Application environment

Introduction

Because the Secure Element has limited RAM, it supports only one running application at a time. This isolation prevents other applications from interfering with the SE-MCU link. It also allows Ledger OS to give the running application full control of I/O with the device’s peripherals.

This model gives applications as much control over the device’s features as possible. Each application effectively runs in a virtual device and can reconfigure the hardware. Ledger OS isolates the application from other applications and restricts its flash memory access to areas allocated exclusively to it.

This control does not limit what the application can do, but it makes each application responsible for managing every layer of the transport protocols used to communicate outside the Secure Element. The SDK implements the I/O handling that typical applications need. Developers can also customize I/O protocols for specialized applications.

The application-centric view of the Ledger OS environment

The diagram shows the system from the application’s perspective. The application directly accesses multiple peripherals and controls the device while it runs. Each box represents a coprocessor under the application’s direct command.

Some peripherals receive commands from the Secure Element and trigger events that the MCU relays back to it. These peripherals include buttons activated by user actions and I/O peripherals that communicate in the background, such as the USB controller. They can also pass requests to the application for processing.

In this model, the application is central and does not rely on other embedded co-applications.

Delegation model

An overview of the USB delegation model

After Ledger OS boots an application, the application can no longer reach the operating system directly. Ledger OS provides only basic services through system calls while the application runs. As a result, Ledger OS does not process commands that peripherals, such as USB, send to the device and does not participate in I/O handling.

Together, application control and I/O delegation put applications in charge of the device. They can customize the display, user input actions, and how the device is enumerated over USB. Through event handling, an application can emulate Mass Storage or appear as a WinUSB peripheral.