Switch the examples to use naked functions.

We cannot use this on the main library, because it means we'd need to
use the instruction_set attribute (rather than a .arm or .thumb
directive) and that isn't available on stable for most of our targets.

Author: jonathanpallant

.github/workflows/build.yml

@@ -63,9 +63,9 @@ jobs:
         uses: taiki-e/install-action@just
       - name: Install Rust
         run: |
-          rustup install nightly-2026-01-26
-          rustup component add rust-src --toolchain nightly-2026-01-26
-          rustup default nightly-2026-01-26
+          rustup install nightly-2026-02-26
+          rustup component add rust-src --toolchain nightly-2026-02-26
+          rustup default nightly-2026-02-26
       - name: Build
         run: |
           just build-tier3 ${{ matrix.target }}
@@ -89,9 +89,9 @@ jobs:
         uses: taiki-e/install-action@just
       - name: Install Rust
         run: |
-          rustup install nightly-2026-01-26
-          rustup component add rust-src --toolchain nightly-2026-01-26
-          rustup default nightly-2026-01-26
+          rustup install nightly-2026-02-26
+          rustup component add rust-src --toolchain nightly-2026-02-26
+          rustup default nightly-2026-02-26
       - name: Build
         run: |
           just build-tier3-no-atomics ${{ matrix.target }}

examples/mps3-an536/rust-toolchain.toml

@@ -1,5 +1,5 @@
 [toolchain]
-channel = "nightly-2026-01-26"
+channel = "nightly-2026-02-26"
 targets = [
 	"armv8r-none-eabihf",
 ]

examples/mps3-an536/src/bin/abt-exception-a32.rs

@@ -23,10 +23,9 @@ fn main() -> ! {
     enable_alignment_check();
 
     println!("Hello, this is an data abort exception example");
-    unsafe {
-        // Unaligned read
-        unaligned_from_a32();
-    }
+
+    // Unaligned read
+    unaligned_from_a32();
 
     // turn it off before we do the stack dump on exit, because println! has been
     // observed to do unaligned reads.
@@ -37,26 +36,17 @@ fn main() -> ! {
     mps3_an536::exit(0);
 }
 
-// These functions are written in assembly
-unsafe extern "C" {
-    fn unaligned_from_a32();
+#[unsafe(naked)]
+#[instruction_set(arm::a32)]
+extern "C" fn unaligned_from_a32() {
+    core::arch::naked_asm!(
+        "ldr     r0, =COUNTER",
+        "add     r0, r0, 1",
+        "ldr     r0, [r0]",
+        "bx      lr",
+    );
 }
 
-core::arch::global_asm!(
-    r#"
-    // fn unaligned_from_a32();
-    .arm
-    .global unaligned_from_a32
-    .type unaligned_from_a32, %function
-    unaligned_from_a32:
-        ldr     r0, =COUNTER
-        add     r0, r0, 1
-        ldr     r0, [r0]
-        bx      lr
-    .size unaligned_from_a32, . - unaligned_from_a32
-"#
-);
-
 fn enable_alignment_check() {
     let mut sctrl = Sctlr::read();
     sctrl.set_a(true);
@@ -92,7 +82,7 @@ unsafe fn data_abort_handler(addr: usize) -> usize {
     enable_alignment_check();
 
     // note the fault isn't at the start of the function
-    let expect_fault_at = unaligned_from_a32 as unsafe extern "C" fn() as usize + 8;
+    let expect_fault_at = unaligned_from_a32 as extern "C" fn() as usize + 8;
 
     if addr == expect_fault_at {
         println!("caught unaligned_from_a32");

examples/mps3-an536/src/bin/abt-exception-t32.rs

@@ -23,10 +23,8 @@ fn main() -> ! {
     enable_alignment_check();
 
     println!("Hello, this is an data abort exception example");
-    unsafe {
-        // Unaligned read
-        unaligned_from_t32();
-    }
+    // Unaligned read
+    unaligned_from_t32();
 
     // turn it off before we do the stack dump on exit, because println! has been
     // observed to do unaligned reads.
@@ -37,26 +35,17 @@ fn main() -> ! {
     mps3_an536::exit(0);
 }
 
-// These functions are written in assembly
-unsafe extern "C" {
-    fn unaligned_from_t32();
+#[unsafe(naked)]
+#[instruction_set(arm::t32)]
+extern "C" fn unaligned_from_t32() {
+    core::arch::naked_asm!(
+        "ldr     r0, =COUNTER",
+        "adds    r0, r0, 1",
+        "ldr     r0, [r0]",
+        "bx      lr",
+    );
 }
 
-core::arch::global_asm!(
-    r#"
-    // fn unaligned_from_t32();
-    .thumb
-    .global unaligned_from_t32
-    .type unaligned_from_t32, %function
-    unaligned_from_t32:
-        ldr     r0, =COUNTER
-        add     r0, r0, 1
-        ldr     r0, [r0]
-        bx      lr
-    .size unaligned_from_t32, . - unaligned_from_t32
-"#
-);
-
 fn enable_alignment_check() {
     let mut sctrl = Sctlr::read();
     sctrl.set_a(true);
@@ -92,7 +81,7 @@ unsafe fn data_abort_handler(addr: usize) -> usize {
     enable_alignment_check();
 
     // note the fault isn't at the start of the function
-    let expect_fault_at = unaligned_from_t32 as unsafe extern "C" fn() as usize + 5;
+    let expect_fault_at = unaligned_from_t32 as extern "C" fn() as usize + 5;
 
     if addr == expect_fault_at {
         println!("caught unaligned_from_t32");

examples/mps3-an536/src/bin/el2_hello.rs

@@ -33,16 +33,17 @@ fn main() -> ! {
 //
 // Unlike the default routine, it does not initialise any other stacks, or
 // switch to EL1 mode.
-core::arch::global_asm!(
-    r#"
-    // Work around https://github.com/rust-lang/rust/issues/127269
-    .fpu vfp3-d16
-
-    .section .text.start
-
-    .global _start
-    .type _start, %function
-    _start:
+//
+/// # Safety
+///
+/// This function should not be called manually. It should only be called on reset
+/// from the reset vector.
+#[unsafe(naked)]
+#[unsafe(no_mangle)]
+#[instruction_set(arm::t32)]
+pub unsafe extern "C" fn _start() {
+    core::arch::naked_asm!(
+        r#"
         // Set stack pointer
         ldr     sp, =_hyp_stack
         // Set the HVBAR (for EL2) to _vector_table
@@ -80,19 +81,19 @@ core::arch::global_asm!(
         bl      kmain
         // In case the application returns, loop forever
         b       .
-    .size _start, . - _start
-    "#,
-    hactlr_bits = const {
-        Hactlr::new_with_raw_value(0)
-            .with_cpuactlr(true)
-            .with_cdbgdci(true)
-            .with_flashifregionr(true)
-            .with_periphpregionr(true)
-            .with_qosr(true)
-            .with_bustimeoutr(true)
-            .with_intmonr(true)
-            .with_err(true)
-            .with_testr1(true)
-            .raw_value()
-    },
-);
+        "#,
+        hactlr_bits = const {
+            Hactlr::new_with_raw_value(0)
+                .with_cpuactlr(true)
+                .with_cdbgdci(true)
+                .with_flashifregionr(true)
+                .with_periphpregionr(true)
+                .with_qosr(true)
+                .with_bustimeoutr(true)
+                .with_intmonr(true)
+                .with_err(true)
+                .with_testr1(true)
+                .raw_value()
+        },
+    );
+}

examples/mps3-an536/src/bin/prefetch-exception-a32.rs

@@ -21,35 +21,26 @@ fn main() -> ! {
 
     // A BKPT instruction triggers a Prefetch Abort except when Halting debug-mode is enabled.
     // See p. 2038 of ARMv7-M Architecture Reference Manual
-    unsafe {
-        // trigger an prefetch abort exception, from A32 (Arm) mode
-        bkpt_from_a32();
-    }
+
+    // trigger an prefetch abort exception, from A32 (Arm) mode
+    bkpt_from_a32();
 
     println!("Recovered from fault OK!");
 
     mps3_an536::exit(0);
 }
 
-// These functions are written in assembly
-unsafe extern "C" {
-    fn bkpt_from_a32();
-}
-
-core::arch::global_asm!(
-    r#"
-    // fn bkpt_from_a32();
-    .arm
-    .global bkpt_from_a32
-    .type bkpt_from_a32, %function
-    bkpt_from_a32:
+#[unsafe(naked)]
+#[instruction_set(arm::a32)]
+extern "C" fn bkpt_from_a32() {
+    core::arch::naked_asm!(
+        r#"
         bkpt    #0
         bx      lr
-    .size bkpt_from_a32, . - bkpt_from_a32
-"#
-);
+        "#
+    );
+}
 
-// Custom link sections are allowed as well.
 #[exception(Undefined)]
 fn undefined_handler(_addr: usize) -> ! {
     panic!("unexpected undefined exception");
@@ -64,12 +55,12 @@ unsafe fn prefetch_abort_handler(addr: usize) -> usize {
     let ifar = Ifar::read();
     println!("IFAR (Faulting Address Register): {:?}", ifar);
 
-    if addr == bkpt_from_a32 as unsafe extern "C" fn() as usize {
+    if addr == bkpt_from_a32 as extern "C" fn() as usize {
         println!("caught bkpt_from_a32");
     } else {
         println!(
             "Bad fault address {:08x} is not {:08x}",
-            addr, bkpt_from_a32 as unsafe extern "C" fn() as usize
+            addr, bkpt_from_a32 as extern "C" fn() as usize
         );
     }
 

examples/mps3-an536/src/bin/prefetch-exception-t32.rs

@@ -21,33 +21,25 @@ fn main() -> ! {
 
     // A BKPT instruction triggers a Prefetch Abort except when Halting debug-mode is enabled.
     // See p. 2038 of ARMv7-M Architecture Reference Manual
-    unsafe {
-        // trigger an prefetch abort exception, from T32 (Thumb) mode
-        bkpt_from_t32();
-    }
+
+    // trigger an prefetch abort exception, from T32 (Thumb) mode
+    bkpt_from_t32();
 
     println!("Recovered from fault OK!");
 
     mps3_an536::exit(0);
 }
 
-// These functions are written in assembly
-unsafe extern "C" {
-    fn bkpt_from_t32();
-}
-
-core::arch::global_asm!(
-    r#"
-    // fn bkpt_from_t32();
-    .thumb
-    .global bkpt_from_t32
-    .type bkpt_from_t32, %function
-    bkpt_from_t32:
+#[unsafe(naked)]
+#[instruction_set(arm::t32)]
+extern "C" fn bkpt_from_t32() {
+    core::arch::naked_asm!(
+        r#"
         bkpt    #0
         bx      lr
-    .size bkpt_from_t32, . - bkpt_from_t32
-"#
-);
+        "#
+    );
+}
 
 #[exception(Undefined)]
 fn undefined_handler(_addr: usize) -> ! {
@@ -63,15 +55,15 @@ unsafe fn prefetch_abort_handler(addr: usize) -> usize {
     let ifar = Ifar::read();
     println!("IFAR (Faulting Address Register): {:?}", ifar);
 
-    if (addr + 1) == bkpt_from_t32 as unsafe extern "C" fn() as usize {
+    if (addr + 1) == bkpt_from_t32 as extern "C" fn() as usize {
         // note that thumb functions have their LSB set, despite always being a
         // multiple of two - that's how the CPU knows they are written in T32
         // machine code.
         println!("caught bkpt_from_t32");
     } else {
         println!(
             "Bad fault address {:08x} is not {:08x}",
-            addr, bkpt_from_t32 as unsafe extern "C" fn() as usize
+            addr, bkpt_from_t32 as extern "C" fn() as usize
         );
     }
 

examples/mps3-an536/src/bin/undef-exception-a32.rs

@@ -18,34 +18,25 @@ static COUNTER: AtomicU32 = AtomicU32::new(0);
 fn main() -> ! {
     println!("Hello, this is a undef exception example");
 
-    unsafe {
-        // trigger an Undefined exception, from A32 (Arm) mode
-        udf_from_a32();
-    }
+    // trigger an Undefined exception, from A32 (Arm) mode
+    udf_from_a32();
 
     println!("Recovered from fault OK!");
 
     mps3_an536::exit(0);
 }
 
-// These functions are written in assembly
-unsafe extern "C" {
-    fn udf_from_a32();
+#[unsafe(naked)]
+#[instruction_set(arm::a32)]
+extern "C" fn udf_from_a32() {
+    core::arch::naked_asm!(
+        // Do a UDF
+        "udf     #0",
+        // Return
+        "bx      lr",
+    );
 }
 
-core::arch::global_asm!(
-    r#"
-    // fn udf_from_a32();
-    .arm
-    .global udf_from_a32
-    .type udf_from_a32, %function
-    udf_from_a32:
-        udf     #0
-        bx      lr
-    .size udf_from_a32, . - udf_from_a32
-"#
-);
-
 #[exception(PrefetchAbort)]
 fn prefetch_abort_handler(_addr: usize) -> ! {
     panic!("unexpected undefined exception");
@@ -55,12 +46,12 @@ fn prefetch_abort_handler(_addr: usize) -> ! {
 unsafe fn undefined_handler(addr: usize) -> usize {
     println!("undefined abort occurred");
 
-    if addr == udf_from_a32 as unsafe extern "C" fn() as usize {
+    if addr == udf_from_a32 as extern "C" fn() as usize {
         println!("caught udf_from_a32");
     } else {
         println!(
             "Bad fault address {:08x} is not {:08x}",
-            addr, udf_from_a32 as unsafe extern "C" fn() as usize
+            addr, udf_from_a32 as extern "C" fn() as usize
         );
     }