executor/src/arch/std.rs
@@ -10,9 +10,9 @@ mod thread {
 
     pub use embassy_executor_macros::main_std as main;
 
-    use crate::{raw, Spawner};
+    use crate::{Spawner, raw};
 
-    #[export_name = "__pender"]
+    #[unsafe(export_name = "__pender")]
     fn __pender(context: *mut ()) {
         let signaler: &'static Signaler = unsafe { std::mem::transmute(context) };
         signaler.signal()
@@ -55,11 +55,24 @@ mod thread {
         ///
         /// This function never returns.
         pub fn run(&'static mut self, init: impl FnOnce(Spawner)) -> ! {
+            self.run_until(init, || false);
+            unreachable!()
+        }
+
+        /// Run the executor until a flag is raised.
+        ///
+        /// This function is identical to `Executor::run()` apart from offering a `done` flag to stop execution.
+        pub fn run_until(&'static mut self, init: impl FnOnce(Spawner), mut done: impl FnMut() -> bool) {
             init(self.inner.spawner());
 
             loop {
                 unsafe { self.inner.poll() };
-                self.signaler.wait()
+
+                if done() {
+                    break;
+                }
+
+                self.signaler.wait();
             }
         }
     }
diff --git a/embassy-executor/src/arch/wasm.rs b/embassy-executor/src/arch/wasm.rs
index f9d0f935c..d2ff2fe51 100644
--- a/embassy-executor/src/arch/wasm.rs
+++ b/embassy-executor/src/arch/wasm.rs
@@ -13,9 +13,9 @@ mod thread {
     use wasm_bindgen::prelude::*;
 
     use crate::raw::util::UninitCell;
-    use crate::{raw, Spawner};
+    use crate::{Spawner, raw};
 
-    #[export_name = "__pender"]
+    #[unsafe(export_name = "__pender")]
     fn __pender(context: *mut ()) {
         let signaler: &'static WasmContext = unsafe { std::mem::transmute(context) };
         let _ = signaler.promise.then(unsafe { signaler.closure.as_mut() });
diff --git a/embassy-executor/src/lib.rs b/embassy-executor/src/lib.rs
index e47b8eb9f..cffc76699 100644
--- a/embassy-executor/src/lib.rs
+++ b/embassy-executor/src/lib.rs
@@ -1,5 +1,6 @@
 #![cfg_attr(not(any(feature = "arch-std", feature = "arch-wasm")), no_std)]
 #![allow(clippy::new_without_default)]
+#![allow(unsafe_op_in_unsafe_fn)]
 #![doc = include_str!("../README.md")]
 #![warn(missing_docs)]
 
diff --git a/embassy-executor/src/metadata.rs b/embassy-executor/src/metadata.rs
index bc0df0f83..76504ab0b 100644
--- a/embassy-executor/src/metadata.rs
+++ b/embassy-executor/src/metadata.rs
@@ -1,6 +1,6 @@
 #[cfg(feature = "metadata-name")]
 use core::cell::Cell;
-use core::future::{poll_fn, Future};
+use core::future::{Future, poll_fn};
 #[cfg(feature = "scheduler-priority")]
 use core::sync::atomic::{AtomicU8, Ordering};
 use core::task::Poll;
diff --git a/embassy-executor/src/raw/mod.rs b/embassy-executor/src/raw/mod.rs
index dbd70cbf4..ab845ed3b 100644
--- a/embassy-executor/src/raw/mod.rs
+++ b/embassy-executor/src/raw/mod.rs
@@ -52,7 +52,7 @@ pub use self::waker::task_from_waker;
 use super::SpawnToken;
 use crate::{Metadata, SpawnError};
 
-#[no_mangle]
+#[unsafe(no_mangle)]
 extern "Rust" fn __embassy_time_queue_item_from_waker(waker: &Waker) -> &'static mut TimerQueueItem {
     unsafe { task_from_waker(waker).timer_queue_item() }
 }
@@ -407,7 +407,7 @@ unsafe impl Sync for Pender {}
 
 impl Pender {
     pub(crate) fn pend(self) {
-        extern "Rust" {
+        unsafe extern "Rust" {
             fn __pender(context: *mut ());
         }
         unsafe { __pender(self.0) };
@@ -507,7 +507,7 @@ impl SyncExecutor {
 /// The pender function must be exported with the name `__pender` and have the following signature:
 ///
 /// ```rust
-/// #[export_name = "__pender"]
+/// #[unsafe(export_name = "__pender")]
 /// fn pender(context: *mut ()) {
 ///    // schedule `poll()` to be called
 /// }
diff --git a/embassy-executor/src/raw/run_queue.rs b/embassy-executor/src/raw/run_queue.rs
index b8b052310..6f2abdbd0 100644
--- a/embassy-executor/src/raw/run_queue.rs
+++ b/embassy-executor/src/raw/run_queue.rs
@@ -1,9 +1,9 @@
-use core::ptr::{addr_of_mut, NonNull};
+use core::ptr::{NonNull, addr_of_mut};
 
-use cordyceps::sorted_list::Links;
 use cordyceps::Linked;
 #[cfg(any(feature = "scheduler-priority", feature = "scheduler-deadline"))]
 use cordyceps::SortedList;
+use cordyceps::sorted_list::Links;
 
 #[cfg(target_has_atomic = "ptr")]
 type TransferStack<T> = cordyceps::TransferStack<T>;
diff --git a/embassy-executor/src/raw/state_atomics_arm.rs b/embassy-executor/src/raw/state_atomics_arm.rs
index b743dcc2c..f68de955f 100644
--- a/embassy-executor/src/raw/state_atomics_arm.rs
+++ b/embassy-executor/src/raw/state_atomics_arm.rs
@@ -1,4 +1,4 @@
-use core::sync::atomic::{compiler_fence, AtomicBool, AtomicU32, Ordering};
+use core::sync::atomic::{AtomicBool, AtomicU32, Ordering, compiler_fence};
 
 #[derive(Clone, Copy)]
 pub(crate) struct Token(());
diff --git a/embassy-executor/src/raw/state_critical_section.rs b/embassy-executor/src/raw/state_critical_section.rs
index b69a6ac66..8d7ef2892 100644
--- a/embassy-executor/src/raw/state_critical_section.rs
+++ b/embassy-executor/src/raw/state_critical_section.rs
@@ -1,7 +1,7 @@
 use core::cell::Cell;
 
-pub(crate) use critical_section::{with as locked, CriticalSection as Token};
 use critical_section::{CriticalSection, Mutex};
+pub(crate) use critical_section::{CriticalSection as Token, with as locked};
 
 #[cfg(target_arch = "avr")]
 type StateBits = u8;
diff --git a/embassy-executor/src/raw/trace.rs b/embassy-executor/src/raw/trace.rs
index b3086948c..830162039 100644
--- a/embassy-executor/src/raw/trace.rs
+++ b/embassy-executor/src/raw/trace.rs
@@ -169,7 +169,7 @@ impl TaskTracker {
 }
 
 #[cfg(feature = "trace")]
-extern "Rust" {
+unsafe extern "Rust" {
     /// This callback is called when the executor begins polling. This will always
     /// be paired with a later call to `_embassy_trace_executor_idle`.
     ///
@@ -368,11 +368,7 @@ impl rtos_trace::RtosTraceOSCallbacks for crate::raw::SyncExecutor {
     }
     fn time() -> u64 {
         const fn gcd(a: u64, b: u64) -> u64 {
-            if b == 0 {
-                a
-            } else {
-                gcd(b, a % b)
-            }
+            if b == 0 { a } else { gcd(b, a % b) }
         }
 
         const GCD_1M: u64 = gcd(embassy_time_driver::TICK_HZ, 1_000_000);
diff --git a/embassy-executor/src/raw/waker.rs b/embassy-executor/src/raw/waker.rs
index d0d7b003d..2706f0fdf 100644
--- a/embassy-executor/src/raw/waker.rs
+++ b/embassy-executor/src/raw/waker.rs
@@ -1,6 +1,6 @@
 use core::task::{RawWaker, RawWakerVTable, Waker};
 
-use super::{wake_task, TaskHeader, TaskRef};
+use super::{TaskHeader, TaskRef, wake_task};
 
 static VTABLE: RawWakerVTable = RawWakerVTable::new(clone, wake, wake, drop);
 
@@ -35,7 +35,9 @@ pub fn task_from_waker(waker: &Waker) -> TaskRef {
     // make sure to compare vtable addresses. Doing `==` on the references
     // will compare the contents, which is slower.
     if waker.vtable() as *const _ != &VTABLE as *const _ {
-        panic!("Found waker not created by the Embassy executor. `embassy_time::Timer` only works with the Embassy executor.")
+        panic!(
+            "Found waker not created by the Embassy executor. `embassy_time::Timer` only works with the Embassy executor."
+        )
     }
     // safety: our wakers are always created with `TaskRef::as_ptr`
     unsafe { TaskRef::from_ptr(waker.data() as *const TaskHeader) }
diff --git a/embassy-executor/src/raw/waker_turbo.rs b/embassy-executor/src/raw/waker_turbo.rs
index 435a0ff7e..919bcc61a 100644
--- a/embassy-executor/src/raw/waker_turbo.rs
+++ b/embassy-executor/src/raw/waker_turbo.rs
@@ -1,7 +1,7 @@
 use core::ptr::NonNull;
 use core::task::Waker;
 
-use super::{wake_task, TaskHeader, TaskRef};
+use super::{TaskHeader, TaskRef, wake_task};
 
 pub(crate) unsafe fn from_task(p: TaskRef) -> Waker {
     Waker::from_turbo_ptr(NonNull::new_unchecked(p.as_ptr() as _))
@@ -26,7 +26,7 @@ pub fn task_from_waker(waker: &Waker) -> TaskRef {
 }
 
 #[inline(never)]
-#[no_mangle]
+#[unsafe(no_mangle)]
 fn _turbo_wake(ptr: NonNull<()>) {
     // safety: our wakers are always created with `TaskRef::as_ptr`
     let task = unsafe { TaskRef::from_ptr(ptr.as_ptr() as *const TaskHeader) };
diff --git a/embassy-executor/src/spawner.rs b/embassy-executor/src/spawner.rs
index 83d896b76..b73a1e7c6 100644
--- a/embassy-executor/src/spawner.rs
+++ b/embassy-executor/src/spawner.rs
@@ -1,4 +1,4 @@
-use core::future::{poll_fn, Future};
+use core::future::{Future, poll_fn};
 use core::marker::PhantomData;
 use core::mem;
 use core::sync::atomic::Ordering;
@@ -75,7 +75,10 @@ impl core::fmt::Debug for SpawnError {
 impl core::fmt::Display for SpawnError {
     fn fmt(&self, f: &mut core::fmt::Formatter<'_>) -> core::fmt::Result {
         match self {
-            SpawnError::Busy => write!(f, "Busy - Too many instances of this task are already running. Check the `pool_size` attribute of the task."),
+            SpawnError::Busy => write!(
+                f,
+                "Busy - Too many instances of this task are already running. Check the `pool_size` attribute of the task."
+            ),
         }
     }
 }
@@ -84,7 +87,10 @@ impl core::fmt::Display for SpawnError {
 impl defmt::Format for SpawnError {
     fn format(&self, f: defmt::Formatter) {
         match self {
-            SpawnError::Busy => defmt::write!(f, "Busy - Too many instances of this task are already running. Check the `pool_size` attribute of the task."),
+            SpawnError::Busy => defmt::write!(
+                f,
+                "Busy - Too many instances of this task are already running. Check the `pool_size` attribute of the task."
+            ),
         }
     }
 }