RP2040: avoid XIP hangs during flash operations with scheduler=cores by rdon-key · Pull Request #5411 · tinygo-org/tinygo

rdon-key · 2026-05-20T12:34:37Z

RP2040 flash program / erase / command operations temporarily disable XIP.
With scheduler=cores, the other core may continue executing instructions from XIP flash during that window, which can cause a system hang.

What was done

This change adds an RP2040-specific flash-safe section.

Runtime changes:

For scheduler=cores, send a SIO FIFO command to the other core before starting a flash operation.
The interrupted core enters a RAM-resident flash-safe handler and waits there until the flash operation is complete.
The core performing the flash operation waits until the other core has entered the handler before disabling XIP.
For non-cores schedulers, keep the existing local interrupt disable / restore behavior.
Add a build-only RP2350 stub handler so shared RP2 runtime code continues to compile without changing RP2350 behavior.

Machine changes:

Wrap flash_range_write
Wrap flash_erase_blocks
Wrap flash_do_cmd

These flash operations now run inside rp2040EnterFlashSafeSection / rp2040ExitFlashSafeSection.

Notes

This is intentionally limited to RP2040 flash operations that temporarily disable XIP.
It is not intended to be a general multicore lock.

Other shared peripherals should be protected by their own ownership or locking rules.

RP2350 behavior is intentionally left unchanged.
The RP2350 handler added here is only a build-only stub for shared RP2 runtime code.

If the monitor output becomes corrupted under scheduler=cores, for example:

sta100
multi-core scheduler:
slected flash : 0
seedflashs0
run0oe: at
p e
ease re

please also test this reproducer with pull request #5391:

https://github.com/tinygo-org/tinygo/pull/5391

That output corruption appears to be a separate USB CDC multicore output issue, and it can make the flash test result difficult to read.

Reproducer

Warning: Flash memory has a limited number of program/erase cycles. This reproducer repeatedly erases and writes flash, so run it only when needed.

main.go

//go:build tinygo && rp2040

package main

import (
	"machine"
	"runtime"
	"sync/atomic"
	"time"
	"unsafe"
)

const maxRounds uint32 = 100
const writeSize = 4096

const sioCPUID = uintptr(0xd0000000)

func coreID() uint32 {
	return *(*uint32)(unsafe.Pointer(sioCPUID))
}

func alignDown(v uintptr, align uintptr) uintptr {
	return v & ^(align - 1)
}

func roundUp(v int64, align int64) int64 {
	return (v + align - 1) &^ (align - 1)
}

func safeFlashOffset(round uint32) int64 {
	start := uintptr(machine.FlashDataStart())
	end := uintptr(machine.FlashDataEnd())
	eraseSize := uintptr(machine.Flash.EraseBlockSize())
	testSpan := uintptr(roundUp(writeSize, int64(eraseSize)))

	if eraseSize == 0 || eraseSize&(eraseSize-1) != 0 {
		println("invalid erase block size")
		for {
		}
	}

	if end <= start || end-start < testSpan {
		println("not enough writable flash data area")
		for {
		}
	}

	// Compute the number of usable erase-aligned regions and rotate the offset
	// per round so that we don't repeatedly erase/program the same sector.
	// main rotates DOWN from the top of the data region.
	lastAligned := alignDown(end-testSpan, eraseSize)
	available := (lastAligned-start)/eraseSize + 1

	rotated := uintptr(round) % available
	absOffset := lastAligned - rotated*eraseSize
	relOffset := absOffset - start

	println("selected flash abs offset:", absOffset)
	println("selected flash rel offset:", relOffset)

	return int64(relOffset)
}

var writeBuf [writeSize]byte
var readBuf [writeSize]byte

// Worker observability.
//   workerDone:   0 = continue, 1 = stop requested, 2 = stopped
//   workerCore:   99 = not started, otherwise the core id worker is running on
//   workerWrites: number of successful flash writes performed by the worker
var (
	workerDone   uint32
	workerCore   uint32 = 99
	workerWrites uint32
)

// Worker writes to a fixed low offset, well separated from main's rotating
// range (main covers the top sectors of the data region). The two never write
// to the same sector during a single test run.
const workerWriteOffset = int64(0)

var workerWriteBuf [writeSize]byte

// Exactly 256 bytes: 4 lines x 64 chars.
const chunk256 = "" +
	"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" +
	"fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210" +
	"00112233445566778899aabbccddeeffffeeddccbbaa99887766554433221100" +
	"rp2040xipcacheflashworkerrandomaccesstestdataAAAAAAAAAAAAAAAAAAA"

// 4096 bytes (4 KB).
const block4k = chunk256 + chunk256 + chunk256 + chunk256 +
	chunk256 + chunk256 + chunk256 + chunk256 +
	chunk256 + chunk256 + chunk256 + chunk256 +
	chunk256 + chunk256 + chunk256 + chunk256

// 65536 bytes (64 KB). Large enough to overflow the 16 KB XIP cache on RP2040.
const flashData = block4k + block4k + block4k + block4k +
	block4k + block4k + block4k + block4k +
	block4k + block4k + block4k + block4k +
	block4k + block4k + block4k + block4k

func fillWriteBuffer(round uint32) {
	seed := byte(0x5a ^ byte(round*37))
	for i := range writeBuf {
		writeBuf[i] = byte(i) ^ seed
	}
}

func readFlash(label string, off int64) {
	for i := range readBuf {
		readBuf[i] = 0
	}
	n, err := machine.Flash.ReadAt(readBuf[:], off)
	if err != nil {
		println(label, "readback error:", err.Error())
		for {
		}
	}
	if n != len(readBuf) {
		println(label, "readback length mismatch:", n)
		for {
		}
	}
}

func verifyWrite(round uint32) {
	for i := range readBuf {
		if readBuf[i] != writeBuf[i] {
			println("write readback mismatch round:", round, "index:", i, "got:", readBuf[i], "want:", writeBuf[i])
			for {
			}
		}
	}
	println("write readback ok")
}

func verifyErase(round uint32) {
	for i := range readBuf {
		if readBuf[i] != 0xff {
			println("erase readback mismatch round:", round, "index:", i, "got:", readBuf[i])
			for {
			}
		}
	}
	println("erase readback ok")
}

func eraseFlash(label string, off int64) {
	eraseSize := machine.Flash.EraseBlockSize()
	eraseStart := off / eraseSize
	eraseBlocks := roundUp(writeSize, eraseSize) / eraseSize

	println(label, "erase start")
	err := machine.Flash.EraseBlocks(eraseStart, eraseBlocks)
	if err != nil {
		println(label, "erase error:", err.Error())
		for {
		}
	}
	println(label, "erase done")
}

// worker exercises the system from the second core:
//   1. Continuous random reads from a 64 KB flash-resident const array.
//      This defeats the 16 KB XIP cache and produces sustained flash
//      instruction/data traffic, which is required to make the bug
//      observable on stock TinyGo.
//   2. Periodic flash writes to a fixed low offset. This forces the
//      worker and main to race for rp2040EnterFlashSafeSection, which
//      is what the flash-safe spinlock fix is supposed to serialize.
func worker() {
	core := coreID()
	atomic.StoreUint32(&workerCore, core)
	println("worker started on core:", core)

	led := machine.LED
	led.Configure(machine.PinConfig{Mode: machine.PinOutput})

	// Distinct pattern so the worker's flash content differs from main's.
	for i := range workerWriteBuf {
		workerWriteBuf[i] = byte(i) ^ 0xa5
	}

	eraseSize := machine.Flash.EraseBlockSize()

	x := uint32(0x12345678)
	sum := uint32(0)
	writes := uint32(0)

	for atomic.LoadUint32(&workerDone) == 0 {
		// Hammer the XIP cache with random reads.
		for n := 0; n < 8192; n++ {
			x = x*1664525 + 1013904223
			i := int(x % uint32(len(flashData)))
			sum += uint32(flashData[i])
		}
		led.Set((sum & 0x800000) != 0)

		// Periodically write to flash. (sum & 0xff) == 0 fires roughly
		// once every couple hundred outer iterations -> enough overlap
		// chance with main's flash ops without burning the sector too
		// hard.
		if (sum & 0xff) == 0 {
			if err := machine.Flash.EraseBlocks(workerWriteOffset/eraseSize, 1); err == nil {
				if _, err := machine.Flash.WriteAt(workerWriteBuf[:], workerWriteOffset); err == nil {
					writes++
					atomic.StoreUint32(&workerWrites, writes)
				}
			}
		}
	}

	led.Low()
	atomic.StoreUint32(&workerDone, 2)
}

func main() {
	time.Sleep(2 * time.Second)

	numCPU := runtime.NumCPU()
	workerStarted := numCPU > 1

	println("start")
	println("NumCPU:", numCPU)
	println("main core:", coreID())
	println("flashData size:", len(flashData))
	println("max rounds:", maxRounds)

	if workerStarted {
		println("multi-core scheduler: worker may run concurrently (with concurrent flash writes)")
	} else {
		println("single-core scheduler: worker will not be started")
	}

	// Sanity-check sizes at runtime as well.
	if len(chunk256) != 256 {
		println("WARN: chunk256 size unexpected:", len(chunk256))
	}
	if len(flashData) != 65536 {
		println("WARN: flashData size unexpected:", len(flashData))
	}

	for round := uint32(0); round < maxRounds; round++ {
		fillWriteBuffer(round)
	}

	if workerStarted {
		go worker()
	}

	for round := uint32(0); round < maxRounds; round++ {
		flashOffset := safeFlashOffset(round)
		fillWriteBuffer(round)

		println("round:", round,
			"main core:", coreID(),
			"worker core:", atomic.LoadUint32(&workerCore),
			"worker writes:", atomic.LoadUint32(&workerWrites),
		)

		eraseFlash("prepare", flashOffset)
		readFlash("prepare", flashOffset)
		verifyErase(round)

		println("write start")
		n, err := machine.Flash.WriteAt(writeBuf[:], flashOffset)
		if err != nil {
			println("write error:", err.Error())
			for {
			}
		}
		println("write done:", n)
		if n != len(writeBuf) {
			println("write length mismatch:", n)
			for {
			}
		}

		readFlash("write", flashOffset)
		verifyWrite(round)

		eraseFlash("final", flashOffset)
		readFlash("final", flashOffset)
		verifyErase(round)
	}

	if workerStarted {
		println("requesting worker stop")
		atomic.StoreUint32(&workerDone, 1)

		const maxSpin = 100_000_000
		spun := 0
		for atomic.LoadUint32(&workerDone) != 2 && spun < maxSpin {
			spun++
		}

		if atomic.LoadUint32(&workerDone) == 2 {
			println("worker stopped cleanly")
		} else {
			println("worker did not stop within bound")
		}

		println("worker core:", atomic.LoadUint32(&workerCore))
		println("worker writes:", atomic.LoadUint32(&workerWrites))
	} else {
		println("worker was not started")
	}

	println("test finished")

	// Pure busy loop: keep main pinned to its current core.
	for {
	}
}

Test results

Tested on RP2040/Pico.

With `-scheduler=cores` (the failing case before this PR)

Reproducer: a worker goroutine on core 1 performs continuous random reads
from a 64 KB flash-resident const slice (which defeats the 16 KB XIP cache)
and periodic flash writes to a fixed low offset. Main on core 0 does
100 rounds of erase / write / read-back / verify on the top sectors of the
data region.

Before this PR: hangs at the first write start on core 0.

After this PR:

$ tinygo flash -target=pico -scheduler=cores -monitor main.go
start
NumCPU: 2
main core: 0
flashData size: 65536
max rounds: 100
multi-core scheduler: worker may run concurrently (with concurrent flash writes)
selected flash abs offset: 0x101ff000
worker started on core: 1
selected flash rel offset: 0x001eb000
round: 0 main core: 0 worker core: 1 worker writes: 0
prepare erase start
prepare erase done
erase readback ok
write start
write done: 4096
write readback ok
final erase start
final erase done
erase readback ok
...
round: 50 main core: 0 worker core: 1 worker writes: 79
prepare erase start
prepare erase done
erase readback ok
write start
write done: 4096
write readback ok
final erase start
final erase done
erase readback ok
...
round: 99 main core: 0 worker core: 1 worker writes: 155
prepare erase start
prepare erase done
erase readback ok
write start
write done: 4096
write readback ok
final erase start
final erase done
erase readback ok
requesting worker stop
worker stopped cleanly
worker core: 1
worker writes: 156
test finished

Evidence:

worker started on core: 1 and worker core: 1 in every round header
confirm the test condition (worker is actually running on core 1, not 0).
worker writes: N grows from 0 to 156, meaning the worker successfully
performed 156 flash writes concurrently with main's flash ops. Each of
those is a moment when both cores were contending for the flash-safe
section, exercising the spinlock added in this PR.
All 100 rounds of main's erase / write / read-back complete without
any mismatch or error, so the cross-core lockout protocol did not
corrupt either core's data.
worker stopped cleanly confirms no deadlock at shutdown.

With `-scheduler=tasks` (non-regression check)

$ tinygo flash -target=pico -scheduler=tasks -monitor main.go
start
NumCPU: 1
main core: 0
flashData size: 65536
max rounds: 100
single-core scheduler: worker will not be started
selected flash abs offset: 0x101ff000
selected flash rel offset: 0x001fb000
round: 0 main core: 0 worker core: 99 worker writes: 0
prepare erase start
prepare erase done
erase readback ok
write start
write done: 4096
write readback ok
final erase start
final erase done
erase readback ok
...
round: 99 main core: 0 worker core: 99 worker writes: 0
prepare erase start
prepare erase done
erase readback ok
write start
write done: 4096
write readback ok
final erase start
final erase done
erase readback ok
worker was not started
test finished

Single-core builds go through runtime_rp2040_flashsafe_single.go, which
is a plain interrupt.Disable() / interrupt.Restore() pair. 100 rounds
complete with no regression. worker core: 99 is the sentinel value
meaning the worker goroutine was never started (NumCPU == 1).

Symbol placement (`//go:section .ramfuncs`)

$ llvm-nm test.elf | grep rp2FlashSafe
10003314 t __Thumbv6MABSLongThunk_runtime.rp2FlashSafeInterruptHandler
20001184 t runtime.rp2FlashSafeInterruptHandler

rp2FlashSafeInterruptHandler is placed at 0x20001184 (RP2040 SRAM),
not in the XIP-mapped flash region. The flash-side symbol is the long-branch
thunk LLVM auto-generates for Cortex-M0; it is fetched while XIP is still
enabled, so it is safe.

rdon-key · 2026-06-09T13:01:07Z

Rebased onto the latest dev after #5391 (usb/cdc: fix RP2 USB CDC TX race with cores scheduler) was merged.

Re-ran the RP2040 Pico reproducer:

scheduler=cores: 100 rounds completed without hang, mismatch, or deadlock
scheduler=tasks: 100 rounds completed without regression

deadprogram · 2026-06-12T19:37:09Z

+	interrupt.Restore(state)
+}
+
+func rp2FlashSafeInterruptHandler(core uint32) {


You could add a comment here that it is a no-op on single core.

Good point, done.

deadprogram · 2026-06-12T19:37:31Z

+}
+
+func rp2FlashSafeInterruptHandler(core uint32) {
+	_ = core


If you add the above comment you can remove this line.

Good point, done.

deadprogram · 2026-06-12T19:37:56Z

+
+package runtime
+
+func rp2FlashSafeInterruptHandler(core uint32) {


Same feedback as above.

Good point, done.

rdon-key · 2026-06-13T17:01:53Z

Thank you for your review. I addressed the comments.

Also, the println / monitor output appears to be affected by a separate issue, so I attached a reduced test case with fewer messages.

Details

//go:build tinygo && rp2040

package main

import (
	"machine"
	"runtime"
	"sync/atomic"
	"time"
	"unsafe"
)

const maxRounds uint32 = 100
const writeSize = 4096

// Keep hot-loop progress off USB CDC. This test uses GP14/GP15 as the
// primary progress indicator so USB CDC problems don't hide as flash hangs.
const usbProgressLog = false

const (
	debugPhaseIdle    uint8 = iota
	debugPhasePrepare       // GP14 on
	debugPhaseWrite         // GP15 on
	debugPhaseFinal         // GP14 + GP15 on
)

var (
	debugLED0 = machine.GPIO14
	debugLED1 = machine.GPIO15
)

func initDebugLEDs() {
	debugLED0.Configure(machine.PinConfig{Mode: machine.PinOutput})
	debugLED1.Configure(machine.PinConfig{Mode: machine.PinOutput})
	setDebugPhase(debugPhaseIdle)
}

func setDebugPhase(phase uint8) {
	debugLED0.Set((phase & 1) != 0)
	debugLED1.Set((phase & 2) != 0)
}

func blinkDebug(phase uint8, count int) {
	for i := 0; i < count; i++ {
		setDebugPhase(phase)
		time.Sleep(100 * time.Millisecond)
		setDebugPhase(debugPhaseIdle)
		time.Sleep(100 * time.Millisecond)
	}
}

const sioCPUID = uintptr(0xd0000000)

func coreID() uint32 {
	return *(*uint32)(unsafe.Pointer(sioCPUID))
}

func alignDown(v uintptr, align uintptr) uintptr {
	return v & ^(align - 1)
}

func roundUp(v int64, align int64) int64 {
	return (v + align - 1) &^ (align - 1)
}

func safeFlashOffset(round uint32) int64 {
	start := uintptr(machine.FlashDataStart())
	end := uintptr(machine.FlashDataEnd())
	eraseSize := uintptr(machine.Flash.EraseBlockSize())
	testSpan := uintptr(roundUp(writeSize, int64(eraseSize)))

	if eraseSize == 0 || eraseSize&(eraseSize-1) != 0 {
		println("invalid erase block size")
		for {
		}
	}

	if end <= start || end-start < testSpan {
		println("not enough writable flash data area")
		for {
		}
	}

	// Compute the number of usable erase-aligned regions and rotate the offset
	// per round so that we don't repeatedly erase/program the same sector.
	// main rotates DOWN from the top of the data region.
	lastAligned := alignDown(end-testSpan, eraseSize)
	available := (lastAligned-start)/eraseSize + 1

	rotated := uintptr(round) % available
	absOffset := lastAligned - rotated*eraseSize
	relOffset := absOffset - start

	if usbProgressLog {
		println("selected flash abs offset:", absOffset)
		println("selected flash rel offset:", relOffset)
	}

	return int64(relOffset)
}

var writeBuf [writeSize]byte
var readBuf [writeSize]byte

// Worker observability.
//
//	workerDone:   0 = continue, 1 = stop requested, 2 = stopped
//	workerCore:   99 = not started, otherwise the core id worker is running on
//	workerWrites: number of successful flash writes performed by the worker
var (
	workerDone   uint32
	workerCore   uint32 = 99
	workerWrites uint32
)

// Worker writes to a fixed low offset, well separated from main's rotating
// range (main covers the top sectors of the data region). The two never write
// to the same sector during a single test run.
const workerWriteOffset = int64(0)

var workerWriteBuf [writeSize]byte

// Exactly 256 bytes: 4 lines x 64 chars.
const chunk256 = "" +
	"0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" +
	"fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210" +
	"00112233445566778899aabbccddeeffffeeddccbbaa99887766554433221100" +
	"rp2040xipcacheflashworkerrandomaccesstestdataAAAAAAAAAAAAAAAAAAA"

// 4096 bytes (4 KB).
const block4k = chunk256 + chunk256 + chunk256 + chunk256 +
	chunk256 + chunk256 + chunk256 + chunk256 +
	chunk256 + chunk256 + chunk256 + chunk256 +
	chunk256 + chunk256 + chunk256 + chunk256

// 65536 bytes (64 KB). Large enough to overflow the 16 KB XIP cache on RP2040.
const flashData = block4k + block4k + block4k + block4k +
	block4k + block4k + block4k + block4k +
	block4k + block4k + block4k + block4k +
	block4k + block4k + block4k + block4k

func fillWriteBuffer(round uint32) {
	seed := byte(0x5a ^ byte(round*37))
	for i := range writeBuf {
		writeBuf[i] = byte(i) ^ seed
	}
}

func readFlash(label string, off int64) {
	for i := range readBuf {
		readBuf[i] = 0
	}
	n, err := machine.Flash.ReadAt(readBuf[:], off)
	if err != nil {
		println(label, "readback error:", err.Error())
		for {
		}
	}
	if n != len(readBuf) {
		println(label, "readback length mismatch:", n)
		for {
		}
	}
}

func verifyWrite(round uint32) {
	for i := range readBuf {
		if readBuf[i] != writeBuf[i] {
			println("write readback mismatch round:", round, "index:", i, "got:", readBuf[i], "want:", writeBuf[i])
			for {
			}
		}
	}
	if usbProgressLog {
		println("write readback ok")
	}
}

func verifyErase(round uint32) {
	for i := range readBuf {
		if readBuf[i] != 0xff {
			println("erase readback mismatch round:", round, "index:", i, "got:", readBuf[i])
			for {
			}
		}
	}
	if usbProgressLog {
		println("erase readback ok")
	}
}

func eraseFlash(label string, off int64) {
	eraseSize := machine.Flash.EraseBlockSize()
	eraseStart := off / eraseSize
	eraseBlocks := roundUp(writeSize, eraseSize) / eraseSize

	if usbProgressLog {
		println(label, "erase start")
	}
	err := machine.Flash.EraseBlocks(eraseStart, eraseBlocks)
	if err != nil {
		println(label, "erase error:", err.Error())
		for {
		}
	}
	if usbProgressLog {
		println(label, "erase done")
	}
}

// worker exercises the system from the second core:
//  1. Continuous random reads from a 64 KB flash-resident const array.
//     This defeats the 16 KB XIP cache and produces sustained flash
//     instruction/data traffic, which is required to make the bug
//     observable on stock TinyGo.
//  2. Periodic flash writes to a fixed low offset. This forces the
//     worker and main to race for rp2040EnterFlashSafeSection, which
//     is what the flash-safe spinlock fix is supposed to serialize.
func worker() {
	core := coreID()
	atomic.StoreUint32(&workerCore, core)
	println("worker started on core:", core)

	led := machine.LED
	led.Configure(machine.PinConfig{Mode: machine.PinOutput})

	// Distinct pattern so the worker's flash content differs from main's.
	for i := range workerWriteBuf {
		workerWriteBuf[i] = byte(i) ^ 0xa5
	}

	eraseSize := machine.Flash.EraseBlockSize()

	x := uint32(0x12345678)
	sum := uint32(0)
	writes := uint32(0)

	for atomic.LoadUint32(&workerDone) == 0 {
		// Hammer the XIP cache with random reads.
		for n := 0; n < 8192; n++ {
			x = x*1664525 + 1013904223
			i := int(x % uint32(len(flashData)))
			sum += uint32(flashData[i])
		}
		led.Set((sum & 0x800000) != 0)

		// Periodically write to flash. (sum & 0xff) == 0 fires roughly
		// once every couple hundred outer iterations -> enough overlap
		// chance with main's flash ops without burning the sector too
		// hard.
		if (sum & 0xff) == 0 {
			if err := machine.Flash.EraseBlocks(workerWriteOffset/eraseSize, 1); err == nil {
				if _, err := machine.Flash.WriteAt(workerWriteBuf[:], workerWriteOffset); err == nil {
					writes++
					atomic.StoreUint32(&workerWrites, writes)
				}
			}
		}
	}

	led.Low()
	atomic.StoreUint32(&workerDone, 2)
}

func main() {
	time.Sleep(2 * time.Second)
	initDebugLEDs()
	blinkDebug(debugPhasePrepare, 1)
	blinkDebug(debugPhaseWrite, 1)

	numCPU := runtime.NumCPU()
	workerStarted := numCPU > 1

	println("start")
	println("NumCPU:", numCPU)
	println("main core:", coreID())
	println("flashData size:", len(flashData))
	println("max rounds:", maxRounds)

	if workerStarted {
		println("multi-core scheduler: worker may run concurrently (with concurrent flash writes)")
	} else {
		println("single-core scheduler: worker will not be started")
	}

	// Sanity-check sizes at runtime as well.
	if len(chunk256) != 256 {
		println("WARN: chunk256 size unexpected:", len(chunk256))
	}
	if len(flashData) != 65536 {
		println("WARN: flashData size unexpected:", len(flashData))
	}

	for round := uint32(0); round < maxRounds; round++ {
		fillWriteBuffer(round)
	}

	if workerStarted {
		go worker()
	}

	for round := uint32(0); round < maxRounds; round++ {
		flashOffset := safeFlashOffset(round)
		fillWriteBuffer(round)

		if usbProgressLog {
			println("round:", round,
				"main core:", coreID(),
				"worker core:", atomic.LoadUint32(&workerCore),
				"worker writes:", atomic.LoadUint32(&workerWrites),
			)
		}

		setDebugPhase(debugPhasePrepare)
		eraseFlash("prepare", flashOffset)
		readFlash("prepare", flashOffset)
		verifyErase(round)

		setDebugPhase(debugPhaseWrite)
		if usbProgressLog {
			println("write start")
		}
		n, err := machine.Flash.WriteAt(writeBuf[:], flashOffset)
		if err != nil {
			println("write error:", err.Error())
			for {
			}
		}
		setDebugPhase(debugPhaseFinal)
		if usbProgressLog {
			println("write done:", n)
		}
		if n != len(writeBuf) {
			println("write length mismatch:", n)
			for {
			}
		}

		readFlash("write", flashOffset)
		verifyWrite(round)

		eraseFlash("final", flashOffset)
		readFlash("final", flashOffset)
		verifyErase(round)
		setDebugPhase(debugPhaseIdle)
	}

	if workerStarted {
		println("requesting worker stop")
		atomic.StoreUint32(&workerDone, 1)

		const maxSpin = 100_000_000
		spun := 0
		for atomic.LoadUint32(&workerDone) != 2 && spun < maxSpin {
			spun++
		}

		if atomic.LoadUint32(&workerDone) == 2 {
			println("worker stopped cleanly")
		} else {
			println("worker did not stop within bound")
		}

		println("worker core:", atomic.LoadUint32(&workerCore))
		println("worker writes:", atomic.LoadUint32(&workerWrites))
	} else {
		println("worker was not started")
	}

	println("test finished")
	blinkDebug(debugPhaseFinal, 5)
	setDebugPhase(debugPhaseIdle)

	// Pure busy loop: keep main pinned to its current core.
	for {
	}
}

rdon-key · 2026-07-04T12:14:22Z

Rebased this branch onto current dev.

This branch conflicted with #5482, runtime/rp2: handle RP2350 shared FIFO IRQ for GC. During the rebase, I resolved the conflict by keeping the current per-chip SIO FIFO IRQ handler split introduced by #5482, and applying the flash-safe FIFO command handling to that structure instead of restoring the older inline handlers in runtime_rp2.go.

The resolved structure is:

RP2040: handle both GC and flash-safe FIFO commands in handleSIOFifoInterruptCore0/1.
RP2350: keep the shared FIFO IRQ handler from runtime/rp2: handle RP2350 shared FIFO IRQ for GC #5482 and route the flash-safe command to the RP2350 no-op stub.

Tested after the rebase:

GC stress test

pico / scheduler=tasks: PASS
pico / scheduler=cores: PASS
pico2 / scheduler=tasks: PASS
pico2 / scheduler=cores: PASS

Each target survived 10,000 cycles of runtime.Gosched() + runtime.GC().

RP2040 flash-safe stress test

pico / scheduler=tasks: PASS
pico / scheduler=cores: PASS

The flash-safe stress test completed 100 rounds successfully. Each round erased, read back, wrote, verified, and erased a flash sector again.

For scheduler=cores, another goroutine was running on the other core. It continuously generated XIP pressure by randomly reading from a 64 KB flash-resident const array, and also periodically performed flash erase/write operations to a separate sector.

Result:

all 100 rounds completed
all erase readbacks verified as 0xff
all write readbacks matched
worker stopped cleanly
worker completed 75 flash writes

I also ran the flash test on pico2 with scheduler=tasks as a sanity check. I did not run the pico2 scheduler=cores flash test, because this PR does not implement RP2350 flash-safe handling; the RP2350 flash-safe handler is intentionally a no-op stub, and the pico2 GC stress test already covers the shared FIFO IRQ path.

aykevl

Looks reasonable, a few comments below.

aykevl · 2026-07-05T12:00:35Z

+//
+// id: 24 is reserved here. ids 20-23 are already used by printLock,
+// schedulerLock, atomicsLock, futexLock (see runtime_rp2.go).
+var flashSafeLock = spinLock{id: 24}


Please either put this spinLock in runtime_rp2.go along with the rest (preferably), or add a comment there referring here that ID 24 is in use. Otherwise it's easy to miss this other spinlock when adding a new spinlock in the future.

Thanks. I moved flashSafeLock next to the other RP2 runtime spinLock definitions in runtime_rp2.go, so the spinLock IDs remain visible in one place.

aykevl · 2026-07-05T12:01:53Z

+	txbuf := make([]byte, len(tx))
+	copy(txbuf, tx)


Why does this need to be copied to a newly heap-allocated array, instead of just using tx directly?

Thanks, this is an important concern. I removed the unconditional RAM copy here.

I originally added it after seeing failures when the source buffer itself was placed in flash, but that is a separate pre-existing limitation: using an XIP flash address as the source buffer is not safe even with the tasks scheduler.

For this PR, I think it is better to rely on the caller passing a RAM-resident buffer, as before, and avoid adding an unconditional heap allocation. XIP-flash source buffers should be handled explicitly in a separate change, either by copying only when the source overlaps XIP flash or by returning an error for that case.

aykevl · 2026-07-05T12:03:58Z

+	buf := make([]byte, len(padded))
+	copy(buf, padded)


Same here, this is potentially very expensive. In fact, flashPad already can heap allocate if it isn't aligned and you're allocating even more here (where p can be a potentially large buffer).

Same here. I removed the unconditional RAM copy and now use the padded slice directly, so flashPad's buffer is not copied again.

aykevl · 2026-07-05T12:08:34Z

+}
+
+func rp2040FlashSafePauseCore(core uint32) {
+	_ = core // RP2040 SIO FIFO writes to the other core.


Nit: this isn't doing anything (though the comment is helpful and would be useful to keep)

Suggested change

_ = core // RP2040 SIO FIFO writes to the other core.

Done. I removed the unused assignment and kept the RP2040 SIO FIFO comment.

aykevl · 2026-07-05T12:11:20Z

+//
+//go:section .ramfuncs
+func rp2FlashSafeInterruptHandler(core uint32) {
+	_ = core


same here, is this for linter reasons? Right not it just adds noise.

Done. It wasn't for linter reasons; removing it doesn't cause any warning, so I removed the unused assignment here as well.

rdon-key · 2026-07-07T04:57:53Z

I addressed the review comments and re-ran the RP2040 flash-safe stress test with both scheduler=tasks and scheduler=cores. Both completed 100 rounds successfully after removing the unconditional RAM copies.

This PR is still scoped to RP2040 only; the RP2350 flash-safe handler remains a no-op stub. If this direction looks good, I'm happy to implement similar handling for RP2350 as well — would you prefer that here, or as a separate follow-up PR?

rdon-key force-pushed the rp2040-flashsafe-section branch from 59911c7 to 4c44c4a Compare June 9, 2026 12:50

deadprogram reviewed Jun 12, 2026

View reviewed changes

rdon added 9 commits July 4, 2026 19:53

runtime, machine: add RP2040 flash-safe section

ae60b18

runtime: harden flash-safe section for multicore

caa56da

machine: copy RP2040 flash write buffer to RAM

920df83

gofmt files

c907842

copy doFlashCommand tx buffer to RAM

51901b2

handle empty flash buffers

d1af9b4

name RP2 FIFO and flash-safe states

d9f4924

ci: rerun checks

7e24ce0

runtime: update comments for RP2 flash-safe no-op handlers

27373a0

rdon-key force-pushed the rp2040-flashsafe-section branch from e3dc1bd to 27373a0 Compare July 4, 2026 12:05

aykevl reviewed Jul 5, 2026

View reviewed changes

rdon-key added 2 commits July 7, 2026 01:56

runtime/rp2: keep flash-safe spinlock with runtime locks

c1f3c64

machine/rp2040: avoid unconditional flash buffer copies

ddc5485


		package runtime

		func rp2FlashSafeInterruptHandler(core uint32) {

Uh oh!

Uh oh!

Conversation

rdon-key commented May 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What was done

Notes

Reproducer

Test results

With -scheduler=cores (the failing case before this PR)

With -scheduler=tasks (non-regression check)

Symbol placement (//go:section .ramfuncs)

Uh oh!

rdon-key commented Jun 9, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rdon-key commented Jun 13, 2026

Uh oh!

rdon-key commented Jul 4, 2026

Uh oh!

aykevl left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

rdon-key commented Jul 7, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

rdon-key commented May 20, 2026 •

edited

Loading

With `-scheduler=cores` (the failing case before this PR)

With `-scheduler=tasks` (non-regression check)

Symbol placement (`//go:section .ramfuncs`)