--- xnu/xnu-12377.121.6/iokit/Kernel/i386/IOKeyStoreHelper.cpp
+++ xnu/xnu-7195.81.3/iokit/Kernel/i386/IOKeyStoreHelper.cpp
@@ -54,19 +54,24 @@
 IOMemoryDescriptor* IOGetAPFSKeyStoreData();
 void IOSetAPFSKeyStoreData(IOMemoryDescriptor* data);
 
-static volatile UInt32 ARVRootHashFetched = 0;
+static volatile UInt32 arvRootHashFetched = 0;
 static volatile UInt32 bsARVRootHashFetched = 0;
+static IOMemoryDescriptor* arvRootHashData = NULL;
+static IOMemoryDescriptor* bsARVRootHashData = NULL;
 
 IOMemoryDescriptor* IOGetARVRootHashData(void);
+void IOSetARVRootHashData(IOMemoryDescriptor* arvData);
+
 IOMemoryDescriptor* IOGetBaseSystemARVRootHashData(void);
-
 bool IOBaseSystemARVRootHashAvailable(void);
-
-static volatile UInt32 ARVManifestFetched = 0;
-static volatile UInt32 bsARVManifestFetched = 0;
+void IOSetBaseSystemARVRootHashData(IOMemoryDescriptor* arvData);
+
+
+static volatile UInt32 arvManifestFetched = 0;
+static IOMemoryDescriptor* arvManifestData = NULL;
 
 IOMemoryDescriptor* IOGetARVManifestData(void);
-IOMemoryDescriptor* IOGetBaseSystemARVManifestData(void);
+void IOSetARVManifestData(IOMemoryDescriptor* arvData);
 
 __END_DECLS
 
@@ -176,15 +181,34 @@
 
 // ARV Root Hash fetcher
 
-// Retrieve any root hash we may have (stored in boot_args)
+// Store in-memory Root Hash
+void
+IOSetARVRootHashData(IOMemoryDescriptor* arvData)
+{
+	// Do not allow re-fetching of the boot_args root hash by passing NULL here.
+	if (arvData) {
+		arvRootHashData = arvData;
+		arvRootHashFetched = 0;
+	}
+}
+
+// Retrieve any root hash we may have (stored in boot_args or in-memory)
 IOMemoryDescriptor*
 IOGetARVRootHashData(void)
 {
 	// Check if someone got the root hash before us
-	if (!OSCompareAndSwap(0, 1, &ARVRootHashFetched)) {
-		return NULL;
-	}
-
+	if (!OSCompareAndSwap(0, 1, &arvRootHashFetched)) {
+		return NULL;
+	}
+
+	// Do we have in-memory root hash?
+	if (arvRootHashData) {
+		IOMemoryDescriptor* arvData = arvRootHashData;
+		arvRootHashData = NULL;
+		return arvData;
+	}
+
+	// Looks like there was no in-memory root hash and it's the first call - try boot_args
 	boot_args* args = (boot_args*)PE_state.bootArgs;
 
 	DEBG("%s: data at address %llu size %llu\n", __func__, args->arvRootHashStart, args->arvRootHashSize);
@@ -204,62 +228,68 @@
 	return memoryDescriptor;
 }
 
-// Base System Analogue
+// Base System Analogues
 
 IOMemoryDescriptor*
 IOGetBaseSystemARVRootHashData(void)
 {
-	// Check if someone got the base system root hash before us
-	if (!OSCompareAndSwap(0, 1, &bsARVRootHashFetched)) {
-		return NULL;
-	}
-
-	boot_args* args = (boot_args*)PE_state.bootArgs;
-
-	DEBG("%s: data at address %llu size %llu\n", __func__, args->bsARVRootHashStart, args->bsARVRootHashSize);
-	if (args->bsARVRootHashStart == 0) {
-		return NULL;
-	}
-
-	// We have the base system root hash in the boot_args, create IOMemoryDescriptor for the blob
-	IOAddressRange ranges;
-	ranges.address = args->bsARVRootHashStart;
-	ranges.length = args->bsARVRootHashSize;
-
-	const IOOptionBits options = kIODirectionInOut | kIOMemoryTypePhysical64 | kIOMemoryMapperNone;
-
-	IOMemoryDescriptor* memoryDescriptor = IOMemoryDescriptor::withOptions(&ranges, 1, 0, NULL, options);
-	DEBG("%s: memory descriptor %p\n", __func__, memoryDescriptor);
-	return memoryDescriptor;
+	//TBD!
+	return NULL;
 }
 
 bool
 IOBaseSystemARVRootHashAvailable(void)
 {
-	boot_args* args = (boot_args*)PE_state.bootArgs;
-
-	if (args->bsARVRootHashStart == 0 || args->bsARVRootHashSize == 0) {
+	// Check if someone got the root hash before us
+	if (!OSCompareAndSwap(0, 1, &bsARVRootHashFetched)) {
 		return false;
 	}
 
-	if (args->bsARVManifestStart == 0 || args->bsARVManifestSize == 0) {
-		return false;
-	}
-
-	return true;
-}
+	// Do we have in-memory root hash?
+	if (bsARVRootHashData) {
+		return true;
+	}
+	return false;
+}
+
+
+void
+IOSetBaseSystemARVRootHashData(IOMemoryDescriptor* arvData)
+{
+	return;
+}
+
 
 // ARV Manifest fetcher
 
-// Retrieve any manifest we may have (stored in boot_args)
+// Store in-memory Manifest
+void
+IOSetARVManifestData(IOMemoryDescriptor* arvData)
+{
+	// Do not allow re-fetching of the boot_args manifest by passing NULL here.
+	if (arvData) {
+		arvManifestData = arvData;
+		arvManifestFetched = 0;
+	}
+}
+
+// Retrieve any manifest we may have (stored in boot_args or in-memory)
 IOMemoryDescriptor*
 IOGetARVManifestData(void)
 {
 	// Check if someone got the manifest before us
-	if (!OSCompareAndSwap(0, 1, &ARVManifestFetched)) {
-		return NULL;
-	}
-
+	if (!OSCompareAndSwap(0, 1, &arvManifestFetched)) {
+		return NULL;
+	}
+
+	// Do we have in-memory manifest?
+	if (arvManifestData) {
+		IOMemoryDescriptor* arvData = arvManifestData;
+		arvManifestData = NULL;
+		return arvData;
+	}
+
+	// Looks like there was no in-memory manifest and it's the first call - try boot_args
 	boot_args* args = (boot_args*)PE_state.bootArgs;
 
 	DEBG("%s: data at address %llu size %llu\n", __func__, args->arvManifestStart, args->arvManifestSize);
@@ -278,32 +308,3 @@
 	DEBG("%s: memory descriptor %p\n", __func__, memoryDescriptor);
 	return memoryDescriptor;
 }
-
-// Base System Analogue
-
-IOMemoryDescriptor*
-IOGetBaseSystemARVManifestData(void)
-{
-	// Check if someone got the base system manifest before us
-	if (!OSCompareAndSwap(0, 1, &bsARVManifestFetched)) {
-		return NULL;
-	}
-
-	boot_args* args = (boot_args*)PE_state.bootArgs;
-
-	DEBG("%s: data at address %llu size %llu\n", __func__, args->bsARVManifestStart, args->bsARVManifestSize);
-	if (args->bsARVManifestStart == 0) {
-		return NULL;
-	}
-
-	// We have the manifest in the boot_args, create IOMemoryDescriptor for the blob
-	IOAddressRange ranges;
-	ranges.address = args->bsARVManifestStart;
-	ranges.length = args->bsARVManifestSize;
-
-	const IOOptionBits options = kIODirectionInOut | kIOMemoryTypePhysical64 | kIOMemoryMapperNone;
-
-	IOMemoryDescriptor* memoryDescriptor = IOMemoryDescriptor::withOptions(&ranges, 1, 0, NULL, options);
-	DEBG("%s: memory descriptor %p\n", __func__, memoryDescriptor);
-	return memoryDescriptor;
-}