efi_loader: handle EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS

We don't yet support EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS for file
based variables, but we should pass it to TEE based variable stores.

Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>

diff --git a/include/efi.h b/include/efi.h
index 62cfb993d2e344113a39faf515edc3ce360ab794..c3c4b93f860a22a8aec339c6dbf25851f409372a 100644 (file)
--- a/include/efi.h
+++ b/include/efi.h
@@ -507,7 +507,8 @@ extern char _binary_u_boot_bin_start[], _binary_u_boot_bin_end[];
                                EFI_VARIABLE_HARDWARE_ERROR_RECORD | \
                                EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | \
                                EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | \
-                               EFI_VARIABLE_APPEND_WRITE)
+                               EFI_VARIABLE_APPEND_WRITE | \
+                               EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS)
 
 /**
  * efi_get_priv() - Get access to the EFI-private information

diff --git a/lib/efi_loader/efi_variable.c b/lib/efi_loader/efi_variable.c
index b2f8ebdd78e1153208f0f1a24933b5dfcfda41a3..6fe3792a12a5382db59bae589f3611f4bedacafc 100644 (file)
--- a/lib/efi_loader/efi_variable.c
+++ b/lib/efi_loader/efi_variable.c
@@ -235,8 +235,12 @@ efi_status_t efi_set_variable_int(const u16 *variable_name,
        if (data_size && !data)
                return EFI_INVALID_PARAMETER;
 
-       /* EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated */
-       if (attributes & EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)
+       /*
+        * EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS is deprecated.
+        * We don't support EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS.
+        */
+       if (attributes & (EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS | \
+                         EFI_VARIABLE_ENHANCED_AUTHENTICATED_ACCESS))
                return EFI_UNSUPPORTED;
 
        /* Make sure if runtime bit is set, boot service bit is set also */