1 // SPDX-License-Identifier: GPL-2.0 1 // SPDX-License-Identifier: GPL-2.0
2 2
3 //! String representations. 3 //! String representations.
4 4
5 use crate::alloc::{flags::*, vec_ext::VecExt, 5 use crate::alloc::{flags::*, vec_ext::VecExt, AllocError};
6 use alloc::vec::Vec; 6 use alloc::vec::Vec;
7 use core::fmt::{self, Write}; 7 use core::fmt::{self, Write};
8 use core::ops::{self, Deref, DerefMut, Index}; 8 use core::ops::{self, Deref, DerefMut, Index};
9 9
10 use crate::error::{code::*, Error}; 10 use crate::error::{code::*, Error};
11 11
12 /// Byte string without UTF-8 validity guarant 12 /// Byte string without UTF-8 validity guarantee.
13 #[repr(transparent)] 13 #[repr(transparent)]
14 pub struct BStr([u8]); 14 pub struct BStr([u8]);
15 15
16 impl BStr { 16 impl BStr {
17 /// Returns the length of this string. 17 /// Returns the length of this string.
18 #[inline] 18 #[inline]
19 pub const fn len(&self) -> usize { 19 pub const fn len(&self) -> usize {
20 self.0.len() 20 self.0.len()
21 } 21 }
22 22
23 /// Returns `true` if the string is empty. 23 /// Returns `true` if the string is empty.
24 #[inline] 24 #[inline]
25 pub const fn is_empty(&self) -> bool { 25 pub const fn is_empty(&self) -> bool {
26 self.len() == 0 26 self.len() == 0
27 } 27 }
28 28
29 /// Creates a [`BStr`] from a `[u8]`. 29 /// Creates a [`BStr`] from a `[u8]`.
30 #[inline] 30 #[inline]
31 pub const fn from_bytes(bytes: &[u8]) -> & 31 pub const fn from_bytes(bytes: &[u8]) -> &Self {
32 // SAFETY: `BStr` is transparent to `[ 32 // SAFETY: `BStr` is transparent to `[u8]`.
33 unsafe { &*(bytes as *const [u8] as *c 33 unsafe { &*(bytes as *const [u8] as *const BStr) }
34 } 34 }
35 } 35 }
36 36
37 impl fmt::Display for BStr { 37 impl fmt::Display for BStr {
38 /// Formats printable ASCII characters, es 38 /// Formats printable ASCII characters, escaping the rest.
39 /// 39 ///
40 /// ``` 40 /// ```
41 /// # use kernel::{fmt, b_str, str::{BStr, 41 /// # use kernel::{fmt, b_str, str::{BStr, CString}};
42 /// let ascii = b_str!("Hello, BStr!"); 42 /// let ascii = b_str!("Hello, BStr!");
43 /// let s = CString::try_from_fmt(fmt!("{} 43 /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap();
44 /// assert_eq!(s.as_bytes(), "Hello, BStr! 44 /// assert_eq!(s.as_bytes(), "Hello, BStr!".as_bytes());
45 /// 45 ///
46 /// let non_ascii = b_str!("🦀"); 46 /// let non_ascii = b_str!("🦀");
47 /// let s = CString::try_from_fmt(fmt!("{} 47 /// let s = CString::try_from_fmt(fmt!("{}", non_ascii)).unwrap();
48 /// assert_eq!(s.as_bytes(), "\\xf0\\x9f\\ 48 /// assert_eq!(s.as_bytes(), "\\xf0\\x9f\\xa6\\x80".as_bytes());
49 /// ``` 49 /// ```
50 fn fmt(&self, f: &mut fmt::Formatter<'_>) 50 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
51 for &b in &self.0 { 51 for &b in &self.0 {
52 match b { 52 match b {
53 // Common escape codes. 53 // Common escape codes.
54 b'\t' => f.write_str("\\t")?, 54 b'\t' => f.write_str("\\t")?,
55 b'\n' => f.write_str("\\n")?, 55 b'\n' => f.write_str("\\n")?,
56 b'\r' => f.write_str("\\r")?, 56 b'\r' => f.write_str("\\r")?,
57 // Printable characters. 57 // Printable characters.
58 0x20..=0x7e => f.write_char(b 58 0x20..=0x7e => f.write_char(b as char)?,
59 _ => write!(f, "\\x{:02x}", b) 59 _ => write!(f, "\\x{:02x}", b)?,
60 } 60 }
61 } 61 }
62 Ok(()) 62 Ok(())
63 } 63 }
64 } 64 }
65 65
66 impl fmt::Debug for BStr { 66 impl fmt::Debug for BStr {
67 /// Formats printable ASCII characters wit 67 /// Formats printable ASCII characters with a double quote on either end,
68 /// escaping the rest. 68 /// escaping the rest.
69 /// 69 ///
70 /// ``` 70 /// ```
71 /// # use kernel::{fmt, b_str, str::{BStr, 71 /// # use kernel::{fmt, b_str, str::{BStr, CString}};
72 /// // Embedded double quotes are escaped. 72 /// // Embedded double quotes are escaped.
73 /// let ascii = b_str!("Hello, \"BStr\"!") 73 /// let ascii = b_str!("Hello, \"BStr\"!");
74 /// let s = CString::try_from_fmt(fmt!("{: 74 /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap();
75 /// assert_eq!(s.as_bytes(), "\"Hello, \\\ 75 /// assert_eq!(s.as_bytes(), "\"Hello, \\\"BStr\\\"!\"".as_bytes());
76 /// 76 ///
77 /// let non_ascii = b_str!("😺"); 77 /// let non_ascii = b_str!("😺");
78 /// let s = CString::try_from_fmt(fmt!("{: 78 /// let s = CString::try_from_fmt(fmt!("{:?}", non_ascii)).unwrap();
79 /// assert_eq!(s.as_bytes(), "\"\\xf0\\x9f 79 /// assert_eq!(s.as_bytes(), "\"\\xf0\\x9f\\x98\\xba\"".as_bytes());
80 /// ``` 80 /// ```
81 fn fmt(&self, f: &mut fmt::Formatter<'_>) 81 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
82 f.write_char('"')?; 82 f.write_char('"')?;
83 for &b in &self.0 { 83 for &b in &self.0 {
84 match b { 84 match b {
85 // Common escape codes. 85 // Common escape codes.
86 b'\t' => f.write_str("\\t")?, 86 b'\t' => f.write_str("\\t")?,
87 b'\n' => f.write_str("\\n")?, 87 b'\n' => f.write_str("\\n")?,
88 b'\r' => f.write_str("\\r")?, 88 b'\r' => f.write_str("\\r")?,
89 // String escape characters. 89 // String escape characters.
90 b'\"' => f.write_str("\\\"")?, 90 b'\"' => f.write_str("\\\"")?,
91 b'\\' => f.write_str("\\\\")?, 91 b'\\' => f.write_str("\\\\")?,
92 // Printable characters. 92 // Printable characters.
93 0x20..=0x7e => f.write_char(b 93 0x20..=0x7e => f.write_char(b as char)?,
94 _ => write!(f, "\\x{:02x}", b) 94 _ => write!(f, "\\x{:02x}", b)?,
95 } 95 }
96 } 96 }
97 f.write_char('"') 97 f.write_char('"')
98 } 98 }
99 } 99 }
100 100
101 impl Deref for BStr { 101 impl Deref for BStr {
102 type Target = [u8]; 102 type Target = [u8];
103 103
104 #[inline] 104 #[inline]
105 fn deref(&self) -> &Self::Target { 105 fn deref(&self) -> &Self::Target {
106 &self.0 106 &self.0
107 } 107 }
108 } 108 }
109 109
110 /// Creates a new [`BStr`] from a string liter 110 /// Creates a new [`BStr`] from a string literal.
111 /// 111 ///
112 /// `b_str!` converts the supplied string lite 112 /// `b_str!` converts the supplied string literal to byte string, so non-ASCII
113 /// characters can be included. 113 /// characters can be included.
114 /// 114 ///
115 /// # Examples 115 /// # Examples
116 /// 116 ///
117 /// ``` 117 /// ```
118 /// # use kernel::b_str; 118 /// # use kernel::b_str;
119 /// # use kernel::str::BStr; 119 /// # use kernel::str::BStr;
120 /// const MY_BSTR: &BStr = b_str!("My awesome 120 /// const MY_BSTR: &BStr = b_str!("My awesome BStr!");
121 /// ``` 121 /// ```
122 #[macro_export] 122 #[macro_export]
123 macro_rules! b_str { 123 macro_rules! b_str {
124 ($str:literal) => {{ 124 ($str:literal) => {{
125 const S: &'static str = $str; 125 const S: &'static str = $str;
126 const C: &'static $crate::str::BStr = 126 const C: &'static $crate::str::BStr = $crate::str::BStr::from_bytes(S.as_bytes());
127 C 127 C
128 }}; 128 }};
129 } 129 }
130 130
131 /// Possible errors when using conversion func 131 /// Possible errors when using conversion functions in [`CStr`].
132 #[derive(Debug, Clone, Copy)] 132 #[derive(Debug, Clone, Copy)]
133 pub enum CStrConvertError { 133 pub enum CStrConvertError {
134 /// Supplied bytes contain an interior `NU 134 /// Supplied bytes contain an interior `NUL`.
135 InteriorNul, 135 InteriorNul,
136 136
137 /// Supplied bytes are not terminated by ` 137 /// Supplied bytes are not terminated by `NUL`.
138 NotNulTerminated, 138 NotNulTerminated,
139 } 139 }
140 140
141 impl From<CStrConvertError> for Error { 141 impl From<CStrConvertError> for Error {
142 #[inline] 142 #[inline]
143 fn from(_: CStrConvertError) -> Error { 143 fn from(_: CStrConvertError) -> Error {
144 EINVAL 144 EINVAL
145 } 145 }
146 } 146 }
147 147
148 /// A string that is guaranteed to have exactl 148 /// A string that is guaranteed to have exactly one `NUL` byte, which is at the
149 /// end. 149 /// end.
150 /// 150 ///
151 /// Used for interoperability with kernel APIs 151 /// Used for interoperability with kernel APIs that take C strings.
152 #[repr(transparent)] 152 #[repr(transparent)]
153 pub struct CStr([u8]); 153 pub struct CStr([u8]);
154 154
155 impl CStr { 155 impl CStr {
156 /// Returns the length of this string excl 156 /// Returns the length of this string excluding `NUL`.
157 #[inline] 157 #[inline]
158 pub const fn len(&self) -> usize { 158 pub const fn len(&self) -> usize {
159 self.len_with_nul() - 1 159 self.len_with_nul() - 1
160 } 160 }
161 161
162 /// Returns the length of this string with 162 /// Returns the length of this string with `NUL`.
163 #[inline] 163 #[inline]
164 pub const fn len_with_nul(&self) -> usize 164 pub const fn len_with_nul(&self) -> usize {
165 // SAFETY: This is one of the invarian 165 // SAFETY: This is one of the invariant of `CStr`.
166 // We add a `unreachable_unchecked` he 166 // We add a `unreachable_unchecked` here to hint the optimizer that
167 // the value returned from this functi 167 // the value returned from this function is non-zero.
168 if self.0.is_empty() { 168 if self.0.is_empty() {
169 unsafe { core::hint::unreachable_u 169 unsafe { core::hint::unreachable_unchecked() };
170 } 170 }
171 self.0.len() 171 self.0.len()
172 } 172 }
173 173
174 /// Returns `true` if the string only incl 174 /// Returns `true` if the string only includes `NUL`.
175 #[inline] 175 #[inline]
176 pub const fn is_empty(&self) -> bool { 176 pub const fn is_empty(&self) -> bool {
177 self.len() == 0 177 self.len() == 0
178 } 178 }
179 179
180 /// Wraps a raw C string pointer. 180 /// Wraps a raw C string pointer.
181 /// 181 ///
182 /// # Safety 182 /// # Safety
183 /// 183 ///
184 /// `ptr` must be a valid pointer to a `NU 184 /// `ptr` must be a valid pointer to a `NUL`-terminated C string, and it must
185 /// last at least `'a`. When `CStr` is ali 185 /// last at least `'a`. When `CStr` is alive, the memory pointed by `ptr`
186 /// must not be mutated. 186 /// must not be mutated.
187 #[inline] 187 #[inline]
188 pub unsafe fn from_char_ptr<'a>(ptr: *cons 188 pub unsafe fn from_char_ptr<'a>(ptr: *const core::ffi::c_char) -> &'a Self {
189 // SAFETY: The safety precondition gua 189 // SAFETY: The safety precondition guarantees `ptr` is a valid pointer
190 // to a `NUL`-terminated C string. 190 // to a `NUL`-terminated C string.
191 let len = unsafe { bindings::strlen(pt 191 let len = unsafe { bindings::strlen(ptr) } + 1;
192 // SAFETY: Lifetime guaranteed by the 192 // SAFETY: Lifetime guaranteed by the safety precondition.
193 let bytes = unsafe { core::slice::from 193 let bytes = unsafe { core::slice::from_raw_parts(ptr as _, len as _) };
194 // SAFETY: As `len` is returned by `st 194 // SAFETY: As `len` is returned by `strlen`, `bytes` does not contain interior `NUL`.
195 // As we have added 1 to `len`, the la 195 // As we have added 1 to `len`, the last byte is known to be `NUL`.
196 unsafe { Self::from_bytes_with_nul_unc 196 unsafe { Self::from_bytes_with_nul_unchecked(bytes) }
197 } 197 }
198 198
199 /// Creates a [`CStr`] from a `[u8]`. 199 /// Creates a [`CStr`] from a `[u8]`.
200 /// 200 ///
201 /// The provided slice must be `NUL`-termi 201 /// The provided slice must be `NUL`-terminated, does not contain any
202 /// interior `NUL` bytes. 202 /// interior `NUL` bytes.
203 pub const fn from_bytes_with_nul(bytes: &[ 203 pub const fn from_bytes_with_nul(bytes: &[u8]) -> Result<&Self, CStrConvertError> {
204 if bytes.is_empty() { 204 if bytes.is_empty() {
205 return Err(CStrConvertError::NotNu 205 return Err(CStrConvertError::NotNulTerminated);
206 } 206 }
207 if bytes[bytes.len() - 1] != 0 { 207 if bytes[bytes.len() - 1] != 0 {
208 return Err(CStrConvertError::NotNu 208 return Err(CStrConvertError::NotNulTerminated);
209 } 209 }
210 let mut i = 0; 210 let mut i = 0;
211 // `i + 1 < bytes.len()` allows LLVM t 211 // `i + 1 < bytes.len()` allows LLVM to optimize away bounds checking,
212 // while it couldn't optimize away bou 212 // while it couldn't optimize away bounds checks for `i < bytes.len() - 1`.
213 while i + 1 < bytes.len() { 213 while i + 1 < bytes.len() {
214 if bytes[i] == 0 { 214 if bytes[i] == 0 {
215 return Err(CStrConvertError::I 215 return Err(CStrConvertError::InteriorNul);
216 } 216 }
217 i += 1; 217 i += 1;
218 } 218 }
219 // SAFETY: We just checked that all pr 219 // SAFETY: We just checked that all properties hold.
220 Ok(unsafe { Self::from_bytes_with_nul_ 220 Ok(unsafe { Self::from_bytes_with_nul_unchecked(bytes) })
221 } 221 }
222 222
223 /// Creates a [`CStr`] from a `[u8]` witho 223 /// Creates a [`CStr`] from a `[u8]` without performing any additional
224 /// checks. 224 /// checks.
225 /// 225 ///
226 /// # Safety 226 /// # Safety
227 /// 227 ///
228 /// `bytes` *must* end with a `NUL` byte, 228 /// `bytes` *must* end with a `NUL` byte, and should only have a single
229 /// `NUL` byte (or the string will be trun 229 /// `NUL` byte (or the string will be truncated).
230 #[inline] 230 #[inline]
231 pub const unsafe fn from_bytes_with_nul_un 231 pub const unsafe fn from_bytes_with_nul_unchecked(bytes: &[u8]) -> &CStr {
232 // SAFETY: Properties of `bytes` guara 232 // SAFETY: Properties of `bytes` guaranteed by the safety precondition.
233 unsafe { core::mem::transmute(bytes) } 233 unsafe { core::mem::transmute(bytes) }
234 } 234 }
235 235
236 /// Creates a mutable [`CStr`] from a `[u8 236 /// Creates a mutable [`CStr`] from a `[u8]` without performing any
237 /// additional checks. 237 /// additional checks.
238 /// 238 ///
239 /// # Safety 239 /// # Safety
240 /// 240 ///
241 /// `bytes` *must* end with a `NUL` byte, 241 /// `bytes` *must* end with a `NUL` byte, and should only have a single
242 /// `NUL` byte (or the string will be trun 242 /// `NUL` byte (or the string will be truncated).
243 #[inline] 243 #[inline]
244 pub unsafe fn from_bytes_with_nul_unchecke 244 pub unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut CStr {
245 // SAFETY: Properties of `bytes` guara 245 // SAFETY: Properties of `bytes` guaranteed by the safety precondition.
246 unsafe { &mut *(bytes as *mut [u8] as 246 unsafe { &mut *(bytes as *mut [u8] as *mut CStr) }
247 } 247 }
248 248
249 /// Returns a C pointer to the string. 249 /// Returns a C pointer to the string.
250 #[inline] 250 #[inline]
251 pub const fn as_char_ptr(&self) -> *const 251 pub const fn as_char_ptr(&self) -> *const core::ffi::c_char {
252 self.0.as_ptr() as _ 252 self.0.as_ptr() as _
253 } 253 }
254 254
255 /// Convert the string to a byte slice wit 255 /// Convert the string to a byte slice without the trailing `NUL` byte.
256 #[inline] 256 #[inline]
257 pub fn as_bytes(&self) -> &[u8] { 257 pub fn as_bytes(&self) -> &[u8] {
258 &self.0[..self.len()] 258 &self.0[..self.len()]
259 } 259 }
260 260
261 /// Convert the string to a byte slice con 261 /// Convert the string to a byte slice containing the trailing `NUL` byte.
262 #[inline] 262 #[inline]
263 pub const fn as_bytes_with_nul(&self) -> & 263 pub const fn as_bytes_with_nul(&self) -> &[u8] {
264 &self.0 264 &self.0
265 } 265 }
266 266
267 /// Yields a [`&str`] slice if the [`CStr` 267 /// Yields a [`&str`] slice if the [`CStr`] contains valid UTF-8.
268 /// 268 ///
269 /// If the contents of the [`CStr`] are va 269 /// If the contents of the [`CStr`] are valid UTF-8 data, this
270 /// function will return the corresponding 270 /// function will return the corresponding [`&str`] slice. Otherwise,
271 /// it will return an error with details o 271 /// it will return an error with details of where UTF-8 validation failed.
272 /// 272 ///
273 /// # Examples 273 /// # Examples
274 /// 274 ///
275 /// ``` 275 /// ```
276 /// # use kernel::str::CStr; 276 /// # use kernel::str::CStr;
277 /// let cstr = CStr::from_bytes_with_nul(b 277 /// let cstr = CStr::from_bytes_with_nul(b"foo\0").unwrap();
278 /// assert_eq!(cstr.to_str(), Ok("foo")); 278 /// assert_eq!(cstr.to_str(), Ok("foo"));
279 /// ``` 279 /// ```
280 #[inline] 280 #[inline]
281 pub fn to_str(&self) -> Result<&str, core: 281 pub fn to_str(&self) -> Result<&str, core::str::Utf8Error> {
282 core::str::from_utf8(self.as_bytes()) 282 core::str::from_utf8(self.as_bytes())
283 } 283 }
284 284
285 /// Unsafely convert this [`CStr`] into a 285 /// Unsafely convert this [`CStr`] into a [`&str`], without checking for
286 /// valid UTF-8. 286 /// valid UTF-8.
287 /// 287 ///
288 /// # Safety 288 /// # Safety
289 /// 289 ///
290 /// The contents must be valid UTF-8. 290 /// The contents must be valid UTF-8.
291 /// 291 ///
292 /// # Examples 292 /// # Examples
293 /// 293 ///
294 /// ``` 294 /// ```
295 /// # use kernel::c_str; 295 /// # use kernel::c_str;
296 /// # use kernel::str::CStr; 296 /// # use kernel::str::CStr;
297 /// let bar = c_str!("ツ"); 297 /// let bar = c_str!("ツ");
298 /// // SAFETY: String literals are guarant 298 /// // SAFETY: String literals are guaranteed to be valid UTF-8
299 /// // by the Rust compiler. 299 /// // by the Rust compiler.
300 /// assert_eq!(unsafe { bar.as_str_uncheck 300 /// assert_eq!(unsafe { bar.as_str_unchecked() }, "ツ");
301 /// ``` 301 /// ```
302 #[inline] 302 #[inline]
303 pub unsafe fn as_str_unchecked(&self) -> & 303 pub unsafe fn as_str_unchecked(&self) -> &str {
304 unsafe { core::str::from_utf8_unchecke 304 unsafe { core::str::from_utf8_unchecked(self.as_bytes()) }
305 } 305 }
306 306
307 /// Convert this [`CStr`] into a [`CString 307 /// Convert this [`CStr`] into a [`CString`] by allocating memory and
308 /// copying over the string data. 308 /// copying over the string data.
309 pub fn to_cstring(&self) -> Result<CString 309 pub fn to_cstring(&self) -> Result<CString, AllocError> {
310 CString::try_from(self) 310 CString::try_from(self)
311 } 311 }
312 312
313 /// Converts this [`CStr`] to its ASCII lo 313 /// Converts this [`CStr`] to its ASCII lower case equivalent in-place.
314 /// 314 ///
315 /// ASCII letters 'A' to 'Z' are mapped to 315 /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z',
316 /// but non-ASCII letters are unchanged. 316 /// but non-ASCII letters are unchanged.
317 /// 317 ///
318 /// To return a new lowercased value witho 318 /// To return a new lowercased value without modifying the existing one, use
319 /// [`to_ascii_lowercase()`]. 319 /// [`to_ascii_lowercase()`].
320 /// 320 ///
321 /// [`to_ascii_lowercase()`]: #method.to_a 321 /// [`to_ascii_lowercase()`]: #method.to_ascii_lowercase
322 pub fn make_ascii_lowercase(&mut self) { 322 pub fn make_ascii_lowercase(&mut self) {
323 // INVARIANT: This doesn't introduce o 323 // INVARIANT: This doesn't introduce or remove NUL bytes in the C
324 // string. 324 // string.
325 self.0.make_ascii_lowercase(); 325 self.0.make_ascii_lowercase();
326 } 326 }
327 327
328 /// Converts this [`CStr`] to its ASCII up 328 /// Converts this [`CStr`] to its ASCII upper case equivalent in-place.
329 /// 329 ///
330 /// ASCII letters 'a' to 'z' are mapped to 330 /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z',
331 /// but non-ASCII letters are unchanged. 331 /// but non-ASCII letters are unchanged.
332 /// 332 ///
333 /// To return a new uppercased value witho 333 /// To return a new uppercased value without modifying the existing one, use
334 /// [`to_ascii_uppercase()`]. 334 /// [`to_ascii_uppercase()`].
335 /// 335 ///
336 /// [`to_ascii_uppercase()`]: #method.to_a 336 /// [`to_ascii_uppercase()`]: #method.to_ascii_uppercase
337 pub fn make_ascii_uppercase(&mut self) { 337 pub fn make_ascii_uppercase(&mut self) {
338 // INVARIANT: This doesn't introduce o 338 // INVARIANT: This doesn't introduce or remove NUL bytes in the C
339 // string. 339 // string.
340 self.0.make_ascii_uppercase(); 340 self.0.make_ascii_uppercase();
341 } 341 }
342 342
343 /// Returns a copy of this [`CString`] whe 343 /// Returns a copy of this [`CString`] where each character is mapped to its
344 /// ASCII lower case equivalent. 344 /// ASCII lower case equivalent.
345 /// 345 ///
346 /// ASCII letters 'A' to 'Z' are mapped to 346 /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z',
347 /// but non-ASCII letters are unchanged. 347 /// but non-ASCII letters are unchanged.
348 /// 348 ///
349 /// To lowercase the value in-place, use [ 349 /// To lowercase the value in-place, use [`make_ascii_lowercase`].
350 /// 350 ///
351 /// [`make_ascii_lowercase`]: str::make_as 351 /// [`make_ascii_lowercase`]: str::make_ascii_lowercase
352 pub fn to_ascii_lowercase(&self) -> Result 352 pub fn to_ascii_lowercase(&self) -> Result<CString, AllocError> {
353 let mut s = self.to_cstring()?; 353 let mut s = self.to_cstring()?;
354 354
355 s.make_ascii_lowercase(); 355 s.make_ascii_lowercase();
356 356
357 Ok(s) 357 Ok(s)
358 } 358 }
359 359
360 /// Returns a copy of this [`CString`] whe 360 /// Returns a copy of this [`CString`] where each character is mapped to its
361 /// ASCII upper case equivalent. 361 /// ASCII upper case equivalent.
362 /// 362 ///
363 /// ASCII letters 'a' to 'z' are mapped to 363 /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z',
364 /// but non-ASCII letters are unchanged. 364 /// but non-ASCII letters are unchanged.
365 /// 365 ///
366 /// To uppercase the value in-place, use [ 366 /// To uppercase the value in-place, use [`make_ascii_uppercase`].
367 /// 367 ///
368 /// [`make_ascii_uppercase`]: str::make_as 368 /// [`make_ascii_uppercase`]: str::make_ascii_uppercase
369 pub fn to_ascii_uppercase(&self) -> Result 369 pub fn to_ascii_uppercase(&self) -> Result<CString, AllocError> {
370 let mut s = self.to_cstring()?; 370 let mut s = self.to_cstring()?;
371 371
372 s.make_ascii_uppercase(); 372 s.make_ascii_uppercase();
373 373
374 Ok(s) 374 Ok(s)
375 } 375 }
376 } 376 }
377 377
378 impl fmt::Display for CStr { 378 impl fmt::Display for CStr {
379 /// Formats printable ASCII characters, es 379 /// Formats printable ASCII characters, escaping the rest.
380 /// 380 ///
381 /// ``` 381 /// ```
382 /// # use kernel::c_str; 382 /// # use kernel::c_str;
383 /// # use kernel::fmt; 383 /// # use kernel::fmt;
384 /// # use kernel::str::CStr; 384 /// # use kernel::str::CStr;
385 /// # use kernel::str::CString; 385 /// # use kernel::str::CString;
386 /// let penguin = c_str!("🐧"); 386 /// let penguin = c_str!("🐧");
387 /// let s = CString::try_from_fmt(fmt!("{} 387 /// let s = CString::try_from_fmt(fmt!("{}", penguin)).unwrap();
388 /// assert_eq!(s.as_bytes_with_nul(), "\\x 388 /// assert_eq!(s.as_bytes_with_nul(), "\\xf0\\x9f\\x90\\xa7\0".as_bytes());
389 /// 389 ///
390 /// let ascii = c_str!("so \"cool\""); 390 /// let ascii = c_str!("so \"cool\"");
391 /// let s = CString::try_from_fmt(fmt!("{} 391 /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap();
392 /// assert_eq!(s.as_bytes_with_nul(), "so 392 /// assert_eq!(s.as_bytes_with_nul(), "so \"cool\"\0".as_bytes());
393 /// ``` 393 /// ```
394 fn fmt(&self, f: &mut fmt::Formatter<'_>) 394 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
395 for &c in self.as_bytes() { 395 for &c in self.as_bytes() {
396 if (0x20..0x7f).contains(&c) { 396 if (0x20..0x7f).contains(&c) {
397 // Printable character. 397 // Printable character.
398 f.write_char(c as char)?; 398 f.write_char(c as char)?;
399 } else { 399 } else {
400 write!(f, "\\x{:02x}", c)?; 400 write!(f, "\\x{:02x}", c)?;
401 } 401 }
402 } 402 }
403 Ok(()) 403 Ok(())
404 } 404 }
405 } 405 }
406 406
407 impl fmt::Debug for CStr { 407 impl fmt::Debug for CStr {
408 /// Formats printable ASCII characters wit 408 /// Formats printable ASCII characters with a double quote on either end, escaping the rest.
409 /// 409 ///
410 /// ``` 410 /// ```
411 /// # use kernel::c_str; 411 /// # use kernel::c_str;
412 /// # use kernel::fmt; 412 /// # use kernel::fmt;
413 /// # use kernel::str::CStr; 413 /// # use kernel::str::CStr;
414 /// # use kernel::str::CString; 414 /// # use kernel::str::CString;
415 /// let penguin = c_str!("🐧"); 415 /// let penguin = c_str!("🐧");
416 /// let s = CString::try_from_fmt(fmt!("{: 416 /// let s = CString::try_from_fmt(fmt!("{:?}", penguin)).unwrap();
417 /// assert_eq!(s.as_bytes_with_nul(), "\"\ 417 /// assert_eq!(s.as_bytes_with_nul(), "\"\\xf0\\x9f\\x90\\xa7\"\0".as_bytes());
418 /// 418 ///
419 /// // Embedded double quotes are escaped. 419 /// // Embedded double quotes are escaped.
420 /// let ascii = c_str!("so \"cool\""); 420 /// let ascii = c_str!("so \"cool\"");
421 /// let s = CString::try_from_fmt(fmt!("{: 421 /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap();
422 /// assert_eq!(s.as_bytes_with_nul(), "\"s 422 /// assert_eq!(s.as_bytes_with_nul(), "\"so \\\"cool\\\"\"\0".as_bytes());
423 /// ``` 423 /// ```
424 fn fmt(&self, f: &mut fmt::Formatter<'_>) 424 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
425 f.write_str("\"")?; 425 f.write_str("\"")?;
426 for &c in self.as_bytes() { 426 for &c in self.as_bytes() {
427 match c { 427 match c {
428 // Printable characters. 428 // Printable characters.
429 b'\"' => f.write_str("\\\"")?, 429 b'\"' => f.write_str("\\\"")?,
430 0x20..=0x7e => f.write_char(c 430 0x20..=0x7e => f.write_char(c as char)?,
431 _ => write!(f, "\\x{:02x}", c) 431 _ => write!(f, "\\x{:02x}", c)?,
432 } 432 }
433 } 433 }
434 f.write_str("\"") 434 f.write_str("\"")
435 } 435 }
436 } 436 }
437 437
438 impl AsRef<BStr> for CStr { 438 impl AsRef<BStr> for CStr {
439 #[inline] 439 #[inline]
440 fn as_ref(&self) -> &BStr { 440 fn as_ref(&self) -> &BStr {
441 BStr::from_bytes(self.as_bytes()) 441 BStr::from_bytes(self.as_bytes())
442 } 442 }
443 } 443 }
444 444
445 impl Deref for CStr { 445 impl Deref for CStr {
446 type Target = BStr; 446 type Target = BStr;
447 447
448 #[inline] 448 #[inline]
449 fn deref(&self) -> &Self::Target { 449 fn deref(&self) -> &Self::Target {
450 self.as_ref() 450 self.as_ref()
451 } 451 }
452 } 452 }
453 453
454 impl Index<ops::RangeFrom<usize>> for CStr { 454 impl Index<ops::RangeFrom<usize>> for CStr {
455 type Output = CStr; 455 type Output = CStr;
456 456
457 #[inline] 457 #[inline]
458 fn index(&self, index: ops::RangeFrom<usiz 458 fn index(&self, index: ops::RangeFrom<usize>) -> &Self::Output {
459 // Delegate bounds checking to slice. 459 // Delegate bounds checking to slice.
460 // Assign to _ to mute clippy's unnece 460 // Assign to _ to mute clippy's unnecessary operation warning.
461 let _ = &self.as_bytes()[index.start.. 461 let _ = &self.as_bytes()[index.start..];
462 // SAFETY: We just checked the bounds. 462 // SAFETY: We just checked the bounds.
463 unsafe { Self::from_bytes_with_nul_unc 463 unsafe { Self::from_bytes_with_nul_unchecked(&self.0[index.start..]) }
464 } 464 }
465 } 465 }
466 466
467 impl Index<ops::RangeFull> for CStr { 467 impl Index<ops::RangeFull> for CStr {
468 type Output = CStr; 468 type Output = CStr;
469 469
470 #[inline] 470 #[inline]
471 fn index(&self, _index: ops::RangeFull) -> 471 fn index(&self, _index: ops::RangeFull) -> &Self::Output {
472 self 472 self
473 } 473 }
474 } 474 }
475 475
476 mod private { 476 mod private {
477 use core::ops; 477 use core::ops;
478 478
479 // Marker trait for index types that can b 479 // Marker trait for index types that can be forward to `BStr`.
480 pub trait CStrIndex {} 480 pub trait CStrIndex {}
481 481
482 impl CStrIndex for usize {} 482 impl CStrIndex for usize {}
483 impl CStrIndex for ops::Range<usize> {} 483 impl CStrIndex for ops::Range<usize> {}
484 impl CStrIndex for ops::RangeInclusive<usi 484 impl CStrIndex for ops::RangeInclusive<usize> {}
485 impl CStrIndex for ops::RangeToInclusive<u 485 impl CStrIndex for ops::RangeToInclusive<usize> {}
486 } 486 }
487 487
488 impl<Idx> Index<Idx> for CStr 488 impl<Idx> Index<Idx> for CStr
489 where 489 where
490 Idx: private::CStrIndex, 490 Idx: private::CStrIndex,
491 BStr: Index<Idx>, 491 BStr: Index<Idx>,
492 { 492 {
493 type Output = <BStr as Index<Idx>>::Output 493 type Output = <BStr as Index<Idx>>::Output;
494 494
495 #[inline] 495 #[inline]
496 fn index(&self, index: Idx) -> &Self::Outp 496 fn index(&self, index: Idx) -> &Self::Output {
497 &self.as_ref()[index] 497 &self.as_ref()[index]
498 } 498 }
499 } 499 }
500 500
501 /// Creates a new [`CStr`] from a string liter 501 /// Creates a new [`CStr`] from a string literal.
502 /// 502 ///
503 /// The string literal should not contain any 503 /// The string literal should not contain any `NUL` bytes.
504 /// 504 ///
505 /// # Examples 505 /// # Examples
506 /// 506 ///
507 /// ``` 507 /// ```
508 /// # use kernel::c_str; 508 /// # use kernel::c_str;
509 /// # use kernel::str::CStr; 509 /// # use kernel::str::CStr;
510 /// const MY_CSTR: &CStr = c_str!("My awesome 510 /// const MY_CSTR: &CStr = c_str!("My awesome CStr!");
511 /// ``` 511 /// ```
512 #[macro_export] 512 #[macro_export]
513 macro_rules! c_str { 513 macro_rules! c_str {
514 ($str:expr) => {{ 514 ($str:expr) => {{
515 const S: &str = concat!($str, "\0"); 515 const S: &str = concat!($str, "\0");
516 const C: &$crate::str::CStr = match $c 516 const C: &$crate::str::CStr = match $crate::str::CStr::from_bytes_with_nul(S.as_bytes()) {
517 Ok(v) => v, 517 Ok(v) => v,
518 Err(_) => panic!("string contains 518 Err(_) => panic!("string contains interior NUL"),
519 }; 519 };
520 C 520 C
521 }}; 521 }};
522 } 522 }
523 523
524 #[cfg(test)] 524 #[cfg(test)]
525 mod tests { 525 mod tests {
526 use super::*; 526 use super::*;
527 use alloc::format; 527 use alloc::format;
528 528
529 const ALL_ASCII_CHARS: &'static str = 529 const ALL_ASCII_CHARS: &'static str =
530 "\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\ 530 "\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\
531 \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x 531 \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f \
532 !\"#$%&'()*+,-./0123456789:;<=>?@\ 532 !\"#$%&'()*+,-./0123456789:;<=>?@\
533 ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcde 533 ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\\x7f\
534 \\x80\\x81\\x82\\x83\\x84\\x85\\x86\\x 534 \\x80\\x81\\x82\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8a\\x8b\\x8c\\x8d\\x8e\\x8f\
535 \\x90\\x91\\x92\\x93\\x94\\x95\\x96\\x 535 \\x90\\x91\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9a\\x9b\\x9c\\x9d\\x9e\\x9f\
536 \\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\x 536 \\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\xa7\\xa8\\xa9\\xaa\\xab\\xac\\xad\\xae\\xaf\
537 \\xb0\\xb1\\xb2\\xb3\\xb4\\xb5\\xb6\\x 537 \\xb0\\xb1\\xb2\\xb3\\xb4\\xb5\\xb6\\xb7\\xb8\\xb9\\xba\\xbb\\xbc\\xbd\\xbe\\xbf\
538 \\xc0\\xc1\\xc2\\xc3\\xc4\\xc5\\xc6\\x 538 \\xc0\\xc1\\xc2\\xc3\\xc4\\xc5\\xc6\\xc7\\xc8\\xc9\\xca\\xcb\\xcc\\xcd\\xce\\xcf\
539 \\xd0\\xd1\\xd2\\xd3\\xd4\\xd5\\xd6\\x 539 \\xd0\\xd1\\xd2\\xd3\\xd4\\xd5\\xd6\\xd7\\xd8\\xd9\\xda\\xdb\\xdc\\xdd\\xde\\xdf\
540 \\xe0\\xe1\\xe2\\xe3\\xe4\\xe5\\xe6\\x 540 \\xe0\\xe1\\xe2\\xe3\\xe4\\xe5\\xe6\\xe7\\xe8\\xe9\\xea\\xeb\\xec\\xed\\xee\\xef\
541 \\xf0\\xf1\\xf2\\xf3\\xf4\\xf5\\xf6\\x 541 \\xf0\\xf1\\xf2\\xf3\\xf4\\xf5\\xf6\\xf7\\xf8\\xf9\\xfa\\xfb\\xfc\\xfd\\xfe\\xff";
542 542
543 #[test] 543 #[test]
544 fn test_cstr_to_str() { 544 fn test_cstr_to_str() {
545 let good_bytes = b"\xf0\x9f\xa6\x80\0" 545 let good_bytes = b"\xf0\x9f\xa6\x80\0";
546 let checked_cstr = CStr::from_bytes_wi 546 let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap();
547 let checked_str = checked_cstr.to_str( 547 let checked_str = checked_cstr.to_str().unwrap();
548 assert_eq!(checked_str, "🦀"); 548 assert_eq!(checked_str, "🦀");
549 } 549 }
550 550
551 #[test] 551 #[test]
552 #[should_panic] 552 #[should_panic]
553 fn test_cstr_to_str_panic() { 553 fn test_cstr_to_str_panic() {
554 let bad_bytes = b"\xc3\x28\0"; 554 let bad_bytes = b"\xc3\x28\0";
555 let checked_cstr = CStr::from_bytes_wi 555 let checked_cstr = CStr::from_bytes_with_nul(bad_bytes).unwrap();
556 checked_cstr.to_str().unwrap(); 556 checked_cstr.to_str().unwrap();
557 } 557 }
558 558
559 #[test] 559 #[test]
560 fn test_cstr_as_str_unchecked() { 560 fn test_cstr_as_str_unchecked() {
561 let good_bytes = b"\xf0\x9f\x90\xA7\0" 561 let good_bytes = b"\xf0\x9f\x90\xA7\0";
562 let checked_cstr = CStr::from_bytes_wi 562 let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap();
563 let unchecked_str = unsafe { checked_c 563 let unchecked_str = unsafe { checked_cstr.as_str_unchecked() };
564 assert_eq!(unchecked_str, "🐧"); 564 assert_eq!(unchecked_str, "🐧");
565 } 565 }
566 566
567 #[test] 567 #[test]
568 fn test_cstr_display() { 568 fn test_cstr_display() {
569 let hello_world = CStr::from_bytes_wit 569 let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap();
570 assert_eq!(format!("{}", hello_world), 570 assert_eq!(format!("{}", hello_world), "hello, world!");
571 let non_printables = CStr::from_bytes_ 571 let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap();
572 assert_eq!(format!("{}", non_printable 572 assert_eq!(format!("{}", non_printables), "\\x01\\x09\\x0a");
573 let non_ascii = CStr::from_bytes_with_ 573 let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap();
574 assert_eq!(format!("{}", non_ascii), " 574 assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu");
575 let good_bytes = CStr::from_bytes_with 575 let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap();
576 assert_eq!(format!("{}", good_bytes), 576 assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80");
577 } 577 }
578 578
579 #[test] 579 #[test]
580 fn test_cstr_display_all_bytes() { 580 fn test_cstr_display_all_bytes() {
581 let mut bytes: [u8; 256] = [0; 256]; 581 let mut bytes: [u8; 256] = [0; 256];
582 // fill `bytes` with [1..=255] + [0] 582 // fill `bytes` with [1..=255] + [0]
583 for i in u8::MIN..=u8::MAX { 583 for i in u8::MIN..=u8::MAX {
584 bytes[i as usize] = i.wrapping_add 584 bytes[i as usize] = i.wrapping_add(1);
585 } 585 }
586 let cstr = CStr::from_bytes_with_nul(& 586 let cstr = CStr::from_bytes_with_nul(&bytes).unwrap();
587 assert_eq!(format!("{}", cstr), ALL_AS 587 assert_eq!(format!("{}", cstr), ALL_ASCII_CHARS);
588 } 588 }
589 589
590 #[test] 590 #[test]
591 fn test_cstr_debug() { 591 fn test_cstr_debug() {
592 let hello_world = CStr::from_bytes_wit 592 let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap();
593 assert_eq!(format!("{:?}", hello_world 593 assert_eq!(format!("{:?}", hello_world), "\"hello, world!\"");
594 let non_printables = CStr::from_bytes_ 594 let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap();
595 assert_eq!(format!("{:?}", non_printab 595 assert_eq!(format!("{:?}", non_printables), "\"\\x01\\x09\\x0a\"");
596 let non_ascii = CStr::from_bytes_with_ 596 let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap();
597 assert_eq!(format!("{:?}", non_ascii), 597 assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\"");
598 let good_bytes = CStr::from_bytes_with 598 let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap();
599 assert_eq!(format!("{:?}", good_bytes) 599 assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\"");
600 } 600 }
601 601
602 #[test] 602 #[test]
603 fn test_bstr_display() { 603 fn test_bstr_display() {
604 let hello_world = BStr::from_bytes(b"h 604 let hello_world = BStr::from_bytes(b"hello, world!");
605 assert_eq!(format!("{}", hello_world), 605 assert_eq!(format!("{}", hello_world), "hello, world!");
606 let escapes = BStr::from_bytes(b"_\t_\ 606 let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");
607 assert_eq!(format!("{}", escapes), "_\ 607 assert_eq!(format!("{}", escapes), "_\\t_\\n_\\r_\\_'_\"_");
608 let others = BStr::from_bytes(b"\x01") 608 let others = BStr::from_bytes(b"\x01");
609 assert_eq!(format!("{}", others), "\\x 609 assert_eq!(format!("{}", others), "\\x01");
610 let non_ascii = BStr::from_bytes(b"d\x 610 let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");
611 assert_eq!(format!("{}", non_ascii), " 611 assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu");
612 let good_bytes = BStr::from_bytes(b"\x 612 let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");
613 assert_eq!(format!("{}", good_bytes), 613 assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80");
614 } 614 }
615 615
616 #[test] 616 #[test]
617 fn test_bstr_debug() { 617 fn test_bstr_debug() {
618 let hello_world = BStr::from_bytes(b"h 618 let hello_world = BStr::from_bytes(b"hello, world!");
619 assert_eq!(format!("{:?}", hello_world 619 assert_eq!(format!("{:?}", hello_world), "\"hello, world!\"");
620 let escapes = BStr::from_bytes(b"_\t_\ 620 let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");
621 assert_eq!(format!("{:?}", escapes), " 621 assert_eq!(format!("{:?}", escapes), "\"_\\t_\\n_\\r_\\\\_'_\\\"_\"");
622 let others = BStr::from_bytes(b"\x01") 622 let others = BStr::from_bytes(b"\x01");
623 assert_eq!(format!("{:?}", others), "\ 623 assert_eq!(format!("{:?}", others), "\"\\x01\"");
624 let non_ascii = BStr::from_bytes(b"d\x 624 let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");
625 assert_eq!(format!("{:?}", non_ascii), 625 assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\"");
626 let good_bytes = BStr::from_bytes(b"\x 626 let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");
627 assert_eq!(format!("{:?}", good_bytes) 627 assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\"");
628 } 628 }
629 } 629 }
630 630
631 /// Allows formatting of [`fmt::Arguments`] in 631 /// Allows formatting of [`fmt::Arguments`] into a raw buffer.
632 /// 632 ///
633 /// It does not fail if callers write past the 633 /// It does not fail if callers write past the end of the buffer so that they can calculate the
634 /// size required to fit everything. 634 /// size required to fit everything.
635 /// 635 ///
636 /// # Invariants 636 /// # Invariants
637 /// 637 ///
638 /// The memory region between `pos` (inclusive 638 /// The memory region between `pos` (inclusive) and `end` (exclusive) is valid for writes if `pos`
639 /// is less than `end`. 639 /// is less than `end`.
640 pub(crate) struct RawFormatter { 640 pub(crate) struct RawFormatter {
641 // Use `usize` to use `saturating_*` funct 641 // Use `usize` to use `saturating_*` functions.
642 beg: usize, 642 beg: usize,
643 pos: usize, 643 pos: usize,
644 end: usize, 644 end: usize,
645 } 645 }
646 646
647 impl RawFormatter { 647 impl RawFormatter {
648 /// Creates a new instance of [`RawFormatt 648 /// Creates a new instance of [`RawFormatter`] with an empty buffer.
649 fn new() -> Self { 649 fn new() -> Self {
650 // INVARIANT: The buffer is empty, so 650 // INVARIANT: The buffer is empty, so the region that needs to be writable is empty.
651 Self { 651 Self {
652 beg: 0, 652 beg: 0,
653 pos: 0, 653 pos: 0,
654 end: 0, 654 end: 0,
655 } 655 }
656 } 656 }
657 657
658 /// Creates a new instance of [`RawFormatt 658 /// Creates a new instance of [`RawFormatter`] with the given buffer pointers.
659 /// 659 ///
660 /// # Safety 660 /// # Safety
661 /// 661 ///
662 /// If `pos` is less than `end`, then the 662 /// If `pos` is less than `end`, then the region between `pos` (inclusive) and `end`
663 /// (exclusive) must be valid for writes f 663 /// (exclusive) must be valid for writes for the lifetime of the returned [`RawFormatter`].
664 pub(crate) unsafe fn from_ptrs(pos: *mut u 664 pub(crate) unsafe fn from_ptrs(pos: *mut u8, end: *mut u8) -> Self {
665 // INVARIANT: The safety requirements 665 // INVARIANT: The safety requirements guarantee the type invariants.
666 Self { 666 Self {
667 beg: pos as _, 667 beg: pos as _,
668 pos: pos as _, 668 pos: pos as _,
669 end: end as _, 669 end: end as _,
670 } 670 }
671 } 671 }
672 672
673 /// Creates a new instance of [`RawFormatt 673 /// Creates a new instance of [`RawFormatter`] with the given buffer.
674 /// 674 ///
675 /// # Safety 675 /// # Safety
676 /// 676 ///
677 /// The memory region starting at `buf` an 677 /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes
678 /// for the lifetime of the returned [`Raw 678 /// for the lifetime of the returned [`RawFormatter`].
679 pub(crate) unsafe fn from_buffer(buf: *mut 679 pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {
680 let pos = buf as usize; 680 let pos = buf as usize;
681 // INVARIANT: We ensure that `end` is 681 // INVARIANT: We ensure that `end` is never less then `buf`, and the safety requirements
682 // guarantees that the memory region i 682 // guarantees that the memory region is valid for writes.
683 Self { 683 Self {
684 pos, 684 pos,
685 beg: pos, 685 beg: pos,
686 end: pos.saturating_add(len), 686 end: pos.saturating_add(len),
687 } 687 }
688 } 688 }
689 689
690 /// Returns the current insert position. 690 /// Returns the current insert position.
691 /// 691 ///
692 /// N.B. It may point to invalid memory. 692 /// N.B. It may point to invalid memory.
693 pub(crate) fn pos(&self) -> *mut u8 { 693 pub(crate) fn pos(&self) -> *mut u8 {
694 self.pos as _ 694 self.pos as _
695 } 695 }
696 696
697 /// Returns the number of bytes written to 697 /// Returns the number of bytes written to the formatter.
698 pub(crate) fn bytes_written(&self) -> usiz 698 pub(crate) fn bytes_written(&self) -> usize {
699 self.pos - self.beg 699 self.pos - self.beg
700 } 700 }
701 } 701 }
702 702
703 impl fmt::Write for RawFormatter { 703 impl fmt::Write for RawFormatter {
704 fn write_str(&mut self, s: &str) -> fmt::R 704 fn write_str(&mut self, s: &str) -> fmt::Result {
705 // `pos` value after writing `len` byt 705 // `pos` value after writing `len` bytes. This does not have to be bounded by `end`, but we
706 // don't want it to wrap around to 0. 706 // don't want it to wrap around to 0.
707 let pos_new = self.pos.saturating_add( 707 let pos_new = self.pos.saturating_add(s.len());
708 708
709 // Amount that we can copy. `saturatin 709 // Amount that we can copy. `saturating_sub` ensures we get 0 if `pos` goes past `end`.
710 let len_to_copy = core::cmp::min(pos_n 710 let len_to_copy = core::cmp::min(pos_new, self.end).saturating_sub(self.pos);
711 711
712 if len_to_copy > 0 { 712 if len_to_copy > 0 {
713 // SAFETY: If `len_to_copy` is non 713 // SAFETY: If `len_to_copy` is non-zero, then we know `pos` has not gone past `end`
714 // yet, so it is valid for write p 714 // yet, so it is valid for write per the type invariants.
715 unsafe { 715 unsafe {
716 core::ptr::copy_nonoverlapping 716 core::ptr::copy_nonoverlapping(
717 s.as_bytes().as_ptr(), 717 s.as_bytes().as_ptr(),
718 self.pos as *mut u8, 718 self.pos as *mut u8,
719 len_to_copy, 719 len_to_copy,
720 ) 720 )
721 }; 721 };
722 } 722 }
723 723
724 self.pos = pos_new; 724 self.pos = pos_new;
725 Ok(()) 725 Ok(())
726 } 726 }
727 } 727 }
728 728
729 /// Allows formatting of [`fmt::Arguments`] in 729 /// Allows formatting of [`fmt::Arguments`] into a raw buffer.
730 /// 730 ///
731 /// Fails if callers attempt to write more tha 731 /// Fails if callers attempt to write more than will fit in the buffer.
732 pub(crate) struct Formatter(RawFormatter); 732 pub(crate) struct Formatter(RawFormatter);
733 733
734 impl Formatter { 734 impl Formatter {
735 /// Creates a new instance of [`Formatter` 735 /// Creates a new instance of [`Formatter`] with the given buffer.
736 /// 736 ///
737 /// # Safety 737 /// # Safety
738 /// 738 ///
739 /// The memory region starting at `buf` an 739 /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes
740 /// for the lifetime of the returned [`For 740 /// for the lifetime of the returned [`Formatter`].
741 pub(crate) unsafe fn from_buffer(buf: *mut 741 pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {
742 // SAFETY: The safety requirements of 742 // SAFETY: The safety requirements of this function satisfy those of the callee.
743 Self(unsafe { RawFormatter::from_buffe 743 Self(unsafe { RawFormatter::from_buffer(buf, len) })
744 } 744 }
745 } 745 }
746 746
747 impl Deref for Formatter { 747 impl Deref for Formatter {
748 type Target = RawFormatter; 748 type Target = RawFormatter;
749 749
750 fn deref(&self) -> &Self::Target { 750 fn deref(&self) -> &Self::Target {
751 &self.0 751 &self.0
752 } 752 }
753 } 753 }
754 754
755 impl fmt::Write for Formatter { 755 impl fmt::Write for Formatter {
756 fn write_str(&mut self, s: &str) -> fmt::R 756 fn write_str(&mut self, s: &str) -> fmt::Result {
757 self.0.write_str(s)?; 757 self.0.write_str(s)?;
758 758
759 // Fail the request if we go past the 759 // Fail the request if we go past the end of the buffer.
760 if self.0.pos > self.0.end { 760 if self.0.pos > self.0.end {
761 Err(fmt::Error) 761 Err(fmt::Error)
762 } else { 762 } else {
763 Ok(()) 763 Ok(())
764 } 764 }
765 } 765 }
766 } 766 }
767 767
768 /// An owned string that is guaranteed to have 768 /// An owned string that is guaranteed to have exactly one `NUL` byte, which is at the end.
769 /// 769 ///
770 /// Used for interoperability with kernel APIs 770 /// Used for interoperability with kernel APIs that take C strings.
771 /// 771 ///
772 /// # Invariants 772 /// # Invariants
773 /// 773 ///
774 /// The string is always `NUL`-terminated and 774 /// The string is always `NUL`-terminated and contains no other `NUL` bytes.
775 /// 775 ///
776 /// # Examples 776 /// # Examples
777 /// 777 ///
778 /// ``` 778 /// ```
779 /// use kernel::{str::CString, fmt}; 779 /// use kernel::{str::CString, fmt};
780 /// 780 ///
781 /// let s = CString::try_from_fmt(fmt!("{}{}{} 781 /// let s = CString::try_from_fmt(fmt!("{}{}{}", "abc", 10, 20)).unwrap();
782 /// assert_eq!(s.as_bytes_with_nul(), "abc1020 782 /// assert_eq!(s.as_bytes_with_nul(), "abc1020\0".as_bytes());
783 /// 783 ///
784 /// let tmp = "testing"; 784 /// let tmp = "testing";
785 /// let s = CString::try_from_fmt(fmt!("{tmp}{ 785 /// let s = CString::try_from_fmt(fmt!("{tmp}{}", 123)).unwrap();
786 /// assert_eq!(s.as_bytes_with_nul(), "testing 786 /// assert_eq!(s.as_bytes_with_nul(), "testing123\0".as_bytes());
787 /// 787 ///
788 /// // This fails because it has an embedded ` 788 /// // This fails because it has an embedded `NUL` byte.
789 /// let s = CString::try_from_fmt(fmt!("a\0b{} 789 /// let s = CString::try_from_fmt(fmt!("a\0b{}", 123));
790 /// assert_eq!(s.is_ok(), false); 790 /// assert_eq!(s.is_ok(), false);
791 /// ``` 791 /// ```
792 pub struct CString { 792 pub struct CString {
793 buf: Vec<u8>, 793 buf: Vec<u8>,
794 } 794 }
795 795
796 impl CString { 796 impl CString {
797 /// Creates an instance of [`CString`] fro 797 /// Creates an instance of [`CString`] from the given formatted arguments.
798 pub fn try_from_fmt(args: fmt::Arguments<' 798 pub fn try_from_fmt(args: fmt::Arguments<'_>) -> Result<Self, Error> {
799 // Calculate the size needed (formatte 799 // Calculate the size needed (formatted string plus `NUL` terminator).
800 let mut f = RawFormatter::new(); 800 let mut f = RawFormatter::new();
801 f.write_fmt(args)?; 801 f.write_fmt(args)?;
802 f.write_str("\0")?; 802 f.write_str("\0")?;
803 let size = f.bytes_written(); 803 let size = f.bytes_written();
804 804
805 // Allocate a vector with the required 805 // Allocate a vector with the required number of bytes, and write to it.
806 let mut buf = <Vec<_> as VecExt<_>>::w 806 let mut buf = <Vec<_> as VecExt<_>>::with_capacity(size, GFP_KERNEL)?;
807 // SAFETY: The buffer stored in `buf` 807 // SAFETY: The buffer stored in `buf` is at least of size `size` and is valid for writes.
808 let mut f = unsafe { Formatter::from_b 808 let mut f = unsafe { Formatter::from_buffer(buf.as_mut_ptr(), size) };
809 f.write_fmt(args)?; 809 f.write_fmt(args)?;
810 f.write_str("\0")?; 810 f.write_str("\0")?;
811 811
812 // SAFETY: The number of bytes that ca 812 // SAFETY: The number of bytes that can be written to `f` is bounded by `size`, which is
813 // `buf`'s capacity. The contents of t 813 // `buf`'s capacity. The contents of the buffer have been initialised by writes to `f`.
814 unsafe { buf.set_len(f.bytes_written() 814 unsafe { buf.set_len(f.bytes_written()) };
815 815
816 // Check that there are no `NUL` bytes 816 // Check that there are no `NUL` bytes before the end.
817 // SAFETY: The buffer is valid for rea 817 // SAFETY: The buffer is valid for read because `f.bytes_written()` is bounded by `size`
818 // (which the minimum buffer size) and 818 // (which the minimum buffer size) and is non-zero (we wrote at least the `NUL` terminator)
819 // so `f.bytes_written() - 1` doesn't 819 // so `f.bytes_written() - 1` doesn't underflow.
820 let ptr = unsafe { bindings::memchr(bu 820 let ptr = unsafe { bindings::memchr(buf.as_ptr().cast(), 0, (f.bytes_written() - 1) as _) };
821 if !ptr.is_null() { 821 if !ptr.is_null() {
822 return Err(EINVAL); 822 return Err(EINVAL);
823 } 823 }
824 824
825 // INVARIANT: We wrote the `NUL` termi 825 // INVARIANT: We wrote the `NUL` terminator and checked above that no other `NUL` bytes
826 // exist in the buffer. 826 // exist in the buffer.
827 Ok(Self { buf }) 827 Ok(Self { buf })
828 } 828 }
829 } 829 }
830 830
831 impl Deref for CString { 831 impl Deref for CString {
832 type Target = CStr; 832 type Target = CStr;
833 833
834 fn deref(&self) -> &Self::Target { 834 fn deref(&self) -> &Self::Target {
835 // SAFETY: The type invariants guarant 835 // SAFETY: The type invariants guarantee that the string is `NUL`-terminated and that no
836 // other `NUL` bytes exist. 836 // other `NUL` bytes exist.
837 unsafe { CStr::from_bytes_with_nul_unc 837 unsafe { CStr::from_bytes_with_nul_unchecked(self.buf.as_slice()) }
838 } 838 }
839 } 839 }
840 840
841 impl DerefMut for CString { 841 impl DerefMut for CString {
842 fn deref_mut(&mut self) -> &mut Self::Targ 842 fn deref_mut(&mut self) -> &mut Self::Target {
843 // SAFETY: A `CString` is always NUL-t 843 // SAFETY: A `CString` is always NUL-terminated and contains no other
844 // NUL bytes. 844 // NUL bytes.
845 unsafe { CStr::from_bytes_with_nul_unc 845 unsafe { CStr::from_bytes_with_nul_unchecked_mut(self.buf.as_mut_slice()) }
846 } 846 }
847 } 847 }
848 848
849 impl<'a> TryFrom<&'a CStr> for CString { 849 impl<'a> TryFrom<&'a CStr> for CString {
850 type Error = AllocError; 850 type Error = AllocError;
851 851
852 fn try_from(cstr: &'a CStr) -> Result<CStr 852 fn try_from(cstr: &'a CStr) -> Result<CString, AllocError> {
853 let mut buf = Vec::new(); 853 let mut buf = Vec::new();
854 854
855 <Vec<_> as VecExt<_>>::extend_from_sli 855 <Vec<_> as VecExt<_>>::extend_from_slice(&mut buf, cstr.as_bytes_with_nul(), GFP_KERNEL)
856 .map_err(|_| AllocError)?; 856 .map_err(|_| AllocError)?;
857 857
858 // INVARIANT: The `CStr` and `CString` 858 // INVARIANT: The `CStr` and `CString` types have the same invariants for
859 // the string data, and we copied it o 859 // the string data, and we copied it over without changes.
860 Ok(CString { buf }) 860 Ok(CString { buf })
861 } 861 }
862 } 862 }
863 863
864 impl fmt::Debug for CString { 864 impl fmt::Debug for CString {
865 fn fmt(&self, f: &mut fmt::Formatter<'_>) 865 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
866 fmt::Debug::fmt(&**self, f) 866 fmt::Debug::fmt(&**self, f)
867 } 867 }
868 } 868 }
869 869
870 /// A convenience alias for [`core::format_arg 870 /// A convenience alias for [`core::format_args`].
871 #[macro_export] 871 #[macro_export]
872 macro_rules! fmt { 872 macro_rules! fmt {
873 ($($f:tt)*) => ( core::format_args!($($f)* 873 ($($f:tt)*) => ( core::format_args!($($f)*) )
874 } 874 }
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.