Date: Wed, 01 Jul 2026 11:49:34 +0000
From: Brooks Davis <brooks@FreeBSD.org>
To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org
Subject: git: 7f55dbe6ae89 - main - CHERI: declare mem{cpy,move}_data
Message-ID: <6a44fece.1bbcb.42aefb18@gitrepo.freebsd.org>
index | next in thread | raw e-mail
The branch main has been updated by brooks: URL: https://cgit.FreeBSD.org/src/commit/?id=7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1 commit 7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1 Author: Brooks Davis <brooks@FreeBSD.org> AuthorDate: 2026-07-01 11:45:51 +0000 Commit: Brooks Davis <brooks@FreeBSD.org> CommitDate: 2026-07-01 11:46:11 +0000 CHERI: declare mem{cpy,move}_data Declare kernel-only, provenance-discarding memcpy_data, and memmove_data APIs intended to copy raw data which does not contain pointers (e.g., buffers on their way to or from network or storage devices). On CHERI architectures, they will explicitly remove tags from capabilities, removing any provenance. This reduces the risk of accidental spread of pointers on CHERI systems. Document that bcopy preserves pointer provenance. Reviewed by: ziaee, kib, adrian, markj Effort: CHERI upstreaming Sponsored by: DARPA, AFRL, Innovate UK Differential Revision: https://reviews.freebsd.org/D57662 --- share/man/man9/Makefile | 2 ++ share/man/man9/bcopy.9 | 6 ++++-- share/man/man9/memcpy.9 | 30 +++++++++++++++++++++++------- share/man/man9/memmove.9 | 29 ++++++++++++++++++++++++----- sys/sys/systm.h | 9 +++++++++ 5 files changed, 62 insertions(+), 14 deletions(-) diff --git a/share/man/man9/Makefile b/share/man/man9/Makefile index f465c7f49696..e00a74a49a94 100644 --- a/share/man/man9/Makefile +++ b/share/man/man9/Makefile @@ -1616,6 +1616,8 @@ MLINKS+=mdchain.9 md_append_record.9 \ mdchain.9 md_get_uio.9 \ mdchain.9 md_initm.9 \ mdchain.9 md_next_record.9 +MLINKS+=memcpy.9 memcpy_data.9 +MLINKS+=memmove.9 memmove_data.9 MLINKS+=microtime.9 bintime.9 \ microtime.9 getbintime.9 \ microtime.9 getmicrotime.9 \ diff --git a/share/man/man9/bcopy.9 b/share/man/man9/bcopy.9 index a82c66c66965..0952216ba25f 100644 --- a/share/man/man9/bcopy.9 +++ b/share/man/man9/bcopy.9 @@ -28,7 +28,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 19, 2026 +.Dd July 1, 2026 .Dt BCOPY 9 .Os .Sh NAME @@ -46,7 +46,9 @@ function copies bytes from object .Fa src to object -.Fa dst . +.Fa dst +preserving the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . The two objects may overlap. If .Fa len diff --git a/share/man/man9/memcpy.9 b/share/man/man9/memcpy.9 index e9675a55cf13..26c3e5af4401 100644 --- a/share/man/man9/memcpy.9 +++ b/share/man/man9/memcpy.9 @@ -29,16 +29,19 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 19, 2026 +.Dd July 1, 2026 .Dt MEMCPY 9 .Os .Sh NAME -.Nm memcpy +.Nm memcpy , +.Nm memcpy_data .Nd copy bytes in memory .Sh SYNOPSIS .In sys/systm.h .Ft void * .Fn memcpy "void *dst" "const void *src" "size_t len" +.Ft void * +.Fn memcpy_data "void *dst" "const void *src" "size_t len" .Sh DESCRIPTION The .Fn memcpy @@ -47,22 +50,31 @@ function copies bytes from object .Fa src to object -.Fa dst . +.Fa dst +in a manner that preserves the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . If .Fa src and .Fa dst overlap, the results are not defined. +The +.Fn memcpy_data +function does the same except that it does not preserve the provenance +of pointers in the copied object. +On CHERI targets, the validity tag of any copied capability is +explicitly cleared. .Sh RETURN VALUES The .Fn memcpy -function -returns the original value of +and +.Fn memcpy_data +functions return the original value of .Fa dst . -.Pp .Sh SEE ALSO .Xr bcopy 9 , -.Xr memmove 9 +.Xr memmove 9 , +.Xr memmove_data 9 .Sh STANDARDS The .Fn memcpy @@ -76,3 +88,7 @@ function first appeared in .At V and was reimplemented for .Bx 4.3 Tahoe . +The +.Fn memcpy_data +function first appeared in +.Fx 16.0 . diff --git a/share/man/man9/memmove.9 b/share/man/man9/memmove.9 index 54031dc37d96..ec9af1cfdb71 100644 --- a/share/man/man9/memmove.9 +++ b/share/man/man9/memmove.9 @@ -29,16 +29,19 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 19, 2026 +.Dd July 1, 2026 .Dt MEMMOVE 9 .Os .Sh NAME -.Nm memmove +.Nm memmove , +.Nm memmove_data .Nd copy bytes in memory .Sh SYNOPSIS .In sys/systm.h .Ft void * .Fn memmove "void *dst" "const void *src" "size_t len" +.Ft void * +.Fn memmove_data "void *dst" "const void *src" "size_t len" .Sh DESCRIPTION The .Fn memmove @@ -49,18 +52,34 @@ bytes from object to object .Fa dst . The two objects may overlap; -the copy is always done in a non-destructive manner. +the copy is always done in a non-destructive manner and preserves +the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . +The +.Fn memmove_data +function does the same except that it does not preserve the provenance +of pointers in the copied object. +On CHERI targets, the validity tag of any copied capability is +explicitly cleared. .Sh RETURN VALUES The .Fn memmove -function returns the original value of +and +.Fn memmove_data +functions return the original value of .Fa dst . .Sh SEE ALSO .Xr bcopy 9 , -.Xr memcpy 9 +.Xr memcpy 9 , +.Xr memcpy_data 9 .Sh STANDARDS The .Fn memmove function conforms to .St -isoC . +.Sh HISTORY +The +.Fn memmove_data +function first appeared in +.Fx 16.0 . diff --git a/sys/sys/systm.h b/sys/sys/systm.h index 83023d24fe7d..f7814949ac86 100644 --- a/sys/sys/systm.h +++ b/sys/sys/systm.h @@ -256,6 +256,15 @@ void *memset(void * _Nonnull buf, int c, size_t len); void *memcpy(void * _Nonnull to, const void * _Nonnull from, size_t len); void *memmove(void * _Nonnull dest, const void * _Nonnull src, size_t n); int memcmp(const void *b1, const void *b2, size_t len); +#ifdef __CHERI__ +void *memcpy_data(void * _Nonnull to, const void * _Nonnull from, + size_t len); +void *memmove_data(void * _Nonnull dest, const void * _Nonnull src, + size_t n); +#else +#define memcpy_data memcpy +#define memmove_data memmove +#endif #ifdef SAN_NEEDS_INTERCEPTORS #define SAN_INTERCEPTOR(func) \home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?6a44fece.1bbcb.42aefb18>