From nobody Mon Jun 29 13:01:39 2026 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4gpmd01qM3z6hcqR for ; Mon, 29 Jun 2026 13:01:40 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "YR1" (not verified)) by mx1.freebsd.org (Postfix) with ESMTPS id 4gpmd01343z40kQ for ; Mon, 29 Jun 2026 13:01:40 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782738100; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=aajNxR/2EdiKt4nS214beeA4r3qgn0+tdbeHNc9xFtI=; b=GM3ovSGuSxTO+A8V8mOBpzEi131YeT4Vxt2/LzAgwHFq1GUX/mktSPKxp9O+B0umH/yOOv SMFLV9EU4azX+pWfME9EToF7pHU+ASfGi/sxEJeppE4g8vqUqQB9jAblZh2KMRBwFVo50A 6x/AVFiql0xsiD9lePQzTg0NT+ERjUmxihze2flSBb+EKp+HB/Qx2vqH8kba7eJPl+BqzP bfLry+k2exaQ7JYuzunFqhiEK75+Zkuk2J/WyBxIsCk3tC+PJEDjqylyxIClMSCi5i+LTG nTeaKlcfXeEJjxHWn+FDBJd62an4KB6GM5jdQBSvjzpSU3hXF7AcFU13xaW7YQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1782738100; a=rsa-sha256; cv=none; b=qgbcQ4W4jaJvvKcT7NtE6FLI+m1u3T1guGj0npMnPO8afYC3yKpudO8RIO1ZnPV6zmtDt+ J7et5Whv2M33Iz93yVZYqXWWnL9vN7zCvrZyXIZsG/0d3xB2kyAdNCYOGOOSvv84DBakNL ZGtPFMmhBAjXMLmdAzCzIMZPtPwYXAxnZ7bTvhIVSDeXpdLmfzXUdz2isbGiACkBCTESFV AbpNtmUD3JOs8X+x+XAtW4tbZab0wPtDJCfGHSP9GHYNqb9NIBNSiIOYKeLbs51xg5cwiI cgNJ/+TgpDW5GzifsMk5NtGIMR2IQLHymsZNvYAUT1Eu9XYk0mprEAy6X8jBKQ== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1782738100; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=aajNxR/2EdiKt4nS214beeA4r3qgn0+tdbeHNc9xFtI=; b=ZNJWQ1h/ZeAXdxForqgYLGBIWmaSP3Z67vs8xnz2JnKsc7G4Jyp7MutznjZ5+XnEmeER4I XOh0L6OhsCsdkFUTYzElDi0pHfgPxmUbi9G/dD2zh3H2Wi0XJjbvQEIEudhUMqBh4snVU0 oT4pHB1WUdKmhuwVnpi8WQqA88iWUbfq1ipkveRrcd9fbKSwPrq9O98EsJAz7PmFBELgl7 Hpmw4/45X0kE66ynEfoxDIN0Yupm8n8PWDIaihGk55KMasNAiUpUd47ljPZiyZBYrYla4Q Bo/T0/fdRGJ/ySuGhrun50gxrfO97XAtWxbQXGXSYHu6TcSRr9A0zjqzg/HHRw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) by mxrelay.nyi.freebsd.org (Postfix) with ESMTP id 4gpmcz73HTzyR3 for ; Mon, 29 Jun 2026 13:01:39 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from git (uid 1279) (envelope-from git@FreeBSD.org) id 21ca8 by gitrepo.freebsd.org (DragonFly Mail Agent v0.13+ on gitrepo.freebsd.org); Mon, 29 Jun 2026 13:01:39 +0000 To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Brooks Davis Subject: git: b517edb8deed - main - CHERI: declare copy{in,out}ptr{,_nofault} List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-all@freebsd.org Sender: owner-dev-commits-src-all@FreeBSD.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: brooks X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: b517edb8deed23b8c616f0ad4453e4dee7b0ac0f Auto-Submitted: auto-generated Date: Mon, 29 Jun 2026 13:01:39 +0000 Message-Id: <6a426cb3.21ca8.6f79461f@gitrepo.freebsd.org> The branch main has been updated by brooks: URL: https://cgit.FreeBSD.org/src/commit/?id=b517edb8deed23b8c616f0ad4453e4dee7b0ac0f commit b517edb8deed23b8c616f0ad4453e4dee7b0ac0f Author: Brooks Davis AuthorDate: 2026-06-29 12:58:52 +0000 Commit: Brooks Davis CommitDate: 2026-06-29 12:59:29 +0000 CHERI: declare copy{in,out}ptr{,_nofault} These provenance-preserving functions are to be used when copying objects that are expected to contain pointers. Data buffers which do not contain pointers should be copied by the traditional copyin/copyout functions which *do not* preserve pointer provenance (on CHERI they clear validity tags). NOTE: Going forward, this requires changes when adding new syscalls or ioctl that take pointers to objects containing pointers. Fortunately, the vast majority (>90%) of copyin and copyout statements do not copy pointers and require no change. Failure to make the chance will have no effect on non-CHERI architectures. Reviewed by: kib, markj Effort: CHERI upstreaming Sponsored by: DARPA, AFRL, Innovate UK Differential Revision: https://reviews.freebsd.org/D57663 --- share/man/man9/copy.9 | 49 ++++++++++++++++++++++++++++++++++++++++++++----- sys/kern/subr_uio.c | 24 ++++++++++++++++++++++++ sys/sys/systm.h | 18 ++++++++++++++++++ 3 files changed, 86 insertions(+), 5 deletions(-) diff --git a/share/man/man9/copy.9 b/share/man/man9/copy.9 index fe51bbd12704..a1aa75e2c84f 100644 --- a/share/man/man9/copy.9 +++ b/share/man/man9/copy.9 @@ -32,15 +32,19 @@ .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF .\" SUCH DAMAGE. .\" -.Dd May 11, 2020 +.Dd June 29, 2026 .Dt COPY 9 .Os .Sh NAME .Nm copy , .Nm copyin , .Nm copyin_nofault , +.Nm copyinptr , +.Nm copyinptr_nofault , .Nm copyout , .Nm copyout_nofault , +.Nm copyoutptr , +.Nm copyoutptr_nofault , .Nm copystr , .Nm copyinstr .Nd heterogeneous address space copy functions @@ -52,9 +56,17 @@ .Ft int .Fn copyin_nofault "const void *uaddr" "void *kaddr" "size_t len" .Ft int +.Fn copyinptr "const void *uaddr" "void *kaddr" "size_t len" +.Ft int +.Fn copyinptr_nofault "const void *uaddr" "void *kaddr" "size_t len" +.Ft int .Fn copyout "const void *kaddr" "void *uaddr" "size_t len" .Ft int .Fn copyout_nofault "const void *kaddr" "void *uaddr" "size_t len" +.Ft int +.Fn copyoutptr "const void *kaddr" "void *uaddr" "size_t len" +.Ft int +.Fn copyoutptr_nofault "const void *kaddr" "void *uaddr" "size_t len" .Ft int __deprecated .Fn copystr "const void *kfaddr" "void *kdaddr" "size_t len" "size_t *done" .Ft int @@ -81,7 +93,15 @@ functions copy bytes of data from the user-space address .Fa uaddr to the kernel-space address -.Fa kaddr . +.Fa kaddr +without preserving the provenance of pointers in the copied object +.Pq see Xr memory_model 7 for further information . +The +.Fn copyinptr +and +.Fn copyinptr_nofault +functions do the same, +but preserves the provenance of copied pointers to user-space. .Pp The .Fn copyout @@ -92,12 +112,21 @@ functions copy bytes of data from the kernel-space address .Fa kaddr to the user-space address -.Fa uaddr . +.Fa uaddr +without preserving the provenance of pointers in the copied object. +The +.Fn copyoutptr +and +.Fn copyoutptr_nofault +functions do the same, +but preserves the provenance of copied pointers to user-space. .Pp The -.Fn copyin_nofault +.Fn copyin_nofault , +.Fn copyinptr_nofault , +.Fn copyout_nofault , and -.Fn copyout_nofault +.Fn copyoutptr_nofault functions require that the kernel-space and user-space data be accessible without incurring a page fault. The source and destination addresses must be physically mapped for @@ -105,6 +134,16 @@ read and write access, respectively, and neither the source nor destination addresses may be pageable. .Pp The +.Fn copyinptr , +.Fn copyinptr_nofault , +.Fn copyoutptr , +and +.Fn copyoutptr_nofault +functions must be used when copying data which may contain pointers, +but they should only be used when necessary to limit the number of +code paths that could leak pointers between address spaces. +.Pp +The .Fn copystr function copies a NUL-terminated string, at most .Fa len diff --git a/sys/kern/subr_uio.c b/sys/kern/subr_uio.c index e2059d3813d4..ea75c6abc539 100644 --- a/sys/kern/subr_uio.c +++ b/sys/kern/subr_uio.c @@ -88,6 +88,30 @@ copyout_nofault(const void *kaddr, void *udaddr, size_t len) return (error); } +#ifdef __CHERI__ +int +copyinptr_nofault(const void *udaddr, void *kaddr, size_t len) +{ + int error, save; + + save = vm_fault_disable_pagefaults(); + error = copyinptr(udaddr, kaddr, len); + vm_fault_enable_pagefaults(save); + return (error); +} + +int +copyoutptr_nofault(const void *kaddr, void *udaddr, size_t len) +{ + int error, save; + + save = vm_fault_disable_pagefaults(); + error = copyoutptr(kaddr, udaddr, len); + vm_fault_enable_pagefaults(save); + return (error); +} +#endif + #define PHYS_PAGE_COUNT(len) (howmany(len, PAGE_SIZE) + 1) int diff --git a/sys/sys/systm.h b/sys/sys/systm.h index e50b02bfb7cf..f2c5051ac03d 100644 --- a/sys/sys/systm.h +++ b/sys/sys/systm.h @@ -313,6 +313,24 @@ __nodiscard int copyout_nofault( const void * _Nonnull __restrict kaddr, void * __restrict udaddr, size_t len); +#ifdef __CHERI__ +__nodiscard int copyinptr(const void * __restrict udaddr, + void * _Nonnull __restrict kaddr, size_t len); +__nodiscard int copyinptr_nofault(const void * __restrict udaddr, + void * _Nonnull __restrict kaddr, size_t len); +__nodiscard int copyoutptr( + const void * _Nonnull __restrict kaddr, void * __restrict udaddr, + size_t len); +__nodiscard int copyoutptr_nofault( + const void * _Nonnull __restrict kaddr, void * __restrict udaddr, + size_t len); +#else +#define copyinptr copyin +#define copyinptr_nofault copyin_nofault +#define copyoutptr copyout +#define copyoutptr_nofault copyout_nofault +#endif + #ifdef SAN_NEEDS_INTERCEPTORS int SAN_INTERCEPTOR(copyin)(const void *, void *, size_t); int SAN_INTERCEPTOR(copyinstr)(const void *, void *, size_t, size_t *);