contrib/surface: add Surface Pro/Laptop x86-64 bootc example (systemd-boot, linux-surface, TPM2)

contrib/surface/x86/Containerfile.fedora

@@ -0,0 +1,40 @@
+# Surface Pro / Surface Laptop (x86-64) bootc image - Fedora base
+# Uses the linux-surface patched kernel for full hardware support.
+#
+# Build:
+#   podman build --platform linux/amd64 -f Containerfile.fedora -t surface-x86-fedora .
+#
+# Install to disk (Secure Boot disabled first, or enroll ParticleOS cert):
+#   podman run --rm --privileged --pid=host \
+#     -v /dev:/dev -v /var/lib/containers:/var/lib/containers \
+#     surface-x86-fedora bootc install to-disk /dev/nvme0n1
+#
+# Source: linux-surface https://github.com/linux-surface/linux-surface
+# Source: bootc install config - https://bootc-dev.github.io/bootc/install/config/
+
+FROM quay.io/fedora/fedora-bootc:latest
+
+# Add linux-surface COPR for patched kernel (Type Cover, IPTS touchscreen, pen)
+RUN dnf config-manager --add-repo \
+      https://pkg.surfacelinux.com/fedora/linux-surface.repo && \
+    dnf install -y \
+      kernel-surface \
+      iptsd \
+      libwacom-surface \
+      surface-control \
+      thermald \
+      sof-firmware \
+      linux-firmware \
+      tpm2-tools \
+      tpm2-tss \
+      sbctl && \
+    dnf remove -y \
+      kernel kernel-core kernel-modules kernel-modules-core kernel-modules-extra && \
+    dnf clean all
+
+# Overlay Surface-specific bootc config, kargs.d, modprobe, and systemd files
+COPY usr/ /usr/
+
+# Rebuild initramfs for the surface kernel
+RUN kver=$(ls /usr/lib/modules | grep -v $(uname -r) | head -1) && \
+    dracut --force --kver "$kver"

contrib/surface/x86/README.md

@@ -0,0 +1,47 @@
+# Surface x86 bootc Image (Surface Pro / Surface Laptop)
+
+Produces a bootc-compatible OCI image for Microsoft Surface Pro and Surface Laptop
+(x86-64) devices using their standard UEFI firmware.
+
+## What ships in the image
+
+| Layer | Details |
+|---|---|
+| Kernel | linux-surface (patched for IPTS touch, Type Cover HID, pen) |
+| Touch daemon | iptsd (IPTS frame processing) |
+| Thermal | thermald (surface power management) |
+| Firmware | sof-firmware, linux-firmware |
+| kargs | PSR off, deep sleep, lid fix, native ACPI backlight |
+| Bootloader | systemd-boot (via bootc install config) |
+| TPM2 | tpm2-tools, sbctl (for Secure Boot key enrollment) |
+
+## Build
+
+    podman build --platform linux/amd64 -f Containerfile.fedora -t surface-x86 .
+
+## Install to disk
+
+    # Disable Secure Boot in Surface UEFI first (Volume Up + Power -> Security)
+    podman run --rm --privileged --pid=host \
+      -v /dev:/dev -v /var/lib/containers:/var/lib/containers \
+      surface-x86 bootc install to-disk /dev/nvme0n1
+
+    # With TPM2-LUKS disk encryption:
+    podman run --rm --privileged --pid=host \
+      -v /dev:/dev -v /var/lib/containers:/var/lib/containers \
+      surface-x86 bootc install to-disk --block-setup=tpm2-luks /dev/nvme0n1
+
+## Secure Boot
+
+After first boot, run sbctl to enroll your own Platform Key:
+
+    sbctl create-keys
+    sbctl enroll-keys --microsoft   # keeps Windows dual-boot working
+    sbctl sign /efi/EFI/Linux/*.efi
+
+Re-enable Secure Boot in Surface UEFI.
+
+## bootc day-2 upgrades
+
+    bootc upgrade   # pulls new OCI image, applies on next reboot
+    bootc rollback  # revert to previous deployment if needed

contrib/surface/x86/usr/lib/bootc/install/50-surface-x86.toml

@@ -0,0 +1,34 @@
+# bootc install configuration for Microsoft Surface Pro / Surface Laptop (x86-64)
+# Ships inside the container image; applied during `bootc install to-disk`.
+#
+# Field reference: https://github.com/bootc-dev/bootc/blob/main/crates/lib/src/install/config.rs
+#   match-architectures  — filter: only applied on x86_64 hosts
+#   kargs               — kernel arguments injected at install time
+#   bootloader          — "systemd" = systemd-boot (Surface UEFI is standard EFI)
+#   discoverable-partitions — DPS GPT-type-GUID root discovery (no root= karg needed)
+#   block               — allowed disk encryption schemes at install time
+
+[install]
+match-architectures = ["x86_64"]
+
+# Use systemd-boot: Surface UEFI is standard x86-64 EFI, no GRUB needed.
+bootloader = "systemd"
+
+# Enable DPS root discovery (systemd-boot always implements BLI).
+# Source: config.rs - use_discoverable_partitions() defaults true for systemd-boot.
+discoverable-partitions = true
+
+# Allow both direct and TPM2-LUKS at install time; user selects via --block-setup.
+block = ["direct", "tpm2-luks"]
+
+# Surface-specific kernel arguments.
+# i915.enable_psr=0         - disable Panel Self Refresh (prevents screen flicker)
+# mem_sleep_default=deep    - prefer S3 suspend (Surface Pro 5-9 support S3)
+# button.lid_init_state=open - fix lid detection on some Surface models
+# acpi_backlight=native     - use native ACPI backlight driver
+kargs = [
+  "i915.enable_psr=0",
+  "mem_sleep_default=deep",
+  "button.lid_init_state=open",
+  "acpi_backlight=native",
+]

contrib/surface/x86/usr/lib/bootc/kargs.d/50-surface-x86.toml

@@ -0,0 +1,10 @@
+# Persistent kernel arguments for Microsoft Surface Pro / Surface Laptop (x86-64)
+# Ships in the container image; applied on install and preserved across upgrades.
+# Format: https://github.com/bootc-dev/bootc/tree/main/contrib/packaging/usr-extras/lib/bootc/kargs.d
+
+kargs = [
+  "i915.enable_psr=0",
+  "mem_sleep_default=deep",
+  "button.lid_init_state=open",
+  "acpi_backlight=native",
+]

contrib/surface/x86/usr/lib/modprobe.d/surface-x86.conf

@@ -0,0 +1,8 @@
+# Kernel module options for Microsoft Surface Pro / Surface Laptop
+
+# Reduce USB polling latency for Type Cover keyboard/trackpad
+options usbhid mousepoll=1
+
+# No PC speaker on Surface
+blacklist pcspkr
+blacklist snd_pcsp

contrib/surface/x86/usr/lib/systemd/sleep.conf.d/surface-x86.conf

@@ -0,0 +1,5 @@
+# Prefer S3 (deep) suspend on Surface x86; fall back to s2idle.
+# Surface Pro 5-9 and Surface Laptop 3-5 support S3 via ACPI.
+[Sleep]
+SuspendState=mem standby freeze
+HibernateMode=shutdown

contrib/surface/x86/usr/lib/systemd/system-preset/15-surface-x86.preset

@@ -0,0 +1,3 @@
+# Enable Surface-specific services
+enable iptsd.service
+enable thermald.service

contrib/surface/x86/usr/lib/udev/rules.d/99-surface-typecover.rules

@@ -0,0 +1,2 @@
+# Enable wakeup from suspend via the Surface Type Cover (Microsoft USB vendor 0x045e)
+ACTION=="add", SUBSYSTEM=="usb", ATTR{idVendor}=="045e", ATTR{power/wakeup}=="disabled", ATTR{power/wakeup}="enabled"