LIVE cartercole.net --:--:-- UTC

// 03 HARDWARE

zeroflip

RUST SWIFTUI AMQP KITH

A Raspberry Pi Zero W with a 2.13-inch e-paper screen, running a kernel I wrote in Rust with no operating system underneath it. It drives the screen, the Wi-Fi and Bluetooth chip, USB keyboards and gamepads straight through their registers, takes messages over RabbitMQ, and updates itself over the air. An iPhone app controls it: a D-pad with a live mirror of the screen, photos dithered on the phone, a drawing pad, and Wi-Fi setup over Bluetooth. Every command, from the app or the network, has to carry a kith token for my identity.

The e-paper HAT on a Pi Zero W, lying on a wooden table, its orange flex cable folded round the left end. The screen's title bar reads ZEROFLIP with Wi-Fi bars and mq, 33C and 14:01. The System page is selected in the menu of System, Wi-Fi, Inbox, Log, GPIO and Display, and reads Pi Zero W r1.1, ARM 700 core 250, temp 32.5 C, RAM 496 MB, boot SD, build 0714Z-20770, 2026-11-13 14:01. 01 On the real board: online, clock set, System page The e-paper held between finger and thumb, showing a close-up photo of a person's face, eyes and nose, turned into black and white dots that fill the 250 by 122 screen. 02 A photo from the phone, dithered to 1-bit Four screens of the zeroflip kernel's e-paper interface, 250 by 122 pixels each, black on grey. Each has a ZEROFLIP title bar with the temperature, 25C, and the uptime. System: Pi Zero r1.2, ARM 700, core 350, temp 25.0 C, RAM 448 MB, boot SD, build 0112Z-20771. GPIO: two rows of fourteen boxes for BCM pins 0 to 27 with a few filled in, LEV0 00060100, keys on 5 6 13 19 26, EPD on RST17 DC25 CS8. Log: USB lines for a hub and a keyboard, the device id ZF-00123457, key presses and a fast refresh. Display: SSD1680 e-paper, 250x122 1-bit, SPI0 at 5468 kHz, refresh counts and a ghosting budget, HDMI 500x244. A menu down the left side lists System, Wi-Fi, Inbox, Log, GPIO and Display. 03 The kernel's own screens: System, GPIO, Log, Display Three iPhone screens of the Zeroflip app. Control: a live mirror of the e-paper showing the System page, above a round D-pad with an OK button in the middle. Send: a message box for the Inbox screen and a photo turned into a dithered 1-bit picture at the display's size, with switches for fill, dither and invert. Draw: a drawing pad the shape of the display with hi and a smiley face drawn on it, pen and eraser, brush size, Clear and Show on the Pi. 04 The iPhone app: Control, Send, Draw Left, the e-paper with no network: a QR code beside No Wi-Fi, Scan with the iPhone camera: Zeroflip opens and sends this Pi a network over Bluetooth, the device id ZF-00123457 and the reason, no zeroflip.pak. Right, the iPhone app's Control tab mirroring the same screen above its D-pad. 05 No network: the Pi shows a QR code for the phone The e-paper held in a hand on a cluttered bench, on the Wi-Fi page: join error, the network name, no IP address, mq waiting, msgs 0, and the board's MAC address. The uptime reads 00:00:14. 06 Bring-up: the Wi-Fi page after a failed join The e-paper held in a hand, on the Log page: wifi lines repeating pmk Status(-2), joining the home network, and deauth/disassoc ev 11 reason 8, over and over. The uptime reads 00:00:38. 07 Bring-up: the log through a run of failed joins

What the kernel drives

The firmware jumps to the kernel at 0x8000 and it runs from there in kernel mode, about 8,500 lines of Rust.

The iPhone app

A SwiftUI app with five tabs. Control is a D-pad under a live copy of the e-paper. Send puts a message on the Inbox screen, or turns a photo into a dithered 250 × 122 picture on the phone before it goes. Draw is a pad the shape of the screen. Bluetooth has the Pi scan the room. Pi shows its status and log, sets its Wi-Fi network and the lost-and-found owner, and puts it to sleep or turns it off.

At home it talks HTTP to zeroflip.local. For away from home there is a gateway for AWS Lambda that checks the same token and passes the command to the Pi as RabbitMQ RPC, over Tailscale, so nothing at home is open to the internet. When the Pi has no network for 45 seconds its screen shows a QR code; the iPhone camera opens the app, which sends it a network over Bluetooth. The phone works out the WPA2 key itself, so the password never reaches the Pi.

Signing in, with no clock

The app signs in to my kith hub with a passkey, and the Pi checks every token's signature, issuer, audience, subject and expiry. The Pi has no clock, though, and gets the time over NTP. Away from its Wi-Fi it checks a Bluetooth token at the moment it was issued and sets its clock from it, only ever forward. For when nothing else works there is a recovery key: an Ed25519 key pinned on the card, whose private half stays in the Mac's keychain, answering a one-time challenge from the Pi's hardware random number generator.

Updates and sleep

A new kernel arrives as a RabbitMQ message with a single-use token. The running kernel writes it into the spare of two 4 MB slots on the SD card, reads it back, and jumps into it in memory. The new kernel only switches the boot slot after staying connected for 30 seconds, so a bad one never sticks: power it off and the old one boots.

Fifteen minutes after the screen goes blank, a lost-and-found tag with the device id and its owner goes up and the panel sleeps. A key or a message wakes it. Holding OK for three seconds shows the tag and halts, and e-paper keeps the tag with no power at all.

The pictures

The photos are the board itself: on the table once it was online with its clock set, showing a photo sent from the phone, and earlier, during bring-up, failing to join the network over and over. The flat screens are the same kernel booted in QEMU's Pi Zero model with its HDMI output captured. The app is in the iOS simulator, driving that QEMU kernel through a small bridge that turns the app's HTTP calls into QEMU key presses and screen captures. QEMU has no Wi-Fi chip, which is why its setup screen says there is no network.