Driver Signing Practical Info

Hey Jeff,

Yes, I thought the info about server requiring passing the WHQL tests was the biggest news in that interview, actually.

You sure you have to logo as a Windows audio device? Given your products aren’t “normal” consumer audio stuff, can you fit in another category? I bet you can work this issue… No way they intend to make it impossible for professional audio to be connected to Windows. That’s just my feeling… I don’t have any special knowledge in this regard…

Peter
OSR
@OSRDrivers

Thanks Peter. I’ve just emailed sysdev at Microsoft with that very question,
and will pass on their response.

Jeff

Having worked on a a number of bleeding edge server technologies over the years, which initially didn’t have any matching WHQL category to get certified under (Infinband RDMA and FCOE come to mind), not being able to even load a driver unless it passes WHQL certification seems like a way to assure Windows will get left behind by vendors of interesting new technology.

Jan

On 7/26/15, 6:39 PM, “xxxxx@lists.osr.com on behalf of xxxxx@osr.com” wrote:

>Yes, I thought the info about server requiring passing the WHQL tests was the biggest news in that interview, actually.
>

Please DO pass on what they say.

Plus, do your own investigation. Read the WHQL requirement carefully and interpret them truthfully, but in the best possible way for your product. Remember: YOU run the tests and send-in the results. I’m not saying to lie. But it’s like the tax laws. There’s absolutely nothing wrong with working the rules to the best of your advantage.

One thing people at smaller vendors typically fail to take into account is that what gets signed is ultimately a matter for negotiation. I’ll tell you a story: There is a very large vendor (who shall remain nameless) who had a driver that violated an extremely fundamental policy rule for its category of device. They knew it and Microsoft new it, and the violation was absolutely intentional by design (I know all this to be fact, it’s not speculation). Microsoft WHQL’ed that driver for YEARS… like ten years… as a result of negotiation. The result was not bad for the community in any way, not bad for interoperability, not bad for Windows, not bad for the vendor, not bad for for Microsoft. So it was a win-win for everyone involved. But OTHER people? THEY had to follow the rules. Unless they made their OWN deal.

The WHQL process has a built-in waiver system for precisely this reason. Smaller vendors need to work this system. It’s a PITA, and can require a lot of person-to-person dickering… but there’s always a path forward.

I’m not in favor of what they’re doing for server, not in any way. But don’t forget that there’s always “unclassified”… which is a pretty reasonable set of tests (if any of these tests can be termed “reasonable”).

What scares me is that the WHQL tests (arrrgh… we’re supposed to say the “Windows Lab Kit” Compatibility Tests now, aren’t we…) are a mixture of basic correctness tests and policy-based tests. Some of the policy-based tests are more of a “we think this is best practice for device” type of thing, and preventing drivers loading based on their hardware’s lack of adherence to what one vendor considers “best practice” seems to be… well… awfully extreme.

For example, PCIe devices for server *must* support AER, though it is optional in the Express spec and several of the available FPGA cores don’t support it. Sure, supporting AER is good. But refusing to load drivers for devices that don’t support AER seems to me to be a really bad policy. How about all those devices that were built before AER was required?

Peter
OSR
@OSRDrivers

“there’s always unclassified”

It would be interesting to know if Microsoft would accept a device tested
under “unclassified” for a signature valid on server.

I mainly work on PCIExpress devices, targeted at the ISM market, for which
there are no appropriate device specific Microsoft tests: it’s far too
specialist.

Best regards

Chris Read

> I have some practical questions about the Windows 10 driver signing thing, for those of

you who have already been through it.

Well, I don’t care about driver signing, for the understandable reasons, but what makes me worried is SecureBoot in Windows10

http://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/

Does someone have any AUTHORITATIVE information on whether a switch to allow Secure Boot to be turned off is still mandatory under Windows10

Anton Bassov

Why should Microsoft hardware requirements mandate that the switch must exist? Their interest is to require secure boot exist not that it not exist.

Want to run Linux on your shiny new Dell server? I bet that will be very much supported by Dell because they will have the option in the firmware.

Want to do the same on a SurfacePro? Well geez, really?

FUD

cheers
Dave Cattley

Sent from my Windows Phone


From: xxxxx@hotmail.commailto:xxxxx
Sent: ‎7/‎27/‎2015 9:57 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Driver Signing Practical Info

> I have some practical questions about the Windows 10 driver signing thing, for those of
> you who have already been through it.

Well, I don’t care about driver signing, for the understandable reasons, but what makes me worried is SecureBoot in Windows10

http://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/

Does someone have any AUTHORITATIVE information on whether a switch to allow Secure Boot to be turned off is still mandatory under Windows10

Anton Bassov


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

> Why should Microsoft hardware requirements mandate that the switch must exist?

Their interest is to require secure boot exist not that it not exist.

Whatever their interest may be like, under Windows8 this switch is mandatory. The question is whether it is going to change in Windows10…

Want to run Linux on your shiny new Dell server? I bet that will be very much supported
by Dell because they will have the option in the firmware. Want to do the same on
a SurfacePro? Well geez, really?

My main concern as all about the medium-and-higher-end laptops(Asus,Acer,Sony,DEll,HP, etc).

Anton Bassov

I’ll have to respectfully disagree, Dave. Since Microsoft is creating the requirement for virtually all PC hardware to include UEFI (and its successors), they should also mandate the OWNER of the hardware be allowed to turn it off in order to run other OS software (or even run bare metal as is the case in embedded systems).

I’m not one to give into conspiracy theories, but in this case it sure appears to be an attempt to force migration to Windows 10 and total lock-in to MS after that.

Look at it this way:

  1. A hardware vendor will not be able to effectively sell PCs without that MS Logo just by sheer market size enjoyed by MS. You can’t lock out 80%-90% of all hardware sales by not getting that Windows Logo. Therefore, ALL hardware will include this feature.

  2. Once older hardware is no longer available that will run Windows 7 (or accept Linux or…), people and companies will be forced to “upgrade” to Windows 1 or later.

  3. Reports I’ve read (could be wrong) have indicated Windows Updates will no longer be a nuisance to avoid, but will be REQUIRED for all but the largest of customers. Again, MS is forcing people into migrating to the newest OS. It’s a good plan for MS as they can drop costly support for older OS versions much quicker.

I think this could run afoul of regulators in several countries, just as the original UEFI did before the options to disable it.

The Surface Pro isn’t a good example in that it fits under the Mobile category, not general PC. Mobile (non-PC) devices have always been vendor-locked. That trend is changing somewhat with the popularity of Android-based phones, availability of the entire source code and even vendor-supplied image modification instructions from some of the largest vendors.

Please, this is NOT a flame-bait. I consult on both Windows Embedded and Android (embedded Linux) and find pros and cons in both. Neither is superior to the other for all things. It depends upon your needs. In the case of mandatory secure boot, MS wins, users lose.

Greg

xxxxx@msn.com wrote:

From: Dave Cattley
To: “Windows System Software Devs Interest List”
Subject: RE: [ntdev] Driver Signing Practical Info
Date: Mon, 27 Jul 2015 10:15:42 -0400

Why should Microsoft hardware requirements mandate that the switch must exist? Their interest is to require secure boot exist not that it not exist.

Want to run Linux on your shiny new Dell server? I bet that will be very much supported by Dell because they will have the option in the firmware.

Want to do the same on a SurfacePro? Well geez, really?

FUD

cheers
Dave Cattley

Sent from my Windows Phone
________________________________
From: xxxxx@hotmail.commailto:xxxxx
Sent: ‎7/‎27/‎2015 9:57 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Driver Signing Practical Info

> I have some practical questions about the Windows 10 driver signing thing, for those of
> you who have already been through it.

Well, I don’t care about driver signing, for the understandable reasons, but what makes me worried is SecureBoot in Windows10

http://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/

Does someone have any AUTHORITATIVE information on whether a switch to allow Secure Boot to be turned off is still mandatory under Windows10

Anton Bassov


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

On the UEFI, I think most of the vendors will want to support Windows 7 for a while, just because of the established base is so large. IT shops are pretty conservative in many cases, and Windows 7 is likely to be around for a long time. On the Windows Updates, there is a way to block them see the article http://www.zdnet.com/article/microsoft-releases-tool-to-hide-or-block-unwanted-windows-10-updates/

Don Burn
Windows Driver Consulting
Website: http://www.windrvr.com

-----Original Message-----
From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of Gregory G Dyess
Sent: Monday, July 27, 2015 10:46 AM
To: Windows System Software Devs Interest List
Cc: xxxxx@lists.osr.com
Subject: RE: [ntdev] Driver Signing Practical Info

I’ll have to respectfully disagree, Dave. Since Microsoft is creating the requirement for virtually all PC hardware to include UEFI (and its successors), they should also mandate the OWNER of the hardware be allowed to turn it off in order to run other OS software (or even run bare metal as is the case in embedded systems).

I’m not one to give into conspiracy theories, but in this case it sure appears to be an attempt to force migration to Windows 10 and total lock-in to MS after that.

Look at it this way:

  1. A hardware vendor will not be able to effectively sell PCs without that MS Logo just by sheer market size enjoyed by MS. You can’t lock out 80%-90% of all hardware sales by not getting that Windows Logo. Therefore, ALL hardware will include this feature.

  2. Once older hardware is no longer available that will run Windows 7 (or accept Linux or…), people and companies will be forced to “upgrade” to Windows 1 or later.

  3. Reports I’ve read (could be wrong) have indicated Windows Updates will no longer be a nuisance to avoid, but will be REQUIRED for all but the largest of customers. Again, MS is forcing people into migrating to the newest OS. It’s a good plan for MS as they can drop costly support for older OS versions much quicker.

I think this could run afoul of regulators in several countries, just as the original UEFI did before the options to disable it.

The Surface Pro isn’t a good example in that it fits under the Mobile category, not general PC. Mobile (non-PC) devices have always been vendor-locked. That trend is changing somewhat with the popularity of Android-based phones, availability of the entire source code and even vendor-supplied image modification instructions from some of the largest vendors.

Please, this is NOT a flame-bait. I consult on both Windows Embedded and Android (embedded Linux) and find pros and cons in both. Neither is superior to the other for all things. It depends upon your needs. In the case of mandatory secure boot, MS wins, users lose.

Greg

xxxxx@msn.com wrote:

From: Dave Cattley
To: “Windows System Software Devs Interest List”
Subject: RE: [ntdev] Driver Signing Practical Info
Date: Mon, 27 Jul 2015 10:15:42 -0400

Why should Microsoft hardware requirements mandate that the switch must exist? Their interest is to require secure boot exist not that it not exist.

Want to run Linux on your shiny new Dell server? I bet that will be very much supported by Dell because they will have the option in the firmware.

Want to do the same on a SurfacePro? Well geez, really?

FUD

cheers
Dave Cattley

Sent from my Windows Phone
________________________________
From: xxxxx@hotmail.commailto:xxxxx
Sent: ‎7/‎27/‎2015 9:57 AM
To: Windows System Software Devs Interest Listmailto:xxxxx
Subject: RE:[ntdev] Driver Signing Practical Info

> I have some practical questions about the Windows 10 driver signing thing, for those of
> you who have already been through it.

Well, I don’t care about driver signing, for the understandable reasons, but what makes me worried is SecureBoot in Windows10

http://arstechnica.com/information-technology/2015/03/windows-10-to-make-the-secure-boot-alt-os-lock-out-a-reality/

Does someone have any AUTHORITATIVE information on whether a switch to allow Secure Boot to be turned off is still mandatory under Windows10

Anton Bassov


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer</mailto:xxxxx></mailto:xxxxx>

They always have in the past… I can’t imagine they wouldn’t.

There’s just no possible way for them to create categories for every potential device you would want in a server.

For example: I worked on a very cool hardware solution for *very closely* synchronizing time among multiple servers. That’s the type of device that’s very obviously unclassifiable.

Peter
OSR
@OSRDrivers

When I read “Does anybody have authoritative information about…” and the information being requested is public, I often wonder why the person asking doesn’t just go and read the Windows Requirements, since they’re curious, and post the answer here for the benefit of the community. GIYF.

For Windows 10 Mobile and Desktop, support for UEFI Secure Boot is *required* for Win10 ?Logo?

In terms of the ability to disable Secure Boot:

https:



Just look it up, people. It’s not a mystery. And everyone else is just as busy as you are.

Peter
OSR
@OSRDrivers</https:>

> A hardware vendor will not be able to effectively sell PCs without that MS Logo just by

sheer market size enjoyed by MS. You can’t lock out 80%-90% of all hardware sales by
not getting that Windows Logo.

Actually, the last time I checked laptops in the store was something around a year ago or so.
What amazed me was noticing that virtually NONE of the laptops on display had Windows logo - the only thing that I saw was a store-provided poster saying “Windows8 included”, but no Windows logos, no “Designed for Windows” posters/stickers,etc. To make it even more interersting, some machines were nothing more than just pieces of bare hardware with no OS pre-installed. The whole thing was reminiscent of early 2000s and looked totally different from the way it had looked just 3-4 years before (i.e 2010-2011) when evey laptop on display was proudly displaying (no pun intended) "Windows 7 " logo on it.

I just wonder if the whole thing may be somehow related to Secure Boot and UEFI…

Anton Bassov

Simply because the article that I had referred to was, in turn, referring EXACTLY to the docs that you quote, and saying that this info was not yet a final one and a subject to change…

Anton Bassov

Sloppy thinking resulting in sloppy journalism. Everything is subject to change. It’s called entropy.

Sigh.

The reason OEMs insist on the “logo” (or whatever it’s called now) isn’t because people want it (for the most part… some corporate customers DO in fact require the logo as a simple measure of “goodness”). It’s because if the OEM sells a Logo’ed system, they get a discount on the OS license from MSFT.

It’s all economics.

Peter
OSR
@OSRDrivers



> Everything is subject to change.

Really? Even “interface contracts” like “supported” API?

> It’s called entropy.

Actually, the term “entropy” happens to refer to the degree of disorder in a system. I guess you should check https://en.wikipedia.org/wiki/Entropy (feel free to dismiss it as a piece of “sloppy journalism”) before using the terminology that you don’t really seem to understand…

It’s because if the OEM sells a Logo’ed system, they get a discount on the OS
license from MSFT.

…which amounts to unfair market practice, abuse of dominant position,etc…

Anton Bassov

Oh, citing Wikipedia! You ARE a scholar.

Actually, you should check your attitude, your English usage, and your definitions, before you mouth off to the list owner.

As usual, you’ve missed the point of my (rather clever, I though) post… and concentrated on the trees instead of the forest.

The term entropy is most often used in English as shorthand for the process of “all things” eventually trending toward degradation or disorder. It comes from the measure of *unavailable* energy in a thermodynamic system. The unavailable energy in the system is considered to be a measure of that system’s lack of “order.”

Hence, “everything is subject to change” because in the end, everything in the world tends to disorder. Breathing increases entropy, after all.

So, you know, I think I’m good without Wikipedia.

I advise you to take the rest of the day off from posting here.

Peter
OSR
@OSRDrivers

On 7/27/2015 10:15 AM, Dave Cattley wrote:

Why should Microsoft hardware requirements mandate that the switch
must exist? Their interest is to require secure boot exist not that it
not exist.

Want to run Linux on your shiny new Dell server? I bet that will be
very much supported by Dell because they will have the option in the
firmware.

Want to do the same on a SurfacePro? Well geez, really?

FUD

cheers
Dave Cattley
Microsoft introduced the whole concept. If we are only talking purely
about interest, their *interest* is that nothing but Windows can run,
however they can get to that end.

Want to do the same on a Surface Pro? It’s a laptop. Why *not*? The only
honest argument I can think of is lock-in.

James

> Oh, citing Wikipedia! You ARE a scholar.

Actually, I am just a "regular bloke"who was brought up to believe that trying to sound unnecessarily “clever” and “educated” by using scientific terminology may be indicator of anything but “high intelligence” that the person in question purports to show. In fact, in most cases it shows exactly the opposite. However, if one is just desperate to use scientific terminilogy they should at least make sure that they use it properly in order to avoid making complete fools of themselves. The funniest thing is that, in actuality, they rarely use this “clever” terminology properly.

As an example, few years ago someone whose name rhymes with “Jim Floberts” was speaking about “six sigma average” in this NG, referring to 99% of cases. Sigma is a statistical term that is used for standard deviation. For example, a value may differ from the sample average (mean) by more than 3 deviations, effectively falling outside of six-sigma range, i.e. 3 deviations in each direction that covers more than 99% of the cases. However, the phrase “six sigma average” in itself is nothing more than just a meaningless word salad,albeit a “clever-sounding” one. Your use of the term “entropy” in this context falls in the same class as “six sigma average”. More on it below.

Actually, you should check your attitude, your English usage, and your definitions,

OK, let me do it

http://www.merriam-webster.com/dictionary/entropy

The term entropy is most often used in English as shorthand for the process
of “all things” eventually trending toward degradation or disorder.

The above quotation strongly suggests that this term simply does not and cannot have ANY usage in a “regular” English language - this is a scientific term that originates in thermodynamics and is simply unfamiliar to an “average Joe”. In fact, even some textbooks admit that "entropy"happens to be not the easiest term to explain. This is why I referred you to Wikipedia that generally defines this term as a “degree of disorder”. It may have different meanings in different contexts, depending on what the term “disorder” means in a given context. For example, due to the nature of our occupation, we are most likely to encounter this term in context of information theory, which defines it as a measure of unpredictability of information content, so that it may be used as an expected value (average) of the information contained in each message received (i.e Shannon entropy).

However, the way you used it here is reminiscent of “six sigma average” …

before you mouth off to the list owner.

I don’'t “mouth off to the list owner.” - I just politely pointed out to the list owner that unnecessary
(and wrong) use of scientific terminology makes him sound in a way that happens to be exactly the opposite of the one he purports to sound…

Anton Bassov

Mr. Bellinger & Mr. Dyess I appreciate your perspectives.

My point was really to just note that by removing a requirement (or relaxing one) MSFT was just simply enabling more ‘freedom’ in the market.

Had they mandated that the Secure Boot Disable option be removed, that would have been a whole different thing.

Instead they just said (or propose to say) it is ‘optional’ (except for mobile platforms).

This seems to me to be completely consistent with the downgrade rights available for Windows licensing.

And to our gracious host’s observation that MSFT discounts OEM licensing to manufacturers that get the logo, well, hey, that is business. (I don’t know that this is true but it seems reasonable and likely and PGV is not likely to be wrong on this point). Again my reaction is “so what”?

I want to acknowledge Mr. Bassov’s restrained reply by saying that I think we can reasonably expect high-end laptop manufacturers to do precisely nothing that they are not compelled to do. And given that they are shipping firmware that permits disabling secure boot they will more than likely continue to do so until the conspiracy theorists are proven correct and MSFT mandates that secure boot is required on all platforms.

What I find interesting is the hoopla. This is a relaxation of restriction. The OEM is ‘free’ to choose what type of market then pursue and the customer is ‘free’ to choose what sort of OEM platform they will source for their application.

I can definitely imagine a market for PC endpoints that does not permit relaxation of the secure boot requirement and now that market is enabled and OEMs are free to service it with logo compliant systems.

And I can of course see that there still exists a [healthy] market for systems that permit the choice and I expect OEMs to continue to service that market.

Let the market do what it does. Sort out what matters. Over time.

Cheers all,

Dave Cattley

From: xxxxx@lists.osr.com [mailto:xxxxx@lists.osr.com] On Behalf Of James Bellinger
Sent: Monday, July 27, 2015 10:00 PM
To: Windows System Software Devs Interest List
Subject: Re: [ntdev] Driver Signing Practical Info

On 7/27/2015 10:15 AM, Dave Cattley wrote:

Why should Microsoft hardware requirements mandate that the switch must exist? Their interest is to require secure boot exist not that it not exist.

Want to run Linux on your shiny new Dell server? I bet that will be very much supported by Dell because they will have the option in the firmware.

Want to do the same on a SurfacePro? Well geez, really?

FUD

cheers
Dave Cattley

Microsoft introduced the whole concept. If we are only talking purely about interest, their interest is that nothing but Windows can run, however they can get to that end.

Want to do the same on a Surface Pro? It’s a laptop. Why not? The only honest argument I can think of is lock-in.

James


NTDEV is sponsored by OSR

Visit the list at: http://www.osronline.com/showlists.cfm?list=ntdev

OSR is HIRING!! See http://www.osr.com/careers

For our schedule of WDF, WDM, debugging and other seminars visit:
http://www.osr.com/seminars

To unsubscribe, visit the List Server section of OSR Online at http://www.osronline.com/page.cfm?name=ListServer