[Qemu-devel] [PATCH v4 0/4] fw_cfg: Add edk2_add_host_crypto_policy()

[Philippe Mathieu-Daudé]

Hi,

This series consists of:
- add fw_cfg_add_file_from_host()
- add edk2_add_host_crypto_policy() and the Edk2Crypto object

The Edk2Crypto object is used to hold configuration values specific
to EDK2.

The edk2_add_host_crypto_policy() function loads crypto policies
from the host, and register them as fw_cfg named file items.

So far only the 'https' policy is supported.

A usercase example is the 'HTTPS Boof' feature of OVMF [*].

Usage example:

$ qemu-system-x86_64 \
    --object edk2_crypto,id=https,\
        ciphers=/etc/crypto-policies/back-ends/openssl.config,\
        cacerts=/etc/pki/ca-trust/extracted/edk2/cacerts.bin

(On Fedora these files are provided by the ca-certificates and
crypto-policies packages).

[*]: https://github.com/tianocore/edk2/blob/master/OvmfPkg/README

Since v3:
- Addressed Markus' comments (do not care about heap)
Since v2:
- Split of
Since v1:
- Addressed Michael and Laszlo comments.

Please review,

Phil.

$ git backport-diff -u fw_cfg_edk2_crypto_policies-v3
Key:
[####] : number of functional differences between upstream/downstream patch
The flags [FC] indicate (F)unctional and (C)ontextual differences, respectively

001/4:[0022] [FC] 'hw/nvram/fw_cfg: Add fw_cfg_add_file_from_host()'
002/4:[0085] [FC] 'hw/firmware: Add Edk2Crypto and 
edk2_add_host_crypto_policy()'
003/4:[0002] [FC] 'hw/i386: Use edk2_add_host_crypto_policy()'
004/4:[0002] [FC] 'hw/arm/virt: Use edk2_add_host_crypto_policy()'

v3: https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg02965.html
v2: https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg02522.html
v1: https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg01598.html

Philippe Mathieu-Daudé (4):
  hw/nvram/fw_cfg: Add fw_cfg_add_file_from_host()
  hw/firmware: Add Edk2Crypto and edk2_add_host_crypto_policy()
  hw/i386: Use edk2_add_host_crypto_policy()
  hw/arm/virt: Use edk2_add_host_crypto_policy()

 MAINTAINERS                             |   8 ++
 hw/Makefile.objs                        |   1 +
 hw/arm/virt.c                           |   7 +
 hw/firmware/Makefile.objs               |   1 +
 hw/firmware/uefi_edk2_crypto_policies.c | 182 ++++++++++++++++++++++++
 hw/i386/pc.c                            |   7 +
 hw/nvram/fw_cfg.c                       |  23 +++
 include/hw/firmware/uefi_edk2.h         |  30 ++++
 include/hw/nvram/fw_cfg.h               |  25 ++++
 9 files changed, 284 insertions(+)
 create mode 100644 hw/firmware/Makefile.objs
 create mode 100644 hw/firmware/uefi_edk2_crypto_policies.c
 create mode 100644 include/hw/firmware/uefi_edk2.h

-- 
2.20.1