3 ms·

Does the UEFI/Secure Boot/TPM requirement mean that I won't be able to boot Windows 11 in a VM?

• yjftsjthsd-h 5y ago
  VMs can certainly do UEFI, and I believe TPM emulations exist, so probably doable.
  • jasonjayr 5y ago
    IIRC Hyper-V has an additional mode that chains with the real hardware TPM (if I'm understanding the feature correctly), which would allow attestation through the vm to the physical hardware root of trust to work as well. (Please, if this is wrong, please gently correct me ...)
    • DiabloD3 5y ago
      This is called VBS. It requires: virtualization instructions enabled and working, legacy bios disabled (not merely just booted with UEFI; workstations that are qualified for this operation usually have the option entirely removed, but simply turning legacy boot off entirely is enough), UEFI on, trusted boot on with Microsoft's keys enrolled, TPM 2.0 on and functioning and the OEM has to physically qualify that no external DMA interfaces can be hacked (ex: my 1660 Super claims it has a USB-C port (due to type-C DP support), the card physically only has DP and HDMI, no type-C, so I have to set a registry key saying "this PCI-E device has been qualified to not be an external concern") (another ex: even with USB3 etc host chips that are qualified (ie, the IOMMU properly sandboxes them), VBS sets the option that disables connecting a USB etc device awhile device is locked; you can only plug in a device while unlocked and have it actually connect). VBS is for truly secure workstations, the kind that really truly try to defend themselves against all sorts of security issues, including physically there (in concert with Intel vPro deployed correctly for VBS, and AMD's equivalent that I'm blanking on the name for).