aboutsummaryrefslogtreecommitdiffci
diff refs
from: back
to: back
| flip
diff options
context:
space:
mode:
-rw-r--r--Fedora.kiwi1
-rw-r--r--Jenkinsfile163
-rw-r--r--README.md16
-rw-r--r--components/boot.xml59
-rw-r--r--components/liveinstall.xml13
-rw-r--r--config-cdroot.tarbin204800 -> 0 bytes
-rwxr-xr-xconfig.sh145
-rw-r--r--docs/FedoraOnSurface.jpgbin0 -> 529833 bytes
-rw-r--r--grub-arm.cfg.iso-template11
-rw-r--r--repositories/kernel-sp12in.xml6
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/db/local.d/00-power-button2
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/profile/user2
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/cmdline2
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree2
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/logind.conf.d/60-surface-power-key.conf2
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service1
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service11
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf14
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service12
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/wireupcameras.service13
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/yum.repos.d/kernel-sp12in.repo7
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install28
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install10
-rwxr-xr-xroot/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh183
-rw-r--r--root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/wireupcameras.sh18
-rwxr-xr-xsurface-editbootconfig.sh49
26 files changed, 658 insertions, 112 deletions
diff --git a/Fedora.kiwi b/Fedora.kiwi
index dda43e5..6ac2adb 100644
--- a/Fedora.kiwi
+++ b/Fedora.kiwi
@@ -15,6 +15,7 @@
<release-version>45</release-version>
</preferences>
<include from="this://./repositories/core.xml"/>
+ <include from="this://./repositories/kernel-sp12in.xml"/>
<include from="this://./components/common.xml"/>
<include from="this://./components/boot.xml"/>
<include from="this://./components/desktops/common.xml"/>
diff --git a/Jenkinsfile b/Jenkinsfile
new file mode 100644
index 0000000..1732307
--- /dev/null
+++ b/Jenkinsfile
@@ -0,0 +1,163 @@
+pipeline {
+ agent none
+
+ options {
+ timestamps()
+ }
+
+ environment {
+ KIWI_FILE = 'Fedora.kiwi'
+ IMAGE_TYPE = 'iso'
+ IMAGE_PROFILE = 'Workstation-Live'
+ IMAGE_VERSION = '45'
+ OUTPUT_DIR = 'outdir'
+
+ B2_ENDPOINT = 'https://s3.eu-central-003.backblazeb2.com'
+ AWS_DEFAULT_REGION = 'eu-central-003'
+ ISO_BUCKET = 'dist-sayagit-fedora-iso'
+
+ // Must match the <source path="..."/> in
+ // repositories/kernel-sp12in.xml.
+ KERNEL_SURFACE_REPO_URL = 'https://rpm.sayag.it/kernel-sp12in/fedora/45/aarch64'
+
+ // awscli2 sends CRC32 checksums by default, which B2 rejects. Ask for
+ // them only where the S3 API requires them.
+ AWS_REQUEST_CHECKSUM_CALCULATION = 'when_required'
+ AWS_RESPONSE_CHECKSUM_VALIDATION = 'when_required'
+ }
+
+ stages {
+ stage('Build Fedora Workstation Live ISO (ARM64)') {
+ agent {
+ kubernetes {
+ defaultContainer 'kiwi'
+ yaml """
+apiVersion: v1
+kind: Pod
+metadata:
+ namespace: jenkins
+spec:
+ nodeSelector:
+ kubernetes.io/arch: arm64
+ containers:
+ - name: kiwi
+ image: fedora:44
+ imagePullPolicy: Always
+ command: [ 'sleep' ]
+ args: [ 'infinity' ]
+ tty: true
+ securityContext:
+ privileged: true
+ resources:
+ requests:
+ cpu: "2"
+ memory: 4Gi
+ ephemeral-storage: 20Gi
+ limits:
+ memory: 12Gi
+ ephemeral-storage: 50Gi
+"""
+ }
+ }
+ steps {
+ checkout scm
+ container('kiwi') {
+ script {
+ try {
+ // The kernel-surface RPM is a build input, not
+ // something this repository can produce: the image
+ // installs kernel-surface by name and <ignore>s
+ // Fedora's kernel packages. Its pipeline publishes
+ // it to rpm.sayag.it, which repositories/kernel-sp12in.xml
+ // points at directly, so there is nothing to stage
+ // here. Fail now rather than several minutes into
+ // kiwi on an unresolvable package name.
+ sh '''
+ set -eux
+
+ dnf --assumeyes install curl
+
+ repomd="${KERNEL_SURFACE_REPO_URL}/repodata/repomd.xml"
+ if ! curl -fsS --retry 3 -o /dev/null "${repomd}"; then
+ echo "No kernel-surface repository at ${repomd}." >&2
+ echo "Run the kernel-surface pipeline for Fedora ${IMAGE_VERSION} first." >&2
+ exit 1
+ fi
+ '''
+
+ sh '''
+ dnf --assumeyes install git kiwi kiwi-systemdeps distribution-gpg-keys
+ git config --global --add safe.directory .
+ git submodule update --init --recursive
+
+ ./kiwi-build \\
+ --kiwi-file="${KIWI_FILE}" \\
+ --image-type="${IMAGE_TYPE}" \\
+ --image-profile="${IMAGE_PROFILE}" \\
+ --output-dir "${OUTPUT_DIR}"
+
+ ls -lh "${OUTPUT_DIR}-build"
+ '''
+ } catch (Exception e) {
+ echo "Caught exception: ${e.getMessage()}"
+ currentBuild.result = 'FAILURE'
+ throw e
+ }
+ }
+ stash name: "fedora-workstation-live-iso-stash", includes: "${OUTPUT_DIR}-build/Fedora.aarch64-${IMAGE_VERSION}.iso"
+ }
+ }
+ }
+
+ stage('Push Fedora Workstation Live ISO (ARM64)') {
+ agent {
+ kubernetes {
+ defaultContainer 's5cmd'
+ yaml """
+apiVersion: v1
+kind: Pod
+metadata:
+ namespace: jenkins
+spec:
+ containers:
+ - name: s5cmd
+ image: peakcom/s5cmd:v2.3.0
+ imagePullPolicy: IfNotPresent
+ command: [ 'sleep' ]
+ args: [ 'infinity' ]
+ tty: true
+ resources:
+ requests:
+ cpu: "0.5"
+ memory: 4Gi
+"""
+ }
+ }
+ steps {
+ container('s5cmd') {
+ unstash "fedora-workstation-live-iso-stash"
+ withCredentials([usernamePassword(
+ credentialsId: 'backblaze-b2-dist-iso',
+ usernameVariable: 'AWS_ACCESS_KEY_ID',
+ passwordVariable: 'AWS_SECRET_ACCESS_KEY')]) {
+ sh '''
+ set -eux
+
+ cd "${OUTPUT_DIR}-build"
+ src="Fedora.aarch64-${IMAGE_VERSION}.iso"
+ moddate=$(date -r "${src}" -u +"%Y%m%d-%H%M%S")
+ dst="Fedora.Surface-Pro-12in.${IMAGE_PROFILE}.${IMAGE_VERSION}.${moddate}.aarch64.iso"
+ mv "${src}" "${dst}"
+ ls -lh
+
+ /s5cmd --endpoint-url "${B2_ENDPOINT}" cp \\
+ --content-type "application/x-iso9660-image" \\
+ "${dst}" \\
+ "s3://${ISO_BUCKET}/fedora/${IMAGE_VERSION}/aarch64/${dst}"
+ '''
+ }
+ }
+ }
+ }
+ }
+}
diff --git a/README.md b/README.md
index b9cc94e..b34e38b 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,8 @@
# Fedora KIWI image descriptions, modified to build & launch for Surface Pro 12" Gen 1
+![Fedora Workstation Rawhide running on Surface Pro 12"](docs/FedoraOnSurface.jpg)
+
It is the fork of the original [KIWI image descriptions](https://forge.fedoraproject.org/releng/kiwi-descriptions), modified for launching Fedora Linux Rawhide Live ISO on Surface Pro 12" Gen 1 (and further installing it on the device).
I bought this device as I viewed it as a great Linux GNOME tablet, but after several days, many hours of work of trying to do so, I must say that installing a distribution here (and then having it work fine) is a huge pain in the ass.
@@ -24,18 +26,22 @@ To build this on Fedora Linux:
[]$ sudo dnf --assumeyes install kiwi kiwi-systemdeps distribution-gpg-keys
# Run the image build
[]$ sudo ./kiwi-build --kiwi-file=Fedora.kiwi --image-type=<image_type> --image-profile=<image_profile> --output-dir ./outdir
-# An example for Workstation Live CD ISO
+# An example for Workstation Live CD ISO, takes around 16 minutes
[]$ sudo ./kiwi-build --kiwi-file=Fedora.kiwi --image-type=iso --image-profile=Workstation-Live --output-dir ./outdir
```
## What is left out (for now)
-* Live CD has to run in RAM, so `rd.live.ram=1` is set for cmdline. Otherwise, at least on my ancient flash drive, it fails to load multiple necessary services, including `polkit`.
+* Live CD has to run in RAM, so `rd.live.ram=1` is set for cmdline. Otherwise, at least on my ancient flash drive, it fails to load multiple necessary services, including `polkit`. So, ~5 minutes of loading on USB 2 drive, while screen is not backlit, is to be expected.
* No rescue vmlinuz.
* No secure boot possible for this ISO for now, as the platform used is `efi` and not `uefi`.
-* No GRUB auto hidden menu. Trying to have the menu hidden results in system leads to restart after trying to boot it.
-* `wireupcameras.service` (which enables tablet's cameras to be used) fails on installed system (not in Live CD though), as no `/dev/media*` gets initialized.
-* No hardware video decoding for now, as the iris video codec (`qcvss8380_pa.mbn`) is Windows-only (as far as I researched), but you can copy one to `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/`, if you have Windows ARM64 partition.
+* No GRUB auto hidden menu. Trying to have the menu hidden results in system restarting after trying to boot it.
+* Hardware video encoding/decoding needs a firmware blob the image is not allowed to ship. The `qcom/vpu/vpu30_p1_s7.mbn` that `linux-firmware` provides is the same codec signed with Qualcomm's SecTools *test* key chain, which a retail Surface's TrustZone rejects -- `qcom_scm_pas_init_image()` fails and the kernel logs `qcom-iris aa00000.video-codec: error -22 initializing firmware`. The production-signed build exists only inside Microsoft's Surface driver package, which grants no redistribution right, so what ships here is the means and not the blob:
+ * If you kept the Windows ARM64 partition, `surface-video-firmware.service` finds it on the first boot after install and copies `qcvss8380_pa.mbn` out of its DriverStore. Nothing to do.
+ * If Windows is gone, download the [Surface Pro 12-inch driver pack](https://www.microsoft.com/en-us/download/details.aspx?id=108199) (~500 MB MSI) and run `sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi`. There is no automatic download: the Download Center hands out per-session links.
+
+ The kernel's device tree already points `iris` at `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn`, so the driver picks it up as soon as it is there.
+* Suspend on Snapdragon X is still very unstable. No deep sleep is available, so `mem_sleep_default=s2idle` was set. Even that leads to compromises as suspending via GNOME results in hard freeze, so the default power button behavior was changed to `interactive` and should not be changed back to `suspend`.
## Image variants
diff --git a/components/boot.xml b/components/boot.xml
index 816bb91..11b48a5 100644
--- a/components/boot.xml
+++ b/components/boot.xml
@@ -42,17 +42,44 @@
<package name="systemd-oomd-defaults"/>
<package name="systemd-resolved"/>
</packages>
- <packages type="image" patternType="plusRecommended" profiles="BootCore">
- <ignore name="kernel-*debug*"/>
- <package name="kernel-core"/>
- </packages>
- <packages type="image" patternType="plusRecommended" profiles="BootCoreLive">
+ <!-- Surface Pro 12" (Snapdragon X1P-42-100) kernel selection. One block for
+ every profile that needs a kernel: BootCore, BootCoreLive, and
+ BootDiskCore through its <requires profile="BootCore"/> above.
+
+ kernel-surface is vanilla upstream plus the miasvanklei overlay's patch
+ set for this board (device tree, SAM RTC, SAM suspend workaround,
+ CAMSS/CSI-2, remoteproc attach, clk/PCI/irqchip fixes). It is built from
+ the sibling ../kernel-surface checkout and comes from the repository
+ repositories/kernel-sp12in.xml adds.
+
+ It is a single package (kernel image, every module, device trees) and
+ Provides kernel, kernel-core, kernel-modules, kernel-modules-core and
+ kernel-modules-extra, so anything with a plain Requires on one of those
+ resolves against it. That is why no -modules/-modules-extra entry is
+ needed in any profile any more.
+
+ Fedora's split kernel packages are ignored by name instead, so dnf can
+ never drag one in as a dependency. kernel-uki-dtbloader is ignored as
+ well: kernel-surface Conflicts it, so without the exclusion any package
+ pulling it in would fail the depsolve instead of just losing it. It
+ bakes in ~3000 boards' dtbs (.dtbauto sections), does not carry this
+ board, and is a hard Requires of the plain "kernel" metapackage on
+ aarch64, which makes that metapackage uninstallable here too, since it
+ is also the only thing that could satisfy kernel-core by name.
+
+ Consequence for the profiles this fork does not target: the ones that
+ still ask for a Fedora kernel by name through BootCore, namely
+ Server-Host-Generic (kernel) and Cloud-Base-Azure (kernel-modules),
+ cannot depsolve. Everything this device builds (Live via BootCoreLive,
+ disk via BootDiskCore) takes its kernel from here. -->
+ <packages type="image" patternType="plusRecommended" profiles="BootCore,BootCoreLive">
<ignore name="kernel-*debug*"/>
- <!-- Surface Pro 12": kernel-uki-dtbloader bakes in ~3000 boards' dtbs
- (.dtbauto sections) and hard-conflicts with kernel-core. This board
- isn't in its dtb database anyway (dtb delivered separately via
- grub's devicetree directive), so plain kernel-core is enough. -->
- <package name="kernel-core"/>
+ <ignore name="kernel-core"/>
+ <ignore name="kernel-modules"/>
+ <ignore name="kernel-modules-core"/>
+ <ignore name="kernel-modules-extra"/>
+ <ignore name="kernel-uki-dtbloader"/>
+ <package name="kernel-surface"/>
</packages>
<packages type="image" patternType="plusRecommended" profiles="BootCoreUKI">
<package name="shim-signed-aa64"/>
@@ -66,16 +93,12 @@
<package name="grub2-efi-aa64-cdboot"/>
</packages>
<packages type="image" patternType="plusRecommended" profiles="BootDiskCore">
- <ignore name="kernel-*debug*"/>
<package name="glibc-all-langpacks"/>
- <!-- Surface Pro 12": kernel-core, not kernel-uki-dtbloader's multi-board
- dtb bloat, same reasoning as BootCoreLive above. arm-image-installer
- and uboot-images-armv8 dropped too, they exist for flashing/booting
- other ARM SBCs (device-tree selection, U-Boot), not relevant to this
+ <!-- Surface Pro 12": the kernel comes from the shared BootCore block
+ above, which this profile requires. arm-image-installer and
+ uboot-images-armv8 dropped, they exist for flashing/booting other
+ ARM SBCs (device-tree selection, U-Boot), not relevant to this
single UEFI/GPT device. -->
- <package name="kernel-core"/>
- <package name="kernel-modules"/>
- <package name="kernel-modules-extra"/>
<package name="btrfs-progs"/>
<package name="udisks2-btrfs"/>
</packages>
diff --git a/components/liveinstall.xml b/components/liveinstall.xml
index 55ae4eb..6b683b2 100644
--- a/components/liveinstall.xml
+++ b/components/liveinstall.xml
@@ -10,8 +10,9 @@
publisher="Fedora Project" volid="Fedora_Linux" application_id="Fedora_Linux"
primary="true" flags="dmsquash" filesystem="erofs" erofscompression="lzma,level=6" mediacheck="true"
firmware="efi" efiparttable="gpt" efifatimagesize="30"
- kernelcmdline="quiet rhgb clk_ignore_unused pd_ignore_unused systemd.tpm2_wait=0 rd.live.ram=1"
+ kernelcmdline="quiet rhgb mem_sleep_default=s2idle clk_ignore_unused pd_ignore_unused systemd.tpm2_wait=0 rd.live.ram=1"
fscreateoptions="-Efragments -C 1048576"
+ editbootconfig="surface-editbootconfig.sh"
>
<bootloader name="grub2" grub_template="grub-arm.cfg.iso-template" console="console" timeout="10"/>
</type>
@@ -28,12 +29,10 @@
<package name="dracut-live"/>
<package name="glibc-all-langpacks"/>
<package name="isomd5sum"/>
- <!-- Surface Pro 12": no plain "kernel" package here, it hard-Requires
- kernel-uki-dtbloader on aarch64, which conflicts with BootCoreLive's
- kernel-core. grub2's ISO kernel lookup just needs a vmlinuz in /boot,
- which kernel-core (already installed there) already provides. -->
- <package name="kernel-modules"/>
- <package name="kernel-modules-extra"/>
+ <!-- Surface Pro 12": no kernel package here at all. BootCoreLive's
+ kernel-surface already carries every module, and its %posttrans
+ kernel-install leaves the /boot vmlinuz that grub2's ISO kernel
+ lookup needs. See the kernel block in components/boot.xml. -->
<package name="livesys-scripts"/>
<package name="btrfs-progs"/>
<package name="udisks2-btrfs"/>
diff --git a/config-cdroot.tar b/config-cdroot.tar
deleted file mode 100644
index 6aafdc9..0000000
--- a/config-cdroot.tar
+++ /dev/null
Binary files differ
diff --git a/config.sh b/config.sh
index 7ae0dac..be5a142 100755
--- a/config.sh
+++ b/config.sh
@@ -58,7 +58,7 @@ if [[ "$kiwi_profiles" != *"Container"* ]] && [[ "$kiwi_profiles" != *"FEX"* ]]
## "devicetree /dtb-$kver/$GRUB_DEVICETREE". /etc/kernel/devicetree does
## nothing here: /boot/<machine-id> does not exist, so kernel-install runs
## with layout=other and 90-loaderentry.install (which would read it) bails.
- echo "GRUB_DEVICETREE=qcom/x1p42100-microsoft-surface-pro-12-inch.dtb" >> /etc/default/grub
+ echo "GRUB_DEVICETREE=qcom/x1p42100-microsoft-sp12in.dtb" >> /etc/default/grub
## Upstream sets menu_auto_hide=1 + boot_indeterminate=1 here for Disk images
## to match anaconda's behaviour. Deliberately not done for Surface Pro 12":
## with the menu hidden, GRUB counts down GRUB_TIMEOUT against a blank screen
@@ -436,18 +436,45 @@ fi
# Surface Pro 12" customizations
#--------------------------------------
-# /etc/surface-dtb is the master copy 60-surface-dtb.install re-stages into each
-# new kernel's module tree on update. The other two are what that hook and
-# 10-devicetree.install would normally produce, done up front here because
-# kernel-install never runs during this build -- without the module-tree copy,
-# anything keyed off /usr/lib/modules/$kver/dtb (including the anaconda
-# post-script) finds nothing and silently does nothing.
-install -Dm644 /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/boot/dtb \
- "/etc/surface-dtb/x1p42100-microsoft-surface-pro-12-inch.dtb"
-install -Dm644 /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/boot/dtb \
- "/usr/lib/modules/$kver/dtb/qcom/x1p42100-microsoft-surface-pro-12-inch.dtb"
-install -Dm644 /tmp/harrisonvanderbyl/surface-pro-12-inch-linux/boot/dtb \
- "/boot/dtb-$kver/qcom/x1p42100-microsoft-surface-pro-12-inch.dtb"
+install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/yum.repos.d/kernel-sp12in.repo \
+ /etc/yum.repos.d/kernel-sp12in.repo
+
+# Device tree. kernel-surface compiles the patched dts in-tree and installs the
+# result twice: into its own module tree (dtb/qcom, from dtbs_install) and into
+# /usr/lib/surface-dtb/<kver>/. The latter is the master copy
+# 60-surface-dtb.install re-stages into a kernel that shipped without one,
+# which is the only reason the image no longer carries a prebuilt blob of its
+# own -- the description installs kernel-surface by name and <ignore>s Fedora's
+# kernel packages, so the package is always there.
+#
+# One name throughout, upstream's: this block, GRUB_DEVICETREE above, both
+# kernel-install plugins, /etc/kernel/devicetree, and the ISO grub template.
+#
+# The module-tree and /boot copies plus the /boot/dtb symlink are what that hook
+# and grubby's 10-devicetree.install would normally produce, done up front here
+# because kernel-install does not run again during this build -- without the
+# module-tree copy, anything keyed off /usr/lib/modules/$kver/dtb (including the
+# anaconda post-script) finds nothing and silently does nothing.
+dtb_name=x1p42100-microsoft-sp12in.dtb
+# One directory per kernel version under /usr/lib/surface-dtb: kernel-surface is
+# installonly, so nothing it owns can be version-unqualified. Only one release is
+# ever installed at this point in the build, but glob anyway rather than assume.
+dtb_src=$(ls -1 /usr/lib/surface-dtb/*/"$dtb_name" 2>/dev/null | sort -V | tail -n1)
+if [[ -z "$dtb_src" ]]; then
+ printf 'Error: no %s under /usr/lib/surface-dtb/, so kernel-surface (built from ../kernel-surface) is not installed.\n' "$dtb_name" >&2
+ exit 1
+fi
+install -Dm644 "$dtb_src" "/usr/lib/modules/$kver/dtb/qcom/$dtb_name"
+install -Dm644 "$dtb_src" "/boot/dtb-$kver/qcom/$dtb_name"
+# dtbs_install ships every arm64 device tree, ~1000 boards, and the module tree
+# goes straight into the image filesystem. This image targets exactly one board,
+# so drop the rest -- the same objection that rules out kernel-uki-dtbloader in
+# components/boot.xml. Only affects the image; a later kernel-surface update on
+# the installed system restores the full tree.
+find "/usr/lib/modules/$kver/dtb" -mindepth 1 \
+ \! -path "/usr/lib/modules/$kver/dtb/qcom" \
+ \! -name "$dtb_name" \
+ -delete
# /boot/dtb -> dtb-$kver is what grubby's 10-devicetree.install maintains, and
# what the boot loader entry's devicetree path resolves through
ln -sfn "dtb-$kver" /boot/dtb
@@ -507,7 +534,7 @@ fi
# documented way to disable a plugin: a /dev/null symlink of the same name).
mkdir -p /etc/kernel/install.d
ln -sf /dev/null /etc/kernel/install.d/51-dracut-rescue.install
-# kernel-core's own package scriptlet already ran kernel-install once, before
+# kernel-surface's %posttrans scriptlet already ran kernel-install once, before
# this mask existed (root overlay lands after package install), leaving a
# stale rescue image behind. Remove it now so kiwi's systemd_boot EFI-FAT-image
# step doesn't try to cram it in too.
@@ -604,23 +631,85 @@ dnf install -y alsa-ucm-utils
install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service \
/etc/systemd/system/hexagonrpc.service
-install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service \
- /etc/systemd/system/iio-sensor-proxy.service
-install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules \
- /etc/udev/rules.d/61-sensors-surface-pro-12-inch.rules
-systemctl enable hexagonrpc.service iio-sensor-proxy.service
-# Rear camera pipeline (msm/camss) needs /dev/media0, which only exists once the
-# real silicon probes on the booted system -- install the wiring but do not run
-# it here, there is no camera hardware in the KIWI build chroot.
+# iio-sensor-proxy keeps the unit its own build installed, and gets only the
+# ordering against hexagonrpcd added on top. The drop-in is dead weight if that
+# unit is not there, so check rather than let it pass silently.
+test -f /usr/lib/systemd/system/iio-sensor-proxy.service
+install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf \
+ /etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf
+
+# Only hexagonrpcd is enabled statically. iio-sensor-proxy is started through
+# its D-Bus name by whatever asks for net.hadess.SensorProxy, which then pulls
+# hexagonrpc.service in through the drop-in above.
+systemctl enable hexagonrpc.service
+
+# Cameras (msm/camss). Nothing has to be wired up at boot. libcamera's "simple"
+# pipeline handler claims qcom-camss and builds the media graph itself in
+# configure(), including flipping the csiphy -> msm_csid0 link between the rear
+# ov13858 and the front ov02c10, so a media-ctl unit only fights it: pinning
+# csid0 to the rear sensor at boot leaves the front camera disconnected until
+# something re-links it, and the formats such a unit has to guess are what made
+# the old wireupcameras.service die with "Unable to setup formats: Invalid
+# argument (22)" on every boot.
+#
+# v4l-utils stays, for inspecting the graph by hand -- media-ctl -p, and
+# v4l2-ctl --stream-mmap on the RDI node to check the sensor below libcamera.
dnf install -y v4l-utils
-install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/wireupcameras.sh \
- /usr/local/bin/wireupcameras.sh
-install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/wireupcameras.service \
- /etc/systemd/system/wireupcameras.service
-systemctl enable wireupcameras.service
-restorecon -Rv /usr /lib /etc/systemd/system /etc/udev/rules.d
+# The front ov02c10 needs a libcamera that knows its analogue gain model and
+# black level; upstream libcamera has neither, and there is no plugin mechanism
+# for them, but kernel-sp12in repo offers libcamera with supported models.
+# Pulled in by name because it would otherwise only arrive as a dependency,
+# which makes it easy to lose without noticing.
+dnf install -y libcamera libcamera-ipa
+
+libcamera_nevra=$(rpm -q libcamera)
+case "${libcamera_nevra}" in
+ *.sp12in*) printf 'Using %s\n' "${libcamera_nevra}" ;;
+ *)
+ printf 'Error: %s is Fedora'"'"'s libcamera, not the sp12in rebuild.\n' \
+ "${libcamera_nevra}" >&2
+ printf 'Fedora has probably bumped the release past the rebuild; rebase\n' >&2
+ printf 'patches/ in ../libcamera and tag a new release suffix.\n' >&2
+ exit 1
+ ;;
+esac
+
+# Hardware video decode needs firmware this image is not allowed to carry. The
+# qcom/vpu/vpu30_p1_s7.mbn in linux-firmware is the same codec signed with
+# Qualcomm's SecTools test keys, which a retail Surface's TrustZone rejects, and
+# the production-signed build exists only inside Microsoft's Surface driver
+# package, under terms that grant no redistribution right.
+#
+# So the image ships the means rather than the blob: a script that copies it out
+# of a Windows install the owner already has a licence for, and a unit that runs
+# that once on a dual-boot machine. Where Windows is gone, the script says which
+# driver pack to download and how to point it at one.
+dnf install -y msitools
+install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh \
+ /usr/local/bin/surface-video-firmware.sh
+install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service \
+ /etc/systemd/system/surface-video-firmware.service
+systemctl enable surface-video-firmware.service
+
+# Suspend on Snapdragon is still very unstable. This is the reason why
+# 'mem_sleep_default=s2idle' is set explicitly in the cmdline as 'deep' mode
+# does not function at all.
+# Even then, suspending via gnome settings daemon results in hard freeze.
+# This is why:
+# logind behavior is kept intact with suspend behavior.
+# gnome default power button behavior was replaced with 'interactive'.
+install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/logind.conf.d/60-surface-power-key.conf \
+ /etc/systemd/logind.conf.d/60-surface-power-key.conf
+install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/db/local.d/00-power-button \
+ /etc/dconf/db/local.d/00-power-button
+install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/profile/user \
+ /etc/dconf/profile/user
+
+dconf update
+
+restorecon -Rv /usr /lib /etc/systemd /etc/dconf /etc/udev/rules.d /etc/yum.repos.d
#======================================
# Set the WSL name for ELN
diff --git a/docs/FedoraOnSurface.jpg b/docs/FedoraOnSurface.jpg
new file mode 100644
index 0000000..6b37f3c
--- /dev/null
+++ b/docs/FedoraOnSurface.jpg
Binary files differ
diff --git a/grub-arm.cfg.iso-template b/grub-arm.cfg.iso-template
index 8badfb5..447a1f3 100644
--- a/grub-arm.cfg.iso-template
+++ b/grub-arm.cfg.iso-template
@@ -26,19 +26,24 @@ set timeout_style=${boot_timeout_style}
search ${search_params}
+# Surface Pro 12" (Snapdragon X1P-42-100): the dtb the entries below load is a
+# plain file in this same loader directory on the ISO9660 filesystem. GRUB
+# cannot read the erofs root image, and kiwi has no device tree support, so
+# surface-editbootconfig.sh copies it there out of the kernel-surface RPM in the
+# image root. See that script for why editbootconfig is the hook that can.
menuentry "Start ${title}" --class fedora --class gnu-linux --class gnu --class os {
- devicetree ($$root)${bootpath}/x1p42100-microsoft-surface-pro-12-inch.dtb
+ devicetree ($$root)${bootpath}/x1p42100-microsoft-sp12in.dtb
linux ($$root)${bootpath}/${kernel_file} ${boot_options}
initrd ($$root)${bootpath}/${initrd_file}
}
menuentry "Test this media & start ${title}" --class fedora --class gnu-linux --class gnu --class os {
- devicetree ($$root)${bootpath}/x1p42100-microsoft-surface-pro-12-inch.dtb
+ devicetree ($$root)${bootpath}/x1p42100-microsoft-sp12in.dtb
linux ($$root)${bootpath}/${kernel_file} ${boot_options} rd.live.check
initrd ($$root)${bootpath}/${initrd_file}
}
submenu "Troubleshooting -->" {
menuentry "Start ${title} in basic graphics mode" --class fedora --class gnu-linux --class gnu --class os {
- devicetree ($$root)${bootpath}/x1p42100-microsoft-surface-pro-12-inch.dtb
+ devicetree ($$root)${bootpath}/x1p42100-microsoft-sp12in.dtb
linux ($$root)${bootpath}/${kernel_file} ${boot_options} $${basicgfx}
initrd ($$root)${bootpath}/${initrd_file}
}
diff --git a/repositories/kernel-sp12in.xml b/repositories/kernel-sp12in.xml
new file mode 100644
index 0000000..2419e06
--- /dev/null
+++ b/repositories/kernel-sp12in.xml
@@ -0,0 +1,6 @@
+<image>
+ <!-- Surface Pro 12" (Snapdragon X1P-42-100): the patched kernel + libcamera.-->
+ <repository type="rpm-md" alias="kernel-surface" priority="1">
+ <source path="https://rpm.sayag.it/kernel-sp12in/fedora/$releasever/aarch64/"/>
+ </repository>
+</image>
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/db/local.d/00-power-button b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/db/local.d/00-power-button
new file mode 100644
index 0000000..1b69eab
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/db/local.d/00-power-button
@@ -0,0 +1,2 @@
+[org/gnome/settings-daemon/plugins/power]
+power-button-action='interactive'
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/profile/user b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/profile/user
new file mode 100644
index 0000000..aca0641
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/dconf/profile/user
@@ -0,0 +1,2 @@
+user-db:user
+system-db:local
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/cmdline b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/cmdline
index 9479627..5b92d02 100644
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/cmdline
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/cmdline
@@ -1 +1 @@
-rootflags=subvol=root clk_ignore_unused pd_ignore_unused systemd.tpm2_wait=0 rhgb quiet
+rootflags=subvol=root mem_sleep_default=s2idle clk_ignore_unused pd_ignore_unused systemd.tpm2_wait=0 rhgb quiet
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree
index 37226e7..2acf815 100644
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/kernel/devicetree
@@ -1 +1 @@
-qcom/x1p42100-microsoft-surface-pro-12-inch.dtb
+qcom/x1p42100-microsoft-sp12in.dtb
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/logind.conf.d/60-surface-power-key.conf b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/logind.conf.d/60-surface-power-key.conf
new file mode 100644
index 0000000..c6fc547
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/logind.conf.d/60-surface-power-key.conf
@@ -0,0 +1,2 @@
+HandlePowerKey=suspend
+HandlePowerKeyLongPress=poweroff
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service
index 5b252fd..2e3cf82 100644
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/hexagonrpc.service
@@ -1,6 +1,5 @@
[Unit]
Description=HexagonRPC Service
-After=network.target
[Service]
ExecStart=/usr/local/bin/hexagonrpcd -f /dev/fastrpc-adsp-secure -s
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service
deleted file mode 100644
index f0eb446..0000000
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service
+++ /dev/null
@@ -1,11 +0,0 @@
-[Unit]
-Description=IIO Sensor Proxy Service
-After=network.target hexagonrpc.service
-Requires=hexagonrpc.service
-
-[Service]
-ExecStart=/usr/libexec/iio-sensor-proxy
-Restart=on-failure
-
-[Install]
-WantedBy=multi-user.target
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf
new file mode 100644
index 0000000..7b3cfcb
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/iio-sensor-proxy.service.d/60-surface-pro-12-inch.conf
@@ -0,0 +1,14 @@
+# Surface Pro 12" (Snapdragon X1P-42-100)
+#
+# The sensors on this device are not IIO devices. They live behind the SLPI
+# DSP, reached over fastrpc by hexagonrpcd, and iio-sensor-proxy only sees them
+# through the SSC backend it is built with here (-Dssc-support=enabled). So it
+# has to start after that daemon, and stop being useful if the daemon dies.
+#
+# A drop-in rather than a replacement unit: upstream's own unit is D-Bus
+# activated (Type=dbus, BusName=net.hadess.SensorProxy), which is how anything
+# asking for net.hadess.SensorProxy gets the service started, and overriding it
+# wholesale traded that away for nothing but this ordering.
+[Unit]
+Requires=hexagonrpc.service
+After=hexagonrpc.service
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service
new file mode 100644
index 0000000..5c83962
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service
@@ -0,0 +1,12 @@
+[Unit]
+Description=Install Surface Pro 12in video codec firmware from a Windows partition
+ConditionPathExists=!/lib/firmware/qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn
+After=local-fs.target
+
+[Service]
+Type=oneshot
+RemainAfterExit=yes
+ExecStart=/usr/local/bin/surface-video-firmware.sh
+
+[Install]
+WantedBy=multi-user.target
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/wireupcameras.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/wireupcameras.service
deleted file mode 100644
index 538d79a..0000000
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/wireupcameras.service
+++ /dev/null
@@ -1,13 +0,0 @@
-[Unit]
-Description=Wire up Surface Pro rear camera (media-ctl pipeline)
-After=dev-media0.device
-Wants=dev-media0.device
-DefaultDependencies=no
-
-[Service]
-Type=oneshot
-ExecStart=/usr/local/bin/wireupcameras.sh
-RemainAfterExit=yes
-
-[Install]
-WantedBy=multi-user.target
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/yum.repos.d/kernel-sp12in.repo b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/yum.repos.d/kernel-sp12in.repo
new file mode 100644
index 0000000..24fe9f3
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/yum.repos.d/kernel-sp12in.repo
@@ -0,0 +1,7 @@
+[kernel-sp12in]
+name=kernel-sp12in for Fedora $releasever - $basearch
+baseurl=https://rpm.sayag.it/kernel-sp12in/fedora/$releasever/$basearch/
+enabled=1
+priority=1
+gpgcheck=0
+metadata_expire=6h
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install
index c12ff47..7622406 100644
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install
@@ -5,11 +5,35 @@ umask 022
COMMAND="$1"
KVER="$2"
-SRC="/etc/surface-dtb/x1p42100-microsoft-surface-pro-12-inch.dtb"
-DEST="/usr/lib/modules/${KVER}/dtb/qcom/x1p42100-microsoft-surface-pro-12-inch.dtb"
+DTB_NAME=x1p42100-microsoft-sp12in.dtb
+DEST="/usr/lib/modules/${KVER}/dtb/qcom/${DTB_NAME}"
+
+# The master copies come from kernel-surface: it builds the dtb in-tree from the
+# patched dts and installs it under /usr/lib/surface-dtb, deliberately outside
+# any /usr/lib/modules/<kver>, so it can be re-staged into a kernel that ships
+# no device tree of its own -- a stock Fedora one.
+#
+# One directory per kernel version, because kernel-surface is installonly and
+# rpm will not let two installed releases own one unqualified path once the file
+# differs. They are all the same board, so the highest version is as good a
+# choice as any, and is the one most likely to carry recent fixes.
+SRC=$(ls -1 /usr/lib/surface-dtb/*/"${DTB_NAME}" 2>/dev/null | sort -V | tail -n1)
case "${COMMAND}" in
add)
+ # kernel-surface ships its own dtb through dtbs_install, and that
+ # one is the release-matched copy. Leave it alone; the master is
+ # only for kernels that arrived without one.
+ if [ -f "${DEST}" ]; then
+ exit 0
+ fi
+ # Neither means there is nothing this board can boot with, so say
+ # so rather than failing silently three steps later in the boot
+ # loader.
+ if [ -z "${SRC}" ]; then
+ echo "60-surface-dtb: no ${DTB_NAME} under /usr/lib/surface-dtb" >&2
+ exit 1
+ fi
mkdir -p "$(dirname ${DEST})"
cp -f "${SRC}" "${DEST}"
chmod 644 "${DEST}"
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install
index 375b085..65b8745 100644
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install
@@ -29,17 +29,19 @@ KVER="${2:-}"
[ "$COMMAND" = "add" ] || exit 0
[ -n "$KVER" ] || exit 0
-DTB_NAME=x1p42100-microsoft-surface-pro-12-inch.dtb
+DTB_NAME=x1p42100-microsoft-sp12in.dtb
DTB_REL="qcom/$DTB_NAME"
BOOT_ROOT="${KERNEL_INSTALL_BOOT_ROOT:-/boot}"
# 60-surface-dtb.install stages the dtb into this kernel's module tree; fall
-# back to the master copy if it has not run (or was removed).
+# back to kernel-surface's version-independent master copy if it has not run
+# (or was removed).
DTB_SRC="/usr/lib/modules/${KVER}/dtb/${DTB_REL}"
if [ ! -f "$DTB_SRC" ]; then
- DTB_SRC="/etc/surface-dtb/$DTB_NAME"
+ # One directory per kernel version under here; see 60-surface-dtb.install.
+ DTB_SRC=$(ls -1 /usr/lib/surface-dtb/*/"$DTB_NAME" 2>/dev/null | sort -V | tail -n1)
fi
-[ -f "$DTB_SRC" ] || exit 0
+[ -n "$DTB_SRC" ] && [ -f "$DTB_SRC" ] || exit 0
# The boot loader reads the dtb from the boot filesystem, not the module tree
install -Dm644 "$DTB_SRC" "${BOOT_ROOT}/dtb-${KVER}/${DTB_REL}"
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh
new file mode 100755
index 0000000..35dfdf1
--- /dev/null
+++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh
@@ -0,0 +1,183 @@
+#!/bin/bash
+# Surface Pro 12" (Snapdragon X1P-42-100): install the video codec firmware.
+#
+# The iris video codec needs firmware TrustZone will accept. linux-firmware's
+# qcom/vpu/vpu30_p1_s7.mbn is the same codec signed with Qualcomm's SecTools
+# *test* key chain, which a retail Surface rejects:
+#
+# qcom-iris aa00000.video-codec: error -22 initializing firmware qcom/vpu/vpu30_p1_s7.mbn
+#
+# The production-signed build ships only inside Microsoft's Surface driver
+# package, which grants no redistribution right, so the image cannot carry it.
+# What it can do is copy it out of a Windows install the owner already has a
+# licence for, or out of a driver pack they downloaded themselves. This script
+# does the copying; it never fetches anything the caller did not ask for.
+#
+# Usage: surface-video-firmware.sh [-m MSI] [-u URL] [-n]
+#
+# (no options) look for a Windows partition on this machine and copy the
+# firmware out of its DriverStore. No network access.
+# -m MSI extract from a Surface driver pack already on disk
+# -u URL download a driver pack and extract from that
+# -n say what would happen, change nothing
+#
+# The driver pack is a ~500 MB MSI from
+#
+# https://www.microsoft.com/en-us/download/details.aspx?id=108199
+#
+# There is no stable direct link to hardcode: the Download Center hands out
+# per-session URLs and the file name carries the driver release, so -u takes
+# the URL the browser was given rather than guessing one that would rot.
+
+set -euo pipefail
+
+FW_DIR=/lib/firmware/qcom/x1p42100/Microsoft/Surface12
+BLOB=qcvss8380_pa.mbn
+DRIVERSTORE=Windows/System32/DriverStore/FileRepository
+PAGE=https://www.microsoft.com/en-us/download/details.aspx?id=108199
+
+msi=""
+url=""
+dry_run=false
+
+while getopts ':m:u:nh' opt; do
+ case "${opt}" in
+ m) msi=${OPTARG} ;;
+ u) url=${OPTARG} ;;
+ n) dry_run=true ;;
+ h) sed -n '2,31p' "${BASH_SOURCE[0]}"; exit 0 ;;
+ *) echo "unknown option -${OPTARG}" >&2; exit 2 ;;
+ esac
+done
+
+log() { printf 'surface-video-firmware: %s\n' "$*"; }
+die() { printf 'surface-video-firmware: %s\n' "$*" >&2; exit 1; }
+
+if [[ -f "${FW_DIR}/${BLOB}" ]]; then
+ log "${FW_DIR}/${BLOB} is already installed"
+ exit 0
+fi
+
+[[ ${EUID} -eq 0 ]] || die "must run as root"
+
+cleanup_dirs=()
+cleanup_mounts=()
+cleanup() {
+ local m d
+ for m in ${cleanup_mounts[@]+"${cleanup_mounts[@]}"}; do
+ mountpoint -q "${m}" && umount "${m}" || true
+ done
+ for d in ${cleanup_dirs[@]+"${cleanup_dirs[@]}"}; do
+ rm -rf "${d}" || true
+ done
+}
+trap cleanup EXIT
+
+install_blob() {
+ local src=$1
+ if [[ ${dry_run} == true ]]; then
+ log "would install ${src} as ${FW_DIR}/${BLOB}"
+ return 0
+ fi
+
+ install -Dm644 "${src}" "${FW_DIR}/${BLOB}"
+ log "installed ${FW_DIR}/${BLOB}"
+
+ # The driver only asks for its firmware while probing, so it has to be
+ # reloaded to pick this up. It refuses while a decode session holds it,
+ # which is why a failure here is only worth a note.
+ if lsmod | grep -q '^qcom_iris'; then
+ if modprobe -r qcom_iris 2>/dev/null && modprobe qcom_iris 2>/dev/null; then
+ log "reloaded qcom_iris"
+ else
+ log "could not reload qcom_iris; reboot to start using the firmware"
+ fi
+ fi
+}
+
+# Everything below hands find(1) the bare file name rather than a full path:
+# the DriverStore directory carries a per-build hash, and the layout inside an
+# extracted MSI is not documented anywhere worth trusting.
+find_blob() {
+ find "$1" -type f -name "${BLOB}" -print -quit 2>/dev/null
+}
+
+from_windows() {
+ local dev fstype part_mnt mnt found
+
+ while read -r dev fstype part_mnt; do
+ [[ ${fstype} == ntfs* ]] || continue
+
+ if [[ -n ${part_mnt} ]]; then
+ mnt=${part_mnt}
+ else
+ mnt=$(mktemp -d)
+ cleanup_dirs+=("${mnt}")
+ if ! mount -t ntfs3 -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null &&
+ ! mount -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null; then
+ log "/dev/${dev}: could not mount read-only, skipping"
+ log "/dev/${dev}: if Windows is hibernated, shut it down fully and retry"
+ continue
+ fi
+ cleanup_mounts+=("${mnt}")
+ fi
+
+ [[ -d "${mnt}/${DRIVERSTORE}" ]] || continue
+
+ found=$(find_blob "${mnt}/${DRIVERSTORE}")
+ if [[ -n ${found} ]]; then
+ log "found ${BLOB} on /dev/${dev}"
+ install_blob "${found}"
+ return 0
+ fi
+ log "/dev/${dev}: a Windows install, but no ${BLOB} in its DriverStore"
+ done < <(lsblk -rno NAME,FSTYPE,MOUNTPOINT)
+
+ return 1
+}
+
+from_msi() {
+ local pack=$1 work found
+
+ command -v msiextract >/dev/null || die "msiextract is missing; install msitools"
+
+ work=$(mktemp -d)
+ cleanup_dirs+=("${work}")
+
+ log "extracting ${pack}"
+ ( cd "${work}" && msiextract "${pack}" >/dev/null )
+
+ found=$(find_blob "${work}")
+ [[ -n ${found} ]] || die "no ${BLOB} inside ${pack}; is it the Surface Pro 12in driver pack?"
+
+ log "found ${BLOB} in the driver pack"
+ install_blob "${found}"
+}
+
+if [[ -n ${url} ]]; then
+ dl=$(mktemp -d)
+ cleanup_dirs+=("${dl}")
+ msi="${dl}/driverpack.msi"
+ log "downloading ${url}"
+ curl -fL --retry 3 --progress-bar -o "${msi}" "${url}"
+fi
+
+if [[ -n ${msi} ]]; then
+ [[ -f ${msi} ]] || die "${msi} does not exist"
+ from_msi "${msi}"
+ exit 0
+fi
+
+if from_windows; then
+ exit 0
+fi
+
+# Nothing found, and nothing was asked for. Not an error: most of the time this
+# is a machine with no Windows left on it, and the only thing left to do is say
+# how to finish the job by hand.
+log "no Windows install on this machine carries ${BLOB}"
+log "hardware video decode stays off until it is installed. To finish by hand:"
+log " 1. download the Surface Pro 12in driver pack (~500 MB) from"
+log " ${PAGE}"
+log " 2. sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi"
+exit 0
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/wireupcameras.sh b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/wireupcameras.sh
deleted file mode 100644
index 2e8f2d3..0000000
--- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/wireupcameras.sh
+++ /dev/null
@@ -1,18 +0,0 @@
-#!/bin/bash
-set -e
-
-SENSOR="ov13858 1-0010"
-
-# Tell each pad in the path what format to expect
-media-ctl -V "\"$SENSOR\":0[fmt:SGRBG10_1X10/4224x3136]"
-media-ctl -V '"msm_csiphy0":0[fmt:SGRBG10_1X10/4224x3136]'
-media-ctl -V '"msm_csiphy0":1[fmt:SGRBG10_1X10/4224x3136]'
-media-ctl -V '"msm_csid0":0[fmt:SGRBG10_1X10/4224x3136]'
-media-ctl -V '"msm_csid0":1[fmt:SGRBG10_1X10/4224x3136]'
-media-ctl -V '"msm_vfe0_rdi0":0[fmt:SGRBG10_1X10/4224x3136]'
-
-# Disable the OV02C10 path so it doesn't fight for csid0
-media-ctl -l '"msm_csiphy4":1->"msm_csid0":0[0]'
-
-# Enable the rear path
-media-ctl -l '"msm_csiphy0":1->"msm_csid0":0[1]'
diff --git a/surface-editbootconfig.sh b/surface-editbootconfig.sh
new file mode 100755
index 0000000..e6cc67c
--- /dev/null
+++ b/surface-editbootconfig.sh
@@ -0,0 +1,49 @@
+#!/bin/bash
+# Surface Pro 12" (Snapdragon X1P-42-100): put the device tree on the ISO.
+#
+# kiwi has no device tree support of its own, and the ISO's GRUB needs the dtb
+# as a plain file it can read: it loads it with a "devicetree" line before the
+# kernel (see grub-arm.cfg.iso-template), it cannot read the erofs root image,
+# and kiwi copies only the kernel and the initrd into the ISO's loader
+# directory.
+#
+# editbootconfig is the one hook that reaches the ISO tree. kiwi's live builder
+# calls it with "iso:<media dir>" as the first argument and the image root as
+# the working directory, after setup_media_loader_directory has created the
+# loader directory and the GRUB config has been written. So the dtb can be
+# taken straight out of the kernel-surface RPM installed in the image root,
+# which is why config-cdroot.tar is no longer needed to carry a committed copy.
+
+set -euo pipefail
+
+target="${1:-}"
+case "${target}" in
+ iso:*) media_dir="${target#iso:}" ;;
+ *)
+ echo "surface-editbootconfig: expected an iso: target, got '${target}'" >&2
+ exit 1
+ ;;
+esac
+
+dtb_name=x1p42100-microsoft-sp12in.dtb
+
+# The working directory is the image root, so this is kernel-surface's own copy,
+# under a directory named for the kernel version because that package is
+# installonly. config.sh has already failed the build if it is not there.
+dtb_src=$(ls -1 usr/lib/surface-dtb/*/"${dtb_name}" 2>/dev/null | sort -V | tail -n1)
+if [[ -z "${dtb_src}" ]]; then
+ echo "surface-editbootconfig: no ${dtb_name} under usr/lib/surface-dtb/ in the image root" >&2
+ exit 1
+fi
+
+# ${bootpath} in the GRUB template is /boot/<kiwi platform name>/loader. Read
+# the directory back off the media tree rather than recomputing that name, so
+# the dtb cannot end up somewhere the GRUB config does not look.
+loader_dirs=("${media_dir}"/boot/*/loader)
+if [[ ${#loader_dirs[@]} -ne 1 || ! -d "${loader_dirs[0]}" ]]; then
+ echo "surface-editbootconfig: expected one ${media_dir}/boot/*/loader, found ${#loader_dirs[@]}" >&2
+ exit 1
+fi
+
+install -Dm644 "${dtb_src}" "${loader_dirs[0]}/${dtb_name}"
+echo "surface-editbootconfig: staged ${loader_dirs[0]}/${dtb_name}"