feat: touchless display build for screen+button boards (display-keys) by IsayIsee · Pull Request #123 · TheMaxMur/RS-Key

IsayIsee · 2026-09-23T05:22:20Z

Adds a second screen build, for boards with a panel and a single button — the
Waveshare RP2350-GEEK (1.14" 240×135 ST7789V2, no touch, BOOTSEL button) is the
first target. The panel shows the ambient status (Ready / Working / Starting)
and a trusted confirm page naming the pending operation; the button is the
presence source (a short press approves, a hold past 0.8 s declines). With no
touch pad there is no on-device PIN entry — uv stays unadvertised and the CCID
pinpad stays off — so PINs are host-side exactly as on a button-only key.

Shape

display-keys is a cargo feature parallel to display (the two are
compile_error!-exclusive) and shares only display_panel; rsk-display,
rsk-bip39, rsk-slip39 and the touch flow are not pulled in.
firmware/src/display_keys.rs is the build's own glue: the PIO panel bring-up,
the status wash, and the confirm/decision pages. The arbitration it waits on is
host-tested — rsk_device::presence::GestureWait (release before the hold
threshold confirms, a longer hold declines) carries the same spent latch and
scoped cancel as ButtonWait, with unit tests and Kani proofs beside it.
The partial glass needs board keys: display.madctl_scan, display.win_x,
display.win_y (all default 0, so every existing board is unchanged), plus the
full ST7789V2 init register set and a GRAM blank before display-on — without
them the 240×135 frame lands on the controller's larger GRAM and is clipped.
firmware/boards/waveshare-geek.toml and the firmware-display-keys nix
package, with the -strong-pin / -always-uv posture variants following the
default board's convention, appended to the release matrix: fourteen flavors
become seventeen.
bcdDevice → 0x09DB, with the CHANGELOG [Unreleased] entry.

Verification

scripts/check.sh rows for the new form: rustdoc, clippy, and a release build
of BOARD=waveshare-geek LED_KIND=none --features display-keys.
The assurance matrix gained the four new columns as gap cells with settling
questions (the display family has no evidence run at those columns yet);
docs/assurance-matrix.md, docs/assurance-bounds.md,
docs/assurance-vector.md, docs/supply-chain.md and
docs/verified-compilation.md are regenerated or updated, and the citations
the new code moved are re-locked.
Hardware: the panel init and the confirm flow were verified on an
RP2350-GEEK. The touch board was not re-verified. reset_and_init is
shared, and the claim that the added register set and the GRAM blank are
neutral on a 240×320 full-GRAM glass is an argument, not a measurement — worth
a bench run before merge.

Open question

waveshare-geek as a bare board preset (no display-keys) is buildable but
unexercised: nothing in check.sh builds firmware on it, and its
bl_pwm_slice / bl_pwm_channel exist only to keep the file shaped like a
display board it is never built as. That is recorded as a ruling question in
assurance/configurations.toml: should the tree build that preset, or is the
panel a knob of firmware-display-keys instead?

…ollow The branch stacks on TheMaxMur#123 and inherits its gate failure: `display` and `display-keys` both stole the panel pads with the same five tokens, so `site_keys()` had no sequence to tell them apart and fell back to a positional `~2`. The same `panel_pad` helper lands here, as an equivalent change rather than a rebase — neither branch needs the other to build. The menu's own bump sits on top of the parent's 0x09DC: - `device_release` 0x09DD, with both CHANGELOG entries: the helper as `refactor, no behaviour change`, the menu as the behaviour change it is — a new flavor to build, a new settings record, a new screen. - `assurance/platform.toml` (PLAT-UNSAFE-004's ninth cover, plus PLAT-UNSAFE-013), `docs/unsafe.md` (Runtime sites 24) and `docs/platform-assumptions.md`: the audit surface TheMaxMur#123 moves, over this tree's line numbers. - `formal/citations.lock` and `assurance/board/PLAT-TIMER-00{2,3}.toml`: the line numbers the menu code and the two bumps moved.

github-actions · 2026-09-29T07:47:54Z

Development firmware for this pull request: https://rskey.fob.wtf/preview?pr=123

The link always opens the latest successful preview build.

Waveshare RP2350-GEEK is the first target: a 1.14" 240x135 ST7789V2 panel over the shared PIO transport, driven by one physical button. The screen shows the ambient status, a trusted one-key confirm page naming the pending operation, and approve/decline feedback; a short press approves, a hold past 0.8 s declines. No touch pad means no on-device PIN entry, so `uv` stays unadvertised and the CCID pinpad stays off — PINs are host-side, as on a button-only key. `display-keys` is a cargo feature parallel to `display` (the two are `compile_error!`-exclusive) and shares only `display_panel`; `rsk-display`, `rsk-bip39`, `rsk-slip39` and the touch flow are not pulled in. The arbitration the new build waits on is host-tested: `rsk_device::presence::GestureWait` carries the same `spent` latch and scoped cancel as `ButtonWait`, with unit tests and Kani proofs beside it — which is what moves the `BugNoDropStaleCancelAtEntry` comutant's anchor onto the `wait` signature, the two entry preambles now being identical. The partial glass needs board keys: `display.madctl_scan`, `display.win_x` and `display.win_y` (all default 0, so every existing board is unchanged) plus the full ST7789V2 init register set and a GRAM blank before display-on, without which the 240x135 frame lands on the controller's larger GRAM and is clipped. The GEEK board file and the `firmware-display-keys` nix package (with the `-strong-pin` / `-always-uv` posture variants the default board has) join the release matrix, fourteen flavors become seventeen; `bcdDevice` moves to 0x09DB. The assurance matrix gains the four new columns as `gap` cells with settling questions, the pages the new code moved are regenerated, and the citations are re-locked.

`display_keys.rs`: the nested `if let` collapses into a let-chain, and the two divisibility tests (`% 2 == 0`, `% 3 == 0`) become `is_multiple_of`. These are what the gate's clippy reports; no other file changes.

`docs/releases.md`'s `display-keys` row sends a reader to `guides/display.md`, and the guide had nothing to say about the touchless build: the one-key flow lived only in the README and the CHANGELOG. - `guides/display.md`: a "The touchless variant" section — ambient status, the confirm page naming the pending operation, a short press against the ~0.8 s hold, PINs host-side — with the See-also line naming both features. - `hardware.md`: the board beside the touch one, photo and label. - `build.md`: the feature's own row and `waveshare-geek` in the `BOARD` list, which is what the See-also line now points at. The `display-keys` matrix row also stops advertising the no-host idle menu, which this PR does not build; the menu PR restores the mention (TheMaxMur#126). Docs only: no `bcdDevice` move, no wire surface.

`display` and `display-keys` both steal the same CS/DC/RST pads, and both wrote the steal as the same five tokens, so `site_keys()` had no word sequence to name them apart and fell back to a positional `~2` — a key the registry cannot cite. `display-keys` now takes its four control pads through one `panel_pad` helper, which is one site. The helper is a refactor of shipped code, so `device_release` moves to 0x09DC with a CHANGELOG entry that says so. What it moves besides is the audit surface: - `assurance/platform.toml`: PLAT-UNSAFE-004 states the helper and counts the one site as its ninth cover; PLAT-UNSAFE-013 registers the keygen screen's shared-panel pointer in `display_keys.rs`, `pending`, refining PLAT-TOOLCHAIN-002. - `docs/unsafe.md`: Runtime sites 22 -> 24, the pad row is `×9` and `### 5-13`, and the keygen handle becomes `### 14` with the sections after it renumbered. - `formal/citations.lock` and `assurance/board/PLAT-TIMER-00{2,3}.toml`: the line numbers the helper and the bump moved; the lock's nine entries are relocations of unchanged text. - `docs/platform-assumptions.md` regenerated from the registry.

`docs/platform-assumptions.md` is written from the rows in `assurance/platform.toml`, and the LED-task row still carried the numbers from before the citation pass: `firmware/src/main.rs:1071/1009/1017` where the registry, and the file itself, say 1072/1010/1018. The page was generated before that relocation, so the region generated from the registry went stale by three numbers — the bcd comment above the spawns is the one line that moved them. `scripts/platform_gate.py --write`, one line. The registry and the tree agreed already; only the copy generated from them did not.

`AnyPin::steal` hands back `Peri<'static, AnyPin>`, so a helper declared `-> AnyPin` erased the token `Output::new` needs. Only the `display-keys` flavor compiles through the helper — the `display` build passes the same expression inline, where nothing erases it.

… build `AnyPin::steal` hands back `Peri<'static, AnyPin>`, so a helper declared `-> AnyPin` erased the token `Output::new` needs. Only the `display-keys` flavor compiles through the helper — the `display` build passes the same expression inline, where nothing erases it. A line that can reach the image owes the bump, so `bcdDevice` moves to 0x09DD.

The `display-keys` packages and the `waveshare-geek` board took the matrix from 31 configurations to 35 and its 1240 cells to 1400 (37 covered, 143 equivalent, 109 out-of-scope, 1111 gap). The eleven slices kept the old line, so `bundle_gate` read 88 stale transcriptions and the check job stopped on its row; the cases pinning the same numbers were stale with it, and the generated page carried the pre-board input counts. Gate, tests and docs only: `assurance/`, `scripts/` and `docs/` carry no line the image is built from, so no `bcdDevice` bump.

The `waveshare-geek` board and its three `display-keys` packages took the matrix from 19 flake packages to 22 and its boards from 6 to 7, and the touchless build added a ninth `AnyPin::steal` site, a thirteenth PLAT-UNSAFE row and a ninth `cargo doc` row. Four pins still held the pre-board counts, so `pytest (gate scripts)` read three failures — `matrix_gate.FLOOR_PACKAGES` at 19 against a derivation of 22, `len(steals)` at 8 against 9, and the `cargo doc` row count at 8 against 9 — and the check job stopped on its row. The floors sit AT the count by design (upstream's `583e58eb`), and this PR's own `docs/unsafe.md` already numbers the ninth steal — ×8 → ×9 — so the pins were stale, not the tree. The prose carrying the same counts follows them, in the same diff: the `matrix_gate` docstring and the matrix page's template sentence, that page regenerated with `--write`; `docs/formal.md`'s sentence naming packages, features and boards; `check.sh`'s comment on the matrix row; the two test comments quoting the old figures; and `PLAT-TOOLCHAIN-002`'s statement, discharge and header comment, which still counted twelve rows over thirty-one sites with eight of them GPIO steals — its page regenerated with `--write` as well. `12 against 19` stays where it is: that is the history of where the floor came from, not a count of this tree. Gate, tests and docs only: `scripts/`, `docs/` and `assurance/` carry no line the image is built from, so no `bcdDevice` bump.

…ollow The branch stacks on TheMaxMur#123 and inherits its gate failure: `display` and `display-keys` both stole the panel pads with the same five tokens, so `site_keys()` had no sequence to tell them apart and fell back to a positional `~2`. The same `panel_pad` helper lands here, as an equivalent change rather than a rebase — neither branch needs the other to build. The menu's own bump sits on top of the parent's 0x09DC: - `device_release` 0x09DD, with both CHANGELOG entries: the helper as `refactor, no behaviour change`, the menu as the behaviour change it is — a new flavor to build, a new settings record, a new screen. - `assurance/platform.toml` (PLAT-UNSAFE-004's ninth cover, plus PLAT-UNSAFE-013), `docs/unsafe.md` (Runtime sites 24) and `docs/platform-assumptions.md`: the audit surface TheMaxMur#123 moves, over this tree's line numbers. - `formal/citations.lock` and `assurance/board/PLAT-TIMER-00{2,3}.toml`: the line numbers the menu code and the two bumps moved.

This was referenced Sep 23, 2026

fix(piv): serve a synthesized Card Capability Container #124

Merged

feat: display-keys no-host idle menu, and a named PIV consent slot #126

Open

This was referenced Sep 24, 2026

[rehearsal] feat: touchless display build for screen+button boards (display-keys) IsayIsee/RS-Key#2

Open

[rehearsal] feat: display-keys no-host idle menu, and a named PIV consent slot IsayIsee/RS-Key#3

Open

Zhongren233 mentioned this pull request Oct 5, 2026

feat(panel): a status-only screen build for a board with no touch #131

Open

1 of 8 tasks

IsayIsee added 9 commits October 19, 2026 08:57

fix(firmware): the clippy findings the pinned toolchain reports

23c0ae9

`display_keys.rs`: the nested `if let` collapses into a let-chain, and the two divisibility tests (`% 2 == 0`, `% 3 == 0`) become `is_multiple_of`. These are what the gate's clippy reports; no other file changes.

IsayIsee force-pushed the pr/board-display-keys branch from 3113a77 to f14f242 Compare October 19, 2026 01:10

Navigation Menu

Repository navigation

feat: touchless display build for screen+button boards (display-keys) - #123

feat: touchless display build for screen+button boards (display-keys)#123
IsayIsee wants to merge 9 commits into
TheMaxMur:mainfrom
IsayIsee:pr/board-display-keys

IsayIsee commented Sep 23, 2026

Uh oh!

github-actions Bot commented Sep 29, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

IsayIsee commented Sep 23, 2026

Shape

Verification

Open question

Uh oh!

github-actions Bot commented Sep 29, 2026

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant