1// SPDX-License-Identifier: GPL-2.0
  2
  3//! String representations.
  4
  5use crate::alloc::{flags::*, AllocError, KVec};
  6use core::fmt::{self, Write};
  7use core::ops::{self, Deref, DerefMut, Index};
  8
  9use crate::error::{code::*, Error};
 10
 11/// Byte string without UTF-8 validity guarantee.
 12#[repr(transparent)]
 13pub struct BStr([u8]);
 14
 15impl BStr {
 16    /// Returns the length of this string.
 17    #[inline]
 18    pub const fn len(&self) -> usize {
 19        self.0.len()
 20    }
 21
 22    /// Returns `true` if the string is empty.
 23    #[inline]
 24    pub const fn is_empty(&self) -> bool {
 25        self.len() == 0
 26    }
 27
 28    /// Creates a [`BStr`] from a `[u8]`.
 29    #[inline]
 30    pub const fn from_bytes(bytes: &[u8]) -> &Self {
 31        // SAFETY: `BStr` is transparent to `[u8]`.
 32        unsafe { &*(bytes as *const [u8] as *const BStr) }
 33    }
 34}
 35
 36impl fmt::Display for BStr {
 37    /// Formats printable ASCII characters, escaping the rest.
 38    ///
 39    /// ```
 40    /// # use kernel::{fmt, b_str, str::{BStr, CString}};
 41    /// let ascii = b_str!("Hello, BStr!");
 42    /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap();
 43    /// assert_eq!(s.as_bytes(), "Hello, BStr!".as_bytes());
 44    ///
 45    /// let non_ascii = b_str!("🦀");
 46    /// let s = CString::try_from_fmt(fmt!("{}", non_ascii)).unwrap();
 47    /// assert_eq!(s.as_bytes(), "\\xf0\\x9f\\xa6\\x80".as_bytes());
 48    /// ```
 49    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
 50        for &b in &self.0 {
 51            match b {
 52                // Common escape codes.
 53                b'\t' => f.write_str("\\t")?,
 54                b'\n' => f.write_str("\\n")?,
 55                b'\r' => f.write_str("\\r")?,
 56                // Printable characters.
 57                0x20..=0x7e => f.write_char(b as char)?,
 58                _ => write!(f, "\\x{:02x}", b)?,
 59            }
 60        }
 61        Ok(())
 62    }
 63}
 64
 65impl fmt::Debug for BStr {
 66    /// Formats printable ASCII characters with a double quote on either end,
 67    /// escaping the rest.
 68    ///
 69    /// ```
 70    /// # use kernel::{fmt, b_str, str::{BStr, CString}};
 71    /// // Embedded double quotes are escaped.
 72    /// let ascii = b_str!("Hello, \"BStr\"!");
 73    /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap();
 74    /// assert_eq!(s.as_bytes(), "\"Hello, \\\"BStr\\\"!\"".as_bytes());
 75    ///
 76    /// let non_ascii = b_str!("😺");
 77    /// let s = CString::try_from_fmt(fmt!("{:?}", non_ascii)).unwrap();
 78    /// assert_eq!(s.as_bytes(), "\"\\xf0\\x9f\\x98\\xba\"".as_bytes());
 79    /// ```
 80    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
 81        f.write_char('"')?;
 82        for &b in &self.0 {
 83            match b {
 84                // Common escape codes.
 85                b'\t' => f.write_str("\\t")?,
 86                b'\n' => f.write_str("\\n")?,
 87                b'\r' => f.write_str("\\r")?,
 88                // String escape characters.
 89                b'\"' => f.write_str("\\\"")?,
 90                b'\\' => f.write_str("\\\\")?,
 91                // Printable characters.
 92                0x20..=0x7e => f.write_char(b as char)?,
 93                _ => write!(f, "\\x{:02x}", b)?,
 94            }
 95        }
 96        f.write_char('"')
 97    }
 98}
 99
100impl Deref for BStr {
101    type Target = [u8];
102
103    #[inline]
104    fn deref(&self) -> &Self::Target {
105        &self.0
106    }
107}
108
109/// Creates a new [`BStr`] from a string literal.
110///
111/// `b_str!` converts the supplied string literal to byte string, so non-ASCII
112/// characters can be included.
113///
114/// # Examples
115///
116/// ```
117/// # use kernel::b_str;
118/// # use kernel::str::BStr;
119/// const MY_BSTR: &BStr = b_str!("My awesome BStr!");
120/// ```
121#[macro_export]
122macro_rules! b_str {
123    ($str:literal) => {{
124        const S: &'static str = $str;
125        const C: &'static $crate::str::BStr = $crate::str::BStr::from_bytes(S.as_bytes());
126        C
127    }};
128}
129
130/// Possible errors when using conversion functions in [`CStr`].
131#[derive(Debug, Clone, Copy)]
132pub enum CStrConvertError {
133    /// Supplied bytes contain an interior `NUL`.
134    InteriorNul,
135
136    /// Supplied bytes are not terminated by `NUL`.
137    NotNulTerminated,
138}
139
140impl From<CStrConvertError> for Error {
141    #[inline]
142    fn from(_: CStrConvertError) -> Error {
143        EINVAL
144    }
145}
146
147/// A string that is guaranteed to have exactly one `NUL` byte, which is at the
148/// end.
149///
150/// Used for interoperability with kernel APIs that take C strings.
151#[repr(transparent)]
152pub struct CStr([u8]);
153
154impl CStr {
155    /// Returns the length of this string excluding `NUL`.
156    #[inline]
157    pub const fn len(&self) -> usize {
158        self.len_with_nul() - 1
159    }
160
161    /// Returns the length of this string with `NUL`.
162    #[inline]
163    pub const fn len_with_nul(&self) -> usize {
164        if self.0.is_empty() {
165            // SAFETY: This is one of the invariant of `CStr`.
166            // We add a `unreachable_unchecked` here to hint the optimizer that
167            // the value returned from this function is non-zero.
168            unsafe { core::hint::unreachable_unchecked() };
169        }
170        self.0.len()
171    }
172
173    /// Returns `true` if the string only includes `NUL`.
174    #[inline]
175    pub const fn is_empty(&self) -> bool {
176        self.len() == 0
177    }
178
179    /// Wraps a raw C string pointer.
180    ///
181    /// # Safety
182    ///
183    /// `ptr` must be a valid pointer to a `NUL`-terminated C string, and it must
184    /// last at least `'a`. When `CStr` is alive, the memory pointed by `ptr`
185    /// must not be mutated.
186    #[inline]
187    pub unsafe fn from_char_ptr<'a>(ptr: *const crate::ffi::c_char) -> &'a Self {
188        // SAFETY: The safety precondition guarantees `ptr` is a valid pointer
189        // to a `NUL`-terminated C string.
190        let len = unsafe { bindings::strlen(ptr) } + 1;
191        // SAFETY: Lifetime guaranteed by the safety precondition.
192        let bytes = unsafe { core::slice::from_raw_parts(ptr as _, len) };
193        // SAFETY: As `len` is returned by `strlen`, `bytes` does not contain interior `NUL`.
194        // As we have added 1 to `len`, the last byte is known to be `NUL`.
195        unsafe { Self::from_bytes_with_nul_unchecked(bytes) }
196    }
197
198    /// Creates a [`CStr`] from a `[u8]`.
199    ///
200    /// The provided slice must be `NUL`-terminated, does not contain any
201    /// interior `NUL` bytes.
202    pub const fn from_bytes_with_nul(bytes: &[u8]) -> Result<&Self, CStrConvertError> {
203        if bytes.is_empty() {
204            return Err(CStrConvertError::NotNulTerminated);
205        }
206        if bytes[bytes.len() - 1] != 0 {
207            return Err(CStrConvertError::NotNulTerminated);
208        }
209        let mut i = 0;
210        // `i + 1 < bytes.len()` allows LLVM to optimize away bounds checking,
211        // while it couldn't optimize away bounds checks for `i < bytes.len() - 1`.
212        while i + 1 < bytes.len() {
213            if bytes[i] == 0 {
214                return Err(CStrConvertError::InteriorNul);
215            }
216            i += 1;
217        }
218        // SAFETY: We just checked that all properties hold.
219        Ok(unsafe { Self::from_bytes_with_nul_unchecked(bytes) })
220    }
221
222    /// Creates a [`CStr`] from a `[u8]` without performing any additional
223    /// checks.
224    ///
225    /// # Safety
226    ///
227    /// `bytes` *must* end with a `NUL` byte, and should only have a single
228    /// `NUL` byte (or the string will be truncated).
229    #[inline]
230    pub const unsafe fn from_bytes_with_nul_unchecked(bytes: &[u8]) -> &CStr {
231        // SAFETY: Properties of `bytes` guaranteed by the safety precondition.
232        unsafe { core::mem::transmute(bytes) }
233    }
234
235    /// Creates a mutable [`CStr`] from a `[u8]` without performing any
236    /// additional checks.
237    ///
238    /// # Safety
239    ///
240    /// `bytes` *must* end with a `NUL` byte, and should only have a single
241    /// `NUL` byte (or the string will be truncated).
242    #[inline]
243    pub unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut CStr {
244        // SAFETY: Properties of `bytes` guaranteed by the safety precondition.
245        unsafe { &mut *(bytes as *mut [u8] as *mut CStr) }
246    }
247
248    /// Returns a C pointer to the string.
249    #[inline]
250    pub const fn as_char_ptr(&self) -> *const crate::ffi::c_char {
251        self.0.as_ptr()
252    }
253
254    /// Convert the string to a byte slice without the trailing `NUL` byte.
255    #[inline]
256    pub fn as_bytes(&self) -> &[u8] {
257        &self.0[..self.len()]
258    }
259
260    /// Convert the string to a byte slice containing the trailing `NUL` byte.
261    #[inline]
262    pub const fn as_bytes_with_nul(&self) -> &[u8] {
263        &self.0
264    }
265
266    /// Yields a [`&str`] slice if the [`CStr`] contains valid UTF-8.
267    ///
268    /// If the contents of the [`CStr`] are valid UTF-8 data, this
269    /// function will return the corresponding [`&str`] slice. Otherwise,
270    /// it will return an error with details of where UTF-8 validation failed.
271    ///
272    /// # Examples
273    ///
274    /// ```
275    /// # use kernel::str::CStr;
276    /// let cstr = CStr::from_bytes_with_nul(b"foo\0").unwrap();
277    /// assert_eq!(cstr.to_str(), Ok("foo"));
278    /// ```
279    #[inline]
280    pub fn to_str(&self) -> Result<&str, core::str::Utf8Error> {
281        core::str::from_utf8(self.as_bytes())
282    }
283
284    /// Unsafely convert this [`CStr`] into a [`&str`], without checking for
285    /// valid UTF-8.
286    ///
287    /// # Safety
288    ///
289    /// The contents must be valid UTF-8.
290    ///
291    /// # Examples
292    ///
293    /// ```
294    /// # use kernel::c_str;
295    /// # use kernel::str::CStr;
296    /// let bar = c_str!("ツ");
297    /// // SAFETY: String literals are guaranteed to be valid UTF-8
298    /// // by the Rust compiler.
299    /// assert_eq!(unsafe { bar.as_str_unchecked() }, "ツ");
300    /// ```
301    #[inline]
302    pub unsafe fn as_str_unchecked(&self) -> &str {
303        // SAFETY: TODO.
304        unsafe { core::str::from_utf8_unchecked(self.as_bytes()) }
305    }
306
307    /// Convert this [`CStr`] into a [`CString`] by allocating memory and
308    /// copying over the string data.
309    pub fn to_cstring(&self) -> Result<CString, AllocError> {
310        CString::try_from(self)
311    }
312
313    /// Converts this [`CStr`] to its ASCII lower case equivalent in-place.
314    ///
315    /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z',
316    /// but non-ASCII letters are unchanged.
317    ///
318    /// To return a new lowercased value without modifying the existing one, use
319    /// [`to_ascii_lowercase()`].
320    ///
321    /// [`to_ascii_lowercase()`]: #method.to_ascii_lowercase
322    pub fn make_ascii_lowercase(&mut self) {
323        // INVARIANT: This doesn't introduce or remove NUL bytes in the C
324        // string.
325        self.0.make_ascii_lowercase();
326    }
327
328    /// Converts this [`CStr`] to its ASCII upper case equivalent in-place.
329    ///
330    /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z',
331    /// but non-ASCII letters are unchanged.
332    ///
333    /// To return a new uppercased value without modifying the existing one, use
334    /// [`to_ascii_uppercase()`].
335    ///
336    /// [`to_ascii_uppercase()`]: #method.to_ascii_uppercase
337    pub fn make_ascii_uppercase(&mut self) {
338        // INVARIANT: This doesn't introduce or remove NUL bytes in the C
339        // string.
340        self.0.make_ascii_uppercase();
341    }
342
343    /// Returns a copy of this [`CString`] where each character is mapped to its
344    /// ASCII lower case equivalent.
345    ///
346    /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z',
347    /// but non-ASCII letters are unchanged.
348    ///
349    /// To lowercase the value in-place, use [`make_ascii_lowercase`].
350    ///
351    /// [`make_ascii_lowercase`]: str::make_ascii_lowercase
352    pub fn to_ascii_lowercase(&self) -> Result<CString, AllocError> {
353        let mut s = self.to_cstring()?;
354
355        s.make_ascii_lowercase();
356
357        Ok(s)
358    }
359
360    /// Returns a copy of this [`CString`] where each character is mapped to its
361    /// ASCII upper case equivalent.
362    ///
363    /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z',
364    /// but non-ASCII letters are unchanged.
365    ///
366    /// To uppercase the value in-place, use [`make_ascii_uppercase`].
367    ///
368    /// [`make_ascii_uppercase`]: str::make_ascii_uppercase
369    pub fn to_ascii_uppercase(&self) -> Result<CString, AllocError> {
370        let mut s = self.to_cstring()?;
371
372        s.make_ascii_uppercase();
373
374        Ok(s)
375    }
376}
377
378impl fmt::Display for CStr {
379    /// Formats printable ASCII characters, escaping the rest.
380    ///
381    /// ```
382    /// # use kernel::c_str;
383    /// # use kernel::fmt;
384    /// # use kernel::str::CStr;
385    /// # use kernel::str::CString;
386    /// let penguin = c_str!("🐧");
387    /// let s = CString::try_from_fmt(fmt!("{}", penguin)).unwrap();
388    /// assert_eq!(s.as_bytes_with_nul(), "\\xf0\\x9f\\x90\\xa7\0".as_bytes());
389    ///
390    /// let ascii = c_str!("so \"cool\"");
391    /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap();
392    /// assert_eq!(s.as_bytes_with_nul(), "so \"cool\"\0".as_bytes());
393    /// ```
394    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
395        for &c in self.as_bytes() {
396            if (0x20..0x7f).contains(&c) {
397                // Printable character.
398                f.write_char(c as char)?;
399            } else {
400                write!(f, "\\x{:02x}", c)?;
401            }
402        }
403        Ok(())
404    }
405}
406
407impl fmt::Debug for CStr {
408    /// Formats printable ASCII characters with a double quote on either end, escaping the rest.
409    ///
410    /// ```
411    /// # use kernel::c_str;
412    /// # use kernel::fmt;
413    /// # use kernel::str::CStr;
414    /// # use kernel::str::CString;
415    /// let penguin = c_str!("🐧");
416    /// let s = CString::try_from_fmt(fmt!("{:?}", penguin)).unwrap();
417    /// assert_eq!(s.as_bytes_with_nul(), "\"\\xf0\\x9f\\x90\\xa7\"\0".as_bytes());
418    ///
419    /// // Embedded double quotes are escaped.
420    /// let ascii = c_str!("so \"cool\"");
421    /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap();
422    /// assert_eq!(s.as_bytes_with_nul(), "\"so \\\"cool\\\"\"\0".as_bytes());
423    /// ```
424    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
425        f.write_str("\"")?;
426        for &c in self.as_bytes() {
427            match c {
428                // Printable characters.
429                b'\"' => f.write_str("\\\"")?,
430                0x20..=0x7e => f.write_char(c as char)?,
431                _ => write!(f, "\\x{:02x}", c)?,
432            }
433        }
434        f.write_str("\"")
435    }
436}
437
438impl AsRef<BStr> for CStr {
439    #[inline]
440    fn as_ref(&self) -> &BStr {
441        BStr::from_bytes(self.as_bytes())
442    }
443}
444
445impl Deref for CStr {
446    type Target = BStr;
447
448    #[inline]
449    fn deref(&self) -> &Self::Target {
450        self.as_ref()
451    }
452}
453
454impl Index<ops::RangeFrom<usize>> for CStr {
455    type Output = CStr;
456
457    #[inline]
458    fn index(&self, index: ops::RangeFrom<usize>) -> &Self::Output {
459        // Delegate bounds checking to slice.
460        // Assign to _ to mute clippy's unnecessary operation warning.
461        let _ = &self.as_bytes()[index.start..];
462        // SAFETY: We just checked the bounds.
463        unsafe { Self::from_bytes_with_nul_unchecked(&self.0[index.start..]) }
464    }
465}
466
467impl Index<ops::RangeFull> for CStr {
468    type Output = CStr;
469
470    #[inline]
471    fn index(&self, _index: ops::RangeFull) -> &Self::Output {
472        self
473    }
474}
475
476mod private {
477    use core::ops;
478
479    // Marker trait for index types that can be forward to `BStr`.
480    pub trait CStrIndex {}
481
482    impl CStrIndex for usize {}
483    impl CStrIndex for ops::Range<usize> {}
484    impl CStrIndex for ops::RangeInclusive<usize> {}
485    impl CStrIndex for ops::RangeToInclusive<usize> {}
486}
487
488impl<Idx> Index<Idx> for CStr
489where
490    Idx: private::CStrIndex,
491    BStr: Index<Idx>,
492{
493    type Output = <BStr as Index<Idx>>::Output;
494
495    #[inline]
496    fn index(&self, index: Idx) -> &Self::Output {
497        &self.as_ref()[index]
498    }
499}
500
501/// Creates a new [`CStr`] from a string literal.
502///
503/// The string literal should not contain any `NUL` bytes.
504///
505/// # Examples
506///
507/// ```
508/// # use kernel::c_str;
509/// # use kernel::str::CStr;
510/// const MY_CSTR: &CStr = c_str!("My awesome CStr!");
511/// ```
512#[macro_export]
513macro_rules! c_str {
514    ($str:expr) => {{
515        const S: &str = concat!($str, "\0");
516        const C: &$crate::str::CStr = match $crate::str::CStr::from_bytes_with_nul(S.as_bytes()) {
517            Ok(v) => v,
518            Err(_) => panic!("string contains interior NUL"),
519        };
520        C
521    }};
522}
523
524#[cfg(test)]
525mod tests {
526    use super::*;
527
528    struct String(CString);
529
530    impl String {
531        fn from_fmt(args: fmt::Arguments<'_>) -> Self {
532            String(CString::try_from_fmt(args).unwrap())
533        }
534    }
535
536    impl Deref for String {
537        type Target = str;
538
539        fn deref(&self) -> &str {
540            self.0.to_str().unwrap()
541        }
542    }
543
544    macro_rules! format {
545        ($($f:tt)*) => ({
546            &*String::from_fmt(kernel::fmt!($($f)*))
547        })
548    }
549
550    const ALL_ASCII_CHARS: &'static str =
551        "\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\
552        \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f \
553        !\"#$%&'()*+,-./0123456789:;<=>?@\
554        ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\\x7f\
555        \\x80\\x81\\x82\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8a\\x8b\\x8c\\x8d\\x8e\\x8f\
556        \\x90\\x91\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9a\\x9b\\x9c\\x9d\\x9e\\x9f\
557        \\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\xa7\\xa8\\xa9\\xaa\\xab\\xac\\xad\\xae\\xaf\
558        \\xb0\\xb1\\xb2\\xb3\\xb4\\xb5\\xb6\\xb7\\xb8\\xb9\\xba\\xbb\\xbc\\xbd\\xbe\\xbf\
559        \\xc0\\xc1\\xc2\\xc3\\xc4\\xc5\\xc6\\xc7\\xc8\\xc9\\xca\\xcb\\xcc\\xcd\\xce\\xcf\
560        \\xd0\\xd1\\xd2\\xd3\\xd4\\xd5\\xd6\\xd7\\xd8\\xd9\\xda\\xdb\\xdc\\xdd\\xde\\xdf\
561        \\xe0\\xe1\\xe2\\xe3\\xe4\\xe5\\xe6\\xe7\\xe8\\xe9\\xea\\xeb\\xec\\xed\\xee\\xef\
562        \\xf0\\xf1\\xf2\\xf3\\xf4\\xf5\\xf6\\xf7\\xf8\\xf9\\xfa\\xfb\\xfc\\xfd\\xfe\\xff";
563
564    #[test]
565    fn test_cstr_to_str() {
566        let good_bytes = b"\xf0\x9f\xa6\x80\0";
567        let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap();
568        let checked_str = checked_cstr.to_str().unwrap();
569        assert_eq!(checked_str, "🦀");
570    }
571
572    #[test]
573    #[should_panic]
574    fn test_cstr_to_str_panic() {
575        let bad_bytes = b"\xc3\x28\0";
576        let checked_cstr = CStr::from_bytes_with_nul(bad_bytes).unwrap();
577        checked_cstr.to_str().unwrap();
578    }
579
580    #[test]
581    fn test_cstr_as_str_unchecked() {
582        let good_bytes = b"\xf0\x9f\x90\xA7\0";
583        let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap();
584        let unchecked_str = unsafe { checked_cstr.as_str_unchecked() };
585        assert_eq!(unchecked_str, "🐧");
586    }
587
588    #[test]
589    fn test_cstr_display() {
590        let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap();
591        assert_eq!(format!("{}", hello_world), "hello, world!");
592        let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap();
593        assert_eq!(format!("{}", non_printables), "\\x01\\x09\\x0a");
594        let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap();
595        assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu");
596        let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap();
597        assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80");
598    }
599
600    #[test]
601    fn test_cstr_display_all_bytes() {
602        let mut bytes: [u8; 256] = [0; 256];
603        // fill `bytes` with [1..=255] + [0]
604        for i in u8::MIN..=u8::MAX {
605            bytes[i as usize] = i.wrapping_add(1);
606        }
607        let cstr = CStr::from_bytes_with_nul(&bytes).unwrap();
608        assert_eq!(format!("{}", cstr), ALL_ASCII_CHARS);
609    }
610
611    #[test]
612    fn test_cstr_debug() {
613        let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap();
614        assert_eq!(format!("{:?}", hello_world), "\"hello, world!\"");
615        let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap();
616        assert_eq!(format!("{:?}", non_printables), "\"\\x01\\x09\\x0a\"");
617        let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap();
618        assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\"");
619        let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap();
620        assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\"");
621    }
622
623    #[test]
624    fn test_bstr_display() {
625        let hello_world = BStr::from_bytes(b"hello, world!");
626        assert_eq!(format!("{}", hello_world), "hello, world!");
627        let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");
628        assert_eq!(format!("{}", escapes), "_\\t_\\n_\\r_\\_'_\"_");
629        let others = BStr::from_bytes(b"\x01");
630        assert_eq!(format!("{}", others), "\\x01");
631        let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");
632        assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu");
633        let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");
634        assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80");
635    }
636
637    #[test]
638    fn test_bstr_debug() {
639        let hello_world = BStr::from_bytes(b"hello, world!");
640        assert_eq!(format!("{:?}", hello_world), "\"hello, world!\"");
641        let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");
642        assert_eq!(format!("{:?}", escapes), "\"_\\t_\\n_\\r_\\\\_'_\\\"_\"");
643        let others = BStr::from_bytes(b"\x01");
644        assert_eq!(format!("{:?}", others), "\"\\x01\"");
645        let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");
646        assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\"");
647        let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");
648        assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\"");
649    }
650}
651
652/// Allows formatting of [`fmt::Arguments`] into a raw buffer.
653///
654/// It does not fail if callers write past the end of the buffer so that they can calculate the
655/// size required to fit everything.
656///
657/// # Invariants
658///
659/// The memory region between `pos` (inclusive) and `end` (exclusive) is valid for writes if `pos`
660/// is less than `end`.
661pub(crate) struct RawFormatter {
662    // Use `usize` to use `saturating_*` functions.
663    beg: usize,
664    pos: usize,
665    end: usize,
666}
667
668impl RawFormatter {
669    /// Creates a new instance of [`RawFormatter`] with an empty buffer.
670    fn new() -> Self {
671        // INVARIANT: The buffer is empty, so the region that needs to be writable is empty.
672        Self {
673            beg: 0,
674            pos: 0,
675            end: 0,
676        }
677    }
678
679    /// Creates a new instance of [`RawFormatter`] with the given buffer pointers.
680    ///
681    /// # Safety
682    ///
683    /// If `pos` is less than `end`, then the region between `pos` (inclusive) and `end`
684    /// (exclusive) must be valid for writes for the lifetime of the returned [`RawFormatter`].
685    pub(crate) unsafe fn from_ptrs(pos: *mut u8, end: *mut u8) -> Self {
686        // INVARIANT: The safety requirements guarantee the type invariants.
687        Self {
688            beg: pos as _,
689            pos: pos as _,
690            end: end as _,
691        }
692    }
693
694    /// Creates a new instance of [`RawFormatter`] with the given buffer.
695    ///
696    /// # Safety
697    ///
698    /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes
699    /// for the lifetime of the returned [`RawFormatter`].
700    pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {
701        let pos = buf as usize;
702        // INVARIANT: We ensure that `end` is never less then `buf`, and the safety requirements
703        // guarantees that the memory region is valid for writes.
704        Self {
705            pos,
706            beg: pos,
707            end: pos.saturating_add(len),
708        }
709    }
710
711    /// Returns the current insert position.
712    ///
713    /// N.B. It may point to invalid memory.
714    pub(crate) fn pos(&self) -> *mut u8 {
715        self.pos as _
716    }
717
718    /// Returns the number of bytes written to the formatter.
719    pub(crate) fn bytes_written(&self) -> usize {
720        self.pos - self.beg
721    }
722}
723
724impl fmt::Write for RawFormatter {
725    fn write_str(&mut self, s: &str) -> fmt::Result {
726        // `pos` value after writing `len` bytes. This does not have to be bounded by `end`, but we
727        // don't want it to wrap around to 0.
728        let pos_new = self.pos.saturating_add(s.len());
729
730        // Amount that we can copy. `saturating_sub` ensures we get 0 if `pos` goes past `end`.
731        let len_to_copy = core::cmp::min(pos_new, self.end).saturating_sub(self.pos);
732
733        if len_to_copy > 0 {
734            // SAFETY: If `len_to_copy` is non-zero, then we know `pos` has not gone past `end`
735            // yet, so it is valid for write per the type invariants.
736            unsafe {
737                core::ptr::copy_nonoverlapping(
738                    s.as_bytes().as_ptr(),
739                    self.pos as *mut u8,
740                    len_to_copy,
741                )
742            };
743        }
744
745        self.pos = pos_new;
746        Ok(())
747    }
748}
749
750/// Allows formatting of [`fmt::Arguments`] into a raw buffer.
751///
752/// Fails if callers attempt to write more than will fit in the buffer.
753pub(crate) struct Formatter(RawFormatter);
754
755impl Formatter {
756    /// Creates a new instance of [`Formatter`] with the given buffer.
757    ///
758    /// # Safety
759    ///
760    /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes
761    /// for the lifetime of the returned [`Formatter`].
762    pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {
763        // SAFETY: The safety requirements of this function satisfy those of the callee.
764        Self(unsafe { RawFormatter::from_buffer(buf, len) })
765    }
766}
767
768impl Deref for Formatter {
769    type Target = RawFormatter;
770
771    fn deref(&self) -> &Self::Target {
772        &self.0
773    }
774}
775
776impl fmt::Write for Formatter {
777    fn write_str(&mut self, s: &str) -> fmt::Result {
778        self.0.write_str(s)?;
779
780        // Fail the request if we go past the end of the buffer.
781        if self.0.pos > self.0.end {
782            Err(fmt::Error)
783        } else {
784            Ok(())
785        }
786    }
787}
788
789/// An owned string that is guaranteed to have exactly one `NUL` byte, which is at the end.
790///
791/// Used for interoperability with kernel APIs that take C strings.
792///
793/// # Invariants
794///
795/// The string is always `NUL`-terminated and contains no other `NUL` bytes.
796///
797/// # Examples
798///
799/// ```
800/// use kernel::{str::CString, fmt};
801///
802/// let s = CString::try_from_fmt(fmt!("{}{}{}", "abc", 10, 20)).unwrap();
803/// assert_eq!(s.as_bytes_with_nul(), "abc1020\0".as_bytes());
804///
805/// let tmp = "testing";
806/// let s = CString::try_from_fmt(fmt!("{tmp}{}", 123)).unwrap();
807/// assert_eq!(s.as_bytes_with_nul(), "testing123\0".as_bytes());
808///
809/// // This fails because it has an embedded `NUL` byte.
810/// let s = CString::try_from_fmt(fmt!("a\0b{}", 123));
811/// assert_eq!(s.is_ok(), false);
812/// ```
813pub struct CString {
814    buf: KVec<u8>,
815}
816
817impl CString {
818    /// Creates an instance of [`CString`] from the given formatted arguments.
819    pub fn try_from_fmt(args: fmt::Arguments<'_>) -> Result<Self, Error> {
820        // Calculate the size needed (formatted string plus `NUL` terminator).
821        let mut f = RawFormatter::new();
822        f.write_fmt(args)?;
823        f.write_str("\0")?;
824        let size = f.bytes_written();
825
826        // Allocate a vector with the required number of bytes, and write to it.
827        let mut buf = KVec::with_capacity(size, GFP_KERNEL)?;
828        // SAFETY: The buffer stored in `buf` is at least of size `size` and is valid for writes.
829        let mut f = unsafe { Formatter::from_buffer(buf.as_mut_ptr(), size) };
830        f.write_fmt(args)?;
831        f.write_str("\0")?;
832
833        // SAFETY: The number of bytes that can be written to `f` is bounded by `size`, which is
834        // `buf`'s capacity. The contents of the buffer have been initialised by writes to `f`.
835        unsafe { buf.set_len(f.bytes_written()) };
836
837        // Check that there are no `NUL` bytes before the end.
838        // SAFETY: The buffer is valid for read because `f.bytes_written()` is bounded by `size`
839        // (which the minimum buffer size) and is non-zero (we wrote at least the `NUL` terminator)
840        // so `f.bytes_written() - 1` doesn't underflow.
841        let ptr = unsafe { bindings::memchr(buf.as_ptr().cast(), 0, f.bytes_written() - 1) };
842        if !ptr.is_null() {
843            return Err(EINVAL);
844        }
845
846        // INVARIANT: We wrote the `NUL` terminator and checked above that no other `NUL` bytes
847        // exist in the buffer.
848        Ok(Self { buf })
849    }
850}
851
852impl Deref for CString {
853    type Target = CStr;
854
855    fn deref(&self) -> &Self::Target {
856        // SAFETY: The type invariants guarantee that the string is `NUL`-terminated and that no
857        // other `NUL` bytes exist.
858        unsafe { CStr::from_bytes_with_nul_unchecked(self.buf.as_slice()) }
859    }
860}
861
862impl DerefMut for CString {
863    fn deref_mut(&mut self) -> &mut Self::Target {
864        // SAFETY: A `CString` is always NUL-terminated and contains no other
865        // NUL bytes.
866        unsafe { CStr::from_bytes_with_nul_unchecked_mut(self.buf.as_mut_slice()) }
867    }
868}
869
870impl<'a> TryFrom<&'a CStr> for CString {
871    type Error = AllocError;
872
873    fn try_from(cstr: &'a CStr) -> Result<CString, AllocError> {
874        let mut buf = KVec::new();
875
876        buf.extend_from_slice(cstr.as_bytes_with_nul(), GFP_KERNEL)?;
877
878        // INVARIANT: The `CStr` and `CString` types have the same invariants for
879        // the string data, and we copied it over without changes.
880        Ok(CString { buf })
881    }
882}
883
884impl fmt::Debug for CString {
885    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
886        fmt::Debug::fmt(&**self, f)
887    }
888}
889
890/// A convenience alias for [`core::format_args`].
891#[macro_export]
892macro_rules! fmt {
893    ($($f:tt)*) => ( core::format_args!($($f)*) )
894}