Skip to content

Draft: explore LA57-aware virtual address validity #599

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
aarkegz wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

Draft: explore LA57-aware virtual address validity #599

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
37 changes: 37 additions & 0 deletions Changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,42 @@
# Unreleased

## New Features

- Add sealed `FixedValidity<48>`, `FixedValidity<57>`, and `RuntimeValidity` policies for virtual
addresses.
- Add the `VirtAddr48`, `VirtAddr57`, and `VirtAddrRT` aliases. `VirtAddr` and all validity-aware
aggregate types use runtime validity by default.
- Propagate virtual-address validity through pages, descriptor pointers, TSS, GDT, IDT, handler
types, interrupt stack frames, TLB commands, and CET legacy bitmap pages.
- Make hardware address APIs use runtime-valid addresses through their existing names. These APIs
are available only on `x86_64` with the `instructions` feature and require ring 0 when they read
`CR4.LA57`.
- Add `is_valid_current` for explicitly checking an existing address against the active mode.

## Compatibility Notes

- `VirtAddr::new`, `try_new`, `new_truncate`, and `from_ptr` now construct runtime-valid addresses
and are not const. Fixed 48-bit and 57-bit construction uses `new_const`, `try_new_const`,
`new_truncate_const`, and `from_ptr_const`.
- Checked default construction is unavailable without the `instructions` feature and on non-x86
targets. Storage-only operations such as `zero`, `new_unsafe`, formatting, and comparison remain
available.
- Hardware APIs that previously returned or accepted `VirtAddr`, `Page`, or descriptor pointers
retain their names but their concrete function-pointer signatures now use runtime validity.
- `Segment64` keeps its existing declaration, but its unparameterized `VirtAddr` methods now use
runtime validity. `HandlerFuncType`, handler aliases, and `InterruptStackFrame` likewise default
to runtime validity.
- Installing a handler or encoding a default TSS descriptor checks the containing object's address
by reading `CR4.LA57`, so these operations require ring 0. Ring 3 callers can use an explicit
fixed validity policy when the address-space contract is fixed.
- Unparameterized `Page` and page ranges are runtime-valid. The existing mapper stack still accepts
only `Page<_, FixedValidity<48>>`, so mapper call sites must use an explicit fixed page policy.
- Aggregate type inference changes wherever a validity parameter was previously omitted, including
GDT, IDT, TSS, descriptor pointers, TLB commands, and CET legacy bitmap pages.
- Validity is checked when a value is created. Later address-space mode changes do not
retroactively invalidate existing values.
- The mapper stack remains limited to four-level page tables and explicitly accepts VA48 pages.

# 0.15.5 – 2026-07-11

This release is compatible with Rust nightlies starting with `nightly-2026-07-10` (this only applies when the `nightly` feature is used).
Expand Down
Loading