Details

Reviewers

kib
markj
jhb
jrtc27

Group Reviewers

cheri

Commits

rGb517edb8deed: CHERI: declare copy{in,out}ptr{,_nofault}

Summary

These provenance-preserving functions are to be used when copying
objects that are expected to contain pointers. Data buffers which do
not contain pointers should be copied by the traditional copyin/copyout
functions which *do not* preserve pointer provenance (on CHERI they
clear validity tags).

NOTE: Going forward, this requires changes when adding new syscalls or ioctl that take pointers to objects containing pointers. Fortunatly, the vast majority (>90%) of copyin and copyout statements do not copy pointers and require no change. Failure to make the chance will have no effect on non-CHERI architectures.

Effort: CHERI upstreaming
Sponsored by: DARPA, AFRL, Innovate UK

Diff Detail

Repository

rG FreeBSD src repository

Lint

Lint Passed

Unit

No Test Coverage

Build Status

Buildable 74195
Build 71078: arc lint + arc unit

Event Timeline

brooks created this revision.Jun 19 2026, 2:12 PM

Herald added subscribers: ziaee, olce, imp. · View Herald TranscriptJun 19 2026, 2:12 PM

brooks requested review of this revision.Jun 19 2026, 2:12 PM

Herald added a reviewer: cheri. · View Herald TranscriptJun 19 2026, 2:12 PM

Harbormaster completed remote builds in B73998: Diff 180058.Jun 19 2026, 2:12 PM

brooks added a parent revision: D57662: CHERI: add mem{cpy,move}_data.Jun 19 2026, 2:12 PM

brooks added a child revision: D57664: CHERI: declare fueptr and suptr.

Link manpages to the description of pointer provenacne in arch(7)

Harbormaster completed remote builds in B74195: Diff 180518.Wed, Jun 24, 10:08 AM

markj added inline comments.Wed, Jun 24, 2:28 PM

share/man/man9/copy.9
100	You might clarify here that you're talking about user pointers. It's always a bug to copy out kernel capabilities.
100
112
sys/sys/systm.h
321	Hmm, I didn't realize that `__nodiscard` and `__result_use_check` are aliases. Should we prefer one over the other?
336	We might as well add it anyway, no?

brooks retitled this revision from CHERI: declare copy{in,out}ptr and copyoutptr_nofault to CHERI: declare copy{in,out}ptr{,_nofault}.Thu, Jun 25, 10:36 AM

Doc fixes. Add copyinptr_nofault

Harbormaster completed remote builds in B74238: Diff 180610.Thu, Jun 25, 10:36 AM

brooks marked 4 inline comments as done.Thu, Jun 25, 10:38 AM

brooks added a subscriber: alfredo.mazzinghi_cl.cam.ac.uk.

brooks added inline comments.

share/man/man9/copy.9
100	You might clarify here that you're talking about user pointers. It's always a bug to copy out kernel capabilities. I've mentioned they are pointers to user-space, though the current implementations don't know the difference. @alfredo.mazzinghi_cl.cam.ac.uk does have patches to use the local-global mechanism to prevent kernel pointer from leaking to userspace so documenting this intent does seem like the right thing to do.