diff --git a/plat/st/stm32mp1/bl2_plat_setup.c b/plat/st/stm32mp1/bl2_plat_setup.c
index 27d298e..7de264b 100644
--- a/plat/st/stm32mp1/bl2_plat_setup.c
+++ b/plat/st/stm32mp1/bl2_plat_setup.c
@@ -17,6 +17,7 @@
 #include <drivers/generic_delay_timer.h>
 #include <drivers/st/bsec.h>
 #include <drivers/st/stm32_console.h>
+#include <drivers/st/stm32_iwdg.h>
 #include <drivers/st/stm32mp_pmic.h>
 #include <drivers/st/stm32mp_reset.h>
 #include <drivers/st/stm32mp1_clk.h>
@@ -28,6 +29,7 @@
 #include <plat/common/platform.h>
 
 #include <stm32mp1_context.h>
+#include <stm32mp1_dbgmcu.h>
 
 static struct console_stm32 console;
 
@@ -276,6 +278,16 @@
 	}
 
 skip_console_init:
+	if (stm32_iwdg_init() < 0) {
+		panic();
+	}
+
+	stm32_iwdg_refresh();
+
+	result = stm32mp1_dbgmcu_freeze_iwdg2();
+	if (result != 0) {
+		INFO("IWDG2 freeze error : %i\n", result);
+	}
 
 	if (stm32_save_boot_interface(boot_context->boot_interface_selected,
 				      boot_context->boot_interface_instance) !=
diff --git a/plat/st/stm32mp1/include/stm32mp1_dbgmcu.h b/plat/st/stm32mp1/include/stm32mp1_dbgmcu.h
new file mode 100644
index 0000000..a878308
--- /dev/null
+++ b/plat/st/stm32mp1/include/stm32mp1_dbgmcu.h
@@ -0,0 +1,17 @@
+/*
+ * Copyright (c) 2015-2019, STMicroelectronics - All Rights Reserved
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#ifndef STM32MP1_DBGMCU_H
+#define STM32MP1_DBGMCU_H
+
+/*
+ * Freeze watchdog when a debugger is attached, if the security configuration
+ * allows it.
+ * Return 0 on success, a negative error value otherwise.
+ */
+int stm32mp1_dbgmcu_freeze_iwdg2(void);
+
+#endif /* STM32MP1_DBGMCU_H */
diff --git a/plat/st/stm32mp1/platform.mk b/plat/st/stm32mp1/platform.mk
index 0ea7bbb..83d9770 100644
--- a/plat/st/stm32mp1/platform.mk
+++ b/plat/st/stm32mp1/platform.mk
@@ -57,11 +57,13 @@
 				drivers/st/ddr/stm32mp1_ddr_helpers.c			\
 				drivers/st/gpio/stm32_gpio.c				\
 				drivers/st/i2c/stm32_i2c.c				\
+				drivers/st/iwdg/stm32_iwdg.c				\
 				drivers/st/pmic/stm32mp_pmic.c				\
 				drivers/st/pmic/stpmic1.c				\
 				drivers/st/reset/stm32mp1_reset.c			\
 				plat/st/common/stm32mp_dt.c				\
 				plat/st/stm32mp1/stm32mp1_context.c			\
+				plat/st/stm32mp1/stm32mp1_dbgmcu.c			\
 				plat/st/stm32mp1/stm32mp1_helper.S			\
 				plat/st/stm32mp1/stm32mp1_security.c			\
 				plat/st/stm32mp1/stm32mp1_syscfg.c
diff --git a/plat/st/stm32mp1/sp_min/sp_min_setup.c b/plat/st/stm32mp1/sp_min/sp_min_setup.c
index 329ff68..5ad2190 100644
--- a/plat/st/stm32mp1/sp_min/sp_min_setup.c
+++ b/plat/st/stm32mp1/sp_min/sp_min_setup.c
@@ -19,6 +19,7 @@
 #include <drivers/st/bsec.h>
 #include <drivers/st/stm32_console.h>
 #include <drivers/st/stm32_gpio.h>
+#include <drivers/st/stm32_iwdg.h>
 #include <drivers/st/stm32mp1_clk.h>
 #include <dt-bindings/clock/stm32mp1-clks.h>
 #include <lib/el3_runtime/context_mgmt.h>
@@ -157,6 +158,10 @@
 	for (uint32_t pin = 0U; pin < STM32MP_GPIOZ_PIN_MAX_COUNT; pin++) {
 		set_gpio_secure_cfg(GPIO_BANK_Z, pin, false);
 	}
+
+	if (stm32_iwdg_init() < 0) {
+		panic();
+	}
 }
 
 void sp_min_plat_arch_setup(void)
diff --git a/plat/st/stm32mp1/stm32mp1_dbgmcu.c b/plat/st/stm32mp1/stm32mp1_dbgmcu.c
new file mode 100644
index 0000000..a614267
--- /dev/null
+++ b/plat/st/stm32mp1/stm32mp1_dbgmcu.c
@@ -0,0 +1,66 @@
+/*
+ * Copyright (c) 2016-2019, STMicroelectronics - All Rights Reserved
+ *
+ * SPDX-License-Identifier: BSD-3-Clause
+ */
+
+#include <errno.h>
+
+#include <platform_def.h>
+
+#include <common/debug.h>
+#include <drivers/st/bsec.h>
+#include <drivers/st/stm32mp1_rcc.h>
+#include <lib/mmio.h>
+#include <lib/utils_def.h>
+
+#include <stm32mp1_dbgmcu.h>
+
+#define DBGMCU_APB4FZ1		U(0x2C)
+#define DBGMCU_APB4FZ1_IWDG2	BIT(2)
+
+static uintptr_t get_rcc_base(void)
+{
+	/* This is called before stm32mp_rcc_base() is available */
+	return RCC_BASE;
+}
+
+static int stm32mp1_dbgmcu_init(void)
+{
+	uint32_t dbg_conf;
+	uintptr_t rcc_base = get_rcc_base();
+
+	dbg_conf = bsec_read_debug_conf();
+
+	if ((dbg_conf & BSEC_DBGSWGEN) == 0U) {
+		uint32_t result = bsec_write_debug_conf(dbg_conf |
+							BSEC_DBGSWGEN);
+
+		if (result != BSEC_OK) {
+			ERROR("Error enabling DBGSWGEN\n");
+			return -1;
+		}
+	}
+
+	mmio_setbits_32(rcc_base + RCC_DBGCFGR, RCC_DBGCFGR_DBGCKEN);
+
+	return 0;
+}
+
+int stm32mp1_dbgmcu_freeze_iwdg2(void)
+{
+	uint32_t dbg_conf;
+
+	if (stm32mp1_dbgmcu_init() != 0) {
+		return -EPERM;
+	}
+
+	dbg_conf = bsec_read_debug_conf();
+
+	if ((dbg_conf & (BSEC_SPIDEN | BSEC_SPINDEN)) != 0U) {
+		mmio_setbits_32(DBGMCU_BASE + DBGMCU_APB4FZ1,
+				DBGMCU_APB4FZ1_IWDG2);
+	}
+
+	return 0;
+}
diff --git a/plat/st/stm32mp1/stm32mp1_def.h b/plat/st/stm32mp1/stm32mp1_def.h
index 37941aa..34e6e3c 100644
--- a/plat/st/stm32mp1/stm32mp1_def.h
+++ b/plat/st/stm32mp1/stm32mp1_def.h
@@ -15,6 +15,7 @@
 #include <lib/xlat_tables/xlat_tables_defs.h>
 
 #ifndef __ASSEMBLER__
+#include <drivers/st/bsec.h>
 #include <drivers/st/stm32mp1_clk.h>
 
 #include <boot_api.h>
@@ -87,9 +88,9 @@
 #endif
 #else
 #if STACK_PROTECTOR_ENABLED
-#define STM32MP_BL2_SIZE		U(0x00015000)	/* 84 Ko for BL2 */
+#define STM32MP_BL2_SIZE		U(0x00018000)	/* 96 Ko for BL2 */
 #else
-#define STM32MP_BL2_SIZE		U(0x00013000)	/* 76 Ko for BL2 */
+#define STM32MP_BL2_SIZE		U(0x00016000)	/* 88 Ko for BL2 */
 #endif
 #endif
 
@@ -245,6 +246,11 @@
 /* DATA0 */
 #define DATA0_OTP_SECURED		BIT(6)
 
+/* IWDG OTP */
+#define HW2_OTP_IWDG_HW_POS		U(3)
+#define HW2_OTP_IWDG_FZ_STOP_POS	U(5)
+#define HW2_OTP_IWDG_FZ_STANDBY_POS	U(7)
+
 /* HW2 OTP */
 #define HW2_OTP_PRODUCT_BELOW_2V5	BIT(13)
 
@@ -272,13 +278,29 @@
 #define DDRPHYC_BASE			U(0x5A004000)
 
 /*******************************************************************************
+ * STM32MP1 IWDG
+ ******************************************************************************/
+#define IWDG_MAX_INSTANCE		U(2)
+#define IWDG1_INST			U(0)
+#define IWDG2_INST			U(1)
+
+#define IWDG1_BASE			U(0x5C003000)
+#define IWDG2_BASE			U(0x5A002000)
+
+/*******************************************************************************
  * STM32MP1 I2C4
  ******************************************************************************/
 #define I2C4_BASE			U(0x5C002000)
 
 /*******************************************************************************
+ * STM32MP1 DBGMCU
+ ******************************************************************************/
+#define DBGMCU_BASE			U(0x50081000)
+
+/*******************************************************************************
  * Device Tree defines
  ******************************************************************************/
+#define DT_IWDG_COMPAT			"st,stm32mp1-iwdg"
 #define DT_PWR_COMPAT			"st,stm32mp1-pwr"
 #define DT_RCC_CLK_COMPAT		"st,stm32mp1-rcc"
 #define DT_SYSCFG_COMPAT		"st,stm32mp157-syscfg"
diff --git a/plat/st/stm32mp1/stm32mp1_private.c b/plat/st/stm32mp1/stm32mp1_private.c
index 340c7fb..886a8f3 100644
--- a/plat/st/stm32mp1/stm32mp1_private.c
+++ b/plat/st/stm32mp1/stm32mp1_private.c
@@ -8,6 +8,7 @@
 
 #include <platform_def.h>
 
+#include <drivers/st/stm32_iwdg.h>
 #include <lib/xlat_tables/xlat_tables_v2.h>
 
 #define MAP_SRAM	MAP_REGION_FLAT(STM32MP_SYSRAM_BASE, \
@@ -66,3 +67,78 @@
 
 	return GPIOA + (bank - GPIO_BANK_A);
 }
+
+uint32_t stm32_iwdg_get_instance(uintptr_t base)
+{
+	switch (base) {
+	case IWDG1_BASE:
+		return IWDG1_INST;
+	case IWDG2_BASE:
+		return IWDG2_INST;
+	default:
+		panic();
+	}
+}
+
+uint32_t stm32_iwdg_get_otp_config(uint32_t iwdg_inst)
+{
+	uint32_t iwdg_cfg = 0U;
+	uint32_t otp_value;
+
+#if defined(IMAGE_BL2)
+	if (bsec_shadow_register(HW2_OTP) != BSEC_OK) {
+		panic();
+	}
+#endif
+
+	if (bsec_read_otp(&otp_value, HW2_OTP) != BSEC_OK) {
+		panic();
+	}
+
+	if ((otp_value & BIT(iwdg_inst + HW2_OTP_IWDG_HW_POS)) != 0U) {
+		iwdg_cfg |= IWDG_HW_ENABLED;
+	}
+
+	if ((otp_value & BIT(iwdg_inst + HW2_OTP_IWDG_FZ_STOP_POS)) != 0U) {
+		iwdg_cfg |= IWDG_DISABLE_ON_STOP;
+	}
+
+	if ((otp_value & BIT(iwdg_inst + HW2_OTP_IWDG_FZ_STANDBY_POS)) != 0U) {
+		iwdg_cfg |= IWDG_DISABLE_ON_STANDBY;
+	}
+
+	return iwdg_cfg;
+}
+
+#if defined(IMAGE_BL2)
+uint32_t stm32_iwdg_shadow_update(uint32_t iwdg_inst, uint32_t flags)
+{
+	uint32_t otp;
+	uint32_t result;
+
+	if (bsec_shadow_read_otp(&otp, HW2_OTP) != BSEC_OK) {
+		panic();
+	}
+
+	if ((flags & IWDG_DISABLE_ON_STOP) != 0U) {
+		otp |= BIT(iwdg_inst + HW2_OTP_IWDG_FZ_STOP_POS);
+	}
+
+	if ((flags & IWDG_DISABLE_ON_STANDBY) != 0U) {
+		otp |= BIT(iwdg_inst + HW2_OTP_IWDG_FZ_STANDBY_POS);
+	}
+
+	result = bsec_write_otp(otp, HW2_OTP);
+	if (result != BSEC_OK) {
+		return result;
+	}
+
+	/* Sticky lock OTP_IWDG (read and write) */
+	if (!bsec_write_sr_lock(HW2_OTP, 1U) ||
+	    !bsec_write_sw_lock(HW2_OTP, 1U)) {
+		return BSEC_LOCK_FAIL;
+	}
+
+	return BSEC_OK;
+}
+#endif