Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1636758 > unrolled thread

RE: RFC: WMI Enhancements

Started by<Mario.Limonciello@dell.com>
First post2017-05-06 00:00 +0200
Last post2017-05-09 21:30 +0200
Articles 5 on this page of 25 — 5 participants

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-06 00:00 +0200
    Re: RFC: WMI Enhancements Darren Hart <dvhart@infradead.org> - 2017-05-06 01:50 +0200
      RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-06 03:00 +0200
        Re: RFC: WMI Enhancements Andy Lutomirski <luto@kernel.org> - 2017-05-06 03:30 +0200
          Re: RFC: WMI Enhancements Darren Hart <dvhart@infradead.org> - 2017-05-08 17:30 +0200
            RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-08 17:40 +0200
              Re: RFC: WMI Enhancements Darren Hart <dvhart@infradead.org> - 2017-05-08 17:50 +0200
                Re: RFC: WMI Enhancements Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-05-08 18:10 +0200
                  RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-08 21:00 +0200
                    Re: RFC: WMI Enhancements Darren Hart <dvhart@infradead.org> - 2017-05-08 21:10 +0200
                      RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-08 21:20 +0200
                RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-08 18:10 +0200
    Re: RFC: WMI Enhancements Pali Rohár <pali.rohar@gmail.com> - 2017-05-08 19:20 +0200
      RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-08 21:30 +0200
        Re: RFC: WMI Enhancements Pali Rohár <pali.rohar@gmail.com> - 2017-05-08 23:10 +0200
          RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-08 23:20 +0200
            Re: RFC: WMI Enhancements Pali Rohár <pali.rohar@gmail.com> - 2017-05-09 00:20 +0200
              RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-09 03:20 +0200
                Re: RFC: WMI Enhancements Pali Rohár <pali.rohar@gmail.com> - 2017-05-09 09:40 +0200
                  RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-09 20:20 +0200
                    Re: RFC: WMI Enhancements Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-05-09 21:10 +0200
                      RE: RFC: WMI Enhancements <Mario.Limonciello@dell.com> - 2017-05-09 21:20 +0200
                        Re: RFC: WMI Enhancements Andy Shevchenko <andy.shevchenko@gmail.com> - 2017-05-09 21:30 +0200
                          Re: RFC: WMI Enhancements Pali Rohár <pali.rohar@gmail.com> - 2017-05-10 00:40 +0200
                      Re: RFC: WMI Enhancements Pali Rohár <pali.rohar@gmail.com> - 2017-05-09 21:30 +0200

Page 2 of 2 — ← Prev page 1 [2]

#1638353

FromAndy Shevchenko <andy.shevchenko@gmail.com>
Date2017-05-09 21:10 +0200
Message-ID<tFiGe-5YT-9@gated-at.bofh.it>
In reply to#1638329
On Tue, May 9, 2017 at 9:10 PM,  <Mario.Limonciello@dell.com> wrote:

>> > > Then took relevant decompression code and it really decompressed that
>> > > binary MOF WMI buffer. But still decompressed format is binary, but I
>> > > now see all WMI GUID encoded in UTF-16. Decompressed BMF file has again
>> > > "FOMB" magic header.
>> >
>> > Well that's great.  Is it possible that this compression is used for every time
>> > a class was declared?
>>
>> Looks like not. That decompressed output seems to be not compressed
>> anymore. Just use same magic header.
> Actually it looks like a new magic header to me after decompressed.
>
> 46 4f 4d 42 54 15 00 00  01 00 00 00 01 00 00 00
> That's now FOMBT

I think you just mistakenly take 0x54 as letter when it looks more like

0x00001554
0x00000001
0x00000001

from the above dump.

-- 
With Best Regards,
Andy Shevchenko

[toc] | [prev] | [next] | [standalone]

#1638365

From<Mario.Limonciello@dell.com>
Date2017-05-09 21:20 +0200
Message-ID<tFiPT-62w-3@gated-at.bofh.it>
In reply to#1638353
> -----Original Message-----
> From: Andy Shevchenko [mailto:andy.shevchenko@gmail.com]
> Sent: Tuesday, May 9, 2017 2:04 PM
> To: Limonciello, Mario <Mario_Limonciello@Dell.com>
> Cc: Pali Rohár <pali.rohar@gmail.com>; dvhart@infradead.org; Rafael J. Wysocki
> <rjw@rjwysocki.net>; Andy Lutomirski <luto@amacapital.net>; Brown, Len
> <len.brown@intel.com>; Corentin Chary <corentin.chary@gmail.com>; Andy
> Lutomirski <luto@kernel.org>; Andy Shevchenko
> <andriy.shevchenko@linux.intel.com>; linux-kernel@vger.kernel.org; Platform
> Driver <platform-driver-x86@vger.kernel.org>; linux-pm@vger.kernel.org
> Subject: Re: RFC: WMI Enhancements
> 
> On Tue, May 9, 2017 at 9:10 PM,  <Mario.Limonciello@dell.com> wrote:
> 
> >> > > Then took relevant decompression code and it really decompressed that
> >> > > binary MOF WMI buffer. But still decompressed format is binary, but I
> >> > > now see all WMI GUID encoded in UTF-16. Decompressed BMF file has again
> >> > > "FOMB" magic header.
> >> >
> >> > Well that's great.  Is it possible that this compression is used for every time
> >> > a class was declared?
> >>
> >> Looks like not. That decompressed output seems to be not compressed
> >> anymore. Just use same magic header.
> > Actually it looks like a new magic header to me after decompressed.
> >
> > 46 4f 4d 42 54 15 00 00  01 00 00 00 01 00 00 00
> > That's now FOMBT
> 
> I think you just mistakenly take 0x54 as letter when it looks more like
> 
> 0x00001554
> 0x00000001
> 0x00000001
> 
> from the above dump.
Ah, that's true, but second word is different than original was main point.
We didn't know what that represented (maybe it's part of magic header).

46 4f 4d 42 01 00 00 00  ed 04 00 00 d8 15 00 00
0x00000001

> --
> With Best Regards,
> Andy Shevchenko

[toc] | [prev] | [next] | [standalone]

#1638372

FromAndy Shevchenko <andy.shevchenko@gmail.com>
Date2017-05-09 21:30 +0200
Message-ID<tFiZA-66p-13@gated-at.bofh.it>
In reply to#1638365
On Tue, May 9, 2017 at 10:16 PM,  <Mario.Limonciello@dell.com> wrote:


>> > 46 4f 4d 42 54 15 00 00  01 00 00 00 01 00 00 00
>> > That's now FOMBT
>>
>> I think you just mistakenly take 0x54 as letter when it looks more like
>>

>> 0x00001554

This one looks like offset (or size 5460)

>> 0x00000001
>> 0x00000001
>>
>> from the above dump.
> Ah, that's true, but second word is different than original was main point.
> We didn't know what that represented (maybe it's part of magic header).
>

> 46 4f 4d 42 01 00 00 00  ed 04 00 00 d8 15 00 00
> 0x00000001

0x000015d8

Again, looks like offset (or size).

0x000004ed



-- 
With Best Regards,
Andy Shevchenko

[toc] | [prev] | [next] | [standalone]

#1638425

FromPali Rohár <pali.rohar@gmail.com>
Date2017-05-10 00:40 +0200
Message-ID<tFlXs-82p-1@gated-at.bofh.it>
In reply to#1638372

[Multipart message — attachments visible in raw view] — view raw

I updated my bmfdec.c (git://github.com/pali/bmfdec.git) and here is
guessed header description:

/*
 * BMF file is compressed by DS-01 algorithm with additional header:
 * 4 bytes: 46 4f 4d 42 - 'F' 'O' 'M' 'B'
 * 4 bytes: 01 00 00 00 - version 0x01
 * 4 bytes: size of compressed data (low endian) without this header
 * 4 bytes: size of decompressed data (low endian) without this header
 */

/*
 * Decompressed part of BMF file contains:
 * 4 bytes: 46 4f 4d 42 - 'F' 'O' 'M' 'B'
 * 4 bytes: N = size of first part (low endian) since beginning
 * N-8 bytes: first part data
 * 16 bytes: 42 4d 4f 46 51 55 41 4c 46 4c 41 56 4f 52 31 31 - "BMOFQUALFLAVOR11"
 * M bytes: second part data of unknown length
 */

First part of decompressed data contains UTF-16 strings terminated by
two zero bytes and between two strings are some binary data. Those
strings are just literals found in decompiled MOF file, so looks like
binary parts just decodes types and MOF language keywords.

And it looks like second part is not required and sometimes missing.
It contains only binary data, no idea what is there.

Now somebody with knowledge of MOF language should be able to describe
what and how is stored in first part.

-- 
Pali Rohár
pali.rohar@gmail.com

[toc] | [prev] | [next] | [standalone]

#1638368

FromPali Rohár <pali.rohar@gmail.com>
Date2017-05-09 21:30 +0200
Message-ID<tFiZz-66p-3@gated-at.bofh.it>
In reply to#1638353

[Multipart message — attachments visible in raw view] — view raw

On Tuesday 09 May 2017 21:04:15 Andy Shevchenko wrote:
> On Tue, May 9, 2017 at 9:10 PM,  <Mario.Limonciello@dell.com> wrote:
> >> > > Then took relevant decompression code and it really
> >> > > decompressed that binary MOF WMI buffer. But still
> >> > > decompressed format is binary, but I now see all WMI GUID
> >> > > encoded in UTF-16. Decompressed BMF file has again "FOMB"
> >> > > magic header.
> >> > 
> >> > Well that's great.  Is it possible that this compression is used
> >> > for every time a class was declared?
> >> 
> >> Looks like not. That decompressed output seems to be not
> >> compressed anymore. Just use same magic header.
> > 
> > Actually it looks like a new magic header to me after decompressed.
> > 
> > 46 4f 4d 42 54 15 00 00  01 00 00 00 01 00 00 00
> > That's now FOMBT
> 
> I think you just mistakenly take 0x54 as letter when it looks more
> like
> 
> 0x00001554
> 0x00000001
> 0x00000001
> 
> from the above dump.

I looked at more decompressed BMF dumps from ACPI WMI and they have 
different 5th and 6th bytes. So they are really not FOMBT.

46 4f 4d 42 26 35 00 00 01 00 00 00 01 00 00 00
46 4f 4d 42 fa 17 00 00 01 00 00 00 01 00 00 00
46 4f 4d 42 8e 11 00 00 01 00 00 00 01 00 00 00
46 4f 4d 42 ac 1b 00 00 01 00 00 00 01 00 00 00

So magic is only FOMB.

-- 
Pali Rohár
pali.rohar@gmail.com

[toc] | [prev] | [standalone]

Page 2 of 2 — ← Prev page 1 [2]

Back to top | Article view | linux.kernel

csiph-web