Microsoft Surface Pro 9 - ArchWiki

Jump to content

# Microsoft Surface Pro 9

From ArchWiki

This article or section does not follow the Laptop page guidelines.

Reason: Stub, missing some IDs in the hardware table. (Discuss in Talk:Microsoft Surface Pro 9)

Hardware | PCI/USB ID | Working?
--- | --- | ---
Touchpad |  | Yes
Keyboard |  | Yes
Touchscreen |  | Yes
Digitizer Pen | `8086:51d0` | Yes
GPU | `8086:46a8` | Yes
Webcam |  | No
Bluetooth | `8087:0033` | Yes
Audio | `8086:9dc8` | Yes
Wireless | `8086:51f0` | Yes
Thunderbolt 4 | `8086:461f` | Yes
`8086:462f` | Yes
TPM |  | Yes

This page aims to document specific information on getting Arch Linux working on the Microsoft Surface Pro 9 tablet with Intel Processor.

## Installation

Hold `Volume Up` key on the tablet to enter UEFI setup utility. Disable Secure Boot, enable booting from the external USB devices, then boot from the installation media.

Since the Linux kernel does not ship required drivers to use the detachable keyboard, touchscreen and stylus, you have two options to control the operating system:

- Plug in a USB keyboard into a free USB port and continue the installation process as usual.
- Remaster the Archiso and include drivers and kernel from the linux-surface project.

## Secure Boot

Note: Replacing Microsoft's platform keys with your own (e.g. using sbctl) is safe and does not brick the laptop).

It is possible to set the tablet to use only user-provided keys in UEFI setup utility, but the default options allow only either using MS keys, or MS + 3rd Party CA, or disabling the Secure Boot.

The procedure of setting up the secure boot is as follows:

- Disable Secure Boot
- Follow Secure Boot for general setup until the key enrollment.
- Make sure that enrolling keys is the last action you'd do with the Secure Boot before shutting down the machine. In other words, for example, either `sbctl enroll-keys` (only 3rd Party CA only), or `sbctl enroll-keys -m` (MS + 3rd Party CA) commands must be entered before shutting down.
- Shutdown the tablet. Do not reboot, do not reboot into the UEFI firmware setup directly.
- Turn the tablet back on and hold "Volume Down" key.
- Navigate to the "Security" section in the menu. If it says that it needs the reboot to access the settings, select the "Reboot to UEFI" option on the same page.
- After the reboot, navigate to the "Security" section again. Verify that the Secure Boot is enabled automatically. If the text says "Secure Boot is Enabled with custom key configuration", then it means that UEFI enabled the hidden option to use only third-party CAs and keys automatically. Never select any other option there if you want to keep using your own keys.
- Reboot to the operating system and verify that the Secure Boot is enabled. E.g. `sbctl status` should tell that the Secure Boot is enabled.

Category:

- Microsoft

Hidden category:

- Pages or sections flagged with Template:Laptop style