Port firmware to ChibiOS 21.11.5

[PhysicistJohn]

Summary

Port both tinySA firmware targets from the historical ChibiOS fork to ChibiOS 21.11.5. This updates the RT7/HAL9 build, board, ADC, timer, PAL, USB, queue, stream-VMT, and interrupt APIs while preserving the established analyzer behavior. It also restores measured sweep/display/self-test timing and makes F303 fault entry stack-safe.

The branch is reconstructed directly on public upstream c979386; every commit uses the public noreply identity. No private development history or experimental feature framework is included.

ChibiOS dependency

The draft temporarily points .gitmodules at public integration commit db35f6df137058c612dc13e4488ac923219d881a in PhysicistJohn/chibios. That commit is exactly ver21.11.5 plus two focused fixes:

1. standalone STM32F0 TIM14 GPT ISR;
2. USBv1 endpoint-zero PMA preservation across endpoint reconfiguration.

Current-branch fixes are ChibiOS #84 and #85. Stable backports are draft ChibiOS #86 and #87. Before this PR is marked ready, the submodule URL and gitlink will be repointed to the canonical merged stable commit.

tinySA dependencies

This draft carries the changes from #164 (current zero-span grid) and #165 (deterministic backup checksum image) as explicit commits because the qualified ChibiOS candidate contains them. They will be rebased away or recognized automatically after those independent PRs merge. The scientific formatter fix in #163 is intentionally not included.

Build verification

Arm GNU 11.3.Rel1 clean builds pass without compiler warnings:

• F303: 192,940-byte BIN, 78.51% of 240 KiB flash;
• F072: 115,236-byte BIN, 97.01% of 116 KiB flash.

With SOURCE_DATE_EPOCH pinned to the port commit timestamp, two clean F303 builds are byte-identical. Final draft artifact SHA-256: 13f72e9ee9a80af170438958fc26029c516f6106c87aed9a45eea335a9a59fc9.

The final public binary passed destructive executable-twin fault qualification for both extended-FPU PSP origin and nested MSP origin: core and callee frames, EXC_RETURN, stack canaries, fatal-screen output, 1 KiB MSP, and 6,488-byte heap all passed with zero unexpected model warnings.

The same final exact image passed the complete executable-twin matrix:

• full UI restoration and frequency-selective modeled RF tone;
• all 14 positive self-tests;
• disconnected-CAL failure detection and recovery;
• USB enumeration, CDC, same-value and 1 -> 0 -> 1 reconfiguration, EP0 PMA ownership, STALL, and reset recovery;
• two boots plus RTC warm-reset restoration of frequency, mode, attenuation, and the zeroed checksum-covered reserved byte;
• 162 remote-redraw USB packets / 10,366 bytes;
• 660 bytes free on the sweep stack and 920 bytes free on MSP;
• zero unexpected model warnings.

Sealed local report SHA-256 values:

• general: d0556431e24758a9a50ef74973b49f326482ab59d2c82d9fcab2d5d47d1a9797;
• fault: 73a7fa6fe114467b29305a65091d5b7bd27d15e323f73555a46124e898ef145b;
• runtime state: c27620424a44cadb73f52acb07951b360d85ba3e8fcca8044b3332bbee1d9649.

Physical evidence and boundary

The predecessor RC5 image using the same application port and equivalent ChibiOS fixes was flashed to a tinySA Ultra+ ZS407. Exact DFU write/readback, USB runtime, warm reset retention, cold boot, and all fourteen built-in self-tests passed. A fresh official-versus-candidate A/B had one first-cold measured-level threshold failure in case 2; three repeats, including a second cold run, passed. No candidate-only persistent spur cluster was found.

This clean public commit has a different embedded version and binary hash. Keep the PR draft until:

• the final exact-image simulations complete;
• the ChibiOS stable dependencies have a canonical home;
• the clean public binary receives one physical cold-boot, USB, and all-14 self-test smoke run.

No firmware binary is being proposed as an official release in this PR.

[PhysicistJohn]

Physical qualification update (exact candidate 13f72e9e...)

Additional physical hardware results on the exact draft binary (SHA-256
13f72e9ee9a80af170438958fc26029c516f6106c87aed9a45eea335a9a59fc9,
tinySA4_v1.4-231-g5e02990), beyond what was in place when this PR was opened:

• True power-off cold boot + all-fourteen self-test: passed, all 14 cases,
  13/13 persisted-configuration observations retained. One case (a suppression
  peak check) initially measured 0.16 dB over its official-relative limit on
  first cold boot.
• Targeted cold retest of that case: a second true power-off (>=5s) cold
  boot plus a case-only recapture measured comfortably inside the limit
  (3.84 dB margin), quieter than both the official reference and an earlier
  warm repeat. This rules out a persistent regression; the original overage
  reads as a transient/startup effect, not a fault in the port.
• Disconnected-CAL failure/recovery control: both phases passed on real
  hardware — CAL-to-RF loopback physically disconnected (failure-path
  identity/screen/ACK/config checks passed), then reconnected (recovery-path
  checks passed).

Still open before this can leave draft, per the port doc's own checklist:

• physical CDC/USB-runtime and warm-reset-retention captures (blocked: no
  admitted DFU flash-evidence record exists yet for this exact candidate);
• RF, controls/touch, and acquisition checks (manual, no automated tooling
  written for these yet);
• F072 target hardware qualification (build evidence only so far).

No firmware binary is being proposed as an official release in this PR; it
remains draft pending the items above.