Document source: 51e93508f22f; code reference: 51e93508f22f. 中文. Source language: zh_CN; requested: en; actual: en; translation: reviewed.

Source documentation does not establish software or physical hardware qualification. See the support and qualification records for their exact scope.

Cortex-M software support and platform-integration boundaries

Nexus CPU software supports M0, M0+, M3, M4, M7, M23, M33, M55 and M85. One immutable CPU-profile parser drives Core/Arch/atomics/baremetal-FreeRTOS runtime configuration. DSP, FPU, MVE, cache, MPU, DWT, security and SAU are explicit facts. Core selection generates no new SoC/Board/vector/startup/driver/link layout/typed factory. The three STM32F407/GD32F470 Boards maintain launch modes. G474/H743/U575 have exact GPIO/IRQ-UART/timebase references; G474 adds selected EXTI, H743 fixed Cache and bounded UART TX DMA, U575 an independent OS-free synchronous split-domain GPIO reference. CPU selection alone establishes none of these SoC mechanisms or wider peripheral support. All physical HIL remains unexecuted.

Detailed ownership/context/rejection semantics are in Arch contracts, OS lifecycle in OS adaptation, and exact whole-platform scope in support matrix. Previous-HEAD candidates/qualification are not inherited.

Nine cores and optional capabilities

The table lists capability formats accepted by the parser. Optional capabilities require concrete chip facts, not inference from CPU names. none/zero explicitly means undeclared, with no runtime discovery.

CPU	Atomic RMW / IRQ mask	Optional hardware formats	Maintained FreeRTOS port
M0	saved-PRIMASK / PRIMASK	No FPU/MVE/cache/MPU/SAU	GCC/ARM_CM0
M0+	saved-PRIMASK / PRIMASK	Optional v7-format MPU	GCC/ARM_CM0
M3	compiler exclusive / BASEPRI	v7 MPU, DWT	GCC/ARM_CM3
M4	compiler exclusive / BASEPRI	fpv4-sp-d16, v7 MPU, DWT	CM3 without FP; CM4F with FP
M7	compiler exclusive / BASEPRI	fpv5-sp-d16/fpv5-d16, 32-byte cache, v7 MPU, DWT	Reviewed integer overlay without FP; CM7/r0p1 with FP
M23	compiler exclusive / PRIMASK	v8 MPU, explicit security state, Secure SAU	ARM_CM23_NTZ/non_secure
M33	compiler exclusive / BASEPRI	Optional DSP, fpv5-sp-d16, v8 MPU, DWT, explicit security state, Secure SAU	ARM_CM33_NTZ/non_secure
M55	compiler exclusive / BASEPRI	Explicit FPU/MVE, 32-byte cache, v8 MPU, DWT, security state, Secure SAU	ARM_CM55_NTZ/non_secure
M85	compiler exclusive / BASEPRI	Explicit FPU/MVE, 32-byte cache, v8 MPU, DWT, security state, Secure SAU	ARM_CM85_NTZ/non_secure

Cortex-M uses short-enums ABI. Without FPU/MVE use soft; with FPU explicitly choose hard/softfp. M55/M85 MVE is none, integer or float: no MVE adds +nomve, no scalar FP adds +nofp; integer-only MVE uses softfp while FPU remains none. FP-MVE requires a declared available FPU. M55/M85 FPU choices are auto, fpv5-sp-d16 or fpv5-d16; auto is an explicit compiler option, not hardware detection.

Security state is single, secure or nonsecure. Only security-extension-capable M23/M33/M55/M85 may declare the latter states; Secure adds -mcmse. SAU requires true Secure facts. Cache lines are zero/32 bytes; MPU is zero or maintained v7/v8 format. M0/M0+/M23 forbid DWT capability. Other cores also require explicit facts to read an already enabled cycle counter.

IRQ priority width, external IRQ count and clock are chip facts. PRIMASK profiles fix two priority bits; BASEPRI supports 3–8. M0/M0+ support at most 32 external IRQs; M3/M4/M7/M23 240; M33/M55/M85 480. SoCs declare actual valid ranges. These limits do not replace vendor facts/electrical verification.

CPU mechanisms and ownership

Arch depends on no SoC/I/O/kernel/vendor SDK. Production algorithms execute through inline-instruction/MMIO boundaries; GoogleTest/GoogleMock replace only that hardware boundary. Native provides actual recursive thread exclusion, C11 fences/publication but models no NVIC, physical IRQ, privilege switching or actual cycles.

Restore PRIMASK tokens once, in reverse order on the same CPU/thread, preserving input BASEPRI/FAULTMASK. Protected metadata permits privileged Thread/configurable IRQ only; NMI/HardFault, other CPUs/security worlds/DMA are outside exclusion. Context queries authorize no kernel-ISR calls. Barriers prove neither peripheral idle nor DMA drain. DWT enables/resets no counters and is not a monotonic deadline source.

Aligned-word acquire/release loads/stores do not mask IRQs. M0/M0+ RMW uses bounded saved-PRIMASK exclusion without silent libatomic linkage. Other cores use compiler lock-free RMW; exclusive retries are not fixed cycles. Owners guarantee request/buffer/notification lifetimes; atomic publication reclaims no objects.

cache.h maintains exclusive complete 32-byte lines only, without rounding/enabling; all relevant cache capability/enabled checks precede writes. Providers/products own pre-DMA-RX/post-drain maintenance, reachable addresses and buffer loans. cache_control.h separately maintains M7 cold enable/disable; other cores reject it. Callers supply owned control objects/exclude other memory users. Trusted reset or prior successful owned clean/disable is required; CCR=0 proves no foreign-dirty cleanliness. Actual set/way geometry is checked, failures retain cache/selector responsibility, and a stack-free leaf cleans all D-cache before disabling. This is neither ordinary live range maintenance nor DMA drain.

MPU v7/v8 and SAU use distinct exact encoders. Actual single-region programming requires privileged Thread in this domain, input PRIMASK=1 and the unit already disabled. CTRL, other regions and input RNR are preserved; nothing implicitly enables the unit.

Products own MPU/MAIR policy, SAU/IDAU, NSC veneers, secure boot, shared-resource protocols and recovery. CPU MPU programming alone establishes no user-task isolation. Explicit restricted-task runtime uses an actual FreeRTOS MPU port; software and physical security acceptance remain separate.

nonsecure.h provides full-span CMSE permission observation from Secure privileged Thread, checking attribution/MPU as NS-unprivileged read/read-write; other images reject it. Observation neither copies/pins memory, identifies callers, excludes MMIO/DMA nor freezes mapping. The U575 reference adds cold ownership, fixed world principal, synchronous snapshots/output prevalidation for a limited gateway; no NS RTOS/asynchronous user DMA. See U575 split-domain contract.

FreeRTOS software contracts

Every CPU profile selects exact pinned-kernel port sources; M0/v8-M also compile required assembly files. Non-FP M7 uses a reviewed build overlay derived from pinned CM3, adding erratum-837070 PRIMASK-preserving BASEPRI helpers/PendSV handling while vendor files remain locked. Mapping every core to CM4F for convenience is forbidden.

Armv8-M NTZ, Secure-only and standalone NonSecure defaults are selected by explicit facts with configENABLE_TRUSTZONE=0. Optional split profiles use matched Secure/NS images, actual TZ-aware ports and caller Secure-context/Idle storage, without default Secure heaps/pools. External projects still own Secure startup, IDAU/SAU and NS coprocessor access. Optional MPU profiles provide restricted tasks/narrow delay-tick SVC; ordinary APIs remain privileged. MPU-only/split-only are separate; MPU+split is rejected. OS support records exact variants/executed software evidence, not physical-isolation acceptance.

M55/M85 use actual MVE-aware context ports. configENABLE_FPU with FP/MVE enables shared register banks/extended-lazy frames; integer-only MVE gains no scalar FP. Upper-bank save paths are checked separately in source/objects. VPR/lower bank depend on hardware extended exception framing, a port-acceptance assumption requiring architectural/physical checks. Compilation/ELF proves neither complete payload retention nor real FP/MVE switching and cannot replace physical acceptance.

Callers statically supply tasks, TCBs, stacks, queues and notification storage; kernels link no heap allocator. Applications own scheduler startup, workers, queue depths, fairness, shutdown progress and post-join reclaim. Platform start neither starts schedulers nor generates hidden tasks/daemons.

Running APIs require privileged unmasked Thread. Only NOT_STARTED permits the pinned port’s canonical bootstrap mask: PRIMASK=1 for Baseline, exact syscall BASEPRI for Mainline. Masks prove no provenance and confer no runtime/suspended permission. Fault/other masks are rejected before object changes. IRQ wake separately checks external exception range, priority width and actual-port syscall rules; notification only prompts request/sequence predicate rechecks.

External CPU-runtime configuration

Complete SoC projects retain strict platform assembly. CPU/Core/OS-only reuse takes external runtime.toml plus chip-package cpu.json. The following is an M33 NonSecure software-configuration example, not new chip/Board support. Replace clock/IRQ-count/optional capabilities with reviewed real-chip facts. No Board file is needed and no SoC/device factory is emitted.

runtime.toml must contain the following four entries; paths are relative to that TOML. It may also explicitly provide [os] policy matching the selected backend. Baremetal accepts no kernel policy; CPU-only configuration rejects low-power timebase selections requiring SoC timer facts:

schema_version = 1
cpu_facts = "cpu.json"
backend = "freertos"
optimization = "Os"

backend is baremetal, freertos or explicitly scoped threadx. ThreadX accepts Native/Cortex-M4/M4F only and inherits no nine-core FreeRTOS port scope from this page; see ThreadX integration. optimization accepts O0, Og, O2, Os or O3; Debug selections establish no timing or resource qualification. CPU-package/CPU/IRQ fields are complete and unique. Unknown fields, duplicate JSON keys, contradictory feature/ABI, invalid schema/clock and symlink paths are rejected; authored overrides cannot fabricate chip capabilities.

{
  "schema_version": 1,
  "cpu": {
    "arch": "cortex-m33",
    "dsp": false,
    "fpu": "none",
    "float_abi": "soft",
    "dwt_cyccnt": false,
    "mpu_version": 8,
    "icache_line_bytes": 0,
    "dcache_line_bytes": 0,
    "security": "nonsecure",
    "sau": false,
    "mve": "none"
  },
  "irq": {"priority_bits": 3, "external_count": 64},
  "clock_hz": 64000000
}

Validate independently and emit the bundle atomically:

python -B tools/configure/runtime.py \
    --assembly /path/to/product/runtime.toml \
    --output /path/to/build/generated-runtime

Outputs are resolved-cpu.json, nexus_config.h, selection.cmake, input_paths.json and ownership marker, binding input/config SHA-256. No linker script/bindings/factory is emitted. Failed configuration invalidates existing owned bundles instead of reusing stale selection. Nonowned directories are never cleared; outputs cannot overwrite inputs/parents. clock_hz does not set clocks.

Public CMake entry from a source checkout:

cmake_minimum_required(VERSION 3.24)
project(product_runtime LANGUAGES C ASM)
include("/path/to/nexus/cmake/platform/Runtime.cmake")
nexus_add_runtime(ASSEMBLY "${CMAKE_CURRENT_SOURCE_DIR}/runtime.toml")
add_library(application STATIC application.c)
target_link_libraries(application PRIVATE Nexus::Runtime)

Installed source SDK uses the entry below; the other two target operations are unchanged:

find_package(Nexus REQUIRED COMPONENTS Runtime)
nexus_add_runtime(ASSEMBLY "${CMAKE_CURRENT_SOURCE_DIR}/runtime.toml")

Nexus::Runtime propagates Config/ABI, Core, Arch, typed I/O faces and selected OS adapter without SoC/Board/factory. A CMake build allows one resolved Nexus assembly and no conflicting ABIs; external projects explicitly link extra components. MCU projects select cmake/toolchains/arm-gcc.cmake on first configure. External projects still implement startup/vectors/link layout/clocks/hardware/final executable. The example shows a reusable static-library source graph, not runnable-board firmware.

Installed SDK checks complete source identity before generation/compilation. Development-fixture SDK requires explicit opt-in and is not a publishable candidate; opt-in bypasses no checksum/closure checks. SDK/external consumers must rerun for this new HEAD.

Execution evidence and remaining acceptance

CPU-profile/Runtime-resolver tests cover immutable IR, strict schemas, ABI/feature conflicts, atomic publication, changed inputs and stale outputs. Google models execute actual CPU algorithms. ARM gates retain macros/objects/assembly-disassembly/commands/exits/raw hashes. Runtime gates reuse the nexus_add_runtime production graph to build Core/Arch/OS and inspect actual FP/MVE kernel context/ELF rather than maintain another handwritten source graph.

python -B -m unittest discover -s tools/configure -p 'test_*.py'
python scripts/ci/tdd_gate.py --all --preset native-debug
python -B -m unittest discover -s scripts/ci -p 'test_*.py'
python scripts/ci/arch_compile.py --compiler arm-none-eabi-gcc \
    --output build/arch-compiler
python scripts/ci/cache_control_compile.py --compiler arm-none-eabi-gcc \
    --output build/cache-control-compiler
python scripts/ci/cortex_runtime.py --compiler arm-none-eabi-gcc \
    --output build/cortex-runtime

These commands establish CPU-primitive/runtime software evidence within actually executed scope. Concrete F407/F470 platforms, G474/H743/U575 references and physical stations have their own gates; compilation provides no physical evidence. Optional-feature scope follows actual execution; one passed combination does not qualify every possible combination. Current development output is /workspace/nexus-all-cortex-evidence; actual reports establish counts/source identity instead of previous-version counts.

This iteration adds no actual Board and runs no physical HIL. IRQ latency, FP/MVE switching, cache/DMA coherence, MPU/SAU behavior, security-world cooperation, stack high-water, clocks/waveforms remain unaccepted. Formal clean-source SDK, offline double-build, image hashes and candidate sealing must rerun per qualification. Software support does not automatically become production release, hardware qualification, safety certification or LTS.