Skip to main content

Module channels

hsm_firmware

Module channels 

Source
Expand description

Global communication primitives between firmware tasks.

The firmware uses three async tasks (USB run loop, dispatch loop, animation loop) plus the touch and state tasks. They communicate through three lock-free primitives, all backed by [CriticalSectionRawMutex].

§Why CriticalSectionRawMutex and not NoopRawMutex

The embassy executor used here is single-threaded, so the “no-op” mutex would be sufficient in terms of actual synchronisation. Unfortunately NoopRawMutex is explicitly not Sync (so it cannot be placed in a static), because it cannot guarantee correctness when shared across threads. CriticalSectionRawMutex is Sync and pays only the cost of a brief critical section (interrupts off) per lock, which is fine on the RP2040.

  • EVENT_CHANNEL : fan-in queue of [Event]s. Every task that wants to drive a state transition (dispatch_loop on PIN verified, touch_task on press, timer_task on timeout) posts here. The state_task is the sole consumer.
  • TOKEN_STATE : last-write-wins signal carrying the current [TokenState]. The state_task publishes; the animation_task reads.
  • TOUCH_CONFIRMED : pulsed by the state_task each time the SM transitions into [TokenState::Signing]. The dispatch_loop awaits it to know its Sign request has been authorised by the user.

Constants§

EVENT_QUEUE_DEPTH 🔒
Capacity of the event channel. 16 is generous: in practice the channel holds 0 or 1 event most of the time. The producer tasks all use non-blocking try_send so an unexpected backlog drops events rather than stalling the firmware.

Statics§

EVENT_CHANNEL 🔒
Fan-in queue of state machine events.
TOKEN_STATE 🔒
Last-write-wins signal of the current operating state. The animation task reads this on every frame; the state task republishes on every transition.
TOUCH_CONFIRMED 🔒
Pulsed by the state task when the SM enters [TokenState::Signing]. The dispatch loop blocks on it after firing [hsm_firmware_logic::Event::SignRequested] so it can resume signing only after the user has physically touched the button.

Functions§

post_event 🔒
Fire an event without blocking.