microsoft/mu_basecore v2025110001.0.6

v2025110001.0.6

Repository: microsoft/mu_basecore

Tag: v2025110001.0.6

Published: 2026-05-06T20:05:37Z

Prerelease: no

Release notes:

What's Changed

[CHERRY-PICK] Adding TPM over FFA ACPI table revision fix @kuqin12 (#1786)

Change Details

Description

This change updates the TPM2 table when using TPM over FFA to support the functionality.

For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

• [x] Impacts functionality?
• [ ] Impacts security?
• [x] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

This was tested on the latest Windows OS and booted to desktop with expected event log entries.

Integration Instructions

• To use this revision, the platforms have to update the table revision to 5 through gEfiSecurityPkgTokenSpaceGuid.PcdTpm2AcpiTableRev|5.
• The Windows OS has to be updated to the latest to support this new revision. Otherwise, the event logs will not be recorded.

[REBASE \& FF] Support IORT revision 6 @kuqin12 (#1707)

Change Details

Description

This change reverts the original Project MU changes as the edk2 upstreaming efforts are complete.

For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

• [x] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

This is being tested on physical hardware.

Integration Instructions

N/A

[CHERRY-PICK] SecurityPkg: AuthVariableLib: Handle empty signature lists @kuqin12 (#1785)

Change Details

Description

The current implementation fails to set authenticated variables when the signature list is empty. This can legitimately occur for dbx when no signatures are revoked after a certificate rotation.

Update the logic to explicitly handle empty signature lists, avoiding an implicit dependency on the variable being absent from variable storage.

(cherry picked from commit b980aa07196a5534581b16563cd78cfc67a74074)

• [x] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

This was tested on physical ARM64 platforms and booted to OS desktop and can set empty siglist variable from powershell.

Integration Instructions

N/A

[CHERRY-PICK] [REBASE \& FF] Revert MU\_CHANGE in Favor of edk2 Commits @os-d (#1784)

Change Details

Description

This reverts a MU_CHANGE and pulls in the two relevant edk2 commits replacing it.

• [x] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

N/A.

Integration Instructions

N/A.

CryptoPkg: Correct MockBaseCryptLib interface @PaddyDeng-v (#1777)

Change Details

Description

MU_BASECORE has a override (TCBZ3925) in BaseCryptLib.h. So the mock library should align to the change in override.

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

Enable the current disabled Host Unit Test for CryptoPkg (https://github.com/PaddyDeng-v/mu_basecore/commit/c24c879178379c4ff1ebc722b877d15edd499571). Make sure MockBaseCryptLib is built and the CI build process passed.

Integration Instructions

N/A

TlsLib Unit Tests @Flickdm (#1747)

Change Details

Included in: MU_CRYPTO_RELEASE Milestone 1

Description

Add unit tests for the TlsLib library class. The test suite validates TLS functionality through the TlsLib API surface. Today there are no unit tests.

The goal with this is to catch regressions as we move through faster crypto changes. Importantly this prints which TLS algorithms are being used to catch regressions against DFCI or other features.

What's included

50 test cases across 6 test suites, with both host-based and UEFI Shell entry points:

| Suite | Tests | Coverage | |-------|-------|----------| | Function pointer validation | 3 | TlsInitialize, TlsCtxNew, TlsNew | | Context lifecycle | 4 | Create/free, client/server endpoint, version setting | | Cipher suite enumeration | 8 | 14 TLS 1.2 ciphers, DFCI required ciphers (hard-fail), EC curves, TLS 1.3, PQC hybrid groups | | Configuration | 13 | Verify mode, hostname verification, SNI, session ID, signature algorithms, compression, security level, shutdown, handshake state | | Certificate management | 10 | CA cert set/get, host cert, private key, CRL | | Getter/query functions | 12 | Version, connection end, cipher, compression, verify, session ID, client/server random, key material |

Key features

• DFCI/Intune cipher validation: Hard-fails if any of the 4 required ECDHE-RSA cipher suites are missing, catching regressions that would break Surface firmware cloud connectivity
• Structured capability reports: Outputs machine-parseable SUPPORTED/UNSUPPORTED status for all probed algorithms, suitable for CI action consumption
• PQC readiness probing: Documents ML-KEM hybrid key exchange group support status (X25519MLKEM768, SecP256r1MLKEM768, SecP384r1MLKEM1024)
• Firmware policy assertions: Validates that server mode returns EFI_UNSUPPORTED (client-only policy) and TLS compression is disabled (CRIME attack mitigation)

Code coverage

| File | Line Coverage | |------|-------------| | TlsConfig.c | 74.3% | | TlsInit.c | 72.6% | | TlsProcess.c | 8.2% (handshake/IO functions need loopback test) | | Overall | ~61% |

For details on how to complete these options and their meaning refer to CONTRIBUTING.md.

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [X] Includes tests?
• [ ] Includes documentation?

How This Was Tested

This will be added as a automation for MU_CRYPTO_RELEASE on changes to the OpensslPkg and TlsLib

Integration Instructions

N/A

MdeModulePkg/NvmExpressDxe: Add NVMe namespace filtering PCD @eeshanl (#1754)

Change Details

Description

Add PcdNvmeNamespaceFilterId to control NVMe namespace enumeration. When != 0, only the specified NSID is discovered and enumerated. When 0 (default), all namespaces are enumerated as before.

This improves...