Re: [OvmfPkg] Secure Boot issues

[Philipp Deppenwiese <zaolin.daisuki@gmail.com>]

Hey Laszlo,

We are using VirtualBox as virtualization solution and
don't load guest drivers. But we had the same issue with
the current Qemu version as well.

Can you try to test your setup with the latest Windows 10 LTSB ?
That would help us to understand if that's a general EDK2
issue or just our problem.


Best Regards, Philipp

On 12.06.2018 20:14, Laszlo Ersek wrote:
> On 06/12/18 16:51, Philipp Deppenwiese wrote:
>
>> Also Windows 10 in safe mode with secure boot works but not the
>> normal mode.
>>
>> We use the
>> 14393.0.160715-1616.RS1_RELEASE_CLIENTENTERPRISE_S_EVAL_X64 LTSB
>> release for testing.
> Interesting, this reminds me of the "new" driver signing requirements
> when Secure Boot is enabled. Something something about cross-signed
> drivers not being accepted by recent Windows 10 when SB is enabled.
>
> I could imagine that some of your native guest drivers (paravirt /
> virtio drivers) aren't "appropriately signed" (whatever that may mean),
> and then something crashes when windows *rejects* loading those drivers.
>
> In safe mode, I could imagine Windows doesn't even attempt to load those
> drivers.
>
> Really I'm just speculating here. In support of the speculation:
>
> https://docs.fedoraproject.org/quick-docs/en-US/creating-windows-virtual-machines-using-virtio-drivers.html
>
> """
> Fedora VirtIO Drivers vs. RHEL VirtIO Drivers
>
> The RPMs in the virtio-win-stable repository are the same driver builds
> as what is shipped with Red Hat Enterprise Linux. All the Windows
> binaries are from builds done on Red Hat’s internal build system, which
> are generated using publicly available code. For more details about how
> the RPM and repo are built, see the README for this repo.
>
> The drivers are cryptographically signed with Red Hat’s vendor
> signature. However they are not signed with Microsoft’s WHQL signature.
> """
>
> In addition, please see
> <https://bugzilla.redhat.com/show_bug.cgi?id=1376048#c0>.
>
> Thanks
> Laszlo