Remove outdated safety comments

ostd/src/arch/loongarch/irq/ipi.rs

@@ -16,13 +16,7 @@ impl HwCpuId {
 }
 
 /// Sends a general inter-processor interrupt (IPI) to the specified CPU.
-///
-/// # Safety
-///
-/// The caller must ensure that the interrupt number is valid and that
-/// the corresponding handler is configured correctly on the remote CPU.
-/// Furthermore, invoking the interrupt handler must also be safe.
-pub(crate) unsafe fn send_ipi(_hw_cpu_id: HwCpuId, _guard: &dyn PinCurrentCpu) {
+pub(crate) fn send_ipi(_hw_cpu_id: HwCpuId, _guard: &dyn PinCurrentCpu) {
     // To suppress unused function lint errors. We should be using it here.
     let _ = crate::smp::do_inter_processor_call;
     unimplemented!()

ostd/src/arch/riscv/irq/chip/mod.rs

@@ -64,7 +64,7 @@ pub(in crate::arch) unsafe fn init_current_hart() {
 /// An IRQ chip.
 ///
 /// This abstracts the hardware IRQ chips (or IRQ controllers), allowing the bus
-/// or device drivers to enable [`IrqLine`]s (via, e.g., [`map_interrupt_source_to`])
+/// or device drivers to enable [`IrqLine`]s (via, e.g., [`map_fdt_pin_to`])
 /// regardless of the specifics of the IRQ chip.
 ///
 /// In the RISC-V architecture, the underlying hardware is typically Platform-Level

ostd/src/arch/riscv/irq/ipi.rs

@@ -11,8 +11,8 @@ use crate::{cpu::PinCurrentCpu, irq::IrqLine};
 pub(crate) struct HwCpuId(u32);
 
 impl HwCpuId {
-    #[expect(unused_variables)]
-    pub(crate) fn read_current(guard: &dyn PinCurrentCpu) -> Self {
+    pub(crate) fn read_current(_guard: &dyn PinCurrentCpu) -> Self {
+        // No races because of `_guard`.
         Self(crate::arch::boot::smp::get_current_hart_id())
     }
 }
@@ -49,14 +49,7 @@ pub(in crate::arch) unsafe fn init_current_hart() {
 }
 
 /// Sends a general inter-processor interrupt (IPI) to the specified CPU.
-///
-/// # Safety
-///
-/// The caller must ensure that the interrupt number is valid and that
-/// the corresponding handler is configured correctly on the remote CPU.
-/// Furthermore, invoking the interrupt handler must also be safe.
-#[expect(unused_variables)]
-pub(crate) unsafe fn send_ipi(hw_cpu_id: HwCpuId, guard: &dyn PinCurrentCpu) {
+pub(crate) fn send_ipi(hw_cpu_id: HwCpuId, _guard: &dyn PinCurrentCpu) {
     const XLEN: usize = core::mem::size_of::<usize>() * 8;
     const XLEN_MASK: usize = XLEN - 1;
 

ostd/src/arch/riscv/trap/mod.rs

@@ -110,6 +110,7 @@ pub(super) fn handle_irq(trap_frame: &TrapFrame, interrupt: Interrupt, priv_leve
             );
         }
         Interrupt::SupervisorExternal => {
+            // No races because we're in IRQs.
             let hart_id = crate::arch::boot::smp::get_current_hart_id();
             while let Some(hw_irq_line) = IRQ_CHIP.get().unwrap().claim_interrupt(hart_id) {
                 call_irq_callback_functions(trap_frame, &hw_irq_line, priv_level);

ostd/src/arch/x86/irq/ipi.rs

@@ -32,13 +32,7 @@ pub(in crate::arch) fn init() {
 }
 
 /// Sends a general inter-processor interrupt (IPI) to the specified CPU.
-///
-/// # Safety
-///
-/// The caller must ensure that the interrupt number is valid and that
-/// the corresponding handler is configured correctly on the remote CPU.
-/// Furthermore, invoking the interrupt handler must also be safe.
-pub(crate) unsafe fn send_ipi(hw_cpu_id: HwCpuId, guard: &dyn PinCurrentCpu) {
+pub(crate) fn send_ipi(hw_cpu_id: HwCpuId, guard: &dyn PinCurrentCpu) {
     use crate::arch::kernel::apic::{self, Icr};
 
     let irq_num = IPI_IRQ.get().unwrap().num();

ostd/src/smp.rs

@@ -50,11 +50,7 @@ pub fn inter_processor_call(targets: &CpuSet, f: fn()) {
             continue;
         }
         let hw_cpu_id = ipi_data.hw_cpu_ids[cpu_id.as_usize()];
-        // SAFETY: The value of `irq_num` corresponds to a valid IRQ line and
-        // triggering it will not cause any safety issues.
-        unsafe {
-            crate::arch::irq::send_ipi(hw_cpu_id, &irq_guard as _);
-        }
+        crate::arch::irq::send_ipi(hw_cpu_id, &irq_guard as _);
     }
     if call_on_self {
         // Execute the function synchronously.
@@ -76,7 +72,8 @@ cpu_local! {
 ///
 /// # Safety
 ///
-/// It should only be called upon the inter processor interrupt.
+/// This function must be called from an IRQ handler that can be triggered by
+/// inter-processor interrupts.
 pub(crate) unsafe fn do_inter_processor_call(_trapframe: &TrapFrame) {
     // No races because we are in IRQs.
     let this_cpu_id = crate::cpu::CpuId::current_racy();