875 lines · rust
1// SPDX-License-Identifier: GPL-2.02 3//! String representations.4 5use crate::alloc::{flags::*, vec_ext::VecExt, AllocError};6use alloc::vec::Vec;7use core::fmt::{self, Write};8use core::ops::{self, Deref, DerefMut, Index};9 10use crate::error::{code::*, Error};11 12/// Byte string without UTF-8 validity guarantee.13#[repr(transparent)]14pub struct BStr([u8]);15 16impl BStr {17 /// Returns the length of this string.18 #[inline]19 pub const fn len(&self) -> usize {20 self.0.len()21 }22 23 /// Returns `true` if the string is empty.24 #[inline]25 pub const fn is_empty(&self) -> bool {26 self.len() == 027 }28 29 /// Creates a [`BStr`] from a `[u8]`.30 #[inline]31 pub const fn from_bytes(bytes: &[u8]) -> &Self {32 // SAFETY: `BStr` is transparent to `[u8]`.33 unsafe { &*(bytes as *const [u8] as *const BStr) }34 }35}36 37impl fmt::Display for BStr {38 /// Formats printable ASCII characters, escaping the rest.39 ///40 /// ```41 /// # use kernel::{fmt, b_str, str::{BStr, CString}};42 /// let ascii = b_str!("Hello, BStr!");43 /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap();44 /// assert_eq!(s.as_bytes(), "Hello, BStr!".as_bytes());45 ///46 /// let non_ascii = b_str!("🦀");47 /// let s = CString::try_from_fmt(fmt!("{}", non_ascii)).unwrap();48 /// assert_eq!(s.as_bytes(), "\\xf0\\x9f\\xa6\\x80".as_bytes());49 /// ```50 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {51 for &b in &self.0 {52 match b {53 // Common escape codes.54 b'\t' => f.write_str("\\t")?,55 b'\n' => f.write_str("\\n")?,56 b'\r' => f.write_str("\\r")?,57 // Printable characters.58 0x20..=0x7e => f.write_char(b as char)?,59 _ => write!(f, "\\x{:02x}", b)?,60 }61 }62 Ok(())63 }64}65 66impl fmt::Debug for BStr {67 /// Formats printable ASCII characters with a double quote on either end,68 /// escaping the rest.69 ///70 /// ```71 /// # use kernel::{fmt, b_str, str::{BStr, CString}};72 /// // Embedded double quotes are escaped.73 /// let ascii = b_str!("Hello, \"BStr\"!");74 /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap();75 /// assert_eq!(s.as_bytes(), "\"Hello, \\\"BStr\\\"!\"".as_bytes());76 ///77 /// let non_ascii = b_str!("😺");78 /// let s = CString::try_from_fmt(fmt!("{:?}", non_ascii)).unwrap();79 /// assert_eq!(s.as_bytes(), "\"\\xf0\\x9f\\x98\\xba\"".as_bytes());80 /// ```81 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {82 f.write_char('"')?;83 for &b in &self.0 {84 match b {85 // Common escape codes.86 b'\t' => f.write_str("\\t")?,87 b'\n' => f.write_str("\\n")?,88 b'\r' => f.write_str("\\r")?,89 // String escape characters.90 b'\"' => f.write_str("\\\"")?,91 b'\\' => f.write_str("\\\\")?,92 // Printable characters.93 0x20..=0x7e => f.write_char(b as char)?,94 _ => write!(f, "\\x{:02x}", b)?,95 }96 }97 f.write_char('"')98 }99}100 101impl Deref for BStr {102 type Target = [u8];103 104 #[inline]105 fn deref(&self) -> &Self::Target {106 &self.0107 }108}109 110/// Creates a new [`BStr`] from a string literal.111///112/// `b_str!` converts the supplied string literal to byte string, so non-ASCII113/// characters can be included.114///115/// # Examples116///117/// ```118/// # use kernel::b_str;119/// # use kernel::str::BStr;120/// const MY_BSTR: &BStr = b_str!("My awesome BStr!");121/// ```122#[macro_export]123macro_rules! b_str {124 ($str:literal) => {{125 const S: &'static str = $str;126 const C: &'static $crate::str::BStr = $crate::str::BStr::from_bytes(S.as_bytes());127 C128 }};129}130 131/// Possible errors when using conversion functions in [`CStr`].132#[derive(Debug, Clone, Copy)]133pub enum CStrConvertError {134 /// Supplied bytes contain an interior `NUL`.135 InteriorNul,136 137 /// Supplied bytes are not terminated by `NUL`.138 NotNulTerminated,139}140 141impl From<CStrConvertError> for Error {142 #[inline]143 fn from(_: CStrConvertError) -> Error {144 EINVAL145 }146}147 148/// A string that is guaranteed to have exactly one `NUL` byte, which is at the149/// end.150///151/// Used for interoperability with kernel APIs that take C strings.152#[repr(transparent)]153pub struct CStr([u8]);154 155impl CStr {156 /// Returns the length of this string excluding `NUL`.157 #[inline]158 pub const fn len(&self) -> usize {159 self.len_with_nul() - 1160 }161 162 /// Returns the length of this string with `NUL`.163 #[inline]164 pub const fn len_with_nul(&self) -> usize {165 // SAFETY: This is one of the invariant of `CStr`.166 // We add a `unreachable_unchecked` here to hint the optimizer that167 // the value returned from this function is non-zero.168 if self.0.is_empty() {169 unsafe { core::hint::unreachable_unchecked() };170 }171 self.0.len()172 }173 174 /// Returns `true` if the string only includes `NUL`.175 #[inline]176 pub const fn is_empty(&self) -> bool {177 self.len() == 0178 }179 180 /// Wraps a raw C string pointer.181 ///182 /// # Safety183 ///184 /// `ptr` must be a valid pointer to a `NUL`-terminated C string, and it must185 /// last at least `'a`. When `CStr` is alive, the memory pointed by `ptr`186 /// must not be mutated.187 #[inline]188 pub unsafe fn from_char_ptr<'a>(ptr: *const core::ffi::c_char) -> &'a Self {189 // SAFETY: The safety precondition guarantees `ptr` is a valid pointer190 // to a `NUL`-terminated C string.191 let len = unsafe { bindings::strlen(ptr) } + 1;192 // SAFETY: Lifetime guaranteed by the safety precondition.193 let bytes = unsafe { core::slice::from_raw_parts(ptr as _, len as _) };194 // SAFETY: As `len` is returned by `strlen`, `bytes` does not contain interior `NUL`.195 // As we have added 1 to `len`, the last byte is known to be `NUL`.196 unsafe { Self::from_bytes_with_nul_unchecked(bytes) }197 }198 199 /// Creates a [`CStr`] from a `[u8]`.200 ///201 /// The provided slice must be `NUL`-terminated, does not contain any202 /// interior `NUL` bytes.203 pub const fn from_bytes_with_nul(bytes: &[u8]) -> Result<&Self, CStrConvertError> {204 if bytes.is_empty() {205 return Err(CStrConvertError::NotNulTerminated);206 }207 if bytes[bytes.len() - 1] != 0 {208 return Err(CStrConvertError::NotNulTerminated);209 }210 let mut i = 0;211 // `i + 1 < bytes.len()` allows LLVM to optimize away bounds checking,212 // while it couldn't optimize away bounds checks for `i < bytes.len() - 1`.213 while i + 1 < bytes.len() {214 if bytes[i] == 0 {215 return Err(CStrConvertError::InteriorNul);216 }217 i += 1;218 }219 // SAFETY: We just checked that all properties hold.220 Ok(unsafe { Self::from_bytes_with_nul_unchecked(bytes) })221 }222 223 /// Creates a [`CStr`] from a `[u8]` without performing any additional224 /// checks.225 ///226 /// # Safety227 ///228 /// `bytes` *must* end with a `NUL` byte, and should only have a single229 /// `NUL` byte (or the string will be truncated).230 #[inline]231 pub const unsafe fn from_bytes_with_nul_unchecked(bytes: &[u8]) -> &CStr {232 // SAFETY: Properties of `bytes` guaranteed by the safety precondition.233 unsafe { core::mem::transmute(bytes) }234 }235 236 /// Creates a mutable [`CStr`] from a `[u8]` without performing any237 /// additional checks.238 ///239 /// # Safety240 ///241 /// `bytes` *must* end with a `NUL` byte, and should only have a single242 /// `NUL` byte (or the string will be truncated).243 #[inline]244 pub unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut CStr {245 // SAFETY: Properties of `bytes` guaranteed by the safety precondition.246 unsafe { &mut *(bytes as *mut [u8] as *mut CStr) }247 }248 249 /// Returns a C pointer to the string.250 #[inline]251 pub const fn as_char_ptr(&self) -> *const core::ffi::c_char {252 self.0.as_ptr() as _253 }254 255 /// Convert the string to a byte slice without the trailing `NUL` byte.256 #[inline]257 pub fn as_bytes(&self) -> &[u8] {258 &self.0[..self.len()]259 }260 261 /// Convert the string to a byte slice containing the trailing `NUL` byte.262 #[inline]263 pub const fn as_bytes_with_nul(&self) -> &[u8] {264 &self.0265 }266 267 /// Yields a [`&str`] slice if the [`CStr`] contains valid UTF-8.268 ///269 /// If the contents of the [`CStr`] are valid UTF-8 data, this270 /// function will return the corresponding [`&str`] slice. Otherwise,271 /// it will return an error with details of where UTF-8 validation failed.272 ///273 /// # Examples274 ///275 /// ```276 /// # use kernel::str::CStr;277 /// let cstr = CStr::from_bytes_with_nul(b"foo\0").unwrap();278 /// assert_eq!(cstr.to_str(), Ok("foo"));279 /// ```280 #[inline]281 pub fn to_str(&self) -> Result<&str, core::str::Utf8Error> {282 core::str::from_utf8(self.as_bytes())283 }284 285 /// Unsafely convert this [`CStr`] into a [`&str`], without checking for286 /// valid UTF-8.287 ///288 /// # Safety289 ///290 /// The contents must be valid UTF-8.291 ///292 /// # Examples293 ///294 /// ```295 /// # use kernel::c_str;296 /// # use kernel::str::CStr;297 /// let bar = c_str!("ツ");298 /// // SAFETY: String literals are guaranteed to be valid UTF-8299 /// // by the Rust compiler.300 /// assert_eq!(unsafe { bar.as_str_unchecked() }, "ツ");301 /// ```302 #[inline]303 pub unsafe fn as_str_unchecked(&self) -> &str {304 unsafe { core::str::from_utf8_unchecked(self.as_bytes()) }305 }306 307 /// Convert this [`CStr`] into a [`CString`] by allocating memory and308 /// copying over the string data.309 pub fn to_cstring(&self) -> Result<CString, AllocError> {310 CString::try_from(self)311 }312 313 /// Converts this [`CStr`] to its ASCII lower case equivalent in-place.314 ///315 /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z',316 /// but non-ASCII letters are unchanged.317 ///318 /// To return a new lowercased value without modifying the existing one, use319 /// [`to_ascii_lowercase()`].320 ///321 /// [`to_ascii_lowercase()`]: #method.to_ascii_lowercase322 pub fn make_ascii_lowercase(&mut self) {323 // INVARIANT: This doesn't introduce or remove NUL bytes in the C324 // string.325 self.0.make_ascii_lowercase();326 }327 328 /// Converts this [`CStr`] to its ASCII upper case equivalent in-place.329 ///330 /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z',331 /// but non-ASCII letters are unchanged.332 ///333 /// To return a new uppercased value without modifying the existing one, use334 /// [`to_ascii_uppercase()`].335 ///336 /// [`to_ascii_uppercase()`]: #method.to_ascii_uppercase337 pub fn make_ascii_uppercase(&mut self) {338 // INVARIANT: This doesn't introduce or remove NUL bytes in the C339 // string.340 self.0.make_ascii_uppercase();341 }342 343 /// Returns a copy of this [`CString`] where each character is mapped to its344 /// ASCII lower case equivalent.345 ///346 /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z',347 /// but non-ASCII letters are unchanged.348 ///349 /// To lowercase the value in-place, use [`make_ascii_lowercase`].350 ///351 /// [`make_ascii_lowercase`]: str::make_ascii_lowercase352 pub fn to_ascii_lowercase(&self) -> Result<CString, AllocError> {353 let mut s = self.to_cstring()?;354 355 s.make_ascii_lowercase();356 357 Ok(s)358 }359 360 /// Returns a copy of this [`CString`] where each character is mapped to its361 /// ASCII upper case equivalent.362 ///363 /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z',364 /// but non-ASCII letters are unchanged.365 ///366 /// To uppercase the value in-place, use [`make_ascii_uppercase`].367 ///368 /// [`make_ascii_uppercase`]: str::make_ascii_uppercase369 pub fn to_ascii_uppercase(&self) -> Result<CString, AllocError> {370 let mut s = self.to_cstring()?;371 372 s.make_ascii_uppercase();373 374 Ok(s)375 }376}377 378impl fmt::Display for CStr {379 /// Formats printable ASCII characters, escaping the rest.380 ///381 /// ```382 /// # use kernel::c_str;383 /// # use kernel::fmt;384 /// # use kernel::str::CStr;385 /// # use kernel::str::CString;386 /// let penguin = c_str!("🐧");387 /// let s = CString::try_from_fmt(fmt!("{}", penguin)).unwrap();388 /// assert_eq!(s.as_bytes_with_nul(), "\\xf0\\x9f\\x90\\xa7\0".as_bytes());389 ///390 /// let ascii = c_str!("so \"cool\"");391 /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap();392 /// assert_eq!(s.as_bytes_with_nul(), "so \"cool\"\0".as_bytes());393 /// ```394 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {395 for &c in self.as_bytes() {396 if (0x20..0x7f).contains(&c) {397 // Printable character.398 f.write_char(c as char)?;399 } else {400 write!(f, "\\x{:02x}", c)?;401 }402 }403 Ok(())404 }405}406 407impl fmt::Debug for CStr {408 /// Formats printable ASCII characters with a double quote on either end, escaping the rest.409 ///410 /// ```411 /// # use kernel::c_str;412 /// # use kernel::fmt;413 /// # use kernel::str::CStr;414 /// # use kernel::str::CString;415 /// let penguin = c_str!("🐧");416 /// let s = CString::try_from_fmt(fmt!("{:?}", penguin)).unwrap();417 /// assert_eq!(s.as_bytes_with_nul(), "\"\\xf0\\x9f\\x90\\xa7\"\0".as_bytes());418 ///419 /// // Embedded double quotes are escaped.420 /// let ascii = c_str!("so \"cool\"");421 /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap();422 /// assert_eq!(s.as_bytes_with_nul(), "\"so \\\"cool\\\"\"\0".as_bytes());423 /// ```424 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {425 f.write_str("\"")?;426 for &c in self.as_bytes() {427 match c {428 // Printable characters.429 b'\"' => f.write_str("\\\"")?,430 0x20..=0x7e => f.write_char(c as char)?,431 _ => write!(f, "\\x{:02x}", c)?,432 }433 }434 f.write_str("\"")435 }436}437 438impl AsRef<BStr> for CStr {439 #[inline]440 fn as_ref(&self) -> &BStr {441 BStr::from_bytes(self.as_bytes())442 }443}444 445impl Deref for CStr {446 type Target = BStr;447 448 #[inline]449 fn deref(&self) -> &Self::Target {450 self.as_ref()451 }452}453 454impl Index<ops::RangeFrom<usize>> for CStr {455 type Output = CStr;456 457 #[inline]458 fn index(&self, index: ops::RangeFrom<usize>) -> &Self::Output {459 // Delegate bounds checking to slice.460 // Assign to _ to mute clippy's unnecessary operation warning.461 let _ = &self.as_bytes()[index.start..];462 // SAFETY: We just checked the bounds.463 unsafe { Self::from_bytes_with_nul_unchecked(&self.0[index.start..]) }464 }465}466 467impl Index<ops::RangeFull> for CStr {468 type Output = CStr;469 470 #[inline]471 fn index(&self, _index: ops::RangeFull) -> &Self::Output {472 self473 }474}475 476mod private {477 use core::ops;478 479 // Marker trait for index types that can be forward to `BStr`.480 pub trait CStrIndex {}481 482 impl CStrIndex for usize {}483 impl CStrIndex for ops::Range<usize> {}484 impl CStrIndex for ops::RangeInclusive<usize> {}485 impl CStrIndex for ops::RangeToInclusive<usize> {}486}487 488impl<Idx> Index<Idx> for CStr489where490 Idx: private::CStrIndex,491 BStr: Index<Idx>,492{493 type Output = <BStr as Index<Idx>>::Output;494 495 #[inline]496 fn index(&self, index: Idx) -> &Self::Output {497 &self.as_ref()[index]498 }499}500 501/// Creates a new [`CStr`] from a string literal.502///503/// The string literal should not contain any `NUL` bytes.504///505/// # Examples506///507/// ```508/// # use kernel::c_str;509/// # use kernel::str::CStr;510/// const MY_CSTR: &CStr = c_str!("My awesome CStr!");511/// ```512#[macro_export]513macro_rules! c_str {514 ($str:expr) => {{515 const S: &str = concat!($str, "\0");516 const C: &$crate::str::CStr = match $crate::str::CStr::from_bytes_with_nul(S.as_bytes()) {517 Ok(v) => v,518 Err(_) => panic!("string contains interior NUL"),519 };520 C521 }};522}523 524#[cfg(test)]525mod tests {526 use super::*;527 use alloc::format;528 529 const ALL_ASCII_CHARS: &'static str =530 "\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\531 \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f \532 !\"#$%&'()*+,-./0123456789:;<=>?@\533 ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\\x7f\534 \\x80\\x81\\x82\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8a\\x8b\\x8c\\x8d\\x8e\\x8f\535 \\x90\\x91\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9a\\x9b\\x9c\\x9d\\x9e\\x9f\536 \\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\xa7\\xa8\\xa9\\xaa\\xab\\xac\\xad\\xae\\xaf\537 \\xb0\\xb1\\xb2\\xb3\\xb4\\xb5\\xb6\\xb7\\xb8\\xb9\\xba\\xbb\\xbc\\xbd\\xbe\\xbf\538 \\xc0\\xc1\\xc2\\xc3\\xc4\\xc5\\xc6\\xc7\\xc8\\xc9\\xca\\xcb\\xcc\\xcd\\xce\\xcf\539 \\xd0\\xd1\\xd2\\xd3\\xd4\\xd5\\xd6\\xd7\\xd8\\xd9\\xda\\xdb\\xdc\\xdd\\xde\\xdf\540 \\xe0\\xe1\\xe2\\xe3\\xe4\\xe5\\xe6\\xe7\\xe8\\xe9\\xea\\xeb\\xec\\xed\\xee\\xef\541 \\xf0\\xf1\\xf2\\xf3\\xf4\\xf5\\xf6\\xf7\\xf8\\xf9\\xfa\\xfb\\xfc\\xfd\\xfe\\xff";542 543 #[test]544 fn test_cstr_to_str() {545 let good_bytes = b"\xf0\x9f\xa6\x80\0";546 let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap();547 let checked_str = checked_cstr.to_str().unwrap();548 assert_eq!(checked_str, "🦀");549 }550 551 #[test]552 #[should_panic]553 fn test_cstr_to_str_panic() {554 let bad_bytes = b"\xc3\x28\0";555 let checked_cstr = CStr::from_bytes_with_nul(bad_bytes).unwrap();556 checked_cstr.to_str().unwrap();557 }558 559 #[test]560 fn test_cstr_as_str_unchecked() {561 let good_bytes = b"\xf0\x9f\x90\xA7\0";562 let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap();563 let unchecked_str = unsafe { checked_cstr.as_str_unchecked() };564 assert_eq!(unchecked_str, "🐧");565 }566 567 #[test]568 fn test_cstr_display() {569 let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap();570 assert_eq!(format!("{}", hello_world), "hello, world!");571 let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap();572 assert_eq!(format!("{}", non_printables), "\\x01\\x09\\x0a");573 let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap();574 assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu");575 let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap();576 assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80");577 }578 579 #[test]580 fn test_cstr_display_all_bytes() {581 let mut bytes: [u8; 256] = [0; 256];582 // fill `bytes` with [1..=255] + [0]583 for i in u8::MIN..=u8::MAX {584 bytes[i as usize] = i.wrapping_add(1);585 }586 let cstr = CStr::from_bytes_with_nul(&bytes).unwrap();587 assert_eq!(format!("{}", cstr), ALL_ASCII_CHARS);588 }589 590 #[test]591 fn test_cstr_debug() {592 let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap();593 assert_eq!(format!("{:?}", hello_world), "\"hello, world!\"");594 let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap();595 assert_eq!(format!("{:?}", non_printables), "\"\\x01\\x09\\x0a\"");596 let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap();597 assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\"");598 let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap();599 assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\"");600 }601 602 #[test]603 fn test_bstr_display() {604 let hello_world = BStr::from_bytes(b"hello, world!");605 assert_eq!(format!("{}", hello_world), "hello, world!");606 let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");607 assert_eq!(format!("{}", escapes), "_\\t_\\n_\\r_\\_'_\"_");608 let others = BStr::from_bytes(b"\x01");609 assert_eq!(format!("{}", others), "\\x01");610 let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");611 assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu");612 let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");613 assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80");614 }615 616 #[test]617 fn test_bstr_debug() {618 let hello_world = BStr::from_bytes(b"hello, world!");619 assert_eq!(format!("{:?}", hello_world), "\"hello, world!\"");620 let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");621 assert_eq!(format!("{:?}", escapes), "\"_\\t_\\n_\\r_\\\\_'_\\\"_\"");622 let others = BStr::from_bytes(b"\x01");623 assert_eq!(format!("{:?}", others), "\"\\x01\"");624 let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");625 assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\"");626 let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");627 assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\"");628 }629}630 631/// Allows formatting of [`fmt::Arguments`] into a raw buffer.632///633/// It does not fail if callers write past the end of the buffer so that they can calculate the634/// size required to fit everything.635///636/// # Invariants637///638/// The memory region between `pos` (inclusive) and `end` (exclusive) is valid for writes if `pos`639/// is less than `end`.640pub(crate) struct RawFormatter {641 // Use `usize` to use `saturating_*` functions.642 beg: usize,643 pos: usize,644 end: usize,645}646 647impl RawFormatter {648 /// Creates a new instance of [`RawFormatter`] with an empty buffer.649 fn new() -> Self {650 // INVARIANT: The buffer is empty, so the region that needs to be writable is empty.651 Self {652 beg: 0,653 pos: 0,654 end: 0,655 }656 }657 658 /// Creates a new instance of [`RawFormatter`] with the given buffer pointers.659 ///660 /// # Safety661 ///662 /// If `pos` is less than `end`, then the region between `pos` (inclusive) and `end`663 /// (exclusive) must be valid for writes for the lifetime of the returned [`RawFormatter`].664 pub(crate) unsafe fn from_ptrs(pos: *mut u8, end: *mut u8) -> Self {665 // INVARIANT: The safety requirements guarantee the type invariants.666 Self {667 beg: pos as _,668 pos: pos as _,669 end: end as _,670 }671 }672 673 /// Creates a new instance of [`RawFormatter`] with the given buffer.674 ///675 /// # Safety676 ///677 /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes678 /// for the lifetime of the returned [`RawFormatter`].679 pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {680 let pos = buf as usize;681 // INVARIANT: We ensure that `end` is never less then `buf`, and the safety requirements682 // guarantees that the memory region is valid for writes.683 Self {684 pos,685 beg: pos,686 end: pos.saturating_add(len),687 }688 }689 690 /// Returns the current insert position.691 ///692 /// N.B. It may point to invalid memory.693 pub(crate) fn pos(&self) -> *mut u8 {694 self.pos as _695 }696 697 /// Returns the number of bytes written to the formatter.698 pub(crate) fn bytes_written(&self) -> usize {699 self.pos - self.beg700 }701}702 703impl fmt::Write for RawFormatter {704 fn write_str(&mut self, s: &str) -> fmt::Result {705 // `pos` value after writing `len` bytes. This does not have to be bounded by `end`, but we706 // don't want it to wrap around to 0.707 let pos_new = self.pos.saturating_add(s.len());708 709 // Amount that we can copy. `saturating_sub` ensures we get 0 if `pos` goes past `end`.710 let len_to_copy = core::cmp::min(pos_new, self.end).saturating_sub(self.pos);711 712 if len_to_copy > 0 {713 // SAFETY: If `len_to_copy` is non-zero, then we know `pos` has not gone past `end`714 // yet, so it is valid for write per the type invariants.715 unsafe {716 core::ptr::copy_nonoverlapping(717 s.as_bytes().as_ptr(),718 self.pos as *mut u8,719 len_to_copy,720 )721 };722 }723 724 self.pos = pos_new;725 Ok(())726 }727}728 729/// Allows formatting of [`fmt::Arguments`] into a raw buffer.730///731/// Fails if callers attempt to write more than will fit in the buffer.732pub(crate) struct Formatter(RawFormatter);733 734impl Formatter {735 /// Creates a new instance of [`Formatter`] with the given buffer.736 ///737 /// # Safety738 ///739 /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes740 /// for the lifetime of the returned [`Formatter`].741 pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {742 // SAFETY: The safety requirements of this function satisfy those of the callee.743 Self(unsafe { RawFormatter::from_buffer(buf, len) })744 }745}746 747impl Deref for Formatter {748 type Target = RawFormatter;749 750 fn deref(&self) -> &Self::Target {751 &self.0752 }753}754 755impl fmt::Write for Formatter {756 fn write_str(&mut self, s: &str) -> fmt::Result {757 self.0.write_str(s)?;758 759 // Fail the request if we go past the end of the buffer.760 if self.0.pos > self.0.end {761 Err(fmt::Error)762 } else {763 Ok(())764 }765 }766}767 768/// An owned string that is guaranteed to have exactly one `NUL` byte, which is at the end.769///770/// Used for interoperability with kernel APIs that take C strings.771///772/// # Invariants773///774/// The string is always `NUL`-terminated and contains no other `NUL` bytes.775///776/// # Examples777///778/// ```779/// use kernel::{str::CString, fmt};780///781/// let s = CString::try_from_fmt(fmt!("{}{}{}", "abc", 10, 20)).unwrap();782/// assert_eq!(s.as_bytes_with_nul(), "abc1020\0".as_bytes());783///784/// let tmp = "testing";785/// let s = CString::try_from_fmt(fmt!("{tmp}{}", 123)).unwrap();786/// assert_eq!(s.as_bytes_with_nul(), "testing123\0".as_bytes());787///788/// // This fails because it has an embedded `NUL` byte.789/// let s = CString::try_from_fmt(fmt!("a\0b{}", 123));790/// assert_eq!(s.is_ok(), false);791/// ```792pub struct CString {793 buf: Vec<u8>,794}795 796impl CString {797 /// Creates an instance of [`CString`] from the given formatted arguments.798 pub fn try_from_fmt(args: fmt::Arguments<'_>) -> Result<Self, Error> {799 // Calculate the size needed (formatted string plus `NUL` terminator).800 let mut f = RawFormatter::new();801 f.write_fmt(args)?;802 f.write_str("\0")?;803 let size = f.bytes_written();804 805 // Allocate a vector with the required number of bytes, and write to it.806 let mut buf = <Vec<_> as VecExt<_>>::with_capacity(size, GFP_KERNEL)?;807 // SAFETY: The buffer stored in `buf` is at least of size `size` and is valid for writes.808 let mut f = unsafe { Formatter::from_buffer(buf.as_mut_ptr(), size) };809 f.write_fmt(args)?;810 f.write_str("\0")?;811 812 // SAFETY: The number of bytes that can be written to `f` is bounded by `size`, which is813 // `buf`'s capacity. The contents of the buffer have been initialised by writes to `f`.814 unsafe { buf.set_len(f.bytes_written()) };815 816 // Check that there are no `NUL` bytes before the end.817 // SAFETY: The buffer is valid for read because `f.bytes_written()` is bounded by `size`818 // (which the minimum buffer size) and is non-zero (we wrote at least the `NUL` terminator)819 // so `f.bytes_written() - 1` doesn't underflow.820 let ptr = unsafe { bindings::memchr(buf.as_ptr().cast(), 0, (f.bytes_written() - 1) as _) };821 if !ptr.is_null() {822 return Err(EINVAL);823 }824 825 // INVARIANT: We wrote the `NUL` terminator and checked above that no other `NUL` bytes826 // exist in the buffer.827 Ok(Self { buf })828 }829}830 831impl Deref for CString {832 type Target = CStr;833 834 fn deref(&self) -> &Self::Target {835 // SAFETY: The type invariants guarantee that the string is `NUL`-terminated and that no836 // other `NUL` bytes exist.837 unsafe { CStr::from_bytes_with_nul_unchecked(self.buf.as_slice()) }838 }839}840 841impl DerefMut for CString {842 fn deref_mut(&mut self) -> &mut Self::Target {843 // SAFETY: A `CString` is always NUL-terminated and contains no other844 // NUL bytes.845 unsafe { CStr::from_bytes_with_nul_unchecked_mut(self.buf.as_mut_slice()) }846 }847}848 849impl<'a> TryFrom<&'a CStr> for CString {850 type Error = AllocError;851 852 fn try_from(cstr: &'a CStr) -> Result<CString, AllocError> {853 let mut buf = Vec::new();854 855 <Vec<_> as VecExt<_>>::extend_from_slice(&mut buf, cstr.as_bytes_with_nul(), GFP_KERNEL)856 .map_err(|_| AllocError)?;857 858 // INVARIANT: The `CStr` and `CString` types have the same invariants for859 // the string data, and we copied it over without changes.860 Ok(CString { buf })861 }862}863 864impl fmt::Debug for CString {865 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {866 fmt::Debug::fmt(&**self, f)867 }868}869 870/// A convenience alias for [`core::format_args`].871#[macro_export]872macro_rules! fmt {873 ($($f:tt)*) => ( core::format_args!($($f)*) )874}875