Surface Book 2 Ubuntu/Linux Installation and Recovery Guide

This is a recovery-first guide for installing Ubuntu on a Microsoft Surface Book 2, keeping Windows in a dual-boot setup, and optionally adding the current linux-surface kernel. It was reviewed on 2026-09-01. Surface firmware, Ubuntu installers, package names, and the project support matrix change; recheck the linked primary sources on the day of the change.

The old jakeday checklist is preserved at the end for provenance, but it is not a maintained procedure. Do not use its abandoned repository, arbitrary mirror substitution, blind Boot-Repair step, boot-theme work, fixed DPI value, or vague “SS” instruction.

Table of Contents

Choose the outcome before changing the machine

Use the least invasive route that satisfies the need:

Need	Preferred first route	Stop condition
Linux command-line tools while Windows remains primary	A supported virtual machine or WSL, if it meets the workload	Hardware passthrough or kernel testing is required
Test Ubuntu hardware compatibility	A verified Ubuntu live USB without installing	The live session cannot reliably use keyboard, storage, display, or network
General Ubuntu desktop	Stock Ubuntu kernel first	A required Surface feature is absent and the current linux-surface matrix says its kernel supplies it
Dual boot	Shrink Windows from Windows, then install only into confirmed unallocated space	BitLocker recovery, backups, or exact partition identity is uncertain
Replace Windows	Only after a tested restore plan and explicit acceptance of losing the Windows installation	Windows firmware/recovery access or required applications must remain available

There is no universal “everything works” claim. Surface Book 2 variants differ by size, processor, storage, and optional NVIDIA GPU. Treat the exact device and the current support matrix as evidence.

Gate 1: identify the device and encryption state in Windows

Before entering UEFI or resizing a volume, record the model, CPU architecture, firmware version, disk layout, Windows edition, and whether BitLocker or Device Encryption protects each volume. These read-only PowerShell and Command Prompt checks avoid printing a recovery key:

Get-CimInstance Win32_ComputerSystem | Select-Object Manufacturer, Model, SystemType
Get-CimInstance Win32_Processor | Select-Object Name
Get-CimInstance Win32_BIOS | Select-Object SMBIOSBIOSVersion
Get-Disk | Select-Object Number, FriendlyName, PartitionStyle, Size
Get-Partition | Select-Object DiskNumber, PartitionNumber, DriveLetter, Type, Size
manage-bde -status

Keep the output private: disk identifiers and firmware inventory can still be identifying. Confirm whether the clipboard base contains a discrete NVIDIA GPU; do not infer it from the product family name.

Find the matching BitLocker recovery key through Microsoft’s documented account, organization, printout, or USB routes, and verify from a second device that you can retrieve the correct key ID. Never paste the 48-digit key into a post, ticket, shell history, screenshot, or source repository. Microsoft states that it cannot recreate a lost key; if the key cannot be recovered, stop before firmware, Secure Boot, boot-order, or partition changes.

Gate 2: create and test recovery assets

Have all of these before installation:

A current file backup of Windows and any existing Linux data, stored on a different device.
A second independent copy of irreplaceable data.
A Surface USB recovery drive or the exact-model Surface recovery image prepared according to Microsoft.
A verified Ubuntu installer USB made from an official image.
The BitLocker recovery route and account recovery methods available offline.
Power, a known-good USB adapter if required, and preferably a spare USB keyboard and mouse.

Verify backups by opening sampled files and, for a backup system, performing a test restore to a separate location. Merely seeing a backup job marked “successful” is not a restore test. Boot each recovery USB far enough to identify it, then exit without starting reset, repartition, or installation. Label drives clearly and disconnect backup disks during the Ubuntu install so they cannot be selected accidentally.

Update firmware under Windows first

Microsoft’s supported route for Surface drivers and firmware is Windows Update, with the official Surface package as an advanced fallback. Connect the base and accessories, use stable power, finish updates and reboots, then capture the new firmware version. Do not interrupt a firmware update or detach the base.

Keep Windows available for future Surface firmware servicing unless an explicitly documented alternative supports the exact firmware. Do not install a firmware payload from a forum, copy one between Surface models, or attempt a Windows firmware update while also changing the Linux kernel or bootloader.

Know the two Surface button sequences

Microsoft documents different sequences:

Open Surface UEFI: shut down, hold Volume Up, press and release Power, and keep holding Volume Up until UEFI appears.
Boot a prepared USB once: shut down, insert the USB, hold Volume Down, press and release Power, and release Volume Down when the boot indication appears.

Record the current boot order and Secure Boot state before changing anything. Prefer the one-time USB boot action over permanently placing USB first. Change one setting at a time. Never delete firmware keys, clear the TPM, set an unrecoverable UEFI password, or disable Secure Boot merely because an old tutorial says so. Managed devices require the organization’s approval.

Prepare and test the Ubuntu medium

Download a supported Ubuntu image from Ubuntu, verify the signed checksum by following Canonical’s current verification guide, and write it using the current Ubuntu installer instructions. The write operation erases the selected USB, so identify it by capacity and unplug unrelated storage first.

Boot “Try Ubuntu” before installing. The live-session test should include keyboard, touchpad, both display modes you intend to use, Wi-Fi, Bluetooth if required, audio, USB, SD card, suspend/wake, battery reporting, touch/pen, and external displays. Test the base-attached configuration first. A live image normally uses the stock Ubuntu kernel, so a failure may still be addressed by linux-surface—but only when the current matrix and device page support that conclusion. If storage or the internal keyboard is unreliable, do not install.

Dual boot: shrink Windows safely

For dual boot, use Windows Disk Management to shrink the Windows NTFS volume and leave the result unallocated. Microsoft’s documentation explains the supported shrink operation. Do not delete, format, move, or reuse EFI System, Microsoft Reserved, Windows Recovery, or OEM partitions. Do not use a guessed partition number from another machine.

Before shrinking:

Finish Windows updates and restart cleanly.
Confirm backups and the BitLocker recovery key again.
Run Windows filesystem checks appropriate to the machine and resolve errors.
Record screenshots or a diagram of disk sizes and partition types, without exposing serial numbers.
Decide a capacity based on measured workload and preserve Windows free space.

If organizational policy requires suspending BitLocker for a documented change, use the Microsoft procedure and resume protection immediately afterward; do not decrypt the drive or disable protection casually. Do not write to a hibernated Windows filesystem from Linux. In the Ubuntu installer, match the internal disk by model and size and allocate only the space you deliberately freed. If the installer layout differs from the record, cancel.

Install stock Ubuntu first

Prefer a supported Ubuntu LTS release and its default desktop unless a different edition has a defined owner and support window. Keep Secure Boot enabled when the official Ubuntu installer boots successfully. Use the installer’s supported encryption options only after reading the linux-surface disk-encryption notes: a Surface-specific keyboard driver may need to be present in the early boot image, and a USB keyboard is not a substitute for a tested recovery design.

After the first boot, update Ubuntu from its configured official release sources. Do not mechanically replace mirrors. Choose a mirror through Ubuntu’s supported configuration only after checking release, signature, HTTPS, and ownership. Do not install another full desktop merely to fix scaling or input.

Capture a read-only baseline:

uname -a
cat /etc/os-release
test -d /sys/firmware/efi && echo UEFI
findmnt -no SOURCE,FSTYPE,OPTIONS /
lsblk -e 7 -o NAME,PATH,SIZE,TYPE,FSTYPE,MOUNTPOINTS,MODEL
lspci -nnk
lsusb
mokutil --sb-state
echo "$XDG_SESSION_TYPE"

Redact serials, MAC addresses, hostnames, usernames, mount paths, and network names before sharing diagnostics.

Decide whether linux-surface is necessary

Trying the distribution kernel first is the least invasive route: the current Surface Book 2 page shows that some features are already provided by upstream drivers, while others still need Surface-specific components. Check that current device page and feature matrix, not screenshots or old posts. At the 2026-09-01 review, the device page attributes keyboard and touchpad to upstream drivers, while touch/pen, tablet mode, battery/performance integration, clipboard detachment, and discrete-GPU handling depend on Surface-specific components; cameras are not listed as working. Details can change.

Write down the missing feature and the matrix entry that justifies a custom kernel. If stock Ubuntu meets the need, keep it. A custom kernel increases the testing surface for Secure Boot, DKMS modules, NVIDIA drivers, suspend, and updates.

Install only from the current signed linux-surface route

Use only the current linux-surface Installation and Setup page and its HTTPS binary package repository. The project supplies signed packages and a separate MOK enrollment package. Do not use the abandoned jakeday/linux-surface repository, download random kernel files, import keys from copied commands, or pipe an unreviewed network response into a privileged shell.

After adding the repository exactly as currently documented, inspect package origin before installation. On the review date, the documented Ubuntu/Debian package set includes the Surface image, headers, iptsd, and a separate Secure Boot MOK package. The same page explicitly tells Ubuntu 26.04 users to omit libwacom-surface because of a current conflict, so do not hard-code that package across releases.

sudo apt update
apt-cache policy linux-image-surface linux-headers-surface iptsd linux-surface-secureboot-mok
sudo apt install linux-image-surface linux-headers-surface iptsd
sudo apt install linux-surface-secureboot-mok
sudo update-grub

Read APT’s origin, package list, disk change, and removal plan before confirming. Stop if the origin is unexpected, the package names differ from the live official page, APT proposes removing the stock Ubuntu kernel, or /boot lacks space. Keep the distribution kernel installed as the rollback entry. Install any release-specific package, such as libwacom-surface, only when the current page says it applies.

Keep Secure Boot; understand MOK enrollment

Ubuntu uses a signed boot chain and MOK management for additional trusted keys. The linux-surface package installs the project’s public certificate so its signed kernel can be accepted. This is a trust decision: confirm that the certificate and package came from the current project route, read the on-screen package instructions, and enroll only the expected key at the next local reboot.

Do not publish or reuse the temporary enrollment credential. Do not disable validation, turn off Secure Boot, delete all firmware keys, or clear the TPM as routine troubleshooting. If MokManager does not show the expected certificate, the keyboard layout is uncertain, or Windows immediately demands an unavailable recovery key, stop and return to the stock Ubuntu kernel or recorded UEFI state. Kernel module signing is a separate issue: NVIDIA or other out-of-tree modules must also be compatible with the active kernel and accepted by the Secure Boot policy.

Reboot with an explicit rollback path

Before the first Surface-kernel reboot, confirm the stock kernel remains installed and appears under GRUB’s advanced entries. Reboot with local access, recovery media, power, and enough time to roll back. Do not perform the first boot remotely.

After booting, verify rather than assume:

uname -r
mokutil --sb-state
dpkg-query -W linux-image-surface linux-headers-surface iptsd linux-surface-secureboot-mok
systemctl --no-pager --full status iptsd
journalctl -b -p warning..alert --no-pager
journalctl -b -k --no-pager

If the new kernel fails, use GRUB’s advanced menu to boot the known-good Ubuntu kernel. Keep the failed boot’s logs. Do not run Boot-Repair blindly or edit EFI files until the failure is classified as firmware selection, bootloader, kernel, initramfs, encryption unlock, or filesystem damage.

Validate Surface Book 2 features individually

Use a matrix with pass/fail evidence after each kernel, firmware, NVIDIA, or desktop-session change:

Feature	Safe test	Boundary
Keyboard and touchpad	Type in an unprivileged editor; test click, scroll, sleep, and wake	Stop if input is lost at login or encryption unlock
Touch and pen	Test calibration, edges, rotation, pressure if needed, and suspend/resume	`iptsd` and Surface kernel support are version-dependent
Clipboard/base detach	Close GPU and storage users, then use the supported detachment service	Never force detach during writes, updates, or active dGPU use
NVIDIA dGPU	Identify the PCI device and driver, then run a bounded application test	A listed GPU is not proof that power control, offload, and detach are safe
Power and batteries	Compare both batteries, AC state, idle drain, suspend, and wake across cycles	Stop on heat, swelling, sudden discharge, or failed wake
Cameras	Treat as unsupported unless the current matrix and exact tested stack say otherwise	Do not promise camera support for calls or authentication
Wi-Fi and Bluetooth	Test the required network/security mode and simultaneous devices	Do not weaken network security to hide a driver limitation

The dGPU and detachment utilities have their own project documentation. Install them only for the matching hardware and only after the basic system is stable. Never detach the base while the dGPU is in use, a base-connected disk is mounted, or a firmware/package operation is running.

Wayland, X11, HiDPI, and input methods

Record the current session with echo "$XDG_SESSION_TYPE". Test Wayland first when it is the Ubuntu default, but compare an X11 session when an NVIDIA, screen-sharing, pen, or legacy application problem is reproducible there. Do not globally force one display stack based on an old fix.

Use the desktop’s Displays settings for integer or fractional scaling. A hard-coded DPI of 256 is not portable between the 13.5-inch and 15-inch models, external displays, or desktop environments. Check login screen, menus, browser zoom, terminal, external monitors, touch coordinates, and performance before accepting a scale.

For multilingual text, configure Ubuntu’s supported input-source UI first. Use one input-method framework with a clear owner; do not install fcitx or Fcitx 5 merely because the historical note names it, and do not run it concurrently with IBus without a tested requirement. Verify composition in normal applications and at the lock screen without entering a real password into a test field.

Updates and reproducibility

Change one layer per maintenance window: Surface firmware in Windows, Ubuntu packages, linux-surface kernel, NVIDIA/DKMS module, or desktop settings. Before each kernel update, confirm free /boot space, a known-good stock kernel, recovery media, and local access. Afterward, repeat boot, input, storage, network, power, suspend, and Secure Boot checks.

Keep a private manifest containing:

Surface model and size, CPU, dGPU presence, and firmware version.
Ubuntu release, stock and Surface kernel package versions, and package origins.
Secure Boot state and the expected enrolled certificate fingerprint—never credentials or recovery keys.
Wayland/X11 session, graphics driver, iptsd version, and matrix review date.
Partition diagram, backup/restore test date, and Windows recovery-media test date.
Test results, regressions, relevant boot IDs, and rollback performed.

Recovery and uninstall

Use the smallest reversible recovery:

Desktop or input regression: select the previous session or boot the stock Ubuntu kernel.
Surface kernel regression: retain logs, boot the stock kernel, and follow the current linux-surface removal instructions. Do not remove the running kernel.
MOK problem: follow Ubuntu and linux-surface key-management instructions for the specific enrolled certificate. Never reset all firmware keys.
Ubuntu bootloader problem: use the Ubuntu live medium to inspect disks, EFI entries, filesystems, and logs first. Repair only the proven failed layer.
Windows boot or BitLocker problem: use the matching recovery key and Microsoft’s Windows/Surface recovery tools. Avoid manual EFI reconstruction when official recovery works.
Remove dual boot: prove Windows starts independently, back up again, restore the Windows boot path with Microsoft tools, and only then reclaim confirmed Linux space in Windows Disk Management.

A Surface recovery image can erase the device. Read the selected recovery action and confirm the backup before proceeding. Preserve evidence until both systems have completed multiple cold boots and suspend/resume cycles.

Stop and escalate

Stop immediately when any of these is true:

The exact model, target disk, partition, or encryption owner is uncertain.
The BitLocker recovery key cannot be retrieved and matched from another device.
Backups have not passed a sample restore, or recovery media does not boot.
UEFI is organization-managed, a firmware password is unknown, or policy forbids changes.
The installer proposes erasing a disk, EFI/recovery partition, or more space than planned.
The official linux-surface page, repository origin, signature, or package transaction does not match the reviewed plan.
The stock kernel or Windows recovery path would be removed.
There is overheating, battery swelling, repeated I/O error, filesystem corruption, or unreliable input at encryption unlock.
A required camera, dGPU, detach, suspend, or external-display workflow fails its acceptance test.

Escalate with redacted model/firmware/package inventory and logs to Microsoft, Ubuntu, the linux-surface project, or the organization’s administrator according to the failed layer.

Primary sources reviewed

Historical source archive

The following inert text is the complete visible body from the 2019 source export. It is preserved byte-for-byte, including its leading newline, final newline, and six lines with trailing spaces. No text, URL, or whitespace was normalized or redacted. It is provenance, not current instructions; do not execute its commands or follow its links.


0, Install Xubuntu

1, Adjust the fonts and icons 

Settings->Apperance->Fonts->DPI->256

Panel

Window Manager

Desktop

2, Change the fonts of grub bootloader

Bootloader(/boot/default/grub)

3, Change the apt source list

/etc/apt/source.list(cn.ubuntu.com->mirrors.aliyun.com)

update && upgrade

4, Kernel

Use the jakeday’s kernel for surface. You can get more information from link below. 

[https://github.com/jakeday/linux-surface#instructions](https://github.com/jakeday/linux-surface#instructions)

5, 3rd party

Enable 3rd party installing. Reboot to UEFI (hold power and volume minus simultaneously and release power button once boot up) and navigate the *Boot* menu. In the security settings, choose Microsoft & 3rd party instead. 

6, Signing

For more information, please move to the link below. 

[https://github.com/jakeday/linux-surface/blob/master/SIGNING.md](https://github.com/jakeday/linux-surface/blob/master/SIGNING.md)

7, repair and beautify the boot menu

boot-repair

For customized theme and beautifying stuff, follow this link. 

[https://github.com/timobaehr/Surface-Boot-Themes/tree/surface_book](https://github.com/timobaehr/Surface-Boot-Themes/tree/surface_book)

8, Language Support and Input Method

fcitx

9, Additional drivers

Try to enable the GPU support. 

10, Synchronize settings with Windows

Horizontal scrolling and reverse scrolling direction

Add panel docker

11, Install ubuntu-desktop

 12, Install SS