From f91612b7c8ea8ceb94f68cae523df34a0137d5ea Mon Sep 17 00:00:00 2001
From: night1rider <backman23@live.com>
Date: Mon, 3 Aug 2026 00:15:05 -0600
Subject: [PATCH] Xilinx Versal Gen2 ASU port: make TRNG direct RNG opt-in
 (seed the software DRBG by default) and wait on completion with
 Xil_WaitForEvent

---
 .wolfssl_known_macro_extras                     |  2 ++
 .../src/port/xilinx/versal_gen2_asu/asu_rng.c   | 13 ++++++++-----
 .../src/port/xilinx/versal_gen2_asu/asu_util.c  | 17 ++++++++++++++++-
 3 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/.wolfssl_known_macro_extras b/.wolfssl_known_macro_extras
index 4fdfa0f3606..0826b6a8790 100644
--- a/.wolfssl_known_macro_extras
+++ b/.wolfssl_known_macro_extras
@@ -1061,6 +1061,7 @@ WOLFSSL_VA416X0_TRNG
 WOLFSSL_VALIDATE_DH_KEYGEN
 WOLFSSL_VERSAL_GEN2_ASU
 WOLFSSL_VERSAL_GEN2_ASU_RTC
+WOLFSSL_VERSAL_GEN2_ASU_TRNG_DIRECT
 WOLFSSL_WC_SLHDSA_RECURSIVE
 WOLFSSL_WC_XMSS_NO_SHA256
 WOLFSSL_WICED_PSEUDO_UNIX_EPOCH_TIME
@@ -1094,6 +1095,7 @@ XGETPASSWD
 XMSS_CALL_PRF_KEYGEN
 XPAR_VERSAL_CIPS_0_PSPMC_0_PSV_CORTEXA72_0_TIMESTAMP_CLK_FREQ
 XSECURE_CACHE_DISABLE
+XYIELD
 _ABI64
 _ABIO64
 _ARCH_PPC64
diff --git a/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rng.c b/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rng.c
index df32a5770e9..eacf1a890f5 100644
--- a/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rng.c
+++ b/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_rng.c
@@ -100,8 +100,9 @@ static int wc_AsuRngSeed(wc_CryptoInfo* info)
     return wc_AsuTrngFill(info->seed.seed, info->seed.sz);
 }
 
-/* WC_ALGO_TYPE_RNG: serve random blocks straight from the ASU TRNG.
- * Internal helper reached through the wc_AsuRng dispatcher. */
+#ifdef WOLFSSL_VERSAL_GEN2_ASU_TRNG_DIRECT
+/* Serve random blocks straight from the TRNG (opt in). Off by default so the TRNG
+ * only seeds the software DRBG instead of replacing it. */
 static int wc_AsuRngGenerate(wc_CryptoInfo* info)
 {
     if (info == NULL) {
@@ -110,10 +111,10 @@ static int wc_AsuRngGenerate(wc_CryptoInfo* info)
 
     return wc_AsuTrngFill(info->rng.out, info->rng.sz);
 }
+#endif
 
-/* Single entry point for the ASU TRNG. The crypto callback dispatcher routes
- * both random number requests here and this handler decides which it is: seed a
- * DRBG (WC_ALGO_TYPE_SEED) or serve random blocks (WC_ALGO_TYPE_RNG). */
+/* Entry point for the ASU TRNG. Seeds the software DRBG by default; the DIRECT
+ * macro also serves random blocks straight from the TRNG. */
 int wc_AsuRng(wc_CryptoInfo* info)
 {
     if (info == NULL) {
@@ -123,8 +124,10 @@ int wc_AsuRng(wc_CryptoInfo* info)
     switch (info->algo_type) {
         case WC_ALGO_TYPE_SEED:
             return wc_AsuRngSeed(info);
+    #ifdef WOLFSSL_VERSAL_GEN2_ASU_TRNG_DIRECT
         case WC_ALGO_TYPE_RNG:
             return wc_AsuRngGenerate(info);
+    #endif
         default:
             return CRYPTOCB_UNAVAILABLE;
     }
diff --git a/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_util.c b/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_util.c
index b83f05af2ba..f2b2cba1d92 100644
--- a/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_util.c
+++ b/wolfcrypt/src/port/xilinx/versal_gen2_asu/asu_util.c
@@ -32,6 +32,7 @@
 #include <wolfssl/wolfcrypt/wc_port.h>
 
 #include "xil_cache.h"
+#include "xil_util.h"
 #include "xstatus.h"
 
 #ifdef WOLFSSL_VERSAL_GEN2_ASU_RTC
@@ -68,10 +69,24 @@ void wc_AsuWaitPrepare(AsuWait* wait, XAsu_ClientParams* params)
     params->AdditionalStatus = (u32)XST_FAILURE;
 }
 
+#ifndef WC_ASU_WAIT_TIMEOUT_US
+    /* Per poll cycle in microseconds; the loop re-arms until the flag is set, so a
+     * timeout just repeats the wait rather than failing the transaction. */
+    #define WC_ASU_WAIT_TIMEOUT_US 1000000U
+#endif
+
 word32 wc_AsuWaitDone(AsuWait* wait)
 {
     while (wait->Done == 0) {
-        /* busy wait for the single threaded baremetal client */
+    #ifdef XYIELD
+        /* Hand the wait to an RTOS/scheduler when the app defines XYIELD. */
+        XYIELD();
+    #else
+        /* Poll the completion flag with a bounded wait, re-arming until it is set.
+         * Done is one byte, so mask the low byte of the word Xil_WaitForEvent reads. */
+        (void)Xil_WaitForEvent((UINTPTR)&wait->Done, 0xFFU, 1U,
+            WC_ASU_WAIT_TIMEOUT_US);
+    #endif
     }
 
     return wait->Status;