Feature: AARCH64 Single Copy - #264
Merged
Doug Flick (Flickdm) merged 5 commits intoAug 3, 2026
Merged
Conversation
mu-automation
Bot
added
language:python
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
2 times, most recently
from
July 7, 2026 00:08
98f6e5b to
9997144
Compare
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
3 times, most recently
from
July 15, 2026 00:07
16703b0 to
30dfc1e
Compare
5 tasks
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
3 times, most recently
from
July 23, 2026 19:06
a9ffc48 to
e83123d
Compare
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
7 times, most recently
from
July 23, 2026 22:10
bb878e3 to
8ab87fc
Compare
Doug Flick (Flickdm)
marked this pull request as ready for review
July 23, 2026 22:27
mu-automation
Bot
added
the
type:documentation
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
from
July 24, 2026 00:51
8ab87fc to
0210312
Compare
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
4 times, most recently
from
July 27, 2026 06:01
7453b20 to
38e742f
Compare
kuqin12
reviewed
Jul 30, 2026
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
from
July 31, 2026 17:18
38e742f to
9c9b001
Compare
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
3 times, most recently
from
July 31, 2026 17:55
a38eb8f to
cc503af
Compare
Doug Flick (Flickdm)
requested review from
kuqin12 and
Oliver Smith-Denny (os-d)
July 31, 2026 17:57
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
from
July 31, 2026 17:57
cc503af to
4d1e56b
Compare
Doug Flick (Flickdm)
enabled auto-merge (rebase)
August 3, 2026 16:50
Oliver Smith-Denny (os-d)
approved these changes
Aug 3, 2026
Member
Author
|
Not really, but the CRC is also just completely useless in RELEASE because there is really nothing I can do if it fails |
Contributor
Sure, but you might say never load a driver that fails the CRC. You won't boot, but also you won't execute garbage which has security implications. But, in general, I think constraining your dependencies is more important than skipping useless work, unless there is a real perf reason. |
Member
Author
|
Sure I'll make the change - I'm not really against it - but I was trying to restrict it to only DEBUG which was a lot easier when I assumed I could use the same debug libs across AARCH64 which is no longer the case |
Doug Flick (Flickdm)
disabled auto-merge
August 3, 2026 20:18
kuqin12
approved these changes
Aug 3, 2026
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
2 times, most recently
from
August 3, 2026 21:09
425f317 to
89fd7ac
Compare
Add the MM-side image provider protocol, message format, provider implementation, and package declarations needed to locate and serve OneCrypto image bytes from StandaloneMM. Signed-off-by: Doug Flick <dougflick@microsoft.com>
Add the AARCH64 DXE loader that fetches OneCrypto image bytes from StandaloneMM over MM communication and update package wiring to build and package the new handoff path. Signed-off-by: Doug Flick <dougflick@microsoft.com>
Update the OneCrypto bundler to include the AARCH64 MM handoff artifacts and add the integration INF used to package the MM image provider in the binary drop. Signed-off-by: Doug Flick <dougflick@microsoft.com>
Document the AARCH64 MM-to-DXE handoff flow, loader roles, and packaging expectations for the single-copy OneCrypto path. Signed-off-by: Doug Flick <dougflick@microsoft.com>
…ugLib AARCH64 single-copy uses ArmFfaConsoleDebugLib (FF-A console debug for the StandaloneMM secure partition), which is present on microsoft/mu_basecore release/202511. Bump the pinned commit to pick it up. No fork required. Signed-off-by: Doug Flick <dougflick@microsoft.com>
Doug Flick (Flickdm)
force-pushed
the
feat/onecrypto-aarch64-single-copy
branch
from
August 3, 2026 21:09
89fd7ac to
94827c0
Compare
Doug Flick (Flickdm)
enabled auto-merge (rebase)
August 3, 2026 21:09
Oliver Smith-Denny (os-d)
approved these changes
Aug 3, 2026
5 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This pull request introduces a new AARCH64 "single-copy" integration mode for OneCryptoPkg, enabling DXE to load the OneCrypto binary directly from StandaloneMM via MM communication, and updates documentation and build files to reflect this architecture. It adds new modules and protocols to support this mode, clarifies the packaging and loading flow, and updates references to dependencies.
AARCH64 Single-Copy Integration Mode
OneCryptoLoaderDxeFromMm) and MM image provider (OneCryptoImageProviderStandaloneMm) modules to support fetching and loading OneCrypto from secure-world MM usingEFI_MM_COMMUNICATION2_PROTOCOL. [1] [2] [3]OneCryptoImageProviderGuid.h,OneCryptoImageProviderMessage.h). [1] [2]Architecture.md,FAQs.md) to describe the new single-copy mode, detail the dual integration modes on AARCH64, and explain packaging and flow differences. [1] [2] [3] [4] [5] [6] [7]Packaging and Build System Updates
OneCryptoFileGuid.h).MU_BASECOREin build scripts (CISettings.py,DriverBuild.py). [1] [2]These changes enable more robust and space-efficient deployment of OneCrypto on AARCH64 platforms, especially those with secure/non-secure separation, and provide extensive documentation for integrators and developers.
For details on how to complete these options and their meaning refer to CONTRIBUTING.md.
How This Was Tested
Physical Platform and QemuArmVirtPkg
Integration Instructions
See OneCryptoPkg/Docs/Architecture.md