| -rw-r--r-- | Jenkinsfile | 4 | ||||
| -rw-r--r-- | README.md | 6 | ||||
| -rwxr-xr-x | config.sh | 17 | ||||
| -rw-r--r-- | root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service | 12 | ||||
| -rwxr-xr-x | root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh | 183 |
5 files changed, 3 insertions, 219 deletions
diff --git a/Jenkinsfile b/Jenkinsfile index 62357ff..5b7cf51 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -17,7 +17,7 @@ pipeline { ISO_BUCKET = 'dist-sayagit-fedora-iso' // Must match the <source path="..."/> in - // repositories/kernel-sp12in.xml. + // repositories/kernel-surface.xml. KERNEL_SURFACE_REPO_URL = 'https://rpm.sayag.it/kernel-sp12in/fedora/45/aarch64' // awscli2 sends CRC32 checksums by default, which B2 rejects. Ask for @@ -68,7 +68,7 @@ spec: // something this repository can produce: the image // installs kernel-surface by name and <ignore>s // Fedora's kernel packages. Its pipeline publishes - // it to rpm.sayag.it, which repositories/kernel-sp12in.xml + // it to rpm.sayag.it, which repositories/kernel-surface.xml // points at directly, so there is nothing to stage // here. Fail now rather than several minutes into // kiwi on an unresolvable package name. @@ -36,11 +36,7 @@ To build this on Fedora Linux: * No rescue vmlinuz. * No secure boot possible for this ISO for now, as the platform used is `efi` and not `uefi`. * No GRUB auto hidden menu. Trying to have the menu hidden results in system restarting after trying to boot it. -* Hardware video encoding/decoding needs a firmware blob the image is not allowed to ship. The `qcom/vpu/vpu30_p1_s7.mbn` that `linux-firmware` provides is the same codec signed with Qualcomm's SecTools *test* key chain, which a retail Surface's TrustZone rejects -- `qcom_scm_pas_init_image()` fails and the kernel logs `qcom-iris aa00000.video-codec: error -22 initializing firmware`. The production-signed build exists only inside Microsoft's Surface driver package, which grants no redistribution right, so what ships here is the means and not the blob: - * If you kept the Windows ARM64 partition, `surface-video-firmware.service` finds it on the first boot after install and copies `qcvss8380_pa.mbn` out of its DriverStore. Nothing to do. - * If Windows is gone, download the [Surface Pro 12-inch driver pack](https://www.microsoft.com/en-us/download/details.aspx?id=108199) (~500 MB MSI) and run `sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi`. There is no automatic download: the Download Center hands out per-session links. - - The kernel's device tree already points `iris` at `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn`, so the driver picks it up as soon as it is there. +* Hardware video encoding/decoding needs a firmware blob the image cannot ship. The `qcom/vpu/vpu30_p1_s7.mbn` that `linux-firmware` provides is signed with Qualcomm's SecTools *test* key chain, which a retail Surface's TrustZone rejects -- `qcom_scm_pas_init_image()` fails and the kernel logs `qcom-iris aa00000.video-codec: error -22 initializing firmware`. The production-signed build of the same firmware ships with Windows, so if you kept the Windows ARM64 partition, copy `qcvss8380_pa.mbn` out of `/path/to/mounted/windows/drive/Windows/System32/DriverStore/FileRepository/qcdx8380.inf_arm64_*/` into `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/`. The kernel's device tree already points `iris` at that path. * Suspend on Snapdragon X is still very unstable. No deep sleep is available, so `mem_sleep_default=s2idle` was set. Even that leads to compromises as suspending via GNOME results in hard freeze, so the default power button behavior was changed to `interactive` and should not be changed back to `suspend`. ## Image variants @@ -735,23 +735,6 @@ case "${libcamera_nevra}" in ;; esac -# Hardware video decode needs firmware this image is not allowed to carry. The -# qcom/vpu/vpu30_p1_s7.mbn in linux-firmware is the same codec signed with -# Qualcomm's SecTools test keys, which a retail Surface's TrustZone rejects, and -# the production-signed build exists only inside Microsoft's Surface driver -# package, under terms that grant no redistribution right. -# -# So the image ships the means rather than the blob: a script that copies it out -# of a Windows install the owner already has a licence for, and a unit that runs -# that once on a dual-boot machine. Where Windows is gone, the script says which -# driver pack to download and how to point it at one. -dnf install -y msitools -install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh \ - /usr/local/bin/surface-video-firmware.sh -install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service \ - /etc/systemd/system/surface-video-firmware.service -systemctl enable surface-video-firmware.service - # Suspend on Snapdragon is still very unstable. This is the reason why # 'mem_sleep_default=s2idle' is set explicitly in the cmdline as 'deep' mode # does not function at all. diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service deleted file mode 100644 index 5c83962..0000000 --- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service +++ /dev/null @@ -1,12 +0,0 @@ -[Unit] -Description=Install Surface Pro 12in video codec firmware from a Windows partition -ConditionPathExists=!/lib/firmware/qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn -After=local-fs.target - -[Service] -Type=oneshot -RemainAfterExit=yes -ExecStart=/usr/local/bin/surface-video-firmware.sh - -[Install] -WantedBy=multi-user.target diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh deleted file mode 100755 index 35dfdf1..0000000 --- a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh +++ /dev/null @@ -1,183 +0,0 @@ -#!/bin/bash -# Surface Pro 12" (Snapdragon X1P-42-100): install the video codec firmware. -# -# The iris video codec needs firmware TrustZone will accept. linux-firmware's -# qcom/vpu/vpu30_p1_s7.mbn is the same codec signed with Qualcomm's SecTools -# *test* key chain, which a retail Surface rejects: -# -# qcom-iris aa00000.video-codec: error -22 initializing firmware qcom/vpu/vpu30_p1_s7.mbn -# -# The production-signed build ships only inside Microsoft's Surface driver -# package, which grants no redistribution right, so the image cannot carry it. -# What it can do is copy it out of a Windows install the owner already has a -# licence for, or out of a driver pack they downloaded themselves. This script -# does the copying; it never fetches anything the caller did not ask for. -# -# Usage: surface-video-firmware.sh [-m MSI] [-u URL] [-n] -# -# (no options) look for a Windows partition on this machine and copy the -# firmware out of its DriverStore. No network access. -# -m MSI extract from a Surface driver pack already on disk -# -u URL download a driver pack and extract from that -# -n say what would happen, change nothing -# -# The driver pack is a ~500 MB MSI from -# -# https://www.microsoft.com/en-us/download/details.aspx?id=108199 -# -# There is no stable direct link to hardcode: the Download Center hands out -# per-session URLs and the file name carries the driver release, so -u takes -# the URL the browser was given rather than guessing one that would rot. - -set -euo pipefail - -FW_DIR=/lib/firmware/qcom/x1p42100/Microsoft/Surface12 -BLOB=qcvss8380_pa.mbn -DRIVERSTORE=Windows/System32/DriverStore/FileRepository -PAGE=https://www.microsoft.com/en-us/download/details.aspx?id=108199 - -msi="" -url="" -dry_run=false - -while getopts ':m:u:nh' opt; do - case "${opt}" in - m) msi=${OPTARG} ;; - u) url=${OPTARG} ;; - n) dry_run=true ;; - h) sed -n '2,31p' "${BASH_SOURCE[0]}"; exit 0 ;; - *) echo "unknown option -${OPTARG}" >&2; exit 2 ;; - esac -done - -log() { printf 'surface-video-firmware: %s\n' "$*"; } -die() { printf 'surface-video-firmware: %s\n' "$*" >&2; exit 1; } - -if [[ -f "${FW_DIR}/${BLOB}" ]]; then - log "${FW_DIR}/${BLOB} is already installed" - exit 0 -fi - -[[ ${EUID} -eq 0 ]] || die "must run as root" - -cleanup_dirs=() -cleanup_mounts=() -cleanup() { - local m d - for m in ${cleanup_mounts[@]+"${cleanup_mounts[@]}"}; do - mountpoint -q "${m}" && umount "${m}" || true - done - for d in ${cleanup_dirs[@]+"${cleanup_dirs[@]}"}; do - rm -rf "${d}" || true - done -} -trap cleanup EXIT - -install_blob() { - local src=$1 - if [[ ${dry_run} == true ]]; then - log "would install ${src} as ${FW_DIR}/${BLOB}" - return 0 - fi - - install -Dm644 "${src}" "${FW_DIR}/${BLOB}" - log "installed ${FW_DIR}/${BLOB}" - - # The driver only asks for its firmware while probing, so it has to be - # reloaded to pick this up. It refuses while a decode session holds it, - # which is why a failure here is only worth a note. - if lsmod | grep -q '^qcom_iris'; then - if modprobe -r qcom_iris 2>/dev/null && modprobe qcom_iris 2>/dev/null; then - log "reloaded qcom_iris" - else - log "could not reload qcom_iris; reboot to start using the firmware" - fi - fi -} - -# Everything below hands find(1) the bare file name rather than a full path: -# the DriverStore directory carries a per-build hash, and the layout inside an -# extracted MSI is not documented anywhere worth trusting. -find_blob() { - find "$1" -type f -name "${BLOB}" -print -quit 2>/dev/null -} - -from_windows() { - local dev fstype part_mnt mnt found - - while read -r dev fstype part_mnt; do - [[ ${fstype} == ntfs* ]] || continue - - if [[ -n ${part_mnt} ]]; then - mnt=${part_mnt} - else - mnt=$(mktemp -d) - cleanup_dirs+=("${mnt}") - if ! mount -t ntfs3 -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null && - ! mount -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null; then - log "/dev/${dev}: could not mount read-only, skipping" - log "/dev/${dev}: if Windows is hibernated, shut it down fully and retry" - continue - fi - cleanup_mounts+=("${mnt}") - fi - - [[ -d "${mnt}/${DRIVERSTORE}" ]] || continue - - found=$(find_blob "${mnt}/${DRIVERSTORE}") - if [[ -n ${found} ]]; then - log "found ${BLOB} on /dev/${dev}" - install_blob "${found}" - return 0 - fi - log "/dev/${dev}: a Windows install, but no ${BLOB} in its DriverStore" - done < <(lsblk -rno NAME,FSTYPE,MOUNTPOINT) - - return 1 -} - -from_msi() { - local pack=$1 work found - - command -v msiextract >/dev/null || die "msiextract is missing; install msitools" - - work=$(mktemp -d) - cleanup_dirs+=("${work}") - - log "extracting ${pack}" - ( cd "${work}" && msiextract "${pack}" >/dev/null ) - - found=$(find_blob "${work}") - [[ -n ${found} ]] || die "no ${BLOB} inside ${pack}; is it the Surface Pro 12in driver pack?" - - log "found ${BLOB} in the driver pack" - install_blob "${found}" -} - -if [[ -n ${url} ]]; then - dl=$(mktemp -d) - cleanup_dirs+=("${dl}") - msi="${dl}/driverpack.msi" - log "downloading ${url}" - curl -fL --retry 3 --progress-bar -o "${msi}" "${url}" -fi - -if [[ -n ${msi} ]]; then - [[ -f ${msi} ]] || die "${msi} does not exist" - from_msi "${msi}" - exit 0 -fi - -if from_windows; then - exit 0 -fi - -# Nothing found, and nothing was asked for. Not an error: most of the time this -# is a machine with no Windows left on it, and the only thing left to do is say -# how to finish the job by hand. -log "no Windows install on this machine carries ${BLOB}" -log "hardware video decode stays off until it is installed. To finish by hand:" -log " 1. download the Surface Pro 12in driver pack (~500 MB) from" -log " ${PAGE}" -log " 2. sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi" -exit 0 |