Document source: e47887d3a11f; code reference: e47887d3a11f. 中文. Source language: zh_CN; requested: en; actual: en; translation: reviewed.

Source documentation does not establish software or physical hardware qualification. See the support and qualification records for their exact scope.

Exact support scope

The derived capability matrix automatically checks SoC/route modes, reference Board bindings and production sources selected by the actual resolver/emitter. Narrative tables describe runtime contracts; derived tables describe exact identities and bounded source consistency. Neither inherits old-HEAD qualification nor replaces physical execution. See mainstream MCU adaptation for this increment and its platform feedback process. Other parts, packages and modes in the same family do not automatically inherit this scope.

Chips, Boards and systems

Target	Software implementation	Unfinished physical facts
STM32F407ZGT6 / Qiming Xinxin V3.1	Cortex-M4F; 1 MiB Flash; main SRAM 128 KiB, CCM 64 KiB; declared clock/profile and reviewed routes	Actual PCB revision, crystal, power, continuity, waveforms and loads
STM32F407VET6 / Sky Star Youth Edition	Cortex-M4F; 512 KiB Flash; main SRAM 128 KiB, CCM 64 KiB; independent Board resources	Corresponding actual PCB/electrical/HIL acceptance
GD32F470ZGT6 / Liangshan Pi	Cortex-M4F; 1 MiB Flash; main SRAM 192 KiB, ADDSRAM 256 KiB, TCM 64 KiB; declared 25 MHz input, 200 MHz profile; optional independent 48 MHz USB owner	PCB/crystal/electrical facts unobserved; default linker uses main SRAM only; actual USB clock/PHY unmeasured
STM32G474RET6 / MB1367 source-reference configuration	Cortex-M4F; 512 KiB Flash; 96 KiB SRAM1/2 and separately counted 32 KiB CCM; HSE24/170 MHz, TIM2; package GPIO, six IRQ-byte UARTs, polling SPI1/2, TIM3/4 CH1 PWM, IWDG and EXTI0/1; separate software fixtures add ADC1 shots/finite TIM6 DMA blocks, polling I2C1 and physical Flash; baremetal/FreeRTOS static factory	The 52 package GPIO pads do not establish PCB wiring; PF0/PF1 and PG10 remain reserved; ADC DMA selects SRAM1/2 only and excludes CCM aliases; no UART/SPI DMA, continuous ADC or automatic AF selection; PCB/electrical/HIL behavior unobserved
STM32H743ZIT6 / NUCLEO-H743ZI2 source-reference configuration	Cortex-M7F; 2 MiB Flash; 512 KiB AXI SRAM, with explicitly selected and initialized D2 SRAM1; pre-RAM LDO, HSI32/HSI64 with Cache off/on, TIM2, GPIO and USART3 IRQ/finite TX DMA/finite RX DMA-IDLE; independent software fixtures add SPI4, I2C1, ADC1, TIM3 CH1, EXTI0/1, IWDG1 and physical Flash; base assemblies use baremetal/FreeRTOS; separate V-revision HSI64 baremetal references provide finite SPI4 DMA, continuous double-buffer USART3 RX and explicitly selected finite TX-DMA/continuous RX duplex, all with Cache off/on, with separate PLL384/Cache-off baremetal clock references; an optional independent V/D-Cache-off/AXI RGB565 DMA2D component	PCB, power, silicon revision and Cache coherence remain unobserved; finite RX has service/rearm gaps, while continuous RX has a bounded inactive-bank replacement deadline and explicit loss/stop; the new UART/SPI DMA modes accept only selected AXI SRAM, excluding PLL384 and FreeRTOS; Cache on requires exclusive complete 32-byte lines; no other selected DMA engine or running-state adoption; DMA2D has no TOML/factory route; Flash remains Cache off; software qualification is recorded against its exact source
STM32U575ZIT6Q / NUCLEO-U575ZI-Q single-state reference configuration	Cortex-M33F; 2 MiB Flash; 192 KiB SRAM1; externally established TZEN=0/SWAP_BANK=0, MSIS4 MHz and TIM2; GPIOA..H, USART1/2 IRQ bytes and IWDG; USART1 separately selects finite GPDMA TX, finite hardware-chain TX or bounded FIFO IRQ bytes; independent software fixtures add SPI1, I2C1, ADC4, TIM3 CH1, EXTI0/1, physical Flash, a pinless LPTIM2 RUN one-shot counter and prepared-LSE RTC AlarmA RUN polling; base assemblies use baremetal/FreeRTOS, with each new mode admitted against its exact configuration	PCB, SMPS, silicon revision, option bytes and VDDIO2 remain unmeasured; Cache off; ADC requires externally prepared VDDA/ASV; USART1 GPDMA supports only finite contiguous SRAM1 TX and retains IRQ-byte RX; hardware chains have at most three blocks and two private nodes, without general SG or cyclic chains; LPTIM2/RTC are baremetal RUN only; an external boot owner prepares the RTC backup domain; no RX DMA, LPDMA, autonomous low power, Stop/VBAT continuity, generic dual-domain factory or other RAM placement
Independent STM32U575 TZEN=1 split-domain reference	Externally preconfigured option bytes; two Runtime images, cold SAU/MPU/SRAM-attribution owner, actual CMSE SG; one unprivileged NonSecure Thread accesses restricted PC7 GPIO through synchronously copied messages	No physical-isolation acceptance; no OS, generic split-domain factory, NS task identity, asynchronous borrow/cross-domain DMA or product-image authentication; does not change default TZEN=0 assembly above
STM32F103RBT6 / NUCLEO-F103RB source reference	Cortex-M3 without FPU; 128 KiB Flash, 20 KiB SRAM; HSI8 and 16-bit TIM2; GPIO, USART2 IRQ bytes/finite DMA TX/duplex RX blocks, polling SPI1, I2C1 IRQ messages, PA0 ADC1, PA6 TIM3 CH1 PWM, EXTI0/1, IWDG and physical Flash; baremetal/FreeRTOS static assembly	Normal startup checks only the 128 KiB factory Flash density; ES096 2.2.2 prevents ordinary firmware from observing DBGMCU, so device group/revision remain unobserved and part/package are configuration declarations; PCB, VCP bridges, pin loads and HSI accuracy unobserved; PA5 LED/SPI and PA6 SPI/PWM conflicts must reject; priority-zero I2C cannot call a kernel; RX has gaps; no SPI/I2C DMA or support for other F1 parts
GD32F303RCT6 / chip software reference	Cortex-M4F; 256 KiB Flash, 48 KiB SRAM; IRC8M and TIMER1/TIMER4 hardware-cascaded time; GPIO, USART0 IRQ bytes/finite DMA TX/duplex RX blocks, polling SPI0, I2C0 IRQ messages, PA0 ADC0, PA6 TIMER2 CH0 PWM, EXTI0/1, FWDGT and physical FMC; baremetal/FreeRTOS static assembly	No reviewed PCB, LED, crystal, UART adapter or connector wiring; priority-zero I2C cannot call a kernel; RX has gaps; no SPI/I2C DMA or support for other F30x parts; cascade propagation and electrical behavior require physical measurement
Native	Linux/POSIX behavior model with actual threads/persistent-file fault models	No MCU or electrical qualification

Baremetal/pinned FreeRTOS are explicitly selected thin adapters. Startup establishes platform clocks/interfaces only, without schedulers, product tasks or workflows. FreeRTOS POSIX host execution verifies software lifecycle, not MCU IRQ ceilings, FPU context or physical stack high-water.

H743 uses official Cortex-M7 startup/bounded LDO entry and forbids RAM writes before ACTVOSRDY, establishing selected clocks/Cache from trusted HSI64/Cache-off cold state. Disabled Cache bits do not prove foreign dirty data clean; trusted reset/prior successful owned clean-disable is required. Default U575 Platform uses official Cortex-M33 startup/TZEN=0 single-address state. Independent TZEN=1 has separate entry/security owner. Reading option registers after startup cannot legalize incompatible startup. Neither changes option bytes or automatically takes over bootloaders, DMA or existing clock/IRQ owners. Original CMSIS Device H7/U5 bytes/licenses/versions are source-locked. Entries: H743, U575.

ThreadX is an additional explicit backend pinned to official Eclipse ThreadX 6.5.2.202603. Configuration maintains Cortex-M4 GNU on three F407/F470 Boards and Native Linux GNU. Independent CPU runtime maintains M4 integer/M4F hard-softfp with BASEPRI/PRIMASK policies; other Cortex-M ThreadX ports reject. Production graphs, actual Linux task/queue/join and three-board ARM links are verified separately. Linux pthread stacks/internal host allocations are not MCU cost. ThreadX implements none of this project’s FreeRTOS MPU/split-security/tickless modes. See ThreadX. Platform start enters no kernel; products enter explicitly. Running schedulers cannot lose clock/Tick through ordinary I/O shutdown.

CPU software additionally supports M0/M0+/M3/M4/M7/M23/M33/M55/M85. One strict fact parser selects Core/Arch/atomics/baremetal-FreeRTOS runtime. M0/M0+ RMW uses bounded saved-PRIMASK. Optional cache/MPU/SAU execute real CPU algorithms; FPU/MVE/security choose exact kernel ports/ABI. CPU-only runtime generates no SoC/Board/factory. H743/U575 slices separately own assembly/acceptance. Compilation, register models and actual FP/MVE/cache/MPU/security-world acceptance are recorded separately. cache.h range maintenance and M7-only cold control are separate; CMSE permission observation alone provides no user-memory pin/copy/transport. Restricted-MPU-task/split Secure-NonSecure runtime have independent software implementations with separately verified narrow delay/tick SVC, Secure-context leases and caller static storage. Default remains privileged single-world; MPU+split rejects; no physical HIL added. See Cortex-M and Arch contracts.

Launch modes

The complete peripheral table below applies only to the initial F407/F470 implementation. F103, GD303, G474, H743 and U575 maintain only the slices explicitly listed above and in their SoC contracts; they do not inherit this complete I/O table. The U575 dual-world synchronous GPIO reference is maintained separately. Chip names or generic interfaces do not imply additional peripherals, DMA, ThreadX or low-power modes.

Interface	Implemented modes and limits
GPIO	Authorized mask, atomic set/reset, snapshot read and single-writer toggle
UART	8N1 IRQ TX or bounded TX DMA; caller-owned requests, actual TC; IRQ RX blocks/IDLE, bounded/continuous RX DMA and duplex DMA; explicit RTS/CTS/external static RS485 adapter; STM minimum baud 1282, GD minimum 1526, maximum 1 Mbaud
SPI	8-bit MSB-first; short polling ≤256 bytes/transaction; bounded DMA ≤65535 bytes; incrementing bidirectional spans or caller one-byte fixed dummy/discard; one wire-active operation, complete CS interval, separate CS endpoints
I2C	100 kHz; ≤8 messages, read/write 1–256 bytes each; polling/IRQ/DMA messages; 1/2/final-three-byte ACK, repeated START/NACK/arbitration/STOP; recovery checks BUSY/selected SCL-SDA levels; separate bounded GPIO bus-clear tool
Flash	STM exact 16/64/128 KiB sectors and x32 program (4-byte alignment/length, declared 2.7–3.6 V); GD official independent 4 KiB page erase/halfword program; complete physical space with external restricted regions
Watchdog	Independent enable/feed/reset cause; successful nominal programming returns SUCCESS, activation is irreversible and failures after activation retain responsibility; F407 and GD470 currently report physical timeout bounds as 0/0 unknown; an enabled state query returns UNSUPPORTED while preserving enabled, irreversible and actual debug facts; failed preactivation LSI/debug cleanup can be retried through Platform stop
EXTI	Selected lines, shared vectors, caller-sized event queues, visible loss/coalescing; no debounce policy
PWM	Fixed timer/channel/base, CCR shadow, 0/100%, safe inactive; public stop permits restart, platform teardown releases owner
ADC	Reviewed channels, single-shot/low-rate scan, bounded/continuous double-buffer timer-triggered DMA blocks; explicit sample time/reference; complete scans only; optional external sequences/software observation timestamps
Classic CAN	11/29-bit DATA/RTR, 0–8 bytes, three real mailboxes/shared filter domain, explicit abort/bus-off recovery; no CAN FD/automatic retransmission
USB FS device	Internal-PHY PIO, EP0 control IN/OUT64, EP1–3 bulk IN/OUT MPS8/16/32/64 B and interrupt IN MPS1–64 B, packet loans, SETUP epochs, reset/stop drain and an independent 48 MHz owner; a separate optional activation face explicitly manages nonzero direction active state and masks, with only EP0 active at cold start; after actual reset drain, software masks and withdraws nonzero active state, requiring explicit enable with the current epoch; the external owner supplies Chapter 9 configuration transactions and rollback; no Host/HS/DMA/ISO/class stack

F407 dma-tx explicitly selects official HAL finite TX and disjoint LL IRQ byte/event RX under one private static provider. Public faces, shared readonly ops, cancellation, drain and borrow contracts remain; other UART modes retain their existing engines. Only UART/DMA/RCC C units and reviewed headers enter the private build; HAL_Init is not called and HAL SysTick is not started; no support is granted to other HAL modules. See official driver integration for the exact callback ABI, IRQ deferral, held EN/TE, clock and full withdrawal contract. Models, factory, ARM/SDK, same-contract resource comparisons and physical HIL are accepted separately; reuse does not imply lower cost.

F407 uses nominal period (RLR + 1) × divisor / 32000, while GD470 uses (RLD × divisor + 1) / 32000; the formulas are not interchangeable. The F407 datasheet characterizes 17..47 kHz at VDD=3 V and TA=-40..105 °C; no current operating profile declares these conditions. The GD470 datasheet provides only the typical IRC32K frequency, without a reviewed guaranteed Min/Max. Both therefore report unknown physical bounds. SUCCESS means nominal register programming completed, not that a physical timeout was proved. An UNSUPPORTED query after activation does not mean the counter is disabled. Products requiring guaranteed timing must reject profiles that do not satisfy their timing contract before irreversible activation.

USB configuration/factory actually ARM-links on software-Board fixtures for both STM packages/GD470. Default reference Boards expose no automatic USB connector/VBUS electrical facts. vbus_sensing=true rejects absent reviewed electrical facts. PA11/PA12 AF10 silicon routes prove no actual jumpers/power/VBUS/ESD; CAN1/USART1-flow-control conflicts must reject. See USB packet contract.

The following slices have independent production mechanisms/development evidence. Final configuration/SDK/full-image integration are accepted separately. One passed model cannot mean whole-platform/reference-PCB acceptance.

Optional mechanism	Exact scope and current boundary
Existing raw Ethernet eth / MDIO / DP83848	Native/ST/GD normal chained descriptors, RMII, 14–1514-byte untagged Ethernet II and caller-owned RX loans; ETH/MDIO faces share one MAC context; ST ZG/GD ZG software fixtures have factory and baremetal/FreeRTOS ELF checks; this face has no SG, VLAN or hardware timestamps; no protocol stack, checksum offload or jumbo frames
Enhanced Ethernet eth_frames / MDIO	Exact F407/GD470 RMII references and a Native model; rmii-vlan-sg-ptp selects independent state, eight-word descriptors, complete SG frame loans, one in-band VLAN C-tag and MAC hardware-event timestamps; baremetal software fixtures with separate development evidence; it cannot share a MAC with the existing eth face; no tag insertion/stripping, checksum offload, jumbo frames, network clock synchronization or protocol stack; physical execution is pending
Input capture	STM TIM4 CH1 / GD TIMER3 CH0, PB6 AF2, 16-bit modulo counts, caller event rings; software observation time is not edge aperture; assembly integration separately accepted
Complementary PWM / break	STM TIM1 / GD TIMER0, PA8/PB13/PB12 AF1; immutable exact deadtime/BKIN, no automatic restart; no power-stage safety qualification
User I/O broker	Privileged-kernel scalar GPIO read/set-reset with actual principal/pin/copy/unpin narrow ports; independent OS-free U575 synchronous CMSE gateway; no generic SVC/multitask-userspace transport/asynchronous user DMA

Reference Boards do not declare Ethernet PHY/REFCLK/reset wiring by default. The optional Qiming ZG RMII source uses PG11/13/14 and therefore does not authorize the VE100 package; Sky and Liangshan have no reviewed PHY route. Protocols, cables, PHY power/reset, product MAC addresses and recovery policies remain external. See Ethernet, enhanced frames, advanced timers, the user I/O broker and G474.

G474 package GPIO, six UARTs, SPI1/2, IWDG and PA0/PA1 EXTI each have explicit production implementations and generated fixtures. LPUART1, USART1/2/3 and UART4/5 maintain IRQ bytes only. SPI uses 8-bit words, modes 0..3, explicit active-low CS and at most 256 bytes per call; the current 170 MHz profile admits requested SCK from 664063 Hz to 42.5 MHz. There is no DMA, RX event/block mode or arbitrary automatic AF selection. Actual wiring still requires Board authorization. Source, budget, method-retention and vector checks do not establish the physical MCU, X3 crystal, VCP/LD2 bridges or SPI electrical behavior. Initial SoC records preserve their historical code revision; extension records bind later source and evidence separately. Offline reproduction and candidate sealing have independent exits and cannot inherit the earlier F407/F470 candidate qualification.

G474 fixed-pwm maintains only TIM3 CH1/PA6 AF2 and TIM4 CH1/PB6 AF2, each owning the whole controller. tick_hz must divide the 170 MHz clock exactly with an integer divisor from 1..65536. Fixed periods are 1..65535 ticks and duty is 0..period, active-high and edge-aligned, with explicit 0/100% handling. Stop observes CCER/CEN disabled before establishing the Board-declared GPIO inactive level. An unproved stop retains the fault and clock lease for private close retry. PA6 conflicts with SPI1 MISO. Shared timer bases, complementary outputs, capture, break, PWM IRQ and DMA are not provided. Models, factory and ARM fixtures do not establish physical output frequency, loads or electrical safety.

H743 USART3 dma-tx uses DMA1 Stream0 and DMAMUX1 channel0/request46, retaining an IRQ-byte RX ring; rx-dma-idle uses DMA1 Stream1 and DMAMUX1 channel1/request45, retaining IRQ TX. These are explicit alternatives, without automatic DMA duplex composition. Only selected initialized AXI SRAM/D2 SRAM1 is admitted. Cache off accepts 1..65535 bytes per block/request; Cache on requires 32-byte-aligned addresses and lengths up to 65504 bytes with exclusive complete cache lines. TX starts after clean; RX invalidates before DMA and after drain, publishing a full block or IDLE prefix only after stable remaining-count observation and maintenance. Unjoined references, channels, DMAR or cache maintenance retain the borrow; consumer-held blocks retain the stream and platform dependencies. These two finite modes publish and rearm through owner service and may have gaps; they do not provide circular or double-buffer RX or extend other DMA engines, RAM placement or runtime clock changes. Cache configuration remains fixed throughout the platform lifecycle; all providers must drain before the timebase and Cache close.

The separate rx-dma-continuous mode requires H743 V, HSI64, baremetal and initialized AXI SRAM, using USART3, DMA1 Stream1/request45 and two DBM/CIRC hardware targets. Callers supply at least three equal nonoverlapping blocks: 32..65535 bytes with Cache off, or exclusive complete aligned 32-byte lines of 32..65504 bytes with Cache on. Task service replaces the inactive bank before the conservative replace_by derived from the correlated BRR/TIM2 domain, then completes Cache maintenance before publication; IRQs perform no Cache maintenance. A missed deadline, uncertain CT, Cache failure or no FREE block reports loss, stops production and retains loans until actual drain; it never overwrites old blocks or automatically rearms. IDLE closes this producer and publishes the drained prefix; callers must explicitly reinitialize the stream before starting again. TX remains independent finite IRQ, without DMA duplex. Development models and linking do not establish continuous lossless throughput, deadlines or HIL qualification.

Only a separately selected dma-duplex-continuous adds finite TX DMA to the exact V/HSI64/baremetal/AXI reference above, using DMA1 Stream0/request46 while RX retains Stream1/request45. Three vectors separately own TX DMA, RX DMA and USART duties. TX requests/payloads must be disjoint from the complete RX pool, slots and control storage. Cache-on TX uses exclusive aligned whole 32-byte lines, 32..65504 bytes; Cache-off accepts 1..65535 bytes. DMA TC, wire TC and borrow drain remain distinct. Cancellation does not revoke the borrow; failed drain retains QUARANTINED storage. Successful stop permits another normal startup; failed cold restoration retains responsibility. Clock/timer/Cache loss permanently taints the current retained lifetime. This mode does not extend RTOS, PLL384, D2 SRAM or physical throughput/Cache-coherency qualification.

The independent H743 SPI4 finite dma mode selects DEV_ID 0x450, REV_ID 0x2003 (V), HSI64/default trim, Cache off/on and baremetal. PE12/PE13/PE14 AF5 and PE11 active-low CS are software routes. DMA1 Stream2/3 handle RX/TX and admit only non-overlapping TX/RX spans in initialized AXI SRAM. Cache off accepts 1..65535 bytes; Cache on requires exclusive complete 32-byte lines, with aligned addresses and lengths of 32..65504 bytes. It may combine with independent USART3 Stream0 TX or Stream1 RX selections. PLL384, FreeRTOS, 16-bit, fixed dummy/discard and multisegment transfers are excluded. See the H743 provider contract.

U575 USART1 dma-tx selects GPDMA1 channel0/request25, TZEN0, MSIS4, 8N1 and Cache off, admitting only 1..65535 bytes in nonsecure SRAM1; RX retains its IRQ-byte ring. Under ES0499, DMAT persists until full UART stop proves UE/ACK withdrawal and joins both IRQs and publishers. DMA TCF cannot replace wire TC or final borrow drain. The separate irq-fifo-bytes mode has explicit thresholds and per-IRQ RX/TX byte budgets and does not combine with GPDMA. Neither mode extends USART2, TrustZone or low power; see finite GPDMA and the FIFO IRQ contract.

The separate dma-chain-tx mode reuses USART1, GPDMA1 channel0/request25 and IRQ-byte RX. One request still borrows a contiguous SRAM1 span, with a protocol limit of 196605 bytes that must also fit entirely in reachable RAM without overlapping live state, rings, facts or nodes; there are at most three blocks of at most 65535 bytes each. Two packed 12-byte private nodes form a 24-byte array, with the entire array aligned to 32 bytes within one 64 KiB CLBAR window. Nodes and payload remain live until fetch/channel/IRQ drain and independently observed UART TC. It does not enable SG, cyclic chains, RX DMA or autonomous low-power operation.

The independent pinless LPTIM2 irq-counter16-oneshot mode selects TZEN0, MSIS4, baremetal, nominal 1 MHz PCLK1/4 and IRQ68 priority5/calls_os=false. A one-shot accepts 2..65536 ticks; one tick returns UNSUPPORTED because hardware ARR must exceed reset CCR0. Cross-clock write synchronization, update completion and source drain are observed separately. It owns no external pin or DMA and promises no Stop, backup or VBAT continuity or physical timing accuracy. PCB and silicon revision of the reference remain unobserved.

The U575 TZEN0 Platform maintains selected GPIO, USART1/2 IRQ bytes, IWDG and the six finite peripheral classes above; GPIOH admits PH0/PH1/PH3 only. PG2..PG15 additionally require an external power owner to establish VDDIO2, the PWR clock and IO2SV. The Platform neither enables an unknown external supply nor treats IO2SV as a voltage measurement. Partitioning, the fixed principal and synchronous-borrow prerequisites of the independent TZEN=1 reference are defined by the TrustZone contract; they do not expand the TZEN=0 factory or authorize asynchronous cross-domain DMA.

F103’s 1 MHz TIM2 is 16-bit; overflow IRQ service and interrupt-mask intervals must remain below nominal 65.536 ms. GD303 uses TIMER1 update TRGO to drive TIMER4 in a hardware cascade, requiring high-overflow IRQ service within 4,294,967,296 µs; actual carry propagation still needs HIL. Both correct only one pending full wrap and do not turn software observation time into measured accuracy. Both SPI selections use 8-bit modes 0..3 and bounded polling, at most 256 bytes per call and 31.25 kHz..4 MHz. F103 uses SPI1 and GD303 SPI0. F103 PA5 connects both LED and SPI SCK, so conflicting selections reject. See F103 and GD303 for exact integration and failure-stop contracts; these slices do not grant whole-family or all-peripheral support.

F103/GD303 UART channel-DMA admits only declared SRAM spans of 1..65535 bytes. TX-only instances retain compact TX state and an IRQ-byte ring; duplex alone adds the caller’s receive-block extension. DMA TC cannot replace actual UART TC. Normal RX publishes after DMA withdrawal and stable count; owner service rearms with gaps and never overwrites a consumer loan. I2C fixes PB6/PB7, nominal 80 kHz and 7-bit addressing. Priority-zero receive windows preserve the incoming mask and reject kernel notifications; no implicit bus-clear is provided.

Finite contracts for added peripherals

The separate G474 acquisition fixture selects ADC1 PA0/IN1, 12-bit bulb sampling, SYSCLK/128=1.328125 MHz and sample code0. TIM6 normal-DMA blocks admit only 2.5–50 kHz rates dividing 1 MHz exactly. Aperture depends on the previous EOC and next trigger, not SMPR alone. Each activation discards the first conversion; publication follows trigger/DMA/ADC withdrawal and observed ADEN clear. A later service restarts with gaps. I2C1 PB8/PB9 uses independent HSI16 and fixed Standard-mode timing. G474 owns the exact warmup, calibration, errata and memory contracts.

New H743 finite peripherals use a separate software Board package; selecting SPI4, I2C1, PA3 ADC1, PA6 TIM3 and EXTI does not establish NUCLEO physical wiring. Optional D2 SRAM1 has independent budgeting and startup DATA/BSS initialization. Callers initialize NOINIT, and DMA rechecks the SRAM1 gate before borrowing. Cache-on DMA requires exclusively owned complete 32-byte lines. FIG-09’s AXI-only TX diagram is one exact reference, not an inventory of the added placements or finite RX modes. See the H743 contract.

U575 SPI1/I2C1/ADC4/PWM/EXTI/Flash remain TZEN0 selections. ADC4 shots require external VDDA, the power clock and ASV. SPI1 MISO and TIM3 CH1 share PA6, so their assemblies must be mutually exclusive. The separate TZEN1 reference only copies up to eight synchronous GPIO commands into private Secure storage; it supplies no generic dual-world factory or asynchronous transport for the new peripherals. See U575 and the dual-world contract.

Exact Flash	Physical geometry and program unit
F103RB	128 × 1 KiB page；2-byte halfword
GD303RC	128 × 2 KiB page；2-byte halfword
G474RE	DBANK=1, unswapped mapping; 256 × 2 KiB pages; 8-byte ECC doubleword
H743ZI	Two unswapped banks; 16 × 128 KiB sectors; 32-byte ECC flashword; Cache off
U575ZIQ	TZEN0/SWAP0；256 × 8 KiB page；16-byte ECC quadword

Public geometry.program_flags may set NX_FLASH_PROGRAM_REQUIRES_FRESH_ERASE, requiring callers to prove that an ECC program unit has received no other program pulse since a successful erase. FF readback cannot prove hidden ECC history; failed/interrupted pulses require another erase. Zero flags do not waive the selected provider’s own programming rules. All-FF source units skip the physical pulse. Every started pulse obtains fresh completion evidence and drains before return. Deadlines prevent later pulses rather than aborting hardware. Products explicitly own supply declarations, erase-aligned regions, same-bank fetch stalls, watchdog and power-loss recovery. Models and linking establish neither analog accuracy, measured pulse timing, Flash power-cut behavior nor Cache coherency; all HIL remains not_executed. Current source implementation and final clean-source software qualification are recorded separately without inherited historical counts.

Completion-flag latching is family-specific: F407/G474/U575 require their EOPIE and GD470 requires ENDIE. While the polling owner temporarily acquires these bits, the FLASH IRQ remains NVIC-disabled under exclusive admission with no active/pending state. Cleanup removes sources, locks and observes pending withdrawal. F103/GD303/H743 completion flags latch unconditionally under their register contracts; other families’ interrupt-enable requirements are not copied onto them. See the mainstream integration contract for pulse and cleanup requirements.

Ethernet fixtures retain exact TX/RX descriptors/RX buffers and admit only STM main SRAM128 KiB/GD main SRAM192 KiB. Development budget/retention on four ZG ARM graphs authorize no GD ADDSRAM/TCM, STM CCM, VE100 PG routes or product PHY. Independent cold review/clean-source SDK/physical qualification remain separate. Default references select no ETH/MDIO.

Exact bounded-DMA launch routes follow; the resolver rejects other controller/channel combinations.

Mode	STM32F407	GD32F470
UART TX DMA	USART1；DMA2 stream7 channel4	USART0；DMA1 channel7 selector4
UART RX DMA / duplex DMA	USART1; RX DMA2 stream2 channel4; TX as above	USART0; RX DMA1 channel2 selector4; TX as above
SPI full-duplex DMA	SPI1；DMA2 RXstream0／TXstream3 channel3	SPI4；DMA1 RXchannel3／TXchannel4 selector2
I2C message DMA	I2C1；DMA1 RXstream0／TXstream6 channel1	I2C0；DMA0 RXchannel0／TXchannel6 selector1
ADC bounded/continuous trigger blocks	ADC1；TIM3 TRGO；DMA2 stream4 channel0	ADC0；TIMER2 TRGO；DMA1 channel0 selector0

Reviewed software-Board configurations support STM32F407 I2C1/I2C2 and GD32F470 I2C0/I2C1 IRQ/DMA assembly/typed factories. Dual-controller fixtures have independent-instance isolation/real-SDK link evidence. Reference Boards expose declared bindings only; other silicon routes/actual wiring require separate review. See multicontroller ownership.

SPI DMA requires nonempty/nonoverlapping actual TX/RX spans; fixed-address directions access caller one-byte storage only. No scratch/implicit copy pool is allocated. Providers recheck actual memory domains/permissions; STM CCM/GD TCM cannot be DMA buffers. DMA TC is a memory fact; UART TC/SPI idle are line facts. Both drain proofs precede SETTLED. Cancellation/timeout/EN-disable refusal retain borrows in QUARANTINED.

UART irq-blocks keeps independent IRQ RX. rx-dma-idle uses bounded DMA/IDLE, rx-dma-continuous hardware double buffers; explicit dma-duplex/dma-duplex-continuous also exist. Caller blocks remain immutable after consumer acquire until matching-epoch release. Continuous modes reserve two hardware targets/replacement blocks. Replacement-address readback, bank/new-error checks precede old-block publication. No replacement means stop, never overwrite consumer loans. RX-only uses a separate read-only table without TX-DMA methods, corresponding linked code or an embedded TX-DMA extension. Only a duplex instance selects that separate extension. Actual RAM/Flash costs still require same-source linked ELF measurements; zero lifecycle overhead cannot be inferred. RTS/CTS does not replace capacity/drain. External RS485 supplies DE pin/polarity/setup-hold; actual UART TC precedes hold/DE withdrawal. See UART DMA/RS485.

ADC trigger-dma uses ordinary bounded DMA: stop trigger/conversion/memory writes per block before publishing complete blocks. Callers explicitly service stabilization/GD calibration before next trigger. No free loan means pause without overwriting/invented exact missed samples. Inter-block gaps are expected. trigger-dma-continuous explicitly selects hardware double buffers/preposted blocks, publishing after successful replacement; at least three caller slots are needed. Frequency must satisfy exact timer division/full scan time. GD continuous selects SDK sample-time codes; bounded mode retains 15-cycle samples. Optional timestamps are software publication observations, not sampling apertures. One latched TC/CT cannot count unobserved multiple rounds. Stop with outstanding loans returns BUSY.

I2C IRQ/DMA share a V1 register algorithm checked against both SDK layouts/bits; MCU hot paths access registers directly. DMA TC is not wire completion. Final byte/BTF/STOP-MSL/DMA-EN/IRQ publishers drain before SETTLED. Separate bus-clear requires quiescent peripherals, exclusive open-drain GPIO and bounded waits; at most nine completed pulses. STOP/release failure retains leases for cleanup retries. No automatic pin switching occurs on unreviewed Boards. See I2C recovery.

These are SoC implementation capabilities. Default reference bindings, software-fixture routes and field measurements are independent. STM defaults declare no qualifiable SPI CS; resource matrices measure only empty/GPIO/UART, so fixture SPI does not qualify reference-board SPI. Default GD SPI4 PF6/7/8/9 has public provenance; external NOR exact part remains unknown.

Explicit boundaries

Continuous modes promise no losslessness under arbitrary IRQ latency/consumer speed. I2C reads beyond 256 bytes, dynamic clocks, deep sleep/STOP, secure boot/update and unmaintained modes are unavailable. FreeRTOS lowpower_port="timebase" uses shallow Sleep only on fixed F407/GD470 profiles, requiring SysTick/tickless/single-privileged/no-MPU. Default custom adds no sleep mechanism; CPU-only runtime without SoC timebase rejects the choice. Actual phase/clock continuity/wake latency/power are physically unexecuted; see shallow sleep. Unsupported configurations reject explicitly rather than claim support through successful stubs.

Deadlines cannot cancel Flash pulses; uncleared BUSY retains responsibility. Products own Flash stalls/voltage/watchdog windows/power cuts/authentication/layout/persistent-format migration. Generic storage CRC/commit is not a secure-update protocol.

GD32 Flash relock-readback failure retains static providers/rejects further operations and requires controlled reset; ordinary stop cannot recover it. tests/google/gd32_flash_fault_test.cpp checks postfault read/write/controller-reacquisition refusal, without physical qualification. See security review for lifecycle/scan diagnostics.

Hardware is disconnected. Clock/reset/GPIO-safe-output/UART-TC-abort-RX/SPI-I2C-electrical/Flash-power-cut/watchdog-reset/EXTI-waveform/PWM/ADC-precision execution is absent for every MCU target. Current support cannot replace physical HIL or product-release promotion.