Treat safe target_feature functions as unsafe by default

compiler/rustc_hir/src/hir.rs

@@ -3762,8 +3762,18 @@ impl fmt::Display for Constness {
     }
 }
 
+/// The actualy safety specified in syntax. We may treat
+/// its safety different within the type system to create a
+/// "sound by default" system that needs checking this enum
+/// explicitly to allow unsafe operations.
 #[derive(Copy, Clone, Debug, HashStable_Generic, PartialEq, Eq)]
 pub enum HeaderSafety {
+    /// A safe function annotated with `#[target_features]`.
+    /// The type system treats this function as an unsafe function,
+    /// but safety checking will check this enum to treat it as safe
+    /// and allowing calling other safe target feature functions with
+    /// the same features without requiring an additional unsafe block.
+    SafeTargetFeatures,
     Normal(Safety),
 }
 
@@ -3800,6 +3810,7 @@ impl FnHeader {
 
     pub fn safety(&self) -> Safety {
         match self.safety {
+            HeaderSafety::SafeTargetFeatures => Safety::Unsafe,
             HeaderSafety::Normal(safety) => safety,
         }
     }