[PATCH 00/11] bus: add stm32 debug bus and coresight support for stm32mp1x platforms

[PATCH 00/11] bus: add stm32 debug bus and coresight support for stm32mp1x platforms

[Gatien Chevallier]

Stm32 SoCs embed debug peripherals such as Coresight. These peripherals
can monitor the activity of the cores. Because of that, they can be
used only if some features in the debug configuration are enabled.
Else, errors or firewall exceptions can be observed. Similarly to
the ETZPC(on stm32mp1x platforms) or the RIFSC(on stm32mp2x platforms),
debug-related peripherals access can be assessed at bus level to
prevent these issues from happening.

The debug configuration can only be accessed by the secure world.
That means that a service must be implemented in the secure world for
the kernel to check the firewall configuration. On OpenSTLinux, it is
done through a Debug access PTA in OP-TEE [1].
To represent the debug peripherals present on a dedicated debug bus,
create a debug bus node in the device tree and the associated driver
that will interact with this PTA.

[1]: https://github.com/OP-TEE/optee_os/pull/7673

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
Gatien Chevallier (11):
      dt-bindings: document access-controllers property for coresight peripherals
      dt-bindings: pinctrl: document access-controllers property for stm32 HDP
      dt-bindings: bus: document the stm32 debug bus
      bus: stm32_firewall: allow check on different firewall controllers
      drivers: bus: add the stm32 debug bus driver
      arm: dts: stm32: introduce the debug bus for stm32mp1x platforms
      arm: dts: stm32: enable the debug bus on stm32mp1x boards
      arm: dts: stm32: enable CoreSight on stm32mp15xx-dkx boards
      arm: dts: stm32: enable CoreSight on the stm32mp157c-ev1 board
      arm: dts: stm32: enable CoreSight on the stm32mp135f-dk board
      pinctrl: stm32: add firewall checks before probing the HDP driver

 .../devicetree/bindings/arm/arm,coresight-cti.yaml |   3 +
 .../devicetree/bindings/arm/arm,coresight-etm.yaml |   3 +
 .../devicetree/bindings/arm/arm,coresight-tmc.yaml |   3 +
 .../bindings/arm/arm,coresight-tpiu.yaml           |   3 +
 .../bindings/bus/st,stm32mp131-dbg-bus.yaml        |  86 +++++++
 .../devicetree/bindings/pinctrl/st,stm32-hdp.yaml  |   4 +
 MAINTAINERS                                        |   1 +
 arch/arm/boot/dts/st/stm32mp131.dtsi               | 119 +++++++++
 arch/arm/boot/dts/st/stm32mp135f-dk.dts            |  24 ++
 arch/arm/boot/dts/st/stm32mp151.dtsi               | 173 +++++++++++++
 arch/arm/boot/dts/st/stm32mp153.dtsi               |  68 +++++
 arch/arm/boot/dts/st/stm32mp157c-ev1.dts           |  40 +++
 arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi          |  40 +++
 drivers/bus/Kconfig                                |  10 +
 drivers/bus/Makefile                               |   1 +
 drivers/bus/stm32_dbg_bus.c                        | 285 +++++++++++++++++++++
 drivers/bus/stm32_firewall.c                       |   2 +-
 drivers/pinctrl/stm32/pinctrl-stm32-hdp.c          |  41 +++
 18 files changed, 905 insertions(+), 1 deletion(-)
---
base-commit: 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb
change-id: 20260108-debug_bus-392666c7a3aa

Best regards,
-- 
Gatien Chevallier <gatien.chevallier@foss.st.com>

[PATCH 01/11] dt-bindings: document access-controllers property for coresight peripherals

[Gatien Chevallier]

Document the access-controllers for coresight peripherals in case some
access checks need to be performed to use them.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 Documentation/devicetree/bindings/arm/arm,coresight-cti.yaml  | 3 +++
 Documentation/devicetree/bindings/arm/arm,coresight-etm.yaml  | 3 +++
 Documentation/devicetree/bindings/arm/arm,coresight-tmc.yaml  | 3 +++
 Documentation/devicetree/bindings/arm/arm,coresight-tpiu.yaml | 3 +++
 4 files changed, 12 insertions(+)

diff --git a/Documentation/devicetree/bindings/arm/arm,coresight-cti.yaml b/Documentation/devicetree/bindings/arm/arm,coresight-cti.yaml
index 2a91670ccb8c..949444aba1f8 100644
--- a/Documentation/devicetree/bindings/arm/arm,coresight-cti.yaml
+++ b/Documentation/devicetree/bindings/arm/arm,coresight-cti.yaml
@@ -128,6 +128,9 @@ properties:
   "#address-cells":
     const: 1
 
+  access-controllers:
+    maxItems: 1
+
 patternProperties:
   '^trig-conns@([0-9]+)$':
     type: object
diff --git a/Documentation/devicetree/bindings/arm/arm,coresight-etm.yaml b/Documentation/devicetree/bindings/arm/arm,coresight-etm.yaml
index 71f2e1ed27e5..10ebbbeadf93 100644
--- a/Documentation/devicetree/bindings/arm/arm,coresight-etm.yaml
+++ b/Documentation/devicetree/bindings/arm/arm,coresight-etm.yaml
@@ -118,6 +118,9 @@ properties:
         description: Output connection from the ETM to CoreSight Trace bus.
         $ref: /schemas/graph.yaml#/properties/port
 
+  access-controllers:
+    maxItems: 1
+
 required:
   - compatible
   - clocks
diff --git a/Documentation/devicetree/bindings/arm/arm,coresight-tmc.yaml b/Documentation/devicetree/bindings/arm/arm,coresight-tmc.yaml
index 96dd5b5f771a..9dc096698c65 100644
--- a/Documentation/devicetree/bindings/arm/arm,coresight-tmc.yaml
+++ b/Documentation/devicetree/bindings/arm/arm,coresight-tmc.yaml
@@ -128,6 +128,9 @@ properties:
       - const: tracedata
       - const: metadata
 
+  access-controllers:
+    maxItems: 1
+
 required:
   - compatible
   - reg
diff --git a/Documentation/devicetree/bindings/arm/arm,coresight-tpiu.yaml b/Documentation/devicetree/bindings/arm/arm,coresight-tpiu.yaml
index a207f6899e67..29bbc3961fdf 100644
--- a/Documentation/devicetree/bindings/arm/arm,coresight-tpiu.yaml
+++ b/Documentation/devicetree/bindings/arm/arm,coresight-tpiu.yaml
@@ -70,6 +70,9 @@ properties:
         description: Input connection from the CoreSight Trace bus.
         $ref: /schemas/graph.yaml#/properties/port
 
+  access-controllers:
+    maxItems: 1
+
 required:
   - compatible
   - reg

-- 
2.43.0

[PATCH 02/11] dt-bindings: pinctrl: document access-controllers property for stm32 HDP

[Gatien Chevallier]

HDP being functional depends on the debug configuration on the platform
that can be checked using the access-controllers property, document it.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml b/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
index 845b6b7b7552..75054c1e4044 100644
--- a/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
+++ b/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
@@ -27,6 +27,10 @@ properties:
   clocks:
     maxItems: 1
 
+  access-controllers:
+    minItems: 1
+    maxItems: 2
+
 patternProperties:
   "^hdp[0-7]-pins$":
     type: object

-- 
2.43.0

Re: [PATCH 02/11] dt-bindings: pinctrl: document access-controllers property for stm32 HDP

[Krzysztof Kozlowski]

On 09/01/2026 11:55, Gatien Chevallier wrote:
> HDP being functional depends on the debug configuration on the platform
> that can be checked using the access-controllers property, document it.
> 
> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
> ---
>  Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml b/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
> index 845b6b7b7552..75054c1e4044 100644
> --- a/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
> +++ b/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
> @@ -27,6 +27,10 @@ properties:
>    clocks:
>      maxItems: 1
>  
> +  access-controllers:
> +    minItems: 1
> +    maxItems: 2

You need to list the items. Why is this flexible?

Best regards,
Krzysztof

Re: [PATCH 02/11] dt-bindings: pinctrl: document access-controllers property for stm32 HDP

[Gatien CHEVALLIER]

On 1/11/26 12:27, Krzysztof Kozlowski wrote:
> On 09/01/2026 11:55, Gatien Chevallier wrote:
>> HDP being functional depends on the debug configuration on the platform
>> that can be checked using the access-controllers property, document it.
>>
>> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
>> ---
>>   Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml | 4 ++++
>>   1 file changed, 4 insertions(+)
>>
>> diff --git a/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml b/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
>> index 845b6b7b7552..75054c1e4044 100644
>> --- a/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
>> +++ b/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
>> @@ -27,6 +27,10 @@ properties:
>>     clocks:
>>       maxItems: 1
>>   
>> +  access-controllers:
>> +    minItems: 1
>> +    maxItems: 2
> 
> You need to list the items. Why is this flexible?
> 
> Best regards,
> Krzysztof

I will need to list 2 items (2 different firewall controllers)
for the stm32mp2x series that I planned doing in a second time.

On stm32mp1x series, only debug configuration needs to be checked
for this peripheral. On stm32mp2x series, both debug and RIFSC
(which is the peripheral firewall) configurations need to be checked.

By listing, you mean adding the description of each of the possible
access controller, am I right?

Can I keep it like this or do I introduce the flexibility when needed?

Re: [PATCH 02/11] dt-bindings: pinctrl: document access-controllers property for stm32 HDP

[Krzysztof Kozlowski]

On 12/01/2026 09:24, Gatien CHEVALLIER wrote:
> 
> 
> On 1/11/26 12:27, Krzysztof Kozlowski wrote:
>> On 09/01/2026 11:55, Gatien Chevallier wrote:
>>> HDP being functional depends on the debug configuration on the platform
>>> that can be checked using the access-controllers property, document it.
>>>
>>> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
>>> ---
>>>   Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml | 4 ++++
>>>   1 file changed, 4 insertions(+)
>>>
>>> diff --git a/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml b/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
>>> index 845b6b7b7552..75054c1e4044 100644
>>> --- a/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
>>> +++ b/Documentation/devicetree/bindings/pinctrl/st,stm32-hdp.yaml
>>> @@ -27,6 +27,10 @@ properties:
>>>     clocks:
>>>       maxItems: 1
>>>   
>>> +  access-controllers:
>>> +    minItems: 1
>>> +    maxItems: 2
>>
>> You need to list the items. Why is this flexible?
>>
>> Best regards,
>> Krzysztof
> 
> I will need to list 2 items (2 different firewall controllers)
> for the stm32mp2x series that I planned doing in a second time.
> 
> On stm32mp1x series, only debug configuration needs to be checked
> for this peripheral. On stm32mp2x series, both debug and RIFSC
> (which is the peripheral firewall) configurations need to be checked.
> 
> By listing, you mean adding the description of each of the possible
> access controller, am I right?

items with "- description: foo bar" for each, so each is strictly
defined. I doubt that you can hook it into any access controller...

> 
> Can I keep it like this or do I introduce the flexibility when needed?

Lists should not be flexible but rather constrained per each device.
With loose approach here you only force quite restrictive driver
behavior, although not sure if it matters now for Linux.

Best regards,
Krzysztof

[PATCH 03/11] dt-bindings: bus: document the stm32 debug bus

[Gatien Chevallier]

Document the stm32 debug bus. The debug bus is responsible for
checking the debug sub-system accessibility before probing any related
drivers.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 .../bindings/bus/st,stm32mp131-dbg-bus.yaml        | 86 ++++++++++++++++++++++
 1 file changed, 86 insertions(+)

diff --git a/Documentation/devicetree/bindings/bus/st,stm32mp131-dbg-bus.yaml b/Documentation/devicetree/bindings/bus/st,stm32mp131-dbg-bus.yaml
new file mode 100644
index 000000000000..68bdfba08909
--- /dev/null
+++ b/Documentation/devicetree/bindings/bus/st,stm32mp131-dbg-bus.yaml
@@ -0,0 +1,86 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/bus/st,stm32mp131-dbg-bus.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: STM32 Coresight bus
+
+maintainers:
+  - Gatien Chevallier <gatien.chevallier@foss.st.com>
+
+description: |
+  The STM32 debug bus is in charge of checking the debug configuration
+  of the platform before probing the peripheral drivers that rely on the debug
+  domain.
+
+properties:
+  compatible:
+    oneOf:
+      - items:
+          - enum:
+              - st,stm32mp131-dbg-bus
+              - st,stm32mp151-dbg-bus
+
+  "#address-cells":
+    const: 1
+
+  "#size-cells":
+    const: 1
+
+  clocks:
+    maxItems: 1
+
+  ranges: true
+
+  reg:
+    maxItems: 1
+
+  "#access-controller-cells":
+    const: 1
+    description:
+      Contains the debug profile necessary to access the peripheral.
+
+patternProperties:
+  "^.*@[0-9a-f]+$":
+    description: Debug related peripherals
+    type: object
+
+    additionalProperties: true
+
+    required:
+      - access-controllers
+
+required:
+  - "#access-controller-cells"
+  - "#address-cells"
+  - "#size-cells"
+  - clocks
+  - compatible
+  - ranges
+  - reg
+
+additionalProperties: false
+
+examples:
+  - |
+    #include <dt-bindings/clock/stm32mp1-clks.h>
+
+    dbg_bus: bus@50080000 {
+      compatible = "st,stm32mp131-dbg-bus";
+      reg = <0x50080000 0x3f80000>;
+      #address-cells = <1>;
+      #size-cells = <1>;
+      clocks = <&rcc CK_DBG>;
+      #access-controller-cells = <1>;
+      ranges;
+
+      cs_cti_trace: cti@50094000 {
+        compatible = "arm,coresight-cti", "arm,primecell";
+        reg = <0x50094000 0x1000>;
+        clocks = <&rcc CK_DBG>;
+        clock-names = "apb_pclk";
+        access-controllers = <&dbg_bus 0>;
+        status = "disabled";
+      };
+    };

-- 
2.43.0

Re: [PATCH 03/11] dt-bindings: bus: document the stm32 debug bus

[Krzysztof Kozlowski]

On 09/01/2026 11:55, Gatien Chevallier wrote:
> Document the stm32 debug bus. The debug bus is responsible for
> checking the debug sub-system accessibility before probing any related
> drivers.
> 
> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
> ---
>  .../bindings/bus/st,stm32mp131-dbg-bus.yaml        | 86 ++++++++++++++++++++++
>  1 file changed, 86 insertions(+)
> 
> diff --git a/Documentation/devicetree/bindings/bus/st,stm32mp131-dbg-bus.yaml b/Documentation/devicetree/bindings/bus/st,stm32mp131-dbg-bus.yaml
> new file mode 100644
> index 000000000000..68bdfba08909
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/bus/st,stm32mp131-dbg-bus.yaml
> @@ -0,0 +1,86 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +%YAML 1.2
> +---
> +$id: http://devicetree.org/schemas/bus/st,stm32mp131-dbg-bus.yaml#
> +$schema: http://devicetree.org/meta-schemas/core.yaml#
> +
> +title: STM32 Coresight bus
> +
> +maintainers:
> +  - Gatien Chevallier <gatien.chevallier@foss.st.com>
> +
> +description: |


Do not need '|' unless you need to preserve formatting.

> +  The STM32 debug bus is in charge of checking the debug configuration

What sort of bus it is? What protocol? Looks like rather fake wrapping
node. You cannot just organize children in MMIO and call it a "bus".
just to justify having child nodes.

> +  of the platform before probing the peripheral drivers that rely on the debug
> +  domain.
> +
> +properties:
> +  compatible:
> +    oneOf:

Drop

> +      - items:

Drop

> +          - enum:
> +              - st,stm32mp131-dbg-bus
> +              - st,stm32mp151-dbg-bus
> +
> +  "#address-cells":
> +    const: 1
> +
> +  "#size-cells":
> +    const: 1
> +
> +  clocks:
> +    maxItems: 1
> +
> +  ranges: true
> +
> +  reg:
> +    maxItems: 1

What stuff is here? Your driver does not use it at all.

> +
> +  "#access-controller-cells":
> +    const: 1
> +    description:
> +      Contains the debug profile necessary to access the peripheral.
> +
> +patternProperties:
> +  "^.*@[0-9a-f]+$":
> +    description: Debug related peripherals
> +    type: object
> +
> +    additionalProperties: true
> +
> +    required:
> +      - access-controllers

I don't get why children need to reference the parent. If you have such
relationship, then the access-controllers are redundant, no?

> +
> +required:
> +  - "#access-controller-cells"
> +  - "#address-cells"
> +  - "#size-cells"
> +  - clocks
> +  - compatible
> +  - ranges
> +  - reg
> +
> +additionalProperties: false
> +
> +examples:
> +  - |
> +    #include <dt-bindings/clock/stm32mp1-clks.h>
> +
> +    dbg_bus: bus@50080000 {
> +      compatible = "st,stm32mp131-dbg-bus";
> +      reg = <0x50080000 0x3f80000>;
> +      #address-cells = <1>;
> +      #size-cells = <1>;
> +      clocks = <&rcc CK_DBG>;

So the same clock as child? Another argument that this node is not a
true bus node.

> +      #access-controller-cells = <1>;
> +      ranges;
> +
> +      cs_cti_trace: cti@50094000 {

Drop unused label

> +        compatible = "arm,coresight-cti", "arm,primecell";
> +        reg = <0x50094000 0x1000>;
> +        clocks = <&rcc CK_DBG>;
> +        clock-names = "apb_pclk";
> +        access-controllers = <&dbg_bus 0>;
> +        status = "disabled";

Drop

> +      };
> +    };
> 


Best regards,
Krzysztof

Re: [PATCH 03/11] dt-bindings: bus: document the stm32 debug bus

[Gatien CHEVALLIER]

On 1/11/26 12:27, Krzysztof Kozlowski wrote:
> On 09/01/2026 11:55, Gatien Chevallier wrote:
>> Document the stm32 debug bus. The debug bus is responsible for
>> checking the debug sub-system accessibility before probing any related
>> drivers.
>>
>> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
>> ---
>>   .../bindings/bus/st,stm32mp131-dbg-bus.yaml        | 86 ++++++++++++++++++++++
>>   1 file changed, 86 insertions(+)
>>
>> diff --git a/Documentation/devicetree/bindings/bus/st,stm32mp131-dbg-bus.yaml b/Documentation/devicetree/bindings/bus/st,stm32mp131-dbg-bus.yaml
>> new file mode 100644
>> index 000000000000..68bdfba08909
>> --- /dev/null
>> +++ b/Documentation/devicetree/bindings/bus/st,stm32mp131-dbg-bus.yaml
>> @@ -0,0 +1,86 @@
>> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
>> +%YAML 1.2
>> +---
>> +$id: http://devicetree.org/schemas/bus/st,stm32mp131-dbg-bus.yaml#
>> +$schema: http://devicetree.org/meta-schemas/core.yaml#
>> +
>> +title: STM32 Coresight bus
>> +
>> +maintainers:
>> +  - Gatien Chevallier <gatien.chevallier@foss.st.com>
>> +
>> +description: |
> 
> 
> Do not need '|' unless you need to preserve formatting.
> >> +  The STM32 debug bus is in charge of checking the debug configuration
> 
> What sort of bus it is? What protocol? Looks like rather fake wrapping
> node. You cannot just organize children in MMIO and call it a "bus".
> just to justify having child nodes.
> 

It is a standard APB bus, gated through the debug configuration,
dedicated for debug peripherals.

>> +  of the platform before probing the peripheral drivers that rely on the debug
>> +  domain.
>> +
>> +properties:
>> +  compatible:
>> +    oneOf:
> 
> Drop
> 
>> +      - items:
> 
> Drop
> 
>> +          - enum:
>> +              - st,stm32mp131-dbg-bus
>> +              - st,stm32mp151-dbg-bus
>> +
>> +  "#address-cells":
>> +    const: 1
>> +
>> +  "#size-cells":
>> +    const: 1
>> +
>> +  clocks:
>> +    maxItems: 1
>> +
>> +  ranges: true
>> +
>> +  reg:
>> +    maxItems: 1
> 
> What stuff is here? Your driver does not use it at all.
> 

I listed the reg property so that it is clear what memory range
the debug bus covers. Peripherals under it should be in that range.
Do you prefer no reg and explicit ranges property with the memory
range in it?

>> +
>> +  "#access-controller-cells":
>> +    const: 1
>> +    description:
>> +      Contains the debug profile necessary to access the peripheral.
>> +
>> +patternProperties:
>> +  "^.*@[0-9a-f]+$":
>> +    description: Debug related peripherals
>> +    type: object
>> +
>> +    additionalProperties: true
>> +
>> +    required:
>> +      - access-controllers
> 
> I don't get why children need to reference the parent. If you have such
> relationship, then the access-controllers are redundant, no?
> 

They can reference the parent, but nothing prevents them to reference
a different access controller, if needed. It's not only the parent
that is referenced, it is also the argument representing the
specific configuration to check.

For now, the peripherals in this patchset all check the
same configuration bits, but there are others that differ,
so I need per-node property.

No peripherals on this bus can function properly without some
bits of debug configuration being set, so I made the property
mandatory.

>> +
>> +required:
>> +  - "#access-controller-cells"
>> +  - "#address-cells"
>> +  - "#size-cells"
>> +  - clocks
>> +  - compatible
>> +  - ranges
>> +  - reg
>> +
>> +additionalProperties: false
>> +
>> +examples:
>> +  - |
>> +    #include <dt-bindings/clock/stm32mp1-clks.h>
>> +
>> +    dbg_bus: bus@50080000 {
>> +      compatible = "st,stm32mp131-dbg-bus";
>> +      reg = <0x50080000 0x3f80000>;
>> +      #address-cells = <1>;
>> +      #size-cells = <1>;
>> +      clocks = <&rcc CK_DBG>;
> 
> So the same clock as child? Another argument that this node is not a
> true bus node.
> 

In fact, I do not need to manipulate the clock at bus level. I'll
simply remove it for V2 and let the peripherals enable the bus clock
when needed. Thank you.

>> +      #access-controller-cells = <1>;
>> +      ranges;
>> +
>> +      cs_cti_trace: cti@50094000 {
> 
> Drop unused label
> 
>> +        compatible = "arm,coresight-cti", "arm,primecell";
>> +        reg = <0x50094000 0x1000>;
>> +        clocks = <&rcc CK_DBG>;
>> +        clock-names = "apb_pclk";
>> +        access-controllers = <&dbg_bus 0>;
>> +        status = "disabled";
> 
> Drop
> 
>> +      };
>> +    };
>>
> 
> 
> Best regards,
> Krzysztof

I'll address the comments for v2

Best regards,
Gatien

[PATCH 04/11] bus: stm32_firewall: allow check on different firewall controllers

[Gatien Chevallier]

Current implementation restricts the check on the firewall controller
being the bus parent. Change this by using the controller referenced
in each firewall queries.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 drivers/bus/stm32_firewall.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/bus/stm32_firewall.c b/drivers/bus/stm32_firewall.c
index 2fc9761dadec..2717754d811d 100644
--- a/drivers/bus/stm32_firewall.c
+++ b/drivers/bus/stm32_firewall.c
@@ -274,7 +274,7 @@ int stm32_firewall_populate_bus(struct stm32_firewall_controller *firewall_contr
 		}
 
 		for (i = 0; i < len; i++) {
-			if (firewall_controller->grant_access(firewall_controller,
+			if (firewall_controller->grant_access(firewalls[i].firewall_ctrl,
 							      firewalls[i].firewall_id)) {
 				/*
 				 * Peripheral access not allowed or not defined.

-- 
2.43.0

[PATCH 05/11] drivers: bus: add the stm32 debug bus driver

[Gatien Chevallier]

Add the stm32 debug bus driver that is responsible of checking the
debug subsystem accessibility before probing the related peripheral
drivers.

This driver is OP-TEE dependent and relies on the STM32 debug access
PTA.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 MAINTAINERS                 |   1 +
 drivers/bus/Kconfig         |  10 ++
 drivers/bus/Makefile        |   1 +
 drivers/bus/stm32_dbg_bus.c | 285 ++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 297 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 765ad2daa218..2489a24a0515 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -24701,6 +24701,7 @@ F:	drivers/power/supply/stc3117_fuel_gauge.c
 ST STM32 FIREWALL
 M:	Gatien Chevallier <gatien.chevallier@foss.st.com>
 S:	Maintained
+F:	drivers/bus/stm32_dbg_bus.c
 F:	drivers/bus/stm32_etzpc.c
 F:	drivers/bus/stm32_firewall.c
 F:	drivers/bus/stm32_rifsc.c
diff --git a/drivers/bus/Kconfig b/drivers/bus/Kconfig
index fe7600283e70..c9be21d5dfda 100644
--- a/drivers/bus/Kconfig
+++ b/drivers/bus/Kconfig
@@ -169,6 +169,16 @@ config QCOM_SSC_BLOCK_BUS
 	  i2c/spi/uart controllers, a hexagon core, and a clock controller
 	  which provides clocks for the above.
 
+config STM32_DBG_BUS
+	tristate "OP-TEE based debug access bus"
+	depends on OPTEE && STM32_FIREWALL
+	depends on ARCH_STM32 || COMPILE_TEST
+	help
+	  Select this to get the support for the OP-TEE based STM32 debug bus
+	  driver that is used to handle debug-related peripherals on STM32
+	  platforms when the debug configuration is not accessible by the
+	  normal world.
+
 config STM32_FIREWALL
 	bool "STM32 Firewall framework"
 	depends on (ARCH_STM32 || COMPILE_TEST) && OF
diff --git a/drivers/bus/Makefile b/drivers/bus/Makefile
index 8e693fe8a03a..799724cfc2df 100644
--- a/drivers/bus/Makefile
+++ b/drivers/bus/Makefile
@@ -27,6 +27,7 @@ obj-$(CONFIG_OMAP_INTERCONNECT)	+= omap_l3_smx.o omap_l3_noc.o
 obj-$(CONFIG_OMAP_OCP2SCP)	+= omap-ocp2scp.o
 obj-$(CONFIG_QCOM_EBI2)		+= qcom-ebi2.o
 obj-$(CONFIG_QCOM_SSC_BLOCK_BUS)	+= qcom-ssc-block-bus.o
+obj-$(CONFIG_STM32_DBG_BUS)	+= stm32_dbg_bus.o
 obj-$(CONFIG_STM32_FIREWALL)	+= stm32_firewall.o stm32_rifsc.o stm32_etzpc.o
 obj-$(CONFIG_SUN50I_DE2_BUS)	+= sun50i-de2.o
 obj-$(CONFIG_SUNXI_RSB)		+= sunxi-rsb.o
diff --git a/drivers/bus/stm32_dbg_bus.c b/drivers/bus/stm32_dbg_bus.c
new file mode 100644
index 000000000000..9e1238575b94
--- /dev/null
+++ b/drivers/bus/stm32_dbg_bus.c
@@ -0,0 +1,285 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * Copyright (C) 2026, STMicroelectronics - All Rights Reserved
+ */
+
+#include <linux/bus/stm32_firewall_device.h>
+#include <linux/clk.h>
+#include <linux/device.h>
+#include <linux/err.h>
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/of.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/pm_runtime.h>
+#include <linux/slab.h>
+#include <linux/tee_drv.h>
+#include <linux/types.h>
+
+#include "stm32_firewall.h"
+
+enum stm32_dbg_profile {
+	PERIPHERAL_DBG_PROFILE	= 0,
+	HDP_DBG_PROFILE		= 1,
+};
+
+enum stm32_dbg_pta_command {
+	/*
+	 * PTA_CMD_GRANT_DBG_ACCESS - Verify the debug configuration against the given debug profile
+	 * and grant access or not
+	 *
+	 * [in]     value[0].a  Debug profile to grant access to.
+	 */
+	PTA_CMD_GRANT_DBG_ACCESS,
+};
+
+/**
+ * struct stm32_dbg_bus - OP-TEE based STM32 debug bus private data
+ * @dev: STM32 debug bus device.
+ * @ctx: OP-TEE context handler.
+ * @dbg_clk: Debug bus clock.
+ */
+struct stm32_dbg_bus {
+	struct device *dev;
+	struct tee_context *ctx;
+	struct clk *dbg_clk;
+};
+
+/* Expect at most 1 instance of this driver */
+static struct stm32_dbg_bus *stm32_dbg_bus_priv;
+
+static int stm32_dbg_pta_open_session(u32 *id)
+{
+	struct tee_client_device *dbg_bus_dev = to_tee_client_device(stm32_dbg_bus_priv->dev);
+	struct tee_ioctl_open_session_arg sess_arg;
+	int ret;
+
+	memset(&sess_arg, 0, sizeof(sess_arg));
+	export_uuid(sess_arg.uuid, &dbg_bus_dev->id.uuid);
+	sess_arg.clnt_login = TEE_IOCTL_LOGIN_REE_KERNEL;
+
+	ret = tee_client_open_session(stm32_dbg_bus_priv->ctx, &sess_arg, NULL);
+	if (ret < 0 || sess_arg.ret) {
+		dev_err(stm32_dbg_bus_priv->dev, "Failed opening tee session, err: %#x\n",
+			sess_arg.ret);
+		return -EOPNOTSUPP;
+	}
+
+	*id = sess_arg.session;
+
+	return 0;
+}
+
+static void stm32_dbg_pta_close_session(u32 id)
+{
+	tee_client_close_session(stm32_dbg_bus_priv->ctx, id);
+}
+
+static int stm32_dbg_bus_grant_access(struct stm32_firewall_controller *ctrl, u32 dbg_profile)
+{
+	struct tee_ioctl_invoke_arg inv_arg = {0};
+	struct tee_param param[1] = {0};
+	u32 session_id;
+	int ret;
+
+	if (dbg_profile != PERIPHERAL_DBG_PROFILE && dbg_profile != HDP_DBG_PROFILE)
+		return -EOPNOTSUPP;
+
+	ret = stm32_dbg_pta_open_session(&session_id);
+	if (ret)
+		return ret;
+
+	inv_arg.func = PTA_CMD_GRANT_DBG_ACCESS;
+	inv_arg.session = session_id;
+	inv_arg.num_params = 1;
+	param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT;
+	param[0].u.value.a = dbg_profile;
+
+	ret = tee_client_invoke_func(stm32_dbg_bus_priv->ctx, &inv_arg, param);
+	if (ret < 0 || inv_arg.ret != 0) {
+		dev_dbg(stm32_dbg_bus_priv->dev,
+			"When invoking function, err %x, TEE returns: %x\n", ret, inv_arg.ret);
+		if (!ret)
+			ret = -EACCES;
+	}
+
+	stm32_dbg_pta_close_session(session_id);
+
+	return ret;
+}
+
+/* Implement mandatory release_access ops even if it does nothing*/
+static void stm32_dbg_bus_release_access(struct stm32_firewall_controller *ctrl, u32 dbg_profile)
+{
+}
+
+static int stm32_dbg_bus_plat_probe(struct platform_device *pdev)
+{
+	struct stm32_firewall_controller *dbg_controller;
+	int ret;
+
+	if (!stm32_dbg_bus_priv)
+		return dev_err_probe(&pdev->dev, -EPROBE_DEFER,
+				     "OP-TEE debug services not yet available\n");
+
+	dbg_controller = devm_kzalloc(&pdev->dev, sizeof(*dbg_controller), GFP_KERNEL);
+	if (!dbg_controller)
+		return dev_err_probe(&pdev->dev, -ENOMEM, "Couldn't allocate debug controller\n");
+
+	dbg_controller->dev = &pdev->dev;
+	dbg_controller->mmio = NULL;
+	dbg_controller->name = dev_driver_string(dbg_controller->dev);
+	dbg_controller->type = STM32_PERIPHERAL_FIREWALL;
+	dbg_controller->grant_access = stm32_dbg_bus_grant_access;
+	dbg_controller->release_access = stm32_dbg_bus_release_access;
+
+	stm32_dbg_bus_priv->dbg_clk = devm_clk_get_enabled(&pdev->dev, NULL);
+	if (IS_ERR(stm32_dbg_bus_priv->dbg_clk))
+		return PTR_ERR(stm32_dbg_bus_priv->dbg_clk);
+
+	ret = stm32_firewall_controller_register(dbg_controller);
+	if (ret) {
+		dev_err(dbg_controller->dev, "Couldn't register as a firewall controller: %d", ret);
+		return ret;
+	}
+
+	ret = stm32_firewall_populate_bus(dbg_controller);
+	if (ret) {
+		dev_err(dbg_controller->dev, "Couldn't populate debug bus: %d", ret);
+		stm32_firewall_controller_unregister(dbg_controller);
+		return ret;
+	}
+
+	pm_runtime_enable(&pdev->dev);
+
+	ret = of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
+	if (ret) {
+		dev_err(dbg_controller->dev, "Couldn't populate the node: %d", ret);
+		stm32_firewall_controller_unregister(dbg_controller);
+		return ret;
+	}
+
+	return 0;
+}
+
+static int __maybe_unused stm32_dbg_bus_runtime_suspend(struct device *dev)
+{
+	clk_disable_unprepare(stm32_dbg_bus_priv->dbg_clk);
+
+	return 0;
+}
+
+static int __maybe_unused stm32_dbg_bus_runtime_resume(struct device *dev)
+{
+	int ret = clk_prepare_enable(stm32_dbg_bus_priv->dbg_clk);
+
+	if (ret) {
+		dev_err(dev, "Failed to enable clock: %d\n", ret);
+		return ret;
+	}
+
+	return 0;
+}
+
+static const struct of_device_id stm32_dbg_bus_of_match[] = {
+	{ .compatible = "st,stm32mp131-dbg-bus", },
+	{ .compatible = "st,stm32mp151-dbg-bus", },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, stm32_dbg_bus_of_match);
+
+static const struct dev_pm_ops simple_pm_bus_pm_ops = {
+	SET_RUNTIME_PM_OPS(stm32_dbg_bus_runtime_suspend, stm32_dbg_bus_runtime_resume, NULL)
+	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
+};
+
+static struct platform_driver stm32_dbg_bus_driver = {
+	.probe = stm32_dbg_bus_plat_probe,
+	.driver = {
+		.name = "stm32-dbg-bus",
+		.of_match_table = of_match_ptr(stm32_dbg_bus_of_match),
+		.pm = pm_ptr(&simple_pm_bus_pm_ops),
+	},
+};
+
+static int optee_ctx_match(struct tee_ioctl_version_data *ver, const void *data)
+{
+	return (ver->impl_id == TEE_IMPL_ID_OPTEE);
+}
+
+static int stm32_dbg_bus_probe(struct device *dev)
+{
+	struct stm32_dbg_bus *priv;
+
+	if (stm32_dbg_bus_priv)
+		return dev_err_probe(dev, -EBUSY,
+				     "A STM32 debug bus device is already initialized\n");
+
+	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
+	if (!priv)
+		return dev_err_probe(dev, -ENOMEM, "Cannot allocate priv data\n");
+
+	/* Open context with TEE driver */
+	priv->ctx = tee_client_open_context(NULL, optee_ctx_match, NULL, NULL);
+	if (IS_ERR_OR_NULL(priv->ctx))
+		return dev_err_probe(dev, PTR_ERR_OR_ZERO(priv->ctx), "Cannot open TEE context\n");
+
+	stm32_dbg_bus_priv = priv;
+	stm32_dbg_bus_priv->dev = dev;
+
+	return 0;
+}
+
+static int stm32_dbg_bus_remove(struct device *dev)
+{
+	tee_client_close_context(stm32_dbg_bus_priv->ctx);
+	stm32_dbg_bus_priv = NULL;
+
+	return 0;
+}
+
+static const struct tee_client_device_id optee_dbg_bus_id_table[] = {
+	{UUID_INIT(0xdd05bc8b, 0x9f3b, 0x49f0,
+		   0xb6, 0x49, 0x01, 0xaa, 0x10, 0xc1, 0xc2, 0x10)},
+	{}
+};
+
+static struct tee_client_driver stm32_optee_dbg_bus_driver = {
+	.id_table = optee_dbg_bus_id_table,
+	.driver = {
+		.name = "optee_dbg_bus",
+		.bus = &tee_bus_type,
+		.probe = stm32_dbg_bus_probe,
+		.remove = stm32_dbg_bus_remove,
+	},
+};
+
+static int __init optee_dbg_bus_mod_init(void)
+{
+	int ret;
+
+	ret = driver_register(&stm32_optee_dbg_bus_driver.driver);
+	if (ret)
+		return ret;
+
+	ret = platform_driver_register(&stm32_dbg_bus_driver);
+	if (ret)
+		driver_unregister(&stm32_optee_dbg_bus_driver.driver);
+
+	return ret;
+}
+
+static void __exit optee_dbg_bus_mod_exit(void)
+{
+	platform_driver_unregister(&stm32_dbg_bus_driver);
+	driver_unregister(&stm32_optee_dbg_bus_driver.driver);
+}
+
+module_init(optee_dbg_bus_mod_init);
+module_exit(optee_dbg_bus_mod_exit);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Gatien Chevallier <gatien.chevallier@foss.st.com>");
+MODULE_DESCRIPTION("OP-TEE based STM32 debug access bus driver");

-- 
2.43.0

Re: [PATCH 05/11] drivers: bus: add the stm32 debug bus driver

[Krzysztof Kozlowski]

On 09/01/2026 11:55, Gatien Chevallier wrote:
> Add the stm32 debug bus driver that is responsible of checking the
> +
> +static int stm32_dbg_bus_grant_access(struct stm32_firewall_controller *ctrl, u32 dbg_profile)
> +{
> +	struct tee_ioctl_invoke_arg inv_arg = {0};
> +	struct tee_param param[1] = {0};
> +	u32 session_id;
> +	int ret;
> +
> +	if (dbg_profile != PERIPHERAL_DBG_PROFILE && dbg_profile != HDP_DBG_PROFILE)
> +		return -EOPNOTSUPP;
> +
> +	ret = stm32_dbg_pta_open_session(&session_id);
> +	if (ret)
> +		return ret;
> +
> +	inv_arg.func = PTA_CMD_GRANT_DBG_ACCESS;
> +	inv_arg.session = session_id;
> +	inv_arg.num_params = 1;
> +	param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT;
> +	param[0].u.value.a = dbg_profile;
> +
> +	ret = tee_client_invoke_func(stm32_dbg_bus_priv->ctx, &inv_arg, param);
> +	if (ret < 0 || inv_arg.ret != 0) {
> +		dev_dbg(stm32_dbg_bus_priv->dev,
> +			"When invoking function, err %x, TEE returns: %x\n", ret, inv_arg.ret);
> +		if (!ret)
> +			ret = -EACCES;
> +	}
> +
> +	stm32_dbg_pta_close_session(session_id);
> +
> +	return ret;
> +}
> +
> +/* Implement mandatory release_access ops even if it does nothing*/
> +static void stm32_dbg_bus_release_access(struct stm32_firewall_controller *ctrl, u32 dbg_profile)
> +{
> +}
> +
> +static int stm32_dbg_bus_plat_probe(struct platform_device *pdev)
> +{
> +	struct stm32_firewall_controller *dbg_controller;
> +	int ret;
> +
> +	if (!stm32_dbg_bus_priv)
> +		return dev_err_probe(&pdev->dev, -EPROBE_DEFER,
> +				     "OP-TEE debug services not yet available\n");
> +
> +	dbg_controller = devm_kzalloc(&pdev->dev, sizeof(*dbg_controller), GFP_KERNEL);
> +	if (!dbg_controller)
> +		return dev_err_probe(&pdev->dev, -ENOMEM, "Couldn't allocate debug controller\n");
> +
> +	dbg_controller->dev = &pdev->dev;
> +	dbg_controller->mmio = NULL;
> +	dbg_controller->name = dev_driver_string(dbg_controller->dev);
> +	dbg_controller->type = STM32_PERIPHERAL_FIREWALL;
> +	dbg_controller->grant_access = stm32_dbg_bus_grant_access;
> +	dbg_controller->release_access = stm32_dbg_bus_release_access;
> +
> +	stm32_dbg_bus_priv->dbg_clk = devm_clk_get_enabled(&pdev->dev, NULL);
> +	if (IS_ERR(stm32_dbg_bus_priv->dbg_clk))
> +		return PTR_ERR(stm32_dbg_bus_priv->dbg_clk);
> +
> +	ret = stm32_firewall_controller_register(dbg_controller);
> +	if (ret) {
> +		dev_err(dbg_controller->dev, "Couldn't register as a firewall controller: %d", ret);
> +		return ret;
> +	}
> +
> +	ret = stm32_firewall_populate_bus(dbg_controller);
> +	if (ret) {
> +		dev_err(dbg_controller->dev, "Couldn't populate debug bus: %d", ret);
> +		stm32_firewall_controller_unregister(dbg_controller);
> +		return ret;
> +	}
> +
> +	pm_runtime_enable(&pdev->dev);
> +
> +	ret = of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
> +	if (ret) {
> +		dev_err(dbg_controller->dev, "Couldn't populate the node: %d", ret);
> +		stm32_firewall_controller_unregister(dbg_controller);
> +		return ret;

Where do you depopulate on unbind?

> +	}
> +
> +	return 0;
> +}
> +
> +static int __maybe_unused stm32_dbg_bus_runtime_suspend(struct device *dev)
> +{
> +	clk_disable_unprepare(stm32_dbg_bus_priv->dbg_clk);
> +
> +	return 0;
> +}
> +
> +static int __maybe_unused stm32_dbg_bus_runtime_resume(struct device *dev)
> +{
> +	int ret = clk_prepare_enable(stm32_dbg_bus_priv->dbg_clk);
> +
> +	if (ret) {
> +		dev_err(dev, "Failed to enable clock: %d\n", ret);
> +		return ret;
> +	}
> +
> +	return 0;
> +}
> +
> +static const struct of_device_id stm32_dbg_bus_of_match[] = {
> +	{ .compatible = "st,stm32mp131-dbg-bus", },
> +	{ .compatible = "st,stm32mp151-dbg-bus", },

So devices are fully compatible?

> +	{ },
> +};
> +MODULE_DEVICE_TABLE(of, stm32_dbg_bus_of_match);
> +
> +static const struct dev_pm_ops simple_pm_bus_pm_ops = {
> +	SET_RUNTIME_PM_OPS(stm32_dbg_bus_runtime_suspend, stm32_dbg_bus_runtime_resume, NULL)
> +	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
> +};
> +
> +static struct platform_driver stm32_dbg_bus_driver = {
> +	.probe = stm32_dbg_bus_plat_probe,
> +	.driver = {
> +		.name = "stm32-dbg-bus",
> +		.of_match_table = of_match_ptr(stm32_dbg_bus_of_match),

Warning :/. Why do people still keep copying of_match_ptr?

> +		.pm = pm_ptr(&simple_pm_bus_pm_ops),
> +	},
> +};
> +
> +static int optee_ctx_match(struct tee_ioctl_version_data *ver, const void *data)
> +{
> +	return (ver->impl_id == TEE_IMPL_ID_OPTEE);
> +}
> +
> +static int stm32_dbg_bus_probe(struct device *dev)
> +{
> +	struct stm32_dbg_bus *priv;
> +
> +	if (stm32_dbg_bus_priv)
> +		return dev_err_probe(dev, -EBUSY,
> +				     "A STM32 debug bus device is already initialized\n");
> +
> +	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
> +	if (!priv)
> +		return dev_err_probe(dev, -ENOMEM, "Cannot allocate priv data\n");

You NEVER print error allocations on kzalloc, even if with dev_err_probe
it is silenced.

> +
> +	/* Open context with TEE driver */
> +	priv->ctx = tee_client_open_context(NULL, optee_ctx_match, NULL, NULL);
> +	if (IS_ERR_OR_NULL(priv->ctx))
> +		return dev_err_probe(dev, PTR_ERR_OR_ZERO(priv->ctx), "Cannot open TEE context\n");
> +
> +	stm32_dbg_bus_priv = priv;
> +	stm32_dbg_bus_priv->dev = dev;
> +
> +	return 0;
> +}
> +
> +static int stm32_dbg_bus_remove(struct device *dev)
> +{
> +	tee_client_close_context(stm32_dbg_bus_priv->ctx);
> +	stm32_dbg_bus_priv = NULL;
> +
> +	return 0;
> +}
> +
> +static const struct tee_client_device_id optee_dbg_bus_id_table[] = {
> +	{UUID_INIT(0xdd05bc8b, 0x9f3b, 0x49f0,
> +		   0xb6, 0x49, 0x01, 0xaa, 0x10, 0xc1, 0xc2, 0x10)},
> +	{}
> +};
> +
> +static struct tee_client_driver stm32_optee_dbg_bus_driver = {
> +	.id_table = optee_dbg_bus_id_table,
> +	.driver = {
> +		.name = "optee_dbg_bus",
> +		.bus = &tee_bus_type,
> +		.probe = stm32_dbg_bus_probe,
> +		.remove = stm32_dbg_bus_remove,
> +	},
> +};
> +
> +static int __init optee_dbg_bus_mod_init(void)
> +{
> +	int ret;
> +
> +	ret = driver_register(&stm32_optee_dbg_bus_driver.driver);
> +	if (ret)
> +		return ret;
> +
> +	ret = platform_driver_register(&stm32_dbg_bus_driver);
> +	if (ret)
> +		driver_unregister(&stm32_optee_dbg_bus_driver.driver);
> +
> +	return ret;
> +}
> +
> +static void __exit optee_dbg_bus_mod_exit(void)
> +{
> +	platform_driver_unregister(&stm32_dbg_bus_driver);
> +	driver_unregister(&stm32_optee_dbg_bus_driver.driver);
> +}
> +
> +module_init(optee_dbg_bus_mod_init);
> +module_exit(optee_dbg_bus_mod_exit);
> +
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR("Gatien Chevallier <gatien.chevallier@foss.st.com>");
> +MODULE_DESCRIPTION("OP-TEE based STM32 debug access bus driver");
> 


Best regards,
Krzysztof

Re: [PATCH 05/11] drivers: bus: add the stm32 debug bus driver

[Gatien CHEVALLIER]

On 1/11/26 12:27, Krzysztof Kozlowski wrote:
> On 09/01/2026 11:55, Gatien Chevallier wrote:
>> Add the stm32 debug bus driver that is responsible of checking the
>> +
>> +static int stm32_dbg_bus_grant_access(struct stm32_firewall_controller *ctrl, u32 dbg_profile)
>> +{
>> +	struct tee_ioctl_invoke_arg inv_arg = {0};
>> +	struct tee_param param[1] = {0};
>> +	u32 session_id;
>> +	int ret;
>> +
>> +	if (dbg_profile != PERIPHERAL_DBG_PROFILE && dbg_profile != HDP_DBG_PROFILE)
>> +		return -EOPNOTSUPP;
>> +
>> +	ret = stm32_dbg_pta_open_session(&session_id);
>> +	if (ret)
>> +		return ret;
>> +
>> +	inv_arg.func = PTA_CMD_GRANT_DBG_ACCESS;
>> +	inv_arg.session = session_id;
>> +	inv_arg.num_params = 1;
>> +	param[0].attr = TEE_IOCTL_PARAM_ATTR_TYPE_VALUE_INPUT;
>> +	param[0].u.value.a = dbg_profile;
>> +
>> +	ret = tee_client_invoke_func(stm32_dbg_bus_priv->ctx, &inv_arg, param);
>> +	if (ret < 0 || inv_arg.ret != 0) {
>> +		dev_dbg(stm32_dbg_bus_priv->dev,
>> +			"When invoking function, err %x, TEE returns: %x\n", ret, inv_arg.ret);
>> +		if (!ret)
>> +			ret = -EACCES;
>> +	}
>> +
>> +	stm32_dbg_pta_close_session(session_id);
>> +
>> +	return ret;
>> +}
>> +
>> +/* Implement mandatory release_access ops even if it does nothing*/
>> +static void stm32_dbg_bus_release_access(struct stm32_firewall_controller *ctrl, u32 dbg_profile)
>> +{
>> +}
>> +
>> +static int stm32_dbg_bus_plat_probe(struct platform_device *pdev)
>> +{
>> +	struct stm32_firewall_controller *dbg_controller;
>> +	int ret;
>> +
>> +	if (!stm32_dbg_bus_priv)
>> +		return dev_err_probe(&pdev->dev, -EPROBE_DEFER,
>> +				     "OP-TEE debug services not yet available\n");
>> +
>> +	dbg_controller = devm_kzalloc(&pdev->dev, sizeof(*dbg_controller), GFP_KERNEL);
>> +	if (!dbg_controller)
>> +		return dev_err_probe(&pdev->dev, -ENOMEM, "Couldn't allocate debug controller\n");
>> +
>> +	dbg_controller->dev = &pdev->dev;
>> +	dbg_controller->mmio = NULL;
>> +	dbg_controller->name = dev_driver_string(dbg_controller->dev);
>> +	dbg_controller->type = STM32_PERIPHERAL_FIREWALL;
>> +	dbg_controller->grant_access = stm32_dbg_bus_grant_access;
>> +	dbg_controller->release_access = stm32_dbg_bus_release_access;
>> +
>> +	stm32_dbg_bus_priv->dbg_clk = devm_clk_get_enabled(&pdev->dev, NULL);
>> +	if (IS_ERR(stm32_dbg_bus_priv->dbg_clk))
>> +		return PTR_ERR(stm32_dbg_bus_priv->dbg_clk);
>> +
>> +	ret = stm32_firewall_controller_register(dbg_controller);
>> +	if (ret) {
>> +		dev_err(dbg_controller->dev, "Couldn't register as a firewall controller: %d", ret);
>> +		return ret;
>> +	}
>> +
>> +	ret = stm32_firewall_populate_bus(dbg_controller);
>> +	if (ret) {
>> +		dev_err(dbg_controller->dev, "Couldn't populate debug bus: %d", ret);
>> +		stm32_firewall_controller_unregister(dbg_controller);
>> +		return ret;
>> +	}
>> +
>> +	pm_runtime_enable(&pdev->dev);
>> +
>> +	ret = of_platform_populate(pdev->dev.of_node, NULL, NULL, &pdev->dev);
>> +	if (ret) {
>> +		dev_err(dbg_controller->dev, "Couldn't populate the node: %d", ret);
>> +		stm32_firewall_controller_unregister(dbg_controller);
>> +		return ret;
> 
> Where do you depopulate on unbind?
> 

Nowhere, so I'll add it for V2.

>> +	}
>> +
>> +	return 0;
>> +}
>> +
>> +static int __maybe_unused stm32_dbg_bus_runtime_suspend(struct device *dev)
>> +{
>> +	clk_disable_unprepare(stm32_dbg_bus_priv->dbg_clk);
>> +
>> +	return 0;
>> +}
>> +
>> +static int __maybe_unused stm32_dbg_bus_runtime_resume(struct device *dev)
>> +{
>> +	int ret = clk_prepare_enable(stm32_dbg_bus_priv->dbg_clk);
>> +
>> +	if (ret) {
>> +		dev_err(dev, "Failed to enable clock: %d\n", ret);
>> +		return ret;
>> +	}
>> +
>> +	return 0;
>> +}
>> +
>> +static const struct of_device_id stm32_dbg_bus_of_match[] = {
>> +	{ .compatible = "st,stm32mp131-dbg-bus", },
>> +	{ .compatible = "st,stm32mp151-dbg-bus", },
> 
> So devices are fully compatible?
> 

As it is a standard bus, yes. The goal of this driver is to be
able to interface with the secure world to check the debug
configuration.

>> +	{ },
>> +};
>> +MODULE_DEVICE_TABLE(of, stm32_dbg_bus_of_match);
>> +
>> +static const struct dev_pm_ops simple_pm_bus_pm_ops = {
>> +	SET_RUNTIME_PM_OPS(stm32_dbg_bus_runtime_suspend, stm32_dbg_bus_runtime_resume, NULL)
>> +	SET_SYSTEM_SLEEP_PM_OPS(pm_runtime_force_suspend, pm_runtime_force_resume)
>> +};
>> +
>> +static struct platform_driver stm32_dbg_bus_driver = {
>> +	.probe = stm32_dbg_bus_plat_probe,
>> +	.driver = {
>> +		.name = "stm32-dbg-bus",
>> +		.of_match_table = of_match_ptr(stm32_dbg_bus_of_match),
> 
> Warning :/. Why do people still keep copying of_match_ptr?
> 

I'll remove that in V2.

>> +		.pm = pm_ptr(&simple_pm_bus_pm_ops),
>> +	},
>> +};
>> +
>> +static int optee_ctx_match(struct tee_ioctl_version_data *ver, const void *data)
>> +{
>> +	return (ver->impl_id == TEE_IMPL_ID_OPTEE);
>> +}
>> +
>> +static int stm32_dbg_bus_probe(struct device *dev)
>> +{
>> +	struct stm32_dbg_bus *priv;
>> +
>> +	if (stm32_dbg_bus_priv)
>> +		return dev_err_probe(dev, -EBUSY,
>> +				     "A STM32 debug bus device is already initialized\n");
>> +
>> +	priv = devm_kzalloc(dev, sizeof(*priv), GFP_KERNEL);
>> +	if (!priv)
>> +		return dev_err_probe(dev, -ENOMEM, "Cannot allocate priv data\n");
> 
> You NEVER print error allocations on kzalloc, even if with dev_err_probe
> it is silenced.
> 

Ok, I'll keep that in mind and remove that for V2.

Best regards,
Gatien

>> +
>> +	/* Open context with TEE driver */
>> +	priv->ctx = tee_client_open_context(NULL, optee_ctx_match, NULL, NULL);
>> +	if (IS_ERR_OR_NULL(priv->ctx))
>> +		return dev_err_probe(dev, PTR_ERR_OR_ZERO(priv->ctx), "Cannot open TEE context\n");
>> +
>> +	stm32_dbg_bus_priv = priv;
>> +	stm32_dbg_bus_priv->dev = dev;
>> +
>> +	return 0;
>> +}
>> +
>> +static int stm32_dbg_bus_remove(struct device *dev)
>> +{
>> +	tee_client_close_context(stm32_dbg_bus_priv->ctx);
>> +	stm32_dbg_bus_priv = NULL;
>> +
>> +	return 0;
>> +}
>> +
>> +static const struct tee_client_device_id optee_dbg_bus_id_table[] = {
>> +	{UUID_INIT(0xdd05bc8b, 0x9f3b, 0x49f0,
>> +		   0xb6, 0x49, 0x01, 0xaa, 0x10, 0xc1, 0xc2, 0x10)},
>> +	{}
>> +};
>> +
>> +static struct tee_client_driver stm32_optee_dbg_bus_driver = {
>> +	.id_table = optee_dbg_bus_id_table,
>> +	.driver = {
>> +		.name = "optee_dbg_bus",
>> +		.bus = &tee_bus_type,
>> +		.probe = stm32_dbg_bus_probe,
>> +		.remove = stm32_dbg_bus_remove,
>> +	},
>> +};
>> +
>> +static int __init optee_dbg_bus_mod_init(void)
>> +{
>> +	int ret;
>> +
>> +	ret = driver_register(&stm32_optee_dbg_bus_driver.driver);
>> +	if (ret)
>> +		return ret;
>> +
>> +	ret = platform_driver_register(&stm32_dbg_bus_driver);
>> +	if (ret)
>> +		driver_unregister(&stm32_optee_dbg_bus_driver.driver);
>> +
>> +	return ret;
>> +}
>> +
>> +static void __exit optee_dbg_bus_mod_exit(void)
>> +{
>> +	platform_driver_unregister(&stm32_dbg_bus_driver);
>> +	driver_unregister(&stm32_optee_dbg_bus_driver.driver);
>> +}
>> +
>> +module_init(optee_dbg_bus_mod_init);
>> +module_exit(optee_dbg_bus_mod_exit);
>> +
>> +MODULE_LICENSE("GPL");
>> +MODULE_AUTHOR("Gatien Chevallier <gatien.chevallier@foss.st.com>");
>> +MODULE_DESCRIPTION("OP-TEE based STM32 debug access bus driver");
>>
> 
> 
> Best regards,
> Krzysztof

Re: [PATCH 05/11] drivers: bus: add the stm32 debug bus driver

[Jens Wiklander]

Hi,

On Fri, Jan 9, 2026 at 11:57 AM Gatien Chevallier
<gatien.chevallier@foss.st.com> wrote:
>
> Add the stm32 debug bus driver that is responsible of checking the
> debug subsystem accessibility before probing the related peripheral
> drivers.
>
> This driver is OP-TEE dependent and relies on the STM32 debug access
> PTA.
>
> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
> ---
>  MAINTAINERS                 |   1 +
>  drivers/bus/Kconfig         |  10 ++
>  drivers/bus/Makefile        |   1 +
>  drivers/bus/stm32_dbg_bus.c | 285 ++++++++++++++++++++++++++++++++++++++++++++
>  4 files changed, 297 insertions(+)
>

[snip]

> +
> +static const struct tee_client_device_id optee_dbg_bus_id_table[] = {
> +       {UUID_INIT(0xdd05bc8b, 0x9f3b, 0x49f0,
> +                  0xb6, 0x49, 0x01, 0xaa, 0x10, 0xc1, 0xc2, 0x10)},
> +       {}
> +};
> +
> +static struct tee_client_driver stm32_optee_dbg_bus_driver = {
> +       .id_table = optee_dbg_bus_id_table,
> +       .driver = {
> +               .name = "optee_dbg_bus",
> +               .bus = &tee_bus_type,
> +               .probe = stm32_dbg_bus_probe,
> +               .remove = stm32_dbg_bus_remove,
> +       },
> +};

Just a heads up. With
https://lore.kernel.org/op-tee/cover.1765791463.git.u.kleine-koenig@baylibre.com/
we're switching to use bus methods instead of device_driver callbacks.
That plan is to merge that patch set in the next merge window.

Cheers,
Jens

> +
> +static int __init optee_dbg_bus_mod_init(void)
> +{
> +       int ret;
> +
> +       ret = driver_register(&stm32_optee_dbg_bus_driver.driver);
> +       if (ret)
> +               return ret;
> +
> +       ret = platform_driver_register(&stm32_dbg_bus_driver);
> +       if (ret)
> +               driver_unregister(&stm32_optee_dbg_bus_driver.driver);
> +
> +       return ret;
> +}
> +
> +static void __exit optee_dbg_bus_mod_exit(void)
> +{
> +       platform_driver_unregister(&stm32_dbg_bus_driver);
> +       driver_unregister(&stm32_optee_dbg_bus_driver.driver);
> +}
> +
> +module_init(optee_dbg_bus_mod_init);
> +module_exit(optee_dbg_bus_mod_exit);
> +
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR("Gatien Chevallier <gatien.chevallier@foss.st.com>");
> +MODULE_DESCRIPTION("OP-TEE based STM32 debug access bus driver");
>
> --
> 2.43.0
>
>

Re: [PATCH 05/11] drivers: bus: add the stm32 debug bus driver

[Gatien CHEVALLIER]

On 1/13/26 15:45, Jens Wiklander wrote:
> Hi,
> 
> On Fri, Jan 9, 2026 at 11:57 AM Gatien Chevallier
> <gatien.chevallier@foss.st.com> wrote:
>>
>> Add the stm32 debug bus driver that is responsible of checking the
>> debug subsystem accessibility before probing the related peripheral
>> drivers.
>>
>> This driver is OP-TEE dependent and relies on the STM32 debug access
>> PTA.
>>
>> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
>> ---
>>   MAINTAINERS                 |   1 +
>>   drivers/bus/Kconfig         |  10 ++
>>   drivers/bus/Makefile        |   1 +
>>   drivers/bus/stm32_dbg_bus.c | 285 ++++++++++++++++++++++++++++++++++++++++++++
>>   4 files changed, 297 insertions(+)
>>
> 
> [snip]
> 
>> +
>> +static const struct tee_client_device_id optee_dbg_bus_id_table[] = {
>> +       {UUID_INIT(0xdd05bc8b, 0x9f3b, 0x49f0,
>> +                  0xb6, 0x49, 0x01, 0xaa, 0x10, 0xc1, 0xc2, 0x10)},
>> +       {}
>> +};
>> +
>> +static struct tee_client_driver stm32_optee_dbg_bus_driver = {
>> +       .id_table = optee_dbg_bus_id_table,
>> +       .driver = {
>> +               .name = "optee_dbg_bus",
>> +               .bus = &tee_bus_type,
>> +               .probe = stm32_dbg_bus_probe,
>> +               .remove = stm32_dbg_bus_remove,
>> +       },
>> +};
> 
> Just a heads up. With
> https://lore.kernel.org/op-tee/cover.1765791463.git.u.kleine-koenig@baylibre.com/
> we're switching to use bus methods instead of device_driver callbacks.
> That plan is to merge that patch set in the next merge window.
> 
> Cheers,
> Jens
> 

Hello Jens,

Thank you for the link!
Is it fine if I push on top on your "next" branch for the review along
with the appropriate changes? I'm open to suggestions.

Thanks,
Gatien

>> +
>> +static int __init optee_dbg_bus_mod_init(void)
>> +{
>> +       int ret;
>> +
>> +       ret = driver_register(&stm32_optee_dbg_bus_driver.driver);
>> +       if (ret)
>> +               return ret;
>> +
>> +       ret = platform_driver_register(&stm32_dbg_bus_driver);
>> +       if (ret)
>> +               driver_unregister(&stm32_optee_dbg_bus_driver.driver);
>> +
>> +       return ret;
>> +}
>> +
>> +static void __exit optee_dbg_bus_mod_exit(void)
>> +{
>> +       platform_driver_unregister(&stm32_dbg_bus_driver);
>> +       driver_unregister(&stm32_optee_dbg_bus_driver.driver);
>> +}
>> +
>> +module_init(optee_dbg_bus_mod_init);
>> +module_exit(optee_dbg_bus_mod_exit);
>> +
>> +MODULE_LICENSE("GPL");
>> +MODULE_AUTHOR("Gatien Chevallier <gatien.chevallier@foss.st.com>");
>> +MODULE_DESCRIPTION("OP-TEE based STM32 debug access bus driver");
>>
>> --
>> 2.43.0
>>
>>

Re: [PATCH 05/11] drivers: bus: add the stm32 debug bus driver

[Jens Wiklander]

On Tue, Jan 13, 2026 at 5:09 PM Gatien CHEVALLIER
<gatien.chevallier@foss.st.com> wrote:
>
>
>
> On 1/13/26 15:45, Jens Wiklander wrote:
> > Hi,
> >
> > On Fri, Jan 9, 2026 at 11:57 AM Gatien Chevallier
> > <gatien.chevallier@foss.st.com> wrote:
> >>
> >> Add the stm32 debug bus driver that is responsible of checking the
> >> debug subsystem accessibility before probing the related peripheral
> >> drivers.
> >>
> >> This driver is OP-TEE dependent and relies on the STM32 debug access
> >> PTA.
> >>
> >> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
> >> ---
> >>   MAINTAINERS                 |   1 +
> >>   drivers/bus/Kconfig         |  10 ++
> >>   drivers/bus/Makefile        |   1 +
> >>   drivers/bus/stm32_dbg_bus.c | 285 ++++++++++++++++++++++++++++++++++++++++++++
> >>   4 files changed, 297 insertions(+)
> >>
> >
> > [snip]
> >
> >> +
> >> +static const struct tee_client_device_id optee_dbg_bus_id_table[] = {
> >> +       {UUID_INIT(0xdd05bc8b, 0x9f3b, 0x49f0,
> >> +                  0xb6, 0x49, 0x01, 0xaa, 0x10, 0xc1, 0xc2, 0x10)},
> >> +       {}
> >> +};
> >> +
> >> +static struct tee_client_driver stm32_optee_dbg_bus_driver = {
> >> +       .id_table = optee_dbg_bus_id_table,
> >> +       .driver = {
> >> +               .name = "optee_dbg_bus",
> >> +               .bus = &tee_bus_type,
> >> +               .probe = stm32_dbg_bus_probe,
> >> +               .remove = stm32_dbg_bus_remove,
> >> +       },
> >> +};
> >
> > Just a heads up. With
> > https://lore.kernel.org/op-tee/cover.1765791463.git.u.kleine-koenig@baylibre.com/
> > we're switching to use bus methods instead of device_driver callbacks.
> > That plan is to merge that patch set in the next merge window.
> >
> > Cheers,
> > Jens
> >
>
> Hello Jens,
>
> Thank you for the link!
> Is it fine if I push on top on your "next" branch for the review along
> with the appropriate changes? I'm open to suggestions.

Please base it on the tee_bus_callback_for_6.20 branch instead.

Cheers,
Jens

>
> Thanks,
> Gatien
>
> >> +
> >> +static int __init optee_dbg_bus_mod_init(void)
> >> +{
> >> +       int ret;
> >> +
> >> +       ret = driver_register(&stm32_optee_dbg_bus_driver.driver);
> >> +       if (ret)
> >> +               return ret;
> >> +
> >> +       ret = platform_driver_register(&stm32_dbg_bus_driver);
> >> +       if (ret)
> >> +               driver_unregister(&stm32_optee_dbg_bus_driver.driver);
> >> +
> >> +       return ret;
> >> +}
> >> +
> >> +static void __exit optee_dbg_bus_mod_exit(void)
> >> +{
> >> +       platform_driver_unregister(&stm32_dbg_bus_driver);
> >> +       driver_unregister(&stm32_optee_dbg_bus_driver.driver);
> >> +}
> >> +
> >> +module_init(optee_dbg_bus_mod_init);
> >> +module_exit(optee_dbg_bus_mod_exit);
> >> +
> >> +MODULE_LICENSE("GPL");
> >> +MODULE_AUTHOR("Gatien Chevallier <gatien.chevallier@foss.st.com>");
> >> +MODULE_DESCRIPTION("OP-TEE based STM32 debug access bus driver");
> >>
> >> --
> >> 2.43.0
> >>
> >>
>

[PATCH 06/11] arm: dts: stm32: introduce the debug bus for stm32mp1x platforms

[Gatien Chevallier]

Some peripherals cannot be probed if a debug configuration is not set
in the BSEC.
Introduce a debug bus that will check the debug subsystem accessibility
before probing these peripheral drivers.

Add Coresight peripheral nodes under this bus and add the appropriate
access-controllers property to the HDP node.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp131.dtsi | 119 ++++++++++++++++++++++++
 arch/arm/boot/dts/st/stm32mp151.dtsi | 173 +++++++++++++++++++++++++++++++++++
 arch/arm/boot/dts/st/stm32mp153.dtsi |  68 ++++++++++++++
 3 files changed, 360 insertions(+)

diff --git a/arch/arm/boot/dts/st/stm32mp131.dtsi b/arch/arm/boot/dts/st/stm32mp131.dtsi
index b9657ff91c23..d394061b85ac 100644
--- a/arch/arm/boot/dts/st/stm32mp131.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp131.dtsi
@@ -3,6 +3,7 @@
  * Copyright (C) STMicroelectronics 2021 - All Rights Reserved
  * Author: Alexandre Torgue <alexandre.torgue@foss.st.com> for STMicroelectronics.
  */
+#include <dt-bindings/arm/coresight-cti-dt.h>
 #include <dt-bindings/interrupt-controller/arm-gic.h>
 #include <dt-bindings/clock/stm32mp13-clks.h>
 #include <dt-bindings/reset/stm32mp13-resets.h>
@@ -964,9 +965,127 @@ hdp: pinctrl@5002a000 {
 			compatible = "st,stm32mp131-hdp";
 			reg = <0x5002a000 0x400>;
 			clocks = <&rcc HDP>;
+			access-controllers = <&dbg_bus 1>;
 			status = "disabled";
 		};
 
+		dbg_bus: bus@50080000 {
+			compatible = "st,stm32mp131-dbg-bus";
+			reg = <0x50080000 0x3f80000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			clocks = <&rcc CK_DBG>;
+			#access-controller-cells = <1>;
+			ranges;
+			status = "disabled";
+
+			cs_etf: etf@50092000 {
+				compatible = "arm,coresight-tmc", "arm,primecell";
+				reg = <0x50092000 0x1000>;
+				clocks = <&rcc CK_DBG>;
+				clock-names = "apb_pclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				in-ports {
+					port {
+						etf_in_port: endpoint {
+							remote-endpoint = <&etm0_out_port>;
+						};
+					};
+				};
+
+				out-ports {
+					port {
+						etf_out_port: endpoint {
+							remote-endpoint = <&tpiu_in_port>;
+						};
+					};
+				};
+			};
+
+			cs_tpiu: tpiu@50093000 {
+				compatible = "arm,coresight-tpiu", "arm,primecell";
+				reg = <0x50093000 0x1000>;
+				clocks = <&rcc CK_DBG>, <&rcc CK_TRACE>;
+				clock-names = "apb_pclk", "atclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				in-ports {
+					port {
+						tpiu_in_port: endpoint {
+							remote-endpoint = <&etf_out_port>;
+						};
+					};
+				};
+			};
+
+			cs_cti_trace: cti@50094000 {
+				compatible = "arm,coresight-cti", "arm,primecell";
+				reg = <0x50094000 0x1000>;
+				clocks = <&rcc CK_DBG>;
+				clock-names = "apb_pclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+			};
+
+			cs_cti_cpu0: cti@500d8000 {
+				compatible = "arm,coresight-cti", "arm,primecell";
+				reg = <0x500d8000 0x1000>;
+				clocks = <&rcc CK_DBG>;
+				clock-names = "apb_pclk";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				trig-conns@0 {
+					reg = <0>;
+					arm,trig-in-sigs = <0 4 5>;
+					arm,trig-in-types = <PE_DBGTRIGGER
+							     GEN_IO
+							     GEN_IO>;
+					arm,trig-out-sigs = <0 7>;
+					arm,trig-out-types = <PE_EDBGREQ
+							      PE_DBGRESTART>;
+					cpu = <&cpu0>;
+				};
+
+				trig-conns@2 {
+					reg = <2>;
+					arm,trig-in-sigs = <2 3 6>;
+					arm,trig-in-types = <ETM_EXTOUT
+							     ETM_EXTOUT
+							     ETM_EXTOUT>;
+					arm,trig-out-sigs = <1 2 3 4>;
+					arm,trig-out-types = <ETM_EXTIN
+							      ETM_EXTIN
+							      ETM_EXTIN
+							      ETM_EXTIN>;
+					arm,cs-dev-assoc = <&cs_etm0>;
+				};
+			};
+
+			cs_etm0: etm@500dc000 {
+				compatible = "arm,coresight-etm3x", "arm,primecell";
+				reg = <0x500dc000 0x1000>;
+				cpu = <&cpu0>;
+				clocks = <&rcc CK_DBG>, <&rcc CK_TRACE>;
+				clock-names = "apb_pclk", "atclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				out-ports {
+					port {
+						etm0_out_port: endpoint {
+							remote-endpoint = <&etf_in_port>;
+						};
+					};
+				};
+			};
+		};
+
 		mdma: dma-controller@58000000 {
 			compatible = "st,stm32h7-mdma";
 			reg = <0x58000000 0x1000>;
diff --git a/arch/arm/boot/dts/st/stm32mp151.dtsi b/arch/arm/boot/dts/st/stm32mp151.dtsi
index b1b568dfd126..a6371d626a2e 100644
--- a/arch/arm/boot/dts/st/stm32mp151.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp151.dtsi
@@ -3,6 +3,7 @@
  * Copyright (C) STMicroelectronics 2017 - All Rights Reserved
  * Author: Ludovic Barre <ludovic.barre@st.com> for STMicroelectronics.
  */
+#include <dt-bindings/arm/coresight-cti-dt.h>
 #include <dt-bindings/interrupt-controller/arm-gic.h>
 #include <dt-bindings/clock/stm32mp1-clks.h>
 #include <dt-bindings/reset/stm32mp1-resets.h>
@@ -274,9 +275,181 @@ hdp: pinctrl@5002a000 {
 			compatible = "st,stm32mp151-hdp";
 			reg = <0x5002a000 0x400>;
 			clocks = <&rcc HDP>;
+			access-controllers = <&dbg_bus 1>;
 			status = "disabled";
 		};
 
+		dbg_bus: bus@50080000 {
+			compatible = "st,stm32mp151-dbg-bus";
+			reg = <0x50080000 0x3f80000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			clocks = <&rcc CK_DBG>;
+			#access-controller-cells = <1>;
+			ranges;
+			status = "disabled";
+
+			cs_funnel: funnel@50091000 {
+				compatible = "arm,coresight-dynamic-funnel", "arm,primecell";
+				reg = <0x50091000 0x1000>;
+				clocks = <&rcc CK_DBG>, <&rcc CK_TRACE>;
+				clock-names = "apb_pclk", "atclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				in-ports {
+					#address-cells = <1>;
+					#size-cells = <0>;
+					port@0 {
+						reg = <0>;
+						funnel_in_port0: endpoint {
+							remote-endpoint = <&stm_out_port>;
+						};
+					};
+
+					port@1 {
+						reg = <1>;
+						funnel_in_port1: endpoint {
+							remote-endpoint = <&etm0_out>;
+						};
+					};
+				};
+
+				out-ports {
+					port {
+						funnel_out_port: endpoint {
+							remote-endpoint = <&etf_in_port>;
+						};
+					};
+				};
+			};
+
+			cs_etf: etf@50092000 {
+				compatible = "arm,coresight-tmc", "arm,primecell";
+				reg = <0x50092000 0x1000>;
+				clocks = <&rcc CK_DBG>;
+				clock-names = "apb_pclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				in-ports {
+					port {
+						etf_in_port: endpoint {
+							remote-endpoint = <&funnel_out_port>;
+						};
+					};
+				};
+
+				out-ports {
+					port {
+						etf_out_port: endpoint {
+							remote-endpoint = <&tpiu_in_port>;
+						};
+					};
+				};
+			};
+
+			cs_tpiu: tpiu@50093000 {
+				compatible = "arm,coresight-tpiu", "arm,primecell";
+				reg = <0x50093000 0x1000>;
+				clocks = <&rcc CK_DBG>, <&rcc CK_TRACE>;
+				clock-names = "apb_pclk", "atclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				in-ports {
+					port {
+						tpiu_in_port: endpoint {
+							remote-endpoint = <&etf_out_port>;
+						};
+					};
+				};
+			};
+
+			cs_cti_trace: cti@50094000 {
+				compatible = "arm,coresight-cti", "arm,primecell";
+				reg = <0x50094000 0x1000>;
+				clocks = <&rcc CK_DBG>;
+				clock-names = "apb_pclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+			};
+
+			cs_stm: stm@500a0000 {
+				compatible = "arm,coresight-stm", "arm,primecell";
+				reg = <0x500a0000 0x00001000>,
+				<0x90000000 0x01000000>;
+				reg-names = "stm-base", "stm-stimulus-base";
+				clocks = <&rcc CK_DBG>, <&rcc CK_TRACE>;
+				clock-names = "apb_pclk", "atclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				out-ports {
+					port {
+						stm_out_port: endpoint {
+							remote-endpoint = <&funnel_in_port0>;
+						};
+					};
+				};
+			};
+
+			cs_cti_cpu0: cti@500d8000 {
+				compatible = "arm,coresight-cti", "arm,primecell";
+				reg = <0x500d8000 0x1000>;
+				clocks = <&rcc CK_DBG>;
+				clock-names = "apb_pclk";
+				#address-cells = <1>;
+				#size-cells = <0>;
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				trig-conns@0 {
+					reg = <0>;
+					arm,trig-in-sigs = <0 4 5>;
+					arm,trig-in-types = <PE_DBGTRIGGER
+							     GEN_IO
+							     GEN_IO>;
+					arm,trig-out-sigs = <0 7>;
+					arm,trig-out-types = <PE_EDBGREQ
+							      PE_DBGRESTART>;
+					cpu = <&cpu0>;
+				};
+
+				trig-conns@2 {
+					reg = <2>;
+					arm,trig-in-sigs = <2 3 6>;
+					arm,trig-in-types = <ETM_EXTOUT
+							     ETM_EXTOUT
+							     ETM_EXTOUT>;
+					arm,trig-out-sigs = <1 2 3 4>;
+					arm,trig-out-types = <ETM_EXTIN
+							      ETM_EXTIN
+							      ETM_EXTIN
+							      ETM_EXTIN>;
+					arm,cs-dev-assoc = <&cs_etm0>;
+				};
+			};
+
+			cs_etm0: etm@500dc000 {
+				compatible = "arm,coresight-etm3x", "arm,primecell";
+				reg = <0x500dc000 0x1000>;
+				cpu = <&cpu0>;
+				clocks = <&rcc CK_DBG>, <&rcc CK_TRACE>;
+				clock-names = "apb_pclk", "atclk";
+				access-controllers = <&dbg_bus 0>;
+				status = "disabled";
+
+				out-ports {
+					port {
+						etm0_out: endpoint {
+							remote-endpoint = <&funnel_in_port1>;
+						};
+					};
+				};
+			};
+		};
+
 		mdma1: dma-controller@58000000 {
 			compatible = "st,stm32h7-mdma";
 			reg = <0x58000000 0x1000>;
diff --git a/arch/arm/boot/dts/st/stm32mp153.dtsi b/arch/arm/boot/dts/st/stm32mp153.dtsi
index 92794b942ab2..17d52d93695e 100644
--- a/arch/arm/boot/dts/st/stm32mp153.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp153.dtsi
@@ -30,6 +30,74 @@ timer {
 	};
 };
 
+&cs_funnel {
+	in-ports {
+		port@2 {
+			reg = <2>;
+			funnel_in_port2: endpoint {
+				remote-endpoint = <&etm1_out>;
+			};
+		};
+	};
+};
+
+&dbg_bus {
+	cs_cti_cpu1: cti@500d9000 {
+		compatible = "arm,coresight-cti", "arm,primecell";
+		reg = <0x500d9000 0x1000>;
+		clocks = <&rcc CK_DBG>;
+		clock-names = "apb_pclk";
+		#address-cells = <1>;
+		#size-cells = <0>;
+		access-controllers = <&dbg_bus 0>;
+		status = "disabled";
+
+		trig-conns@0 {
+			reg = <0>;
+			arm,trig-in-sigs = <0 4 5>;
+			arm,trig-in-types = <PE_DBGTRIGGER
+					     GEN_IO
+					     GEN_IO>;
+			arm,trig-out-sigs = <0 7>;
+			arm,trig-out-types = <PE_EDBGREQ
+					      PE_DBGRESTART>;
+			cpu = <&cpu1>;
+		};
+
+		trig-conns@2 {
+			reg = <2>;
+			arm,trig-in-sigs = <2 3 6>;
+			arm,trig-in-types = <ETM_EXTOUT
+					     ETM_EXTOUT
+					     ETM_EXTOUT>;
+			arm,trig-out-sigs = <1 2 3 4>;
+			arm,trig-out-types = <ETM_EXTIN
+					      ETM_EXTIN
+					      ETM_EXTIN
+					      ETM_EXTIN>;
+			arm,cs-dev-assoc = <&cs_etm1>;
+		};
+	};
+
+	cs_etm1: etm@500dd000 {
+		compatible = "arm,coresight-etm3x", "arm,primecell";
+		reg = <0x500dd000 0x1000>;
+		cpu = <&cpu1>;
+		clocks = <&rcc CK_DBG>, <&rcc CK_TRACE>;
+		clock-names = "apb_pclk", "atclk";
+		access-controllers = <&dbg_bus 0>;
+		status = "disabled";
+
+		out-ports {
+			port {
+				etm1_out: endpoint {
+					remote-endpoint = <&funnel_in_port2>;
+				};
+			};
+		};
+	};
+};
+
 &etzpc {
 	m_can1: can@4400e000 {
 		compatible = "bosch,m_can";

-- 
2.43.0

[PATCH 07/11] arm: dts: stm32: enable the debug bus on stm32mp1x boards

[Gatien Chevallier]

On stm32mp1x boards, enable the debug bus so we always try to probe
the debug peripherals, if their status and the debug configuration
allow it.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp135f-dk.dts   | 4 ++++
 arch/arm/boot/dts/st/stm32mp157c-ev1.dts  | 4 ++++
 arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/arch/arm/boot/dts/st/stm32mp135f-dk.dts b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
index f894ee35b3db..ebc719797271 100644
--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
@@ -174,6 +174,10 @@ &cryp {
 	status = "okay";
 };
 
+&dbg_bus {
+	status = "okay";
+};
+
 &dcmipp {
 	pinctrl-names = "default", "sleep";
 	pinctrl-0 = <&dcmipp_pins_a>;
diff --git a/arch/arm/boot/dts/st/stm32mp157c-ev1.dts b/arch/arm/boot/dts/st/stm32mp157c-ev1.dts
index 8f99c30f1af1..e69c8e282c8b 100644
--- a/arch/arm/boot/dts/st/stm32mp157c-ev1.dts
+++ b/arch/arm/boot/dts/st/stm32mp157c-ev1.dts
@@ -81,6 +81,10 @@ &cec {
 	status = "okay";
 };
 
+&dbg_bus {
+	status = "okay";
+};
+
 &dcmi {
 	status = "okay";
 	pinctrl-names = "default", "sleep";
diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi
index 8cea6facd27b..fe2ab07ea4a8 100644
--- a/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi
@@ -140,6 +140,10 @@ &crc1 {
 	status = "okay";
 };
 
+&dbg_bus {
+	status = "okay";
+};
+
 &dts {
 	status = "okay";
 };

-- 
2.43.0

[PATCH 08/11] arm: dts: stm32: enable CoreSight on stm32mp15xx-dkx boards

[Gatien Chevallier]

Enable CoreSight peripherals on the stm32mp15xx-dkx boards. All boards
including this file are embedding a dual core SoC so this change is
applicable.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi | 36 +++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi
index fe2ab07ea4a8..c91204476161 100644
--- a/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi
@@ -140,6 +140,42 @@ &crc1 {
 	status = "okay";
 };
 
+&cs_cti_trace {
+	status = "okay";
+};
+
+&cs_cti_cpu0 {
+	status = "okay";
+};
+
+&cs_cti_cpu1 {
+	status = "okay";
+};
+
+&cs_etf {
+	status = "okay";
+};
+
+&cs_etm0 {
+	status = "okay";
+};
+
+&cs_etm1 {
+	status = "okay";
+};
+
+&cs_funnel {
+	status = "okay";
+};
+
+&cs_stm {
+	status = "okay";
+};
+
+&cs_tpiu {
+	status = "okay";
+};
+
 &dbg_bus {
 	status = "okay";
 };

-- 
2.43.0

[PATCH 09/11] arm: dts: stm32: enable CoreSight on the stm32mp157c-ev1 board

[Gatien Chevallier]

Enable CoreSight peripherals on the stm32mp157c-ev1 board.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp157c-ev1.dts | 36 ++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/arch/arm/boot/dts/st/stm32mp157c-ev1.dts b/arch/arm/boot/dts/st/stm32mp157c-ev1.dts
index e69c8e282c8b..913c20e31196 100644
--- a/arch/arm/boot/dts/st/stm32mp157c-ev1.dts
+++ b/arch/arm/boot/dts/st/stm32mp157c-ev1.dts
@@ -81,6 +81,42 @@ &cec {
 	status = "okay";
 };
 
+&cs_cti_trace {
+	status = "okay";
+};
+
+&cs_cti_cpu0 {
+	status = "okay";
+};
+
+&cs_cti_cpu1 {
+	status = "okay";
+};
+
+&cs_etf {
+	status = "okay";
+};
+
+&cs_etm0 {
+	status = "okay";
+};
+
+&cs_etm1 {
+	status = "okay";
+};
+
+&cs_funnel {
+	status = "okay";
+};
+
+&cs_stm {
+	status = "okay";
+};
+
+&cs_tpiu {
+	status = "okay";
+};
+
 &dbg_bus {
 	status = "okay";
 };

-- 
2.43.0

[PATCH 10/11] arm: dts: stm32: enable CoreSight on the stm32mp135f-dk board

[Gatien Chevallier]

Enable CoreSight peripherals on the stm32mp135f-dk board.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp135f-dk.dts | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/arch/arm/boot/dts/st/stm32mp135f-dk.dts b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
index ebc719797271..2ce38e46c6d0 100644
--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
@@ -174,6 +174,26 @@ &cryp {
 	status = "okay";
 };
 
+&cs_cti_trace {
+	status = "okay";
+};
+
+&cs_cti_cpu0 {
+	status = "okay";
+};
+
+&cs_etf {
+	status = "okay";
+};
+
+&cs_etm0 {
+	status = "okay";
+};
+
+&cs_tpiu {
+	status = "okay";
+};
+
 &dbg_bus {
 	status = "okay";
 };

-- 
2.43.0

[PATCH 11/11] pinctrl: stm32: add firewall checks before probing the HDP driver

[Gatien Chevallier]

Because the HDP peripheral both depends on debug and firewall
configuration, when CONFIG_STM32_FIREWALL is present, use the
stm32 firewall framework to be able to check these configuration against
the relevant controllers.

Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
---
 drivers/pinctrl/stm32/pinctrl-stm32-hdp.c | 41 +++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/drivers/pinctrl/stm32/pinctrl-stm32-hdp.c b/drivers/pinctrl/stm32/pinctrl-stm32-hdp.c
index 0b1dff01e04c..7e4aa0465c06 100644
--- a/drivers/pinctrl/stm32/pinctrl-stm32-hdp.c
+++ b/drivers/pinctrl/stm32/pinctrl-stm32-hdp.c
@@ -4,6 +4,7 @@
  * Author: Clément Le Goffic <clement.legoffic@foss.st.com> for STMicroelectronics.
  */
 #include <linux/bits.h>
+#include <linux/bus/stm32_firewall_device.h>
 #include <linux/clk.h>
 #include <linux/gpio/driver.h>
 #include <linux/gpio/generic.h>
@@ -605,10 +606,50 @@ MODULE_DEVICE_TABLE(of, stm32_hdp_of_match);
 static int stm32_hdp_probe(struct platform_device *pdev)
 {
 	struct gpio_generic_chip_config config;
+	struct stm32_firewall *firewall = NULL;
 	struct device *dev = &pdev->dev;
 	struct stm32_hdp *hdp;
+	int nb_firewall;
 	u8 version;
 	int err;
+	int i;
+
+	nb_firewall = of_count_phandle_with_args(pdev->dev.of_node, "access-controllers",
+						 "#access-controller-cells");
+	if (IS_ENABLED(CONFIG_STM32_FIREWALL) && nb_firewall != -ENOENT) {
+		if (nb_firewall <= 0)
+			return -EINVAL;
+
+		firewall = devm_kcalloc(dev, nb_firewall, sizeof(*firewall), GFP_KERNEL);
+		if (!firewall)
+			return -ENOMEM;
+
+		/* Get stm32 firewall information */
+		err = stm32_firewall_get_firewall(dev->of_node, firewall, nb_firewall);
+		if (err)
+			return dev_err_probe(dev, err, "Failed to get firewall controller\n");
+
+		for (i = 0; i < nb_firewall; i++) {
+			err = stm32_firewall_grant_access_by_id(firewall + i,
+								firewall[i].firewall_id);
+			if (err) {
+				while (i) {
+					u32 id;
+
+					i--;
+					id = firewall[i].firewall_id;
+					stm32_firewall_release_access_by_id(firewall + i, id);
+				}
+				if (err == -EACCES) {
+					dev_info(dev, "No firewall access\n");
+					return -ENODEV;
+				}
+
+				return dev_err_probe(dev, err, "Error checking firewall access\n");
+			}
+		}
+	}
+
 
 	hdp = devm_kzalloc(dev, sizeof(*hdp), GFP_KERNEL);
 	if (!hdp)

-- 
2.43.0

Re: [PATCH 00/11] bus: add stm32 debug bus and coresight support for stm32mp1x platforms

[Linus Walleij]

Hi Gatien,

thanks for your patch series!

On Fri, Jan 9, 2026 at 11:56 AM Gatien Chevallier
<gatien.chevallier@foss.st.com> wrote:

> Stm32 SoCs embed debug peripherals such as Coresight. These peripherals
> can monitor the activity of the cores. Because of that, they can be
> used only if some features in the debug configuration are enabled.
> Else, errors or firewall exceptions can be observed. Similarly to
> the ETZPC(on stm32mp1x platforms) or the RIFSC(on stm32mp2x platforms),
> debug-related peripherals access can be assessed at bus level to
> prevent these issues from happening.
>
> The debug configuration can only be accessed by the secure world.
> That means that a service must be implemented in the secure world for
> the kernel to check the firewall configuration. On OpenSTLinux, it is
> done through a Debug access PTA in OP-TEE [1].
> To represent the debug peripherals present on a dedicated debug bus,
> create a debug bus node in the device tree and the associated driver
> that will interact with this PTA.
>
> [1]: https://github.com/OP-TEE/optee_os/pull/7673
>
> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>

I think Jens Wiklander wants to have a look at this partch
series, so added him to the To:.

Yours,
Linus Walleij

Re: [PATCH 00/11] bus: add stm32 debug bus and coresight support for stm32mp1x platforms

[Gatien CHEVALLIER]

On 1/10/26 00:10, Linus Walleij wrote:
> Hi Gatien,
> 
> thanks for your patch series!
> 
> On Fri, Jan 9, 2026 at 11:56 AM Gatien Chevallier
> <gatien.chevallier@foss.st.com> wrote:
> 
>> Stm32 SoCs embed debug peripherals such as Coresight. These peripherals
>> can monitor the activity of the cores. Because of that, they can be
>> used only if some features in the debug configuration are enabled.
>> Else, errors or firewall exceptions can be observed. Similarly to
>> the ETZPC(on stm32mp1x platforms) or the RIFSC(on stm32mp2x platforms),
>> debug-related peripherals access can be assessed at bus level to
>> prevent these issues from happening.
>>
>> The debug configuration can only be accessed by the secure world.
>> That means that a service must be implemented in the secure world for
>> the kernel to check the firewall configuration. On OpenSTLinux, it is
>> done through a Debug access PTA in OP-TEE [1].
>> To represent the debug peripherals present on a dedicated debug bus,
>> create a debug bus node in the device tree and the associated driver
>> that will interact with this PTA.
>>
>> [1]: https://github.com/OP-TEE/optee_os/pull/7673
>>
>> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
> 
> I think Jens Wiklander wants to have a look at this partch
> series, so added him to the To:.
> 
> Yours,
> Linus Walleij

Hi Linus,

Sure, I'll keep the To. addition for V2, thank you.

Best regards,
Gatien

Re: [PATCH 00/11] bus: add stm32 debug bus and coresight support for stm32mp1x platforms

[Rob Herring]

On Fri, 09 Jan 2026 11:55:00 +0100, Gatien Chevallier wrote:
> Stm32 SoCs embed debug peripherals such as Coresight. These peripherals
> can monitor the activity of the cores. Because of that, they can be
> used only if some features in the debug configuration are enabled.
> Else, errors or firewall exceptions can be observed. Similarly to
> the ETZPC(on stm32mp1x platforms) or the RIFSC(on stm32mp2x platforms),
> debug-related peripherals access can be assessed at bus level to
> prevent these issues from happening.
> 
> The debug configuration can only be accessed by the secure world.
> That means that a service must be implemented in the secure world for
> the kernel to check the firewall configuration. On OpenSTLinux, it is
> done through a Debug access PTA in OP-TEE [1].
> To represent the debug peripherals present on a dedicated debug bus,
> create a debug bus node in the device tree and the associated driver
> that will interact with this PTA.
> 
> [1]: https://github.com/OP-TEE/optee_os/pull/7673
> 
> Signed-off-by: Gatien Chevallier <gatien.chevallier@foss.st.com>
> ---
> Gatien Chevallier (11):
>       dt-bindings: document access-controllers property for coresight peripherals
>       dt-bindings: pinctrl: document access-controllers property for stm32 HDP
>       dt-bindings: bus: document the stm32 debug bus
>       bus: stm32_firewall: allow check on different firewall controllers
>       drivers: bus: add the stm32 debug bus driver
>       arm: dts: stm32: introduce the debug bus for stm32mp1x platforms
>       arm: dts: stm32: enable the debug bus on stm32mp1x boards
>       arm: dts: stm32: enable CoreSight on stm32mp15xx-dkx boards
>       arm: dts: stm32: enable CoreSight on the stm32mp157c-ev1 board
>       arm: dts: stm32: enable CoreSight on the stm32mp135f-dk board
>       pinctrl: stm32: add firewall checks before probing the HDP driver
> 
>  .../devicetree/bindings/arm/arm,coresight-cti.yaml |   3 +
>  .../devicetree/bindings/arm/arm,coresight-etm.yaml |   3 +
>  .../devicetree/bindings/arm/arm,coresight-tmc.yaml |   3 +
>  .../bindings/arm/arm,coresight-tpiu.yaml           |   3 +
>  .../bindings/bus/st,stm32mp131-dbg-bus.yaml        |  86 +++++++
>  .../devicetree/bindings/pinctrl/st,stm32-hdp.yaml  |   4 +
>  MAINTAINERS                                        |   1 +
>  arch/arm/boot/dts/st/stm32mp131.dtsi               | 119 +++++++++
>  arch/arm/boot/dts/st/stm32mp135f-dk.dts            |  24 ++
>  arch/arm/boot/dts/st/stm32mp151.dtsi               | 173 +++++++++++++
>  arch/arm/boot/dts/st/stm32mp153.dtsi               |  68 +++++
>  arch/arm/boot/dts/st/stm32mp157c-ev1.dts           |  40 +++
>  arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi          |  40 +++
>  drivers/bus/Kconfig                                |  10 +
>  drivers/bus/Makefile                               |   1 +
>  drivers/bus/stm32_dbg_bus.c                        | 285 +++++++++++++++++++++
>  drivers/bus/stm32_firewall.c                       |   2 +-
>  drivers/pinctrl/stm32/pinctrl-stm32-hdp.c          |  41 +++
>  18 files changed, 905 insertions(+), 1 deletion(-)
> ---
> base-commit: 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb
> change-id: 20260108-debug_bus-392666c7a3aa
> 
> Best regards,
> --
> Gatien Chevallier <gatien.chevallier@foss.st.com>
> 
> 
> 


My bot found new DTB warnings on the .dts files added or changed in this
series.

Some warnings may be from an existing SoC .dtsi. Or perhaps the warnings
are fixed by another series. Ultimately, it is up to the platform
maintainer whether these warnings are acceptable or not. No need to reply
unless the platform maintainer has comments.

If you already ran DT checks and didn't see these error(s), then
make sure dt-schema is up to date:

  pip3 install dtschema --upgrade


This patch series was applied (using b4) to base:
 Base: 9ace4753a5202b02191d54e9fdf7f9e3d02b85eb (use --merge-base to override)

If this is not the correct base, please add 'base-commit' tag
(or use b4 which does this automatically)

New warnings running 'make CHECK_DTBS=y for arch/arm/boot/dts/st/' for 20260109-debug_bus-v1-0-8f2142b5a738@foss.st.com:

arch/arm/boot/dts/st/stm32mp157c-dk2.dtb: funnel@50091000 (arm,coresight-dynamic-funnel): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-dynamic-funnel.yaml
arch/arm/boot/dts/st/stm32mp157c-ev1.dtb: funnel@50091000 (arm,coresight-dynamic-funnel): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-dynamic-funnel.yaml
arch/arm/boot/dts/st/stm32mp157c-dk2.dtb: stm@500a0000 (arm,coresight-stm): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-stm.yaml
arch/arm/boot/dts/st/stm32mp157c-ev1.dtb: stm@500a0000 (arm,coresight-stm): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-stm.yaml
arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dtb: funnel@50091000 (arm,coresight-dynamic-funnel): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-dynamic-funnel.yaml
arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dtb: stm@500a0000 (arm,coresight-stm): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-stm.yaml
arch/arm/boot/dts/st/stm32mp157a-dk1.dtb: funnel@50091000 (arm,coresight-dynamic-funnel): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-dynamic-funnel.yaml
arch/arm/boot/dts/st/stm32mp157a-dk1.dtb: stm@500a0000 (arm,coresight-stm): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-stm.yaml
arch/arm/boot/dts/st/stm32mp157f-dk2.dtb: funnel@50091000 (arm,coresight-dynamic-funnel): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-dynamic-funnel.yaml
arch/arm/boot/dts/st/stm32mp157f-dk2.dtb: stm@500a0000 (arm,coresight-stm): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-stm.yaml
arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dtb: funnel@50091000 (arm,coresight-dynamic-funnel): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-dynamic-funnel.yaml
arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dtb: stm@500a0000 (arm,coresight-stm): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-stm.yaml
arch/arm/boot/dts/st/stm32mp157a-iot-box.dtb: serial@40010000 (st,stm32h7-uart): False schema does not allow [[44, 15, 1]]
	from schema $id: http://devicetree.org/schemas/serial/st,stm32-uart.yaml
arch/arm/boot/dts/st/stm32mp157a-iot-box.dtb: serial@40010000 (st,stm32h7-uart): False schema does not allow [[45, 0, 1]]
	from schema $id: http://devicetree.org/schemas/serial/st,stm32-uart.yaml
arch/arm/boot/dts/st/stm32mp157a-iot-box.dtb: serial@40010000 (st,stm32h7-uart): False schema does not allow [[44, 15, 1]]
	from schema $id: http://devicetree.org/schemas/serial/serial.yaml
arch/arm/boot/dts/st/stm32mp157a-iot-box.dtb: serial@40010000 (st,stm32h7-uart): False schema does not allow [[45, 0, 1]]
	from schema $id: http://devicetree.org/schemas/serial/serial.yaml
arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dtb: funnel@50091000 (arm,coresight-dynamic-funnel): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-dynamic-funnel.yaml
arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dtb: stm@500a0000 (arm,coresight-stm): Unevaluated properties are not allowed ('access-controllers' was unexpected)
	from schema $id: http://devicetree.org/schemas/arm/arm,coresight-stm.yaml