McBankErrorInjection Module (index 0225)

Overview

SMM driver that injects Machine Check Bank (MCBANK) error records into the UEFI
variable store for RAS (Reliability, Availability, Serviceability) testing on
Intel Purley platforms. On each boot, it checks an OEM policy variable to
decide whether to inject a pre-built error injection record (SMI handler
registration with INTEL vendor GUID). This is a debug/test driver -- it
generates test error records that platform RAS firmware (e.g. the BIOS error
record handler) can consume.

Address Range

0x280 - 0x1020 (18 functions)

File Metadata

• Image: McBankErrorInjection.efi
• Image size: 0x1ca0
• Architecture: X64
• Source branch: PurleyPlatPkg\Ras\Smm\McBankErrorInjection
• MD5: f4eb9888b50f0dbe3add207008acadaa
• SHA256: 739a991d6999aadd74d79b23ceb4866fa0a2b8ebd608c71a01c460aa17aee35c

Entry Points (Public API)

Driver Flow

_ModuleEntryPoint (0x464)

  +-- sub_510()          -- Init UEFI Boot/SMM services, SMRAM ranges

  +-- sub_280(&unk_1A30) -- SetJump/save context (for LongJump on error)

  +-- sub_8F0()          -- MAIN: OEM policy check + error injection
     |
     +-- Get SMM CPU I/O protocol (0x17C0) to check MSR
     +-- Read OEM policy variable (via SMM Variable protocol 0x17E0)
     +-- If OEM policy allows:
     |     +-- sub_754() -- Build INTEL error injection descriptor
     |     |     |
     |     |     +-- Allocate 0x140-byte buffer
     |     |     +-- Fill structure: Type=3, fields zeroed
     |     |     +-- Build "INTEL " vendor signature (6+8 bytes)
     |     |     +-- Register SMI handler via SMM SW Dispatch (0x17B0)
     |     |     +-- Locate INTEL SMI handler via unk_17F0 GUID
     |     |
     |     +-- Get SMM Variable protocol (0x19C0)
     |     +-- Write 159-byte error injection record via variable
     |
     +-- Return status

  +-- sub_C54(&unk_1A30) -- Validate jump buffer alignment
  +-- sub_320(&unk_1A30) -- LongJump (restore context, never reached on success)
  +-- AutoGen DEBUG() cleanups

  +-- sub_FB8() -- Free SMRAM buffer on failure

Key Functions

Application-Level Logic

Library / Support Functions

Debug / Assert

SetJump / LongJump

Memory Operations

Protocol Interfaces

Consumed (this module calls)

INTEL Vendor SMI Handler (0x17F0)

The block at 0x17F0 is the INTEL vendor descriptor:

• dword_17F0 = 0x4A45434D ("MCEJ" = Machine Check Error Injection)
• dword_17F4 = 0x00000130 (size/version descriptor, 0x130 = 304 bytes)
• 0x17FA: "INTEL " vendor signature (6 bytes)

This identifies the error injection descriptor as an INTEL-vendor-specific SMI
handler record, matching the Purley platform's RAS error injection mechanism.

Global Variables

Initialized .data (0x1780 - 0x1B60)

Zero-initialized BSS (0x1A08 - 0x1B38)

Data Structures

Error Injection Descriptor (at allocated buffer, 0x140 = 320 bytes)

Offset  Size  Field
------  ----  -----
+0x00     8   Type (always 3)
+0x08     8   Field (initially 0)
+0x10     8   Field (initially 0)
+0x18     8   Field (initially 0)
+0x20     8   Field (initially 0)
+0x28     8   Field (initially 0)
+0x30     ...  INTEL vendor signature region (6+8 bytes "INTEL ")
+0x40     0x90  Extended descriptor data (144 bytes copied via CopyMem)

The descriptor follows the Purley INTEL MCEJ (Machine Check Error Injection)
format. Type=3 indicates the error record type.

Calling Patterns

1. Boot flow: _ModuleEntryPoint -> sub_510 (init) -> sub_280 (SetJump) -> sub_8F0 (OEM check + inject) -> sub_C54/sub_320 (LongJump cleanup) -> return status

2. OEM policy check: sub_8F0 gets SMM CPU I/O protocol, checks MSR via SmmCpuIo2, reads SMM Variable for OEM policy bit (byte_19B0), checks OEM field at offset +24 via qword_19C8.

3. Error injection: sub_754 allocates 320-byte buffer, fills INTEL error injection descriptor, registers SMI handler via gEfiSmmSwDispatch2ProtocolGuid, then calls the INTEL SMI handler protocol.

Dependencies

Consumed (this module calls)

Consumed By (other modules call this)

This module is an SMM driver with no registered protocols -- it is called by
the SMM core via ModuleEntryPoint on SMM driver load. No other module
consumes its services.

OEM Extension Point

The module references McBankErrorInjectionOem.c (at 0x1140), indicating an
OEM-customizable portion of the policy check. The OEM file would define the
SMM Variable GUID and field offset at +24 for the enable/disable flag.

Notes

• This is a debug/test driver -- the AutoGen.c ASSERT lines at lines 307
  and 322 confirm this module is only built in DEBUG_VS2015 configuration.
• The module is SMM-only and does not install any UEFI protocols itself.
• The error injection descriptor is 320 bytes, with Type=3 indicating the
  INTEL MC Bank error format.
• The "INTEL " vendor signature (0x17FA) is used to match against the INTEL
  SMI handler protocol registered by platform firmware.
• CMOS port 0x70/0x71 access in sub_E7C is used to determine debug level for
  ASSERT output filtering.