git: 7f55dbe6ae89 - main - CHERI: declare mem{cpy,move}_data
- Go to: [ bottom of page ] [ top of archives ] [ this month ]
Date: Wed, 01 Jul 2026 11:49:34 UTC
The branch main has been updated by brooks:
URL: https://cgit.FreeBSD.org/src/commit/?id=7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1
commit 7f55dbe6ae89c356db1bc4fb2c42d9d007ae5da1
Author: Brooks Davis <brooks@FreeBSD.org>
AuthorDate: 2026-07-01 11:45:51 +0000
Commit: Brooks Davis <brooks@FreeBSD.org>
CommitDate: 2026-07-01 11:46:11 +0000
CHERI: declare mem{cpy,move}_data
Declare kernel-only, provenance-discarding memcpy_data, and memmove_data
APIs intended to copy raw data which does not contain pointers (e.g.,
buffers on their way to or from network or storage devices). On CHERI
architectures, they will explicitly remove tags from capabilities,
removing any provenance. This reduces the risk of accidental spread of
pointers on CHERI systems.
Document that bcopy preserves pointer provenance.
Reviewed by: ziaee, kib, adrian, markj
Effort: CHERI upstreaming
Sponsored by: DARPA, AFRL, Innovate UK
Differential Revision: https://reviews.freebsd.org/D57662
---
share/man/man9/Makefile | 2 ++
share/man/man9/bcopy.9 | 6 ++++--
share/man/man9/memcpy.9 | 30 +++++++++++++++++++++++-------
share/man/man9/memmove.9 | 29 ++++++++++++++++++++++++-----
sys/sys/systm.h | 9 +++++++++
5 files changed, 62 insertions(+), 14 deletions(-)
diff --git a/share/man/man9/Makefile b/share/man/man9/Makefile
index f465c7f49696..e00a74a49a94 100644
--- a/share/man/man9/Makefile
+++ b/share/man/man9/Makefile
@@ -1616,6 +1616,8 @@ MLINKS+=mdchain.9 md_append_record.9 \
mdchain.9 md_get_uio.9 \
mdchain.9 md_initm.9 \
mdchain.9 md_next_record.9
+MLINKS+=memcpy.9 memcpy_data.9
+MLINKS+=memmove.9 memmove_data.9
MLINKS+=microtime.9 bintime.9 \
microtime.9 getbintime.9 \
microtime.9 getmicrotime.9 \
diff --git a/share/man/man9/bcopy.9 b/share/man/man9/bcopy.9
index a82c66c66965..0952216ba25f 100644
--- a/share/man/man9/bcopy.9
+++ b/share/man/man9/bcopy.9
@@ -28,7 +28,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd June 19, 2026
+.Dd July 1, 2026
.Dt BCOPY 9
.Os
.Sh NAME
@@ -46,7 +46,9 @@ function copies
bytes from object
.Fa src
to object
-.Fa dst .
+.Fa dst
+preserving the provenance of pointers in the copied object
+.Pq see Xr memory_model 7 for further information .
The two objects may overlap.
If
.Fa len
diff --git a/share/man/man9/memcpy.9 b/share/man/man9/memcpy.9
index e9675a55cf13..26c3e5af4401 100644
--- a/share/man/man9/memcpy.9
+++ b/share/man/man9/memcpy.9
@@ -29,16 +29,19 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd June 19, 2026
+.Dd July 1, 2026
.Dt MEMCPY 9
.Os
.Sh NAME
-.Nm memcpy
+.Nm memcpy ,
+.Nm memcpy_data
.Nd copy bytes in memory
.Sh SYNOPSIS
.In sys/systm.h
.Ft void *
.Fn memcpy "void *dst" "const void *src" "size_t len"
+.Ft void *
+.Fn memcpy_data "void *dst" "const void *src" "size_t len"
.Sh DESCRIPTION
The
.Fn memcpy
@@ -47,22 +50,31 @@ function copies
bytes from object
.Fa src
to object
-.Fa dst .
+.Fa dst
+in a manner that preserves the provenance of pointers in the copied object
+.Pq see Xr memory_model 7 for further information .
If
.Fa src
and
.Fa dst
overlap, the results are not defined.
+The
+.Fn memcpy_data
+function does the same except that it does not preserve the provenance
+of pointers in the copied object.
+On CHERI targets, the validity tag of any copied capability is
+explicitly cleared.
.Sh RETURN VALUES
The
.Fn memcpy
-function
-returns the original value of
+and
+.Fn memcpy_data
+functions return the original value of
.Fa dst .
-.Pp
.Sh SEE ALSO
.Xr bcopy 9 ,
-.Xr memmove 9
+.Xr memmove 9 ,
+.Xr memmove_data 9
.Sh STANDARDS
The
.Fn memcpy
@@ -76,3 +88,7 @@ function first appeared in
.At V
and was reimplemented for
.Bx 4.3 Tahoe .
+The
+.Fn memcpy_data
+function first appeared in
+.Fx 16.0 .
diff --git a/share/man/man9/memmove.9 b/share/man/man9/memmove.9
index 54031dc37d96..ec9af1cfdb71 100644
--- a/share/man/man9/memmove.9
+++ b/share/man/man9/memmove.9
@@ -29,16 +29,19 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd June 19, 2026
+.Dd July 1, 2026
.Dt MEMMOVE 9
.Os
.Sh NAME
-.Nm memmove
+.Nm memmove ,
+.Nm memmove_data
.Nd copy bytes in memory
.Sh SYNOPSIS
.In sys/systm.h
.Ft void *
.Fn memmove "void *dst" "const void *src" "size_t len"
+.Ft void *
+.Fn memmove_data "void *dst" "const void *src" "size_t len"
.Sh DESCRIPTION
The
.Fn memmove
@@ -49,18 +52,34 @@ bytes from object
to object
.Fa dst .
The two objects may overlap;
-the copy is always done in a non-destructive manner.
+the copy is always done in a non-destructive manner and preserves
+the provenance of pointers in the copied object
+.Pq see Xr memory_model 7 for further information .
+The
+.Fn memmove_data
+function does the same except that it does not preserve the provenance
+of pointers in the copied object.
+On CHERI targets, the validity tag of any copied capability is
+explicitly cleared.
.Sh RETURN VALUES
The
.Fn memmove
-function returns the original value of
+and
+.Fn memmove_data
+functions return the original value of
.Fa dst .
.Sh SEE ALSO
.Xr bcopy 9 ,
-.Xr memcpy 9
+.Xr memcpy 9 ,
+.Xr memcpy_data 9
.Sh STANDARDS
The
.Fn memmove
function
conforms to
.St -isoC .
+.Sh HISTORY
+The
+.Fn memmove_data
+function first appeared in
+.Fx 16.0 .
diff --git a/sys/sys/systm.h b/sys/sys/systm.h
index 83023d24fe7d..f7814949ac86 100644
--- a/sys/sys/systm.h
+++ b/sys/sys/systm.h
@@ -256,6 +256,15 @@ void *memset(void * _Nonnull buf, int c, size_t len);
void *memcpy(void * _Nonnull to, const void * _Nonnull from, size_t len);
void *memmove(void * _Nonnull dest, const void * _Nonnull src, size_t n);
int memcmp(const void *b1, const void *b2, size_t len);
+#ifdef __CHERI__
+void *memcpy_data(void * _Nonnull to, const void * _Nonnull from,
+ size_t len);
+void *memmove_data(void * _Nonnull dest, const void * _Nonnull src,
+ size_t n);
+#else
+#define memcpy_data memcpy
+#define memmove_data memmove
+#endif
#ifdef SAN_NEEDS_INTERCEPTORS
#define SAN_INTERCEPTOR(func) \