litebox_{platform_lvbs,shim_optee}: simplify box_new_zeroed

litebox_platform_lvbs/src/lib.rs

@@ -36,7 +36,7 @@ use x86_64::{
         mapper::MapToError,
     },
 };
-use zerocopy::{FromBytes, IntoBytes};
+use zerocopy::{FromBytes, FromZeros, IntoBytes};
 
 #[cfg(feature = "optee_syscall")]
 use crate::mm::vmap::vmap_allocator;
@@ -50,29 +50,18 @@ pub mod mshv;
 
 pub mod syscall_entry;
 
-/// Allocate a zeroed `Box<T>` directly on the heap, avoiding stack intermediaries
-/// for large types (e.g., 4096-byte `HekiPage`).
+/// Allocate a zeroed `Box<T>` directly on the heap, avoiding stack
+/// intermediaries for large types (e.g., 4096-byte `HekiPage`).
 ///
-/// This is safe because `T: FromBytes` guarantees that all-zero bytes are a valid `T`.
-///
-/// # Panics
-///
-/// Panics if `T` is a zero-sized type, since `alloc_zeroed` with a zero-sized
-/// layout is undefined behavior.
-fn box_new_zeroed<T: FromBytes>() -> alloc::boxed::Box<T> {
-    assert!(
-        core::mem::size_of::<T>() > 0,
-        "box_new_zeroed does not support zero-sized types"
-    );
-    let layout = core::alloc::Layout::new::<T>();
-    // Safety: layout has a non-zero size and correct alignment for T.
-    let ptr = unsafe { alloc::alloc::alloc_zeroed(layout) }.cast::<T>();
-    if ptr.is_null() {
-        alloc::alloc::handle_alloc_error(layout);
-    }
-    // Safety: ptr is a valid, zeroed, properly aligned heap allocation for T.
-    // T: FromBytes guarantees all-zero is a valid bit pattern.
-    unsafe { alloc::boxed::Box::from_raw(ptr) }
+/// This is safe because `T: FromZeroes` guarantees that a well-aligned & sized,
+/// all-zero region of memory bytes is a valid instance of type `T`.
+fn box_new_zeroed<T: FromZeros>() -> alloc::boxed::Box<T> {
+    // # Safety
+    //
+    // `Box::new_zeroed` returns a `MaybeUninit` over zeroed memory. `FromZeros`
+    // guarantees that it is safe to transmute a well-initialized & aligned,
+    // zeroed region of memory into type `T`.
+    unsafe { alloc::boxed::Box::new_zeroed().assume_init() }
 }
 
 static CPU_MHZ: AtomicU64 = AtomicU64::new(0);

litebox_shim_optee/src/ptr.rs

@@ -65,28 +65,20 @@ use litebox_common_linux::vmap::{
     PhysPageAddr, PhysPageMapInfo, PhysPageMapPermissions, PhysPointerError, VmapManager,
 };
 use litebox_platform_multiplex::platform;
-use zerocopy::FromBytes;
+use zerocopy::{FromBytes, FromZeros};
 
-/// Allocate a zeroed `Box<T>` on the heap.
+/// Allocate a zeroed `Box<T>` directly on the heap, avoiding stack
+/// intermediaries for large types (e.g., 4096-byte `HekiPage`).
 ///
-/// # Panics
-///
-/// Panics if `T` is a zero-sized type, since `alloc_zeroed` with a zero-sized
-/// layout is undefined behavior.
-fn box_new_zeroed<T: FromBytes>() -> alloc::boxed::Box<T> {
-    assert!(
-        core::mem::size_of::<T>() > 0,
-        "box_new_zeroed does not support zero-sized types"
-    );
-    let layout = core::alloc::Layout::new::<T>();
-    // Safety: layout has a non-zero size and correct alignment for T.
-    let ptr = unsafe { alloc::alloc::alloc_zeroed(layout) }.cast::<T>();
-    if ptr.is_null() {
-        alloc::alloc::handle_alloc_error(layout);
-    }
-    // Safety: ptr is a valid, zeroed, properly aligned heap allocation for T.
-    // T: FromBytes guarantees all-zero is a valid bit pattern.
-    unsafe { alloc::boxed::Box::from_raw(ptr) }
+/// This is safe because `T: FromZeroes` guarantees that a well-aligned & sized,
+/// all-zero region of memory bytes is a valid instance of type `T`.
+fn box_new_zeroed<T: FromZeros>() -> alloc::boxed::Box<T> {
+    // # Safety
+    //
+    // `Box::new_zeroed` returns a `MaybeUninit` over zeroed memory. `FromZeros`
+    // guarantees that it is safe to transmute a well-initialized & aligned,
+    // zeroed region of memory into type `T`.
+    unsafe { alloc::boxed::Box::new_zeroed().assume_init() }
 }
 
 #[inline]