DRAFT: feat: use kernel tailored for surface pro 12-inch

15 files changed, 288 insertions, 70 deletions

diff --git a/Fedora.kiwi b/Fedora.kiwi
index dda43e5..37d86a5 100644
--- a/Fedora.kiwi
+++ b/Fedora.kiwi
@@ -15,6 +15,7 @@
 		<release-version>45</release-version>
 	</preferences>
 	<include from="this://./repositories/core.xml"/>
+	<include from="this://./repositories/kernel-surface.xml"/>
 	<include from="this://./components/common.xml"/>
 	<include from="this://./components/boot.xml"/>
 	<include from="this://./components/desktops/common.xml"/>
diff --git a/Jenkinsfile b/Jenkinsfile
index 24aa17a..0797a5f 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -11,6 +11,20 @@ pipeline {
         IMAGE_PROFILE = 'Workstation-Live'
         IMAGE_VERSION = '45'
         OUTPUT_DIR = 'outdir'
+
+        B2_ENDPOINT = 'https://s3.eu-central-003.backblazeb2.com'
+        AWS_DEFAULT_REGION = 'eu-central-003'
+        RPM_BUCKET = 'dist-sayagit-fedora-rpm'
+        ISO_BUCKET = 'dist-sayagit-fedora-iso'
+
+        // awscli2 sends CRC32 checksums by default, which B2 rejects. Ask for
+        // them only where the S3 API requires them.
+        AWS_REQUEST_CHECKSUM_CALCULATION = 'when_required'
+        AWS_RESPONSE_CHECKSUM_VALIDATION = 'when_required'
+
+        // Must match the <source path="dir://..."/> in
+        // repositories/kernel-surface.xml.
+        KERNEL_SURFACE_REPO = '/var/lib/kernel-surface-repo'
     }
 
     stages {
@@ -51,6 +65,41 @@ spec:
                 container('kiwi') {
                     script {
                         try {
+                            // The kernel-surface RPM is a build input, not
+                            // something this repository can produce: the image
+                            // installs kernel-surface by name and <ignore>s
+                            // Fedora's kernel packages, so it has to be in the
+                            // local repository before kiwi starts. The buckets
+                            // stay private, so it is pulled with credentials
+                            // rather than fetched over a public URL.
+                            withCredentials([usernamePassword(
+                                credentialsId: 'backblaze-b2-dist-rpm',
+                                usernameVariable: 'AWS_ACCESS_KEY_ID',
+                                passwordVariable: 'AWS_SECRET_ACCESS_KEY')]) {
+                                sh '''
+                                    set -eux
+
+                                    dnf --assumeyes install awscli2 createrepo_c
+
+                                    mkdir -p "${KERNEL_SURFACE_REPO}"
+                                    aws s3 sync --endpoint-url "${B2_ENDPOINT}" \\
+                                        "s3://${RPM_BUCKET}/fedora/${IMAGE_VERSION}/aarch64/" \\
+                                        "${KERNEL_SURFACE_REPO}/" \\
+                                        --exclude '*' --include 'kernel-surface-*.rpm'
+
+                                    # Say so here rather than letting kiwi fail
+                                    # several minutes later on an unresolvable
+                                    # package name.
+                                    if ! ls "${KERNEL_SURFACE_REPO}"/kernel-surface-*.rpm; then
+                                        echo "No kernel-surface RPM in ${RPM_BUCKET} for Fedora ${IMAGE_VERSION}." >&2
+                                        echo "Run the kernel-surface pipeline first." >&2
+                                        exit 1
+                                    fi
+
+                                    createrepo_c "${KERNEL_SURFACE_REPO}"
+                                '''
+                            }
+
                             sh '''
                                 dnf --assumeyes install git kiwi kiwi-systemdeps distribution-gpg-keys
                                 git config --global --add safe.directory .
@@ -102,12 +151,25 @@ spec:
             steps {
                 container('s5cmd') {
                     unstash "fedora-workstation-live-iso-stash"
-                    sh '''
-                        cd ${OUTPUT_DIR}-build
-                        moddate=$(date -r Fedora.aarch64-${IMAGE_VERSION}.iso -u +"%Y%m%d-%H%M%S")
-                        mv Fedora.aarch64-${IMAGE_VERSION}.iso "Fedora.Surface-Pro-12in.${IMAGE_PROFILE}.${IMAGE_VERSION}.${moddate}.aarch64.iso"
-                        ls -lh
-                    '''
+                    withCredentials([usernamePassword(
+                        credentialsId: 'backblaze-b2-dist-iso',
+                        usernameVariable: 'AWS_ACCESS_KEY_ID',
+                        passwordVariable: 'AWS_SECRET_ACCESS_KEY')]) {
+                        sh '''
+                            set -eux
+
+                            cd "${OUTPUT_DIR}-build"
+                            src="Fedora.aarch64-${IMAGE_VERSION}.iso"
+                            moddate=$(date -r "${src}" -u +"%Y%m%d-%H%M%S")
+                            dst="Fedora.Surface-Pro-12in.${IMAGE_PROFILE}.${IMAGE_VERSION}.${moddate}.aarch64.iso"
+                            mv "${src}" "${dst}"
+                            ls -lh
+
+                            s5cmd --endpoint-url "${B2_ENDPOINT}" cp \\
+                                "${dst}" \\
+                                "s3://${ISO_BUCKET}/fedora/${IMAGE_VERSION}/aarch64/${dst}"
+                        '''
+                    }
                 }
             }
         }
diff --git a/components/boot.xml b/components/boot.xml
index 816bb91..36d8ffa 100644
--- a/components/boot.xml
+++ b/components/boot.xml
@@ -42,17 +42,44 @@
 		<package name="systemd-oomd-defaults"/>
 		<package name="systemd-resolved"/>
 	</packages>
-	<packages type="image" patternType="plusRecommended" profiles="BootCore">
-		<ignore name="kernel-*debug*"/>
-		<package name="kernel-core"/>
-	</packages>
-	<packages type="image" patternType="plusRecommended" profiles="BootCoreLive">
+	<!-- Surface Pro 12" (Snapdragon X1P-42-100) kernel selection. One block for
+	     every profile that needs a kernel: BootCore, BootCoreLive, and
+	     BootDiskCore through its <requires profile="BootCore"/> above.
+
+	     kernel-surface is vanilla upstream plus the miasvanklei overlay's patch
+	     set for this board (device tree, SAM RTC, SAM suspend workaround,
+	     CAMSS/CSI-2, remoteproc attach, clk/PCI/irqchip fixes). It is built from
+	     the sibling ../kernel-surface checkout and comes from the repository
+	     repositories/kernel-surface.xml adds.
+
+	     It is a single package (kernel image, every module, device trees) and
+	     Provides kernel, kernel-core, kernel-modules, kernel-modules-core and
+	     kernel-modules-extra, so anything with a plain Requires on one of those
+	     resolves against it. That is why no -modules/-modules-extra entry is
+	     needed in any profile any more.
+
+	     Fedora's split kernel packages are ignored by name instead, so dnf can
+	     never drag one in as a dependency. kernel-uki-dtbloader is ignored as
+	     well: kernel-surface Conflicts it, so without the exclusion any package
+	     pulling it in would fail the depsolve instead of just losing it. It
+	     bakes in ~3000 boards' dtbs (.dtbauto sections), does not carry this
+	     board, and is a hard Requires of the plain "kernel" metapackage on
+	     aarch64, which makes that metapackage uninstallable here too, since it
+	     is also the only thing that could satisfy kernel-core by name.
+
+	     Consequence for the profiles this fork does not target: the ones that
+	     still ask for a Fedora kernel by name through BootCore, namely
+	     Server-Host-Generic (kernel) and Cloud-Base-Azure (kernel-modules),
+	     cannot depsolve. Everything this device builds (Live via BootCoreLive,
+	     disk via BootDiskCore) takes its kernel from here. -->
+	<packages type="image" patternType="plusRecommended" profiles="BootCore,BootCoreLive">
 		<ignore name="kernel-*debug*"/>
-		<!-- Surface Pro 12": kernel-uki-dtbloader bakes in ~3000 boards' dtbs
-		     (.dtbauto sections) and hard-conflicts with kernel-core. This board
-		     isn't in its dtb database anyway (dtb delivered separately via
-		     grub's devicetree directive), so plain kernel-core is enough. -->
-		<package name="kernel-core"/>
+		<ignore name="kernel-core"/>
+		<ignore name="kernel-modules"/>
+		<ignore name="kernel-modules-core"/>
+		<ignore name="kernel-modules-extra"/>
+		<ignore name="kernel-uki-dtbloader"/>
+		<package name="kernel-surface"/>
 	</packages>
 	<packages type="image" patternType="plusRecommended" profiles="BootCoreUKI">
 		<package name="shim-signed-aa64"/>
@@ -66,16 +93,12 @@
 		<package name="grub2-efi-aa64-cdboot"/>
 	</packages>
 	<packages type="image" patternType="plusRecommended" profiles="BootDiskCore">
-		<ignore name="kernel-*debug*"/>
 		<package name="glibc-all-langpacks"/>
-		<!-- Surface Pro 12": kernel-core, not kernel-uki-dtbloader's multi-board
-		     dtb bloat, same reasoning as BootCoreLive above. arm-image-installer
-		     and uboot-images-armv8 dropped too, they exist for flashing/booting
-		     other ARM SBCs (device-tree selection, U-Boot), not relevant to this
+		<!-- Surface Pro 12": the kernel comes from the shared BootCore block
+		     above, which this profile requires. arm-image-installer and
+		     uboot-images-armv8 dropped, they exist for flashing/booting other
+		     ARM SBCs (device-tree selection, U-Boot), not relevant to this
 		     single UEFI/GPT device. -->
-		<package name="kernel-core"/>
-		<package name="kernel-modules"/>
-		<package name="kernel-modules-extra"/>
 		<package name="btrfs-progs"/>
 		<package name="udisks2-btrfs"/>
 	</packages>
diff --git a/components/liveinstall.xml b/components/liveinstall.xml
index c04ca7f..6b683b2 100644
--- a/components/liveinstall.xml
+++ b/components/liveinstall.xml
@@ -12,6 +12,7 @@
 			firmware="efi" efiparttable="gpt" efifatimagesize="30"
 			kernelcmdline="quiet rhgb mem_sleep_default=s2idle clk_ignore_unused pd_ignore_unused systemd.tpm2_wait=0 rd.live.ram=1"
 			fscreateoptions="-Efragments -C 1048576"
+			editbootconfig="surface-editbootconfig.sh"
 			>
 			<bootloader name="grub2" grub_template="grub-arm.cfg.iso-template" console="console" timeout="10"/>
 		</type>
@@ -28,12 +29,10 @@
 		<package name="dracut-live"/>
 		<package name="glibc-all-langpacks"/>
 		<package name="isomd5sum"/>
-		<!-- Surface Pro 12": no plain "kernel" package here, it hard-Requires
-		     kernel-uki-dtbloader on aarch64, which conflicts with BootCoreLive's
-		     kernel-core. grub2's ISO kernel lookup just needs a vmlinuz in /boot,
-		     which kernel-core (already installed there) already provides. -->
-		<package name="kernel-modules"/>
-		<package name="kernel-modules-extra"/>
+		<!-- Surface Pro 12": no kernel package here at all. BootCoreLive's
+		     kernel-surface already carries every module, and its %posttrans
+		     kernel-install leaves the /boot vmlinuz that grub2's ISO kernel
+		     lookup needs. See the kernel block in components/boot.xml. -->
 		<package name="livesys-scripts"/>
 		<package name="btrfs-progs"/>
 		<package name="udisks2-btrfs"/>
diff --git a/config-cdroot.tar b/config-cdroot.tar
deleted file mode 100644
index 6aafdc9..0000000
--- a/config-cdroot.tar
+++ /dev/null
diff --git a/config.sh b/config.sh
index c431bcb..690cb48 100755
--- a/config.sh
+++ b/config.sh
@@ -58,7 +58,7 @@ if [[ "$kiwi_profiles" != *"Container"* ]] && [[ "$kiwi_profiles" != *"FEX"* ]]
 	## "devicetree /dtb-$kver/$GRUB_DEVICETREE". /etc/kernel/devicetree does
 	## nothing here: /boot/<machine-id> does not exist, so kernel-install runs
 	## with layout=other and 90-loaderentry.install (which would read it) bails.
-	echo "GRUB_DEVICETREE=qcom/x1p42100-microsoft-surface-pro-12-inch.dtb" >> /etc/default/grub
+	echo "GRUB_DEVICETREE=qcom/x1p42100-microsoft-sp12in.dtb" >> /etc/default/grub
 	## Upstream sets menu_auto_hide=1 + boot_indeterminate=1 here for Disk images
 	## to match anaconda's behaviour. Deliberately not done for Surface Pro 12":
 	## with the menu hidden, GRUB counts down GRUB_TIMEOUT against a blank screen
@@ -436,18 +436,39 @@ fi
 # Surface Pro 12" customizations
 #--------------------------------------
 
-# /etc/surface-dtb is the master copy 60-surface-dtb.install re-stages into each
-# new kernel's module tree on update. The other two are what that hook and
-# 10-devicetree.install would normally produce, done up front here because
-# kernel-install never runs during this build -- without the module-tree copy,
-# anything keyed off /usr/lib/modules/$kver/dtb (including the anaconda
-# post-script) finds nothing and silently does nothing.
-install -Dm644 /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/boot/dtb \
-	"/etc/surface-dtb/x1p42100-microsoft-surface-pro-12-inch.dtb"
-install -Dm644 /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/boot/dtb \
-	"/usr/lib/modules/$kver/dtb/qcom/x1p42100-microsoft-surface-pro-12-inch.dtb"
-install -Dm644 /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/boot/dtb \
-	"/boot/dtb-$kver/qcom/x1p42100-microsoft-surface-pro-12-inch.dtb"
+# Device tree. kernel-surface compiles the patched dts in-tree and installs the
+# result twice: into its own module tree (dtb/qcom, from dtbs_install) and
+# version-independently into /usr/lib/surface-dtb. The latter is the master copy
+# 60-surface-dtb.install re-stages into each new kernel's module tree on update,
+# which is the only reason the image no longer carries a prebuilt blob of its
+# own -- the description installs kernel-surface by name and <ignore>s Fedora's
+# kernel packages, so the package is always there.
+#
+# One name throughout, upstream's: this block, GRUB_DEVICETREE above, both
+# kernel-install plugins, /etc/kernel/devicetree, and the ISO grub template.
+#
+# The module-tree and /boot copies plus the /boot/dtb symlink are what that hook
+# and grubby's 10-devicetree.install would normally produce, done up front here
+# because kernel-install does not run again during this build -- without the
+# module-tree copy, anything keyed off /usr/lib/modules/$kver/dtb (including the
+# anaconda post-script) finds nothing and silently does nothing.
+dtb_name=x1p42100-microsoft-sp12in.dtb
+dtb_src="/usr/lib/surface-dtb/$dtb_name"
+if [[ ! -f "$dtb_src" ]]; then
+	printf 'Error: %s is missing, so kernel-surface (built from ../kernel-surface) is not installed.\n' "$dtb_src" >&2
+	exit 1
+fi
+install -Dm644 "$dtb_src" "/usr/lib/modules/$kver/dtb/qcom/$dtb_name"
+install -Dm644 "$dtb_src" "/boot/dtb-$kver/qcom/$dtb_name"
+# dtbs_install ships every arm64 device tree, ~1000 boards, and the module tree
+# goes straight into the image filesystem. This image targets exactly one board,
+# so drop the rest -- the same objection that rules out kernel-uki-dtbloader in
+# components/boot.xml. Only affects the image; a later kernel-surface update on
+# the installed system restores the full tree.
+find "/usr/lib/modules/$kver/dtb" -mindepth 1 \
+	\! -path "/usr/lib/modules/$kver/dtb/qcom" \
+	\! -name "$dtb_name" \
+	-delete
 # /boot/dtb -> dtb-$kver is what grubby's 10-devicetree.install maintains, and
 # what the boot loader entry's devicetree path resolves through
 ln -sfn "dtb-$kver" /boot/dtb
@@ -507,7 +528,7 @@ fi
 # documented way to disable a plugin: a /dev/null symlink of the same name).
 mkdir -p /etc/kernel/install.d
 ln -sf /dev/null /etc/kernel/install.d/51-dracut-rescue.install
-# kernel-core's own package scriptlet already ran kernel-install once, before
+# kernel-surface's %posttrans scriptlet already ran kernel-install once, before
 # this mask existed (root overlay lands after package install), leaving a
 # stale rescue image behind. Remove it now so kiwi's systemd_boot EFI-FAT-image
 # step doesn't try to cram it in too.
@@ -604,11 +625,18 @@ dnf install -y alsa-ucm-utils
 
 install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service \
 	/etc/systemd/system/hexagonrpc.service
-install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service \
-	/etc/systemd/system/iio-sensor-proxy.service
-install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules \
-	/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules
-systemctl enable hexagonrpc.service iio-sensor-proxy.service
+
+# iio-sensor-proxy keeps the unit its own build installed, and gets only the
+# ordering against hexagonrpcd added on top. The drop-in is dead weight if that
+# unit is not there, so check rather than let it pass silently.
+test -f /usr/lib/systemd/system/iio-sensor-proxy.service
+install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf \
+	/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf
+
+# Only hexagonrpcd is enabled statically. iio-sensor-proxy is started through
+# its D-Bus name by whatever asks for net.hadess.SensorProxy, which then pulls
+# hexagonrpc.service in through the drop-in above.
+systemctl enable hexagonrpc.service
 
 # Rear camera pipeline (msm/camss) needs /dev/media0, which only exists once the
 # real silicon probes on the booted system -- install the wiring but do not run
diff --git a/grub-arm.cfg.iso-template b/grub-arm.cfg.iso-template
index 8badfb5..447a1f3 100644
--- a/grub-arm.cfg.iso-template
+++ b/grub-arm.cfg.iso-template
@@ -26,19 +26,24 @@ set timeout_style=${boot_timeout_style}
 
 search ${search_params}
 
+# Surface Pro 12" (Snapdragon X1P-42-100): the dtb the entries below load is a
+# plain file in this same loader directory on the ISO9660 filesystem. GRUB
+# cannot read the erofs root image, and kiwi has no device tree support, so
+# surface-editbootconfig.sh copies it there out of the kernel-surface RPM in the
+# image root. See that script for why editbootconfig is the hook that can.
 menuentry "Start ${title}" --class fedora --class gnu-linux --class gnu --class os {
-	devicetree ($$root)${bootpath}/x1p42100-microsoft-surface-pro-12-inch.dtb
+	devicetree ($$root)${bootpath}/x1p42100-microsoft-sp12in.dtb
 	linux ($$root)${bootpath}/${kernel_file} ${boot_options}
 	initrd ($$root)${bootpath}/${initrd_file}
 }
 menuentry "Test this media & start ${title}" --class fedora --class gnu-linux --class gnu --class os {
-	devicetree ($$root)${bootpath}/x1p42100-microsoft-surface-pro-12-inch.dtb
+	devicetree ($$root)${bootpath}/x1p42100-microsoft-sp12in.dtb
 	linux ($$root)${bootpath}/${kernel_file} ${boot_options} rd.live.check
 	initrd ($$root)${bootpath}/${initrd_file}
 }
 submenu "Troubleshooting -->" {
 	menuentry "Start ${title} in basic graphics mode" --class fedora --class gnu-linux --class gnu --class os {
-		devicetree ($$root)${bootpath}/x1p42100-microsoft-surface-pro-12-inch.dtb
+		devicetree ($$root)${bootpath}/x1p42100-microsoft-sp12in.dtb
 		linux ($$root)${bootpath}/${kernel_file} ${boot_options} $${basicgfx}
 		initrd ($$root)${bootpath}/${initrd_file}
 	}
diff --git a/repositories/kernel-surface.xml b/repositories/kernel-surface.xml
new file mode 100644
index 0000000..f92c1b0
--- /dev/null
+++ b/repositories/kernel-surface.xml
@@ -0,0 +1,31 @@
+<image>
+	<!-- Surface Pro 12" (Snapdragon X1P-42-100): the patched kernel.
+	     Built from the sibling ../kernel-surface checkout (see that directory's
+	     README.md). components/boot.xml installs kernel-surface by name and
+	     ignores Fedora's kernel packages, so this repository is not optional:
+	     without it the image cannot depsolve at all.
+
+	     priority="1" beats the fedora/updates repositories, which carry no
+	     priority and therefore sit at dnf's default 99 (lower number wins).
+
+	     A local directory repository, which is what a plain `createrepo_c` over
+	     a directory of RPMs produces. In CI the Jenkinsfile fills it from the
+	     dist-sayagit-fedora-rpm B2 bucket that the kernel-surface pipeline
+	     publishes to, then runs createrepo_c, all before kiwi starts. The
+	     bucket stays private, so the RPM is pulled with credentials instead of
+	     this description pointing at a public URL. By hand:
+
+	         sudo mkdir -p /var/lib/kernel-surface-repo
+	         sudo cp ~/rpmbuild/RPMS/aarch64/kernel-surface-*.rpm \
+	             /var/lib/kernel-surface-repo/
+	         sudo createrepo_c /var/lib/kernel-surface-repo
+
+	     The path has to exist on the build host before kiwi starts; kiwi binds
+	     a dir:// repository into the image root at the same path. It has no
+	     <signing> element, so kiwi configures it with gpgcheck off. Changing
+	     the path here means changing KERNEL_SURFACE_REPO in the Jenkinsfile
+	     too. -->
+	<repository type="rpm-md" alias="kernel-surface" priority="1">
+		<source path="dir:///var/lib/kernel-surface-repo"/>
+	</repository>
+</image>
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree
index 37226e7..2acf815 100644
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree
@@ -1 +1 @@
-qcom/x1p42100-microsoft-surface-pro-12-inch.dtb
+qcom/x1p42100-microsoft-sp12in.dtb
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service
index 5b252fd..2e3cf82 100644
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service
@@ -1,6 +1,5 @@
 [Unit]
 Description=HexagonRPC Service
-After=network.target
 
 [Service]
 ExecStart=/usr/local/bin/hexagonrpcd -f /dev/fastrpc-adsp-secure -s
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service
deleted file mode 100644
index f0eb446..0000000
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service
+++ /dev/null
@@ -1,11 +0,0 @@
-[Unit]
-Description=IIO Sensor Proxy Service
-After=network.target hexagonrpc.service
-Requires=hexagonrpc.service
-
-[Service]
-ExecStart=/usr/libexec/iio-sensor-proxy
-Restart=on-failure
-
-[Install]
-WantedBy=multi-user.target
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf
new file mode 100644
index 0000000..7b3cfcb
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf
@@ -0,0 +1,14 @@
+# Surface Pro 12" (Snapdragon X1P-42-100)
+#
+# The sensors on this device are not IIO devices. They live behind the SLPI
+# DSP, reached over fastrpc by hexagonrpcd, and iio-sensor-proxy only sees them
+# through the SSC backend it is built with here (-Dssc-support=enabled). So it
+# has to start after that daemon, and stop being useful if the daemon dies.
+#
+# A drop-in rather than a replacement unit: upstream's own unit is D-Bus
+# activated (Type=dbus, BusName=net.hadess.SensorProxy), which is how anything
+# asking for net.hadess.SensorProxy gets the service started, and overriding it
+# wholesale traded that away for nothing but this ordering.
+[Unit]
+Requires=hexagonrpc.service
+After=hexagonrpc.service
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install
index c12ff47..2dadac5 100644
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install
@@ -5,11 +5,28 @@ umask 022
 COMMAND="$1"
 KVER="$2"
 
-SRC="/etc/surface-dtb/x1p42100-microsoft-surface-pro-12-inch.dtb"
-DEST="/usr/lib/modules/${KVER}/dtb/qcom/x1p42100-microsoft-surface-pro-12-inch.dtb"
+DTB_NAME=x1p42100-microsoft-sp12in.dtb
+DEST="/usr/lib/modules/${KVER}/dtb/qcom/${DTB_NAME}"
+
+# The master copy comes from kernel-surface: it builds the dtb in-tree from the
+# patched dts and installs it under /usr/lib/surface-dtb, deliberately outside
+# any /usr/lib/modules/<kver>, so it can be re-staged into any kernel installed
+# alongside it.
+SRC="/usr/lib/surface-dtb/${DTB_NAME}"
+[ -f "${SRC}" ] || SRC=""
 
 case "${COMMAND}" in
 	add)
+		# No master and no dtb already in this kernel's tree means there is
+		# nothing this board can boot with, so say so rather than failing
+		# silently three steps later in the boot loader.
+		if [ -z "${SRC}" ]; then
+			if [ -f "${DEST}" ]; then
+				exit 0
+			fi
+			echo "60-surface-dtb: no ${DTB_NAME} in /usr/lib/surface-dtb" >&2
+			exit 1
+		fi
 		mkdir -p "$(dirname ${DEST})"
 		cp -f "${SRC}" "${DEST}"
 		chmod 644 "${DEST}"
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install
index 375b085..f0314b0 100644
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install
@@ -29,15 +29,16 @@ KVER="${2:-}"
 [ "$COMMAND" = "add" ] || exit 0
 [ -n "$KVER" ] || exit 0
 
-DTB_NAME=x1p42100-microsoft-surface-pro-12-inch.dtb
+DTB_NAME=x1p42100-microsoft-sp12in.dtb
 DTB_REL="qcom/$DTB_NAME"
 BOOT_ROOT="${KERNEL_INSTALL_BOOT_ROOT:-/boot}"
 
 # 60-surface-dtb.install stages the dtb into this kernel's module tree; fall
-# back to the master copy if it has not run (or was removed).
+# back to kernel-surface's version-independent master copy if it has not run
+# (or was removed).
 DTB_SRC="/usr/lib/modules/${KVER}/dtb/${DTB_REL}"
 if [ ! -f "$DTB_SRC" ]; then
-	DTB_SRC="/etc/surface-dtb/$DTB_NAME"
+	DTB_SRC="/usr/lib/surface-dtb/$DTB_NAME"
 fi
 [ -f "$DTB_SRC" ] || exit 0
 
diff --git a/surface-editbootconfig.sh b/surface-editbootconfig.sh
new file mode 100755
index 0000000..a426645
--- /dev/null
+++ b/surface-editbootconfig.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+# Surface Pro 12" (Snapdragon X1P-42-100): put the device tree on the ISO.
+#
+# kiwi has no device tree support of its own, and the ISO's GRUB needs the dtb
+# as a plain file it can read: it loads it with a "devicetree" line before the
+# kernel (see grub-arm.cfg.iso-template), it cannot read the erofs root image,
+# and kiwi copies only the kernel and the initrd into the ISO's loader
+# directory.
+#
+# editbootconfig is the one hook that reaches the ISO tree. kiwi's live builder
+# calls it with "iso:<media dir>" as the first argument and the image root as
+# the working directory, after setup_media_loader_directory has created the
+# loader directory and the GRUB config has been written. So the dtb can be
+# taken straight out of the kernel-surface RPM installed in the image root,
+# which is why config-cdroot.tar is no longer needed to carry a committed copy.
+
+set -euo pipefail
+
+target="${1:-}"
+case "${target}" in
+	iso:*) media_dir="${target#iso:}" ;;
+	*)
+		echo "surface-editbootconfig: expected an iso: target, got '${target}'" >&2
+		exit 1
+		;;
+esac
+
+dtb_name=x1p42100-microsoft-sp12in.dtb
+
+# The working directory is the image root, so this is kernel-surface's own
+# version-independent copy. config.sh has already failed the build if the
+# package did not provide it.
+dtb_src="usr/lib/surface-dtb/${dtb_name}"
+if [[ ! -f "${dtb_src}" ]]; then
+	echo "surface-editbootconfig: ${dtb_src} not found in the image root" >&2
+	exit 1
+fi
+
+# ${bootpath} in the GRUB template is /boot/<kiwi platform name>/loader. Read
+# the directory back off the media tree rather than recomputing that name, so
+# the dtb cannot end up somewhere the GRUB config does not look.
+loader_dirs=("${media_dir}"/boot/*/loader)
+if [[ ${#loader_dirs[@]} -ne 1 || ! -d "${loader_dirs[0]}" ]]; then
+	echo "surface-editbootconfig: expected one ${media_dir}/boot/*/loader, found ${#loader_dirs[@]}" >&2
+	exit 1
+fi
+
+install -Dm644 "${dtb_src}" "${loader_dirs[0]}/${dtb_name}"
+echo "surface-editbootconfig: staged ${loader_dirs[0]}/${dtb_name}"