Skip to content

Releases: microsoft/mu_tiano_platforms

v12.0.1

13 Mar 23:37
e4fee38

Choose a tag to compare

What's Changed

  • Do not checkout Hafnium submodule recursively @kuqin12 (#1352)
    Change Details
      ## Description

    The current workflow will checkout the hafnium submodule recursively. This is not necessary unless a Hafnium build is explicitly requested.

    This change moves the pipeline to not checkout all the nested submodules of Hafnium repo and only hydrate them when the Hafnium build from source is needed.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    The pipeline builds properly.

    Integration Instructions

    N/A




Full Changelog: v12.0.0...v12.0.1

v12.0.0

13 Mar 01:55
0ef25ab

Choose a tag to compare

What's Changed

  • Submodule updates to align with latest releases. @Raymond-MS (#1350)
    Change Details
      ## Description

    Updated Features/FFA and MU_BASECORE submodules for their respective releases.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Built QemuSbsa Successfully.

    Integration Instructions

    N/A




  • [TPM]Platform Updates for RUST TPM Service @Raymond-MS (#1343)
    Change Details
      ## Description

    Removed code related to the C secure partition. Added the TPM service to the RUST secure partition. Updated the TF-A patch files to reflect the C secure partition removal.

    The TpmStartupLib was removed in the latest updates regarding 202511, added them back in.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Built QemuSbsa with TPM enabled. Verified TPM communication. Features/FFA, MU_BASECORE, and Silicon/Arm/MU_TIANO were at latest 202502 release branches.

    Integration Instructions

    N/A




  • QemuQ35,QemuSbsa: Update for 202511 @apop5 (#1329)
    Change Details
      ## Description Changes for 202511
    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Booting Q35, Sbsa to OS.

    Integration Instructions

    No integration necessary.




  • [TPM]Add Tpm2Startup Lib to QemuSbsa PeilessSec @Raymond-MS (#1344)
    Change Details
      ## Description

    Add Tpm2StartupLib to QemuSbsa platform .dsc. This should only be used in PeilessSec.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Built QEMU SBSA with TPM enabled, verified TPM communication.

    Integration Instructions

    N/A




  • QemuQ35Pkg: Increase QEMU extended TSEG to 32 MB @Flickdm (#1345)
    Change Details
      ## Description

    Add the -global mch.extended-tseg-mbytes=32 argument to the QEMU runner to increase the extended TSEG from the QEMU default of 16 MB to 32 MB. Update the PcdQ35TsegMbytes PCD comment to note the QEMU default extended TSEG size of 16 MB.

    REF: https://edk2.groups.io/g/devel/message/11505
    REF: https://lists.nongnu.org/archive/html/qemu-devel/2017-06/msg03902.html

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    During OneCrypto testing it was seen that with OneCrypto + existing conditions - this pushed TSEG usage to 16.3 MB causing TSEG memory exhaustion. Increasing the TSEG to 32Mb allows for the platform to boot.

    I will also investigate why we're pushing TSEG usage to 16.3 to determine if this is normal / expected or if there is something we should / can do to reduce the pressure.

    UPDATE:

    It appears that Openssl 3 performs a lot of small allocations during its initialization and when combined with Pool guard - this exhausts a 16Mb TSEG.

    Specifically this line enables pool guard :
    https://github.com/microsoft/mu_tiano_platforms/blob/54f18bd28fe16b41e51785af1aa9b51627f244a7/Platforms/QemuQ35Pkg/PlatformPei/Platform.c#L800

    With this disabled, the platform will be able to boot normally with 16Mb TSEG.

    Leaving it enabled for QemuQ35 is recommended - as it's useful for detecting memory bugs early before they reach physical platforms. Meaning that increasing the TSEG here is acceptable.

    This was tested in both DEBUG and RELEASE using the following commands (after building):

    DEBUG

    python Platforms/QemuQ35Pkg/PlatformBuild.py TOOL_CHAIN_TAG=GCC5 PATH_TO_OS=ValidationOS.qcow2 QEMU_ACCEL=kvm --FlashOnly

    RELEASE

    python Platforms/QemuQ35Pkg/PlatformBuild.py TOOL_CHAIN_TAG=GCC5 PATH_TO_OS=ValidationOS.qcow2 QEMU_ACCEL=kvm TARGET=RELEASE --FlashOnly

    Integration Instructions

    N/A




  • Rename `TEST_REGEX` to `FILE_REGEX` @Javagedes (#1338)
    Change Details
      ## Description

    This commit renames the TEST_REGEX command line option to FILE_REGEX and updates the logic so that files matching FILE_REGEX are always moved to the virtual drive; then if RUN_TESTS=TRUE we will treat those files as platform unit tests and will generate a startup nsh to automatically run the tests.

    This makes it easy for developers to move files onto the virtual drive automatically without necessarily treating those files as on-platform unit tests.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Platform CI

    Integration Instructions

    Users must update any automation that uses TEST_REGEX to now use FILE_REGEX

  • Update submodules to latest of 202502 branches. @apop5 (#1332)
    Change Details
      ## Description

    mu_basecore from v2025020003.0.3 to v2025020003.0.4
    mu_plus from v2025020003.0.1 to v2025020003.0.3
    mu_tiano_plus from v2025020005.0.0 to v2025020006.0.0
    mu_silicon_arm_tiano from v2025020002.0.0 to v2025020003.0.0
    mu_feature_config from 6.0.3 to 6.0.4
    mu_feature_debugger from 0.2.7 to 1.0.0
    mu_feature_ffa from 0.1.2 to 0.1.3
    mu_feature_mm_supv from 21.0.2 to 22.0.0

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    CI

    Integration Instructions

    No Integration necessary.




  • QemuQ35 Acceleration @Flickdm (#1319)
    Change Details
      ## Description

    This pull request introduces configuration changes to support QEMU acceleration mode (KVM) for the QemuQ35Pkg platform

    Configuration Improvements:

    • Set PcdFirstTimeWakeUpAPsBySipi to FALSE in QemuQ35PkgCommon.dsc.inc to ensure proper multi-core SMP initialization under Hyper-V nested virtualization (e.g., WSL2), addressing known issues with SIPI-only wakeup.

    REF: tianocore/edk2@1d76560

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Validation OS

    Integration Instructions

    N/A




  • TF-A Patch for Locality Management @Raymond-MS (#1286)
    Change Details
      ## Description

    Added support for logical secure partitions in TF-A. Added a logical secure-partition to handle locality management. Initializes the locality states upon start-up. Added code to handle DRTM locality management when measuring to the TPM. Added support for sending DIRECT_REQ2 messages from TF-A. Added support for closing localities 2 and 3 as an SMC to TF-A.

    For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Built QEMU SBSA with TPM enabled. Ran to shell successfully. Verified LSP is launched and locality states are updated in the TPM service.

    Integration Instructions

    N/A

  • Remove PEI modules in SBSA @kuqin12 (#1299)
    Change Details
      ## Description

    This change removes the PEI phase from SBSA platform.

    For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    This was built locally a...

Read more

v11.0.2

17 Dec 22:12
274ac78

Choose a tag to compare

What's Changed

  • .github: Use the GitHub app token to upload release assets @makubacki (#1295)
    Change Details
      ## Description

    Commit 75d168f did not update the upload step to use the app derived token.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • Verified app permissions. Will test with release post-merge.

    Integration Instructions

    • N/A


Full Changelog: v11.0.1...v11.0.2

v11.0.1

17 Dec 19:56
75d168f

Choose a tag to compare

What's Changed

  • Fix permissions for build-haf-tfa.yml @eeshanl (#1293)
    Change Details
      ## Description

    Fix permissions for build-haf-tfa.yml

    Fixes an issue where the release assets would fail to upload.

    HTTP 403: Resource not accessible by integration (https://uploads.github.com/repos/microsoft/mu_tiano_platforms/releases/261590859/assets?label=&name=haf-tfa-firmware-v11.0.0.zip)

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Tested on my fork by disabling Read and Write Permissions for Workflows on my fork. It was set to Read and Write by default. Changed to only Read permissions then performed the following test:

    Tested the workflow on a test release to make sure it fails the upload step. Failing run: https://github.com/eeshanl/mu_tiano_platforms/actions/runs/20293867580/job/58283434736

    Then tested again with this PR's commit by adding the Generate Token step to the yml and the test succeeded.
    https://github.com/microsoft/mu_tiano_platforms/actions/runs/20312966615/job/58348972808

    Real test will be in main.

    Integration Instructions

    N/A




Full Changelog: v11.0.0...v11.0.1

v11.0.0

17 Dec 00:39
dc87bca

Choose a tag to compare

What's Changed

  • Move out HAF and TFA build to pipeline and consume the bins locally @eeshanl (#1227)
    Change Details
      ## Description

    For SBSA, move out HAF and TFA build to GitHub workflow and consume the bins locally.
    Eliminates need for local developer to rely on HAF/TFA build steps via a new HAF_TFA_BUILD build flag set to FALSE by default.

    The GitHub Workflow on Release will run stuart_build with HAF_TFA_BUILD=TRUE and publishes the Hafnium and TFA binaries for consumption as a part of the GitHub release. It will also publish a file fip_blob_manifest.json which is generated using the output of the fiptool from TFA against fip.bin. This is needed because the fiptool reports offsets that are necessary to patch up the fip.bin if we want to employ this method of building SBSA with HAF/TFA bins being pulled down from an extdep.

    The GitHub workflow runs the end-to-end build with HAF_TFA_BUILD=TRUE only on GitHub releases. We will not publish the binaries after building on arbitrary PR runs, but will still run stuart_build with HAF_TFA_BUILD=TRUE.
    On github releases, the version number and sha for the extdep must also be updated for every release, as the contents of the binaries and the json manifest, fip_blob_manifest.json needs to get updated also.

    Once this and #1229 are merged, a developer can build SBSA like they would normally, however the default behavior for building the Hafnium and TFA binaries will be to use the extdep through stuart_update. Along with this, the Post-Build step will now patch the extdep binaries with the contents of the secure partitions that the local developer has built as a part of stuart_build. For more advanced use cases, where the developer would need to modify the secure partition DTS files, or if the developer changes the .fd files to be larger than the size reported in the fip_blob_manifest.json, then the developer would have to use HAF_TFA_BUILD=TRUE in their stuart_build step as an argument.

    After this PR is merged, we need to make a formal GitHub release so that the necessary binaries and artifacts can be published as a part of that release.

    For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Tested on my fork by doing a release and making this pr and watching the pipeline build publish the bins to test13 release on my fork https://github.com/eeshanl/mu_tiano_platforms/releases/tag/test13_tag but skips the just the publish step on this pr.

    pr pipeline run: https://github.com/microsoft/mu_tiano_platforms/actions/runs/17990944480/job/51180666584?pr=1227
    release pipeline run: https://github.com/eeshanl/mu_tiano_platforms/actions/runs/18020305440/job/51275744986

    And then locally tested the ext_deps step by pointing to this release.

    Integration Instructions

    This PR must be merged first, then make a release. Then merge #1229 to enable ext_deps and set HAF_TFA_BUILD = FALSE

      </blockquote>
      <hr>
    </details>
    
  • Fixing watchdog timer driver SBSA @kuqin12 (#1285)
    Change Details
      ## Description

    The current usage of WatchdogTimer (WDT) from MdeModulePkg in SBSA is incorrect.

    This change moves to use the ARM specific version of WDT support.

    For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    This was tested on QEMU SBSA and verified system will reset through the interrupt handler as expected.

    Integration Instructions

    N/A

      </blockquote>
      <hr>
    </details>
    
  • Use PR eval for both 32bit and 64bit PEI @kuqin12 (#1271)
    Change Details
      ## Description

    This change resolves a concern around the dsc file being used for PR eval is always the x64 version.

    The change was inherited from EDK2 OvmfPkg.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    The pipeline checks all pass.

    Integration Instructions

    N/A




  • Pick up new binaries of QEMU v10 @kuqin12 (#1270)
    Change Details
      ## Description

    This change picks up the new binary releases of QEMU v10.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Built QEMU Q35 firmware and booted to UEFI shell.

    Integration Instructions

    N/A




⚠️ Breaking Changes

  • Integrate breaking changes from basecore and supervisor repos @kuqin12 (#1282)
    Change Details
      ## Description

    This change integrates the latest breaking changes from basecore and supervisor repos.

    Specifically, supervisor repo embraced the implementation from edk2 for MM communication protocol, as well as removed privileged instructions from BaseLib. Basecore has pairing changes to accommodate the supervisor update for MMI channel differentiation.

    The platform changes adopted some changes from EDK2 with regards to MemEncryptSevLib and build fixes in dsc and fdf.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    This was tested on QEMU Q35 and booted to UEFI shell.

    Integration Instructions

    N/A




  • Fixing memory usage of QEMU SBSA @kuqin12 (#1268)
    Change Details
      ## Description

    This change fixed an issue where the memory available specified in QEMU Runner has to be fixed to 2GB.

    With the integration of FF-A, the MM communication buffer exposed to STMM secure partition has to match what was subscribed in the partition manifest, in this case the PCD is set to match the value in the DTS.

    In addition, the fix includes an update in mu_silicon_arm where the memory for MM communicate buffer is carved out from the system memory. Accordingly, the platform does not need to manipulate the system memory PCDs.

    Lastly, the TF-A manifest needs to be updated to over-subscribe the memory available to the system.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    This change was tested locally and booted to both UEFI shell with 2GB memory and Windows Desktop with 8GB.

    Integration Instructions

    Update to latest mu_silicon_arm_tiano.




Full Changelog: v10.0.0...v11.0.0

v10.0.0

11 Nov 22:54
35c0ad8

Choose a tag to compare

What's Changed

  • Update mainline to QEMU v10 for Windows environment @kuqin12 (#1269)
    Change Details
      ## Description

    QEMU for Linux environment has been updated through the container refresh in mu_devops.

    As Chocolatey starts to host v10, this change updates the external dependency to v10 to bring parity to both environments.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Booted QEMU Q35 to UEFI shell.

    Integration Instructions

    N/A




  • Adding spin\_lock usage to ensure no time related MP issues @kuqin12 (#1258)
    Change Details
      ## Description

    Current code has used a global variable to store the next instruction after the system returned from its initial SMI.

    This is not being guarded by any atomic locks, which could cause the system to hang if the other APs come to change that first.

    For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    This change fixed the hanging issue on pipeline.

    Integration Instructions

    N/A

      </blockquote>
      <hr>
    </details>
    
  • Onboarding 64bit PEI for Q35 platform @kuqin12 (#1243)
    Change Details
      ## Description

    This change adds support for (and default to) 64 bit PEI for QEMU Q35 platform.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    This change does not touch x86 platform. X64 platform is tested by booting to Windows desktop.

    Integration Instructions

    If you are using 64 bit PEI, no change needed, otherwise one needs to specify -a IA32,X64.




  • Add key interrupt so that it will reset the console mode @kuqin12 (#1242)
    Change Details
      ## Description

    If QEMU is interrupted with Ctrl + C, the QEMU will leave the odd console mode enabled.

    There used to be some logic handling the console mode restoration, but that did not work with key interrupt case.

    This change is updated to fix that case.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Verified that QEMU interrupted by keyboard no longer has odd console mode after the change.

    Integration Instructions

    N/A




  • Update Submodules to latest tags (release tags) @apop5 (#1223)
    Change Details
      ## Description

    MU_BASECORE to v2025020002.0.0
    MU_TIANO_PLUS to v2025020004.0.0
    MU_FEATURE_CONFIG to v6.0.2
    MU_FEATURE_DEBUGGER to v0.2.7
    MU_FEATURE_MM_SUPV v19.0.0
    MU_FEATURE_DFCI to v4.0.9
    MU_PLUS to v2025020003.0.0
    MU_OEM_SAMPLE to v2025020001.0.0
    MU_SILICON_ARM_TIANO to v2025020001.0.0

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Local Build and Boot.

    Integration Instructions

    No integration necessary.




  • Adding MP management test application for SBSA @kuqin12 (#1218)
    Change Details
      ## Description

    The existing QEMU SBSA has certain issues in the TF-A side that would prevent the system to launch multiple cores with proper MP support. Specifically due to the following flow:

    • The setup places BL1, BL2, BL31, STMM code, and UEFI variables in secure flash to emulate physical platform behavior.
    • During POR, TFA BL1 powers on all cores but boots only the primary core. The secondary APs enter an idle loop, polling the mailbox command.
      Note: The secondary APs execute in XIP mode from flash where BL1 resides.
    • Once the primary core transitions to STMM, the UEFI flash driver attempts to write to the flash device, using this logic
    • This write operation switches the flash to program mode, which inadvertently wakes the secondary cores from WFE.
    • Since the flash is no longer in read mode, the secondary cores encounter data abort faults when trying to fetch instructions.

    This change in TFA patch will move the AP cores to be held in BL31 context. The wfi routine inside is created to prevent the BSP to be waken up too easily.

    The rest of the change is to integrate the MP management driver and test to be run on CI pipeline.

    For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    This was tested on QEMU SBSA and passed the test application.

    Integration Instructions

    N/A

      </blockquote>
      <hr>
    </details>
    
  • Update all submodules to latest @makubacki (#1219)
    Change Details
      ## Description

    Major incoming changes:

    • Update to shared crypto v1.1.1

    • Set CLANGPDB X64 file alignment to 512 to support current goblin expectations

    • Allow up to 32 delayed dispatch entries in PEI

    • PiSmmIpl: Prevent freeing from uninitialized pointers

    • UefiCpuPkg/MpLib: Spinlock RestoreVolatileRegisters

    • XhciDxe: Fix USB reset issues

    • Various Arm FFA changes

    • UefiCPuPkg/PiSmmCpuDxeSmm: Safe handling of IDT register on SMM entry

    • Tpm2HelpLib addition

    • OnScreenKeyboardDriver: Add null check for SCT compliance

    • Add SEC support to BaseArm instance of AdvancedLoggerLib

    • OemPkg: MuUefiVersionLib - fix ClangDwarf compile

    • Adds support to query the TPM for supported hash algorithms

    • MM Supervisor version updated to "19"

    • MM Supervisor: BaseLibSysCall - support the GCC build family

    • MM Supervisor: CVE 2025-3770 integration

    • Impacts functionality?

    • Impacts security?

    • Breaking change?

    • Includes tests?

    • Includes documentation?

    How This Was Tested

    • Q35 build and boot to EFI shell
    • SBSA build and boot to EFI shell

    Integration Instructions

    • N/A


  • Remove rust content from repo @apop5 (#1216)
    Change Details
      ## Description

    Remove building rust infs from Q35 and Sbsa.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    CI

    Integration Instructions

    No integration necessary.




  • Cleanup ArmPlatformLib usage for QEMU SBSA @kuqin12 (#1213)
    Change Details
      ## Description

    The current state of platform is using NULL instance of ArmPlatformLib for the SEC phase and the real QEMU SBSA instance for PEI phase. This will cause the incorrect hobs to be created and consumed by later components.

    This change moves the h...

Read more

v9.1.1

06 Jun 22:03

Choose a tag to compare

What's Changed

  • Update to Q35/SBSA to 202502 Dev Branches. [Merge \& FF] @apop5 (#1142)
    Change Details
      ## Description

    Update submodules to 202502 dev branches.
    mu_basecore to dev-v2025020000.0.6
    mu_plus to dev-v2025020000.1.1
    mu_oem_sample to dev-2025020000.0.0
    mu_tiano_plus to dev-v2025020000.0.0

    mu_feature_config to v6.0.0
    mu_feature_debugger to v0.2.4
    mu_feature_dfci to v4.0.9
    mu_feature_mm_supv to v17.0.0
    mu_silicon_arm_tiano to dev-v2025020000.0.0

    TFA to v2.13.0-rc

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Local CI (Unit Tests, Build Tests, etc)
    Booted Windows 11 Image for Q35
    Booted Windows Image for Sbsa.

    Integration Instructions

    No integration necessary.




Full Changelog: v9.1.0...v9.1.1

v9.1.0

06 Jun 20:35
fb306a2

Choose a tag to compare

What's Changed

  • Update QEMU in Linux environment to use v10 @kuqin12 (#1144)
    Change Details
      ## Description

    This change picks up the v10.0.0 version of QEMU for Linux environment, because we need a timer feature from this version to support hafnium.

    Windows version is left out because Chocolatey is not updated to produce this version yet.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    This change is tested locally and booted to Windows.

    Integration Instructions

    N/A




  • [REBASE\&FF] Re-enable Rust CI @Javagedes (#1118)
    Change Details
      ## Description

    Closes #1113

    Adds a new command line argument to all Build Files (QemuQ35Pkg/PlatformBuild.py, QemuSbsaPkg/PlatformBuild.py, .pytool/CISettings.py), --rust, which adds the rust-ci scope and adds in rust components to the platform.

    Additionally updates the CI system to add two new runners to test:

    • Linux, Debug, QemuQ35Pkg + Rust
    • Linux, Debug, QemuSbsaPkg + Rust

    Finally, re-enables rust in all CI builds (stuart_ci_build) by adding the --rust flag.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    All Platforms continue to build and pass, both with rust and non-rust builds. rust CI is ran with stuart_ci_build when the --rust flag is added, including on CI Runners

    Integration Instructions

    N/A




  • Enable LineParserTestApp Again @makubacki (#1120)
    Change Details
      ## Description

    Was broken for a while due to some earlier adv logger changes. Temporarily exempted to unblock Mu Plus updates in: 7970218

    Issues fixed in:
    microsoft/mu_plus@4ac6d20

    Enabled again here with that submodule update.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • Run LineParserTestApp in EFI shell

    Integration Instructions

    • N/A


  • Cargo: Update dependencies @Javagedes (#1117)
    Change Details
      ## Description

    RustAdvancedLoggerDxe has a dependency on mu_uefi_boot_services, but microsoft/mu_rust_helpers#50 removed the crate from the repository. Following the integration instructions in the PR, we now pull in the crate from crates.io.

    This re-enables the ability to build rust with BLD_*_BUILD_RUST_CODE=TRUE

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Confirmed build with BLD_*_BUILD_RUST_CODE=TRUE

    Integration Instructions

    <Describe how these changes should be integrated. Use N/A if nothing is required.>

      </blockquote>
      <hr>
    </details>
    
  • Move default to dev branches and non-Rust build [Rebase \& FF] @makubacki (#1112)
    Change Details
      ## Description

    Moves to dev branches as the default to allow new features and code to be tested.

    Move the Rust modules behind build flag to prevent Rust from being enabled by default.

    This is to immediately simplify and update the build to latest. Further changes will be made to both changes.

    1. Enhance separation of the Rust build.
    2. Consider testing release branches in addition to the default use of dev branches in CI.
    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • Build without specifying BLD_*_BUILD_RUST_CODE=TRUE
    • Boot to EFI shell

    Integration Instructions

    Currently, BLD_*_BUILD_RUST_CODE=TRUE must be specified to build the modules that contain Rust code. The rust-ci scope will be added back when building Rust code is active in a future change.




  • devcontainer.json: Use Ubuntu 24.04 @makubacki (#1110)
    Change Details
      ## Description

    Updates the dev container to use the ubuntu-24-dev image.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • Set up devcontainer locally in VS Code.

    Integration Instructions

    • N/A


  • Use hidparser crate from crates.io @makubacki (#1100)
    Change Details
      ## Description

    Swap the dependency out to the published crate since that will be the official release moving forward.

    https://crates.io/crates/hidparser

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • Local build and CI

    Integration Instructions

    • N/A


  • Fix memory leak and also detect failed memory allocation @vincent-j-zimmer (#1084)
    Change Details
      ## Description

    Fixes #632

    This change is responsive to #632. It fixes a memory leak and also defends against a failed memory allocation.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Build test and boot to shell using QEMU

    Integration Instructions

    N/A




  • Updating Secure Boot Binaries to v1.1.3 @Flickdm (#1074)
    Change Details
      ## Description

    Updating to the latest secure boot binaries.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Booted to Windows on physical platform

    Integration Instructions

    N/A




  • Bugfix: Do not enable SERIAL\_PORT by default in SBSA @eeshanl (#1057)
    Change Details
      ## Description

    Bug fix for SERIAL_PORT being enabled by default in QemuRunner.py for SBSA.
    On SBSA, the serial port should not be set by default, as it will prevent writing to stdout, making it hard to tell progress.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Tested locally in mu_tiano_platforms

    Integration Instructions

    N/A

      </blockquote>
      <hr>
    </details>
    
  • Enable Debugger By Default in Q35/SBSA @os-d (#1036)
    Change Details
      ## Description

    This PR turns mu_feature_debugger on by default in Q35/SBSA. It sets no initial breakpoint, but will break in on an exception. As part of this, QemuRunner defaults to having SERIAL_PORT=50001 if this is not overridden, so that on a regular boot of Q35 the debugger can easily be used. On SBSA, the serial port is not added by default, as it will prevent writing to stdout, making it hard to tell progress.

    An additional command line flag is added BLD_*_DXE_DBG_BRK to control whether the initial breakpoint is set. Passing BLD_*_DXE_DBG_BRK=TRUE on the commandline will set an unlimited initial breakpoint on DxeCore entrance.

    The other caveat in SBSA is that with a single serial port, debugger polling is disabled, otherwise the debugger can eat user keystrokes at the shell.

    Once supervised StMM support is added to mu_feature_debugger (microsoft/mu_feature_debugger#59), it will be added here with a corresponding flag to force breaking in to the MM debugger.

    • Impacts function...
Read more

v9.0.0

24 Sep 17:03

Choose a tag to compare

What's Changed

⚠️ Breaking Changes

  • Drop S3 and Lock Box Support [Rebase \& FF] @makubacki (#1042)
    Change Details
      ## Description

    Contains the following changes:

    QemuQ35Pkg: Drop S3 and Lock Box support

    1. Drop SmmLockBox from build and flash image

      This is a Traditional SMM module that cannot be dispached with
      the Standalone MM model currently supported in QemuQ35Pkg.

    2. Drop PEI and DXE S3 and Lock Box related modules from the
      QemuQ35Pkg build and flash image.

      gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3Enable is FALSE which
      disables S3 support. Code is also currently not being written to
      support S3 boot script replay and S3 is not tested. Modern physical
      platforms rarely support S3 and S3 presents its own security
      related concerns and maintenance overhead.

      Since S3 is not needed, the lock box code which is currently only
      used to store the S3 boot script is not needed.

      As a consequence, the following S3, boot script, and lock box
      related PEI and DXE modules are removed from QemuQ35Pkg:

      • BootScriptExecutorDxe
      • CpuS3DataDxe
      • S3Resume2Pei
      • S3SaveStateDxe
    3. Drop S3 and lock box related library instances from QemuQ35Pkg
      build.

      The following library instances also do not need to be build given
      S3 is not supported and are removed from the QemuQ35Pkg build:

      • MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf
      • MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxDxeLib.inf
      • MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxPeiLib.inf
      • MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxSmmLib.inf
      • MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxStandaloneMmLib.inf
      • QemuPkg/Library/LockBoxLib/LockBoxBaseLib.inf
      • QemuQ35Pkg/Library/QemuFwCfgS3Lib/PeiQemuFwCfgS3LibFwCfg.inf

    QemuQ35Pkg: Remove S3 and Lock Box related code

    Removes libraries and modules that support S3 and Lock Box since S3
    is not supported by QemuQ35Pkg.

    QemuQ35Pkg/Sec: Drop S3 and Lock Box support

    Always follow the non-S3 flow to decompress the main FV and load
    the PEI core from it during SEC startup.

    QemuQ35Pkg/PlatformPei: Drop S3 and Lock Box support

    Removes platform initialization logic for S3 and the lock box.

    Notably, the number of MMRAM regions is reduced from two to one since
    the first MMRAM range was previously a 4KB page used to hold S3
    resume structures.

    The amount of ACPI NVS reservation is reduced substantially since
    areas like the following do not need to be preserved for S3 resume:

    • CPU AP stack buffers
    • Temp RAM stack and heap
    • GUIDed section extraction handlers
    • Reset vector initial page tables

    The lock box storage buffer is also not allocated at all. Previously,
    it was allocated as boot services data (not ACPI NVS) since S3 was
    never enabled. In any case, that space is no longer allocated.

    Asserts are added in places through key control flow to alert a
    developer if S3 is detected as enabled when it should not be.

    QemuQ35Pkg/AcpiPlatformDxe: Drop S3 and Lock Box support

    Removes S3 boot script related code since S3 is no longer supported.

    QemuQ35Pkg/SmmControl2Dxe: Drop S3 and Lock Box support

    Removes S3 and boot script related code to focus the module on simply
    installing Trigger() and Clear() functionality for the SMM
    Control protocol.

    QemuQ35Pkg/SmmAccess: Drop S3 and Lock Box support

    Main change is to compensate for the single MMRAM range used now that
    the S3 resume area is removed from MMRAM. A single range is now used
    to cover all of TSEG.

    QemuQ35Pkg.fdf: Remove assignment of Lock Box PCDs

    Removes the following PCDs since the lock box is no longer supported.

    • gQemuPkgTokenSpaceGuid.PcdOvmfLockBoxStorageBase
    • gQemuPkgTokenSpaceGuid.PcdOvmfLockBoxStorageSize

    QemuSbsaPkg: Use LockBoxLib null instance

    The QemuPkg LockBoxLib is being removed. Used the null instance here
    for libraries (like PerformanceLib) that link against a LockBoxLib
    instance.

    QemuPkg: Remove LockBoxLib

    Not needed since S3 support is not used requiring the Lock Box.


    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • Boot to EFI shell and perform cold and warm reset
    • Verify Standalone MM drivers are dispatched and execute successfully

    Integration Instructions

    • N/A - Affects platform firmware operation


🚀 Features & ✨ Enhancements

  • Drop S3 and Lock Box Support [Rebase \& FF] @makubacki (#1042)
    Change Details
      ## Description

    Contains the following changes:

    QemuQ35Pkg: Drop S3 and Lock Box support

    1. Drop SmmLockBox from build and flash image

      This is a Traditional SMM module that cannot be dispached with
      the Standalone MM model currently supported in QemuQ35Pkg.

    2. Drop PEI and DXE S3 and Lock Box related modules from the
      QemuQ35Pkg build and flash image.

      gEfiMdeModulePkgTokenSpaceGuid.PcdAcpiS3Enable is FALSE which
      disables S3 support. Code is also currently not being written to
      support S3 boot script replay and S3 is not tested. Modern physical
      platforms rarely support S3 and S3 presents its own security
      related concerns and maintenance overhead.

      Since S3 is not needed, the lock box code which is currently only
      used to store the S3 boot script is not needed.

      As a consequence, the following S3, boot script, and lock box
      related PEI and DXE modules are removed from QemuQ35Pkg:

      • BootScriptExecutorDxe
      • CpuS3DataDxe
      • S3Resume2Pei
      • S3SaveStateDxe
    3. Drop S3 and lock box related library instances from QemuQ35Pkg
      build.

      The following library instances also do not need to be build given
      S3 is not supported and are removed from the QemuQ35Pkg build:

      • MdeModulePkg/Library/PiDxeS3BootScriptLib/DxeS3BootScriptLib.inf
      • MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxDxeLib.inf
      • MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxPeiLib.inf
      • MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxSmmLib.inf
      • MdeModulePkg/Library/SmmLockBoxLib/SmmLockBoxStandaloneMmLib.inf
      • QemuPkg/Library/LockBoxLib/LockBoxBaseLib.inf
      • QemuQ35Pkg/Library/QemuFwCfgS3Lib/PeiQemuFwCfgS3LibFwCfg.inf

    QemuQ35Pkg: Remove S3 and Lock Box related code

    Removes libraries and modules that support S3 and Lock Box since S3
    is not supported by QemuQ35Pkg.

    QemuQ35Pkg/Sec: Drop S3 and Lock Box support

    Always follow the non-S3 flow to decompress the main FV and load
    the PEI core from it during SEC startup.

    QemuQ35Pkg/PlatformPei: Drop S3 and Lock Box support

    Removes platform initialization logic for S3 and the lock box.

    Notably, the number of MMRAM regions is reduced from two to one since
    the first MMRAM range was previously a 4KB page used to hold S3
    resume structures.

    The amount of ACPI NVS reservation is reduced substantially since
    areas like the following do not need to be preserved for S3 resume:

    • CPU AP stack buffers
    • Temp RAM stack and heap
    • GUIDed section extraction handlers
    • Reset vector initial page tables

    The lock box storage buffer is also not allocated at all. Previously,
    it was allocated as boot services data (not ACPI NVS) since S3 was
    never enabled. In any case, that space is no longer allocated.

    Asserts are added in places through key control flow to alert a
    developer if S3 is detected as enabled when it should not be.

    QemuQ35Pkg/AcpiPlatformDxe: Drop S3 and Lock Box support

    Removes S3 boot script related code since S3 is no longer supported.

    QemuQ35Pkg/SmmControl2Dxe: Drop S3 and Lock Box support

    Removes S3 and boot script related code to focus the module on simply
    installing Trigger() and Clear() functionality for the SMM
    Control protocol.

    QemuQ35Pkg/SmmAccess: Drop S3 and Lock Box support

    Main change is to compensate for the single MMRAM range used now that
    the S3 resume area is removed from MMRAM. A single range is now used
    to cover all of TSEG.

    QemuQ35Pkg.fdf: Remove assignment of Lock Box PCDs

    Removes the following PCDs since the lock box is no longer supported.

    • gQemuPkgTokenSpaceGuid.PcdOvmfLockBoxStorageBase
    • gQemuPkgTokenSpaceGuid.PcdOvmfLockBoxStorageSize

    QemuSbsaPkg: Use LockBoxLib null instance

    The QemuPkg LockBoxLib is being removed. Used the null instance here
    for libraries (like PerformanceLib) that link against a LockBoxLib
    instance.

    QemuPkg: Remove LockBoxLib

    Not needed since S3 support is not used requiring the Lock Box.


    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • Boot to EFI shell and perform cold and warm reset
    • Verify Standalone MM drivers are dispatched and execute successfully

    Integration Instructions

    • N/A - Affects platform firmware operation


Full Changelog: v8.0.1...v9.0.0

v8.0.1

24 Sep 14:01
ed05914

Choose a tag to compare

What's Changed

  • QemuQ35Pkg.dsc: Apply XenHypercallLib to valid archs @makubacki (#1041)
    Change Details
      ## Description

    The XenHypercallLib instance in QemuQ35Pkg has the following LIBRARY_CLASS value in its [DEFINES] section:

      [Defines.IA32, Defines.X64]
        LIBRARY_CLASS                  = XenHypercallLib|...
    
      [Defines.ARM, Defines.AARCH64]
        LIBRARY_CLASS                  = XenHypercallLib
    

    However, the library instance is specified in QemuQ35Pkg.dsc against the "Common" architecture as it is placed in the [LibraryClasses] section.

    This raises the following warning during build:

      INFO - QemuQ35Pkg.dsc(...): warning:
        Platforms\QemuQ35Pkg\Library\XenHypercallLib\XenHypercallLib.inf
        does not support LIBRARY_CLASS XenHypercallLib
    

    This is printed from the _ValidateLibraryClass() function in BaseTools/Source/Python/Workspace/DscBuildData.py because the library class is bound by architecture in the INF file so it does not support the "Common" architecture.

    This change maps the library instance to the XenHypercallLib class per the defined architectures (IA32 and X64) in QemuQ35Pkg.dsc.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    • QemuQ35Pkg before and after the change

    Integration Instructions

    • N/A


  • Update basecore and supervisor submodules @kuqin12 (#1025)
    Change Details
      ## Description

    Update mu_basecore to top of release/202405 and supervisor repo to pair up with the updated override tags.

    For details on how to complete to complete these options and their meaning refer to CONTRIBUTING.md.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    Tested on QEMU Q35 and booted to shell.

    Integration Instructions

    N/A




  • Set workspace resolver to version 2 @antklein (#1024)
    Change Details
      ## Description

    Add an explicit set for resolver to use version 2. This is required for virtual workspaces as the rust edition cannot be inferred by the compiler.

    For details on how to complete to complete these options and their meaning refer to CONTRIBUTING.md.

    • Impacts functionality?
    • Impacts security?
    • Breaking change?
    • Includes tests?
    • Includes documentation?

    How This Was Tested

    I validated that cargo make build, test, and coverage did not change.

    Integration Instructions

    N/A




🛠️ Submodule Updates

  • Bump Common/MU\_TIANO from 2024050000.0.0 to 2024050000.0.1 @ProjectMuBot (#1033)
    Change Details
      Bumps Common/MU_TIANO from `2024050000.0.0` to `2024050000.0.1`

    Introduces 8 new commits in Common/MU_TIANO.

    Commits
    • 60690b Revert "FmpDevicePkg: Assert on PcdFmpDeviceImageTypeIdGuid Size Mismatch"
    • 8e813d [CHERRY-PICK] FmpDevicePkg: Assert on PcdFmpDeviceImageTypeIdGuid Size Mismatch
    • d60d41 Revert "EmbeddedPkg: Mark DMA Memory Allocations XP By Default"
    • 622dc7 [CHERRY-PICK] EmbeddedPkg: Mark DMA Memory Allocations XP By Default
    • c454e6 Revert "PrmPkg: Don"t Set Access Attributes of Runtime MMIO Ranges (#51)"
    • 432fdb [CHERRY-PICK] PrmPkg: Don"t Set Access Attributes of Runtime MMIO Ranges
    • 67e042 [CHERRY-PICK] EmbeddedPkg: NonCoherentDmaLib: Set EFI_MEMORY_XP Capability on DMA Buffer
    • ef21d6 pip: bump edk2-pytool-extensions from 0.27.11 to 0.27.12 (#329)

    Signed-off-by: Project Mu Bot mubot@microsoft.com




  • Bump Features/CONFIG from 2.0.13 to 3.0.0 @ProjectMuBot (#1035)
    Change Details
      Bumps Features/CONFIG from `2.0.13` to `3.0.0`

    Introduces 22 new commits in Features/CONFIG.

    Commits
    • fb0659 SetupDataPkg/ConfApp: Fix incorrect type used in a GUID print (#381)
    • ab3555 pip: bump edk2-pytool-extensions from 0.27.9 to 0.27.10 (#382)
    • 7eb698 Removing script that would create windows executable from a python file. (#380)
    • 07d1b6 pip: bump pytest from 8.2.2 to 8.3.1 (#384)
    • 84061c pip: bump pyopenssl from 24.1.0 to 24.2.1 (#383)
    • 473977 pip: bump regex from 2024.5.15 to 2024.7.24 (#387)
    • a9ead4 pip: bump xmlschema from 3.3.1 to 3.3.2 (#386)
    • e6856b pip: bump pytest from 8.3.1 to 8.3.2 (#385)
    • 2c08cd pip: bump edk2-pytool-library from 0.21.8 to 0.21.9 (#388)
    • c4ffcc pip: bump flake8 from 7.1.0 to 7.1.1 (#391)
    • 5552ed pip: bump antlr4-python3-runtime from 4.13.1 to 4.13.2 (#390)
    • 377d98 Switch to use edk2-pytool-library UefiVariableSupportLib. (#362)
    • bd44e7 pip: bump edk2-pytool-library from 0.21.9 to 0.21.10 (#389)
    • 7d4a54 Repo File Sync: synced file(s) with microsoft/mu_devops (#392)
    • f7a1e7 pip: bump edk2-pytool-extensions from 0.27.10 to 0.27.11 (
Read more