Hello from msi-ec

[glpnk]

We have bunch of research data which might help you:

• Better understanding EC structure, model and firmware naming BeardOverflow/msi-ec#98
• https://github.com/BeardOverflow/msi-ec/blob/main/docs/device_support_guide.md
• Quick fixes BeardOverflow/msi-ec#130

List of supported devices with linked issues:

• Supported device list [Device-> issue/PR list] BeardOverflow/msi-ec#277

[glpnk]

For majority of devices you support you can get rid of kernel driver and use only WMI, but only for Generation 2 devices, which MSI call WMI2

[Sparronator9999]

Oh, this was a bit unexpected. Hello!

I actually already had a look at the MSI EC project before, that's how I implemented the Fan Mode feature. But thanks for the links, I will be looking at them again at some point.

For majority of devices you support you can get rid of kernel driver and use only WMI, but only for Generation 2 devices, which MSI call WMI2

I have absolutely no idea how to call WMI for MSI laptops, or if the temperature thresholds (as far as I can tell, a unique feature to YAMDCC) are even supported via WMI. If you have more information, please reply.

EDIT: Knowing how to read/write the EC using WMI would be very beneficial to this project, as the current way it is done is through a kernel driver (as you pointed out). This works, but comes with stability issues that I haven't been able to fix that manifest as anything from the fan profile not applying correctly (mainly after waking from sleep), to the battery state exhibiting various issues (laptop thinking it has no battery installed, thinking it is plugged in when it is not, and even registering as having >100% charge when checked with BatteryInfoView), to disabling the fans entirely (the latter two cases require an EC reset). I wish I had screenshots for some of these, because all of the above have happened from my personal usage of YAMDCC.

Also, there's the fact that Microsoft recently decided that WinRing0 was insecure enough to the point of blocking it with Windows Defender (and likely other antiviruses picked up on this as well), despite my... borrowed workaround.

[glpnk]

WMI is mapped to next addresses (check pics). Map is sourced from DSDT tables of some devices. For calling WMI on MSI laptops you need to install .mof file, which maps ACPI methods to WMI space. Often this file is built in ACPI tables (DSDT), but MSI share it in drivers. You can find decompiled version in 98 issue.

Sadly, not all addresses are mapped on older WMI1 devices.

• GUIDs Better understanding EC structure, model and firmware naming BeardOverflow/msi-ec#98 (comment)
• Full mof Better understanding EC structure, model and firmware naming BeardOverflow/msi-ec#98 (reply in thread)

Also:

• Linux driver for lm-sensors which reads RPM on WMI2 devices https://github.com/torvalds/linux/blob/master/drivers/platform/x86/msi-wmi-platform.c

[Sparronator9999]

So what do the numbers in each EC entry mean? I shouldn't have much trouble calling the WMI functions once I install the MOF DLL, but I'm unsure how to actually read/write the specific registers (obviously the colours correspond to a WMI method to call).

EDIT: in particular, I want to know the WMI2 methods first, so I can get my laptop working first.

[glpnk]

You can't get rid of WinIO/WinRing0 driver for WMI1, without removing some functionality, like battery limit, cooler boost, FN-WIN swap (at least instant)

But this functions are not really necessary, you can make it optional to load

[glpnk]

As Linux GUI we use MControlCenter, which is currently being updated https://github.com/dmitry-s93/MControlCenter

[glpnk]

About battery issues you've mentioned - not sure what you trying to write, or what is really being written, because last time I experimented with Windows, I had ability to only write 4 byte blocks, which is dumb and unsafe.

[Sparronator9999]

What I meant is that I think my EC access conflicts with the OS's EC access (i.e. a race condition). Basically if my service accesses the EC at the same time as the OS does, my service may end up inadvertently writing to the wrong EC register, for example. But that's just a theory. I agree that is is probably unsafe, but it's the only way I can achieve EC access currently*.

*was typing on phone and accidentally closed the issue...

[Wer-Wolf]

This seems to be result of bad coding style, where in some place they used class methods, in other - access by address.

I've had a look at the decompiled code for Feature Manager (MSI Center for a Turkish sub-vendor), and the code is pretty messy (that could be the result of ILSpy decompilation however).

I can assure you that decompiling .Net bytecode nearly replicates the original source code.

[Sparronator9999]

I can assure you that decompiling .Net bytecode nearly replicates the original source code.

I nearly lost some source code for OpenBootCamp once (before I published it on GitHub), but ILSpy saved me lol (the only thing I lost were variable names and comments, as well as some minor code style differences).

[glpnk]

I can assure you that decompiling .Net bytecode nearly replicates the original source code.

I've tried to understand spaghetti from modules, client-server architecture and other overcomplication

---

WMI2-s mapped addresses

• Red - bits from byte
• Orange - whole bytes

---

This looks like hardcoded Cooler Boost match

If ((IPAR == 0x98))
                    {
                        If ((\_SB.PC00.LPCB.EC0.FANT == Zero))
                        {
                            BL01 = (\_SB.PC00.LPCB.EC0.FANT << Zero)
                        }

                        If ((\_SB.PC00.LPCB.EC0.FANT == One))
                        {
                            BL01 = (\_SB.PC00.LPCB.EC0.FANT << 0x07)
                        }
                    }

Need to re-paginate it

[glpnk]

Literally Shift, Backlight and Fan

Spoiled ASL

If ((IPAR == 0xD2))
                    {
                        If ((BS00 == 0xC4))
                        {
                            \_SB.PC00.LPCB.EC0.QTMD = One
                        }

                        If ((BS00 == 0xC1))
                        {
                            \_SB.PC00.LPCB.EC0.QTMD = Zero
                        }

                        If ((BS00 == 0xC2))
                        {
                            \_SB.PC00.LPCB.EC0.QTMD = 0x02
                            \_SB.PC00.LPCB.EC0.KBBR = Zero
                        }

                        SSFM (Zero, \_SB.PC00.LPCB.EC0.QTMD)
                        SSFM (One, Zero)
                    }

                    If ((IPAR == 0xD3))
                    {
                        If ((BS00 == 0x80))
                        {
                            \_SB.PC00.LPCB.EC0.KBBR = Zero
                        }

                        If ((BS00 == 0x81))
                        {
                            \_SB.PC00.LPCB.EC0.KBBR = One
                        }

                        If ((BS00 == 0x82))
                        {
                            \_SB.PC00.LPCB.EC0.KBBR = 0x02
                        }

                        If ((BS00 == 0x83))
                        {
                            \_SB.PC00.LPCB.EC0.KBBR = 0x03
                        }

                        If ((BS00 == 0x84))
                        {
                            \_SB.PC00.LPCB.EC0.KBBR = 0x04
                        }
                    }

                    If ((IPAR == 0xD4))
                    {
                        If ((BS00 == 0x10))
                        {
                            If ((\_SB.PC00.LPCB.EC0.QTMD == Zero))
                            {
                                \_SB.PC00.LPCB.EC0.QTMD = 0x02
                                SSFM (Zero, \_SB.PC00.LPCB.EC0.QTMD)
                                SSFM (One, Zero)
                            }
                        }
                    }

[glpnk]

@Wer-Wolf seems I've extracted all available ACPI table from that device BIOS, do you need them?

There are 48 SSDTs, many of which have identical objects

[glpnk]

Laptops have keyboard backlight register, and devices with RGB keyboards should have disabled backlight regulator logic.

For long time I had question - why this happens. But then I discovered that few devices under same EC name might have single- and RGB colored backlight.

For mute leds - you probably can subscribe to Windows audio stack issues and write to led bits. On Linux we have problem, because audio stack often don't mark sound device as primary, so kernel don't monitor it's state.

[glpnk]

Have you seen reddit post with "check backdoor" function? EC is accessible not only through EC calls, but it's mapped to system memory space, which you can read/write on Linux and Windows (highly unsafe, but used you know where).

• https://www.reddit.com/r/MSILaptops/comments/n1pthe/question_what_is_checkbackdoor/

[glpnk]

If you've used ImHex you can try to use my patterns, which maps dump to WMI-like arrays https://github.com/glpnk/hexpats

[glpnk]

Would be fun if you implement WMI events. You need to enable events with some bit and subscribe to events class

[Sparronator9999]

Okay, sorry for the delay in replying. This will be a long one.

WMI is mapped to next addresses (check pics)

Do you know which laptops use WMI1 specifically? Is it all the old pre-10th-gen Intel laptops, or even older than that?

As Linux GUI we use MControlCenter, which is currently being updated https://github.com/dmitry-s93/MControlCenter

I have heard of this project before (it's even linked somewhere as an alternative for Linux users).

Laptops have keyboard backlight register, and devices with RGB keyboards should have disabled backlight regulator logic.

Yes, this is how I control keyboard backlight through YAMDCC. Currently I don't detect which laptops have this functionality (well, I sort of do, but it could be better), but it appears that the MSB of register 0xD3 is always set for laptops that have monochrome keyboard backlights, but isn't for laptops with RGB backlights (and possibly ones without a backlight at all, if they somehow exist).

For mute leds - you probably can subscribe to Windows audio stack issues and write to led bits. On Linux we have problem, because audio stack often don't mark sound device as primary, so kernel don't monitor it's state.

I can look into this at some point if I have time.

Have you seen reddit post with "check backdoor" function? EC is accessible not only through EC calls, but it's mapped to system memory space, which you can read/write on Linux and Windows

I have not heard of this function, and I've decompiled Feature Manager (basically MSI Center for the Turkish, who have stricter privacy/data collection laws) to try to understand the GPU switch feature.

(highly unsafe, but used you know where).

I don't.

(...you're not talking about YAMDCC, are you??)

If you've used ImHex you can try to use my patterns, which maps dump to WMI-like arrays https://github.com/glpnk/hexpats

I haven't used ImHex (HxD is my current hex editor).

Would be fun if you implement WMI events. You need to enable events with some bit and subscribe to events class

Not sure what they would be useful for (note to self: look at the WMI mappings again lol)

[Sparronator9999]

Oh.

The fan mode register appears to be left over from an old version of Dragon Center which had a single slider for basic mode, if I remember correctly (don't quote me on that however). I have no idea if it even still works on WMI2 laptops, but I added it anyway because it allowed me to deprecate a config option that allowed arbitrary EC write if a bad YAMDCC config were to be loaded.

[glpnk]

Be sure, it really works and i can show how later

[glpnk]

EDIT: I have also come across a "Gen 2.5" (or "Gen 3", depending on the number of changes) laptop that stores the temperature down threshold in the EC differently.

Can you mention exact model/config/issue?

[Sparronator9999]

The laptop in question is an MSI Vector 16 HX AI A2XWIG, and the only difference I've found so far is the temperature down threshold storage. The YAMDCC config is located here. The only difference between this config and any other one (apart from fan profiles and sometimes EC registers) is the option OffsetDT, which is set to false in this config, when it is true by default (and in older YAMDCC versions).

[glpnk]

Eh, this (#76) seems to be regular EC design, maybe with some bugs and quirks, but standard.

[Sparronator9999]

Okay, I had a look at the full decompiled MOF table. Assuming I can get WMI access working, would it be OK for me to incorporate those MOF definitions into YAMDCC directly? I can give @Wer-Wolf and/or the msi-ec team a shoutout in a special thanks section of some description (README/in-app?)

Also, do those MOF definitions work on both WMI1 and WMI2 laptops? Or do I need a separate one for WMI1 and WMI2 laptops?

[Sparronator9999]

Oh, it's an official app? Wow, didn't expect that lol. Anyways, this installation of Windows has never seen MSI Center, so I don't think I'll find anything.

[glpnk]

Before Center named apps and WMI2, MSI used different MOF with WMI1 exclusively in their MSI SCM, you can find it here (Spoiler: MOF from MSI SCM) BeardOverflow/msi-ec#98 (reply in thread)

[Sparronator9999]

That MOF looks eerily familiar to the one found in this project (except without the #pragma namespaces).

[glpnk]

I'll check will Windows 10 load unsigned MOF or fail after cleanup

[glpnk]

It worked. Would be interesting to sideload own SSDT table, which will add WMI2 interface to WMI1 devices

[glpnk]

You've dig into UEFI variables. One of them is intended for persistence of settings after reboot. It is "MsiDCVarData". But I've only found how to swap win-fn and (un)hide this option from bios

[Sparronator9999]

I've looked at this UEFI variable before (and successfully been able to write to it), but that was while I was attempting to RE the dGPU option.

[Wer-Wolf]

I am currently working with another developer to extend the msi-wmi-platform linux driver which uses the WMI2 interface, see here.

At least on the MSI Claw this UEFI variable contains the following data:

• Offset 0x1: Set to 1 when the MSI software loads
• Offset 0x6: 0 when overboost is enabled, 1 otherwise (could be an error)
• Offset 0x7: True when overboost is supported

[Sparronator9999]

Does "overboost" refer to Cooler Boost (i.e. set all fans to max speed), or something else?

[glpnk]

Cooler Boost is just "emergency" mode in fan controller, which bypasses other control methods

[glpnk]

MSI center S isn't exclusive to WMI2-S devices, but supports regular WMI2 BeardOverflow/msi-ec#311 (comment)

[glpnk]

This device have AMI bios, but doesn't support custom fan curve at all. Plus it always spin fans

[glpnk]

For proper functioning, this device require to set SCM bit BeardOverflow/msi-ec#311 (comment)

[glpnk]

@Sparronator9999 Hi, can you add ASCII preview to dump for ec-inspect dump tool used in this guide

I will mention this method in msi-ec guide

[Sparronator9999]

Uh, I thought I already did that? That was one of the reasons I made ec-inspect in the first place, another being to replace ec-probe from NoteBook FanControl.

EDIT: Oh, you're talking about my config guide. That hasn't been updated for a very long time.

[glpnk]

Okay, please update it, because I'm linking it in support request

[Sparronator9999]

It is already done.

[glpnk]

Thanks

[glpnk]

@Sparronator9999 hi, pls reply in matrix

[Sparronator9999]

Done.

Note that I don't usually keep my Matrix client open (unlike 100% of people I know that use Discord), and email notifications (which i explicitly enabled) don't work for me for some reason. Plus, this thing called timezones.

[glpnk]

Note that I don't usually keep my Matrix client open

That's normal, I have ~all notification disabled and orienting on "tab updated" marker in browser and message counter in taskbar

Plus, this thing called timezones.

That's incredible that you replying that early. Sometimes less different time zones create more problems.

[Sparronator9999]

That's incredible that you replying that early. Sometimes less different time zones create more problems.

Early bird (it was about 6am when I woke up).