surface-arm64: add Snapdragon X Elite profile (Surface Laptop 7, arm64, upstream kernel, TPM enrollment)

[corning-croak-cable]

Surface ARM64 - Snapdragon X Elite (Surface Laptop 7)

Adds a surface-arm64 mkosi profile producing bootable ParticleOS images for
the Microsoft Surface Laptop 7 (Snapdragon X Elite / x1e80100, arm64).

Scope

• Upstream kernel only (Fedora rawhide aarch64 / Debian unstable) - no linux-surface patchset
• Bootable images as the primary goal - display, NVMe, WiFi working; camera/touchscreen deferred
• TPM enrollment quirks addressed (see design decisions below)

Files

mkosi.profiles/surface-arm64/
  mkosi.conf                          # arm64 arch, SignExpectedPcr=no, Qualcomm packages
  mkosi.conf.d/
    fedora/mkosi.conf                 # upstream Fedora rawhide kernel, qrtr-tools, pd-mapper
    debian/mkosi.conf                 # debian unstable arm64, firmware-qcom-soc
  mkosi.extra/
    usr/lib/modprobe.d/surface-arm64.conf           # tpm_crb forced, tpm_tis blacklisted, qrtr tuning
    usr/lib/systemd/system/qrtr-ns.service          # Qualcomm IPC Router Namespace daemon
    usr/lib/systemd/system/pd-mapper.service        # Qualcomm Protection Domain Mapper
    usr/lib/systemd/system/surface-sb-enroll.service  # firstboot Secure Boot enrollment
    usr/lib/surface/sb-enroll.sh                    # sbctl key gen + UEFI enrollment guide
    usr/lib/systemd/system-preset/15-particleos-surface-arm64.preset
    usr/lib/systemd/sleep.conf.d/surface-arm64.conf  # s2idle only (no S3)
  ADR.md                              # Architecture Decision Record
  README.md

Design decisions (see ADR.md)

1. Upstream kernel (no linux-surface)

The x1e80100-microsoft-romulus13.dts and romulus15.dts device trees are merged
upstream since kernel 6.12. Fedora rawhide aarch64 ships them as part of kernel-core.
linux-surface provides no aarch64 packages, so patched kernel is not an option.

Trade-off accepted: camera (MIPI/IPU6) and full audio not functional until upstreamed.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/arch/arm64/boot/dts/qcom/x1e80100-microsoft-romulus13.dts

2. SignExpectedPcr=no (overrides root SignExpectedPcr=yes)

The Qualcomm fTPM on X Elite is not available during the initrd phase when the
kernel attempts PCR measurements for UKI hash policy. This causes a boot-time hang
or enrollment failure.

Disabling PCR-prediction signing keeps disk encryption working (tpm2-tools + tpm_crb)
without binding to boot state. Weaker policy, but the image boots.

Source: community testing; linux-surface/linux-surface#1590

3. No MokManager - sbctl firstboot + direct UEFI db enrollment

Surface UEFI enforces NX (No-Execute) mode in the firmware environment.
Most current MokManager builds allocate executable memory without NX-compatible APIs,
causing a black screen hang at the Microsoft logo when key enrollment is triggered.

ParticleOS already avoids this: UKI + systemd-boot with no shim means MokManager
is never invoked. The surface-sb-enroll.service firstboot unit:

1. Runs sbctl create-keys to generate PK/KEK/db signing keys
2. Signs all UKIs in the ESP with the generated keys
3. Exports ParticleOS-PK.cer (DER format) for UEFI enrollment
4. Writes step-by-step instructions to /var/lib/surface-sb-enroll/ENROLL_SECURE_BOOT.md

The user then enrolls the Platform Key directly in Surface UEFI (no MokManager, no shim).

Source: linux-surface/linux-surface#1590

4. SuspendState=freeze (s2idle only)

Snapdragon X Elite does not expose S3 (suspend-to-RAM) on Linux via PSCI/ACPI.
Setting mem_sleep_default=deep (used in the x86 surface profile) would fail silently.

Build commands

# Fedora rawhide aarch64 (recommended)
mkosi --profile obs-repos --profile desktop --profile gnome --profile surface-arm64 build

# Debian unstable aarch64
mkosi --distribution debian --profile desktop --profile gnome --profile surface-arm64 build

# Cross-building from x86-64 host (requires qemu-user-static)
sudo dnf install qemu-user-static  # Fedora host

Hardware status (kernel 6.15+)

Component	Status
Boot (systemd-boot + UKI)	Works
CPU (Oryon 12-core)	Works
NVMe (PCIe Gen 4)	Works
Display (eDP 120Hz)	Works
WiFi (WCN785x / ath12k)	Works (needs linux-firmware)
USB-A / USB-C	Works
Suspend (s2idle)	Works
TPM2 disk encryption	Works (no PCR binding)
Secure Boot	Manual setup via sb-enroll service
Audio	Partial (Windows firmware blobs needed)
Camera	Not working (IPU6/MIPI unmerged)
Touchscreen	Not working (HID-over-SPI unmerged)