feat: automate installing production-signed iris firmware driver

5 files changed, 219 insertions, 3 deletions

diff --git a/Jenkinsfile b/Jenkinsfile
index 5b7cf51..62357ff 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -17,7 +17,7 @@ pipeline {
         ISO_BUCKET = 'dist-sayagit-fedora-iso'
 
         // Must match the <source path="..."/> in
-        // repositories/kernel-surface.xml.
+        // repositories/kernel-sp12in.xml.
         KERNEL_SURFACE_REPO_URL = 'https://rpm.sayag.it/kernel-sp12in/fedora/45/aarch64'
 
         // awscli2 sends CRC32 checksums by default, which B2 rejects. Ask for
@@ -68,7 +68,7 @@ spec:
                             // something this repository can produce: the image
                             // installs kernel-surface by name and <ignore>s
                             // Fedora's kernel packages. Its pipeline publishes
-                            // it to rpm.sayag.it, which repositories/kernel-surface.xml
+                            // it to rpm.sayag.it, which repositories/kernel-sp12in.xml
                             // points at directly, so there is nothing to stage
                             // here. Fail now rather than several minutes into
                             // kiwi on an unresolvable package name.
diff --git a/README.md b/README.md
index a8a7b58..b34e38b 100644
--- a/README.md
+++ b/README.md
@@ -36,7 +36,11 @@ To build this on Fedora Linux:
 * No rescue vmlinuz.
 * No secure boot possible for this ISO for now, as the platform used is `efi` and not `uefi`.
 * No GRUB auto hidden menu. Trying to have the menu hidden results in system restarting after trying to boot it.
-* Hardware video encoding/decoding needs a firmware blob the image cannot ship. The `qcom/vpu/vpu30_p1_s7.mbn` that `linux-firmware` provides is signed with Qualcomm's SecTools *test* key chain, which a retail Surface's TrustZone rejects -- `qcom_scm_pas_init_image()` fails and the kernel logs `qcom-iris aa00000.video-codec: error -22 initializing firmware`. The production-signed build of the same firmware ships with Windows, so if you kept the Windows ARM64 partition, copy `qcvss8380_pa.mbn` out of `/path/to/mounted/windows/drive/Windows/System32/DriverStore/FileRepository/qcdx8380.inf_arm64_*/` into `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/`. The kernel's device tree already points `iris` at that path.
+* Hardware video encoding/decoding needs a firmware blob the image is not allowed to ship. The `qcom/vpu/vpu30_p1_s7.mbn` that `linux-firmware` provides is the same codec signed with Qualcomm's SecTools *test* key chain, which a retail Surface's TrustZone rejects -- `qcom_scm_pas_init_image()` fails and the kernel logs `qcom-iris aa00000.video-codec: error -22 initializing firmware`. The production-signed build exists only inside Microsoft's Surface driver package, which grants no redistribution right, so what ships here is the means and not the blob:
+    * If you kept the Windows ARM64 partition, `surface-video-firmware.service` finds it on the first boot after install and copies `qcvss8380_pa.mbn` out of its DriverStore. Nothing to do.
+    * If Windows is gone, download the [Surface Pro 12-inch driver pack](https://www.microsoft.com/en-us/download/details.aspx?id=108199) (~500 MB MSI) and run `sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi`. There is no automatic download: the Download Center hands out per-session links.
+
+  The kernel's device tree already points `iris` at `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn`, so the driver picks it up as soon as it is there.
 * Suspend on Snapdragon X is still very unstable. No deep sleep is available, so `mem_sleep_default=s2idle` was set. Even that leads to compromises as suspending via GNOME results in hard freeze, so the default power button behavior was changed to `interactive` and should not be changed back to `suspend`.
 
 ## Image variants
diff --git a/config.sh b/config.sh
index eed828d..ef17771 100755
--- a/config.sh
+++ b/config.sh
@@ -670,6 +670,23 @@ case "${libcamera_nevra}" in
 		;;
 esac
 
+# Hardware video decode needs firmware this image is not allowed to carry. The
+# qcom/vpu/vpu30_p1_s7.mbn in linux-firmware is the same codec signed with
+# Qualcomm's SecTools test keys, which a retail Surface's TrustZone rejects, and
+# the production-signed build exists only inside Microsoft's Surface driver
+# package, under terms that grant no redistribution right.
+#
+# So the image ships the means rather than the blob: a script that copies it out
+# of a Windows install the owner already has a licence for, and a unit that runs
+# that once on a dual-boot machine. Where Windows is gone, the script says which
+# driver pack to download and how to point it at one.
+dnf install -y msitools
+install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh \
+	/usr/local/bin/surface-video-firmware.sh
+install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service \
+	/etc/systemd/system/surface-video-firmware.service
+systemctl enable surface-video-firmware.service
+
 # Suspend on Snapdragon is still very unstable. This is the reason why
 # 'mem_sleep_default=s2idle' is set explicitly in the cmdline as 'deep' mode
 # does not function at all.
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service
new file mode 100644
index 0000000..5c83962
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Install Surface Pro 12in video codec firmware from a Windows partition
+ConditionPathExists=!/lib/firmware/qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn
+After=local-fs.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/bin/surface-video-firmware.sh
+
+[Install]
+WantedBy=multi-user.target
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh
new file mode 100755
index 0000000..35dfdf1
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh
@@ -0,0 +1,183 @@
+#!/bin/bash
+# Surface Pro 12" (Snapdragon X1P-42-100): install the video codec firmware.
+#
+# The iris video codec needs firmware TrustZone will accept. linux-firmware's
+# qcom/vpu/vpu30_p1_s7.mbn is the same codec signed with Qualcomm's SecTools
+# *test* key chain, which a retail Surface rejects:
+#
+#   qcom-iris aa00000.video-codec: error -22 initializing firmware qcom/vpu/vpu30_p1_s7.mbn
+#
+# The production-signed build ships only inside Microsoft's Surface driver
+# package, which grants no redistribution right, so the image cannot carry it.
+# What it can do is copy it out of a Windows install the owner already has a
+# licence for, or out of a driver pack they downloaded themselves. This script
+# does the copying; it never fetches anything the caller did not ask for.
+#
+# Usage: surface-video-firmware.sh [-m MSI] [-u URL] [-n]
+#
+#   (no options)  look for a Windows partition on this machine and copy the
+#                 firmware out of its DriverStore. No network access.
+#   -m MSI        extract from a Surface driver pack already on disk
+#   -u URL        download a driver pack and extract from that
+#   -n            say what would happen, change nothing
+#
+# The driver pack is a ~500 MB MSI from
+#
+#   https://www.microsoft.com/en-us/download/details.aspx?id=108199
+#
+# There is no stable direct link to hardcode: the Download Center hands out
+# per-session URLs and the file name carries the driver release, so -u takes
+# the URL the browser was given rather than guessing one that would rot.
+
+set -euo pipefail
+
+FW_DIR=/lib/firmware/qcom/x1p42100/Microsoft/Surface12
+BLOB=qcvss8380_pa.mbn
+DRIVERSTORE=Windows/System32/DriverStore/FileRepository
+PAGE=https://www.microsoft.com/en-us/download/details.aspx?id=108199
+
+msi=""
+url=""
+dry_run=false
+
+while getopts ':m:u:nh' opt; do
+	case "${opt}" in
+		m) msi=${OPTARG} ;;
+		u) url=${OPTARG} ;;
+		n) dry_run=true ;;
+		h) sed -n '2,31p' "${BASH_SOURCE[0]}"; exit 0 ;;
+		*) echo "unknown option -${OPTARG}" >&2; exit 2 ;;
+	esac
+done
+
+log() { printf 'surface-video-firmware: %s\n' "$*"; }
+die() { printf 'surface-video-firmware: %s\n' "$*" >&2; exit 1; }
+
+if [[ -f "${FW_DIR}/${BLOB}" ]]; then
+	log "${FW_DIR}/${BLOB} is already installed"
+	exit 0
+fi
+
+[[ ${EUID} -eq 0 ]] || die "must run as root"
+
+cleanup_dirs=()
+cleanup_mounts=()
+cleanup() {
+	local m d
+	for m in ${cleanup_mounts[@]+"${cleanup_mounts[@]}"}; do
+		mountpoint -q "${m}" && umount "${m}" || true
+	done
+	for d in ${cleanup_dirs[@]+"${cleanup_dirs[@]}"}; do
+		rm -rf "${d}" || true
+	done
+}
+trap cleanup EXIT
+
+install_blob() {
+	local src=$1
+	if [[ ${dry_run} == true ]]; then
+		log "would install ${src} as ${FW_DIR}/${BLOB}"
+		return 0
+	fi
+
+	install -Dm644 "${src}" "${FW_DIR}/${BLOB}"
+	log "installed ${FW_DIR}/${BLOB}"
+
+	# The driver only asks for its firmware while probing, so it has to be
+	# reloaded to pick this up. It refuses while a decode session holds it,
+	# which is why a failure here is only worth a note.
+	if lsmod | grep -q '^qcom_iris'; then
+		if modprobe -r qcom_iris 2>/dev/null && modprobe qcom_iris 2>/dev/null; then
+			log "reloaded qcom_iris"
+		else
+			log "could not reload qcom_iris; reboot to start using the firmware"
+		fi
+	fi
+}
+
+# Everything below hands find(1) the bare file name rather than a full path:
+# the DriverStore directory carries a per-build hash, and the layout inside an
+# extracted MSI is not documented anywhere worth trusting.
+find_blob() {
+	find "$1" -type f -name "${BLOB}" -print -quit 2>/dev/null
+}
+
+from_windows() {
+	local dev fstype part_mnt mnt found
+
+	while read -r dev fstype part_mnt; do
+		[[ ${fstype} == ntfs* ]] || continue
+
+		if [[ -n ${part_mnt} ]]; then
+			mnt=${part_mnt}
+		else
+			mnt=$(mktemp -d)
+			cleanup_dirs+=("${mnt}")
+			if ! mount -t ntfs3 -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null &&
+			   ! mount -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null; then
+				log "/dev/${dev}: could not mount read-only, skipping"
+				log "/dev/${dev}: if Windows is hibernated, shut it down fully and retry"
+				continue
+			fi
+			cleanup_mounts+=("${mnt}")
+		fi
+
+		[[ -d "${mnt}/${DRIVERSTORE}" ]] || continue
+
+		found=$(find_blob "${mnt}/${DRIVERSTORE}")
+		if [[ -n ${found} ]]; then
+			log "found ${BLOB} on /dev/${dev}"
+			install_blob "${found}"
+			return 0
+		fi
+		log "/dev/${dev}: a Windows install, but no ${BLOB} in its DriverStore"
+	done < <(lsblk -rno NAME,FSTYPE,MOUNTPOINT)
+
+	return 1
+}
+
+from_msi() {
+	local pack=$1 work found
+
+	command -v msiextract >/dev/null || die "msiextract is missing; install msitools"
+
+	work=$(mktemp -d)
+	cleanup_dirs+=("${work}")
+
+	log "extracting ${pack}"
+	( cd "${work}" && msiextract "${pack}" >/dev/null )
+
+	found=$(find_blob "${work}")
+	[[ -n ${found} ]] || die "no ${BLOB} inside ${pack}; is it the Surface Pro 12in driver pack?"
+
+	log "found ${BLOB} in the driver pack"
+	install_blob "${found}"
+}
+
+if [[ -n ${url} ]]; then
+	dl=$(mktemp -d)
+	cleanup_dirs+=("${dl}")
+	msi="${dl}/driverpack.msi"
+	log "downloading ${url}"
+	curl -fL --retry 3 --progress-bar -o "${msi}" "${url}"
+fi
+
+if [[ -n ${msi} ]]; then
+	[[ -f ${msi} ]] || die "${msi} does not exist"
+	from_msi "${msi}"
+	exit 0
+fi
+
+if from_windows; then
+	exit 0
+fi
+
+# Nothing found, and nothing was asked for. Not an error: most of the time this
+# is a machine with no Windows left on it, and the only thing left to do is say
+# how to finish the job by hand.
+log "no Windows install on this machine carries ${BLOB}"
+log "hardware video decode stays off until it is installed. To finish by hand:"
+log "  1. download the Surface Pro 12in driver pack (~500 MB) from"
+log "     ${PAGE}"
+log "  2. sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi"
+exit 0