From d03799ec3c3448bacd068ce9a2f8b2c524918595 Mon Sep 17 00:00:00 2001
From: Jeff Xu <jeffxu@google.com>
Date: Mon, 17 Nov 2025 20:26:05 +0000
Subject: [PATCH] soc/mediatek/mt8196: Configure registers and parameters
 required for MTE

To support Memory Tagging Extension (MTE), configure booker
(custom CI-700) registers related to MTE to set up MTE tag address.

According to CI-700 documentation, the por_mtu_tag_addr_base register is
only accessible by Secure accesses. Therefore these registers are now
configured in coreboot ramstage before passing to payloads.

BRANCH=rauru
BUG=b:438666196
TEST=manual test

Change-Id: I0d98cfee3e208a559116f84362528f005ea6f2c8
Signed-off-by: Jeff Xu <jeffxu@chromium.org>
Reviewed-on: https://review.coreboot.org/c/coreboot/+/90141
Reviewed-by: Yu-Ping Wu <yupingso@google.com>
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Yidi Lin <yidilin@google.com>
---
 src/soc/mediatek/mt8196/Makefile.mk          |  1 +
 src/soc/mediatek/mt8196/booker.c             | 45 ++++++++++++++++++++
 src/soc/mediatek/mt8196/include/soc/booker.h |  5 +++
 src/soc/mediatek/mt8196/soc.c                |  7 +++
 4 files changed, 58 insertions(+)

diff --git a/src/soc/mediatek/mt8196/Makefile.mk b/src/soc/mediatek/mt8196/Makefile.mk
index e4bb1bd523..a4926056aa 100644
--- a/src/soc/mediatek/mt8196/Makefile.mk
+++ b/src/soc/mediatek/mt8196/Makefile.mk
@@ -54,6 +54,7 @@ romstage-y += ../common/thermal.c thermal.c
 romstage-y += ../common/thermal_sram.c thermal_sram.c
 
 ramstage-$(CONFIG_ARM64_USE_ARM_TRUSTED_FIRMWARE) += ../common/bl31.c
+ramstage-y += booker.c
 ramstage-y += dcc.c
 ramstage-y += ddp.c
 ramstage-y += ../common/display.c
diff --git a/src/soc/mediatek/mt8196/booker.c b/src/soc/mediatek/mt8196/booker.c
index 020af9ad0b..c571734f62 100644
--- a/src/soc/mediatek/mt8196/booker.c
+++ b/src/soc/mediatek/mt8196/booker.c
@@ -13,8 +13,31 @@
 #define INSTANCE1_SBSX_POR_SBSX_CFG_CTL	(0x0A800000 + POR_SBSX_CFG_CTL_OFFSET)
 #define INSTANCE2_SBSX_POR_SBSX_CFG_CTL	(0x0B000000 + POR_SBSX_CFG_CTL_OFFSET)
 #define INSTANCE3_SBSX_POR_SBSX_CFG_CTL	(0x0B800000 + POR_SBSX_CFG_CTL_OFFSET)
+
+#define POR_MTU_BASE			0x790000
+#define POR_MTU_AUX_CTL_OFFSET		(POR_MTU_BASE + 0x0A08)
+#define POR_MTU_TAG_ADDR_CTL_OFFSET	(POR_MTU_BASE + 0x0A40)
+#define POR_MTU_TAG_ADDR_BASE_OFFSET	(POR_MTU_BASE + 0x0A48)
+#define POR_MTU_TAG_ADDR_SHUTTER0_OFFSET	(POR_MTU_BASE + 0x0A50)
+#define POR_MTU_TAG_ADDR_SHUTTER1_OFFSET	(POR_MTU_BASE + 0x0A58)
+#define POR_MTU_TAG_ADDR_SHUTTER2_OFFSET	(POR_MTU_BASE + 0x0A60)
+
+#define BIT_DISABLE_BOOKER_TAG		BIT(0)
 #define BIT_DISABLE_CMO_PROP		BIT(3)
 
+#define MTU_TYPE_MODE_0			0x5
+#define MTU_SHUTTER0_SETTING		0x2222222222222200ULL
+#define MTU_SHUTTER1_SETTING		0x2222222222222222ULL
+#define MTU_SHUTTER2_SETTING		0x0000000002222222ULL
+
+/* Booker instance base addresses */
+static const uint32_t booker_base[] = {
+	0x0A000000,
+	0x0A800000,
+	0x0B000000,
+	0x0B800000,
+};
+
 /*
  * Configure booker and disable HN-D coherence request to avoid
  * receiving NDE(Non-data Error) before MMU enabled.
@@ -36,3 +59,25 @@ void booker_init(void)
 	       __func__,
 	       read32p(REG_READ_ONLY_HASH_VALUE));
 }
+
+void booker_mte_init(uint64_t mte_tag_addr)
+{
+	int i;
+
+	printk(BIOS_DEBUG, "%s: MTE tag addr %#llx\n", __func__, mte_tag_addr);
+
+	/* Setting MTU TAG */
+	for (i = 0; i < ARRAY_SIZE(booker_base); i++) {
+		write64p(booker_base[i] + POR_MTU_TAG_ADDR_CTL_OFFSET, MTU_TYPE_MODE_0);
+		write64p(booker_base[i] + POR_MTU_TAG_ADDR_BASE_OFFSET, mte_tag_addr);
+		write64p(booker_base[i] + POR_MTU_TAG_ADDR_SHUTTER0_OFFSET,
+			 MTU_SHUTTER0_SETTING);
+		write64p(booker_base[i] + POR_MTU_TAG_ADDR_SHUTTER1_OFFSET,
+			 MTU_SHUTTER1_SETTING);
+		write64p(booker_base[i] + POR_MTU_TAG_ADDR_SHUTTER2_OFFSET,
+			 MTU_SHUTTER2_SETTING);
+		setbits64p(booker_base[i] + POR_MTU_AUX_CTL_OFFSET, BIT_DISABLE_BOOKER_TAG);
+	}
+	dsb();
+	isb();
+}
diff --git a/src/soc/mediatek/mt8196/include/soc/booker.h b/src/soc/mediatek/mt8196/include/soc/booker.h
index a9f8d6375c..25c2d140af 100644
--- a/src/soc/mediatek/mt8196/include/soc/booker.h
+++ b/src/soc/mediatek/mt8196/include/soc/booker.h
@@ -3,6 +3,11 @@
 #ifndef SOC_MEDIATEK_MT8196_BOOKER_H
 #define SOC_MEDIATEK_MT8196_BOOKER_H
 
+#include <stdint.h>
+
+#define MTE_TAG_ADDR 0x460E80000
+
 void booker_init(void);
+void booker_mte_init(uint64_t mte_tag_addr);
 
 #endif
diff --git a/src/soc/mediatek/mt8196/soc.c b/src/soc/mediatek/mt8196/soc.c
index 16271643ea..1fbe09025f 100644
--- a/src/soc/mediatek/mt8196/soc.c
+++ b/src/soc/mediatek/mt8196/soc.c
@@ -3,6 +3,7 @@
 #include <bootmem.h>
 #include <device/device.h>
 #include <device/pci.h>
+#include <soc/booker.h>
 #include <soc/dcc.h>
 #include <soc/dramc_info.h>
 #include <soc/emi.h>
@@ -51,6 +52,12 @@ static void soc_init(struct device *dev)
 	gpueb_init();
 	mcupm_init();
 	mt6685_init_pmif_arb();
+	/*
+	 * According to CI-700 documentation:
+	 * Registers are only accessible by Secure accesses. Writes to them must occur prior to
+	 * the first non-configuration access targeting the device.
+	 */
+	booker_mte_init(MTE_TAG_ADDR);
 }
 
 static struct device_operations soc_ops = {