AmiErrorHandlerMain Module

Overview

SMM error handler for Intel Purley (Xeon Scalable) platform. Receives error notifications via SMM communication protocol, classifies them by error source type (1-9), and dispatches to platform-specific handlers that log/report errors to BMC via IPMI/SMM communicate. Manages CPU topology tracking (socket/core/thread) for error source correlation.

Address Range

0x300 - 0x4880 (97 functions)

Module Type

UEFI SMM Driver (SMM_DISPATCH)

Key Functions

Entry Points (Public API)

• 0x5f8 ModuleEntryPoint: Standard UEFI driver entry. Calls sub_3E24 (AutoGen), then sub_42EC (SMM init).

• 0x4364 sub_4364: SMI dispatch callback registered via SmmSwDispatch2. Entry receives a context buffer. Reads error type from buffer offset+12, copies payload data, and dispatches to sub_27E4. Handles 3 protocol GUIDs (unk_5C80, unk_5C90, unk_5CA0).

• 0x4808 sub_4808: Called during sub_4680 init if a hardware flag is set. Registers sub_4854 as an SMI handler for all CPUs.

• 0x4854 sub_4854: SMI handler that clears bit 0 of SMI status register at I/O port 0x790 (1936 dec).

Internal Helpers

Init Sequence (called from sub_3E24 in order):

1. 0x6e8 - Init gImageHandle, gST, gBS globals
2. 0x784 - Init gRT (Runtime Services Table)
3. 0x7c0 - Init gSmst via SmmBase2Protocol (GUID F4CCBFB7-F6E0-47FD-9dd410a8-f150c191)
4. 0xc68 - Init SMM memory ranges via SmmAccessProtocol
5. 0xee4 - (thunk to protocol init)
6. 0xfc0 - Additional protocol init
7. 0x1158 - Protocol init
8. 0x1168 - Protocol init
9. 0x1204 - Protocol init
10. 0x1500 - MP sync data init (CPU topology)
11. 0x1ca0 - EMCA platform hooks init (GUID: 6820ABD4-A292-4817-9147d91d-c8c53542)
12. 0x2520 - Protocol init
13. 0x263c - Protocol init

Core Error Flow (sub_27E4):

SMI dispatch (sub_4364) -> sub_27E4 (error dispatch)

  +-- Error Source 1: sub_2724 (severity classify) -> funcs_27C2[] chain
     chain starts with sub_3628 (MCA error detail) -> sub_31F0 (CSR dump to BMC)

  +-- Error Source 3: sub_33DC (check lock status) -> funcs_29FA[] chain

  +-- Error Source 4: sub_3500 (PCIe error) -> funcs_29AA[] chain

  +-- Error Source 6: sub_37FC loop (generic handler)
  +-- Error Source 7: sub_37FC loop
  +-- Error Source 8: sub_37FC loop
  +-- Error Source 9: sub_37FC loop

State Management

Global Variables (.data segment 0x5B80-0x27780)

MC Bank Tables (selected by CPU model):

• 0x5CB0 - Generic MC bank name table
• 0x5CC0 - MC bank info for CPUs with n4=5..6
• 0x5F40 - MC bank data for CPUs with n4=3..4
• 0x61C0 - MC bank register map

Data Structures

Error Record Buffer Layout

The error record structure (passed as p_n3 / int * in sub_27E4) has the following known offsets:

Error Source Dispatch Table

+--------+----------+--------------------------------------------------+
 Source | Handler  | Description                                      |
+--------+----------+--------------------------------------------------+
 1      | sub_2724 | MCA (Machine Check Architecture) errors          |
        | + chain  | sub_3628 -> sub_31F0 (MCA detail -> CSR dump)    |
 3      | sub_33DC | Corrected/Uncorrected MCA errors                 |
        | + chain  | (funcs_29FA chain, same function list)           |
 4      | sub_3500 | PCIe errors (AER)                                |
        | + chain  | (funcs_29AA chain)                               |
 6      | sub_37FC | Generic CSR errors                               |
 7      | sub_37FC | Generic bus errors                                |
 8      | sub_37FC | Generic I/O errors                                |
 9      | sub_37FC | Generic memory errors                             |
+--------+----------+--------------------------------------------------+

Severity Classification (Error Source 1, sub_2724)

Protocol GUIDs

Calling Patterns

Module Initialization Flow:

ModuleEntryPoint(0x5f8)

  +-> sub_3E24 (AutoGen init)
     +-> sub_6E8    -> gBS/gST init
     +-> sub_784    -> gRT init
     +-> sub_7C0    -> gSmst init (SmmBase2)
     +-> sub_C68    -> SMRAM ranges
     +-> sub_EE4    -> [thunk protocol]
     +-> sub_FC0    -> [protocol]
     +-> sub_1158   -> [protocol]
     +-> sub_1168   -> [protocol]
     +-> sub_1204   -> [protocol]
     +-> sub_1500   -> MP sync data init
     +-> sub_1CA0   -> EMCA platform hooks
     +-> sub_2520   -> [protocol]
     +-> sub_263C   -> [protocol]

  +-> sub_42EC (SMM registration)
        +-> sub_300    -> debug check
        +-> sub_4680   -> SMM protocol registration
              +-> SmmSwDispatch2.Register()
              +-> SmmCommunication.Register()
              +-> sub_4808 (if flag set)
                    +-> SmmSwDispatch2->Register(sub_4854)

Error Handling Flow:

SMM Software SMI (sub_4364)

  +-> Compare GUID at offset+144
     +-- A5BC1114-... -> error source 1 (MCA)
     +-- D995E954-... -> error source 3 (corrected MCA)
     +-- 9876CCAD-... -> error source 4 (PCIe)

  +-> sub_27E4 (error dispatch)

        +-> Log: "ErrorSource: %d, ErrorSeverity: %d"

        +-> switch(error_source):
             case 1: sub_2724 -> severity classify
                        -> funcs_27C2 chain (sub_3628 -> sub_31F0)
             case 3: sub_33DC -> check lock status
                        -> funcs_29FA chain
             case 4: sub_3500 -> PCIe error
                        -> funcs_29AA chain
             case 6-9: sub_37FC loop -> generic CSR report
               (extracts socket/bus/device/function from record)
               -> sub_2F2C (report to BMC via IPMI)

CSR Reporting to BMC (sub_2F2C):

sub_2F2C(socket, bus, dev, func, reg, value)

  +-> Format record (12 bytes):
     [0]: socket
     [1]: bus  
     [2]: dev
     [3]: func
     [4-5]: reg (16-bit)
     [6]: 0x40 (command=64)
     [7-11]: value (32-bit)

  +-> SmmCommunication->Communicate(guid_5C60, cmd=0x2E, data_len=122)
     -> "LnvReportCsrInfoToBmc: Report the Status fail"  (on error)

  +-> DEBUG: "LnvReportCsrInfoToBmc: Socket:%x Bus:%x/%x/%x-%x: 0x%08x"
           (socket, bus, dev, func, reg, value)

Dependencies

Consumed (this module calls protocols)

• gBS->LocateProtocol (BootServices + 320): Used to locate SMM protocols
• SmmBase2Protocol GUID=F4CCBFB7-...: To get gSmst
• gSmst (SmmServicesTable): SmmSwDispatch2->Register, SmmCommunication->Communicate, protocol locate via gSmst+208
• EFI_SMM_ACCESS2_PROTOCOL GUID=C2702B74-...: To query SMRAM ranges
• EFI_SMM_MP_PROTOCOL GUID=A7CED760-...: For multi-processor sync
• EFI_SMM_CPU_IO2_PROTOCOL GUID=0067835F-...: CPU I/O access
• SMM CSR Report Protocol GUID=1DBD1503-...: Send error reports to BMC
• EMCA Platform Hooks GUID=86B091ED-...: Platform-specific error handling
• SMM Variable Protocol GUID=4E2CC220-...: Variable services

Consumed By (other modules call this)

• SMM Core: Calls sub_4364 via SmmSwDispatch2 registered handler
• BMC/IPMI subsystem: Receives error reports via SmmCommunication from sub_2F2C

Notes

1. The module uses SMM Software SMI (SwSmi) for dispatch rather than hardware SMIs. The SMI handler at 0x4364 clears its SMI status bit at port 0x790 after processing.

2. Error severity string "LnvReportCsrInfoToBmc" suggests Lenovo customization for BMC CSR (Configuration Status Register) reporting.

3. The MP sync data at 0x1500 creates a 3D topology mapping (socket x core x thread) indexed by APIC ID, with max 4 sockets, 448 cores per socket, 64 threads per core.

4. The function pointer tables (funcs_27C2, funcs_29AA, funcs_29FA, qword_5408) are sparse arrays terminated by NULL. Only the first entry is populated in each table.

5. MC bank list selection (sub_1BE4) branches on CPU model byte at qword_66A8+1782:

   • n4=3..4: Uses MC bank table at 0x5F40, 6 socket bits, 2 core bits
   • n4=5..6: Uses MC bank table at 0x5CC0, 6 socket bits, 2 core bits

6. The sub_300 function at 0x300 is a debug/release build check (checked via sub_C40/C4C/C58 chain).