projects/linux·blob v7.0 · refs

885 lines · 29.2 KiB

1// SPDX-License-Identifier: GPL-2.0
2
3//! String representations.
4
5use crate::{
6 alloc::{flags::*, AllocError, KVec},
7 error::{to_result, Result},
8 fmt::{self, Write},
9 prelude::*,
10};
11use core::{
12 marker::PhantomData,
13 ops::{Deref, DerefMut, Index},
14};
15
16pub use crate::prelude::CStr;
17
18pub mod parse_int;
19
20/// Byte string without UTF-8 validity guarantee.
21#[repr(transparent)]
22pub struct BStr([u8]);
23
24impl BStr {
25 /// Returns the length of this string.
26 #[inline]
27 pub const fn len(&self) -> usize {
28 self.0.len()
29 }
30
31 /// Returns `true` if the string is empty.
32 #[inline]
33 pub const fn is_empty(&self) -> bool {
34 self.len() == 0
35 }
36
37 /// Creates a [`BStr`] from a `[u8]`.
38 #[inline]
39 pub const fn from_bytes(bytes: &[u8]) -> &Self {
40 // SAFETY: `BStr` is transparent to `[u8]`.
41 unsafe { &*(core::ptr::from_ref(bytes) as *const BStr) }
42 }
43
44 /// Strip a prefix from `self`. Delegates to [`slice::strip_prefix`].
45 ///
46 /// # Examples
47 ///
48 /// ```
49 /// # use kernel::b_str;
50 /// assert_eq!(Some(b_str!("bar")), b_str!("foobar").strip_prefix(b_str!("foo")));
51 /// assert_eq!(None, b_str!("foobar").strip_prefix(b_str!("bar")));
52 /// assert_eq!(Some(b_str!("foobar")), b_str!("foobar").strip_prefix(b_str!("")));
53 /// assert_eq!(Some(b_str!("")), b_str!("foobar").strip_prefix(b_str!("foobar")));
54 /// ```
55 pub fn strip_prefix(&self, pattern: impl AsRef<Self>) -> Option<&BStr> {
56 self.deref()
57 .strip_prefix(pattern.as_ref().deref())
58 .map(Self::from_bytes)
59 }
60}
61
62impl fmt::Display for BStr {
63 /// Formats printable ASCII characters, escaping the rest.
64 ///
65 /// ```
66 /// # use kernel::{prelude::fmt, b_str, str::{BStr, CString}};
67 /// let ascii = b_str!("Hello, BStr!");
68 /// let s = CString::try_from_fmt(fmt!("{ascii}"))?;
69 /// assert_eq!(s.to_bytes(), "Hello, BStr!".as_bytes());
70 ///
71 /// let non_ascii = b_str!("🦀");
72 /// let s = CString::try_from_fmt(fmt!("{non_ascii}"))?;
73 /// assert_eq!(s.to_bytes(), "\\xf0\\x9f\\xa6\\x80".as_bytes());
74 /// # Ok::<(), kernel::error::Error>(())
75 /// ```
76 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
77 for &b in &self.0 {
78 match b {
79 // Common escape codes.
80 b'\t' => f.write_str("\\t")?,
81 b'\n' => f.write_str("\\n")?,
82 b'\r' => f.write_str("\\r")?,
83 // Printable characters.
84 0x20..=0x7e => f.write_char(b as char)?,
85 _ => write!(f, "\\x{b:02x}")?,
86 }
87 }
88 Ok(())
89 }
90}
91
92impl fmt::Debug for BStr {
93 /// Formats printable ASCII characters with a double quote on either end,
94 /// escaping the rest.
95 ///
96 /// ```
97 /// # use kernel::{prelude::fmt, b_str, str::{BStr, CString}};
98 /// // Embedded double quotes are escaped.
99 /// let ascii = b_str!("Hello, \"BStr\"!");
100 /// let s = CString::try_from_fmt(fmt!("{ascii:?}"))?;
101 /// assert_eq!(s.to_bytes(), "\"Hello, \\\"BStr\\\"!\"".as_bytes());
102 ///
103 /// let non_ascii = b_str!("😺");
104 /// let s = CString::try_from_fmt(fmt!("{non_ascii:?}"))?;
105 /// assert_eq!(s.to_bytes(), "\"\\xf0\\x9f\\x98\\xba\"".as_bytes());
106 /// # Ok::<(), kernel::error::Error>(())
107 /// ```
108 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
109 f.write_char('"')?;
110 for &b in &self.0 {
111 match b {
112 // Common escape codes.
113 b'\t' => f.write_str("\\t")?,
114 b'\n' => f.write_str("\\n")?,
115 b'\r' => f.write_str("\\r")?,
116 // String escape characters.
117 b'\"' => f.write_str("\\\"")?,
118 b'\\' => f.write_str("\\\\")?,
119 // Printable characters.
120 0x20..=0x7e => f.write_char(b as char)?,
121 _ => write!(f, "\\x{b:02x}")?,
122 }
123 }
124 f.write_char('"')
125 }
126}
127
128impl Deref for BStr {
129 type Target = [u8];
130
131 #[inline]
132 fn deref(&self) -> &Self::Target {
133 &self.0
134 }
135}
136
137impl PartialEq for BStr {
138 fn eq(&self, other: &Self) -> bool {
139 self.deref().eq(other.deref())
140 }
141}
142
143impl<Idx> Index<Idx> for BStr
144where
145 [u8]: Index<Idx, Output = [u8]>,
146{
147 type Output = Self;
148
149 fn index(&self, index: Idx) -> &Self::Output {
150 BStr::from_bytes(&self.0[index])
151 }
152}
153
154impl AsRef<BStr> for [u8] {
155 fn as_ref(&self) -> &BStr {
156 BStr::from_bytes(self)
157 }
158}
159
160impl AsRef<BStr> for BStr {
161 fn as_ref(&self) -> &BStr {
162 self
163 }
164}
165
166/// Creates a new [`BStr`] from a string literal.
167///
168/// `b_str!` converts the supplied string literal to byte string, so non-ASCII
169/// characters can be included.
170///
171/// # Examples
172///
173/// ```
174/// # use kernel::b_str;
175/// # use kernel::str::BStr;
176/// const MY_BSTR: &BStr = b_str!("My awesome BStr!");
177/// ```
178#[macro_export]
179macro_rules! b_str {
180 ($str:literal) => {{
181 const S: &'static str = $str;
182 const C: &'static $crate::str::BStr = $crate::str::BStr::from_bytes(S.as_bytes());
183 C
184 }};
185}
186
187/// Returns a C pointer to the string.
188// It is a free function rather than a method on an extension trait because:
189//
190// - error[E0379]: functions in trait impls cannot be declared const
191#[inline]
192pub const fn as_char_ptr_in_const_context(c_str: &CStr) -> *const c_char {
193 c_str.as_ptr().cast()
194}
195
196mod private {
197 pub trait Sealed {}
198
199 impl Sealed for super::CStr {}
200}
201
202/// Extensions to [`CStr`].
203pub trait CStrExt: private::Sealed {
204 /// Wraps a raw C string pointer.
205 ///
206 /// # Safety
207 ///
208 /// `ptr` must be a valid pointer to a `NUL`-terminated C string, and it must
209 /// last at least `'a`. When `CStr` is alive, the memory pointed by `ptr`
210 /// must not be mutated.
211 // This function exists to paper over the fact that `CStr::from_ptr` takes a `*const
212 // core::ffi::c_char` rather than a `*const crate::ffi::c_char`.
213 unsafe fn from_char_ptr<'a>(ptr: *const c_char) -> &'a Self;
214
215 /// Creates a mutable [`CStr`] from a `[u8]` without performing any
216 /// additional checks.
217 ///
218 /// # Safety
219 ///
220 /// `bytes` *must* end with a `NUL` byte, and should only have a single
221 /// `NUL` byte (or the string will be truncated).
222 unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut Self;
223
224 /// Returns a C pointer to the string.
225 // This function exists to paper over the fact that `CStr::as_ptr` returns a `*const
226 // core::ffi::c_char` rather than a `*const crate::ffi::c_char`.
227 fn as_char_ptr(&self) -> *const c_char;
228
229 /// Convert this [`CStr`] into a [`CString`] by allocating memory and
230 /// copying over the string data.
231 fn to_cstring(&self) -> Result<CString, AllocError>;
232
233 /// Converts this [`CStr`] to its ASCII lower case equivalent in-place.
234 ///
235 /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z',
236 /// but non-ASCII letters are unchanged.
237 ///
238 /// To return a new lowercased value without modifying the existing one, use
239 /// [`to_ascii_lowercase()`].
240 ///
241 /// [`to_ascii_lowercase()`]: #method.to_ascii_lowercase
242 fn make_ascii_lowercase(&mut self);
243
244 /// Converts this [`CStr`] to its ASCII upper case equivalent in-place.
245 ///
246 /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z',
247 /// but non-ASCII letters are unchanged.
248 ///
249 /// To return a new uppercased value without modifying the existing one, use
250 /// [`to_ascii_uppercase()`].
251 ///
252 /// [`to_ascii_uppercase()`]: #method.to_ascii_uppercase
253 fn make_ascii_uppercase(&mut self);
254
255 /// Returns a copy of this [`CString`] where each character is mapped to its
256 /// ASCII lower case equivalent.
257 ///
258 /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z',
259 /// but non-ASCII letters are unchanged.
260 ///
261 /// To lowercase the value in-place, use [`make_ascii_lowercase`].
262 ///
263 /// [`make_ascii_lowercase`]: str::make_ascii_lowercase
264 fn to_ascii_lowercase(&self) -> Result<CString, AllocError>;
265
266 /// Returns a copy of this [`CString`] where each character is mapped to its
267 /// ASCII upper case equivalent.
268 ///
269 /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z',
270 /// but non-ASCII letters are unchanged.
271 ///
272 /// To uppercase the value in-place, use [`make_ascii_uppercase`].
273 ///
274 /// [`make_ascii_uppercase`]: str::make_ascii_uppercase
275 fn to_ascii_uppercase(&self) -> Result<CString, AllocError>;
276}
277
278impl fmt::Display for CStr {
279 /// Formats printable ASCII characters, escaping the rest.
280 ///
281 /// ```
282 /// # use kernel::prelude::fmt;
283 /// # use kernel::str::CStr;
284 /// # use kernel::str::CString;
285 /// let penguin = c"🐧";
286 /// let s = CString::try_from_fmt(fmt!("{penguin}"))?;
287 /// assert_eq!(s.to_bytes_with_nul(), "\\xf0\\x9f\\x90\\xa7\0".as_bytes());
288 ///
289 /// let ascii = c"so \"cool\"";
290 /// let s = CString::try_from_fmt(fmt!("{ascii}"))?;
291 /// assert_eq!(s.to_bytes_with_nul(), "so \"cool\"\0".as_bytes());
292 /// # Ok::<(), kernel::error::Error>(())
293 /// ```
294 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
295 for &c in self.to_bytes() {
296 if (0x20..0x7f).contains(&c) {
297 // Printable character.
298 f.write_char(c as char)?;
299 } else {
300 write!(f, "\\x{c:02x}")?;
301 }
302 }
303 Ok(())
304 }
305}
306
307/// Converts a mutable C string to a mutable byte slice.
308///
309/// # Safety
310///
311/// The caller must ensure that the slice ends in a NUL byte and contains no other NUL bytes before
312/// the borrow ends and the underlying [`CStr`] is used.
313unsafe fn to_bytes_mut(s: &mut CStr) -> &mut [u8] {
314 // SAFETY: the cast from `&CStr` to `&[u8]` is safe since `CStr` has the same layout as `&[u8]`
315 // (this is technically not guaranteed, but we rely on it here). The pointer dereference is
316 // safe since it comes from a mutable reference which is guaranteed to be valid for writes.
317 unsafe { &mut *(core::ptr::from_mut(s) as *mut [u8]) }
318}
319
320impl CStrExt for CStr {
321 #[inline]
322 unsafe fn from_char_ptr<'a>(ptr: *const c_char) -> &'a Self {
323 // SAFETY: The safety preconditions are the same as for `CStr::from_ptr`.
324 unsafe { CStr::from_ptr(ptr.cast()) }
325 }
326
327 #[inline]
328 unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut Self {
329 // SAFETY: the cast from `&[u8]` to `&CStr` is safe since the properties of `bytes` are
330 // guaranteed by the safety precondition and `CStr` has the same layout as `&[u8]` (this is
331 // technically not guaranteed, but we rely on it here). The pointer dereference is safe
332 // since it comes from a mutable reference which is guaranteed to be valid for writes.
333 unsafe { &mut *(core::ptr::from_mut(bytes) as *mut CStr) }
334 }
335
336 #[inline]
337 fn as_char_ptr(&self) -> *const c_char {
338 self.as_ptr().cast()
339 }
340
341 fn to_cstring(&self) -> Result<CString, AllocError> {
342 CString::try_from(self)
343 }
344
345 fn make_ascii_lowercase(&mut self) {
346 // SAFETY: This doesn't introduce or remove NUL bytes in the C string.
347 unsafe { to_bytes_mut(self) }.make_ascii_lowercase();
348 }
349
350 fn make_ascii_uppercase(&mut self) {
351 // SAFETY: This doesn't introduce or remove NUL bytes in the C string.
352 unsafe { to_bytes_mut(self) }.make_ascii_uppercase();
353 }
354
355 fn to_ascii_lowercase(&self) -> Result<CString, AllocError> {
356 let mut s = self.to_cstring()?;
357
358 s.make_ascii_lowercase();
359
360 Ok(s)
361 }
362
363 fn to_ascii_uppercase(&self) -> Result<CString, AllocError> {
364 let mut s = self.to_cstring()?;
365
366 s.make_ascii_uppercase();
367
368 Ok(s)
369 }
370}
371
372impl AsRef<BStr> for CStr {
373 #[inline]
374 fn as_ref(&self) -> &BStr {
375 BStr::from_bytes(self.to_bytes())
376 }
377}
378
379/// Creates a new [`CStr`] from a string literal.
380///
381/// The string literal should not contain any `NUL` bytes.
382///
383/// # Examples
384///
385/// ```
386/// # use kernel::c_str;
387/// # use kernel::str::CStr;
388/// const MY_CSTR: &CStr = c_str!("My awesome CStr!");
389/// ```
390#[macro_export]
391macro_rules! c_str {
392 ($str:expr) => {{
393 const S: &str = concat!($str, "\0");
394 const C: &$crate::str::CStr = match $crate::str::CStr::from_bytes_with_nul(S.as_bytes()) {
395 Ok(v) => v,
396 Err(_) => panic!("string contains interior NUL"),
397 };
398 C
399 }};
400}
401
402#[kunit_tests(rust_kernel_str)]
403mod tests {
404 use super::*;
405
406 impl From<core::ffi::FromBytesWithNulError> for Error {
407 #[inline]
408 fn from(_: core::ffi::FromBytesWithNulError) -> Error {
409 EINVAL
410 }
411 }
412
413 macro_rules! format {
414 ($($f:tt)*) => ({
415 CString::try_from_fmt(fmt!($($f)*))?.to_str()?
416 })
417 }
418
419 const ALL_ASCII_CHARS: &str =
420 "\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\
421 \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f \
422 !\"#$%&'()*+,-./0123456789:;<=>?@\
423 ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\\x7f\
424 \\x80\\x81\\x82\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8a\\x8b\\x8c\\x8d\\x8e\\x8f\
425 \\x90\\x91\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9a\\x9b\\x9c\\x9d\\x9e\\x9f\
426 \\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\xa7\\xa8\\xa9\\xaa\\xab\\xac\\xad\\xae\\xaf\
427 \\xb0\\xb1\\xb2\\xb3\\xb4\\xb5\\xb6\\xb7\\xb8\\xb9\\xba\\xbb\\xbc\\xbd\\xbe\\xbf\
428 \\xc0\\xc1\\xc2\\xc3\\xc4\\xc5\\xc6\\xc7\\xc8\\xc9\\xca\\xcb\\xcc\\xcd\\xce\\xcf\
429 \\xd0\\xd1\\xd2\\xd3\\xd4\\xd5\\xd6\\xd7\\xd8\\xd9\\xda\\xdb\\xdc\\xdd\\xde\\xdf\
430 \\xe0\\xe1\\xe2\\xe3\\xe4\\xe5\\xe6\\xe7\\xe8\\xe9\\xea\\xeb\\xec\\xed\\xee\\xef\
431 \\xf0\\xf1\\xf2\\xf3\\xf4\\xf5\\xf6\\xf7\\xf8\\xf9\\xfa\\xfb\\xfc\\xfd\\xfe\\xff";
432
433 #[test]
434 fn test_cstr_to_str() -> Result {
435 let cstr = c"\xf0\x9f\xa6\x80";
436 let checked_str = cstr.to_str()?;
437 assert_eq!(checked_str, "🦀");
438 Ok(())
439 }
440
441 #[test]
442 fn test_cstr_to_str_invalid_utf8() -> Result {
443 let cstr = c"\xc3\x28";
444 assert!(cstr.to_str().is_err());
445 Ok(())
446 }
447
448 #[test]
449 fn test_cstr_display() -> Result {
450 let hello_world = c"hello, world!";
451 assert_eq!(format!("{hello_world}"), "hello, world!");
452 let non_printables = c"\x01\x09\x0a";
453 assert_eq!(format!("{non_printables}"), "\\x01\\x09\\x0a");
454 let non_ascii = c"d\xe9j\xe0 vu";
455 assert_eq!(format!("{non_ascii}"), "d\\xe9j\\xe0 vu");
456 let good_bytes = c"\xf0\x9f\xa6\x80";
457 assert_eq!(format!("{good_bytes}"), "\\xf0\\x9f\\xa6\\x80");
458 Ok(())
459 }
460
461 #[test]
462 fn test_cstr_display_all_bytes() -> Result {
463 let mut bytes: [u8; 256] = [0; 256];
464 // fill `bytes` with [1..=255] + [0]
465 for i in u8::MIN..=u8::MAX {
466 bytes[i as usize] = i.wrapping_add(1);
467 }
468 let cstr = CStr::from_bytes_with_nul(&bytes)?;
469 assert_eq!(format!("{cstr}"), ALL_ASCII_CHARS);
470 Ok(())
471 }
472
473 #[test]
474 fn test_cstr_debug() -> Result {
475 let hello_world = c"hello, world!";
476 assert_eq!(format!("{hello_world:?}"), "\"hello, world!\"");
477 let non_printables = c"\x01\x09\x0a";
478 assert_eq!(format!("{non_printables:?}"), "\"\\x01\\t\\n\"");
479 let non_ascii = c"d\xe9j\xe0 vu";
480 assert_eq!(format!("{non_ascii:?}"), "\"d\\xe9j\\xe0 vu\"");
481 Ok(())
482 }
483
484 #[test]
485 fn test_bstr_display() -> Result {
486 let hello_world = BStr::from_bytes(b"hello, world!");
487 assert_eq!(format!("{hello_world}"), "hello, world!");
488 let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");
489 assert_eq!(format!("{escapes}"), "_\\t_\\n_\\r_\\_'_\"_");
490 let others = BStr::from_bytes(b"\x01");
491 assert_eq!(format!("{others}"), "\\x01");
492 let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");
493 assert_eq!(format!("{non_ascii}"), "d\\xe9j\\xe0 vu");
494 let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");
495 assert_eq!(format!("{good_bytes}"), "\\xf0\\x9f\\xa6\\x80");
496 Ok(())
497 }
498
499 #[test]
500 fn test_bstr_debug() -> Result {
501 let hello_world = BStr::from_bytes(b"hello, world!");
502 assert_eq!(format!("{hello_world:?}"), "\"hello, world!\"");
503 let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_");
504 assert_eq!(format!("{escapes:?}"), "\"_\\t_\\n_\\r_\\\\_'_\\\"_\"");
505 let others = BStr::from_bytes(b"\x01");
506 assert_eq!(format!("{others:?}"), "\"\\x01\"");
507 let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu");
508 assert_eq!(format!("{non_ascii:?}"), "\"d\\xe9j\\xe0 vu\"");
509 let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80");
510 assert_eq!(format!("{good_bytes:?}"), "\"\\xf0\\x9f\\xa6\\x80\"");
511 Ok(())
512 }
513}
514
515/// Allows formatting of [`fmt::Arguments`] into a raw buffer.
516///
517/// It does not fail if callers write past the end of the buffer so that they can calculate the
518/// size required to fit everything.
519///
520/// # Invariants
521///
522/// The memory region between `pos` (inclusive) and `end` (exclusive) is valid for writes if `pos`
523/// is less than `end`.
524pub struct RawFormatter {
525 // Use `usize` to use `saturating_*` functions.
526 beg: usize,
527 pos: usize,
528 end: usize,
529}
530
531impl RawFormatter {
532 /// Creates a new instance of [`RawFormatter`] with an empty buffer.
533 fn new() -> Self {
534 // INVARIANT: The buffer is empty, so the region that needs to be writable is empty.
535 Self {
536 beg: 0,
537 pos: 0,
538 end: 0,
539 }
540 }
541
542 /// Creates a new instance of [`RawFormatter`] with the given buffer pointers.
543 ///
544 /// # Safety
545 ///
546 /// If `pos` is less than `end`, then the region between `pos` (inclusive) and `end`
547 /// (exclusive) must be valid for writes for the lifetime of the returned [`RawFormatter`].
548 pub(crate) unsafe fn from_ptrs(pos: *mut u8, end: *mut u8) -> Self {
549 // INVARIANT: The safety requirements guarantee the type invariants.
550 Self {
551 beg: pos as usize,
552 pos: pos as usize,
553 end: end as usize,
554 }
555 }
556
557 /// Creates a new instance of [`RawFormatter`] with the given buffer.
558 ///
559 /// # Safety
560 ///
561 /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes
562 /// for the lifetime of the returned [`RawFormatter`].
563 pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {
564 let pos = buf as usize;
565 // INVARIANT: We ensure that `end` is never less than `buf`, and the safety requirements
566 // guarantees that the memory region is valid for writes.
567 Self {
568 pos,
569 beg: pos,
570 end: pos.saturating_add(len),
571 }
572 }
573
574 /// Returns the current insert position.
575 ///
576 /// N.B. It may point to invalid memory.
577 pub(crate) fn pos(&self) -> *mut u8 {
578 self.pos as *mut u8
579 }
580
581 /// Returns the number of bytes written to the formatter.
582 pub fn bytes_written(&self) -> usize {
583 self.pos - self.beg
584 }
585}
586
587impl fmt::Write for RawFormatter {
588 fn write_str(&mut self, s: &str) -> fmt::Result {
589 // `pos` value after writing `len` bytes. This does not have to be bounded by `end`, but we
590 // don't want it to wrap around to 0.
591 let pos_new = self.pos.saturating_add(s.len());
592
593 // Amount that we can copy. `saturating_sub` ensures we get 0 if `pos` goes past `end`.
594 let len_to_copy = core::cmp::min(pos_new, self.end).saturating_sub(self.pos);
595
596 if len_to_copy > 0 {
597 // SAFETY: If `len_to_copy` is non-zero, then we know `pos` has not gone past `end`
598 // yet, so it is valid for write per the type invariants.
599 unsafe {
600 core::ptr::copy_nonoverlapping(
601 s.as_bytes().as_ptr(),
602 self.pos as *mut u8,
603 len_to_copy,
604 )
605 };
606 }
607
608 self.pos = pos_new;
609 Ok(())
610 }
611}
612
613/// Allows formatting of [`fmt::Arguments`] into a raw buffer.
614///
615/// Fails if callers attempt to write more than will fit in the buffer.
616pub struct Formatter<'a>(RawFormatter, PhantomData<&'a mut ()>);
617
618impl Formatter<'_> {
619 /// Creates a new instance of [`Formatter`] with the given buffer.
620 ///
621 /// # Safety
622 ///
623 /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes
624 /// for the lifetime of the returned [`Formatter`].
625 pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self {
626 // SAFETY: The safety requirements of this function satisfy those of the callee.
627 Self(unsafe { RawFormatter::from_buffer(buf, len) }, PhantomData)
628 }
629
630 /// Create a new [`Self`] instance.
631 pub fn new(buffer: &mut [u8]) -> Self {
632 // SAFETY: `buffer` is valid for writes for the entire length for
633 // the lifetime of `Self`.
634 unsafe { Formatter::from_buffer(buffer.as_mut_ptr(), buffer.len()) }
635 }
636}
637
638impl Deref for Formatter<'_> {
639 type Target = RawFormatter;
640
641 fn deref(&self) -> &Self::Target {
642 &self.0
643 }
644}
645
646impl fmt::Write for Formatter<'_> {
647 fn write_str(&mut self, s: &str) -> fmt::Result {
648 self.0.write_str(s)?;
649
650 // Fail the request if we go past the end of the buffer.
651 if self.0.pos > self.0.end {
652 Err(fmt::Error)
653 } else {
654 Ok(())
655 }
656 }
657}
658
659/// A mutable reference to a byte buffer where a string can be written into.
660///
661/// The buffer will be automatically null terminated after the last written character.
662///
663/// # Invariants
664///
665/// * The first byte of `buffer` is always zero.
666/// * The length of `buffer` is at least 1.
667pub struct NullTerminatedFormatter<'a> {
668 buffer: &'a mut [u8],
669}
670
671impl<'a> NullTerminatedFormatter<'a> {
672 /// Create a new [`Self`] instance.
673 pub fn new(buffer: &'a mut [u8]) -> Option<NullTerminatedFormatter<'a>> {
674 *(buffer.first_mut()?) = 0;
675
676 // INVARIANT:
677 // - We wrote zero to the first byte above.
678 // - If buffer was not at least length 1, `buffer.first_mut()` would return None.
679 Some(Self { buffer })
680 }
681}
682
683impl Write for NullTerminatedFormatter<'_> {
684 fn write_str(&mut self, s: &str) -> fmt::Result {
685 let bytes = s.as_bytes();
686 let len = bytes.len();
687
688 // We want space for a zero. By type invariant, buffer length is always at least 1, so no
689 // underflow.
690 if len > self.buffer.len() - 1 {
691 return Err(fmt::Error);
692 }
693
694 let buffer = core::mem::take(&mut self.buffer);
695 // We break the zero start invariant for a short while.
696 buffer[..len].copy_from_slice(bytes);
697 // INVARIANT: We checked above that buffer will have size at least 1 after this assignment.
698 self.buffer = &mut buffer[len..];
699
700 // INVARIANT: We write zero to the first byte of the buffer.
701 self.buffer[0] = 0;
702
703 Ok(())
704 }
705}
706
707/// # Safety
708///
709/// - `string` must point to a null terminated string that is valid for read.
710unsafe fn kstrtobool_raw(string: *const u8) -> Result<bool> {
711 let mut result: bool = false;
712
713 // SAFETY:
714 // - By function safety requirement, `string` is a valid null-terminated string.
715 // - `result` is a valid `bool` that we own.
716 to_result(unsafe { bindings::kstrtobool(string, &mut result) })?;
717 Ok(result)
718}
719
720/// Convert common user inputs into boolean values using the kernel's `kstrtobool` function.
721///
722/// This routine returns `Ok(bool)` if the first character is one of 'YyTt1NnFf0', or
723/// \[oO\]\[NnFf\] for "on" and "off". Otherwise it will return `Err(EINVAL)`.
724///
725/// # Examples
726///
727/// ```
728/// # use kernel::str::kstrtobool;
729///
730/// // Lowercase
731/// assert_eq!(kstrtobool(c"true"), Ok(true));
732/// assert_eq!(kstrtobool(c"tr"), Ok(true));
733/// assert_eq!(kstrtobool(c"t"), Ok(true));
734/// assert_eq!(kstrtobool(c"twrong"), Ok(true));
735/// assert_eq!(kstrtobool(c"false"), Ok(false));
736/// assert_eq!(kstrtobool(c"f"), Ok(false));
737/// assert_eq!(kstrtobool(c"yes"), Ok(true));
738/// assert_eq!(kstrtobool(c"no"), Ok(false));
739/// assert_eq!(kstrtobool(c"on"), Ok(true));
740/// assert_eq!(kstrtobool(c"off"), Ok(false));
741///
742/// // Camel case
743/// assert_eq!(kstrtobool(c"True"), Ok(true));
744/// assert_eq!(kstrtobool(c"False"), Ok(false));
745/// assert_eq!(kstrtobool(c"Yes"), Ok(true));
746/// assert_eq!(kstrtobool(c"No"), Ok(false));
747/// assert_eq!(kstrtobool(c"On"), Ok(true));
748/// assert_eq!(kstrtobool(c"Off"), Ok(false));
749///
750/// // All caps
751/// assert_eq!(kstrtobool(c"TRUE"), Ok(true));
752/// assert_eq!(kstrtobool(c"FALSE"), Ok(false));
753/// assert_eq!(kstrtobool(c"YES"), Ok(true));
754/// assert_eq!(kstrtobool(c"NO"), Ok(false));
755/// assert_eq!(kstrtobool(c"ON"), Ok(true));
756/// assert_eq!(kstrtobool(c"OFF"), Ok(false));
757///
758/// // Numeric
759/// assert_eq!(kstrtobool(c"1"), Ok(true));
760/// assert_eq!(kstrtobool(c"0"), Ok(false));
761///
762/// // Invalid input
763/// assert_eq!(kstrtobool(c"invalid"), Err(EINVAL));
764/// assert_eq!(kstrtobool(c"2"), Err(EINVAL));
765/// ```
766pub fn kstrtobool(string: &CStr) -> Result<bool> {
767 // SAFETY:
768 // - The pointer returned by `CStr::as_char_ptr` is guaranteed to be
769 // null terminated.
770 // - `string` is live and thus the string is valid for read.
771 unsafe { kstrtobool_raw(string.as_char_ptr()) }
772}
773
774/// Convert `&[u8]` to `bool` by deferring to [`kernel::str::kstrtobool`].
775///
776/// Only considers at most the first two bytes of `bytes`.
777pub fn kstrtobool_bytes(bytes: &[u8]) -> Result<bool> {
778 // `ktostrbool` only considers the first two bytes of the input.
779 let stack_string = [*bytes.first().unwrap_or(&0), *bytes.get(1).unwrap_or(&0), 0];
780 // SAFETY: `stack_string` is null terminated and it is live on the stack so
781 // it is valid for read.
782 unsafe { kstrtobool_raw(stack_string.as_ptr()) }
783}
784
785/// An owned string that is guaranteed to have exactly one `NUL` byte, which is at the end.
786///
787/// Used for interoperability with kernel APIs that take C strings.
788///
789/// # Invariants
790///
791/// The string is always `NUL`-terminated and contains no other `NUL` bytes.
792///
793/// # Examples
794///
795/// ```
796/// use kernel::{str::CString, prelude::fmt};
797///
798/// let s = CString::try_from_fmt(fmt!("{}{}{}", "abc", 10, 20))?;
799/// assert_eq!(s.to_bytes_with_nul(), "abc1020\0".as_bytes());
800///
801/// let tmp = "testing";
802/// let s = CString::try_from_fmt(fmt!("{tmp}{}", 123))?;
803/// assert_eq!(s.to_bytes_with_nul(), "testing123\0".as_bytes());
804///
805/// // This fails because it has an embedded `NUL` byte.
806/// let s = CString::try_from_fmt(fmt!("a\0b{}", 123));
807/// assert_eq!(s.is_ok(), false);
808/// # Ok::<(), kernel::error::Error>(())
809/// ```
810pub struct CString {
811 buf: KVec<u8>,
812}
813
814impl CString {
815 /// Creates an instance of [`CString`] from the given formatted arguments.
816 pub fn try_from_fmt(args: fmt::Arguments<'_>) -> Result<Self, Error> {
817 // Calculate the size needed (formatted string plus `NUL` terminator).
818 let mut f = RawFormatter::new();
819 f.write_fmt(args)?;
820 f.write_str("\0")?;
821 let size = f.bytes_written();
822
823 // Allocate a vector with the required number of bytes, and write to it.
824 let mut buf = KVec::with_capacity(size, GFP_KERNEL)?;
825 // SAFETY: The buffer stored in `buf` is at least of size `size` and is valid for writes.
826 let mut f = unsafe { Formatter::from_buffer(buf.as_mut_ptr(), size) };
827 f.write_fmt(args)?;
828 f.write_str("\0")?;
829
830 // SAFETY: The number of bytes that can be written to `f` is bounded by `size`, which is
831 // `buf`'s capacity. The contents of the buffer have been initialised by writes to `f`.
832 unsafe { buf.inc_len(f.bytes_written()) };
833
834 // Check that there are no `NUL` bytes before the end.
835 // SAFETY: The buffer is valid for read because `f.bytes_written()` is bounded by `size`
836 // (which the minimum buffer size) and is non-zero (we wrote at least the `NUL` terminator)
837 // so `f.bytes_written() - 1` doesn't underflow.
838 let ptr = unsafe { bindings::memchr(buf.as_ptr().cast(), 0, f.bytes_written() - 1) };
839 if !ptr.is_null() {
840 return Err(EINVAL);
841 }
842
843 // INVARIANT: We wrote the `NUL` terminator and checked above that no other `NUL` bytes
844 // exist in the buffer.
845 Ok(Self { buf })
846 }
847}
848
849impl Deref for CString {
850 type Target = CStr;
851
852 fn deref(&self) -> &Self::Target {
853 // SAFETY: The type invariants guarantee that the string is `NUL`-terminated and that no
854 // other `NUL` bytes exist.
855 unsafe { CStr::from_bytes_with_nul_unchecked(self.buf.as_slice()) }
856 }
857}
858
859impl DerefMut for CString {
860 fn deref_mut(&mut self) -> &mut Self::Target {
861 // SAFETY: A `CString` is always NUL-terminated and contains no other
862 // NUL bytes.
863 unsafe { CStr::from_bytes_with_nul_unchecked_mut(self.buf.as_mut_slice()) }
864 }
865}
866
867impl<'a> TryFrom<&'a CStr> for CString {
868 type Error = AllocError;
869
870 fn try_from(cstr: &'a CStr) -> Result<CString, AllocError> {
871 let mut buf = KVec::new();
872
873 buf.extend_from_slice(cstr.to_bytes_with_nul(), GFP_KERNEL)?;
874
875 // INVARIANT: The `CStr` and `CString` types have the same invariants for
876 // the string data, and we copied it over without changes.
877 Ok(CString { buf })
878 }
879}
880
881impl fmt::Debug for CString {
882 fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
883 fmt::Debug::fmt(&**self, f)
884 }
885}