Re: RFC: userspace exception fixups

[Dave Hansen <dave.hansen@intel.com>]

On 11/6/18 7:37 AM, Sean Christopherson wrote:
> 
> void *sgx_alloc_untrusted_stack(size_t size)
> {
> 	struct sgx_encl_tls *tls = get_encl_tls();
> 	struct sgx_out_call_context *context;
> 	void *tmp;
> 
> 	/* create a frame on the trusted stack to hold the out-call context */
> 	tls->trusted_stack -= sizeof(struct sgx_out_call_context);
> 
> 	/* save the untrusted %RSP into the out-call context */
> 	context = (struct sgx_out_call_context *)tls->trusted_stack;
> 	context->untrusted_stack = tls->save_state_area[SSA_RSP];
> 
> 	/* allocate space on the untrusted stack */
> 	tmp = (void *)(tls->save_state_area[SSA_RSP] - size);
> 	tls->save_state_area[SSA_RSP] = tmp;
> 
> 	return tmp;
> }

Why does it bother to go to all the trouble of mucking with the
untrusted stack?  It could *easily* just leave it alone and do out-calls
if it needs to allocate memory for parameter storage.  Heck, that could
theoretically even be _on_ the stack if the untrusted runtime was being
clever.

The only downside would be that the untrusted runtime would have to keep
track of the space a bit more explicitly so it could be cleaned up if
the enclave didn't do it.