let ch32 skip the app check's length test, word the cli refusal for both causes

Author: aq1018

CHANGELOG.md

@@ -4,8 +4,24 @@ Releases up through `v0.4.0` were workspace-wide and tagged `vX.Y.Z`. From `0.4.
 
 ## [Unreleased]
 
+## [tinyboot 0.5.2] - 2026-10-20
+
+### Fixed
+
+- A refused reset to the app reports that an update is in progress or no app is flashed, instead of only the former.
+
+## [tinyboot-ch32 0.7.1] - 2026-10-20
+
+### Changed
+
+- `Storage` overrides `app_present()` without the length check, since its app base is always readable flash. The bootloader's reset guard from tinyboot-core 0.6.2 costs 4 bytes instead of 18.
+
 ## [tinyboot-core 0.6.2] - 2026-10-20
 
+### Added
+
+- `Storage::app_present()`, provided: the app region's first word is programmed. A platform that knows its region holds a word overrides it without the length check.
+
 ### Fixed
 
 - The bootloader refuses `Reset` to the app with `Unsupported` when the app region's first word is erased, as it does mid-update, and stays in the bootloader. A system-flash bootloader hands off by boot mode without checking the app, so a chip with no app flashed jumped into blank flash and hung until a power cycle.

ch32/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "tinyboot-ch32"
 description = "tinyboot ch32 implementation"
-version = "0.7.0"
+version = "0.7.1"
 edition.workspace = true
 repository.workspace = true
 license.workspace = true
@@ -53,7 +53,7 @@ license = "MIT OR Apache-2.0"
 
 [workspace.dependencies]
 tinyboot-core = { version = "0.6.2", path = "../lib/core", default-features = false }
-tinyboot-ch32 = { version = "0.7.0", path = ".", default-features = false }
+tinyboot-ch32 = { version = "0.7.1", path = ".", default-features = false }
 embedded-hal = "1"
 embedded-io = "0.7"
 embedded-storage = "0.3"

ch32/src/platform/storage.rs

@@ -87,6 +87,13 @@ impl StorageTrait for Storage {
     fn as_slice(&self) -> &[u8] {
         unsafe { core::slice::from_raw_parts(self.app_ptr(), self.app_size) }
     }
+
+    #[inline(always)]
+    fn app_present(&self) -> bool {
+        // SAFETY: the app base is a word-aligned flash address on every
+        // chip, readable whatever the region's length.
+        unsafe { core::ptr::read_volatile(self.app_ptr() as *const u32) != 0xFFFF_FFFF }
+    }
 }
 
 impl ReadNorFlash for Storage {

cli/Cargo.lock

@@ -1,7 +1,7 @@
 [package]
 name = "tinyboot"
 description = "CLI firmware flasher for tinyboot bootloader"
-version = "0.5.1"
+version = "0.5.2"
 edition = "2024"
 repository = "https://github.com/OpenServoCore/tinyboot"
 license = "MIT OR Apache-2.0"

cli/Cargo.toml

@@ -285,11 +285,11 @@ fn parse_baud(rate: &str) -> Result<Option<BaudRate>, Box<dyn std::error::Error>
     })
 }
 
-/// The bootloader refuses to start the app while an update is in progress.
+/// The bootloader refuses to start the app mid-update or with no app flashed.
 fn refused_app(e: FlashError) -> Box<dyn std::error::Error> {
     match e {
         FlashError::Device(Status::Unsupported) => "the bootloader refused to start the app: \
-             an update is in progress. Flash again, or `tinyboot reset --bootloader`."
+             an update is in progress or no app is flashed. Flash an app."
             .into(),
         e => e.into(),
     }

cli/src/main.rs

@@ -96,7 +96,7 @@ where
             }) == stored;
         }
         // No CRC stored (virgin / debugger-flashed).
-        self.platform.app_present()
+        self.platform.storage.app_present()
     }
 
     #[inline(always)]

lib/core/src/core.rs

@@ -38,14 +38,4 @@ where
             ctl,
         }
     }
-
-    /// The app region's first word is programmed. Without a stored CRC
-    /// this is the only sign of an app: an erased chip reads all 0xFF.
-    #[inline(always)]
-    pub(crate) fn app_present(&self) -> bool {
-        let data = self.storage.as_slice();
-        // SAFETY: flash is word-aligned and the length is checked first.
-        data.len() >= 4
-            && unsafe { core::ptr::read_volatile(data.as_ptr() as *const u32) } != 0xFFFF_FFFF
-    }
 }

lib/core/src/platform.rs

@@ -332,7 +332,7 @@ impl<
             // chips that hand off by run mode, so a half-written image
             // would run and an erased app region would hang the chip.
             if !flags.contains(ResetFlags::BOOTLOADER)
-                && (state == BootState::Updating || !self.platform.app_present())
+                && (state == BootState::Updating || !self.platform.storage.app_present())
             {
                 self.frame.status = Status::Unsupported;
             } else {

lib/core/src/protocol.rs

@@ -53,6 +53,18 @@ pub trait Storage:
 {
     /// Zero-copy read access to the app region.
     fn as_slice(&self) -> &[u8];
+
+    /// The app region's first word is programmed. Without a stored CRC
+    /// this is the only sign of an app: an erased chip reads all 0xFF.
+    /// A platform that knows its region holds a word may skip the length
+    /// check.
+    #[inline(always)]
+    fn app_present(&self) -> bool {
+        let data = self.as_slice();
+        // SAFETY: flash is word-aligned and the length is checked first.
+        data.len() >= 4
+            && unsafe { core::ptr::read_volatile(data.as_ptr() as *const u32) } != 0xFFFF_FFFF
+    }
 }
 
 /// Boot control primitives.