feat: Add FIPS self test support

Added fips_selftest run before any crypto use in Stage1A.
updated IppCrypto to 1.0.1 version

Signed-off-by: Antara Borwankar <antara.borwankar@intel.com>

BootloaderCommonPkg/BootloaderCommonPkg.dec

@@ -157,6 +157,12 @@
   #     0x04    - SM3_256.<BR>
   gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg                 |        0x01| UINT8 | 0x20000702
 
+  ## This PCD indicates the signing scheme type used for Component signing
+  #  Based on the value set, the required algorithm should be used while verfication
+  #     0x0001    - RSA_PKCS_1_5.<BR>
+  #     0x0002    - RSA_PSS.<BR>
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignType                    |        0x02| UINT8 | 0x20000228
+
   ## This PCD indicates the signing scheme type included in IPP Crypto library
   #  Based on the value set, the required algorithm should be used while verfication
   #     0x0001    - RSA_PKCS_1_5.<BR>
@@ -345,3 +351,7 @@
   gPlatformCommonLibTokenSpaceGuid.PcdCpuX2ApicEnabled            | FALSE  | BOOLEAN | 0x20000220
   gPlatformCommonLibTokenSpaceGuid.PcdTccEnabled                  | FALSE  | BOOLEAN | 0x20000221
   gPlatformCommonLibTokenSpaceGuid.PcdFspNoEop                    | FALSE  | BOOLEAN | 0x20000223
+
+[PcdsFixedAtBuild]
+  gPlatformCommonLibTokenSpaceGuid.PcdFipsSupport     | FALSE      | BOOLEAN | 0x20000226
+  gPlatformCommonLibTokenSpaceGuid.PcdIppcrypto2Lib   | FALSE      | BOOLEAN | 0x20000227

BootloaderCommonPkg/Include/Library/CryptoLib.h

@@ -174,6 +174,29 @@ Sm3 (
   OUT       UINT8          *Digest
   );
 
+/**
+  Verifies the RSA signature with PKCS1-v1_5 encoding scheme defined in RSA PKCS#1.
+
+  @param[in]  PubKeyHdr         Pointer to a PubKey data.
+  @param[in]  SignatureHdr      Pointer to signature data to be verified.
+  @param[in]  Src               Pointer to meassage.
+  @param[in]  SrcSize           Size of the message.
+
+  @retval  RETURN_SUCCESS             Valid signature.
+  @retval  RETURN_INVALID_PARAMETER   Key or signature format is incorrect.
+  @retval  RETURN_SECURITY_VIOLATION  Invalid signature.
+
+**/
+
+RETURN_STATUS
+EFIAPI
+RsaVerify2_Pkcs_1_5 (
+  IN CONST PUB_KEY_HDR        *PubKeyHdr,
+  IN CONST SIGNATURE_HDR      *SignatureHdr,
+  IN CONST UINT8              *Src,
+  IN CONST UINT32             SrcSize
+  );
+
 /**
   Verifies the RSA signature with PKCS1-v1_5 encoding scheme defined in RSA PKCS#1.
 
@@ -434,5 +457,16 @@ Sm3Final (
   OUT      UINT8      *Hash
   );
 
+/**
+  Runs FIPS self test before any crypto function gets executed.
+
+  @retval  RETURN_SUCCESS             Success.
+  @retval  RETURN_UNSUPPORTED  All other errors.
+**/
+RETURN_STATUS
+EFIAPI
+RunFipsSelftests (
+  VOID
+);
 #endif
 

BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2Lib.inf

@@ -68,7 +68,6 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h
-  $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c
   $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c
@@ -76,17 +75,18 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c
 
   # Hash source files
-  $(IPP_PATH)/sources/ippcp/pcphashmethod_sha256.c
-  $(IPP_PATH)/sources/ippcp/pcphashsha256px.c
-  $(IPP_PATH)/sources/ippcp/pcphashmethod_sha384.c
-  $(IPP_PATH)/sources/ippcp/pcphashsha512px.c
-  $(IPP_PATH)/sources/ippcp/sm3/pcphashmethod_sm3.c
-  $(IPP_PATH)/sources/ippcp/sm3/pcphashsm3px.c
-  $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethod_sha256.c
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashsha256px.c
+  $(IPP_PATH)/sources/ippcp/hash/sha384/pcphashmethod_sha384.c
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashsha512px.c
+  $(IPP_PATH)/sources/ippcp/hash/sm3/pcphashmethod_sm3.c
+  $(IPP_PATH)/sources/ippcp/hash/sm3/pcphashsm3px.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
 
   # HMAC source files
   $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c
@@ -108,6 +108,8 @@
   gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask
   gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask
   gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignType
 
 [BuildOptions]
   MSFT:*_*_*_CC_FLAGS = -D_ABL_ /GL-

BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibE9.inf

@@ -73,7 +73,7 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h
-  $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c
   $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c
@@ -81,12 +81,14 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c
 
   # Hash source files
-  $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c
-  $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcpsha256stuff.h
 
   # HMAC source files
   $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c
@@ -95,12 +97,73 @@
   $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c
   $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c
 
+  # FIPS source files
+  fips.c
+  $(IPP_PATH)/include/ippcp/fips_cert.h
+  $(IPP_PATH)/sources/ippcp/fips_cert/common.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c
+  $(IPP_PATH)/sources/ippcp/gsscramble.c
+  $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c
+  $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c
+  $(IPP_PATH)/sources/ippcp/cpinit.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngenca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_range.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c
+  $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val3.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c
+  $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c
+  $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c
+  $(IPP_PATH)/sources/ippcp/pcpprng_gen.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c
+
 [Sources.X64]
   $(IPP_PATH)/sources/ippcp/asm_ia32/pcpvariant_xmm7560.inc
   # E9 files
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256e9as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsm3e9as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha512e9as.nasm
+  # FIPS
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1e9as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm
   # M7 files
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnuaddm7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnudivm7as.nasm
@@ -124,6 +187,11 @@
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.asm   : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.asm  : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm       : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm      : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.asm              : $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1e9as.asm          : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1e9as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.asm          : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.asm        : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm
 
 
 [Packages]
@@ -139,10 +207,12 @@
   gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask
   gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask
   gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignType
 
 [BuildOptions]
-  MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_E9 /GL- /arch:AVX
+  MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_E9 -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED /GL- /arch:AVX
   MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_E9 -DWIN32E
   GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_E9 -DLINUX32E
-  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_E9 -w -Wformat -Wformat-security -march=sandybridge -mavx -maes -mpclmul -msha -mrdrnd -mrdseed
+  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_E9 -w -Wformat -Wformat-security -march=sandybridge -mavx -maes -mpclmul -msha -mrdrnd -mrdseed -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED -DMBX_FIPS_MODE
 

BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibL9.inf

@@ -75,7 +75,7 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h
-  $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c
   $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c
@@ -83,12 +83,14 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c
 
   # Hash source files
-  $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c
-  $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcpsha256stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h
 
   # HMAC source files
   $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c
@@ -97,7 +99,73 @@
   $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c
   $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c
 
+  # FIPS source files
+  fips.c
+  $(IPP_PATH)/include/ippcp/fips_cert.h
+  $(IPP_PATH)/sources/ippcp/fips_cert/common.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c
+  $(IPP_PATH)/sources/ippcp/gsscramble.c
+  $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c
+  $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c
+  $(IPP_PATH)/sources/ippcp/cpinit.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngenca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_range.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c
+  $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val3.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c
+  $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c
+  $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c
+  $(IPP_PATH)/sources/ippcp/pcpprng_gen.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__avx2_private.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_avx2.c
+
 [Sources.X64]
+  # FIPS
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1l9as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul1024_avx2as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul_avx2as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr1024_avx2as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr_avx2as.nasm
   #L9 files
   $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256l9as.nasm
@@ -126,6 +194,15 @@
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumulschoolsrvl9.asm  : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumulschoolsrvl9as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumulschoolsrvl9pp.asm  : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumulschoolsrvl9pp.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm       : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm      : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.asm           : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.asm         : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1l9as.asm           : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1l9as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul1024_avx2as.asm   : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul1024_avx2as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul_avx2as.asm     : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontmul_avx2as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr1024_avx2as.asm   : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr1024_avx2as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr_avx2as.asm     : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontsqr_avx2as.nasm
+
 
 
 [Packages]
@@ -141,10 +218,12 @@
   gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask
   gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask
   gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignType
 
 [BuildOptions]
-  MSFT:*_*_X64_CC_FLAGS = -D_ABL_ -D_L9 -D_ARCH_EM64T /GL- /arch:AVX2
+  MSFT:*_*_X64_CC_FLAGS = -D_ABL_ -D_L9 -D_ARCH_EM64T -DIPPCP_FIPS_MODE -D_NO_IPP_DEPRECATED /GL- /arch:AVX2
   MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_L9 -DWIN32E
   GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_L9 -DLINUX32E
-  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_L9 -w -Wformat -Wformat-security -march=haswell -mavx2 -maes -mvaes -mpclmul -mvpclmulqdq -msha -mrdrnd -mrdseed
+  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_L9 -w -Wformat -Wformat-security -march=haswell -mavx2 -maes -mvaes -mpclmul -mvpclmulqdq -msha -mrdrnd -mrdseed -DIPPCP_FIPS_MODE -DMBX_FIPS_MODE -D_NO_IPP_DEPRECATED
 

BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibM7.inf

@@ -73,7 +73,7 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h
-  $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c
   $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c
@@ -81,14 +81,16 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c
 
   # Hash source files
-  $(IPP_PATH)/sources/ippcp/sm3/pcphashmethod_sm3.c
-  $(IPP_PATH)/sources/ippcp/sm3/pcphashsm3px.c
-  $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c
-  $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sm3/pcphashmethod_sm3.c
+  $(IPP_PATH)/sources/ippcp/hash/sm3/pcphashsm3px.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcpsha256stuff.h
 
   # HMAC source files
   $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c
@@ -97,8 +99,67 @@
   $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c
   $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c
 
+  # FIPS source files
+  fips.c
+  $(IPP_PATH)/include/ippcp/fips_cert.h
+  $(IPP_PATH)/sources/ippcp/fips_cert/common.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c
+  $(IPP_PATH)/sources/ippcp/gsscramble.c
+  $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c
+  $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c
+  $(IPP_PATH)/sources/ippcp/cpinit.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngenca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_range.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c
+  $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val3.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c
+  $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c
+  $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c
+  $(IPP_PATH)/sources/ippcp/pcpprng_gen.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c
+
 [Sources.X64]
   $(IPP_PATH)/sources/ippcp/asm_ia32/pcpvariant_xmm7560.inc
+  # FIPS
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1m7as.nasm
   # m7 files
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256m7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha512m7as.nasm
@@ -123,6 +184,9 @@
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.asm   : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.asm  : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm       : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm      : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.asm              : $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1m7as.asm           : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1m7as.nasm
 
 
 [Packages]
@@ -138,10 +202,13 @@
   gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask
   gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask
   gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignType
+
 
 [BuildOptions]
-  MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_M7 /GL-
+  MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_M7 -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED /GL-
   MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_M7 -DWIN32E
   GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_M7 -DLINUX32E
-  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_M7 -w -Wformat -Wformat-security -march=nocona -msse3
+  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_M7 -w -Wformat -Wformat-security -march=nocona -msse3 -DIPPCP_FIPS_MODE -DMBX_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED
 

BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibU8.inf

@@ -73,7 +73,7 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h
-  $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c
   $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c
@@ -81,12 +81,14 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c
 
   # Hash source files
-  $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c
-  $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcpsha256stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h
 
   # HMAC source files
   $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c
@@ -95,11 +97,70 @@
   $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c
   $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c
 
+  # FIPS source files
+  fips.c
+  $(IPP_PATH)/include/ippcp/fips_cert.h
+  $(IPP_PATH)/sources/ippcp/fips_cert/common.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c
+  $(IPP_PATH)/sources/ippcp/gsscramble.c
+  $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c
+  $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c
+  $(IPP_PATH)/sources/ippcp/cpinit.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngenca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_range.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c
+  $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val3.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c
+  $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c
+  $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c
+  $(IPP_PATH)/sources/ippcp/pcpprng_gen.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c
+
 [Sources.X64]
   $(IPP_PATH)/sources/ippcp/asm_ia32/pcpvariant_xmm7560.inc
   # U8 files
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256u8as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsm3u8as.nasm
+  # FIPS
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm
   # m7 files
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha512m7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnuaddm7as.nasm
@@ -124,6 +185,9 @@
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.asm   : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.asm  : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm       : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.asm           : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm      : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.asm              : $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm
 
 
 [Packages]
@@ -139,10 +203,12 @@
   gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask
   gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask
   gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignType
 
 [BuildOptions]
-  MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_U8 /GL-
+  MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_U8 -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED /GL-
   MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_U8 -DWIN32E
   GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_U8 -DLINUX32E
-  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_U8 -w -Wformat -Wformat-security
+  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_U8 -w -Wformat -Wformat-security -DIPPCP_FIPS_MODE -DMBX_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED
 

BootloaderCommonPkg/Library/IppCrypto2Lib/IppCrypto2LibY8.inf

@@ -73,7 +73,6 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_initpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_setpublickey.c
   $(IPP_PATH)/sources/ippcp/pcprsa_sizeof_pubkey.h
-  $(IPP_PATH)/sources/ippcp/pcprsaverifyhash_pkcs1v15_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsaverify_pss_rmf.c
   $(IPP_PATH)/sources/ippcp/pcprsa_gspub_cipher.c
   $(IPP_PATH)/sources/ippcp/gsmodmethod_rsa.c
@@ -81,12 +80,13 @@
   $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_public.c
 
   # Hash source files
-  $(IPP_PATH)/sources/ippcp/pcphashmessage_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashinit_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashupdate_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashfinal_rmf.c
-  $(IPP_PATH)/sources/ippcp/pcphashca_rmf.c
-  $(IPP_PATH)/sources/ippcp/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmessage_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashinit_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashupdate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashfinal_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashca_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sm3/pcpsm3stuff.h
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcpsha512stuff.h
 
   # HMAC source files
   $(IPP_PATH)/sources/ippcp/pcphmacmessage_rmf.c
@@ -95,12 +95,73 @@
   $(IPP_PATH)/sources/ippcp/pcphmacupdate_rmf.c
   $(IPP_PATH)/sources/ippcp/pcphmacfinal_rmf.c
 
+  # FIPS source files
+  fips.c
+  $(IPP_PATH)/include/ippcp/fips_cert.h
+  $(IPP_PATH)/sources/ippcp/fips_cert/common.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pkcs_v15.c
+  $(IPP_PATH)/sources/ippcp/pcprsaverify_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getbuffersizeprivatekey.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_setprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnsetwords.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pkcs1v15_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/sha256/pcphashmethodset_sha256_tt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsmethod__gpr_private.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher_crt.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_gsprv_cipher.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win_sscm.c
+  $(IPP_PATH)/sources/ippcp/pcpngmontexpstuff_win.c
+  $(IPP_PATH)/sources/ippcp/gsscramble.c
+  $(IPP_PATH)/sources/ippcp/gsscramble_sscm.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_hash_msg_upd_sha.c
+  $(IPP_PATH)/sources/ippcp/hash/sha512/pcphashmethodset_sha512.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgetsize_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_aes_upd_hmac.c
+  $(IPP_PATH)/sources/ippcp/pcphmacgettag_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcphmacduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashcnt.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashduplicate_rmf.c
+  $(IPP_PATH)/sources/ippcp/fips_cert/selftest_rsa_sign_verify_pss.c
+  $(IPP_PATH)/sources/ippcp/cpinit.c
+  $(IPP_PATH)/sources/ippcp/pcprsasign_pss_rmf.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_generatekeys.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_initprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcprsa_getsizeprivatekeytype2.c
+  $(IPP_PATH)/sources/ippcp/pcpprimeginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprimegetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngenca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnginitca.c
+  $(IPP_PATH)/sources/ippcp/pcpprnggetsize.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_range.c
+  $(IPP_PATH)/sources/ippcp/pcpprngen_pattern.c
+  $(IPP_PATH)/sources/ippcp/pcpprime_mimimaltest.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val3.c
+  $(IPP_PATH)/sources/ippcp/pcpbn_val1.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_lsr.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_ntz.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_minv.c
+  $(IPP_PATH)/sources/ippcp/pcpbnarithgcd.c
+  $(IPP_PATH)/sources/ippcp/gsmodmethod_mont.c
+  $(IPP_PATH)/sources/ippcp/pcpprng_gen.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu_arith_gcd.c
+  $(IPP_PATH)/sources/ippcp/pcpbnu32_arith_muldigit.c
+  $(IPP_PATH)/sources/ippcp/hash/pcphashmethodgetsize.c
+
 [Sources.X64]
   $(IPP_PATH)/sources/ippcp/asm_ia32/pcpvariant_xmm7560.inc
   # NI files
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256nias.nasm
   # U8 files
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsm3u8as.nasm
+  # FIPS
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256u8as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm
   # m7 files
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha512m7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnuaddm7as.nasm
@@ -125,7 +186,11 @@
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.asm   : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnusqrschoolm7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.asm  : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpmontreductionm7as.nasm
   $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.asm       : $(IPP_PATH)/sources/ippcp/asm_intel64/pcppurgeblkm7as.nasm
-
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256u8as.asm         : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha256u8as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.asm           : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1u8as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.asm      : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpbnumaconem7as.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.asm           : $(IPP_PATH)/sources/ippcp/asm_intel64/pcpsha1nias.nasm
+  $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.asm              : $(IPP_PATH)/sources/ippcp/asm_intel64/cpinitas.nasm
 
 [Packages]
   MdePkg/MdePkg.dec
@@ -140,10 +205,12 @@
   gPlatformCommonLibTokenSpaceGuid.PcdCryptoShaOptMask
   gPlatformCommonLibTokenSpaceGuid.PcdIppHashLibSupportedMask
   gPlatformCommonLibTokenSpaceGuid.PcdCompSignSchemeSupportedMask
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg
+  gPlatformCommonLibTokenSpaceGuid.PcdCompSignType
 
 [BuildOptions]
-  MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_Y8 /GL-
+  MSFT:*_*_*_CC_FLAGS = -D_ABL_ -D_Y8 -DIPPCP_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED /GL-
   MSFT:*_*_X64_NASM_FLAGS = -D_ABL_ -D_Y8 -DWIN32E
   GCC:*_*_X64_NASM_FLAGS = -D_ABL_ -D_Y8 -DLINUX32E
-  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_Y8 -w -Wformat -Wformat-security -march=nehalem -msse4.2 -maes -mpclmul -msha -U__INTEL_COMPILER
+  GCC:*_*_*_CC_FLAGS  = -D_ABL_ -D_Y8  -DIPPCP_FIPS_MODE -DMBX_FIPS_MODE -D_ARCH_EM64T -D_NO_IPP_DEPRECATED -w -Wformat -Wformat-security -march=nehalem -msse4.2 -maes -mpclmul -msha -U__INTEL_COMPILER
 

BootloaderCommonPkg/Library/IppCrypto2Lib/fips.c

@@ -0,0 +1,411 @@
+/** @file
+
+  Copyright (c) 2025, Intel Corporation. All rights reserved.<BR>
+  SPDX-License-Identifier: BSD-2-Clause-Patent
+
+**/
+#include "owndefs.h"
+#include "owncp.h"
+
+#include "pcpngrsa.h"
+#include "pcphash.h"
+#include "pcptool.h"
+#include "ippcp/fips_cert.h"
+
+#include <Library/CryptoLib.h>
+#include <Library/BlMemoryAllocationLib.h>
+#include <Library/DebugLib.h>
+
+
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestRsaVerifyPkcsv15 ()
+{
+    DEBUG ((DEBUG_INFO, "FipsSelftestRsaVerifyPkcsv15\n"));
+    //------ FIPS-required part
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(RSAVerify_PKCS1v15_rmf)) {
+        return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    int KeysBufferSize = 0;
+    selftest_status += fips_selftest_ippsRSASignVerify_PKCS1v15_rmf_get_size_keys(&KeysBufferSize);
+
+    Ipp8u *pKeysBuffer = AllocateTemporaryMemory(KeysBufferSize);
+    if (pKeysBuffer == NULL) {
+        return RETURN_OUT_OF_RESOURCES;
+    }
+    int BufferSize = 0;
+    selftest_status += fips_selftest_ippsRSASignVerify_PKCS1v15_rmf_get_size(&BufferSize, pKeysBuffer);
+
+    Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize);
+    if (pBuffer == NULL) {
+        FreeTemporaryMemory(pKeysBuffer);
+        return RETURN_OUT_OF_RESOURCES;
+    }
+
+    // Run the test
+    selftest_status += fips_selftest_ippsRSAVerify_PKCS1v15_rmf(pBuffer, pKeysBuffer);
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+        return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    FreeTemporaryMemory(pKeysBuffer);
+    FreeTemporaryMemory(pBuffer);
+    return RETURN_SUCCESS;
+}
+
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestSHA256 ()
+{
+    DEBUG ((DEBUG_INFO, "FipsSelftestSHA256\n"));
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(HashMessage_rmf)) {
+      return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    selftest_status += fips_selftest_ippsHashMessage_rmf(ippHashAlg_SHA256);
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+      return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    return RETURN_SUCCESS;
+}
+
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestSHA384 ()
+{
+    DEBUG ((DEBUG_INFO, "FipsSelftestSHA384\n"));
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(HashMessage_rmf)) {
+      return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    selftest_status += fips_selftest_ippsHashMessage_rmf(ippHashAlg_SHA384);
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+      return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    return RETURN_SUCCESS;
+}
+
+/* SM3 is not supported by FIPS
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestSM3 ()
+{
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(HashMessage_rmf)) {
+      return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    selftest_status += fips_selftest_ippsHashMessage_rmf(ippHashAlg_SM3);
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+      return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    return RETURN_SUCCESS;
+}
+
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestSM3Update ()
+{
+    //------ FIPS-required part
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(HashUpdate_rmf)) {
+        return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    int BufferSize = 0;
+    selftest_status += fips_selftest_ippsHash_rmf_get_size(&BufferSize);
+
+    Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize);
+    if (pBuffer == NULL) {
+        return RETURN_OUT_OF_RESOURCES;
+    }
+
+    // Run the test
+    selftest_status += fips_selftest_ippsHashUpdate_rmf(ippHashAlg_SM3, pBuffer);
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+        return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    FreeTemporaryMemory(pBuffer);
+    return RETURN_SUCCESS;
+}
+*/
+
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestSHA256Update ()
+{
+    DEBUG ((DEBUG_INFO, "FipsSelftestSHA256Update\n"));
+    //------ FIPS-required part
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(HashUpdate_rmf)) {
+        return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    int BufferSize = 0;
+    selftest_status += fips_selftest_ippsHash_rmf_get_size(&BufferSize);
+
+    Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize);
+    if (pBuffer == NULL) {
+        return RETURN_OUT_OF_RESOURCES;
+    }
+
+    // Run the test
+    selftest_status += fips_selftest_ippsHashUpdate_rmf(ippHashAlg_SHA256, pBuffer);
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+        return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    FreeTemporaryMemory(pBuffer);
+    return RETURN_SUCCESS;
+}
+
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestSHA384Update ()
+{
+    DEBUG ((DEBUG_INFO, "FipsSelftestSHA384Update\n"));
+    //------ FIPS-required part
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(HashUpdate_rmf)) {
+        return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    int BufferSize = 0;
+    selftest_status += fips_selftest_ippsHash_rmf_get_size(&BufferSize);
+
+    Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize);
+    if (pBuffer == NULL) {
+        return RETURN_OUT_OF_RESOURCES;
+    }
+
+    // Run the test
+    selftest_status += fips_selftest_ippsHashUpdate_rmf(ippHashAlg_SHA384, pBuffer);
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+        return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    FreeTemporaryMemory(pBuffer);
+    return RETURN_SUCCESS;
+}
+
+#if 0
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestHMAC ()
+{
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(HMACMessage_rmf)) {
+      return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    selftest_status += fips_selftest_ippsHMACMessage_rmf();
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+      return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    return RETURN_SUCCESS;
+}
+
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestHMACUpdate ()
+{
+    //------ FIPS-required part
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(HMACUpdate_rmf)) {
+        return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    int BufferSize = 0;
+    selftest_status += fips_selftest_ippsHMAC_rmf_get_size(&BufferSize);
+
+    Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize);
+    if (pBuffer == NULL) {
+        return RETURN_OUT_OF_RESOURCES;
+    }
+
+    // Run the test
+    selftest_status += fips_selftest_ippsHMACUpdate_rmf(pBuffer);
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+        return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    FreeTemporaryMemory(pBuffer);
+    return RETURN_SUCCESS;
+}
+#endif
+
+RETURN_STATUS
+EFIAPI
+IppCrypto2LibFipsSelftestRsaVerifyPSS ()
+{
+    DEBUG ((DEBUG_INFO, "FipsSelftestRsaVerifyPSS\n"));
+    //------ FIPS-required part
+    // 1. check that the function is FIPS-approved:
+    if(!ippcp_is_fips_approved_func(RSAVerify_PSS_rmf)) {
+        return RETURN_UNSUPPORTED; // cannot use this function in FIPS mode.
+    }
+
+    // 2. Run the Selftest
+    fips_test_status selftest_status = IPPCP_ALGO_SELFTEST_OK;
+
+    // Query buffer size for the test and allocate it (it can be done on Intel® Cryptography Primitives Library side with IPPCP_SELFTEST_USE_MALLOC=on)
+    int KeysBufferSize = 0;
+    selftest_status += fips_selftest_ippsRSASignVerify_PSS_rmf_get_size_keys(&KeysBufferSize);
+
+    Ipp8u *pKeysBuffer = AllocateTemporaryMemory(KeysBufferSize);
+    if (pKeysBuffer == NULL) {
+        return RETURN_OUT_OF_RESOURCES;
+    }
+
+    int BufferSize = 0;
+    selftest_status += fips_selftest_ippsRSASignVerify_PSS_rmf_get_size(&BufferSize, pKeysBuffer);
+
+    Ipp8u *pBuffer = AllocateTemporaryMemory(BufferSize);
+    if (pBuffer == NULL) {
+        FreeTemporaryMemory(pKeysBuffer);
+        return RETURN_OUT_OF_RESOURCES;
+    }
+
+    // Run the test
+    selftest_status += fips_selftest_ippsRSAVerify_PSS_rmf(pBuffer, pKeysBuffer);
+
+    // Check selftest status
+    if (IPPCP_ALGO_SELFTEST_OK != selftest_status) {
+        return RETURN_UNSUPPORTED; // selftest is not successful -> cannot use this function in FIPS mode.
+    }
+    //------ FIPS-required part ends (only needed before the first use of algorithm)
+
+    FreeTemporaryMemory(pKeysBuffer);
+    FreeTemporaryMemory(pBuffer);
+    return RETURN_SUCCESS;
+}
+
+RETURN_STATUS
+EFIAPI
+RunFipsSelftests ()
+{
+    DEBUG ((DEBUG_INFO, "Running FIPS selftests\n"));
+    // Run the selftests for SHA256
+    if(FixedPcdGet8(PcdCompSignHashAlg) == HASH_TYPE_SHA256) {
+        if (EFI_ERROR(IppCrypto2LibFipsSelftestSHA256())) {
+            return RETURN_UNSUPPORTED;
+        }
+        if (EFI_ERROR(IppCrypto2LibFipsSelftestSHA256Update())) {
+            return RETURN_UNSUPPORTED;
+        }
+    }
+
+    // Run the selftests for SHA384
+    if(FixedPcdGet8(PcdCompSignHashAlg) == HASH_TYPE_SHA384) {
+        if (EFI_ERROR(IppCrypto2LibFipsSelftestSHA384())) {
+            return RETURN_UNSUPPORTED;
+        }
+        if (EFI_ERROR(IppCrypto2LibFipsSelftestSHA384Update())) {
+            return RETURN_UNSUPPORTED;
+        }
+    }
+/* SM3 is not supported by FIPS
+    // Run the selftests for SM3
+    if (EFI_ERROR(IppCrypto2LibFipsSelftestSM3())) {
+        //return RETURN_UNSUPPORTED;
+    }
+    if (EFI_ERROR(IppCrypto2LibFipsSelftestSM3Update())) {
+        //return RETURN_UNSUPPORTED;
+    }
+*/
+/* HMAC is not being used yet
+    // Run the selftests for HMAC
+    if (EFI_ERROR(IppCrypto2LibFipsSelftestHMAC())) {
+        return RETURN_UNSUPPORTED;
+    }
+    if (EFI_ERROR(IppCrypto2LibFipsSelftestHMACUpdate())) {
+        return RETURN_UNSUPPORTED;
+    }
+*/
+    // Run the selftests for RSA PKCSv15 Verify
+    if ((FixedPcdGet8(PcdCompSignType) & IPP_RSALIB_PKCS_1_5) != 0) {
+        if (EFI_ERROR(IppCrypto2LibFipsSelftestRsaVerifyPkcsv15())) {
+            return RETURN_UNSUPPORTED;
+        }
+    }
+
+    // Run the selftests for RSA PSS Verify
+    if ((FixedPcdGet8(PcdCompSignType) & IPP_RSALIB_PSS) != 0) {
+        if (EFI_ERROR(IppCrypto2LibFipsSelftestRsaVerifyPSS())) {
+            return RETURN_UNSUPPORTED;
+        }
+    }
+    return RETURN_SUCCESS;
+}

BootloaderCommonPkg/Library/IppCrypto2Lib/rsa_verify.c

@@ -28,7 +28,7 @@ IPPAPI( const IppsHashMethod*, ippsHashMethod_SHA256Sbl, (void) )
 /* Wrapper function for RSA PKCS_1.5 Verify to make the inferface consistent.
  * Returns non-zero on failure, 0 on success.
  */
-int VerifyRsaPkcs1Signature (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *SignatureHdr,  CONST UINT8  *Hash)
+int VerifyRsaPkcs1Signature (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *SignatureHdr,  CONST UINT8  *Src, CONST UINT32  Size)
 {
   int    sz_n;
   int    sz_e;
@@ -136,7 +136,7 @@ int VerifyRsaPkcs1Signature (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *
   }
 
   if (pHashMethod != NULL) {
-    err = ippsRSAVerifyHash_PKCS1v15_rmf((const Ipp8u *)Hash, (Ipp8u *)SignatureHdr->Signature, &signature_verified, rsa_key_s, pHashMethod, scratch_buf);
+    err = ippsRSAVerify_PKCS1v15_rmf ((const Ipp8u *)Src, Size, (Ipp8u *)SignatureHdr->Signature, &signature_verified, rsa_key_s, pHashMethod, scratch_buf);
   } else {
     err = ippStsNoOperation;
   }
@@ -292,7 +292,7 @@ int VerifyRsaPssSignature (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *Si
  */
 RETURN_STATUS
 EFIAPI
-RsaVerify_Pkcs_1_5 (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *SignatureHdr,  CONST UINT8  *Hash)
+RsaVerify2_Pkcs_1_5 (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *SignatureHdr,  CONST UINT8  *Src, CONST UINT32 SrcSize)
 {
 
   if (FixedPcdGet8(PcdCompSignSchemeSupportedMask) & IPP_RSALIB_PKCS_1_5) {
@@ -300,7 +300,7 @@ RsaVerify_Pkcs_1_5 (CONST PUB_KEY_HDR *PubKeyHdr, CONST SIGNATURE_HDR *Signature
                     ((SignatureHdr->SigSize != RSA2048_MOD_SIZE) && (SignatureHdr->SigSize != RSA3072_MOD_SIZE))) {
       return RETURN_INVALID_PARAMETER;
     } else {
-      return VerifyRsaPkcs1Signature (PubKeyHdr, SignatureHdr, Hash) ? RETURN_SECURITY_VIOLATION : RETURN_SUCCESS ;
+      return VerifyRsaPkcs1Signature (PubKeyHdr, SignatureHdr, Src, SrcSize) ? RETURN_SECURITY_VIOLATION : RETURN_SUCCESS ;
     }
   } else {
       return RETURN_UNSUPPORTED;

BootloaderCommonPkg/Library/LoaderPerformanceLib/LoaderPerformancePrintLib.c

@@ -139,6 +139,8 @@ DefPerfIdToStr (
     return "FSP EndOfFirmware notify";
   case 0x31F0:
     return "End of stage2";
+  case 0x10D0:
+    return "FIPS Selftest run";
   }
   return NULL;
 }

BootloaderCommonPkg/Library/SecureBootLib/SecureBootLib.inf

@@ -40,3 +40,6 @@
   BootloaderCommonLib
   BootloaderLib
   RngLib
+
+[FixedPcd]
+  gPlatformCommonLibTokenSpaceGuid.PcdIppcrypto2Lib

BootloaderCommonPkg/Library/SecureBootLib/SecureBootRsa.c

@@ -86,7 +86,12 @@ DoRsaVerify (
       CopyMem (OutHash, Digest, DigestSize);
     }
 
+#if FixedPcdGetBool(PcdIppcrypto2Lib)
+    // RSA Pkcs 1.5 requires to pass message to be verified
+    Status = RsaVerify2_Pkcs_1_5 (PublicKey, SignatureHdr, Data, Length);
+#else
     Status = RsaVerify_Pkcs_1_5 (PublicKey, SignatureHdr, Digest);
+#endif
 
   } else if(SignatureHdr->SigType == SIGNING_TYPE_RSA_PSS) {
 

BootloaderCorePkg/BootloaderCorePkg.dsc

@@ -496,3 +496,5 @@
   # VS: Use default /Od for now
 !endif
 
+  MSFT:*_*_X64_DLINK_FLAGS = /ALIGN:64
+

BootloaderCorePkg/Stage1A/Stage1A.c

@@ -173,6 +173,18 @@ PrepareStage1B (
   LOADER_COMPRESSED_HEADER *Hdr;
   UINT8                     SignHashAlg;
 
+#if FixedPcdGetBool(PcdFipsSupport)
+  /* If FIPS is enabled, run FIPS self tests before any crypto algorithm is run.
+     Halt execution if any FIPS self test fails
+  */
+  Status = RunFipsSelftests ();
+  if (EFI_ERROR(Status)) {
+    CpuHalt ("FIPS Self Test Failed");
+  }
+  DEBUG((DEBUG_INFO, "FIPS Self-tests Status = Success\n"));
+  AddMeasurePoint (0x10D0);
+#endif
+
   // Load Stage 1B
   Status = GetComponentInfo (FLASH_MAP_SIG_STAGE1B, &Src, &Length);
   if (EFI_ERROR (Status)) {

BootloaderCorePkg/Stage1A/Stage1A.h

@@ -37,6 +37,7 @@
 #include <Guid/LoaderPlatformDataGuid.h>
 #include <Guid/PcdDataBaseSignatureGuid.h>
 #include <VerInfo.h>
+#include <Library/CryptoLib.h>
 
 /**
   Continue Stage 1A execution.

BootloaderCorePkg/Stage1A/Stage1A.inf

@@ -58,6 +58,7 @@
   ExtraBaseLib
   StageLib
   TopSwapLib
+  CryptoLib
 
 [Guids]
   gPlatformModuleTokenSpaceGuid
@@ -92,5 +93,8 @@
   gPlatformCommonLibTokenSpaceGuid.PcdCompSignHashAlg
   gPlatformModuleTokenSpaceGuid.PcdIdenticalTopSwapsBuilt
 
+[FixedPcd]
+  gPlatformCommonLibTokenSpaceGuid.PcdFipsSupport
+
 [Depex]
   TRUE

BuildLoader.py

@@ -182,6 +182,7 @@ class BaseBoard(object):
         self.ENABLE_SMM_REBASE     = 0
         self.ENABLE_IPP_CRYPTO_PERF = 0
         self.ENABLE_UPL_HANDOFF_FDT = 0
+        self.ENABLE_FIPS_SELFTEST   = 0
 
         self.SUPPORT_ARI           = 0
         self.SUPPORT_SR_IOV        = 0

Platform/ArrowlakeBoardPkg/BoardConfigArlh.py

@@ -73,6 +73,7 @@ class Board(BaseBoard):
         self.ENABLE_SMM_REBASE    = 2
         # 0: Disable 1: Enable IPP Crypto performance mesurement
         self.ENABLE_IPP_CRYPTO_PERF = 0
+        self.ENABLE_FIPS_SELFTEST   = 0
 
         # 0 - PCH UART0, 1 - PCH UART1, 2 - PCH UART2, 0xFF - EC UART 0x3F8
         self.DEBUG_PORT_NUMBER = 0xFF
@@ -123,6 +124,8 @@ class Board(BaseBoard):
         self.STAGE2_XIP           = 0
 
         self.STAGE1A_SIZE         = 0x00020000
+        if self.ENABLE_FIPS_SELFTEST:
+            self.STAGE1A_SIZE       += 0x0000A000
         self.STAGE1_STACK_SIZE    = 0x00003000
         self.STAGE1_DATA_SIZE     = 0x00014000
         self.FSP_M_STACK_TOP      = 0xFEFDFF00
@@ -172,7 +175,7 @@ class Board(BaseBoard):
 
         # If BUILD_IDENTICAL_TS is 0, the flash map sizings and layout
         # will need to be adjusted so that uCode and Stage 1B are in
-        # redudant partition
+        # redundant partition
         self.BUILD_IDENTICAL_TS    = 1
 
         # If ENABLE_SBL_RESILIENCY is 1, BiosRedAssistance FIT strap setting
@@ -406,6 +409,10 @@ class Board(BaseBoard):
 
         dsc['PcdsFixedAtBuild'] = ['gPlatformModuleTokenSpaceGuid.PcdAcpiTablesMaxEntry | 40']
 
+        if self.ENABLE_FIPS_SELFTEST:
+            dsc['PcdsFixedAtBuild'].append ('gPlatformCommonLibTokenSpaceGuid.PcdFipsSupport | TRUE')
+
+        dsc['PcdsFixedAtBuild'].append ('gPlatformCommonLibTokenSpaceGuid.PcdIppcrypto2Lib | TRUE')
 
         return dsc