How does mobilecoin ensure proper alignment?

[Bajix]

I was hoping someone could shed clarity on how mobilecoin ensures pointer alignment with ecalls and ocalls. What guarantees correct alignment; are there any relevant compilation flags etc.

In this example, for instance, outbuf_used will be misaligned if outbuf isn't padded resulting in a panic. Is there some magic somewhere to ensure this aligns correctly? It's the case that every [in, size=inbuf_len] const uint8_t* and every [in, string] const char* can cause misalignment is it not? Would love any clarity on how alignment is guaranteed here

        public sgx_status_t ingest_enclave_call([in, size=inbuf_len] const uint8_t* inbuf,
                                                size_t inbuf_len,
                                                [out, size=outbuf_len] uint8_t *outbuf,
                                                size_t outbuf_len,
                                                [out] size_t* outbuf_used,
                                                [in, out] uint64_t* outbuf_retry_id);

[cbeck88]

The basic answer is, this is following the documentation for Intel's official edger8r tool for defining C apis for an enclave. This is basically C code with a few extra keywords and these [...] annotations, which are used in code gen but don't become part of the C API.

edger8r is going to take the above and generate code for a C API:

        sgx_status_t ingest_enclave_call(const uint8_t* inbuf,
                                                size_t inbuf_len,
                                                uint8_t *outbuf,
                                                size_t outbuf_len,
                                                size_t* outbuf_used,
                                                uint64_t* outbuf_retry_id);

with all the [...] and such removed. Here, outbuf_len is marked as size_t, so the C compiler has to align it to the boundary of size_t, both when calling the function and when the function body reads things off the stack. If it doesn't, that's a bug in the C compiler, and it's going to break a lot more programs than just this one.

Possibly, the size= stuff is throwing you off. For example:

[out, size=outbuf_len] uint8_t *outbuf,

This is not telling the C compiler that sizeof(outbuf) == outbuf_len, which indeed would be weird. sizeof(outbuf) is going to equal 8 because a pointer is 8 bytes on this platform. The size annotation refers to the length of the buffer pointed to by outbuf . So none of that stuff is going to cause misalignment on the stack.

You can read more about the EDL file syntax in the Intel edger8r tool documentation.