From f144c3b41b171ea3af68d9f06dbcf490ab94108f Mon Sep 17 00:00:00 2001 From: corning-croak-cable Date: Sat, 9 May 2026 02:20:50 -0700 Subject: [PATCH 1/8] surface/x86: add bootc install config (systemd-boot, DPS, Surface kargs) --- .../usr/lib/bootc/install/50-surface-x86.toml | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 contrib/surface/x86/usr/lib/bootc/install/50-surface-x86.toml diff --git a/contrib/surface/x86/usr/lib/bootc/install/50-surface-x86.toml b/contrib/surface/x86/usr/lib/bootc/install/50-surface-x86.toml new file mode 100644 index 000000000..23342041e --- /dev/null +++ b/contrib/surface/x86/usr/lib/bootc/install/50-surface-x86.toml @@ -0,0 +1,34 @@ +# bootc install configuration for Microsoft Surface Pro / Surface Laptop (x86-64) +# Ships inside the container image; applied during `bootc install to-disk`. +# +# Field reference: https://github.com/bootc-dev/bootc/blob/main/crates/lib/src/install/config.rs +# match-architectures — filter: only applied on x86_64 hosts +# kargs — kernel arguments injected at install time +# bootloader — "systemd" = systemd-boot (Surface UEFI is standard EFI) +# discoverable-partitions — DPS GPT-type-GUID root discovery (no root= karg needed) +# block — allowed disk encryption schemes at install time + +[install] +match-architectures = ["x86_64"] + +# Use systemd-boot: Surface UEFI is standard x86-64 EFI, no GRUB needed. +bootloader = "systemd" + +# Enable DPS root discovery (systemd-boot always implements BLI). +# Source: config.rs - use_discoverable_partitions() defaults true for systemd-boot. +discoverable-partitions = true + +# Allow both direct and TPM2-LUKS at install time; user selects via --block-setup. +block = ["direct", "tpm2-luks"] + +# Surface-specific kernel arguments. +# i915.enable_psr=0 - disable Panel Self Refresh (prevents screen flicker) +# mem_sleep_default=deep - prefer S3 suspend (Surface Pro 5-9 support S3) +# button.lid_init_state=open - fix lid detection on some Surface models +# acpi_backlight=native - use native ACPI backlight driver +kargs = [ + "i915.enable_psr=0", + "mem_sleep_default=deep", + "button.lid_init_state=open", + "acpi_backlight=native", +] From 9ea2695cb8f2130e074419122067c7dbdb8a2357 Mon Sep 17 00:00:00 2001 From: corning-croak-cable Date: Sat, 9 May 2026 02:20:51 -0700 Subject: [PATCH 2/8] surface/x86: add kargs.d for Surface-specific persistent kernel args --- .../x86/usr/lib/bootc/kargs.d/50-surface-x86.toml | 10 ++++++++++ 1 file changed, 10 insertions(+) create mode 100644 contrib/surface/x86/usr/lib/bootc/kargs.d/50-surface-x86.toml diff --git a/contrib/surface/x86/usr/lib/bootc/kargs.d/50-surface-x86.toml b/contrib/surface/x86/usr/lib/bootc/kargs.d/50-surface-x86.toml new file mode 100644 index 000000000..966d54d09 --- /dev/null +++ b/contrib/surface/x86/usr/lib/bootc/kargs.d/50-surface-x86.toml @@ -0,0 +1,10 @@ +# Persistent kernel arguments for Microsoft Surface Pro / Surface Laptop (x86-64) +# Ships in the container image; applied on install and preserved across upgrades. +# Format: https://github.com/bootc-dev/bootc/tree/main/contrib/packaging/usr-extras/lib/bootc/kargs.d + +kargs = [ + "i915.enable_psr=0", + "mem_sleep_default=deep", + "button.lid_init_state=open", + "acpi_backlight=native", +] From 173543fbd9e9c200730be78ac6728e22b87abe92 Mon Sep 17 00:00:00 2001 From: corning-croak-cable Date: Sat, 9 May 2026 02:20:52 -0700 Subject: [PATCH 3/8] surface/x86: add modprobe options (usbhid, pcspkr blacklist) --- contrib/surface/x86/usr/lib/modprobe.d/surface-x86.conf | 8 ++++++++ 1 file changed, 8 insertions(+) create mode 100644 contrib/surface/x86/usr/lib/modprobe.d/surface-x86.conf diff --git a/contrib/surface/x86/usr/lib/modprobe.d/surface-x86.conf b/contrib/surface/x86/usr/lib/modprobe.d/surface-x86.conf new file mode 100644 index 000000000..ac1ee5947 --- /dev/null +++ b/contrib/surface/x86/usr/lib/modprobe.d/surface-x86.conf @@ -0,0 +1,8 @@ +# Kernel module options for Microsoft Surface Pro / Surface Laptop + +# Reduce USB polling latency for Type Cover keyboard/trackpad +options usbhid mousepoll=1 + +# No PC speaker on Surface +blacklist pcspkr +blacklist snd_pcsp From aecd300066c00d65a5779ccce15fc0fb32ba85b8 Mon Sep 17 00:00:00 2001 From: corning-croak-cable Date: Sat, 9 May 2026 02:20:53 -0700 Subject: [PATCH 4/8] surface/x86: add systemd sleep config (prefer S3/deep) --- .../x86/usr/lib/systemd/sleep.conf.d/surface-x86.conf | 5 +++++ 1 file changed, 5 insertions(+) create mode 100644 contrib/surface/x86/usr/lib/systemd/sleep.conf.d/surface-x86.conf diff --git a/contrib/surface/x86/usr/lib/systemd/sleep.conf.d/surface-x86.conf b/contrib/surface/x86/usr/lib/systemd/sleep.conf.d/surface-x86.conf new file mode 100644 index 000000000..608033303 --- /dev/null +++ b/contrib/surface/x86/usr/lib/systemd/sleep.conf.d/surface-x86.conf @@ -0,0 +1,5 @@ +# Prefer S3 (deep) suspend on Surface x86; fall back to s2idle. +# Surface Pro 5-9 and Surface Laptop 3-5 support S3 via ACPI. +[Sleep] +SuspendState=mem standby freeze +HibernateMode=shutdown From 7392a498f63de182873a181a93e0635cd48ca7dd Mon Sep 17 00:00:00 2001 From: corning-croak-cable Date: Sat, 9 May 2026 02:20:54 -0700 Subject: [PATCH 5/8] surface/x86: add udev wakeup rule for Type Cover --- .../surface/x86/usr/lib/udev/rules.d/99-surface-typecover.rules | 2 ++ 1 file changed, 2 insertions(+) create mode 100644 contrib/surface/x86/usr/lib/udev/rules.d/99-surface-typecover.rules diff --git a/contrib/surface/x86/usr/lib/udev/rules.d/99-surface-typecover.rules b/contrib/surface/x86/usr/lib/udev/rules.d/99-surface-typecover.rules new file mode 100644 index 000000000..1e88aa6a9 --- /dev/null +++ b/contrib/surface/x86/usr/lib/udev/rules.d/99-surface-typecover.rules @@ -0,0 +1,2 @@ +# Enable wakeup from suspend via the Surface Type Cover (Microsoft USB vendor 0x045e) +ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="045e", ATTR{power/wakeup}=="disabled", ATTR{power/wakeup}="enabled" From 1acab8e23b5396061859d29c1c27954c8e54aa8b Mon Sep 17 00:00:00 2001 From: corning-croak-cable Date: Sat, 9 May 2026 02:20:55 -0700 Subject: [PATCH 6/8] surface/x86: add systemd preset enabling iptsd and thermald --- .../x86/usr/lib/systemd/system-preset/15-surface-x86.preset | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 contrib/surface/x86/usr/lib/systemd/system-preset/15-surface-x86.preset diff --git a/contrib/surface/x86/usr/lib/systemd/system-preset/15-surface-x86.preset b/contrib/surface/x86/usr/lib/systemd/system-preset/15-surface-x86.preset new file mode 100644 index 000000000..ba4addc5c --- /dev/null +++ b/contrib/surface/x86/usr/lib/systemd/system-preset/15-surface-x86.preset @@ -0,0 +1,3 @@ +# Enable Surface-specific services +enable iptsd.service +enable thermald.service From 4bcd53edc05697aa204a09863d7db2494f2fd763 Mon Sep 17 00:00:00 2001 From: corning-croak-cable Date: Sat, 9 May 2026 02:20:56 -0700 Subject: [PATCH 7/8] surface/x86: add Fedora bootc Containerfile (linux-surface kernel, iptsd) --- contrib/surface/x86/Containerfile.fedora | 40 ++++++++++++++++++++++++ 1 file changed, 40 insertions(+) create mode 100644 contrib/surface/x86/Containerfile.fedora diff --git a/contrib/surface/x86/Containerfile.fedora b/contrib/surface/x86/Containerfile.fedora new file mode 100644 index 000000000..47f585a79 --- /dev/null +++ b/contrib/surface/x86/Containerfile.fedora @@ -0,0 +1,40 @@ +# Surface Pro / Surface Laptop (x86-64) bootc image - Fedora base +# Uses the linux-surface patched kernel for full hardware support. +# +# Build: +# podman build --platform linux/amd64 -f Containerfile.fedora -t surface-x86-fedora . +# +# Install to disk (Secure Boot disabled first, or enroll ParticleOS cert): +# podman run --rm --privileged --pid=host \ +# -v /dev:/dev -v /var/lib/containers:/var/lib/containers \ +# surface-x86-fedora bootc install to-disk /dev/nvme0n1 +# +# Source: linux-surface https://github.com/linux-surface/linux-surface +# Source: bootc install config - https://bootc-dev.github.io/bootc/install/config/ + +FROM quay.io/fedora/fedora-bootc:latest + +# Add linux-surface COPR for patched kernel (Type Cover, IPTS touchscreen, pen) +RUN dnf config-manager --add-repo \ + https://pkg.surfacelinux.com/fedora/linux-surface.repo && \ + dnf install -y \ + kernel-surface \ + iptsd \ + libwacom-surface \ + surface-control \ + thermald \ + sof-firmware \ + linux-firmware \ + tpm2-tools \ + tpm2-tss \ + sbctl && \ + dnf remove -y \ + kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra && \ + dnf clean all + +# Overlay Surface-specific bootc config, kargs.d, modprobe, and systemd files +COPY usr/ /usr/ + +# Rebuild initramfs for the surface kernel +RUN kver=$(ls /usr/lib/modules | grep -v $(uname -r) | head -1) && \ + dracut --force --kver "$kver" From 8444a0ce79ff45ffa674ccf32a26a3a5d9cfccac Mon Sep 17 00:00:00 2001 From: corning-croak-cable Date: Sat, 9 May 2026 02:20:57 -0700 Subject: [PATCH 8/8] surface/x86: add README --- contrib/surface/x86/README.md | 47 +++++++++++++++++++++++++++++++++++ 1 file changed, 47 insertions(+) create mode 100644 contrib/surface/x86/README.md diff --git a/contrib/surface/x86/README.md b/contrib/surface/x86/README.md new file mode 100644 index 000000000..06cfc183e --- /dev/null +++ b/contrib/surface/x86/README.md @@ -0,0 +1,47 @@ +# Surface x86 bootc Image (Surface Pro / Surface Laptop) + +Produces a bootc-compatible OCI image for Microsoft Surface Pro and Surface Laptop +(x86-64) devices using their standard UEFI firmware. + +## What ships in the image + +| Layer | Details | +|---|---| +| Kernel | linux-surface (patched for IPTS touch, Type Cover HID, pen) | +| Touch daemon | iptsd (IPTS frame processing) | +| Thermal | thermald (surface power management) | +| Firmware | sof-firmware, linux-firmware | +| kargs | PSR off, deep sleep, lid fix, native ACPI backlight | +| Bootloader | systemd-boot (via bootc install config) | +| TPM2 | tpm2-tools, sbctl (for Secure Boot key enrollment) | + +## Build + + podman build --platform linux/amd64 -f Containerfile.fedora -t surface-x86 . + +## Install to disk + + # Disable Secure Boot in Surface UEFI first (Volume Up + Power -> Security) + podman run --rm --privileged --pid=host \ + -v /dev:/dev -v /var/lib/containers:/var/lib/containers \ + surface-x86 bootc install to-disk /dev/nvme0n1 + + # With TPM2-LUKS disk encryption: + podman run --rm --privileged --pid=host \ + -v /dev:/dev -v /var/lib/containers:/var/lib/containers \ + surface-x86 bootc install to-disk --block-setup=tpm2-luks /dev/nvme0n1 + +## Secure Boot + +After first boot, run sbctl to enroll your own Platform Key: + + sbctl create-keys + sbctl enroll-keys --microsoft # keeps Windows dual-boot working + sbctl sign /efi/EFI/Linux/*.efi + +Re-enable Secure Boot in Surface UEFI. + +## bootc day-2 upgrades + + bootc upgrade # pulls new OCI image, applies on next reboot + bootc rollback # revert to previous deployment if needed