Hi,
This series consists of:
- add fw_cfg_add_file_from_host()
- add edk2_add_host_crypto_policy() and the Edk2Crypto object
The Edk2Crypto object is used to hold configuration values specific
to EDK2.
The edk2_add_host_crypto_policy() function loads crypto policies
from the host, and register them as fw_cfg named file items.
So far only the 'https' policy is supported.
A usercase example is the 'HTTPS Boof' feature of OVMF [*].
Usage example:
$ qemu-system-x86_64 \
--object edk2_crypto,id=https,\
ciphers=/etc/crypto-policies/back-ends/openssl.config,\
cacerts=/etc/pki/ca-trust/extracted/edk2/cacerts.bin
(On Fedora these files are provided by the ca-certificates and
crypto-policies packages).
[*]: https://github.com/tianocore/edk2/blob/master/OvmfPkg/README
Since v2:
- Split of
Since v1:
- Addressed Michael and Laszlo comments.
Please review,
Phil.
v2: https://lists.gnu.org/archive/html/qemu-devel/2019-03/msg02522.html
v1: https://lists.gnu.org/archive/html/qemu-devel/2018-12/msg01598.html
Philippe Mathieu-Daudé (4):
hw/nvram/fw_cfg: Add fw_cfg_add_file_from_host()
hw/firmware: Add Edk2Crypto and edk2_add_host_crypto_policy()
hw/i386: Use edk2_add_host_crypto_policy()
hw/arm/virt: Use edk2_add_host_crypto_policy()
MAINTAINERS | 8 ++
hw/Makefile.objs | 1 +
hw/arm/virt.c | 7 +
hw/firmware/Makefile.objs | 1 +
hw/firmware/uefi_edk2_crypto_policies.c | 177 ++++++++++++++++++++++++
hw/i386/pc.c | 7 +
hw/nvram/fw_cfg.c | 21 +++
include/hw/firmware/uefi_edk2.h | 28 ++++
include/hw/nvram/fw_cfg.h | 23 +++
9 files changed, 273 insertions(+)
create mode 100644 hw/firmware/Makefile.objs
create mode 100644 hw/firmware/uefi_edk2_crypto_policies.c
create mode 100644 include/hw/firmware/uefi_edk2.h
--
2.20.1
