Better understanding EC structure, model and firmware naming #98
Replies: 17 comments 63 replies
-
Is it legal to obtain/share/use reverse engineered by C# dotnet binary decompilation? Or at least "Trust me bro" representation without direct sharing result of decompilation |
Beta Was this translation helpful? Give feedback.
-
Please suggest list of apps for MSI laptops and it compatibility:
I'm interested in older ones an it cross compatibility. Each device is supported only by one App, unless the opposite is stated on the support page. Some model supports two Apps, but with different BIOS version. Interesting facts - there are at least 2 or 3 method of accessing EC:
About similar case with WinIO on MSI hardware on Reddit WinIO returns 4 byte for each requested address, 1 current and 3 next. On write WinIO require all 4 bytes as uint32, so usage is quite dangerous if we mess with some important realtime value after it had been changed by hardware. All Apps contain some WMI code called WMI1:
WMI2: (Also shares same BMOF code inside)
MOF code from older Apps is extended in newer with WMI2 section Some EFI vars store info and preferences for model, like Win-FN swap direction. But possibly it's just temp storage. [TODO] |
Beta Was this translation helpful? Give feedback.
-
Info from DSDT table by https://github.com/aymanbagabas/bmf2mof.wasm Technically speaking, I think that MSI app interact with some BIOS backend via WMI, not EC RAM directly, but also part of this code stored inside the driver. MTDE _WDG B2526ED4-CB45-49FA-9230-8D2FE8AFB8EC
notify_id: 4d
reserved: 4b
instance_count: 01
flags: ACPI_WMI_METHOD(0x2)
1E2A0DA0-2B9E-424F-9C87-B1DAC3F4E9DA
notify_id: b0
reserved: 00
instance_count: 01
flags: ACPI_WMI_EVENT(0x8)
05901221-D566-11D1-B2F0-00A0C9062910
notify_id: 4d
reserved: 4d
instance_count: 01
flags: 0x00 SCM0 _WDG 24418D6A-0A79-524C-9AB1-18B78CA68CE7 # MSI_Software
notify_id: 41
reserved: 41
instance_count: 22
flags: ACPI_WMI_EXPENSIVE(0x1)
4AFBD56B-9F91-8F49-81F5-995BA73822AF # MSI_Device
notify_id: 41
reserved: 42
instance_count: 04
flags: ACPI_WMI_EXPENSIVE(0x1)
2D3CBA6C-1C9C-7F41-B54C-F5D5D580D482 # MSI_Power
notify_id: 41
reserved: 43
instance_count: 03
flags: ACPI_WMI_EXPENSIVE(0x1)
40BA026D-075D-CD4A-9710-F7C57347CAC9 # MSI_Master_Battery
notify_id: 41
reserved: 44
instance_count: 10
flags: ACPI_WMI_EXPENSIVE(0x1)
8DBCCF6E-9DB4-0E46-A3F2-99AFAAA77A7A # MSI_Slave_Battery
notify_id: 41
reserved: 45
instance_count: 0e
flags: ACPI_WMI_EXPENSIVE(0x1)
BD2A216F-2FB9-A640-B807-DDDBAD656891 # MSI_CPU
notify_id: 41
reserved: 46
instance_count: 13
flags: ACPI_WMI_EXPENSIVE(0x1)
1EC3EC7A-1E9B-E74A-9026-CF122B0BBD21 # MSI_VGA
notify_id: 41
reserved: 47
instance_count: 12
flags: ACPI_WMI_EXPENSIVE(0x1)
A1753D7B-B621-DE4A-B41A-55716A0ECE7A # MSI_System
notify_id: 41
reserved: 48
instance_count: 15
flags: ACPI_WMI_EXPENSIVE(0x1)
A1753D7C-B621-DE4A-B41A-55716A0ECE7A # MSI_AP
notify_id: 41
reserved: 49
instance_count: 08
flags: ACPI_WMI_EXPENSIVE(0x1)
5B3CC38A-40D9-7245-8AE6-1145B751BE3F # MSI_Event
notify_id: c0
reserved: 00
instance_count: 01
flags: ACPI_WMI_EXPENSIVE(0x1) | ACPI_WMI_EVENT(0x8) WLAN QR01 FC0E0C01-080C-08FA-04FC-0A0DFC0A08FA
notify_id: 06
reserved: 04
instance_count: fc
flags: 00 |
Beta Was this translation helpful? Give feedback.
-
Some obtained data for "New EC/WMI2" (possible Intel) and "Old" (possible AMD). Data from MSI Center Pro (AKA Business) Some settings presented as MWI1 with different from original address Aside from EC addresses program is changing some UEFI vars:
$ efivar -n dd96baaf-145e-4f56-b1cf-193256298e99-MsiDCVarData -p
GUID: dd96baaf-145e-4f56-b1cf-193256298e99
Name: "MsiDCVarData"
Attributes:
Non-Volatile
Boot Service Access
Runtime Service Access
Value:
00000000 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |................|
00000010 00 00 00 00 |.... | Format: hex b bit New:
Old:
WMI1: (address with bit is toggle)
|
Beta Was this translation helpful? Give feedback.
-
Beta Was this translation helpful? Give feedback.
-
@teackot Here is pattern of used addresses from DSDT. Can you share your model name and DSDT dump saved in txt (because Github restricts uploading binary files in issues, or try pastebin) sudo cat /sys/firmware/acpi/tables/DSDT > dsdt.txt In my case there were two EC sequences. ImHex [Remove .txt at the end of filename] five.hexpat.txt Some values are named but unused inside DSDT code, some intersects inside both tables
But anyway many addresses is not highlighted |
Beta Was this translation helpful? Give feedback.
-
BIOS and EC naming:
On EMSn/IMSn - Look like all current generation EC FW are made on 8051-like architecture |
Beta Was this translation helpful? Give feedback.
-
Model to software list
Cases:
Some mode like Commercial or Limited Series are offshots of base models and not shown. |
Beta Was this translation helpful? Give feedback.
-
There are at least 2 or 3 WMI API for different hardware: Intel 12+ gen Business, Gaming, Creator? & AMD Ryzen 7 gen Gaming devices on ITE EC & Intel 11+gen on ENE EC ABBC0F6A-8EA1-11D1-00A0-C90629100000 # Class to test Query/Set a package
notify_id: 41
reserved: 4b
instance_count: 01
flags: ACPI_WMI_EXPENSIVE(0x1)
ABBC0F6B-8EA1-11D1-00A0-C90629100000 # Class to test Query/Set a string
notify_id: 41
reserved: 4c
instance_count: 01
flags: ACPI_WMI_EXPENSIVE(0x1)
ABBC0F6D-8EA1-11D1-00A0-C90629100000 # Class used to operate methods on a package
notify_id: 41
reserved: 4a
instance_count: 01
flags: ACPI_WMI_METHOD(0x2)
ABBC0F6E-8EA1-11D1-00A0-C90629100000 # MSI_ACPI, also "Class used to operate methods on a string" from MS guide
notify_id: 41
reserved: 4d
instance_count: 01
flags: ACPI_WMI_METHOD(0x2)
5B3CC38A-40D9-7245-8AE6-1145B751BE3F # MSI_Event
notify_id: c0
reserved: 00
instance_count: 01
flags: ACPI_WMI_EXPENSIVE(0x1) | ACPI_WMI_EVENT(0x8) AMD Ryzen 5 gen Gaming on ITE EC & Ryzen 4,5,7 gen Business on ENE EC & Intel 10 gen and older on ENE EC
24418D6A-0A79-524C-9AB1-18B78CA68CE7 # MSI_Software
notify_id: 41
reserved: 41
instance_count: 22
flags: ACPI_WMI_EXPENSIVE(0x1)
4AFBD56B-9F91-8F49-81F5-995BA73822AF # MSI_Device
notify_id: 41
reserved: 42
instance_count: 04
flags: ACPI_WMI_EXPENSIVE(0x1)
2D3CBA6C-1C9C-7F41-B54C-F5D5D580D482 # MSI_Power
notify_id: 41
reserved: 43
instance_count: 03
flags: ACPI_WMI_EXPENSIVE(0x1)
40BA026D-075D-CD4A-9710-F7C57347CAC9 # MSI_Master_Battery
notify_id: 41
reserved: 44
instance_count: 10
flags: ACPI_WMI_EXPENSIVE(0x1)
8DBCCF6E-9DB4-0E46-A3F2-99AFAAA77A7A # MSI_Slave_Battery
notify_id: 41
reserved: 45
instance_count: 0e
flags: ACPI_WMI_EXPENSIVE(0x1)
BD2A216F-2FB9-A640-B807-DDDBAD656891 # MSI_CPU
notify_id: 41
reserved: 46
instance_count: 13
flags: ACPI_WMI_EXPENSIVE(0x1)
1EC3EC7A-1E9B-E74A-9026-CF122B0BBD21 # MSI_VGA
notify_id: 41
reserved: 47
instance_count: 12
flags: ACPI_WMI_EXPENSIVE(0x1)
A1753D7B-B621-DE4A-B41A-55716A0ECE7A # MSI_System
notify_id: 41
reserved: 48
instance_count: 15
flags: ACPI_WMI_EXPENSIVE(0x1)
A1753D7C-B621-DE4A-B41A-55716A0ECE7A # MSI_AP
notify_id: 41
reserved: 49
instance_count: 08
flags: ACPI_WMI_EXPENSIVE(0x1)
5B3CC38A-40D9-7245-8AE6-1145B751BE3F # MSI_Event
notify_id: c0
reserved: 00
instance_count: 01
flags: ACPI_WMI_EXPENSIVE(0x1) | ACPI_WMI_EVENT(0x8) |
Beta Was this translation helpful? Give feedback.
-
Today LTT showed new Handheld from MSI and look like it running on ENE EC |
Beta Was this translation helpful? Give feedback.
-
I found awesome module which can read and call ACPI methods. mkottman/acpi_call and newer maintained version nix-community/acpi_call By using this module, ImHex pattern made from DSDT field-structure map we can read required fields.
Drawbacks:
|
Beta Was this translation helpful? Give feedback.
-
Memory "fields" addressing in ACPI, as it turned out, is not linear as you can assume after looking at mapped address space, which look like this: Field (EC, ByteAcc, NoLock, Preserve){
...
a, 8,
b, 1,
c, 3,
, 4,
d, 16,
...
} I've assumed that they are mapped linearly. Possibly, this mode is present, when b = EC[n] & 1;
c = (EC[n] & 0b00001110) >> 1; Correct me if I'm wrong, please. |
Beta Was this translation helpful? Give feedback.
-
Bogus screen brightness events are caused by EC, probably in firmware or even board traces |
Beta Was this translation helpful? Give feedback.
-
Are you still collecting USB PCAP dumps for new hardware? If so, where do we submit them? I have a GE76 which I'm trying to get the keyboard perkey RGB to turn on -- just turning on would be nice, changing colors isn't necessary. |
Beta Was this translation helpful? Give feedback.
-
Probably, it is possible to log WMI commands https://learn.microsoft.com/en-us/windows/win32/wmisdk/tracing-wmi-activity |
Beta Was this translation helpful? Give feedback.
-
PD charger after connection generates next scancodes as generic keyboard:
|
Beta Was this translation helpful? Give feedback.
-
Now we have 4 MSI related modules in kernel:
What we really can do, to not create duplicated projects? |
Beta Was this translation helpful? Give feedback.
-
Preamble
Thanks all who shared EC dumps.
For better readability screenshots made with this HexPat
Model naming
Model name regularly contain display size and CPU generation. For newer devices is easy to spot as part of model name something like 10-11-12-13... for Intel 10+gen based and 3-4-5-7... for AMD Ryzen based CPU/SoC. Older Intel i3/i5/i7 based devices follows same rule but it submission to this repo is rare. Some models submitted without EC dump or full name.
EC firmware naming
Most fresh models named like
abcdEMS1.ver
, whereab
frequently but not always equals to screen diagonal,bc
is some model code,EMS1
is something,ver
is version number.Some models have
xxxxEMS2
or different code but it structure seems near the sameSeems that
xxxx
part in EC name is mainboard or model codename.Look at the value
Motherboard -> Model
and compare it toBIOS Version
.Source #66 @benitozh
Intel VS AMD
Intel 10+gen have shift, backlight, fan settings on
0xD_
addresses.AMD Ryzen models - on
0xF_
addresses.Older Intel requires more data and research.
[For now] Unusual models
16K2ED61.101
not likexxxxEMS1
#8817G1EMS2.106
withEMS2
#82Older models
Very unusual model+release datetime from #35
168AEMS1 Ver4.04, 05/31/2010
but followsxxxxEMS1
patternExperiments [DO NOT RETRY it can destroy your hardware]
If I understood correctly in #64 @vt92i tried to fix broken keyboard backlight. For this he wrote
0xFF
to all EC registers and this somehow impacted some default values, some of them seemedreadonly
but some wasread/wright
.Highlighted values with binary pattern
?4
. Some other values are changed too, like datetime in EC name/Deltas
Very similar AMD based devices.
Some values could be ignored, but range
0x30-4f
looks interesting.AMD based device with EC name
IMS1
look similar to Intel based device withEMS1
(which is more submitted)In many cases
EMS1
AMD and Intel devices is less compatibleIf you have model with different from usual
xxxxEMS1.ver
EC firmware name please send it dumpBeta Was this translation helpful? Give feedback.
All reactions