Releases: microsoft/mu_tiano_platforms
v12.0.1
What's Changed
-
Do not checkout Hafnium submodule recursively @kuqin12 (#1352)
Change Details
## Description
The current workflow will checkout the hafnium submodule recursively. This is not necessary unless a Hafnium build is explicitly requested.
This change moves the pipeline to not checkout all the nested submodules of Hafnium repo and only hydrate them when the Hafnium build from source is needed.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
The pipeline builds properly.
Integration Instructions
N/A
-
Redirect Hafnium submodules to GitHub mirrors @makubacki (#1353)
Change Details
## Description
Nested submodules in the Hafnium repository are pointing to unreliable hosts. This commit updates the submodule URLs to point to GitHub mirrors.
-
https://github.com/TF-Hafnium/hafnium-third_party-googletest
-
Impacts functionality?
-
Impacts security?
-
Breaking change?
-
Includes tests?
-
Includes documentation?
How This Was Tested
- Run HAF TF build on fork
Integration Instructions
- N/A - Stabilizes CI
Full Changelog: v12.0.0...v12.0.1
v12.0.0
What's Changed
-
Submodule updates to align with latest releases. @Raymond-MS (#1350)
Change Details
## Description
Updated Features/FFA and MU_BASECORE submodules for their respective releases.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Built QemuSbsa Successfully.
Integration Instructions
N/A
-
[TPM]Platform Updates for RUST TPM Service @Raymond-MS (#1343)
Change Details
## Description
Removed code related to the C secure partition. Added the TPM service to the RUST secure partition. Updated the TF-A patch files to reflect the C secure partition removal.
The TpmStartupLib was removed in the latest updates regarding 202511, added them back in.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Built QemuSbsa with TPM enabled. Verified TPM communication. Features/FFA, MU_BASECORE, and Silicon/Arm/MU_TIANO were at latest 202502 release branches.
Integration Instructions
N/A
-
QemuQ35,QemuSbsa: Update for 202511 @apop5 (#1329)
Change Details
## Description Changes for 202511
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Booting Q35, Sbsa to OS.
Integration Instructions
No integration necessary.
-
[TPM]Add Tpm2Startup Lib to QemuSbsa PeilessSec @Raymond-MS (#1344)
Change Details
## Description
Add Tpm2StartupLib to QemuSbsa platform .dsc. This should only be used in PeilessSec.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Built QEMU SBSA with TPM enabled, verified TPM communication.
Integration Instructions
N/A
-
QemuQ35Pkg: Increase QEMU extended TSEG to 32 MB @Flickdm (#1345)
Change Details
## Description
Add the -global mch.extended-tseg-mbytes=32 argument to the QEMU runner to increase the extended TSEG from the QEMU default of 16 MB to 32 MB. Update the PcdQ35TsegMbytes PCD comment to note the QEMU default extended TSEG size of 16 MB.
REF: https://edk2.groups.io/g/devel/message/11505
REF: https://lists.nongnu.org/archive/html/qemu-devel/2017-06/msg03902.html- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
During OneCrypto testing it was seen that with OneCrypto + existing conditions - this pushed TSEG usage to 16.3 MB causing TSEG memory exhaustion. Increasing the TSEG to 32Mb allows for the platform to boot.
I will also investigate why we're pushing TSEG usage to 16.3 to determine if this is normal / expected or if there is something we should / can do to reduce the pressure.
UPDATE:
It appears that Openssl 3 performs a lot of small allocations during its initialization and when combined with Pool guard - this exhausts a 16Mb TSEG.
Specifically this line enables pool guard :
https://github.com/microsoft/mu_tiano_platforms/blob/54f18bd28fe16b41e51785af1aa9b51627f244a7/Platforms/QemuQ35Pkg/PlatformPei/Platform.c#L800With this disabled, the platform will be able to boot normally with 16Mb TSEG.
Leaving it enabled for QemuQ35 is recommended - as it's useful for detecting memory bugs early before they reach physical platforms. Meaning that increasing the TSEG here is acceptable.
This was tested in both DEBUG and RELEASE using the following commands (after building):
DEBUG
python Platforms/QemuQ35Pkg/PlatformBuild.py TOOL_CHAIN_TAG=GCC5 PATH_TO_OS=ValidationOS.qcow2 QEMU_ACCEL=kvm --FlashOnly
RELEASE
python Platforms/QemuQ35Pkg/PlatformBuild.py TOOL_CHAIN_TAG=GCC5 PATH_TO_OS=ValidationOS.qcow2 QEMU_ACCEL=kvm TARGET=RELEASE --FlashOnly
Integration Instructions
N/A
-
Rename `TEST_REGEX` to `FILE_REGEX` @Javagedes (#1338)
Change Details
## Description
This commit renames the
TEST_REGEXcommand line option toFILE_REGEXand updates the logic so that files matchingFILE_REGEXare always moved to the virtual drive; then ifRUN_TESTS=TRUEwe will treat those files as platform unit tests and will generate a startup nsh to automatically run the tests.This makes it easy for developers to move files onto the virtual drive automatically without necessarily treating those files as on-platform unit tests.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Platform CI
Integration Instructions
Users must update any automation that uses
TEST_REGEXto now useFILE_REGEX
-
Update submodules to latest of 202502 branches. @apop5 (#1332)
Change Details
## Description
mu_basecore from v2025020003.0.3 to v2025020003.0.4
mu_plus from v2025020003.0.1 to v2025020003.0.3
mu_tiano_plus from v2025020005.0.0 to v2025020006.0.0
mu_silicon_arm_tiano from v2025020002.0.0 to v2025020003.0.0
mu_feature_config from 6.0.3 to 6.0.4
mu_feature_debugger from 0.2.7 to 1.0.0
mu_feature_ffa from 0.1.2 to 0.1.3
mu_feature_mm_supv from 21.0.2 to 22.0.0- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
CI
Integration Instructions
No Integration necessary.
-
QemuQ35 Acceleration @Flickdm (#1319)
Change Details
## Description
This pull request introduces configuration changes to support QEMU acceleration mode (KVM) for the QemuQ35Pkg platform
Configuration Improvements:
- Set
PcdFirstTimeWakeUpAPsBySipitoFALSEinQemuQ35PkgCommon.dsc.incto ensure proper multi-core SMP initialization under Hyper-V nested virtualization (e.g., WSL2), addressing known issues with SIPI-only wakeup.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Validation OS
Integration Instructions
N/A
- Set
-
TF-A Patch for Locality Management @Raymond-MS (#1286)
Change Details
## Description
Added support for logical secure partitions in TF-A. Added a logical secure-partition to handle locality management. Initializes the locality states upon start-up. Added code to handle DRTM locality management when measuring to the TPM. Added support for sending DIRECT_REQ2 messages from TF-A. Added support for closing localities 2 and 3 as an SMC to TF-A.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Built QEMU SBSA with TPM enabled. Ran to shell successfully. Verified LSP is launched and locality states are updated in the TPM service.
Integration Instructions
N/A
-
Remove PEI modules in SBSA @kuqin12 (#1299)
Change Details
## Description
This change removes the PEI phase from SBSA platform.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
This was built locally a...
v11.0.2
What's Changed
-
.github: Use the GitHub app token to upload release assets @makubacki (#1295)
Change Details
## Description
Commit 75d168f did not update the upload step to use the app derived token.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
- Verified app permissions. Will test with release post-merge.
Integration Instructions
- N/A
Full Changelog: v11.0.1...v11.0.2
v11.0.1
What's Changed
-
Fix permissions for build-haf-tfa.yml @eeshanl (#1293)
Change Details
## Description
Fix permissions for build-haf-tfa.yml
Fixes an issue where the release assets would fail to upload.
HTTP 403: Resource not accessible by integration (https://uploads.github.com/repos/microsoft/mu_tiano_platforms/releases/261590859/assets?label=&name=haf-tfa-firmware-v11.0.0.zip)- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Tested on my fork by disabling Read and Write Permissions for Workflows on my fork. It was set to Read and Write by default. Changed to only Read permissions then performed the following test:
Tested the workflow on a test release to make sure it fails the upload step. Failing run: https://github.com/eeshanl/mu_tiano_platforms/actions/runs/20293867580/job/58283434736
Then tested again with this PR's commit by adding the Generate Token step to the yml and the test succeeded.
https://github.com/microsoft/mu_tiano_platforms/actions/runs/20312966615/job/58348972808Real test will be in main.
Integration Instructions
N/A
Full Changelog: v11.0.0...v11.0.1
v11.0.0
What's Changed
-
Move out HAF and TFA build to pipeline and consume the bins locally @eeshanl (#1227)
Change Details
## Description
For SBSA, move out HAF and TFA build to GitHub workflow and consume the bins locally.
Eliminates need for local developer to rely on HAF/TFA build steps via a newHAF_TFA_BUILDbuild flag set toFALSEby default.The GitHub Workflow on Release will run
stuart_buildwithHAF_TFA_BUILD=TRUEand publishes the Hafnium and TFA binaries for consumption as a part of the GitHub release. It will also publish a filefip_blob_manifest.jsonwhich is generated using the output of the fiptool from TFA against fip.bin. This is needed because the fiptool reports offsets that are necessary to patch up the fip.bin if we want to employ this method of building SBSA with HAF/TFA bins being pulled down from an extdep.The GitHub workflow runs the end-to-end build with
HAF_TFA_BUILD=TRUEonly on GitHub releases. We will not publish the binaries after building on arbitrary PR runs, but will still run stuart_build withHAF_TFA_BUILD=TRUE.
On github releases, the version number and sha for the extdep must also be updated for every release, as the contents of the binaries and the json manifest,fip_blob_manifest.jsonneeds to get updated also.Once this and #1229 are merged, a developer can build SBSA like they would normally, however the default behavior for building the Hafnium and TFA binaries will be to use the extdep through
stuart_update. Along with this, the Post-Build step will now patch the extdep binaries with the contents of the secure partitions that the local developer has built as a part ofstuart_build. For more advanced use cases, where the developer would need to modify the secure partition DTS files, or if the developer changes the .fd files to be larger than the size reported in thefip_blob_manifest.json, then the developer would have to useHAF_TFA_BUILD=TRUEin theirstuart_buildstep as an argument.After this PR is merged, we need to make a formal GitHub release so that the necessary binaries and artifacts can be published as a part of that release.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Tested on my fork by doing a release and making this pr and watching the pipeline build publish the bins to test13 release on my fork https://github.com/eeshanl/mu_tiano_platforms/releases/tag/test13_tag but skips the just the publish step on this pr.
pr pipeline run: https://github.com/microsoft/mu_tiano_platforms/actions/runs/17990944480/job/51180666584?pr=1227
release pipeline run: https://github.com/eeshanl/mu_tiano_platforms/actions/runs/18020305440/job/51275744986And then locally tested the ext_deps step by pointing to this release.
Integration Instructions
This PR must be merged first, then make a release. Then merge #1229 to enable ext_deps and set HAF_TFA_BUILD = FALSE
</blockquote> <hr> </details>
-
Fixing watchdog timer driver SBSA @kuqin12 (#1285)
Change Details
## Description
The current usage of WatchdogTimer (WDT) from MdeModulePkg in SBSA is incorrect.
This change moves to use the ARM specific version of WDT support.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
This was tested on QEMU SBSA and verified system will reset through the interrupt handler as expected.
Integration Instructions
N/A
</blockquote> <hr> </details>
-
Use PR eval for both 32bit and 64bit PEI @kuqin12 (#1271)
Change Details
## Description
This change resolves a concern around the dsc file being used for PR eval is always the x64 version.
The change was inherited from EDK2 OvmfPkg.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
The pipeline checks all pass.
Integration Instructions
N/A
-
Pick up new binaries of QEMU v10 @kuqin12 (#1270)
Change Details
## Description
This change picks up the new binary releases of QEMU v10.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Built QEMU Q35 firmware and booted to UEFI shell.
Integration Instructions
N/A
⚠️ Breaking Changes
-
Integrate breaking changes from basecore and supervisor repos @kuqin12 (#1282)
Change Details
## Description
This change integrates the latest breaking changes from basecore and supervisor repos.
Specifically, supervisor repo embraced the implementation from edk2 for MM communication protocol, as well as removed privileged instructions from BaseLib. Basecore has pairing changes to accommodate the supervisor update for MMI channel differentiation.
The platform changes adopted some changes from EDK2 with regards to
MemEncryptSevLiband build fixes in dsc and fdf.- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
This was tested on QEMU Q35 and booted to UEFI shell.
Integration Instructions
N/A
-
Fixing memory usage of QEMU SBSA @kuqin12 (#1268)
Change Details
## Description
This change fixed an issue where the memory available specified in QEMU Runner has to be fixed to 2GB.
With the integration of FF-A, the MM communication buffer exposed to STMM secure partition has to match what was subscribed in the partition manifest, in this case the PCD is set to match the value in the DTS.
In addition, the fix includes an update in mu_silicon_arm where the memory for MM communicate buffer is carved out from the system memory. Accordingly, the platform does not need to manipulate the system memory PCDs.
Lastly, the TF-A manifest needs to be updated to over-subscribe the memory available to the system.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
This change was tested locally and booted to both UEFI shell with 2GB memory and Windows Desktop with 8GB.
Integration Instructions
Update to latest mu_silicon_arm_tiano.
Full Changelog: v10.0.0...v11.0.0
v10.0.0
What's Changed
-
Update mainline to QEMU v10 for Windows environment @kuqin12 (#1269)
Change Details
## Description
QEMU for Linux environment has been updated through the container refresh in mu_devops.
As Chocolatey starts to host v10, this change updates the external dependency to v10 to bring parity to both environments.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Booted QEMU Q35 to UEFI shell.
Integration Instructions
N/A
-
Submodule Updates @Raymond-MS (#1244)
Change Details
## Description
Updated submodules to point to the latest release or main branches.
MU_BASECORE updated to v2025020002.0.3
https://github.com/microsoft/mu_basecore/releases/tag/v2025020002.0.3MU_TIANO updated to v2025020005.0.0
https://github.com/microsoft/mu_tiano_plus/releases/tag/v2025020005.0.0MU_SILICON_ARM_TIANO updated to v2025020002.0.0
https://github.com/microsoft/mu_silicon_arm_tiano/releases/tag/v2025020002.0.0FEATURE_FFA updated to v0.1.2
https://github.com/microsoft/mu_feature_ffa/releases/tag/v0.1.2MM_SUPV update to v19.0.2
https://github.com/microsoft/mu_feature_mm_supv/releases/tag/v19.0.2- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Built and ran using QEMU SBSA and Q35
Integration Instructions
N/A
-
Adding spin\_lock usage to ensure no time related MP issues @kuqin12 (#1258)
Change Details
## Description
Current code has used a global variable to store the next instruction after the system returned from its initial SMI.
This is not being guarded by any atomic locks, which could cause the system to hang if the other APs come to change that first.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
This change fixed the hanging issue on pipeline.
Integration Instructions
N/A
</blockquote> <hr> </details>
-
Onboarding 64bit PEI for Q35 platform @kuqin12 (#1243)
Change Details
## Description
This change adds support for (and default to) 64 bit PEI for QEMU Q35 platform.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
This change does not touch x86 platform. X64 platform is tested by booting to Windows desktop.
Integration Instructions
If you are using 64 bit PEI, no change needed, otherwise one needs to specify
-a IA32,X64.
-
Add key interrupt so that it will reset the console mode @kuqin12 (#1242)
Change Details
## Description
If QEMU is interrupted with
Ctrl + C, the QEMU will leave the odd console mode enabled.There used to be some logic handling the console mode restoration, but that did not work with key interrupt case.
This change is updated to fix that case.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Verified that QEMU interrupted by keyboard no longer has odd console mode after the change.
Integration Instructions
N/A
-
Update Submodules to latest tags (release tags) @apop5 (#1223)
Change Details
## Description
MU_BASECORE to v2025020002.0.0
MU_TIANO_PLUS to v2025020004.0.0
MU_FEATURE_CONFIG to v6.0.2
MU_FEATURE_DEBUGGER to v0.2.7
MU_FEATURE_MM_SUPV v19.0.0
MU_FEATURE_DFCI to v4.0.9
MU_PLUS to v2025020003.0.0
MU_OEM_SAMPLE to v2025020001.0.0
MU_SILICON_ARM_TIANO to v2025020001.0.0- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Local Build and Boot.
Integration Instructions
No integration necessary.
-
Adding MP management test application for SBSA @kuqin12 (#1218)
Change Details
## Description
The existing QEMU SBSA has certain issues in the TF-A side that would prevent the system to launch multiple cores with proper MP support. Specifically due to the following flow:
- The setup places BL1, BL2, BL31, STMM code, and UEFI variables in secure flash to emulate physical platform behavior.
- During POR, TFA BL1 powers on all cores but boots only the primary core. The secondary APs enter an idle loop, polling the mailbox command.
Note: The secondary APs execute in XIP mode from flash where BL1 resides. - Once the primary core transitions to STMM, the UEFI flash driver attempts to write to the flash device, using this logic
- This write operation switches the flash to program mode, which inadvertently wakes the secondary cores from WFE.
- Since the flash is no longer in read mode, the secondary cores encounter data abort faults when trying to fetch instructions.
This change in TFA patch will move the AP cores to be held in BL31 context. The wfi routine inside is created to prevent the BSP to be waken up too easily.
The rest of the change is to integrate the MP management driver and test to be run on CI pipeline.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
This was tested on QEMU SBSA and passed the test application.
Integration Instructions
N/A
</blockquote> <hr> </details>
-
Update all submodules to latest @makubacki (#1219)
Change Details
## Description
Major incoming changes:
-
Update to shared crypto v1.1.1
-
Set CLANGPDB X64 file alignment to 512 to support current goblin expectations
-
Allow up to 32 delayed dispatch entries in PEI
-
PiSmmIpl: Prevent freeing from uninitialized pointers
-
UefiCpuPkg/MpLib: Spinlock RestoreVolatileRegisters
-
XhciDxe: Fix USB reset issues
-
Various Arm FFA changes
-
UefiCPuPkg/PiSmmCpuDxeSmm: Safe handling of IDT register on SMM entry
-
Tpm2HelpLib addition
-
OnScreenKeyboardDriver: Add null check for SCT compliance
-
Add SEC support to BaseArm instance of AdvancedLoggerLib
-
OemPkg: MuUefiVersionLib - fix ClangDwarf compile
-
Adds support to query the TPM for supported hash algorithms
-
MM Supervisor version updated to "19"
-
MM Supervisor: BaseLibSysCall - support the GCC build family
-
MM Supervisor: CVE 2025-3770 integration
-
Impacts functionality?
-
Impacts security?
-
Breaking change?
-
Includes tests?
-
Includes documentation?
How This Was Tested
- Q35 build and boot to EFI shell
- SBSA build and boot to EFI shell
Integration Instructions
- N/A
-
-
Remove rust content from repo @apop5 (#1216)
Change Details
## Description
Remove building rust infs from Q35 and Sbsa.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
CI
Integration Instructions
No integration necessary.
-
Cleanup ArmPlatformLib usage for QEMU SBSA @kuqin12 (#1213)
Change Details
## Description
The current state of platform is using NULL instance of ArmPlatformLib for the SEC phase and the real QEMU SBSA instance for PEI phase. This will cause the incorrect hobs to be created and consumed by later components.
This change moves the h...
v9.1.1
What's Changed
-
Update to Q35/SBSA to 202502 Dev Branches. [Merge \& FF] @apop5 (#1142)
Change Details
## Description
Update submodules to 202502 dev branches.
mu_basecore to dev-v2025020000.0.6
mu_plus to dev-v2025020000.1.1
mu_oem_sample to dev-2025020000.0.0
mu_tiano_plus to dev-v2025020000.0.0mu_feature_config to v6.0.0
mu_feature_debugger to v0.2.4
mu_feature_dfci to v4.0.9
mu_feature_mm_supv to v17.0.0
mu_silicon_arm_tiano to dev-v2025020000.0.0TFA to v2.13.0-rc
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Local CI (Unit Tests, Build Tests, etc)
Booted Windows 11 Image for Q35
Booted Windows Image for Sbsa.Integration Instructions
No integration necessary.
Full Changelog: v9.1.0...v9.1.1
v9.1.0
What's Changed
-
Update QEMU in Linux environment to use v10 @kuqin12 (#1144)
Change Details
## Description
This change picks up the v10.0.0 version of QEMU for Linux environment, because we need a timer feature from this version to support hafnium.
Windows version is left out because Chocolatey is not updated to produce this version yet.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
This change is tested locally and booted to Windows.
Integration Instructions
N/A
-
[REBASE\&FF] Re-enable Rust CI @Javagedes (#1118)
Change Details
## Description
Closes #1113
Adds a new command line argument to all Build Files (
QemuQ35Pkg/PlatformBuild.py,QemuSbsaPkg/PlatformBuild.py,.pytool/CISettings.py),--rust, which adds therust-ciscope and adds in rust components to the platform.Additionally updates the CI system to add two new runners to test:
- Linux, Debug, QemuQ35Pkg + Rust
- Linux, Debug, QemuSbsaPkg + Rust
Finally, re-enables rust in all CI builds (
stuart_ci_build) by adding the--rustflag.- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
All Platforms continue to build and pass, both with rust and non-rust builds. rust CI is ran with
stuart_ci_buildwhen the--rustflag is added, including on CI RunnersIntegration Instructions
N/A
-
Enable LineParserTestApp Again @makubacki (#1120)
Change Details
## Description
Was broken for a while due to some earlier adv logger changes. Temporarily exempted to unblock Mu Plus updates in: 7970218
Issues fixed in:
microsoft/mu_plus@4ac6d20Enabled again here with that submodule update.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
- Run LineParserTestApp in EFI shell
Integration Instructions
- N/A
-
Cargo: Update dependencies @Javagedes (#1117)
Change Details
## Description
RustAdvancedLoggerDxe has a dependency on mu_uefi_boot_services, but microsoft/mu_rust_helpers#50 removed the crate from the repository. Following the integration instructions in the PR, we now pull in the crate from crates.io.
This re-enables the ability to build rust with
BLD_*_BUILD_RUST_CODE=TRUE- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Confirmed build with
BLD_*_BUILD_RUST_CODE=TRUEIntegration Instructions
<Describe how these changes should be integrated. Use N/A if nothing is required.>
</blockquote> <hr> </details>
-
Move default to dev branches and non-Rust build [Rebase \& FF] @makubacki (#1112)
Change Details
## Description
Moves to dev branches as the default to allow new features and code to be tested.
Move the Rust modules behind build flag to prevent Rust from being enabled by default.
This is to immediately simplify and update the build to latest. Further changes will be made to both changes.
- Enhance separation of the Rust build.
- Consider testing release branches in addition to the default use of dev branches in CI.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
- Build without specifying
BLD_*_BUILD_RUST_CODE=TRUE - Boot to EFI shell
Integration Instructions
Currently,
BLD_*_BUILD_RUST_CODE=TRUEmust be specified to build the modules that contain Rust code. Therust-ciscope will be added back when building Rust code is active in a future change.
-
devcontainer.json: Use Ubuntu 24.04 @makubacki (#1110)
Change Details
## Description
Updates the dev container to use the ubuntu-24-dev image.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
- Set up devcontainer locally in VS Code.
Integration Instructions
- N/A
-
Use hidparser crate from crates.io @makubacki (#1100)
Change Details
## Description
Swap the dependency out to the published crate since that will be the official release moving forward.
https://crates.io/crates/hidparser
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
- Local build and CI
Integration Instructions
- N/A
-
Fix memory leak and also detect failed memory allocation @vincent-j-zimmer (#1084)
Change Details
## Description
Fixes #632
This change is responsive to #632. It fixes a memory leak and also defends against a failed memory allocation.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Build test and boot to shell using QEMU
Integration Instructions
N/A
-
Updating Secure Boot Binaries to v1.1.3 @Flickdm (#1074)
Change Details
## Description
Updating to the latest secure boot binaries.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Booted to Windows on physical platform
Integration Instructions
N/A
-
Bugfix: Do not enable SERIAL\_PORT by default in SBSA @eeshanl (#1057)
Change Details
## Description
Bug fix for SERIAL_PORT being enabled by default in QemuRunner.py for SBSA.
On SBSA, the serial port should not be set by default, as it will prevent writing to stdout, making it hard to tell progress.- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Tested locally in mu_tiano_platforms
Integration Instructions
N/A
</blockquote> <hr> </details>
-
Enable Debugger By Default in Q35/SBSA @os-d (#1036)
Change Details
## Description
This PR turns mu_feature_debugger on by default in Q35/SBSA. It sets no initial breakpoint, but will break in on an exception. As part of this, QemuRunner defaults to having
SERIAL_PORT=50001if this is not overridden, so that on a regular boot of Q35 the debugger can easily be used. On SBSA, the serial port is not added by default, as it will prevent writing to stdout, making it hard to tell progress.An additional command line flag is added
BLD_*_DXE_DBG_BRKto control whether the initial breakpoint is set. PassingBLD_*_DXE_DBG_BRK=TRUEon the commandline will set an unlimited initial breakpoint on DxeCore entrance.The other caveat in SBSA is that with a single serial port, debugger polling is disabled, otherwise the debugger can eat user keystrokes at the shell.
Once supervised StMM support is added to mu_feature_debugger (microsoft/mu_feature_debugger#59), it will be added here with a corresponding flag to force breaking in to the MM debugger.
- Impacts function...
v9.0.0
What's Changed
⚠️ Breaking Changes
-
Drop S3 and Lock Box Support [Rebase \& FF] @makubacki (#1042)
Change Details
## Description
Contains the following changes:
QemuQ35Pkg: Drop S3 and Lock Box support
-
Drop SmmLockBox from build and flash image
This is a Traditional SMM module that cannot be dispached with
the Standalone MM model currently supported in QemuQ35Pkg. -
Drop PEI and DXE S3 and Lock Box related modules from the
QemuQ35Pkg build and flash image.gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3EnableisFALSEwhich
disables S3 support. Code is also currently not being written to
support S3 boot script replay and S3 is not tested. Modern physical
platforms rarely support S3 and S3 presents its own security
related concerns and maintenance overhead.Since S3 is not needed, the lock box code which is currently only
used to store the S3 boot script is not needed.As a consequence, the following S3, boot script, and lock box
related PEI and DXE modules are removed from QemuQ35Pkg:BootScriptExecutorDxeCpuS3DataDxeS3Resume2PeiS3SaveStateDxe
-
Drop S3 and lock box related library instances from QemuQ35Pkg
build.The following library instances also do not need to be build given
S3 is not supported and are removed from the QemuQ35Pkg build:MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.infMdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxDxeLib.infMdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxPeiLib.infMdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxSmmLib.infMdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxStandaloneMmLib.infQemuPkg/Library/LockBoxLib/LockBoxBaseLib.infQemuQ35Pkg/Library/QemuFwCfgS3Lib/PeiQemuFwCfgS3LibFwCfg.inf
QemuQ35Pkg: Remove S3 and Lock Box related code
Removes libraries and modules that support S3 and Lock Box since S3
is not supported by QemuQ35Pkg.QemuQ35Pkg/Sec: Drop S3 and Lock Box support
Always follow the non-S3 flow to decompress the main FV and load
the PEI core from it during SEC startup.QemuQ35Pkg/PlatformPei: Drop S3 and Lock Box support
Removes platform initialization logic for S3 and the lock box.
Notably, the number of MMRAM regions is reduced from two to one since
the first MMRAM range was previously a 4KB page used to hold S3
resume structures.The amount of ACPI NVS reservation is reduced substantially since
areas like the following do not need to be preserved for S3 resume:- CPU AP stack buffers
- Temp RAM stack and heap
- GUIDed section extraction handlers
- Reset vector initial page tables
The lock box storage buffer is also not allocated at all. Previously,
it was allocated as boot services data (not ACPI NVS) since S3 was
never enabled. In any case, that space is no longer allocated.Asserts are added in places through key control flow to alert a
developer if S3 is detected as enabled when it should not be.QemuQ35Pkg/AcpiPlatformDxe: Drop S3 and Lock Box support
Removes S3 boot script related code since S3 is no longer supported.
QemuQ35Pkg/SmmControl2Dxe: Drop S3 and Lock Box support
Removes S3 and boot script related code to focus the module on simply
installingTrigger()andClear()functionality for the SMM
Control protocol.QemuQ35Pkg/SmmAccess: Drop S3 and Lock Box support
Main change is to compensate for the single MMRAM range used now that
the S3 resume area is removed from MMRAM. A single range is now used
to cover all of TSEG.QemuQ35Pkg.fdf: Remove assignment of Lock Box PCDs
Removes the following PCDs since the lock box is no longer supported.
gQemuPkgTokenSpaceGuid.PcdOvmfLockBoxStorageBasegQemuPkgTokenSpaceGuid.PcdOvmfLockBoxStorageSize
QemuSbsaPkg: Use LockBoxLib null instance
The QemuPkg
LockBoxLibis being removed. Used the null instance here
for libraries (likePerformanceLib) that link against aLockBoxLib
instance.QemuPkg: Remove LockBoxLib
Not needed since S3 support is not used requiring the Lock Box.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
- Boot to EFI shell and perform cold and warm reset
- Verify Standalone MM drivers are dispatched and execute successfully
Integration Instructions
- N/A - Affects platform firmware operation
-
🚀 Features & ✨ Enhancements
-
Drop S3 and Lock Box Support [Rebase \& FF] @makubacki (#1042)
Change Details
## Description
Contains the following changes:
QemuQ35Pkg: Drop S3 and Lock Box support
-
Drop SmmLockBox from build and flash image
This is a Traditional SMM module that cannot be dispached with
the Standalone MM model currently supported in QemuQ35Pkg. -
Drop PEI and DXE S3 and Lock Box related modules from the
QemuQ35Pkg build and flash image.gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3EnableisFALSEwhich
disables S3 support. Code is also currently not being written to
support S3 boot script replay and S3 is not tested. Modern physical
platforms rarely support S3 and S3 presents its own security
related concerns and maintenance overhead.Since S3 is not needed, the lock box code which is currently only
used to store the S3 boot script is not needed.As a consequence, the following S3, boot script, and lock box
related PEI and DXE modules are removed from QemuQ35Pkg:BootScriptExecutorDxeCpuS3DataDxeS3Resume2PeiS3SaveStateDxe
-
Drop S3 and lock box related library instances from QemuQ35Pkg
build.The following library instances also do not need to be build given
S3 is not supported and are removed from the QemuQ35Pkg build:MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.infMdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxDxeLib.infMdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxPeiLib.infMdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxSmmLib.infMdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxStandaloneMmLib.infQemuPkg/Library/LockBoxLib/LockBoxBaseLib.infQemuQ35Pkg/Library/QemuFwCfgS3Lib/PeiQemuFwCfgS3LibFwCfg.inf
QemuQ35Pkg: Remove S3 and Lock Box related code
Removes libraries and modules that support S3 and Lock Box since S3
is not supported by QemuQ35Pkg.QemuQ35Pkg/Sec: Drop S3 and Lock Box support
Always follow the non-S3 flow to decompress the main FV and load
the PEI core from it during SEC startup.QemuQ35Pkg/PlatformPei: Drop S3 and Lock Box support
Removes platform initialization logic for S3 and the lock box.
Notably, the number of MMRAM regions is reduced from two to one since
the first MMRAM range was previously a 4KB page used to hold S3
resume structures.The amount of ACPI NVS reservation is reduced substantially since
areas like the following do not need to be preserved for S3 resume:- CPU AP stack buffers
- Temp RAM stack and heap
- GUIDed section extraction handlers
- Reset vector initial page tables
The lock box storage buffer is also not allocated at all. Previously,
it was allocated as boot services data (not ACPI NVS) since S3 was
never enabled. In any case, that space is no longer allocated.Asserts are added in places through key control flow to alert a
developer if S3 is detected as enabled when it should not be.QemuQ35Pkg/AcpiPlatformDxe: Drop S3 and Lock Box support
Removes S3 boot script related code since S3 is no longer supported.
QemuQ35Pkg/SmmControl2Dxe: Drop S3 and Lock Box support
Removes S3 and boot script related code to focus the module on simply
installingTrigger()andClear()functionality for the SMM
Control protocol.QemuQ35Pkg/SmmAccess: Drop S3 and Lock Box support
Main change is to compensate for the single MMRAM range used now that
the S3 resume area is removed from MMRAM. A single range is now used
to cover all of TSEG.QemuQ35Pkg.fdf: Remove assignment of Lock Box PCDs
Removes the following PCDs since the lock box is no longer supported.
gQemuPkgTokenSpaceGuid.PcdOvmfLockBoxStorageBasegQemuPkgTokenSpaceGuid.PcdOvmfLockBoxStorageSize
QemuSbsaPkg: Use LockBoxLib null instance
The QemuPkg
LockBoxLibis being removed. Used the null instance here
for libraries (likePerformanceLib) that link against aLockBoxLib
instance.QemuPkg: Remove LockBoxLib
Not needed since S3 support is not used requiring the Lock Box.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
- Boot to EFI shell and perform cold and warm reset
- Verify Standalone MM drivers are dispatched and execute successfully
Integration Instructions
- N/A - Affects platform firmware operation
-
Full Changelog: v8.0.1...v9.0.0
v8.0.1
What's Changed
-
QemuQ35Pkg.dsc: Apply XenHypercallLib to valid archs @makubacki (#1041)
Change Details
## Description
The XenHypercallLib instance in QemuQ35Pkg has the following LIBRARY_CLASS value in its [DEFINES] section:
[Defines.IA32, Defines.X64] LIBRARY_CLASS = XenHypercallLib|... [Defines.ARM, Defines.AARCH64] LIBRARY_CLASS = XenHypercallLibHowever, the library instance is specified in QemuQ35Pkg.dsc against the "Common" architecture as it is placed in the
[LibraryClasses]section.This raises the following warning during build:
INFO - QemuQ35Pkg.dsc(...): warning: Platforms\QemuQ35Pkg\Library\XenHypercallLib\XenHypercallLib.inf does not support LIBRARY_CLASS XenHypercallLibThis is printed from the
_ValidateLibraryClass()function inBaseTools/Source/Python/Workspace/DscBuildData.pybecause the library class is bound by architecture in the INF file so it does not support the "Common" architecture.This change maps the library instance to the XenHypercallLib class per the defined architectures (
IA32andX64) in QemuQ35Pkg.dsc.- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
QemuQ35Pkgbefore and after the change
Integration Instructions
- N/A
-
Update basecore and supervisor submodules @kuqin12 (#1025)
Change Details
## Description
Update mu_basecore to top of release/202405 and supervisor repo to pair up with the updated override tags.
For details on how to complete to complete these options and their meaning refer to CONTRIBUTING.md.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
Tested on QEMU Q35 and booted to shell.
Integration Instructions
N/A
-
Set workspace resolver to version 2 @antklein (#1024)
Change Details
## Description
Add an explicit set for resolver to use version 2. This is required for virtual workspaces as the rust edition cannot be inferred by the compiler.
For details on how to complete to complete these options and their meaning refer to CONTRIBUTING.md.
- Impacts functionality?
- Impacts security?
- Breaking change?
- Includes tests?
- Includes documentation?
How This Was Tested
I validated that cargo make build, test, and coverage did not change.
Integration Instructions
N/A
🛠️ Submodule Updates
-
Bump Common/MU\_TIANO from 2024050000.0.0 to 2024050000.0.1 @ProjectMuBot (#1033)
Change Details
Bumps Common/MU_TIANO from `2024050000.0.0` to `2024050000.0.1`
Introduces 8 new commits in Common/MU_TIANO.
Commits
- 60690b Revert "FmpDevicePkg: Assert on PcdFmpDeviceImageTypeIdGuid Size Mismatch"
- 8e813d [CHERRY-PICK] FmpDevicePkg: Assert on PcdFmpDeviceImageTypeIdGuid Size Mismatch
- d60d41 Revert "EmbeddedPkg: Mark DMA Memory Allocations XP By Default"
- 622dc7 [CHERRY-PICK] EmbeddedPkg: Mark DMA Memory Allocations XP By Default
- c454e6 Revert "PrmPkg: Don"t Set Access Attributes of Runtime MMIO Ranges (#51)"
- 432fdb [CHERRY-PICK] PrmPkg: Don"t Set Access Attributes of Runtime MMIO Ranges
- 67e042 [CHERRY-PICK] EmbeddedPkg: NonCoherentDmaLib: Set EFI_MEMORY_XP Capability on DMA Buffer
- ef21d6 pip: bump edk2-pytool-extensions from 0.27.11 to 0.27.12 (#329)
Signed-off-by: Project Mu Bot mubot@microsoft.com
-
Bump Features/CONFIG from 2.0.13 to 3.0.0 @ProjectMuBot (#1035)
Change Details
Bumps Features/CONFIG from `2.0.13` to `3.0.0`
Introduces 22 new commits in Features/CONFIG.
Commits
- fb0659 SetupDataPkg/ConfApp: Fix incorrect type used in a GUID print (#381)
- ab3555 pip: bump edk2-pytool-extensions from 0.27.9 to 0.27.10 (#382)
- 7eb698 Removing script that would create windows executable from a python file. (#380)
- 07d1b6 pip: bump pytest from 8.2.2 to 8.3.1 (#384)
- 84061c pip: bump pyopenssl from 24.1.0 to 24.2.1 (#383)
- 473977 pip: bump regex from 2024.5.15 to 2024.7.24 (#387)
- a9ead4 pip: bump xmlschema from 3.3.1 to 3.3.2 (#386)
- e6856b pip: bump pytest from 8.3.1 to 8.3.2 (#385)
- 2c08cd pip: bump edk2-pytool-library from 0.21.8 to 0.21.9 (#388)
- c4ffcc pip: bump flake8 from 7.1.0 to 7.1.1 (#391)
- 5552ed pip: bump antlr4-python3-runtime from 4.13.1 to 4.13.2 (#390)
- 377d98 Switch to use edk2-pytool-library UefiVariableSupportLib. (#362)
- bd44e7 pip: bump edk2-pytool-library from 0.21.9 to 0.21.10 (#389)
- 7d4a54 Repo File Sync: synced file(s) with microsoft/mu_devops (#392)
- f7a1e7 pip: bump edk2-pytool-extensions from 0.27.10 to 0.27.11 (