linux-kernel - Re: In-kernel parser for the BMOF format used by WMI-ACPI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <D8E0QXRHRR61.2WEESGHZM0RM7@gmail.com>
Date: Tue, 11 Mar 2025 23:56:07 -0500
From: "Kurt Borja" <kuurtb@...il.com>
To: "Armin Wolf" <W_Armin@....de>, Pali Rohár
 <pali@...nel.org>, "linux@...ssschuh.net" <linux@...ssschuh.net>,
 <akpm@...ux-foundation.org>, <mcgrof@...nel.org>, <russ.weight@...ux.dev>,
 <dakr@...nel.org>
Cc: "platform-driver-x86@...r.kernel.org"
 <platform-driver-x86@...r.kernel.org>, "LKML"
 <linux-kernel@...r.kernel.org>
Subject: Re: In-kernel parser for the BMOF format used by WMI-ACPI

On Tue Mar 11, 2025 at 3:06 PM -05, Armin Wolf wrote:
> Hello,
>
> since around 2017 we are able to partially decode the Binary MOF (BMOF) data used to describe the interfaces of WMI-ACPI
> devices found inside modern devices. This initial reverse-engineering was done by Pali Rohár and implementing a BMOF parser
> inside the kernel was originally also proposed by him (see https://lore.kernel.org/lkml/201706041809.21573@pali/T/).
>
> As part of my bachelor thesis i finished the reverse-engineering and created yet another utility for parsing BMOF data.
> This utility can be found at github (https://github.com/Wer-Wolf/tarkin) and i now intend to use it to finally implement
> a BMOF parser inside the kernel.

It most be a very cool thesis project, I'll look into tarkin.

>
> There exists a growing list of WMI drivers using quirk tables for detecting the presence of specific WMI methods on a given
> device. This approach is maintenance-intensive and not exactly user friendly (end users rarely send kernel patches). Because
> of this we need this BMOF parser so that we can check which WMI methods are available.

A BMOF parser in-kernel is definetly a game changer for a lot of
drivers. Can't wait to implement this in alienware-wmi! Please, keep me
updated.

I wish you the best for your thesis :)

-- 
 ~ Kurt