feat: include patched libcamera for working front camera

8 files changed, 58 insertions, 119 deletions

diff --git a/Fedora.kiwi b/Fedora.kiwi
index 37d86a5..6ac2adb 100644
--- a/Fedora.kiwi
+++ b/Fedora.kiwi
@@ -15,7 +15,7 @@
 		<release-version>45</release-version>
 	</preferences>
 	<include from="this://./repositories/core.xml"/>
-	<include from="this://./repositories/kernel-surface.xml"/>
+	<include from="this://./repositories/kernel-sp12in.xml"/>
 	<include from="this://./components/common.xml"/>
 	<include from="this://./components/boot.xml"/>
 	<include from="this://./components/desktops/common.xml"/>
diff --git a/Jenkinsfile b/Jenkinsfile
index 0797a5f..5b7cf51 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -14,17 +14,16 @@ pipeline {
 
         B2_ENDPOINT = 'https://s3.eu-central-003.backblazeb2.com'
         AWS_DEFAULT_REGION = 'eu-central-003'
-        RPM_BUCKET = 'dist-sayagit-fedora-rpm'
         ISO_BUCKET = 'dist-sayagit-fedora-iso'
 
+        // Must match the <source path="..."/> in
+        // repositories/kernel-surface.xml.
+        KERNEL_SURFACE_REPO_URL = 'https://rpm.sayag.it/kernel-sp12in/fedora/45/aarch64'
+
         // awscli2 sends CRC32 checksums by default, which B2 rejects. Ask for
         // them only where the S3 API requires them.
         AWS_REQUEST_CHECKSUM_CALCULATION = 'when_required'
         AWS_RESPONSE_CHECKSUM_VALIDATION = 'when_required'
-
-        // Must match the <source path="dir://..."/> in
-        // repositories/kernel-surface.xml.
-        KERNEL_SURFACE_REPO = '/var/lib/kernel-surface-repo'
     }
 
     stages {
@@ -68,37 +67,23 @@ spec:
                             // The kernel-surface RPM is a build input, not
                             // something this repository can produce: the image
                             // installs kernel-surface by name and <ignore>s
-                            // Fedora's kernel packages, so it has to be in the
-                            // local repository before kiwi starts. The buckets
-                            // stay private, so it is pulled with credentials
-                            // rather than fetched over a public URL.
-                            withCredentials([usernamePassword(
-                                credentialsId: 'backblaze-b2-dist-rpm',
-                                usernameVariable: 'AWS_ACCESS_KEY_ID',
-                                passwordVariable: 'AWS_SECRET_ACCESS_KEY')]) {
-                                sh '''
-                                    set -eux
-
-                                    dnf --assumeyes install awscli2 createrepo_c
-
-                                    mkdir -p "${KERNEL_SURFACE_REPO}"
-                                    aws s3 sync --endpoint-url "${B2_ENDPOINT}" \\
-                                        "s3://${RPM_BUCKET}/fedora/${IMAGE_VERSION}/aarch64/" \\
-                                        "${KERNEL_SURFACE_REPO}/" \\
-                                        --exclude '*' --include 'kernel-surface-*.rpm'
+                            // Fedora's kernel packages. Its pipeline publishes
+                            // it to rpm.sayag.it, which repositories/kernel-surface.xml
+                            // points at directly, so there is nothing to stage
+                            // here. Fail now rather than several minutes into
+                            // kiwi on an unresolvable package name.
+                            sh '''
+                                set -eux
 
-                                    # Say so here rather than letting kiwi fail
-                                    # several minutes later on an unresolvable
-                                    # package name.
-                                    if ! ls "${KERNEL_SURFACE_REPO}"/kernel-surface-*.rpm; then
-                                        echo "No kernel-surface RPM in ${RPM_BUCKET} for Fedora ${IMAGE_VERSION}." >&2
-                                        echo "Run the kernel-surface pipeline first." >&2
-                                        exit 1
-                                    fi
+                                dnf --assumeyes install curl
 
-                                    createrepo_c "${KERNEL_SURFACE_REPO}"
-                                '''
-                            }
+                                repomd="${KERNEL_SURFACE_REPO_URL}/repodata/repomd.xml"
+                                if ! curl -fsS --retry 3 -o /dev/null "${repomd}"; then
+                                    echo "No kernel-surface repository at ${repomd}." >&2
+                                    echo "Run the kernel-surface pipeline for Fedora ${IMAGE_VERSION} first." >&2
+                                    exit 1
+                                fi
+                            '''
 
                             sh '''
                                 dnf --assumeyes install git kiwi kiwi-systemdeps distribution-gpg-keys
diff --git a/README.md b/README.md
index 5502ed3..a8a7b58 100644
--- a/README.md
+++ b/README.md
@@ -36,8 +36,7 @@ To build this on Fedora Linux:
 * No rescue vmlinuz.
 * No secure boot possible for this ISO for now, as the platform used is `efi` and not `uefi`.
 * No GRUB auto hidden menu. Trying to have the menu hidden results in system restarting after trying to boot it.
-* `wireupcameras.service` (which enables tablet's cameras to be used) fails on installed system (not in Live CD though), as no `/dev/media*` gets initialized.
-* No hardware video encoding/decoding for now, as the iris video codec (`qcvss8380_pa.mbn`) is Windows-only (as far as I researched), but you can copy one from `/path/to/mounted/windows/drive/Windows/System32/DriverStore/FileRepository/qcdx8380.inf_arm64_*/qcvss8380_pa.mbn` to `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/`, if you keep Windows ARM64 partition.
+* Hardware video encoding/decoding needs a firmware blob the image cannot ship. The `qcom/vpu/vpu30_p1_s7.mbn` that `linux-firmware` provides is signed with Qualcomm's SecTools *test* key chain, which a retail Surface's TrustZone rejects -- `qcom_scm_pas_init_image()` fails and the kernel logs `qcom-iris aa00000.video-codec: error -22 initializing firmware`. The production-signed build of the same firmware ships with Windows, so if you kept the Windows ARM64 partition, copy `qcvss8380_pa.mbn` out of `/path/to/mounted/windows/drive/Windows/System32/DriverStore/FileRepository/qcdx8380.inf_arm64_*/` into `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/`. The kernel's device tree already points `iris` at that path.
 * Suspend on Snapdragon X is still very unstable. No deep sleep is available, so `mem_sleep_default=s2idle` was set. Even that leads to compromises as suspending via GNOME results in hard freeze, so the default power button behavior was changed to `interactive` and should not be changed back to `suspend`.
 
 ## Image variants
diff --git a/config.sh b/config.sh
index 690cb48..eed828d 100755
--- a/config.sh
+++ b/config.sh
@@ -638,15 +638,37 @@ install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system
 # hexagonrpc.service in through the drop-in above.
 systemctl enable hexagonrpc.service
 
-# Rear camera pipeline (msm/camss) needs /dev/media0, which only exists once the
-# real silicon probes on the booted system -- install the wiring but do not run
-# it here, there is no camera hardware in the KIWI build chroot.
+# Cameras (msm/camss). Nothing has to be wired up at boot. libcamera's "simple"
+# pipeline handler claims qcom-camss and builds the media graph itself in
+# configure(), including flipping the csiphy -> msm_csid0 link between the rear
+# ov13858 and the front ov02c10, so a media-ctl unit only fights it: pinning
+# csid0 to the rear sensor at boot leaves the front camera disconnected until
+# something re-links it, and the formats such a unit has to guess are what made
+# the old wireupcameras.service die with "Unable to setup formats: Invalid
+# argument (22)" on every boot.
+#
+# v4l-utils stays, for inspecting the graph by hand -- media-ctl -p, and
+# v4l2-ctl --stream-mmap on the RDI node to check the sensor below libcamera.
 dnf install -y v4l-utils
-install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/wireupcameras.sh \
-    /usr/local/bin/wireupcameras.sh
-install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/wireupcameras.service \
-	/etc/systemd/system/wireupcameras.service
-systemctl enable wireupcameras.service
+
+# The front ov02c10 needs a libcamera that knows its analogue gain model and
+# black level; upstream libcamera has neither, and there is no plugin mechanism
+# for them, but kernel-sp12in repo offers libcamera with supported models.
+# Pulled in by name because it would otherwise only arrive as a dependency,
+# which makes it easy to lose without noticing.
+dnf install -y libcamera libcamera-ipa
+
+libcamera_nevra=$(rpm -q libcamera)
+case "${libcamera_nevra}" in
+	*.sp12in*) printf 'Using %s\n' "${libcamera_nevra}" ;;
+	*)
+		printf 'Error: %s is Fedora'"'"'s libcamera, not the sp12in rebuild.\n' \
+			"${libcamera_nevra}" >&2
+		printf 'Fedora has probably bumped the release past the rebuild; rebase\n' >&2
+		printf 'patches/ in ../libcamera and tag a new release suffix.\n' >&2
+		exit 1
+		;;
+esac
 
 # Suspend on Snapdragon is still very unstable. This is the reason why
 # 'mem_sleep_default=s2idle' is set explicitly in the cmdline as 'deep' mode
@@ -656,7 +678,7 @@ systemctl enable wireupcameras.service
 #   logind behavior is kept intact with suspend behavior.
 #   gnome default power button behavior was replaced with 'interactive'.
 install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/logind.conf.d/60-surface-power-key.conf \
-	/etc/systemd/login.conf.d/60-surface-power-key.conf
+	/etc/systemd/logind.conf.d/60-surface-power-key.conf
 install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/db/local.d/00-power-button \
 	/etc/dconf/db/local.d/00-power-button
 install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/profile/user \
diff --git a/repositories/kernel-sp12in.xml b/repositories/kernel-sp12in.xml
new file mode 100644
index 0000000..2419e06
--- /dev/null
+++ b/repositories/kernel-sp12in.xml
@@ -0,0 +1,6 @@
+<image>
+	<!-- Surface Pro 12" (Snapdragon X1P-42-100): the patched kernel + libcamera.-->
+	<repository type="rpm-md" alias="kernel-surface" priority="1">
+		<source path="https://rpm.sayag.it/kernel-sp12in/fedora/$releasever/aarch64/"/>
+	</repository>
+</image>
diff --git a/repositories/kernel-surface.xml b/repositories/kernel-surface.xml
deleted file mode 100644
index f92c1b0..0000000
--- a/repositories/kernel-surface.xml
+++ /dev/null
@@ -1,31 +0,0 @@
-<image>
-	<!-- Surface Pro 12" (Snapdragon X1P-42-100): the patched kernel.
-	     Built from the sibling ../kernel-surface checkout (see that directory's
-	     README.md). components/boot.xml installs kernel-surface by name and
-	     ignores Fedora's kernel packages, so this repository is not optional:
-	     without it the image cannot depsolve at all.
-
-	     priority="1" beats the fedora/updates repositories, which carry no
-	     priority and therefore sit at dnf's default 99 (lower number wins).
-
-	     A local directory repository, which is what a plain `createrepo_c` over
-	     a directory of RPMs produces. In CI the Jenkinsfile fills it from the
-	     dist-sayagit-fedora-rpm B2 bucket that the kernel-surface pipeline
-	     publishes to, then runs createrepo_c, all before kiwi starts. The
-	     bucket stays private, so the RPM is pulled with credentials instead of
-	     this description pointing at a public URL. By hand:
-
-	         sudo mkdir -p /var/lib/kernel-surface-repo
-	         sudo cp ~/rpmbuild/RPMS/aarch64/kernel-surface-*.rpm \
-	             /var/lib/kernel-surface-repo/
-	         sudo createrepo_c /var/lib/kernel-surface-repo
-
-	     The path has to exist on the build host before kiwi starts; kiwi binds
-	     a dir:// repository into the image root at the same path. It has no
-	     <signing> element, so kiwi configures it with gpgcheck off. Changing
-	     the path here means changing KERNEL_SURFACE_REPO in the Jenkinsfile
-	     too. -->
-	<repository type="rpm-md" alias="kernel-surface" priority="1">
-		<source path="dir:///var/lib/kernel-surface-repo"/>
-	</repository>
-</image>
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/wireupcameras.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/wireupcameras.service
deleted file mode 100644
index 31eff6c..0000000
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/wireupcameras.service
+++ /dev/null
@@ -1,10 +0,0 @@
-[Unit]
-Description=Wire up Surface Pro rear camera (media-ctl pipeline)
-
-[Service]
-Type=oneshot
-ExecStart=/usr/local/bin/wireupcameras.sh
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/wireupcameras.sh b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/wireupcameras.sh
deleted file mode 100644
index 833a422..0000000
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/wireupcameras.sh
+++ /dev/null
@@ -1,32 +0,0 @@
-#!/bin/bash
-set -e
-
-# Wait for /dev/media0 to appear (MSM VFE driver may need firmware to probe)
-# Timeout after 10 seconds to avoid infinite hangs on systems without camera hardware
-MAX_WAIT=10
-WAIT_COUNT=0
-while [ ! -e /dev/media0 ] && [ $WAIT_COUNT -lt $MAX_WAIT ]; do
-    sleep 1
-    WAIT_COUNT=$((WAIT_COUNT + 1))
-done
-
-if [ ! -e /dev/media0 ]; then
-    echo "wireupcameras: /dev/media0 not found after ${MAX_WAIT}s, skipping" >&2
-    exit 0
-fi
-
-SENSOR="ov13858 1-0010"
-
-# Tell each pad in the path what format to expect
-media-ctl -V "\"$SENSOR\":0[fmt:SGRBG10_1X10/4224x3136]"
-media-ctl -V '"msm_csiphy0":0[fmt:SGRBG10_1X10/4224x3136]'
-media-ctl -V '"msm_csiphy0":1[fmt:SGRBG10_1X10/4224x3136]'
-media-ctl -V '"msm_csid0":0[fmt:SGRBG10_1X10/4224x3136]'
-media-ctl -V '"msm_csid0":1[fmt:SGRBG10_1X10/4224x3136]'
-media-ctl -V '"msm_vfe0_rdi0":0[fmt:SGRBG10_1X10/4224x3136]'
-
-# Disable the OV02C10 path so it doesn't fight for csid0
-media-ctl -l '"msm_csiphy4":1->"msm_csid0":0[0]'
-
-# Enable the rear path
-media-ctl -l '"msm_csiphy0":1->"msm_csid0":0[1]'