From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([209.51.188.92]:48903) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1h2mdL-0001ED-1c for qemu-devel@nongnu.org; Sat, 09 Mar 2019 19:48:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1h2mdJ-0006UW-J7 for qemu-devel@nongnu.org; Sat, 09 Mar 2019 19:48:06 -0500 Received: from mx1.redhat.com ([209.132.183.28]:51294) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1h2mdJ-0006SF-Bu for qemu-devel@nongnu.org; Sat, 09 Mar 2019 19:48:05 -0500 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 6844F3084246 for ; Sun, 10 Mar 2019 00:48:02 +0000 (UTC) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Date: Sun, 10 Mar 2019 01:47:45 +0100 Message-Id: <20190310004749.27029-1-philmd@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Subject: [Qemu-devel] [PATCH v3 0/4] fw_cfg: Add edk2_add_host_crypto_policy() List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Laszlo Ersek , Gerd Hoffmann , "Michael S. Tsirkin" , qemu-devel@nongnu.org Cc: Markus Armbruster , Eric Blake , "Daniel P . Berrange" , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Hi, This series consists of: - add fw_cfg_add_file_from_host() - add edk2_add_host_crypto_policy() and the Edk2Crypto object The Edk2Crypto object is used to hold configuration values specific to EDK2. The edk2_add_host_crypto_policy() function loads crypto policies from the host, and register them as fw_cfg named file items. So far only the 'https' policy is supported. A usercase example is the 'HTTPS Boof' feature of OVMF [*]. Usage example: $ qemu-system-x86_64 \ --object edk2_crypto,id=3Dhttps,\ ciphers=3D/etc/crypto-policies/back-ends/openssl.config,\ cacerts=3D/etc/pki/ca-trust/extracted/edk2/cacerts.bin (On Fedora these files are provided by the ca-certificates and crypto-policies packages). [*]: https://github.com/tianocore/edk2/blob/master/OvmfPkg/README Since v2: - Split of Since v1: - Addressed Michael and Laszlo comments. Please review, Phil. v2: https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg02522.html v1: https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg01598.html Philippe Mathieu-Daud=C3=A9 (4): hw/nvram/fw_cfg: Add fw_cfg_add_file_from_host() hw/firmware: Add Edk2Crypto and edk2_add_host_crypto_policy() hw/i386: Use edk2_add_host_crypto_policy() hw/arm/virt: Use edk2_add_host_crypto_policy() MAINTAINERS | 8 ++ hw/Makefile.objs | 1 + hw/arm/virt.c | 7 + hw/firmware/Makefile.objs | 1 + hw/firmware/uefi_edk2_crypto_policies.c | 177 ++++++++++++++++++++++++ hw/i386/pc.c | 7 + hw/nvram/fw_cfg.c | 21 +++ include/hw/firmware/uefi_edk2.h | 28 ++++ include/hw/nvram/fw_cfg.h | 23 +++ 9 files changed, 273 insertions(+) create mode 100644 hw/firmware/Makefile.objs create mode 100644 hw/firmware/uefi_edk2_crypto_policies.c create mode 100644 include/hw/firmware/uefi_edk2.h --=20 2.20.1