Commit | Line | Data |
---|---|---|
247b365d WAF |
1 | // SPDX-License-Identifier: GPL-2.0 |
2 | ||
3 | //! String representations. | |
4 | ||
2c109285 | 5 | use crate::alloc::{flags::*, vec_ext::VecExt, AllocError}; |
65e1e497 | 6 | use alloc::vec::Vec; |
c07e67bd | 7 | use core::fmt::{self, Write}; |
a321f3ad | 8 | use core::ops::{self, Deref, DerefMut, Index}; |
247b365d | 9 | |
00280272 | 10 | use crate::error::{code::*, Error}; |
d126d238 | 11 | |
7c597746 | 12 | /// Byte string without UTF-8 validity guarantee. |
4951ddd5 YO |
13 | #[repr(transparent)] |
14 | pub struct BStr([u8]); | |
15 | ||
16 | impl BStr { | |
17 | /// Returns the length of this string. | |
18 | #[inline] | |
19 | pub const fn len(&self) -> usize { | |
20 | self.0.len() | |
21 | } | |
22 | ||
23 | /// Returns `true` if the string is empty. | |
24 | #[inline] | |
25 | pub const fn is_empty(&self) -> bool { | |
26 | self.len() == 0 | |
27 | } | |
28 | ||
29 | /// Creates a [`BStr`] from a `[u8]`. | |
30 | #[inline] | |
31 | pub const fn from_bytes(bytes: &[u8]) -> &Self { | |
32 | // SAFETY: `BStr` is transparent to `[u8]`. | |
33 | unsafe { &*(bytes as *const [u8] as *const BStr) } | |
34 | } | |
35 | } | |
36 | ||
37 | impl fmt::Display for BStr { | |
38 | /// Formats printable ASCII characters, escaping the rest. | |
39 | /// | |
40 | /// ``` | |
41 | /// # use kernel::{fmt, b_str, str::{BStr, CString}}; | |
42 | /// let ascii = b_str!("Hello, BStr!"); | |
43 | /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap(); | |
44 | /// assert_eq!(s.as_bytes(), "Hello, BStr!".as_bytes()); | |
45 | /// | |
46 | /// let non_ascii = b_str!("🦀"); | |
47 | /// let s = CString::try_from_fmt(fmt!("{}", non_ascii)).unwrap(); | |
48 | /// assert_eq!(s.as_bytes(), "\\xf0\\x9f\\xa6\\x80".as_bytes()); | |
49 | /// ``` | |
50 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { | |
51 | for &b in &self.0 { | |
52 | match b { | |
53 | // Common escape codes. | |
54 | b'\t' => f.write_str("\\t")?, | |
55 | b'\n' => f.write_str("\\n")?, | |
56 | b'\r' => f.write_str("\\r")?, | |
57 | // Printable characters. | |
58 | 0x20..=0x7e => f.write_char(b as char)?, | |
59 | _ => write!(f, "\\x{:02x}", b)?, | |
60 | } | |
61 | } | |
62 | Ok(()) | |
63 | } | |
64 | } | |
65 | ||
66 | impl fmt::Debug for BStr { | |
67 | /// Formats printable ASCII characters with a double quote on either end, | |
68 | /// escaping the rest. | |
69 | /// | |
70 | /// ``` | |
71 | /// # use kernel::{fmt, b_str, str::{BStr, CString}}; | |
72 | /// // Embedded double quotes are escaped. | |
73 | /// let ascii = b_str!("Hello, \"BStr\"!"); | |
74 | /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap(); | |
75 | /// assert_eq!(s.as_bytes(), "\"Hello, \\\"BStr\\\"!\"".as_bytes()); | |
76 | /// | |
77 | /// let non_ascii = b_str!("😺"); | |
78 | /// let s = CString::try_from_fmt(fmt!("{:?}", non_ascii)).unwrap(); | |
79 | /// assert_eq!(s.as_bytes(), "\"\\xf0\\x9f\\x98\\xba\"".as_bytes()); | |
80 | /// ``` | |
81 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { | |
82 | f.write_char('"')?; | |
83 | for &b in &self.0 { | |
84 | match b { | |
85 | // Common escape codes. | |
86 | b'\t' => f.write_str("\\t")?, | |
87 | b'\n' => f.write_str("\\n")?, | |
88 | b'\r' => f.write_str("\\r")?, | |
89 | // String escape characters. | |
90 | b'\"' => f.write_str("\\\"")?, | |
91 | b'\\' => f.write_str("\\\\")?, | |
92 | // Printable characters. | |
93 | 0x20..=0x7e => f.write_char(b as char)?, | |
94 | _ => write!(f, "\\x{:02x}", b)?, | |
95 | } | |
96 | } | |
97 | f.write_char('"') | |
98 | } | |
99 | } | |
100 | ||
101 | impl Deref for BStr { | |
102 | type Target = [u8]; | |
103 | ||
104 | #[inline] | |
105 | fn deref(&self) -> &Self::Target { | |
106 | &self.0 | |
107 | } | |
108 | } | |
7c597746 | 109 | |
650ec515 GG |
110 | /// Creates a new [`BStr`] from a string literal. |
111 | /// | |
112 | /// `b_str!` converts the supplied string literal to byte string, so non-ASCII | |
113 | /// characters can be included. | |
114 | /// | |
115 | /// # Examples | |
116 | /// | |
117 | /// ``` | |
118 | /// # use kernel::b_str; | |
119 | /// # use kernel::str::BStr; | |
120 | /// const MY_BSTR: &BStr = b_str!("My awesome BStr!"); | |
121 | /// ``` | |
122 | #[macro_export] | |
123 | macro_rules! b_str { | |
124 | ($str:literal) => {{ | |
125 | const S: &'static str = $str; | |
4951ddd5 | 126 | const C: &'static $crate::str::BStr = $crate::str::BStr::from_bytes(S.as_bytes()); |
650ec515 GG |
127 | C |
128 | }}; | |
129 | } | |
130 | ||
d126d238 GG |
131 | /// Possible errors when using conversion functions in [`CStr`]. |
132 | #[derive(Debug, Clone, Copy)] | |
133 | pub enum CStrConvertError { | |
134 | /// Supplied bytes contain an interior `NUL`. | |
135 | InteriorNul, | |
136 | ||
137 | /// Supplied bytes are not terminated by `NUL`. | |
138 | NotNulTerminated, | |
139 | } | |
140 | ||
141 | impl From<CStrConvertError> for Error { | |
142 | #[inline] | |
143 | fn from(_: CStrConvertError) -> Error { | |
144 | EINVAL | |
145 | } | |
146 | } | |
147 | ||
148 | /// A string that is guaranteed to have exactly one `NUL` byte, which is at the | |
149 | /// end. | |
150 | /// | |
151 | /// Used for interoperability with kernel APIs that take C strings. | |
152 | #[repr(transparent)] | |
153 | pub struct CStr([u8]); | |
154 | ||
155 | impl CStr { | |
156 | /// Returns the length of this string excluding `NUL`. | |
157 | #[inline] | |
158 | pub const fn len(&self) -> usize { | |
159 | self.len_with_nul() - 1 | |
160 | } | |
161 | ||
162 | /// Returns the length of this string with `NUL`. | |
163 | #[inline] | |
164 | pub const fn len_with_nul(&self) -> usize { | |
165 | // SAFETY: This is one of the invariant of `CStr`. | |
166 | // We add a `unreachable_unchecked` here to hint the optimizer that | |
167 | // the value returned from this function is non-zero. | |
168 | if self.0.is_empty() { | |
169 | unsafe { core::hint::unreachable_unchecked() }; | |
170 | } | |
171 | self.0.len() | |
172 | } | |
173 | ||
174 | /// Returns `true` if the string only includes `NUL`. | |
175 | #[inline] | |
176 | pub const fn is_empty(&self) -> bool { | |
177 | self.len() == 0 | |
178 | } | |
179 | ||
180 | /// Wraps a raw C string pointer. | |
181 | /// | |
182 | /// # Safety | |
183 | /// | |
184 | /// `ptr` must be a valid pointer to a `NUL`-terminated C string, and it must | |
185 | /// last at least `'a`. When `CStr` is alive, the memory pointed by `ptr` | |
186 | /// must not be mutated. | |
187 | #[inline] | |
188 | pub unsafe fn from_char_ptr<'a>(ptr: *const core::ffi::c_char) -> &'a Self { | |
189 | // SAFETY: The safety precondition guarantees `ptr` is a valid pointer | |
190 | // to a `NUL`-terminated C string. | |
191 | let len = unsafe { bindings::strlen(ptr) } + 1; | |
192 | // SAFETY: Lifetime guaranteed by the safety precondition. | |
193 | let bytes = unsafe { core::slice::from_raw_parts(ptr as _, len as _) }; | |
194 | // SAFETY: As `len` is returned by `strlen`, `bytes` does not contain interior `NUL`. | |
195 | // As we have added 1 to `len`, the last byte is known to be `NUL`. | |
196 | unsafe { Self::from_bytes_with_nul_unchecked(bytes) } | |
197 | } | |
198 | ||
199 | /// Creates a [`CStr`] from a `[u8]`. | |
200 | /// | |
201 | /// The provided slice must be `NUL`-terminated, does not contain any | |
202 | /// interior `NUL` bytes. | |
203 | pub const fn from_bytes_with_nul(bytes: &[u8]) -> Result<&Self, CStrConvertError> { | |
204 | if bytes.is_empty() { | |
205 | return Err(CStrConvertError::NotNulTerminated); | |
206 | } | |
207 | if bytes[bytes.len() - 1] != 0 { | |
208 | return Err(CStrConvertError::NotNulTerminated); | |
209 | } | |
210 | let mut i = 0; | |
211 | // `i + 1 < bytes.len()` allows LLVM to optimize away bounds checking, | |
212 | // while it couldn't optimize away bounds checks for `i < bytes.len() - 1`. | |
213 | while i + 1 < bytes.len() { | |
214 | if bytes[i] == 0 { | |
215 | return Err(CStrConvertError::InteriorNul); | |
216 | } | |
217 | i += 1; | |
218 | } | |
219 | // SAFETY: We just checked that all properties hold. | |
220 | Ok(unsafe { Self::from_bytes_with_nul_unchecked(bytes) }) | |
221 | } | |
222 | ||
223 | /// Creates a [`CStr`] from a `[u8]` without performing any additional | |
224 | /// checks. | |
225 | /// | |
226 | /// # Safety | |
227 | /// | |
228 | /// `bytes` *must* end with a `NUL` byte, and should only have a single | |
229 | /// `NUL` byte (or the string will be truncated). | |
230 | #[inline] | |
231 | pub const unsafe fn from_bytes_with_nul_unchecked(bytes: &[u8]) -> &CStr { | |
232 | // SAFETY: Properties of `bytes` guaranteed by the safety precondition. | |
233 | unsafe { core::mem::transmute(bytes) } | |
234 | } | |
235 | ||
a321f3ad DK |
236 | /// Creates a mutable [`CStr`] from a `[u8]` without performing any |
237 | /// additional checks. | |
238 | /// | |
239 | /// # Safety | |
240 | /// | |
241 | /// `bytes` *must* end with a `NUL` byte, and should only have a single | |
242 | /// `NUL` byte (or the string will be truncated). | |
243 | #[inline] | |
244 | pub unsafe fn from_bytes_with_nul_unchecked_mut(bytes: &mut [u8]) -> &mut CStr { | |
245 | // SAFETY: Properties of `bytes` guaranteed by the safety precondition. | |
246 | unsafe { &mut *(bytes as *mut [u8] as *mut CStr) } | |
247 | } | |
248 | ||
d126d238 GG |
249 | /// Returns a C pointer to the string. |
250 | #[inline] | |
251 | pub const fn as_char_ptr(&self) -> *const core::ffi::c_char { | |
252 | self.0.as_ptr() as _ | |
253 | } | |
254 | ||
8cfce47d | 255 | /// Convert the string to a byte slice without the trailing `NUL` byte. |
d126d238 GG |
256 | #[inline] |
257 | pub fn as_bytes(&self) -> &[u8] { | |
258 | &self.0[..self.len()] | |
259 | } | |
260 | ||
8cfce47d | 261 | /// Convert the string to a byte slice containing the trailing `NUL` byte. |
d126d238 GG |
262 | #[inline] |
263 | pub const fn as_bytes_with_nul(&self) -> &[u8] { | |
264 | &self.0 | |
265 | } | |
266 | ||
267 | /// Yields a [`&str`] slice if the [`CStr`] contains valid UTF-8. | |
268 | /// | |
269 | /// If the contents of the [`CStr`] are valid UTF-8 data, this | |
270 | /// function will return the corresponding [`&str`] slice. Otherwise, | |
271 | /// it will return an error with details of where UTF-8 validation failed. | |
272 | /// | |
273 | /// # Examples | |
274 | /// | |
275 | /// ``` | |
276 | /// # use kernel::str::CStr; | |
277 | /// let cstr = CStr::from_bytes_with_nul(b"foo\0").unwrap(); | |
278 | /// assert_eq!(cstr.to_str(), Ok("foo")); | |
279 | /// ``` | |
280 | #[inline] | |
281 | pub fn to_str(&self) -> Result<&str, core::str::Utf8Error> { | |
282 | core::str::from_utf8(self.as_bytes()) | |
283 | } | |
284 | ||
285 | /// Unsafely convert this [`CStr`] into a [`&str`], without checking for | |
286 | /// valid UTF-8. | |
287 | /// | |
288 | /// # Safety | |
289 | /// | |
290 | /// The contents must be valid UTF-8. | |
291 | /// | |
292 | /// # Examples | |
293 | /// | |
294 | /// ``` | |
295 | /// # use kernel::c_str; | |
296 | /// # use kernel::str::CStr; | |
4c62348d | 297 | /// let bar = c_str!("ツ"); |
d126d238 GG |
298 | /// // SAFETY: String literals are guaranteed to be valid UTF-8 |
299 | /// // by the Rust compiler. | |
d126d238 GG |
300 | /// assert_eq!(unsafe { bar.as_str_unchecked() }, "ツ"); |
301 | /// ``` | |
302 | #[inline] | |
303 | pub unsafe fn as_str_unchecked(&self) -> &str { | |
304 | unsafe { core::str::from_utf8_unchecked(self.as_bytes()) } | |
305 | } | |
66bd7533 AR |
306 | |
307 | /// Convert this [`CStr`] into a [`CString`] by allocating memory and | |
308 | /// copying over the string data. | |
309 | pub fn to_cstring(&self) -> Result<CString, AllocError> { | |
310 | CString::try_from(self) | |
311 | } | |
a321f3ad DK |
312 | |
313 | /// Converts this [`CStr`] to its ASCII lower case equivalent in-place. | |
314 | /// | |
315 | /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z', | |
316 | /// but non-ASCII letters are unchanged. | |
317 | /// | |
318 | /// To return a new lowercased value without modifying the existing one, use | |
319 | /// [`to_ascii_lowercase()`]. | |
320 | /// | |
321 | /// [`to_ascii_lowercase()`]: #method.to_ascii_lowercase | |
322 | pub fn make_ascii_lowercase(&mut self) { | |
323 | // INVARIANT: This doesn't introduce or remove NUL bytes in the C | |
324 | // string. | |
325 | self.0.make_ascii_lowercase(); | |
326 | } | |
327 | ||
328 | /// Converts this [`CStr`] to its ASCII upper case equivalent in-place. | |
329 | /// | |
330 | /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z', | |
331 | /// but non-ASCII letters are unchanged. | |
332 | /// | |
333 | /// To return a new uppercased value without modifying the existing one, use | |
334 | /// [`to_ascii_uppercase()`]. | |
335 | /// | |
336 | /// [`to_ascii_uppercase()`]: #method.to_ascii_uppercase | |
337 | pub fn make_ascii_uppercase(&mut self) { | |
338 | // INVARIANT: This doesn't introduce or remove NUL bytes in the C | |
339 | // string. | |
340 | self.0.make_ascii_uppercase(); | |
341 | } | |
342 | ||
343 | /// Returns a copy of this [`CString`] where each character is mapped to its | |
344 | /// ASCII lower case equivalent. | |
345 | /// | |
346 | /// ASCII letters 'A' to 'Z' are mapped to 'a' to 'z', | |
347 | /// but non-ASCII letters are unchanged. | |
348 | /// | |
349 | /// To lowercase the value in-place, use [`make_ascii_lowercase`]. | |
350 | /// | |
351 | /// [`make_ascii_lowercase`]: str::make_ascii_lowercase | |
352 | pub fn to_ascii_lowercase(&self) -> Result<CString, AllocError> { | |
353 | let mut s = self.to_cstring()?; | |
354 | ||
355 | s.make_ascii_lowercase(); | |
356 | ||
357 | Ok(s) | |
358 | } | |
359 | ||
360 | /// Returns a copy of this [`CString`] where each character is mapped to its | |
361 | /// ASCII upper case equivalent. | |
362 | /// | |
363 | /// ASCII letters 'a' to 'z' are mapped to 'A' to 'Z', | |
364 | /// but non-ASCII letters are unchanged. | |
365 | /// | |
366 | /// To uppercase the value in-place, use [`make_ascii_uppercase`]. | |
367 | /// | |
368 | /// [`make_ascii_uppercase`]: str::make_ascii_uppercase | |
369 | pub fn to_ascii_uppercase(&self) -> Result<CString, AllocError> { | |
370 | let mut s = self.to_cstring()?; | |
371 | ||
372 | s.make_ascii_uppercase(); | |
373 | ||
374 | Ok(s) | |
375 | } | |
d126d238 GG |
376 | } |
377 | ||
c07e67bd GG |
378 | impl fmt::Display for CStr { |
379 | /// Formats printable ASCII characters, escaping the rest. | |
380 | /// | |
381 | /// ``` | |
382 | /// # use kernel::c_str; | |
cf36a495 | 383 | /// # use kernel::fmt; |
c07e67bd GG |
384 | /// # use kernel::str::CStr; |
385 | /// # use kernel::str::CString; | |
386 | /// let penguin = c_str!("🐧"); | |
387 | /// let s = CString::try_from_fmt(fmt!("{}", penguin)).unwrap(); | |
388 | /// assert_eq!(s.as_bytes_with_nul(), "\\xf0\\x9f\\x90\\xa7\0".as_bytes()); | |
389 | /// | |
390 | /// let ascii = c_str!("so \"cool\""); | |
391 | /// let s = CString::try_from_fmt(fmt!("{}", ascii)).unwrap(); | |
392 | /// assert_eq!(s.as_bytes_with_nul(), "so \"cool\"\0".as_bytes()); | |
393 | /// ``` | |
394 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { | |
395 | for &c in self.as_bytes() { | |
396 | if (0x20..0x7f).contains(&c) { | |
397 | // Printable character. | |
398 | f.write_char(c as char)?; | |
399 | } else { | |
400 | write!(f, "\\x{:02x}", c)?; | |
401 | } | |
402 | } | |
403 | Ok(()) | |
404 | } | |
405 | } | |
406 | ||
407 | impl fmt::Debug for CStr { | |
408 | /// Formats printable ASCII characters with a double quote on either end, escaping the rest. | |
409 | /// | |
410 | /// ``` | |
411 | /// # use kernel::c_str; | |
cf36a495 | 412 | /// # use kernel::fmt; |
c07e67bd GG |
413 | /// # use kernel::str::CStr; |
414 | /// # use kernel::str::CString; | |
415 | /// let penguin = c_str!("🐧"); | |
416 | /// let s = CString::try_from_fmt(fmt!("{:?}", penguin)).unwrap(); | |
417 | /// assert_eq!(s.as_bytes_with_nul(), "\"\\xf0\\x9f\\x90\\xa7\"\0".as_bytes()); | |
418 | /// | |
419 | /// // Embedded double quotes are escaped. | |
420 | /// let ascii = c_str!("so \"cool\""); | |
421 | /// let s = CString::try_from_fmt(fmt!("{:?}", ascii)).unwrap(); | |
422 | /// assert_eq!(s.as_bytes_with_nul(), "\"so \\\"cool\\\"\"\0".as_bytes()); | |
423 | /// ``` | |
424 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { | |
425 | f.write_str("\"")?; | |
426 | for &c in self.as_bytes() { | |
427 | match c { | |
428 | // Printable characters. | |
429 | b'\"' => f.write_str("\\\"")?, | |
430 | 0x20..=0x7e => f.write_char(c as char)?, | |
431 | _ => write!(f, "\\x{:02x}", c)?, | |
432 | } | |
433 | } | |
434 | f.write_str("\"") | |
435 | } | |
436 | } | |
437 | ||
438 | impl AsRef<BStr> for CStr { | |
439 | #[inline] | |
440 | fn as_ref(&self) -> &BStr { | |
4951ddd5 | 441 | BStr::from_bytes(self.as_bytes()) |
c07e67bd GG |
442 | } |
443 | } | |
444 | ||
445 | impl Deref for CStr { | |
446 | type Target = BStr; | |
447 | ||
448 | #[inline] | |
449 | fn deref(&self) -> &Self::Target { | |
4951ddd5 | 450 | self.as_ref() |
c07e67bd GG |
451 | } |
452 | } | |
453 | ||
454 | impl Index<ops::RangeFrom<usize>> for CStr { | |
455 | type Output = CStr; | |
456 | ||
457 | #[inline] | |
458 | fn index(&self, index: ops::RangeFrom<usize>) -> &Self::Output { | |
459 | // Delegate bounds checking to slice. | |
460 | // Assign to _ to mute clippy's unnecessary operation warning. | |
461 | let _ = &self.as_bytes()[index.start..]; | |
462 | // SAFETY: We just checked the bounds. | |
463 | unsafe { Self::from_bytes_with_nul_unchecked(&self.0[index.start..]) } | |
464 | } | |
465 | } | |
466 | ||
467 | impl Index<ops::RangeFull> for CStr { | |
468 | type Output = CStr; | |
469 | ||
470 | #[inline] | |
471 | fn index(&self, _index: ops::RangeFull) -> &Self::Output { | |
472 | self | |
473 | } | |
474 | } | |
475 | ||
476 | mod private { | |
477 | use core::ops; | |
478 | ||
479 | // Marker trait for index types that can be forward to `BStr`. | |
480 | pub trait CStrIndex {} | |
481 | ||
482 | impl CStrIndex for usize {} | |
483 | impl CStrIndex for ops::Range<usize> {} | |
484 | impl CStrIndex for ops::RangeInclusive<usize> {} | |
485 | impl CStrIndex for ops::RangeToInclusive<usize> {} | |
486 | } | |
487 | ||
488 | impl<Idx> Index<Idx> for CStr | |
489 | where | |
490 | Idx: private::CStrIndex, | |
491 | BStr: Index<Idx>, | |
492 | { | |
493 | type Output = <BStr as Index<Idx>>::Output; | |
494 | ||
495 | #[inline] | |
496 | fn index(&self, index: Idx) -> &Self::Output { | |
4951ddd5 | 497 | &self.as_ref()[index] |
c07e67bd GG |
498 | } |
499 | } | |
500 | ||
b18cb00e GG |
501 | /// Creates a new [`CStr`] from a string literal. |
502 | /// | |
503 | /// The string literal should not contain any `NUL` bytes. | |
504 | /// | |
505 | /// # Examples | |
506 | /// | |
507 | /// ``` | |
508 | /// # use kernel::c_str; | |
509 | /// # use kernel::str::CStr; | |
510 | /// const MY_CSTR: &CStr = c_str!("My awesome CStr!"); | |
511 | /// ``` | |
512 | #[macro_export] | |
513 | macro_rules! c_str { | |
514 | ($str:expr) => {{ | |
515 | const S: &str = concat!($str, "\0"); | |
516 | const C: &$crate::str::CStr = match $crate::str::CStr::from_bytes_with_nul(S.as_bytes()) { | |
517 | Ok(v) => v, | |
518 | Err(_) => panic!("string contains interior NUL"), | |
519 | }; | |
520 | C | |
521 | }}; | |
522 | } | |
523 | ||
985f1f09 ML |
524 | #[cfg(test)] |
525 | mod tests { | |
526 | use super::*; | |
4951ddd5 YO |
527 | use alloc::format; |
528 | ||
529 | const ALL_ASCII_CHARS: &'static str = | |
530 | "\\x01\\x02\\x03\\x04\\x05\\x06\\x07\\x08\\x09\\x0a\\x0b\\x0c\\x0d\\x0e\\x0f\ | |
531 | \\x10\\x11\\x12\\x13\\x14\\x15\\x16\\x17\\x18\\x19\\x1a\\x1b\\x1c\\x1d\\x1e\\x1f \ | |
532 | !\"#$%&'()*+,-./0123456789:;<=>?@\ | |
533 | ABCDEFGHIJKLMNOPQRSTUVWXYZ[\\]^_`abcdefghijklmnopqrstuvwxyz{|}~\\x7f\ | |
534 | \\x80\\x81\\x82\\x83\\x84\\x85\\x86\\x87\\x88\\x89\\x8a\\x8b\\x8c\\x8d\\x8e\\x8f\ | |
535 | \\x90\\x91\\x92\\x93\\x94\\x95\\x96\\x97\\x98\\x99\\x9a\\x9b\\x9c\\x9d\\x9e\\x9f\ | |
536 | \\xa0\\xa1\\xa2\\xa3\\xa4\\xa5\\xa6\\xa7\\xa8\\xa9\\xaa\\xab\\xac\\xad\\xae\\xaf\ | |
537 | \\xb0\\xb1\\xb2\\xb3\\xb4\\xb5\\xb6\\xb7\\xb8\\xb9\\xba\\xbb\\xbc\\xbd\\xbe\\xbf\ | |
538 | \\xc0\\xc1\\xc2\\xc3\\xc4\\xc5\\xc6\\xc7\\xc8\\xc9\\xca\\xcb\\xcc\\xcd\\xce\\xcf\ | |
539 | \\xd0\\xd1\\xd2\\xd3\\xd4\\xd5\\xd6\\xd7\\xd8\\xd9\\xda\\xdb\\xdc\\xdd\\xde\\xdf\ | |
540 | \\xe0\\xe1\\xe2\\xe3\\xe4\\xe5\\xe6\\xe7\\xe8\\xe9\\xea\\xeb\\xec\\xed\\xee\\xef\ | |
541 | \\xf0\\xf1\\xf2\\xf3\\xf4\\xf5\\xf6\\xf7\\xf8\\xf9\\xfa\\xfb\\xfc\\xfd\\xfe\\xff"; | |
985f1f09 ML |
542 | |
543 | #[test] | |
544 | fn test_cstr_to_str() { | |
545 | let good_bytes = b"\xf0\x9f\xa6\x80\0"; | |
546 | let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap(); | |
547 | let checked_str = checked_cstr.to_str().unwrap(); | |
548 | assert_eq!(checked_str, "🦀"); | |
549 | } | |
550 | ||
551 | #[test] | |
552 | #[should_panic] | |
553 | fn test_cstr_to_str_panic() { | |
554 | let bad_bytes = b"\xc3\x28\0"; | |
555 | let checked_cstr = CStr::from_bytes_with_nul(bad_bytes).unwrap(); | |
556 | checked_cstr.to_str().unwrap(); | |
557 | } | |
558 | ||
559 | #[test] | |
560 | fn test_cstr_as_str_unchecked() { | |
561 | let good_bytes = b"\xf0\x9f\x90\xA7\0"; | |
562 | let checked_cstr = CStr::from_bytes_with_nul(good_bytes).unwrap(); | |
563 | let unchecked_str = unsafe { checked_cstr.as_str_unchecked() }; | |
564 | assert_eq!(unchecked_str, "🐧"); | |
565 | } | |
4951ddd5 YO |
566 | |
567 | #[test] | |
568 | fn test_cstr_display() { | |
569 | let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap(); | |
570 | assert_eq!(format!("{}", hello_world), "hello, world!"); | |
571 | let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap(); | |
572 | assert_eq!(format!("{}", non_printables), "\\x01\\x09\\x0a"); | |
573 | let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap(); | |
574 | assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu"); | |
575 | let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap(); | |
576 | assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80"); | |
577 | } | |
578 | ||
579 | #[test] | |
580 | fn test_cstr_display_all_bytes() { | |
581 | let mut bytes: [u8; 256] = [0; 256]; | |
582 | // fill `bytes` with [1..=255] + [0] | |
583 | for i in u8::MIN..=u8::MAX { | |
584 | bytes[i as usize] = i.wrapping_add(1); | |
585 | } | |
586 | let cstr = CStr::from_bytes_with_nul(&bytes).unwrap(); | |
587 | assert_eq!(format!("{}", cstr), ALL_ASCII_CHARS); | |
588 | } | |
589 | ||
590 | #[test] | |
591 | fn test_cstr_debug() { | |
592 | let hello_world = CStr::from_bytes_with_nul(b"hello, world!\0").unwrap(); | |
593 | assert_eq!(format!("{:?}", hello_world), "\"hello, world!\""); | |
594 | let non_printables = CStr::from_bytes_with_nul(b"\x01\x09\x0a\0").unwrap(); | |
595 | assert_eq!(format!("{:?}", non_printables), "\"\\x01\\x09\\x0a\""); | |
596 | let non_ascii = CStr::from_bytes_with_nul(b"d\xe9j\xe0 vu\0").unwrap(); | |
597 | assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\""); | |
598 | let good_bytes = CStr::from_bytes_with_nul(b"\xf0\x9f\xa6\x80\0").unwrap(); | |
599 | assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\""); | |
600 | } | |
601 | ||
602 | #[test] | |
603 | fn test_bstr_display() { | |
604 | let hello_world = BStr::from_bytes(b"hello, world!"); | |
605 | assert_eq!(format!("{}", hello_world), "hello, world!"); | |
606 | let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_"); | |
607 | assert_eq!(format!("{}", escapes), "_\\t_\\n_\\r_\\_'_\"_"); | |
608 | let others = BStr::from_bytes(b"\x01"); | |
609 | assert_eq!(format!("{}", others), "\\x01"); | |
610 | let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu"); | |
611 | assert_eq!(format!("{}", non_ascii), "d\\xe9j\\xe0 vu"); | |
612 | let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80"); | |
613 | assert_eq!(format!("{}", good_bytes), "\\xf0\\x9f\\xa6\\x80"); | |
614 | } | |
615 | ||
616 | #[test] | |
617 | fn test_bstr_debug() { | |
618 | let hello_world = BStr::from_bytes(b"hello, world!"); | |
619 | assert_eq!(format!("{:?}", hello_world), "\"hello, world!\""); | |
620 | let escapes = BStr::from_bytes(b"_\t_\n_\r_\\_\'_\"_"); | |
621 | assert_eq!(format!("{:?}", escapes), "\"_\\t_\\n_\\r_\\\\_'_\\\"_\""); | |
622 | let others = BStr::from_bytes(b"\x01"); | |
623 | assert_eq!(format!("{:?}", others), "\"\\x01\""); | |
624 | let non_ascii = BStr::from_bytes(b"d\xe9j\xe0 vu"); | |
625 | assert_eq!(format!("{:?}", non_ascii), "\"d\\xe9j\\xe0 vu\""); | |
626 | let good_bytes = BStr::from_bytes(b"\xf0\x9f\xa6\x80"); | |
627 | assert_eq!(format!("{:?}", good_bytes), "\"\\xf0\\x9f\\xa6\\x80\""); | |
628 | } | |
985f1f09 ML |
629 | } |
630 | ||
247b365d WAF |
631 | /// Allows formatting of [`fmt::Arguments`] into a raw buffer. |
632 | /// | |
633 | /// It does not fail if callers write past the end of the buffer so that they can calculate the | |
634 | /// size required to fit everything. | |
635 | /// | |
636 | /// # Invariants | |
637 | /// | |
638 | /// The memory region between `pos` (inclusive) and `end` (exclusive) is valid for writes if `pos` | |
639 | /// is less than `end`. | |
640 | pub(crate) struct RawFormatter { | |
641 | // Use `usize` to use `saturating_*` functions. | |
247b365d WAF |
642 | beg: usize, |
643 | pos: usize, | |
644 | end: usize, | |
645 | } | |
646 | ||
647 | impl RawFormatter { | |
65e1e497 WAF |
648 | /// Creates a new instance of [`RawFormatter`] with an empty buffer. |
649 | fn new() -> Self { | |
650 | // INVARIANT: The buffer is empty, so the region that needs to be writable is empty. | |
651 | Self { | |
652 | beg: 0, | |
653 | pos: 0, | |
654 | end: 0, | |
655 | } | |
656 | } | |
657 | ||
247b365d WAF |
658 | /// Creates a new instance of [`RawFormatter`] with the given buffer pointers. |
659 | /// | |
660 | /// # Safety | |
661 | /// | |
662 | /// If `pos` is less than `end`, then the region between `pos` (inclusive) and `end` | |
663 | /// (exclusive) must be valid for writes for the lifetime of the returned [`RawFormatter`]. | |
664 | pub(crate) unsafe fn from_ptrs(pos: *mut u8, end: *mut u8) -> Self { | |
88e8c2ec | 665 | // INVARIANT: The safety requirements guarantee the type invariants. |
247b365d WAF |
666 | Self { |
667 | beg: pos as _, | |
668 | pos: pos as _, | |
669 | end: end as _, | |
670 | } | |
671 | } | |
672 | ||
fffed679 WAF |
673 | /// Creates a new instance of [`RawFormatter`] with the given buffer. |
674 | /// | |
675 | /// # Safety | |
676 | /// | |
677 | /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes | |
678 | /// for the lifetime of the returned [`RawFormatter`]. | |
679 | pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self { | |
680 | let pos = buf as usize; | |
681 | // INVARIANT: We ensure that `end` is never less then `buf`, and the safety requirements | |
682 | // guarantees that the memory region is valid for writes. | |
683 | Self { | |
684 | pos, | |
685 | beg: pos, | |
686 | end: pos.saturating_add(len), | |
687 | } | |
688 | } | |
689 | ||
247b365d WAF |
690 | /// Returns the current insert position. |
691 | /// | |
692 | /// N.B. It may point to invalid memory. | |
693 | pub(crate) fn pos(&self) -> *mut u8 { | |
694 | self.pos as _ | |
695 | } | |
65e1e497 | 696 | |
b6cda913 | 697 | /// Returns the number of bytes written to the formatter. |
65e1e497 WAF |
698 | pub(crate) fn bytes_written(&self) -> usize { |
699 | self.pos - self.beg | |
700 | } | |
247b365d WAF |
701 | } |
702 | ||
703 | impl fmt::Write for RawFormatter { | |
704 | fn write_str(&mut self, s: &str) -> fmt::Result { | |
705 | // `pos` value after writing `len` bytes. This does not have to be bounded by `end`, but we | |
706 | // don't want it to wrap around to 0. | |
707 | let pos_new = self.pos.saturating_add(s.len()); | |
708 | ||
709 | // Amount that we can copy. `saturating_sub` ensures we get 0 if `pos` goes past `end`. | |
710 | let len_to_copy = core::cmp::min(pos_new, self.end).saturating_sub(self.pos); | |
711 | ||
712 | if len_to_copy > 0 { | |
713 | // SAFETY: If `len_to_copy` is non-zero, then we know `pos` has not gone past `end` | |
714 | // yet, so it is valid for write per the type invariants. | |
715 | unsafe { | |
716 | core::ptr::copy_nonoverlapping( | |
717 | s.as_bytes().as_ptr(), | |
718 | self.pos as *mut u8, | |
719 | len_to_copy, | |
720 | ) | |
721 | }; | |
722 | } | |
723 | ||
724 | self.pos = pos_new; | |
725 | Ok(()) | |
726 | } | |
727 | } | |
fffed679 WAF |
728 | |
729 | /// Allows formatting of [`fmt::Arguments`] into a raw buffer. | |
730 | /// | |
731 | /// Fails if callers attempt to write more than will fit in the buffer. | |
732 | pub(crate) struct Formatter(RawFormatter); | |
733 | ||
734 | impl Formatter { | |
735 | /// Creates a new instance of [`Formatter`] with the given buffer. | |
736 | /// | |
737 | /// # Safety | |
738 | /// | |
739 | /// The memory region starting at `buf` and extending for `len` bytes must be valid for writes | |
740 | /// for the lifetime of the returned [`Formatter`]. | |
fffed679 WAF |
741 | pub(crate) unsafe fn from_buffer(buf: *mut u8, len: usize) -> Self { |
742 | // SAFETY: The safety requirements of this function satisfy those of the callee. | |
743 | Self(unsafe { RawFormatter::from_buffer(buf, len) }) | |
744 | } | |
745 | } | |
746 | ||
747 | impl Deref for Formatter { | |
748 | type Target = RawFormatter; | |
749 | ||
750 | fn deref(&self) -> &Self::Target { | |
751 | &self.0 | |
752 | } | |
753 | } | |
754 | ||
755 | impl fmt::Write for Formatter { | |
756 | fn write_str(&mut self, s: &str) -> fmt::Result { | |
757 | self.0.write_str(s)?; | |
758 | ||
759 | // Fail the request if we go past the end of the buffer. | |
760 | if self.0.pos > self.0.end { | |
761 | Err(fmt::Error) | |
762 | } else { | |
763 | Ok(()) | |
764 | } | |
765 | } | |
766 | } | |
65e1e497 WAF |
767 | |
768 | /// An owned string that is guaranteed to have exactly one `NUL` byte, which is at the end. | |
769 | /// | |
770 | /// Used for interoperability with kernel APIs that take C strings. | |
771 | /// | |
772 | /// # Invariants | |
773 | /// | |
774 | /// The string is always `NUL`-terminated and contains no other `NUL` bytes. | |
775 | /// | |
776 | /// # Examples | |
777 | /// | |
778 | /// ``` | |
cf36a495 | 779 | /// use kernel::{str::CString, fmt}; |
65e1e497 WAF |
780 | /// |
781 | /// let s = CString::try_from_fmt(fmt!("{}{}{}", "abc", 10, 20)).unwrap(); | |
782 | /// assert_eq!(s.as_bytes_with_nul(), "abc1020\0".as_bytes()); | |
783 | /// | |
784 | /// let tmp = "testing"; | |
785 | /// let s = CString::try_from_fmt(fmt!("{tmp}{}", 123)).unwrap(); | |
786 | /// assert_eq!(s.as_bytes_with_nul(), "testing123\0".as_bytes()); | |
787 | /// | |
788 | /// // This fails because it has an embedded `NUL` byte. | |
789 | /// let s = CString::try_from_fmt(fmt!("a\0b{}", 123)); | |
790 | /// assert_eq!(s.is_ok(), false); | |
791 | /// ``` | |
792 | pub struct CString { | |
793 | buf: Vec<u8>, | |
794 | } | |
795 | ||
796 | impl CString { | |
797 | /// Creates an instance of [`CString`] from the given formatted arguments. | |
798 | pub fn try_from_fmt(args: fmt::Arguments<'_>) -> Result<Self, Error> { | |
799 | // Calculate the size needed (formatted string plus `NUL` terminator). | |
800 | let mut f = RawFormatter::new(); | |
801 | f.write_fmt(args)?; | |
802 | f.write_str("\0")?; | |
803 | let size = f.bytes_written(); | |
804 | ||
805 | // Allocate a vector with the required number of bytes, and write to it. | |
5ab560ce | 806 | let mut buf = <Vec<_> as VecExt<_>>::with_capacity(size, GFP_KERNEL)?; |
65e1e497 WAF |
807 | // SAFETY: The buffer stored in `buf` is at least of size `size` and is valid for writes. |
808 | let mut f = unsafe { Formatter::from_buffer(buf.as_mut_ptr(), size) }; | |
809 | f.write_fmt(args)?; | |
810 | f.write_str("\0")?; | |
811 | ||
812 | // SAFETY: The number of bytes that can be written to `f` is bounded by `size`, which is | |
813 | // `buf`'s capacity. The contents of the buffer have been initialised by writes to `f`. | |
814 | unsafe { buf.set_len(f.bytes_written()) }; | |
815 | ||
816 | // Check that there are no `NUL` bytes before the end. | |
817 | // SAFETY: The buffer is valid for read because `f.bytes_written()` is bounded by `size` | |
818 | // (which the minimum buffer size) and is non-zero (we wrote at least the `NUL` terminator) | |
819 | // so `f.bytes_written() - 1` doesn't underflow. | |
820 | let ptr = unsafe { bindings::memchr(buf.as_ptr().cast(), 0, (f.bytes_written() - 1) as _) }; | |
821 | if !ptr.is_null() { | |
822 | return Err(EINVAL); | |
823 | } | |
824 | ||
825 | // INVARIANT: We wrote the `NUL` terminator and checked above that no other `NUL` bytes | |
826 | // exist in the buffer. | |
827 | Ok(Self { buf }) | |
828 | } | |
829 | } | |
830 | ||
831 | impl Deref for CString { | |
832 | type Target = CStr; | |
833 | ||
834 | fn deref(&self) -> &Self::Target { | |
835 | // SAFETY: The type invariants guarantee that the string is `NUL`-terminated and that no | |
836 | // other `NUL` bytes exist. | |
837 | unsafe { CStr::from_bytes_with_nul_unchecked(self.buf.as_slice()) } | |
838 | } | |
839 | } | |
ef320549 | 840 | |
a321f3ad DK |
841 | impl DerefMut for CString { |
842 | fn deref_mut(&mut self) -> &mut Self::Target { | |
843 | // SAFETY: A `CString` is always NUL-terminated and contains no other | |
844 | // NUL bytes. | |
845 | unsafe { CStr::from_bytes_with_nul_unchecked_mut(self.buf.as_mut_slice()) } | |
846 | } | |
847 | } | |
848 | ||
66bd7533 AR |
849 | impl<'a> TryFrom<&'a CStr> for CString { |
850 | type Error = AllocError; | |
851 | ||
852 | fn try_from(cstr: &'a CStr) -> Result<CString, AllocError> { | |
853 | let mut buf = Vec::new(); | |
854 | ||
5ab560ce | 855 | <Vec<_> as VecExt<_>>::extend_from_slice(&mut buf, cstr.as_bytes_with_nul(), GFP_KERNEL) |
66bd7533 AR |
856 | .map_err(|_| AllocError)?; |
857 | ||
858 | // INVARIANT: The `CStr` and `CString` types have the same invariants for | |
859 | // the string data, and we copied it over without changes. | |
860 | Ok(CString { buf }) | |
861 | } | |
862 | } | |
863 | ||
c3f41b00 AL |
864 | impl fmt::Debug for CString { |
865 | fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result { | |
866 | fmt::Debug::fmt(&**self, f) | |
867 | } | |
868 | } | |
869 | ||
ef320549 WAF |
870 | /// A convenience alias for [`core::format_args`]. |
871 | #[macro_export] | |
872 | macro_rules! fmt { | |
873 | ($($f:tt)*) => ( core::format_args!($($f)*) ) | |
874 | } |