Repository navigation
Bug fixes and test coverage - #59
Merged
Merged
Conversation
- Write both 32-bit halves of the AAD and payload bit lengths in the WB/WBA GCM and GMAC final block - Store the streaming GCM payload byte count as uint64_t on WB, WBA and N6
…R streaming - Add whal_AesEcb_Stop, whal_AesCbc_Stop and whal_AesCtr_Stop with a Stop vtable entry - Implement Stop on WB, WBA/U5 and N6: disable the engine and clear the key and IV registers - Document Stop in writing_a_driver.md - Add Start/Process/Stop streaming tests for ECB, CBC and CTR that check against Oneshot output
…DOUTR on timeout - Clear all WB key and IV registers at the start of ECB/CBC/CTR Start so a shorter key does not inherit old key words - Drain DOUTR when WaitForCCF times out and in Deinit on WB and WBA/U5
- Replace Disable plus ZeroKeyIv with an IPRST reset that also clears the FIFOs - Use it on all error, cleanup and success paths, in Stop and in Deinit
- Build crypto.c and the per-algorithm AES, SHA and HMAC dispatch sources in tests/core - Add NULL device, NULL driver and valid dispatch tests for every crypto API - Check that a missing Stop, Finalize or GMAC Oneshot slot returns WHAL_ENOTSUP
- Decrypt GCM and CCM with a partial final block, one-shot and streaming - Test GMAC with partial and empty AAD and CCM with AAD of 14 bytes or less - Test CCM with every nonce length from 7 to 12 and a 300-byte payload - Reject out-of-range GCM/GMAC IV and CCM nonce sizes - Add AES-128 known-answer tests for CTR, GCM, GMAC and CCM, and AES-192 ECB on STM32N6 - Generate the new vectors with gen_test_vectors.py
…hash tests - Set HASH_CR.INIT and clear HASH_SR.DINIS on every HMAC timeout exit and in Deinit - Add a WBA readback test for the HASH context swap and digest registers after INIT and Deinit - Add HMAC known-answer tests with 64-byte and 131-byte keys, one-shot and streaming - Add SHA and HMAC streaming tests that leave 0 to 3 trailing bytes for Finalize and match Oneshot - Generate the new vectors with gen_test_vectors.py
- Zero all 894 words of PKA RAM in Deinit before clearing PKA_CR.EN - Add NULL, zero-size, mismatched-size and over-limit tests for every PKA primitive
- Generate 1, 3, 5 and 7 bytes into a 0xA5-filled buffer and check no byte outside the request changes
…document no-op locks - Return WHAL_EHARDWARE from L1 Unlock if PELOCK or PRGLOCK stays set after the key sequences - Lock WB0 flash with a PAGEPROT segment covering every page; Unlock clears both PAGEPROT registers - Document that Lock and Unlock are driver-specific and may return success without applying protection
…geometry and CFGBSY cleanup, add erase extent tests - Encode F4 sectors 12 and up into the 5-bit dual-bank SNB field - Derive H5 sectors per bank from the configured flash size instead of assuming 2 MB - Add pageSize to the F0/F3 flash config and use it for erase; set 2 KB on the F091 and F302R8 boards - Skip FLASH_CR writes in WB and C0 cleanup while CFGBSY is set; reject CFGBSY and clear stale PG/PER on entry - Test multi-sector erase extents on every flash device and a one-byte-past-sector erase on on-chip flash - Add a PIC32CZ platform test for single-doubleword and mixed single/quad programming
…ssing and SD extent tests - SPI-NOR Init rejects a pageSz that is not a power of two, since the write path splits pages with a mask - Add pageSz to the peripheral flash config; set 256 on the W25Q64 - Add a SPI-NOR cross-page write test - Add SD block tests for erase extent and high block addresses
…own, add WB DMA tests - WB DMA IRQ checks TEIF first and reports one error when TCIF and TEIF are both pending - GPDMA Deinit aborts each enabled channel (suspend, idle wait, reset), since RESET has no effect on a running channel; the abort sequence is shared with Stop - GPDMA Configure rejects an unknown direction - WBA UART-DMA Deinit runs every teardown step and returns the first error; blocking Send and Recv return a DMA stop failure - Document that a one-byte WBA UART-DMA send is copied to an internal buffer - Add a WB55 DMA platform test for CCR/CPAR/CMAR/CNDTR/DMAMUX composition per direction, mem-to-mem transfers, and TC/TE IRQ dispatch
… UART line errors, validate I2C StartCom, add I2C timing tests - Polled UART Recv (WB family, F0/F3, F4/L1, PIC32CZ) checks parity, framing, noise and overrun per byte, clears them and returns WHAL_EHARDWARE - Blocking WB and WBA UART-DMA Recv check the same flags after the transfer; async callbacks are unchanged - PIC32CZ Send returns immediately for zero bytes instead of waiting on TXC - WB-family UART Deinit clears FIFOEN after disabling the USART - I2C StartCom (WB family, L1) rejects addresses wider than addrSz - L1 I2C rejects frequencies above 400 kHz; WB-family I2C rejects a pclk below 1 MHz - Add StartCom rejection tests for every I2C board - Add a WB55 test that decodes TIMINGR against the I2C-bus minimum SCL times and checks the CR2 address encoding - Add an L1 test for the Fast-mode limit
… configuration readback tests - STM32 and WB0 GPIO Set write BSRR instead of read-modify-writing ODR - PIC32CZ GPIO Set writes OUTSET or OUTCLR instead of read-modify-writing OUT - Any nonzero Set value drives the pin high - Add an STM32 test that reads back MODER, OTYPER, OSPEEDR, PUPDR and the AF nibble for every board pin, and a WB0 version - Add a PIC32CZ test that reads back PINCFG, PMUX and DIR - Add GPIO platform test stubs for F4, H5, U5 and WBA - Test that a nonzero Set value drives the pin high
…add send length tests - H5 Init rejects missing descriptor or buffer memory, zero counts and zero buffer sizes, matching N6 - H5 and N6 Init reject RX buffers that are not a multiple of the RBSZ granularity (4 bytes on H5, 8 on N6) or exceed 14 bits, and TX buffers that exceed the 14-bit length field - Document that N6 descriptors and buffers must be in non-cacheable memory - Test that Send rejects zero and oversize lengths - Add H5 and N6 loopback tests that a frame of exactly the TX buffer size is accepted
…PWM polarity, add SysTick and full-duty tests - SysTick Deinit clears ENABLE and TICKINT and zeroes the counter - PWM Start (generic dispatch and LPTIM) rejects polarities other than NORMAL and INVERTED - Add a WB55 SysTick test that reads back RVR, CLKSOURCE and TICKINT, and checks Stop, Start and Deinit - Add dispatch tests for 100% duty, inverted polarity and an undefined polarity - Test that 100% duty reaches the PWM driver on hardware
…, add BMI270 decode and gravity tests - BMI270 Init, Deinit and Read return an I2C EndCom failure when the transfer succeeded - Sharp LCD Clear, Init, Deinit and Update run every cleanup step (SCS deassert, SPI EndCom, PWM Stop) and return the first error - Sharp LCD Init stops the VCOM PWM on any failure, including EndCom - Move the BMI270 parse into whal_Bmi270_Decode and test it against a fixed buffer - Replace the nonzero accel check with a gravity magnitude check
…MA receive, add GPDMA reject and WB0 lock tests - WB and WBA UART-DMA RecvAsync clear latched line errors before arming, so blocking Recv reports only its own errors; document that async completions carry only the DMA result - Comment why a failed DMA stop wins in WBA UART-DMA Send and Recv - Document that the H5 flash config must describe the whole device - Rename the F0 flash pageSize field to pageSz and fix the stale 2 KB page docs - Skip the on-chip erase extent tests when the extent would reach the running image - Skip the cross-page write test when the page size does not fit its buffers - Add a WBA GPDMA test that Configure rejects a bad channel, direction and byte count - Add a WB0 flash test that a locked page cannot be erased or written
There was a problem hiding this comment.
🟡 Changes recommended
Both blocking UART-DMA receive paths can bypass latched line errors, returning misleading timeouts or waiting indefinitely.
2 open findings
What changed in this PR
This PR strengthens wolfHAL driver error handling, cleanup, and validation, with expanded regression tests and updated API documentation.
Changes:
- Improve peripheral teardown, flash handling, and input validation.
- Extend crypto streaming APIs and hardware-state cleanup.
- Add boundary, known-answer, and register-readback tests.
| File | Description |
|---|---|
| wolfHAL/uart/uart.h | Document receive errors. |
| wolfHAL/uart/stm32wba_uart_dma.h | Clarify DMA buffers and errors. |
| wolfHAL/uart/stm32wb_uart.h | Document receive errors. |
| wolfHAL/uart/stm32wb_uart_dma.h | Clarify DMA receive errors. |
| wolfHAL/uart/stm32f4_uart.h | Document receive errors. |
| wolfHAL/uart/stm32f0_uart.h | Document receive errors. |
| wolfHAL/uart/pic32cz_uart.h | Document receive errors. |
| wolfHAL/timer/systick.h | Document timer teardown. |
| wolfHAL/sensor/imu/bmi270_sensor.h | Expose raw-data decoder. |
| wolfHAL/pwm/stm32wb_lptim_pwm.h | Document polarity validation. |
| wolfHAL/pwm/pwm.h | Document polarity validation. |
| wolfHAL/i2c/stm32wb_i2c.h | Document configuration limits. |
| wolfHAL/i2c/stm32l1_i2c.h | Document address and frequency limits. |
| wolfHAL/gpio/gpio.h | Define nonzero output behavior. |
| wolfHAL/flash/stm32wb0_flash.h | Document PAGEPROT locking. |
| wolfHAL/flash/stm32h5_flash.h | Clarify bank configuration. |
| wolfHAL/flash/stm32f0_flash.h | Add configurable erase-page size. |
| wolfHAL/flash/spi_nor_flash.h | Document page-size constraint. |
| wolfHAL/flash/flash.h | Clarify backend-specific locking. |
| wolfHAL/eth/stm32n6_eth.h | Document cache and buffer requirements. |
| wolfHAL/eth/stm32h5_eth.h | Document buffer limits. |
| wolfHAL/crypto/stm32wba_aes.h | Widen GCM state; declare Stop APIs. |
| wolfHAL/crypto/stm32wb_aes.h | Widen GCM state; declare Stop APIs. |
| wolfHAL/crypto/stm32n6_cryp.h | Widen GCM state; declare Stop APIs. |
| wolfHAL/crypto/crypto.h | Add block-cipher Stop interfaces. |
| tests/timer/test_stm32wb_timer.c | Test SysTick configuration and teardown. |
| tests/sensor/imu/test_bmi270_sensor.c | Test decoding and gravity magnitude. |
| tests/rng/test_rng.c | Test odd-length output boundaries. |
| tests/pwm/test_stm32wb_pwm.c | Test invalid polarity. |
| tests/pwm/test_pwm.c | Test polarity and full duty. |
| tests/main.c | Register platform crypto suites. |
| tests/i2c/test_stm32wb_i2c.c | Test timing and addressing. |
| tests/i2c/test_stm32l1_i2c.c | Test frequency limits. |
| tests/i2c/test_i2c.c | Test invalid communication parameters. |
| tests/gpio/test_stm32wba_gpio.c | Reuse STM32 GPIO tests. |
| tests/gpio/test_stm32wb0_gpio.c | Test pin configuration and output. |
| tests/gpio/test_stm32wb_gpio.c | Expand register-readback tests. |
| tests/gpio/test_stm32u5_gpio.c | Reuse STM32 GPIO tests. |
| tests/gpio/test_stm32h5_gpio.c | Reuse STM32 GPIO tests. |
| tests/gpio/test_stm32f4_gpio.c | Reuse STM32 GPIO tests. |
| tests/gpio/test_pic32cz_gpio.c | Expand configuration and output tests. |
| tests/flash/test_stm32wb0_flash.c | Test write protection. |
| tests/flash/test_pic32cz_flash.c | Test doubleword write boundaries. |
| tests/flash/test_flash.c | Test erase extent and cross-page writes. |
| tests/eth/test_stm32n6_eth.c | Test maximum transmit length. |
| tests/eth/test_stm32h5_eth.c | Test maximum transmit length. |
| tests/eth/test_eth.c | Test invalid transmit lengths. |
| tests/dma/test_stm32wba_dma.c | Test invalid channel configurations. |
| tests/crypto/test_stm32wba_hmac_sha256.c | Test HASH context cleanup. |
| tests/crypto/test_stm32n6_aes_ecb.c | Add AES-192 known-answer test. |
| tests/crypto/test_sha256.c | Test streaming tail lengths. |
| tests/crypto/test_sha224.c | Test streaming tail lengths. |
| tests/crypto/test_sha1.c | Test streaming tail lengths. |
| tests/crypto/test_pka.c | Test invalid operand sizes. |
| tests/crypto/test_hmac_sha224.c | Test long keys and streaming tails. |
| tests/crypto/test_hmac_sha1.c | Test long keys and streaming tails. |
| tests/crypto/test_aes_gmac.c | Test key, AAD, and IV cases. |
| tests/crypto/test_aes_gcm.c | Expand decrypt and boundary tests. |
| tests/crypto/test_aes_ecb.c | Test streaming and Stop. |
| tests/crypto/test_aes_ctr.c | Test AES-128 and streaming. |
| tests/crypto/test_aes_cbc.c | Test streaming and Stop. |
| tests/crypto/gen_test_vectors.py | Generate additional crypto vectors. |
| tests/core/Makefile | Include crypto dispatch sources. |
| tests/block/test_block.c | Test erase extent and high addresses. |
| src/uart/stm32wba_uart_dma.c | Propagate receive and teardown errors. |
| src/uart/stm32wb_uart.c | Detect receive errors; clear FIFOEN. |
| src/uart/stm32wb_uart_dma.c | Detect receive line errors. |
| src/uart/stm32f4_uart.c | Detect receive line errors. |
| src/uart/stm32f0_uart.c | Detect receive line errors. |
| src/uart/pic32cz_uart.c | Handle empty sends and receive errors. |
| src/timer/systick.c | Stop and clear SysTick on teardown. |
| src/sensor/imu/bmi270_sensor.c | Extract decoder; propagate cleanup errors. |
| src/pwm/stm32wb_lptim_pwm.c | Reject undefined polarity. |
| src/pwm/pwm.c | Validate polarity before dispatch. |
| src/i2c/stm32wb_i2c.c | Validate address and peripheral clock. |
| src/i2c/stm32l1_i2c.c | Validate address and frequency. |
| src/gpio/stm32wb0_gpio.c | Use atomic pin writes. |
| src/gpio/stm32wb_gpio.c | Use atomic pin writes. |
| src/gpio/pic32cz_gpio.c | Use atomic output registers. |
| src/flash/stm32wb0_flash.c | Implement PAGEPROT locking. |
| src/flash/stm32wb_flash.c | Guard control writes while busy. |
| src/flash/stm32l1_flash.c | Verify unlock success. |
| src/flash/stm32h5_flash.c | Derive bank size from configuration. |
| src/flash/stm32f4_flash.c | Correct dual-bank sector encoding. |
| src/flash/stm32f0_flash.c | Use configured erase-page size. |
| src/flash/stm32c0_flash.c | Guard control writes while busy. |
| src/flash/spi_nor_flash.c | Require power-of-two page sizes. |
| src/eth/stm32n6_eth.c | Validate DMA buffer sizes. |
| src/eth/stm32h5_eth.c | Validate descriptor and buffer configuration. |
| src/dma/stm32wba_gpdma.c | Abort during teardown; validate direction. |
| src/dma/stm32wb_dma.c | Prioritize transfer-error callbacks. |
| src/display/sharp_memory_display.c | Propagate cleanup failures. |
| src/crypto/stm32wba_hash.c | Reset HASH on teardown and timeouts. |
| src/crypto/stm32wb_pka.c | Clear PKA RAM on teardown. |
| src/crypto/aes_ecb.c | Dispatch Stop calls. |
| src/crypto/aes_ctr.c | Dispatch Stop calls. |
| src/crypto/aes_cbc.c | Dispatch Stop calls. |
| docs/writing_a_driver.md | Explain block-cipher Stop lifecycle. |
| boards/stm32wb55xx_nucleo/wolfHAL_board.h | Expose optional DMA instance. |
| boards/stm32f302r8_nucleo/wolfHAL_board.h | Configure flash page size. |
| boards/stm32f091rc_nucleo/wolfHAL_board.h | Configure flash page size. |
| boards/peripheral/wolfHAL_peripheral.h | Add program-page test metadata. |
| boards/peripheral/wolfHAL_peripheral.c | Supply SPI-NOR page size. |
🧠 Review effort: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- Deinit no longer writes RESET to a channel whose suspend/idle wait timed out, since a reset of a non-idle channel may not apply and the write would clear SUSP - Remaining channels are still torn down and the first error is returned
…WBA HASH context test - HMAC Oneshot returns WHAL_ENOTSUP for an empty message, since the HASH core ignores DCAL in the HMAC message phase when no data was written - HMAC Finalize resets the core and returns WHAL_ENOTSUP when no message data was processed - Document the empty-message limitation on the HMAC Oneshot and Finalize functions - HMAC residue tests accept WHAL_ENOTSUP for empty messages, provided streaming and Oneshot agree - WBA HASH context test polls for DINIS after Start and compares all 54 context registers, since the HMAC state lives in CSR0 to CSR37
…NOR Init - SD (SPI) and SPI-NOR Init no longer reject a NULL spiDev or gpioDev, since single-instance boards pass WHAL_INTERNAL_DEV (NULL) for them - Init still rejects a missing spiComCfg
aidangarske
approved these changes
Oct 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Works through the open findings in the wolfHAL review: driver fixes, new tests, and doc corrections across crypto, flash, DMA, UART, I2C, GPIO,
Ethernet, timer/PWM and external peripherals. Findings that were by design, false positives or API misuse are closed without code changes.
Changes
Crypto
Stopto AES ECB/CBC/CTR streaming so the key can be cleared after a sessionFlash and block
pageSzcfg field)DMA and UART
I2C, GPIO, Ethernet, timer, PWM
External peripherals
whal_Bmi270_DecodeTests