build: generated presets and a check entry point

tools/make_presets.py emits the uniform pipeline the hand-grown file had
drifted from — generated configure/build/test presets and workflows for
all 37 chips, reflect configure/build for libavr's 12-chip spot set —
and tools/check.sh runs every chip's workflow (--full adds the reflect
spot) as the port's gate.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019553N6pLmaKhxEwkiCs3RX

.gitmodules

@@ -1,3 +0,0 @@
-[submodule "libavr"]
-	path = libavr
-	url = ../libavr.git

CMakeLists.txt

@@ -8,9 +8,6 @@ include(FetchContent)
 if(NOT LIBAVR_ROOT AND DEFINED ENV{LIBAVR_ROOT})
 	set(LIBAVR_ROOT $ENV{LIBAVR_ROOT})
 endif()
-if(NOT LIBAVR_ROOT)
-	set(LIBAVR_ROOT ${CMAKE_CURRENT_SOURCE_DIR}/libavr)
-endif()
 if(LIBAVR_ROOT)
 	FetchContent_Declare(libavr SOURCE_DIR ${LIBAVR_ROOT})
 else()
@@ -186,22 +183,6 @@ if(PROJECT_IS_TOP_LEVEL)
 		set_tests_properties(pureboot.reloc PROPERTIES TIMEOUT 180
 		                     ENVIRONMENT "PB_OBJCOPY=${CMAKE_OBJCOPY}")
 
-		# Entering the loader from a running application with no reset
-		# between, over a page buffer the application dirtied — the case the
-		# loader declines to guard and the host repairs. Hardware forbids the
-		# state here (SPM runs only from the boot section); simavr does not,
-		# which is what makes it constructible.
-		if(LIBAVR_MCU STREQUAL "atmega328p")
-			add_test(NAME pureboot.dirty
-			         COMMAND ${Python3_EXECUTABLE} ${CMAKE_CURRENT_SOURCE_DIR}/test/pbdirty.py
-			                 ${PB_DEVICE} $<TARGET_FILE:pureboot> ${PUREBOOT_SIM_MCU} ${_pb_stock_hz}
-			                 ${PUREBOOT_BASE_HEX} ${PUREBOOT_PAGE} ${_pb_stock_baud}
-			                 $<TARGET_FILE:pbapp>.bin
-			                 ${CMAKE_CURRENT_SOURCE_DIR}/pureboot/pureboot.py
-			                 ${CMAKE_BINARY_DIR}/pbdirty-work)
-			set_tests_properties(pureboot.dirty PROPERTIES TIMEOUT 180)
-		endif()
-
 		# Re-homing: a loader mistakenly programmed at address 0 (a raw .bin
 		# handed to a programmer) or sitting in the staging slot must heal
 		# into the canonical slot through the ordinary --update-loader flow.

CMakePresets.json

@@ -6,7 +6,7 @@
    "hidden": true,
    "generator": "Ninja",
    "binaryDir": "${sourceDir}/build/${presetName}",
-   "toolchainFile": "${sourceDir}/libavr/cmake/avr-toolchain.cmake",
+   "toolchainFile": "$env{LIBAVR_ROOT}/cmake/avr-toolchain.cmake",
    "cacheVariables": {
     "CMAKE_BUILD_TYPE": "Release",
     "CMAKE_EXPORT_COMPILE_COMMANDS": "ON",

pureboot/CMakeLists.txt

@@ -294,15 +294,6 @@ function(pureboot_add_loader name)
 	add_executable(${name} ${CMAKE_CURRENT_FUNCTION_LIST_DIR}/pureboot.cpp)
 	target_link_libraries(${name} PRIVATE libavr)
 	target_compile_definitions(${name} PRIVATE ${_defines})
-	# Codegen shaping for the loader TU only, worth ~40 B on every chip and
-	# what carries the far-flash 1284 build under 512. At -Os GCC otherwise
-	# rewrites the byte-stream loops' counters into end-pointer forms that
-	# cost registers (-fno-ivopts, -fno-split-wide-types), leaves register
-	# pressure on the table with the default allocator
-	# (-fira-algorithm=priority), and spends bytes on rewrites a
-	# straight-line loader gains nothing from.
-	target_compile_options(${name} PRIVATE
-	    -fno-ivopts -fira-algorithm=priority -fno-expensive-optimizations -fno-split-wide-types)
 	target_link_options(${name} PRIVATE -nostartfiles -Wl,--section-start=.text=${_base_hex}
 	                    -Wl,--defsym=pureboot_app=${_app} ${_wrap})
 	add_custom_command(TARGET ${name} POST_BUILD COMMAND ${CMAKE_SIZE} $<TARGET_FILE:${name}>)

pureboot/README.md

@@ -2,27 +2,19 @@
 
 A serial bootloader on [libavr](https://git.blackmark.me/avr/libavr), pure by
 constraint: one C++ source, no inline assembly, no global register variables
-(attributes and compiler flags allowed), built for **every chip libavr
-targets — all 37 — in 512 bytes each**: 434 B on the tiny13s, 438–442 B on
-the tiny25/45/85, 412–452 B across the megas, and 506 B on the
-ATmega1284/1284P, whose far-flash machinery (ELPM reads, RAMPZ page commands,
-word-addressed wire) is the heaviest. Those are the stock deployments;
-choosing the software UART where the chip has a USART costs 8–46 B more (a
-bit-bang against a peripheral), which every chip still absorbs inside its
-slot — on the 1284s that means their 1 KiB boot sector, where the
-software-serial image lands at 546 B. Bringing the 1284's default build
-under 512 at all is what the loop-placement attributes on the byte streamers
-(`pureboot.cpp`) and the codegen flags on the loader TU (`CMakeLists.txt`)
-are for; measured against each chip's own budget the tightest is the
-ATmega328P, 50 B spare. Clock, baud, serial backend and
-pins are per-build configuration (below); the size matrix in the test suite
-holds every combination inside its slot. The device speaks primitives; every
-composite — verify, erase, reset-vector surgery, updating the loader itself —
-lives in the host tool (`pureboot.py`).
-
-The 1284s still *deploy* in a 1 KiB slot, their smallest boot sector being
-512 words; at 506 B the image would also fit the 644's
-two-512-byte-slots-per-boot-sector geometry.
+(attributes allowed), built for **every chip libavr targets — all 37 —
+fitting each chip's smallest boot sector**: 512 bytes everywhere — 470 B on
+the tiny13s, ~484 B on the tiny25/45/85, 458–506 B across the megas and
+every configured variant of them (the m8's software-serial build is the
+fattest) — except the ATmega1284/1284P, whose smallest boot sector is 1 KiB
+and whose far-flash machinery (ELPM reads, RAMPZ page commands,
+word-addressed wire) lands at 556–562 B in a 1 KiB slot: the 512-byte
+figure is a hardware boundary those chips simply do not have, and no
+implementation of this feature set fits it there. Clock, baud, serial
+backend and pins are per-build configuration (below); the size matrix in
+the test suite holds every combination inside its slot. The device speaks
+primitives; every composite — verify, erase, reset-vector surgery, updating
+the loader itself — lives in the host tool (`pureboot.py`).
 
 The image is **position-independent**: control flow is PC-relative, the
 read/write paths take wire addresses, the write guard protects the slot the
@@ -141,20 +133,7 @@ byte-addressed). EEPROM addresses are always bytes, counts always bytes.
 then erases and programs; the address must be page-aligned. Pages inside the
 512-byte slot the loader is *running* in are drained but never programmed — a
 broken host cannot brick the running copy, and a staged copy may rewrite the
-resident slot.
-
-The loader never clears the SPM buffer before a fill, so **one `W` may
-program the wrong bytes, and the host is what fixes it**. The buffer is
-write-once per word until cleared, and two things leave words in it: a
-refused page (drained, never programmed) and — where SPM runs from anywhere,
-the tinies and the m48s — an application that self-programmed before
-entering. The next `W` takes those stale words, and clears them: a page write
-auto-erases the buffer (§26.2.1; §19.2 on the tinies), so repeating it
-programs correctly. The host therefore verifies every page it writes and
-rewrites what comes back wrong (three retries, then it stops); a host that
-programs without reading back cannot trust the first `W` after either event.
-
-`w` is host-paced: send the next byte only after the previous
+resident slot. `w` is host-paced: send the next byte only after the previous
 byte's `+`. `F` returns the bytes in the hardware's Z order; on a chip
 without an extended fuse byte (the ATtiny13A) that slot carries no meaning.
 Fuse *writing* does not exist: SPM reaches flash (and, on the mega, lock
@@ -170,7 +149,7 @@ The info block (`b`):
 
 | Offset | Content |
 |---|---|
-| 0–2 | `'P'`, `'B'`, pureboot version (2) |
+| 0–2 | `'P'`, `'B'`, protocol version (1) |
 | 3–5 | device signature |
 | 6 | SPM page size in bytes (0 means 256) |
 | 7–8 | loader base — application flash ends here (a word address when bit 1 is set) |
@@ -180,21 +159,6 @@ The info block (`b`):
 Composites are the host's job: verify = read back and compare, erase =
 write `0xff` (per page for flash, per byte for EEPROM).
 
-## Version
-
-The third byte of the info block is the **pureboot version** — the loader's
-one identity number, and the only way to tell what a deployed loader is.
-Nothing else is numbered: the wire protocol has no version of its own, a
-pureboot version implies its protocol, and the host tool is what holds that
-map. It states the window of loader versions it speaks
-(`OLDEST_LOADER`/`NEWEST_LOADER` in `pureboot.py`); a version that changes
-the protocol becomes the new floor there. So far none has: pureboot 1 and 2
-speak the identical session, and a loader newer than the tool is refused by
-name rather than decoded on the assumption that nothing moved.
-
-The tool carries its own version, free to drift from the loader's:
-`--version` prints both it and the window.
-
 ## Deployment
 
 The build leaves three artifacts per chip. The ELF is a container for the
@@ -260,7 +224,7 @@ BOOTRST does not exist there.
 ## Updating the loader
 
 `pureboot.py --update-loader new_pureboot.bin` replaces the resident loader
-with any pureboot build — a re-timed window, a newer version — using the
+with any pureboot build — a re-timed window, a newer protocol — using the
 loader itself as its own staging loader. The image is the loader's own 512
 bytes as a raw binary, or the Intel HEX the build emits beside it, which
 links the loader at its base inside an otherwise blank flash image:
@@ -319,20 +283,16 @@ update, flash (erase / program / read / verify), EEPROM (erase / program /
 read / verify) — then the loader hands over to the application; `--stay`
 keeps the session alive instead, and a later invocation reconnects into it
 (the knock converges there too). `--flash` and `--eeprom` verify by
-read-back unless `--no-verify`, and a flash page that reads back wrong is
-rewritten up to three times before the run stops — the loader leaves one
-recoverable way for a page to land wrong (see `W` above), and rewriting is
-what clears it. `--verify-flash` only reports. Images are raw binary, or
-Intel HEX by extension. `--force` overrides the refusable safety checks (today: flashing
+read-back unless `--no-verify`; images are raw binary, or Intel HEX by
+extension. `--force` overrides the refusable safety checks (today: flashing
 application data into a mega's reset walk region).
 
 Readouts come one fact per line: `--info` prints the decoded info block
-field by field, the loader's version first; `--fuses` each fuse byte on its
-own line — plus, on a boot-sectioned mega, the decoded meaning (where the
-BOOTSZ section starts, what BOOTRST does to reset). Transfers that take
-wire time — programming, reading, erasing, verifying, the update phases —
-draw a transient progress bar on stderr when it is a tty; logs and pipes
-see only the summary lines.
+field by field, `--fuses` each fuse byte on its own line — plus, on a
+boot-sectioned mega, the decoded meaning (where the BOOTSZ section starts,
+what BOOTRST does to reset). Transfers that take wire time — programming,
+reading, erasing, verifying, the update phases — draw a transient progress
+bar on stderr when it is a tty; logs and pipes see only the summary lines.
 `-v`/`--verbose` adds the decisions as they happen: knock counts, the
 programming plan (vector-surgery targets, skipped blank pages), update
 state handling and per-phase page counts.
@@ -360,10 +320,8 @@ regenerates the presets). Per chip preset, `ctest` runs:
   in the image, the info block within its first 256 bytes;
 - `pureboot.planner` — the host tool's pure logic: programming orders and
   their recovery properties, the surgery, the staging composition, the
-  boot-fuse decode, the update preflight's error/warning matrix over
-  synthetic fuse bytes, and the repairing verify against a fake device — one
-  bad write repaired in a single rewrite, a page that never comes good
-  stopping after exactly three;
+  boot-fuse decode, and the update preflight's error/warning matrix over
+  synthetic fuse bytes;
 - `pureboot.protocol` — end to end against a simavr device
   (`test/pureboot_device.c` — a hardware USART as a pty, or a cycle-timed
   GPIO⇄pty bridge for a software-UART build, selected with `-l` to match
@@ -377,14 +335,6 @@ regenerates the presets). Per chip preset, `ctest` runs:
 - `pureboot.reloc` — the identical image installed one slot below the
   resident serves the complete command set from there (the
   position-independence acceptance test);
-- `pureboot.dirty` (328P) — entering the loader from a running application
-  with no reset between, over an SPM page buffer the fixture deliberately
-  dirtied: the case the loader declines to guard against. A bare verify must
-  see the corruption, the repairing verify must fix it in one rewrite, and a
-  plain verify afterwards must pass. On the boot-sectioned megas hardware
-  forbids the state outright (SPM runs only from the boot section, and reset
-  erases the buffer), but simavr dispatches SPM from anywhere — which is what
-  makes the path constructible at all;
 - `pureboot.update` — the full `--update-loader` flow to a re-timed build,
   then every power-fail phase: the device is killed mid-write, restarted
   from its flash dump, and a re-run must complete the update with the

pureboot/pureboot.cpp

@@ -67,11 +67,13 @@ consteval std::int16_t wdrf_field()
 // without a hardware boot section — the tinies and the m48s, whose SPM
 // runs from anywhere (Atmel-8271 §26). A boot section also means the CPU
 // runs on while the RWW section programs; everywhere else it halts through
-// the operation.
+// the operation. The m48s still carry RWWSRE as their temporary-buffer
+// discard (§26.2), so the discard picks by that bit, not by the section.
 constexpr std::uint16_t slot_bytes = spm::flash_bytes > 65536 ? 1024 : 512;
 constexpr std::uint32_t base = spm::flash_bytes - slot_bytes;
 constexpr std::uint16_t page = spm::page_bytes;
 constexpr bool boot_section = avr::hw::curated::has_boot_section();
+constexpr bool rww_discard = spm::detail::has_rww();
 
 // Past 64 KiB a byte address no longer fits the wire's 16 bits, so on the
 // large chips every flash address on the wire — and all slot arithmetic —
@@ -92,20 +94,14 @@ constexpr std::uint16_t wire_page_mask = word_flash ? (page / 2 - 1) : (page - 1
 #endif
 constexpr std::uint8_t timeout_seconds = PUREBOOT_TIMEOUT;
 
-// The pureboot version: the loader's one identity number, carried in the info
-// block so a host can tell a deployed loader apart from another. The wire
-// protocol has no number of its own — a version implies its protocol, and the
-// host tool is what holds that map (README.md).
-constexpr std::uint8_t version = 2;
-
-// The 12-byte info block the host reads with the 'b' command, flash-resident
-// through flash_table (there is no crt to copy a .data image, and its storage
-// carries the word alignment 'b' needs to halve the address on the large
-// chips). The page byte is the wire count convention: 0 means 256.
-inline constexpr avr::flash_table<std::array<std::uint8_t, 12>{
+// The 12-byte info block the host reads with the 'b' command; flash-resident
+// (there is no crt to copy a .data image), word-aligned so its wire (word)
+// address is exact on the large chips. The page byte is the wire count
+// convention: 0 means 256.
+[[gnu::progmem]] alignas(2) inline constexpr std::array<std::uint8_t, 12> info_data = {
     'P',
     'B',
-    version, // magic, then the loader's version
+    1, // magic, protocol version
     avr::hw::db.signature[0],
     avr::hw::db.signature[1],
     avr::hw::db.signature[2],
@@ -117,8 +113,7 @@ inline constexpr avr::flash_table<std::array<std::uint8_t, 12>{
     // bit 0: host must patch the reset vector (no hardware boot section);
     // bit 1: flash wire addresses are word addresses
     static_cast<std::uint8_t>((boot_section ? 0 : 1) | (word_flash ? 2 : 0)),
-}>
-    info_data;
+};
 
 // The serial link. PUREBOOT_USART forces a hardware USART instance,
 // PUREBOOT_SOFT_SERIAL the polled software UART (no vector — the table
@@ -144,6 +139,16 @@ constexpr char usart_digit = '0' + PUREBOOT_USART;
 constexpr char usart_digit = '0';
 #endif
 
+// Whether the chip carries the selected USART: the suffixed instance name,
+// or — for instance 0 — the classic megas' un-numbered block.
+consteval bool usart_exists()
+{
+	const char name[] = {'U', 'S', 'A', 'R', 'T', usart_digit};
+	if (avr::hw::db.has_instance(std::string_view{name, sizeof(name)}))
+		return true;
+	return usart_digit == '0' && avr::hw::db.has_instance("USART");
+}
+
 template <avr::hertz_t C>
 struct hardware_link {
 	using uart = avr::uart::usart<usart_digit, C, {.baud = wire_baud, .max_baud_error = 2.5_pct}>;
@@ -214,13 +219,12 @@ struct software_link {
 };
 
 #if defined(PUREBOOT_USART)
-static_assert(avr::uart::has_usart<usart_digit>(), "PUREBOOT_USART selects a hardware USART this chip does not have");
+static_assert(usart_exists(), "PUREBOOT_USART selects a hardware USART this chip does not have");
 using link = hardware_link<dev::clock>;
 #elif defined(PUREBOOT_SOFT_SERIAL)
 using link = software_link<dev::clock>;
 #else
-using link =
-    std::conditional_t<avr::uart::has_usart<usart_digit>(), hardware_link<dev::clock>, software_link<dev::clock>>;
+using link = std::conditional_t<usart_exists(), hardware_link<dev::clock>, software_link<dev::clock>>;
 #endif
 
 // The application's entry, an absolute address the linker pins (--defsym in
@@ -270,51 +274,36 @@ std::uint8_t rx_deadline()
 	return link::rx();
 }
 
-// Inlined into its call sites: reading two bytes across a call otherwise
-// strands the first in a call-saved register the caller must push/pop; folded
-// into the (noreturn) command loop that cost disappears.
-[[gnu::always_inline]] inline std::uint16_t rx16()
+std::uint16_t rx16()
 {
 	std::uint16_t low = link::rx();
 	return static_cast<std::uint16_t>(low | (link::rx() << 8));
 }
 
 // The streamers take the count in the wire's 8-bit form: 0 means 256.
-//
-// Two functions, because they want opposite placement and placement is an
-// attribute: the byte-addressed loop is small enough to inline into both
-// callers, the word-addressed one stays out of line but flattened — a call to
-// the transmit inside it would strand the 24-bit cursor in callee-saved
-// registers. `word_flash` picks at the call site.
-[[maybe_unused, gnu::always_inline]] inline void send_flash_near(std::uint16_t address, std::uint8_t count)
+// send_flash stays out of line: its two callers ('b' and 'R') otherwise each
+// inline a private copy of the loop. On the large chips the address is a
+// word address and the read goes through ELPM (flash_load_far).
+[[gnu::noinline]] void send_flash(std::uint16_t address, std::uint8_t count)
 {
-	do
-		link::tx(avr::flash_load(reinterpret_cast<const std::uint8_t *>(address++)));
-	while (--count);
-}
-
-// The 24-bit cursor as the machine holds it: the RAMPZ byte and a 16-bit Z,
-// carried explicitly (the reassembled 32-bit address folds away inside the
-// inlined far load).
-[[maybe_unused, gnu::flatten, gnu::noinline]] void send_flash_far(std::uint16_t address, std::uint8_t count)
-{
-	std::uint8_t rampz = static_cast<std::uint8_t>(address >> 15);
-	std::uint16_t z = static_cast<std::uint16_t>(address << 1);
-	do {
-		link::tx(avr::flash_load_far<std::uint8_t>((static_cast<std::uint32_t>(rampz) << 16) | z));
-		// The protocol never reads across 64 KiB, but carrying the wrap is
-		// smaller than the flat 32-bit cursor GCC builds without it.
-		if (++z == 0)
-			++rampz;
-	} while (--count);
-}
-
-[[gnu::always_inline]] inline void send_flash(std::uint16_t address, std::uint8_t count)
-{
-	if constexpr (word_flash)
-		send_flash_far(address, count);
-	else
-		send_flash_near(address, count);
+	if constexpr (word_flash) {
+		// The 24-bit cursor as the machine holds it: the RAMPZ byte and a
+		// 16-bit Z, carried explicitly (the reassembled 32-bit address
+		// folds away inside the inlined far load). A single read never
+		// crosses a 64 KiB boundary — the protocol forbids it and the host
+		// splits its chunks there — so RAMPZ holds for the whole run.
+		std::uint8_t rampz = static_cast<std::uint8_t>(address >> 15);
+		std::uint16_t z = static_cast<std::uint16_t>(address << 1);
+		do {
+			link::tx(avr::flash_load_far<std::uint8_t>((static_cast<std::uint32_t>(rampz) << 16) | z));
+			if (++z == 0)
+				++rampz; // robustness for a host that reads across 64 KiB
+		} while (--count);
+	} else {
+		do
+			link::tx(avr::flash_load(reinterpret_cast<const std::uint8_t *>(address++)));
+		while (--count);
+	}
 }
 
 void send_eeprom(std::uint16_t address, std::uint8_t count)
@@ -342,15 +331,19 @@ void store_eeprom(std::uint16_t address, std::uint8_t count)
 // itself. `slot_high` is the high byte of that running slot's base (run()
 // derives it); a broken host thus cannot brick the running loader, and a
 // copy flashed one slot lower may rewrite the slot above it — how pureboot
-// updates itself.
+// updates itself. On the mega the RWW section is re-enabled so reads work
+// immediately.
 void program_flash(std::uint16_t wire_address, std::uint8_t slot_high)
 {
-	// No discard before the fill: the buffer is write-once per word
-	// (§26.2.1), so filling over one a refused page or an application left
-	// dirty programs stale words — but a page write auto-erases the buffer
-	// (§26.2.1; §19.2 on the tinies), so that write clears the condition and
-	// the host's read-back rewrites the page.
-
+	// A buffer word cannot be loaded twice without an erase (§26.2.1), so a
+	// refused page's drained data must not linger for the next write:
+	// discard the buffer up front — CTPB on the tinies; on the megas
+	// writing RWWSRE aborts a pending load (§26.2.2 — on the m48s that
+	// flush is the bit's whole documented job).
+	if constexpr (rww_discard)
+		spm::rww_enable<off>();
+	else
+		spm::clear_buffer<off>();
 	// One induction either way. On the byte-addressed chips the wire address
 	// itself walks the page (aligned, so the offset bits wrap to zero); on
 	// the word-addressed large chips the wire word address becomes a 32-bit
@@ -396,14 +389,11 @@ void program_flash(std::uint16_t wire_address, std::uint8_t slot_high)
 		if constexpr (boot_section)
 			spm::wait();
 		spm::write_page<off>(address);
-		if constexpr (boot_section)
+		if constexpr (boot_section) {
 			spm::wait();
+			spm::rww_enable<off>();
+		}
 	}
-	// The megas program with their RWW section disabled; reads need it back
-	// on. The same store discards the buffer (§26.2.2), so they never meet
-	// the stale-word case above. boot_section implies an RWW section.
-	if constexpr (boot_section)
-		spm::rww_enable<off>();
 }
 
 // The four fuse/lock bytes in the hardware's own Z order: low, lock,
@@ -459,7 +449,7 @@ void send_fuses()
 			// runtime address is the running slot's. Composed from the two
 			// bytes — the high half is runtime data, so no absolute address
 			// is ever materialized.
-			const auto link_low = reinterpret_cast<std::uint16_t>(info_data.storage.data());
+			const auto link_low = reinterpret_cast<std::uint16_t>(info_data.data());
 			const std::uint8_t low =
 			    word_flash ? static_cast<std::uint8_t>(link_low >> 1) : static_cast<std::uint8_t>(link_low);
 			send_flash(static_cast<std::uint16_t>(low | (slot_high << 8)), static_cast<std::uint8_t>(info_data.size()));

pureboot/pureboot.py

@@ -35,16 +35,8 @@ else:
     import termios
 
 PROMPT = b"+"
-VERSION = 2  # this tool's own version — free to drift from a loader's
-# The loader versions this tool speaks to. A pureboot version implies its wire
-# protocol — the protocol carries no number of its own — so knowing which
-# versions speak what is the tool's job, and this window is where it says so:
-# every pureboot so far speaks this protocol, and a version that changes it
-# becomes the new floor here.
-OLDEST_LOADER = 1
-NEWEST_LOADER = 2
+PROTOCOL_VERSION = 1
 SLOT = 512  # the loader slot on byte-addressed chips; word-addressed ones (>64 KiB) use 1 KiB — their own smallest boot sector
-RETRIES = 3  # rewrites of a page that reads back wrong, before the run stops
 
 VERBOSE = False
 
@@ -320,12 +312,8 @@ class Info:
     def __init__(self, raw):
         if len(raw) != 12 or raw[0:2] != b"PB":
             raise Error(f"bad info block: {raw.hex()}")
-        self.version = raw[2]
-        if not OLDEST_LOADER <= self.version <= NEWEST_LOADER:
-            raise Error(
-                f"pureboot {self.version}: this tool (version {VERSION}) speaks pureboot "
-                f"{OLDEST_LOADER}..{NEWEST_LOADER} — a newer loader needs a newer tool"
-            )
+        if raw[2] != PROTOCOL_VERSION:
+            raise Error(f"protocol version {raw[2]}, tool speaks {PROTOCOL_VERSION}")
         self.raw = bytes(raw)
         self.signature = raw[3:6]
         self.page = raw[6] or 256  # the wire count convention: 0 means 256
@@ -360,7 +348,6 @@ class Info:
         else:
             hand_over = "hardware boot section, jump to word 0"
         return (
-            f"version      pureboot {self.version}",
             f"signature    {' '.join(f'{b:02x}' for b in self.signature)}",
             f"flash        {self.flash_size} B, {self.page} B pages"
             + (", word-addressed wire" if self.word_flash else ""),
@@ -650,15 +637,9 @@ def mega_boot(info, fuse_bytes):
 
 
 def image_info(image):
-    """The info block embedded in a pureboot binary, or None. Searched per
-    known loader version, so the magic stays three selective bytes rather than
-    two that code could carry by chance — and a binary this tool does not know
-    the version of reads as no block at all, which is what it is to the tool."""
-    for version in range(OLDEST_LOADER, NEWEST_LOADER + 1):
-        at = image.find(b"PB" + bytes((version,)))
-        if 0 <= at <= len(image) - 12:
-            return Info(image[at : at + 12])
-    return None
+    """The info block embedded in a pureboot binary, or None."""
+    at = image.find(b"PB" + bytes((PROTOCOL_VERSION,)))
+    return Info(image[at : at + 12]) if 0 <= at <= len(image) - 12 else None
 
 
 def loader_image(path):
@@ -695,10 +676,7 @@ def update_preflight(image, info, fuse_bytes):
     """Errors and warnings before any flash is touched. Returns warnings."""
     embedded = image_info(image)
     if embedded is None:
-        raise Error(
-            "no pureboot info block in the update image — not a pureboot binary, "
-            f"or a version this tool ({VERSION}) does not know"
-        )
+        raise Error("no pureboot info block in the update image — not a pureboot binary?")
     if embedded.raw[3:] != info.raw[3:]:
         raise Error(
             f"update image is for another target: it declares "
@@ -789,26 +767,9 @@ def write_differing(loader, base, content, order=None, label=None):
             bar.step()
     if label:
         verbose(f"{label}: {written} of {len(offsets)} pages differed")
-    # Page-wise read-back with the same bounded repair as verify_pages: this
-    # is the loader-update path, where a page left wrong is a half-written
-    # loader slot.
-    for retry in range(RETRIES + 1):
-        bad = [
-            offset
-            for offset in range(0, len(content), page)
-            if loader.read_flash(base + offset, len(content[offset : offset + page])) != content[offset : offset + page]
-        ]
-        if not bad:
-            break
-        if retry == RETRIES:
-            raise Error(
-                f"verify failed at {base + bad[0]:#06x} after programming "
-                f"(still wrong after {RETRIES} retries)"
-            )
-        for offset in bad:
-            verbose(f"rewriting page {base + offset:#06x} (retry {retry + 1})")
-            loader.write_page(base + offset, content[offset : offset + page])
-            written += 1
+    for at in range(0, len(content), 256):
+        if loader.read_flash(base + at, min(256, len(content) - at)) != content[at : at + 256]:
+            raise Error(f"verify failed at {base + at:#06x} after programming")
     return written
 
 
@@ -832,8 +793,6 @@ def op_update_loader(loader, wait, path, state_path, fuse_bytes):
     image = loader_image(path)
     for warning in update_preflight(image, info, fuse_bytes):
         print(f"note: {warning}")
-    update = image_info(image)  # the preflight proved it is there
-    verbose(f"installing pureboot {update.version} over pureboot {info.version}")
     staged = staging_content(image, info)
     resident = bytes(image) + bytes([0xFF] * (info.slot - len(image)))
     page = info.page
@@ -900,7 +859,7 @@ def op_update_loader(loader, wait, path, state_path, fuse_bytes):
     write_differing(loader, info.stage, state.staging, order, label="staging restore")
 
     state.discard()
-    print(f"loader updated: pureboot {update.version}, {len(image)} B at {info.base:#06x}, staging region restored")
+    print(f"loader updated: {len(image)} B at {info.base:#06x}, staging region restored")
 
 
 def check_walk_region(pages, info, fuse_bytes, force):
@@ -961,37 +920,21 @@ def op_flash(loader, path, erase, verify, fuse_bytes=None, force=False):
             bar.step()
     print(f"flash: {path}: {len(order)} pages")
     if verify:
-        verify_pages(loader, pages, repair=True)
+        verify_pages(loader, pages)
 
 
-def verify_pages(loader, pages, repair=False):
-    """Read every page back and compare. With `repair`, a mismatched page is
-    rewritten and re-read, up to RETRIES times before it is raised: a page
-    filled over a dirty SPM buffer takes stale words, and the write that took
-    them cleared the buffer, so one rewrite settles it. Anything still wrong
-    after three is not that, and stops the run."""
-    repaired = 0
+def verify_pages(loader, pages):
     with Progress("verify", len(pages)) as bar:
         for address in sorted(pages):
-            for retry in range(RETRIES + 1):
-                got = loader.read_flash(address, loader.info.page)
-                if got == pages[address]:
-                    break
+            got = loader.read_flash(address, loader.info.page)
+            if got != pages[address]:
                 first = next(i for i in range(len(got)) if got[i] != pages[address][i])
-                detail = (
+                raise Error(
                     f"verify failed at {address + first:#06x}: "
                     f"wrote {pages[address][first]:02x}, read {got[first]:02x}"
                 )
-                if not repair:
-                    raise Error(detail)
-                if retry == RETRIES:
-                    raise Error(f"{detail} (still wrong after {RETRIES} retries)")
-                verbose(f"{detail} — rewriting page {address:#06x} (retry {retry + 1})")
-                loader.write_page(address, pages[address])
-                repaired += 1
             bar.step()
-    note = f", {repaired} page rewrite(s)" if repaired else ""
-    print(f"verify: {len(pages)} pages ok{note}")
+    print(f"verify: {len(pages)} pages ok")
 
 
 def op_verify_flash(loader, path):
@@ -1075,8 +1018,6 @@ def main():
     parser = argparse.ArgumentParser(
         description="pureboot host tool", epilog="operations run in the order listed above"
     )
-    parser.add_argument("--version", action="version", version=f"%(prog)s {VERSION} "
-                        f"(speaks pureboot {OLDEST_LOADER}..{NEWEST_LOADER})")
     parser.add_argument("--port", required=True, help="serial device: COM6, /dev/ttyUSB0, or a simavr pty")
     parser.add_argument("--baud", type=int, default=115200, help="115200 mega, 57600 tinies")
     parser.add_argument("--wait", type=float, default=30.0, help="seconds to keep knocking")

test/check_pi.py

@@ -37,12 +37,11 @@ def main():
         sys.exit(1)
 
     symbols = subprocess.run([nm, "-C", elf], capture_output=True, text=True, check=True).stdout
-    info = [line for line in symbols.splitlines() if "flash_table" in line and "::storage" in line]
+    info = [line for line in symbols.splitlines() if "info_data" in line]
     if len(info) != 1:
         print(f"FAIL: expected one info-block storage symbol, found {len(info)}")
         sys.exit(1)
-    address = int(info[0].split()[0], 16)
-    offset = address - text_start
+    offset = int(info[0].split()[0], 16) - text_start
     if not 0 <= offset < 256:
         print(f"FAIL: info block at image offset {offset:#x}, must sit in the first 256 bytes")
         sys.exit(1)

test/pbapp.cpp

@@ -69,18 +69,9 @@ struct link {
 		// 'L' hands back to the loader at the top slot — 512 bytes, or the
 		// 1 KiB the >64 KiB chips use.
 		constexpr std::uint32_t slot = avr::hw::db.mem.flash_size > 65536 ? 1024 : 512;
-		for (;;) {
-			auto command = tx_t::read_blocking();
-			if (command == 'L')
+		for (;;)
+			if (tx_t::read_blocking() == 'L')
 				reinterpret_cast<void (*)()>(static_cast<std::uint16_t>((avr::hw::db.mem.flash_size - slot) / 2))();
-			// 'D' leaves every word of the SPM page buffer dirty, so that a
-			// following 'L' enters the loader with the buffer it never clears.
-			if (command == 'D') {
-				for (std::uint16_t at = 0; at < avr::spm::page_bytes; at += 2)
-					avr::spm::fill(at, 0xdead);
-				tx('D');
-			}
-		}
 	}
 };
 

test/pbdirty.py

@@ -1,90 +0,0 @@
-#!/usr/bin/env python3
-"""Dirty-page-buffer acceptance test: the loader carries no buffer discard,
-so a page filled over words an earlier writer left behind programs those
-instead. This asserts the whole contract — the corruption is real and a bare
-verify sees it, the repairing verify fixes it in one rewrite (the write that
-took the stale words auto-erased the buffer), and it stays fixed.
-
-The state is reached the way the loader cannot prevent: an application
-dirties the buffer and jumps in with no reset between. Real boot-sectioned
-megas forbid that outright — SPM executes only from the boot section
-(Atmel-8271 §26.2) — but simavr dispatches SPM from anywhere, which is what
-makes the path constructible at all.
-
-Usage: pbdirty.py <device_bin> <pureboot_elf> <mcu> <hz> <base_hex> <page>
-                  <baud> <app_bin> <tool_py> <workdir>
-"""
-
-import os
-import sys
-
-
-def fail(message):
-    print(f"FAIL: {message}")
-    sys.exit(1)
-
-
-def main():
-    device_bin, elf, mcu, hz, base_hex, page, baud, app_bin, tool, workdir = sys.argv[1:]
-    page, baud = int(page), int(baud)
-    sys.path.insert(0, os.path.dirname(os.path.abspath(tool)))
-    sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
-    import pbsim
-    import pureboot as pb
-
-    os.makedirs(workdir, exist_ok=True)
-    dump = os.path.join(workdir, "dump.bin")
-
-    # Reset boots the application on a BOOTRST-unprogrammed mega; its 'L' is
-    # the loader entry this test needs, reached without a reset.
-    device = pbsim.Device(device_bin, elf, mcu, hz, base_hex, page, baud, dump, reset_hex="0")
-    try:
-        port = pb.Port(device.pty, baud)
-        loader = pb.Loader(port)
-        loader.connect(25)
-
-        # Install the application and hand over to it.
-        pb.op_flash(loader, app_bin, erase=False, verify=True)
-        loader.run_application()
-        if port.read_exact(3, 5.0) != b"APP":
-            fail("the application did not start")
-
-        port.write(b"D")
-        if port.read_exact(1, 5.0) != b"D":
-            fail("the application did not acknowledge dirtying the page buffer")
-        port.write(b"L")
-        loader = pb.Loader(port)
-        loader.connect(25)
-
-        # Program by hand, so the corruption is observable before anything
-        # repairs it.
-        pages = pb.plan_flash(open(app_bin, "rb").read(), loader.info)
-        for address in sorted(pages):
-            loader.write_page(address, pages[address])
-        try:
-            pb.verify_pages(loader, pages)
-        except pb.Error as error:
-            if "verify failed" not in str(error):
-                fail(f"the read-back failed, but not at verify: {error}")
-        else:
-            # Either the fixture no longer dirties the buffer, or the loader
-            # clears it again — in which case this test's premise is gone.
-            fail("programming over a dirty page buffer came back clean")
-
-        # What the programming path uses: one rewrite settles it, and it stays
-        # settled.
-        pb.verify_pages(loader, pages, repair=True)
-        pb.verify_pages(loader, pages)
-
-        # Ground truth beyond the loader's own read-back.
-        loader.run_application()
-        if port.read_exact(3, 5.0) != b"APP":
-            fail("the application did not start after the recovered write")
-        port.close()
-    finally:
-        device.stop()
-    print("pbdirty: a dirty page buffer is caught by verify and cleared by the retry")
-
-
-if __name__ == "__main__":
-    main()

test/pbreloc.py

@@ -66,10 +66,8 @@ def main():
         if loader.read_eeprom(0, len(pattern)) != pattern:
             fail("EEPROM round-trip through the staged copy")
 
-        # The guard, both ways: its own slot refused (drained, unchanged), the
-        # resident slot writable. The refusal leaves its drained words in the
-        # SPM buffer, so the write that follows may take them — and clears
-        # them by writing, so the retry must not.
+        # The guard, both ways: its own slot refused (drained, unchanged),
+        # the resident slot writable.
         before = loader.read_flash(stage, page)
         loader.write_page(stage, bytes(page))
         if loader.read_flash(stage, page) != before:
@@ -77,9 +75,7 @@ def main():
         marker = bytes((i * 3) & 0xFF for i in range(page))
         loader.write_page(base, marker)
         if loader.read_flash(base, page) != marker:
-            loader.write_page(base, marker)
-            if loader.read_flash(base, page) != marker:
-                fail("the staged copy could not write the resident slot, even on retry")
+            fail("the staged copy could not write the resident slot")
 
         # Restore the resident image through the staged copy, then 'J' back
         # into it and prove it lives.

test/pbtest.py

@@ -61,7 +61,7 @@ def main():
     wire_base = base // 2 if word_flash else base
     flags = (1 if patch else 0) | (2 if word_flash else 0)
     info = pb.Info(
-        bytes([ord("P"), ord("B"), pb.NEWEST_LOADER, 0, 0, 0, page & 0xFF])
+        bytes([ord("P"), ord("B"), 1, 0, 0, 0, page & 0xFF])
         + bytes([wire_base & 0xFF, wire_base >> 8, eeprom_size & 0xFF, eeprom_size >> 8])
         + bytes([flags])
     )
@@ -71,7 +71,7 @@ def main():
         # Session 1: knock from reset, identify, program everything, stay.
         out = pbsim.run_tool(tool, device.pty, baud, "--info", "--fuses", "--flash", app_bin,
                              "--eeprom", ee_path, "--stay")
-        for needed in ("version", "signature", "fuses", "verify:", "stays"):
+        for needed in ("signature", "fuses", "verify:", "stays"):
             if needed not in out:
                 fail(f"session 1 output lacks {needed!r}")
 
@@ -101,12 +101,7 @@ def main():
         port = pb.Port(device.pty, baud)
         try:
             loader = pb.Loader(port)
-            live = loader.connect(15)
-            # The loader built from this tree and the tool beside it must
-            # agree on where the version numbering stands: a bump the tool
-            # was never told about is a loader it would refuse to speak to.
-            if live.version != pb.NEWEST_LOADER:
-                fail(f"loader reports pureboot {live.version}, the tool's newest is {pb.NEWEST_LOADER}")
+            loader.connect(15)
             loader.run_application()
             banner = port.read_exact(3, 5.0)
             if banner != b"APP":

test/test_planner.py

@@ -27,12 +27,12 @@ def expect_error(what, fn, *needles):
     fail(f"{what}: no error raised")
 
 
-def info_of(pb, base, page, patch, flash, signature=(0x1E, 0x93, 0x0B), word_flash=False, version=None):
+def info_of(pb, base, page, patch, flash, signature=(0x1E, 0x93, 0x0B), word_flash=False):
     scale = 2 if word_flash else 1
     wire_base = base // scale
     flags = (1 if patch else 0) | (2 if word_flash else 0)
-    raw = bytes((0x50, 0x42, pb.NEWEST_LOADER if version is None else version,
-                 *signature, page & 0xFF, wire_base & 0xFF, wire_base >> 8, 0, 2, flags))
+    raw = bytes((0x50, 0x42, 1, *signature, page & 0xFF, wire_base & 0xFF, wire_base >> 8,
+                 0, 2, flags))
     info = pb.Info(raw)
     assert info.flash_size == flash
     return info
@@ -55,21 +55,6 @@ def main():
     tiny = info_of(pb, 0x1E00, 64, True, 0x2000)
     mega = info_of(pb, 0x7E00, 128, False, 0x8000, signature=(0x1E, 0x95, 0x0F))
 
-    # Versioning: the block's third byte is the loader's version, and the tool
-    # speaks a window of them. Every version in the window decodes, so an older
-    # deployed loader stays usable; one above the window is refused by name,
-    # since which version changed the protocol is knowledge only the tool
-    # holds, and it holds none about a version it has never heard of.
-    for version in range(pb.OLDEST_LOADER, pb.NEWEST_LOADER + 1):
-        if info_of(pb, 0x1E00, 64, True, 0x2000, version=version).version != version:
-            fail(f"pureboot {version} does not decode")
-    expect_error(
-        "unknown loader version",
-        lambda: info_of(pb, 0x1E00, 64, True, 0x2000, version=pb.NEWEST_LOADER + 1),
-        f"pureboot {pb.NEWEST_LOADER + 1}",
-        "newer tool",
-    )
-
     # mega_boot: BOOTSZ words and the BOOTRST sense per chip — the fuse byte
     # index (EXTENDED on the x8 line except the m328s' HIGH, HIGH elsewhere)
     # and the per-family ladders (Atmel-2486/2466/2503/2545/8271/DS40002065/
@@ -169,12 +154,6 @@ def main():
         fail("image_info misses the embedded block")
     if pb.image_info(bytes((0xAA,)) * 40) is not None:
         fail("image_info invents a block")
-    # An older loader's image stays readable, so a deployed build can be
-    # identified and installed like any other.
-    old = info_of(pb, 0x1E00, 64, True, 0x2000, version=pb.OLDEST_LOADER)
-    found_old = pb.image_info(bytes((0xAA,)) * 10 + old.raw)
-    if found_old is None or found_old.version != pb.OLDEST_LOADER:
-        fail("image_info misses an older loader's block")
 
     # loader_image must peel a padded image down to the slot content: a raw
     # .bin padded from address 0 (or a whole-flash read-back with the loader
@@ -225,52 +204,6 @@ def main():
     pb.check_walk_region({0x7800: bytes((0xFF,)) * 128}, mega, fuses(0xFA), False)
     pb.check_walk_region(deep, mega, None, False)  # fuses unknown: no check
 
-    # The repairing verify: a mismatched page is rewritten rather than raised,
-    # bounded so a fault that is not self-clearing cannot spin.
-    class FakeLoader:
-        """A device whose first `bad` writes of any page land wrong."""
-
-        def __init__(self, info, bad):
-            self.info = info
-            self.bad = bad
-            self.flash = {}
-            self.writes = 0
-
-        def write_page(self, address, data):
-            self.writes += 1
-            self.flash[address] = bytes(len(data)) if self.bad > 0 else bytes(data)
-            self.bad -= 1
-
-        def read_flash(self, address, count):
-            return self.flash.get(address, bytes(count))
-
-    want = {0: bytes((i * 5) & 0xFF for i in range(128))}
-
-    # One bad write, then good: repaired in place, and the caller never sees
-    # an error. The rewrite is counted, so a silent no-op cannot pass.
-    device = FakeLoader(info_of(pb, 0x7E00, 128, False, 0x8000), bad=1)
-    device.write_page(0, want[0])
-    pb.verify_pages(device, want, repair=True)
-    if device.writes != 2:
-        fail(f"repairing verify made {device.writes} writes, expected 2")
-
-    # Without repair the same state raises, so the repair is what fixed it.
-    device = FakeLoader(info_of(pb, 0x7E00, 128, False, 0x8000), bad=1)
-    device.write_page(0, want[0])
-    expect_error("verify without repair", lambda: pb.verify_pages(device, want), "verify failed")
-
-    # A page that never comes good stops after RETRIES rewrites, and says so.
-    device = FakeLoader(info_of(pb, 0x7E00, 128, False, 0x8000), bad=99)
-    device.write_page(0, want[0])
-    expect_error(
-        "unrepairable page",
-        lambda: pb.verify_pages(device, want, repair=True),
-        "verify failed",
-        f"after {pb.RETRIES} retries",
-    )
-    if device.writes != pb.RETRIES + 1:
-        fail(f"unrepairable page took {device.writes} writes, expected {pb.RETRIES + 1}")
-
     print("test_planner: all planner and policy checks pass")