Make all CSR writes unsafe by default

[romancardenas]

Closes #209

Work in Progress! I added a safe pattern to opt out of unsafety in cases where we consider there to be no safety issues. I will list all the different registers where we use this macro and nominate some to maintain write safety.

[rmsyn]

Since most of these registers are WARL, what are we using for safe vs. unsafe criteria? Is it going to be related to side-effects, e.g. mtvec pointing to a potentially invalid memory region only triggered by an interrupt/exception?

Whatever criteria we come up with, maybe we should also add a blurb to the top-level register module about them?

Adding the safe opt-out is a good approach in my opinion. I agree that the CSR writes should be unsafe by default.

[romancardenas]

what are we using for safe vs. unsafe criteria? Is it going to be related to side-effects, e.g. mtvec pointing to a potentially invalid memory region only triggered by an interrupt/exception?

Yes, let us leave all writes of CSRs that might trigger invalid states unsafe. mtvec is a good example. I guess that mstatus must also be unsafe, as it can break critical sections, for instance.

[romancardenas]

Registers built with write_csr_as_usize that could be write-safe

• mepc
• mhpmcounterx
• mhpmeventx
• mscratch
• pmpaddrx
• pmpcfgx
• satp
• sepc
• sscratch

I personally think that all these registers should be unsafe to write

[romancardenas]

I have been reading the ISA and I feel like most of the registers should be unsafe to write. I think it would be a better idea force all write functions to be unsafe and open a new issue/RFC to nominate registers to be safe. What do you think @rust-embedded/riscv ?

[rmsyn]

I think it would be a better idea force all write functions to be unsafe and open a new issue/RFC to nominate registers to be safe.

I agree with this approach, and we should probably outline criteria for CSR write safety.

As we discussed before, most of the CSRs in the ISA are WARL (Write Anything Read Legal), so safety should be based on side-effects of writing to the registers.

For a rough set of attributes to consider:

• does a CSR write introduce potential memory safety issues in safe code?
• does a CSR write introduce potential undefined behavior in safe code?
• does a CSR write invalidate invariants in safe code?

It may be a good idea to add some sort of entry in either the top-level or register documentation. Something we can at least point contributors to when a safe RFC is being reviewed.

[romancardenas]

I drafted a quick RFC template to ease the nomination process in #256