From 2411d569bb9c00b434691bf0a2add278e16c798e Mon Sep 17 00:00:00 2001 From: Saya Andy Date: Mon, 7 Sep 2026 11:47:28 +0700 Subject: feat: automate installing production-signed iris firmware driver --- Jenkinsfile | 4 +- README.md | 6 +- config.sh | 17 ++ .../systemd/system/surface-video-firmware.service | 12 ++ .../usr/local/bin/surface-video-firmware.sh | 183 +++++++++++++++++++++ 5 files changed, 219 insertions(+), 3 deletions(-) create mode 100644 root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service create mode 100755 root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh diff --git a/Jenkinsfile b/Jenkinsfile index 5b7cf51..62357ff 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -17,7 +17,7 @@ pipeline { ISO_BUCKET = 'dist-sayagit-fedora-iso' // Must match the in - // repositories/kernel-surface.xml. + // repositories/kernel-sp12in.xml. KERNEL_SURFACE_REPO_URL = 'https://rpm.sayag.it/kernel-sp12in/fedora/45/aarch64' // awscli2 sends CRC32 checksums by default, which B2 rejects. Ask for @@ -68,7 +68,7 @@ spec: // something this repository can produce: the image // installs kernel-surface by name and s // Fedora's kernel packages. Its pipeline publishes - // it to rpm.sayag.it, which repositories/kernel-surface.xml + // it to rpm.sayag.it, which repositories/kernel-sp12in.xml // points at directly, so there is nothing to stage // here. Fail now rather than several minutes into // kiwi on an unresolvable package name. diff --git a/README.md b/README.md index a8a7b58..b34e38b 100644 --- a/README.md +++ b/README.md @@ -36,7 +36,11 @@ To build this on Fedora Linux: * No rescue vmlinuz. * No secure boot possible for this ISO for now, as the platform used is `efi` and not `uefi`. * No GRUB auto hidden menu. Trying to have the menu hidden results in system restarting after trying to boot it. -* Hardware video encoding/decoding needs a firmware blob the image cannot ship. The `qcom/vpu/vpu30_p1_s7.mbn` that `linux-firmware` provides is signed with Qualcomm's SecTools *test* key chain, which a retail Surface's TrustZone rejects -- `qcom_scm_pas_init_image()` fails and the kernel logs `qcom-iris aa00000.video-codec: error -22 initializing firmware`. The production-signed build of the same firmware ships with Windows, so if you kept the Windows ARM64 partition, copy `qcvss8380_pa.mbn` out of `/path/to/mounted/windows/drive/Windows/System32/DriverStore/FileRepository/qcdx8380.inf_arm64_*/` into `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/`. The kernel's device tree already points `iris` at that path. +* Hardware video encoding/decoding needs a firmware blob the image is not allowed to ship. The `qcom/vpu/vpu30_p1_s7.mbn` that `linux-firmware` provides is the same codec signed with Qualcomm's SecTools *test* key chain, which a retail Surface's TrustZone rejects -- `qcom_scm_pas_init_image()` fails and the kernel logs `qcom-iris aa00000.video-codec: error -22 initializing firmware`. The production-signed build exists only inside Microsoft's Surface driver package, which grants no redistribution right, so what ships here is the means and not the blob: + * If you kept the Windows ARM64 partition, `surface-video-firmware.service` finds it on the first boot after install and copies `qcvss8380_pa.mbn` out of its DriverStore. Nothing to do. + * If Windows is gone, download the [Surface Pro 12-inch driver pack](https://www.microsoft.com/en-us/download/details.aspx?id=108199) (~500 MB MSI) and run `sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi`. There is no automatic download: the Download Center hands out per-session links. + + The kernel's device tree already points `iris` at `/lib/firmware/qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn`, so the driver picks it up as soon as it is there. * Suspend on Snapdragon X is still very unstable. No deep sleep is available, so `mem_sleep_default=s2idle` was set. Even that leads to compromises as suspending via GNOME results in hard freeze, so the default power button behavior was changed to `interactive` and should not be changed back to `suspend`. ## Image variants diff --git a/config.sh b/config.sh index eed828d..ef17771 100755 --- a/config.sh +++ b/config.sh @@ -670,6 +670,23 @@ case "${libcamera_nevra}" in ;; esac +# Hardware video decode needs firmware this image is not allowed to carry. The +# qcom/vpu/vpu30_p1_s7.mbn in linux-firmware is the same codec signed with +# Qualcomm's SecTools test keys, which a retail Surface's TrustZone rejects, and +# the production-signed build exists only inside Microsoft's Surface driver +# package, under terms that grant no redistribution right. +# +# So the image ships the means rather than the blob: a script that copies it out +# of a Windows install the owner already has a licence for, and a unit that runs +# that once on a dual-boot machine. Where Windows is gone, the script says which +# driver pack to download and how to point it at one. +dnf install -y msitools +install -Dm755 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh \ + /usr/local/bin/surface-video-firmware.sh +install -Dm644 /tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service \ + /etc/systemd/system/surface-video-firmware.service +systemctl enable surface-video-firmware.service + # Suspend on Snapdragon is still very unstable. This is the reason why # 'mem_sleep_default=s2idle' is set explicitly in the cmdline as 'deep' mode # does not function at all. diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service new file mode 100644 index 0000000..5c83962 --- /dev/null +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/etc/systemd/system/surface-video-firmware.service @@ -0,0 +1,12 @@ +[Unit] +Description=Install Surface Pro 12in video codec firmware from a Windows partition +ConditionPathExists=!/lib/firmware/qcom/x1p42100/Microsoft/Surface12/qcvss8380_pa.mbn +After=local-fs.target + +[Service] +Type=oneshot +RemainAfterExit=yes +ExecStart=/usr/local/bin/surface-video-firmware.sh + +[Install] +WantedBy=multi-user.target diff --git a/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh new file mode 100755 index 0000000..35dfdf1 --- /dev/null +++ b/root/tmp/SayaAndy/surface-pro-12-inch-linux-fedora/usr/local/bin/surface-video-firmware.sh @@ -0,0 +1,183 @@ +#!/bin/bash +# Surface Pro 12" (Snapdragon X1P-42-100): install the video codec firmware. +# +# The iris video codec needs firmware TrustZone will accept. linux-firmware's +# qcom/vpu/vpu30_p1_s7.mbn is the same codec signed with Qualcomm's SecTools +# *test* key chain, which a retail Surface rejects: +# +# qcom-iris aa00000.video-codec: error -22 initializing firmware qcom/vpu/vpu30_p1_s7.mbn +# +# The production-signed build ships only inside Microsoft's Surface driver +# package, which grants no redistribution right, so the image cannot carry it. +# What it can do is copy it out of a Windows install the owner already has a +# licence for, or out of a driver pack they downloaded themselves. This script +# does the copying; it never fetches anything the caller did not ask for. +# +# Usage: surface-video-firmware.sh [-m MSI] [-u URL] [-n] +# +# (no options) look for a Windows partition on this machine and copy the +# firmware out of its DriverStore. No network access. +# -m MSI extract from a Surface driver pack already on disk +# -u URL download a driver pack and extract from that +# -n say what would happen, change nothing +# +# The driver pack is a ~500 MB MSI from +# +# https://www.microsoft.com/en-us/download/details.aspx?id=108199 +# +# There is no stable direct link to hardcode: the Download Center hands out +# per-session URLs and the file name carries the driver release, so -u takes +# the URL the browser was given rather than guessing one that would rot. + +set -euo pipefail + +FW_DIR=/lib/firmware/qcom/x1p42100/Microsoft/Surface12 +BLOB=qcvss8380_pa.mbn +DRIVERSTORE=Windows/System32/DriverStore/FileRepository +PAGE=https://www.microsoft.com/en-us/download/details.aspx?id=108199 + +msi="" +url="" +dry_run=false + +while getopts ':m:u:nh' opt; do + case "${opt}" in + m) msi=${OPTARG} ;; + u) url=${OPTARG} ;; + n) dry_run=true ;; + h) sed -n '2,31p' "${BASH_SOURCE[0]}"; exit 0 ;; + *) echo "unknown option -${OPTARG}" >&2; exit 2 ;; + esac +done + +log() { printf 'surface-video-firmware: %s\n' "$*"; } +die() { printf 'surface-video-firmware: %s\n' "$*" >&2; exit 1; } + +if [[ -f "${FW_DIR}/${BLOB}" ]]; then + log "${FW_DIR}/${BLOB} is already installed" + exit 0 +fi + +[[ ${EUID} -eq 0 ]] || die "must run as root" + +cleanup_dirs=() +cleanup_mounts=() +cleanup() { + local m d + for m in ${cleanup_mounts[@]+"${cleanup_mounts[@]}"}; do + mountpoint -q "${m}" && umount "${m}" || true + done + for d in ${cleanup_dirs[@]+"${cleanup_dirs[@]}"}; do + rm -rf "${d}" || true + done +} +trap cleanup EXIT + +install_blob() { + local src=$1 + if [[ ${dry_run} == true ]]; then + log "would install ${src} as ${FW_DIR}/${BLOB}" + return 0 + fi + + install -Dm644 "${src}" "${FW_DIR}/${BLOB}" + log "installed ${FW_DIR}/${BLOB}" + + # The driver only asks for its firmware while probing, so it has to be + # reloaded to pick this up. It refuses while a decode session holds it, + # which is why a failure here is only worth a note. + if lsmod | grep -q '^qcom_iris'; then + if modprobe -r qcom_iris 2>/dev/null && modprobe qcom_iris 2>/dev/null; then + log "reloaded qcom_iris" + else + log "could not reload qcom_iris; reboot to start using the firmware" + fi + fi +} + +# Everything below hands find(1) the bare file name rather than a full path: +# the DriverStore directory carries a per-build hash, and the layout inside an +# extracted MSI is not documented anywhere worth trusting. +find_blob() { + find "$1" -type f -name "${BLOB}" -print -quit 2>/dev/null +} + +from_windows() { + local dev fstype part_mnt mnt found + + while read -r dev fstype part_mnt; do + [[ ${fstype} == ntfs* ]] || continue + + if [[ -n ${part_mnt} ]]; then + mnt=${part_mnt} + else + mnt=$(mktemp -d) + cleanup_dirs+=("${mnt}") + if ! mount -t ntfs3 -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null && + ! mount -o ro,noatime "/dev/${dev}" "${mnt}" 2>/dev/null; then + log "/dev/${dev}: could not mount read-only, skipping" + log "/dev/${dev}: if Windows is hibernated, shut it down fully and retry" + continue + fi + cleanup_mounts+=("${mnt}") + fi + + [[ -d "${mnt}/${DRIVERSTORE}" ]] || continue + + found=$(find_blob "${mnt}/${DRIVERSTORE}") + if [[ -n ${found} ]]; then + log "found ${BLOB} on /dev/${dev}" + install_blob "${found}" + return 0 + fi + log "/dev/${dev}: a Windows install, but no ${BLOB} in its DriverStore" + done < <(lsblk -rno NAME,FSTYPE,MOUNTPOINT) + + return 1 +} + +from_msi() { + local pack=$1 work found + + command -v msiextract >/dev/null || die "msiextract is missing; install msitools" + + work=$(mktemp -d) + cleanup_dirs+=("${work}") + + log "extracting ${pack}" + ( cd "${work}" && msiextract "${pack}" >/dev/null ) + + found=$(find_blob "${work}") + [[ -n ${found} ]] || die "no ${BLOB} inside ${pack}; is it the Surface Pro 12in driver pack?" + + log "found ${BLOB} in the driver pack" + install_blob "${found}" +} + +if [[ -n ${url} ]]; then + dl=$(mktemp -d) + cleanup_dirs+=("${dl}") + msi="${dl}/driverpack.msi" + log "downloading ${url}" + curl -fL --retry 3 --progress-bar -o "${msi}" "${url}" +fi + +if [[ -n ${msi} ]]; then + [[ -f ${msi} ]] || die "${msi} does not exist" + from_msi "${msi}" + exit 0 +fi + +if from_windows; then + exit 0 +fi + +# Nothing found, and nothing was asked for. Not an error: most of the time this +# is a machine with no Windows left on it, and the only thing left to do is say +# how to finish the job by hand. +log "no Windows install on this machine carries ${BLOB}" +log "hardware video decode stays off until it is installed. To finish by hand:" +log " 1. download the Surface Pro 12in driver pack (~500 MB) from" +log " ${PAGE}" +log " 2. sudo surface-video-firmware.sh -m /path/to/SurfacePro_12in_*.msi" +exit 0 -- cgit v1.3.1+14