FpgaErrorHandler Module

Overview

SMM driver that handles FPGA (Field Programmable Gate Array) error status monitoring and correction for the Intel Purley platform. This module runs in System Management Mode (SMM), monitors FPGA error registers via MMIO, and performs error acknowledgment and system reset when critical FPGA errors are detected. Also integrates with the MpSyncData library for multi-processor synchronization.

Address Range

0x280 - 0x1E80 (0x1C00 bytes .text, 44 functions)

Key Functions

Entry Points (Public API)

• 0x514 _ModuleEntryPoint: Standard UEFI SMM driver entry point. Saves boot services, locates protocols, registers FPGA error callbacks, and initializes error monitoring.

Internal Helpers

UEFI Infrastructure (Auto-generated or library code)

• 0x5C0 sub_5C0: UEFI boot services initialization. Saves ImageHandle, SystemTable, gBS, gRT, gSmst pointers from the UEFI system table. Generated by AutoGen.c
• 0x280 sub_280: SetJump implementation -- saves CPU register context (GP registers, XMM, MXCSR) into a jump buffer structure for non-local goto. Used to protect the entry point during error handling.
• 0x320 sub_320: LongJump implementation -- restores CPU context from a jump buffer and longjmps back. Used to recover from errors during initialization.
• 0x11E0 sub_11E0: SetJump validation wrapper -- validates jump buffer alignment (8-byte aligned) and non-null.
• 0x3A0 sub_3A0: ZeroMem -- zero-fills memory buffers (aligned + tail).
• 0x12FC sub_12FC: ZeroMem wrapper with validation -- validates buffer non-null and length bounds.
• 0x430 sub_430: RDTSC wrapper -- reads timestamp counter.
• 0x420 sub_420: _mm_pause wrapper -- CPU spin-loop hint.
• 0x4A0 sub_4A0: _enable() -- enable interrupts.
• 0x4B0 sub_4B0: _disable() -- disable interrupts.
• 0x4C0 sub_4C0: __getcallerseflags() -- read EFLAGS.
• 0x440 sub_440: __cpuid wrapper (leaf-based) -- CPUID with EAX input, returns EAX/EBX/ECX/EDX.
• 0x470 sub_470: __cpuid wrapper (function-based) -- CPUID with query type input.

MMIO/I/O Access Wrappers

• 0x128C sub_128C: 64-bit MMIO read -- reads a QWORD from an MMIO address with alignment check.
• 0x12BC sub_12BC: 64-bit MMIO write -- writes a QWORD to an MMIO address with alignment check.
• 0x1228 sub_1228: 16-bit MMIO read -- reads a WORD from IO address with alignment check.
• 0x1258 sub_1258: 16-bit MMIO write (constant 0x500) -- writes 0x500 to a WORD MMIO address.
• 0x1D54 sub_1D54: __indword -- reads a DWORD from an I/O port.
• 0x1D24 sub_1D24: Unaligned read -- reads a QWORD from potentially unaligned address.

PCI Express Helpers

• 0x1544 sub_1544: PCI Express MMIO address translation -- validates PCIe address (upper bits must be zero) and adds the MMIO base from qword_2E68.
• 0x143C sub_143C: MMIO read via PciRootBridge protocol -- reads a DWORD from PCI config space (Bus 0, Dev 0, Func 0, Reg 0xF8000 = 1015808) using protocol at qword_2E58.
• 0x1C00 sub_1C00: PCH info query -- reads LPC device ID to determine PCH SKU, validates it (checks for supported PCH), returns PCH-specific data from unk_2B00.
• 0x1BA0 sub_1BA0: GPIO value read -- reads a GPIO value via MMIO (address 0xFD000148 + shifted offset) using PCH info.

Memory Management

• 0x13D4 sub_13D4: Free pool -- frees the allocated buffer at qword_23FF0. Uses either InternalSmmFreePool or gBS->FreePool depending on context.
• 0x1360 sub_1360: MM RAM range check -- checks if an address is within any registered SMM memory region.
• 0x13A4 sub_13A4: SMM allocate pool -- allocates memory via the SMM memory allocator.

Protocol Lookups (Singleton pattern)

• 0x10C8 sub_10C8: Lazy-loads debug logging protocol at GUID unk_2A60 into qword_2E50.
• 0x1C98 sub_1C98: Lazy-loads PCD protocol at GUID unk_2A50 into qword_2EA0.
• 0x146C sub_146C: Lazy-loads HOB list from SystemTable's HOB list pointer.

HOB/Data Comparison

• 0x1D84 sub_1D84: GUID comparison -- compares two GUID values (16 bytes each, split as two QWORDs). Used to find matching HOB entries.
• 0x1990 sub_1990: CPU topology discovery -- uses CPUID to determine thread bits and core bits for the CPU topology.

Spinlock

• 0x1DF4 sub_1DF4: Spinlock initialization -- sets a spinlock QWORD to 1 (unlocked).

Assertion/Logging

• 0x11A0 sub_11A0: Debug logging -- calls debug print protocol if available (lazy-loaded).
• 0x1118 sub_1118: Conditional debug print with platform check -- checks CMOS (I/O 0x70/0x71) for platform type and error severity level before printing.

State Management

Global Variables (.data section, 0x2A00 - 0x24800)

Large Data Tables (0x7FC8 - 0xE7E0)

Reference Data (.rdata section, 0x1E80 - 0x2A00)

Protocol GUIDs

Located via SMM System Table (qword_2E48 + 208 = Smst->SmmLocateProtocol)

Located via BootServices (gBS + 320 = gBS->LocateProtocol)

Located via MpSyncData (qword_2E78 + 208 = MpSyncData->SmmLocateProtocol)

Data Structures

FPGA State Structure (accessed via qword_24050)

The FPGA state object is obtained from MmPciBase protocol. Key offsets:

• +22: Byte field with bitmask of active FPGA sockets (bits 0-3 for sockets 0-3)
• +14958 (0x3A6E): Per-socket FPGA error status array (starts at offset 14958 from base)
• Each socket's FPGA status spans 14944 bytes

FPGA Error Register Set

• Based on PCI config space at MMIO base derived from MmPciBase
• Register offsets at 0x1FD0 table: 0x394, 0x39C, 0x3A4, 0x3AC, 0x3B4, 0x3BC
• Register offsets at 0x1FE0 table: 0x390, 0x398, 0x3A0, 0x3A8, 0x3B0, 0x3B8
• These appear to be FPGA error status/clear registers

FPGA Callback Registration Structure (at qword_24058)

Protocol with a function at offset 0 that takes an array of 6 function pointers and a parameter:

typedef struct {
    void (*Register)(FPGA_CALLBACK_ARRAY *Callbacks, UINT8 Param);
} FPGA_CALLBACK_PROTOCOL;

The callback array has 6 entries:

• [0] = sub_B38: FPGA error presence check
• [1] = sub_B48: FPGA error clear
• [2] = sub_BF0: FPGA error buffer clear
• [3] = sub_C90: FPGA error status query
• [4] = sub_CB4: FPGA fatal error handler
• [5] = sub_D48: FPGA error poll handler

Per-CPU Data Tables (MpSyncData)

The module allocates large tables indexed by (socket, core, thread):

• byte_7FE0: Per-CPU active flag (1 = active)
• byte_E7E0: Per-CPU state byte (0 = invalid, 1 = present, 2 = initialized)
• dword_C7E0: Per-CPU initial APIC ID
• qword_87E0: Per-CPU APIC ID (64-bit)
• byte_2FC8: Per-CPU active flag (40-byte stride)
• unk_2FC0: Per-CPU spinlock (40-byte stride)

Offset calculation: idx = thread + (core + 448 * socket) * 64

• 448 cores per socket max, 64 threads per core max

Calling Patterns

1. Module Initialization Flow

_ModuleEntryPoint (0x514)
  -> sub_5C0 (0x5C0): Save boot services, gBS, gRT, gSmst
  -> sub_280 (0x280): SetJump to protect against errors
  -> sub_EAC (0xEAC): Main FPGA error handler setup
      -> LocateProtocol (MmPciBase) -> gets FPGA base -> qword_24050
      -> LocateProtocol (PCI config) -> qword_24058
      -> LocateProtocol (MpSyncData) -> qword_2E20
      -> Register protocol callbacks:
           RegisterCallback( {sub_B38, sub_B48, sub_BF0, sub_C90, sub_CB4, sub_D48}, 3)
  -> sub_11E0: Validate SetJump buffer
  -> sub_320: LongJump back if error occurred

2. FPGA Error Polling Flow (sub_DFC - error status collection)

sub_DFC (0xDFC) - called from FPCA callback framework
  -> For each of 4 sockets:
     -> Check if bit N is set in FPGA state byte (+22)
     -> Read FPGA error register via MMIO protocol at qword_2E98
     -> Store status in buf_ array

3. FPGA Error Correction Flow (sub_D48)

sub_D48 (0xD48) - poll handler
  -> For each active socket:
     -> Check error register at offset +16400 (error pending)
     -> If pending: call sub_A30 to log, set output flag
     -> Check register at offset +968 (secondary error)
     -> If pending: call sub_A30 to log, set output flag

4. Fatal Error Flow (sub_CB4)

sub_CB4 (0xCB4) - fatal FPGA error handler
  -> Read GPIO value via sub_1BA0 (MMIO 0xFD000148 + shift)
  -> Write GPIO output bit
  -> __outbyte(0xCF9, 2): Reset CPU
  -> __outbyte(0xCF9, 6): Full system reset
  -> Infinite loop

5. MpSyncData Initialization Flow (sub_1580)

sub_1580 (0x1580) - initialize CPU sync data
  -> LocateProtocol (MpSyncData)
  -> LocateProtocol (MpSyncData second)
  -> LocateProtocol (MpSyncData CPU info)
  -> sub_1990: Get CPU topology (thread_bits, core_bits)
  -> Initialize per-CPU data tables (spinlocks, flags, APIC IDs)
  -> Enumerate all CPUs via MpSyncData CPU info protocol

Dependencies

Consumed (this module calls out to)

• UEFI Boot Services (gBS): LocateProtocol, FreePool
• SMM System Table (gSmst): SmmLocateProtocol, SmmAllocatePool, InternalSmmFreePool
• MmPciBase Protocol: Provides FPGA MMIO config space base address
• MmPci IO Protocol: FPGA register read/write access
• FPGA Callback Registration Protocol: Registers error handler callbacks
• MpSyncData Protocol: Multi-processor synchronization data management
• PciRootBridge Protocol: PCI config space access for PCH detection
• PCD Protocol: Platform Configuration Database
• Debug Print Protocol: DEBUG/ASSERT message output
• GPIO Private Library: GPIO status register access via MMIO
• PCH Info Library: PCH SKU detection via LPC device ID

Consumed By (other modules call this)

• SMM Core: Via registered FPCA callback protocol -- the 6 callbacks (sub_B38, sub_B48, sub_BF0, sub_C90, sub_CB4, sub_D48) are registered with the FPGA framework to be called when FPGA errors occur.

Notes

1. Source file: PurleyPlatPkg/Ras/Smm/ErrHandling/FpgaErrorHandler/FpgaErrorHandler.c -- SMM driver for FPGA error handling on Intel Purley platform.

2. Multi-socket support: All error handling iterates over sockets 0-3, using a bitmask at FPGA state byte +22 to determine which sockets are populated.

3. FPGA Register Layout: The FPGA error status registers are at offsets 0x390-0x3BC in the FPGA PCI config space. Two sets of 6 WORD-sized registers (set1: 0x394/0x39C/0x3A4/0x3AC/0x3B4/0x3BC, set2: 0x390/0x398/0x3A0/0x3A8/0x3B0/0x3B8).

4. Error severity levels: The callbacks are registered with parameter "3", and the sub_1118 debug print function checks the platform type via CMOS to control which error levels get logged.

5. CMOS-based debug control: sub_1118 reads CMOS offset 0x4C (via I/O ports 0x70/0x71) to determine platform type and control error message output.

6. Warm reset signaling: Fatal errors trigger a warm reset via the standard 0xCF9 reset port (write 2 then 6). The GPIO register at 0xFD000148 is used to signal the error cause to the hardware.

7. CPU topology: sub_1990 uses CPUID leaf 0xB (Extended Topology) to discover thread bits per core and core bits per package, supporting up to 4 sockets, ~448 cores per socket, and 64 threads per core.

8. SetJump protection: The entry point uses SetJump/LongJump (sub_280/sub_320) to protect against crashes during initialization -- if sub_EAC fails (longjmp called), the module continues gracefully.