LastBootErrorLog Module

Overview

DXE driver that processes the last boot error log for RAS (Reliability, Availability, Serviceability) purposes on Intel Purley (Xeon Scalable) platforms. Reads error records from HOB (Hand-Off Block), translates them through the WHEA (Windows Hardware Error Architecture) protocol, and dispatches error information to crash handler, error log, and platform-specific storage.

File Identity

• MD5: 137910c91f16445d1110a15497cad810
• SHA256: 59eac854dd652a03a271728efee20722b59d502ac19da02d0a5870ade0d3d0ea
• Build Path: e:\hs\Build\HR6N0XMLK\DEBUG_VS2015\X64\PurleyPlatPkg\Ras\Whea\LastBootErrorLog\LastBootErrorLog\DEBUG\
• Source: PurleyPlatPkg/Ras/Whea/LastBootErrorLog/ (under PurleyPlatPkg)
• Library Dependencies: WheaSiliconHooksLib, mpsyncdatalib, DxeMmPciBaseLib, DxeHobLib, SmmMemoryAllocationLib, UefiBootServicesTableLib, DxePcdLib, various MdePkg base libs

Address Range

Total: 84 functions, 65 strings.

Entry Points (Public API)

Key Functions

Initialization Flow

_ModuleEntryPoint (0x588)

  +-- sub_3D94 (0x3D94) -- AutoGen-generated driver init: calls sub-functions in a long chain
     Calls: sub_678, sub_714, sub_750, sub_A44, sub_CC0, sub_D24, sub_E38,
            sub_EEC, sub_10FC, sub_1210, sub_192C
     Each call is wrapped with ASSERT_EFI_ERROR / DebugAssert checks

  +-- sub_41C0 (0x41C0) -- Main DXE driver logic
     |
     +-- sub_2A0 (0x2A0) - SetJump (saves CPU context for LongJump)
     +-- sub_43FC (0x43FC) -- Core initialization
     |     +-- sub_4238 (0x4238) -- Protocol resolution & data structure init
     |     +-- sub_EA0 (0xEA0) -- HOB traversal to find error log HOB
     |     +-- sub_23FC (0x23FC) -- Process last boot error from HOB (main logic)
     |     +-- sub_208C (0x208C) -- Process platform-specific error data
     +-- sub_3D44 (0x3D44) -- Record driver status, LongJump

  +-- sub_4150 (0x4150) -- Unload handler (called if sub_41C0 fails)

Library Initialization Helpers (AutoGen)

WHEA / Last Boot Error Processing

Processor Error Decode Pipeline

Error Handler Callbacks (registered in WHEA protocol table)

Error Record Cache Management

Data Flow Functions

Debug/Assert Infrastructure

Global Variables

Error Cache Structure (at 0x56E0)

20 entries, each 16 bytes:

+0x00: u8    valid
+0x01: u8    socket_id
+0x02: u8    core_bit  (bit in core mask)
+0x03: u8    thread_id
+0x04: u8    severity/type
+0x05-0x07: padding
+0x08: u64   error_address (bits 63:6 masked = address, bits 5:0 = status)

Protocol GUIDs Used

The module resolves protocols via BootServices->LocateProtocol (offset 320 in protocol table). The untyped GUID references are embedded in the .data section at 0x5100-0x5230. Based on function context:

Error Record Processing Flow

Step 1: HOB Discovery (sub_192C)

1. Resolves gEfiWheaBootProtocolGuid via BootServices->LocateProtocol
2. Registers sub_18F4 as notification callback
3. Resolves gEfiSmmCpuSyncProtocolGuid (protocol at 0x5140) to get SMM sync data
4. Resolves gEfiSmmCpuProtocolGuid (protocol at 0x5150) for WHEA protocol table
5. Resolves gEfiSmiHandlerProtocolGuid for SMI handler registration
6. Calls sub_EA0 to find HOB matching gEfiLastBootErrorHobGuid
7. Stores HOB pointer in qword_5698 (offset +24 from HOB header)

Step 2: Error Record Parsing (sub_23FC)

The HOB error record starts with a header:

+0x00: u16  structure_size (must be >= 2)
+0x02: u8   type (1=error, 2=clear)
+0x03: ...
+0x08: u16  sub_type (error group identifier):
            Groups: 4-5, 12, 19 -> sub_1EF8 (corrected errors via processor decode)
                    9-11, 7-8  -> sub_1CD0
                    0-3        -> sub_1E40
                    13-18      -> sub_1D88
+0x0A: u64  flags (bit 61=valid, bit 57=platform_error)

Based on error type:

• type 1 (error event): Dispatches to type-specific handler based on sub_type
• type 2 (clear event): Calls sub_1F60 to clear error flags, sets byte_56CB = 1

Step 3: Alternative Path (sub_23FC - no HOB)

If qword_5698 is NULL but qword_56A0 (WHEA protocol alternate) is set:

• Iterates 8 CPU slots
• For each active slot, calls SMI handler via qword_5688+8 to check/clear the error
• If the return code indicates a recoverable error, calls sub_202C to clear it

Step 4: Platform Error Processing (sub_208C)

For each of 4 sockets:

1. Checks if the socket has any active threads (from unk_5240 structure)
2. For each of 21 threads per socket:
   • Reads error status via PCIe config space (sub_11B8 builds the config address)
   • If error is present (checked via sub_3AA8 - MMIO read, sub_3B28)
   • Dispatches error data to WHEA boot protocol (qword_56A8+40, function index 5 = type 25)
3. Also checks 8 "special" error slots

Step 5: Processor Error Decode (sub_34BC)

The main decode function:

1. Reads error type from input structure field at +6
2. Determines memory error type (Sparing/Lockstep/Any) based on type value
3. Reads MSR 0x179 (MCG_CAP - Machine Check Global Capability)
4. Determines error correction mode (6 modes: 0=Corrected, 2=Deferred, 3=Recoverable, 5=Uncorrected, etc.)
5. Routes to appropriate handler callback based on mode:
   • Mode 2: cmc_handler (qword_5848 = sub_2A74)
   • Mode 5: ue_handler (qword_5828 = sub_2E30)
   • Other: smi_handler (qword_5840 = sub_2E08)
6. For mode 0 (corrected/deferred), decodes memory controller address to DIMM location

Data Structures

Last Boot Error HOB (input from PEI)

+0x00: u16  Length          // Structure size
+0x02: u8   Type            // 1=error, 2=clear
+0x03: u8   Severity        // Error severity
+0x04: u8   Socket/Bus      // Socket identifier
+0x05-0x07: u8[3]           // Error address fields
+0x08: u16  SubType         // Error group identifier
+0x0A: u64  ErrorFlags      // Flags with valid/severity bits

WHEA Error Output Structure (64 bytes at stack)

Output from sub_34BC decode, consumed by handler callbacks:

+0x00: u16  length           // Structure size
+0x02: u64  status_flags     // Status bits (0x3B = valid mask)
+0x0A: u16  reserved
+0x0C: u16  error_type       // 0=No error, 2=Deferred, 3=Recoverable, 8=SMI, 14=Corrected
+0x0E: u16  socket_id|flags  // Socket ID in upper bits
+0x12: u16  core_id
+0x14: u16  thread_id
+0x16: u16  severity
+0x18: u16  error_code
+0x1A: u16  reserved2
+0x1C: u32  reserved3
+0x20: u32  mc_status_low
+0x24: u32  mc_status_high
+0x28: u32  mc_addr_low
+0x2C: u32  mc_addr_high
+0x30: u32  mc_misc
+0x34-0x3F: u8[12] reserved

Cache Table Entry (20 entries at 0x56E0, 16 bytes each)

+0x00: u8   valid
+0x01: u8   socket_id
+0x02: u8   core_bit       // bit in the core mask
+0x03: u8   thread_id
+0x04: u8   error_type/severity
+0x05-0x07: padding
+0x08: u64  error_address  // address with MC (address << 6) format

Calling Patterns

Module Initialization

_ModuleEntryPoint(ImageHandle, SystemTable)
  sub_3D94()  -- AutoGen: initialize all library constructors
  sub_41C0()  -- Main: SetJump, init protocols, process HOB
    if success: sub_3D44(LongJump) -- commit
    if fail: sub_4150() -- unload libs

Error Record Processing

HOB available (qword_5698 != NULL):
  sub_23FC()
-- type==1 (error):
     |-- sub_type in {4,5,12,19}: sub_1EF8() -> sub_34BC(decode) -> dispatch callback
     |-- sub_type in {9,10,11,7,8}: sub_1CD0() -> WHEA boot (type=1)
     |-- sub_type in {0,1,2,3}: sub_1E40() -> WHEA boot (type=1)
     |-- sub_type in {13,14,15,16,17,18}: sub_1D88() -> WHEA boot (type=1)
-- type==2 (clear): sub_1F60() -> WHEA boot (type=25)
     sets byte_56CB = 1

HOB not available but qword_56A0 set:
  sub_23FC() alternate path
    for 8 CPU slots:
      if active: call smi_handler -> sub_202C() to clear

Error Decode + Handler Dispatch

sub_34BC(input_hdr, output_block)
-- Read MCG_CAP MSR (0x179)
-- Determine correction mode (0-6)
-- If mode==0 (corrected):
     sub_33A8() -> Get CPU topology for error address
     sub_2CD8() -> Read MCi_STATUS MSRs, validate address match
     sub_2B64() -> Verify with SMI handler protocol
     sub_2EC4() -> Find error in bank, dispatch to handler callback
       |-- sub_2E48() -> Read CPU topology from CSR
       |-- For found error: run callback (cmc/smi/handler)
       |-- For not found: sub_27D4(build notification) -> callback
-- Return to sub_1EF8, route to WHEA boot protocol

Dependencies

Consumed (this module calls)

Consumed By (other modules call this)

This module is a DXE driver that installs WHEA protocol interfaces. Based on context:

• WheaErrorInj: May use the WHEA boot protocol interfaces installed here
• ProcessorErrorHandler: Shares the same WHEA protocol table
• PlatformErrorHandler: May consume error status populated by this driver
• CrystalRidge (NVDIMM): May use the same sync data infrastructure

Notes

1. DXE-only phase: This driver operates in DXE, not SMM. It reads HOB data produced by PEI modules and translates it.

2. SetJump/LongJump pattern: sub_2A0 saves context at sub_2A0-style JMP_BUF (248 bytes: 8 GP regs, 16 XMM regs, MXCSR, return address). sub_3D44 restores via LongJump. This is used as a poor-man's try/catch around the error processing pipeline.

3. Round-robin cache: The 20-entry error cache at 0x56E0 uses a round-robin replacement policy (dword_5824 tracks the insertion index, byte_5820 = wrapping flag).

4. CPU topology encoding: The sub_16C8 function derives thread/core bit widths from CPUID, used to pack APIC IDs into the error structures. Values stored in dword_26880 (cores bitmask) and dword_A878 (threads bitmask).

5. PCIe config address format (sub_11B8): Builds address as:

   • Low 12 bits: register offset
   • Bits 12-14: function (3 bits)
   • Bits 15-19: device (5 bits)
   • Bits 20-24: bus (5 bits)
   • Bits 25-31: segment/domain
   • High bits: socket id
   • Bit 9 of flags: extended config space access (0x200 = 512 byte access)

6. Build path string: Matches Build\HR6N0XMLK\DEBUG_VS2015\X64\ indicating this is a debug build for the HR6N0XMLK platform variant (likely HR650X).

7. WHEA protocol interface offsets (from qword_56A8):

   • +8: Unknown function
   • +32: Function index 4 (type 17) -- log/clear error
   • +40: Function index 5 (type 25) -- log platform error
   • +56: Function index 7 (type 1) -- dispatch error record