/** @file
  Provide support functions for Secure Boot.

;******************************************************************************
;* Copyright (c) 2012 - 2021, Insyde Software Corp. All Rights Reserved.
;*
;* You may not reproduce, distribute, publish, display, perform, modify, adapt,
;* transmit, broadcast, present, recite, release, license or otherwise exploit
;* any part of this publication in any form, by any means, without the prior
;* written permission of Insyde Software Corporation.
;*
;******************************************************************************
*/


#include "SecureBoot.h"
#include "AuthService.h"
#include "VariableLock.h"
#include "SensitiveVariable.h"
#include "VariableCache.h"
#include "VarCheck.h"

SMI_SUB_FUNCTION_MAP mSecureBootFunctionsTable [] = {
  { ADD_HASH_IMAGE_FUN_NUM,                   SmmAddFileHashImage           , FALSE}, \
  { SECURE_BOOT_ENFORCE_FUN_NUM,              SmmUpdateSecureBootEnforce    , FALSE}, \
  { CLEAR_ALL_SECURE_SETTINGS_FUN_NUM,        SmmClearAllSecureSettings     , FALSE}, \
  { RESTORE_FACTORY_DEFAULT_FUN_NUM,          SmmRestoreFactoryDefault      , FALSE}, \
  { UPDATE_PK_FUN_NUM,                        SmmUpdatePkVariable           , FALSE}, \
  { UPDATE_KEK_FUN_NUM,                       SmmUpdateKekVariable          , FALSE}, \
  { UPDATE_DB_FUN_NUM,                        SmmUpdateDbVariable           , FALSE}, \
  { UPDATE_DBX_FUN_NUM,                       SmmUpdateDbxVariable          , FALSE}, \
  { UPDATE_DBT_FUN_NUM,                       SmmUpdateDbtVariable          , FALSE}, \
  { UPDATE_DBR_FUN_NUM,                       SmmUpdateDbrVariable          , FALSE}, \
  { CLEAR_DEPLOYED_MODE_VALUE_FUN_NUM,        SmmClearDeployedMode          , FALSE}, \
  { SELECT_SECURE_BOOT_MODE_FUN_NUM,          SmmSelectSecureBootMode       , FALSE}, \
  { SET_SENSITIVE_VARIABLE_FUN_NUM,           SmmSetSensitiveVariable       ,  TRUE}, \
  { SMM_VARIABLE_LOCK_FUN_NUM,                SmmCreateVariableLockList     ,  TRUE}, \
  { LEGACY_BOOT_SMI_FUN_NUM,                  SmmLegacyBootEvent            ,  TRUE}, \
  { SMM_SET_VARIABLE_SMI_FUN_NUM,             SmmInternalSetVariable        ,  TRUE}, \
  { DISABLE_VARIABLE_CACHE_SMI_FUN_NUM,       SmmDisableVariableCache       ,  TRUE}, \
  { DISABLE_SECURE_BOOT_SMI_FUN_NUM,          SmmDisableSecureBootSmi       ,  TRUE}, \
  { UPDATE_VARIABLE_PROPERTY_FUN_NUM,         SmmUpdateVariablePropertySmi  ,  TRUE}, \
  { 0,                                        NULL                          ,  TRUE}
  };

SECURE_BOOT_SUB_FUNCTION_MAP mNonSmiSecureBootFunctionsTable[] = {
  { EFI_ADD_HASH_IMMAGE_NAME,             RuntimeDxeAddFileHashImage         }, \
  { EFI_SECURE_BOOT_ENFORCE_NAME,         RuntimeDxeUpdateSecureBootEnforce  }, \
  { EFI_CLEAR_ALL_SECURE_SETTINGS_NAME,   RuntimeDxeClearAllSecureSettings   }, \
  { EFI_RESTORE_FACTORY_DEFAULT_NAME,     RuntimeDxeRestoreFactoryDefault    }, \
  { EFI_PLATFORM_KEY_NAME,                RuntimeDxeUpdatePkVariable         }, \
  { EFI_KEY_EXCHANGE_KEY_NAME,            RuntimeDxeUpdateKekVariable        }, \
  { EFI_IMAGE_SECURITY_DATABASE,          RuntimeDxeUpdateDbVariable         }, \
  { EFI_IMAGE_SECURITY_DATABASE1,         RuntimeDxeUpdateDbxVariable        }, \
  { EFI_IMAGE_SECURITY_DATABASE2,         RuntimeDxeUpdateDbtVariable        }, \
  { EFI_IMAGE_SECURITY_DATABASE3,         RuntimeDxeUpdateDbrVariable        }, \
  { EFI_CLEAR_DEPLOYED_MODE_NAME,         RuntimeDxeClearDeployedMode        }, \
  { NULL,                                 NULL                               }
  };


/**
  This function is an internal function which used for update normal
  authenticated

  @param  VariableName          Name of Variable to be found
  @param  VendorGuid            Variable vendor GUID
  @param  DataSize              Size of Data found. If size is less than the data, this value contains the required size.
  @param  Data                  Data pointer
  @param  UpdateKey             Boolean value to indicate want to update key or not.

Retruns:

  @retval EFI_SUCCESS           The update operation is success.
  @return EFI_OUT_OF_RESOURCES  Variable region is full, can not write other data into this region.

**/
STATIC
EFI_STATUS
InternalUpdateAuthVariable (
  IN CHAR16                  *VariableName,
  IN EFI_GUID                *VendorGuid,
  IN UINTN                   DataSize,
  IN VOID                    *Data,
  IN BOOLEAN                 UpdateKey
  )
{
  UINT8                            *VariableBuffer;
  EFI_VARIABLE_AUTHENTICATION      *CertData;
  UINTN                            VariableCount;
  VARIABLE_POINTER_TRACK           Variable;
  UINT32                           KeyIndex;


  if (UpdateKey) {
    if (DataSize < AUTHINFO_SIZE) {
      return EFI_UNSUPPORTED;
    }

    VariableBuffer = (UINT8 *) Data;
    CertData = (EFI_VARIABLE_AUTHENTICATION *) VariableBuffer;

    FindVariableByLifetime (
      VariableName,
      VendorGuid,
      &Variable,
      &VariableCount,
      &mVariableModuleGlobal->VariableBase
      );

    KeyIndex = 0;
    return UpdateVariable (
             VariableName,
             VendorGuid,
             VariableBuffer + AUTHINFO_SIZE,
             DataSize - AUTHINFO_SIZE,
             EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
             EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
             KeyIndex,
             CertData->MonotonicCount,
             &Variable,
             NULL,
             &mVariableModuleGlobal->VariableBase
             );
  } else {
    FindVariableByLifetime (
      VariableName,
      VendorGuid,
      &Variable,
      &VariableCount,
      &mVariableModuleGlobal->VariableBase
      );

   return UpdateVariable (
             VariableName,
             VendorGuid,
             Data,
             DataSize,
             EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
             EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
             0,
             0,
             &Variable,
             NULL,
             &mVariableModuleGlobal->VariableBase
             );
  }
}

/**
  Internal function to update secure boot database variable.

  @param[in]  VariableName  Name of Variable to be found
  @param[in]  VendorGuid    Variable vendor GUID
  @param[in]  DataSize      Size of Data found. If size is less than the data, this value contains the required size.
  @param[in]  Data          Data pointer
  @param[in]  UpdateType    The Input update type. This update type should be UPDATE_AUTHENTICATED_VARIABLE
                            or APPEND_AUTHENTICATED_VARIABLE.

  @retval EFI_SUCCESS            update secure boot database variable successfully.
  @retval EFI_INVALID_PARAMETER  Any input parameter is incorrect.
  @retval Other                  Set variable failed in this function.
**/
STATIC
EFI_STATUS
InternalUpdateSecureDatabaseVariable (
  IN CHAR16                  *VariableName,
  IN EFI_GUID                *VendorGuid,
  IN UINTN                   DataSize,
  IN VOID                    *Data,
  IN UINT8                   UpdateType
  )
{
  EFI_VARIABLE_AUTHENTICATION_2    *CertData;
  UINT8                            *VariableBuffer;
  EFI_SIGNATURE_LIST               *SigList;
  UINTN                            VariableCount;
  VARIABLE_POINTER_TRACK           Variable;
  EFI_STATUS                       Status;
  UINT32                           Attribute;
  BOOLEAN                          DelPk;

  if (VariableName == NULL || VendorGuid == NULL || Data == NULL) {
    return EFI_INVALID_PARAMETER;
  }

  if (UpdateType != UPDATE_AUTHENTICATED_VARIABLE && UpdateType != APPEND_AUTHENTICATED_VARIABLE) {
    return EFI_INVALID_PARAMETER;
  }

  if (!IsSecureDatabaseVariable (VariableName, VendorGuid)) {
    return EFI_INVALID_PARAMETER;
  }

  if (IsPkVariable (VariableName, VendorGuid) && UpdateType != UPDATE_AUTHENTICATED_VARIABLE) {
    return EFI_INVALID_PARAMETER;
  }

  if (DataSize < AUTHINFO2_SIZE (Data) || DataSize > MAX_VARIABLE_SIZE) {
    return EFI_INVALID_PARAMETER;
  }

  VariableBuffer = (UINT8 *) Data;
  CertData = (EFI_VARIABLE_AUTHENTICATION_2 *) VariableBuffer;
  if ((CertData->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) ||
      !CompareGuid (&CertData->AuthInfo.CertType, &gEfiCertPkcs7Guid)) {
    return EFI_INVALID_PARAMETER;;
  }

  SigList  = (EFI_SIGNATURE_LIST *) (VariableBuffer + AUTHINFO2_SIZE (VariableBuffer));

  FindVariableByLifetime (
    VariableName,
    VendorGuid,
    &Variable,
    &VariableCount,
    &mVariableModuleGlobal->VariableBase
    );

  Attribute = EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
  if (UpdateType == APPEND_AUTHENTICATED_VARIABLE) {
    Attribute |= EFI_VARIABLE_APPEND_WRITE;
  }
  DelPk = (DataSize - AUTHINFO2_SIZE (VariableBuffer)) == 0 ? TRUE : FALSE;
  Status = UpdateVariable (
             VariableName,
             VendorGuid,
             SigList,
             DataSize - AUTHINFO2_SIZE (VariableBuffer),
             Attribute,
             0,
             0,
             &Variable,
             &CertData->TimeStamp,
             &mVariableModuleGlobal->VariableBase
             );
  ASSERT_EFI_ERROR (Status);
  if (EFI_ERROR (Status)) {
   return Status;
  }
  //
  // Update secure boot mode if PK present is changed.
  //
  if (IsPkVariable (VariableName, VendorGuid)) {
    if (mPlatformMode == USER_MODE && DelPk && !DoesPkExist ()) {
      ChangeSecureBootModeByDeletePk ();
    } else if (mPlatformMode == SETUP_MODE && !DelPk)  {
      ChangeSecureBootModeByInsertPk ();
    }
  }
  //
  // Set "CustomSecurity" variable to 1 indicates secure boot database has been modified by user.
  //
  Status = UpdateCustomSecurityStatus (1);
  ASSERT_EFI_ERROR (Status);

  return Status;

}

/**
  Append new hash image to EFI_IMAGE_SECURITY_DATABASE (db)

  @param  VariableName                Name of Variable to be found.
  @param  VendorGuid                  Variable vendor GUID.
  @param  Data                        Data pointer.
  @param  DataSize                    Size of Data found. If size is less than the
                                      data, this value contains the required size.
  @param  Attributes                  Attribute value of the variable.

  @return EFI_INVALID_PARAMETER       Invalid parameter.
  @return EFI_WRITE_PROTECTED         Variable is write-protected and needs authentication with
                                      EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
  @return EFI_SECURITY_VIOLATION      The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
                                      set, but the AuthInfo does NOT pass the validation
                                      check carried out by the firmware.
  @return EFI_SUCCESS                 Variable is not write-protected or pass validation successfully.

**/
EFI_STATUS
CommonAddFileHashImage (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  EFI_SIGNATURE_LIST               *SigList;
  EFI_VARIABLE_AUTHENTICATION_2    *CertData2;
  UINTN                            VariableCount;
  VARIABLE_POINTER_TRACK           Variable;
  EFI_STATUS                       Status;

  if (DataSize != (AUTHINFO2_SIZE (Data) + sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + SHA256_DIGEST_SIZE) &&
      DataSize != (AUTHINFO2_SIZE (Data) + sizeof (EFI_SIGNATURE_LIST) + sizeof (EFI_SIGNATURE_DATA) - 1 + SHA1_DIGEST_SIZE)) {
    return EFI_UNSUPPORTED;
  }

  CertData2 = (EFI_VARIABLE_AUTHENTICATION_2 *) Data;
  SigList = (EFI_SIGNATURE_LIST *) ((UINT8 *) Data + AUTHINFO2_SIZE (Data));

  if (!CompareGuid (&SigList->SignatureType, &gEfiCertSha256Guid) &&
      !CompareGuid (&SigList->SignatureType, &gEfiCertSha1Guid)) {
    return EFI_UNSUPPORTED;
  }

  FindVariableByLifetime (
    EFI_IMAGE_SECURITY_DATABASE,
    &gEfiImageSecurityDatabaseGuid,
    &Variable,
    &VariableCount,
    &mVariableModuleGlobal->VariableBase
    );

  Status = UpdateVariable (
             VariableName,
             VendorGuid,
             SigList,
             DataSize - AUTHINFO2_SIZE (Data),
             Attributes,
             0,
             0,
             &Variable,
             &CertData2->TimeStamp,
             &mVariableModuleGlobal->VariableBase
             );
 ASSERT_EFI_ERROR (Status);
 if (EFI_ERROR (Status)) {
  return Status;
 }
 //
 // Set "CustomSecurity" variable to 1 indicates secure boot database has been modified by user.
 //
 Status = UpdateCustomSecurityStatus (1);
 ASSERT_EFI_ERROR (Status);

 return Status;
}

/**
  This function uses to check secure boot enforce is enabled or disabled.

  @retval TRUE     Secure boot enforce is enabled.
  @retval FALSE    Secure boot enforce is disabled.
**/
BOOLEAN
IsSecureBootEnforceEnabled (
  VOID
  )
{
  UINTN                            VariableCount;
  VARIABLE_POINTER_TRACK           Variable;
  UINT8                            *SecureBootEnforceEnabled;

  VariableCount = 0;
  FindVariableByLifetime (
    EFI_SECURE_BOOT_ENFORCE_NAME,
    &gEfiGenericVariableGuid,
    &Variable,
    &VariableCount,
    &mVariableModuleGlobal->VariableBase
    );
  ASSERT (Variable.CurrPtr != NULL && DataSizeOfVariable (Variable.CurrPtr) == sizeof (UINT8));
  SecureBootEnforceEnabled = GetVariableDataPtr (Variable.CurrPtr);

  return (BOOLEAN) *SecureBootEnforceEnabled;
}

/**
  Update EFI_SECURE_BOOT_ENFORCE_NAME variable.

  @param  VariableName                Name of Variable to be found.
  @param  VendorGuid                  Variable vendor GUID.
  @param  Data                        Data pointer.
  @param  DataSize                    Size of Data found. If size is less than the
                                      data, this value contains the required size.

  @return EFI_INVALID_PARAMETER       Invalid parameter.
  @return EFI_WRITE_PROTECTED         Variable is write-protected and needs authentication with
                                      EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
  @return EFI_SECURITY_VIOLATION      The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
                                      set, but the AuthInfo does NOT pass the validation
                                      check carried out by the firmware.
  @return EFI_SUCCESS                 Variable is not write-protected or pass validation successfully.

**/
EFI_STATUS
CommoneUpdateSecureBootEnforce (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize
  )
{
  EFI_STATUS        Status;

  if (DataSize != (AUTHINFO_SIZE + sizeof (UINT8))) {
    return EFI_UNSUPPORTED;
  }

  Status = InternalUpdateAuthVariable (
             VariableName,
             VendorGuid,
             DataSize,
             Data,
             TRUE
             );

  ASSERT_EFI_ERROR (Status);
  if (EFI_ERROR (Status)) {
   return Status;
  }

  if (!IsSecureBootEnforceEnabled ()) {
    UpdatePlatformBootMode (SECURE_BOOT_MODE_DISABLE, &mVariableModuleGlobal->VariableBase);
  }

  return Status;
}
/**
  This function uses to clear PK, KEK, db and dbx variable

  @retval EFI_SUCCESS  Clear secure settins successful.
  @return Other        Any error occurred while clearing secure settins

**/
STATIC
EFI_STATUS
CommonClearAllSecureSettings (
  VOID
  )
{
  EFI_STATUS     Status;

  Status = ClearSecureSettings (&mVariableModuleGlobal->VariableBase);
  ASSERT_EFI_ERROR (Status);
  if (EFI_ERROR (Status)) {
    return Status;
  }
  //
  // Set "CustomSecurity" variable to 1 indicates secure boot database has been modified by user.
  //
  Status = UpdateCustomSecurityStatus (1);
  ASSERT_EFI_ERROR (Status);
  return Status;
}

/**
  This function uses to clear DeployedMode value to 0 and update the related
  variables' property.

  @retval EFI_SUCCESS  Clear DeployedMode value successful.
  @return Other        Any error occurred while clear DeployedMode value to 0
**/
EFI_STATUS
CommonClearDeployedMode (
  VOID
  )
{
  EFI_STATUS              Status;

  if (!FeaturePcdGet (PcdH2OCustomizedSecureBootSupported)) {
    return EFI_UNSUPPORTED;
  }
  Status = UpdateDeployedModeValue (0);
  if (Status == EFI_SUCCESS) {
    UpdateDeployedModeProperty (0);
    UpdateAuditModeProperty (0);
  }
  return Status;
}

/**
  UUpdate "RestoreFactoryDefault" EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS variable.

  @param  VariableName                Name of Variable to be found.
  @param  VendorGuid                  Variable vendor GUID.
  @param  Data                        Data pointer.
  @param  DataSize                    Size of Data found. If size is less than the
                                      data, this value contains the required size.

  @return EFI_INVALID_PARAMETER       Invalid parameter.
  @return EFI_WRITE_PROTECTED         Variable is write-protected and needs authentication with
                                      EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
  @return EFI_SECURITY_VIOLATION      The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
                                      set, but the AuthInfo does NOT pass the validation
                                      check carried out by the firmware.
  @return EFI_SUCCESS                 Variable is not write-protected or pass validation successfully.

**/
EFI_STATUS
CommoneRestoreFactoryDefault (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize
  )
{
  EFI_STATUS         Status;
  if (DataSize != (AUTHINFO_SIZE + sizeof (UINT8))) {
     return EFI_UNSUPPORTED;
  }

  Status = InternalUpdateAuthVariable (
             VariableName,
             VendorGuid,
             DataSize,
             Data,
             TRUE
             );

  ASSERT_EFI_ERROR (Status);
  if (EFI_ERROR (Status)) {
   return Status;
  }
 //
 // Set "CustomSecurity" variable to 0 indicates secure boot database has been restored to factory by user.
 //
  Status = UpdateCustomSecurityStatus (0);
  ASSERT_EFI_ERROR (Status);
  return Status;
}


/**
  Add selected file hash image to allowed database (db)

  @retval EFI_SUCCESS     Add image hash to allowed database (db) successful.
  @return Other           Any error occurred while updating hash to allowed database (db)

**/
EFI_STATUS
SmmAddFileHashImage (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;

  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;
  return CommonAddFileHashImage (
           EFI_IMAGE_SECURITY_DATABASE,
           &gEfiImageSecurityDatabaseGuid,
           VariableBuffer,
           BufferSize,
           EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
           EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS |
           EFI_VARIABLE_APPEND_WRITE
           );
}

/**
  Update "SecureBootEnforce" EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS variable

  @retval EFI_SUCCESS   Update "SecureBootEnforce" variable successful.
  @return Other         Any error occurred while updating "SecureBootEnforce" variable

**/
EFI_STATUS
SmmUpdateSecureBootEnforce (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;

  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;
  return CommoneUpdateSecureBootEnforce (
           EFI_SECURE_BOOT_ENFORCE_NAME,
           &gEfiGenericVariableGuid,
           VariableBuffer,
           BufferSize
           );
}

/**
  This function uses to clear PK, KEK, db and dbx variable

  @retval EFI_SUCCESS  Clear secure settins successful.
  @return Other        Any error occurred while clearing secure settins

**/
EFI_STATUS
SmmClearAllSecureSettings (
  VOID
  )
{
  return CommonClearAllSecureSettings ();
}

/**
  Update "RestoreFactoryDefault" EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS variable

  @retval EFI_SUCCESS  Update "RestoreFactoryDefault" variable successful.
  @return Other        Any error occurred while updating "RestoreFactoryDefault" variable

**/
EFI_STATUS
SmmRestoreFactoryDefault (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;

  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;

  return CommoneRestoreFactoryDefault (
           EFI_RESTORE_FACTORY_DEFAULT_NAME,
           &gEfiGenericVariableGuid,
           VariableBuffer,
           BufferSize
           );
}

/**
  This function uses to update PK variable.

  @retval EFI_SUCCESS            Update PK variable successfully.
  @retval Other                  Any error occurred while updating PK variable.
**/
EFI_STATUS
SmmUpdatePkVariable (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;
  EFI_STATUS                       Status;
  UINT8                            Updatetype;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }

  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;
  Updatetype = *(VariableBuffer + AUTHINFO2_SIZE (VariableBuffer) - 1);

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_PLATFORM_KEY_NAME,
             &gEfiGlobalVariableGuid,
             BufferSize,
             VariableBuffer,
             Updatetype
             );
  return Status;
}

/**
  This function uses to update KEK variable.

  @retval EFI_SUCCESS            Update KEK variable successfully.
  @retval Other                  Any error occurred while updating KEK variable.
**/
EFI_STATUS
SmmUpdateKekVariable (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;
  EFI_STATUS                       Status;
  UINT8                            Updatetype;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }

  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;
  Updatetype = *(VariableBuffer + AUTHINFO2_SIZE (VariableBuffer) - 1);

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_KEY_EXCHANGE_KEY_NAME,
             &gEfiGlobalVariableGuid,
             BufferSize,
             VariableBuffer,
             Updatetype
             );
  return Status;
}

/**
  This function uses to update db variable.

  @retval EFI_SUCCESS            Update db variable successfully.
  @retval Other                  Any error occurred while updating db variable
**/
EFI_STATUS
SmmUpdateDbVariable (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;
  EFI_STATUS                       Status;
  UINT8                            Updatetype;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }


  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;
  Updatetype = *(VariableBuffer + AUTHINFO2_SIZE (VariableBuffer) - 1);

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_IMAGE_SECURITY_DATABASE,
             &gEfiImageSecurityDatabaseGuid,
             BufferSize,
             VariableBuffer,
             Updatetype
             );
  return Status;
}

/**
  This function uses to update dbx variable.

  @retval EFI_SUCCESS            Update dbx variable successfully.
  @retval Other                  Any error occurred while updating dbx variable
**/
EFI_STATUS
SmmUpdateDbxVariable (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;
  EFI_STATUS                       Status;
  UINT8                            Updatetype;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }


  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;
  Updatetype = *(VariableBuffer + AUTHINFO2_SIZE (VariableBuffer) - 1);

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_IMAGE_SECURITY_DATABASE1,
             &gEfiImageSecurityDatabaseGuid,
             BufferSize,
             VariableBuffer,
             Updatetype
             );
  return Status;
}

/**
  This function uses to update dbt variable.

  @retval EFI_SUCCESS            Update dbt variable successfully.
  @retval Other                  Any error occurred while updating dbt variable
**/
EFI_STATUS
SmmUpdateDbtVariable (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;
  EFI_STATUS                       Status;
  UINT8                            Updatetype;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }


  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;
  Updatetype = *(VariableBuffer + AUTHINFO2_SIZE (VariableBuffer) - 1);

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_IMAGE_SECURITY_DATABASE2,
             &gEfiImageSecurityDatabaseGuid,
             BufferSize,
             VariableBuffer,
             Updatetype
             );
  return Status;
}


/**
  This function uses to update dbr variable.

  @retval EFI_SUCCESS            Update dbr variable successfully.
  @retval Other                  Any error occurred while updating dbr variable
**/
EFI_STATUS
SmmUpdateDbrVariable (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;
  EFI_STATUS                       Status;
  UINT8                            Updatetype;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }


  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;
  Updatetype = *(VariableBuffer + AUTHINFO2_SIZE (VariableBuffer) - 1);

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_IMAGE_SECURITY_DATABASE3,
             &gEfiImageSecurityDatabaseGuid,
             BufferSize,
             VariableBuffer,
             Updatetype
             );
  return Status;
}

/**
  This function uses to clear DeployedMode variable.

  @retval EFI_SUCCESS            Update PK variable successfully.
  @retval Other                  Any error occurred while updating PK variable.
**/
EFI_STATUS
SmmClearDeployedMode (
  VOID
  )
{
  return CommonClearDeployedMode ();
}

/**
  This function uses to get current secur boot mode.

  @return SecureBootMode      Current secure boot mode.
**/
STATIC
UINT8
GetSecureBootMode (
  VOID
  )
{
  UINTN                   VariableCount;
  VARIABLE_POINTER_TRACK  SetupModeVariable;
  EFI_STATUS              Status;

  if (DeployedModeValue () == 1) {
    return H2O_DEPLOYED_MODE;
  } else if (AuditModeValue () == 1) {
    return H2O_AUDIT_MODE;
  }

  VariableCount = 0;
  Status = FindVariableByLifetime (
             EFI_SETUP_MODE_NAME,
             &gEfiGlobalVariableGuid,
             &SetupModeVariable,
             &VariableCount,
             &mVariableModuleGlobal->VariableBase
             );
  if (Status == EFI_SUCCESS && SetupModeVariable.CurrPtr &&
    *GetVariableDataPtr (SetupModeVariable.CurrPtr) == 0) {
    return H2O_USER_MODE;
  }
  return H2O_SETUP_MODE;
}


/**
  This function uses to delete PK and change secure boot mode to correct mode.
**/
VOID
DeletePkVariable (
  VOID
  )
{
  UINTN                            VariableCount;
  VARIABLE_POINTER_TRACK           Variable;

  VariableCount = 0;
  FindVariableByLifetime (
    EFI_PLATFORM_KEY_NAME,
    &gEfiGlobalVariableGuid,
    &Variable,
    &VariableCount,
    &mVariableModuleGlobal->VariableBase
    );

   UpdateVariable (
     EFI_PLATFORM_KEY_NAME,
     &gEfiGlobalVariableGuid,
     NULL,
     0,
     EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
     EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS,
     0,
     0,
     &Variable,
     NULL,
     &mVariableModuleGlobal->VariableBase
     );
  ChangeSecureBootModeByDeletePk ();
}


/**
  This function uses to change secure boot mode.

  @retval EFI_SUCCESS            Change secure boot mode successfully.
  @retval Other                  Any error occurred while changing secure boot mode.
**/
EFI_STATUS
SmmSelectSecureBootMode (
  VOID
  )
{
  UINTN                            BufferSize;
  UINT8                            *VariableBuffer;
  UINT8                            NewSecureBootMode;
  UINT8                            SecureBootMode;
  EFI_STATUS                       Status;

  if (!FeaturePcdGet (PcdH2OCustomizedSecureBootSupported)) {
    return EFI_UNSUPPORTED;
  }

  VariableBuffer = (UINT8 *)(mVariableModuleGlobal->SmmVarBuf + 1);
  BufferSize = mVariableModuleGlobal->SmmVarBuf->DataSize;
  if (BufferSize != (AUTHINFO_SIZE + sizeof (UINT8))) {
     return EFI_UNSUPPORTED;
  }
  NewSecureBootMode = VariableBuffer[BufferSize - 1];
  SecureBootMode = GetSecureBootMode ();

  switch (SecureBootMode) {

  case H2O_USER_MODE:
    if (NewSecureBootMode == H2O_SETUP_MODE) {
      DeletePkVariable ();
    } else if (NewSecureBootMode == H2O_AUDIT_MODE) {
      DeletePkVariable ();
      Status = UpdateAuditModeValue (1);
      if (!EFI_ERROR (Status)) {
        UpdateAuditModeProperty (VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY);
      }
    } else if (NewSecureBootMode == H2O_DEPLOYED_MODE) {
      Status = UpdateDeployedModeValue (1);
      if (!EFI_ERROR (Status)) {
        UpdateDeployedModeProperty (VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY);
      }
    }
    break;

  case H2O_SETUP_MODE:
    if (NewSecureBootMode == H2O_AUDIT_MODE) {
      Status = UpdateAuditModeValue (1);
      if (!EFI_ERROR (Status)) {
        UpdateAuditModeProperty (VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY);
      }
    }
    break;

  case H2O_AUDIT_MODE:
    if (NewSecureBootMode == H2O_SETUP_MODE) {
      Status = UpdateAuditModeValue (0);
      if (!EFI_ERROR (Status)) {
        UpdateAuditModeProperty (0);
      }
    }
    break;

  case H2O_DEPLOYED_MODE:
    if (NewSecureBootMode == H2O_USER_MODE) {
      CommonClearDeployedMode ();
    } else if (NewSecureBootMode == H2O_SETUP_MODE) {
      DeletePkVariable ();
    } else if (NewSecureBootMode == H2O_AUDIT_MODE) {
      DeletePkVariable ();
      Status = UpdateAuditModeValue (1);
      if (!EFI_ERROR (Status)) {
        UpdateAuditModeProperty (VAR_CHECK_VARIABLE_PROPERTY_READ_ONLY);
      }
    }
    break;
  }

  return EFI_SUCCESS;

}

/**
  This function uses to disable all of secure boot SMI functions

  @retval EFI_SUCCESS   Disable all secure boot SMI functions successful.
  @return Other         Any error occurred while disabling all secure boot SMI functions successful.

**/
EFI_STATUS
SmmDisableSecureBootSmi (
  VOID
  )
{
  mReadyToBootEventSignaled = TRUE;
  return EFI_SUCCESS;
}


/**
  Use variable name and variable GUID to get relative SMM function index.

  @param  VariableName       Name of Variable to be found.
  @param  VendorGuid         Variable vendor GUID.
  @param  FunctionIndex      Pointer to save output function index, if this pointer isn't NULL.

  @retval TRUE               This variable is a administer secure boot relative variable.
  @retval FALSE              This variable isn't a administer secure boot relative variable
**/
EFI_STATUS
GetSecureBootFunctionIndex (
  IN     CHAR16                             *VariableName,
  IN     EFI_GUID                           *VendorGuid,
  OUT    UINTN                              *FunctionIndex  OPTIONAL
  )
{

  UINTN          Index;
  EFI_STATUS     Status;

  Status = EFI_NOT_FOUND;
  if (VariableName == NULL || VendorGuid == NULL) {
    return Status;
  }

  if (!CompareGuid (VendorGuid, &gEfiGenericVariableGuid)) {
   return Status;
  }

  for (Index = 0; mNonSmiSecureBootFunctionsTable[Index].VariableName != NULL; Index++) {
    if (!StrCmp (mNonSmiSecureBootFunctionsTable[Index].VariableName, VariableName)) {
      Status = EFI_SUCCESS;
      break;
    }
  }

  if (Status == EFI_SUCCESS && FunctionIndex != NULL) {
    *FunctionIndex = Index;
  }

  return Status;
}

/**
  Use variable name and variable GUID to check this variable is administer secure boot relative variable

  @param  VariableName       Name of Variable to be found.
  @param  VendorGuid         Variable vendor GUID.

  @retval TRUE               This variable is a administer secure boot relative variable.
  @retval FALSE              This variable isn't a administer secure boot relative variable
**/
BOOLEAN
IsAdministerSecureVariable (
  IN     CHAR16                             *VariableName,
  IN     EFI_GUID                           *VendorGuid
  )
{
  EFI_STATUS       Status;

  Status = GetSecureBootFunctionIndex (
             VariableName,
             VendorGuid,
             NULL
             );
 return Status == EFI_SUCCESS ? TRUE : FALSE;
}

/**
  Update administer secure boot relative variable

  @param  VariableName                Name of Variable to be found.
  @param  VendorGuid                  Variable vendor GUID.
  @param  Data                        Data pointer.
  @param  DataSize                    Size of Data found. If size is less than the
                                      data, this value contains the required size.
  @param  Attributes                  Attribute value of the variable.

  @return EFI_INVALID_PARAMETER       Invalid parameter.
  @return EFI_WRITE_PROTECTED         Variable is write-protected and needs authentication with
                                      EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
  @return EFI_SECURITY_VIOLATION      The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
                                      set, but the AuthInfo does NOT pass the validation
                                      check carried out by the firmware.
  @return EFI_SUCCESS                 Variable is not write-protected or pass validation successfully.

**/
EFI_STATUS
UpdateAdministerSecureVariable (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  EFI_STATUS            Status;
  UINTN                 FunctionIndex;


  if (VariableName == NULL || VendorGuid == NULL || Data == NULL) {
    return EFI_INVALID_PARAMETER;
  }

  Status = GetSecureBootFunctionIndex (VariableName, VendorGuid, &FunctionIndex);
  if (!EFI_ERROR (Status)) {
    Status = mNonSmiSecureBootFunctionsTable[FunctionIndex].SecureBootSubFunction (
                                                              VariableName,
                                                              VendorGuid,
                                                              Data,
                                                              DataSize,
                                                              Attributes
                                                              );
  }

  return Status;
}

/**
  Append new hash image to EFI_IMAGE_SECURITY_DATABASE (db)

  @param  VariableName                Name of Variable to be found.
  @param  VendorGuid                  Variable vendor GUID.
  @param  Data                        Data pointer.
  @param  DataSize                    Size of Data found. If size is less than the
                                      data, this value contains the required size.
  @param  Attributes                  Attribute value of the variable.

  @return EFI_INVALID_PARAMETER       Invalid parameter.
  @return EFI_WRITE_PROTECTED         Variable is write-protected and needs authentication with
                                      EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
  @return EFI_SECURITY_VIOLATION      The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
                                      set, but the AuthInfo does NOT pass the validation
                                      check carried out by the firmware.
  @return EFI_SUCCESS                 Variable is not write-protected or pass validation successfully.

**/
EFI_STATUS
RuntimeDxeAddFileHashImage (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  if (Attributes != (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_NON_VOLATILE |
      EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_APPEND_WRITE)) {
    return EFI_INVALID_PARAMETER;
  }
  return CommonAddFileHashImage (
           EFI_IMAGE_SECURITY_DATABASE,
           &gEfiImageSecurityDatabaseGuid,
           Data,
           DataSize,
           Attributes
           );
}

/**
  Update EFI_SECURE_BOOT_ENFORCE_NAME variable.

  @param  VariableName                Name of Variable to be found.
  @param  VendorGuid                  Variable vendor GUID.
  @param  Data                        Data pointer.
  @param  DataSize                    Size of Data found. If size is less than the
                                      data, this value contains the required size.
  @param  Attributes                  Attribute value of the variable.

  @return EFI_INVALID_PARAMETER       Invalid parameter.
  @return EFI_WRITE_PROTECTED         Variable is write-protected and needs authentication with
                                      EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
  @return EFI_SECURITY_VIOLATION      The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
                                      set, but the AuthInfo does NOT pass the validation
                                      check carried out by the firmware.
  @return EFI_SUCCESS                 Variable is not write-protected or pass validation successfully.

**/
EFI_STATUS
RuntimeDxeUpdateSecureBootEnforce (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  if (Attributes != (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)) {
    return EFI_INVALID_PARAMETER;
  }

  return CommoneUpdateSecureBootEnforce (
           VariableName,
           VendorGuid,
           Data,
           DataSize
           );
}

/**
  clear all secure boot settings.

  @param  VariableName                Name of Variable to be found.
  @param  VendorGuid                  Variable vendor GUID.
  @param  Data                        Data pointer.
  @param  DataSize                    Size of Data found. If size is less than the
                                      data, this value contains the required size.
  @param  Attributes                  Attribute value of the variable.

  @return EFI_INVALID_PARAMETER       Invalid parameter.
  @return EFI_WRITE_PROTECTED         Variable is write-protected and needs authentication with
                                      EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
  @return EFI_SECURITY_VIOLATION      The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
                                      set, but the AuthInfo does NOT pass the validation
                                      check carried out by the firmware.
  @return EFI_SUCCESS                 Variable is not write-protected or pass validation successfully.

**/
EFI_STATUS
RuntimeDxeClearAllSecureSettings (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{

  if (DataSize != (AUTHINFO_SIZE + sizeof (UINT8))) {
     return EFI_UNSUPPORTED;
  }
  //
  // Check input is whether want to clear all secure settings
  //
  if (*((UINT8 *) Data + AUTHINFO_SIZE) != 1) {
    return EFI_UNSUPPORTED;
  }

  return CommonClearAllSecureSettings ();
}

/**
  Update EFI_RESTORE_FACTORY_DEFAULT_NAME variable and then system will restore secure boot
  database to factory default during next POST.

  @param  VariableName                Name of Variable to be found.
  @param  VendorGuid                  Variable vendor GUID.
  @param  Data                        Data pointer.
  @param  DataSize                    Size of Data found. If size is less than the
                                      data, this value contains the required size.
  @param  Attributes                  Attribute value of the variable.

  @return EFI_INVALID_PARAMETER       Invalid parameter.
  @return EFI_WRITE_PROTECTED         Variable is write-protected and needs authentication with
                                      EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS set.
  @return EFI_SECURITY_VIOLATION      The variable is with EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS
                                      set, but the AuthInfo does NOT pass the validation
                                      check carried out by the firmware.
  @return EFI_SUCCESS                 Variable is not write-protected or pass validation successfully.

**/
EFI_STATUS
RuntimeDxeRestoreFactoryDefault (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{

  if (Attributes != (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_AUTHENTICATED_WRITE_ACCESS)) {
    return EFI_INVALID_PARAMETER;
  }

  return CommoneRestoreFactoryDefault (
           VariableName,
           VendorGuid,
           Data,
           DataSize
           );
}

/**
  This function uses to update PK variable.

  @param[in] VariableName    Name of Variable to be found.
  @param[in] VendorGuid      Variable vendor GUID.
  @param[in] Data            Data pointer.
  @param[in] DataSize        Size of Data found. If size is less than the
                             data, this value contains the required size.
  @param[in] Attributes      Attribute value of the variable.

  @retval EFI_SUCCESS        Update PK variable successfully.
  @retval Other              Any error occurred while updating PK variable.
**/
EFI_STATUS
RuntimeDxeUpdatePkVariable (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  EFI_STATUS     Status;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }

  if (Attributes != (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
    return EFI_INVALID_PARAMETER;
  }

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_PLATFORM_KEY_NAME,
             &gEfiGlobalVariableGuid,
             DataSize,
             Data,
             UPDATE_AUTHENTICATED_VARIABLE
             );
  return Status;
}

/**
  This function uses to update KEK variable.

  @param[in] VariableName    Name of Variable to be found.
  @param[in] VendorGuid      Variable vendor GUID.
  @param[in] Data            Data pointer.
  @param[in] DataSize        Size of Data found. If size is less than the
                             data, this value contains the required size.
  @param[in] Attributes      Attribute value of the variable.

  @retval EFI_SUCCESS        Update KEK variable successfully.
  @retval Other              Any error occurred while updating KEK variable.
**/
EFI_STATUS
RuntimeDxeUpdateKekVariable (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  EFI_STATUS     Status;
  UINT8          UpdateType;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }

  if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
    UpdateType = UPDATE_AUTHENTICATED_VARIABLE;
  } else if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_APPEND_WRITE)) {
    UpdateType = APPEND_AUTHENTICATED_VARIABLE;
  } else {
    return EFI_INVALID_PARAMETER;
  }

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_KEY_EXCHANGE_KEY_NAME,
             &gEfiGlobalVariableGuid,
             DataSize,
             Data,
             UpdateType
             );
  return Status;
}

/**
  This function uses to update db variable.

  @param[in] VariableName    Name of Variable to be found.
  @param[in] VendorGuid      Variable vendor GUID.
  @param[in] Data            Data pointer.
  @param[in] DataSize        Size of Data found. If size is less than the
                             data, this value contains the required size.
  @param[in] Attributes      Attribute value of the variable.

  @retval EFI_SUCCESS        Update db variable successfully.
  @retval Other              Any error occurred while updating db variable.
**/
EFI_STATUS
RuntimeDxeUpdateDbVariable (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  EFI_STATUS     Status;
  UINT8          UpdateType;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }

  if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
    UpdateType = UPDATE_AUTHENTICATED_VARIABLE;
  } else if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_APPEND_WRITE)) {
    UpdateType = APPEND_AUTHENTICATED_VARIABLE;
  } else {
    return EFI_INVALID_PARAMETER;
  }

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_IMAGE_SECURITY_DATABASE,
             &gEfiImageSecurityDatabaseGuid,
             DataSize,
             Data,
             UpdateType
             );
  return Status;
}

/**
  This function uses to update dbx variable.

  @param[in] VariableName    Name of Variable to be found.
  @param[in] VendorGuid      Variable vendor GUID.
  @param[in] Data            Data pointer.
  @param[in] DataSize        Size of Data found. If size is less than the
                             data, this value contains the required size.
  @param[in] Attributes      Attribute value of the variable.

  @retval EFI_SUCCESS        Update dbx variable successfully.
  @retval Other              Any error occurred while updating dbx variable.
**/
EFI_STATUS
RuntimeDxeUpdateDbxVariable (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  EFI_STATUS     Status;
  UINT8          UpdateType;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }

  if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
    UpdateType = UPDATE_AUTHENTICATED_VARIABLE;
  } else if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_APPEND_WRITE)) {
    UpdateType = APPEND_AUTHENTICATED_VARIABLE;
  } else {
    return EFI_INVALID_PARAMETER;
  }

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_IMAGE_SECURITY_DATABASE1,
             &gEfiImageSecurityDatabaseGuid,
             DataSize,
             Data,
             UpdateType
             );
  return Status;
}

/**
  This function uses to update dbt variable.

  @param[in] VariableName    Name of Variable to be found.
  @param[in] VendorGuid      Variable vendor GUID.
  @param[in] Data            Data pointer.
  @param[in] DataSize        Size of Data found. If size is less than the
                             data, this value contains the required size.
  @param[in] Attributes      Attribute value of the variable.

  @retval EFI_SUCCESS        Update dbt variable successfully.
  @retval Other              Any error occurred while updating dbt variable.
**/
EFI_STATUS
RuntimeDxeUpdateDbtVariable (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  EFI_STATUS     Status;
  UINT8          UpdateType;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }

  if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
    UpdateType = UPDATE_AUTHENTICATED_VARIABLE;
  } else if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_APPEND_WRITE)) {
    UpdateType = APPEND_AUTHENTICATED_VARIABLE;
  } else {
    return EFI_INVALID_PARAMETER;
  }

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_IMAGE_SECURITY_DATABASE2,
             &gEfiImageSecurityDatabaseGuid,
             DataSize,
             Data,
             UpdateType
             );
  return Status;
}

/**
  This function uses to update dbr variable.

  @param[in] VariableName    Name of Variable to be found.
  @param[in] VendorGuid      Variable vendor GUID.
  @param[in] Data            Data pointer.
  @param[in] DataSize        Size of Data found. If size is less than the
                             data, this value contains the required size.
  @param[in] Attributes      Attribute value of the variable.

  @retval EFI_SUCCESS        Update dbr variable successfully.
  @retval Other              Any error occurred while updating dbr variable.
**/
EFI_STATUS
RuntimeDxeUpdateDbrVariable (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  EFI_STATUS     Status;
  UINT8          UpdateType;

  if (!PcdGetBool(PcdUpdateSecureBootVariablesSupported)) {
    return EFI_UNSUPPORTED;
  }

  if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS)) {
    UpdateType = UPDATE_AUTHENTICATED_VARIABLE;
  } else if (Attributes == (EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_RUNTIME_ACCESS |
      EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS | EFI_VARIABLE_APPEND_WRITE)) {
    UpdateType = APPEND_AUTHENTICATED_VARIABLE;
  } else {
    return EFI_INVALID_PARAMETER;
  }

  Status = InternalUpdateSecureDatabaseVariable (
             EFI_IMAGE_SECURITY_DATABASE3,
             &gEfiImageSecurityDatabaseGuid,
             DataSize,
             Data,
             UpdateType
             );
  return Status;
}

/**
  This function uses to clear DeployedMode variable value to 0..

  @param[in] VariableName    Name of Variable to be found.
  @param[in] VendorGuid      Variable vendor GUID.
  @param[in] Data            Data pointer.
  @param[in] DataSize        Size of Data found. If size is less than the
                             data, this value contains the required size.
  @param[in] Attributes      Attribute value of the variable.

  @retval EFI_SUCCESS        Update DeployedMode value to 0 successfully.
  @retval Other              Any error occurred while updating DeployedMode value to 0.
**/
EFI_STATUS
RuntimeDxeClearDeployedMode (
  IN     CHAR16          *VariableName,
  IN     EFI_GUID        *VendorGuid,
  IN     VOID            *Data,
  IN     UINTN           DataSize,
  IN     UINT32          Attributes
  )
{
  if (DataSize != (AUTHINFO_SIZE + sizeof (UINT8))) {
     return EFI_UNSUPPORTED;
  }
  //
  // Check input is whether want to clear all secure settings
  //
  if (*((UINT8 *) Data + AUTHINFO_SIZE) != 1) {
    return EFI_UNSUPPORTED;
  }
  return CommonClearDeployedMode ();
}
/**
  Initialize all of administer secure boot relative authenticated variables.

  @retval EFI_SUCCESS  Update all of secure boot relative authenticated variables successful
  @retval Other        The driver failded to start the device

**/
EFI_STATUS
InitializeAdministerSecureBootVariables (
  VOID
  )
{
  UINTN                            VariableCount;
  VARIABLE_POINTER_TRACK           Variable;
  EFI_STATUS                       Status;

  //
  // create all of Administer secure boot variables if they don't exist to prevent from other tool or
  // application can set these variables.
  //
  VariableCount = 0;
  FindVariableByLifetime (
    EFI_SECURE_BOOT_ENFORCE_NAME,
    &gEfiGenericVariableGuid,
    &Variable,
    &VariableCount,
    &mVariableModuleGlobal->VariableBase
    );
  if (Variable.CurrPtr == NULL) {
    Status = UpdateSecureBootEnforceVariable (1);
    if (EFI_ERROR (Status)) {
      return Status;
    }
  }

  VariableCount = 0;
  FindVariableByLifetime (
    EFI_RESTORE_FACTORY_DEFAULT_NAME,
    &gEfiGenericVariableGuid,
    &Variable,
    &VariableCount,
    &mVariableModuleGlobal->VariableBase
    );
  if (Variable.CurrPtr == NULL) {
    Status = UpdateRestoreFactoryDefaultVariable (0);
    if (EFI_ERROR (Status)) {
      return Status;
    }
  }

  VariableCount = 0;
  FindVariableByLifetime (
    EFI_CUSTOM_SECURITY_NAME,
    &gEfiGenericVariableGuid,
    &Variable,
    &VariableCount,
    &mVariableModuleGlobal->VariableBase
    );
  if (Variable.CurrPtr == NULL) {
    Status = UpdateCustomSecurityStatus (0);
    if (EFI_ERROR (Status)) {
      return Status;
    }
  } else {
    Status = UpdateCustomSecurityStatus (*(GetVariableDataPtr (Variable.CurrPtr)));
  }

  return EFI_SUCCESS;
}

/**
  According input data to update L"SecureBootEnforce" variable

  @param  Data         Input data to update "SecureBootEnforce" variable

  @retval EFI_SUCCESS  update "SecureBootEnforce" successful.
  @retval Other        The driver failded to start the device

**/
EFI_STATUS
UpdateSecureBootEnforceVariable (
  UINT8           Data
  )
{
  return InternalUpdateAuthVariable (
           EFI_SECURE_BOOT_ENFORCE_NAME,
           &gEfiGenericVariableGuid,
           sizeof (UINT8),
           &Data,
           FALSE
           );
}
/**
  According input data to update L"RestoreFactoryDefault" variable

  @param  Data         Input data to update "RestoreFactoryDefault" variable

  @retval EFI_SUCCESS  update "RestoreFactoryDefault" successful.
  @retval Other        The driver failded to start the device

**/
EFI_STATUS
UpdateRestoreFactoryDefaultVariable (
  UINT8           Data
  )
{
  return InternalUpdateAuthVariable (
           EFI_RESTORE_FACTORY_DEFAULT_NAME,
           &gEfiGenericVariableGuid,
           sizeof (UINT8),
           &Data,
           FALSE
           );
}


/**
  According to input data to update custom security status.

  In this function, it will update "CustomSecurity" variable and "vendorKeys" variable.
  If input Data is 0, it will update "CustomSecurity" to 0 and "vendorKeys" to 1.
  If input Data is 1, it will update "CustomSecurity" to 1 and "vendorKeys" to 0.

  @param[in] Data                Input data to update custom security status.

  @retval EFI_SUCCESS            Update custom security status successful.
  @retval EFI_INVALID_PARAMETER  The value of Data isn't 0 or 1.
  @retval Other                  Any error occurred while updating variable.
**/
EFI_STATUS
UpdateCustomSecurityStatus (
  IN  UINT8               Data
  )
{
  EFI_STATUS              Status;
  VARIABLE_POINTER_TRACK  Variable;
  UINTN                   VariableCount;
  UINT8                   VendorKeyData;

  if (Data != 0 && Data != 1) {
    return EFI_INVALID_PARAMETER;
  }

  //
  // Update "CustomSecurity" variable
  //
  Status = InternalUpdateAuthVariable (
             EFI_CUSTOM_SECURITY_NAME,
             &gEfiGenericVariableGuid,
             sizeof (UINT8),
             &Data,
             FALSE
             );
  ASSERT_EFI_ERROR (Status);
  if (EFI_ERROR (Status)) {
    return Status;
  }

  //
  // Update "VendorKeys" variable
  //
  VendorKeyData = Data == 0 ? 1 : 0;
  VariableCount = 0;
  Status = FindVariableByLifetime (
             EFI_VENDOR_KEYS_VARIABLE_NAME,
             &gEfiGlobalVariableGuid,
             &Variable,
             &VariableCount,
             &mVariableModuleGlobal->VariableBase
             );

  Status  = UpdateVariable (
              EFI_VENDOR_KEYS_VARIABLE_NAME,
              &gEfiGlobalVariableGuid,
              &VendorKeyData,
              sizeof (UINT8),
              EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS,
              0,
              0,
              &Variable,
              NULL,
              &mVariableModuleGlobal->VariableBase
              );
  ASSERT_EFI_ERROR (Status);
  if (EFI_ERROR (Status)) {
    return Status;
  }

  return Status;


}

/**
  This function uses to disable all of secure boot relative callbacks

  @param[in] Event      Event whose notification function is being invoked.
  @param[in] Context    Pointer to the notification function's context.
**/
STATIC
VOID
EFIAPI
DisableSecureBootCallback (
  IN EFI_EVENT        Event,
  IN VOID             *Context
  )
{
  STATIC  BOOLEAN     SmiDisabled = FALSE;

  if (!SmiDisabled) {
    if (mVariableModuleGlobal->SmmCodeReady) {
      InitCommunicationBufferHeader ();
      mVariableModuleGlobal->SmmVarBuf->AccessType = DISABLE_SECURE_BOOT_SMI_FUN_NUM;
      SendCommunicateBuffer ();
      SmiDisabled = TRUE;
    }
  }
  mVariableModuleGlobal->SecureBootCallbackEnabled = FALSE;
  gBS->CloseEvent (Event);
  return;
}

/**
  Register call back function (on ReadytoBoot event and an platform specific event) to disable
  all of secure boot functions.

  @return EFI_SUCCESS   Register callback function successful.
--*/
EFI_STATUS
RegisterEventToDisableSecureBoot (
  VOID
  )
{
  EFI_STATUS       Status;
  EFI_EVENT        Event;
  VOID             *Registration;


  Event = VariableCreateProtocolNotifyEvent (
            &gPlatformDisableSecureBootGuid,
            TPL_CALLBACK,
            DisableSecureBootCallback,
            NULL,
            &Registration
            );

  Status = EfiCreateEventReadyToBootEx (
             TPL_NOTIFY,
             DisableSecureBootCallback,
             NULL,
             &Event
             );

  return Status;
}