[PATCH v3 0/4] Add support for Versal Xilsem edac

[PATCH v3 0/4] Add support for Versal Xilsem edac

[Rama devi Veggalam]

Add sysfs interface for Xilsem scan operations initialize, start,
stop scan, error inject, read ECC, status and configuration values.
Handle correctable and uncorrectable xilsem error events.

Changes in V3:
- Merged XilSEM edac with Versal Edac driver to address
the review feedback.

Rama devi Veggalam (4):
  dt-bindings: edac: Add bindings for Xilinx Versal XilSEM
  Documentation: ABI: Add ABI doc for versal edac sysfs
  firmware: xilinx: Add support for Xilsem scan operations
  edac: xilinx: Add EDAC support for Versal XilSem

 .../ABI/testing/sysfs-driver-versal-edac      |  303 ++++
 .../xlnx,versal-ddrmc-edac.yaml               |   22 +-
 MAINTAINERS                                   |    1 +
 drivers/edac/Kconfig                          |    4 +-
 drivers/edac/versal_edac.c                    | 1348 ++++++++++++++++-
 drivers/firmware/xilinx/Makefile              |    2 +-
 drivers/firmware/xilinx/zynqmp-sem.c          |  176 +++
 drivers/soc/xilinx/xlnx_event_manager.c       |    6 +-
 .../linux/firmware/xlnx-versal-error-events.h |   43 +
 include/linux/firmware/xlnx-zynqmp-sem.h      |   69 +
 include/linux/firmware/xlnx-zynqmp.h          |    1 +
 11 files changed, 1965 insertions(+), 10 deletions(-)
 create mode 100644 Documentation/ABI/testing/sysfs-driver-versal-edac
 create mode 100644 drivers/firmware/xilinx/zynqmp-sem.c
 create mode 100644 include/linux/firmware/xlnx-versal-error-events.h
 create mode 100644 include/linux/firmware/xlnx-zynqmp-sem.h

-- 
2.23.0

[PATCH v3 1/4] dt-bindings: edac: Add bindings for Xilinx Versal XilSEM

[Rama devi Veggalam]

Update versal edac device tree bindings for
Versal Soft Error Mitigation (XilSEM).

Signed-off-by: Rama devi Veggalam <rama.devi.veggalam@amd.com>
---
Changes in v3:
- Merged XilSEM edac with Versal Edac

Changes in v2:
- Changed "xlnx,versal-xilsem-edac" to constant
- Removed "compatible: in required section
- Removed "|" in description
- Removed "items" in compatible
- Fixed indentation in examples
- Updated title and description
---
 .../xlnx,versal-ddrmc-edac.yaml               | 22 ++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/Documentation/devicetree/bindings/memory-controllers/xlnx,versal-ddrmc-edac.yaml b/Documentation/devicetree/bindings/memory-controllers/xlnx,versal-ddrmc-edac.yaml
index 12f8e9f350bc..568d2af7de81 100644
--- a/Documentation/devicetree/bindings/memory-controllers/xlnx,versal-ddrmc-edac.yaml
+++ b/Documentation/devicetree/bindings/memory-controllers/xlnx,versal-ddrmc-edac.yaml
@@ -4,17 +4,31 @@
 $id: http://devicetree.org/schemas/memory-controllers/xlnx,versal-ddrmc-edac.yaml#
 $schema: http://devicetree.org/meta-schemas/core.yaml#
 
-title: Xilinx Versal DDRMC (Integrated DDR Memory Controller)
+title: Xilinx Versal DDRMC (Integrated DDR Memory Controller) and Soft Error Mitigation (XilSEM)
 
 maintainers:
   - Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
   - Sai Krishna Potthuri <sai.krishna.potthuri@amd.com>
+  - Rama Devi Veggalam <rama.devi.veggalam@amd.com>
 
 description:
   The integrated DDR Memory Controllers (DDRMCs) support both DDR4 and LPDDR4/
   4X memory interfaces. Versal DDR memory controller has an optional ECC support
   which correct single bit ECC errors and detect double bit ECC errors.
 
+  Xilinx Versal Soft Error Mitigation (XilSEM) is part of the
+  Platform Loader and Manager (PLM) which runs on the
+  Platform Management Controller (PMC). XilSEM is responsible for reporting
+  and optionally correcting soft errors in Configuration Memory of Versal.
+  The Configuration Memory includes Configuration RAM and
+  Network on Chip (NoC) peripheral interconnect (NPI) Registers.
+
+  The memory is scanned by a hardware controller in the Versal Programmable
+  Logic (PL). During the scan, if the controller detects any error, be it
+  correctable or uncorrectable, it reports the error to PLM.
+  The XilSEM on PLM performs the error validation and notifies the errors to user application.
+
+
 properties:
   compatible:
     const: xlnx,versal-ddrmc
@@ -23,11 +37,13 @@ properties:
     items:
       - description: DDR Memory Controller registers
       - description: NOC registers corresponding to DDR Memory Controller
+      - description: SEM RTCA Controller registers
 
   reg-names:
     items:
       - const: base
       - const: noc
+      - const: semrtca
 
   interrupts:
     maxItems: 1
@@ -49,8 +65,8 @@ examples:
       #size-cells = <2>;
       memory-controller@f6150000 {
         compatible = "xlnx,versal-ddrmc";
-        reg = <0x0 0xf6150000 0x0 0x2000>, <0x0 0xf6070000 0x0 0x20000>;
-        reg-names = "base", "noc";
+        reg = <0x0 0xf6150000 0x0 0x2000>, <0x0 0xf6070000 0x0 0x20000>, < 0x00 0xf2014050 0x00 0xc4>;
+        reg-names = "base", "noc" , "semrtca";
         interrupt-parent = <&gic>;
         interrupts = <GIC_SPI 147 IRQ_TYPE_LEVEL_HIGH>;
       };
-- 
2.23.0

[PATCH v3 2/4] Documentation: ABI: Add ABI doc for versal edac sysfs

[Rama devi Veggalam]

Add documentation for the sysfs entries created for
versal edac (XilSEM).

Signed-off-by: Rama devi Veggalam <rama.devi.veggalam@amd.com>
---
Changes in v3:
- Renamed file name from xilsem edac to versal edac

Changes in v2:
- Updated Date field in sysfs file
---
 .../ABI/testing/sysfs-driver-versal-edac      | 303 ++++++++++++++++++
 1 file changed, 303 insertions(+)
 create mode 100644 Documentation/ABI/testing/sysfs-driver-versal-edac

diff --git a/Documentation/ABI/testing/sysfs-driver-versal-edac b/Documentation/ABI/testing/sysfs-driver-versal-edac
new file mode 100644
index 000000000000..c35d864fcbe2
--- /dev/null
+++ b/Documentation/ABI/testing/sysfs-driver-versal-edac
@@ -0,0 +1,303 @@
+What:		/sys/devices/system/edac/versal_xilsem/xsem_scan_control
+Date:		What:		/sys/devices/system/edac/mc/mc0/xsem_scan_control
+Date:		June 2026
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to the firmware for doing requested scan operation in
+		Configuration RAM (CRAM) or NPI of Versal mono/SSIT devices.
+		User needs to provide scan operation id (init, start, stop) and
+		SLR id (Versal SSIT device) details. For Versal mono devices,
+		the SLR id should be 0.
+		The scan operation id values are as given below:
+		1 - Initialize the scan
+		2 - Start CRAM scan
+		3 - Stop CRAM scan
+		5 - Start NPI scan
+		6 - Stop NPI scan
+		7 - Inject NPI error in first descriptor
+
+		When read, it shows the current scan status with error code.
+		The format is <0x1030 | operation Id> <error code> <Slr ID>
+		The different error codes are as given below:
+		==========	=====
+		Error Code	Cause
+		==========	=====
+		0x0			Scan operation success
+		0x1			Failure in NPI scan
+		0x80		Calibration timeout
+		0x2000		Internal error
+		0x500000	CRAM initialization not yet done
+		0x600000	Start scan failed
+		0x700000	Stop scan failed
+		0xF00000	Active CRC/UE error
+		0x1000000	ECC/CRC error detected during calibration
+		==========	=====
+
+What:		/sys/devices/system/edac/mc/mc0/xsem_cram_injecterr
+Date:		June 2026
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to the firmware for doing error injection in
+		Configuration RAM (CRAM) of Versal mono/SSIT devices.
+		User needs to provide the location details of CRAM
+		(frame, qword, bit number, row number) and
+		SLR id (Versal SSIT device) details to inject the error.
+		For Versal mono devices, the SLR id should be 0..
+		When read, it shows the current error injection status. The
+		format is <header> <error code> <Slr ID>
+		Example: 0x10304 0
+		The different error codes are as given below:
+		==========	=====
+		Error Code	Cause
+		==========	=====
+		0x0			Error injection success
+		0x2000		Internal NULL pointer error
+		0x500000	CRAM initialization not yet done
+		0x800000	Invalid row
+		0x900000	Invalid qword
+		0xA00000	Invalid bit
+		0xB00000	Invalid frame address
+		0xC00000	Unexpected bits flipped
+		0xD00000	Masked bit
+		0xE00000	Invalid block type
+		0xF00000	Active CRC/UE error in CRAM
+		==========	=====
+
+What:		/sys/devices/system/edac/mc/mc0/xsem_cram_framecc_read
+Date:		June 2026
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to the firmware for reading frame ECC values in
+		Configuration RAM (CRAM) of Versal devices. User needs
+		to provide the location details of CRAM
+		(frame, row number, SLR id in SSIT device) to read the ECC values.
+		For Versal mono devices, SLR id should be 0.
+		When read, it shows the ECC values for the requested frame.
+		The format is <header> <ECC_0> <ECC_1> <status>
+		Example:
+		Read Frame ECC Cmd: [0x3030a]
+		Frame ECC Word_0: [0x52f245]
+		Frame ECC Word_1: [0x7c5a6b]
+		Cmd Status: [0x0]
+
+What:		/sys/devices/system/edac/mc/mc0/xsem_read_config
+Date:		June 2026
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to the firmware for reading Xilsem configuration.
+		When read, it shows the CRAM and NPI scan configuration.
+		The format is <status> <header> <CRAM config> <NPI config>
+		Example: Read Config Cmd: [0x30309]
+		CRAM Scan Config: [0x2e]
+		NPI Scan Config: [0x5016]
+		Cmd Status: [0x0]
+
+What:		/sys/devices/system/edac/mc/mc0/xsem_read_status
+Date:		June 2026
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request read the Xilsem status. User needs to provide
+		the module id for status. The module id values are as given below:
+		1 - CRAM scan
+		2 - NPI scan
+		When read, it shows the status of the requested module.
+		For CRAM: <status> <CE count>
+		Example: 0x10005 0
+		For NPI: <status> <scan count> <heartbeat count>
+		Example: 0xA01 0x10 0x1
+
+What:		/sys/devices/system/edac/mc/mc0/xsem_cram_ssit_getcrc
+Date:		June 2026
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to read CRC of a row in CRAM. User needs to provide
+		the row number and SLR id (Versal SSIT device) for which CRC
+		to be read. For Versal mono devices, SLR id should be 0.
+		When read, it shows the CRC of the requested row.
+		The format is: <Header> <CRC Word 0 to 3> <status>
+		Example: Read CRC Cmd:[0x1030c]
+		CRC_Word 0:[0x0]
+		CRC_Word 1:[0x1f72d881]
+		CRC_Word 2:[0x0]
+		CRC_Word 3:[0x0]
+		Cmd status: [0x0]
+
+What:		/sys/devices/system/edac/mc/mc0/xsem_read_ssit_status
+Date:		June 2026
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to read CRAM and NPI scan status information in a given SLR.
+		User needs to provide SLR id in Versal SSIT device for which
+		XilSEM status to be read. When read, it shows
+		the XilSEM status of the requested SLR.
+		The format is: <Header> <SLR id> <NPI status info> <CRAM status info>
+		Example: Read SLR Status Cmd:[0x1030d]
+		SLR ID:[0x3]
+		NPI status:[0xa01]
+		NPI scan count:[0x413]
+		NPI Heartbeat count:[0x1150c]
+		NPI scan skip count 0 :[0x0]
+		NPI scan skip count 1 :[0x0]
+		NPI scan skip count 2 :[0x0]
+		NPI scan skip count 3 :[0x0]
+		NPI scan skip count 4 :[0x0]
+		NPI scan skip count 5 :[0x0]
+		NPI scan skip count 6 :[0x0]
+		NPI scan skip count 7 :[0x0]
+		NPI error info 0 :[0x0]
+		NPI error info 1 :[0x0]
+		CRAM status:[0x10005]
+		Error Location High 0: [0x0]
+		Error Location Low 0: [0x0]
+		Error Location High 1: [0x0]
+		Error Location Low 1: [0x0]
+		Error Location High 2: [0x0]
+		Error Location Low 2: [0x0]
+		Error Location High 3: [0x0]
+		Error Location Low 3: [0x0]
+		Error Location High 4: [0x0]
+		Error Location Low 4: [0x0]
+		Error Location High 5: [0x0]
+		Error Location Low 5: [0x0]
+		Error Location High 6: [0x0]
+		Error Location Low 6: [0x0]
+		CRAM scan CE count:[0x0]
+
+What:		/sys/devices/system/edac/mc/mc0/xsem_total_cframes_ssit
+Date:		June 2026
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to read total cframes in a row in CRAM.
+		User needs to provide row number and SLR id in
+		Versal SSIT device for which total frames to be read.
+		When read, it shows total number of Cframes for the requested SLR.
+		The format is: <Header> <SLR id> <row> <total frames> <Cmd status>
+		Example: Read Total Frames Cmd : [0x4030e]
+		SLR ID : [0x3]
+		Row Index: [0x0]
+		Type[0] frame count: [38752]
+		Type[1] frame count: [262144]
+		Type[2] frame count: [20480]
+		Type[3] frame count: [16]
+		Type[4] frame count: [8]
+		Type[5] frame count: [0]
+		Type[6] frame count: [83]
+		Cmd Status: [0x0]
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to the firmware for doing requested scan operation in
+		Configuration RAM (CRAM) or NPI of Versal devices. User needs
+		to provide scan operation id (init, start, stop) details.
+		The scan operation id values are as given below:
+		1 - Initialize the scan
+		2 - Start CRAM scan
+		3 - Stop CRAM scan
+		5 - Start NPI scan
+		6 - Stop NPI scan
+		7 - Inject NPI error in first descriptor
+
+		When read, it shows the current scan status with error code.
+		The format is <0x1030 | operation Id> <error code>.
+		The different error codes are as given below:
+		==========	=====
+		Error Code	Cause
+		==========	=====
+		0x0			Scan operation success
+		0x1			Failure in NPI scan
+		0x80		Calibration timeout
+		0x2000		Internal error
+		0x500000	CRAM initialization not yet done
+		0x600000	Start scan failed
+		0x700000	Stop scan failed
+		0xF00000	Active CRC/UE error
+		0x1000000	ECC/CRC error detected during calibration
+		==========	=====
+
+What:		/sys/devices/system/edac/versal_xilsem/xsem_cram_injecterr
+Date:		July 2025
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to the firmware for doing error injection in
+		Configuration RAM (CRAM) of Versal devices. User needs
+		to provide the location details of CRAM
+		(frame, qword, bit number, row number) to inject the error.
+		When read, it shows the current error injection status. The
+		format is <header> <error code>.
+		Example: 0x10304 0
+		The different error codes are as given below:
+		==========	=====
+		Error Code	Cause
+		==========	=====
+		0x0			Error injection success
+		0x2000		Internal NULL pointer error
+		0x500000	CRAM initialization not yet done
+		0x800000	Invalid row
+		0x900000	Invalid qword
+		0xA00000	Invalid bit
+		0xB00000	Invalid frame address
+		0xC00000	Unexpected bits flipped
+		0xD00000	Masked bit
+		0xE00000	Invalid block type
+		0xF00000	Active CRC/UE error in CRAM
+		==========	=====
+
+What:		/sys/devices/system/edac/versal_xilsem/xsem_cram_framecc_read
+Date:		July 2025
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to the firmware for reading frame ECC values in
+		Configuration RAM (CRAM) of Versal devices. User needs
+		to provide the location details of CRAM
+		(frame, row number) to read the ECC values.
+		When read, it shows the ECC values for the requested frame.
+		The format is <status> <header> <ECC_0> <ECC_1>
+		Example: 0 0x1030A 0x363B1A 0x8A0200
+
+What:		/sys/devices/system/edac/versal_xilsem/xsem_read_config
+Date:		July 2025
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request to the firmware for reading Xilsem configuration.
+		When read, it shows the CRAM and NPI scan configuration.
+		The format is <status> <header> <CRAM config> <NPI config>
+		Example: 0 0x1030A 0x26 0x5016
+
+What:		/sys/devices/system/edac/versal_xilsem/xsem_read_status
+Date:		July 2025
+Contact:	rama.devi.veggalam@amd.com
+Description:
+		It is a read/write file.
+		Writing to this file causes the software to initiate a
+		request read the Xilsem status. User needs to provide
+		the module id for status. The module id values are as given below:
+		1 - CRAM scan
+		2 - NPI scan
+		When read, it shows the status of the requested module.
+		For CRAM: <status> <CE count>
+		Example: 0x10005 0
+		For NPI: <status> <scan count> <heartbeat count>
+		Example: 0xA01 0x10 0x1
-- 
2.23.0

[PATCH v3 3/4] firmware: xilinx: Add support for Xilsem scan operations

[Rama devi Veggalam]

Add the ATF EEMI call support for Xilsem scan operations.
Initialize, start, stop scan, error inject, read configuration,
status and register for software error events.

Add macros for XilSem correctable and uncorrectable error events.

Signed-off-by: Rama devi Veggalam <rama.devi.veggalam@amd.com>
---
Changes in v3:
- created separate file for Xilsem ATF EEMI calls.

Changes in v2:
- Patch created on top of dependent patch series
"enhance zynqmp_pm_get_family_info()"
- Removed non-relevant SOB names in error event header files
- Updated copyright information
- Merged Versal and Versal NET error event definitions to firmware
patch
---
 drivers/firmware/xilinx/Makefile              |   2 +-
 drivers/firmware/xilinx/zynqmp-sem.c          | 176 ++++++++++++++++++
 drivers/soc/xilinx/xlnx_event_manager.c       |   6 +-
 .../linux/firmware/xlnx-versal-error-events.h |  43 +++++
 include/linux/firmware/xlnx-zynqmp-sem.h      |  69 +++++++
 include/linux/firmware/xlnx-zynqmp.h          |   1 +
 6 files changed, 294 insertions(+), 3 deletions(-)
 create mode 100644 drivers/firmware/xilinx/zynqmp-sem.c
 create mode 100644 include/linux/firmware/xlnx-versal-error-events.h
 create mode 100644 include/linux/firmware/xlnx-zynqmp-sem.h

diff --git a/drivers/firmware/xilinx/Makefile b/drivers/firmware/xilinx/Makefile
index 8db0e66b6b7e..f9380c8931ae 100644
--- a/drivers/firmware/xilinx/Makefile
+++ b/drivers/firmware/xilinx/Makefile
@@ -1,5 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0
 # Makefile for Xilinx firmwares
 
-obj-$(CONFIG_ZYNQMP_FIRMWARE) += zynqmp.o zynqmp-ufs.o zynqmp-crypto.o
+obj-$(CONFIG_ZYNQMP_FIRMWARE) += zynqmp.o zynqmp-sem.o zynqmp-ufs.o zynqmp-crypto.o
 obj-$(CONFIG_ZYNQMP_FIRMWARE_DEBUG) += zynqmp-debug.o
diff --git a/drivers/firmware/xilinx/zynqmp-sem.c b/drivers/firmware/xilinx/zynqmp-sem.c
new file mode 100644
index 000000000000..5cd399b165f5
--- /dev/null
+++ b/drivers/firmware/xilinx/zynqmp-sem.c
@@ -0,0 +1,176 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Firmware layer for XilSEM APIs.
+ *
+ * Copyright (C), 2026 Advanced Micro Devices, Inc.
+ */
+
+#include <linux/export.h>
+#include <linux/firmware/xlnx-zynqmp.h>
+
+/**
+ * zynqmp_pm_xilsem_cntrl_ops - PM call to perform XilSEM operations
+ * @cmd:	Command for XilSEM scan control operations
+ * @slrid:	SLR id on which scan operation to be done
+ * @response:	Output response (command header, error code or status, slr id)
+ *
+ * Return: Returns 0 on success or error value on failure.
+ */
+int zynqmp_pm_xilsem_cntrl_ops(u32 cmd, u32 slrid, u32 *const response)
+{
+	u32 ret_buf[PAYLOAD_ARG_CNT];
+	int ret;
+
+	ret = zynqmp_pm_invoke_fn(PM_XSEM_HEADER | cmd, ret_buf, 1, slrid);
+	response[0] = ret_buf[1];
+	response[1] = ret_buf[2];
+	response[2] = ret_buf[3];
+	response[3] = ret_buf[4];
+	response[4] = ret_buf[5];
+	response[5] = ret_buf[6];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_cntrl_ops);
+
+/**
+ * zynqmp_pm_xilsem_cram_errinj - PM call to perform CRAM error injection
+ * @slrid:	SLR id to inject error in CRAM
+ * @frame:	Frame number to be used for error injection
+ * @qword:	Word number to be used for error injection
+ * @bit:	Bit location to be used for error injection
+ * @row:	CFRAME row number to be used for error injection
+ * @response:	Output response (command header, error code or status, slr id)
+ *
+ * Return: Returns 0 on success or error value on failure.
+ */
+int zynqmp_pm_xilsem_cram_errinj(u32 slrid, u32 frame, u32 qword, u32 bit, u32 row,
+				 u32 *const response)
+{
+	u32 ret_buf[PAYLOAD_ARG_CNT];
+	int ret;
+
+	ret = zynqmp_pm_invoke_fn(PM_XSEM_CRAM_ERRINJ, ret_buf, 5, slrid, frame, qword, bit, row);
+	response[0] = ret_buf[1];
+	response[1] = ret_buf[2];
+	response[2] = ret_buf[3];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_cram_errinj);
+
+/**
+ * zynqmp_pm_xilsem_cram_readecc - PM call to perform CFRAME ECC read
+ * @slrid:	SLR id on which Frame ECC read to be done
+ * @frame:	Frame number to be used for reading ECC
+ * @row:	CFRAME row number to be used for reading ECC
+ * @response:	Output response (Frame ecc header, ECC values, status)
+ *
+ * Return: Returns 0 on success or error value on failure.
+ */
+int zynqmp_pm_xilsem_cram_readecc(u32 slrid, u32 frame, u32 row, u32 *const response)
+{
+	u32 ret_buf[PAYLOAD_ARG_CNT];
+	int ret;
+
+	ret = zynqmp_pm_invoke_fn(PM_XSEM_CRAM_RD_ECC, ret_buf, 3, slrid, frame, row);
+	response[0] = ret_buf[1];
+	response[1] = ret_buf[2];
+	response[2] = ret_buf[3];
+	response[3] = ret_buf[4];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_cram_readecc);
+
+/**
+ * zynqmp_pm_xilsem_read_cfg - PM call to perform Xilsem configuration read
+ * @slrid:	SLR id for which configuration to be read
+ * @response:	Output response (config header, Xilsem config, status)
+ *
+ * Return: Returns 0 on success or error value on failure.
+ */
+int zynqmp_pm_xilsem_read_cfg(u32 slrid, u32 *const response)
+{
+	u32 ret_buf[PAYLOAD_ARG_CNT];
+	int ret;
+
+	ret = zynqmp_pm_invoke_fn(PM_XSEM_RD_CONFIG, ret_buf, 1, slrid);
+	response[0] = ret_buf[1];
+	response[1] = ret_buf[2];
+	response[2] = ret_buf[3];
+	response[3] = ret_buf[4];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_read_cfg);
+
+/**
+ * zynqmp_pm_xilsem_read_ssit_status - PM call to perform Xilsem SSIT status
+ * @slrid:	SLR id for which ECC read to be done
+ * @bufaddr:	Buffer address to get the status information
+ * @response:	Output response (status read header, slr id)
+ *
+ * Return: Returns 0 on success or error value on failure.
+ */
+int zynqmp_pm_xilsem_read_ssit_status(u32 slrid, u32 bufaddr, u32 *const response)
+{
+	u32 ret_buf[PAYLOAD_ARG_CNT];
+	int ret;
+
+	ret = zynqmp_pm_invoke_fn(PM_XSEM_SSIT_RD_STS, ret_buf, 2, slrid, bufaddr);
+	response[0] = ret_buf[1];
+	response[1] = ret_buf[2];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_read_ssit_status);
+
+/**
+ * zynqmp_pm_xilsem_cram_getcrc - PM call to perform CRAM Row CRC read
+ * @slrid:	SLR id for which CRC read to be done
+ * @rowindex:	CFRAME row number to be used for reading CRC
+ * @response:	Output response (Get CRC header, CRC values, status)
+ *
+ * Return: Returns 0 on success or error value on failure.
+ */
+int zynqmp_pm_xilsem_cram_getcrc(u32 slrid, u32 rowindex, u32 *const response)
+{
+	u32 ret_buf[PAYLOAD_ARG_CNT];
+	int ret;
+
+	ret = zynqmp_pm_invoke_fn(PM_XSEM_SSIT_GET_CRC, ret_buf, 2, slrid, rowindex);
+	response[0] = ret_buf[1];
+	response[1] = ret_buf[2];
+	response[2] = ret_buf[3];
+	response[3] = ret_buf[4];
+	response[4] = ret_buf[5];
+	response[5] = ret_buf[6];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_cram_getcrc);
+
+/**
+ * zynqmp_pm_xilsem_cram_ssit_totframes - PM call to perform total frames read
+ * @slrid:	SLR id for which total frames read to be done
+ * @row:	CFRAME row number to be used for reading ECC
+ * @framecnt: Buffer address to get toral frames data
+ * @response:	Output response (Total frames header, slr id, row, status)
+ *
+ * Return: Returns 0 on success or error value on failure.
+ */
+int zynqmp_pm_xilsem_cram_ssit_totframes(u32 slrid, u32 row, u32 framecnt, u32 *const response)
+{
+	u32 ret_buf[PAYLOAD_ARG_CNT];
+	int ret;
+
+	ret = zynqmp_pm_invoke_fn(PM_XSEM_SSIT_GET_FRAMES, ret_buf, 3, slrid, row, framecnt);
+	response[0] = ret_buf[1];
+	response[1] = ret_buf[2];
+	response[2] = ret_buf[3];
+	response[3] = ret_buf[4];
+
+	return ret;
+}
+EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_cram_ssit_totframes);
diff --git a/drivers/soc/xilinx/xlnx_event_manager.c b/drivers/soc/xilinx/xlnx_event_manager.c
index f733dc42b3b1..fb820fb15173 100644
--- a/drivers/soc/xilinx/xlnx_event_manager.c
+++ b/drivers/soc/xilinx/xlnx_event_manager.c
@@ -3,12 +3,13 @@
  * Xilinx Event Management Driver
  *
  *  Copyright (C) 2021 Xilinx, Inc.
- *  Copyright (C) 2024 Advanced Micro Devices, Inc.
+ *  Copyright (C) 2024-2026 Advanced Micro Devices, Inc.
  *
  *  Abhyuday Godhasara <abhyuday.godhasara@xilinx.com>
  */
 
 #include <linux/cpuhotplug.h>
+#include <linux/firmware/xlnx-versal-error-events.h>
 #include <linux/firmware/xlnx-event-manager.h>
 #include <linux/firmware/xlnx-zynqmp.h>
 #include <linux/hashtable.h>
@@ -85,7 +86,8 @@ static bool xlnx_is_error_event(const u32 node_id)
 		if (node_id == VERSAL_EVENT_ERROR_PMC_ERR1 ||
 		    node_id == VERSAL_EVENT_ERROR_PMC_ERR2 ||
 		    node_id == VERSAL_EVENT_ERROR_PSM_ERR1 ||
-		    node_id == VERSAL_EVENT_ERROR_PSM_ERR2)
+		    node_id == VERSAL_EVENT_ERROR_PSM_ERR2 ||
+		    node_id == VERSAL_EVENT_ERROR_SW_ERR)
 			return true;
 	} else if (pm_family_code == PM_VERSAL_NET_FAMILY_CODE) {
 		if (node_id == VERSAL_NET_EVENT_ERROR_PMC_ERR1 ||
diff --git a/include/linux/firmware/xlnx-versal-error-events.h b/include/linux/firmware/xlnx-versal-error-events.h
new file mode 100644
index 000000000000..4767a23c9e4d
--- /dev/null
+++ b/include/linux/firmware/xlnx-versal-error-events.h
@@ -0,0 +1,43 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Xilinx Versal Error Event Node IDs and Error Event Mask.
+ * Use with Xilinx Event Management Driver
+ *
+ * Copyright (C) 2021-2022 Xilinx
+ * Copyright (C) 2023-2026 Advanced Micro Devices, Inc.
+ *
+ */
+
+#ifndef _FIRMWARE_XLNX_VERSAL_ERROR_EVENTS_H_
+#define _FIRMWARE_XLNX_VERSAL_ERROR_EVENTS_H_
+
+/*
+ * Error Event Node Ids
+ */
+#define VERSAL_EVENT_ERROR_PMC_ERR1	(0x28100000U)
+#define VERSAL_EVENT_ERROR_PMC_ERR2	(0x28104000U)
+#define VERSAL_EVENT_ERROR_PSM_ERR1	(0x28108000U)
+#define VERSAL_EVENT_ERROR_PSM_ERR2	(0x2810C000U)
+#define VERSAL_EVENT_ERROR_SW_ERR	(0x28110000U)
+
+/*
+ * XPM_VERSAL_EVENT_ERROR_MASK_XSEM_CRAM_CE_5: Error event mask for handling
+ * correctable error in Versal Configuration RAM which is reported by
+ * Soft Error Mitigation (XilSEM).
+ */
+#define XPM_VERSAL_EVENT_ERROR_MASK_XSEM_CRAM_CE_5		BIT(5)
+
+/**
+ * XPM_VERSAL_EVENT_ERROR_MASK_XSEM_CRAM_UE_6: Error event mask for handling
+ * uncorrectable error in Versal Configuration RAM which is reported by
+ * Soft Error Mitigation (XilSEM).
+ */
+#define XPM_VERSAL_EVENT_ERROR_MASK_XSEM_CRAM_UE_6		BIT(6)
+
+/**
+ * XPM_VERSAL_EVENT_ERROR_MASK_XSEM_NPI_UE_7: Error event mask for handling
+ * uncorrectable error in Versal NoC programming interface (NPI)
+ * register which is reported by Soft Error Mitigation (XilSEM).
+ */
+#define XPM_VERSAL_EVENT_ERROR_MASK_XSEM_NPI_UE_7		BIT(7)
+#endif /* _FIRMWARE_XLNX_VERSAL_ERROR_EVENTS_H_ */
diff --git a/include/linux/firmware/xlnx-zynqmp-sem.h b/include/linux/firmware/xlnx-zynqmp-sem.h
new file mode 100644
index 000000000000..722849cc6403
--- /dev/null
+++ b/include/linux/firmware/xlnx-zynqmp-sem.h
@@ -0,0 +1,69 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Firmware layer for XilSEM APIs.
+ *
+ * Copyright (C), 2026 Advanced Micro Devices, Inc.
+ */
+
+#ifndef __FIRMWARE_ZYNQMP_SEM_H__
+#define __FIRMWARE_ZYNQMP_SEM_H__
+
+/* XilSEM commands */
+#define PM_XSEM_HEADER			0x300
+#define PM_XSEM_CRAM_ERRINJ		0x304
+#define PM_XSEM_RD_CONFIG		0x309
+#define PM_XSEM_CRAM_RD_ECC		0x30B
+#define PM_XSEM_SSIT_GET_CRC		0x30C
+#define PM_XSEM_SSIT_RD_STS		0x30D
+#define PM_XSEM_SSIT_GET_FRAMES		0x30E
+
+#if IS_REACHABLE(CONFIG_ZYNQMP_FIRMWARE)
+int zynqmp_pm_xilsem_cntrl_ops(u32 cmd, u32 slrid, u32 *const response);
+int zynqmp_pm_xilsem_cram_errinj(u32 slrid, u32 frame, u32 qword, u32 bit, u32 row,
+				 u32 *const response);
+int zynqmp_pm_xilsem_cram_readecc(u32 slrid, u32 frame, u32 row, u32 *const response);
+int zynqmp_pm_xilsem_read_cfg(u32 slrid, u32 *const response);
+int zynqmp_pm_xilsem_read_ssit_status(u32 slrid, u32 bufaddr, u32 *const response);
+int zynqmp_pm_xilsem_cram_getcrc(u32 slrid, u32 rowindex, u32 *const response);
+int zynqmp_pm_xilsem_cram_ssit_totframes(u32 slrid, u32 row, u32 framecnt,
+					 u32 *const response);
+#else
+static inline int zynqmp_pm_xilsem_cntrl_ops(u32 cmd, u32 slrid, u32 *const response)
+{
+	return -ENODEV;
+}
+
+static inline int zynqmp_pm_xilsem_cram_errinj(u32 slrid, u32 frame, u32 qword, u32 bit, u32 row,
+					       u32 *const response)
+{
+	return -ENODEV;
+}
+
+static inline int zynqmp_pm_xilsem_cram_readecc(u32 slrid, u32 frame, u32 row, u32 *const response)
+{
+	return -ENODEV;
+}
+
+static inline int zynqmp_pm_xilsem_read_cfg(u32 slrid, u32 *const response)
+{
+	return -ENODEV;
+}
+
+static inline int zynqmp_pm_xilsem_read_ssit_status(u32 slrid, u32 bufaddr, u32 *const response)
+{
+	return -ENODEV;
+}
+
+static inline int zynqmp_pm_xilsem_cram_getcrc(u32 slrid, u32 rowindex, u32 *const response)
+{
+	return -ENODEV;
+}
+
+static inline int zynqmp_pm_xilsem_cram_ssit_totframes(u32 slrid, u32 row, u32 framecnt,
+						       u32 *const response)
+{
+	return -ENODEV;
+}
+#endif
+
+#endif /* __FIRMWARE_ZYNQMP_SEM_H__ */
diff --git a/include/linux/firmware/xlnx-zynqmp.h b/include/linux/firmware/xlnx-zynqmp.h
index 7e27b0f7bf7e..f5808f39c7a6 100644
--- a/include/linux/firmware/xlnx-zynqmp.h
+++ b/include/linux/firmware/xlnx-zynqmp.h
@@ -18,6 +18,7 @@
 #include <linux/err.h>
 #include <linux/firmware/xlnx-zynqmp-ufs.h>
 #include <linux/firmware/xlnx-zynqmp-crypto.h>
+#include <linux/firmware/xlnx-zynqmp-sem.h>
 
 #define ZYNQMP_PM_VERSION_MAJOR	1
 #define ZYNQMP_PM_VERSION_MINOR	0
-- 
2.23.0

[PATCH v3 4/4] edac: xilinx: Add EDAC support for Versal XilSem

[Rama devi Veggalam]

Xilinx Versal Soft Error Mitigation (XilSEM) is responsible for reporting
and optionally correcting soft errors in Configuration Memory of Versal.
The Configuration Memory includes Configuration RAM and
Network on Chip (NoC) peripheral interconnect (NPI) Registers.

The Configuration RAM (CRAM) memory is used for storing configuration
data for the programmable logic (PL) fabric. The NPI registers are used
for configuring the memory controllers, miscellaneous integrated hardware,
NoC interface units in the Veral device.

Add support to handle correctable and uncorrectable error events
from XilSEM.

Add sysfs interface for XilSEM scan operations
initialize, start, stop scan, error inject, read ECC, scan status and
configuration values.

Signed-off-by: Rama devi Veggalam <rama.devi.veggalam@amd.com>
---
Changes in v3:
- Merged Versal XilSem edac with Versal edac

Changes in v2:
- Patch created on top of dependent patch series
"enhance zynqmp_pm_get_family_info()"
- Fixed maximum length warning in patch description
- Added details for eprobe_defer conditions
- Updated copyright information
- Removed ARCH_ZYNQMP in dependent list of XilSEM Kconfig
- Added error code for invalid versal device type
- Removed redundant sysfs details in function headers
- Included MAINTAINERS to this patch
- Added more description in commit message
- Removed print for probe success
- Removed function comments for xsem_edac_remove()
---
 MAINTAINERS                |    1 +
 drivers/edac/Kconfig       |    4 +-
 drivers/edac/versal_edac.c | 1348 +++++++++++++++++++++++++++++++++++-
 3 files changed, 1349 insertions(+), 4 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 9b787bc2855f..3109d05c324a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -29585,6 +29585,7 @@ F:	include/uapi/linux/xilinx-v4l2-controls.h
 XILINX VERSAL EDAC DRIVER
 M:	Shubhrajyoti Datta <shubhrajyoti.datta@amd.com>
 M:	Sai Krishna Potthuri <sai.krishna.potthuri@amd.com>
+M:	Rama Devi Veggalam <rama.devi.veggalam@amd.com>
 S:	Maintained
 F:	Documentation/devicetree/bindings/memory-controllers/xlnx,versal-ddrmc-edac.yaml
 F:	drivers/edac/versal_edac.c
diff --git a/drivers/edac/Kconfig b/drivers/edac/Kconfig
index a44b85c440ca..1549dbff3666 100644
--- a/drivers/edac/Kconfig
+++ b/drivers/edac/Kconfig
@@ -546,11 +546,11 @@ config EDAC_NPCM
 	  device used to store data is used for ECC storage).
 
 config EDAC_VERSAL
-	tristate "Xilinx Versal DDR Memory Controller"
+	tristate "Xilinx Versal DDR Memory Controller and XilSEM"
 	depends on ARCH_ZYNQMP || COMPILE_TEST
 	help
 	  Support for error detection and correction on the Xilinx Versal DDR
-	  memory controller.
+	  memory controller and configuration memory of the programmable logic (PL) fabric. Support detection of errors in Network on Chip (NoC) peripheral interconnect (NPI) Registers.
 
 	  Report both single bit errors (CE) and double bit errors (UE).
 	  Support injecting both correctable and uncorrectable errors
diff --git a/drivers/edac/versal_edac.c b/drivers/edac/versal_edac.c
index 5a43b5d43ca2..024ddd90f699 100644
--- a/drivers/edac/versal_edac.c
+++ b/drivers/edac/versal_edac.c
@@ -1,7 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
  * Xilinx Versal memory controller driver
- * Copyright (C) 2023 Advanced Micro Devices, Inc.
+ * Copyright (C) 2022 - 2026, Advanced Micro Devices, Inc.
  */
 #include <linux/bitfield.h>
 #include <linux/edac.h>
@@ -11,12 +11,88 @@
 #include <linux/of_address.h>
 #include <linux/of_device.h>
 #include <linux/platform_device.h>
+#include <linux/dma-mapping.h>
 #include <linux/sizes.h>
+#include <linux/io.h>
 #include <linux/firmware/xlnx-zynqmp.h>
+#include <linux/firmware/xlnx-versal-error-events.h>
 #include <linux/firmware/xlnx-event-manager.h>
 
 #include "edac_module.h"
 
+/* XilSem CE Error log count */
+#define XILSEM_MAX_CE_LOG_CNT	7
+
+/** Maximum CRAM error register count */
+#define MAX_CRAMERR_REG_CNT		14
+/** Maximum NPI slave skip count */
+#define MAX_NPI_SLV_SKIP_CNT	8
+/** Maximum NPI Error info count */
+#define MAX_NPI_ERR_INFO_CNT	2
+
+/* Maximum SLR count */
+#define MAX_SLR_ID	3
+
+/** Maximum number of cframe types  */
+#define CFRAME_MAX_TYPE	7
+
+/** Mask for getting Type_0, Type_4 frames */
+#define CFRAME_TYPE_0_4_MASK	GENMASK(19, 0)
+
+/** Low mask, High mask for getting Type_1, Type_5 frames */
+#define CFRAME_TYPE_1_5_MASK_L	GENMASK(39, 20)
+#define CFRAME_TYPE_1_5_MASK_H	GENMASK(7, 0)
+
+/** Shift for getting Type_1, Type_5 frames */
+#define CFRAME_TYPE_1_5_SHIFT_R		0x20
+#define CFRAME_TYPE_1_5_SHIFT_L		0x12
+
+/** Mask for getting Type_2, Type_6 frames */
+#define CFRAME_TYPE_2_6_MASK	GENMASK(27, 8)
+
+/** Shift for getting Type_2, Type_6 frames */
+#define CFRAME_TYPE_2_6_SHIFT_R		0x8
+
+/** Low mask, high mask for getting Type_3 frames */
+#define CFRAME_TYPE_3_MASK_L		GENMASK(31, 28)
+#define CFRAME_TYPE_3_MASK_H		GENMASK(15, 0)
+
+/** Shift for getting Type_3 */
+#define CFRAME_TYPE_3_SHIFT_R	0x28
+#define CFRAME_TYPE_3_SHIFT_L	0x4
+
+/* XilSem_CRAM scan error info registers */
+#define CRAM_STS_INFO_OFFSET	0x34
+#define CRAM_CE_ADDRL0_OFFSET	0x38
+#define CRAM_CE_ADDRH0_OFFSET	0x3C
+#define CRAM_CE_COUNT_OFFSET	0x70
+
+/* XilSem_NPI_Scan uncorrectable error info registers */
+#define NPI_SCAN_COUNT			0x24
+#define NPI_SCAN_HB_COUNT		0x28
+#define NPI_ERR0_INFO_OFFSET	0x2C
+#define NPI_ERR1_INFO_OFFSET	0x30
+
+/* XilSem bit masks for extracting error details */
+#define CRAM_ERR_ROW_MASK	GENMASK(26, 23)
+#define CRAM_ERR_BIT_MASK	GENMASK(22, 16)
+#define CRAM_ERR_QWRD_MASK	GENMASK(27, 23)
+#define CRAM_ERR_FRAME_MASK	GENMASK(22, 0)
+
+enum xsem_cmd_id {
+	CRAM_INIT_SCAN = 1, /* To initialize CRAM scan */
+	CRAM_START_SCAN = 2, /* To start CRAM scan */
+	CRAM_STOP_SCAN = 3, /* To stop CRAM scan */
+	CRAM_ERR_INJECT = 4, /* To inject CRAM error */
+	NPI_START_SCAN = 5, /* To start NPI scan */
+	NPI_STOP_SCAN = 6, /* To stop NPI scan */
+	NPI_ERR_INJECT = 7, /* To inject NPI error */
+};
+
+/* XilSem Module IDs */
+#define CRAM_MOD_ID			0x1
+#define NPI_MOD_ID			0x2
+
 /* Granularity of reported error in bytes */
 #define XDDR_EDAC_ERR_GRAIN			1
 
@@ -205,6 +281,105 @@ struct ecc_status {
 	u8 error_type;
 };
 
+/*  XILSEM structures */
+/**
+ * struct xsem_ecc_error_info - ECC error log information
+ * @status:	CRAM/NPI scan error status
+ * @data0:	Checksum of the error descriptor
+ * @data1:	Index of the error descriptor
+ * @frame_addr:	Frame location at which error occurred
+ * @block_type:	Block type
+ * @row_id:	Row number
+ * @bit_loc:	Bit position in the Qword
+ * @qword:	Qword location in the frame
+ */
+struct xsem_ecc_error_info {
+	u32 status;
+	u32 data0;
+	u32 data1;
+	u32 frame_addr;
+	u8 block_type;
+	u8 row_id;
+	u8 bit_loc;
+	u8 qword;
+};
+
+/**
+ * struct xsem_error_status - ECC status information to report
+ * @ce_cnt:	Correctable error count
+ * @ue_cnt:	Uncorrectable error count
+ * @ceinfo:	Correctable error log information
+ * @ueinfo:	Uncorrectable error log information
+ */
+struct xsem_error_status {
+	u32 ce_cnt;
+	u32 ue_cnt;
+	struct xsem_ecc_error_info ceinfo;
+	struct xsem_ecc_error_info ueinfo;
+};
+
+/**
+ * struct xsem_ssit_status - SSIT status information
+ * @npi_status: NPI Status
+ * @slvskpcnt: NPI Slave skip count
+ * @scancnt: NPI Scan count
+ * @hbcnt: NPI Heartbeat count
+ * @err_info: NPI Error Information
+ * @cram_status: Cram Status
+ * @err_addr: Address of corrected error location
+ * @errcnt: Corrected Error count.
+ */
+struct xsem_ssit_status {
+	u32 npi_status;
+	u32 slvskpcnt[MAX_NPI_SLV_SKIP_CNT];
+	u32 scancnt;
+	u32 hbcnt;
+	u32 err_info[MAX_NPI_ERR_INFO_CNT];
+	u32 cram_status;
+	u32 err_addr[MAX_CRAMERR_REG_CNT];
+	u32 errcnt;
+};
+
+/**
+ * struct xsem_rtca_priv - Xilsem private instance data
+ * @baseaddr:	Base address of the XilSem PLM RTCA module
+ * @cram_get_frames_status:	Buffer for get total frames command
+ * @cram_get_crc_status:	Buffer for CRC read command
+ * @xilsem_ssit_status:	Buffer for SLR status command
+ * @cram_errinj_status:	Buffer for CRAM error injection
+ * @cram_total_frames:	Buffer for total cframes data
+ * @scan_ctrl_status:	Buffer for scan ctrl commands
+ * @cram_frame_ecc:	Buffer for CRAM frame ECC
+ * @xilsem_status:	Buffer for CRAM & NPI status
+ * @xilsem_cfg:	Buffer for CRAM & NPI configuration
+ * @sw_event_node_id:	Error event node Id
+ * @cram_ce_mask: Event bit mask for CRAM correctable error
+ * @cram_ue_mask: Event bit mask for CRAM uncorrectable error
+ * @npi_ue_mask: Event bit mask for NPI uncorrectable error
+ * @cram_ce_cnt:	Correctable Error count
+ * @cram_ue_cnt:	Uncorrectable Error count
+ * @slr_info:	Pointer to get SSIT status information
+ */
+struct xsem_rtca_priv {
+	void __iomem *baseaddr;
+	u32 cram_get_frames_status[4];
+	u32 cram_get_crc_status[6];
+	u32 xilsem_ssit_status[4];
+	u32 cram_errinj_status[3];
+	u32 cram_total_frames[7];
+	u32 scan_ctrl_status[7];
+	u32 cram_frame_ecc[4];
+	u32 xilsem_status[4];
+	u32 xilsem_cfg[6];
+	u32 sw_event_node_id;
+	u32 cram_ce_mask;
+	u32 cram_ue_mask;
+	u32 npi_ue_mask;
+	u32 cram_ce_cnt;
+	u32 cram_ue_cnt;
+	struct xsem_ssit_status *slr_info;
+};
+
 /**
  * struct edac_priv - DDR memory controller private instance data.
  * @ddrmc_baseaddr:	Base address of the DDR controller.
@@ -227,6 +402,8 @@ struct ecc_status {
 struct edac_priv {
 	void __iomem *ddrmc_baseaddr;
 	void __iomem *ddrmc_noc_baseaddr;
+	void __iomem *sem_baseaddr;
+	struct xsem_rtca_priv *xsem_rtca;
 	char message[XDDR_EDAC_MSG_SIZE];
 	u32 mc_id;
 	u32 ce_cnt;
@@ -1073,14 +1250,1108 @@ static u32 emif_get_id(struct device_node *node)
 	return my_id;
 }
 
+/**
+ * xsem_scan_control_show - Shows scan control operation status
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ *
+ * Shows the scan control operations status
+ * Return: Number of bytes copied.
+ */
+static ssize_t xsem_scan_control_show(struct device *dev,
+				      struct device_attribute *mattr,
+				      char *data)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	return sprintf(data, "[0x%x][0x%x][0x%x][0x%x][0x%x][0x%x][0x%x]\n\r",
+			priv->xsem_rtca->scan_ctrl_status[0],
+			priv->xsem_rtca->scan_ctrl_status[0],
+			priv->xsem_rtca->scan_ctrl_status[1],
+			priv->xsem_rtca->scan_ctrl_status[2],
+			priv->xsem_rtca->scan_ctrl_status[3],
+			priv->xsem_rtca->scan_ctrl_status[4],
+			priv->xsem_rtca->scan_ctrl_status[5]);
+}
+
+/**
+ * xsem_scan_control_store - Set scan control operation
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ * @count:	read the size bytes from buffer
+ *
+ * User-space interface for doing Xilsem scan operations
+ * (initialization, start, stop)
+ * Return: count argument if request succeeds, else error code
+ */
+static ssize_t xsem_scan_control_store(struct device *dev,
+				       struct device_attribute *mattr,
+				       const char *data, size_t count)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	char *kern_buff, *inbuf, *tok;
+	u32 cmd;
+	u32 slrid;
+	int ret;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	kern_buff = kzalloc(count, GFP_KERNEL);
+	if (!kern_buff)
+		return -ENOMEM;
+	strscpy(kern_buff, data, count);
+
+	inbuf = kern_buff;
+
+	if (!data) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	/* Read Scan command */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &cmd);
+	if (ret) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	/* Read SLR number */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &slrid);
+	if (ret) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (cmd < CRAM_INIT_SCAN || cmd > NPI_ERR_INJECT || cmd == CRAM_ERR_INJECT) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	if (slrid > MAX_SLR_ID) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	ret = zynqmp_pm_xilsem_cntrl_ops(cmd, slrid, priv->xsem_rtca->scan_ctrl_status);
+err:
+	kfree(kern_buff);
+
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+/**
+ * xsem_cram_injecterr_show - Shows CRAM error injection status
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ *
+ * Shows CRAM error injection status
+ * Return: Number of bytes copied.
+ */
+static ssize_t xsem_cram_injecterr_show(struct device *dev,
+					struct device_attribute *mattr,
+					char *data)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	return sprintf(data, "[0x%x][0x%x][0x%x]]\n\r",
+			priv->xsem_rtca->cram_errinj_status[0],
+			priv->xsem_rtca->cram_errinj_status[1],
+			priv->xsem_rtca->cram_errinj_status[2]);
+}
+
+/**
+ * xsem_cram_injecterr_store - Start error injection
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ * @count:	read the size bytes from buffer
+ *
+ * User-space interface for doing CRAM error injection
+ * Return: count argument if request succeeds, else error code
+ */
+static ssize_t xsem_cram_injecterr_store(struct device *dev,
+					 struct device_attribute *mattr,
+					 const char *data, size_t count)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	char *kern_buff, *inbuf, *tok;
+	u32 row, frame, qword, bitloc, slrid;
+	int ret;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	kern_buff = kzalloc(count, GFP_KERNEL);
+	if (!kern_buff)
+		return -ENOMEM;
+
+	strscpy(kern_buff, data, count);
+
+	inbuf = kern_buff;
+
+	/* Read Frame number */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &frame);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	/* Read Qword number */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &qword);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	/* Read Bit location */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &bitloc);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	/* Read Row number */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &row);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	/* Read slr id */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &slrid);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	if (slrid > MAX_SLR_ID) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	ret = zynqmp_pm_xilsem_cram_errinj(slrid, frame, qword, bitloc, row,
+					   priv->xsem_rtca->cram_errinj_status);
+err:
+	kfree(kern_buff);
+
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+/**
+ * xsem_cram_framecc_read_show - Shows CRAM Frame ECC
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ *
+ * Shows CRAM Frame ECC value
+ * Return: Number of bytes copied.
+ */
+static ssize_t xsem_cram_framecc_read_show(struct device *dev,
+					   struct device_attribute *mattr,
+					   char *data)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	int offset = 0;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	offset += sprintf(data + offset, "Read Frame ECC Cmd: [0x%x]\n\r",
+			  priv->xsem_rtca->cram_frame_ecc[0]);
+	offset += sprintf(data + offset, "Frame ECC Word_0: [0x%x]\n\r",
+			  priv->xsem_rtca->cram_frame_ecc[1]);
+	offset += sprintf(data + offset, "Frame ECC Word_1: [0x%x]\n\r",
+			  priv->xsem_rtca->cram_frame_ecc[2]);
+	offset += sprintf(data + offset, "Cmd Status: [0x%x]\n\r",
+			  priv->xsem_rtca->cram_frame_ecc[3]);
+
+	return offset;
+}
+
+/**
+ * xsem_cram_framecc_read_store - Read CRAM Frame ECC
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ * @count:	read the size bytes from buffer
+ *
+ * User-space interface for reading CRAM frame ECC
+ * Return: count argument if request succeeds, else error code
+ */
+static ssize_t xsem_cram_framecc_read_store(struct device *dev,
+					    struct device_attribute *mattr,
+					    const char *data, size_t count)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	char *kern_buff, *inbuf, *tok;
+	u32 frameaddr, row, slrid;
+	int ret;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	kern_buff = kzalloc(count, GFP_KERNEL);
+	if (!kern_buff)
+		return -ENOMEM;
+
+	strscpy(kern_buff, data, count);
+
+	inbuf = kern_buff;
+
+	/* Read Frame address */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &frameaddr);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	/* Read Row number */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &row);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	/* Read slr id */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &slrid);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	if (slrid > MAX_SLR_ID) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	ret = zynqmp_pm_xilsem_cram_readecc(slrid, frameaddr, row,
+					    priv->xsem_rtca->cram_frame_ecc);
+err:
+	kfree(kern_buff);
+
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+/**
+ * xsem_cram_ssit_getcrc_show - Shows CRAM Row CRC
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ *
+ * Shows CRAM Row CRC value
+ * Return: Number of bytes copied.
+ */
+static ssize_t xsem_cram_ssit_getcrc_show(struct device *dev,
+					  struct device_attribute *mattr,
+					  char *data)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	int offset = 0;
+	u32 id;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	offset += sprintf(data + offset, "Read CRC Cmd:[0x%x]\n\r",
+			  priv->xsem_rtca->cram_get_crc_status[0]);
+	for (id = 0; id < 4; id++)
+		offset += sprintf(data + offset, "CRC_Word %d:[0x%x]\n\r", id,
+				  priv->xsem_rtca->cram_get_crc_status[id + 1]);
+	offset += sprintf(data + offset, "Cmd status: [0x%x]\n\r",
+			  priv->xsem_rtca->cram_get_crc_status[5]);
+
+	return offset;
+}
+
+/**
+ * xsem_cram_ssit_getcrc_store - Read CRAM row CRC
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ * @count:	read the size bytes from buffer
+ *
+ * User-space interface for reading CRAM row CRC
+ * Return: count argument if request succeeds, else error code
+ */
+static ssize_t xsem_cram_ssit_getcrc_store(struct device *dev,
+					   struct device_attribute *mattr,
+					   const char *data, size_t count)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	char *kern_buff, *inbuf, *tok;
+	u32 rowindex, slrid;
+	int ret;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	kern_buff = kzalloc(count, GFP_KERNEL);
+	if (!kern_buff)
+		return -ENOMEM;
+
+	strscpy(kern_buff, data, count);
+
+	inbuf = kern_buff;
+
+	/* Read Row number */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &rowindex);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	/* Read SLR Id */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &slrid);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	if (slrid > MAX_SLR_ID) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	ret = zynqmp_pm_xilsem_cram_getcrc(slrid, rowindex,
+					   priv->xsem_rtca->cram_get_crc_status);
+err:
+	kfree(kern_buff);
+
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+/**
+ * xsem_total_cframes_ssit_show - Shows total cframes
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ *
+ * Shows CRAM total cframes
+ * Return: Number of bytes copied.
+ */
+static ssize_t xsem_total_cframes_ssit_show(struct device *dev,
+					    struct device_attribute *mattr,
+					    char *data)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	u32 temp_buf[CFRAME_MAX_TYPE] = {0};
+	u32 id;
+	int offset = 0;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	for (id = 0; id < CFRAME_MAX_TYPE; id++)
+		temp_buf[id] = priv->xsem_rtca->cram_total_frames[id];
+
+	priv->xsem_rtca->cram_total_frames[0]  = (temp_buf[0] & CFRAME_TYPE_0_4_MASK);
+	priv->xsem_rtca->cram_total_frames[1]  = (temp_buf[0] &
+					CFRAME_TYPE_1_5_MASK_L) >> CFRAME_TYPE_1_5_SHIFT_R;
+	priv->xsem_rtca->cram_total_frames[1] |= (temp_buf[1] &
+					CFRAME_TYPE_1_5_MASK_H) << CFRAME_TYPE_1_5_SHIFT_L;
+	priv->xsem_rtca->cram_total_frames[2]  = (temp_buf[1] &
+					CFRAME_TYPE_2_6_MASK) >> CFRAME_TYPE_2_6_SHIFT_R;
+	priv->xsem_rtca->cram_total_frames[3]  = (temp_buf[1] &
+					CFRAME_TYPE_3_MASK_L) >> CFRAME_TYPE_3_SHIFT_R;
+	priv->xsem_rtca->cram_total_frames[3] |= (temp_buf[2] &
+					CFRAME_TYPE_3_MASK_H) << CFRAME_TYPE_3_SHIFT_L;
+	priv->xsem_rtca->cram_total_frames[4]  = (temp_buf[4] & CFRAME_TYPE_0_4_MASK);
+	priv->xsem_rtca->cram_total_frames[5]  = (temp_buf[4] &
+					CFRAME_TYPE_1_5_MASK_L) >> CFRAME_TYPE_1_5_SHIFT_R;
+	priv->xsem_rtca->cram_total_frames[5] |= (temp_buf[5] &
+					CFRAME_TYPE_1_5_MASK_H) << CFRAME_TYPE_1_5_SHIFT_L;
+	priv->xsem_rtca->cram_total_frames[6]  = (temp_buf[5] &
+					CFRAME_TYPE_2_6_MASK) >> CFRAME_TYPE_2_6_SHIFT_R;
+
+	offset += sprintf(data + offset, "Read Total Frames Cmd : [0x%x]\n\r",
+			  priv->xsem_rtca->cram_get_frames_status[0]);
+	offset += sprintf(data + offset, "SLR ID : [0x%x]\n\r",
+			  priv->xsem_rtca->cram_get_frames_status[1]);
+	offset += sprintf(data + offset, "Row Index: [0x%x]\n\r",
+			  priv->xsem_rtca->cram_get_frames_status[2]);
+	for (id = 0; id < CFRAME_MAX_TYPE; id++)
+		offset += sprintf(data + offset, "Type[%d] frame count: [%d]\n\r", id,
+				  priv->xsem_rtca->cram_total_frames[id]);
+
+	offset += sprintf(data + offset, "Cmd Status: [0x%x]\n\r",
+			  priv->xsem_rtca->cram_get_frames_status[3]);
+	return offset;
+}
+
+/**
+ * xsem_total_cframes_ssit_store - Read total cframes in CRAM
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ * @count:	read the size bytes from buffer
+ *
+ * User-space interface for reading CRAM total frames in ssit device
+ * Return: count argument if request succeeds, else error code
+ */
+static ssize_t xsem_total_cframes_ssit_store(struct device *dev,
+					     struct device_attribute *mattr,
+					     const char *data, size_t count)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	char *kern_buff, *inbuf, *tok, *kbuf1;
+	dma_addr_t dma_addr = 0;
+	u32 row, slrid, dma_size;
+	int ret;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	kern_buff = kzalloc(count, GFP_KERNEL);
+	if (!kern_buff)
+		return -ENOMEM;
+
+	strscpy(kern_buff, data, count);
+
+	inbuf = kern_buff;
+
+	/* Read Row number */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &row);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	/* Read slr id */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &slrid);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	if (slrid > MAX_SLR_ID || row > 4) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	dma_size = sizeof(priv->xsem_rtca->cram_total_frames);
+	kbuf1 = dma_alloc_coherent(dev, dma_size, &dma_addr, GFP_KERNEL);
+	if (!kbuf1) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	ret = zynqmp_pm_xilsem_cram_ssit_totframes(slrid, row, dma_addr,
+						   priv->xsem_rtca->cram_get_frames_status);
+	if (ret) {
+		edac_printk(KERN_ERR, EDAC_MC, "ERROR: XilSEM Status PM API failed\n");
+		dma_free_coherent(dev, dma_size, kbuf1, dma_addr);
+		goto err;
+	}
+
+	memcpy(priv->xsem_rtca->cram_total_frames, kbuf1, dma_size);
+	dma_free_coherent(dev, dma_size, kbuf1, dma_addr);
+
+err:
+	kfree(kern_buff);
+
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+/**
+ * xsem_read_status_show - Shows CRAM & NPI scan status
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ *
+ * Shows CRAM & NPI scan status
+ * Return: Number of bytes copied.
+ */
+static ssize_t xsem_read_status_show(struct device *dev,
+				     struct device_attribute *mattr,
+				     char *data)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	return sprintf(data, "[0x%x][0x%x][0x%x]\n\r",
+			priv->xsem_rtca->xilsem_status[0],
+			priv->xsem_rtca->xilsem_status[1],
+			priv->xsem_rtca->xilsem_status[2]);
+}
+
+/**
+ * xsem_read_status_store - Read CRAM & NPI scan status
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ * @count:	read the size bytes from buffer
+ *
+ * User-space interface for reading Xilsem status
+ * Return: count argument if read succeeds, else error code
+ */
+static ssize_t xsem_read_status_store(struct device *dev,
+				      struct device_attribute *mattr,
+				      const char *data, size_t count)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	u32 module;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	if (!data)
+		return -EFAULT;
+
+	if (kstrtouint(data, 0, &module))
+		return -EINVAL;
+
+	if (module == CRAM_MOD_ID) {
+		if (priv->sem_baseaddr) {
+			priv->xsem_rtca->xilsem_status[0] = readl(priv->sem_baseaddr +
+								   CRAM_STS_INFO_OFFSET);
+			priv->xsem_rtca->xilsem_status[1] = readl(priv->sem_baseaddr +
+								   CRAM_CE_COUNT_OFFSET);
+			priv->xsem_rtca->xilsem_status[2] = 0;
+		}
+	} else if (module == NPI_MOD_ID) {
+		if (priv->sem_baseaddr) {
+			priv->xsem_rtca->xilsem_status[0] = readl(priv->sem_baseaddr);
+			priv->xsem_rtca->xilsem_status[1] = readl(priv->sem_baseaddr +
+								   NPI_SCAN_COUNT);
+			priv->xsem_rtca->xilsem_status[2] = readl(priv->sem_baseaddr +
+								   NPI_SCAN_HB_COUNT);
+		}
+	} else {
+		edac_printk(KERN_ERR, EDAC_MC, "Invalid module %d\n", module);
+		return -EINVAL;
+	}
+
+	return count;
+}
+
+/**
+ * xsem_read_ssit_status_show - Shows CRAM & NPI scan for SSIT device
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ *
+ * Shows CRAM & NPI scan status for given SLR
+ * Return: Number of bytes copied.
+ */
+static ssize_t xsem_read_ssit_status_show(struct device *dev,
+					  struct device_attribute *mattr,
+					  char *data)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	int offset = 0;
+	int id;
+
+	if (!priv->xsem_rtca || !priv->xsem_rtca->slr_info)
+		return -EINVAL;
+
+	offset += sprintf(data + offset, "Read SLR Status Cmd:[0x%x]\n\r",
+			  priv->xsem_rtca->xilsem_ssit_status[0]);
+	offset += sprintf(data + offset, "SLR ID:[0x%x]\n\r",
+			  priv->xsem_rtca->xilsem_ssit_status[1]);
+	offset += sprintf(data + offset, "NPI status:[0x%x]\n\r",
+			  priv->xsem_rtca->slr_info->npi_status);
+	offset += sprintf(data + offset, "NPI scan count:[0x%x]\n\r",
+			  priv->xsem_rtca->slr_info->scancnt);
+	offset += sprintf(data + offset, "NPI Heartbeat count:[0x%x]\n\r",
+			  priv->xsem_rtca->slr_info->hbcnt);
+	for (id = 0; id < MAX_NPI_SLV_SKIP_CNT; id++)
+		offset += sprintf(data + offset, "NPI scan skip count %x :[0x%x]\n\r", id,
+				  priv->xsem_rtca->slr_info->slvskpcnt[id]);
+
+	for (id = 0; id < MAX_NPI_ERR_INFO_CNT; id++)
+		offset += sprintf(data + offset, "NPI error info %x :[0x%x]\n\r", id,
+				  priv->xsem_rtca->slr_info->err_info[id]);
+
+	offset += sprintf(data + offset, "CRAM status:[0x%x]\n\r",
+			  priv->xsem_rtca->slr_info->cram_status);
+
+	for (id = 0U; id < 7; id++) {
+		offset += sprintf(data + offset, "Error Location High %x: [0x%x]\n\r", id,
+				  priv->xsem_rtca->slr_info->err_addr[(id * 2) + 1]);
+		offset += sprintf(data + offset, "Error Location Low %x: [0x%x]\n\r", id,
+				  priv->xsem_rtca->slr_info->err_addr[id * 2]);
+	}
+	offset += sprintf(data + offset, "CRAM scan CE count:[0x%x]\n\r",
+			  priv->xsem_rtca->slr_info->errcnt);
+
+	return offset;
+}
+
+/**
+ * xsem_read_ssit_status_store - Read CRAM & NPI scan SSIT status
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ * @count:	read the size bytes from buffer
+ *
+ * User-space interface for reading Xilsem status for SSIT device
+ * Return: count argument if read succeeds, else error code
+ */
+static ssize_t xsem_read_ssit_status_store(struct device *dev,
+					   struct device_attribute *mattr,
+					   const char *data, size_t count)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	char *kern_buff, *inbuf, *tok, *kbuf1;
+	size_t dma_size;
+	dma_addr_t dma_addr = 0;
+	u32 slrid;
+	int ret;
+
+	if (!priv->xsem_rtca || !priv->xsem_rtca->slr_info)
+		return -EINVAL;
+
+	kern_buff = kzalloc(count, GFP_KERNEL);
+	if (!kern_buff)
+		return -ENOMEM;
+
+	strscpy(kern_buff, data, count);
+
+	inbuf = kern_buff;
+
+	/* Read SLR ID */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &slrid);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	if (slrid > MAX_SLR_ID) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	dma_size  = sizeof(struct xsem_ssit_status);
+
+	kbuf1 = dma_alloc_coherent(dev, dma_size, &dma_addr, GFP_KERNEL);
+	if (!kbuf1) {
+		ret = -ENOMEM;
+		goto err;
+	}
+
+	ret = zynqmp_pm_xilsem_read_ssit_status(slrid, dma_addr,
+						priv->xsem_rtca->xilsem_ssit_status);
+	if (ret) {
+		edac_printk(KERN_ERR, EDAC_MC, "ERROR: XilSEM Status PM API failed\n");
+		dma_free_coherent(dev, dma_size, kbuf1, dma_addr);
+		goto err;
+	}
+
+	memcpy(priv->xsem_rtca->slr_info, kbuf1, dma_size);
+
+	dma_free_coherent(dev, dma_size, kbuf1, dma_addr);
+err:
+	kfree(kern_buff);
+
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+/**
+ * xsem_read_config_show - Shows CRAM & NPI configuration
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ *
+ * Shows CRAM & NPI configuration
+ * Return: Number of bytes copied.
+ */
+static ssize_t xsem_read_config_show(struct device *dev,
+				     struct device_attribute *mattr,
+				     char *data)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	int offset = 0;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	offset += sprintf(data + offset, "Read Config Cmd: [0x%x]\n\r",
+			  priv->xsem_rtca->xilsem_cfg[0]);
+	offset += sprintf(data + offset, "CRAM Scan Config: [0x%x]\n\r",
+			  priv->xsem_rtca->xilsem_cfg[1]);
+	offset += sprintf(data + offset, "NPI Scan Config: [0x%x]\n\r",
+			  priv->xsem_rtca->xilsem_cfg[2]);
+	offset += sprintf(data + offset, "Cmd Status: [0x%x]\n\r",
+			  priv->xsem_rtca->xilsem_cfg[3]);
+
+	return offset;
+}
+
+/**
+ * xsem_read_config_store - Read CRAM & NPI configuration
+ * @dev:	Pointer to the device struct
+ * @mattr:	Pointer to device attribute
+ * @data:	Pointer to user data
+ * @count:	read the size bytes from buffer
+ *
+ * User-space interface for reading Xilsem configuration
+ * Return: count argument if request succeeds, else error code
+ */
+static ssize_t xsem_read_config_store(struct device *dev,
+				      struct device_attribute *mattr,
+				      const char *data, size_t count)
+{
+	struct mem_ctl_info *mci = to_mci(dev);
+	struct edac_priv *priv = mci->pvt_info;
+	char *kern_buff, *inbuf, *tok;
+	u32 slrid;
+	int ret;
+
+	if (!priv->xsem_rtca)
+		return -EINVAL;
+
+	kern_buff = kzalloc(count, GFP_KERNEL);
+	if (!kern_buff)
+		return -ENOMEM;
+
+	strscpy(kern_buff, data, count);
+
+	inbuf = kern_buff;
+
+	/* Read SLR id */
+	tok = strsep(&inbuf, " ");
+	if (!tok) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	ret = kstrtouint(tok, 0, &slrid);
+	if (ret) {
+		ret = -EFAULT;
+		goto err;
+	}
+
+	if (slrid > MAX_SLR_ID) {
+		ret = -EINVAL;
+		goto err;
+	}
+
+	ret = zynqmp_pm_xilsem_read_cfg(slrid, priv->xsem_rtca->xilsem_cfg);
+
+err:
+	kfree(kern_buff);
+
+	if (ret)
+		return ret;
+
+	return count;
+}
+
+/**
+ * xsem_geterror_info - Get the current ecc error info
+ * @mci:	Pointer to the memory controller instance
+ * @p:		Pointer to the Xilsem error status structure
+ * @mask:	mask indicates the error type
+ *
+ * Determines there is any ecc error or not
+ */
+static void xsem_geterror_info(struct mem_ctl_info *mci, struct xsem_error_status *p,
+			       int mask)
+{
+	struct edac_priv *priv = mci->pvt_info;
+	u32 error_word_0, error_word_1, ce_count;
+	u8 index;
+
+	if (!priv->xsem_rtca || !priv->sem_baseaddr)
+		return;
+
+	if (mask & priv->xsem_rtca->cram_ce_mask) {
+		p->ce_cnt++;
+
+		/* Read CRAM total correctable error count */
+		ce_count = readl(priv->sem_baseaddr + CRAM_CE_COUNT_OFFSET);
+		/* Calculate index for error log */
+		index = (ce_count % XILSEM_MAX_CE_LOG_CNT);
+		/*
+		 * Check if addr index is not 0
+		 * if yes, then decrement index, else set index as last entry
+		 */
+		if (index != 0U) {
+			/* Decrement Index */
+			--index;
+		} else {
+			/* Set log index to 6 (Max-1) */
+			index = (XILSEM_MAX_CE_LOG_CNT - 1);
+		}
+		error_word_0 = readl(priv->sem_baseaddr + CRAM_CE_ADDRL0_OFFSET + (index * 8U));
+		error_word_1 = readl(priv->sem_baseaddr + CRAM_CE_ADDRH0_OFFSET + (index * 8U));
+
+		/* Frame is at 22:0 bits of SEM_CRAMERR_ADDRH0 reg */
+		p->ceinfo.frame_addr = FIELD_GET(CRAM_ERR_FRAME_MASK, error_word_1);
+
+		/* row is at 26:23 bits of SEM_CRAMERR_ADDRH0 reg */
+		p->ceinfo.row_id = FIELD_GET(CRAM_ERR_ROW_MASK, error_word_1);
+
+		/* bit is at 22:16 bits of SEM_CRAMERR_ADDRL0 reg */
+		p->ceinfo.bit_loc = FIELD_GET(CRAM_ERR_BIT_MASK, error_word_0);
+
+		/* Qword is at 27:23 bits of SEM_CRAMERR_ADDRL0 reg */
+		p->ceinfo.qword = FIELD_GET(CRAM_ERR_QWRD_MASK, error_word_0);
+
+		/* Read CRAM status */
+		p->ceinfo.status = readl(priv->sem_baseaddr + CRAM_STS_INFO_OFFSET);
+	} else if (mask & priv->xsem_rtca->cram_ue_mask) {
+		p->ue_cnt++;
+		p->ueinfo.data0 = 0;
+		p->ueinfo.data1 = 0;
+		p->ueinfo.status = readl(priv->sem_baseaddr + CRAM_STS_INFO_OFFSET);
+	} else if (mask & priv->xsem_rtca->npi_ue_mask) {
+		p->ue_cnt++;
+		p->ueinfo.data0 = readl(priv->sem_baseaddr + NPI_ERR0_INFO_OFFSET);
+		p->ueinfo.data1 = readl(priv->sem_baseaddr + NPI_ERR1_INFO_OFFSET);
+		p->ueinfo.status = readl(priv->sem_baseaddr);
+	} else {
+		edac_printk(KERN_ERR, EDAC_MC, "Invalid Event received %d\n", mask);
+	}
+}
+
+/**
+ * xsem_handle_error - Handle XilSem error types CE and UE
+ * @mci:	Pointer to the memory controller instance
+ * @p:		Pointer to the xilsem error status structure
+ *
+ * Handles the correctable and uncorrectable error.
+ */
+static void xsem_handle_error(struct mem_ctl_info *mci, struct xsem_error_status *p)
+{
+	struct xsem_ecc_error_info *pinf;
+	char message[XDDR_EDAC_MSG_SIZE];
+
+	if (p->ce_cnt) {
+		pinf = &p->ceinfo;
+		snprintf(message, XDDR_EDAC_MSG_SIZE,
+			 "\n\rXILSEM CRAM error type :%s\n\r"
+			 "\nFrame_Addr: [0x%X]\t Row_num: [0x%X]\t Bit_loc: [0x%X]\t Qword: [0x%X]\n\r",
+			 "CE", pinf->frame_addr, pinf->row_id,
+			 pinf->bit_loc, pinf->qword);
+
+		edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci,
+				     p->ce_cnt, 0, 0, 0, 0, 0, -1,
+				     message, "");
+	}
+
+	if (p->ue_cnt) {
+		pinf = &p->ueinfo;
+		snprintf(message, XDDR_EDAC_MSG_SIZE,
+			 "\n\rXILSEM error type :%s\n\r"
+			 "status: [0x%X]\n\rError_Info0: [0x%X]\n\r"
+			 "Error_Info1: [0x%X]",
+			 "UE", pinf->status, pinf->data0, pinf->data1);
+
+		edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci,
+				     p->ue_cnt, 0, 0, 0, 0, 0, -1,
+				     message, "");
+	}
+}
+
+/**
+ * xsem_err_callback - Handle Correctable and Uncorrectable errors.
+ * @payload:	payload data.
+ * @data:	controller data.
+ *
+ * Handles ECC correctable and uncorrectable errors.
+ */
+static void xsem_err_callback(const u32 *payload, void *data)
+{
+	struct xsem_error_status stat;
+	struct edac_priv *priv;
+	struct mem_ctl_info *mci = (struct mem_ctl_info *)data;
+	int event;
+
+	priv = mci->pvt_info;
+	if (!priv->xsem_rtca)
+		return;
+
+	memset(&stat, 0, sizeof(stat));
+	/* Read payload to get the event type */
+	event = payload[2];
+	edac_printk(KERN_INFO, EDAC_MC, "Event received %x\n", event);
+	xsem_geterror_info(mci, &stat, event);
+
+	priv->xsem_rtca->cram_ce_cnt += stat.ce_cnt;
+	priv->xsem_rtca->cram_ue_cnt += stat.ue_cnt;
+	xsem_handle_error(mci, &stat);
+}
+
+static DEVICE_ATTR_RW(xsem_scan_control);
+static DEVICE_ATTR_RW(xsem_cram_injecterr);
+static DEVICE_ATTR_RW(xsem_cram_framecc_read);
+static DEVICE_ATTR_RW(xsem_cram_ssit_getcrc);
+static DEVICE_ATTR_RW(xsem_read_status);
+static DEVICE_ATTR_RW(xsem_read_ssit_status);
+static DEVICE_ATTR_RW(xsem_total_cframes_ssit);
+static DEVICE_ATTR_RW(xsem_read_config);
+
+static struct attribute *xsem_edac_sysfs_attrs[] = {
+	&dev_attr_xsem_scan_control.attr,
+	&dev_attr_xsem_cram_injecterr.attr,
+	&dev_attr_xsem_cram_framecc_read.attr,
+	&dev_attr_xsem_cram_ssit_getcrc.attr,
+	&dev_attr_xsem_read_status.attr,
+	&dev_attr_xsem_read_ssit_status.attr,
+	&dev_attr_xsem_total_cframes_ssit.attr,
+	&dev_attr_xsem_read_config.attr,
+	NULL,
+};
+
+static const struct attribute_group xsem_edac_sysfs_attr_group = {
+	.attrs = xsem_edac_sysfs_attrs,
+};
+
+static int xsem_edac_create_sysfs_attributes(struct mem_ctl_info *mci)
+{
+	return sysfs_create_group(&mci->dev.kobj, &xsem_edac_sysfs_attr_group);
+}
+
+static void xsem_edac_remove_sysfs_attributes(struct mem_ctl_info *mci)
+{
+	sysfs_remove_group(&mci->dev.kobj, &xsem_edac_sysfs_attr_group);
+}
+
 static int mc_probe(struct platform_device *pdev)
 {
-	void __iomem *ddrmc_baseaddr, *ddrmc_noc_baseaddr;
+	void __iomem *ddrmc_baseaddr, *ddrmc_noc_baseaddr, *sem_baseaddr;
 	struct edac_mc_layer layers[2];
 	struct mem_ctl_info *mci;
 	u8 num_chans, num_csrows;
 	struct edac_priv *priv;
 	u32 edac_mc_id, regval;
+	u32 family_code;
 	int rc;
 
 	ddrmc_baseaddr = devm_platform_ioremap_resource_byname(pdev, "base");
@@ -1094,6 +2365,10 @@ static int mc_probe(struct platform_device *pdev)
 	if (!get_ecc_state(ddrmc_baseaddr))
 		return -ENXIO;
 
+	sem_baseaddr = devm_platform_ioremap_resource_byname(pdev, "semrtca");
+	if (IS_ERR(sem_baseaddr))
+		return PTR_ERR(sem_baseaddr);
+
 	/* Allocate ID number for the EMIF controller */
 	edac_mc_id = emif_get_id(pdev->dev.of_node);
 
@@ -1124,9 +2399,29 @@ static int mc_probe(struct platform_device *pdev)
 	priv = mci->pvt_info;
 	priv->ddrmc_baseaddr = ddrmc_baseaddr;
 	priv->ddrmc_noc_baseaddr = ddrmc_noc_baseaddr;
+	priv->sem_baseaddr = sem_baseaddr;
 	priv->ce_cnt = 0;
 	priv->ue_cnt = 0;
 	priv->mc_id = edac_mc_id;
+	priv->xsem_rtca = NULL;
+
+	/* Allocate and initialize XilSem RTCA structure */
+	priv->xsem_rtca = devm_kzalloc(&pdev->dev,
+				       sizeof(struct xsem_rtca_priv),
+				       GFP_KERNEL);
+	if (!priv->xsem_rtca) {
+		edac_printk(KERN_ERR, EDAC_MC,
+			    "Failed to allocate xsem_rtca\n");
+		rc = -ENOMEM;
+		goto free_edac_mc;
+	}
+
+	priv->xsem_rtca->slr_info = devm_kzalloc(&pdev->dev, sizeof(struct xsem_ssit_status),
+						 GFP_KERNEL);
+	if (!priv->xsem_rtca->slr_info) {
+		rc = -ENOMEM;
+		goto free_edac_mc;
+	}
 
 	mc_init(mci, pdev);
 
@@ -1147,6 +2442,41 @@ static int mc_probe(struct platform_device *pdev)
 		goto del_mc;
 	}
 
+	/* Create XilSem sysfs attributes only if XilSem is available */
+	rc = xsem_edac_create_sysfs_attributes(mci);
+	if (rc) {
+		edac_printk(KERN_ERR, EDAC_MC,
+			    "Failed to create sysfs entries\n");
+		goto remove_sysfs;
+	}
+
+	/*
+	 * Firmware driver returns -ENODEV if it is not probed. In this case
+	 * defer XilSEM error event registration.
+	 */
+	rc = zynqmp_pm_get_family_info(&family_code);
+	if (rc) {
+		if (rc == -ENODEV)
+			rc = -EPROBE_DEFER;
+
+		goto del_mc;
+	}
+	if (family_code == PM_VERSAL_FAMILY_CODE) {
+		priv->xsem_rtca->sw_event_node_id = VERSAL_EVENT_ERROR_SW_ERR;
+		priv->xsem_rtca->cram_ce_mask = XPM_VERSAL_EVENT_ERROR_MASK_XSEM_CRAM_CE_5;
+		priv->xsem_rtca->cram_ue_mask = XPM_VERSAL_EVENT_ERROR_MASK_XSEM_CRAM_UE_6;
+		priv->xsem_rtca->npi_ue_mask = XPM_VERSAL_EVENT_ERROR_MASK_XSEM_NPI_UE_7;
+	} else {
+		edac_printk(KERN_ERR, EDAC_MC, "Invalid Device family code %d\n", family_code);
+	}
+
+	rc = xlnx_register_event(PM_NOTIFY_CB, priv->xsem_rtca->sw_event_node_id,
+				 priv->xsem_rtca->cram_ce_mask | priv->xsem_rtca->cram_ue_mask |
+				 priv->xsem_rtca->npi_ue_mask,
+				 false, xsem_err_callback, mci);
+	if (rc)
+		goto del_mc;
+
 #ifdef CONFIG_EDAC_DEBUG
 	create_debugfs_attributes(mci);
 	setup_address_map(priv);
@@ -1154,6 +2484,8 @@ static int mc_probe(struct platform_device *pdev)
 	enable_intr(priv);
 	return rc;
 
+remove_sysfs:
+	xsem_edac_remove_sysfs_attributes(mci);
 del_mc:
 	edac_mc_del_mc(&pdev->dev);
 free_edac_mc:
@@ -1173,9 +2505,21 @@ static void mc_remove(struct platform_device *pdev)
 	debugfs_remove_recursive(priv->debugfs);
 #endif
 
+	/* Unregister XilSem events if they were registered */
+	if (priv->xsem_rtca) {
+		xlnx_unregister_event(PM_NOTIFY_CB, priv->xsem_rtca->sw_event_node_id,
+				      priv->xsem_rtca->cram_ce_mask |
+					  priv->xsem_rtca->cram_ue_mask |
+					  priv->xsem_rtca->npi_ue_mask,
+				      xsem_err_callback, mci);
+	}
 	xlnx_unregister_event(PM_NOTIFY_CB, VERSAL_EVENT_ERROR_PMC_ERR1,
 			      XPM_EVENT_ERROR_MASK_DDRMC_CR |
 			      XPM_EVENT_ERROR_MASK_DDRMC_NCR, err_callback, mci);
+	/* Remove XilSem sysfs attributes if they were created */
+	if (priv->xsem_rtca)
+		xsem_edac_remove_sysfs_attributes(mci);
+
 	edac_mc_del_mc(&pdev->dev);
 	edac_mc_free(mci);
 }
-- 
2.23.0

Re: [PATCH v3 2/4] Documentation: ABI: Add ABI doc for versal edac sysfs

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [Medium] The sysfs entries implement a stateful RPC command-response interface, causing data races.
- [Medium] Multiple sysfs attributes output complex, multiline blocks instead of single values.
- [Low] Malformed ABI Documentation Syntax.
- [Low] Duplicate and conflicting entries in ABI Documentation.
--

commit 9760cee2db24f4eb5850706de75cd24db0ae078c
Author: Rama devi Veggalam <rama.devi.veggalam@amd.com>

Documentation: ABI: Add ABI doc for versal edac sysfs

Add documentation for the sysfs entries created for
versal edac (XilSEM).

> diff --git a/Documentation/ABI/testing/sysfs-driver-versal-edac b/Documentation/ABI/testing/sysfs-driver-versal-edac
> new file mode 100644
> index 0000000000000..c35d864fcbe2c
> --- /dev/null
> +++ b/Documentation/ABI/testing/sysfs-driver-versal-edac
> @@ -0,0 +1,303 @@
> +What:		/sys/devices/system/edac/versal_xilsem/xsem_scan_control
> +Date:		What:		/sys/devices/system/edac/mc/mc0/xsem_scan_control
> +Date:		June 2026

[Severity: Low]
Is there malformed syntax in this documentation block? The second line has a 
duplicate "What:" definition inside the "Date:" field.

> +Contact:	rama.devi.veggalam@amd.com
> +Description:
> +		It is a read/write file.
> +		Writing to this file causes the software to initiate a
> +		request to the firmware for doing requested scan operation in
> +		Configuration RAM (CRAM) or NPI of Versal mono/SSIT devices.
> +		User needs to provide scan operation id (init, start, stop) and
> +		SLR id (Versal SSIT device) details. For Versal mono devices,
> +		the SLR id should be 0.
> +		The scan operation id values are as given below:
> +		1 - Initialize the scan
> +		2 - Start CRAM scan
> +		3 - Stop CRAM scan
> +		5 - Start NPI scan
> +		6 - Stop NPI scan
> +		7 - Inject NPI error in first descriptor
> +
> +		When read, it shows the current scan status with error code.

[Severity: Medium]
Could this stateful command-response interface introduce data races?

In drivers/edac/versal_edac.c, xsem_scan_control_store() writes the command
result directly to the shared, lockless array:

    ret = zynqmp_pm_xilsem_cntrl_ops(cmd, slrid, priv->xsem_rtca->scan_ctrl_status);

Then xsem_scan_control_show() reads from it:

    return sprintf(data, "[0x%x][0x%x][0x%x][0x%x][0x%x][0x%x][0x%x]\n\r",
                   priv->xsem_rtca->scan_ctrl_status[0],

Will concurrent writes to xsem_scan_control clobber the shared buffers
in priv->xsem_rtca->scan_ctrl_status before either process reads the
attribute, leading to incorrect results?

[ ... ]

> +What:		/sys/devices/system/edac/mc/mc0/xsem_read_ssit_status
> +Date:		June 2026
> +Contact:	rama.devi.veggalam@amd.com
> +Description:
> +		It is a read/write file.
> +		Writing to this file causes the software to initiate a
> +		request to read CRAM and NPI scan status information in a given SLR.
> +		User needs to provide SLR id in Versal SSIT device for which
> +		XilSEM status to be read. When read, it shows
> +		the XilSEM status of the requested SLR.
> +		The format is: <Header> <SLR id> <NPI status info> <CRAM status info>
> +		Example: Read SLR Status Cmd:[0x1030d]
> +		SLR ID:[0x3]
> +		NPI status:[0xa01]

[Severity: Medium]
Will this sysfs attribute violate the single-value-per-file guideline?

Looking at xsem_read_ssit_status_show() in drivers/edac/versal_edac.c, it
generates a multiline block instead of a single value:

    offset += sprintf(data + offset, "Read SLR Status Cmd:[0x%x]\n\r",
                      priv->xsem_rtca->xilsem_ssit_status[0]);
    offset += sprintf(data + offset, "SLR ID:[0x%x]\n\r",
                      priv->xsem_rtca->xilsem_ssit_status[1]);
    offset += sprintf(data + offset, "NPI status:[0x%x]\n\r",

Does this complex multiline output break standard userspace tools that
parse sysfs?

[ ... ]

> +What:		/sys/devices/system/edac/versal_xilsem/xsem_cram_injecterr
> +Date:		July 2025
> +Contact:	rama.devi.veggalam@amd.com

[Severity: Low]
Are there duplicate and conflicting entries in the documentation?

The path /sys/devices/system/edac/versal_xilsem/xsem_cram_injecterr 
listed here appears to conflict with the /sys/devices/system/edac/mc/mc0/ 
path documented earlier for the same attribute.

> +Description:
> +		It is a read/write file.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260624212545.2850787-1-rama.devi.veggalam@amd.com?part=2

Re: [PATCH v3 1/4] dt-bindings: edac: Add bindings for Xilinx Versal XilSEM

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [Critical] Adding a third mandatory item to `reg` and `reg-names` breaks backward compatibility for existing device trees, causing schema validation and driver probe failures.
- [Medium] Unrelated XilSEM hardware registers are incorrectly merged into the DDR Memory Controller (`xlnx,versal-ddrmc`) device tree node, violating DT design principles.
--

commit 4759b2e3e1d7757d4a16075824d7a25fd86d0c73
Author: Rama devi Veggalam <rama.devi.veggalam@amd.com>

dt-bindings: edac: Add bindings for Xilinx Versal XilSEM

Update versal edac device tree bindings for Versal Soft Error Mitigation
(XilSEM).

> diff --git a/Documentation/devicetree/bindings/memory-controllers/xlnx,versal-ddrmc-edac.yaml b/Documentation/devicetree/bindings/memory-controllers/xlnx,versal-ddrmc-edac.yaml
> index 12f8e9f350bcf..568d2af7de81a 100644
> --- a/Documentation/devicetree/bindings/memory-controllers/xlnx,versal-ddrmc-edac.yaml
> +++ b/Documentation/devicetree/bindings/memory-controllers/xlnx,versal-ddrmc-edac.yaml
[ ... ]
> @@ -23,11 +37,13 @@ properties:
>      items:
>        - description: DDR Memory Controller registers
>        - description: NOC registers corresponding to DDR Memory Controller
> +      - description: SEM RTCA Controller registers

[Severity: Medium]
Is it correct to merge unrelated XilSEM hardware registers into the DDR Memory
Controller device tree node?

The device tree describes an inaccurate hardware topology by grouping physically
separate register bases under a single compatible string simply because a single
EDAC driver handles both. Should XilSEM be represented by its own distinct
device tree node?

[Severity: Critical]
Does adding this new required register break backward compatibility with older
device trees?

Because this adds a third mandatory item to the list without specifying
minItems: 2, older device trees lacking the "semrtca" register will fail
schema validation.

Additionally, does the driver unconditionally require this new register in
mc_probe(), causing probes to fail on existing systems? If the driver code
looks for the new register:

drivers/edac/versal_edac.c:mc_probe() {
    ...
    sem_baseaddr = devm_platform_ioremap_resource_byname(pdev, "semrtca");
    if (IS_ERR(sem_baseaddr))
        return PTR_ERR(sem_baseaddr);
    ...
}

This will return an error when the DT node lacks the semrtca register, leading
to immediate probe failure on existing setups.

>  
>    reg-names:
>      items:
>        - const: base
>        - const: noc
> +      - const: semrtca

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260624212545.2850787-1-rama.devi.veggalam@amd.com?part=1

Re: [PATCH v3 4/4] edac: xilinx: Add EDAC support for Versal XilSem

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 13 potential issue(s) to consider:
- [Critical] Passing a 64-bit `dma_addr_t` to a 32-bit firmware API parameter truncates the physical address, causing memory corruption.
- [High] Missing 'semrtca' resource breaks driver probe for older Device Trees.
- [High] The sysfs `store` functions use the virtual EDAC device for DMA allocations instead of the platform device.
- [High] Error paths introduced in `mc_probe` fail to unregister the `VERSAL_EVENT_ERROR_PMC_ERR1` PM notifier, causing a Use-After-Free.
- [High] The error event handler uses an `if - else if` chain for bitmask evaluation, silently dropping uncorrectable errors.
- [Medium] Hexadecimal prefixes mistakenly used for decimal bit-shift macros cause undefined behavior and break CRAM frame decoding.
- [Medium] The `xsem_total_cframes_ssit_show` function mutates the driver's cached CRAM frames state in-place, corrupting data on subsequent reads.
- [Medium] Sysfs `store` functions unconditionally truncate the last character of user input if it is not newline-terminated.
- [Medium] XilSEM fabric and interconnect errors are incorrectly attributed to DDR memory DIMM 0.
- [Medium] Failure to handle an unrecognized `family_code` causes the driver to register an event with uninitialized parameters.
- [Medium] Lack of synchronization in sysfs callbacks causes data races on shared buffers.
- [Medium] The `xsem_err_callback` event handler performs unprotected read-modify-write operations on shared error counters.
- [Low] Copy-paste error in `xsem_scan_control_show` format string causes incorrect output.
--

commit 3ba94d35140e37f0feb1403bd80442cef2ad8ed1
Author: Rama devi Veggalam <rama.devi.veggalam@amd.com>
Subject: edac: xilinx: Add EDAC support for Versal XilSem

This patch adds support for Xilinx Versal Soft Error Mitigation (XilSEM)
to handle and optionally correct soft errors in Configuration Memory.
It also introduces sysfs interfaces for XilSEM scan operations, error
injection, and configuration reads.

> diff --git a/drivers/edac/versal_edac.c b/drivers/edac/versal_edac.c
> index 5a43b5d43ca28..024ddd90f6996 100644
> --- a/drivers/edac/versal_edac.c
> +++ b/drivers/edac/versal_edac.c
[ ... ]
> @@ -11,12 +11,88 @@
>  #include <linux/of_address.h>
>  #include <linux/of_device.h>
>  #include <linux/platform_device.h>
> +#include <linux/dma-mapping.h>
>  #include <linux/sizes.h>
> +#include <linux/io.h>
>  #include <linux/firmware/xlnx-zynqmp.h>
> +#include <linux/firmware/xlnx-versal-error-events.h>
>  #include <linux/firmware/xlnx-event-manager.h>
>  
>  #include "edac_module.h"
>  
> +/* XilSem CE Error log count */
> +#define XILSEM_MAX_CE_LOG_CNT	7
> +
> +/** Maximum CRAM error register count */
> +#define MAX_CRAMERR_REG_CNT		14
> +/** Maximum NPI slave skip count */
> +#define MAX_NPI_SLV_SKIP_CNT	8
> +/** Maximum NPI Error info count */
> +#define MAX_NPI_ERR_INFO_CNT	2
> +
> +/* Maximum SLR count */
> +#define MAX_SLR_ID	3
> +
> +/** Maximum number of cframe types  */
> +#define CFRAME_MAX_TYPE	7
> +
> +/** Mask for getting Type_0, Type_4 frames */
> +#define CFRAME_TYPE_0_4_MASK	GENMASK(19, 0)
> +
> +/** Low mask, High mask for getting Type_1, Type_5 frames */
> +#define CFRAME_TYPE_1_5_MASK_L	GENMASK(39, 20)
> +#define CFRAME_TYPE_1_5_MASK_H	GENMASK(7, 0)
> +
> +/** Shift for getting Type_1, Type_5 frames */
> +#define CFRAME_TYPE_1_5_SHIFT_R		0x20
> +#define CFRAME_TYPE_1_5_SHIFT_L		0x12
> +
> +/** Mask for getting Type_2, Type_6 frames */
> +#define CFRAME_TYPE_2_6_MASK	GENMASK(27, 8)
> +
> +/** Shift for getting Type_2, Type_6 frames */
> +#define CFRAME_TYPE_2_6_SHIFT_R		0x8
> +
> +/** Low mask, high mask for getting Type_3 frames */
> +#define CFRAME_TYPE_3_MASK_L		GENMASK(31, 28)
> +#define CFRAME_TYPE_3_MASK_H		GENMASK(15, 0)
> +
> +/** Shift for getting Type_3 */
> +#define CFRAME_TYPE_3_SHIFT_R	0x28

[Severity: Medium]
Are these macro definitions incorrectly using a hex prefix for decimal shift
values? Shifting a 32-bit value by 0x20 (32) or 0x28 (40) bits will invoke
undefined behavior.

> +#define CFRAME_TYPE_3_SHIFT_L	0x4
[ ... ]
> +static ssize_t xsem_scan_control_show(struct device *dev,
> +				      struct device_attribute *mattr,
> +				      char *data)
> +{
> +	struct mem_ctl_info *mci = to_mci(dev);
> +	struct edac_priv *priv = mci->pvt_info;
> +
> +	if (!priv->xsem_rtca)
> +		return -EINVAL;
> +
> +	return sprintf(data, "[0x%x][0x%x][0x%x][0x%x][0x%x][0x%x][0x%x]\n\r",
> +			priv->xsem_rtca->scan_ctrl_status[0],
> +			priv->xsem_rtca->scan_ctrl_status[0],

[Severity: Low]
Is there a typo here where scan_ctrl_status[0] is printed twice, causing the
output to miss the last element of the array?

> +			priv->xsem_rtca->scan_ctrl_status[1],
> +			priv->xsem_rtca->scan_ctrl_status[2],
> +			priv->xsem_rtca->scan_ctrl_status[3],
> +			priv->xsem_rtca->scan_ctrl_status[4],
> +			priv->xsem_rtca->scan_ctrl_status[5]);
> +}
> +
> +/**
> + * xsem_scan_control_store - Set scan control operation
[ ... ]
> +static ssize_t xsem_scan_control_store(struct device *dev,
> +				       struct device_attribute *mattr,
> +				       const char *data, size_t count)
> +{
> +	struct mem_ctl_info *mci = to_mci(dev);
> +	struct edac_priv *priv = mci->pvt_info;
> +	char *kern_buff, *inbuf, *tok;
> +	u32 cmd;
> +	u32 slrid;
> +	int ret;
> +
> +	if (!priv->xsem_rtca)
> +		return -EINVAL;
> +
> +	kern_buff = kzalloc(count, GFP_KERNEL);
> +	if (!kern_buff)
> +		return -ENOMEM;
> +	strscpy(kern_buff, data, count);

[Severity: Medium]
Does this silently truncate the last character of the user input if it is not
newline-terminated? When count matches the string length exactly, strscpy()
copies at most count - 1 bytes and inserts a null terminator.

> +
> +	inbuf = kern_buff;
[ ... ]
> +static ssize_t xsem_total_cframes_ssit_show(struct device *dev,
> +					    struct device_attribute *mattr,
> +					    char *data)
> +{
> +	struct mem_ctl_info *mci = to_mci(dev);
> +	struct edac_priv *priv = mci->pvt_info;
> +	u32 temp_buf[CFRAME_MAX_TYPE] = {0};
> +	u32 id;
> +	int offset = 0;
> +
> +	if (!priv->xsem_rtca)
> +		return -EINVAL;
> +
> +	for (id = 0; id < CFRAME_MAX_TYPE; id++)
> +		temp_buf[id] = priv->xsem_rtca->cram_total_frames[id];
> +
> +	priv->xsem_rtca->cram_total_frames[0]  = (temp_buf[0] & CFRAME_TYPE_0_4_MASK);
> +	priv->xsem_rtca->cram_total_frames[1]  = (temp_buf[0] &
> +					CFRAME_TYPE_1_5_MASK_L) >> CFRAME_TYPE_1_5_SHIFT_R;

[Severity: Medium]
Does this modify the shared cram_total_frames array in-place during a read
operation? Subsequent reads might apply the bitwise shifts to already-shifted
data, returning garbled output.

> +	priv->xsem_rtca->cram_total_frames[1] |= (temp_buf[1] &
[ ... ]
> +static ssize_t xsem_total_cframes_ssit_store(struct device *dev,
> +					     struct device_attribute *mattr,
> +					     const char *data, size_t count)
> +{
> +	struct mem_ctl_info *mci = to_mci(dev);
> +	struct edac_priv *priv = mci->pvt_info;
> +	char *kern_buff, *inbuf, *tok, *kbuf1;
> +	dma_addr_t dma_addr = 0;
> +	u32 row, slrid, dma_size;
> +	int ret;
[ ... ]
> +	dma_size = sizeof(priv->xsem_rtca->cram_total_frames);
> +	kbuf1 = dma_alloc_coherent(dev, dma_size, &dma_addr, GFP_KERNEL);

[Severity: High]
Are we passing the virtual EDAC device pointer instead of the platform device
here? Sysfs store callbacks for this attribute receive &mci->dev, which lacks
DMA configuration and could cause allocation failures.

> +	if (!kbuf1) {
> +		ret = -ENOMEM;
> +		goto err;
> +	}
> +
> +	ret = zynqmp_pm_xilsem_cram_ssit_totframes(slrid, row, dma_addr,
> +						   priv->xsem_rtca->cram_get_frames_status);

[Severity: Critical]
Can this truncate the physical address and cause memory corruption? On ARM64,
dma_addr_t is 64-bit, but the firmware API parameters are 32-bit.

> +	if (ret) {
> +		edac_printk(KERN_ERR, EDAC_MC, "ERROR: XilSEM Status PM API failed\n");
> +		dma_free_coherent(dev, dma_size, kbuf1, dma_addr);
> +		goto err;
> +	}
> +
> +	memcpy(priv->xsem_rtca->cram_total_frames, kbuf1, dma_size);

[Severity: Medium]
Can concurrent sysfs store operations corrupt this shared buffer due to a lack
of locking?

> +	dma_free_coherent(dev, dma_size, kbuf1, dma_addr);
[ ... ]
> +static ssize_t xsem_read_ssit_status_store(struct device *dev,
> +					   struct device_attribute *mattr,
> +					   const char *data, size_t count)
> +{
> +	struct mem_ctl_info *mci = to_mci(dev);
> +	struct edac_priv *priv = mci->pvt_info;
> +	char *kern_buff, *inbuf, *tok, *kbuf1;
> +	size_t dma_size;
> +	dma_addr_t dma_addr = 0;
> +	u32 slrid;
> +	int ret;
[ ... ]
> +	dma_size  = sizeof(struct xsem_ssit_status);
> +
> +	kbuf1 = dma_alloc_coherent(dev, dma_size, &dma_addr, GFP_KERNEL);

[Severity: High]
Does passing the virtual EDAC device pointer (which lacks DMA configuration)
instead of the platform device cause DMA allocation failures?

> +	if (!kbuf1) {
> +		ret = -ENOMEM;
> +		goto err;
> +	}
> +
> +	ret = zynqmp_pm_xilsem_read_ssit_status(slrid, dma_addr,
> +						priv->xsem_rtca->xilsem_ssit_status);

[Severity: Critical]
Could passing the 64-bit dma_addr to this 32-bit firmware API parameter result
in physical address truncation and subsequent memory corruption?

> +	if (ret) {
> +		edac_printk(KERN_ERR, EDAC_MC, "ERROR: XilSEM Status PM API failed\n");
> +		dma_free_coherent(dev, dma_size, kbuf1, dma_addr);
> +		goto err;
> +	}
> +
> +	memcpy(priv->xsem_rtca->slr_info, kbuf1, dma_size);

[Severity: Medium]
Can concurrent executions of this sysfs store operation result in data races on
this shared slr_info buffer?

> +
> +	dma_free_coherent(dev, dma_size, kbuf1, dma_addr);
[ ... ]
> +static void xsem_geterror_info(struct mem_ctl_info *mci, struct xsem_error_status *p,
> +			       int mask)
> +{
> +	struct edac_priv *priv = mci->pvt_info;
> +	u32 error_word_0, error_word_1, ce_count;
> +	u8 index;
> +
> +	if (!priv->xsem_rtca || !priv->sem_baseaddr)
> +		return;
> +
> +	if (mask & priv->xsem_rtca->cram_ce_mask) {
> +		p->ce_cnt++;
[ ... ]
> +		/* Read CRAM status */
> +		p->ceinfo.status = readl(priv->sem_baseaddr + CRAM_STS_INFO_OFFSET);
> +	} else if (mask & priv->xsem_rtca->cram_ue_mask) {

[Severity: High]
Does this if-else chain cause uncorrectable errors to be silently ignored if
the payload mask contains both a correctable and uncorrectable error?

> +		p->ue_cnt++;
> +		p->ueinfo.data0 = 0;
> +		p->ueinfo.data1 = 0;
> +		p->ueinfo.status = readl(priv->sem_baseaddr + CRAM_STS_INFO_OFFSET);
> +	} else if (mask & priv->xsem_rtca->npi_ue_mask) {
> +		p->ue_cnt++;
> +		p->ueinfo.data0 = readl(priv->sem_baseaddr + NPI_ERR0_INFO_OFFSET);
> +		p->ueinfo.data1 = readl(priv->sem_baseaddr + NPI_ERR1_INFO_OFFSET);
> +		p->ueinfo.status = readl(priv->sem_baseaddr);
> +	} else {
> +		edac_printk(KERN_ERR, EDAC_MC, "Invalid Event received %d\n", mask);
> +	}
> +}
> +
> +/**
> + * xsem_handle_error - Handle XilSem error types CE and UE
> + * @mci:	Pointer to the memory controller instance
> + * @p:		Pointer to the xilsem error status structure
> + *
> + * Handles the correctable and uncorrectable error.
> + */
> +static void xsem_handle_error(struct mem_ctl_info *mci, struct xsem_error_status *p)
> +{
> +	struct xsem_ecc_error_info *pinf;
> +	char message[XDDR_EDAC_MSG_SIZE];
> +
> +	if (p->ce_cnt) {
> +		pinf = &p->ceinfo;
> +		snprintf(message, XDDR_EDAC_MSG_SIZE,
> +			 "\n\rXILSEM CRAM error type :%s\n\r"
> +			 "\nFrame_Addr: [0x%X]\t Row_num: [0x%X]\t Bit_loc: [0x%X]\t Qword: [0x%X]\n\r",
> +			 "CE", pinf->frame_addr, pinf->row_id,
> +			 pinf->bit_loc, pinf->qword);
> +
> +		edac_mc_handle_error(HW_EVENT_ERR_CORRECTED, mci,
> +				     p->ce_cnt, 0, 0, 0, 0, 0, -1,
> +				     message, "");

[Severity: Medium]
Are these fabric and interconnect errors being incorrectly attributed to the
first DDR memory module? Passing top_layer=0 and mid_layer=0 explicitly maps
them to csrow 0, channel 0.

> +	}
> +
> +	if (p->ue_cnt) {
> +		pinf = &p->ueinfo;
> +		snprintf(message, XDDR_EDAC_MSG_SIZE,
> +			 "\n\rXILSEM error type :%s\n\r"
> +			 "status: [0x%X]\n\rError_Info0: [0x%X]\n\r"
> +			 "Error_Info1: [0x%X]",
> +			 "UE", pinf->status, pinf->data0, pinf->data1);
> +
> +		edac_mc_handle_error(HW_EVENT_ERR_UNCORRECTED, mci,
> +				     p->ue_cnt, 0, 0, 0, 0, 0, -1,
> +				     message, "");

[Severity: Medium]
Does mapping uncorrectable XilSEM errors to top_layer=0 incorrectly attribute
them to the first DDR memory DIMM?

> +	}
> +}
> +
> +/**
> + * xsem_err_callback - Handle Correctable and Uncorrectable errors.
> + * @payload:	payload data.
> + * @data:	controller data.
> + *
> + * Handles ECC correctable and uncorrectable errors.
> + */
> +static void xsem_err_callback(const u32 *payload, void *data)
> +{
> +	struct xsem_error_status stat;
> +	struct edac_priv *priv;
> +	struct mem_ctl_info *mci = (struct mem_ctl_info *)data;
> +	int event;
> +
> +	priv = mci->pvt_info;
> +	if (!priv->xsem_rtca)
> +		return;
> +
> +	memset(&stat, 0, sizeof(stat));
> +	/* Read payload to get the event type */
> +	event = payload[2];
> +	edac_printk(KERN_INFO, EDAC_MC, "Event received %x\n", event);
> +	xsem_geterror_info(mci, &stat, event);
> +
> +	priv->xsem_rtca->cram_ce_cnt += stat.ce_cnt;
> +	priv->xsem_rtca->cram_ue_cnt += stat.ue_cnt;

[Severity: Medium]
Could these read-modify-write operations on shared counters lose increments if
the hardware event callback is executed concurrently on multiple CPUs?

> +	xsem_handle_error(mci, &stat);
> +}
[ ... ]
> @@ -1094,6 +2365,10 @@ static int mc_probe(struct platform_device *pdev)
>  	if (!get_ecc_state(ddrmc_baseaddr))
>  		return -ENXIO;
>  
> +	sem_baseaddr = devm_platform_ioremap_resource_byname(pdev, "semrtca");
> +	if (IS_ERR(sem_baseaddr))
> +		return PTR_ERR(sem_baseaddr);

[Severity: High]
Does this make the "semrtca" resource mandatory, breaking the driver probe for
older device trees that do not define it?

> +
>  	/* Allocate ID number for the EMIF controller */
>  	edac_mc_id = emif_get_id(pdev->dev.of_node);
>  
[ ... ]
> +	rc = zynqmp_pm_get_family_info(&family_code);
> +	if (rc) {
> +		if (rc == -ENODEV)
> +			rc = -EPROBE_DEFER;
> +
> +		goto del_mc;
> +	}
> +	if (family_code == PM_VERSAL_FAMILY_CODE) {
> +		priv->xsem_rtca->sw_event_node_id = VERSAL_EVENT_ERROR_SW_ERR;
> +		priv->xsem_rtca->cram_ce_mask = XPM_VERSAL_EVENT_ERROR_MASK_XSEM_CRAM_CE_5;
> +		priv->xsem_rtca->cram_ue_mask = XPM_VERSAL_EVENT_ERROR_MASK_XSEM_CRAM_UE_6;
> +		priv->xsem_rtca->npi_ue_mask = XPM_VERSAL_EVENT_ERROR_MASK_XSEM_NPI_UE_7;
> +	} else {
> +		edac_printk(KERN_ERR, EDAC_MC, "Invalid Device family code %d\n", family_code);
> +	}
> +
> +	rc = xlnx_register_event(PM_NOTIFY_CB, priv->xsem_rtca->sw_event_node_id,

[Severity: Medium]
Does this execution path fall through when the family code is unrecognized,
causing the driver to register an event using uninitialized parameters (zeros)?

> +				 priv->xsem_rtca->cram_ce_mask | priv->xsem_rtca->cram_ue_mask |
> +				 priv->xsem_rtca->npi_ue_mask,
> +				 false, xsem_err_callback, mci);
> +	if (rc)
> +		goto del_mc;
> +
>  #ifdef CONFIG_EDAC_DEBUG
>  	create_debugfs_attributes(mci);
>  	setup_address_map(priv);
> @@ -1154,6 +2484,8 @@ static int mc_probe(struct platform_device *pdev)
>  	enable_intr(priv);
>  	return rc;
>  
> +remove_sysfs:
> +	xsem_edac_remove_sysfs_attributes(mci);
>  del_mc:
>  	edac_mc_del_mc(&pdev->dev);
>  free_edac_mc:
> @@ -1173,9 +2505,21 @@ static void mc_remove(struct platform_device *pdev)

[Severity: High]
Does this error path fail to unregister the VERSAL_EVENT_ERROR_PMC_ERR1 event
that was registered earlier in the function? If the event triggers after mci is
freed, could it cause a use-after-free in the callback?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260624212545.2850787-1-rama.devi.veggalam@amd.com?part=4

Re: [PATCH v3 3/4] firmware: xilinx: Add support for Xilsem scan operations

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:

New issues:
- [High] Uninitialized memory use and potential information leak via uninitialized stack buffer.
- [Medium] Potential address truncation and misleading parameter type for DMA addresses.
- [Low] API contract mismatch and typo in Kernel-Doc.

Pre-existing issues:
- [High] Lockless concurrent modification of global hashtable and arrays causing data races and UAF.
--

commit e939c99be4b47a8ba5e7ed4d9aaf024781ae5543
Author: Rama devi Veggalam <rama.devi.veggalam@amd.com>

firmware: xilinx: Add support for Xilsem scan operations

Add the ATF EEMI call support for Xilsem scan operations.
Initialize, start, stop scan, error inject, read configuration,
status and register for software error events.

Add macros for XilSem correctable and uncorrectable error events.

> diff --git a/drivers/firmware/xilinx/zynqmp-sem.c b/drivers/firmware/xilinx/zynqmp-sem.c
> new file mode 100644
> index 0000000000000..5cd399b165f55
> --- /dev/null
> +++ b/drivers/firmware/xilinx/zynqmp-sem.c
> @@ -0,0 +1,176 @@
> +// SPDX-License-Identifier: GPL-2.0
> +/*
> + * Firmware layer for XilSEM APIs.
> + *
> + * Copyright (C), 2026 Advanced Micro Devices, Inc.
> + */

[ ... ]

> +/**
> + * zynqmp_pm_xilsem_cntrl_ops - PM call to perform XilSEM operations
> + * @cmd:	Command for XilSEM scan control operations
> + * @slrid:	SLR id on which scan operation to be done
> + * @response:	Output response (command header, error code or status, slr id)

[Severity: Low]
Does the documentation accurately reflect the response size? The documentation
specifies 3 elements, but the function below writes 6 elements to the array.
Could this lead future callers to allocate undersized stack arrays?

> + *
> + * Return: Returns 0 on success or error value on failure.
> + */
> +int zynqmp_pm_xilsem_cntrl_ops(u32 cmd, u32 slrid, u32 *const response)
> +{
> +	u32 ret_buf[PAYLOAD_ARG_CNT];
> +	int ret;
> +
> +	ret = zynqmp_pm_invoke_fn(PM_XSEM_HEADER | cmd, ret_buf, 1, slrid);

[Severity: High]
This is a pre-existing issue, but can multiple concurrent drivers calling into
zynqmp_pm_invoke_fn() cause race conditions or use-after-free?

Looking at zynqmp_pm_invoke_fn(), it calls zynqmp_pm_feature() which leads
to lockless hash table insertions into pm_api_features_map:

zynqmp_pm_invoke_fn()
  zynqmp_pm_feature()
    do_feature_check_call()
      hash_add(pm_api_features_map, &feature_data->hentry, api_id);

Since hlist_add_head() is not thread-safe, could concurrent insertions
corrupt the hash bucket's linked list?

Additionally, zynqmp_firmware_remove() frees these hashtable entries
locklessly, which could expose concurrent callers to use-after-free.

> +	response[0] = ret_buf[1];

[Severity: High]
Does this code copy uninitialized memory to response if zynqmp_pm_invoke_fn()
returns an error?

If zynqmp_pm_invoke_fn() fails early (for example, if zynqmp_pm_feature()
returns -EOPNOTSUPP), it returns without writing to ret_buf. The values
from ret_buf are then unconditionally copied into the response array.
Could this lead to reading uninitialized kernel stack memory?

> +	response[1] = ret_buf[2];
> +	response[2] = ret_buf[3];
> +	response[3] = ret_buf[4];
> +	response[4] = ret_buf[5];
> +	response[5] = ret_buf[6];
> +
> +	return ret;
> +}
> +EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_cntrl_ops);

[ ... ]

> +/**
> + * zynqmp_pm_xilsem_read_ssit_status - PM call to perform Xilsem SSIT status
> + * @slrid:	SLR id for which ECC read to be done
> + * @bufaddr:	Buffer address to get the status information
> + * @response:	Output response (status read header, slr id)
> + *
> + * Return: Returns 0 on success or error value on failure.
> + */
> +int zynqmp_pm_xilsem_read_ssit_status(u32 slrid, u32 bufaddr, u32 *const response)
                                                          ^^^^^^^
[Severity: Medium]
Can this parameter cause address truncation? The EDAC driver may allocate a
coherent DMA buffer typed as dma_addr_t and pass it to bufaddr. Since
bufaddr is typed as u32, this could truncate a 64-bit DMA address to 32
bits, causing the firmware to write to an incorrect physical address.

> +{
> +	u32 ret_buf[PAYLOAD_ARG_CNT];
> +	int ret;
> +
> +	ret = zynqmp_pm_invoke_fn(PM_XSEM_SSIT_RD_STS, ret_buf, 2, slrid, bufaddr);
> +	response[0] = ret_buf[1];
> +	response[1] = ret_buf[2];
> +
> +	return ret;
> +}
> +EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_read_ssit_status);

[ ... ]

> +/**
> + * zynqmp_pm_xilsem_cram_getcrc - PM call to perform CRAM Row CRC read
> + * @slrid:	SLR id for which CRC read to be done
> + * @rowindex:	CFRAME row number to be used for reading CRC
> + * @response:	Output response (Get CRC header, CRC values, status)
> + *
> + * Return: Returns 0 on success or error value on failure.
> + */
> +int zynqmp_pm_xilsem_cram_getcrc(u32 slrid, u32 rowindex, u32 *const response)
> +{
> +	u32 ret_buf[PAYLOAD_ARG_CNT];
> +	int ret;
> +
> +	ret = zynqmp_pm_invoke_fn(PM_XSEM_SSIT_GET_CRC, ret_buf, 2, slrid, rowindex);
> +	response[0] = ret_buf[1];

[Severity: High]
Does this code also copy uninitialized memory to response if
zynqmp_pm_invoke_fn() returns an error? If it fails early, ret_buf is
not written to, resulting in uninitialized kernel stack memory being
read and copied unconditionally.

> +	response[1] = ret_buf[2];
> +	response[2] = ret_buf[3];
> +	response[3] = ret_buf[4];
> +	response[4] = ret_buf[5];
> +	response[5] = ret_buf[6];
> +
> +	return ret;
> +}
> +EXPORT_SYMBOL_GPL(zynqmp_pm_xilsem_cram_getcrc);
> +
> +/**
> + * zynqmp_pm_xilsem_cram_ssit_totframes - PM call to perform total frames read
> + * @slrid:	SLR id for which total frames read to be done
> + * @row:	CFRAME row number to be used for reading ECC
> + * @framecnt: Buffer address to get toral frames data

[Severity: Low]
Is there a typo in the documentation here? Should toral be total?

> + * @response:	Output response (Total frames header, slr id, row, status)
> + *
> + * Return: Returns 0 on success or error value on failure.
> + */
> +int zynqmp_pm_xilsem_cram_ssit_totframes(u32 slrid, u32 row, u32 framecnt, u32 *const response)
                                                                 ^^^^^^^^^^^^
[Severity: Medium]
Does framecnt suffer from address truncation similar to bufaddr? The
parameter name framecnt is somewhat misleading since it receives a DMA
buffer address rather than a count. Since it is typed as u32, passing
a 64-bit dma_addr_t could cause truncation.

> +{
> +	u32 ret_buf[PAYLOAD_ARG_CNT];
> +	int ret;
> +
> +	ret = zynqmp_pm_invoke_fn(PM_XSEM_SSIT_GET_FRAMES, ret_buf, 3, slrid, row, framecnt);
> +	response[0] = ret_buf[1];
> +	response[1] = ret_buf[2];
> +	response[2] = ret_buf[3];
> +	response[3] = ret_buf[4];
> +
> +	return ret;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260624212545.2850787-1-rama.devi.veggalam@amd.com?part=3