microsoft/mu_basecore v2025110001.0.4

v2025110001.0.4

Repository: microsoft/mu_basecore

Tag: v2025110001.0.4

Published: 2026-04-23T20:04:22Z

Prerelease: no

Release notes:

What's Changed

[CHERRY-PICK] MdeModulePkg: Don't Allow Guard Pages to Cross Bin Boundaries @os-d (#1774)

Change Details

Description

Currently, the DXE page allocator does not ensure that guard page allocations stay within the bin that it is attempting to allocate within. As a result, S4 resume is jeopardized by bins expanding due to guard pages, either into other bins or out of bins. This is caught by a new assert in CoreGetMemoryMap() to ensure the bins are correct.

This fixes this by changing the internal heap guard API to return the adjusted size and start address of a proposed allocation. The page allocator then can ensure that the adjusted allocation still fits within the bin it is attempting to allocate within; if not, it will search for another descriptor.

(cherry picked from edk2 commit 0f2dc7558713f1774bb7317e9fdcd371fcbb10cc)

• [x] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

On OvmfPkg and a physical Intel system.

Integration Instructions

N/A.

[Squash On Rebase] MdeModulePkg: Unconditionally ApplyMemoryProtectionPolicy @apop5 (#1773)

Change Details

Description

When a non-NX_COMPAT EFI_APPLICATION (e.g. grubx64.efi) is loaded, ActivateCompatibilityMode() sets mEnhancedMemoryProtectionActive = FALSE. From then on, GetPermissionAttributeForMemoryType() returns 0 for every memory type.

ApplyMemoryProtectionPolicy() would get OldAttributes and NewAttributes based upon the memory type, not the actual memory settings, and if attributes matched, return early without a call to SetMemoryAttributes. This could result in the system providing memory with unintended attributes.

Skip the type-compare shortcut. Always call SetMemoryAttributes when returning allocated memory.

Squash on Rebase with https://github.com/microsoft/mu_basecore/commit/b8374261aae751adae10f005b67bea2858d59358 (Implement Compatibility Mode for Enhanced Memory Protection)

• [X] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

Physical platform booting grubx64.

Integration Instructions

No integration necessary.

[release/202511] Update BaseTools ext dep to v2025110001.0.3 @[mu-automation[bot]](https://github.com/apps/mu-automation) (#1772)

Change Details

This PR updates the BaseTools external dependency to version v2025110001.0.3.

🐛 Bug Fixes

EmbeddedPkg/VirtualRealTimeClockLib: Fix RTC offset logic for negative TimeZone @capohuang (#1765)

Change Details

Description

[Problem] A logic defect in VirtualRealTimeClockLib causes incorrect RTC calculation when Time->TimeZone is negative (e.g., -480 for UTC+8). The comparison EpochSeconds > (Time->TimeZone * SEC_PER_MIN) performs unsigned comparison due to C type promotion rules. This treats the negative offset as a very large unsigned integer, causing the code to skip necessary timezone compensation.

[Solution] Updated the logic to ensure the timezone offset calculation and comparison handle signed values correctly. This allows the library to properly apply compensation for both positive and negative timezones.

• [ ] Impacts functionality?
• [ ] Impacts security?
• [ ] Breaking change?
• [ ] Includes tests?
• [ ] Includes documentation?

How This Was Tested

[Steps] Set the system timezone to UTC+8 (which translates to a -480 offset in the UEFI variable). Perform a shutdown or hibernate and cold boot. Observe the RTC time in the UEFI shell and OS.

[Result] The RTC correctly reflects the local time, and the signed/unsigned comparison issue is resolved.

Integration Instructions

N/A

Full Changelog: https://github.com/microsoft/mu_basecore/compare/v2025110001.0.3...v2025110001.0.4