[Bug 190131] New: VirtIO Windows Drivers doesn't support SecureBoot.

[Bug 190131] New: VirtIO Windows Drivers doesn't support SecureBoot.

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=190131

            Bug ID: 190131
           Summary: VirtIO Windows Drivers doesn't support SecureBoot.
           Product: Virtualization
           Version: unspecified
    Kernel Version: 4.4.0
          Hardware: x86-64
                OS: Linux
              Tree: Mainline
            Status: NEW
          Severity: normal
          Priority: P1
         Component: kvm
          Assignee: virtualization_kvm@kernel-bugs.osdl.org
          Reporter: okudayukiko0@yandex.com
        Regression: No

VirtIO Windows Drivers doesn't support SecureBoot(SecureBoot via OVMF).Windows
will prompt "Invalid Digital Signature" when install VirtIO Drivers(Such as
NetKVM,VirtIO SCSI drivers) in Windows.

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 190131] VirtIO Windows Drivers doesn't support SecureBoot.

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=190131

heri16@gmail.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |heri16@gmail.com

--- Comment #1 from heri16@gmail.com ---
Any updates on this? I am also seeing the error during boot if SecureBoot via
OVMF is enabled.

According to MS new driver signing policy, Windows 10 1607 and newer versions
require the drivers to be signed via their Dev Portal. Cross-signed drivers,
will not load when Secure Boot is enabled in the BIOS. Fedora's virtio drivers
are cross-signed and therefore were not being loaded.

https://docs.microsoft.com/en-us/windows-hardware/drivers/install/kernel-mode-code-signing-policy--windows-vista-and-later-

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 190131] VirtIO Windows Drivers doesn't support SecureBoot.

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=190131

vkuznets@redhat.com changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |vkuznets@redhat.com

--- Comment #2 from vkuznets@redhat.com ---
The drivers need to be WHQL or attestation signed to work with UEFI/Secure
Boot. If you're using upstream drivers available through e.g. fedoraproject.org
it definitely will not work. Please see
https://docs.fedoraproject.org/en-US/quick-docs/creating-windows-virtual-machines-using-virtio-drivers/index.html

-- 
You are receiving this mail because:
You are watching the assignee of the bug.

[Bug 190131] VirtIO Windows Drivers doesn't support SecureBoot.

[bugzilla-daemon]

https://bugzilla.kernel.org/show_bug.cgi?id=190131

--- Comment #3 from Vadim Rozenfeld (vrozenfe@redhat.com) ---
Please see the following RH bug for your reference 
https://bugzilla.redhat.com/show_bug.cgi?id=1844726

-- 
You are receiving this mail because:
You are watching the assignee of the bug.