Windows Hardware Certification blog - All Comments

re: Windows Hardware Certification requirement changes effective January 1, 2014

Roger Techima — Fri, 14 Mar 2014 12:18:12 GMT

Sorry, forget to mention. I updated filters last week, but HCK Studio is not automatically applying 4568 in my Fidelity Test.

Best regards,

Roger.

re: Windows Hardware Certification requirement changes effective January 1, 2014

Roger Techima — Fri, 14 Mar 2014 12:15:43 GMT

Dear Andy_Wen, about Errata 4568, I can only apply it in README if I never started the Fildeity Test? Or can I use it after an log importation failure?

Thanks, Roger.

re: Fast-track Windows 8.1 certification

Mark Hughes — Thu, 13 Mar 2014 16:51:59 GMT

This procedure is still valid. The reason errata ID 2657 is not appearing on the DTM filter list is because its a manual errata. Manual errata that don't contain an actual filter so they don't get published on the DTM errata filter list.

re: Fast-track Windows 8.1 certification

Kumar87 — Mon, 10 Mar 2014 18:24:22 GMT

Hi,

I have a driver signed for Windows 8. Is this procedure still valid for getting the driver signed for Windows 8.1? I tried to find Errata 2657 on the DTM Filter page but could not find it. I was hoping this process is valid as of today.

Thanks!

re: Self-test submission model for touch device and precision touchpad certification

Tina — Mon, 10 Mar 2014 06:58:32 GMT

From msdn.microsoft.com/.../dn456917.aspx,

PT3 need to use 7mm diameter contacts; however, there is no mention of the same required for RA.

May I know does RA need to use 7mm diameter contacts, too?

Thanks.

Tina

re: Dashboard system submissions process simplified

Mark Hughes — Fri, 07 Mar 2014 17:43:16 GMT

We are investigating the test reports at this time with the intention to add all previous detail that was present on the previous test reports before this change took place. So the CPU and BIOS information will be incorporated back into the test reports in the near future.

re: HCK for Windows 8.1 and WLK 1.6 usage scenarios

Mark Hughes — Thu, 06 Mar 2014 18:56:53 GMT

If the driver was previously tested for 2003 and 2008 reference that submission ID in the README and check the 2003 and 2008 signature boxes. Its acceptable to update or change the driver that was previously tested and choose the free signature boxes for 2003 and 2008 as long as it was previously tested one time.

re: MUTT software package update available

GongXing Town — Thu, 06 Mar 2014 14:10:50 GMT

@Raven Mill It's OK, It says released "late last year".

re: HCK for Windows 8.1 and WLK 1.6 usage scenarios

Andrew Fox at RIM — Wed, 05 Mar 2014 20:56:25 GMT

I had WHQL'd v1.0 of a driver on all Windows OS's using the HCK 2.0 last year. This year I have v2.0 of the same driver and I'm running it again using HCK 2.1. Now I don't get 2K3 or 2K8 because of the policy change. Can I reference the submissions from last year for a previous version of the driver to get it passed on 2K3 and 2K8 OR do I have to run my driver v2.0 through HCK 2.0 for just 2K3 and 2K8? It's not clear to me how to handle multiple versions of the same driver. Thanks in advance for your response.

re: Dashboard system submissions process simplified

Mark Hughes — Tue, 04 Mar 2014 18:02:38 GMT

By design the BIOS version and processor detail are not being listed on the test reports. The information is present in full detail on the server catalog at this time for server related systems. The full detail may be added to test reports and the client catalogs in the future. The server catalog is presenting more rich information on the actual product detail at this time.

re: Self-test submission model for touch device and precision touchpad certification

Andy_Wen — Mon, 03 Mar 2014 23:40:34 GMT

Hello,

As long as the device can pass requirements, it'd be eligible for self-test submission.

Thanks,

Andy

re: Errata expiration guidelines

Ludi — Fri, 28 Feb 2014 22:34:00 GMT

For how long are Windows Hardware Certifications good for? And where can I find that info?

re: Dashboard system submissions process simplified

kukucz — Fri, 28 Feb 2014 00:57:36 GMT

I did submission 20 February 2014 and it was accepted 21 February 2014.

But in my logo verification report is only BIOS URL which was required to type manually.

I don't see any data about bios and processor information which should be downloaded from hckx file.

It seems that it is not working as it should.

sysdev.microsoft.com/.../LogoVerificationReport.aspx

re: Self-test submission model for touch device and precision touchpad certification

TY — Tue, 25 Feb 2014 07:37:00 GMT

Hi,

I wonder if there is any criteria for proceeding self-test submission or full-test submission?

Thanks.

TY.

re: MUTT software package update available

Raven Mill — Mon, 24 Feb 2014 03:42:25 GMT

I use it update a super mutt, the display of hardwareID is "REV_0040", but we already use FW0040 for some time.please share more detail about this version, thanks!

re: Changes to “System - Sleep and PNP (disable and enable) with IO Before and After (Certification)” test in February HCK QFE

HC Huang — Fri, 21 Feb 2014 06:19:59 GMT

Hi Sir,

I filed a bug on dashboard about this test.

Could you help to take a look at the failure's hckx file?

Bug ID is 605896.

Thank you in advance.

re: Changes to “System - Sleep and PNP (disable and enable) with IO Before and After (Certification)” test in February HCK QFE

KAENNGAI CHAN — Tue, 18 Feb 2014 19:59:15 GMT

with IO Before and After test: You no longer need to configure all devices on the system before the test can run. - We also released...

i like how Microsoft use the words and i know i will fail on test without test, let people have more talents have more chance for test

re: Hardware certification submission fees update

Lyndon Bethel - MSFT HCK Support — Tue, 18 Feb 2014 19:14:49 GMT

I don't understand something related to your comments Don. I have always been able to access the certification filters without a Sysdev account for a short time these were on connect which required a connect loigin that was available to anyone but now they appear freely available: msdn.microsoft.com/.../hh998024.aspx

-Lyndon

re: Changes to “System - Sleep and PNP (disable and enable) with IO Before and After (Certification)” test in February HCK QFE

paul_Reed55 — Tue, 18 Feb 2014 16:50:54 GMT

Hi Mike Lu,

When the requirement relaxations were finalized, we were approaching the holiday season in December and many teams were leaving for extended holiday. Then when they returned there was a really tight deadline to make the February HCK QFE release. Not all teams were able to do so. However, we have published errata filters that will turn all failures into pass. So if you do not wish to test for the quality bar, you can run the test and it will fail. The errata will convert it to a pass.

re: Changes to “System - Sleep and PNP (disable and enable) with IO Before and After (Certification)” test in February HCK QFE

Summer Nie — Mon, 17 Feb 2014 07:11:26 GMT

Hi, Mark:

Is Mutt device supposed to be plugged in during "device status check"?

As we are running QFE006, and it still failed on Super MUTT during device status check phase, so the main test will not process at all.

Per the description, does it mean we could unplug the Super Mutt device from system once device status check was passing?

Thank you!

re: HCK for Windows 8.1 and WLK 1.6 usage scenarios

Mark Hughes — Fri, 14 Feb 2014 19:08:21 GMT

Run testing on HCK 2.1 on the following OS's Server 2008 R2, Server 2012, Server 2012 R2, Win 7, Win 8, and Win 8.1. If you’re using a uniform driver that supports the lower level OS’s check boxes will appear to add digital signatures for the following OS’s if using a unified driver XP, Vista, Server 2003 and Server 2008.

Per policy if you select the Server 2003 and Server 2008 digital signatures you need to provide a README file that references where Server 2003 and Server 2008 were previously tested using either WLK 1.6 or HCK 2.0. If not previously tested you need to use WLK 1.6 and run testing on Server 2003 and Server 2008 so you can provide submissions ID’s for those OS’s in the README file.

For XP and Vista it’s not required to provide a README that verifies the product was previously tested for those OS. You can select the XP and Vista digital signatures without further testing.

re: Microsoft UEFI CA Signing policy updates

Dee — Fri, 14 Feb 2014 03:43:22 GMT

Thanks CT - on the EV in SHIM; We currently provide our own (public) certificate inside shim which was generated via openssl (along of course with the private key). We sign our binaries (from what shim loads all the way to the kernel/main binary) with the private key (which we keep protected). In that case EV certificates don't mean anything, we are 100% sure of who we are and since we will be signing shim (which has our private embedded certificate) with our verisign EV certificate matching the one in sysdev, you're sure that the signed shim we provide is from us and the certificate within it is also under our trust. If someone modified our shim, secure boot wouldn't load it. or am I missing something?

re: Microsoft UEFI CA Signing policy updates

Certification team — Fri, 14 Feb 2014 01:14:47 GMT

Hi Ed,

The Developer Portal is working towards supporting EV certificates from both DigiCert and VeriSign, and we will bring this capability online soon. In the interim, if you are planning to sign up and submit, you can continue to use VeriSign’s Non-EV Code Signing certificate as stated in the sign up workflow, though we would recommend you use VeriSign’s EV certificate to be forward compatible with future requirements (See answer to Dee’s question on EV certificates). If you use a VeriSign’s EV certificate then you don’t need VeriSign’s $99 certificate for sign up.

re: Microsoft UEFI CA Signing policy updates

Certification team — Fri, 14 Feb 2014 01:13:36 GMT

Hi Dee,

(about loading unsigned kernel)

As mentioned in 5.b above, it is strongly recommended to load only signed kernel modules to avoid security vulnerabilities which may result in possible future revocation (if and when exploits are found compromising SecureBoot). This latest article in ITWire(www.itwire.com/.../63120-microsoft-changes-policy-on-third-party-signing-of-efi-code) might help with deeper understanding of the security need of this, and the adoption of these practices by other operating system vendors, such as Fedora.

(about EV in SHIMs)

The rationale for requiring EV inside SHIM is to get a better guarantee of key management and trustworthiness. Signing SHIM is equivalent to cross signing a CA to trust other non-UEFI CA signed modules. Hence the higher security bar for SHIM. We, of course, appreciate this feedback and we will continue discussing with various partners on the impact this change may have on their build infrastructure.

re: Microsoft UEFI CA Signing policy updates

Dee — Thu, 13 Feb 2014 18:32:52 GMT

Still questioning the EV requirement within the shim (6a) - the more I think about, the less sense it makes. If we put our own private strong certificate built using openssl (we know who we are) within the SHIM to verify all our loading of binaries, that is just as strong as using an EV certificate. There is no advantage to having to use an EV certificate within the shim to verify our binaries. Now for submitting to MS, an EV certificate is fine. Once signed, that shim can't be altered with another certificate (only our private certificate can be in there or it would have never been loaded by the UEFI secure boot code).