From nobody Wed Jul 1 11:49:34 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gqyx04SMsz6k8YL for ; Wed, 01 Jul 2026 11:49:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gqywz6qMSz3v5f for ; Wed, 01 Jul 2026 11:49:39 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782906580; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eheyo89SyoP+TSj9c909Bq3pI78l8DksIBvafzkoonQ=; b=m1k6pJSpWScT1sU4cc/MfrC14LnIH/Nuu2iYEGS0FMqDsTXnKW6VVFzok+AWL7IdwiwuaR tXLZPjnQZxmV5zbiWo0TUDrbAUsctuDx6GU+ZNRtY22U9VhTh9pQtJxxmylEfUAIaFgj/s doC47dB9P2ytXozr9rAJU27vt2RB4s3HkK+CH53/9JLeuHQduE7nXdhBddY1pIvT/u+x1F ca/rY4Y6ixAon8Rp+SpxloKVoJqBQdink6HEGg3M8u34M/WbV44HV9zcEoWvZlZvCDuXww k/NzUH5nrrEd3wlvzunSQVpTtV9KQh6s5qJDxbFZM1AqX9n8zGB5D2Y30GAFfw== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782906580; a=rsa-sha256; cv=none; b=qKkUzyfMfJydFBNcIWiqEf0Y/sGD93glC6f6fDt67+O+M0EvgAsbbpPq7ipTZtgdelIKR/ 40sbt634Q9MsMaCLNfgicldsDkpL5rlFyUcHwgWRFuoIgp31ybChLTtxqoWwGowTSBtwGh zHLS28sLR7tS9VNuZNW8/n0i7nr41XGYRTZ2R1Kjn8S5m4gUSFBrEn3bHmXwlG9duPE32I eSVG8foEwguC5a97xkmdOYZeV9LAgF/TDWnaV7oWBo5nDZlR9BDrTjkfSpkqLNmBgrGE89 Uablt2IeiANIKJt4CNGX7xnEXnZnIBcS3rJ9ktAPyQ886GvcNrKRpHWkBSJ+iw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782906580; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=eheyo89SyoP+TSj9c909Bq3pI78l8DksIBvafzkoonQ=; b=S/If/Zaq3S2+colStMprP/DVt4HsczWFyH+lkV0GGSRF74nRo9+GuzSfdCnWhDt9lXLNSd 113cn/fnFEn00c7raBWh9gA6CMdujXRnq1bZKkAEWEjIoK4xRtjnxME0J8BAQ2sGzQp9id 97FirXd3K4tnMNaXnJiMMFEJ0c7bOxAXQGmO+75oAZLjwaYZJ5nmuR1lbKs7PoTlx+PvCV U9klY/eVA+yWerh1LeS7VKD3SInNYfMcFV7pbR9cjxvjKOSVa8EmqhL99i9wi4yPB9kij6 D5+EoPGs9QtrBqVrdSH2RtLMFdEmg7heFl66SPlqYfDuLLTrq3bCETRgHuPEjg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gqywz5Hp4z1S9v for ; Wed, 01 Jul 2026 11:49:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 1bbcb by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Wed, 01 Jul 2026 11:49:34 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Brooks Davis Subject: git: 7f55dbe6ae89 - main - CHERI: declare mem{cpy,move}_data List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: brooks X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1 Auto-Submitted: auto-generated Date: Wed, 01 Jul 2026 11:49:34 +0000 Message-Id: <6a44fece.1bbcb.42aefb18@gitrepo.freebsd.org> The branch main has been updated by brooks: URL: https://cgit.FreeBSD.org/src/commit/?id=7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1 commit 7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1 Author: Brooks Davis AuthorDate: 2026-07-01 11:45:51 +0000 Commit: Brooks Davis CommitDate: 2026-07-01 11:46:11 +0000 CHERI: declare mem{cpy,move}_data Declare kernel-only, provenance-discarding memcpy_data, and memmove_data APIs intended to copy raw data which does not contain pointers (e.g., buffers on their way to or from network or storage devices). On CHERI architectures, they will explicitly remove tags from capabilities, removing any provenance. This reduces the risk of accidental spread of pointers on CHERI systems. Document that bcopy preserves pointer provenance. Reviewed by: ziaee, kib, adrian, markj Effort: CHERI upstreaming Sponsored by: DARPA, AFRL, Innovate UK Differential Revision: https://reviews.freebsd.org/D57662 --- share/man/man9/Makefile | 2 ++ share/man/man9/bcopy.9 | 6 ++++-- share/man/man9/memcpy.9 | 30 +++++++++++++++++++++++------- share/man/man9/memmove.9 | 29 ++++++++++++++++++++++++----- sys/sys/systm.h | 9 +++++++++ 5 files changed, 62 insertions(+), 14 deletions(-) diff --git a/share/man/man9/Makefile b/share/man/man9/Makefile index f465c7f49696..e00a74a49a94 100644 --- a/share/man/man9/Makefile +++ b/share/man/man9/Makefile @@ -1616,6 +1616,8 @@ MLINKS+=mdchain.9 md_append_record.9 \ mdchain.9 md_get_uio.9 \ mdchain.9 md_initm.9 \ mdchain.9 md_next_record.9 +MLINKS+=memcpy.9 memcpy_data.9 +MLINKS+=memmove.9 memmove_data.9 MLINKS+=microtime.9 bintime.9 \ microtime.9 getbintime.9 \ microtime.9 getmicrotime.9 \ diff --git a/share/man/man9/bcopy.9 b/share/man/man9/bcopy.9 index a82c66c66965..0952216ba25f 100644 --- a/share/man/man9/bcopy.9 +++ b/share/man/man9/bcopy.9 @@ -28,7 +28,7 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 19, 2026 +.Dd July 1, 2026 .Dt BCOPY 9 .Os .Sh NAME @@ -46,7 +46,9 @@ function copies bytes from object .Fa src to object -.Fa dst . +.Fa dst +preserving the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . The two objects may overlap. If .Fa len diff --git a/share/man/man9/memcpy.9 b/share/man/man9/memcpy.9 index e9675a55cf13..26c3e5af4401 100644 --- a/share/man/man9/memcpy.9 +++ b/share/man/man9/memcpy.9 @@ -29,16 +29,19 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 19, 2026 +.Dd July 1, 2026 .Dt MEMCPY 9 .Os .Sh NAME -.Nm memcpy +.Nm memcpy , +.Nm memcpy_data .Nd copy bytes in memory .Sh SYNOPSIS .In sys/systm.h .Ft void * .Fn memcpy "void *dst" "const void *src" "size_t len" +.Ft void * +.Fn memcpy_data "void *dst" "const void *src" "size_t len" .Sh DESCRIPTION The .Fn memcpy @@ -47,22 +50,31 @@ function copies bytes from object .Fa src to object -.Fa dst . +.Fa dst +in a manner that preserves the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . If .Fa src and .Fa dst overlap, the results are not defined. +The +.Fn memcpy_data +function does the same except that it does not preserve the provenance +of pointers in the copied object. +On CHERI targets, the validity tag of any copied capability is +explicitly cleared. .Sh RETURN VALUES The .Fn memcpy -function -returns the original value of +and +.Fn memcpy_data +functions return the original value of .Fa dst . -.Pp .Sh SEE ALSO .Xr bcopy 9 , -.Xr memmove 9 +.Xr memmove 9 , +.Xr memmove_data 9 .Sh STANDARDS The .Fn memcpy @@ -76,3 +88,7 @@ function first appeared in .At V and was reimplemented for .Bx 4.3 Tahoe . +The +.Fn memcpy_data +function first appeared in +.Fx 16.0 . diff --git a/share/man/man9/memmove.9 b/share/man/man9/memmove.9 index 54031dc37d96..ec9af1cfdb71 100644 --- a/share/man/man9/memmove.9 +++ b/share/man/man9/memmove.9 @@ -29,16 +29,19 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd June 19, 2026 +.Dd July 1, 2026 .Dt MEMMOVE 9 .Os .Sh NAME -.Nm memmove +.Nm memmove , +.Nm memmove_data .Nd copy bytes in memory .Sh SYNOPSIS .In sys/systm.h .Ft void * .Fn memmove "void *dst" "const void *src" "size_t len" +.Ft void * +.Fn memmove_data "void *dst" "const void *src" "size_t len" .Sh DESCRIPTION The .Fn memmove @@ -49,18 +52,34 @@ bytes from object to object .Fa dst . The two objects may overlap; -the copy is always done in a non-destructive manner. +the copy is always done in a non-destructive manner and preserves +the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . +The +.Fn memmove_data +function does the same except that it does not preserve the provenance +of pointers in the copied object. +On CHERI targets, the validity tag of any copied capability is +explicitly cleared. .Sh RETURN VALUES The .Fn memmove -function returns the original value of +and +.Fn memmove_data +functions return the original value of .Fa dst . .Sh SEE ALSO .Xr bcopy 9 , -.Xr memcpy 9 +.Xr memcpy 9 , +.Xr memcpy_data 9 .Sh STANDARDS The .Fn memmove function conforms to .St -isoC . +.Sh HISTORY +The +.Fn memmove_data +function first appeared in +.Fx 16.0 . diff --git a/sys/sys/systm.h b/sys/sys/systm.h index 83023d24fe7d..f7814949ac86 100644 --- a/sys/sys/systm.h +++ b/sys/sys/systm.h @@ -256,6 +256,15 @@ void *memset(void * _Nonnull buf, int c, size_t len); void *memcpy(void * _Nonnull to, const void * _Nonnull from, size_t len); void *memmove(void * _Nonnull dest, const void * _Nonnull src, size_t n); int memcmp(const void *b1, const void *b2, size_t len); +#ifdef __CHERI__ +void *memcpy_data(void * _Nonnull to, const void * _Nonnull from, + size_t len); +void *memmove_data(void * _Nonnull dest, const void * _Nonnull src, + size_t n); +#else +#define memcpy_data memcpy +#define memmove_data memmove +#endif #ifdef SAN_NEEDS_INTERCEPTORS #define SAN_INTERCEPTOR(func) \