I never knew what this option did, but the answer is ... strange! It's only defined for linux, in os-posix.c. When called, it calls fips_set_state(true), located in osdep.c.
This will read /proc/sys/crypto/fips_enabled and set the static global 'fips_enabled' to true if this setting is on. (Tangent: what does *this* setting actually control? Should QEMU meaningfully change its behavior when it's set?) This static global is exposed via the getter fips_get_state(). This function is called only by vnc.c, and appears to disable the use of the password option for -vnc. This seems very high-level and abstract for something that ultimately only disables VNC password authentication. Is this misleadingly abstract? The docs state: "enable FIPS 140-2 compliance" Like hell it does. Can we deprecate this? It was added in 2012 and never seemed to pursue the mission laid out in the help file. If we do still want it, the documentation should be changed dramatically to reflect what it actually does. This is so at risk of bit-rot, and a misleading crypto flag is certainly worse than no crypto flag. I think it should just go. (If we really do want to keep it, it should probably go under -global somewhere instead to help reduce flag clutter, but we'd need to have a chat about what fips compliance means for literally every other spot in QEMU that is capable of using or receiving a cleartext password.) --js
