Remove unsafe from executor api

embassy/src/executor/executor.rs

@@ -258,27 +258,24 @@ impl Executor {
     }
 
     /// Spawn a future on this executor.
-    ///
-    /// safety: can only be called from the executor thread
-    pub unsafe fn spawn(&'static self, token: SpawnToken) -> Result<(), SpawnError> {
+    pub fn spawn(&'static self, token: SpawnToken) -> Result<(), SpawnError> {
         let header = token.header;
         mem::forget(token);
 
         match header {
-            Some(header) => {
+            Some(header) => unsafe {
                 let header = header.as_ref();
                 header.executor.set(self);
                 self.enqueue(header as *const _ as _);
                 Ok(())
-            }
+            },
             None => Err(SpawnError::Busy),
         }
     }
 
     /// Runs the executor until the queue is empty.
-    ///
-    /// safety: can only be called from the executor thread
-    pub unsafe fn run(&self) {
+    pub fn run(&self) {
+        unsafe {
             self.queue.dequeue_all(|p| {
                 let header = &*p;
 
@@ -296,4 +293,5 @@ impl Executor {
                 header.poll_fn.read()(p as _);
             });
         }
+    }
 }

embassy/src/executor/timer_executor.rs

@@ -34,14 +34,14 @@ impl<A: Alarm> TimerExecutor<A> {
     /// Spawn a future on this executor.
     ///
     /// safety: can only be called from the executor thread
-    pub unsafe fn spawn(&'static self, token: SpawnToken) -> Result<(), SpawnError> {
+    pub fn spawn(&'static self, token: SpawnToken) -> Result<(), SpawnError> {
         self.inner.spawn(token)
     }
 
     /// Runs the executor until the queue is empty.
     ///
     /// safety: can only be called from the executor thread
-    pub unsafe fn run(&'static self) {
+    pub fn run(&'static self) {
         with_timer_queue(&self.timer_queue, || {
             self.timer_queue.check_expirations();
             self.inner.run();