From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-5.7 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,MENTIONS_GIT_HOSTING,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id F25B2C43613 for ; Thu, 20 Jun 2019 12:41:08 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id CBE142083B for ; Thu, 20 Jun 2019 12:41:08 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org CBE142083B Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:47378 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hdwNI-00011P-2l for qemu-devel@archiver.kernel.org; Thu, 20 Jun 2019 08:41:08 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:35874) by lists.gnu.org with esmtp (Exim 4.86_2) (envelope-from ) id 1hdw8N-00079j-99 for qemu-devel@nongnu.org; Thu, 20 Jun 2019 08:25:47 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1hdw8G-0002vH-1O for qemu-devel@nongnu.org; Thu, 20 Jun 2019 08:25:38 -0400 Received: from mx1.redhat.com ([209.132.183.28]:45229) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1hdw2h-0004VR-3s; Thu, 20 Jun 2019 08:19:53 -0400 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id A3A1F30C0DD9; Thu, 20 Jun 2019 12:19:39 +0000 (UTC) Received: from x1w.redhat.com (ovpn-204-106.brq.redhat.com [10.40.204.106]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 0D8E91001B3D; Thu, 20 Jun 2019 12:19:32 +0000 (UTC) From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= To: Laszlo Ersek , qemu-devel@nongnu.org Date: Thu, 20 Jun 2019 14:19:27 +0200 Message-Id: <20190620121930.9729-1-philmd@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.45]); Thu, 20 Jun 2019 12:19:44 +0000 (UTC) Content-Transfer-Encoding: quoted-printable X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] X-Received-From: 209.132.183.28 Subject: [Qemu-devel] [PATCH v5 0/3] fw_cfg: Add edk2_add_host_crypto_policy() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Peter Maydell , Andrew Jones , Eduardo Habkost , "Michael S. Tsirkin" , qemu-arm@nongnu.org, Paolo Bonzini , =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" Hi, This series add edk2_add_host_crypto_policy() and the Edk2Crypto object. The Edk2Crypto object is used to hold configuration values specific to EDK2. So far only the 'https' policy is supported. A usercase example is the 'HTTPS Boof' feature of OVMF [*]. Usage example: $ qemu-system-x86_64 \ --object edk2_crypto,id=3Dhttps,\ ciphers=3D/etc/crypto-policies/back-ends/openssl.config,\ cacerts=3D/etc/pki/ca-trust/extracted/edk2/cacerts.bin (On Fedora these files are provided by the ca-certificates and crypto-policies packages). [*]: https://github.com/tianocore/edk2/blob/master/OvmfPkg/README Since v4: - Addressed Laszlo comments (see patch#1 description) Since v3: - Addressed Markus' comments (do not care about heap) Since v2: - Split of Since v1: - Addressed Michael and Laszlo comments. Please review, Phil. $ git backport-diff -u fw_cfg_edk2_crypto_policies-v3 Key: [####] : number of functional differences between upstream/downstream pat= ch The flags [FC] indicate (F)unctional and (C)ontextual differences, respec= tively 001/3:[0164] [FC] 'hw/firmware: Add Edk2Crypto and edk2_add_host_crypto_p= olicy()' 002/3:[----] [--] 'hw/i386: Use edk2_add_host_crypto_policy()' 003/3:[----] [--] 'hw/arm/virt: Use edk2_add_host_crypto_policy()' v4: https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg04300.html v3: https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg02965.html v2: https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg02522.html v1: https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg01598.html Philippe Mathieu-Daud=C3=A9 (3): hw/firmware: Add Edk2Crypto and edk2_add_host_crypto_policy() hw/i386: Use edk2_add_host_crypto_policy() hw/arm/virt: Use edk2_add_host_crypto_policy() MAINTAINERS | 2 + hw/Makefile.objs | 1 + hw/arm/virt.c | 7 + hw/firmware/Makefile.objs | 1 + hw/firmware/uefi_edk2_crypto_policies.c | 209 ++++++++++++++++++++++++ hw/i386/pc.c | 7 + include/hw/firmware/uefi_edk2.h | 30 ++++ 7 files changed, 257 insertions(+) create mode 100644 hw/firmware/Makefile.objs create mode 100644 hw/firmware/uefi_edk2_crypto_policies.c create mode 100644 include/hw/firmware/uefi_edk2.h --=20 2.20.1