Add patches for 7.2 - #2233

I made a pull request against your 7.1 kernel branch. Built and installed successfully on a Surface Laptop Studio 2. Thanks again for your work.

Generated the same series independently against v7.2.2 — it comes out
identical, and it boots on a Surface Pro 8.

I missed this PR and opened #2262 with the same thing; that one is closed now
in favour of this. Since the two were produced independently, the comparison is
worth something as a cross-check, so here is what came out of it.

I forward-ported the 7.1 series from #2178 onto v7.2.2 with git am --3way.
Fourteen of the fifteen patches applied with no conflict at all. The only one
that needed anything was 0011-surface-shutdown.patch, and only in context:
v7.2 reworded the comment on the neighbouring non_mappable_bars field in
include/linux/pci.h ("BARs can't be mapped to user-space" ->
"BARs can't be mapped by CPU or peers"). The line the patch adds and the code
around it are untouched.

Comparing all sixteen files in this PR against what I ended up with:

configs/surface-7.2.config    byte-identical
patches/7.2/0001..0015        identical content

The only differences in the patches are hunk offsets — your base is an earlier
7.2.x than v7.2.2, so line numbers moved (for instance 0011: @@ -536 here
against @@ -543 on v7.2.2). Nothing to resolve; they apply either way.

Tested on a Surface Pro 8

Built as 7.2.2-surface-1 with make bindeb-pkg and running now — this is
typed from it. Touch (ithc), pen, suspend, battery, and all three cameras
including the IR one with face authentication through PAM. Only the Pro 8 is
covered by that; the rest of the series is as tested as it was in #2178.

Base config was Ubuntu's shipped config-7.0.0-30-generic merged with
pkg/debian/kernel/ubuntu.config and this PR's config, following
.github/scripts/package/debian.sh. CONFIG_RUST comes out unset, which is
correct rather than a mistake: ubuntu.config sets DEBUG_INFO_NONE, so there
is no GENDWARFKSYMS, and with MODVERSIONS on Kconfig does not offer the
symbol at all. Distro rustc is fine — 7.2 wants >= 1.85, Ubuntu ships 1.93.

One trap for anyone building these with Secure Boot on

Signing the kernel image with the DKMS MOK from /var/lib/shim-signed/mok/ —
the obvious key to reach for, since it is already enrolled — does not work:

error: bad shim lock signature
error: you need to load the kernel first

That certificate carries the module-signing-only EKU OID
1.3.6.1.4.1.2312.16.1.2 alongside Code Signing, and shim refuses a boot
image signed by it. What makes it expensive is that sbverify --list reports
the signature as fine: it answers "does this signature match this
certificate", not "will shim accept this image". Check the certificate instead:

openssl x509 -inform DER -in /var/lib/shim-signed/mok/MOK.der -noout -text \
  | grep -A2 'Extended Key Usage'

The fix is a separate key with extendedKeyUsage = codeSigning and no extra
OIDs, sbsign with it, then mokutil --import. sbsign adds its signature
alongside any existing one and shim accepts the image if it trusts either, so
the DKMS key can stay exactly where it is for modules.

Happy to test anything else here on the Pro 8.

Tested on Microsoft Surface Book 2 (Intel Core i7-8650U + NVIDIA GTX 1050 Mobile)
Built package from pkg/arch/kernel against v7.2.4.arch1 on Garuda / Arch Linux.

Hardware Status & Verification:

Touchscreen & Stylus: IPTS (gen4 ME) running in event mode; [email protected] initialized and touch works smoothly.
Dual Batteries: Both BAT1 (clipboard) and BAT2 (base) detected and reporting charging/discharging states properly via SAM.
Surface SAM / DTX: surface-dtx-daemon running; physical latch release, detachment into tablet mode and re-docking (handling dynamic PCIe dGPU and USB re-enumeration) works cleanly.
Keyboard & Touchpad: Base keyboard and trackpad fully responsive with native Wayland 1:1 gestures.
Wi-Fi & Bluetooth: Marvell 88W8897 (mwifiex_pcie) firmware loaded with quirks (reset_d3cold, do_flr_on_bridge, no_bridge_d3) and connects reliably.
NVIDIA dGPU: nvidia-580xx-dkms compiled cleanly and GPU detected (nvidia-smi operational).

Note on PKGBUILD:

The sha256sums array in pkg/arch/kernel/PKGBUILD still references the older patch checksums and needs to be refreshed for the updated 7.2 series (0001 through 0015). Once updated, the package builds and boots without issue.

Thanks for the great work on forward-porting to 7.2!

@AlpenGlowNW Thanks for catching that. Checksums have been updated now.

Tested the 7.2 patch series from this PR at commit

6bcf30a on a Surface Pro (2017 / model
1796) running Pop!_OS 24.04 LTS.

• Kernel source: Linux v7.2.4 with this PR’s patches/7.2/*.patch
  applied. The installed Debian package reports 7.2.4-surface7-exp
  (built with make bindeb-pkg); it was not built from the Arch
  7.2.4.arch1 package.

• Configuration: merged Pop’s 7.1.5 generic config with configs/surface-
  7.2.config; disabled Rust and BTF debug info for this local build and
  cleared the distro signing key paths. Secure Boot was off.

• Touch: working after boot and across normal reboots. The ipts module
  is loaded and iptsd@dev-hidraw*.service is active in touchscreen mode.
  Userspace packages: iptsd 3.1.0 and libwacom-surface 2.17.0.

• surface_aggregator and surface_gpe also load. Pen, cameras, and
  suspend have not been separately tested.

This adds a Surface Pro 5 test point for the v7.2.4 patch set. Thanks to
the contributors who forward-ported the patches