1// SPDX-License-Identifier: GPL-2.0
  2
  3//! String representations.
  4
  5use alloc::alloc::AllocError;
  6use alloc::vec::Vec;
  7use core::fmt::{self, Write};
  8use core::ops::{self, Deref, Index};
  9
 10use crate::{
 11    bindings,
 12    error::{code::*, Error},
 13};
 14
 15/// Byte string without UTF-8 validity guarantee.
 16#[repr(transparent)]
 17pub struct BStr([u8]);
 18
 19impl BStr {
 20    /// Returns the length of this string.
 21    #[inline]
 22    pub const fn len(&self) -> usize {
 23        self.0.len()
 24    }
 25
 26    /// Returns `true` if the string is empty.
 27    #[inline]
 28    pub const fn is_empty(&self) -> bool {
 29        self.len() == 0
 30    }
 31
 32    /// Creates a [`BStr`] from a `[u8]`.
 33    #[inline]
 34    pub const fn from_bytes(bytes: &[u8]) -> &Self {
 35        // SAFETY: `BStr` is transparent to `[u8]`.
 36        unsafe { &*(bytes as *const [u8] as *const BStr) }
 37    }
 38}
 39
 40impl fmt::Display for BStr {
 41    /// Formats printable ASCII characters, escaping the rest.
 42    ///
 43    /// ```
 44    /// # use kernel::{fmt, b_str, str::{BStr, CString}};
 45    /// let ascii = b_str!("Hello, BStr!");
 46    /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap();
 47    /// assert_eq!(s.as_bytes(), "Hello, BStr!".as_bytes());
 48    ///
 49    /// let non_ascii = b_str!("🦀");
 50    /// let s = CString::try_from_fmt(fmt!("{}", non_ascii)).unwrap();
 51    /// assert_eq!(s.as_bytes(), "\\xf0\\x9f\\xa6\\x80".as_bytes());
 52    /// ```
 53    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
 54        for &b in &self.0 {
 55            match b {
 56                // Common escape codes.
 57                b'\t' => f.write_str("\\t")?,
 58                b'\n' => f.write_str("\\n")?,
 59                b'\r' => f.write_str("\\r")?,
 60                // Printable characters.
 61                0x20..=0x7e => f.write_char(b as char)?,
 62                _ => write!(f, "\\x{:02x}", b)?,
 63            }
 64        }
 65        Ok(())
 66    }
 67}
 68
 69impl fmt::Debug for BStr {
 70    /// Formats printable ASCII characters with a double quote on either end,
 71    /// escaping the rest.
 72    ///
 73    /// ```
 74    /// # use kernel::{fmt, b_str, str::{BStr, CString}};
 75    /// // Embedded double quotes are escaped.
 76    /// let ascii = b_str!("Hello, \"BStr\"!");
 77    /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap();
 78    /// assert_eq!(s.as_bytes(), "\"Hello, \\\"BStr\\\"!\"".as_bytes());
 79    ///
 80    /// let non_ascii = b_str!("😺");
 81    /// let s = CString::try_from_fmt(fmt!("{:?}", non_ascii)).unwrap();
 82    /// assert_eq!(s.as_bytes(), "\"\\xf0\\x9f\\x98\\xba\"".as_bytes());
 83    /// ```
 84    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
 85        f.write_char('"')?;
 86        for &b in &self.0 {
 87            match b {
 88                // Common escape codes.
 89                b'\t' => f.write_str("\\t")?,
 90                b'\n' => f.write_str("\\n")?,
 91                b'\r' => f.write_str("\\r")?,
 92                // String escape characters.
 93                b'\"' => f.write_str("\\\"")?,
 94                b'\\' => f.write_str("\\\\")?,
 95                // Printable characters.
 96                0x20..=0x7e => f.write_char(b as char)?,
 97                _ => write!(f, "\\x{:02x}", b)?,
 98            }
 99        }
100        f.write_char('"')
101    }
102}
103
104impl Deref for BStr {
105    type Target = [u8];
106
107    #[inline]
108    fn deref(&self) -> &Self::Target {
109        &self.0
110    }
111}
112
113/// Creates a new [`BStr`] from a string literal.
114///
115/// `b_str!` converts the supplied string literal to byte string, so non-ASCII
116/// characters can be included.
117///
118/// # Examples
119///
120/// ```
121/// # use kernel::b_str;
122/// # use kernel::str::BStr;
123/// const MY_BSTR: &BStr = b_str!("My awesome BStr!");
124/// ```
125#[macro_export]
126macro_rules! b_str {
127    ($str:literal) => {{
128        const S: &'static str = $str;
129        const C: &'static $crate::str::BStr = $crate::str::BStr::from_bytes(S.as_bytes());
130        C
131    }};
132}
133
134/// Possible errors when using conversion functions in [`CStr`].
135#[derive(Debug, Clone, Copy)]
136pub enum CStrConvertError {
137    /// Supplied bytes contain an interior `NUL`.
138    InteriorNul,
139
140    /// Supplied bytes are not terminated by `NUL`.
141    NotNulTerminated,
142}
143
144impl From<CStrConvertError> for Error {
145    #[inline]
146    fn from(_: CStrConvertError) -> Error {
147        EINVAL
148    }
149}
150
151/// A string that is guaranteed to have exactly one `NUL` byte, which is at the
152/// end.
153///
154/// Used for interoperability with kernel APIs that take C strings.
155#[repr(transparent)]
156pub struct CStr([u8]);
157
158impl CStr {
159    /// Returns the length of this string excluding `NUL`.
160    #[inline]
161    pub const fn len(&self) -> usize {
162        self.len_with_nul() - 1
163    }
164
165    /// Returns the length of this string with `NUL`.
166    #[inline]
167    pub const fn len_with_nul(&self) -> usize {
168        // SAFETY: This is one of the invariant of `CStr`.
169        // We add a `unreachable_unchecked` here to hint the optimizer that
170        // the value returned from this function is non-zero.
171        if self.0.is_empty() {
172            unsafe { core::hint::unreachable_unchecked() };
173        }
174        self.0.len()
175    }
176
177    /// Returns `true` if the string only includes `NUL`.
178    #[inline]
179    pub const fn is_empty(&self) -> bool {
180        self.len() == 0
181    }
182
183    /// Wraps a raw C string pointer.
184    ///
185    /// # Safety
186    ///
187    /// `ptr` must be a valid pointer to a `NUL`-terminated C string, and it must
188    /// last at least `'a`. When `CStr` is alive, the memory pointed by `ptr`
189    /// must not be mutated.
190    #[inline]
191    pub unsafe fn from_char_ptr<'a>(ptr: *const core::ffi::c_char) -> &'a Self {
192        // SAFETY: The safety precondition guarantees `ptr` is a valid pointer
193        // to a `NUL`-terminated C string.
194        let len = unsafe { bindings::strlen(ptr) } + 1;
195        // SAFETY: Lifetime guaranteed by the safety precondition.
196        let bytes = unsafe { core::slice::from_raw_parts(ptr as _, len as _) };
197        // SAFETY: As `len` is returned by `strlen`, `bytes` does not contain interior `NUL`.
198        // As we have added 1 to `len`, the last byte is known to be `NUL`.
199        unsafe { Self::from_bytes_with_nul_unchecked(bytes) }
200    }
201
202    /// Creates a [`CStr`] from a `[u8]`.
203    ///
204    /// The provided slice must be `NUL`-terminated, does not contain any
205    /// interior `NUL` bytes.
206    pub const fn from_bytes_with_nul(bytes: &[u8]) -> Result<&Self, CStrConvertError> {
207        if bytes.is_empty() {
208            return Err(CStrConvertError::NotNulTerminated);
209        }
210        if bytes[bytes.len() - 1] != 0 {
211            return Err(CStrConvertError::NotNulTerminated);
212        }
213        let mut i = 0;
214        // `i + 1 < bytes.len()` allows LLVM to optimize away bounds checking,
215        // while it couldn't optimize away bounds checks for `i < bytes.len() - 1`.
216        while i + 1 < bytes.len() {
217            if bytes[i] == 0 {
218                return Err(CStrConvertError::InteriorNul);
219            }
220            i += 1;
221        }
222        // SAFETY: We just checked that all properties hold.
223        Ok(unsafe { Self::from_bytes_with_nul_unchecked(bytes) })
224    }
225
226    /// Creates a [`CStr`] from a `[u8]` without performing any additional
227    /// checks.
228    ///
229    /// # Safety
230    ///
231    /// `bytes` *must* end with a `NUL` byte, and should only have a single
232    /// `NUL` byte (or the string will be truncated).
233    #[inline]
234    pub const unsafe fn from_bytes_with_nul_unchecked(bytes: &[u8]) -> &CStr {
235        // SAFETY: Properties of `bytes` guaranteed by the safety precondition.
236        unsafe { core::mem::transmute(bytes) }
237    }
238
239    /// Returns a C pointer to the string.
240    #[inline]
241    pub const fn as_char_ptr(&self) -> *const core::ffi::c_char {
242        self.0.as_ptr() as _
243    }
244
245    /// Convert the string to a byte slice without the trailing `NUL` byte.
246    #[inline]
247    pub fn as_bytes(&self) -> &[u8] {
248        &self.0[..self.len()]
249    }
250
251    /// Convert the string to a byte slice containing the trailing `NUL` byte.
252    #[inline]
253    pub const fn as_bytes_with_nul(&self) -> &[u8] {
254        &self.0
255    }
256
257    /// Yields a [`&str`] slice if the [`CStr`] contains valid UTF-8.
258    ///
259    /// If the contents of the [`CStr`] are valid UTF-8 data, this
260    /// function will return the corresponding [`&str`] slice. Otherwise,
261    /// it will return an error with details of where UTF-8 validation failed.
262    ///
263    /// # Examples
264    ///
265    /// ```
266    /// # use kernel::str::CStr;
267    /// let cstr = CStr::from_bytes_with_nul(b"foo\0").unwrap();
268    /// assert_eq!(cstr.to_str(), Ok("foo"));
269    /// ```
270    #[inline]
271    pub fn to_str(&self) -> Result<&str, core::str::Utf8Error> {
272        core::str::from_utf8(self.as_bytes())
273    }
274
275    /// Unsafely convert this [`CStr`] into a [`&str`], without checking for
276    /// valid UTF-8.
277    ///
278    /// # Safety
279    ///
280    /// The contents must be valid UTF-8.
281    ///
282    /// # Examples
283    ///
284    /// ```
285    /// # use kernel::c_str;
286    /// # use kernel::str::CStr;
287    /// let bar = c_str!("ツ");
288    /// // SAFETY: String literals are guaranteed to be valid UTF-8
289    /// // by the Rust compiler.
290    /// assert_eq!(unsafe { bar.as_str_unchecked() }, "ツ");
291    /// ```
292    #[inline]
293    pub unsafe fn as_str_unchecked(&self) -> &str {
294        unsafe { core::str::from_utf8_unchecked(self.as_bytes()) }
295    }
296
297    /// Convert this [`CStr`] into a [`CString`] by allocating memory and
298    /// copying over the string data.
299    pub fn to_cstring(&self) -> Result<CString, AllocError> {
300        CString::try_from(self)
301    }
302}
303
304impl fmt::Display for CStr {
305    /// Formats printable ASCII characters, escaping the rest.
306    ///
307    /// ```
308    /// # use kernel::c_str;
309    /// # use kernel::fmt;
310    /// # use kernel::str::CStr;
311    /// # use kernel::str::CString;
312    /// let penguin = c_str!("🐧");
313    /// let s = CString::try_from_fmt(fmt!("{}", penguin)).unwrap();
314    /// assert_eq!(s.as_bytes_with_nul(), "\\xf0\\x9f\\x90\\xa7\0".as_bytes());
315    ///
316    /// let ascii = c_str!("so \"cool\"");
317    /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap();
318    /// assert_eq!(s.as_bytes_with_nul(), "so \"cool\"\0".as_bytes());
319    /// ```
320    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
321        for &c in self.as_bytes() {
322            if (0x20..0x7f).contains(&c) {
323                // Printable character.
324                f.write_char(c as char)?;
325            } else {
326                write!(f, "\\x{:02x}", c)?;
327            }
328        }
329        Ok(())
330    }
331}
332
333impl fmt::Debug for CStr {
334    /// Formats printable ASCII characters with a double quote on either end, escaping the rest.
335    ///
336    /// ```
337    /// # use kernel::c_str;
338    /// # use kernel::fmt;
339    /// # use kernel::str::CStr;
340    /// # use kernel::str::CString;
341    /// let penguin = c_str!("🐧");
342    /// let s = CString::try_from_fmt(fmt!("{:?}", penguin)).unwrap();
343    /// assert_eq!(s.as_bytes_with_nul(), "\"\\xf0\\x9f\\x90\\xa7\"\0".as_bytes());
344    ///
345    /// // Embedded double quotes are escaped.
346    /// let ascii = c_str!("so \"cool\"");
347    /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap();
348    /// assert_eq!(s.as_bytes_with_nul(), "\"so \\\"cool\\\"\"\0".as_bytes());
349    /// ```
350    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
351        f.write_str("\"")?;
352        for &c in self.as_bytes() {
353            match c {
354                // Printable characters.
355                b'\"' => f.write_str("\\\"")?,
356                0x20..=0x7e => f.write_char(c as char)?,
357                _ => write!(f, "\\x{:02x}", c)?,
358            }
359        }
360        f.write_str("\"")
361    }
362}
363
364impl AsRef<BStr> for CStr {
365    #[inline]
366    fn as_ref(&self) -> &BStr {
367        BStr::from_bytes(self.as_bytes())
368    }
369}
370
371impl Deref for CStr {
372    type Target = BStr;
373
374    #[inline]
375    fn deref(&self) -> &Self::Target {
376        self.as_ref()
377    }
378}
379
380impl Index<ops::RangeFrom<usize>> for CStr {
381    type Output = CStr;
382
383    #[inline]
384    fn index(&self, index: ops::RangeFrom<usize>) -> &Self::Output {
385        // Delegate bounds checking to slice.
386        // Assign to _ to mute clippy's unnecessary operation warning.
387        let _ = &self.as_bytes()[index.start..];
388        // SAFETY: We just checked the bounds.
389        unsafe { Self::from_bytes_with_nul_unchecked(&self.0[index.start..]) }
390    }
391}
392
393impl Index<ops::RangeFull> for CStr {
394    type Output = CStr;
395
396    #[inline]
397    fn index(&self, _index: ops::RangeFull) -> &Self::Output {
398        self
399    }
400}
401
402mod private {
403    use core::ops;
404
405    // Marker trait for index types that can be forward to `BStr`.
406    pub trait CStrIndex {}
407
408    impl CStrIndex for usize {}
409    impl CStrIndex for ops::Range<usize> {}
410    impl CStrIndex for ops::RangeInclusive<usize> {}
411    impl CStrIndex for ops::RangeToInclusive<usize> {}
412}
413
414impl<Idx> Index<Idx> for CStr
415where
416    Idx: private::CStrIndex,
417    BStr: Index<Idx>,
418{
419    type Output = <BStr as Index<Idx>>::Output;
420
421    #[inline]
422    fn index(&self, index: Idx) -> &Self::Output {
423        &self.as_ref()[index]
424    }
425}
426
427/// Creates a new [`CStr`] from a string literal.
428///
429/// The string literal should not contain any `NUL` bytes.
430///
431/// # Examples
432///
433/// ```
434/// # use kernel::c_str;
435/// # use kernel::str::CStr;
436/// const MY_CSTR: &CStr = c_str!("My awesome CStr!");
437/// ```
438#[macro_export]
439macro_rules! c_str {
440    ($str:expr) => {{
441        const S: &str = concat!($str, "\0");
442        const C: &$crate::str::CStr = match $crate::str::CStr::from_bytes_with_nul(S.as_bytes()) {
443            Ok(v) => v,
444            Err(_) => panic!("string contains interior NUL"),
445        };
446        C
447    }};
448}
449
450#[cfg(test)]
451mod tests {
452    use super::*;
453    use alloc::format;
454
455    const ALL_ASCII_CHARS: &'static str =
456        "\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\
457        \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f \
458        !\"#$%&'()*+,-./0123456789:;<=>?@\
459        ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\\x7f\
460        \\x80\\x81\\x82\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8a\\x8b\\x8c\\x8d\\x8e\\x8f\
461        \\x90\\x91\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9a\\x9b\\x9c\\x9d\\x9e\\x9f\
462        \\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\xa7\\xa8\\xa9\\xaa\\xab\\xac\\xad\\xae\\xaf\
463        \\xb0\\xb1\\xb2\\xb3\\xb4\\xb5\\xb6\\xb7\\xb8\\xb9\\xba\\xbb\\xbc\\xbd\\xbe\\xbf\
464        \\xc0\\xc1\\xc2\\xc3\\xc4\\xc5\\xc6\\xc7\\xc8\\xc9\\xca\\xcb\\xcc\\xcd\\xce\\xcf\
465        \\xd0\\xd1\\xd2\\xd3\\xd4\\xd5\\xd6\\xd7\\xd8\\xd9\\xda\\xdb\\xdc\\xdd\\xde\\xdf\
466        \\xe0\\xe1\\xe2\\xe3\\xe4\\xe5\\xe6\\xe7\\xe8\\xe9\\xea\\xeb\\xec\\xed\\xee\\xef\
467        \\xf0\\xf1\\xf2\\xf3\\xf4\\xf5\\xf6\\xf7\\xf8\\xf9\\xfa\\xfb\\xfc\\xfd\\xfe\\xff";
468
469    #[test]
470    fn test_cstr_to_str() {
471        let good_bytes = b"\xf0\x9f\xa6\x80\0";
472        let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap();
473        let checked_str = checked_cstr.to_str().unwrap();
474        assert_eq!(checked_str, "🦀");
475    }
476
477    #[test]
478    #[should_panic]
479    fn test_cstr_to_str_panic() {
480        let bad_bytes = b"\xc3\x28\0";
481        let checked_cstr = CStr::from_bytes_with_nul(bad_bytes).unwrap();
482        checked_cstr.to_str().unwrap();
483    }
484
485    #[test]
486    fn test_cstr_as_str_unchecked() {
487        let good_bytes = b"\xf0\x9f\x90\xA7\0";
488        let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap();
489        let unchecked_str = unsafe { checked_cstr.as_str_unchecked() };
490        assert_eq!(unchecked_str, "🐧");
491    }
492
493    #[test]
494    fn test_cstr_display() {
495        let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap();
496        assert_eq!(format!("{}", hello_world), "hello, world!");
497        let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap();
498        assert_eq!(format!("{}", non_printables), "\\x01\\x09\\x0a");
499        let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap();
500        assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu");
501        let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap();
502        assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80");
503    }
504
505    #[test]
506    fn test_cstr_display_all_bytes() {
507        let mut bytes: [u8; 256] = [0; 256];
508        // fill `bytes` with [1..=255] + [0]
509        for i in u8::MIN..=u8::MAX {
510            bytes[i as usize] = i.wrapping_add(1);
511        }
512        let cstr = CStr::from_bytes_with_nul(&bytes).unwrap();
513        assert_eq!(format!("{}", cstr), ALL_ASCII_CHARS);
514    }
515
516    #[test]
517    fn test_cstr_debug() {
518        let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap();
519        assert_eq!(format!("{:?}", hello_world), "\"hello, world!\"");
520        let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap();
521        assert_eq!(format!("{:?}", non_printables), "\"\\x01\\x09\\x0a\"");
522        let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap();
523        assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\"");
524        let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap();
525        assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\"");
526    }
527
528    #[test]
529    fn test_bstr_display() {
530        let hello_world = BStr::from_bytes(b"hello, world!");
531        assert_eq!(format!("{}", hello_world), "hello, world!");
532        let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");
533        assert_eq!(format!("{}", escapes), "_\\t_\\n_\\r_\\_'_\"_");
534        let others = BStr::from_bytes(b"\x01");
535        assert_eq!(format!("{}", others), "\\x01");
536        let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");
537        assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu");
538        let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");
539        assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80");
540    }
541
542    #[test]
543    fn test_bstr_debug() {
544        let hello_world = BStr::from_bytes(b"hello, world!");
545        assert_eq!(format!("{:?}", hello_world), "\"hello, world!\"");
546        let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");
547        assert_eq!(format!("{:?}", escapes), "\"_\\t_\\n_\\r_\\\\_'_\\\"_\"");
548        let others = BStr::from_bytes(b"\x01");
549        assert_eq!(format!("{:?}", others), "\"\\x01\"");
550        let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");
551        assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\"");
552        let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");
553        assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\"");
554    }
555}
556
557/// Allows formatting of [`fmt::Arguments`] into a raw buffer.
558///
559/// It does not fail if callers write past the end of the buffer so that they can calculate the
560/// size required to fit everything.
561///
562/// # Invariants
563///
564/// The memory region between `pos` (inclusive) and `end` (exclusive) is valid for writes if `pos`
565/// is less than `end`.
566pub(crate) struct RawFormatter {
567    // Use `usize` to use `saturating_*` functions.
568    beg: usize,
569    pos: usize,
570    end: usize,
571}
572
573impl RawFormatter {
574    /// Creates a new instance of [`RawFormatter`] with an empty buffer.
575    fn new() -> Self {
576        // INVARIANT: The buffer is empty, so the region that needs to be writable is empty.
577        Self {
578            beg: 0,
579            pos: 0,
580            end: 0,
581        }
582    }
583
584    /// Creates a new instance of [`RawFormatter`] with the given buffer pointers.
585    ///
586    /// # Safety
587    ///
588    /// If `pos` is less than `end`, then the region between `pos` (inclusive) and `end`
589    /// (exclusive) must be valid for writes for the lifetime of the returned [`RawFormatter`].
590    pub(crate) unsafe fn from_ptrs(pos: *mut u8, end: *mut u8) -> Self {
591        // INVARIANT: The safety requirements guarantee the type invariants.
592        Self {
593            beg: pos as _,
594            pos: pos as _,
595            end: end as _,
596        }
597    }
598
599    /// Creates a new instance of [`RawFormatter`] with the given buffer.
600    ///
601    /// # Safety
602    ///
603    /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes
604    /// for the lifetime of the returned [`RawFormatter`].
605    pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {
606        let pos = buf as usize;
607        // INVARIANT: We ensure that `end` is never less then `buf`, and the safety requirements
608        // guarantees that the memory region is valid for writes.
609        Self {
610            pos,
611            beg: pos,
612            end: pos.saturating_add(len),
613        }
614    }
615
616    /// Returns the current insert position.
617    ///
618    /// N.B. It may point to invalid memory.
619    pub(crate) fn pos(&self) -> *mut u8 {
620        self.pos as _
621    }
622
623    /// Returns the number of bytes written to the formatter.
624    pub(crate) fn bytes_written(&self) -> usize {
625        self.pos - self.beg
626    }
627}
628
629impl fmt::Write for RawFormatter {
630    fn write_str(&mut self, s: &str) -> fmt::Result {
631        // `pos` value after writing `len` bytes. This does not have to be bounded by `end`, but we
632        // don't want it to wrap around to 0.
633        let pos_new = self.pos.saturating_add(s.len());
634
635        // Amount that we can copy. `saturating_sub` ensures we get 0 if `pos` goes past `end`.
636        let len_to_copy = core::cmp::min(pos_new, self.end).saturating_sub(self.pos);
637
638        if len_to_copy > 0 {
639            // SAFETY: If `len_to_copy` is non-zero, then we know `pos` has not gone past `end`
640            // yet, so it is valid for write per the type invariants.
641            unsafe {
642                core::ptr::copy_nonoverlapping(
643                    s.as_bytes().as_ptr(),
644                    self.pos as *mut u8,
645                    len_to_copy,
646                )
647            };
648        }
649
650        self.pos = pos_new;
651        Ok(())
652    }
653}
654
655/// Allows formatting of [`fmt::Arguments`] into a raw buffer.
656///
657/// Fails if callers attempt to write more than will fit in the buffer.
658pub(crate) struct Formatter(RawFormatter);
659
660impl Formatter {
661    /// Creates a new instance of [`Formatter`] with the given buffer.
662    ///
663    /// # Safety
664    ///
665    /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes
666    /// for the lifetime of the returned [`Formatter`].
667    pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {
668        // SAFETY: The safety requirements of this function satisfy those of the callee.
669        Self(unsafe { RawFormatter::from_buffer(buf, len) })
670    }
671}
672
673impl Deref for Formatter {
674    type Target = RawFormatter;
675
676    fn deref(&self) -> &Self::Target {
677        &self.0
678    }
679}
680
681impl fmt::Write for Formatter {
682    fn write_str(&mut self, s: &str) -> fmt::Result {
683        self.0.write_str(s)?;
684
685        // Fail the request if we go past the end of the buffer.
686        if self.0.pos > self.0.end {
687            Err(fmt::Error)
688        } else {
689            Ok(())
690        }
691    }
692}
693
694/// An owned string that is guaranteed to have exactly one `NUL` byte, which is at the end.
695///
696/// Used for interoperability with kernel APIs that take C strings.
697///
698/// # Invariants
699///
700/// The string is always `NUL`-terminated and contains no other `NUL` bytes.
701///
702/// # Examples
703///
704/// ```
705/// use kernel::{str::CString, fmt};
706///
707/// let s = CString::try_from_fmt(fmt!("{}{}{}", "abc", 10, 20)).unwrap();
708/// assert_eq!(s.as_bytes_with_nul(), "abc1020\0".as_bytes());
709///
710/// let tmp = "testing";
711/// let s = CString::try_from_fmt(fmt!("{tmp}{}", 123)).unwrap();
712/// assert_eq!(s.as_bytes_with_nul(), "testing123\0".as_bytes());
713///
714/// // This fails because it has an embedded `NUL` byte.
715/// let s = CString::try_from_fmt(fmt!("a\0b{}", 123));
716/// assert_eq!(s.is_ok(), false);
717/// ```
718pub struct CString {
719    buf: Vec<u8>,
720}
721
722impl CString {
723    /// Creates an instance of [`CString`] from the given formatted arguments.
724    pub fn try_from_fmt(args: fmt::Arguments<'_>) -> Result<Self, Error> {
725        // Calculate the size needed (formatted string plus `NUL` terminator).
726        let mut f = RawFormatter::new();
727        f.write_fmt(args)?;
728        f.write_str("\0")?;
729        let size = f.bytes_written();
730
731        // Allocate a vector with the required number of bytes, and write to it.
732        let mut buf = Vec::try_with_capacity(size)?;
733        // SAFETY: The buffer stored in `buf` is at least of size `size` and is valid for writes.
734        let mut f = unsafe { Formatter::from_buffer(buf.as_mut_ptr(), size) };
735        f.write_fmt(args)?;
736        f.write_str("\0")?;
737
738        // SAFETY: The number of bytes that can be written to `f` is bounded by `size`, which is
739        // `buf`'s capacity. The contents of the buffer have been initialised by writes to `f`.
740        unsafe { buf.set_len(f.bytes_written()) };
741
742        // Check that there are no `NUL` bytes before the end.
743        // SAFETY: The buffer is valid for read because `f.bytes_written()` is bounded by `size`
744        // (which the minimum buffer size) and is non-zero (we wrote at least the `NUL` terminator)
745        // so `f.bytes_written() - 1` doesn't underflow.
746        let ptr = unsafe { bindings::memchr(buf.as_ptr().cast(), 0, (f.bytes_written() - 1) as _) };
747        if !ptr.is_null() {
748            return Err(EINVAL);
749        }
750
751        // INVARIANT: We wrote the `NUL` terminator and checked above that no other `NUL` bytes
752        // exist in the buffer.
753        Ok(Self { buf })
754    }
755}
756
757impl Deref for CString {
758    type Target = CStr;
759
760    fn deref(&self) -> &Self::Target {
761        // SAFETY: The type invariants guarantee that the string is `NUL`-terminated and that no
762        // other `NUL` bytes exist.
763        unsafe { CStr::from_bytes_with_nul_unchecked(self.buf.as_slice()) }
764    }
765}
766
767impl<'a> TryFrom<&'a CStr> for CString {
768    type Error = AllocError;
769
770    fn try_from(cstr: &'a CStr) -> Result<CString, AllocError> {
771        let mut buf = Vec::new();
772
773        buf.try_extend_from_slice(cstr.as_bytes_with_nul())
774            .map_err(|_| AllocError)?;
775
776        // INVARIANT: The `CStr` and `CString` types have the same invariants for
777        // the string data, and we copied it over without changes.
778        Ok(CString { buf })
779    }
780}
781
782impl fmt::Debug for CString {
783    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
784        fmt::Debug::fmt(&**self, f)
785    }
786}
787
788/// A convenience alias for [`core::format_args`].
789#[macro_export]
790macro_rules! fmt {
791    ($($f:tt)*) => ( core::format_args!($($f)*) )
792}