[Bug 221107] New: Acer Swift SF16-51: Fn+F9 airplane mode key generates no events (EC firmware bug)

[bugzilla-daemon@kernel.org]

https://bugzilla.kernel.org/show_bug.cgi?id=221107

            Bug ID: 221107
           Summary: Acer Swift SF16-51: Fn+F9 airplane mode key generates
                    no events (EC firmware bug)
           Product: Drivers
           Version: 2.5
          Hardware: Intel
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P3
         Component: Platform_x86
          Assignee: drivers_platform_x86@kernel-bugs.osdl.org
          Reporter: desireall@naver.com
        Regression: No

Created attachment 309408
  --> https://bugzilla.kernel.org/attachment.cgi?id=309408&action=edit
DSDT/SSDT decompilation, dmesg, rfkill state, WMI devices, and module list for
Acer Swift SF16-51

# [BUG] Acer Swift SF16-51: Fn+F9 airplane mode key generates no events

## System Information
- **Model**: Acer Swift SF16-51 (DMI: Milkfish_LNV)
- **BIOS**: V1.31 (11/13/2025)
- **Kernel**: 6.19.3-2-cachyos (Arch-based)
- **Modules**: acer_wmi, intel_hid, wmi_bmof loaded

## Problem Description

The Fn+F9 key (airplane mode toggle) on the Acer Swift SF16-51 generates **no
events** visible to the OS:

- No WMI notifications (acpi_listen shows nothing)
- No input events on any device (evtest, keyd -m show nothing)
- No dmesg output
- No rfkill state changes
- No ACPI events of any kind

Other Fn keys work:
- Fn+F10 (touchpad): WMI event 0xBC on PNP0C14:00 (function=1, key=0x82)
- Fn+F4 (mic mute): F15 scancode via I2C HID keyboard

## DSDT Analysis

### EC Query _Q02 (wireless toggle)
The DSDT defines `_Q02` as the wireless/communication button handler:
```asl
Method (_Q02, 0, NotSerialized)
{
    HKEV (0x02, One)
}
```

### HKEV dispatches WMI notification 0xBC
```asl
Method (HKEV, 2, NotSerialized)
{
    ^^^WMID.FEBC [Zero] = Arg0  // function = 0x02
    ^^^WMID.FEBC [One] = Arg1   // key_num = 0x01
    ^^^WMID.FEBC [0x02] = Zero
    ^^^WMID.FEBC [0x03] = Zero
    Notify (WMID, 0xBC)
}
```

The _WDG table in SSDT24 confirms notification 0xBC maps to
`676AA15E-6A47-4D9F-A2CC-1E6D18D14026` (ACERWMID_EVENT_GUID).

### Two bugs identified

**Bug 1 (firmware/EC):** Pressing Fn+F9 does NOT trigger `_Q02`. The EC
firmware appears to not have Fn+F9 mapped to fire any EC query method. The DSDT
defines the handler, but the EC never calls it.

**Bug 2 (acer_wmi driver):** Even if `_Q02` were triggered, `acer_wmi` does not
handle `function=2` in its event dispatch:

```c
// acer_wmi_notify() switch only handles:
// 0x1 = WMID_HOTKEY_EVENT
// 0x4 = WMID_BACKLIGHT_EVENT
// 0x5 = WMID_ACCEL_OR_KBD_DOCK_EVENT
// 0x7 = WMID_GAMING_TURBO_KEY_EVENT
// 0x8 = WMID_AC_EVENT
// 0x2 = NOT HANDLED (communication button)
```

The driver would log: `"Unknown function number - 2 - 1"`

## Additional Observations

### Boot-time unknown function
At boot, dmesg shows:
```
acer_wmi: Unknown function number - 9 - 1
```
This corresponds to `_QCA` in the DSDT:
```asl
Method (_QCA, 0, NotSerialized)
{
    Sleep (0xC8)
    HKEV (0x09, Zero)
}
```
Function 9 is also unhandled by the driver.

### Missing acer-wireless device
The `acer-wireless` driver expects ACPI HID `10251229` (SMKB device), which
does **not exist** on this laptop. The wireless toggle path goes through WMI
(HKEV/WMID) instead.

### Intel HID 5 button array
Enabling `intel_hid` 5-button array (`enable_5_button_array=Y`) did not help.
The DSDT
has `_QE0`/`_QE1` methods gated by `BTLD` (set by Intel HID `BTNL()`) and `OSYS
>= 0x07DF`,
but these appear to be for different button events, not specifically Fn+F9.

### Forced acer_wmi capabilities
Reloading with `force_caps=0xFFFF` did not produce events for Fn+F9.

### Windows comparison
Fn+F9 airplane mode **works correctly on Windows** with the same hardware/BIOS.
This confirms the EC hardware can generate the event, but the EC firmware
selectively does not fire `_Q02` under Linux (possibly based on OSYS or
another OS detection mechanism).

## Diagnostic Steps Performed

1. `acpi_listen` - no WMI events from Fn+F9
2. `evtest` on event2, event11, event12, event20 - no input events
3. `keyd -m` (monitors all input devices) - no events
4. `dmesg` monitoring after clearing - no kernel messages
5. `rfkill list` before/after - no state change
6. Reloaded `acer_wmi` with `force_caps=0xFFFF`
7. Reloaded `intel_hid` with `enable_5_button_array=Y`
8. DSDT decompilation and analysis
9. Confirmed Fn+F9 works on Windows (same BIOS V1.31)

## Proposed Fix

### For acer_wmi driver:
Add handling for `function=2` (communication button) and `function=9` in
`acer_wmi_notify()`:

```c
case 0x02: /* Communication button - wireless toggle */
    /* Same as WMID_HOTKEY_EVENT but for wireless */
    if (return_value.key_num == 0x01)
        sparse_keymap_report_event(acer_wmi_input_dev,
            return_value.key_num, 1, true);
    break;
```

Also add scancode 0x01 → KEY_RFKILL to the sparse keymap for function=2 events.

### For EC firmware (Acer BIOS team):
Map Fn+F9 to EC query `_Q02` so the OS receives the wireless toggle event.

## Attached Files
- `dsdt.dsl` - Decompiled DSDT
- `dsdt.bin` - Raw DSDT binary
- `ssdt24-wmid.dsl` - Decompiled SSDT24 (contains WMID device definition)
- `dmesg-acer-wmi.txt` - Boot dmesg (acer/wmi filtered)
- `wmi-devices.txt` - WMI GUID listing with driver bindings
- `loaded-modules.txt` - Relevant loaded modules
- `rfkill-state.txt` - rfkill device listing

-- 
You may reply to this email to add a comment.

You are receiving this mail because:
You are watching the assignee of the bug.