TPM 2.0 support and Windows 11 (intel)

Looks like AsRock update the 'Description' for version 21.01 to show it include the keys!

1. Optimized system compatibility. 2. Enhance platform security with Control IOMMU Pre-boot Behavior, VT-d, and the IOMMU option. 3. Update Secure Boot Key (2023 KEK/DB/PK).

No problem :) Thank You for quick answer - have to switch my PC to new one, but not now (DDR5 prices :( ).

Hello!
I have z170 extreme4. Is this mobo support security boot and TMP 2.0?

I didn't achieve anything meaningful. I tried everything I could find on the internet.
I even took it to a repair shop - they couldn't fix it either.
I tried the last-resort method: reprogramming the BIOS chip with a hardware programmer - no success.

The solution:
I threw away a fully working PC and basically sold my kidney to buy a new PC.

Good luck to anyone still trying. If you find another solution, please share it.....

Hello!

Apologies for the late reply, but thank you for the follow-up questions. They are very important and address the key details.

stormryder wrote: Sorry that my reply is not to help--because I can't, unfortunately--but to ask you follow up questions. From the reading that you've done, do you understand how/why this works? It's confusing to me why this is even possible, as I commented in my earlier posts in this thread. Resources I've found state that TPM 2.0 is not backwards compatible with 1.2 Wikipedia bluntly states this: https://en.wikipedia.org/wiki/Trusted_Platform_Module Of course, Wikipedia is just written by volunteers and could be wrong. I'm not technical enough to read and understand that giant document from the Trusted Computing Group that the wikipedia page cited for this claim. Google's AI summary says this: a hardware chip designed for TPM 1.2 cannot be upgraded to TPM 2.0 through a BIOS update alone, as it is a hardware-dependent feature. However, if your motherboard supports a firmware-based TPM (fTPM) and a TPM header for a module, you may be able to update the BIOS to activate or enable TPM 2.0

1. Regarding the External TPM 2.0 Module and the TPM Header
You are correct: TPM 2.0 is not backward compatible with TPM 1.2. We are not trying to upgrade an old 1.2 chip, but rather to install a new TPM 2.0 module into the motherboard's TPM Header.

Hardware Compatibility (The Port): According to the ASRock Fatal1ty Z97X Killer Manual (page 32), our motherboard has a 17-pin TPM Header (connector 18). This port is physically compatible with the corresponding TPM modules.
The manual I used: https://download.asrock.com/Manual/Fatal1ty%20Z97X%20Killer.pdf

Software Problem (The BIOS): The issue is that the stock BIOS on the Z97X Killer lacks the necessary code to recognize, initialize, and pass control of this modern TPM 2.0 module to the operating system (Windows 11).

This is why we are looking for a Custom or Beta BIOS. The goal of these modifications is to add the missing code to the BIOS (often through corrections in the ACPI/DSDT tables) to enable communication and activation of the external TPM 2.0 module.

stormryder wrote: Is the Z97X motherboard such a board? A person on another forum states that only on Intel 100-based chipset and above do you get fTPM built in: https://forum-en.msi.com/index.php?threads/tpm-1-2-to-tpm-2-0.408085/ Are you able to shed more clarity on these hairy details?

2. Regarding fTPM (Firmware-based TPM) and the Z97 Chipset
This is where the limitations of the Z97 chipset (H97, Z87, H87, etc.) come into play.

Definition: fTPM (Firmware/Platform Trust Technology, PTT on Intel) is a function that allows the processor?™s firmware to execute TPM functions. On Intel, this is built into the CPUs and activated via the BIOS.

Z97 Limitation: You are right fTPM/PTT (TPM 2.0), as we know it for Windows 11, only became widely available and standard with the Intel 100-series chipsets (Skylake) and newer. Our Z97 platform (Haswell/Devil's Canyon) precedes this.

Z97 Conclusion: This means that on our ASRock Z97X Killer, we cannot enable TPM 2.0 with a BIOS update alone because this functionality is not built into our processors (Haswell).

Therefore, our only path to TPM 2.0 is through an external hardware module (dTPM), plugged into the dedicated TPM Header, which I mentioned in point 1.


3. Why it Works on Other Z97 Boards (and why our search is justified)
The fact that other manufacturers, or even ASRock for other Z97 models, have provided BIOS versions with support for external TPM 2.0 modules is the key argument.

The Principle: Hardware-wise, an external TPM 2.0 module does not depend on the chipset (Z97), but on the BIOS's ability to recognize and initialize it.

Requirement: Microsoft's only requirement is an active TPM 2.0 module (hardware or firmware) in the system.

Conclusion: If the manufacturer (ASRock) provides a BIOS with the correct code (corrected ACPI/DSDT tables) for our Z97X Killer, ensuring proper communication with a TPM 2.0 module compatible with the 17-pin header, our system will be fully compatible with Windows 11 security requirements.

stormryder wrote: I agree! My biggest motivator is that I feel it's environmentally responsible to keep using, for as long as possible, these perfectly usable machines that are full of metals and other things that were resource-intensive to produce.

4. The Environmental and Financial Argument
I completely agree with your stance on environmental responsibility!

Ecology: Continuing to use perfectly functional hardware instead of prematurely discarding it is the most responsible approach. The waste of metals and plastics, as well as the energy invested in manufacturing a new computer, is a huge environmental footprint that can be avoided.

Economics: Upgrading to 13th or 14th gen (or to AMD AM5) requires a $1000+ investment in a new motherboard, CPU, and RAM. This stands against $10??20 for a TPM module and a few minutes to flash the BIOS.


It is absurd to block functional hardware when a software solution (a new BIOS) and a minimal hardware module can solve the problem. This is purely a marketing hurdle, not a technical one.

Thank you again for the insightful questions!