Diffstat (limited to 'root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr')
4 files changed, 301 insertions, 0 deletions
diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install new file mode 100644 index 0000000..7622406 --- /dev/null +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/60-surface-dtb.install @@ -0,0 +1,44 @@ +#!/bin/bash +set -eu +umask 022 + +COMMAND="$1" +KVER="$2" + +DTB_NAME=x1p42100-microsoft-sp12in.dtb +DEST="/usr/lib/modules/${KVER}/dtb/qcom/${DTB_NAME}" + +# The master copies come from kernel-surface: it builds the dtb in-tree from the +# patched dts and installs it under /usr/lib/surface-dtb, deliberately outside +# any /usr/lib/modules/<kver>, so it can be re-staged into a kernel that ships +# no device tree of its own -- a stock Fedora one. +# +# One directory per kernel version, because kernel-surface is installonly and +# rpm will not let two installed releases own one unqualified path once the file +# differs. They are all the same board, so the highest version is as good a +# choice as any, and is the one most likely to carry recent fixes. +SRC=$(ls -1 /usr/lib/surface-dtb/*/"${DTB_NAME}" 2>/dev/null | sort -V | tail -n1) + +case "${COMMAND}" in + add) + # kernel-surface ships its own dtb through dtbs_install, and that + # one is the release-matched copy. Leave it alone; the master is + # only for kernels that arrived without one. + if [ -f "${DEST}" ]; then + exit 0 + fi + # Neither means there is nothing this board can boot with, so say + # so rather than failing silently three steps later in the boot + # loader. + if [ -z "${SRC}" ]; then + echo "60-surface-dtb: no ${DTB_NAME} under /usr/lib/surface-dtb" >&2 + exit 1 + fi + mkdir -p "$(dirname ${DEST})" + cp -f "${SRC}" "${DEST}" + chmod 644 "${DEST}" + ;; + remove) + rm -f "${DEST}" + ;; +esac diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install new file mode 100644 index 0000000..65b8745 --- /dev/null +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/lib/kernel/install.d/95-surface-dtb-patch.install @@ -0,0 +1,55 @@ +#!/bin/bash +# Surface Pro 12" (Snapdragon X1P-42-100): put a devicetree line into the BLS +# loader entry. +# +# None of Fedora's built-in mechanisms can do this on their own: +# +# * /etc/kernel/devicetree is only read by 90-loaderentry.install, which exits +# early unless KERNEL_INSTALL_LAYOUT=bls. Fedora has no /boot/<entry-token> +# directory, so kernel-install always computes layout=other here and that +# plugin never runs. +# +# * GRUB_DEVICETREE in /etc/default/grub does work on a running system (see +# 20-grub.install's mkbls), but anaconda rewrites /etc/default/grub from a +# fixed list of keys it knows during installation, and GRUB_DEVICETREE is not +# on that list, so it is silently discarded on a fresh install. +# +# A kernel-install plugin survives both: anaconda runs kernel-install inside the +# target during installation, and anything sorting after 20-grub.install sees +# the entry it has just (re)generated. Because 20-grub.install rewrites the +# entry from scratch on every kernel install, this must re-apply each time -- +# hence a plugin rather than a one-shot fixup. + +set -eu +umask 022 + +COMMAND="${1:-}" +KVER="${2:-}" + +[ "$COMMAND" = "add" ] || exit 0 +[ -n "$KVER" ] || exit 0 + +DTB_NAME=x1p42100-microsoft-sp12in.dtb +DTB_REL="qcom/$DTB_NAME" +BOOT_ROOT="${KERNEL_INSTALL_BOOT_ROOT:-/boot}" + +# 60-surface-dtb.install stages the dtb into this kernel's module tree; fall +# back to kernel-surface's version-independent master copy if it has not run +# (or was removed). +DTB_SRC="/usr/lib/modules/${KVER}/dtb/${DTB_REL}" +if [ ! -f "$DTB_SRC" ]; then + # One directory per kernel version under here; see 60-surface-dtb.install. + DTB_SRC=$(ls -1 /usr/lib/surface-dtb/*/"$DTB_NAME" 2>/dev/null | sort -V | tail -n1) +fi +[ -n "$DTB_SRC" ] && [ -f "$DTB_SRC" ] || exit 0 + +# The boot loader reads the dtb from the boot filesystem, not the module tree +install -Dm644 "$DTB_SRC" "${BOOT_ROOT}/dtb-${KVER}/${DTB_REL}" + +# BLS entry paths are relative to the boot filesystem root, matching the +# "linux /vmlinuz-$KVER" line 20-grub.install writes. +for entry in "${BOOT_ROOT}"/loader/entries/*-"${KVER}".conf; do + [ -f "$entry" ] || continue + grep -q '^devicetree[[:space:]]' "$entry" && continue + sed -i "/initrd/i devicetree /dtb-${KVER}/${DTB_REL}" "$entry" +done diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh new file mode 100755 index 0000000..35dfdf1 --- /dev/null +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh @@ -0,0 +1,183 @@ +#!/bin/bash +# Surface Pro 12" (Snapdragon X1P-42-100): install the video codec firmware. +# +# The iris video codec needs firmware TrustZone will accept. linux-firmware's +# qcom/vpu/vpu30_p1_s7.mbn is the same codec signed with Qualcomm's SecTools +# *test* key chain, which a retail Surface rejects: +# +# qcom-iris aa00000.video-codec: error -22 initializing firmware qcom/vpu/vpu30_p1_s7.mbn +# +# The production-signed build ships only inside Microsoft's Surface driver +# package, which grants no redistribution right, so the image cannot carry it. +# What it can do is copy it out of a Windows install the owner already has a +# licence for, or out of a driver pack they downloaded themselves. This script +# does the copying; it never fetches anything the caller did not ask for. +# +# Usage: surface-video-firmware.sh [-m MSI] [-u URL] [-n] +# +# (no options) look for a Windows partition on this machine and copy the +# firmware out of its DriverStore. No network access. +# -m MSI extract from a Surface driver pack already on disk +# -u URL download a driver pack and extract from that +# -n say what would happen, change nothing +# +# The driver pack is a ~500 MB MSI from +# +# https://www.microsoft.com/en-us/download/details.aspx?id=108199 +# +# There is no stable direct link to hardcode: the Download Center hands out +# per-session URLs and the file name carries the driver release, so -u takes +# the URL the browser was given rather than guessing one that would rot. + +set -euo pipefail + +FW_DIR=/lib/firmware/qcom/x1p42100/Microsoft/Surface12 +BLOB=qcvss8380_pa.mbn +DRIVERSTORE=Windows/System32/DriverStore/FileRepository +PAGE=https://www.microsoft.com/en-us/download/details.aspx?id=108199 + +msi="" +url="" +dry_run=false + +while getopts ':m:u:nh' opt; do + case "${opt}" in + m) msi=${OPTARG} ;; + u) url=${OPTARG} ;; + n) dry_run=true ;; + h) sed -n '2,31p' "${BASH_SOURCE[0]}"; exit 0 ;; + *) echo "unknown option -${OPTARG}" >&2; exit 2 ;; + esac +done + +log() { printf 'surface-video-firmware: %s\n' "$*"; } +die() { printf 'surface-video-firmware: %s\n' "$*" >&2; exit 1; } + +if [[ -f "${FW_DIR}/${BLOB}" ]]; then + log "${FW_DIR}/${BLOB} is already installed" + exit 0 +fi + +[[ ${EUID} -eq 0 ]] || die "must run as root" + +cleanup_dirs=() +cleanup_mounts=() +cleanup() { + local m d + for m in ${cleanup_mounts[@]+"${cleanup_mounts[@]}"}; do + mountpoint -q "${m}" && umount "${m}" || true + done + for d in ${cleanup_dirs[@]+"${cleanup_dirs[@]}"}; do + rm -rf "${d}" || true + done +} +trap cleanup EXIT + +install_blob() { + local src=$1 + if [[ ${dry_run} == true ]]; then + log "would install ${src} as ${FW_DIR}/${BLOB}" + return 0 + fi + + install -Dm644 "${src}" "${FW_DIR}/${BLOB}" + log "installed ${FW_DIR}/${BLOB}" + + # The driver only asks for its firmware while probing, so it has to be + # reloaded to pick this up. It refuses while a decode session holds it, + # which is why a failure here is only worth a note. + if lsmod | grep -q '^qcom_iris'; then + if modprobe -r qcom_iris 2>/dev/null && modprobe qcom_iris 2>/dev/null; then + log "reloaded qcom_iris" + else + log "could not reload qcom_iris; reboot to start using the firmware" + fi + fi +} + +# Everything below hands find(1) the bare file name rather than a full path: +# the DriverStore directory carries a per-build hash, and the layout inside an +# extracted MSI is not documented anywhere worth trusting. +find_blob() { + find "$1" -type f -name "${BLOB}" -print -quit 2>/dev/null +} + +from_windows() { + local dev fstype part_mnt mnt found + + while read -r dev fstype part_mnt; do + [[ ${fstype} == ntfs* ]] || continue + + if [[ -n ${part_mnt} ]]; then + mnt=${part_mnt} + else + mnt=$(mktemp -d) + cleanup_dirs+=("${mnt}") + if ! mount -t ntfs3 -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null && + ! mount -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null; then + log "/dev/${dev}: could not mount read-only, skipping" + log "/dev/${dev}: if Windows is hibernated, shut it down fully and retry" + continue + fi + cleanup_mounts+=("${mnt}") + fi + + [[ -d "${mnt}/${DRIVERSTORE}" ]] || continue + + found=$(find_blob "${mnt}/${DRIVERSTORE}") + if [[ -n ${found} ]]; then + log "found ${BLOB} on /dev/${dev}" + install_blob "${found}" + return 0 + fi + log "/dev/${dev}: a Windows install, but no ${BLOB} in its DriverStore" + done < <(lsblk -rno NAME,FSTYPE,MOUNTPOINT) + + return 1 +} + +from_msi() { + local pack=$1 work found + + command -v msiextract >/dev/null || die "msiextract is missing; install msitools" + + work=$(mktemp -d) + cleanup_dirs+=("${work}") + + log "extracting ${pack}" + ( cd "${work}" && msiextract "${pack}" >/dev/null ) + + found=$(find_blob "${work}") + [[ -n ${found} ]] || die "no ${BLOB} inside ${pack}; is it the Surface Pro 12in driver pack?" + + log "found ${BLOB} in the driver pack" + install_blob "${found}" +} + +if [[ -n ${url} ]]; then + dl=$(mktemp -d) + cleanup_dirs+=("${dl}") + msi="${dl}/driverpack.msi" + log "downloading ${url}" + curl -fL --retry 3 --progress-bar -o "${msi}" "${url}" +fi + +if [[ -n ${msi} ]]; then + [[ -f ${msi} ]] || die "${msi} does not exist" + from_msi "${msi}" + exit 0 +fi + +if from_windows; then + exit 0 +fi + +# Nothing found, and nothing was asked for. Not an error: most of the time this +# is a machine with no Windows left on it, and the only thing left to do is say +# how to finish the job by hand. +log "no Windows install on this machine carries ${BLOB}" +log "hardware video decode stays off until it is installed. To finish by hand:" +log " 1. download the Surface Pro 12in driver pack (~500 MB) from" +log " ${PAGE}" +log " 2. sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi" +exit 0 diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te new file mode 100644 index 0000000..b3be8fb --- /dev/null +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/share/selinux/iio-qipcrtr.te @@ -0,0 +1,19 @@ +module iio-qipcrtr 1.0; + +# Fedora's policy grants iiosensorproxy_t no qipcrtr_socket permissions at +# all: the class exists but nothing allows it, because upstream +# iio-sensor-proxy talks to sensors over IIO and never needed QRTR. The SSC +# backend libssc brings in here reaches the Qualcomm Sensor Core over the +# QRTR bus (libssc probes AF_QIPCRTR first; the fastrpc/hexagonrpcd path is +# what actually serves this board, but the probe alone gets the daemon +# killed by "QRTR bus unavailable" + "No sensors" without these perms). +# +# Hand-written rather than audit2allow'd per-incident: create/bind/... is +# the full client lifecycle, so a policy reload or libssc update cannot +# surface a new denied perm one at a time. +require { + type iiosensorproxy_t; + class qipcrtr_socket { create bind connect read write getattr setattr getopt setopt shutdown }; +} + +allow iiosensorproxy_t self:qipcrtr_socket { create bind connect read write getattr setattr getopt setopt shutdown }; |