Merge pull request #1981 from rust-osdev/improvements3

uefi: streamline + fix usize_from_u32()

Author: phip1611

uefi/src/proto/ata/mod.rs

@@ -3,7 +3,6 @@
 //! ATA Protocols.
 
 use crate::mem::{AlignedBuffer, AlignmentError};
-use crate::util::usize_from_u32;
 use core::alloc::LayoutError;
 use core::marker::PhantomData;
 use core::ptr;
@@ -64,8 +63,8 @@ impl<'a> AtaRequestBuilder<'a> {
         protocol: AtaPassThruCommandProtocol,
     ) -> Result<Self, LayoutError> {
         // status block has alignment requirements!
-        let mut asb =
-            AlignedBuffer::from_size_align(size_of::<AtaStatusBlock>(), usize_from_u32(io_align))?;
+        let io_align_usize = usize::try_from(io_align).expect("I/O alignment should fit in usize");
+        let mut asb = AlignedBuffer::from_size_align(size_of::<AtaStatusBlock>(), io_align_usize)?;
         Ok(Self {
             req: AtaRequest {
                 io_align,

uefi/src/proto/loaded_image.rs

@@ -71,7 +71,8 @@ impl LoadedImage {
     /// [`&CStr16`]: `CStr16`
     /// [`load_options_as_bytes`]: `Self::load_options_as_bytes`
     pub fn load_options_as_cstr16(&self) -> Result<&CStr16, LoadOptionsError> {
-        let load_options_size = usize_from_u32(self.0.load_options_size);
+        let load_options_size = usize::try_from(self.0.load_options_size)
+            .expect("load options size should fit in usize");
 
         if self.0.load_options.is_null() {
             Err(LoadOptionsError::NotSet)

uefi/src/proto/tcg/v2.rs

@@ -15,7 +15,7 @@
 use super::{AlgorithmId, EventType, HashAlgorithm, PcrIndex, v1};
 use crate::data_types::{Align, PhysicalAddress, UnalignedSlice};
 use crate::proto::unsafe_protocol;
-use crate::util::{ptr_write_unaligned_and_add, usize_from_u32};
+use crate::util::ptr_write_unaligned_and_add;
 use crate::{Error, Result, Status, StatusExt};
 use core::fmt::{self, Debug, Formatter};
 use core::marker::PhantomData;
@@ -279,7 +279,8 @@ impl<'a> EventLogHeader<'a> {
         let version_major = *event.get(21)?;
         let version_errata = *event.get(22)?;
         let uintn_size = *event.get(23)?;
-        let number_of_algorithms = usize_from_u32(u32_le_from_bytes_at_offset(event, 24)?);
+        let number_of_algorithms = usize::try_from(u32_le_from_bytes_at_offset(event, 24)?)
+            .expect("algorithm count should fit in usize");
         let vendor_info_size_byte_offset =
             28 + (number_of_algorithms * size_of::<AlgorithmDigestSize>());
         let vendor_info_size = usize::from(*event.get(vendor_info_size_byte_offset)?);
@@ -462,7 +463,8 @@ impl<'a> PcrEvent<'a> {
 
         let digests = unsafe { slice::from_raw_parts(digests_ptr, digests_byte_size) };
         let event_size_ptr = unsafe { digests_ptr.add(digests_byte_size) };
-        let event_size = usize_from_u32(unsafe { event_size_ptr.cast::<u32>().read_unaligned() });
+        let event_size = usize::try_from(unsafe { event_size_ptr.cast::<u32>().read_unaligned() })
+            .expect("event size should fit in usize");
         let event_data_ptr = unsafe { event_size_ptr.add(4) };
         let event_data = unsafe { slice::from_raw_parts(event_data_ptr, event_size) };
 

uefi/src/util.rs

@@ -11,21 +11,20 @@ pub const unsafe fn ptr_write_unaligned_and_add<T>(ptr: &mut *mut u8, val: T) {
     }
 }
 
-/// Convert from a `u32` to a `usize`. Panic if the input does fit. On typical
-/// targets `usize` is at least as big as `u32`, so this should never panic
-/// except on unusual targets.
+/// Converts a `u32` to `usize`.
 ///
-/// Comparison to alternatives:
-/// * `val as usize` doesn't check that `val` actually fits in a `usize`.
-/// * `usize::try_from(val).unwrap()` doesn't work in a const context.
+/// Panics if `val` does not fit in `usize`.
+///
+/// On targets where `usize` is at least 32 bits wide, this never panics.
+///
+/// Unlike `as`, this does not silently truncate on narrow `usize` targets.
+/// Unlike `usize::try_from(...).unwrap()`, this works in `const` contexts.
 pub const fn usize_from_u32(val: u32) -> usize {
-    // This is essentially the same as `usize::try_from(val).unwrap()`, but
-    // works in a `const` context on stable.
-    if size_of::<usize>() < size_of::<u32>() && val < (usize::MAX as u32) {
-        panic!("value does not fit in a usize");
-    } else {
-        val as usize
+    if size_of::<usize>() < size_of::<u32>() && val > usize::MAX as u32 {
+        panic!("value does not fit in usize");
     }
+
+    val as usize
 }
 
 /// Get the raw pointer from `opt`, defaulting to `null_mut`.