[PATCH v3 00/13] Update watchdogs support on STM32MP platforms

[PATCH v3 00/13] Update watchdogs support on STM32MP platforms

[Antonio Borneo]

This series allows the stm32_iwdg watchdog driver to determine
whether the watchdog is already running and adds support for
STM32MP2xx devices.

It also completes and rationalizes the configuration of secure and
non-secure watchdogs across STM32MP devices and ST boards.

For STM32MP1xx devices, it enables the ARM SMC watchdog driver in
the machine Kconfig.

Regards,
Antonio


Changes in v3:
- Add support for detecting watchdog running status
- Add pretimeout irq support on STM32MP2xx
- Build ARM SMC watchdog driver on STM32MP1xx
- Use ARM SMC watchdog on platforms that have secure IWDG1 and use the
  native stm32_iwdg driver when the IWDG1 is non-secure
- Add iwdg1 and iwdg2 nodes on STM32MP2xx platforms
- Add the alias in device trees to have the system watchdog allocated
  as watchdog0, independently from the probe order
- Link to v2: https://lore.kernel.org/lkml/20261015154826.1947492-1-antonio.borneo@foss.st.com/

Changes in v2:
- Drop addition of iwdg1 DT node, not needed as OP-TEE keep the watchdog
  secure on all boards;
- Link to v1: https://lore.kernel.org/lkml/20261007151358.1166329-1-antonio.borneo@foss.st.com/

Amelie Delaunay (3):
  ARM: dts: stm32: add iwdg1 node on stm32mp151 SoC
  ARM: dts: stm32: enable iwdg1 on stm32mp15x ST boards
  ARM: dts: stm32: enable arm smc watchdog on stm32mp15x scmi boards

Antonio Borneo (6):
  watchdog: stm32_iwdg: add pretimeout support for iwdg v4.0
  ARM: stm32: enable arm smc watchdog on stm32mp1xx
  ARM: dts: stm32: move arm smc watchdog to stm32mp151 SoC
  ARM: dts: stm32: add watchdog0 alias on ST stm32mp1xx boards
  arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp231
  arm64: dts: st: enable iwdg2 on stm32mp2xx ST boards

Clément Le Goffic (4):
  watchdog: stm32_iwdg: get hardware version during probe
  watchdog: stm32_iwdg: detect whether the watchdog is running
  arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp211
  arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp251

 arch/arm/boot/dts/st/stm32mp135f-dk.dts       |  1 +
 arch/arm/boot/dts/st/stm32mp15-scmi.dtsi      |  4 +
 arch/arm/boot/dts/st/stm32mp151.dtsi          | 16 ++++
 arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts |  9 +++
 arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts |  9 +++
 arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts |  9 +++
 arch/arm/boot/dts/st/stm32mp157c-ed1.dts      |  6 ++
 arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts |  9 +++
 .../arm/boot/dts/st/stm32mp157f-dk2-scmi.dtsi |  7 --
 arch/arm/boot/dts/st/stm32mp157f-dk2.dts      |  1 +
 arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi     |  6 ++
 arch/arm/mach-stm32/Kconfig                   |  2 +
 arch/arm64/boot/dts/st/stm32mp211.dtsi        | 20 +++++
 arch/arm64/boot/dts/st/stm32mp215f-dk.dts     |  6 ++
 arch/arm64/boot/dts/st/stm32mp231.dtsi        | 20 +++++
 arch/arm64/boot/dts/st/stm32mp235f-dk.dts     |  6 ++
 arch/arm64/boot/dts/st/stm32mp251.dtsi        | 20 +++++
 arch/arm64/boot/dts/st/stm32mp257f-dk.dts     |  8 +-
 arch/arm64/boot/dts/st/stm32mp257f-ev1.dts    |  6 ++
 drivers/watchdog/stm32_iwdg.c                 | 73 ++++++++++++++-----
 20 files changed, 211 insertions(+), 27 deletions(-)


base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
-- 
2.34.1

[PATCH v3 01/13] watchdog: stm32_iwdg: get hardware version during probe

[Antonio Borneo]

From: Clément Le Goffic <clement.legoffic@foss.st.com>

Get the hardware version of the IWDG peripheral during probe.

Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 drivers/watchdog/stm32_iwdg.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/watchdog/stm32_iwdg.c b/drivers/watchdog/stm32_iwdg.c
index a8d2db2d3cf8b..30b4cbf20afa9 100644
--- a/drivers/watchdog/stm32_iwdg.c
+++ b/drivers/watchdog/stm32_iwdg.c
@@ -30,6 +30,7 @@
 #define IWDG_SR		0x0C /* Status Register */
 #define IWDG_WINR	0x10 /* Windows Register */
 #define IWDG_EWCR	0x14 /* Early Wake-up Register */
+#define IWDG_VERR	0x3F4 /* Version Register */
 
 /* IWDG_KR register bit mask */
 #define KR_KEY_RELOAD	0xAAAA /* reload counter enable */
@@ -53,6 +54,9 @@
 #define EWCR_EWIC	BIT(14) /* Watchdog early interrupt acknowledge */
 #define EWCR_EWIE	BIT(15) /* Watchdog early interrupt enable */
 
+/* IWDG_VERR register mask */
+#define VERR_MASK	GENMASK(7, 0)
+
 /* set timeout to 100000 us */
 #define TIMEOUT_US	100000
 #define SLEEP_US	1000
@@ -82,6 +86,7 @@ struct stm32_iwdg {
 	struct clk		*clk_lsi;
 	struct clk		*clk_pclk;
 	unsigned int		rate;
+	unsigned int		hw_version;
 };
 
 static inline u32 reg_read(void __iomem *base, u32 reg)
@@ -351,6 +356,8 @@ static int stm32_iwdg_probe(struct platform_device *pdev)
 	if (ret)
 		return ret;
 
+	wdt->hw_version = reg_read(wdt->regs, IWDG_VERR) & VERR_MASK;
+
 	watchdog_set_drvdata(wdd, wdt);
 	watchdog_set_nowayout(wdd, WATCHDOG_NOWAYOUT);
 	watchdog_init_timeout(wdd, 0, dev);
-- 
2.34.1

[PATCH v3 02/13] watchdog: stm32_iwdg: detect whether the watchdog is running

[Antonio Borneo]

From: Clément Le Goffic <clement.legoffic@foss.st.com>

On STM32MP13x and STM32MP2xx platforms, the ONF bit in the IWDG
status register indicates whether the watchdog is running. This
feature was introduced with IWDG hardware version 3.1 and is not
available on older versions, such as the one used on STM32MP15x.

On older hardware versions, determine the watchdog state by
writing the current reload value back to the reload register,
then checking the RVU (Reload Value Update) bit in the status
register. The update completes only if the watchdog is already
running.

Use this state information to service only watchdogs that were
started by earlier boot stages.

Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 drivers/watchdog/stm32_iwdg.c | 45 +++++++++++++++++++++++------------
 1 file changed, 30 insertions(+), 15 deletions(-)

diff --git a/drivers/watchdog/stm32_iwdg.c b/drivers/watchdog/stm32_iwdg.c
index 30b4cbf20afa9..ce3e1f96ef50a 100644
--- a/drivers/watchdog/stm32_iwdg.c
+++ b/drivers/watchdog/stm32_iwdg.c
@@ -49,6 +49,7 @@
 /* IWDG_SR register bit mask */
 #define SR_PVU	BIT(0) /* Watchdog prescaler value update */
 #define SR_RVU	BIT(1) /* Watchdog counter reload value update */
+#define SR_ONF	BIT(8) /* Watchdog enable status bit */
 
 #define EWCR_EWIT	GENMASK(11, 0) /* Watchdog counter window value */
 #define EWCR_EWIC	BIT(14) /* Watchdog early interrupt acknowledge */
@@ -57,6 +58,9 @@
 /* IWDG_VERR register mask */
 #define VERR_MASK	GENMASK(7, 0)
 
+/* IWDG Compatibility */
+#define ONF_MIN_VER	0x31
+
 /* set timeout to 100000 us */
 #define TIMEOUT_US	100000
 #define SLEEP_US	1000
@@ -250,6 +254,31 @@ static int stm32_iwdg_clk_init(struct platform_device *pdev,
 	return 0;
 }
 
+static bool stm32_iwdg_is_running(struct stm32_iwdg *wdt)
+{
+	bool running;
+	u32 rlr, sr;
+	int ret;
+
+	if (wdt->hw_version >= ONF_MIN_VER)
+		return (reg_read(wdt->regs, IWDG_SR) & SR_ONF) != 0;
+
+	/*
+	 * Workaround for old versions without IWDG_SR_ONF bit:
+	 * - write in IWDG_RLR_OFFSET
+	 * - wait for sync
+	 * - if sync succeeds, then iwdg is running
+	 */
+	reg_write(wdt->regs, IWDG_KR, KR_KEY_EWA);
+	rlr = reg_read(wdt->regs, IWDG_RLR);
+	reg_write(wdt->regs, IWDG_RLR, rlr);
+	ret = readl_poll_timeout(wdt->regs + IWDG_SR, sr, !(sr & SR_RVU), SLEEP_US, TIMEOUT_US);
+	running = ret ? false : true;
+	reg_write(wdt->regs, IWDG_KR, KR_KEY_DWA);
+
+	return running;
+}
+
 static const struct watchdog_info stm32_iwdg_info = {
 	.options	= WDIOF_SETTIMEOUT |
 			  WDIOF_MAGICCLOSE |
@@ -362,23 +391,9 @@ static int stm32_iwdg_probe(struct platform_device *pdev)
 	watchdog_set_nowayout(wdd, WATCHDOG_NOWAYOUT);
 	watchdog_init_timeout(wdd, 0, dev);
 
-	/*
-	 * In case of CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED is set
-	 * (Means U-Boot/bootloaders leaves the watchdog running)
-	 * When we get here we should make a decision to prevent
-	 * any side effects before user space daemon will take care of it.
-	 * The best option, taking into consideration that there is no
-	 * way to read values back from hardware, is to enforce watchdog
-	 * being run with deterministic values.
-	 */
-	if (IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED)) {
-		ret = stm32_iwdg_start(wdd);
-		if (ret)
-			return ret;
-
+	if (IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED) && stm32_iwdg_is_running(wdt))
 		/* Make sure the watchdog is serviced */
 		set_bit(WDOG_HW_RUNNING, &wdd->status);
-	}
 
 	ret = devm_watchdog_register_device(dev, wdd);
 	if (ret)
-- 
2.34.1

[PATCH v3 03/13] watchdog: stm32_iwdg: add pretimeout support for iwdg v4.0

[Antonio Borneo]

IWDG hardware version 4.0, used on STM32MP2xx platforms, has a
different register layout for acknowledging pretimeout interrupts.

Use the interrupt clear register (ICR) to acknowledge pretimeout
interrupts on hardware version 4.0 and later.
Add a reg_set() helper to improve code readability.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 drivers/watchdog/stm32_iwdg.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/drivers/watchdog/stm32_iwdg.c b/drivers/watchdog/stm32_iwdg.c
index ce3e1f96ef50a..6121c23889655 100644
--- a/drivers/watchdog/stm32_iwdg.c
+++ b/drivers/watchdog/stm32_iwdg.c
@@ -30,6 +30,7 @@
 #define IWDG_SR		0x0C /* Status Register */
 #define IWDG_WINR	0x10 /* Windows Register */
 #define IWDG_EWCR	0x14 /* Early Wake-up Register */
+#define IWDG_ICR	0x18 /* Interrupt Clear Register */
 #define IWDG_VERR	0x3F4 /* Version Register */
 
 /* IWDG_KR register bit mask */
@@ -55,11 +56,14 @@
 #define EWCR_EWIC	BIT(14) /* Watchdog early interrupt acknowledge */
 #define EWCR_EWIE	BIT(15) /* Watchdog early interrupt enable */
 
+#define ICR_EWIC	BIT(15) /* Watchdog early interrupt acknowledge */
+
 /* IWDG_VERR register mask */
 #define VERR_MASK	GENMASK(7, 0)
 
 /* IWDG Compatibility */
 #define ONF_MIN_VER	0x31
+#define ICR_MIN_VER	0x40
 
 /* set timeout to 100000 us */
 #define TIMEOUT_US	100000
@@ -103,6 +107,15 @@ static inline void reg_write(void __iomem *base, u32 reg, u32 val)
 	writel_relaxed(val, base + reg);
 }
 
+static inline void reg_set(void __iomem *base, u32 reg, u32 set)
+{
+	u32 val;
+
+	val = readl_relaxed(base + reg);
+	val |= set;
+	writel_relaxed(val, base + reg);
+}
+
 static int stm32_iwdg_start(struct watchdog_device *wdd)
 {
 	struct stm32_iwdg *wdt = watchdog_get_drvdata(wdd);
@@ -194,11 +207,11 @@ static irqreturn_t stm32_iwdg_isr(int irq, void *wdog_arg)
 {
 	struct watchdog_device *wdd = wdog_arg;
 	struct stm32_iwdg *wdt = watchdog_get_drvdata(wdd);
-	u32 reg;
 
-	reg = reg_read(wdt->regs, IWDG_EWCR);
-	reg |= EWCR_EWIC;
-	reg_write(wdt->regs, IWDG_EWCR, reg);
+	if (wdt->hw_version >= ICR_MIN_VER)
+		reg_write(wdt->regs, IWDG_ICR, ICR_EWIC);
+	else
+		reg_set(wdt->regs, IWDG_EWCR, EWCR_EWIC);
 
 	watchdog_notify_pretimeout(wdd);
 
-- 
2.34.1

[PATCH v3 04/13] ARM: stm32: enable arm smc watchdog on stm32mp1xx

[Antonio Borneo]

The watchdog IWDG1 is secure by default on STM32MP1xx SoCs.
On boards that keep it secure, Linux must use the arm,smc-wdt
driver to ping it.

Enable the driver for mach-stm32 when ARCH_MULTI_V7 is enabled.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm/mach-stm32/Kconfig | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/arch/arm/mach-stm32/Kconfig b/arch/arm/mach-stm32/Kconfig
index 4ac3384e397aa..de09b2afa0f2e 100644
--- a/arch/arm/mach-stm32/Kconfig
+++ b/arch/arm/mach-stm32/Kconfig
@@ -13,6 +13,8 @@ menuconfig ARCH_STM32
 	select RESET_CONTROLLER
 	select STM32_EXTI if ARM_SINGLE_ARMV7M
 	select STM32_FIREWALL
+	select WATCHDOG if ARCH_MULTI_V7
+	select ARM_SMC_WATCHDOG if ARCH_MULTI_V7
 	help
 	  Support for STMicroelectronics STM32MP1 processors using Cortex-A7
 	  cores. Note that support for the earlier Cortex-M based variants
-- 
2.34.1

[PATCH v3 05/13] ARM: dts: stm32: add iwdg1 node on stm32mp151 SoC

[Antonio Borneo]

From: Amelie Delaunay <amelie.delaunay@foss.st.com>

On STM32MP15x boards where IWDG1 is exposed as a non-secure
watchdog, Linux must register and periodically ping it if it was
started by an earlier boot stage.

Add the IWDG1 node to the STM32MP151 SoC device tree as a child
of the ETZPC node.

Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp151.dtsi | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/arch/arm/boot/dts/st/stm32mp151.dtsi b/arch/arm/boot/dts/st/stm32mp151.dtsi
index ae31883732388..e71b2ab58aa54 100644
--- a/arch/arm/boot/dts/st/stm32mp151.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp151.dtsi
@@ -2037,6 +2037,16 @@ i2c4: i2c@5c002000 {
 				status = "disabled";
 			};
 
+			iwdg1: watchdog@5c003000 {
+				compatible = "st,stm32mp1-iwdg";
+				reg = <0x5c003000 0x400>;
+				interrupts = <GIC_SPI 150 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&rcc IWDG1>, <&rcc CK_LSI>;
+				clock-names = "pclk", "lsi";
+				access-controllers = <&etzpc 2>;
+				status = "disabled";
+			};
+
 			i2c6: i2c@5c009000 {
 				compatible = "st,stm32mp15-i2c";
 				reg = <0x5c009000 0x400>;
-- 
2.34.1

[PATCH v3 06/13] ARM: dts: stm32: enable iwdg1 on stm32mp15x ST boards

[Antonio Borneo]

From: Amelie Delaunay <amelie.delaunay@foss.st.com>

On STM32MP15x ST boards where IWDG1 is exposed as a non-secure
watchdog, Linux must register and periodically ping it if it was
started by an earlier boot stage.

Enable the IWDG1 node on ST non-SCMI boards that use this
non-secure watchdog configuration.

With two watchdogs now enabled on ST STM32MP2xx boards, assign the
watchdog0 alias to the IWDG1 watchdog that may have been started
by an earlier boot stage. This allows userspace to identify and
ping the appropriate watchdog.

Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp15-scmi.dtsi  | 4 ++++
 arch/arm/boot/dts/st/stm32mp157c-ed1.dts  | 6 ++++++
 arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi | 6 ++++++
 3 files changed, 16 insertions(+)

diff --git a/arch/arm/boot/dts/st/stm32mp15-scmi.dtsi b/arch/arm/boot/dts/st/stm32mp15-scmi.dtsi
index 98552fe45d4e0..cc9521b105262 100644
--- a/arch/arm/boot/dts/st/stm32mp15-scmi.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp15-scmi.dtsi
@@ -64,6 +64,10 @@ scmi_usb33: regulator@2 {
 	};
 };
 
+&iwdg1 {
+	status = "disabled";
+};
+
 &reg11 {
 	status = "disabled";
 };
diff --git a/arch/arm/boot/dts/st/stm32mp157c-ed1.dts b/arch/arm/boot/dts/st/stm32mp157c-ed1.dts
index 49dd555cc228c..6c7dfbee29528 100644
--- a/arch/arm/boot/dts/st/stm32mp157c-ed1.dts
+++ b/arch/arm/boot/dts/st/stm32mp157c-ed1.dts
@@ -19,6 +19,7 @@ / {
 
 	aliases {
 		serial0 = &uart4;
+		watchdog0 = &iwdg1;
 	};
 
 	chosen {
@@ -331,6 +332,11 @@ &ipcc {
 	status = "okay";
 };
 
+&iwdg1 {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 &iwdg2 {
 	timeout-sec = <32>;
 	status = "okay";
diff --git a/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi b/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi
index 1a07ae09afb2a..9722e2ab07794 100644
--- a/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp15xx-dkx.dtsi
@@ -13,6 +13,7 @@ aliases {
 		serial0 = &uart4;
 		serial1 = &usart3;
 		serial2 = &uart7;
+		watchdog0 = &iwdg1;
 	};
 
 	memory@c0000000 {
@@ -511,6 +512,11 @@ &ipcc {
 	status = "okay";
 };
 
+&iwdg1 {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 &iwdg2 {
 	timeout-sec = <32>;
 	status = "okay";
-- 
2.34.1

[PATCH v3 07/13] ARM: dts: stm32: move arm smc watchdog to stm32mp151 SoC

[Antonio Borneo]

On boards where IWDG1 is secure and monitored by OP-TEE, Linux
must control the watchdog through SMC calls.

Move the arm,smc-wdt node to the STM32MP151 SoC device tree so
that board device trees can enable it as needed.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp151.dtsi           | 6 ++++++
 arch/arm/boot/dts/st/stm32mp157f-dk2-scmi.dtsi | 7 -------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/arch/arm/boot/dts/st/stm32mp151.dtsi b/arch/arm/boot/dts/st/stm32mp151.dtsi
index e71b2ab58aa54..d00a36a8c93ba 100644
--- a/arch/arm/boot/dts/st/stm32mp151.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp151.dtsi
@@ -31,6 +31,12 @@ arm-pmu {
 		interrupt-parent = <&intc>;
 	};
 
+	arm_wdt: watchdog {
+		compatible = "arm,smc-wdt";
+		arm,smc-id = <0xbc000000>;
+		status = "disabled";
+	};
+
 	psci {
 		compatible = "arm,psci-1.0";
 		method = "smc";
diff --git a/arch/arm/boot/dts/st/stm32mp157f-dk2-scmi.dtsi b/arch/arm/boot/dts/st/stm32mp157f-dk2-scmi.dtsi
index 172347769e025..27ea5e79efc66 100644
--- a/arch/arm/boot/dts/st/stm32mp157f-dk2-scmi.dtsi
+++ b/arch/arm/boot/dts/st/stm32mp157f-dk2-scmi.dtsi
@@ -13,13 +13,6 @@ optee@de000000 {
 			no-map;
 		};
 	};
-
-	arm_wdt: watchdog {
-		compatible = "arm,smc-wdt";
-		arm,smc-id = <0xbc000000>;
-		status = "disabled";
-	};
-
 };
 
 &adc {
-- 
2.34.1

[PATCH v3 08/13] ARM: dts: stm32: enable arm smc watchdog on stm32mp15x scmi boards

[Antonio Borneo]

From: Amelie Delaunay <amelie.delaunay@foss.st.com>

On STM32MP15x SCMI boards, IWDG1 is secure and monitored by OP-TEE.

Enable the arm,smc-wdt node on ST SCMI board variants so that
Linux can control the secure watchdog through SMC calls.

With two watchdogs now enabled on ST STM32MP2xx boards, assign the
watchdog0 alias to the ARM SMC watchdog that may have been started
by an earlier boot stage. This allows userspace to identify and
ping the appropriate watchdog.

Signed-off-by: Amelie Delaunay <amelie.delaunay@foss.st.com>
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts | 9 +++++++++
 arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts | 9 +++++++++
 arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts | 9 +++++++++
 arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts | 9 +++++++++
 4 files changed, 36 insertions(+)

diff --git a/arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts b/arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts
index 53e40e2f776b7..2f4d212de3e9c 100644
--- a/arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts
+++ b/arch/arm/boot/dts/st/stm32mp157a-dk1-scmi.dts
@@ -13,6 +13,10 @@ / {
 	model = "STMicroelectronics STM32MP157A-DK1 SCMI Discovery Board";
 	compatible = "st,stm32mp157a-dk1-scmi", "st,stm32mp157";
 
+	aliases {
+		watchdog0 = &arm_wdt;
+	};
+
 	reserved-memory {
 		optee@de000000 {
 			reg = <0xde000000 0x2000000>;
@@ -21,6 +25,11 @@ optee@de000000 {
 	};
 };
 
+&arm_wdt {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 &cpu0 {
 	clocks = <&scmi_clk CK_SCMI_MPU>;
 };
diff --git a/arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts b/arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts
index 0790ed426ebc0..41ba8a5b756b1 100644
--- a/arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts
+++ b/arch/arm/boot/dts/st/stm32mp157c-dk2-scmi.dts
@@ -13,6 +13,10 @@ / {
 	model = "STMicroelectronics STM32MP157C-DK2 SCMI Discovery Board";
 	compatible = "st,stm32mp157c-dk2-scmi", "st,stm32mp157";
 
+	aliases {
+		watchdog0 = &arm_wdt;
+	};
+
 	reserved-memory {
 		optee@de000000 {
 			reg = <0xde000000 0x2000000>;
@@ -21,6 +25,11 @@ optee@de000000 {
 	};
 };
 
+&arm_wdt {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 &cpu0 {
 	clocks = <&scmi_clk CK_SCMI_MPU>;
 };
diff --git a/arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts b/arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts
index 0a3894aff4aea..2fad04ed60161 100644
--- a/arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts
+++ b/arch/arm/boot/dts/st/stm32mp157c-ed1-scmi.dts
@@ -13,6 +13,10 @@ / {
 	model = "STMicroelectronics STM32MP157C-ED1 SCMI eval daughter";
 	compatible = "st,stm32mp157c-ed1-scmi", "st,stm32mp157";
 
+	aliases {
+		watchdog0 = &arm_wdt;
+	};
+
 	reserved-memory {
 		optee@fe000000 {
 			reg = <0xfe000000 0x2000000>;
@@ -21,6 +25,11 @@ optee@fe000000 {
 	};
 };
 
+&arm_wdt {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 &cpu0 {
 	clocks = <&scmi_clk CK_SCMI_MPU>;
 };
diff --git a/arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts b/arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts
index c2b6efb1cbb74..d14506e9b6f0e 100644
--- a/arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts
+++ b/arch/arm/boot/dts/st/stm32mp157c-ev1-scmi.dts
@@ -13,6 +13,10 @@ / {
 	model = "STMicroelectronics STM32MP157C-EV1 SCMI eval daughter on eval mother";
 	compatible = "st,stm32mp157c-ev1-scmi", "st,stm32mp157c-ed1", "st,stm32mp157";
 
+	aliases {
+		watchdog0 = &arm_wdt;
+	};
+
 	reserved-memory {
 		optee@fe000000 {
 			reg = <0xfe000000 0x2000000>;
@@ -21,6 +25,11 @@ optee@fe000000 {
 	};
 };
 
+&arm_wdt {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 &cpu0 {
 	clocks = <&scmi_clk CK_SCMI_MPU>;
 };
-- 
2.34.1

[PATCH v3 09/13] ARM: dts: stm32: add watchdog0 alias on ST stm32mp1xx boards

[Antonio Borneo]

With two watchdogs enabled on ST STM32MP1xx boards, assign the
watchdog0 alias to the watchdog that may have been started by an
earlier boot stage.

This allows userspace to identify and ping the appropriate
watchdog.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm/boot/dts/st/stm32mp135f-dk.dts  | 1 +
 arch/arm/boot/dts/st/stm32mp157f-dk2.dts | 1 +
 2 files changed, 2 insertions(+)

diff --git a/arch/arm/boot/dts/st/stm32mp135f-dk.dts b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
index 2d6c5af7e4816..bd403acb1577f 100644
--- a/arch/arm/boot/dts/st/stm32mp135f-dk.dts
+++ b/arch/arm/boot/dts/st/stm32mp135f-dk.dts
@@ -24,6 +24,7 @@ aliases {
 		serial1 = &usart1;
 		serial2 = &uart8;
 		serial3 = &usart2;
+		watchdog0 = &arm_wdt;
 	};
 
 	chosen {
diff --git a/arch/arm/boot/dts/st/stm32mp157f-dk2.dts b/arch/arm/boot/dts/st/stm32mp157f-dk2.dts
index 8fa61e54d0261..02697c41a2f6c 100644
--- a/arch/arm/boot/dts/st/stm32mp157f-dk2.dts
+++ b/arch/arm/boot/dts/st/stm32mp157f-dk2.dts
@@ -20,6 +20,7 @@ / {
 	aliases {
 		ethernet0 = &ethernet0;
 		serial3 = &usart2;
+		watchdog0 = &arm_wdt;
 	};
 
 	chosen {
-- 
2.34.1

[PATCH v3 10/13] arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp211

[Antonio Borneo]

From: Clément Le Goffic <clement.legoffic@foss.st.com>

Add the watchdog nodes to the SoC device tree.

Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm64/boot/dts/st/stm32mp211.dtsi | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/arch/arm64/boot/dts/st/stm32mp211.dtsi b/arch/arm64/boot/dts/st/stm32mp211.dtsi
index 4bfd58b26b51b..7ad1c3c304dea 100644
--- a/arch/arm64/boot/dts/st/stm32mp211.dtsi
+++ b/arch/arm64/boot/dts/st/stm32mp211.dtsi
@@ -110,6 +110,26 @@ usart2: serial@400e0000 {
 				access-controllers = <&rifsc 32>;
 				status = "disabled";
 			};
+
+			iwdg1: watchdog@44010000 {
+				compatible = "st,stm32mp1-iwdg";
+				reg = <0x44010000 0x0 0x400>;
+				interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&rcc CK_BUS_IWDG1>, <&scmi_clk CK_SCMI_LSI>;
+				clock-names = "pclk", "lsi";
+				access-controllers = <&rifsc 100>;
+				status = "disabled";
+			};
+
+			iwdg2: watchdog@44020000 {
+				compatible = "st,stm32mp1-iwdg";
+				reg = <0x44020000 0x0 0x400>;
+				interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&rcc CK_BUS_IWDG2>, <&scmi_clk CK_SCMI_LSI>;
+				clock-names = "pclk", "lsi";
+				access-controllers = <&rifsc 101>;
+				status = "disabled";
+			};
 		};
 
 		bsec: efuse@44000000 {
-- 
2.34.1

[PATCH v3 11/13] arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp231

[Antonio Borneo]

Add the watchdog nodes to the SoC device tree.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm64/boot/dts/st/stm32mp231.dtsi | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/arch/arm64/boot/dts/st/stm32mp231.dtsi b/arch/arm64/boot/dts/st/stm32mp231.dtsi
index fefbf6f4f1537..db19429896eb3 100644
--- a/arch/arm64/boot/dts/st/stm32mp231.dtsi
+++ b/arch/arm64/boot/dts/st/stm32mp231.dtsi
@@ -724,6 +724,26 @@ rng: rng@42020000 {
 				status = "disabled";
 			};
 
+			iwdg1: watchdog@44010000 {
+				compatible = "st,stm32mp1-iwdg";
+				reg = <0x44010000 0x400>;
+				interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&rcc CK_BUS_IWDG1>, <&scmi_clk CK_SCMI_LSI>;
+				clock-names = "pclk", "lsi";
+				access-controllers = <&rifsc 98>;
+				status = "disabled";
+			};
+
+			iwdg2: watchdog@44020000 {
+				compatible = "st,stm32mp1-iwdg";
+				reg = <0x44020000 0x400>;
+				interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&rcc CK_BUS_IWDG2>, <&scmi_clk CK_SCMI_LSI>;
+				clock-names = "pclk", "lsi";
+				access-controllers = <&rifsc 99>;
+				status = "disabled";
+			};
+
 			spi8: spi@46020000 {
 				compatible = "st,stm32mp25-spi";
 				reg = <0x46020000 0x400>;
-- 
2.34.1

[PATCH v3 12/13] arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp251

[Antonio Borneo]

From: Clément Le Goffic <clement.legoffic@foss.st.com>

Add the watchdog nodes to the SoC device tree.

Signed-off-by: Clément Le Goffic <clement.legoffic@foss.st.com>
Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm64/boot/dts/st/stm32mp251.dtsi | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/arch/arm64/boot/dts/st/stm32mp251.dtsi b/arch/arm64/boot/dts/st/stm32mp251.dtsi
index dac3d2d23ff00..02064fd05a259 100644
--- a/arch/arm64/boot/dts/st/stm32mp251.dtsi
+++ b/arch/arm64/boot/dts/st/stm32mp251.dtsi
@@ -1474,6 +1474,26 @@ rng: rng@42020000 {
 				status = "disabled";
 			};
 
+			iwdg1: watchdog@44010000 {
+				compatible = "st,stm32mp1-iwdg";
+				reg = <0x44010000 0x400>;
+				interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&rcc CK_BUS_IWDG1>, <&scmi_clk CK_SCMI_LSI>;
+				clock-names = "pclk", "lsi";
+				access-controllers = <&rifsc 98>;
+				status = "disabled";
+			};
+
+			iwdg2: watchdog@44020000 {
+				compatible = "st,stm32mp1-iwdg";
+				reg = <0x44020000 0x400>;
+				interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
+				clocks = <&rcc CK_BUS_IWDG2>, <&scmi_clk CK_SCMI_LSI>;
+				clock-names = "pclk", "lsi";
+				access-controllers = <&rifsc 99>;
+				status = "disabled";
+			};
+
 			spi8: spi@46020000 {
 				#address-cells = <1>;
 				#size-cells = <0>;
-- 
2.34.1

[PATCH v3 13/13] arm64: dts: st: enable iwdg2 on stm32mp2xx ST boards

[Antonio Borneo]

Enable the node for IWDG2 in the STM32MP2xx ST boards to make the
watchdog available for userspace.

With two watchdogs now enabled on ST STM32MP2xx boards, assign the
watchdog0 alias to the ARM SMC watchdog that may have been started
by an earlier boot stage. This allows userspace to identify and
ping the appropriate watchdog.

While there, sort alphabetically the aliases.

Signed-off-by: Antonio Borneo <antonio.borneo@foss.st.com>
---
 arch/arm64/boot/dts/st/stm32mp215f-dk.dts  | 6 ++++++
 arch/arm64/boot/dts/st/stm32mp235f-dk.dts  | 6 ++++++
 arch/arm64/boot/dts/st/stm32mp257f-dk.dts  | 8 +++++++-
 arch/arm64/boot/dts/st/stm32mp257f-ev1.dts | 6 ++++++
 4 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/arch/arm64/boot/dts/st/stm32mp215f-dk.dts b/arch/arm64/boot/dts/st/stm32mp215f-dk.dts
index a1285abc80ca5..c7ab340a7e4dc 100644
--- a/arch/arm64/boot/dts/st/stm32mp215f-dk.dts
+++ b/arch/arm64/boot/dts/st/stm32mp215f-dk.dts
@@ -15,6 +15,7 @@ / {
 
 	aliases {
 		serial0 = &usart2;
+		watchdog0 = &arm_wdt;
 	};
 
 	chosen {
@@ -48,6 +49,11 @@ &bsec {
 	bootph-all;
 };
 
+&iwdg2 {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 &usart2 {
 	status = "okay";
 };
diff --git a/arch/arm64/boot/dts/st/stm32mp235f-dk.dts b/arch/arm64/boot/dts/st/stm32mp235f-dk.dts
index f06b334dc9ce1..c71b914547308 100644
--- a/arch/arm64/boot/dts/st/stm32mp235f-dk.dts
+++ b/arch/arm64/boot/dts/st/stm32mp235f-dk.dts
@@ -22,6 +22,7 @@ / {
 	aliases {
 		ethernet0 = &ethernet1;
 		serial0 = &usart2;
+		watchdog0 = &arm_wdt;
 	};
 
 	chosen {
@@ -263,6 +264,11 @@ &i2c8 {
 	/delete-property/dma-names;
 };
 
+&iwdg2 {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 &ltdc {
 	status = "okay";
 	port {
diff --git a/arch/arm64/boot/dts/st/stm32mp257f-dk.dts b/arch/arm64/boot/dts/st/stm32mp257f-dk.dts
index a8f18508db3e4..aa922abccdbc5 100644
--- a/arch/arm64/boot/dts/st/stm32mp257f-dk.dts
+++ b/arch/arm64/boot/dts/st/stm32mp257f-dk.dts
@@ -21,9 +21,10 @@ / {
 
 	aliases {
 		ethernet0 = &ethernet1;
-		serial0 = &usart2;
 		mmc0 = &sdmmc1;
 		mmc1 = &sdmmc2;
+		serial0 = &usart2;
+		watchdog0 = &arm_wdt;
 	};
 
 	chosen {
@@ -271,6 +272,11 @@ &i2c8 {
 	/delete-property/dma-names;
 };
 
+&iwdg2 {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 &ltdc {
 	status = "okay";
 	port {
diff --git a/arch/arm64/boot/dts/st/stm32mp257f-ev1.dts b/arch/arm64/boot/dts/st/stm32mp257f-ev1.dts
index 782b4bb843eeb..dcfc29c620b02 100644
--- a/arch/arm64/boot/dts/st/stm32mp257f-ev1.dts
+++ b/arch/arm64/boot/dts/st/stm32mp257f-ev1.dts
@@ -24,6 +24,7 @@ aliases {
 		ethernet1 = &ethernet1;
 		serial0 = &usart2;
 		serial1 = &usart6;
+		watchdog0 = &arm_wdt;
 	};
 
 	chosen {
@@ -294,6 +295,11 @@ &i2c8 {
 	/delete-property/dma-names;
 };
 
+&iwdg2 {
+	timeout-sec = <32>;
+	status = "okay";
+};
+
 /* use LPTIMER with tick broadcast for suspend mode */
 &lptimer3 {
 	status = "okay";
-- 
2.34.1

Re: [PATCH v3 02/13] watchdog: stm32_iwdg: detect whether the watchdog is running

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [High] watchdog: stm32_iwdg: unconfigured timeout in
  stm32_iwdg_probe()
- [Medium] watchdog: stm32_iwdg: WDOG_HW_RUNNING gated on Kconfig in
  stm32_iwdg_probe()
--

commit 7c2acc17f93336becc29a7a139de848c3db25624
Author: Clément Le Goffic <clement.legoffic@foss.st.com>

watchdog: stm32_iwdg: detect whether the watchdog is running

This commit adds stm32_iwdg_is_running() to detect whether the watchdog
was already started by an earlier boot stage and sets WDOG_HW_RUNNING in
stm32_iwdg_probe() only when it is running.

[Severity: High]
In drivers/watchdog/stm32_iwdg.c at line 394 in stm32_iwdg_probe(), does
removing the call to stm32_iwdg_start(wdd) leave the hardware prescaler
(IWDG_PR), reload value (IWDG_RLR), and early-wakeup interrupt
(IWDG_EWCR) registers out of sync with wdd->timeout and wdd->pretimeout?

When stm32_iwdg_is_running(wdt) returns true, stm32_iwdg_probe() now sets
WDOG_HW_RUNNING without programming wdd->timeout into the hardware or
reading the bootloader's configured timeout back into wdd->timeout.
Because stm32_iwdg_ops provides stm32_iwdg_ping() (line 162), which only
writes KR_KEY_RELOAD to IWDG_KR, the watchdog core's keepalive worker
schedules pings at half of wdd->timeout while reloading the bootloader's
counter value. If the bootloader configured a hardware timeout shorter
than wdd->timeout / 2, the watchdog expires and resets the system before
the next keepalive ping. Even after userspace opens /dev/watchdog,
watchdog_start() in drivers/watchdog/watchdog_dev.c (line 261) sees both
WDOG_HW_RUNNING and wdd->ops->ping set and calls __watchdog_ping(wdd)
instead of wdd->ops->start(wdd), leaving IWDG_PR, IWDG_RLR, and IWDG_EWCR
unconfigured.

[Severity: Medium]
In drivers/watchdog/stm32_iwdg.c at line 394 in stm32_iwdg_probe(),
should setting WDOG_HW_RUNNING be unconditional when
stm32_iwdg_is_running(wdt) is true, rather than gated on
IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED)?

In drivers/watchdog/watchdog_dev.c at line 1099 in
watchdog_cdev_register(), the watchdog core checks watchdog_hw_running()
to pin the module and device references and to evaluate the runtime
watchdog.handle_boot_enabled parameter. Gating the check on
IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED) in the driver prevents
the core from knowing the hardware is active when
CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=n, breaking the
watchdog.handle_boot_enabled=1 kernel command-line override and skipping
the module/device reference pinning.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106163429.618392-1-antonio.borneo@foss.st.com?part=2

Re: [PATCH v3 03/13] watchdog: stm32_iwdg: add pretimeout support for iwdg v4.0

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Medium] watchdog: stm32_iwdg: IRQ enabled before state init in
  stm32_iwdg_probe()
--

commit f781715ad1087a5b9a86d2dd54ce3b998243a348
Author: Antonio Borneo <antonio.borneo@foss.st.com>

watchdog: stm32_iwdg: add pretimeout support for iwdg v4.0

This commit updates stm32_iwdg_isr() to clear pretimeout interrupts via
IWDG_ICR on IWDG hardware version 4.0 and later, and adds a reg_set()
helper.

> diff --git a/drivers/watchdog/stm32_iwdg.c b/drivers/watchdog/stm32_iwdg.c
> index ce3e1f96ef50a..6121c23889655 100644
> --- a/drivers/watchdog/stm32_iwdg.c
> +++ b/drivers/watchdog/stm32_iwdg.c
[ ... ]
> @@ -194,11 +207,11 @@ static irqreturn_t stm32_iwdg_isr(int irq, void *wdog_arg)
>  {
>  	struct watchdog_device *wdd = wdog_arg;
>  	struct stm32_iwdg *wdt = watchdog_get_drvdata(wdd);
> -	u32 reg;
>  
> -	reg = reg_read(wdt->regs, IWDG_EWCR);
> -	reg |= EWCR_EWIC;
> -	reg_write(wdt->regs, IWDG_EWCR, reg);
> +	if (wdt->hw_version >= ICR_MIN_VER)
> +		reg_write(wdt->regs, IWDG_ICR, ICR_EWIC);
> +	else
> +		reg_set(wdt->regs, IWDG_EWCR, EWCR_EWIC);
>  
>  	watchdog_notify_pretimeout(wdd);

[Severity: Medium]
Can stm32_iwdg_isr() run before wdt->hw_version and wdd's driver data are
initialized in stm32_iwdg_probe()?

drivers/watchdog/stm32_iwdg.c:stm32_iwdg_probe() {
    ...
	ret = stm32_iwdg_irq_init(pdev, wdt);
	if (ret)
		return ret;

	wdt->hw_version = reg_read(wdt->regs, IWDG_VERR) & VERR_MASK;

	watchdog_set_drvdata(wdd, wdt);
    ...
}

stm32_iwdg_irq_init() calls devm_request_irq() before wdt->hw_version is
read from IWDG_VERR and before watchdog_set_drvdata() sets wdd's driver
data.  If the watchdog was already started by the bootloader and a
pretimeout interrupt is pending when the IRQ is requested, stm32_iwdg_isr()
gets NULL from watchdog_get_drvdata(wdd) and dereferences a NULL pointer,
and even with driver data set, wdt->hw_version would still be 0 so v4.0+
hardware would write to IWDG_EWCR instead of IWDG_ICR and fail to clear
the interrupt.

Initializing wdt->hw_version and calling watchdog_set_drvdata(wdd, wdt)
before stm32_iwdg_irq_init() would avoid this window.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106163429.618392-1-antonio.borneo@foss.st.com?part=3

Re: [PATCH v3 04/13] ARM: stm32: enable arm smc watchdog on stm32mp1xx

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] ARM: stm32: selecting WATCHDOG and ARM_SMC_WATCHDOG forces
  built-in config
--

commit 4450302b23f46b760d6b23f33c853eaddb3d821b
Author: Antonio Borneo <antonio.borneo@foss.st.com>

ARM: stm32: enable arm smc watchdog on stm32mp1xx

This commit selects WATCHDOG and ARM_SMC_WATCHDOG from ARCH_STM32 when
ARCH_MULTI_V7 is enabled.

> diff --git a/arch/arm/mach-stm32/Kconfig b/arch/arm/mach-stm32/Kconfig
> index 4ac3384e397aa..de09b2afa0f2e 100644
> --- a/arch/arm/mach-stm32/Kconfig
> +++ b/arch/arm/mach-stm32/Kconfig
> @@ -13,6 +13,8 @@ menuconfig ARCH_STM32
>  	select RESET_CONTROLLER
>  	select STM32_EXTI if ARM_SINGLE_ARMV7M
>  	select STM32_FIREWALL
> +	select WATCHDOG if ARCH_MULTI_V7
> +	select ARM_SMC_WATCHDOG if ARCH_MULTI_V7
>  	help
>  	  Support for STMicroelectronics STM32MP1 processors using Cortex-A7
>  	  cores. Note that support for the earlier Cortex-M based variants

[Severity: Low]
Does selecting WATCHDOG and the tristate ARM_SMC_WATCHDOG from the boolean
ARCH_STM32 force both symbols to y whenever ARCH_MULTI_V7 is enabled?  That
prevents building arm_smc_wdt as a loadable module or disabling the driver
and watchdog subsystem on multi-platform ARMv7 kernels with ARCH_STM32
enabled.

Could ARM_SMC_WATCHDOG instead use a default in drivers/watchdog/Kconfig
(the way STM32_WATCHDOG uses default ARCH_STM32) or be enabled in the
relevant defconfig?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106163429.618392-1-antonio.borneo@foss.st.com?part=4

Re: [PATCH v3 05/13] ARM: dts: stm32: add iwdg1 node on stm32mp151 SoC

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] ARM: dts: stm32: undocumented access-controllers property on
  iwdg1 node
--

commit cd231cb7c5edc8f540770e41801f5662a93d156c
Author: Amelie Delaunay <amelie.delaunay@foss.st.com>

ARM: dts: stm32: add iwdg1 node on stm32mp151 SoC

This commit adds the iwdg1 watchdog device tree node as a child of the
ETZPC bus node on the STM32MP151 SoC.

> diff --git a/arch/arm/boot/dts/st/stm32mp151.dtsi b/arch/arm/boot/dts/st/stm32mp151.dtsi
> index ae31883732388..e71b2ab58aa54 100644
> --- a/arch/arm/boot/dts/st/stm32mp151.dtsi
> +++ b/arch/arm/boot/dts/st/stm32mp151.dtsi
> @@ -2037,6 +2037,16 @@ i2c4: i2c@5c002000 {
>  				status = "disabled";
>  			};
>  
> +			iwdg1: watchdog@5c003000 {
> +				compatible = "st,stm32mp1-iwdg";
> +				reg = <0x5c003000 0x400>;
> +				interrupts = <GIC_SPI 150 IRQ_TYPE_LEVEL_HIGH>;
> +				clocks = <&rcc IWDG1>, <&rcc CK_LSI>;
> +				clock-names = "pclk", "lsi";
> +				access-controllers = <&etzpc 2>;

[Severity: Low]
Does adding access-controllers to watchdog@5c003000 cause dtbs_check to
fail schema validation?

Documentation/devicetree/bindings/watchdog/st,stm32-iwdg.yaml sets
unevaluatedProperties: false and neither it nor watchdog.yaml declares
access-controllers.  Should access-controllers be added to
st,stm32-iwdg.yaml as well?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106163429.618392-1-antonio.borneo@foss.st.com?part=5

Re: [PATCH v3 08/13] ARM: dts: stm32: enable arm smc watchdog on stm32mp15x scmi boards

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] ARM: dts: stm32: commit message references STM32MP2xx instead of
  STM32MP15x
--

commit 827293cb45c655141edc2ff759dd8058ed4045d8
Author: Amelie Delaunay <amelie.delaunay@foss.st.com>

ARM: dts: stm32: enable arm smc watchdog on stm32mp15x scmi boards

This commit enables the arm_wdt node and assigns it the watchdog0 alias on
STM32MP15x SCMI board device trees.

> With two watchdogs now enabled on ST STM32MP2xx boards, assign the
> watchdog0 alias to the ARM SMC watchdog that may have been started
> by an earlier boot stage. This allows userspace to identify and
> ping the appropriate watchdog.

[Severity: Low]
This isn't a bug, but this paragraph refers to STM32MP2xx boards rather
than the STM32MP15x SCMI boards modified by this patch.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106163429.618392-1-antonio.borneo@foss.st.com?part=8

Re: [PATCH v3 10/13] arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp211

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential
issues to consider:
- [High] arm64: dts: st: broken stm32mp215f-dk.dtb build from missing
  rcc header and node
- [Low] arm64: dts: st: undocumented access-controllers property on
  stm32mp1-iwdg nodes
--

commit 67f7dc5ddb768e993fdbc244a39bc4cf2ffdfc02
Author: Clément Le Goffic <clement.legoffic@foss.st.com>

arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp211

This commit adds the iwdg1 and iwdg2 watchdog device tree nodes to
stm32mp211.dtsi.

> diff --git a/arch/arm64/boot/dts/st/stm32mp211.dtsi b/arch/arm64/boot/dts/st/stm32mp211.dtsi
> index 4bfd58b26b51b..7ad1c3c304dea 100644
> --- a/arch/arm64/boot/dts/st/stm32mp211.dtsi
> +++ b/arch/arm64/boot/dts/st/stm32mp211.dtsi
> @@ -110,6 +110,26 @@ usart2: serial@400e0000 {
>  				access-controllers = <&rifsc 32>;
>  				status = "disabled";
>  			};
> +
> +			iwdg1: watchdog@44010000 {
> +				compatible = "st,stm32mp1-iwdg";
> +				reg = <0x44010000 0x0 0x400>;
> +				interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
> +				clocks = <&rcc CK_BUS_IWDG1>, <&scmi_clk CK_SCMI_LSI>;

[Severity: High]
Does this break building stm32mp215f-dk.dtb?

Neither stm32mp211.dtsi nor the files including it include
dt-bindings/clock/st,stm32mp21-rcc.h, leaving CK_BUS_IWDG1, CK_BUS_IWDG2
(in iwdg2 below) and CK_SCMI_LSI unexpanded.  In addition, both nodes
reference &rcc, which is not defined in stm32mp211.dtsi or its include
hierarchy.

> +				clock-names = "pclk", "lsi";
> +				access-controllers = <&rifsc 100>;
> +				status = "disabled";
> +			};
> +
> +			iwdg2: watchdog@44020000 {
> +				compatible = "st,stm32mp1-iwdg";
> +				reg = <0x44020000 0x0 0x400>;
> +				interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
> +				clocks = <&rcc CK_BUS_IWDG2>, <&scmi_clk CK_SCMI_LSI>;
> +				clock-names = "pclk", "lsi";
> +				access-controllers = <&rifsc 101>;

[Severity: Low]
Should Documentation/devicetree/bindings/watchdog/st,stm32-iwdg.yaml
allow the access-controllers property?  Because that schema sets
unevaluatedProperties: false and only references watchdog.yaml#,
dtbs_check will report access-controllers as an unevaluated property on
both iwdg1 and iwdg2.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106163429.618392-1-antonio.borneo@foss.st.com?part=10

Re: [PATCH v3 11/13] arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp231

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] arm64: dts: st: undocumented access-controllers in st,stm32-iwdg
  binding
--

commit 93c31545a492246bcc374e2c2022c94ad8a0467c
Author: Antonio Borneo <antonio.borneo@foss.st.com>

arm64: dts: st: add iwdg1 and iwdg2 support to stm32mp231

This commit adds the iwdg1 and iwdg2 watchdog device tree nodes to
stm32mp231.dtsi.

> diff --git a/arch/arm64/boot/dts/st/stm32mp231.dtsi b/arch/arm64/boot/dts/st/stm32mp231.dtsi
> index fefbf6f4f1537..db19429896eb3 100644
> --- a/arch/arm64/boot/dts/st/stm32mp231.dtsi
> +++ b/arch/arm64/boot/dts/st/stm32mp231.dtsi
> @@ -724,6 +724,26 @@ rng: rng@42020000 {
>  				status = "disabled";
>  			};
>  
> +			iwdg1: watchdog@44010000 {
> +				compatible = "st,stm32mp1-iwdg";
> +				reg = <0x44010000 0x400>;
> +				interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;
> +				clocks = <&rcc CK_BUS_IWDG1>, <&scmi_clk CK_SCMI_LSI>;
> +				clock-names = "pclk", "lsi";
> +				access-controllers = <&rifsc 98>;
> +				status = "disabled";
> +			};
> +
> +			iwdg2: watchdog@44020000 {
> +				compatible = "st,stm32mp1-iwdg";
> +				reg = <0x44020000 0x400>;
> +				interrupts = <GIC_SPI 3 IRQ_TYPE_LEVEL_HIGH>;
> +				clocks = <&rcc CK_BUS_IWDG2>, <&scmi_clk CK_SCMI_LSI>;
> +				clock-names = "pclk", "lsi";
> +				access-controllers = <&rifsc 99>;
> +				status = "disabled";
> +			};

[Severity: Low]
Does adding access-controllers to iwdg1 and iwdg2 cause dtbs_check to fail
against Documentation/devicetree/bindings/watchdog/st,stm32-iwdg.yaml?
That schema sets unevaluatedProperties: false and only references
watchdog.yaml, neither of which documents access-controllers.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106163429.618392-1-antonio.borneo@foss.st.com?part=11

Re: [PATCH v3 13/13] arm64: dts: st: enable iwdg2 on stm32mp2xx ST boards

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [High] arm64: dts: st: unresolved rcc phandle and clock macros in
  stm32mp215f-dk iwdg2
--

commit 7a43e1911df9f04894384d16f6721b48e26c2793
Author: Antonio Borneo <antonio.borneo@foss.st.com>

arm64: dts: st: enable iwdg2 on stm32mp2xx ST boards

This commit enables the iwdg2 watchdog node and assigns the watchdog0
alias to arm_wdt on STM32MP2xx ST board device trees.

> diff --git a/arch/arm64/boot/dts/st/stm32mp215f-dk.dts b/arch/arm64/boot/dts/st/stm32mp215f-dk.dts
> index a1285abc80ca5..c7ab340a7e4dc 100644
> --- a/arch/arm64/boot/dts/st/stm32mp215f-dk.dts
> +++ b/arch/arm64/boot/dts/st/stm32mp215f-dk.dts

[ ... ]

> @@ -48,6 +49,11 @@ &bsec {
>  	bootph-all;
>  };
>  
> +&iwdg2 {
> +	timeout-sec = <32>;
> +	status = "okay";
> +};
> +
>  &usart2 {
>  	status = "okay";
>  };

[Severity: High]
Does building stm32mp215f-dk.dtb fail with syntax and unresolved phandle
errors here?

The iwdg1 and iwdg2 nodes added in commit "arm64: dts: st: add iwdg1 and
iwdg2 support to stm32mp211" reference clocks = <&rcc CK_BUS_IWDG2>,
<&scmi_clk CK_SCMI_LSI>, but arch/arm64/boot/dts/st/stm32mp211.dtsi
neither includes dt-bindings/clock/st,stm32mp21-rcc.h nor defines an rcc
label.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106163429.618392-1-antonio.borneo@foss.st.com?part=13

Re: [PATCH v3 04/13] ARM: stm32: enable arm smc watchdog on stm32mp1xx

[Guenter Roeck]

On 11/6/26 09:19, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential
> issue to consider:
> - [Low] ARM: stm32: selecting WATCHDOG and ARM_SMC_WATCHDOG forces
>    built-in config
> --
> 
> commit 4450302b23f46b760d6b23f33c853eaddb3d821b
> Author: Antonio Borneo <antonio.borneo@foss.st.com>
> 
> ARM: stm32: enable arm smc watchdog on stm32mp1xx
> 
> This commit selects WATCHDOG and ARM_SMC_WATCHDOG from ARCH_STM32 when
> ARCH_MULTI_V7 is enabled.
> 
>> diff --git a/arch/arm/mach-stm32/Kconfig b/arch/arm/mach-stm32/Kconfig
>> index 4ac3384e397aa..de09b2afa0f2e 100644
>> --- a/arch/arm/mach-stm32/Kconfig
>> +++ b/arch/arm/mach-stm32/Kconfig
>> @@ -13,6 +13,8 @@ menuconfig ARCH_STM32
>>   	select RESET_CONTROLLER
>>   	select STM32_EXTI if ARM_SINGLE_ARMV7M
>>   	select STM32_FIREWALL
>> +	select WATCHDOG if ARCH_MULTI_V7
>> +	select ARM_SMC_WATCHDOG if ARCH_MULTI_V7
>>   	help
>>   	  Support for STMicroelectronics STM32MP1 processors using Cortex-A7
>>   	  cores. Note that support for the earlier Cortex-M based variants
> 
> [Severity: Low]
> Does selecting WATCHDOG and the tristate ARM_SMC_WATCHDOG from the boolean
> ARCH_STM32 force both symbols to y whenever ARCH_MULTI_V7 is enabled?  That
> prevents building arm_smc_wdt as a loadable module or disabling the driver
> and watchdog subsystem on multi-platform ARMv7 kernels with ARCH_STM32
> enabled.
> 
> Could ARM_SMC_WATCHDOG instead use a default in drivers/watchdog/Kconfig
> (the way STM32_WATCHDOG uses default ARCH_STM32) or be enabled in the
> relevant defconfig?
> 

ARCH_ASPEED and ARCH_S3C64XX also use select, but those architectures depend
on the watchdog driver's board reset capabilities. The smc watchdog does not
support board resets, and select should not be used here. As far as I can
see this patch is simply unnecessary: Both WATCHDOG and ARM_SMC_WATCHDOG
can be enabled in the configuration file if needed/desired.

Guenter

Re: [PATCH v3 02/13] watchdog: stm32_iwdg: detect whether the watchdog is running

[Guenter Roeck]

On 11/6/26 09:05, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 2 potential
> issues to consider:
> - [High] watchdog: stm32_iwdg: unconfigured timeout in
>    stm32_iwdg_probe()
> - [Medium] watchdog: stm32_iwdg: WDOG_HW_RUNNING gated on Kconfig in
>    stm32_iwdg_probe()
> --
> 
> commit 7c2acc17f93336becc29a7a139de848c3db25624
> Author: Clément Le Goffic <clement.legoffic@foss.st.com>
> 
> watchdog: stm32_iwdg: detect whether the watchdog is running
> 
> This commit adds stm32_iwdg_is_running() to detect whether the watchdog
> was already started by an earlier boot stage and sets WDOG_HW_RUNNING in
> stm32_iwdg_probe() only when it is running.
> 
> [Severity: High]
> In drivers/watchdog/stm32_iwdg.c at line 394 in stm32_iwdg_probe(), does
> removing the call to stm32_iwdg_start(wdd) leave the hardware prescaler
> (IWDG_PR), reload value (IWDG_RLR), and early-wakeup interrupt
> (IWDG_EWCR) registers out of sync with wdd->timeout and wdd->pretimeout?
> 
> When stm32_iwdg_is_running(wdt) returns true, stm32_iwdg_probe() now sets
> WDOG_HW_RUNNING without programming wdd->timeout into the hardware or
> reading the bootloader's configured timeout back into wdd->timeout.
> Because stm32_iwdg_ops provides stm32_iwdg_ping() (line 162), which only
> writes KR_KEY_RELOAD to IWDG_KR, the watchdog core's keepalive worker
> schedules pings at half of wdd->timeout while reloading the bootloader's
> counter value. If the bootloader configured a hardware timeout shorter
> than wdd->timeout / 2, the watchdog expires and resets the system before
> the next keepalive ping. Even after userspace opens /dev/watchdog,
> watchdog_start() in drivers/watchdog/watchdog_dev.c (line 261) sees both
> WDOG_HW_RUNNING and wdd->ops->ping set and calls __watchdog_ping(wdd)
> instead of wdd->ops->start(wdd), leaving IWDG_PR, IWDG_RLR, and IWDG_EWCR
> unconfigured.
> 
> [Severity: Medium]
> In drivers/watchdog/stm32_iwdg.c at line 394 in stm32_iwdg_probe(),
> should setting WDOG_HW_RUNNING be unconditional when
> stm32_iwdg_is_running(wdt) is true, rather than gated on
> IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED)?
> 
> In drivers/watchdog/watchdog_dev.c at line 1099 in
> watchdog_cdev_register(), the watchdog core checks watchdog_hw_running()
> to pin the module and device references and to evaluate the runtime
> watchdog.handle_boot_enabled parameter. Gating the check on
> IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED) in the driver prevents
> the core from knowing the hardware is active when
> CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=n, breaking the
> watchdog.handle_boot_enabled=1 kernel command-line override and skipping
> the module/device reference pinning.
> 

Sashiko has a point. CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED is supposed to be
handled in the watchdog core, not in watchdog drivers, and it is supposed
to be a default value that can be overwritten with a boot parameter.

Having said that, please let me know if this is intentional. If so,
I'll apply the patch anyway.

Thanks,
Guenter

Re: [PATCH v3 04/13] ARM: stm32: enable arm smc watchdog on stm32mp1xx

[Antonio Borneo]

On Fri, 2026-11-06 at 14:18 -0800, Guenter Roeck wrote:
> On 11/6/26 09:19, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 1 potential
> > issue to consider:
> > - [Low] ARM: stm32: selecting WATCHDOG and ARM_SMC_WATCHDOG forces
> >    built-in config
> > --
> > 
> > commit 4450302b23f46b760d6b23f33c853eaddb3d821b
> > Author: Antonio Borneo <antonio.borneo@foss.st.com>
> > 
> > ARM: stm32: enable arm smc watchdog on stm32mp1xx
> > 
> > This commit selects WATCHDOG and ARM_SMC_WATCHDOG from ARCH_STM32 when
> > ARCH_MULTI_V7 is enabled.
> > 
> > > diff --git a/arch/arm/mach-stm32/Kconfig b/arch/arm/mach-stm32/Kconfig
> > > index 4ac3384e397aa..de09b2afa0f2e 100644
> > > --- a/arch/arm/mach-stm32/Kconfig
> > > +++ b/arch/arm/mach-stm32/Kconfig
> > > @@ -13,6 +13,8 @@ menuconfig ARCH_STM32
> > >         select RESET_CONTROLLER
> > >         select STM32_EXTI if ARM_SINGLE_ARMV7M
> > >         select STM32_FIREWALL
> > > +       select WATCHDOG if ARCH_MULTI_V7
> > > +       select ARM_SMC_WATCHDOG if ARCH_MULTI_V7
> > >         help
> > >           Support for STMicroelectronics STM32MP1 processors using Cortex-A7
> > >           cores. Note that support for the earlier Cortex-M based variants
> > 
> > [Severity: Low]
> > Does selecting WATCHDOG and the tristate ARM_SMC_WATCHDOG from the boolean
> > ARCH_STM32 force both symbols to y whenever ARCH_MULTI_V7 is enabled?  That
> > prevents building arm_smc_wdt as a loadable module or disabling the driver
> > and watchdog subsystem on multi-platform ARMv7 kernels with ARCH_STM32
> > enabled.
> > 
> > Could ARM_SMC_WATCHDOG instead use a default in drivers/watchdog/Kconfig
> > (the way STM32_WATCHDOG uses default ARCH_STM32) or be enabled in the
> > relevant defconfig?
> > 
> 
> ARCH_ASPEED and ARCH_S3C64XX also use select, but those architectures depend
> on the watchdog driver's board reset capabilities. The smc watchdog does not
> support board resets, and select should not be used here. As far as I can
> see this patch is simply unnecessary: Both WATCHDOG and ARM_SMC_WATCHDOG
> can be enabled in the configuration file if needed/desired.
> 
> Guenter
> 

Hi Guenter,

on platforms STM32MP1xx the trusted firmware starts the watchdog.
On such platforms the upstream kernel configured with multi_v7_defconfig needs
ARM_SMC_WATCHDOG to prevent a reset during kernel boot.

The same boot constraint is present on arm64 platforms STM32MP2xx, but there
the defconfig already enables ARM_SMC_WATCHDOG thanks to 72a9e7fea586
("watchdog: Add new arm_smc_wdt watchdog driver").

I considered as too invasive patching directly multi_v7_defconfig as too many
platforms use it. Plus here I would have to select 'y' or 'm' for all the users.

I also considered adding in drivers/watchdog/Kconfig

config ARM_SMC_WATCHDOG
	...
	default y if (ARCH_STM32 && ARCH_MULTI_V7)

but it looks strange to me to have, inside the watchdog Kconfig, such link
between a generic watchdog and a specific platform.
Anyway, this option has the advantage to not impact the other platforms when
ARCH_STM32 is not selected.

At the end decided for placing it in the platform specific mach-stm32/Kconfig.

Please advice what should be the preferred way to select it.

Thanks,
Antonio

Re: [PATCH v3 02/13] watchdog: stm32_iwdg: detect whether the watchdog is running

[Antonio Borneo]

On Sun, 2026-11-08 at 09:56 -0800, Guenter Roeck wrote:
> On 11/6/26 09:05, sashiko-bot@kernel.org wrote:
> > Thank you for your contribution! Sashiko AI review found 2 potential
> > issues to consider:
> > - [High] watchdog: stm32_iwdg: unconfigured timeout in
> >    stm32_iwdg_probe()
> > - [Medium] watchdog: stm32_iwdg: WDOG_HW_RUNNING gated on Kconfig in
> >    stm32_iwdg_probe()
> > --
> > 
> > commit 7c2acc17f93336becc29a7a139de848c3db25624
> > Author: Clément Le Goffic <clement.legoffic@foss.st.com>
> > 
> > watchdog: stm32_iwdg: detect whether the watchdog is running
> > 
> > This commit adds stm32_iwdg_is_running() to detect whether the watchdog
> > was already started by an earlier boot stage and sets WDOG_HW_RUNNING in
> > stm32_iwdg_probe() only when it is running.
> > 
> > [Severity: High]
> > In drivers/watchdog/stm32_iwdg.c at line 394 in stm32_iwdg_probe(), does
> > removing the call to stm32_iwdg_start(wdd) leave the hardware prescaler
> > (IWDG_PR), reload value (IWDG_RLR), and early-wakeup interrupt
> > (IWDG_EWCR) registers out of sync with wdd->timeout and wdd->pretimeout?
> > 
> > When stm32_iwdg_is_running(wdt) returns true, stm32_iwdg_probe() now sets
> > WDOG_HW_RUNNING without programming wdd->timeout into the hardware or
> > reading the bootloader's configured timeout back into wdd->timeout.
> > Because stm32_iwdg_ops provides stm32_iwdg_ping() (line 162), which only
> > writes KR_KEY_RELOAD to IWDG_KR, the watchdog core's keepalive worker
> > schedules pings at half of wdd->timeout while reloading the bootloader's
> > counter value. If the bootloader configured a hardware timeout shorter
> > than wdd->timeout / 2, the watchdog expires and resets the system before
> > the next keepalive ping. Even after userspace opens /dev/watchdog,
> > watchdog_start() in drivers/watchdog/watchdog_dev.c (line 261) sees both
> > WDOG_HW_RUNNING and wdd->ops->ping set and calls __watchdog_ping(wdd)
> > instead of wdd->ops->start(wdd), leaving IWDG_PR, IWDG_RLR, and IWDG_EWCR
> > unconfigured.
> > 
> > [Severity: Medium]
> > In drivers/watchdog/stm32_iwdg.c at line 394 in stm32_iwdg_probe(),
> > should setting WDOG_HW_RUNNING be unconditional when
> > stm32_iwdg_is_running(wdt) is true, rather than gated on
> > IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED)?
> > 
> > In drivers/watchdog/watchdog_dev.c at line 1099 in
> > watchdog_cdev_register(), the watchdog core checks watchdog_hw_running()
> > to pin the module and device references and to evaluate the runtime
> > watchdog.handle_boot_enabled parameter. Gating the check on
> > IS_ENABLED(CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED) in the driver prevents
> > the core from knowing the hardware is active when
> > CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED=n, breaking the
> > watchdog.handle_boot_enabled=1 kernel command-line override and skipping
> > the module/device reference pinning.
> > 
> 
> Sashiko has a point. CONFIG_WATCHDOG_HANDLE_BOOT_ENABLED is supposed to be
> handled in the watchdog core, not in watchdog drivers, and it is supposed
> to be a default value that can be overwritten with a boot parameter.
> 
> Having said that, please let me know if this is intentional. If so,
> I'll apply the patch anyway.

Sashiko is right on both points.
I will prepare a new version for this patch.

Regards,
Antonio