1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
|
.. SPDX-License-Identifier: GPL-2.0-or-later
========================================
Bitland MIFS driver (bitland-mifs-wmi)
========================================
Introduction
============
EC WMI interface description
============================
The EC WMI interface description can be decoded from the embedded binary MOF (bmof)
data using the `bmfdec <https://github.com/pali/bmfdec>`_ utility:
::
class WMIEvent : __ExtrinsicEvent {
};
[WMI, Dynamic, Provider("WmiProv"), Locale("MS\\0x40A"), Description("Root WMI HID_EVENT20"), guid("{46c93e13-ee9b-4262-8488-563bca757fef}")]
class HID_EVENT20 : WmiEvent {
[key, read] string InstanceName;
[read] boolean Active;
[WmiDataId(1), read, write, Description("Package Data")] uint8 EventDetail[8];
};
[WMI, Dynamic, Provider("WmiProv"), Locale("MS\\0x40A"), Description("Root WMI HID_EVENT21"), guid("{fa78e245-2c0f-4ca1-91cf-15f34e474850}")]
class HID_EVENT21 : WmiEvent {
[key, read] string InstanceName;
[read] boolean Active;
[WmiDataId(1), read, write, Description("Package Data")] uint8 EventDetail[8];
};
[WMI, Dynamic, Provider("WmiProv"), Locale("MS\\0x40A"), Description("Root WMI HID_EVENT22"), guid("{1dceaf0a-4d63-44bb-bd0c-0d6281bfddc5}")]
class HID_EVENT22 : WmiEvent {
[key, read] string InstanceName;
[read] boolean Active;
[WmiDataId(1), read, write, Description("Package Data")] uint8 EventDetail[8];
};
[WMI, Dynamic, Provider("WmiProv"), Locale("MS\\0x40A"), Description("Root WMI HID_EVENT23"), guid("{3f9e3c26-b077-4f86-91f5-37ff64d8c7ed}")]
class HID_EVENT23 : WmiEvent {
[key, read] string InstanceName;
[read] boolean Active;
[WmiDataId(1), read, write, Description("Package Data")] uint8 EventDetail[8];
};
[WMI, Dynamic, provider("WmiProv"), Locale("MS\\0x409"), Description("Class used to operate firmware interface"), guid("{b60bfb48-3e5b-49e4-a0e9-8cffe1b3434b}")]
class MICommonInterface {
[key, read] string InstanceName;
[read] boolean Active;
[WmiMethodId(1), Implemented, read, write, Description("Method used to support system functions.")] void MiInterface([in, Description("WMI Interface")] uint8 InData[32], [out] uint8 OutData[30], [out] uint16 Reserved);
};
Reverse-Engineering the EC WMI interface
========================================
The OEM software can be download from `this link <https://iknow.lenovo.com.cn/detail/429447>`_
Nothing is obfuscated, In this case, `ILSpy <https://github.com/icsharpcode/ILSpy>`_ could be helpful.
WMI Methods (MICommonInterface)
========================================
The ``MICommonInterface`` class (GUID: ``{b60bfb48-3e5b-49e4-a0e9-8cffe1b3434b}``)
is the primary control interface. It uses a 32-byte buffer for both input
(``InData``) and output (``OutData``).
Method Structure
----------------
The data packet follows a standardized format:
+----------+------------------------------------------------------------------+
| Byte | Description |
+==========+==================================================================+
| 1 | Method Type: Get (0xFA / 250) or Set (0xFB / 251) |
+----------+------------------------------------------------------------------+
| 3 | Command ID (Method Name) |
+----------+------------------------------------------------------------------+
| 4 - 31 | Arguments (for Set) or Return Data (for Get) |
+----------+------------------------------------------------------------------+
Command IDs
-----------
The following Command IDs are used in the third byte of the buffer:
+----------+-----------------------+------------------------------------------+
| ID | Name | Values / Description |
+==========+=======================+==========================================+
| 8 | SystemPerMode | 0: Balance, 1: Performance, 2: Quiet, |
| | | 3: Full-speed |
+----------+-----------------------+------------------------------------------+
| 9 | GPUMode | 0: Hybrid, 1: Discrete, 2: UMA |
+----------+-----------------------+------------------------------------------+
| 10 | KeyboardType | 0: White, 1: Single RGB, 2: Zone RGB |
+----------+-----------------------+------------------------------------------+
| 11 | FnLock | 0: Off, 1: On |
+----------+-----------------------+------------------------------------------+
| 12 | TPLock | 0: Unlock, 1: Lock (Touchpad) |
+----------+-----------------------+------------------------------------------+
| 13 | CPUGPUSYSFanSpeed | Returns 12 bytes of fan data: |
| | | Bytes 4-5: CPU Fan RPM (Little Endian) |
| | | Bytes 6-7: GPU Fan RPM (Little Endian) |
| | | Bytes 10-11: SYS Fan RPM (Little Endian) |
+----------+-----------------------+------------------------------------------+
| 16 | RGBKeyboardMode | 0: Off, 1: Auto Cyclic, 2: Fixed, |
| | | 3: Custom |
+----------+-----------------------+------------------------------------------+
| 17 | RGBKeyboardColor | Bytes 4, 5, 6: Red, Green, Blue values |
+----------+-----------------------+------------------------------------------+
| 18 | RGBKeyboardBrightness | 0-10: Brightness Levels, 128: Auto |
+----------+-----------------------+------------------------------------------+
| 19 | SystemAcType | 1: Type-C, 2: Circular Hole (DC) |
+----------+-----------------------+------------------------------------------+
| 20 | MaxFanSpeedSwitch | Byte 4: Fan Type (0: CPU/GPU, 1: SYS) |
| | | Byte 5: State (0: Off, 1: On) |
+----------+-----------------------+------------------------------------------+
| 21 | MaxFanSpeed | Sets manual fan speed duty cycle |
+----------+-----------------------+------------------------------------------+
| 22 | CPUThermometer | Returns CPU Temperature |
+----------+-----------------------+------------------------------------------+
WMI Events (HID_EVENT20)
========================
The driver listens for events from the ``HID_EVENT20`` class
(GUID: ``{46c93e13-ee9b-4262-8488-563bca757fef}``). These events are triggered
by hotkeys or system state changes (e.g., plugging in AC power).
Event Structure
---------------
The event data is provided in an 8-byte array (``EventDetail``):
+----------+------------------------------------------------------------------+
| Byte | Description |
+==========+==================================================================+
| 0 | Event Type (Always 0x01 for HotKey/Notification) |
+----------+------------------------------------------------------------------+
| 1 | Event ID (Corresponds to the Command IDs above) |
+----------+------------------------------------------------------------------+
| 2 | Value (The new state or value of the feature) |
+----------+------------------------------------------------------------------+
Common Event IDs:
-----------------
Note: reserved event ids are not listed there
+----------+------------------------------------------------------------------+
| Event Id | Description |
+==========+==================================================================+
| 4 | AirPlane mode change |
+----------+------------------------------------------------------------------+
| 5 | Keyboard brightness change |
+----------+------------------------------------------------------------------+
| 6 | Touchpad state (enabled/disabled) change |
+----------+------------------------------------------------------------------+
| 7 | FnLock state (enabled/disabled) change |
+----------+------------------------------------------------------------------+
| 8 | Keyboard mode change |
+----------+------------------------------------------------------------------+
| 9 | CapsLock state change |
+----------+------------------------------------------------------------------+
| 13 | NumLock state change |
+----------+------------------------------------------------------------------+
| 14 | ScrollLock state change |
+----------+------------------------------------------------------------------+
| 15 | Performance plan change |
+----------+------------------------------------------------------------------+
| 25 | Display refresh rate change |
+----------+------------------------------------------------------------------+
| 33 | Super key lock state (enabled/disabled) change |
+----------+------------------------------------------------------------------+
| 35 | Open control center key |
+----------+------------------------------------------------------------------+
Implementation Details
======================
Performance Modes
-----------------
Changing the performance mode via Command ID 0x08 (SystemPerMode) affects the
power limits (PL1/PL2) and fan curves managed by the Embedded Controller (EC).
Note that the "Full-speed" and "Performance" mode (1, 3) is typically only
available when the system is connected to a DC power source (not USB-C/PD).
In the driver implementation, switch to performance/full-speed mode without
DC power connected will throw the EOPNOTSUPP error.
Graphics Switching
------------------
The ``GPUMode`` (0x09) allows switching between Hybrid (Muxless) and Discrete
(Muxed) graphics. Changing this value usually requires a system reboot to
take effect in the BIOS/Firmware.
Fan Control
-----------
The system supports both automatic EC control and manual overrides. Command ID
0x14 (``MaxFanSpeedSwitch``) is used to toggle manual control, while ID 0x15
sets the actual PWM duty cycle.
|
