Skip to content

zeroize: do not rely on volatile operations? #1269

@newpavlov

Description

@newpavlov

write_volatile docs explicitly state that:

Volatile operations are intended to act on I/O memory.

Using it on a non-volatile memory does not cause soundness issues, but it still can be considered a misuse of the function. It also can result in a very suboptimal codegen as noted in #743.

#1252 has introduced optimization_barrier which allows us to use simple writes optimizable by the compiler which are then "observed" by the barrier to prevent removal of the writes.

Unless we discover some practical issues with optimization_barrier, I think we can replace the volatile writes with simple writes. It would require changing promises made in the docs, but it should not matter in practice for downstream users.

As a potential compromise we could keep using volatile writes only on targets which do not have stable asm! macro and where optimization_barrier has to use the "hardened" black_box.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions