MdePkg/BaseLib: Add new AsmLfence API

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1193

This commit will add a new BaseLib API AsmLfence(). This API will perform
a serializing operation on all load-from-memory instructions that were
issued prior to the call of this function. Please note that this API is
only available on IA-32 and x64.

The purpose of adding this API is to mitigate of the [CVE-2017-5753]
Bounds Check Bypass issue when untrusted data are being processed within
SMM. More details can be referred at the 'Bounds check bypass mitigation'
section at the below link:

https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation

Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Regression-tested-by: Laszlo Ersek <lersek@redhat.com>

diff --git a/MdePkg/Include/Library/BaseLib.h b/MdePkg/Include/Library/BaseLib.h
index 2fae312f2f98a9d28a3c3d6bcf4a861ca85cca1d..8cc086983d5446e1c28e4f1563d85b0247eeb242 100644 (file)
--- a/MdePkg/Include/Library/BaseLib.h
+++ b/MdePkg/Include/Library/BaseLib.h
@@ -7696,6 +7696,19 @@ AsmWriteTr (
   IN UINT16 Selector\r
   );\r
 \r
+/**\r
+  Performs a serializing operation on all load-from-memory instructions that\r
+  were issued prior the AsmLfence function.\r
+\r
+  Executes a LFENCE instruction. This function is only available on IA-32 and x64.\r
+\r
+**/\r
+VOID\r
+EFIAPI\r
+AsmLfence (\r
+  VOID\r
+  );\r
+\r
 /**\r
   Patch the immediate operand of an IA32 or X64 instruction such that the byte,\r
   word, dword or qword operand is encoded at the end of the instruction's\r

diff --git a/MdePkg/Library/BaseLib/BaseLib.inf b/MdePkg/Library/BaseLib/BaseLib.inf
index def78d69e836040bd706ba0e15d6c2197b3ea81f..b84e58324c5291fadcdd72c1300b37ff91a5a97f 100644 (file)
--- a/MdePkg/Library/BaseLib/BaseLib.inf
+++ b/MdePkg/Library/BaseLib/BaseLib.inf
@@ -68,6 +68,7 @@
 \r
 [Sources.Ia32]\r
   Ia32/WriteTr.nasm\r
+  Ia32/Lfence.nasm\r
 \r
   Ia32/Wbinvd.c | MSFT\r
   Ia32/WriteMm7.c | MSFT\r
@@ -346,6 +347,7 @@
   X64/EnableCache.nasm\r
   X64/DisableCache.nasm\r
   X64/WriteTr.nasm\r
+  X64/Lfence.nasm\r
 \r
   X64/CpuBreakpoint.c | MSFT\r
   X64/WriteMsr64.c | MSFT\r

diff --git a/MdePkg/Library/BaseLib/Ia32/Lfence.nasm b/MdePkg/Library/BaseLib/Ia32/Lfence.nasm
new file mode 100644 (file)
index 0000000..414f7d7
--- /dev/null
+++ b/MdePkg/Library/BaseLib/Ia32/Lfence.nasm
@@ -0,0 +1,36 @@
+;------------------------------------------------------------------------------ ;\r
+; Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>\r
+; This program and the accompanying materials\r
+; are licensed and made available under the terms and conditions of the BSD License\r
+; which accompanies this distribution.  The full text of the license may be found at\r
+; http://opensource.org/licenses/bsd-license.php.\r
+;\r
+; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
+; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
+;\r
+; Module Name:\r
+;\r
+;   Lfence.nasm\r
+;\r
+; Abstract:\r
+;\r
+;   Performs a serializing operation on all load-from-memory instructions that\r
+;   were issued prior to the call of this function.\r
+;\r
+; Notes:\r
+;\r
+;------------------------------------------------------------------------------\r
+\r
+    SECTION .text\r
+\r
+;------------------------------------------------------------------------------\r
+; VOID\r
+; EFIAPI\r
+; AsmLfence (\r
+;   VOID\r
+;   );\r
+;------------------------------------------------------------------------------\r
+global ASM_PFX(AsmLfence)\r
+ASM_PFX(AsmLfence):\r
+    lfence\r
+    ret\r

diff --git a/MdePkg/Library/BaseLib/X64/Lfence.nasm b/MdePkg/Library/BaseLib/X64/Lfence.nasm
new file mode 100644 (file)
index 0000000..9ee9b56
--- /dev/null
+++ b/MdePkg/Library/BaseLib/X64/Lfence.nasm
@@ -0,0 +1,37 @@
+;------------------------------------------------------------------------------ ;\r
+; Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>\r
+; This program and the accompanying materials\r
+; are licensed and made available under the terms and conditions of the BSD License\r
+; which accompanies this distribution.  The full text of the license may be found at\r
+; http://opensource.org/licenses/bsd-license.php.\r
+;\r
+; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,\r
+; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.\r
+;\r
+; Module Name:\r
+;\r
+;   Lfence.nasm\r
+;\r
+; Abstract:\r
+;\r
+;   Performs a serializing operation on all load-from-memory instructions that\r
+;   were issued prior to the call of this function.\r
+;\r
+; Notes:\r
+;\r
+;------------------------------------------------------------------------------\r
+\r
+    DEFAULT REL\r
+    SECTION .text\r
+\r
+;------------------------------------------------------------------------------\r
+; VOID\r
+; EFIAPI\r
+; AsmLfence (\r
+;   VOID\r
+;   );\r
+;------------------------------------------------------------------------------\r
+global ASM_PFX(AsmLfence)\r
+ASM_PFX(AsmLfence):\r
+    lfence\r
+    ret\r