WheaErrorLog Module Analysis

Overview

SMM WHEA (Windows Hardware Error Architecture) error logging driver for Intel Purley platform. This module initializes WHEA error record storage in SMRAM, registers SMI handlers for error record update and notification callbacks, and interfaces with platform MP (Multi-Processor) sync data, PCIe MM config space, and WHEA boot-time protocols to log hardware errors during OS runtime.

The module acts as the SMM-side counterpart to the DXE WHEA infrastructure, providing persistent error record buffers that survive across SMI entries.

Address Range

0x300 - 0x2FA8 (63 functions, ~154 KB image total including .data)

Image Characteristics

Key Functions

Entry Points (Public API)

Protocols Implemented / Consumed

The module consumes the following protocols (identified by GUID):

SMI Handlers (Registered via SmmSwDispatch2)

• sub_2688 (0x2688) - SMI handler for SwSmi 157: Enables WHEA error logging (byte_40A0 = 1), installs PCI MMIO base
• sub_2664 (0x2664) - SMI handler for SwSmi 158: Disables WHEA error logging (byte_40A0 = 0), releases PCI MMIO base
• sub_2C04 (0x2C04) - SMI handler registered via sub_26F4 callback (caller protocol): Processes WHEA error records, reads CPER data from error sources, writes them into the error status block
• sub_2FA8 (0x2FA8) - SMM notification callback: Clears WHEA state flags (byte_40A1, byte_40A2, byte_40A3)

Internal Helpers

Initialization Chain (from sub_21C0)

sub_21C0 calls 14 init functions in sequence. Each call is wrapped in ASSERT_EFI_ERROR. The chain is:

Protocol Resolution (sub_1ACC)

Looked-up protocols at 0x3E70, 0x3E40 (MP), 0x3E80 (gEfiWheaBootProtocolGuid), 0x3E90 + HOB GUID at 0x3D90.

The function sub_1154 searches the HOB list for a specific GUID (at 0x3D90: 5138B5C5-9369-48EC-5B97-38A2F7096675). The HOB data offset +24 is stored at qword_4148 as a pointer to the WHEA silicon configuration data.

Error Record Processing (sub_2C04)

The SMI handler at 0x2C04 is the core error logging function:

1. Checks if byte_40A0 is set (WHEA logging enabled). Returns EFI_NOT_READY if not.
2. Calls sub_2EF0 to check if error status blocks are pre-initialized. If not, initialize them.
3. Extracts error record details from the input context (offset +128 from a1 / CommunicationBuffer).
4. Calls sub_1F04 to determine error record subtype. If it matches 0x3EC0 (Corrected/PCIe), performs ID translation via sub_1E70.
5. Calls sub_26AC to find the appropriate error status block entry by severity (1 or 2).
6. Extracts a pointer from the error status block entry.
7. Determines error severity (192=non-fatal, 80=corrected, 228=fatal) based on source GUID matching (0x3EA0, 0x3EB0, 0x3EC0, 0x3ED0, 0x3EE0) and policy config.
8. If the error source matches the policy config, fills in the error record:
   • Sets severity flags
   • Copies error timestamp
   • Sets error source GUID
   • Copies FRU (Field Replaceable Unit) text if present (16/20 bytes)
   • Copies error data payload of variable size (n192 bytes)
9. Updates the error block header fields (length, severity flags).

State Management

Global Variables

Per-CPU Data Structures (initialized in sub_13B0)

Three parallel arrays indexed by CPU (up to 512 CPUs):

Also:
0x4308 | byte_4308 | 40 | Per-CPU (up to 0x5000/40=512) sync data structure header |

Layout: [64 * (socket + 448 * package)] [socket offset = 64, package stride = 448 * 64]

SpinLocks

| 0x9308 | unk_9308 | 8 | SpinLock for MP sync |
0x9310 | unk_9310 | 8 | SpinLock for MP sync |

SMRAM Range Info

| 0x25328 | qword_25328 | 8 | Number of SMRAM descriptors (total_size >> 5) |
0x25330 | qword_25330 | 8 | SMRAM range descriptor array pointer |

WHEA Error Status Block Table (at 0x3F28)

Entry structure (24 bytes per entry):

Offset  Size  Field
0x00    2     Type/severity level (1 or 2 = corrected or non-fatal)
0x02    4     Data size
0x08    8     Pointer to error status block structure
0x10    8     Pointer to error source specific data

Entry count at qword_3F90. Each entry points to an error status block whose first field is a flags/status value.

Data Structures

Error Status Block (referenced from 0x3F28 table entries)

Offset  Size  Field
0x00    4     Status/flags bits (bit 0=valid, bit 1=overflow, bit 2=corrected overflow,
              bits 4-5=severity, bits 12-15=type mask)
0x04    4     Reserved
0x08    2     Error severity code
0x0A    2     Reserved
0x0C    4     Error source ID
0x10    16    Error source GUID
0x20    2     Timestamp seconds
0x22    2     Timestamp microseconds

Per-CPU Sync Data Structure Entry (64 bytes each)

Layout derived from sub_13B0 loops:

Offset  Size  Field
0x00    8     Reserved (zeroed)
0x08    8     APIC ID (qword_9B20 entry)
0x10    4     Register value (dword_DB20 entry)
0x14    1     Status byte (0/1/2)
0x18-40       Reserved (zeroed)

Calling Patterns

Module Entry Flow

_ModuleEntryPoint (0x5E8)
  -> sub_21C0 (0x21C0)  [constructors]
      -> sub_6D8   - Init boot services (gBS)
      -> sub_774   - Init runtime services (gRT)
      -> sub_7B0   - Init SMM services (gSmst)
      -> sub_C3C   - Get SMRAM ranges
      -> sub_EB8   - Thunk: init PCI MMIO
      -> sub_EBC   - PCI MMIO base init
      -> sub_F78   - Get PCD token 5
      -> sub_10EC  - Init HOB list
      -> sub_11A0  - ACPI PM timer + WHEA boot protocol
      -> sub_13B0  - MP sync data table init
      -> sub_1ACC  - WHEA silicon hooks protocol resolution
  -> sub_25EC (0x25EC)  [main init]
      -> sub_300   - Save/restore callee regs + SetJump
      -> sub_26F4  - Main protocol installation (SmiHandler registration)
  -> sub_257C (0x257C)  [on failure: unload]
      -> sub_DB0   - Thunk: unload handler

SMI Handler Flow (WHEA error logging)

SMI Entry -> SmmCpuService Router -> sub_2C04 (0x2C04)
  -> sub_2EF0 (0x2EF0)  [pre-init error status blocks if needed]
      -> sub_9E8  [ZeroMem on each block]
  -> sub_1F04 (0x1F04)  [determine error type/severity]
      -> sub_A6C  [GUID compare - check if PCIe error type]
      -> sub_1E70 [ID translation via lookup table]
  -> sub_26AC (0x26AC)  [find error status block by severity]
  -> sub_93C   [CopyMem - copy FRU text, timestamps, error data]

SMM Enable/Disable Callback Flow

sub_2688 - SMI handler 158: enables WHEA
  -> Sets byte_40A0 = 1
  -> Installs PCI MMIO base

sub_2664 - SMI handler 157: disables WHEA
  -> Sets byte_40A0 = 0
  -> Releases PCI MMIO base

sub_2FA8 - SMM Notify callback: reset WHEA state
  -> Clears byte_40A1, byte_40A2, byte_40A3

Dependencies

Consumed Protocols (located via SMM protocol database / Boot Services)

Consumed Boot Services Functions

The module uses the following gBS function table offsets:

• Offset 192 (0xC0) - gBS->RegisterProtocolNotify
• Offset 208 (0xD0) - gBS->LocateProtocol (or SMM equivalent via gSmst at 0x40C8+208)
• Offset 320 (0x140) - gBS->LocateProtocol (DXE boot services version)

Consumed Libraries (linked statically)

• UefiBootServicesTableLib - gBS, gImageHandle init
• UefiRuntimeServicesTableLib - gRT init
• SmmServicesTableLib - SMM table init
• BaseLib - SetJump/LongJump
• BaseMemoryLibRepStr - CopyMem, ZeroMem
• SmmMemoryAllocationLib - SMRAM allocation
• DxeMmPciBaseLib - PCI MMIO configuration
• DxeHobLib - HOB list traversal
• DxePcdLib - PCD protocol access
• BaseIoLibIntrinsic - IO port access (PM1, CMOS)
• BaseSynchronizationLib - SpinLock init
• mpsyncdatalib - MP sync data
• WheaSiliconHooksLib - Platform WHEA hooks

Consumed By (SMI Handlers)

• SMM Core dispatches to registered SwSmi handlers (0x9D / 157, 0x9E / 158)
• SMM CPU Service Callback calls sub_2C04 for WHEA error notification
• SMM Notify calls sub_2FA8 for state cleanup

Platform Configuration

PCD token 5 is read via sub_F78:

• Value stored at qword_40E0
• Used in sub_11A0 at port 0x504 (1280) and 0x508 (1288) - typical ACPI PM1 base

CMOS access in debug logging (sub_B24):

• CMOS index 0x70 / 0x71, register 0x4C
• Determines debug verbosity level based on platform type

Error Source Types (at 0x3EA0-0x3EE0)

Notes

• The module is an SMM driver that registers into gSmst (EFI_SMM_SYSTEM_TABLE2). Despite referencing BootServices, it operates in SMM phase.
• Error status block table at 0x3F28 contains entries with 24-byte stride. Entry count is at qword_3F90.
• WHEA error source configuration array at 0x4126 has 26-byte per-entry stride. Count at qword_4110.
• The error handler at 0x2C04 processes a communication buffer (in SMM) at offset +128 from the input argument, which contains: timestamp at +8, FRU text at +16(16 bytes)/+32(20 bytes), error data at +72, subtype GUID at +16, error severity flags at +10.
• The ID translation table in sub_1E70 is a 255-terminated array of 8-byte entries (4 WORDs each).
• Debug logging uses port 0x70/0x71 CMOS register 0x4C to detect platform debug level.
• ACPI PM1 timer is used in sub_11A0 for timed delay loops (waiting 357 units on port 0x508/1288).
• The module path indicates this is built from PurleyPlatPkg/Ras/Whea/WheaErrorLog/.