MdePkg/BaseLib: Add new AsmLfence API

REF:https://bugzilla.tianocore.org/show_bug.cgi?id=1193

This commit will add a new BaseLib API AsmLfence(). This API will perform
a serializing operation on all load-from-memory instructions that were
issued prior to the call of this function. Please note that this API is
only available on IA-32 and x64.

The purpose of adding this API is to mitigate of the [CVE-2017-5753]
Bounds Check Bypass issue when untrusted data are being processed within
SMM. More details can be referred at the 'Bounds check bypass mitigation'
section at the below link:

https://software.intel.com/security-software-guidance/insights/host-firmware-speculative-execution-side-channel-mitigation

Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Cc: Leif Lindholm <leif.lindholm@linaro.org>
Cc: Michael D Kinney <michael.d.kinney@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Reviewed-by: Liming Gao <liming.gao@intel.com>
Acked-by: Laszlo Ersek <lersek@redhat.com>
Regression-tested-by: Laszlo Ersek <lersek@redhat.com>
(cherry picked from commit 2ecd829972f8553de83fbf943c5b89863999d7c8)

4 files changed, 89 insertions, 1 deletions

diff --git a/MdePkg/Include/Library/BaseLib.h b/MdePkg/Include/Library/BaseLib.h
index 05eb4e33a0..7955a27b99 100644
--- a/MdePkg/Include/Library/BaseLib.h
+++ b/MdePkg/Include/Library/BaseLib.h
@@ -2,7 +2,7 @@
   Provides string functions, linked list functions, math functions, synchronization

   functions, file path functions, and CPU architecture-specific functions.

 

-Copyright (c) 2006 - 2017, Intel Corporation. All rights reserved.<BR>

+Copyright (c) 2006 - 2018, Intel Corporation. All rights reserved.<BR>

 Portions copyright (c) 2008 - 2009, Apple Inc. All rights reserved.<BR>

 This program and the accompanying materials

 are licensed and made available under the terms and conditions of the BSD License

@@ -9067,6 +9067,19 @@ AsmWriteTr (
   IN UINT16 Selector

   );

 

+/**

+  Performs a serializing operation on all load-from-memory instructions that

+  were issued prior the AsmLfence function.

+

+  Executes a LFENCE instruction. This function is only available on IA-32 and x64.

+

+**/

+VOID

+EFIAPI

+AsmLfence (

+  VOID

+  );

+

 #endif

 #endif

 

diff --git a/MdePkg/Library/BaseLib/BaseLib.inf b/MdePkg/Library/BaseLib/BaseLib.inf
index fbfb0063b7..2ea3b0dbfb 100644
--- a/MdePkg/Library/BaseLib/BaseLib.inf
+++ b/MdePkg/Library/BaseLib/BaseLib.inf
@@ -68,6 +68,7 @@
 

 [Sources.Ia32]

   Ia32/WriteTr.nasm

+  Ia32/Lfence.nasm

 

   Ia32/Wbinvd.c | MSFT 

   Ia32/WriteMm7.c | MSFT 

@@ -450,6 +451,7 @@
   X64/DisableCache.nasm

   X64/DisableCache.asm

   X64/WriteTr.nasm

+  X64/Lfence.nasm

 

   X64/CpuBreakpoint.c | MSFT 

   X64/WriteMsr64.c | MSFT 

diff --git a/MdePkg/Library/BaseLib/Ia32/Lfence.nasm b/MdePkg/Library/BaseLib/Ia32/Lfence.nasm
new file mode 100644
index 0000000000..414f7d7344
--- /dev/null
+++ b/MdePkg/Library/BaseLib/Ia32/Lfence.nasm
@@ -0,0 +1,36 @@
+;------------------------------------------------------------------------------ ;

+; Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>

+; This program and the accompanying materials

+; are licensed and made available under the terms and conditions of the BSD License

+; which accompanies this distribution.  The full text of the license may be found at

+; http://opensource.org/licenses/bsd-license.php.

+;

+; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,

+; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

+;

+; Module Name:

+;

+;   Lfence.nasm

+;

+; Abstract:

+;

+;   Performs a serializing operation on all load-from-memory instructions that

+;   were issued prior to the call of this function.

+;

+; Notes:

+;

+;------------------------------------------------------------------------------

+

+    SECTION .text

+

+;------------------------------------------------------------------------------

+; VOID

+; EFIAPI

+; AsmLfence (

+;   VOID

+;   );

+;------------------------------------------------------------------------------

+global ASM_PFX(AsmLfence)

+ASM_PFX(AsmLfence):

+    lfence

+    ret

diff --git a/MdePkg/Library/BaseLib/X64/Lfence.nasm b/MdePkg/Library/BaseLib/X64/Lfence.nasm
new file mode 100644
index 0000000000..9ee9b563e2
--- /dev/null
+++ b/MdePkg/Library/BaseLib/X64/Lfence.nasm
@@ -0,0 +1,37 @@
+;------------------------------------------------------------------------------ ;

+; Copyright (c) 2018, Intel Corporation. All rights reserved.<BR>

+; This program and the accompanying materials

+; are licensed and made available under the terms and conditions of the BSD License

+; which accompanies this distribution.  The full text of the license may be found at

+; http://opensource.org/licenses/bsd-license.php.

+;

+; THE PROGRAM IS DISTRIBUTED UNDER THE BSD LICENSE ON AN "AS IS" BASIS,

+; WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.

+;

+; Module Name:

+;

+;   Lfence.nasm

+;

+; Abstract:

+;

+;   Performs a serializing operation on all load-from-memory instructions that

+;   were issued prior to the call of this function.

+;

+; Notes:

+;

+;------------------------------------------------------------------------------

+

+    DEFAULT REL

+    SECTION .text

+

+;------------------------------------------------------------------------------

+; VOID

+; EFIAPI

+; AsmLfence (

+;   VOID

+;   );

+;------------------------------------------------------------------------------

+global ASM_PFX(AsmLfence)

+ASM_PFX(AsmLfence):

+    lfence

+    ret