refuse a reset to the app when no app is present

Author: aq1018

CHANGELOG.md

@@ -4,6 +4,12 @@ Releases up through `v0.4.0` were workspace-wide and tagged `vX.Y.Z`. From `0.4.
 
 ## [Unreleased]
 
+## [tinyboot-core 0.6.2] - 2026-10-20
+
+### Fixed
+
+- The bootloader refuses `Reset` to the app with `Unsupported` when the app region's first word is erased, as it does mid-update, and stays in the bootloader. A system-flash bootloader hands off by boot mode without checking the app, so a chip with no app flashed jumped into blank flash and hung until a power cycle.
+
 ## [tinyboot-protocol 0.5.1] - 2026-10-20
 
 ### Changed

ch32/Cargo.toml

@@ -52,7 +52,7 @@ repository = "https://github.com/OpenServoCore/tinyboot"
 license = "MIT OR Apache-2.0"
 
 [workspace.dependencies]
-tinyboot-core = { version = "0.6.1", path = "../lib/core", default-features = false }
+tinyboot-core = { version = "0.6.2", path = "../lib/core", default-features = false }
 tinyboot-ch32 = { version = "0.7.0", path = ".", default-features = false }
 embedded-hal = "1"
 embedded-io = "0.7"

docs/remote-updates.md

@@ -97,6 +97,7 @@ When all four hold, the bootloader hands off to the app. As soon as you run a re
 | App's `confirm()` never reaches due to bug | Same as above — trials run out, bootloader wins.                                         |
 | Host crashes mid-flash                     | Same as "power lost during erase or write" — safe, just re-flash.                        |
 | `Reset` to the app mid-flash               | Refused with `Unsupported`; the device stays in the bootloader. Re-flash.                |
+| `Reset` to the app with no app flashed     | Refused with `Unsupported`; the device stays in the bootloader. Flash an app.            |
 | Image built for another board              | Verify returns `Incompatible` (bootloader has a compatibility key); flash the right one. |
 
 ## Several devices on one bus

lib/core/Cargo.toml

@@ -1,7 +1,7 @@
 [package]
 name = "tinyboot-core"
 description = "Core bootloader library for tinyboot"
-version = "0.6.1"
+version = "0.6.2"
 edition.workspace = true
 repository.workspace = true
 license.workspace = true

lib/core/src/core.rs

@@ -95,11 +95,8 @@ where
                 self.platform.storage.as_slice().get_unchecked(..sz)
             }) == stored;
         }
-        // No CRC stored (virgin / debugger-flashed) — require at least one
-        // non-0xFF word to treat the app as present.
-        let data = self.platform.storage.as_slice();
-        data.len() >= 4
-            && unsafe { core::ptr::read_volatile(data.as_ptr() as *const u32) } != 0xFFFF_FFFF
+        // No CRC stored (virgin / debugger-flashed).
+        self.platform.app_present()
     }
 
     #[inline(always)]

lib/core/src/platform.rs

@@ -38,4 +38,14 @@ where
             ctl,
         }
     }
+
+    /// The app region's first word is programmed. Without a stored CRC
+    /// this is the only sign of an app: an erased chip reads all 0xFF.
+    #[inline(always)]
+    pub(crate) fn app_present(&self) -> bool {
+        let data = self.storage.as_slice();
+        // SAFETY: flash is word-aligned and the length is checked first.
+        data.len() >= 4
+            && unsafe { core::ptr::read_volatile(data.as_ptr() as *const u32) } != 0xFFFF_FFFF
+    }
 }

lib/core/src/protocol.rs

@@ -330,8 +330,10 @@ impl<
             let flags = unsafe { flags.reset };
             // A reset to the app skips the bootloader's META check on
             // chips that hand off by run mode, so a half-written image
-            // would run.
-            if state == BootState::Updating && !flags.contains(ResetFlags::BOOTLOADER) {
+            // would run and an erased app region would hang the chip.
+            if !flags.contains(ResetFlags::BOOTLOADER)
+                && (state == BootState::Updating || !self.platform.app_present())
+            {
                 self.frame.status = Status::Unsupported;
             } else {
                 self.cmd_reset(addr, flags);

lib/core/tests/state_transitions.rs

@@ -371,9 +371,15 @@ fn reset_without_baud_flag_keeps_baud() {
     assert_eq!(d.platform.boot_meta.baud_writes, 0);
 }
 
+/// Program the app region's first word, as any image or a debugger does.
+fn seed_app(p: &mut TestPlatform) {
+    p.storage.data[..4].copy_from_slice(&[1, 2, 3, 4]);
+}
+
 #[test]
 fn reset_to_app_refused_while_updating() {
     let mut p = platform(BootState::Updating);
+    seed_app(&mut p);
     let mut d = Dispatcher::<_, _, _, _, TEST_BUF_SIZE>::new(&mut p);
     d.platform.transport.load_request_flags(
         Cmd::Reset,
@@ -406,6 +412,7 @@ fn reset_to_bootloader_allowed_while_updating() {
 #[test]
 fn reset_to_app_allowed_while_validating() {
     let mut p = platform(BootState::Validating);
+    seed_app(&mut p);
     let mut d = Dispatcher::<_, _, _, _, TEST_BUF_SIZE>::new(&mut p);
     d.platform.transport.load_request_flags(
         Cmd::Reset,
@@ -418,6 +425,59 @@ fn reset_to_app_allowed_while_validating() {
     assert_eq!(d.frame.status, Status::Ok);
 }
 
+#[test]
+fn reset_to_app_refused_without_an_app() {
+    let mut p = platform(BootState::Idle);
+    let mut d = Dispatcher::<_, _, _, _, TEST_BUF_SIZE>::new(&mut p);
+    d.platform.transport.load_request_flags(
+        Cmd::Reset,
+        BaudRate::B9600 as u32,
+        reset_flags(ResetFlags::BAUD),
+        0,
+        &[],
+    );
+    take_events();
+    d.dispatch().unwrap();
+    assert_eq!(d.frame.status, Status::Unsupported);
+    assert_ne!(d.platform.transport.tx_pos, 0);
+    assert!(take_events().is_empty());
+}
+
+#[test]
+fn reset_to_app_allowed_with_an_app() {
+    let mut p = platform(BootState::Idle);
+    seed_app(&mut p);
+    let mut d = Dispatcher::<_, _, _, _, TEST_BUF_SIZE>::new(&mut p);
+    d.platform.transport.load_request_flags(
+        Cmd::Reset,
+        0,
+        reset_flags(ResetFlags::empty()),
+        0,
+        &[],
+    );
+    take_events();
+    dispatch_reset(&mut d);
+    assert_eq!(d.frame.status, Status::Ok);
+    assert_eq!(take_events(), ["HandOff", "reset"]);
+}
+
+#[test]
+fn reset_to_bootloader_allowed_without_an_app() {
+    let mut p = platform(BootState::Idle);
+    let mut d = Dispatcher::<_, _, _, _, TEST_BUF_SIZE>::new(&mut p);
+    d.platform.transport.load_request_flags(
+        Cmd::Reset,
+        0,
+        reset_flags(ResetFlags::BOOTLOADER),
+        0,
+        &[],
+    );
+    take_events();
+    dispatch_reset(&mut d);
+    assert_eq!(d.frame.status, Status::Ok);
+    assert_eq!(take_events(), ["Service", "reset"]);
+}
+
 #[test]
 fn erase_restarts_an_update() {
     let mut p = platform(BootState::Updating);

lib/protocol/README.md

@@ -58,7 +58,7 @@ Byte 3 of the address field carries per-command flags. Each command defines its
 | 0   | `BOOTLOADER` | Enter the bootloader (service mode) after reset                         |
 | 1   | `BAUD`       | Store addr byte 0 as the bootloader's `BaudRate` index before resetting |
 
-With no flag set, `Cmd::Reset` boots the app (hand-off mode). The bootloader refuses that with `Unsupported` while an update is in progress (META `Updating`), so a half-written image never runs; `BOOTLOADER` is always accepted.
+With no flag set, `Cmd::Reset` boots the app (hand-off mode). The bootloader refuses that with `Unsupported` while an update is in progress (META `Updating`), so a half-written image never runs, and when the app region's first word is erased, so a chip with no app does not jump into blank flash; `BOOTLOADER` is always accepted.
 
 ### `BaudRate`