va416x0: fix vector table alignment and length, FRAM defects and ML-DSA

[dgarske]

Summary

This PR addresses vector table alignment faults, memory layout constraints, driver defects, and build script reliability. The alignment issue was originally reported by @jgeorge1316 in #885.

Key Fixes & Enhancements

1. Vector Table Alignment

• Issue: The application vector table sits at WOLFBOOT_PARTITION_BOOT_ADDRESS + IMAGE_HEADER_SIZE, which the shipped layout placed at 0xB800 + 0x200 = 0xBA00. With 212 exceptions, ARMv7-M requires that address to be 1024-byte aligned; 0xBA00 is only 512-aligned.
• Impact: The core ORs the vector offset into VTOR rather than adding it, so any vector whose offset shares a set bit with the low bits of VTOR resolves to the wrong entry. Measured on a VA41630 with a 212-entry table at a 512-aligned address: IRQ 77 (EDAC_SBE, offset 0x174) and IRQ 111 (0x1FC) dispatched correctly, IRQ 112 (0x200) hard faulted because it fetches vector 0 (the initial MSP), and IRQ 128 (PORTD2, 0x240) ran the wrong handler. The same table at a 1024-aligned address dispatched IRQ 128 correctly. Every IRQ from 112 upward was silently broken, covering the PORTA-PORTG pin interrupts, DMA and ADC/DAC, while SysTick and everything below IRQ 112 kept working.
• Fix: Raised IMAGE_HEADER_SIZE to 1024, placing the table at 0xBC00. Added a build-time check in hal/va416x0.c so any layout leaving (BOOT_ADDRESS + IMAGE_HEADER_SIZE) unaligned fails to compile, which matters for anyone re-carving the partitions to reclaim space.

2. Vector Table Overflows & Exception Handling

• Issue: hal_init() enabled EDAC single-bit and multi-bit error interrupts (IRQs 76 & 77) during scrubbing configuration. However, wolfBoot’s vector table only included the 16 standard Cortex-M4 system entries (64 bytes).
• Impact: EDAC exceptions fetched handlers from offsets 0x170 and 0x174—260 bytes past the table. This hit SHA-512 round constants in .text (0x47EDAEE6 and 0x81C2C92E), which reside outside the 256KB IRAM. An EDAC interrupt (expected during normal radiation-hardened operation) loaded invalid PC addresses and faulted.
• Fix: Expanded vector tables for both wolfBoot and the demo application to include all 212 entries (16 system + 196 external interrupts, IRQ 0 through TXEV_IRQn). Added a compile-time length check on each.
• Cleanup: Removed UART RX interrupt enabling. Nothing reads the UART, and __HAL_DISABLE_UART0/1/2 prevents the SDK from building handlers for it.

3. Memory Pooling for ML-DSA Level 5 Support

• Issue: ML-DSA Level 5 requires ~48KB of RAM and failed to fit in the 32KB SRAM_0 bank.
• Fix: Updated linker scripts to pool contiguous memory banks SRAM_0 (0x1FFF8000) and SRAM_1 (0x20000000) into a single 64KB region. SRAM_1 was previously unused because the SDK DMA driver is not linked.
• Build Fix: Updated build_test.sh to forward the complete signing tool environment instead of only three variables. This ensures ML_DSA_LEVEL reaches the tool rather than falling back to Level 2 and rejecting the key.

4. FRAM Driver Correctness

• Fixed FRAM_Erase() ignoring its spiBank argument.
• Fixed addr + len integer overflow in bounds check logic.
• Added a missing bank bounds check inside FRAM_Init().
• Bound transfers strictly to the bank selected by a successful FRAM_Init().

5. Build System & Stubs

• Removed always-success internal flash stubs on targets with no internal flash.
• Resolved a set -e fallthrough bug in build_test.sh where a mid-chain failure in an && list allowed broken builds to sign and flash stale images.

6. Documentation & Hardware Alignment

• Corrected flash layout documentation to match the shipped configuration.
• VA41630 VTOR measurement: Writing 0xFFFFFFFF to VTOR reads back 0xFFFFFF80, so the implemented field is VTOR[31:7] and the register accepts 128-byte granularity. That is a red herring: the register holding a value does not mean the fetch honours it, and the 1024-byte table alignment is still required (see section 1). Documented along with the alternative of moving WOLFBOOT_PARTITION_BOOT_ADDRESS instead of growing the header, for layouts that are tight on space.

Hardware Validation

Tested and validated end-to-end on a VA416XX EVK over J-Link across ECC384/SHA384 and ML-DSA Level 5 configurations:

• Boot & Update: Verified factory boot, signed-image updates via three-way swap, and clean reflashing.
• Demo App: Prints VTOR, whether it is 1024-aligned, and a SysTick liveness check. Note that SysTick alone does not prove correct placement: it is exception 15 at offset 0x3C, below the bit alignment affects, so dispatch testing needs an IRQ at or above 112.
• Host Tests: Verified FRAM fixes using host unit tests.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Pull request overview

Completes VA416xx interrupt vector tables to prevent corrupted exception dispatch (notably EDAC IRQs) and fixes multiple VA416x0 FRAM driver correctness issues, plus improves the target’s build/flash helper script and documentation.

Changes:

• Extend wolfBoot and demo-app vector tables to include all VA416xx IRQ entries (preventing EDAC IRQs from vectoring into .text).
• Fix FRAM driver bank selection, bounds checking (incl. overflow-safe), init binding behavior, and “no internal flash” stubs; add unit tests for these cases.
• Harden build_test.sh (avoid set -e fallthrough, size update-blanking from config, allow J-Link SN selection) and update VA416x0 target docs/output examples.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
tools/unit-tests/unit-va416x0-fram.c	Adds/adjusts mocks and unit tests to cover FRAM bank/bounds/init behavior fixes.
tools/scripts/va416x0/build_test.sh	Makes build/sign/flash steps fail-fast, sizes blank update from config, supports selecting a specific J-Link probe.
test-app/startup_arm.c	Expands VA416x0 application vector table to all required IRQ slots.
test-app/app_va416x0.c	Adds VTOR + SysTick liveness reporting; fixes key index printf formatting.
src/boot_arm.c	Expands VA416x0 wolfBoot vector table to all required IRQ slots (incl. EDAC interrupts).
hal/va416x0.h	Clarifies default pin macro comments (no functional change).
hal/va416x0.c	Fixes FRAM driver defects, disables UART RX IRQ usage, makes “no internal flash” stubs fail loudly, avoids large stack allocation.
docs/Targets.md	Updates VA416x0 flash layout and documents vector-table sizing/alignment behavior; refreshes example logs.
config/examples/vorago_va416x0.config	Notes a known non-linking ML-DSA configuration constraint.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.