Improve ARMORED code + minor fixes

[danielinux]

ARMORED=1

• Improved fault mitigation: more redundancy, hardened
• Added redundancy to ML_DSA verification

STM32_TZ SAU:

• Set UPDATE partition to secure. It is only accessed via NSC when the application is running
• flash_top_secure in hal_tz_sau_init to the same range

Fixes:

• Bug preventing rollback in case of ARMORED=1.
• rolled-back image state handling: force update flags on rollback. Set success after complete rollback.

[Copilot]

Pull request overview

This PR enhances fault mitigation in ARMORED mode with improved redundancy checks, adds ARMORED support for ML_DSA signature verification, fixes rollback handling bugs, and reconfigures STM32 TrustZone SAU regions to set the UPDATE partition as secure.

Changes:

• Enhanced ARMORED mode with additional redundancy in signature verification and version checking
• Added redundant verification checks for ML_DSA signatures when ARMORED=1
• Fixed rollback logic to properly handle version checks and state transitions with ARMORED enabled
• Reconfigured STM32_TZ SAU to mark UPDATE partition as secure and adjusted flash region mappings

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
tools/test.mk	Updated size limits for test targets to accommodate increased code size from ARMORED enhancements
src/update_flash.c	Added rollback detection logic, refactored version check to work with ARMORED, and improved rollback state handling
src/image.c	Added ARMORED redundancy checks to ML_DSA verification and updated signature verification macros
include/image.h	Refactored VERIFY_VERSION_ALLOWED macro for both GCC and IAR with improved redundancy and changed signed to unsigned comparisons
hal/stm32_tz.c	Reconfigured SAU regions to mark UPDATE partition as secure with dynamic flash_top_secure calculation

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[dgarske]

Nice!