Merge commit '228fe7300c7df7aa05ba2c0bc19edde6d0156401' into from_upstream

Conflicts:
	doc/openocd.texi
	src/jtag/aice/aice_pipe.c
	src/jtag/aice/aice_usb.c
	src/rtos/FreeRTOS.c
	src/rtos/hwthread.c
	src/rtos/rtos_standard_stackings.c
	src/target/riscv/riscv.c

Change-Id: I0c6228c499d60274325be895fbcd8007ed1699bc

8 files changed, 208 insertions, 103 deletions

diff --git a/src/flash/nor/at91samd.c b/src/flash/nor/at91samd.c
index a0252a2..33e86c7 100644
--- a/src/flash/nor/at91samd.c
+++ b/src/flash/nor/at91samd.c
@@ -12,6 +12,7 @@
 #include "imp.h"
 #include "helper/binarybuffer.h"
 
+#include <helper/time_support.h>
 #include <jtag/jtag.h>
 #include <target/cortex_m.h>
 
@@ -31,7 +32,7 @@
 #define SAMD_NVMCTRL_CTRLA		0x00	/* NVM control A register */
 #define SAMD_NVMCTRL_CTRLB		0x04	/* NVM control B register */
 #define SAMD_NVMCTRL_PARAM		0x08	/* NVM parameters register */
-#define SAMD_NVMCTRL_INTFLAG	0x18	/* NVM Interrupt Flag Status & Clear */
+#define SAMD_NVMCTRL_INTFLAG	0x14	/* NVM Interrupt Flag Status & Clear */
 #define SAMD_NVMCTRL_STATUS		0x18	/* NVM status register */
 #define SAMD_NVMCTRL_ADDR		0x1C	/* NVM address register */
 #define SAMD_NVMCTRL_LOCK		0x20	/* NVM Lock section register */
@@ -55,6 +56,9 @@
 /* NVMCTRL bits */
 #define SAMD_NVM_CTRLB_MANW 0x80
 
+/* NVMCTRL_INTFLAG bits */
+#define SAMD_NVM_INTFLAG_READY 0x01
+
 /* Known identifiers */
 #define SAMD_PROCESSOR_M0	0x01
 #define SAMD_FAMILY_D		0x00
@@ -497,7 +501,27 @@ static int samd_probe(struct flash_bank *bank)
 static int samd_check_error(struct target *target)
 {
 	int ret, ret2;
+	uint8_t intflag;
 	uint16_t status;
+	int timeout_ms = 1000;
+	int64_t ts_start = timeval_ms();
+
+	do {
+		ret = target_read_u8(target,
+			SAMD_NVMCTRL + SAMD_NVMCTRL_INTFLAG, &intflag);
+		if (ret != ERROR_OK) {
+			LOG_ERROR("Can't read NVM intflag");
+			return ret;
+		}
+		if (intflag & SAMD_NVM_INTFLAG_READY)
+			break;
+		keep_alive();
+	} while (timeval_ms() - ts_start < timeout_ms);
+
+	if (!(intflag & SAMD_NVM_INTFLAG_READY)) {
+		LOG_ERROR("SAMD: NVM programming timed out");
+		return ERROR_FLASH_OPERATION_FAILED;
+	}
 
 	ret = target_read_u16(target,
 			SAMD_NVMCTRL + SAMD_NVMCTRL_STATUS, &status);
@@ -543,7 +567,8 @@ static int samd_issue_nvmctrl_command(struct target *target, uint16_t cmd)
 	}
 
 	/* Issue the NVM command */
-	res = target_write_u16(target,
+	/* 32-bit write is used to ensure atomic operation on ST-Link */
+	res = target_write_u32(target,
 			SAMD_NVMCTRL + SAMD_NVMCTRL_CTRLA, SAMD_NVM_CMD(cmd));
 	if (res != ERROR_OK)
 		return res;
diff --git a/src/flash/nor/avrf.c b/src/flash/nor/avrf.c
index 0e2e263..1d317a1 100644
--- a/src/flash/nor/avrf.c
+++ b/src/flash/nor/avrf.c
@@ -64,6 +64,7 @@ static const struct avrf_type avft_chips_info[] = {
 	{"atmega324pa", 0x9511, 128, 256, 4, 256},
 	{"atmega644p", 0x960a, 256, 256, 8, 256},
 	{"atmega1284p", 0x9705, 256, 512, 8, 512},
+	{"atmega32u4", 0x9587, 128, 256, 4, 256},
 };
 
 /* avr program functions */
diff --git a/src/flash/nor/lpc2900.c b/src/flash/nor/lpc2900.c
index c30fa76..948def9 100644
--- a/src/flash/nor/lpc2900.c
+++ b/src/flash/nor/lpc2900.c
@@ -1132,9 +1132,9 @@ static int lpc2900_write(struct flash_bank *bank, const uint8_t *buffer,
 	 * reduced size if that fails. */
 	struct working_area *warea;
 	uint32_t buffer_size = lpc2900_info->max_ram_block - 1 * KiB;
-	while ((retval = target_alloc_working_area_try(target,
+	while (target_alloc_working_area_try(target,
 				 buffer_size + target_code_size,
-				 &warea)) != ERROR_OK) {
+				 &warea) != ERROR_OK) {
 		/* Try a smaller buffer now, and stop if it's too small. */
 		buffer_size -= 1 * KiB;
 		if (buffer_size < 2 * KiB) {
diff --git a/src/flash/nor/rp2040.c b/src/flash/nor/rp2040.c
index 667498c..b0d118b 100644
--- a/src/flash/nor/rp2040.c
+++ b/src/flash/nor/rp2040.c
@@ -50,6 +50,10 @@ struct rp2040_flash_bank {
 	const struct flash_device *dev;
 };
 
+/* guessed SPI flash description if autodetection disabled (same as win w25q16jv) */
+static const struct flash_device rp2040_default_spi_device =
+	FLASH_ID("autodetect disabled", 0x03, 0x00, 0x02, 0xd8, 0xc7, 0, 0x100, 0x10000, 0);
+
 static uint32_t rp2040_lookup_symbol(struct target *target, uint32_t tag, uint16_t *symbol)
 {
 	uint32_t magic;
@@ -87,7 +91,7 @@ static uint32_t rp2040_lookup_symbol(struct target *target, uint32_t tag, uint16
 }
 
 static int rp2040_call_rom_func(struct target *target, struct rp2040_flash_bank *priv,
-		uint16_t func_offset, uint32_t argdata[], unsigned int n_args)
+		uint16_t func_offset, uint32_t argdata[], unsigned int n_args, int timeout_ms)
 {
 	char *regnames[4] = { "r0", "r1", "r2", "r3" };
 
@@ -99,8 +103,7 @@ static int rp2040_call_rom_func(struct target *target, struct rp2040_flash_bank
 	}
 	target_addr_t stacktop = priv->stack->address + priv->stack->size;
 
-	LOG_DEBUG("Calling ROM func @0x%" PRIx16 " with %d arguments", func_offset, n_args);
-	LOG_DEBUG("Calling on core \"%s\"", target->cmd_name);
+	LOG_TARGET_DEBUG(target, "Calling ROM func @0x%" PRIx16 " with %u arguments", func_offset, n_args);
 
 	struct reg_param args[ARRAY_SIZE(regnames) + 2];
 	struct armv7m_algorithm alg_info;
@@ -112,11 +115,12 @@ static int rp2040_call_rom_func(struct target *target, struct rp2040_flash_bank
 	/* Pass function pointer in r7 */
 	init_reg_param(&args[n_args], "r7", 32, PARAM_OUT);
 	buf_set_u32(args[n_args].value, 0, 32, func_offset);
+	/* Setup stack */
 	init_reg_param(&args[n_args + 1], "sp", 32, PARAM_OUT);
 	buf_set_u32(args[n_args + 1].value, 0, 32, stacktop);
+	unsigned int n_reg_params = n_args + 2;	/* User arguments + r7 + sp */
 
-
-	for (unsigned int i = 0; i < n_args + 2; ++i)
+	for (unsigned int i = 0; i < n_reg_params; ++i)
 		LOG_DEBUG("Set %s = 0x%" PRIx32, args[i].reg_name, buf_get_u32(args[i].value, 0, 32));
 
 	/* Actually call the function */
@@ -125,42 +129,82 @@ static int rp2040_call_rom_func(struct target *target, struct rp2040_flash_bank
 	int err = target_run_algorithm(
 		target,
 		0, NULL,          /* No memory arguments */
-		n_args + 1, args, /* User arguments + r7 */
+		n_reg_params, args, /* User arguments + r7 + sp */
 		priv->jump_debug_trampoline, priv->jump_debug_trampoline_end,
-		3000, /* 3s timeout */
+		timeout_ms,
 		&alg_info
 	);
-	for (unsigned int i = 0; i < n_args + 2; ++i)
+
+	for (unsigned int i = 0; i < n_reg_params; ++i)
 		destroy_reg_param(&args[i]);
+
 	if (err != ERROR_OK)
-		LOG_ERROR("Failed to invoke ROM function @0x%" PRIx16 "\n", func_offset);
+		LOG_ERROR("Failed to invoke ROM function @0x%" PRIx16, func_offset);
+
 	return err;
+}
+
+/* Finalize flash write/erase/read ID
+ * - flush cache
+ * - enters memory-mapped (XIP) mode to make flash data visible
+ * - deallocates target ROM func stack if previously allocated
+ */
+static int rp2040_finalize_stack_free(struct flash_bank *bank)
+{
+	struct rp2040_flash_bank *priv = bank->driver_priv;
+	struct target *target = bank->target;
+
+	/* Always flush before returning to execute-in-place, to invalidate stale
+	 * cache contents. The flush call also restores regular hardware-controlled
+	 * chip select following a rp2040_flash_exit_xip().
+	 */
+	LOG_DEBUG("Flushing flash cache after write behind");
+	int err = rp2040_call_rom_func(target, priv, priv->jump_flush_cache, NULL, 0, 1000);
+	if (err != ERROR_OK) {
+		LOG_ERROR("Failed to flush flash cache");
+		/* Intentionally continue after error and try to setup xip anyway */
+	}
+
+	LOG_DEBUG("Configuring SSI for execute-in-place");
+	err = rp2040_call_rom_func(target, priv, priv->jump_enter_cmd_xip, NULL, 0, 1000);
+	if (err != ERROR_OK)
+		LOG_ERROR("Failed to set SSI to XIP mode");
 
+	target_free_working_area(target, priv->stack);
+	priv->stack = NULL;
+	return err;
 }
 
-static int stack_grab_and_prep(struct flash_bank *bank)
+/* Prepare flash write/erase/read ID
+ * - allocates a stack for target ROM func
+ * - switches the SPI interface from memory-mapped mode to direct command mode
+ * Always pair with a call of rp2040_finalize_stack_free()
+ * after flash operation finishes or fails.
+ */
+static int rp2040_stack_grab_and_prep(struct flash_bank *bank)
 {
 	struct rp2040_flash_bank *priv = bank->driver_priv;
+	struct target *target = bank->target;
 
 	/* target_alloc_working_area always allocates multiples of 4 bytes, so no worry about alignment */
 	const int STACK_SIZE = 256;
-	int err = target_alloc_working_area(bank->target, STACK_SIZE, &priv->stack);
+	int err = target_alloc_working_area(target, STACK_SIZE, &priv->stack);
 	if (err != ERROR_OK) {
 		LOG_ERROR("Could not allocate stack for flash programming code");
 		return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
 	}
 
 	LOG_DEBUG("Connecting internal flash");
-	err = rp2040_call_rom_func(bank->target, priv, priv->jump_connect_internal_flash, NULL, 0);
+	err = rp2040_call_rom_func(target, priv, priv->jump_connect_internal_flash, NULL, 0, 1000);
 	if (err != ERROR_OK) {
-		LOG_ERROR("RP2040 erase: failed to connect internal flash");
+		LOG_ERROR("Failed to connect internal flash");
 		return err;
 	}
 
 	LOG_DEBUG("Kicking flash out of XIP mode");
-	err = rp2040_call_rom_func(bank->target, priv, priv->jump_flash_exit_xip, NULL, 0);
+	err = rp2040_call_rom_func(target, priv, priv->jump_flash_exit_xip, NULL, 0, 1000);
 	if (err != ERROR_OK) {
-		LOG_ERROR("RP2040 erase: failed to exit flash XIP mode");
+		LOG_ERROR("Failed to exit flash XIP mode");
 		return err;
 	}
 
@@ -173,16 +217,27 @@ static int rp2040_flash_write(struct flash_bank *bank, const uint8_t *buffer, ui
 
 	struct rp2040_flash_bank *priv = bank->driver_priv;
 	struct target *target = bank->target;
-	struct working_area *bounce;
 
-	int err = stack_grab_and_prep(bank);
-	if (err != ERROR_OK)
-		return err;
+	if (target->state != TARGET_HALTED) {
+		LOG_ERROR("Target not halted");
+		return ERROR_TARGET_NOT_HALTED;
+	}
+
+	struct working_area *bounce = NULL;
 
-	const unsigned int chunk_size = target_get_working_area_avail(target);
-	if (target_alloc_working_area(target, chunk_size, &bounce) != ERROR_OK) {
+	int err = rp2040_stack_grab_and_prep(bank);
+	if (err != ERROR_OK)
+		goto cleanup;
+
+	unsigned int avail_pages = target_get_working_area_avail(target) / priv->dev->pagesize;
+	/* We try to allocate working area rounded down to device page size,
+	 * al least 1 page, at most the write data size
+	 */
+	unsigned int chunk_size = MIN(MAX(avail_pages, 1) * priv->dev->pagesize, count);
+	err = target_alloc_working_area(target, chunk_size, &bounce);
+	if (err != ERROR_OK) {
 		LOG_ERROR("Could not allocate bounce buffer for flash programming. Can't continue");
-		return ERROR_TARGET_RESOURCE_NOT_AVAILABLE;
+		goto cleanup;
 	}
 
 	LOG_DEBUG("Allocated flash bounce buffer @" TARGET_ADDR_FMT, bounce->address);
@@ -200,7 +255,8 @@ static int rp2040_flash_write(struct flash_bank *bank, const uint8_t *buffer, ui
 			bounce->address, /* data */
 			write_size /* count */
 		};
-		err = rp2040_call_rom_func(target, priv, priv->jump_flash_range_program, args, ARRAY_SIZE(args));
+		err = rp2040_call_rom_func(target, priv, priv->jump_flash_range_program,
+								 args, ARRAY_SIZE(args), 3000);
 		if (err != ERROR_OK) {
 			LOG_ERROR("Failed to invoke flash programming code on target");
 			break;
@@ -210,36 +266,32 @@ static int rp2040_flash_write(struct flash_bank *bank, const uint8_t *buffer, ui
 		offset += write_size;
 		count -= write_size;
 	}
+
+cleanup:
 	target_free_working_area(target, bounce);
 
-	if (err != ERROR_OK)
-		return err;
+	rp2040_finalize_stack_free(bank);
 
-	/* Flash is successfully programmed. We can now do a bit of poking to make the flash
-	   contents visible to us via memory-mapped (XIP) interface in the 0x1... memory region */
-	LOG_DEBUG("Flushing flash cache after write behind");
-	err = rp2040_call_rom_func(bank->target, priv, priv->jump_flush_cache, NULL, 0);
-	if (err != ERROR_OK) {
-		LOG_ERROR("RP2040 write: failed to flush flash cache");
-		return err;
-	}
-	LOG_DEBUG("Configuring SSI for execute-in-place");
-	err = rp2040_call_rom_func(bank->target, priv, priv->jump_enter_cmd_xip, NULL, 0);
-	if (err != ERROR_OK)
-		LOG_ERROR("RP2040 write: failed to flush flash cache");
 	return err;
 }
 
 static int rp2040_flash_erase(struct flash_bank *bank, unsigned int first, unsigned int last)
 {
 	struct rp2040_flash_bank *priv = bank->driver_priv;
+	struct target *target = bank->target;
+
+	if (target->state != TARGET_HALTED) {
+		LOG_ERROR("Target not halted");
+		return ERROR_TARGET_NOT_HALTED;
+	}
+
 	uint32_t start_addr = bank->sectors[first].offset;
 	uint32_t length = bank->sectors[last].offset + bank->sectors[last].size - start_addr;
 	LOG_DEBUG("RP2040 erase %d bytes starting at 0x%" PRIx32, length, start_addr);
 
-	int err = stack_grab_and_prep(bank);
+	int err = rp2040_stack_grab_and_prep(bank);
 	if (err != ERROR_OK)
-		return err;
+		goto cleanup;
 
 	LOG_DEBUG("Remote call flash_range_erase");
 
@@ -257,10 +309,15 @@ static int rp2040_flash_erase(struct flash_bank *bank, unsigned int first, unsig
 	https://github.com/raspberrypi/pico-bootrom/blob/master/bootrom/program_flash_generic.c
 
 	In theory, the function algorithm provides for erasing both a smaller "sector" (4096 bytes) and
-	an optional larger "block" (size and command provided in args).  OpenOCD's spi.c only uses "block" sizes.
+	an optional larger "block" (size and command provided in args).
 	*/
 
-	err = rp2040_call_rom_func(bank->target, priv, priv->jump_flash_range_erase, args, ARRAY_SIZE(args));
+	int timeout_ms = 2000 * (last - first) + 1000;
+	err = rp2040_call_rom_func(target, priv, priv->jump_flash_range_erase,
+							args, ARRAY_SIZE(args), timeout_ms);
+
+cleanup:
+	rp2040_finalize_stack_free(bank);
 
 	return err;
 }
@@ -289,11 +346,46 @@ static int rp2040_ssel_active(struct target *target, bool active)
 	return ERROR_OK;
 }
 
+static int rp2040_spi_read_flash_id(struct target *target, uint32_t *devid)
+{
+	uint32_t device_id = 0;
+	const target_addr_t ssi_dr0 = 0x18000060;
+
+	int err = rp2040_ssel_active(target, true);
+
+	/* write RDID request into SPI peripheral's FIFO */
+	for (int count = 0; (count < 4) && (err == ERROR_OK); count++)
+		err = target_write_u32(target, ssi_dr0, SPIFLASH_READ_ID);
+
+	/* by this time, there is a receive FIFO entry for every write */
+	for (int count = 0; (count < 4) && (err == ERROR_OK); count++) {
+		uint32_t status;
+		err = target_read_u32(target, ssi_dr0, &status);
+
+		device_id >>= 8;
+		device_id |= (status & 0xFF) << 24;
+	}
+
+	if (err == ERROR_OK)
+		*devid = device_id >> 8;
+
+	int err2 = rp2040_ssel_active(target, false);
+	if (err2 != ERROR_OK)
+		LOG_ERROR("SSEL inactive failed");
+
+	return err;
+}
+
 static int rp2040_flash_probe(struct flash_bank *bank)
 {
 	struct rp2040_flash_bank *priv = bank->driver_priv;
 	struct target *target = bank->target;
 
+	if (target->state != TARGET_HALTED) {
+		LOG_ERROR("Target not halted");
+		return ERROR_TARGET_NOT_HALTED;
+	}
+
 	int err = rp2040_lookup_symbol(target, FUNC_DEBUG_TRAMPOLINE, &priv->jump_debug_trampoline);
 	if (err != ERROR_OK) {
 		LOG_ERROR("Debug trampoline not found in RP2040 ROM.");
@@ -344,59 +436,48 @@ static int rp2040_flash_probe(struct flash_bank *bank)
 		return err;
 	}
 
-	err = stack_grab_and_prep(bank);
-	if (err != ERROR_OK)
-		return err;
+	if (bank->size) {
+		/* size overridden, suppress reading SPI flash ID */
+		priv->dev = &rp2040_default_spi_device;
+		LOG_DEBUG("SPI flash autodetection disabled, using configured size");
 
-	uint32_t device_id = 0;
-	const target_addr_t ssi_dr0 = 0x18000060;
-
-	err = rp2040_ssel_active(target, true);
+	} else {
+		/* zero bank size in cfg, read SPI flash ID and autodetect */
+		err = rp2040_stack_grab_and_prep(bank);
 
-	/* write RDID request into SPI peripheral's FIFO */
-	for (int count = 0; (count < 4) && (err == ERROR_OK); count++)
-		err = target_write_u32(target, ssi_dr0, SPIFLASH_READ_ID);
+		uint32_t device_id = 0;
+		if (err == ERROR_OK)
+			err = rp2040_spi_read_flash_id(target, &device_id);
 
-	/* by this time, there is a receive FIFO entry for every write */
-	for (int count = 0; (count < 4) && (err == ERROR_OK); count++) {
-		uint32_t status;
-		err = target_read_u32(target, ssi_dr0, &status);
+		rp2040_finalize_stack_free(bank);
 
-		device_id >>= 8;
-		device_id |= (status & 0xFF) << 24;
-	}
-	device_id >>= 8;
-
-	err = rp2040_ssel_active(target, false);
-	if (err != ERROR_OK) {
-		LOG_ERROR("SSEL inactive failed");
-		return err;
-	}
+		if (err != ERROR_OK)
+			return err;
 
-	/* search for a SPI flash Device ID match */
-	priv->dev = NULL;
-	for (const struct flash_device *p = flash_devices; p->name ; p++)
-		if (p->device_id == device_id) {
-			priv->dev = p;
-			break;
+		/* search for a SPI flash Device ID match */
+		priv->dev = NULL;
+		for (const struct flash_device *p = flash_devices; p->name ; p++)
+			if (p->device_id == device_id) {
+				priv->dev = p;
+				break;
+			}
+
+		if (!priv->dev) {
+			LOG_ERROR("Unknown flash device (ID 0x%08" PRIx32 ")", device_id);
+			return ERROR_FAIL;
 		}
+		LOG_INFO("Found flash device '%s' (ID 0x%08" PRIx32 ")",
+			priv->dev->name, priv->dev->device_id);
 
-	if (!priv->dev) {
-		LOG_ERROR("Unknown flash device (ID 0x%08" PRIx32 ")", device_id);
-		return ERROR_FAIL;
+		bank->size = priv->dev->size_in_bytes;
 	}
 
-	LOG_INFO("Found flash device \'%s\' (ID 0x%08" PRIx32 ")",
-		priv->dev->name, priv->dev->device_id);
-
 	/* the Boot ROM flash_range_program() routine requires page alignment */
 	bank->write_start_alignment = priv->dev->pagesize;
 	bank->write_end_alignment = priv->dev->pagesize;
 
-	bank->size = priv->dev->size_in_bytes;
-
 	bank->num_sectors = bank->size / priv->dev->sectorsize;
-	LOG_INFO("RP2040 B0 Flash Probe: %d bytes @" TARGET_ADDR_FMT ", in %d sectors\n",
+	LOG_INFO("RP2040 B0 Flash Probe: %" PRIu32 " bytes @" TARGET_ADDR_FMT ", in %u sectors\n",
 		bank->size, bank->base, bank->num_sectors);
 	bank->sectors = alloc_block_array(0, priv->dev->sectorsize, bank->num_sectors);
 	if (!bank->sectors)
diff --git a/src/flash/nor/spi.c b/src/flash/nor/spi.c
index eed747b..373a9a1 100644
--- a/src/flash/nor/spi.c
+++ b/src/flash/nor/spi.c
@@ -112,6 +112,7 @@ const struct flash_device flash_devices[] = {
 	FLASH_ID("gd gd25q128c",        0x03, 0xeb, 0x02, 0xd8, 0xc7, 0x001840c8, 0x100, 0x10000, 0x1000000),
 	FLASH_ID("gd gd25q256c",        0x13, 0x00, 0x12, 0xdc, 0xc7, 0x001940c8, 0x100, 0x10000, 0x2000000),
 	FLASH_ID("gd gd25q512mc",       0x13, 0x00, 0x12, 0xdc, 0xc7, 0x002040c8, 0x100, 0x10000, 0x4000000),
+	FLASH_ID("issi is25lq040b",     0x03, 0xeb, 0x02, 0x20, 0xc7, 0x0013409d, 0x100, 0x1000,  0x80000),
 	FLASH_ID("issi is25lp032",      0x03, 0x00, 0x02, 0xd8, 0xc7, 0x0016609d, 0x100, 0x10000, 0x400000),
 	FLASH_ID("issi is25lp064",      0x03, 0x00, 0x02, 0xd8, 0xc7, 0x0017609d, 0x100, 0x10000, 0x800000),
 	FLASH_ID("issi is25lp128d",     0x03, 0xeb, 0x02, 0xd8, 0xc7, 0x0018609d, 0x100, 0x10000, 0x1000000),
diff --git a/src/flash/nor/stm32f1x.c b/src/flash/nor/stm32f1x.c
index 292b66d..04f4da0 100644
--- a/src/flash/nor/stm32f1x.c
+++ b/src/flash/nor/stm32f1x.c
@@ -473,7 +473,7 @@ static int stm32x_write_block_async(struct flash_bank *bank, const uint8_t *buff
 
 	/* memory buffer */
 	buffer_size = target_get_working_area_avail(target);
-	buffer_size = MIN(hwords_count * 2, MAX(buffer_size, 256));
+	buffer_size = MIN(hwords_count * 2 + 8, MAX(buffer_size, 256));
 	/* Normally we allocate all available working area.
 	 * MIN shrinks buffer_size if the size of the written block is smaller.
 	 * MAX prevents using async algo if the available working area is smaller
diff --git a/src/flash/nor/stm32lx.c b/src/flash/nor/stm32lx.c
index 860bab3..0c76ed7 100644
--- a/src/flash/nor/stm32lx.c
+++ b/src/flash/nor/stm32lx.c
@@ -132,7 +132,7 @@ static const struct stm32lx_rev stm32_417_revs[] = {
 	{ 0x1000, "A" }, { 0x1008, "Z" }, { 0x1018, "Y" }, { 0x1038, "X" }
 };
 static const struct stm32lx_rev stm32_425_revs[] = {
-	{ 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Y" },
+	{ 0x1000, "A" }, { 0x2000, "B" }, { 0x2008, "Y" }, { 0x2018, "1, X" },
 };
 static const struct stm32lx_rev stm32_427_revs[] = {
 	{ 0x1000, "A" }, { 0x1018, "Y" }, { 0x1038, "X" }, { 0x10f8, "V" },
diff --git a/src/flash/nor/stmqspi.c b/src/flash/nor/stmqspi.c
index 9c266e9..77ea4c4 100644
--- a/src/flash/nor/stmqspi.c
+++ b/src/flash/nor/stmqspi.c
@@ -616,8 +616,6 @@ COMMAND_HANDLER(stmqspi_handle_set)
 
 	LOG_DEBUG("%s", __func__);
 
-	dual = (stmqspi_info->saved_cr & BIT(SPI_DUAL_FLASH)) ? 1 : 0;
-
 	/* chip_erase_cmd, sectorsize and erase_cmd are optional */
 	if ((CMD_ARGC < 7) || (CMD_ARGC > 10))
 		return ERROR_COMMAND_SYNTAX_ERROR;
@@ -628,8 +626,9 @@ COMMAND_HANDLER(stmqspi_handle_set)
 
 	target = bank->target;
 	stmqspi_info = bank->driver_priv;
+	dual = (stmqspi_info->saved_cr & BIT(SPI_DUAL_FLASH)) ? 1 : 0;
 
-	/* invalidate all old info */
+	/* invalidate all flash device info */
 	if (stmqspi_info->probed)
 		free(bank->sectors);
 	bank->size = 0;
@@ -721,10 +720,8 @@ COMMAND_HANDLER(stmqspi_handle_set)
 
 	uint32_t dcr;
 	retval = target_read_u32(target, io_base + SPI_DCR, &dcr);
-
 	if (retval != ERROR_OK)
 		return retval;
-
 	fsize = (dcr >> SPI_FSIZE_POS) & (BIT(SPI_FSIZE_LEN) - 1);
 
 	LOG_DEBUG("FSIZE = 0x%04x", fsize);
@@ -1799,7 +1796,6 @@ static int find_sfdp_dummy(struct flash_bank *bank, int len)
 		}
 	}
 
-	retval = ERROR_FAIL;
 	LOG_DEBUG("no start of SFDP header even after %u dummy bytes", count);
 
 err:
@@ -2081,16 +2077,17 @@ static int stmqspi_probe(struct flash_bank *bank)
 	bool octal_dtr;
 	int retval;
 
-	if (stmqspi_info->probed) {
-		bank->size = 0;
-		bank->num_sectors = 0;
+	/* invalidate all flash device info */
+	if (stmqspi_info->probed)
 		free(bank->sectors);
-		bank->sectors = NULL;
-		memset(&stmqspi_info->dev, 0, sizeof(stmqspi_info->dev));
-		stmqspi_info->sfdp_dummy1 = 0;
-		stmqspi_info->sfdp_dummy2 = 0;
-		stmqspi_info->probed = false;
-	}
+	bank->size = 0;
+	bank->num_sectors = 0;
+	bank->sectors = NULL;
+	stmqspi_info->sfdp_dummy1 = 0;
+	stmqspi_info->sfdp_dummy2 = 0;
+	stmqspi_info->probed = false;
+	memset(&stmqspi_info->dev, 0, sizeof(stmqspi_info->dev));
+	stmqspi_info->dev.name = "unknown";
 
 	/* Abort any previous operation */
 	retval = stmqspi_abort(bank);
@@ -2105,8 +2102,8 @@ static int stmqspi_probe(struct flash_bank *bank)
 	/* check whether QSPI_ABR is writeable and readback returns the value written */
 	retval = target_write_u32(target, io_base + QSPI_ABR, magic);
 	if (retval == ERROR_OK) {
-		retval = target_read_u32(target, io_base + QSPI_ABR, &data);
-		retval = target_write_u32(target, io_base + QSPI_ABR, 0);
+		(void)target_read_u32(target, io_base + QSPI_ABR, &data);
+		(void)target_write_u32(target, io_base + QSPI_ABR, 0);
 	}
 
 	if (data == magic) {