Merge pull request #219 from rust-osdev/unsafe-rflags-write

Make writing the RFLAGS register unsafe

Author: phil-opp

Changelog.md

@@ -11,6 +11,7 @@
   - `interrupts::enable_interrupts_and_hlt`
 - **Breaking:** Make `DescriptorTablePointer::base` a `VirtAddr` ([#215](https://github.com/rust-osdev/x86_64/pull/215))
 - **Breaking:** Change return type of `read_rip` to `VirtAddr` ([#216](https://github.com/rust-osdev/x86_64/pull/216))
+- **Breaking:** Make writing the RFLAGS register unsafe ([#219](https://github.com/rust-osdev/x86_64/pull/219))
 - **Breaking:** Remove `PortReadWrite` trait, which is no longer needed ([#217](https://github.com/rust-osdev/x86_64/pull/217))
 - Relaxe `Sized` requirement for `FrameAllocator` in `Mapper::map_to` ([204](https://github.com/rust-osdev/x86_64/pull/204))
 

src/registers/rflags.rs

@@ -92,8 +92,14 @@ mod x86_64 {
     }
 
     /// Writes the RFLAGS register, preserves reserved bits.
+    ///
+    /// ## Safety
+    ///
+    /// Unsafe because undefined becavior can occur if certain flags are modified. For example,
+    /// the `DF` flag must be unset in all Rust code. Also, modifying `CF`, `PF`, or any other
+    /// flags also used by Rust/LLVM can result in undefined behavior too.
     #[inline]
-    pub fn write(flags: RFlags) {
+    pub unsafe fn write(flags: RFlags) {
         let old_value = read_raw();
         let reserved = old_value & !(RFlags::all().bits());
         let new_value = reserved | flags.bits();
@@ -104,16 +110,23 @@ mod x86_64 {
     /// Writes the RFLAGS register.
     ///
     /// Does not preserve any bits, including reserved bits.
+    ///
+    ///
+    /// ## Safety
+    ///
+    /// Unsafe because undefined becavior can occur if certain flags are modified. For example,
+    /// the `DF` flag must be unset in all Rust code. Also, modifying `CF`, `PF`, or any other
+    /// flags also used by Rust/LLVM can result in undefined behavior too.
     #[inline]
-    pub fn write_raw(val: u64) {
+    pub unsafe fn write_raw(val: u64) {
         #[cfg(feature = "inline_asm")]
-        unsafe {
+        {
             // FIXME - There's probably a better way than saying we preserve the flags even though we actually don't
             asm!("push {}; popf", in(reg) val, options(preserves_flags))
         };
 
         #[cfg(not(feature = "inline_asm"))]
-        unsafe {
+        {
             crate::asm::x86_64_asm_write_rflags(val)
         }
     }