From nobody Wed Jul 1 11:49:34 2026 X-Original-To: dev-commits-src-main@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqywt4mxtz6k8jY for ; Wed, 01 Jul 2026 11:49:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqywt438Cz3tjk for ; Wed, 01 Jul 2026 11:49:34 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782906574; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eheyo89SyoP+TSj9c909Bq3pI78l8DksIBvafzkoonQ=; b=bKmdw/PJgP73HvOzO7zuwaKFD2HN2LOwUryY3b39HOyO2G1wwBCyAonQlzpz5mu919mjq6 JUZa9gV5vy8XMtsQbBKy9H9KUdS54lYohMHEo4caZzuiYkMnLsTSENuoNV5gwGHdUY0K4E m2J1IXVRYyXdcPifjlfOEe9CQpcLzoA1d9ATlWnzuRSjygMXlSsAt9rz8LOb6sXwVi08u1 bvMFnPT16KKnh1cnkEAoIbdEAdhX/LR+cubs9pDpwM0OIV3B1+D+PIzDv+6Tx2xdGMNimi 3ERlMVThQVgEbfgKAOYlnXrMN2frJaavYLpV3jE8ruq5HftZKMAVgfN8WYBhVQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782906574; a=rsa-sha256; cv=none; b=qNEpbQw0jFmf5zS0Rc/N43md+jrShsTJdmRCLKYnxy2okIP5LaQxNm54VlCl4ksEr7ZT72 7UG6gQe5x2lKSVpj6lkYEz/l84mpjRdoLaltAIAiywpyPbM6dGlOx7ytYdHXeqQ1xodOKH ygciv6A0uL1v6a/7xMnCbRfXA5Yhpbu7z1Mqm2GljW8aOE20mQwp9H1wc508GPceh0P99F PH4X3GI5l/5/FXoaq1J/gxQRdwVhUIBj2tsOuPUotNVS8f1nZc5YwF8gH7DZTmebnMOdqK CKkblXXyy2ql8m77q1wWEqQGb8sdEmyen7dgVvbs7X3+P0e/hcpAiRlvBgowgg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782906574; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eheyo89SyoP+TSj9c909Bq3pI78l8DksIBvafzkoonQ=; b=B8pp9pVH7XaD4pmfeEmE3vKu7OKVahnun7zhW532NxVnQH8ooq8n5FE7SXtECSOVPcfnNF ok4GYqHWIWAX0Y3ktrm9GGLB5SJTXag9rFrZWtTJdEWBjSSA/6I1ofMWYXOMd46WXARxD5 aGBU0OYSjqfPWif6dEPtNGzjNIGTztrBju+QVQ9WPOT6mRVL3Gk6LIqznAPvvZAKaVd+t1 BCPs+j+ZrJ5x1JrtxJPlwB2RdLJ+rF2VPeuSg+EHwci4tKglhTqJmzkDkthJK4IvTBXCuv 493R9AfVP7gnZ94V2q5PKztCCKNedqGW0S8cEKCpfR847L5dUUphmdtzzwPj6Q== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqywt37qHz1Rll for ; Wed, 01 Jul 2026 11:49:34 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1bbcb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 01 Jul 2026 11:49:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Brooks Davis Subject: git: 7f55dbe6ae89 - main - CHERI: declare mem{cpy,move}_data List-Id: Commit messages for the main branch of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-main List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-main@freebsd.org Sender: owner-dev-commits-src-main@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: brooks X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1 Auto-Submitted: auto-generated Date: Wed, 01 Jul 2026 11:49:34 +0000 Message-Id: <6a44fece.1bbcb.42aefb18@gitrepo.freebsd.org> The branch main has been updated by brooks: URL: https://cgit.FreeBSD.org/src/commit/?id=7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1 commit 7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1 Author: Brooks Davis AuthorDate: 2026-07-01 11:45:51 +0000 Commit: Brooks Davis CommitDate: 2026-07-01 11:46:11 +0000 CHERI: declare mem{cpy,move}_data Declare kernel-only, provenance-discarding memcpy_data, and memmove_data APIs intended to copy raw data which does not contain pointers (e.g., buffers on their way to or from network or storage devices). On CHERI architectures, they will explicitly remove tags from capabilities, removing any provenance. This reduces the risk of accidental spread of pointers on CHERI systems. Document that bcopy preserves pointer provenance. Reviewed by: ziaee, kib, adrian, markj Effort: CHERI upstreaming Sponsored by: DARPA, AFRL, Innovate UK Differential Revision: https://reviews.freebsd.org/D57662 --- share/man/man9/Makefile | 2 ++ share/man/man9/bcopy.9 | 6 ++++-- share/man/man9/memcpy.9 | 30 +++++++++++++++++++++++------- share/man/man9/memmove.9 | 29 ++++++++++++++++++++++++----- sys/sys/systm.h | 9 +++++++++ 5 files changed, 62 insertions(+), 14 deletions(-) diff --git a/share/man/man9/Makefile b/share/man/man9/Makefile index f465c7f49696..e00a74a49a94 100644 --- a/share/man/man9/Makefile +++ b/share/man/man9/Makefile @@ -1616,6 +1616,8 @@ MLINKS+=mdchain.9 md_append_record.9 \ mdchain.9 md_get_uio.9 \ mdchain.9 md_initm.9 \ mdchain.9 md_next_record.9 +MLINKS+=memcpy.9 memcpy_data.9 +MLINKS+=memmove.9 memmove_data.9 MLINKS+=microtime.9 bintime.9 \ microtime.9 getbintime.9 \ microtime.9 getmicrotime.9 \ diff --git a/share/man/man9/bcopy.9 b/share/man/man9/bcopy.9 index a82c66c66965..0952216ba25f 100644 --- a/share/man/man9/bcopy.9 +++ b/share/man/man9/bcopy.9 @@ -28,7 +28,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 19, 2026 +.Dd July 1, 2026 .Dt BCOPY 9 .Os .Sh NAME @@ -46,7 +46,9 @@ function copies bytes from object .Fa src to object -.Fa dst . +.Fa dst +preserving the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . The two objects may overlap. If .Fa len diff --git a/share/man/man9/memcpy.9 b/share/man/man9/memcpy.9 index e9675a55cf13..26c3e5af4401 100644 --- a/share/man/man9/memcpy.9 +++ b/share/man/man9/memcpy.9 @@ -29,16 +29,19 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 19, 2026 +.Dd July 1, 2026 .Dt MEMCPY 9 .Os .Sh NAME -.Nm memcpy +.Nm memcpy , +.Nm memcpy_data .Nd copy bytes in memory .Sh SYNOPSIS .In sys/systm.h .Ft void * .Fn memcpy "void *dst" "const void *src" "size_t len" +.Ft void * +.Fn memcpy_data "void *dst" "const void *src" "size_t len" .Sh DESCRIPTION The .Fn memcpy @@ -47,22 +50,31 @@ function copies bytes from object .Fa src to object -.Fa dst . +.Fa dst +in a manner that preserves the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . If .Fa src and .Fa dst overlap, the results are not defined. +The +.Fn memcpy_data +function does the same except that it does not preserve the provenance +of pointers in the copied object. +On CHERI targets, the validity tag of any copied capability is +explicitly cleared. .Sh RETURN VALUES The .Fn memcpy -function -returns the original value of +and +.Fn memcpy_data +functions return the original value of .Fa dst . -.Pp .Sh SEE ALSO .Xr bcopy 9 , -.Xr memmove 9 +.Xr memmove 9 , +.Xr memmove_data 9 .Sh STANDARDS The .Fn memcpy @@ -76,3 +88,7 @@ function first appeared in .At V and was reimplemented for .Bx 4.3 Tahoe . +The +.Fn memcpy_data +function first appeared in +.Fx 16.0 . diff --git a/share/man/man9/memmove.9 b/share/man/man9/memmove.9 index 54031dc37d96..ec9af1cfdb71 100644 --- a/share/man/man9/memmove.9 +++ b/share/man/man9/memmove.9 @@ -29,16 +29,19 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 19, 2026 +.Dd July 1, 2026 .Dt MEMMOVE 9 .Os .Sh NAME -.Nm memmove +.Nm memmove , +.Nm memmove_data .Nd copy bytes in memory .Sh SYNOPSIS .In sys/systm.h .Ft void * .Fn memmove "void *dst" "const void *src" "size_t len" +.Ft void * +.Fn memmove_data "void *dst" "const void *src" "size_t len" .Sh DESCRIPTION The .Fn memmove @@ -49,18 +52,34 @@ bytes from object to object .Fa dst . The two objects may overlap; -the copy is always done in a non-destructive manner. +the copy is always done in a non-destructive manner and preserves +the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . +The +.Fn memmove_data +function does the same except that it does not preserve the provenance +of pointers in the copied object. +On CHERI targets, the validity tag of any copied capability is +explicitly cleared. .Sh RETURN VALUES The .Fn memmove -function returns the original value of +and +.Fn memmove_data +functions return the original value of .Fa dst . .Sh SEE ALSO .Xr bcopy 9 , -.Xr memcpy 9 +.Xr memcpy 9 , +.Xr memcpy_data 9 .Sh STANDARDS The .Fn memmove function conforms to .St -isoC . +.Sh HISTORY +The +.Fn memmove_data +function first appeared in +.Fx 16.0 . diff --git a/sys/sys/systm.h b/sys/sys/systm.h index 83023d24fe7d..f7814949ac86 100644 --- a/sys/sys/systm.h +++ b/sys/sys/systm.h @@ -256,6 +256,15 @@ void *memset(void * _Nonnull buf, int c, size_t len); void *memcpy(void * _Nonnull to, const void * _Nonnull from, size_t len); void *memmove(void * _Nonnull dest, const void * _Nonnull src, size_t n); int memcmp(const void *b1, const void *b2, size_t len); +#ifdef __CHERI__ +void *memcpy_data(void * _Nonnull to, const void * _Nonnull from, + size_t len); +void *memmove_data(void * _Nonnull dest, const void * _Nonnull src, + size_t n); +#else +#define memcpy_data memcpy +#define memmove_data memmove +#endif #ifdef SAN_NEEDS_INTERCEPTORS #define SAN_INTERCEPTOR(func) \