diff --git a/litebox_platform_lvbs/src/lib.rs b/litebox_platform_lvbs/src/lib.rs index e41f43ea0..1a7d66a4e 100644 --- a/litebox_platform_lvbs/src/lib.rs +++ b/litebox_platform_lvbs/src/lib.rs @@ -36,7 +36,7 @@ use x86_64::{ mapper::MapToError, }, }; -use zerocopy::{FromBytes, IntoBytes}; +use zerocopy::{FromBytes, FromZeros, IntoBytes}; #[cfg(feature = "optee_syscall")] use crate::mm::vmap::vmap_allocator; @@ -50,29 +50,18 @@ pub mod mshv; pub mod syscall_entry; -/// Allocate a zeroed `Box` directly on the heap, avoiding stack intermediaries -/// for large types (e.g., 4096-byte `HekiPage`). +/// Allocate a zeroed `Box` directly on the heap, avoiding stack +/// intermediaries for large types (e.g., 4096-byte `HekiPage`). /// -/// This is safe because `T: FromBytes` guarantees that all-zero bytes are a valid `T`. -/// -/// # Panics -/// -/// Panics if `T` is a zero-sized type, since `alloc_zeroed` with a zero-sized -/// layout is undefined behavior. -fn box_new_zeroed() -> alloc::boxed::Box { - assert!( - core::mem::size_of::() > 0, - "box_new_zeroed does not support zero-sized types" - ); - let layout = core::alloc::Layout::new::(); - // Safety: layout has a non-zero size and correct alignment for T. - let ptr = unsafe { alloc::alloc::alloc_zeroed(layout) }.cast::(); - if ptr.is_null() { - alloc::alloc::handle_alloc_error(layout); - } - // Safety: ptr is a valid, zeroed, properly aligned heap allocation for T. - // T: FromBytes guarantees all-zero is a valid bit pattern. - unsafe { alloc::boxed::Box::from_raw(ptr) } +/// This is safe because `T: FromZeroes` guarantees that a well-aligned & sized, +/// all-zero region of memory bytes is a valid instance of type `T`. +fn box_new_zeroed() -> alloc::boxed::Box { + // # Safety + // + // `Box::new_zeroed` returns a `MaybeUninit` over zeroed memory. `FromZeros` + // guarantees that it is safe to transmute a well-initialized & aligned, + // zeroed region of memory into type `T`. + unsafe { alloc::boxed::Box::new_zeroed().assume_init() } } static CPU_MHZ: AtomicU64 = AtomicU64::new(0); diff --git a/litebox_shim_optee/src/ptr.rs b/litebox_shim_optee/src/ptr.rs index 06a492506..df56c76bd 100644 --- a/litebox_shim_optee/src/ptr.rs +++ b/litebox_shim_optee/src/ptr.rs @@ -65,28 +65,20 @@ use litebox_common_linux::vmap::{ PhysPageAddr, PhysPageMapInfo, PhysPageMapPermissions, PhysPointerError, VmapManager, }; use litebox_platform_multiplex::platform; -use zerocopy::FromBytes; +use zerocopy::{FromBytes, FromZeros}; -/// Allocate a zeroed `Box` on the heap. +/// Allocate a zeroed `Box` directly on the heap, avoiding stack +/// intermediaries for large types (e.g., 4096-byte `HekiPage`). /// -/// # Panics -/// -/// Panics if `T` is a zero-sized type, since `alloc_zeroed` with a zero-sized -/// layout is undefined behavior. -fn box_new_zeroed() -> alloc::boxed::Box { - assert!( - core::mem::size_of::() > 0, - "box_new_zeroed does not support zero-sized types" - ); - let layout = core::alloc::Layout::new::(); - // Safety: layout has a non-zero size and correct alignment for T. - let ptr = unsafe { alloc::alloc::alloc_zeroed(layout) }.cast::(); - if ptr.is_null() { - alloc::alloc::handle_alloc_error(layout); - } - // Safety: ptr is a valid, zeroed, properly aligned heap allocation for T. - // T: FromBytes guarantees all-zero is a valid bit pattern. - unsafe { alloc::boxed::Box::from_raw(ptr) } +/// This is safe because `T: FromZeroes` guarantees that a well-aligned & sized, +/// all-zero region of memory bytes is a valid instance of type `T`. +fn box_new_zeroed() -> alloc::boxed::Box { + // # Safety + // + // `Box::new_zeroed` returns a `MaybeUninit` over zeroed memory. `FromZeros` + // guarantees that it is safe to transmute a well-initialized & aligned, + // zeroed region of memory into type `T`. + unsafe { alloc::boxed::Box::new_zeroed().assume_init() } } #[inline]