Microsoft Surface Pro 9
Hardware | PCI/USB ID | Working? |
---|---|---|
Touchpad | Yes | |
Keyboard | Yes | |
Touchscreen | Yes | |
Digitizer Pen | 8086:51d0 |
Yes |
GPU | 8086:46a8 |
Yes |
Webcam | No | |
Bluetooth | 8087:0033 |
Yes |
Audio | 8086:9dc8 |
Yes |
Wireless | 8086:51f0 |
Yes |
Thunderbolt 4 | 8086:461f |
Yes |
8086:462f |
Yes | |
TPM | Yes |
This page aims to document specific information on getting Arch Linux working on the Microsoft Surface Pro 9 tablet with Intel Processor.
Installation
Hold Volume Up
key on the tablet to enter UEFI setup utility. Disable Secure Boot, enable booting from the external USB devices, then boot from the installation media.
Since the Linux kernel does not ship required drivers to use the detachable keyboard, touchscreen and stylus, you have two options to control the operating system:
- Plug in a USB keyboard into a free USB port and continue the installation process as usual.
- Remaster the Archiso and include drivers and kernel from the linux-surface project.
Secure Boot
Note: Replacing Microsoft's platform keys with your own (e.g. using sbctl) is safe and does not brick the laptop).
It is possible to set the tablet to use only user-provided keys in UEFI setup utility, but the default options allow only either using MS keys, or MS + 3rd Party CA, or disabling the Secure Boot.
The procedure of setting up the secure boot is as follows:
- Disable Secure Boot
- Follow Secure Boot for general setup until the key enrollment.
- Make sure that enrolling keys is the last action you'd do with the Secure Boot before shutting down the machine. In other words, for example, either
sbctl enroll-keys
(only 3rd Party CA only), orsbctl enroll-keys -m
(MS + 3rd Party CA) commands must be entered before shutting down. - Shutdown the tablet. Do not reboot, do not reboot into the UEFI firmware setup directly.
- Turn the tablet back on and hold "Volume Down" key.
- Navigate to the "Security" section in the menu. If it says that it needs the reboot to access the settings, select the "Reboot to UEFI" option on the same page.
- After the reboot, navigate to the "Security" section again. Verify that the Secure Boot is enabled automatically. If the text says "Secure Boot is Enabled with custom key configuration", then it means that UEFI enabled the hidden option to use only third-party CAs and keys automatically. Never select any other option there if you want to keep using your own keys.
- Reboot to the operating system and verify that the Secure Boot is enabled. E.g.
sbctl status
should tell that the Secure Boot is enabled.