Asahi Linux progress report [LWN.net]

Asahi Linux progress report

Posted Mar 12, 2021 16:07 UTC (Fri) by ledow (guest, #11753)
In reply to: Asahi Linux progress report by mss
Parent article: Asahi Linux progress report

Windows Server requires TPM and Secure Boot.

It won't be long before that's rolled down to consumer versions.

to post comments

Asahi Linux progress report

Posted Mar 12, 2021 17:02 UTC (Fri) by mss (subscriber, #138799) [Link] (4 responses)

> Windows Server requires TPM and Secure Boot.

Which specific Windows Server versions require them to run?

Microsoft has sait it will require TPM and Secure Boot for the *hardware to be certified* for the next (not yet retail) version of Windows Server (2022), but there hasn't been any announcement that it will require these features to actually run.

And Windows Server 2019 certainly doesn't require either.

> It won't be long before that's rolled down to consumer versions.

Most consumer "enthusiast" motherboards offered today lack TPM chip, some (many?) don't even have the necessary LPC bus connector.

Asahi Linux progress report

Posted Mar 13, 2021 5:56 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link] (3 responses)

> Which specific Windows Server versions require them to run?
It's a new requirement that will be enforced starting next month for new installations of WS. It can be overridden if necessary.

Asahi Linux progress report

Posted Mar 13, 2021 13:04 UTC (Sat) by mss (subscriber, #138799) [Link] (2 responses)

> > Which specific Windows Server versions require them to run?
> It's a new requirement that will be enforced starting next month for new installations of WS. It can be overridden if necessary.

Which specific Windows Server versions you have on mind?

Do you have any link to Microsoft annunciation of the policy change next month?

Asahi Linux progress report

Posted Mar 13, 2021 14:48 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link] (1 responses)

I think all of them. https://cloudblogs.microsoft.com/windowsserver/2020/06/11... - there is now a requirement for new Windows Server hardware to include TPMs and they are automatically used by the installer.

You can disable the TPM after the installation.

Asahi Linux progress report

Posted Mar 13, 2021 15:15 UTC (Sat) by mss (subscriber, #138799) [Link]

> there is now a requirement for new Windows Server hardware to include TPMs and they are automatically used by the installer.

They are required for new Windows Server *certified* hardware, that is, for hardware to be specifically blessed by Microsoft.

As I have said in the comment above:
> Microsoft has sai[d] it will require TPM and Secure Boot for the *hardware to be certified* for the next (not yet retail) version of Windows Server (2022),
> but there hasn't been any announcement that it will require these features to actually run.

Nothing in the article you mentioned says that Windows Server will run only on hardware certified by Microsoft.

That is, you can run Windows on hardware that lacks these features.
Just the hardware will not get "blessed by Microsoft" badge.

Asahi Linux progress report

Posted Mar 13, 2021 5:55 UTC (Sat) by Cyberax (✭ supporter ✭, #52523) [Link] (2 responses)

Microsoft has a very serious stake in keeping Windows Server secure, so a TPM requirement is a good idea and it costs pretty much nothing for the server-class hardware.

It simply won't work for foreseeable future on commodity hardware, because TPM chips are not standard and are not present on a lot of hardware. My brand-new gaming PC doesn't have one, for example.

Asahi Linux progress report

Posted Mar 15, 2021 0:28 UTC (Mon) by zlynx (guest, #2285) [Link] (1 responses)

Pretty much any CPU made in the last three years supports "fTPM" which is implemented via the secure compute element in the CPU itself. That goes for Intel and AMD Ryzen.

Asahi Linux progress report

Posted Mar 15, 2021 1:21 UTC (Mon) by mjg59 (subscriber, #23239) [Link]

Not quite - the Intel implementation runs on the ME, which is on the chipset for non-SoC devices. AMD's implementation is on the PSP, which *is* on the CPU package. But yes, assuming the system vendor has wired it up, you don't need a physical TPM for TPM functionality these days. In some ways, it's even preferable - the LPC bus that discrete TPMs are attached to is extremely easy to interpose, which is far less true for fTPMs.