snmalloc icon indicating copy to clipboard operation
snmalloc copied to clipboard

memcpy vs StrictProvenance

Open nwf-msr opened this issue 2 years ago • 0 comments

More Lincoln Logs-style work, mostly: assemble existing pieces differently for a StrictProvenance / CHERI-aware memcpy. As documented, there are two constraints in tension:

  • We must use capability load and store instructions wherever possible, so that our memcpy obliviously copies capabilities (and preserves tags) during its operation.
  • We cannot use capability load or store instructions at misaligned addresses, since those (are permitted to) trap.

Therefore, we have three cases to consider:

  1. copies too small to move a capability: use a jump table of data word copies and be done with it
  2. "equally (mis)aligned" source and targets: these may have a (naturally aligned) capability inside the source that would also land at a naturally aligned destination address: perform data word copies to get us up to alignof(void*), perform capability copies, and then go back to doing data word copies to get us up to the end.
  3. differently aligned source and targets: since at least one of these must be misaligned relative to capabilities, use exclusively data word copies, which will result in the destination having all capability tags clear.

The only part of this that isn't (relatively) straightforward assembly of existing pieces is the change to copy_one to not use __builtin_memcpy_inline on StrictProvenance architectures to work around (or work with?) https://github.com/CTSRD-CHERI/llvm-project/issues/623 .

nwf-msr avatar Jun 09 '22 00:06 nwf-msr