Page MenuHomeFreeBSD

CHERI: add mem{cpy,move}_data
Needs ReviewPublic

Authored by brooks on Fri, Jun 19, 2:12 PM.
Tags
None
Referenced Files
F160556639: D57662.id180075.diff
Thu, Jun 25, 3:48 PM
F160542522: D57662.diff
Thu, Jun 25, 12:28 PM
Unknown Object (File)
Thu, Jun 25, 3:35 AM
Unknown Object (File)
Thu, Jun 25, 3:23 AM
Unknown Object (File)
Wed, Jun 24, 2:38 PM
Unknown Object (File)
Wed, Jun 24, 11:58 AM
Unknown Object (File)
Wed, Jun 24, 1:19 AM
Unknown Object (File)
Tue, Jun 23, 9:20 PM

Details

Reviewers
kib
markj
jhb
jrtc27
Group Reviewers
cheri
Summary

Add kernel-only provenance-discarding memcpy_data and
memmove_data APIs intended to copy raw data which does not contain
pointers (e.g., buffers on their way to or from network or storage
devices). On CHERI architectures, they will explicitly remove tags
from capabilities, removing any provenance. This reduces the risk of
accidental spread of pointers on CHERI system.

This includes a simple C implementation for CHERI targets.

Effort: CHERI upstreaming
Sponsored by: DARPA, AFRL, Innovate UK

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Passed
Unit
No Test Coverage
Build Status
Buildable 74236
Build 71119: arc lint + arc unit

Event Timeline

share/man/man9/memcpy.9
94

typo

emaste added inline comments.
sys/sys/systm.h
295

How widely used is bcopy_data in CHERI? Is it reasonable to move those to memmove_data (possibly moving to memmove first in FreeBSD)? It seems slightly unfortunate to make a new version of a legacy/obsolete interface.

sys/sys/systm.h
295

None of these are widely used. memmove_data is currently completely unused except to implement bcopy_data. I actually think most (or even all) could be memcpy_data (I don't think any of these overlap).

The one slightly perverse argument for bcopy_data is that it's safely outside the reserved mem* namespace.

sys/sys/systm.h
295

I'll make the s/bcopy/memcpy changes and do some consolidation along the way.

Rebase after removing references to strings in base manpages

brooks retitled this revision from CHERI: add mem{cpy,move}_data and bcopy_data to CHERI: add mem{cpy,move}_data.Sat, Jun 20, 5:07 PM
brooks edited the summary of this revision. (Show Details)
adrian added inline comments.
share/man/man9/memcpy.9
63

where is "pointer provenance" defined?

Link manpages to the description of pointer provenacne in arch(7)

brooks added inline comments.
share/man/man9/memcpy.9
63

Now linked to a discussion in arch(7).

share/man/man9/memmove.9
36–37
59
sys/libkern/bcopy.c
66

Do you not get a warning about keeptags being unused in non-CHERI kernels?

161
170
share/man/man9/memcpy.9
53–55
63

Given our explicit decision of making this the non-default case, do we want to make this read a bit more in an active sense -- something along the lines of "discards" rather than "does not preserve"?

"Discards pointer provenance" is not quite right though. In a CHERI sense we could maybe use "discards capability validity." Anyway, a suggestion if you can find a good way to express this, otherwise we can leave it until CHERI-specific content starts getting added.

share/man/man9/memmove.9
60

Same comment as above

brooks marked 9 inline comments as done.

Address feedback, switch references to memory_model.7

share/man/man9/memcpy.9
63

I've added some more active CHERI-specific content. In the non-CHERI case it's probably best to be somewhat passive here since it's literally a no-op today.

sys/libkern/bcopy.c
66

I've added a __maybe_unused.

share/man/man9/memcpy.9
66