litebox_{platform_lvbs,shim_optee}: simplify box_new_zeroed#919
litebox_{platform_lvbs,shim_optee}: simplify box_new_zeroed#919lschuermann wants to merge 1 commit into
litebox_{platform_lvbs,shim_optee}: simplify box_new_zeroed#919Conversation
The existing implementation of `box_new_zeroed` is unnecessarily complex. We can simplify it to two function calls from the standard library: create a new zeroed heap region, and treat it as an initialized instance of type `T`. This also weakens this functions preconditions: `T` no longer strictly needs to be zero-sized (removing a runtime panic), and we can use `FromZeros` instead of `FromBytes: FromZeros`. It does not produce stack invariants, an important invariant for large types.
|
I see that the |
There was a problem hiding this comment.
Overall seems good to me, thanks Leon! Minor stylistic thing: prefer SAFETY: ... comment rather than # Safety\n\n... comment when discharging a safety obligation.
Also, fwiw, maybe we should use FromZeros::new_box_zeroed instead of the current body? Might need to tweak Cargo.toml to pull in the alloc feature, but since we're depending on alloc anyways, that's not an issue. Thoughts?
If we do not use the new_box_zeroed, then yes, we'd need to update the ratchet for this, thanks for confirming.
|
Agreed, |
|
@lschuermann please read the following Contributor License Agreement(CLA). If you agree with the CLA, please reply with the following information.
Contributor License AgreementContribution License AgreementThis Contribution License Agreement (“Agreement”) is agreed to by the party signing below (“You”),
|
The existing implementation of
box_new_zeroedis unnecessarily complex. We can simplify it to two function calls from the standard library: create a new zeroed heap region, and treat it as an initialized instance of typeT. This also weakens this functions preconditions:Tno longer strictly needs to be zero-sized (removing a runtime panic), and we can useFromZerosinstead ofFromBytes: FromZeros. It does not produce stack intermediaries, an important invariant for large types.This is a minor thing I noticed while reviewing #817; it can go in after that PR to avoid conflicts. I'll be happy to rebase it.