From 4328cc962c63aa56d54fb1a11e5735a682196f80 Mon Sep 17 00:00:00 2001
From: Gustavo dos Santos Cardoso <gustavo_16a@hotmail.com>
Date: Sun, 28 Sep 2025 09:17:16 +0000
Subject: [PATCH] DasharoPayloadPkg: Optionally enable sealed capsules

Signed-off-by: Gustavo dos Santos Cardoso <gustavo_16a@hotmail.com>
Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
---
 DasharoPayloadPkg/DasharoPayloadPkg.dsc | 13 +++++++++++++
 DasharoPayloadPkg/DasharoPayloadPkg.fdf |  3 +++
 2 files changed, 16 insertions(+)

diff --git a/DasharoPayloadPkg/DasharoPayloadPkg.dsc b/DasharoPayloadPkg/DasharoPayloadPkg.dsc
index bc92e702bd..0c0e359e98 100644
--- a/DasharoPayloadPkg/DasharoPayloadPkg.dsc
+++ b/DasharoPayloadPkg/DasharoPayloadPkg.dsc
@@ -250,6 +250,7 @@
   FmpDependencyLib|FmpDevicePkg/Library/FmpDependencyLib/FmpDependencyLib.inf
   FmpDeviceLib|DasharoPayloadPkg/Library/FmpDeviceSmmLib/FmpDeviceSmmLib.inf
   FmpPayloadHeaderLib|FmpDevicePkg/Library/FmpPayloadHeaderLibV1/FmpPayloadHeaderLibV1.inf
+  FmpPayloadLib|FmpDevicePkg/Library/FmpPayloadLib/FmpPayloadLib.inf
   PopUpLib|DasharoPayloadPkg/Library/PopUpLib/PopUpLib.inf
   DetectTestKeyLib|FmpDevicePkg/Library/DetectTestKeyLib/DetectTestKeyLib.inf
 !else
@@ -527,6 +528,11 @@ OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrd
 
   gEfiMdeModulePkgTokenSpaceGuid.PcdSdMmcGenericTimeoutValue|$(SD_MMC_TIMEOUT)
   gEfiMdeModulePkgTokenSpaceGuid.PcdCapsuleFmpSupport|$(CAPSULE_SUPPORT)
+  gEfiMdeModulePkgTokenSpaceGuid.PcdSealedFmpCapsules|$(CAPSULES_V2)
+!if $(CAPSULES_V2)
+  # Root key for signing the outer capsule.
+  !include DasharoPayloadPkg/CapsuleRootKey.inc
+!endif
 
   gDasharoPayloadPkgTokenSpaceGuid.PcdSerialOnSuperIo|$(UART_ON_SUPERIO)
 
@@ -822,7 +828,11 @@ OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrd
       #
       # See BaseTools/Source/Python/Pkcs7Sign/Readme.md for more details on such
       # PCDs and include files.
+!if $(CAPSULES_V2)
+      !include BaseTools/Source/Python/Pkcs7Sign/TestRoot.cer.gFmpDevicePkgTokenSpaceGuid.PcdFmpDevicePkcs7CertBufferXdr.inc
+!else
       !include DasharoPayloadPkg/CapsuleRootKey.inc
+!endif
   }
   MdeModulePkg/Application/CapsuleApp/CapsuleApp.inf
   MdeModulePkg/Universal/EsrtDxe/EsrtDxe.inf
@@ -832,6 +842,9 @@ OrderedCollectionLib|MdePkg/Library/BaseOrderedCollectionRedBlackTreeLib/BaseOrd
       GCC:*_*_*_CC_FLAGS = -mmmx -msse
   }
   DasharoPayloadPkg/CapsuleChargerCheckDxe/CapsuleChargerCheckDxe.inf
+!if $(CAPSULES_V2)
+  FmpDevicePkg/DetectTestKeyDxe/DetectTestKeyDxe.inf
+!endif
 !endif
 !if $(RAM_DISK_ENABLE) == TRUE
   MdeModulePkg/Universal/Disk/RamDiskDxe/RamDiskDxe.inf
diff --git a/DasharoPayloadPkg/DasharoPayloadPkg.fdf b/DasharoPayloadPkg/DasharoPayloadPkg.fdf
index 2f41420af0..6930b980a3 100644
--- a/DasharoPayloadPkg/DasharoPayloadPkg.fdf
+++ b/DasharoPayloadPkg/DasharoPayloadPkg.fdf
@@ -422,6 +422,9 @@ FILE DRIVER = CAB058DF-E938-4F85-8978-1F7E6AABDB96 {
 
 !if $(CAPSULE_SUPPORT) == TRUE
 INF  MdeModulePkg/Universal/EsrtDxe/EsrtDxe.inf
+!if $(CAPSULES_V2) == TRUE
+INF FmpDevicePkg/DetectTestKeyDxe/DetectTestKeyDxe.inf
+!endif
 !endif
 
 ################################################################################