X-Git-Url: https://git.proxmox.com/?p=mirror_edk2.git;a=blobdiff_plain;f=SecurityPkg%2FVariableAuthenticated%2FSecureBootConfigDxe%2FSecureBootConfigImpl.c;h=2eaf24633db15d880c95c23ae493b12ed551de49;hp=3084f3364e73366e5c14ca37fac53c9df21aad44;hb=9d9b8b77bc54718a4debfea3a7a3dd59bba16840;hpb=a2f2c258d43f506b93b4a13a5c82d0200465df92

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
index 3084f3364e..2eaf24633d 100644
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfigImpl.c
@@ -1,7 +1,7 @@
 /** @file
   HII Config Access protocol implementation of SecureBoot configuration module.
 
-Copyright (c) 2011 - 2013, Intel Corporation. All rights reserved.<BR>
+Copyright (c) 2011 - 2017, Intel Corporation. All rights reserved.<BR>
 This program and the accompanying materials
 are licensed and made available under the terms and conditions of the BSD License
 which accompanies this distribution.  The full text of the license may be found at
@@ -17,7 +17,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
 CHAR16              mSecureBootStorageName[] = L"SECUREBOOT_CONFIGURATION";
 
 SECUREBOOT_CONFIG_PRIVATE_DATA         mSecureBootConfigPrivateDateTemplate = {
-  SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE,  
+  SECUREBOOT_CONFIG_PRIVATE_DATA_SIGNATURE,
   {
     SecureBootExtractConfig,
     SecureBootRouteConfig,
@@ -48,6 +48,8 @@ HII_VENDOR_DEVICE_PATH          mSecureBootHiiVendorDevicePath = {
 };
 
 
+BOOLEAN mIsEnterSecureBootForm = FALSE;
+
 //
 // OID ASN.1 Value for Hash Algorithms
 //
@@ -61,16 +63,15 @@ UINT8 mHashOidValue[] = {
   };
 
 HASH_TABLE mHash[] = {
-  { L"SHA1",   20, &mHashOidValue[8],  5, Sha1GetContextSize,  Sha1Init,   Sha1Update,    Sha1Final  },
-  { L"SHA224", 28, &mHashOidValue[13], 9, NULL,                NULL,       NULL,          NULL       },
-  { L"SHA256", 32, &mHashOidValue[22], 9, Sha256GetContextSize,Sha256Init, Sha256Update,  Sha256Final},
-  { L"SHA384", 48, &mHashOidValue[31], 9, NULL,                NULL,       NULL,          NULL       },
-  { L"SHA512", 64, &mHashOidValue[40], 9, NULL,                NULL,       NULL,          NULL       }
+  { L"SHA224", 28, &mHashOidValue[13], 9, NULL,                 NULL,       NULL,         NULL       },
+  { L"SHA256", 32, &mHashOidValue[22], 9, Sha256GetContextSize, Sha256Init, Sha256Update, Sha256Final},
+  { L"SHA384", 48, &mHashOidValue[31], 9, Sha384GetContextSize, Sha384Init, Sha384Update, Sha384Final},
+  { L"SHA512", 64, &mHashOidValue[40], 9, Sha512GetContextSize, Sha512Init, Sha512Update, Sha512Final}
 };
 
 //
-// Variable Definitions 
-//                                          
+// Variable Definitions
+//
 UINT32            mPeCoffHeaderOffset = 0;
 WIN_CERTIFICATE   *mCertificate = NULL;
 IMAGE_TYPE        mImageType;
@@ -93,6 +94,33 @@ CHAR16* mDerEncodedSuffix[] = {
 };
 CHAR16* mSupportX509Suffix = L"*.cer/der/crt";
 
+SECUREBOOT_CONFIG_PRIVATE_DATA  *gSecureBootPrivateData = NULL;
+
+/**
+  This code cleans up enrolled file by closing file & free related resources attached to
+  enrolled file.
+
+  @param[in] FileContext            FileContext cached in SecureBootConfig driver
+
+**/
+VOID
+CloseEnrolledFile(
+  IN SECUREBOOT_FILE_CONTEXT *FileContext
+)
+{
+  if (FileContext->FHandle != NULL) {
+    CloseFile (FileContext->FHandle);
+    FileContext->FHandle = NULL;
+  }
+
+  if (FileContext->FileName != NULL){
+    FreePool(FileContext->FileName);
+    FileContext->FileName = NULL;
+  }
+  FileContext->FileType = UNKNOWN_FILE_TYPE;
+
+}
+
 /**
   This code checks if the FileSuffix is one of the possible DER-encoded certificate suffix.
 
@@ -107,7 +135,7 @@ IsDerEncodeCertificate (
   IN CONST CHAR16         *FileSuffix
 )
 {
-  UINTN     Index; 
+  UINTN     Index;
   for (Index = 0; mDerEncodedSuffix[Index] != NULL; Index++) {
     if (StrCmp (FileSuffix, mDerEncodedSuffix[Index]) == 0) {
       return TRUE;
@@ -116,6 +144,61 @@ IsDerEncodeCertificate (
   return FALSE;
 }
 
+/**
+  This code checks if the file content complies with EFI_VARIABLE_AUTHENTICATION_2 format
+The function reads file content but won't open/close given FileHandle.
+
+  @param[in] FileHandle            The FileHandle to be checked
+
+  @retval    TRUE            The content is EFI_VARIABLE_AUTHENTICATION_2 format.
+  @retval    FALSE          The content is NOT a EFI_VARIABLE_AUTHENTICATION_2 format.
+
+**/
+BOOLEAN
+IsAuthentication2Format (
+  IN   EFI_FILE_HANDLE    FileHandle
+)
+{
+  EFI_STATUS                     Status;
+  EFI_VARIABLE_AUTHENTICATION_2  *Auth2;
+  BOOLEAN                        IsAuth2Format;
+
+  IsAuth2Format = FALSE;
+
+  //
+  // Read the whole file content
+  //
+  Status = ReadFileContent(
+             FileHandle,
+             (VOID **) &mImageBase,
+             &mImageSize,
+             0
+             );
+  if (EFI_ERROR (Status)) {
+    goto ON_EXIT;
+  }
+
+  Auth2 = (EFI_VARIABLE_AUTHENTICATION_2 *)mImageBase;
+  if (Auth2->AuthInfo.Hdr.wCertificateType != WIN_CERT_TYPE_EFI_GUID) {
+    goto ON_EXIT;
+  }
+
+  if (CompareGuid(&gEfiCertPkcs7Guid, &Auth2->AuthInfo.CertType)) {
+    IsAuth2Format = TRUE;
+  }
+
+ON_EXIT:
+  //
+  // Do not close File. simply check file content
+  //
+  if (mImageBase != NULL) {
+    FreePool (mImageBase);
+    mImageBase = NULL;
+  }
+
+  return IsAuth2Format;
+}
+
 /**
   Set Secure Boot option into variable space.
 
@@ -145,14 +228,14 @@ SaveSecureBootVariable (
 /**
   Create a time based data payload by concatenating the EFI_VARIABLE_AUTHENTICATION_2
   descriptor with the input data. NO authentication is required in this function.
-  
+
   @param[in, out]   DataSize       On input, the size of Data buffer in bytes.
                                    On output, the size of data returned in Data
                                    buffer in bytes.
-  @param[in, out]   Data           On input, Pointer to data buffer to be wrapped or 
+  @param[in, out]   Data           On input, Pointer to data buffer to be wrapped or
                                    pointer to NULL to wrap an empty payload.
                                    On output, Pointer to the new payload date buffer allocated from pool,
-                                   it's caller's responsibility to free the memory when finish using it. 
+                                   it's caller's responsibility to free the memory when finish using it.
 
   @retval EFI_SUCCESS              Create time based payload successfully.
   @retval EFI_OUT_OF_RESOURCES     There are not enough memory resourses to create time based payload.
@@ -173,20 +256,20 @@ CreateTimeBasedPayload (
   EFI_VARIABLE_AUTHENTICATION_2    *DescriptorData;
   UINTN                            DescriptorSize;
   EFI_TIME                         Time;
-  
+
   if (Data == NULL || DataSize == NULL) {
     return EFI_INVALID_PARAMETER;
   }
-  
+
   //
-  // In Setup mode or Custom mode, the variable does not need to be signed but the 
+  // In Setup mode or Custom mode, the variable does not need to be signed but the
   // parameters to the SetVariable() call still need to be prepared as authenticated
   // variable. So we create EFI_VARIABLE_AUTHENTICATED_2 descriptor without certificate
   // data in it.
   //
   Payload     = *Data;
   PayloadSize = *DataSize;
-  
+
   DescriptorSize    = OFFSET_OF (EFI_VARIABLE_AUTHENTICATION_2, AuthInfo) + OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
   NewData = (UINT8*) AllocateZeroPool (DescriptorSize + PayloadSize);
   if (NewData == NULL) {
@@ -211,16 +294,16 @@ CreateTimeBasedPayload (
   Time.Daylight   = 0;
   Time.Pad2       = 0;
   CopyMem (&DescriptorData->TimeStamp, &Time, sizeof (EFI_TIME));
- 
+
   DescriptorData->AuthInfo.Hdr.dwLength         = OFFSET_OF (WIN_CERTIFICATE_UEFI_GUID, CertData);
   DescriptorData->AuthInfo.Hdr.wRevision        = 0x0200;
   DescriptorData->AuthInfo.Hdr.wCertificateType = WIN_CERT_TYPE_EFI_GUID;
   CopyGuid (&DescriptorData->AuthInfo.CertType, &gEfiCertPkcs7Guid);
-  
+
   if (Payload != NULL) {
     FreePool(Payload);
   }
-  
+
   *DataSize = DescriptorSize + PayloadSize;
   *Data     = NewData;
   return EFI_SUCCESS;
@@ -285,17 +368,17 @@ DeleteVariable (
 
   @param[in]   SecureBootMode        New secure boot mode: STANDARD_SECURE_BOOT_MODE or
                                      CUSTOM_SECURE_BOOT_MODE.
-  
+
   @return EFI_SUCCESS                The platform has switched to the special mode successfully.
   @return other                      Fail to operate the secure boot mode.
-  
+
 **/
 EFI_STATUS
 SetSecureBootMode (
   IN     UINT8         SecureBootMode
   )
 {
-  return gRT->SetVariable (                          
+  return gRT->SetVariable (
                 EFI_CUSTOM_MODE_NAME,
                 &gEfiCustomModeEnableGuid,
                 EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
@@ -309,26 +392,26 @@ SetSecureBootMode (
 
   @param[in]   X509File              FileHandle of X509 Certificate storing file.
   @param[out]  PkCert                Point to the data buffer to store the signature list.
-  
+
   @return EFI_UNSUPPORTED            Unsupported Key Length.
   @return EFI_OUT_OF_RESOURCES       There are not enough memory resourses to form the signature list.
-  
+
 **/
 EFI_STATUS
 CreatePkX509SignatureList (
-  IN    EFI_FILE_HANDLE             X509File, 
-  OUT   EFI_SIGNATURE_LIST          **PkCert 
+  IN    EFI_FILE_HANDLE             X509File,
+  OUT   EFI_SIGNATURE_LIST          **PkCert
   )
 {
-  EFI_STATUS              Status;  
+  EFI_STATUS              Status;
   UINT8                   *X509Data;
   UINTN                   X509DataSize;
   EFI_SIGNATURE_DATA      *PkCertData;
 
   X509Data = NULL;
   PkCertData = NULL;
-  X509DataSize = 0;  
-  
+  X509DataSize = 0;
+
   Status = ReadFileContent (X509File, (VOID**) &X509Data, &X509DataSize, 0);
   if (EFI_ERROR (Status)) {
     goto ON_EXIT;
@@ -348,32 +431,32 @@ CreatePkX509SignatureList (
     goto ON_EXIT;
   }
 
-  (*PkCert)->SignatureListSize   = (UINT32) (sizeof(EFI_SIGNATURE_LIST) 
+  (*PkCert)->SignatureListSize   = (UINT32) (sizeof(EFI_SIGNATURE_LIST)
                                     + sizeof(EFI_SIGNATURE_DATA) - 1
                                     + X509DataSize);
   (*PkCert)->SignatureSize       = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);
   (*PkCert)->SignatureHeaderSize = 0;
   CopyGuid (&(*PkCert)->SignatureType, &gEfiCertX509Guid);
-  PkCertData                     = (EFI_SIGNATURE_DATA*) ((UINTN)(*PkCert) 
+  PkCertData                     = (EFI_SIGNATURE_DATA*) ((UINTN)(*PkCert)
                                                           + sizeof(EFI_SIGNATURE_LIST)
                                                           + (*PkCert)->SignatureHeaderSize);
-  CopyGuid (&PkCertData->SignatureOwner, &gEfiGlobalVariableGuid);   
+  CopyGuid (&PkCertData->SignatureOwner, &gEfiGlobalVariableGuid);
   //
   // Fill the PK database with PKpub data from X509 certificate file.
-  //  
+  //
   CopyMem (&(PkCertData->SignatureData[0]), X509Data, X509DataSize);
-  
+
 ON_EXIT:
-  
+
   if (X509Data != NULL) {
     FreePool (X509Data);
   }
-  
+
   if (EFI_ERROR(Status) && *PkCert != NULL) {
     FreePool (*PkCert);
     *PkCert = NULL;
   }
-  
+
   return Status;
 }
 
@@ -387,19 +470,20 @@ ON_EXIT:
   @retval   EFI_SUCCESS            New PK enrolled successfully.
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
   @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
-  
+
 **/
 EFI_STATUS
 EnrollPlatformKey (
    IN  SECUREBOOT_CONFIG_PRIVATE_DATA*   Private
-  )                       
+  )
 {
   EFI_STATUS                      Status;
   UINT32                          Attr;
   UINTN                           DataSize;
   EFI_SIGNATURE_LIST              *PkCert;
   UINT16*                         FilePostFix;
-  
+  UINTN                           NameLength;
+
   if (Private->FileContext->FileName == NULL) {
     return EFI_INVALID_PARAMETER;
   }
@@ -414,7 +498,11 @@ EnrollPlatformKey (
   //
   // Parse the file's postfix. Only support DER encoded X.509 certificate files.
   //
-  FilePostFix = Private->FileContext->FileName + StrLen (Private->FileContext->FileName) - 4;
+  NameLength = StrLen (Private->FileContext->FileName);
+  if (NameLength <= 4) {
+    return EFI_INVALID_PARAMETER;
+  }
+  FilePostFix = Private->FileContext->FileName + NameLength - 4;
   if (!IsDerEncodeCertificate(FilePostFix)) {
     DEBUG ((EFI_D_ERROR, "Unsupported file type, only DER encoded certificate (%s) is supported.", mSupportX509Suffix));
     return EFI_INVALID_PARAMETER;
@@ -426,18 +514,18 @@ EnrollPlatformKey (
   // Prase the selected PK file and generature PK certificate list.
   //
   Status = CreatePkX509SignatureList (
-            Private->FileContext->FHandle, 
-            &PkCert 
+            Private->FileContext->FHandle,
+            &PkCert
             );
   if (EFI_ERROR (Status)) {
     goto ON_EXIT;
   }
   ASSERT (PkCert != NULL);
-                         
+
   //
   // Set Platform Key variable.
-  // 
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS 
+  //
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
   DataSize = PkCert->SignatureListSize;
   Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &PkCert);
@@ -445,12 +533,12 @@ EnrollPlatformKey (
     DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
     goto ON_EXIT;
   }
-  
+
   Status = gRT->SetVariable(
-                  EFI_PLATFORM_KEY_NAME, 
-                  &gEfiGlobalVariableGuid, 
-                  Attr, 
-                  DataSize, 
+                  EFI_PLATFORM_KEY_NAME,
+                  &gEfiGlobalVariableGuid,
+                  Attr,
+                  DataSize,
                   PkCert
                   );
   if (EFI_ERROR (Status)) {
@@ -459,17 +547,14 @@ EnrollPlatformKey (
     }
     goto ON_EXIT;
   }
-  
+
 ON_EXIT:
 
   if (PkCert != NULL) {
     FreePool(PkCert);
   }
-  
-  if (Private->FileContext->FHandle != NULL) {
-    CloseFile (Private->FileContext->FHandle);
-    Private->FileContext->FHandle = NULL;
-  }
+
+  CloseEnrolledFile(Private->FileContext);
 
   return Status;
 }
@@ -479,7 +564,7 @@ ON_EXIT:
 
   @retval EFI_SUCCESS    Delete PK successfully.
   @retval Others         Could not allow to delete PK.
-  
+
 **/
 EFI_STATUS
 DeletePlatformKey (
@@ -525,7 +610,7 @@ EnrollRsa2048ToKek (
   CPL_KEY_INFO                    *KeyInfo;
   EFI_SIGNATURE_DATA              *KEKSigData;
   UINTN                           KekSigListSize;
-  UINT8                           *KeyBuffer;  
+  UINT8                           *KeyBuffer;
   UINTN                           KeyLenInBytes;
 
   Attr        = 0;
@@ -537,11 +622,11 @@ EnrollRsa2048ToKek (
   KEKSigData  = NULL;
   KekSigList  = NULL;
   KekSigListSize = 0;
-  
+
   //
   // Form the KeKpub certificate list into EFI_SIGNATURE_LIST type.
   // First, We have to parse out public key data from the pbk key file.
-  //                
+  //
   Status = ReadFileContent (
              Private->FileContext->FHandle,
              (VOID**) &KeyBlob,
@@ -558,10 +643,10 @@ EnrollRsa2048ToKek (
     Status = EFI_UNSUPPORTED;
     goto ON_EXIT;
   }
-  
+
   //
   // Convert the Public key to fix octet string format represented in RSA PKCS#1.
-  // 
+  //
   KeyLenInBytes = KeyInfo->KeyLengthInBits / 8;
   KeyBuffer = AllocateZeroPool (KeyLenInBytes);
   if (KeyBuffer == NULL) {
@@ -569,13 +654,13 @@ EnrollRsa2048ToKek (
     goto ON_EXIT;
   }
   Int2OctStr (
-    (UINTN*) (KeyBlob + sizeof (CPL_KEY_INFO)), 
-    KeyLenInBytes / sizeof (UINTN), 
-    KeyBuffer, 
+    (UINTN*) (KeyBlob + sizeof (CPL_KEY_INFO)),
+    KeyLenInBytes / sizeof (UINTN),
+    KeyBuffer,
     KeyLenInBytes
     );
   CopyMem(KeyBlob + sizeof(CPL_KEY_INFO), KeyBuffer, KeyLenInBytes);
-  
+
   //
   // Form an new EFI_SIGNATURE_LIST.
   //
@@ -595,7 +680,7 @@ EnrollRsa2048ToKek (
   KekSigList->SignatureHeaderSize = 0;
   KekSigList->SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + WIN_CERT_UEFI_RSA2048_SIZE;
   CopyGuid (&KekSigList->SignatureType, &gEfiCertRsa2048Guid);
-  
+
   KEKSigData = (EFI_SIGNATURE_DATA*)((UINT8*)KekSigList + sizeof(EFI_SIGNATURE_LIST));
   CopyGuid (&KEKSigData->SignatureOwner, Private->SignatureGUID);
   CopyMem (
@@ -603,13 +688,13 @@ EnrollRsa2048ToKek (
     KeyBlob + sizeof(CPL_KEY_INFO),
     WIN_CERT_UEFI_RSA2048_SIZE
     );
-  
+
   //
-  // Check if KEK entry has been already existed. 
-  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the 
+  // Check if KEK entry has been already existed.
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
   // new KEK to original variable.
-  //            
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS 
+  //
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
          | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
   Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);
   if (EFI_ERROR (Status)) {
@@ -618,10 +703,10 @@ EnrollRsa2048ToKek (
   }
 
   Status = gRT->GetVariable(
-                  EFI_KEY_EXCHANGE_KEY_NAME, 
-                  &gEfiGlobalVariableGuid, 
-                  NULL, 
-                  &DataSize, 
+                  EFI_KEY_EXCHANGE_KEY_NAME,
+                  &gEfiGlobalVariableGuid,
+                  NULL,
+                  &DataSize,
                   NULL
                   );
   if (Status == EFI_BUFFER_TOO_SMALL) {
@@ -629,26 +714,24 @@ EnrollRsa2048ToKek (
   } else if (Status != EFI_NOT_FOUND) {
     goto ON_EXIT;
   }
-  
+
   //
   // Done. Now we have formed the correct KEKpub database item, just set it into variable storage,
-  //             
+  //
   Status = gRT->SetVariable(
-                  EFI_KEY_EXCHANGE_KEY_NAME, 
-                  &gEfiGlobalVariableGuid, 
-                  Attr, 
-                  KekSigListSize, 
+                  EFI_KEY_EXCHANGE_KEY_NAME,
+                  &gEfiGlobalVariableGuid,
+                  Attr,
+                  KekSigListSize,
                   KekSigList
                   );
   if (EFI_ERROR (Status)) {
     goto ON_EXIT;
   }
-  
+
 ON_EXIT:
 
-  CloseFile (Private->FileContext->FHandle);
-  Private->FileContext->FHandle = NULL;
-  Private->FileContext->FileName = NULL;
+  CloseEnrolledFile(Private->FileContext);
 
   if (Private->SignatureGUID != NULL) {
     FreePool (Private->SignatureGUID);
@@ -664,7 +747,7 @@ ON_EXIT:
   if (KekSigList != NULL) {
     FreePool (KekSigList);
   }
-  
+
   return Status;
 }
 
@@ -682,7 +765,7 @@ ON_EXIT:
 EFI_STATUS
 EnrollX509ToKek (
   IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private
-  ) 
+  )
 {
   EFI_STATUS                        Status;
   UINTN                             X509DataSize;
@@ -720,7 +803,7 @@ EnrollX509ToKek (
 
   //
   // Fill Certificate Database parameters.
-  // 
+  //
   KekSigList->SignatureListSize   = (UINT32) KekSigListSize;
   KekSigList->SignatureHeaderSize = 0;
   KekSigList->SignatureSize = (UINT32) (sizeof(EFI_SIGNATURE_DATA) - 1 + X509DataSize);
@@ -731,35 +814,35 @@ EnrollX509ToKek (
   CopyMem (KEKSigData->SignatureData, X509Data, X509DataSize);
 
   //
-  // Check if KEK been already existed. 
-  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the 
+  // Check if KEK been already existed.
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
   // new kek to original variable
-  //    
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS 
+  //
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
   Status = CreateTimeBasedPayload (&KekSigListSize, (UINT8**) &KekSigList);
   if (EFI_ERROR (Status)) {
     DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
     goto ON_EXIT;
   }
-  
+
   Status = gRT->GetVariable(
-                  EFI_KEY_EXCHANGE_KEY_NAME, 
-                  &gEfiGlobalVariableGuid, 
-                  NULL, 
-                  &DataSize, 
+                  EFI_KEY_EXCHANGE_KEY_NAME,
+                  &gEfiGlobalVariableGuid,
+                  NULL,
+                  &DataSize,
                   NULL
                   );
   if (Status == EFI_BUFFER_TOO_SMALL) {
     Attr |= EFI_VARIABLE_APPEND_WRITE;
   } else if (Status != EFI_NOT_FOUND) {
     goto ON_EXIT;
-  }  
+  }
 
   Status = gRT->SetVariable(
-                  EFI_KEY_EXCHANGE_KEY_NAME, 
-                  &gEfiGlobalVariableGuid, 
-                  Attr, 
+                  EFI_KEY_EXCHANGE_KEY_NAME,
+                  &gEfiGlobalVariableGuid,
+                  Attr,
                   KekSigListSize,
                   KekSigList
                   );
@@ -769,9 +852,7 @@ EnrollX509ToKek (
 
 ON_EXIT:
 
-  CloseFile (Private->FileContext->FHandle);
-  Private->FileContext->FileName = NULL;
-  Private->FileContext->FHandle = NULL;
+  CloseEnrolledFile(Private->FileContext);
 
   if (Private->SignatureGUID != NULL) {
     FreePool (Private->SignatureGUID);
@@ -788,23 +869,24 @@ ON_EXIT:
 /**
   Enroll new KEK into the System without PK's authentication.
   The SignatureOwner GUID will be Private->SignatureGUID.
-  
+
   @param[in] PrivateData     The module's private data.
-  
+
   @retval   EFI_SUCCESS            New KEK enrolled successful.
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
   @retval   others                 Fail to enroll KEK data.
-  
+
 **/
 EFI_STATUS
 EnrollKeyExchangeKey (
   IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private
-  ) 
+  )
 {
   UINT16*     FilePostFix;
   EFI_STATUS  Status;
-  
-  if ((Private->FileContext->FileName == NULL) || (Private->SignatureGUID == NULL)) {
+  UINTN       NameLength;
+
+  if ((Private->FileContext->FHandle == NULL) || (Private->FileContext->FileName == NULL) || (Private->SignatureGUID == NULL)) {
     return EFI_INVALID_PARAMETER;
   }
 
@@ -814,27 +896,36 @@ EnrollKeyExchangeKey (
   }
 
   //
-  // Parse the file's postfix. Supports DER-encoded X509 certificate, 
+  // Parse the file's postfix. Supports DER-encoded X509 certificate,
   // and .pbk as RSA public key file.
   //
-  FilePostFix = Private->FileContext->FileName + StrLen (Private->FileContext->FileName) - 4;
+  NameLength = StrLen (Private->FileContext->FileName);
+  if (NameLength <= 4) {
+    return EFI_INVALID_PARAMETER;
+  }
+  FilePostFix = Private->FileContext->FileName + NameLength - 4;
   if (IsDerEncodeCertificate(FilePostFix)) {
     return EnrollX509ToKek (Private);
   } else if (CompareMem (FilePostFix, L".pbk",4) == 0) {
     return EnrollRsa2048ToKek (Private);
   } else {
+    //
+    // File type is wrong, simply close it
+    //
+    CloseEnrolledFile(Private->FileContext);
+
     return EFI_INVALID_PARAMETER;
   }
 }
 
 /**
-  Enroll a new X509 certificate into Signature Database (DB or DBX) without
+  Enroll a new X509 certificate into Signature Database (DB or DBX or DBT) without
   KEK's authentication.
 
   @param[in] PrivateData     The module's private data.
-  @param[in] VariableName    Variable name of signature database, must be 
+  @param[in] VariableName    Variable name of signature database, must be
                              EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.
-  
+
   @retval   EFI_SUCCESS            New X509 is enrolled successfully.
   @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
 
@@ -843,7 +934,7 @@ EFI_STATUS
 EnrollX509toSigDB (
   IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
   IN CHAR16                         *VariableName
-  ) 
+  )
 {
   EFI_STATUS                        Status;
   UINTN                             X509DataSize;
@@ -884,7 +975,7 @@ EnrollX509toSigDB (
 
   //
   // Fill Certificate Database parameters.
-  // 
+  //
   SigDBCert = (EFI_SIGNATURE_LIST*) Data;
   SigDBCert->SignatureListSize   = (UINT32) SigDBSize;
   SigDBCert->SignatureHeaderSize = 0;
@@ -896,11 +987,11 @@ EnrollX509toSigDB (
   CopyMem ((UINT8* ) (SigDBCertData->SignatureData), X509Data, X509DataSize);
 
   //
-  // Check if signature database entry has been already existed. 
-  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the 
+  // Check if signature database entry has been already existed.
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
   // new signature data to original variable
-  //    
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS 
+  //
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
   Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);
   if (EFI_ERROR (Status)) {
@@ -909,22 +1000,22 @@ EnrollX509toSigDB (
   }
 
   Status = gRT->GetVariable(
-                  VariableName, 
-                  &gEfiImageSecurityDatabaseGuid, 
-                  NULL, 
-                  &DataSize, 
+                  VariableName,
+                  &gEfiImageSecurityDatabaseGuid,
+                  NULL,
+                  &DataSize,
                   NULL
                   );
   if (Status == EFI_BUFFER_TOO_SMALL) {
     Attr |= EFI_VARIABLE_APPEND_WRITE;
   } else if (Status != EFI_NOT_FOUND) {
     goto ON_EXIT;
-  }  
+  }
 
   Status = gRT->SetVariable(
-                  VariableName, 
-                  &gEfiImageSecurityDatabaseGuid, 
-                  Attr, 
+                  VariableName,
+                  &gEfiImageSecurityDatabaseGuid,
+                  Attr,
                   SigDBSize,
                   Data
                   );
@@ -934,9 +1025,7 @@ EnrollX509toSigDB (
 
 ON_EXIT:
 
-  CloseFile (Private->FileContext->FHandle);
-  Private->FileContext->FileName = NULL;
-  Private->FileContext->FHandle = NULL;
+  CloseEnrolledFile(Private->FileContext);
 
   if (Private->SignatureGUID != NULL) {
     FreePool (Private->SignatureGUID);
@@ -955,173 +1044,864 @@ ON_EXIT:
 }
 
 /**
-  Load PE/COFF image information into internal buffer and check its validity.
+  Check whether signature is in specified database.
 
-  @retval   EFI_SUCCESS         Successful
-  @retval   EFI_UNSUPPORTED     Invalid PE/COFF file
-  @retval   EFI_ABORTED         Serious error occurs, like file I/O error etc.
+  @param[in]  VariableName        Name of database variable that is searched in.
+  @param[in]  Signature           Pointer to signature that is searched for.
+  @param[in]  SignatureSize       Size of Signature.
+
+  @return TRUE                    Found the signature in the variable database.
+  @return FALSE                   Not found the signature in the variable database.
 
 **/
-EFI_STATUS
-LoadPeImage (
-  VOID 
-  )   
+BOOLEAN
+IsSignatureFoundInDatabase (
+  IN CHAR16             *VariableName,
+  IN UINT8              *Signature,
+  IN UINTN              SignatureSize
+  )
 {
-  EFI_IMAGE_DOS_HEADER                  *DosHdr;
-  EFI_IMAGE_NT_HEADERS32                *NtHeader32;
-  EFI_IMAGE_NT_HEADERS64                *NtHeader64;
+  EFI_STATUS          Status;
+  EFI_SIGNATURE_LIST  *CertList;
+  EFI_SIGNATURE_DATA  *Cert;
+  UINTN               DataSize;
+  UINT8               *Data;
+  UINTN               Index;
+  UINTN               CertCount;
+  BOOLEAN             IsFound;
+
+  //
+  // Read signature database variable.
+  //
+  IsFound   = FALSE;
+  Data      = NULL;
+  DataSize  = 0;
+  Status    = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
+  if (Status != EFI_BUFFER_TOO_SMALL) {
+    return FALSE;
+  }
 
-  NtHeader32 = NULL;
-  NtHeader64 = NULL;
-  //
-  // Read the Dos header
-  //
-  DosHdr = (EFI_IMAGE_DOS_HEADER*)(mImageBase);
-  if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE)
-  {
-    //
-    // DOS image header is present, 
-    // So read the PE header after the DOS image header
-    //
-    mPeCoffHeaderOffset = DosHdr->e_lfanew;
+  Data = (UINT8 *) AllocateZeroPool (DataSize);
+  if (Data == NULL) {
+    return FALSE;
   }
-  else
-  {
-    mPeCoffHeaderOffset = 0;
+
+  Status = gRT->GetVariable (VariableName, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);
+  if (EFI_ERROR (Status)) {
+    goto Done;
   }
 
   //
-  // Read PE header and check the signature validity and machine compatibility
+  // Enumerate all signature data in SigDB to check if executable's signature exists.
   //
-  NtHeader32 = (EFI_IMAGE_NT_HEADERS32*) (mImageBase + mPeCoffHeaderOffset);
-  if (NtHeader32->Signature != EFI_IMAGE_NT_SIGNATURE)
-  {
-    return EFI_UNSUPPORTED;
-  }
+  CertList = (EFI_SIGNATURE_LIST *) Data;
+  while ((DataSize > 0) && (DataSize >= CertList->SignatureListSize)) {
+    CertCount = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
+    Cert      = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList + sizeof (EFI_SIGNATURE_LIST) + CertList->SignatureHeaderSize);
+    if ((CertList->SignatureSize == sizeof(EFI_SIGNATURE_DATA) - 1 + SignatureSize) && (CompareGuid(&CertList->SignatureType, &gEfiCertX509Guid))) {
+      for (Index = 0; Index < CertCount; Index++) {
+        if (CompareMem (Cert->SignatureData, Signature, SignatureSize) == 0) {
+          //
+          // Find the signature in database.
+          //
+          IsFound = TRUE;
+          break;
+        }
+        Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) Cert + CertList->SignatureSize);
+      }
 
-  mNtHeader.Pe32 = NtHeader32;
+      if (IsFound) {
+        break;
+      }
+    }
 
-  //
-  // Check the architecture field of PE header and get the Certificate Data Directory data
-  // Note the size of FileHeader field is constant for both IA32 and X64 arch
-  //
-  if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA32) 
-      || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_EBC)) {
-    //
-    // IA-32 Architecture
-    //
-    mImageType = ImageType_IA32;
-    mSecDataDir = (EFI_IMAGE_SECURITY_DATA_DIRECTORY*) &(NtHeader32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]);
+    DataSize -= CertList->SignatureListSize;
+    CertList  = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
   }
-  else if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA64)
-          || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_X64)) {
-    //
-    // 64-bits Architecture
-    //
-    mImageType = ImageType_X64;
-    NtHeader64 = (EFI_IMAGE_NT_HEADERS64 *) (mImageBase + mPeCoffHeaderOffset);
-    mSecDataDir = (EFI_IMAGE_SECURITY_DATA_DIRECTORY*) &(NtHeader64->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]);
-  } else {
-    return EFI_UNSUPPORTED;
+
+Done:
+  if (Data != NULL) {
+    FreePool (Data);
   }
 
-  return EFI_SUCCESS;
+  return IsFound;
 }
 
 /**
-  Calculate hash of Pe/Coff image based on the authenticode image hashing in
-  PE/COFF Specification 8.0 Appendix A
+  Calculate the hash of a certificate data with the specified hash algorithm.
 
-  @param[in]    HashAlg   Hash algorithm type.
- 
-  @retval TRUE            Successfully hash image.
-  @retval FALSE           Fail in hash image.
+  @param[in]    CertData  The certificate data to be hashed.
+  @param[in]    CertSize  The certificate size in bytes.
+  @param[in]    HashAlg   The specified hash algorithm.
+  @param[out]   CertHash  The output digest of the certificate
+
+  @retval TRUE            Successfully got the hash of the CertData.
+  @retval FALSE           Failed to get the hash of CertData.
 
 **/
-BOOLEAN 
-HashPeImage (
-  IN  UINT32                HashAlg
+BOOLEAN
+CalculateCertHash (
+  IN  UINT8                 *CertData,
+  IN  UINTN                 CertSize,
+  IN  UINT32                HashAlg,
+  OUT UINT8                 *CertHash
   )
 {
   BOOLEAN                   Status;
-  UINT16                    Magic;
-  EFI_IMAGE_SECTION_HEADER  *Section;
   VOID                      *HashCtx;
   UINTN                     CtxSize;
-  UINT8                     *HashBase;
-  UINTN                     HashSize;
-  UINTN                     SumOfBytesHashed;
-  EFI_IMAGE_SECTION_HEADER  *SectionHeader;
-  UINTN                     Index;
-  UINTN                     Pos;
+  UINT8                     *TBSCert;
+  UINTN                     TBSCertSize;
 
-  HashCtx       = NULL;
-  SectionHeader = NULL;
-  Status        = FALSE;
+  HashCtx = NULL;
+  Status  = FALSE;
 
-  if ((HashAlg != HASHALG_SHA1) && (HashAlg != HASHALG_SHA256)) {
+  if (HashAlg >= HASHALG_MAX) {
     return FALSE;
   }
-  
+
   //
-  // Initialize context of hash.
+  // Retrieve the TBSCertificate for Hash Calculation.
   //
-  ZeroMem (mImageDigest, MAX_DIGEST_SIZE);
-
-  if (HashAlg == HASHALG_SHA1) {
-    mImageDigestSize  = SHA1_DIGEST_SIZE;
-    mCertType         = gEfiCertSha1Guid;    
-  } else if (HashAlg == HASHALG_SHA256) {
-    mImageDigestSize  = SHA256_DIGEST_SIZE;
-    mCertType         = gEfiCertSha256Guid;
+  if (!X509GetTBSCert (CertData, CertSize, &TBSCert, &TBSCertSize)) {
+    return FALSE;
   }
 
-  CtxSize   = mHash[HashAlg].GetContextSize();
-  
+  //
+  // 1. Initialize context of hash.
+  //
+  CtxSize = mHash[HashAlg].GetContextSize ();
   HashCtx = AllocatePool (CtxSize);
   ASSERT (HashCtx != NULL);
 
-  // 1.  Load the image header into memory.
-
-  // 2.  Initialize a SHA hash context.
-  Status = mHash[HashAlg].HashInit(HashCtx);
+  //
+  // 2. Initialize a hash context.
+  //
+  Status = mHash[HashAlg].HashInit (HashCtx);
   if (!Status) {
     goto Done;
   }
+
   //
-  // Measuring PE/COFF Image Header;
-  // But CheckSum field and SECURITY data directory (certificate) are excluded
+  // 3. Calculate the hash.
   //
-  if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
-    //
-    // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value 
-    //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the 
-    //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
-    //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
-    //
-    Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;
-  } else {
-    //
-    // Get the magic value from the PE/COFF Optional Header
-    //
-    Magic = mNtHeader.Pe32->OptionalHeader.Magic;
+  Status  = mHash[HashAlg].HashUpdate (HashCtx, TBSCert, TBSCertSize);
+  if (!Status) {
+    goto Done;
   }
-  
+
   //
-  // 3.  Calculate the distance from the base of the image header to the image checksum address.
-  // 4.  Hash the image header from its base to beginning of the image checksum.
+  // 4. Get the hash result.
   //
-  HashBase = mImageBase;
-  if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
-    //
-    // Use PE32 offset.
-    //
-    HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32->OptionalHeader.CheckSum) - HashBase);
-  } else {
-    //
+  ZeroMem (CertHash, mHash[HashAlg].DigestLength);
+  Status  = mHash[HashAlg].HashFinal (HashCtx, CertHash);
+
+Done:
+  if (HashCtx != NULL) {
+    FreePool (HashCtx);
+  }
+
+  return Status;
+}
+
+/**
+  Check whether the hash of an X.509 certificate is in forbidden database (DBX).
+
+  @param[in]  Certificate       Pointer to X.509 Certificate that is searched for.
+  @param[in]  CertSize          Size of X.509 Certificate.
+
+  @return TRUE               Found the certificate hash in the forbidden database.
+  @return FALSE              Certificate hash is Not found in the forbidden database.
+
+**/
+BOOLEAN
+IsCertHashFoundInDbx (
+  IN  UINT8               *Certificate,
+  IN  UINTN               CertSize
+  )
+{
+  BOOLEAN                 IsFound;
+  EFI_STATUS              Status;
+  EFI_SIGNATURE_LIST      *DbxList;
+  EFI_SIGNATURE_DATA      *CertHash;
+  UINTN                   CertHashCount;
+  UINTN                   Index;
+  UINT32                  HashAlg;
+  UINT8                   CertDigest[MAX_DIGEST_SIZE];
+  UINT8                   *DbxCertHash;
+  UINTN                   SiglistHeaderSize;
+  UINT8                   *Data;
+  UINTN                   DataSize;
+
+  IsFound  = FALSE;
+  HashAlg  = HASHALG_MAX;
+  Data     = NULL;
+
+  //
+  // Read signature database variable.
+  //
+  DataSize  = 0;
+  Status    = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
+  if (Status != EFI_BUFFER_TOO_SMALL) {
+    return FALSE;
+  }
+
+  Data = (UINT8 *) AllocateZeroPool (DataSize);
+  if (Data == NULL) {
+    return FALSE;
+  }
+
+  Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);
+  if (EFI_ERROR (Status)) {
+    goto Done;
+  }
+
+  //
+  // Check whether the certificate hash exists in the forbidden database.
+  //
+  DbxList = (EFI_SIGNATURE_LIST *) Data;
+  while ((DataSize > 0) && (DataSize >= DbxList->SignatureListSize)) {
+    //
+    // Determine Hash Algorithm of Certificate in the forbidden database.
+    //
+    if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha256Guid)) {
+      HashAlg = HASHALG_SHA256;
+    } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha384Guid)) {
+      HashAlg = HASHALG_SHA384;
+    } else if (CompareGuid (&DbxList->SignatureType, &gEfiCertX509Sha512Guid)) {
+      HashAlg = HASHALG_SHA512;
+    } else {
+      DataSize -= DbxList->SignatureListSize;
+      DbxList   = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
+      continue;
+    }
+
+    //
+    // Calculate the hash value of current db certificate for comparision.
+    //
+    if (!CalculateCertHash (Certificate, CertSize, HashAlg, CertDigest)) {
+      goto Done;
+    }
+
+    SiglistHeaderSize = sizeof (EFI_SIGNATURE_LIST) + DbxList->SignatureHeaderSize;
+    CertHash          = (EFI_SIGNATURE_DATA *) ((UINT8 *) DbxList + SiglistHeaderSize);
+    CertHashCount     = (DbxList->SignatureListSize - SiglistHeaderSize) / DbxList->SignatureSize;
+    for (Index = 0; Index < CertHashCount; Index++) {
+      //
+      // Iterate each Signature Data Node within this CertList for verify.
+      //
+      DbxCertHash = CertHash->SignatureData;
+      if (CompareMem (DbxCertHash, CertDigest, mHash[HashAlg].DigestLength) == 0) {
+        //
+        // Hash of Certificate is found in forbidden database.
+        //
+        IsFound = TRUE;
+        goto Done;
+      }
+      CertHash = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertHash + DbxList->SignatureSize);
+    }
+
+    DataSize -= DbxList->SignatureListSize;
+    DbxList   = (EFI_SIGNATURE_LIST *) ((UINT8 *) DbxList + DbxList->SignatureListSize);
+  }
+
+Done:
+  if (Data != NULL) {
+    FreePool (Data);
+  }
+
+  return IsFound;
+}
+
+/**
+  Check whether the signature list exists in given variable data.
+
+  It searches the signature list for the ceritificate hash by CertType.
+  If the signature list is found, get the offset of Database for the
+  next hash of a certificate.
+
+  @param[in]  Database      Variable data to save signature list.
+  @param[in]  DatabaseSize  Variable size.
+  @param[in]  SignatureType The type of the signature.
+  @param[out] Offset        The offset to save a new hash of certificate.
+
+  @return TRUE       The signature list is found in the forbidden database.
+  @return FALSE      The signature list is not found in the forbidden database.
+**/
+BOOLEAN
+GetSignaturelistOffset (
+  IN  EFI_SIGNATURE_LIST  *Database,
+  IN  UINTN               DatabaseSize,
+  IN  EFI_GUID            *SignatureType,
+  OUT UINTN               *Offset
+  )
+{
+  EFI_SIGNATURE_LIST      *SigList;
+  UINTN                   SiglistSize;
+
+  if ((Database == NULL) || (DatabaseSize == 0)) {
+    *Offset = 0;
+    return FALSE;
+  }
+
+  SigList     = Database;
+  SiglistSize = DatabaseSize;
+  while ((SiglistSize > 0) && (SiglistSize >= SigList->SignatureListSize)) {
+    if (CompareGuid (&SigList->SignatureType, SignatureType)) {
+      *Offset = DatabaseSize - SiglistSize;
+      return TRUE;
+    }
+    SiglistSize -= SigList->SignatureListSize;
+    SigList      = (EFI_SIGNATURE_LIST *) ((UINT8 *) SigList + SigList->SignatureListSize);
+  }
+  *Offset = 0;
+  return FALSE;
+}
+
+/**
+  Enroll a new X509 certificate hash into Signature Database (dbx) without
+  KEK's authentication.
+
+  @param[in] PrivateData      The module's private data.
+  @param[in] HashAlg          The hash algorithm to enroll the certificate.
+  @param[in] RevocationDate   The revocation date of the certificate.
+  @param[in] RevocationTime   The revocation time of the certificate.
+  @param[in] AlwaysRevocation Indicate whether the certificate is always revoked.
+
+  @retval   EFI_SUCCESS            New X509 is enrolled successfully.
+  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
+  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
+
+**/
+EFI_STATUS
+EnrollX509HashtoSigDB (
+  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
+  IN UINT32                         HashAlg,
+  IN EFI_HII_DATE                   *RevocationDate,
+  IN EFI_HII_TIME                   *RevocationTime,
+  IN BOOLEAN                        AlwaysRevocation
+  )
+{
+  EFI_STATUS          Status;
+  UINTN               X509DataSize;
+  VOID                *X509Data;
+  EFI_SIGNATURE_LIST  *SignatureList;
+  UINTN               SignatureListSize;
+  UINT8               *Data;
+  UINT8               *NewData;
+  UINTN               DataSize;
+  UINTN               DbSize;
+  UINT32              Attr;
+  EFI_SIGNATURE_DATA  *SignatureData;
+  UINTN               SignatureSize;
+  EFI_GUID            SignatureType;
+  UINTN               Offset;
+  UINT8               CertHash[MAX_DIGEST_SIZE];
+  UINT16*             FilePostFix;
+  UINTN               NameLength;
+  EFI_TIME            *Time;
+
+  X509DataSize  = 0;
+  DbSize        = 0;
+  X509Data      = NULL;
+  SignatureData = NULL;
+  SignatureList = NULL;
+  Data          = NULL;
+  NewData       = NULL;
+
+  if ((Private->FileContext->FileName == NULL) || (Private->FileContext->FHandle == NULL) || (Private->SignatureGUID == NULL)) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
+  if (EFI_ERROR (Status)) {
+    return Status;
+  }
+
+  //
+  // Parse the file's postfix.
+  //
+  NameLength = StrLen (Private->FileContext->FileName);
+  if (NameLength <= 4) {
+    return EFI_INVALID_PARAMETER;
+  }
+  FilePostFix = Private->FileContext->FileName + NameLength - 4;
+  if (!IsDerEncodeCertificate(FilePostFix)) {
+    //
+    // Only supports DER-encoded X509 certificate.
+    //
+    return EFI_INVALID_PARAMETER;
+  }
+
+  //
+  // Get the certificate from file and calculate its hash.
+  //
+  Status = ReadFileContent (
+             Private->FileContext->FHandle,
+             &X509Data,
+             &X509DataSize,
+             0
+             );
+  if (EFI_ERROR (Status)) {
+    goto ON_EXIT;
+  }
+  ASSERT (X509Data != NULL);
+
+  if (!CalculateCertHash (X509Data, X509DataSize, HashAlg, CertHash)) {
+    goto ON_EXIT;
+  }
+
+  //
+  // Get the variable for enrollment.
+  //
+  DataSize = 0;
+  Status   = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, NULL);
+  if (Status == EFI_BUFFER_TOO_SMALL) {
+    Data = (UINT8 *) AllocateZeroPool (DataSize);
+    if (Data == NULL) {
+      return EFI_OUT_OF_RESOURCES;
+    }
+
+    Status = gRT->GetVariable (EFI_IMAGE_SECURITY_DATABASE1, &gEfiImageSecurityDatabaseGuid, NULL, &DataSize, Data);
+    if (EFI_ERROR (Status)) {
+      goto ON_EXIT;
+    }
+  }
+
+  //
+  // Allocate memory for Signature and fill the Signature
+  //
+  SignatureSize = sizeof(EFI_SIGNATURE_DATA) - 1 + sizeof (EFI_TIME) + mHash[HashAlg].DigestLength;
+  SignatureData = (EFI_SIGNATURE_DATA *) AllocateZeroPool (SignatureSize);
+  if (SignatureData == NULL) {
+    return EFI_OUT_OF_RESOURCES;
+  }
+  CopyGuid (&SignatureData->SignatureOwner, Private->SignatureGUID);
+  CopyMem (SignatureData->SignatureData, CertHash, mHash[HashAlg].DigestLength);
+
+  //
+  // Fill the time.
+  //
+  if (!AlwaysRevocation) {
+    Time = (EFI_TIME *)(&SignatureData->SignatureData + mHash[HashAlg].DigestLength);
+    Time->Year   = RevocationDate->Year;
+    Time->Month  = RevocationDate->Month;
+    Time->Day    = RevocationDate->Day;
+    Time->Hour   = RevocationTime->Hour;
+    Time->Minute = RevocationTime->Minute;
+    Time->Second = RevocationTime->Second;
+  }
+
+  //
+  // Determine the GUID for certificate hash.
+  //
+  switch (HashAlg) {
+  case HASHALG_SHA256:
+    SignatureType = gEfiCertX509Sha256Guid;
+    break;
+  case HASHALG_SHA384:
+    SignatureType = gEfiCertX509Sha384Guid;
+    break;
+  case HASHALG_SHA512:
+    SignatureType = gEfiCertX509Sha512Guid;
+    break;
+  default:
+    return FALSE;
+  }
+
+  //
+  // Add signature into the new variable data buffer
+  //
+  if (GetSignaturelistOffset((EFI_SIGNATURE_LIST *)Data, DataSize, &SignatureType, &Offset)) {
+    //
+    // Add the signature to the found signaturelist.
+    //
+    DbSize  = DataSize + SignatureSize;
+    NewData = AllocateZeroPool (DbSize);
+    if (NewData == NULL) {
+      Status = EFI_OUT_OF_RESOURCES;
+      goto ON_EXIT;
+    }
+
+    SignatureList     = (EFI_SIGNATURE_LIST *)(Data + Offset);
+    SignatureListSize = (UINTN) ReadUnaligned32 ((UINT32 *)&SignatureList->SignatureListSize);
+    CopyMem (NewData, Data, Offset + SignatureListSize);
+
+    SignatureList = (EFI_SIGNATURE_LIST *)(NewData + Offset);
+    WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32)(SignatureListSize + SignatureSize));
+
+    Offset += SignatureListSize;
+    CopyMem (NewData + Offset, SignatureData, SignatureSize);
+    CopyMem (NewData + Offset + SignatureSize, Data + Offset, DataSize - Offset);
+
+    FreePool (Data);
+    Data     = NewData;
+    DataSize = DbSize;
+  } else {
+    //
+    // Create a new signaturelist, and add the signature into the signaturelist.
+    //
+    DbSize  = DataSize + sizeof(EFI_SIGNATURE_LIST) + SignatureSize;
+    NewData = AllocateZeroPool (DbSize);
+    if (NewData == NULL) {
+      Status = EFI_OUT_OF_RESOURCES;
+      goto ON_EXIT;
+    }
+    //
+    // Fill Certificate Database parameters.
+    //
+    SignatureList     = (EFI_SIGNATURE_LIST*) (NewData + DataSize);
+    SignatureListSize = sizeof(EFI_SIGNATURE_LIST) + SignatureSize;
+    WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureListSize, (UINT32) SignatureListSize);
+    WriteUnaligned32 ((UINT32 *) &SignatureList->SignatureSize, (UINT32) SignatureSize);
+    CopyGuid (&SignatureList->SignatureType, &SignatureType);
+    CopyMem ((UINT8* ) SignatureList + sizeof (EFI_SIGNATURE_LIST), SignatureData, SignatureSize);
+    if ((DataSize != 0) && (Data != NULL)) {
+      CopyMem (NewData, Data, DataSize);
+      FreePool (Data);
+    }
+    Data     = NewData;
+    DataSize = DbSize;
+  }
+
+  Status = CreateTimeBasedPayload (&DataSize, (UINT8**) &Data);
+  if (EFI_ERROR (Status)) {
+    goto ON_EXIT;
+  }
+
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
+          | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+  Status = gRT->SetVariable(
+                  EFI_IMAGE_SECURITY_DATABASE1,
+                  &gEfiImageSecurityDatabaseGuid,
+                  Attr,
+                  DataSize,
+                  Data
+                  );
+  if (EFI_ERROR (Status)) {
+    goto ON_EXIT;
+  }
+
+ON_EXIT:
+
+  CloseEnrolledFile(Private->FileContext);
+
+  if (Private->SignatureGUID != NULL) {
+    FreePool (Private->SignatureGUID);
+    Private->SignatureGUID = NULL;
+  }
+
+  if (Data != NULL) {
+    FreePool (Data);
+  }
+
+  if (SignatureData != NULL) {
+    FreePool (SignatureData);
+  }
+
+  if (X509Data != NULL) {
+    FreePool (X509Data);
+  }
+
+  return Status;
+}
+
+/**
+  Check whether a certificate from a file exists in dbx.
+
+  @param[in] PrivateData     The module's private data.
+  @param[in] VariableName    Variable name of signature database, must be
+                             EFI_IMAGE_SECURITY_DATABASE1.
+
+  @retval   TRUE             The X509 certificate is found in dbx successfully.
+  @retval   FALSE            The X509 certificate is not found in dbx.
+**/
+BOOLEAN
+IsX509CertInDbx (
+  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
+  IN CHAR16                         *VariableName
+  )
+{
+  EFI_STATUS          Status;
+  UINTN               X509DataSize;
+  VOID                *X509Data;
+  BOOLEAN             IsFound;
+
+  //
+  //  Read the certificate from file
+  //
+  X509DataSize  = 0;
+  X509Data      = NULL;
+  Status = ReadFileContent (
+             Private->FileContext->FHandle,
+             &X509Data,
+             &X509DataSize,
+             0
+             );
+  if (EFI_ERROR (Status)) {
+    return FALSE;
+  }
+
+  //
+  // Check the raw certificate.
+  //
+  IsFound = FALSE;
+  if (IsSignatureFoundInDatabase (EFI_IMAGE_SECURITY_DATABASE1, X509Data, X509DataSize)) {
+    IsFound = TRUE;
+    goto ON_EXIT;
+  }
+
+  //
+  // Check the hash of certificate.
+  //
+  if (IsCertHashFoundInDbx (X509Data, X509DataSize)) {
+    IsFound = TRUE;
+    goto ON_EXIT;
+  }
+
+ON_EXIT:
+  if (X509Data != NULL) {
+    FreePool (X509Data);
+  }
+
+  return IsFound;
+}
+
+/**
+  Reads contents of a PE/COFF image in memory buffer.
+
+  Caution: This function may receive untrusted input.
+  PE/COFF image is external input, so this function will make sure the PE/COFF image content
+  read is within the image buffer.
+
+  @param  FileHandle      Pointer to the file handle to read the PE/COFF image.
+  @param  FileOffset      Offset into the PE/COFF image to begin the read operation.
+  @param  ReadSize        On input, the size in bytes of the requested read operation.
+                          On output, the number of bytes actually read.
+  @param  Buffer          Output buffer that contains the data read from the PE/COFF image.
+
+  @retval EFI_SUCCESS     The specified portion of the PE/COFF image was read and the size
+**/
+EFI_STATUS
+EFIAPI
+SecureBootConfigImageRead (
+  IN     VOID    *FileHandle,
+  IN     UINTN   FileOffset,
+  IN OUT UINTN   *ReadSize,
+  OUT    VOID    *Buffer
+  )
+{
+  UINTN               EndPosition;
+
+  if (FileHandle == NULL || ReadSize == NULL || Buffer == NULL) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  if (MAX_ADDRESS - FileOffset < *ReadSize) {
+    return EFI_INVALID_PARAMETER;
+  }
+
+  EndPosition = FileOffset + *ReadSize;
+  if (EndPosition > mImageSize) {
+    *ReadSize = (UINT32)(mImageSize - FileOffset);
+  }
+
+  if (FileOffset >= mImageSize) {
+    *ReadSize = 0;
+  }
+
+  CopyMem (Buffer, (UINT8 *)((UINTN) FileHandle + FileOffset), *ReadSize);
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Load PE/COFF image information into internal buffer and check its validity.
+
+  @retval   EFI_SUCCESS         Successful
+  @retval   EFI_UNSUPPORTED     Invalid PE/COFF file
+  @retval   EFI_ABORTED         Serious error occurs, like file I/O error etc.
+
+**/
+EFI_STATUS
+LoadPeImage (
+  VOID
+  )
+{
+  EFI_IMAGE_DOS_HEADER                  *DosHdr;
+  EFI_IMAGE_NT_HEADERS32                *NtHeader32;
+  EFI_IMAGE_NT_HEADERS64                *NtHeader64;
+  PE_COFF_LOADER_IMAGE_CONTEXT          ImageContext;
+  EFI_STATUS                            Status;
+
+  NtHeader32 = NULL;
+  NtHeader64 = NULL;
+
+  ZeroMem (&ImageContext, sizeof (ImageContext));
+  ImageContext.Handle    = (VOID *) mImageBase;
+  ImageContext.ImageRead = (PE_COFF_LOADER_READ_FILE) SecureBootConfigImageRead;
+
+  //
+  // Get information about the image being loaded
+  //
+  Status = PeCoffLoaderGetImageInfo (&ImageContext);
+  if (EFI_ERROR (Status)) {
+    //
+    // The information can't be got from the invalid PeImage
+    //
+    DEBUG ((DEBUG_INFO, "SecureBootConfigDxe: PeImage invalid. \n"));
+    return Status;
+  }
+
+  //
+  // Read the Dos header
+  //
+  DosHdr = (EFI_IMAGE_DOS_HEADER*)(mImageBase);
+  if (DosHdr->e_magic == EFI_IMAGE_DOS_SIGNATURE)
+  {
+    //
+    // DOS image header is present,
+    // So read the PE header after the DOS image header
+    //
+    mPeCoffHeaderOffset = DosHdr->e_lfanew;
+  }
+  else
+  {
+    mPeCoffHeaderOffset = 0;
+  }
+
+  //
+  // Read PE header and check the signature validity and machine compatibility
+  //
+  NtHeader32 = (EFI_IMAGE_NT_HEADERS32*) (mImageBase + mPeCoffHeaderOffset);
+  if (NtHeader32->Signature != EFI_IMAGE_NT_SIGNATURE)
+  {
+    return EFI_UNSUPPORTED;
+  }
+
+  mNtHeader.Pe32 = NtHeader32;
+
+  //
+  // Check the architecture field of PE header and get the Certificate Data Directory data
+  // Note the size of FileHeader field is constant for both IA32 and X64 arch
+  //
+  if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA32)
+      || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_EBC)
+      || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_ARMTHUMB_MIXED)) {
+    //
+    // 32-bits Architecture
+    //
+    mImageType = ImageType_IA32;
+    mSecDataDir = (EFI_IMAGE_SECURITY_DATA_DIRECTORY*) &(NtHeader32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]);
+  }
+  else if ((NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_IA64)
+          || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_X64)
+          || (NtHeader32->FileHeader.Machine == EFI_IMAGE_MACHINE_AARCH64)) {
+    //
+    // 64-bits Architecture
+    //
+    mImageType = ImageType_X64;
+    NtHeader64 = (EFI_IMAGE_NT_HEADERS64 *) (mImageBase + mPeCoffHeaderOffset);
+    mSecDataDir = (EFI_IMAGE_SECURITY_DATA_DIRECTORY*) &(NtHeader64->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]);
+  } else {
+    return EFI_UNSUPPORTED;
+  }
+
+  return EFI_SUCCESS;
+}
+
+/**
+  Calculate hash of Pe/Coff image based on the authenticode image hashing in
+  PE/COFF Specification 8.0 Appendix A
+
+  Notes: PE/COFF image has been checked by BasePeCoffLib PeCoffLoaderGetImageInfo() in 
+  the function LoadPeImage ().
+
+  @param[in]    HashAlg   Hash algorithm type.
+
+  @retval TRUE            Successfully hash image.
+  @retval FALSE           Fail in hash image.
+
+**/
+BOOLEAN
+HashPeImage (
+  IN  UINT32                HashAlg
+  )
+{
+  BOOLEAN                   Status;
+  UINT16                    Magic;
+  EFI_IMAGE_SECTION_HEADER  *Section;
+  VOID                      *HashCtx;
+  UINTN                     CtxSize;
+  UINT8                     *HashBase;
+  UINTN                     HashSize;
+  UINTN                     SumOfBytesHashed;
+  EFI_IMAGE_SECTION_HEADER  *SectionHeader;
+  UINTN                     Index;
+  UINTN                     Pos;
+
+  HashCtx       = NULL;
+  SectionHeader = NULL;
+  Status        = FALSE;
+
+  if (HashAlg != HASHALG_SHA256) {
+    return FALSE;
+  }
+
+  //
+  // Initialize context of hash.
+  //
+  ZeroMem (mImageDigest, MAX_DIGEST_SIZE);
+
+  mImageDigestSize  = SHA256_DIGEST_SIZE;
+  mCertType         = gEfiCertSha256Guid;
+
+  CtxSize   = mHash[HashAlg].GetContextSize();
+
+  HashCtx = AllocatePool (CtxSize);
+  ASSERT (HashCtx != NULL);
+
+  // 1.  Load the image header into memory.
+
+  // 2.  Initialize a SHA hash context.
+  Status = mHash[HashAlg].HashInit(HashCtx);
+  if (!Status) {
+    goto Done;
+  }
+  //
+  // Measuring PE/COFF Image Header;
+  // But CheckSum field and SECURITY data directory (certificate) are excluded
+  //
+  if (mNtHeader.Pe32->FileHeader.Machine == IMAGE_FILE_MACHINE_IA64 && mNtHeader.Pe32->OptionalHeader.Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
+    //
+    // NOTE: Some versions of Linux ELILO for Itanium have an incorrect magic value
+    //       in the PE/COFF Header. If the MachineType is Itanium(IA64) and the
+    //       Magic value in the OptionalHeader is EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC
+    //       then override the magic value to EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC
+    //
+    Magic = EFI_IMAGE_NT_OPTIONAL_HDR64_MAGIC;
+  } else {
+    //
+    // Get the magic value from the PE/COFF Optional Header
+    //
+    Magic = mNtHeader.Pe32->OptionalHeader.Magic;
+  }
+
+  //
+  // 3.  Calculate the distance from the base of the image header to the image checksum address.
+  // 4.  Hash the image header from its base to beginning of the image checksum.
+  //
+  HashBase = mImageBase;
+  if (Magic == EFI_IMAGE_NT_OPTIONAL_HDR32_MAGIC) {
+    //
+    // Use PE32 offset.
+    //
+    HashSize = (UINTN) (&mNtHeader.Pe32->OptionalHeader.CheckSum) - (UINTN) HashBase;
+  } else {
+    //
     // Use PE32+ offset.
     //
-    HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.CheckSum) - HashBase);
+    HashSize = (UINTN) (&mNtHeader.Pe32Plus->OptionalHeader.CheckSum) - (UINTN) HashBase;
   }
 
   Status  = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
@@ -1138,13 +1918,13 @@ HashPeImage (
     // Use PE32 offset.
     //
     HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.CheckSum + sizeof (UINT32);
-    HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);
+    HashSize = (UINTN) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN) HashBase;
   } else {
     //
     // Use PE32+ offset.
-    //    
+    //
     HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.CheckSum + sizeof (UINT32);
-    HashSize = (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - HashBase);
+    HashSize = (UINTN) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY]) - (UINTN) HashBase;
   }
 
   Status  = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
@@ -1160,13 +1940,13 @@ HashPeImage (
     // Use PE32 offset
     //
     HashBase = (UINT8 *) &mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];
-    HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - (UINTN) ((UINT8 *) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1]) - mImageBase);
+    HashSize = mNtHeader.Pe32->OptionalHeader.SizeOfHeaders - ((UINTN) (&mNtHeader.Pe32->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1]) - (UINTN) mImageBase);
   } else {
     //
     // Use PE32+ offset.
     //
     HashBase = (UINT8 *) &mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1];
-    HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - (UINTN) ((UINT8 *) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1]) - mImageBase);
+    HashSize = mNtHeader.Pe32Plus->OptionalHeader.SizeOfHeaders - ((UINTN) (&mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY + 1]) - (UINTN) mImageBase);
   }
 
   Status  = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
@@ -1265,7 +2045,7 @@ HashPeImage (
       HashSize = (UINTN)(
                  mImageSize -
                  mNtHeader.Pe32Plus->OptionalHeader.DataDirectory[EFI_IMAGE_DIRECTORY_ENTRY_SECURITY].Size -
-                 SumOfBytesHashed);      
+                 SumOfBytesHashed);
     }
 
     Status  = mHash[HashAlg].HashUpdate(HashCtx, HashBase, HashSize);
@@ -1287,15 +2067,15 @@ Done:
 }
 
 /**
-  Recognize the Hash algorithm in PE/COFF Authenticode and caculate hash of 
-  Pe/Coff image based on the authenticated image hashing in PE/COFF Specification 
+  Recognize the Hash algorithm in PE/COFF Authenticode and calculate hash of
+  Pe/Coff image based on the authenticated image hashing in PE/COFF Specification
   8.0 Appendix A
 
   @retval EFI_UNSUPPORTED             Hash algorithm is not supported.
   @retval EFI_SUCCESS                 Hash successfully.
 
 **/
-EFI_STATUS 
+EFI_STATUS
 HashPeImageByType (
   VOID
   )
@@ -1305,10 +2085,10 @@ HashPeImageByType (
 
   PkcsCertData = (WIN_CERTIFICATE_EFI_PKCS *) (mImageBase + mSecDataDir->Offset);
 
-  for (Index = 0; Index < HASHALG_MAX; Index++) {  
+  for (Index = 0; Index < HASHALG_MAX; Index++) {
     //
     // Check the Hash algorithm in PE/COFF Authenticode.
-    //    According to PKCS#7 Definition: 
+    //    According to PKCS#7 Definition:
     //        SignedData ::= SEQUENCE {
     //            version Version,
     //            digestAlgorithms DigestAlgorithmIdentifiers,
@@ -1325,7 +2105,7 @@ HashPeImageByType (
       continue;
     }
 
-    //    
+    //
     if (CompareMem (PkcsCertData->CertData + 32, mHash[Index].OidValue, mHash[Index].OidLength) == 0) {
       break;
     }
@@ -1346,11 +2126,113 @@ HashPeImageByType (
 }
 
 /**
-  Enroll a new executable's signature into Signature Database. 
+  Enroll a new executable's signature into Signature Database.
 
   @param[in] PrivateData     The module's private data.
-  @param[in] VariableName    Variable name of signature database, must be 
-                             EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.
+  @param[in] VariableName    Variable name of signature database, must be
+                             EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1
+                             or EFI_IMAGE_SECURITY_DATABASE2.
+
+  @retval   EFI_SUCCESS            New signature is enrolled successfully.
+  @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
+  @retval   EFI_UNSUPPORTED        Unsupported command.
+  @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
+
+**/
+EFI_STATUS
+EnrollAuthentication2Descriptor (
+  IN SECUREBOOT_CONFIG_PRIVATE_DATA *Private,
+  IN CHAR16                         *VariableName
+  )
+{
+  EFI_STATUS                        Status;
+  VOID                              *Data;
+  UINTN                             DataSize;
+  UINT32                            Attr;
+
+  Data = NULL;
+
+  //
+  // DBT only support DER-X509 Cert Enrollment
+  //
+  if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
+    return EFI_UNSUPPORTED;
+  }
+
+  //
+  // Read the whole file content
+  //
+  Status = ReadFileContent(
+             Private->FileContext->FHandle,
+             (VOID **) &mImageBase,
+             &mImageSize,
+             0
+             );
+  if (EFI_ERROR (Status)) {
+    goto ON_EXIT;
+  }
+  ASSERT (mImageBase != NULL);
+
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
+         | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
+
+  //
+  // Check if SigDB variable has been already existed.
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
+  // new signature data to original variable
+  //
+  DataSize = 0;
+  Status = gRT->GetVariable(
+                  VariableName,
+                  &gEfiImageSecurityDatabaseGuid,
+                  NULL,
+                  &DataSize,
+                  NULL
+                  );
+  if (Status == EFI_BUFFER_TOO_SMALL) {
+    Attr |= EFI_VARIABLE_APPEND_WRITE;
+  } else if (Status != EFI_NOT_FOUND) {
+    goto ON_EXIT;
+  }
+
+  //
+  // Diretly set AUTHENTICATION_2 data to SetVariable
+  //
+  Status = gRT->SetVariable(
+                  VariableName,
+                  &gEfiImageSecurityDatabaseGuid,
+                  Attr,
+                  mImageSize,
+                  mImageBase
+                  );
+
+  DEBUG((DEBUG_INFO, "Enroll AUTH_2 data to Var:%s Status: %x\n", VariableName, Status));
+
+ON_EXIT:
+
+  CloseEnrolledFile(Private->FileContext);
+
+  if (Data != NULL) {
+    FreePool (Data);
+  }
+
+  if (mImageBase != NULL) {
+    FreePool (mImageBase);
+    mImageBase = NULL;
+  }
+
+  return Status;
+
+}
+
+
+/**
+  Enroll a new executable's signature into Signature Database.
+
+  @param[in] PrivateData     The module's private data.
+  @param[in] VariableName    Variable name of signature database, must be
+                             EFI_IMAGE_SECURITY_DATABASE, EFI_IMAGE_SECURITY_DATABASE1
+                             or EFI_IMAGE_SECURITY_DATABASE2.
 
   @retval   EFI_SUCCESS            New signature is enrolled successfully.
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
@@ -1376,6 +2258,10 @@ EnrollImageSignatureToSigDB (
   Data = NULL;
   GuidCertData = NULL;
 
+  if (StrCmp (VariableName, EFI_IMAGE_SECURITY_DATABASE2) == 0) {
+    return EFI_UNSUPPORTED;
+  }
+
   //
   // Form the SigDB certificate list.
   // Format the data item into EFI_SIGNATURE_LIST type.
@@ -1390,13 +2276,13 @@ EnrollImageSignatureToSigDB (
   //
   Status = ReadFileContent(
              Private->FileContext->FHandle,
-             (VOID **) &mImageBase, 
-             &mImageSize, 
+             (VOID **) &mImageBase,
+             &mImageSize,
              0
              );
   if (EFI_ERROR (Status)) {
     goto ON_EXIT;
-  }  
+  }
   ASSERT (mImageBase != NULL);
 
   Status = LoadPeImage ();
@@ -1410,7 +2296,7 @@ EnrollImageSignatureToSigDB (
       goto ON_EXIT;
     }
   } else {
-  
+
     //
     // Read the certificate data
     //
@@ -1427,7 +2313,7 @@ EnrollImageSignatureToSigDB (
         Status = EFI_ABORTED;
         goto ON_EXIT;;
       }
-    
+
     } else if (mCertificate->wCertificateType == WIN_CERT_TYPE_PKCS_SIGNED_DATA) {
 
       Status = HashPeImageByType ();
@@ -1443,7 +2329,7 @@ EnrollImageSignatureToSigDB (
   //
   // Create a new SigDB entry.
   //
-  SigDBSize = sizeof(EFI_SIGNATURE_LIST) 
+  SigDBSize = sizeof(EFI_SIGNATURE_LIST)
               + sizeof(EFI_SIGNATURE_DATA) - 1
               + (UINT32) mImageDigestSize;
 
@@ -1452,10 +2338,10 @@ EnrollImageSignatureToSigDB (
     Status = EFI_OUT_OF_RESOURCES;
     goto ON_EXIT;
   }
-  
+
   //
   // Adjust the Certificate Database parameters.
-  // 
+  //
   SigDBCert = (EFI_SIGNATURE_LIST*) Data;
   SigDBCert->SignatureListSize   = (UINT32) SigDBSize;
   SigDBCert->SignatureHeaderSize = 0;
@@ -1466,41 +2352,41 @@ EnrollImageSignatureToSigDB (
   CopyGuid (&SigDBCertData->SignatureOwner, Private->SignatureGUID);
   CopyMem (SigDBCertData->SignatureData, mImageDigest, mImageDigestSize);
 
-  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS 
+  Attr = EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_RUNTIME_ACCESS
           | EFI_VARIABLE_BOOTSERVICE_ACCESS | EFI_VARIABLE_TIME_BASED_AUTHENTICATED_WRITE_ACCESS;
   Status = CreateTimeBasedPayload (&SigDBSize, (UINT8**) &Data);
   if (EFI_ERROR (Status)) {
     DEBUG ((EFI_D_ERROR, "Fail to create time-based data payload: %r", Status));
     goto ON_EXIT;
   }
-  
+
   //
-  // Check if SigDB variable has been already existed. 
-  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the 
+  // Check if SigDB variable has been already existed.
+  // If true, use EFI_VARIABLE_APPEND_WRITE attribute to append the
   // new signature data to original variable
-  //    
+  //
   DataSize = 0;
   Status = gRT->GetVariable(
-                  VariableName, 
-                  &gEfiImageSecurityDatabaseGuid, 
-                  NULL, 
-                  &DataSize, 
+                  VariableName,
+                  &gEfiImageSecurityDatabaseGuid,
+                  NULL,
+                  &DataSize,
                   NULL
                   );
   if (Status == EFI_BUFFER_TOO_SMALL) {
     Attr |= EFI_VARIABLE_APPEND_WRITE;
   } else if (Status != EFI_NOT_FOUND) {
     goto ON_EXIT;
-  }  
+  }
 
   //
   // Enroll the variable.
   //
   Status = gRT->SetVariable(
-                  VariableName, 
-                  &gEfiImageSecurityDatabaseGuid, 
-                  Attr, 
-                  SigDBSize, 
+                  VariableName,
+                  &gEfiImageSecurityDatabaseGuid,
+                  Attr,
+                  SigDBSize,
                   Data
                   );
   if (EFI_ERROR (Status)) {
@@ -1509,9 +2395,7 @@ EnrollImageSignatureToSigDB (
 
 ON_EXIT:
 
-  CloseFile (Private->FileContext->FHandle);
-  Private->FileContext->FHandle = NULL;
-  Private->FileContext->FileName = NULL;
+  CloseEnrolledFile(Private->FileContext);
 
   if (Private->SignatureGUID != NULL) {
     FreePool (Private->SignatureGUID);
@@ -1531,52 +2415,59 @@ ON_EXIT:
 }
 
 /**
-  Enroll signature into DB/DBX without KEK's authentication.
+  Enroll signature into DB/DBX/DBT without KEK's authentication.
   The SignatureOwner GUID will be Private->SignatureGUID.
-  
+
   @param[in] PrivateData     The module's private data.
-  @param[in] VariableName    Variable name of signature database, must be 
+  @param[in] VariableName    Variable name of signature database, must be
                              EFI_IMAGE_SECURITY_DATABASE or EFI_IMAGE_SECURITY_DATABASE1.
-  
+
   @retval   EFI_SUCCESS            New signature enrolled successfully.
   @retval   EFI_INVALID_PARAMETER  The parameter is invalid.
   @retval   others                 Fail to enroll signature data.
-  
+
 **/
 EFI_STATUS
 EnrollSignatureDatabase (
   IN SECUREBOOT_CONFIG_PRIVATE_DATA     *Private,
   IN CHAR16                             *VariableName
-  ) 
+  )
 {
   UINT16*      FilePostFix;
   EFI_STATUS   Status;
+  UINTN        NameLength;
 
   if ((Private->FileContext->FileName == NULL) || (Private->FileContext->FHandle == NULL) || (Private->SignatureGUID == NULL)) {
     return EFI_INVALID_PARAMETER;
   }
 
-  Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
+  Status = SetSecureBootMode (CUSTOM_SECURE_BOOT_MODE);
   if (EFI_ERROR (Status)) {
     return Status;
   }
-  
+
   //
-  // Parse the file's postfix. 
+  // Parse the file's postfix.
   //
-  FilePostFix = Private->FileContext->FileName + StrLen (Private->FileContext->FileName) - 4;
-  if (IsDerEncodeCertificate(FilePostFix)) {
+  NameLength = StrLen (Private->FileContext->FileName);
+  if (NameLength <= 4) {
+    return EFI_INVALID_PARAMETER;
+  }
+  FilePostFix = Private->FileContext->FileName + NameLength - 4;
+  if (IsDerEncodeCertificate (FilePostFix)) {
     //
     // Supports DER-encoded X509 certificate.
     //
     return EnrollX509toSigDB (Private, VariableName);
+  } else if (IsAuthentication2Format(Private->FileContext->FHandle)){
+    return EnrollAuthentication2Descriptor(Private, VariableName);
+  } else {
+    return EnrollImageSignatureToSigDB (Private, VariableName);
   }
-
-  return EnrollImageSignatureToSigDB (Private, VariableName);
 }
 
 /**
-  List all signatures in specified signature database (e.g. KEK/DB/DBX)
+  List all signatures in specified signature database (e.g. KEK/DB/DBX/DBT)
   by GUID in the page for user to select and delete as needed.
 
   @param[in]    PrivateData         Module's private data.
@@ -1588,7 +2479,7 @@ EnrollSignatureDatabase (
 
   @retval   EFI_SUCCESS             Success to update the signature list page
   @retval   EFI_OUT_OF_RESOURCES    Unable to allocate required resources.
-  
+
 **/
 EFI_STATUS
 UpdateDeletePage (
@@ -1607,7 +2498,7 @@ UpdateDeletePage (
   VOID                        *StartOpCodeHandle;
   VOID                        *EndOpCodeHandle;
   EFI_IFR_GUID_LABEL          *StartLabel;
-  EFI_IFR_GUID_LABEL          *EndLabel;  
+  EFI_IFR_GUID_LABEL          *EndLabel;
   UINTN                       DataSize;
   UINT8                       *Data;
   EFI_SIGNATURE_LIST          *CertList;
@@ -1623,20 +2514,20 @@ UpdateDeletePage (
   GuidStr  = NULL;
   StartOpCodeHandle = NULL;
   EndOpCodeHandle   = NULL;
-  
+
   //
   // Initialize the container for dynamic opcodes.
   //
   StartOpCodeHandle = HiiAllocateOpCodeHandle ();
   if (StartOpCodeHandle == NULL) {
     Status = EFI_OUT_OF_RESOURCES;
-    goto ON_EXIT; 
+    goto ON_EXIT;
   }
 
   EndOpCodeHandle = HiiAllocateOpCodeHandle ();
   if (EndOpCodeHandle == NULL) {
     Status = EFI_OUT_OF_RESOURCES;
-    goto ON_EXIT; 
+    goto ON_EXIT;
   }
 
   //
@@ -1664,7 +2555,7 @@ UpdateDeletePage (
   // Read Variable.
   //
   DataSize = 0;
-  Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);  
+  Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, Data);
   if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
     goto ON_EXIT;
   }
@@ -1703,6 +2594,12 @@ UpdateDeletePage (
       Help = STRING_TOKEN (STR_CERT_TYPE_SHA1_GUID);
     } else if (CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid)) {
       Help = STRING_TOKEN (STR_CERT_TYPE_SHA256_GUID);
+    } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha256Guid)) {
+      Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA256_GUID);
+    } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha384Guid)) {
+      Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA384_GUID);
+    } else if (CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha512Guid)) {
+      Help = STRING_TOKEN (STR_CERT_TYPE_X509_SHA512_GUID);
     } else {
       //
       // The signature type is not supported in current implementation.
@@ -1714,26 +2611,26 @@ UpdateDeletePage (
 
     CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
     for (Index = 0; Index < CertCount; Index++) {
-      Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList 
-                                              + sizeof (EFI_SIGNATURE_LIST) 
-                                              + CertList->SignatureHeaderSize 
+      Cert = (EFI_SIGNATURE_DATA *) ((UINT8 *) CertList
+                                              + sizeof (EFI_SIGNATURE_LIST)
+                                              + CertList->SignatureHeaderSize
                                               + Index * CertList->SignatureSize);
       //
-      // Display GUID and help 
+      // Display GUID and help
       //
       GuidToString (&Cert->SignatureOwner, GuidStr, 100);
       GuidID  = HiiSetString (PrivateData->HiiHandle, 0, GuidStr, NULL);
       HiiCreateCheckBoxOpCode (
         StartOpCodeHandle,
         (EFI_QUESTION_ID) (QuestionIdBase + GuidIndex++),
-        0, 
-        0, 
-        GuidID, 
+        0,
+        0,
+        GuidID,
         Help,
         EFI_IFR_FLAG_CALLBACK,
         0,
         NULL
-        );       
+        );
     }
 
     ItemDataSize -= CertList->SignatureListSize;
@@ -1756,7 +2653,7 @@ ON_EXIT:
   if (EndOpCodeHandle != NULL) {
     HiiFreeOpCodeHandle (EndOpCodeHandle);
   }
-  
+
   if (Data != NULL) {
     FreePool (Data);
   }
@@ -1769,14 +2666,14 @@ ON_EXIT:
 }
 
 /**
-  Delete a KEK entry from KEK database. 
+  Delete a KEK entry from KEK database.
 
   @param[in]    PrivateData         Module's private data.
   @param[in]    QuestionId          Question id of the KEK item to delete.
 
   @retval   EFI_SUCCESS            Delete kek item successfully.
   @retval   EFI_OUT_OF_RESOURCES   Could not allocate needed resources.
-  
+
 **/
 EFI_STATUS
 DeleteKeyExchangeKey (
@@ -1804,18 +2701,18 @@ DeleteKeyExchangeKey (
   OldData         = NULL;
   CertList        = NULL;
   Cert            = NULL;
-  Attr            = 0;   
+  Attr            = 0;
   DeleteKekIndex  = QuestionId - OPTION_DEL_KEK_QUESTION_ID;
 
   Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
   if (EFI_ERROR (Status)) {
     return Status;
   }
-  
+
   //
   // Get original KEK variable.
-  //                           
-  DataSize = 0;  
+  //
+  DataSize = 0;
   Status = gRT->GetVariable (EFI_KEY_EXCHANGE_KEY_NAME, &gEfiGlobalVariableGuid, NULL, &DataSize, NULL);
   if (EFI_ERROR(Status) && Status != EFI_BUFFER_TOO_SMALL) {
     goto ON_EXIT;
@@ -1823,7 +2720,7 @@ DeleteKeyExchangeKey (
 
   OldData = (UINT8*)AllocateZeroPool(DataSize);
   if (OldData == NULL) {
-    Status = EFI_OUT_OF_RESOURCES;  
+    Status = EFI_OUT_OF_RESOURCES;
     goto ON_EXIT;
   }
 
@@ -1833,7 +2730,7 @@ DeleteKeyExchangeKey (
   }
 
   //
-  // Allocate space for new variable.  
+  // Allocate space for new variable.
   //
   Data = (UINT8*) AllocateZeroPool (DataSize);
   if (Data == NULL) {
@@ -1863,7 +2760,7 @@ DeleteKeyExchangeKey (
           // Find it! Skip it!
           //
           NewCertList->SignatureListSize -= CertList->SignatureSize;
-          IsKEKItemFound = TRUE;          
+          IsKEKItemFound = TRUE;
         } else {
           //
           // This item doesn't match. Copy it to the Data buffer.
@@ -1881,7 +2778,7 @@ DeleteKeyExchangeKey (
       CopyMem (Data + Offset, CertList, CertList->SignatureListSize);
       Offset += CertList->SignatureListSize;
     }
-      
+
     KekDataSize -= CertList->SignatureListSize;
     CertList = (EFI_SIGNATURE_LIST*) ((UINT8*) CertList + CertList->SignatureListSize);
   }
@@ -1903,11 +2800,11 @@ DeleteKeyExchangeKey (
   ZeroMem (OldData, KekDataSize);
   while ((KekDataSize > 0) && (KekDataSize >= CertList->SignatureListSize)) {
     CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
-    DEBUG ((DEBUG_ERROR, "       CertCount = %x\n", CertCount));
+    DEBUG ((DEBUG_INFO, "       CertCount = %x\n", CertCount));
     if (CertCount != 0) {
       CopyMem (OldData + Offset, CertList, CertList->SignatureListSize);
       Offset += CertList->SignatureListSize;
-    }    
+    }
     KekDataSize -= CertList->SignatureListSize;
     CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
   }
@@ -1922,17 +2819,17 @@ DeleteKeyExchangeKey (
   }
 
   Status = gRT->SetVariable(
-                  EFI_KEY_EXCHANGE_KEY_NAME, 
-                  &gEfiGlobalVariableGuid, 
-                  Attr, 
-                  DataSize, 
+                  EFI_KEY_EXCHANGE_KEY_NAME,
+                  &gEfiGlobalVariableGuid,
+                  Attr,
+                  DataSize,
                   OldData
                   );
   if (EFI_ERROR (Status)) {
     DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));
     goto ON_EXIT;
   }
- 
+
 ON_EXIT:
   if (Data != NULL) {
     FreePool(Data);
@@ -1943,7 +2840,7 @@ ON_EXIT:
   }
 
   return UpdateDeletePage (
-           PrivateData, 
+           PrivateData,
            EFI_KEY_EXCHANGE_KEY_NAME,
            &gEfiGlobalVariableGuid,
            LABEL_KEK_DELETE,
@@ -1962,7 +2859,7 @@ ON_EXIT:
   @param[in]    FormId              Form ID of current page.
   @param[in]    QuestionIdBase      Base question id of the signature list.
   @param[in]    DeleteIndex         Signature index to delete.
-  
+
   @retval   EFI_SUCCESS             Delete siganture successfully.
   @retval   EFI_NOT_FOUND           Can't find the signature item,
   @retval   EFI_OUT_OF_RESOURCES    Could not allocate needed resources.
@@ -1997,7 +2894,7 @@ DeleteSignature (
   OldData         = NULL;
   CertList        = NULL;
   Cert            = NULL;
-  Attr            = 0; 
+  Attr            = 0;
 
   Status = SetSecureBootMode(CUSTOM_SECURE_BOOT_MODE);
   if (EFI_ERROR (Status)) {
@@ -2006,7 +2903,7 @@ DeleteSignature (
 
   //
   // Get original signature list data.
-  //                           
+  //
   DataSize = 0;
   Status = gRT->GetVariable (VariableName, VendorGuid, NULL, &DataSize, NULL);
   if (EFI_ERROR (Status) && Status != EFI_BUFFER_TOO_SMALL) {
@@ -2015,17 +2912,17 @@ DeleteSignature (
 
   OldData = (UINT8 *) AllocateZeroPool (DataSize);
   if (OldData == NULL) {
-    Status = EFI_OUT_OF_RESOURCES;  
+    Status = EFI_OUT_OF_RESOURCES;
     goto ON_EXIT;
   }
 
   Status = gRT->GetVariable (VariableName, VendorGuid, &Attr, &DataSize, OldData);
   if (EFI_ERROR(Status)) {
     goto ON_EXIT;
-  } 
+  }
 
   //
-  // Allocate space for new variable.  
+  // Allocate space for new variable.
   //
   Data = (UINT8*) AllocateZeroPool (DataSize);
   if (Data == NULL) {
@@ -2045,7 +2942,10 @@ DeleteSignature (
     if (CompareGuid (&CertList->SignatureType, &gEfiCertRsa2048Guid) ||
         CompareGuid (&CertList->SignatureType, &gEfiCertX509Guid) ||
         CompareGuid (&CertList->SignatureType, &gEfiCertSha1Guid) ||
-        CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid)
+        CompareGuid (&CertList->SignatureType, &gEfiCertSha256Guid) ||
+        CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha256Guid) ||
+        CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha384Guid) ||
+        CompareGuid (&CertList->SignatureType, &gEfiCertX509Sha512Guid)
         ) {
       //
       // Copy EFI_SIGNATURE_LIST header then calculate the signature count in this list.
@@ -2061,7 +2961,7 @@ DeleteSignature (
           // Find it! Skip it!
           //
           NewCertList->SignatureListSize -= CertList->SignatureSize;
-          IsItemFound = TRUE;          
+          IsItemFound = TRUE;
         } else {
           //
           // This item doesn't match. Copy it to the Data buffer.
@@ -2079,7 +2979,7 @@ DeleteSignature (
       CopyMem (Data + Offset, (UINT8*)(CertList), CertList->SignatureListSize);
       Offset += CertList->SignatureListSize;
     }
-      
+
     ItemDataSize -= CertList->SignatureListSize;
     CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
   }
@@ -2101,11 +3001,11 @@ DeleteSignature (
   ZeroMem (OldData, ItemDataSize);
   while ((ItemDataSize > 0) && (ItemDataSize >= CertList->SignatureListSize)) {
     CertCount  = (CertList->SignatureListSize - sizeof (EFI_SIGNATURE_LIST) - CertList->SignatureHeaderSize) / CertList->SignatureSize;
-    DEBUG ((DEBUG_ERROR, "       CertCount = %x\n", CertCount));
+    DEBUG ((DEBUG_INFO, "       CertCount = %x\n", CertCount));
     if (CertCount != 0) {
       CopyMem (OldData + Offset, (UINT8*)(CertList), CertList->SignatureListSize);
       Offset += CertList->SignatureListSize;
-    }    
+    }
     ItemDataSize -= CertList->SignatureListSize;
     CertList = (EFI_SIGNATURE_LIST *) ((UINT8 *) CertList + CertList->SignatureListSize);
   }
@@ -2120,17 +3020,17 @@ DeleteSignature (
   }
 
   Status = gRT->SetVariable(
-                  VariableName, 
-                  VendorGuid, 
-                  Attr, 
-                  DataSize, 
+                  VariableName,
+                  VendorGuid,
+                  Attr,
+                  DataSize,
                   OldData
                   );
   if (EFI_ERROR (Status)) {
     DEBUG ((DEBUG_ERROR, "Failed to set variable, Status = %r\n", Status));
     goto ON_EXIT;
   }
- 
+
 ON_EXIT:
   if (Data != NULL) {
     FreePool(Data);
@@ -2141,7 +3041,7 @@ ON_EXIT:
   }
 
   return UpdateDeletePage (
-           PrivateData, 
+           PrivateData,
            VariableName,
            VendorGuid,
            LabelNumber,
@@ -2150,40 +3050,85 @@ ON_EXIT:
            );
 }
 
+/**
+
+  Update SecureBoot strings based on new Secure Boot Mode State. String includes STR_SECURE_BOOT_STATE_CONTENT
+ and STR_CUR_SECURE_BOOT_MODE_CONTENT.
+
+  @param[in]    PrivateData         Module's private data.
+
+  @return EFI_SUCCESS              Update secure boot strings successfully.
+  @return other                          Fail to update secure boot strings.
+
+**/
+EFI_STATUS
+UpdateSecureBootString(
+  IN SECUREBOOT_CONFIG_PRIVATE_DATA  *Private
+  )
+{
+  UINT8       *SecureBoot;
+
+  SecureBoot = NULL;
+
+  //
+  // Get current secure boot state.
+  //
+  GetVariable2 (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SecureBoot, NULL);
+  if (SecureBoot == NULL) {
+    return EFI_NOT_FOUND;
+  }
+
+  if (*SecureBoot == SECURE_BOOT_MODE_ENABLE) {
+    HiiSetString (Private->HiiHandle, STRING_TOKEN (STR_SECURE_BOOT_STATE_CONTENT), L"Enabled", NULL);
+  } else {
+    HiiSetString (Private->HiiHandle, STRING_TOKEN (STR_SECURE_BOOT_STATE_CONTENT), L"Disabled", NULL);
+  }
+
+  FreePool(SecureBoot);
+
+  return EFI_SUCCESS;
+}
+
 /**
   This function extracts configuration from variable.
-  
+
+  @param[in]       Private      Point to SecureBoot configuration driver private data.
   @param[in, out]  ConfigData   Point to SecureBoot configuration private data.
 
 **/
 VOID
 SecureBootExtractConfigFromVariable (
+  IN SECUREBOOT_CONFIG_PRIVATE_DATA  *Private,
   IN OUT SECUREBOOT_CONFIGURATION    *ConfigData
-  ) 
+  )
 {
-  UINT8   *SecureBootEnable;
-  UINT8   *SetupMode;
-  UINT8   *SecureBootMode;
+  UINT8     *SecureBootEnable;
+  UINT8     *SetupMode;
+  UINT8     *SecureBootMode;
+  EFI_TIME  CurrTime;
 
   SecureBootEnable = NULL;
   SetupMode        = NULL;
   SecureBootMode   = NULL;
-  
+
   //
-  // If the SecureBootEnable Variable doesn't exist, hide the SecureBoot Enable/Disable
-  // Checkbox.
+  // Initilize the Date and Time using system time.
   //
-  ConfigData->AttemptSecureBoot = FALSE;
-  GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID**)&SecureBootEnable, NULL);
-  if (SecureBootEnable == NULL) {
-    ConfigData->HideSecureBoot = TRUE;
+  ConfigData->CertificateFormat = HASHALG_RAW;
+  ConfigData->AlwaysRevocation = TRUE;
+  gRT->GetTime (&CurrTime, NULL);
+  ConfigData->RevocationDate.Year   = CurrTime.Year;
+  ConfigData->RevocationDate.Month  = CurrTime.Month;
+  ConfigData->RevocationDate.Day    = CurrTime.Day;
+  ConfigData->RevocationTime.Hour   = CurrTime.Hour;
+  ConfigData->RevocationTime.Minute = CurrTime.Minute;
+  ConfigData->RevocationTime.Second = 0;
+  if (Private->FileContext->FHandle != NULL) {
+    ConfigData->FileEnrollType = Private->FileContext->FileType;
   } else {
-    ConfigData->HideSecureBoot = FALSE;
-    if ((*SecureBootEnable) == SECURE_BOOT_ENABLE) {
-      ConfigData->AttemptSecureBoot = TRUE;
-    }
+    ConfigData->FileEnrollType = UNKNOWN_FILE_TYPE;
   }
-  
+
   //
   // If it is Physical Presence User, set the PhysicalPresent to true.
   //
@@ -2192,7 +3137,7 @@ SecureBootExtractConfigFromVariable (
   } else {
     ConfigData->PhysicalPresent = FALSE;
   }
-  
+
   //
   // If there is no PK then the Delete Pk button will be gray.
   //
@@ -2203,6 +3148,26 @@ SecureBootExtractConfigFromVariable (
     ConfigData->HasPk = TRUE;
   }
 
+  //
+  // Check SecureBootEnable & Pk status, fix the inconsistence. 
+  // If the SecureBootEnable Variable doesn't exist, hide the SecureBoot Enable/Disable
+  // Checkbox.
+  //
+  ConfigData->AttemptSecureBoot = FALSE;
+  GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID**)&SecureBootEnable, NULL);  
+
+  //
+  // Fix Pk, SecureBootEnable inconsistence
+  //
+  if ((SetupMode != NULL) && (*SetupMode) == USER_MODE) {
+    ConfigData->HideSecureBoot = FALSE;
+    if ((SecureBootEnable != NULL) && (*SecureBootEnable == SECURE_BOOT_ENABLE)) {
+      ConfigData->AttemptSecureBoot = TRUE;
+    }
+  } else {
+    ConfigData->HideSecureBoot = TRUE;
+  }
+
   //
   // Get the SecureBootMode from CustomMode variable.
   //
@@ -2267,44 +3232,31 @@ SecureBootExtractConfig (
   EFI_STRING                        ConfigRequestHdr;
   SECUREBOOT_CONFIG_PRIVATE_DATA    *PrivateData;
   BOOLEAN                           AllocatedRequest;
-  UINT8                             *SecureBoot;
 
   if (Progress == NULL || Results == NULL) {
     return EFI_INVALID_PARAMETER;
   }
-  
+
   AllocatedRequest = FALSE;
   ConfigRequestHdr = NULL;
   ConfigRequest    = NULL;
   Size             = 0;
-  SecureBoot       = NULL;
-  
+
   ZeroMem (&Configuration, sizeof (Configuration));
   PrivateData      = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
   *Progress        = Request;
-  
+
   if ((Request != NULL) && !HiiIsConfigHdrMatch (Request, &gSecureBootConfigFormSetGuid, mSecureBootStorageName)) {
     return EFI_NOT_FOUND;
   }
 
+  ZeroMem(&Configuration, sizeof(SECUREBOOT_CONFIGURATION));
+
   //
   // Get Configuration from Variable.
   //
-  SecureBootExtractConfigFromVariable (&Configuration);
+  SecureBootExtractConfigFromVariable (PrivateData, &Configuration);
 
-  //
-  // Update current secure boot state.
-  //
-  GetVariable2 (EFI_SECURE_BOOT_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SecureBoot, NULL);
-  if (SecureBoot != NULL && *SecureBoot == SECURE_BOOT_MODE_ENABLE) {
-    HiiSetString (PrivateData->HiiHandle, STRING_TOKEN (STR_SECURE_BOOT_STATE_CONTENT), L"Enabled", NULL);
-  } else {
-    HiiSetString (PrivateData->HiiHandle, STRING_TOKEN (STR_SECURE_BOOT_STATE_CONTENT), L"Disabled", NULL);
-  }
-  if (SecureBoot != NULL) {
-    FreePool (SecureBoot);
-  }
-  
   BufferSize = sizeof (SECUREBOOT_CONFIGURATION);
   ConfigRequest = Request;
   if ((Request == NULL) || (StrStr (Request, L"OFFSET") == NULL)) {
@@ -2378,11 +3330,11 @@ SecureBootRouteConfig (
        OUT EFI_STRING                          *Progress
   )
 {
-  UINT8                      *SecureBootEnable;
-  SECUREBOOT_CONFIGURATION   IfrNvData;
-  UINTN                      BufferSize;
-  EFI_STATUS                 Status;
-  
+  SECUREBOOT_CONFIGURATION          IfrNvData;
+  UINTN                             BufferSize;
+  SECUREBOOT_CONFIG_PRIVATE_DATA    *PrivateData;
+  EFI_STATUS                        Status;
+
   if (Configuration == NULL || Progress == NULL) {
     return EFI_INVALID_PARAMETER;
   }
@@ -2392,6 +3344,16 @@ SecureBootRouteConfig (
     return EFI_NOT_FOUND;
   }
 
+  PrivateData = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
+
+  //
+  // Get Configuration from Variable.
+  //
+  SecureBootExtractConfigFromVariable (PrivateData, &IfrNvData);
+
+  //
+  // Map the Configuration to the configuration block.
+  //
   BufferSize = sizeof (SECUREBOOT_CONFIGURATION);
   Status = gHiiConfigRouting->ConfigToBlock (
                                 gHiiConfigRouting,
@@ -2407,10 +3369,7 @@ SecureBootRouteConfig (
   //
   // Store Buffer Storage back to EFI variable if needed
   //
-  SecureBootEnable = NULL;
-  GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID**)&SecureBootEnable, NULL);
-  if (NULL != SecureBootEnable) {
-    FreePool (SecureBootEnable);
+  if (!IfrNvData.HideSecureBoot) {
     Status = SaveSecureBootVariable (IfrNvData.AttemptSecureBoot);
     if (EFI_ERROR (Status)) {
       return Status;
@@ -2455,33 +3414,36 @@ SecureBootCallback (
   )
 {
   EFI_INPUT_KEY                   Key;
-  EFI_STATUS                      Status;  
+  EFI_STATUS                      Status;
+  RETURN_STATUS                   RStatus;
   SECUREBOOT_CONFIG_PRIVATE_DATA  *Private;
   UINTN                           BufferSize;
   SECUREBOOT_CONFIGURATION        *IfrNvData;
   UINT16                          LabelId;
   UINT8                           *SecureBootEnable;
+  UINT8                           *Pk;
   UINT8                           *SecureBootMode;
   UINT8                           *SetupMode;
   CHAR16                          PromptString[100];
+  EFI_DEVICE_PATH_PROTOCOL        *File;
+  UINTN                           NameLength;
+  UINT16                          *FilePostFix;
+  SECUREBOOT_CONFIG_PRIVATE_DATA  *PrivateData;
 
+  Status           = EFI_SUCCESS;
   SecureBootEnable = NULL;
   SecureBootMode   = NULL;
   SetupMode        = NULL;
+  File             = NULL;
 
   if ((This == NULL) || (Value == NULL) || (ActionRequest == NULL)) {
     return EFI_INVALID_PARAMETER;
   }
 
-  if ((Action != EFI_BROWSER_ACTION_CHANGED) &&
-      (Action != EFI_BROWSER_ACTION_CHANGING) &&
-      (Action != EFI_BROWSER_ACTION_FORM_CLOSE) &&
-      (Action != EFI_BROWSER_ACTION_DEFAULT_STANDARD)) {
-    return EFI_UNSUPPORTED;
-  }
-  
   Private = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
 
+  gSecureBootPrivateData = Private;
+
   //
   // Retrieve uncommitted data from Browser
   //
@@ -2491,10 +3453,51 @@ SecureBootCallback (
     return EFI_OUT_OF_RESOURCES;
   }
 
-  Status = EFI_SUCCESS;
+  HiiGetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8 *) IfrNvData);
+
+  if (Action == EFI_BROWSER_ACTION_FORM_OPEN) {
+    if (QuestionId == KEY_SECURE_BOOT_MODE) {
+      //
+      // Update secure boot strings when opening this form
+      //
+      Status = UpdateSecureBootString(Private);
+      SecureBootExtractConfigFromVariable (Private, IfrNvData);
+      mIsEnterSecureBootForm = TRUE;
+    } else {
+      //
+      // When entering SecureBoot OPTION Form
+      // always close opened file & free resource
+      //
+      if ((QuestionId == KEY_SECURE_BOOT_PK_OPTION) ||
+          (QuestionId == KEY_SECURE_BOOT_KEK_OPTION) ||
+          (QuestionId == KEY_SECURE_BOOT_DB_OPTION) ||
+          (QuestionId == KEY_SECURE_BOOT_DBX_OPTION) ||
+          (QuestionId == KEY_SECURE_BOOT_DBT_OPTION)) {
+        CloseEnrolledFile(Private->FileContext);
+      }
+    }
+    goto EXIT;
+  }
+
+  if (Action == EFI_BROWSER_ACTION_RETRIEVE) {
+    Status = EFI_UNSUPPORTED;
+    if (QuestionId == KEY_SECURE_BOOT_MODE) {
+      if (mIsEnterSecureBootForm) {
+        Value->u8 = SECURE_BOOT_MODE_STANDARD;
+        Status = EFI_SUCCESS;
+      }
+    } 
+    goto EXIT;
+  }
+
+  if ((Action != EFI_BROWSER_ACTION_CHANGED) &&
+      (Action != EFI_BROWSER_ACTION_CHANGING) &&
+      (Action != EFI_BROWSER_ACTION_FORM_CLOSE) &&
+      (Action != EFI_BROWSER_ACTION_DEFAULT_STANDARD)) {
+    Status = EFI_UNSUPPORTED;
+    goto EXIT;
+  }
 
-  HiiGetBrowserData (NULL, NULL, BufferSize, (UINT8 *) IfrNvData);
-  
   if (Action == EFI_BROWSER_ACTION_CHANGING) {
 
     switch (QuestionId) {
@@ -2521,14 +3524,11 @@ SecureBootCallback (
       }
       break;
 
-    case KEY_SECURE_BOOT_OPTION:
-      FreeMenu (&DirectoryMenu);
-      FreeMenu (&FsOptionMenu);
-      break;
-
     case KEY_SECURE_BOOT_KEK_OPTION:
     case KEY_SECURE_BOOT_DB_OPTION:
     case KEY_SECURE_BOOT_DBX_OPTION:
+    case KEY_SECURE_BOOT_DBT_OPTION:
+      PrivateData = SECUREBOOT_CONFIG_PRIVATE_FROM_THIS (This);
       //
       // Clear Signature GUID.
       //
@@ -2540,10 +3540,17 @@ SecureBootCallback (
         }
       }
 
+      //
+      // Cleanup VFRData once leaving PK/KEK/DB/DBX/DBT enroll/delete page
+      //
+      SecureBootExtractConfigFromVariable (PrivateData, IfrNvData);
+
       if (QuestionId == KEY_SECURE_BOOT_DB_OPTION) {
         LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DB;
       } else if (QuestionId == KEY_SECURE_BOOT_DBX_OPTION) {
         LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBX;
+      } else if (QuestionId == KEY_SECURE_BOOT_DBT_OPTION) {
+        LabelId = SECUREBOOT_ENROLL_SIGNATURE_TO_DBT;
       } else {
         LabelId = FORMID_ENROLL_KEK_FORM;
       }
@@ -2551,29 +3558,69 @@ SecureBootCallback (
       //
       // Refresh selected file.
       //
-      CleanUpPage (LabelId, Private);    
+      CleanUpPage (LabelId, Private);
+      break;
+    case KEY_SECURE_BOOT_PK_OPTION:
+      LabelId = FORMID_ENROLL_PK_FORM;
+      //
+      // Refresh selected file.
+      //
+      CleanUpPage (LabelId, Private);
+      break;
+
+    case FORMID_ENROLL_PK_FORM:
+      ChooseFile (NULL, NULL, UpdatePKFromFile, &File);
       break;
-  
-    case SECUREBOOT_ADD_PK_FILE_FORM_ID:
+
     case FORMID_ENROLL_KEK_FORM:
+      ChooseFile (NULL, NULL, UpdateKEKFromFile, &File);
+      break;
+
     case SECUREBOOT_ENROLL_SIGNATURE_TO_DB:
+      ChooseFile (NULL, NULL, UpdateDBFromFile, &File);
+      break;
+
     case SECUREBOOT_ENROLL_SIGNATURE_TO_DBX:
-      if (QuestionId == SECUREBOOT_ADD_PK_FILE_FORM_ID) {
-        Private->FeCurrentState = FileExplorerStateEnrollPkFile;
-      } else if (QuestionId == FORMID_ENROLL_KEK_FORM) {
-        Private->FeCurrentState = FileExplorerStateEnrollKekFile;
-      } else if (QuestionId == SECUREBOOT_ENROLL_SIGNATURE_TO_DB) {
-        Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDb;
-      } else {
-        Private->FeCurrentState = FileExplorerStateEnrollSignatureFileToDbx;
+      ChooseFile (NULL, NULL, UpdateDBXFromFile, &File);
+
+      if (Private->FileContext->FHandle != NULL) {
+        //
+        // Parse the file's postfix.
+        //
+        NameLength = StrLen (Private->FileContext->FileName);
+        if (NameLength <= 4) {
+          return FALSE;
+        }
+        FilePostFix = Private->FileContext->FileName + NameLength - 4;
+
+        if (IsDerEncodeCertificate (FilePostFix)) {
+          //
+          // Supports DER-encoded X509 certificate.
+          //
+          IfrNvData->FileEnrollType = X509_CERT_FILE_TYPE;
+        } else if (IsAuthentication2Format(Private->FileContext->FHandle)){
+          IfrNvData->FileEnrollType = AUTHENTICATION_2_FILE_TYPE;
+        } else {
+          IfrNvData->FileEnrollType = PE_IMAGE_FILE_TYPE;
+        }
+        Private->FileContext->FileType = IfrNvData->FileEnrollType;
+
+        //
+        // Clean up Certificate Format if File type is not X509 DER
+        //
+        if (IfrNvData->FileEnrollType != X509_CERT_FILE_TYPE) {
+          IfrNvData->CertificateFormat = HASHALG_RAW;
+        }
+        DEBUG((DEBUG_ERROR, "IfrNvData->FileEnrollType %d\n", Private->FileContext->FileType));
       }
 
-      Private->FeDisplayContext = FileExplorerDisplayUnknown;
-      CleanUpPage (FORM_FILE_EXPLORER_ID, Private);
-      UpdateFileExplorer (Private, 0);
       break;
 
-    case KEY_SECURE_BOOT_DELETE_PK: 
+    case SECUREBOOT_ENROLL_SIGNATURE_TO_DBT:
+      ChooseFile (NULL, NULL, UpdateDBTFromFile, &File);
+      break;
+
+    case KEY_SECURE_BOOT_DELETE_PK:
       if (Value->u8) {
         CreatePopUp (
           EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
@@ -2598,16 +3645,16 @@ SecureBootCallback (
 
     case KEY_DELETE_KEK:
       UpdateDeletePage (
-        Private, 
+        Private,
         EFI_KEY_EXCHANGE_KEY_NAME,
         &gEfiGlobalVariableGuid,
         LABEL_KEK_DELETE,
         FORMID_DELETE_KEK_FORM,
-        OPTION_DEL_KEK_QUESTION_ID          
+        OPTION_DEL_KEK_QUESTION_ID
         );
       break;
 
-    case SECUREBOOT_DELETE_SIGNATURE_FROM_DB:        
+    case SECUREBOOT_DELETE_SIGNATURE_FROM_DB:
       UpdateDeletePage (
         Private,
         EFI_IMAGE_SECURITY_DATABASE,
@@ -2630,22 +3677,115 @@ SecureBootCallback (
 
       break;
 
+    case SECUREBOOT_DELETE_SIGNATURE_FROM_DBT:
+      UpdateDeletePage (
+        Private,
+        EFI_IMAGE_SECURITY_DATABASE2,
+        &gEfiImageSecurityDatabaseGuid,
+        LABEL_DBT_DELETE,
+        SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
+        OPTION_DEL_DBT_QUESTION_ID
+        );
+
+      break;
+
     case KEY_VALUE_SAVE_AND_EXIT_KEK:
       Status = EnrollKeyExchangeKey (Private);
+      if (EFI_ERROR (Status)) {
+        CreatePopUp (
+          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+          &Key,
+          L"ERROR: Unsupported file type!",
+          L"Only supports DER-encoded X509 certificate",
+          NULL
+          );
+      }
       break;
 
     case KEY_VALUE_SAVE_AND_EXIT_DB:
       Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE);
+      if (EFI_ERROR (Status)) {
+        CreatePopUp (
+          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+          &Key,
+          L"ERROR: Unsupported file type!",
+          L"Only supports DER-encoded X509 certificate and executable EFI image",
+          NULL
+          );
+      }
       break;
 
     case KEY_VALUE_SAVE_AND_EXIT_DBX:
-      Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE1);
+      if (IsX509CertInDbx (Private, EFI_IMAGE_SECURITY_DATABASE1)) {
+        CreatePopUp (
+          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+          &Key,
+          L"Enrollment failed! Same certificate had already been in the dbx!",
+          NULL
+          );
+
+        //
+        // Cert already exists in DBX. Close opened file before exit.
+        //
+        CloseEnrolledFile(Private->FileContext);
+        break;
+      }
+
+      if ((IfrNvData != NULL) && (IfrNvData->CertificateFormat < HASHALG_MAX)) {
+        Status = EnrollX509HashtoSigDB (
+                   Private,
+                   IfrNvData->CertificateFormat,
+                   &IfrNvData->RevocationDate,
+                   &IfrNvData->RevocationTime,
+                   IfrNvData->AlwaysRevocation
+                   );
+        IfrNvData->CertificateFormat = HASHALG_RAW;
+      } else {
+        Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE1);
+      }
+      if (EFI_ERROR (Status)) {
+        CreatePopUp (
+          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+          &Key,
+          L"ERROR: Unsupported file type!",
+          L"Only supports DER-encoded X509 certificate, AUTH_2 format data & executable EFI image",
+          NULL
+          );
+      }
       break;
 
+    case KEY_VALUE_SAVE_AND_EXIT_DBT:
+      Status = EnrollSignatureDatabase (Private, EFI_IMAGE_SECURITY_DATABASE2);
+      if (EFI_ERROR (Status)) {
+        CreatePopUp (
+          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+          &Key,
+          L"ERROR: Unsupported file type!",
+          L"Only supports DER-encoded X509 certificate.",
+          NULL
+          );
+      }
+      break;
+    case KEY_VALUE_SAVE_AND_EXIT_PK:
+      Status = EnrollPlatformKey (Private);
+      if (EFI_ERROR (Status)) {
+        UnicodeSPrint (
+          PromptString,
+          sizeof (PromptString),
+          L"Only DER encoded certificate file (%s) is supported.",
+          mSupportX509Suffix
+          );
+        CreatePopUp (
+          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
+          &Key,
+          L"ERROR: Unsupported file type!",
+          PromptString,
+          NULL
+          );
+      }
+      break;
     default:
-      if (QuestionId >= FILE_OPTION_OFFSET) {
-        UpdateFileExplorer (Private, QuestionId);
-      } else if ((QuestionId >= OPTION_DEL_KEK_QUESTION_ID) &&
+      if ((QuestionId >= OPTION_DEL_KEK_QUESTION_ID) &&
                  (QuestionId < (OPTION_DEL_KEK_QUESTION_ID + OPTION_CONFIG_RANGE))) {
         DeleteKeyExchangeKey (Private, QuestionId);
       } else if ((QuestionId >= OPTION_DEL_DB_QUESTION_ID) &&
@@ -2654,7 +3794,7 @@ SecureBootCallback (
           Private,
           EFI_IMAGE_SECURITY_DATABASE,
           &gEfiImageSecurityDatabaseGuid,
-          LABEL_DB_DELETE,   
+          LABEL_DB_DELETE,
           SECUREBOOT_DELETE_SIGNATURE_FROM_DB,
           OPTION_DEL_DB_QUESTION_ID,
           QuestionId - OPTION_DEL_DB_QUESTION_ID
@@ -2665,89 +3805,59 @@ SecureBootCallback (
           Private,
           EFI_IMAGE_SECURITY_DATABASE1,
           &gEfiImageSecurityDatabaseGuid,
-          LABEL_DBX_DELETE,   
+          LABEL_DBX_DELETE,
           SECUREBOOT_DELETE_SIGNATURE_FROM_DBX,
           OPTION_DEL_DBX_QUESTION_ID,
           QuestionId - OPTION_DEL_DBX_QUESTION_ID
           );
-      }
-      break;
-    }
-  } else if (Action == EFI_BROWSER_ACTION_CHANGED) {
-    switch (QuestionId) {
-    case KEY_SECURE_BOOT_ENABLE:
-      *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
-      break;  
-    case KEY_VALUE_SAVE_AND_EXIT_PK:
-      Status = EnrollPlatformKey (Private);
-      UnicodeSPrint (
-        PromptString,
-        sizeof (PromptString),
-        L"Only DER encoded certificate file (%s) is supported.",
-        mSupportX509Suffix
-        );
-      if (EFI_ERROR (Status)) {
-        CreatePopUp (
-          EFI_LIGHTGRAY | EFI_BACKGROUND_BLUE,
-          &Key,
-          L"ERROR: Unsupported file type!",
-          PromptString,
-          NULL
+      } else if ((QuestionId >= OPTION_DEL_DBT_QUESTION_ID) &&
+                 (QuestionId < (OPTION_DEL_DBT_QUESTION_ID + OPTION_CONFIG_RANGE))) {
+        DeleteSignature (
+          Private,
+          EFI_IMAGE_SECURITY_DATABASE2,
+          &gEfiImageSecurityDatabaseGuid,
+          LABEL_DBT_DELETE,
+          SECUREBOOT_DELETE_SIGNATURE_FROM_DBT,
+          OPTION_DEL_DBT_QUESTION_ID,
+          QuestionId - OPTION_DEL_DBT_QUESTION_ID
           );
-      } else {
-        *ActionRequest = EFI_BROWSER_ACTION_REQUEST_RESET; 
-      }        
+      }
       break;
 
     case KEY_VALUE_NO_SAVE_AND_EXIT_PK:
     case KEY_VALUE_NO_SAVE_AND_EXIT_KEK:
     case KEY_VALUE_NO_SAVE_AND_EXIT_DB:
     case KEY_VALUE_NO_SAVE_AND_EXIT_DBX:
-      if (Private->FileContext->FHandle != NULL) {
-        CloseFile (Private->FileContext->FHandle);
-        Private->FileContext->FHandle = NULL;
-        Private->FileContext->FileName = NULL;
-      }
-   
+    case KEY_VALUE_NO_SAVE_AND_EXIT_DBT:
+      CloseEnrolledFile(Private->FileContext);
+
       if (Private->SignatureGUID != NULL) {
         FreePool (Private->SignatureGUID);
         Private->SignatureGUID = NULL;
       }
-      *ActionRequest = EFI_BROWSER_ACTION_REQUEST_EXIT;
       break;
-      
+    }
+  } else if (Action == EFI_BROWSER_ACTION_CHANGED) {
+    switch (QuestionId) {
+    case KEY_SECURE_BOOT_ENABLE:
+      *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
+      break;
     case KEY_SECURE_BOOT_MODE:
-      GetVariable2 (EFI_CUSTOM_MODE_NAME, &gEfiCustomModeEnableGuid, (VOID**)&SecureBootMode, NULL);
-      if (NULL != SecureBootMode) {
-        Status = gRT->SetVariable (                          
-                        EFI_CUSTOM_MODE_NAME,
-                        &gEfiCustomModeEnableGuid,
-                        EFI_VARIABLE_NON_VOLATILE | EFI_VARIABLE_BOOTSERVICE_ACCESS,
-                        sizeof (UINT8),
-                        &Value->u8
-                        );
-        *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
-        IfrNvData->SecureBootMode = Value->u8;
-        FreePool (SecureBootMode);
-      }        
+      mIsEnterSecureBootForm = FALSE;
       break;
-
     case KEY_SECURE_BOOT_KEK_GUID:
     case KEY_SECURE_BOOT_SIGNATURE_GUID_DB:
     case KEY_SECURE_BOOT_SIGNATURE_GUID_DBX:
+    case KEY_SECURE_BOOT_SIGNATURE_GUID_DBT:
       ASSERT (Private->SignatureGUID != NULL);
-      Status = StringToGuid (
-                 IfrNvData->SignatureGuid,
-                 StrLen (IfrNvData->SignatureGuid),
-                 Private->SignatureGUID
-                 );
-      if (EFI_ERROR (Status)) {
+      RStatus = StrToGuid (IfrNvData->SignatureGuid, Private->SignatureGUID);
+      if (RETURN_ERROR (RStatus) || (IfrNvData->SignatureGuid[GUID_STRING_LENGTH] != L'\0')) {
+        Status = EFI_INVALID_PARAMETER;
         break;
       }
 
       *ActionRequest = EFI_BROWSER_ACTION_REQUEST_FORM_APPLY;
       break;
-
     case KEY_SECURE_BOOT_DELETE_PK:
       GetVariable2 (EFI_SETUP_MODE_NAME, &gEfiGlobalVariableGuid, (VOID**)&SetupMode, NULL);
       if (SetupMode == NULL || (*SetupMode) == SETUP_MODE) {
@@ -2762,15 +3872,17 @@ SecureBootCallback (
       if (SetupMode != NULL) {
         FreePool (SetupMode);
       }
-      break;  
+      break;
+    default:
+      break;
     }
   } else if (Action == EFI_BROWSER_ACTION_DEFAULT_STANDARD) {
     if (QuestionId == KEY_HIDE_SECURE_BOOT) {
-      GetVariable2 (EFI_SECURE_BOOT_ENABLE_NAME, &gEfiSecureBootEnableDisableGuid, (VOID**)&SecureBootEnable, NULL);
-      if (SecureBootEnable == NULL) {
+      GetVariable2 (EFI_PLATFORM_KEY_NAME, &gEfiGlobalVariableGuid, (VOID**)&Pk, NULL);
+      if (Pk == NULL) {
         IfrNvData->HideSecureBoot = TRUE;
       } else {
-        FreePool (SecureBootEnable);
+        FreePool (Pk);
         IfrNvData->HideSecureBoot = FALSE;
       }
       Value->b = IfrNvData->HideSecureBoot;
@@ -2788,13 +3900,21 @@ SecureBootCallback (
       FreePool (SecureBootMode);
     }
   }
-  
+
+EXIT:
+
   if (!EFI_ERROR (Status)) {
     BufferSize = sizeof (SECUREBOOT_CONFIGURATION);
-    HiiSetBrowserData (NULL, NULL, BufferSize, (UINT8*) IfrNvData, NULL);
+    HiiSetBrowserData (&gSecureBootConfigFormSetGuid, mSecureBootStorageName, BufferSize, (UINT8*) IfrNvData, NULL);
   }
+
   FreePool (IfrNvData);
-  
+
+  if (File != NULL){
+    FreePool(File);
+    File = NULL;
+  }
+
   return EFI_SUCCESS;
 }
 
@@ -2859,18 +3979,11 @@ InstallSecureBootConfigForm (
   PrivateData->HiiHandle = HiiHandle;
 
   PrivateData->FileContext = AllocateZeroPool (sizeof (SECUREBOOT_FILE_CONTEXT));
-  PrivateData->MenuEntry   = AllocateZeroPool (sizeof (SECUREBOOT_MENU_ENTRY));
-  
-  if (PrivateData->FileContext == NULL || PrivateData->MenuEntry == NULL) {
+
+  if (PrivateData->FileContext == NULL) {
     UninstallSecureBootConfigForm (PrivateData);
     return EFI_OUT_OF_RESOURCES;
   }
-  
-  PrivateData->FeCurrentState = FileExplorerStateInActive;
-  PrivateData->FeDisplayContext = FileExplorerDisplayUnknown;
-  
-  InitializeListHead (&FsOptionMenu.Head);
-  InitializeListHead (&DirectoryMenu.Head);
 
   //
   // Init OpCode Handle and Allocate space for creation of Buffer
@@ -2909,7 +4022,7 @@ InstallSecureBootConfigForm (
                                        );
   mEndLabel->ExtendOpCode = EFI_IFR_EXTEND_OP_LABEL;
   mEndLabel->Number       = LABEL_END;
-  
+
   return EFI_SUCCESS;
 }
 
@@ -2951,19 +4064,12 @@ UninstallSecureBootConfigForm (
     FreePool (PrivateData->SignatureGUID);
   }
 
-  if (PrivateData->MenuEntry != NULL) {
-    FreePool (PrivateData->MenuEntry);
-  }
-
   if (PrivateData->FileContext != NULL) {
     FreePool (PrivateData->FileContext);
   }
 
   FreePool (PrivateData);
 
-  FreeMenu (&DirectoryMenu);
-  FreeMenu (&FsOptionMenu);
-
   if (mStartOpCodeHandle != NULL) {
     HiiFreeOpCodeHandle (mStartOpCodeHandle);
   }
