base: avoid use of deprecated base/printf.h

Besides adapting the components to the use of base/log.h, the patch
cleans up a few base headers, i.e., it removes unused includes from
root/component.h, specifically base/heap.h and
ram_session/ram_session.h. Hence, components that relied on the implicit
inclusion of those headers have to manually include those headers now.

While adjusting the log messages, I repeatedly stumbled over the problem
that printing char * arguments is ambiguous. It is unclear whether to
print the argument as pointer or null-terminated string. To overcome
this problem, the patch introduces a new type 'Cstring' that allows the
caller to express that the argument should be handled as null-terminated
string. As a nice side effect, with this type in place, the optional len
argument of the 'String' class could be removed. Instead of supplying a
pair of (char const *, size_t), the constructor accepts a 'Cstring'.
This, in turn, clears the way let the 'String' constructor use the new
output mechanism to assemble a string from multiple arguments (and
thereby getting rid of snprintf within Genode in the near future).

To enforce the explicit resolution of the char * ambiguity, the 'char *'
overload of the 'print' function is marked as deleted.

Issue #1987

repos/base/include/util/string.h

@@ -23,6 +23,7 @@
 namespace Genode {
 
 	class Number_of_bytes;
+	class Cstring;
 	template <Genode::size_t> class String;
 }
 
@@ -499,41 +500,150 @@ namespace Genode {
 }
 
 
+/**
+ * Helper for the formatted output of a length-constrained character buffer
+ */
+class Genode::Cstring
+{
+	private:
+
+		char const * const _str;
+		size_t       const _len;
+
+		static size_t _init_len(char const *str, size_t max_len)
+		{
+			/*
+			 * In contrast to 'strlen' we stop searching for a terminating
+			 * null once we reach 'max_len'.
+			 */
+			size_t res = 0;
+			for (; str && *str && res < max_len; str++, res++);
+			return res;
+		}
+
+	public:
+
+		/**
+		 * Constructor
+		 *
+		 * \param str  null-terminated character buffer
+		 */
+		Cstring(char const *str) : _str(str), _len(strlen(str)) { }
+
+		/**
+		 * Constructor
+		 *
+		 * \param str      character buffer, not neccessarily null-terminated
+		 * \param max_len  maximum number of characters to consume
+		 *
+		 * The 'Cstring' contains all characters up to a terminating null in
+		 * the 'str' buffer but not more that 'max_len' characters.
+		 */
+		Cstring(char const *str, size_t max_len)
+		:
+			_str(str), _len(_init_len(str, max_len))
+		{ }
+
+		void print(Output &out) const { out.out_string(_str, _len); }
+};
+
+
 /**
  * Buffer that contains a null-terminated string
  *
- * \param CAPACITY  buffer size including the terminating zero
+ * \param CAPACITY  buffer size including the terminating zero,
+ *                  must be higher than zero
  */
 template <Genode::size_t CAPACITY>
 class Genode::String
 {
 	private:
 
-		char   _buf[CAPACITY];
-		size_t _length;
+		char _buf[CAPACITY];
+
+		/**
+		 * Number of chars contained in '_buf' including the terminating null
+		 */
+		size_t _len;
+
+		/**
+		 * Output facility that targets a character buffer
+		 */
+		struct Local_output : Output
+		{
+			char * const _buf;
+
+			size_t _num_chars = 0;
+
+			/**
+			 * Return true if '_buf' can fit at least one additional 'char'.
+			 */
+			bool _capacity_left() const { return CAPACITY - _num_chars - 1; }
+
+			void _append(char c) { _buf[_num_chars++] = c; }
+
+			Local_output(char *buf) : _buf(buf) { }
+
+			size_t num_chars() const { return _num_chars; }
+
+			void out_char(char c) override { if (_capacity_left()) _append(c); }
+
+			void out_string(char const *str, size_t n) override
+			{
+				while (n-- > 0 && _capacity_left())
+					_append(*str++);
+			}
+		};
+
+		template <typename... T>
+		void _init(T &&... args)
+		{
+			/* initialize string content */
+			Local_output output(_buf);
+			Genode::print(output, args...);
+
+			/* add terminating null */
+			_buf[output.num_chars()] = 0;
+			_len = output.num_chars() + 1;
+		}
 
 	public:
 
 		constexpr static size_t size() { return CAPACITY; }
 
-		String() : _length(0) { }
+		String() : _len(0) { }
 
-		String(char const *str, size_t len = ~0UL - 1)
-		:
-			_length(min(len + 1, min(strlen(str) + 1, CAPACITY)))
+		/**
+		 * Constructor
+		 *
+		 * If the textual representation of the supplied arguments exceeds
+		 * 'CAPACITY', the resulting string gets truncated. The caller may
+		 * check for this condition by evaluating the 'length' of the
+		 * constructed 'String'. If 'length' equals 'CAPACITY', the string
+		 * may fit perfectly into the buffer or may have been truncated.
+		 * In general, it would be safe to assume the latter.
+		 */
+		template <typename T>
+		String(T const &arg) { _init(arg); }
+
+		/**
+		 * Copy constructor
+		 */
+		template <unsigned N>
+		String(String<N> const &other) : _len(min(other._len, CAPACITY))
 		{
-			strncpy(_buf, str, _length);
+			Genode::strncpy(_buf, other._buf, _len);
 		}
 
 		/**
 		 * Return length of string, including the terminating null character
 		 */
-		size_t length() const { return _length; }
+		size_t length() const { return _len; }
 
 		static constexpr size_t capacity() { return CAPACITY; }
 
 		bool valid() const {
-			return (_length <= CAPACITY) && (_length != 0) && (_buf[_length - 1] == '\0'); }
+			return (_len <= CAPACITY) && (_len != 0) && (_buf[_len - 1] == '\0'); }
 
 		char const *string() const { return valid() ? _buf : ""; }