refuse a reset to the app when no app is present (#53)

* refuse a reset to the app when no app is present

* let ch32 skip the app check's length test, word the cli refusal for both causes

Author: aq1018

CHANGELOG.md

@@ -4,6 +4,28 @@ Releases up through `v0.4.0` were workspace-wide and tagged `vX.Y.Z`. From `0.4.
 
 ## [Unreleased]
 
+## [tinyboot 0.5.2] - 2026-10-20
+
+### Fixed
+
+- A refused reset to the app reports that an update is in progress or no app is flashed, instead of only the former.
+
+## [tinyboot-ch32 0.7.1] - 2026-10-20
+
+### Changed
+
+- `Storage` overrides `app_present()` without the length check, since its app base is always readable flash. The bootloader's reset guard from tinyboot-core 0.6.2 costs 4 bytes instead of 18.
+
+## [tinyboot-core 0.6.2] - 2026-10-20
+
+### Added
+
+- `Storage::app_present()`, provided: the app region's first word is programmed. A platform that knows its region holds a word overrides it without the length check.
+
+### Fixed
+
+- The bootloader refuses `Reset` to the app with `Unsupported` when the app region's first word is erased, as it does mid-update, and stays in the bootloader. A system-flash bootloader hands off by boot mode without checking the app, so a chip with no app flashed jumped into blank flash and hung until a power cycle.
+
 ## [tinyboot-protocol 0.5.1] - 2026-10-20
 
 ### Changed

ch32/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "tinyboot-ch32"
 description = "tinyboot ch32 implementation"
-version = "0.7.0"
+version = "0.7.1"
 edition.workspace = true
 repository.workspace = true
 license.workspace = true
@@ -52,8 +52,8 @@ repository = "https://github.com/OpenServoCore/tinyboot"
 license = "MIT OR Apache-2.0"
 
 [workspace.dependencies]
-tinyboot-core = { version = "0.6.1", path = "../lib/core", default-features = false }
-tinyboot-ch32 = { version = "0.7.0", path = ".", default-features = false }
+tinyboot-core = { version = "0.6.2", path = "../lib/core", default-features = false }
+tinyboot-ch32 = { version = "0.7.1", path = ".", default-features = false }
 embedded-hal = "1"
 embedded-io = "0.7"
 embedded-storage = "0.3"

ch32/src/platform/storage.rs

@@ -87,6 +87,13 @@ impl StorageTrait for Storage {
     fn as_slice(&self) -> &[u8] {
         unsafe { core::slice::from_raw_parts(self.app_ptr(), self.app_size) }
     }
+
+    #[inline(always)]
+    fn app_present(&self) -> bool {
+        // SAFETY: the app base is a word-aligned flash address on every
+        // chip, readable whatever the region's length.
+        unsafe { core::ptr::read_volatile(self.app_ptr() as *const u32) != 0xFFFF_FFFF }
+    }
 }
 
 impl ReadNorFlash for Storage {

cli/Cargo.lock

@@ -1,7 +1,7 @@
 [package]
 name = "tinyboot"
 description = "CLI firmware flasher for tinyboot bootloader"
-version = "0.5.1"
+version = "0.5.2"
 edition = "2024"
 repository = "https://github.com/OpenServoCore/tinyboot"
 license = "MIT OR Apache-2.0"

cli/Cargo.toml

@@ -285,11 +285,11 @@ fn parse_baud(rate: &str) -> Result<Option<BaudRate>, Box<dyn std::error::Error>
     })
 }
 
-/// The bootloader refuses to start the app while an update is in progress.
+/// The bootloader refuses to start the app mid-update or with no app flashed.
 fn refused_app(e: FlashError) -> Box<dyn std::error::Error> {
     match e {
         FlashError::Device(Status::Unsupported) => "the bootloader refused to start the app: \
-             an update is in progress. Flash again, or `tinyboot reset --bootloader`."
+             an update is in progress or no app is flashed. Flash an app."
             .into(),
         e => e.into(),
     }

cli/src/main.rs

@@ -97,6 +97,7 @@ When all four hold, the bootloader hands off to the app. As soon as you run a re
 | App's `confirm()` never reaches due to bug | Same as above — trials run out, bootloader wins.                                         |
 | Host crashes mid-flash                     | Same as "power lost during erase or write" — safe, just re-flash.                        |
 | `Reset` to the app mid-flash               | Refused with `Unsupported`; the device stays in the bootloader. Re-flash.                |
+| `Reset` to the app with no app flashed     | Refused with `Unsupported`; the device stays in the bootloader. Flash an app.            |
 | Image built for another board              | Verify returns `Incompatible` (bootloader has a compatibility key); flash the right one. |
 
 ## Several devices on one bus

docs/remote-updates.md

@@ -1,7 +1,7 @@
 [package]
 name = "tinyboot-core"
 description = "Core bootloader library for tinyboot"
-version = "0.6.1"
+version = "0.6.2"
 edition.workspace = true
 repository.workspace = true
 license.workspace = true

lib/core/Cargo.toml

@@ -95,11 +95,8 @@ where
                 self.platform.storage.as_slice().get_unchecked(..sz)
             }) == stored;
         }
-        // No CRC stored (virgin / debugger-flashed) — require at least one
-        // non-0xFF word to treat the app as present.
-        let data = self.platform.storage.as_slice();
-        data.len() >= 4
-            && unsafe { core::ptr::read_volatile(data.as_ptr() as *const u32) } != 0xFFFF_FFFF
+        // No CRC stored (virgin / debugger-flashed).
+        self.platform.storage.app_present()
     }
 
     #[inline(always)]

lib/core/src/core.rs

@@ -330,8 +330,10 @@ impl<
             let flags = unsafe { flags.reset };
             // A reset to the app skips the bootloader's META check on
             // chips that hand off by run mode, so a half-written image
-            // would run.
-            if state == BootState::Updating && !flags.contains(ResetFlags::BOOTLOADER) {
+            // would run and an erased app region would hang the chip.
+            if !flags.contains(ResetFlags::BOOTLOADER)
+                && (state == BootState::Updating || !self.platform.storage.app_present())
+            {
                 self.frame.status = Status::Unsupported;
             } else {
                 self.cmd_reset(addr, flags);