Fix a bug in secure boot configuration driver: Enroll DB/KEK will disable Attempt...

[mirror_edk2.git] / SecurityPkg / VariableAuthenticated / SecureBootConfigDxe / SecureBootConfig.vfr

diff --git a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
index 656befbb44fb70d0a431f74bcfdce54ae211bba2..9685a9e0c2a3c2b9a85fcc3eb7d932d3d3bd8637 100644 (file)
--- a/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
+++ b/SecurityPkg/VariableAuthenticated/SecureBootConfigDxe/SecureBootConfig.vfr
@@ -65,20 +65,29 @@ formset
     //\r
     // Display of Oneof: 'Secure Boot Mode'\r
     //\r
-    oneof varid  = SECUREBOOT_CONFIGURATION.SecureBootMode,\r
-          questionid = KEY_SECURE_BOOT_MODE,      \r
-          prompt = STRING_TOKEN(STR_SECURE_BOOT_MODE_PROMPT),\r
-          help   = STRING_TOKEN(STR_SECURE_BOOT_MODE_HELP),\r
-          flags  = INTERACTIVE,\r
-          option text = STRING_TOKEN(STR_STANDARD_MODE),    value = SECURE_BOOT_MODE_STANDARD, flags = DEFAULT;\r
-          option text = STRING_TOKEN(STR_CUSTOM_MODE),      value = SECURE_BOOT_MODE_CUSTOM,   flags = 0;\r
-    endoneof;\r
+    disableif TRUE;\r
+      oneof varid  = SECUREBOOT_CONFIGURATION.SecureBootMode,\r
+            prompt = STRING_TOKEN(STR_SECURE_BOOT_MODE_PROMPT),\r
+            help   = STRING_TOKEN(STR_SECURE_BOOT_MODE_HELP),\r
+            flags  = INTERACTIVE,\r
+            option text = STRING_TOKEN(STR_STANDARD_MODE),    value = SECURE_BOOT_MODE_STANDARD, flags = 0;\r
+            option text = STRING_TOKEN(STR_CUSTOM_MODE),      value = SECURE_BOOT_MODE_CUSTOM,   flags = 0;\r
+      endoneof;\r
+    endif;\r
+      oneof name = SecureBootMode,\r
+            questionid = KEY_SECURE_BOOT_MODE,      \r
+            prompt = STRING_TOKEN(STR_SECURE_BOOT_MODE_PROMPT),\r
+            help   = STRING_TOKEN(STR_SECURE_BOOT_MODE_HELP),\r
+            flags  = INTERACTIVE | NUMERIC_SIZE_1,\r
+            option text = STRING_TOKEN(STR_STANDARD_MODE),    value = SECURE_BOOT_MODE_STANDARD, flags = DEFAULT;\r
+            option text = STRING_TOKEN(STR_CUSTOM_MODE),      value = SECURE_BOOT_MODE_CUSTOM,   flags = 0;\r
+      endoneof;\r
     \r
     //\r
     //\r
     // Display of 'Current Secure Boot Mode'\r
     //\r
-    suppressif ideqval SECUREBOOT_CONFIGURATION.SecureBootMode == SECURE_BOOT_MODE_STANDARD;\r
+    suppressif questionref(SecureBootMode) == SECURE_BOOT_MODE_STANDARD;\r
       grayoutif NOT ideqval SECUREBOOT_CONFIGURATION.PhysicalPresent == 1;\r
       goto FORMID_SECURE_BOOT_OPTION_FORM,\r
            prompt = STRING_TOKEN(STR_SECURE_BOOT_OPTION),\r