CHERI: declare mem{cpy,move}_data

Declare kernel-only, provenance-discarding memcpy_data, and memmove_data
APIs intended to copy raw data which does not contain pointers (e.g.,
buffers on their way to or from network or storage devices).  On CHERI
architectures, they will explicitly remove tags from capabilities,
removing any provenance.  This reduces the risk of accidental spread of
pointers on CHERI systems.

Document that bcopy preserves pointer provenance.

Reviewed by:	ziaee, kib, adrian, markj
Effort:		CHERI upstreaming
Sponsored by:	DARPA, AFRL, Innovate UK
Differential Revision:	https://reviews.freebsd.org/D57662

5 files changed, 62 insertions, 14 deletions

diff --git a/share/man/man9/Makefile b/share/man/man9/Makefile
index f465c7f49696..e00a74a49a94 100644
--- a/share/man/man9/Makefile
+++ b/share/man/man9/Makefile
@@ -1616,6 +1616,8 @@ MLINKS+=mdchain.9 md_append_record.9 \
 	mdchain.9 md_get_uio.9 \
 	mdchain.9 md_initm.9 \
 	mdchain.9 md_next_record.9
+MLINKS+=memcpy.9 memcpy_data.9
+MLINKS+=memmove.9 memmove_data.9
 MLINKS+=microtime.9 bintime.9 \
 	microtime.9 getbintime.9 \
 	microtime.9 getmicrotime.9 \
diff --git a/share/man/man9/bcopy.9 b/share/man/man9/bcopy.9
index a82c66c66965..0952216ba25f 100644
--- a/share/man/man9/bcopy.9
+++ b/share/man/man9/bcopy.9
@@ -28,7 +28,7 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd June 19, 2026
+.Dd July 1, 2026
 .Dt BCOPY 9
 .Os
 .Sh NAME
@@ -46,7 +46,9 @@ function copies
 bytes from object
 .Fa src
 to object
-.Fa dst .
+.Fa dst
+preserving the provenance of pointers in the copied object
+.Pq see Xr memory_model 7 for further information .
 The two objects may overlap.
 If
 .Fa len
diff --git a/share/man/man9/memcpy.9 b/share/man/man9/memcpy.9
index e9675a55cf13..26c3e5af4401 100644
--- a/share/man/man9/memcpy.9
+++ b/share/man/man9/memcpy.9
@@ -29,16 +29,19 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd June 19, 2026
+.Dd July 1, 2026
 .Dt MEMCPY 9
 .Os
 .Sh NAME
-.Nm memcpy
+.Nm memcpy ,
+.Nm memcpy_data
 .Nd copy bytes in memory
 .Sh SYNOPSIS
 .In sys/systm.h
 .Ft void *
 .Fn memcpy "void *dst" "const void *src" "size_t len"
+.Ft void *
+.Fn memcpy_data "void *dst" "const void *src" "size_t len"
 .Sh DESCRIPTION
 The
 .Fn memcpy
@@ -47,22 +50,31 @@ function copies
 bytes from object
 .Fa src
 to object
-.Fa dst .
+.Fa dst
+in a manner that preserves the provenance of pointers in the copied object
+.Pq see Xr memory_model 7 for further information .
 If
 .Fa src
 and
 .Fa dst
 overlap, the results are not defined.
+The
+.Fn memcpy_data
+function does the same except that it does not preserve the provenance
+of pointers in the copied object.
+On CHERI targets, the validity tag of any copied capability is
+explicitly cleared.
 .Sh RETURN VALUES
 The
 .Fn memcpy
-function
-returns the original value of
+and
+.Fn memcpy_data
+functions return the original value of
 .Fa dst .
-.Pp
 .Sh SEE ALSO
 .Xr bcopy 9 ,
-.Xr memmove 9
+.Xr memmove 9 ,
+.Xr memmove_data 9
 .Sh STANDARDS
 The
 .Fn memcpy
@@ -76,3 +88,7 @@ function first appeared in
 .At V
 and was reimplemented for
 .Bx 4.3 Tahoe .
+The
+.Fn memcpy_data
+function first appeared in
+.Fx 16.0 .
diff --git a/share/man/man9/memmove.9 b/share/man/man9/memmove.9
index 54031dc37d96..ec9af1cfdb71 100644
--- a/share/man/man9/memmove.9
+++ b/share/man/man9/memmove.9
@@ -29,16 +29,19 @@
 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
 .\" SUCH DAMAGE.
 .\"
-.Dd June 19, 2026
+.Dd July 1, 2026
 .Dt MEMMOVE 9
 .Os
 .Sh NAME
-.Nm memmove
+.Nm memmove ,
+.Nm memmove_data
 .Nd copy bytes in memory
 .Sh SYNOPSIS
 .In sys/systm.h
 .Ft void *
 .Fn memmove "void *dst" "const void *src" "size_t len"
+.Ft void *
+.Fn memmove_data "void *dst" "const void *src" "size_t len"
 .Sh DESCRIPTION
 The
 .Fn memmove
@@ -49,18 +52,34 @@ bytes from object
 to object
 .Fa dst .
 The two objects may overlap;
-the copy is always done in a non-destructive manner.
+the copy is always done in a non-destructive manner and preserves
+the provenance of pointers in the copied object
+.Pq see Xr memory_model 7 for further information .
+The
+.Fn memmove_data
+function does the same except that it does not preserve the provenance
+of pointers in the copied object.
+On CHERI targets, the validity tag of any copied capability is
+explicitly cleared.
 .Sh RETURN VALUES
 The
 .Fn memmove
-function returns the original value of
+and
+.Fn memmove_data
+functions return the original value of
 .Fa dst .
 .Sh SEE ALSO
 .Xr bcopy 9 ,
-.Xr memcpy 9
+.Xr memcpy 9 ,
+.Xr memcpy_data 9
 .Sh STANDARDS
 The
 .Fn memmove
 function
 conforms to
 .St -isoC .
+.Sh HISTORY
+The
+.Fn memmove_data
+function first appeared in
+.Fx 16.0 .
diff --git a/sys/sys/systm.h b/sys/sys/systm.h
index 83023d24fe7d..f7814949ac86 100644
--- a/sys/sys/systm.h
+++ b/sys/sys/systm.h
@@ -256,6 +256,15 @@ void	*memset(void * _Nonnull buf, int c, size_t len);
 void	*memcpy(void * _Nonnull to, const void * _Nonnull from, size_t len);
 void	*memmove(void * _Nonnull dest, const void * _Nonnull src, size_t n);
 int	memcmp(const void *b1, const void *b2, size_t len);
+#ifdef __CHERI__
+void	*memcpy_data(void * _Nonnull to, const void * _Nonnull from,
+	    size_t len);
+void	*memmove_data(void * _Nonnull dest, const void * _Nonnull src,
+	    size_t n);
+#else
+#define	memcpy_data	memcpy
+#define	memmove_data	memmove
+#endif
 
 #ifdef SAN_NEEDS_INTERCEPTORS
 #define	SAN_INTERCEPTOR(func)	\