Validate independent RP2350 cores through one Arm owner.

[jon]

Add an opt-in bench for two independently controlled Cortex-M33 targets borrowed from one armdebug.Conn. It exercises RP2350 core 0 at AP 0x2000 and core 1 at AP 0x4000, with separate RAM counters and serialized calls. Each target retains its own halt ownership and cleanup. Existing APIs suffice; library behavior is unchanged.

For an already-open owner c, acquire both targets and retain partial acquisition for cleanup. The caller supplies operation ctx and a live cleanupCtx, including after cancellation:

var cores [2]*cortexm.Target
var err error
for i, base := range []uint64{0x2000, 0x4000} {
    ap, e := dap.APAt(base)
    if e != nil {
        err = e
        break
    }
    memory, e := c.OpenMemAP(ctx, ap)
    if e != nil {
        err = e
        break
    }
    cores[i], err = cortexm.Acquire(ctx, memory)
    if err != nil {
        break
    }
}
if err == nil {
    err = cores[0].Halt(ctx)
}
if err == nil {
    var halted bool
    halted, err = cores[1].Halted(ctx)
    if err == nil {
        fmt.Printf("core 1 halted=%v\n", halted)
    }
}
if err == nil {
    err = cores[0].Resume(ctx)
}
var releaseErr error
for i := len(cores) - 1; i >= 0; i-- {
    releaseErr = errors.Join(releaseErr, cores[i].Release(cleanupCtx))
}
err = errors.Join(err, releaseErr)
if releaseErr == nil {
    err = errors.Join(err, c.Close())
}
// Retain targets and c if target cleanup fails; retain c if Close fails.

Why

The physical M33 evidence covered core 0. A second MEM-AP and processor do not by themselves establish independent control: inherited cross-trigger routing could couple their stops. This bench checks both CTIs before target acquisition and leaves their configuration untouched. Preparation also rejects conflicting debugger bank selection or missing Secure invasive debug permission before disabling core 1's Secure MPU. The test reads both counters during each observation window, so peer progress is measured while the selected core remains halted.

Both targets must release before their shared memory owner closes. If either target fails to release, the test retains the shared owner and reports which core needs cleanup. The test requests each halt separately; it does not provide a simultaneous halt, atomic memory snapshot, group ownership, or CTI coordination.

Hardware evidence

On Nostalgia, OpenOCD 0.12.0 prepared the supplied two-counter RAM image through J-Link EDU Mini V2 000802011345 at 1 MHz. Its binary SHA-256 is bf878b47815bc5eaf6afb5279efaa6ff163832bd178c5b7b1604f80e6ad6cde9. Preparation resets core 1, replaces RAM at 0x20040000–0x2004006f, disables core 1's Secure MPU for RAM entry, sets its Secure MSP, and replaces both cores' PC/XPSR/interrupt-mask state. All 28 image words are compared through both MEM-APs without running a target checksum algorithm. Flash, OTP, core-0 reset, and CTI routing are untouched; the previous volatile program state is not restored.

openocd -f target/cortexm/testdata/rp2350-dual-counter/prepare.cfg
OSTIOLE_RP2350_HIL_DUAL_CORE=1 \
OSTIOLE_RP2350_HIL_PROGRAM=bf878b47815bc5eaf6afb5279efaa6ff163832bd178c5b7b1604f80e6ad6cde9 \
go test -tags integration ./target/cortexm -run '^TestHILRP2350IndependentCores$' -count=1 -v

Two fresh Ostiole sessions used one shared Arm owner each, CPUID 0x411fd210 on both cores. Each read all 19 registers and checked one architectural step per core against PC/R0/RAM. Core 0's counter stopped while core 1 advanced, and the reverse held for core 1. After sequential halt requests both counters stopped; resuming only core 0 left core 1 stopped. Release from each owned halt restored counter progress.

Both sessions restored initially disabled halting debug and running state on both cores before Arm owner close, with DHCSR 0x01100000 before/after and DSCSR 0x00030000 unchanged. Both CTIs remained disabled and unrouted, with zero pending output/input-channel status and CTIGATE 0x0f unchanged. Both targets released and the shared owner closed successfully.

The programs run in Secure Thread mode with configurable interrupts disabled. This does not exercise simultaneous stopping, CTI propagation or acknowledgement, Non-secure execution, sleeping instructions, or cross-core failure recovery. Per-target cleanup failures have behavioral coverage; this bench does not inject failures. State after Arm owner close was not independently measured. Both loops remain running, and their instruction effects and preparation are not undone.

Documentation

Add the two-core composition and bench procedure to the Cortex-M guide, record its scope in the capability table, architecture and composition guides, and README, and include the counter source, linker script, and explicit OpenOCD preparation.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-02T01:17:43.622215Z	cfa7da2	Manual request
🔒 Security Review	✅ Completed 2026-10-02T01:18:23.329150Z	cfa7da2	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[jon]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

Reviewed commit: cfa7da2151

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".