BaseCryptOnOneCrypto Support

[Flickdm]

Description

This pull request adds support for forwarding cryptographic library calls to the new OneCrypto protocol across DXE, SMM, and Standalone MM phases, enabling modular and version-aware cryptographic provider integration. It introduces new protocol GUIDs, implements library constructors for protocol lookup, and updates build configuration to support these changes. Additionally, it provides documentation and abstracts for the new libraries, and adds a disabled external binary dependency descriptor.

OneCrypto Protocol Integration:

• Introduced new protocol GUIDs for OneCrypto Private, MM, and DXE protocols in CryptoPkg.dec to support phase-specific cryptographic operations.
• Implemented DXE, SMM, and Standalone MM library modules (DxeCryptLib.c, SmmCryptLib.c, StandaloneMmCryptLib.c) that locate and expose the OneCrypto protocol for cryptographic services, with corresponding INF build files for each phase. [1] [2] [3] [4] [5] [6]

Documentation and Descriptions:

---
config:
  layout: elk
---
classDiagram

    namespace Protocol {
        class OneCrypto:::highlight {
            <<Protocol Interface>>
            UINT16 Major;
            UINT16 Minor;
            // v1.0 ------------------------------------------
            ONE_CRYPTO_PROVIDED_FUNC ONE_CRYPTO_PROVIDED_FUNC;
            // ...
        }
    }

    namespace Library {
        class BaseCryptLib:::highlight {
        }

        class TlsLib:::library {

        }

        class HashApiLib:::library {

        }
    }

    namespace LibraryInstance {
        class BaseCryptOnOneCrypto:::highlight  {
            <<Library Interface>>
            EFI_STATUS CryptoFunc(..)
        }
    }

    namespace Driver {
        class OneCryptoBinSupvMm:::driver {
            <<Driver>>
            Phase Agnostic Crypto Driver
            Shared across Phases

            Crypto Entry(..) // phase agnostic code
            SupvMm Entry(..) // stub entry
        }

        class OneCryptoLoaderSupvMm:::driver {
            <<Driver>>
        }

        class OneCryptoLoaderDxe:::driver {
            <<Driver>>
        }
    }

    namespace GenericModules {
        class GenericDriver:::module {
            <<Driver>>
            Any driver that needs crypto
        }

        class GenericLibrary:::module {
            <<Library Interface>>
            Any library that needs crypto
        }

    }

    OneCryptoLoaderSupvMm --> OneCryptoBinSupvMm : Loads Phase Agnostic Code
    OneCryptoLoaderDxe --> OneCryptoBinSupvMm : Loads Phase Agnostic Code

    OneCryptoBinSupvMm ..> OneCryptoLoaderSupvMm : Provides Crypto
    OneCryptoBinSupvMm ..> OneCryptoLoaderDxe : Provides Crypto

    OneCryptoLoaderSupvMm ..|> OneCrypto : Publishes
    OneCryptoLoaderDxe ..|> OneCrypto : Publishes

    BaseCryptOnOneCrypto ..|> OneCrypto : Locates

    BaseCryptOnOneCrypto <.. BaseCryptLib : Backed By
    BaseCryptOnOneCrypto <.. TlsLib : Backed By

    TlsLib ..> BaseCryptLib : Uses
    HashApiLib ..> BaseCryptLib : Uses
    
    GenericLibrary ..> BaseCryptLib : Uses
    GenericDriver ..> BaseCryptLib : Uses
    GenericLibrary ..> TlsLib : Uses
    GenericDriver ..> HashApiLib : Uses

    classDef driver fill:#187286,stroke:#333,stroke-width:2px
    classDef protocol fill:#d63230,stroke:#333,stroke-width:2px
    classDef library fill:#1c77c3,stroke:#333,stroke-width:2px
    classDef module fill:#ff8c00,stroke:#333,stroke-width:2px
    classDef highlight fill:#69995d,stroke:#333,stroke-width:2px

Loading

Specifically this PR is addressing the following (sage green in the chart):

Build and Configuration Updates:

• Removed inclusion of test-specific PCDs from the main DSC configuration to streamline production builds.
• Added a disabled external dependency descriptor for the OneCrypto binary driver in OneCrypto_ext_dep.json.disabled.

BaseCryptLib API Enhancements:

• Added a new API to retrieve cryptographic provider version information in BaseCryptLib.h, improving diagnostics and compatibility checks.

Code Organization and Comments:

• Improved comments and documentation in CryptoPkg.dec regarding deprecated usage and auto-generated sections for cryptographic provider configuration.

BaseCryptOnOneCrypto

• Library implementation and safe calling usage of the phase agnostic code.

OneCryptoProtocol

• Protocol implementation and strict guidance.

• Impacts functionality?
• Impacts security?
• Breaking change?
• Includes tests?
• Includes documentation?

How This Was Tested

QemuQ35

Integration Instructions

N/A

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release/202502@f6015c4). Learn more about missing BASE report.

Additional details and impacted files

@@                Coverage Diff                @@
##             release/202502    #1570   +/-   ##
=================================================
  Coverage                  ?    0.66%           
=================================================
  Files                     ?      939           
  Lines                     ?   329534           
  Branches                  ?     2647           
=================================================
  Hits                      ?     2195           
  Misses                    ?   327161           
  Partials                  ?      178           

Flag	Coverage Δ
MdeModulePkg	0.21% <ø> (?)
NetworkPkg	0.55% <ø> (?)
UefiCpuPkg	4.92% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Flickdm]

Working on fixing the failing gates - uncrustify is failing.

[os-d]

A couple notes on the mermaid diagram for clarity:

I would label this as the library class/interface that is used. In the current diagram it could be seen that BaseCryptLib is different than BaseCryptLibOnOneCrypto, when it is not, the latter implements the former.

Just want to make sure this is correct:

HashApiLib doesn't interact with BaseCryptLib at all?

[os-d]

Suggested change

	Implements the BaseCryptLib and TlsLib using the services of the OneCrypto
	Protocol/PPI.
	Implements the backend crypto services of BaseCryptLib and TlsLib using the OneCrypto
	Protocol.

[Flickdm]

convert this to an extern and drop the function

[Flickdm]

Suggested change

	LIBRARY_CLASS = TlsLib | MM_STANDALONE
	LIBRARY_CLASS = TlsLib | MM_STANDALONE

[Flickdm]

Add document to top level level of CryptoPkg describing what the options are for backing and write out that if a function is added to BaseCryptLib.h that all providers (specifically OneCrypto) needs to be updated to create the WYSIWYG contract