ProcessorErrorHandler Module Analysis

Overview

SMM driver for Intel Purley (Skylake-SP Xeon) platform processor error handling. Responsible for Machine Check Architecture (MCA) error handling, memory error correction reporting, IIO (Integrated IO) error handling, VTD/ITC/OTC/DMA error logging, and Post-Package Repair (PPR) / Thermal Alert System (TAS) management. Runs as a UEFI SMM driver registered via SMM SW dispatch protocol.

Address Range

0x300 - 0x11a00 (.text segment, 232 functions)

Source Files (from debug paths)

• PurleyPlatPkg/Ras/Smm/ErrHandling/ProcessorErrorHandler/ProcessorErrorHandler.c - Main module
• PurleyPlatPkg/Ras/Smm/ErrHandling/ProcessorErrorHandler/McaHandler.c - MCA interrupt handler
• PurleyPlatPkg/Ras/Smm/ErrHandling/ProcessorErrorHandler/MemoryErrorHandler.c - Memory error handler
• LenovoServerPkg/Library/LnvPurleyLib/ProcMemErrReporting/ProcMemErrReporting.c - Lenovo processor/memory error reporting
• PurleyPlatPkg/Ras/Library/mpsyncdatalib/mpsyncdatalib.c - MP sync data library
• PurleySktPkg/Library/emcaplatformhookslib/emcaplatformhookslib.c - eMCA platform hooks

Entry Points (Public API)

0x5F0 - _ModuleEntryPoint (ModuleEntryPoint)

Entry point called by SMM infrastructure. Initializes the module by calling sub_69C, then calls sub_34B0 to locate protocols and register SMI handlers. Sets return status in qword_14FD8.

0x67AC - McaHandler (MCA SMI Handler) (source: McaHandler.c)

Called when an SMI is triggered by a machine check. Parameters:

• a1 - CpuInfo pointer (output struct)
• a2 - InterruptType pointer
• a3 - SystemContext pointer (EFI_SMM_CPU_REGISTER_CONTEXT)
  Extracts CPU APIC ID via sub_9CD4(), reads topology via sub_9DA0(), computes a CPU index via sub_9C34(), and returns a struct with:
• offset 0: APIC ID
• offset 4: Package ID (socket)
• offset 8: Core ID
• offset 12: Thread ID
• offset 16: CPU index (unique identifier)
• offset 24: InterruptType value
• offset 32: SystemContext pointer

0x145C - SmmPeriodicDispatchHandler

Registered via (qword_368C8+16)(sub_145C, 1) meaning SMM SW dispatch with SwSmiInputValue=1. Called periodically to process pending error reports. Iterates over CPU entries in the error array at [qword_36960] (stride 216 bytes each), clears processed errors, and for multi-socket configurations triggers PPR/TAS and error logging.

Protocols Located (via qword_14CF8+208, an SmmLocateProtocol or similar)

From configuration protocol (qword_368E0):

• qword_368D8 = config pointer at offset 0 (GeneralCfg / SystemConfig struct)
• qword_368E8 = config pointer at offset 8 (PcieCfg / PerSocketCfg struct)
• qword_36938 = config pointer at offset 16 (CpuCfg / PerSocketInfo struct)

Key Functions

Initialization (ProcessorErrorHandler.c)

Error Dispatch

MCA Handler (McaHandler.c)

Memory Error Handler (MemoryErrorHandler.c)

IIO / Platform Error Handler (ProcMemErrReporting.c)

Utility / Library Functions

SMM Handler Registration

From sub_34B0 (line ~1856):

1. (qword_36950)(&psub_278C, 3) - Registers isErrorHandlingEnabled handler with SMM CPU protocol
2. (qword_368C8+16)(sub_145C, 1) - Registers periodic SW SMI dispatch handler (SwSmiInputValue=1)
3. If qword_368E8+17 == 1 && qword_368D8+10 == 1: registers with qword_36968+40 for MSR 0x6ABC (MCG_CTL or MCi_CTL2)
4. If qword_368D8+4 == 1: calls sub_3364 for per-socket MCA init

Data Structures

Error Bank Entry (stride 216 bytes at qword_36960)

Offset  Size  Description
0x00    1     Active flag
0x01    1     Retry flag
0x03    1     PPR/TAS flags
0x30    1     Bank valid flag
0x34    1     Error type flags (bit0=UC, bit1=CE, bit2=deferred)
0x3C    4     Error bank/register indices
0x40    4     Error status data

CpuInfo (returned by McaHandler at 0x67AC)

Offset  Size  Description
0x00    4     APIC ID
0x04    1     Package ID (socket)
0x08    1     Core ID
0x0C    1     Thread ID
0x10    8     CPU Index (unique)
0x18    8     InterruptType
0x20    8     SystemContext

Socket Configuration (per socket, stride 14944 bytes at qword_14E70)

Offset  Size  Description
0x00    2     Socket enabled bitmask
0x06    2     Core active bitmask
0x18    1     Socket present / enabled
...     ...   IIO stack config

System Config (at qword_368D8)

Offset  Size  Description
0x00    1     Error handling enable flag
0x04    1     Per-socket MCA init flag
0x0A    1     Advanced RAS enable
0x0C    1     Corrected error logging mode (0=off, 1=logged, 2=throttled)
0x0D    1     PPR/TAS enable (0=off, 1=on, 2=aggressive)
0x11    1     IIO error handling flag

Socket Feature Config (at qword_368E8)

Offset  Size  Description
0x10    1     MCA corrected error handling feature
0x11    1     MCA uncorrected error handling feature
0x1D    1     IIO error handling feature flag

Global Variables

Calling Patterns

Module Init Flow

_ModuleEntryPoint(0x5F0)
  +-- sub_69C()          -- init gST/gBS/gRT/ImageHandle
  +-- sub_300()          -- lock check
  +-- sub_34B0()         -- locate protocols (7 protocols)
     +-- Locate protocols via SMST->SmmLocateProtocol (offset 208)
     +-- Extract config from ConfigProtocol
     +-- sub_85FC()   -- acquire spin lock
     +-- sub_88F0()   -- get HOB list
     +-- sub_5394()   -- run PPR/TAS if needed
     +-- sub_278C()   -- is error handling enabled?
     +-- sub_27E0()   -- full error handler setup
     |     +-- Register SMM SW SMI handler (sub_145C)
     |     +-- Enable MSRs (MCG_CTL, MCi_CTL2)
     |     +-- Read "Setup" UEFI variable
     |     +-- Handle PprAddress NVRAM
     +-- sub_3364()   -- per-socket MCA init (if configured)
  +-- sub_6F88()         -- release lock
  +-- sub_3E0()          -- cleanup

SMI Dispatch Flow

sub_145C() (Periodic SMI handler)
  +-- Iterate error bank array (216 byte stride)
  +-- For each active bank:
     +-- Check error type (UC/CE/deferred)
     +-- sub_BD34()   -- clear error status
     +-- Clear bank entries
  +-- If error reported and multi-socket:
     +-- Check socket IIO error status
     +-- sub_B534()   -- log error to banks
     +-- sub_A76C()   -- remote CPU execution
  +-- Clear per-bank tracking

MCa Handler Flow (sub_67AC)

McaHandler(CpuInfo, InterruptType, SystemContext)
  +-- Validate pointers
  +-- sub_9CD4()         -- read local APIC ID
  +-- sub_9DA0()         -- read CPU topology (package/core/thread)
  +-- sub_9C34()         -- compute CPU index from topology table
  +-- Return populated CpuInfo struct

Error Logging Flow (sub_104D0)

LogErrorEvent(ErrorSourceHeader)
  +-- Switch on ErrorSource byte[0]:
      1 -> sub_10410()        -- CPU error
      3 -> sub_110D0() list   -- PCIe error
      4 -> sub_111F4() list   -- 
      6 -> platform hooks CE  -- Corrected
      7 -> platform hooks     -- Recoverable  
      8 -> platform hooks     -- Fatal
      9 -> platform hooks     -- Uncorrected

Dependencies

Consumed (this module calls)

• SmiHandler via SMST->SmiHandlerRegister (offset 208) to register SMM handlers
• SmmCpuProtocol for CPU save state access (offset 112=remote CPU, 120=current CPU, 128=CPU count, 136=CPU context, 144=CPU state buffer)
• SmmSwDispatch2Protocol for register/unregister SW SMI handlers
• RuntimeServices for GetVariable/SetVariable ("Setup", "PprAddress" UEFI variables)
• BootServices for LocateProtocol
• SmmLockBox for saving error records across resets
• PciIo Protocol for PCI config space access (LocateProtocol at 0x14220)

Consumed By

• SMM Core - calls _ModuleEntryPoint on driver load
• SMM SW Dispatch - calls sub_145C on SMI trigger
• SMM CPU Protocol - calls isErrorHandlingEnabled (sub_278C) callback
• SMM Base2 - calls destructor on SMM termination

Notes

• The module uses a spinlock-based synchronization mechanism (sub_85FC/sub_8760) for thread safety during error handling.
• The module supports up to 4 sockets (n4 loop < 4u throughout).
• Socket configuration data is stored in arrays of 14944 bytes per socket at qword_14E70.
• The byte_15220 table (28672 bytes per socket) is used for CPU topology lookup (package -> core -> thread -> unique index).
• Error bank array stride is 216 bytes, tracked at qword_36960.
• The module uses Lenovo-specific NVRAM for PprAddress storage (sub_27E0 at ~0x2b47).
• The "Setup" UEFI variable (GUID {4E2CC220-057B-4D47-88CF-CDC71BA911F1} at 0x14190) controls error handling features.
• Debug print wrapper at sub_6CB8 uses format "%a entry\n" for function trace logging when DEBGUG build enabled.
• ASSERT implementation at sub_6D40 is a wrapper that prints "ASSERT_EFI_ERROR (Status = %r)" with file/line info.