HSM provisioning UI

Functions
void	hsm_enrol_open (void)
	Opens the CSR-enrolment overlay from an LVGL click; pair with hsm_provision_ui_teardown().
void	hsm_protect_open (void)
	Opens the Protected Update overlay; same pairing contract as hsm_enrol_open().
void	hsm_provision_ui_teardown (void)
	Last statement of the page's destroy_cb, while LVGL objects are still valid.

Detailed Description

Header: hsm_provision_ui.h. Implementation: archived hsm_provision_ui.c (libbento_cm55.a). Two teaching screens on the HSM page — certificate enrolment by CSR, and Protected Update — each a full-screen overlay whose work is asynchronous: IPC_CMD_HSM_PROVISION returns immediately and an lv_timer polls, because a busy-wait would freeze the screen and stop the busy modal from explaining the freeze.

Variant

mtb-mpy and mtb-only

Function Documentation

hsm_enrol_open()

void hsm_enrol_open

(

void

)

Opens the CSR-enrolment overlay from an LVGL click; pair with hsm_provision_ui_teardown().

Open the Enrol screen — key pair, CSR, proof of possession, certificate.

Contract

An lv_event_cb body — invoked from an LVGL button click, GFX-task context only. No arguments, no return, no error path at the call site: the overlay reports its own status. No init precedes it beyond the HSM page existing; it self-constructs the overlay. The owning page must pair it with hsm_provision_ui_teardown() in its destroy path — that pairing is the contract.

Variant

mtb-mpy and mtb-only

/* ...context: button event callbacks - GFX task context ... */
static void enrol_btn_clicked_cb(lv_event_t *e)   { (void)e; hsm_enrol_open(); }
static void protect_btn_clicked_cb(lv_event_t *e) { (void)e; hsm_protect_open(); }

hsm_protect_open()

void hsm_protect_open

(

void

)

Opens the Protected Update overlay; same pairing contract as hsm_enrol_open().

Open the Protect screen — pending change set, confirm, run, read back.

Contract

Same as hsm_enrol_open: event-callback body, GFX-task only, overlay reports its own status, must be paired with hsm_provision_ui_teardown() in the page's destroy.

Variant

mtb-mpy and mtb-only

/* ...context: button event callbacks - GFX task context ... */
static void enrol_btn_clicked_cb(lv_event_t *e)   { (void)e; hsm_enrol_open(); }
static void protect_btn_clicked_cb(lv_event_t *e) { (void)e; hsm_protect_open(); }

hsm_provision_ui_teardown()

void hsm_provision_ui_teardown

(

void

)

Last statement of the page's destroy_cb, while LVGL objects are still valid.

Called from page_hsm_destroy(): drop any overlay and cancel its poll timer.

Contract

Called from the page's destroy_cb (GFX-task context) while the LVGL objects are still valid, as the last statement — after the page's own timers are deleted and its widget pointers nulled: local cleanup first, then the overlay teardown. Idempotent when no overlay is open (the shipped caller does not guard it). Rationale in-code: a provisioning poll timer that fires after the widgets are freed dereferences them. The module's own close button (hsm_provision_ui.c:447) is the other caller.

Variant

mtb-mpy and mtb-only

void page_hsm_destroy(void)
{
    memset(&s_ctx, 0, sizeof(s_ctx));
    s_cert_overlay = NULL;
    s_bench_overlay = NULL;
 
    /* The screen (and every PIN widget under it) is being deleted by the
     * page manager — cancel the pending one-shot timer and drop all widget
     * pointers so a late callback cannot touch freed LVGL objects. */
    if (s_pin.timer) {
        lv_timer_delete(s_pin.timer);
        s_pin.timer = NULL;
    }
    s_pin.overlay = NULL;
    s_pin.icon_lbl = NULL;
    s_pin.title_lbl = NULL;
    s_pin.msg_lbl = NULL;
    for (int i = 0; i < PIN_LENGTH; i++) s_pin.dots[i] = NULL;
    /* Any provisioning overlay and its poll timer go with the page. A timer
     * that fires after these widgets are freed dereferences them. */
    hsm_provision_ui_teardown();