From bcf73733c33b25a1a5bcad109c6fb4c64bbc0110 Mon Sep 17 00:00:00 2001
From: bunnie <bunnie@kosagi.com>
Date: Sat, 24 Jan 2026 23:52:37 +0800
Subject: [PATCH] oem-baosec-lite support in hal-service

this one is a little bit tricky. The lite version of baosec
forgoes the off-chip TRNG to save cost. Thus, there is an
"anti-feature" in the configuration, and so in this case
the dabao version of the server has to be selected despite
the baosec flag.
---
 services/bao1x-hal-service/Cargo.toml          |  1 +
 services/bao1x-hal-service/src/servers.rs      |  2 +-
 services/bao1x-hal-service/src/servers/trng.rs | 14 +++++++-------
 services/bao1x-hal-service/src/trng/dabao.rs   |  4 ++++
 services/bao1x-hal-service/src/trng/mod.rs     |  8 ++++----
 5 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/services/bao1x-hal-service/Cargo.toml b/services/bao1x-hal-service/Cargo.toml
index 1ff8a1bb9..fd1e59103 100644
--- a/services/bao1x-hal-service/Cargo.toml
+++ b/services/bao1x-hal-service/Cargo.toml
@@ -48,6 +48,7 @@ swap = []
 mpw = ["bao1x-hal/mpw"]
 bmp180 = ["bao1x-hal/bmp180"]
 board-baosec = ["bao1x-hal/board-baosec"]
+oem-baosec-lite = []
 board-baosor = ["bao1x-hal/board-baosor"]
 board-dabao = ["bao1x-hal/board-dabao"]
 
diff --git a/services/bao1x-hal-service/src/servers.rs b/services/bao1x-hal-service/src/servers.rs
index 4e510084d..8f799171f 100644
--- a/services/bao1x-hal-service/src/servers.rs
+++ b/services/bao1x-hal-service/src/servers.rs
@@ -1,7 +1,7 @@
 pub mod keyboard;
 
 // TRNG server is only needed for baosec; dabao can cheat and use the kernel TRNG port
-#[cfg(feature = "board-baosec")]
+#[cfg(all(feature = "board-baosec", not(feature = "oem-baosec-lite")))]
 mod baosec_hw;
 pub mod bio;
 pub mod rtc;
diff --git a/services/bao1x-hal-service/src/servers/trng.rs b/services/bao1x-hal-service/src/servers/trng.rs
index f221963da..0fc570795 100644
--- a/services/bao1x-hal-service/src/servers/trng.rs
+++ b/services/bao1x-hal-service/src/servers/trng.rs
@@ -1,11 +1,11 @@
-#[cfg(feature = "board-baosec")]
+#[cfg(all(feature = "board-baosec", not(feature = "oem-baosec-lite")))]
 use bao1x_api::bio::IoConfigMode;
-#[cfg(feature = "board-dabao")]
+#[cfg(any(feature = "board-dabao", feature = "oem-baosec-lite"))]
 use bao1x_hal_service::trng::Trng;
 use bao1x_hal_service::trng::api;
 use flatipc::Ipc;
 use num_traits::*;
-#[cfg(feature = "board-baosec")]
+#[cfg(all(feature = "board-baosec", not(feature = "oem-baosec-lite")))]
 use rand::RngCore;
 use xous::CID;
 use xous_ipc::Buffer;
@@ -18,7 +18,7 @@ struct ScalarCallback {
     cb_to_client_id: u32,
 }
 
-#[cfg(feature = "board-baosec")]
+#[cfg(all(feature = "board-baosec", not(feature = "oem-baosec-lite")))]
 pub fn start_trng_service() {
     std::thread::spawn({
         move || {
@@ -26,7 +26,7 @@ pub fn start_trng_service() {
         }
     });
 }
-#[cfg(feature = "board-baosec")]
+#[cfg(all(feature = "board-baosec", not(feature = "oem-baosec-lite")))]
 fn trng_service() -> ! {
     let xns = xous_names::XousNames::new().unwrap();
     // unlimited connections allowed, anyone including less-trusted processes can get a random number
@@ -88,7 +88,7 @@ fn trng_service() -> ! {
     }
 }
 
-#[cfg(feature = "board-dabao")]
+#[cfg(any(feature = "board-dabao", feature = "oem-baosec-lite"))]
 pub fn start_trng_service() {
     std::thread::spawn({
         move || {
@@ -96,7 +96,7 @@ pub fn start_trng_service() {
         }
     });
 }
-#[cfg(feature = "board-dabao")]
+#[cfg(any(feature = "board-dabao", feature = "oem-baosec-lite"))]
 fn trng_service() -> ! {
     let xns = xous_names::XousNames::new().unwrap();
     // unlimited connections allowed, anyone including less-trusted processes can get a random number
diff --git a/services/bao1x-hal-service/src/trng/dabao.rs b/services/bao1x-hal-service/src/trng/dabao.rs
index 5fd118d3f..e3c0792d0 100644
--- a/services/bao1x-hal-service/src/trng/dabao.rs
+++ b/services/bao1x-hal-service/src/trng/dabao.rs
@@ -104,6 +104,10 @@ impl Trng {
         }
     }
 
+    /// With no avalanche TRNG, this is just a pass-through to the RO as it has enough
+    /// bandwidth to provide random data at the speeds we need.
+    pub fn fill_seeded_bytes(&mut self, dest: &mut [u8]) { self.fill_bytes_via_next(dest); }
+
     /// Sets the test mode according to the argument. Blocks until mode is set.
     pub fn set_test_mode(&mut self, test_mode: api::TrngTestMode) { self.mode = test_mode; }
 
diff --git a/services/bao1x-hal-service/src/trng/mod.rs b/services/bao1x-hal-service/src/trng/mod.rs
index 6b9c7dbd7..e92c74ddd 100644
--- a/services/bao1x-hal-service/src/trng/mod.rs
+++ b/services/bao1x-hal-service/src/trng/mod.rs
@@ -1,10 +1,10 @@
-#[cfg(feature = "board-baosec")]
+#[cfg(all(feature = "board-baosec", not(feature = "oem-baosec-lite")))]
 pub mod baosec;
-#[cfg(feature = "board-baosec")]
+#[cfg(all(feature = "board-baosec", not(feature = "oem-baosec-lite")))]
 pub use baosec::*;
-#[cfg(feature = "board-dabao")]
+#[cfg(any(feature = "board-dabao", feature = "oem-baosec-lite"))]
 pub mod dabao;
-#[cfg(feature = "board-dabao")]
+#[cfg(any(feature = "board-dabao", feature = "oem-baosec-lite"))]
 pub use dabao::*;
 
 pub mod api {