If I buy a new or refurbished PC with TPM 2.0, will I be able to dual boot Ubuntu?

[AbleTassie]

If I buy a new or refurbished PC with TPM 2.0, will I be able to dual boot Ubuntu on it?

I am worried that I will not be able to use Ubuntu if I buy a new PC with TPM 2.0.

Threads on the forum like this one Thread: TPM 2.0 / Secure Boot - Locked have me worried that I will no longer be able to use Ubuntu (or other form of Linux) on a purchased PC. Whether the PC is refurbished or new.

QUESTION: Does anybody have any comments or suggestions as to what I should do if I want to dual boot Windows 11 and Ubuntu (or other version of Linux)?

Thank you,

A.

[#&thj^%]

I'm not a fan of dual booting windows at all so no help from me there. (sorry)
But not all TPM devices are the same IE:

┌───────────────────>
│~ 
└─> cat /sys/class/tpm/tpm*/tpm_version_major
2
┌───────────────────>
│~ 
└─> [ -c /dev/tpm0 ] && echo "TPM 1.2 or 2.0"
TPM 1.2 or 2.0
┌───────────────────>

ADDED:

sudo dmesg | grep -i tpm
[sudo] password for me: 
[    0.000000] efi: ACPI=0xcdffe000 ACPI 2.0=0xcdffe014 TPMFinalLog=0xcdefc000 SMBIOS=0xcb70d000 SMBIOS 3.0=0xcb70b000 ESRT=0xb6640a18 MEMATTR=0xb5214018 
[    0.005718] ACPI: TPM2 0x00000000CDFF0000 000034 (v04 LENOVO CB-01    00000001      01000013)
[    0.005777] ACPI: Reserving TPM2 table memory at [mem 0xcdff0000-0xcdff0033]
[    1.891774] tpm tpm0: AMD fTPM version 0x3002f00000005 causes system stutter; hwrng disabled
[    2.557156] systemd[1]: systemd 253.4-1-arch running in system mode (+PAM +AUDIT -SELINUX -APPARMOR -IMA +SMACK +SECCOMP +GCRYPT +GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT -QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD +BPF_FRAMEWORK +XKBCOMMON +UTMP -SYSVINIT default-hierarchy=unified)
[    2.878154] systemd[1]: TPM2 PCR Machine ID Measurement was skipped because of an unmet condition check (ConditionPathExists=/sys/firmware/efi/efivars/StubPcrKernelImage-4a67b082-0a4c-41cf-b6c7-440b29bb8c4f).

You will need to study the refurbed machine to see if it is locked for windows only.
If you really need windows, consider running one OS in a VM....save yourself from a lot of frustrations that way.

[ian-weisser]

Threads on the forum like this one Thread: TPM 2.0 / Secure Boot - Locked ...

...are an example of the perils of dual-booting with Windows.

If you read that thread carefully, Ubuntu didn't lock the fellow out of Ubuntu. The OEM didn't lock the fellow out of Ubuntu. A Windows update caused the problem...as Windows updates have been doing, on and off, for the entire history of Ubuntu.

So sure, you will be able to install Ubuntu. And you will be able to dual boot...until you cannot. Nothing new there.

I honestly have no idea why dual-booting remains a popular question among new folks. It's so much harder, more fraught, and more limited than simply using a VM.

[ajohnl]

One solution may be to ensure the machine comes with OS installation kit including drivers. The latest version of openbox will support win11 so that could be installed under Linux and win added that way. Best look for comments on openbox's site incase there are TPM variations.

On bios and things greyed out. I have bought a new win11 HP machine. The bios can be a bit confusing as one section can change another. First thing I noticed was boot order. A use once boot order change can be made. A permanent change has to be made elsewhere. It seems when dual booting win's fast boot must be turned off and bitlocking undone if the drive is set up that way. On win11 I turned off fast boot but following an update I can't find the section to do it any more. Fast boot can also be turned off in the bios but that may be another fast boot. Win will do some sort of sleep type turn off if it can. Selecting turn off should prevent that.

There may be another change as well but based on updating a win 8.1 laptop that hadn't been used for several years. The machine had been set up to use our wifi so win used it when auto updates were turned off and before I logged in. Turn off options changed to update and then turn off etc. Updates took a while and then reported a fail following a reboot and reverted most of the changes. As one of the updates wrecked Dell's recovery stuff I ran the update 3 times. The last one has destroyed win. Black screen of death rather than the blue one. The change to turning the machine off may be to make all users update. This may relate to all versions that they still support.

MS do not officially support running under a vm. On the face it they do support dual booting. This page mentions some of the complications and options.
https://wiki.archlinux.org/title/Dual_boot_with_Windows

[TheFu]

Add me to the "use a virtual machine" group. I stopped dual booting around 2008 when any mid-range CPU became capable of running Windows inside a VM nicely. VMs remove all sorts of issues. Just pick the host OS carefully.

[MAFoElffen]

+1 on the VM side for Windows. (This may be a surprise to people here, that know me.) Though with the title of this thread, TPM 2.0 is not an issue for being dual-boot or not.

I have been on the other side of this... But now am on the fence. I have been doing multi-boots for 13 years now. Even on them, I have only had a VM of Windows on Linux... And of Linux on Windows.

*** I have a PC with TPM 2.0, and pass-through the TPM for KVM Virtual Machine Hosting for use with hosting Windows VM's. So, "NO".... I do not have a problem with a computer having a TPM and running Ubuntu Linux. Also... TPM 2.0 can also be emulated via package 'swtpm' to use with KVM VM's to install Windows 11. ***

I do not have a problem installing Ubuntu with SecureBoot enabled... Since around LTS 20.04. 22.04 is even better at that.

On my daily runners, I do only run LTS versions. I test Development versions, but I do not use them as daily runners. My testing process is brutal, to see where I can break things, and to see just how far I can push things, so I run them in sandboxes.

I am not an average "User". I do Ubuntu +1 DEV testing, so am used to dealing with problems of some type almost daily. I am used to dealing with boot problems as they arise. My config's are not "vanilla." But I do not want to deal with problems in my daily runner. They need to be stable, and reliable.

The computers that have problems with being dual-boot, and have BIOS issues tied to the TPM, seem to be mostly of one brand... HP: Hewlett Packard, and their UEFI BIOS settings, that they want to lock a machine to using Windows. I (personally) hate to say that, because I have used HPC Server hardware for years, and my son-in-law is closely related to the Packard Family... But it is true, and the problem is there.

Why am I on the fence now with Dual-booting? As TheFu said, and as I have recommended to others, maintaining a dual-boot is work. Windows runs great in a VM! I very rarely use Windows these days, any more. The most I use it them now, is to keep their Updates current. Or to do Insider Testing. I have a few games I still play on Windows... But my time is not as free as it has been in the past. That is about it.

My hardware is "open." My configurations are very complex. I have a maintenance program that I stick to for security and recovery. Why? Because I know, with what I do, things do break.

[ajohnl]

I've dual booted for a long time. Must be over 25years now but initially installed linux in a VM under windows. An enterprise version of Linux. Suse bought from PCWorld. Boxed DVD's and docs. It came with a support phone number that wouldn't cover an Intel motherboard and a machine with more than one drive but the guy gave me some set up tips. PCworld probably started selling it as the number of people using it in the USA was increasing steadily. Linux people often saw it as a boring distro as it always worked. That meant that latest releases always took a while to appear,

Why dual boot. I suppose in my case there are 2 reasons. In case I need it and the fact that I have paid for it. The machine I am on now has been dual booting for just over 3 years and win has never been used. It's a win10 HP machine. Going on a laptop that hadn't been used for a long time, win8.1 it does seem to be a good idea to use win from time to time to update. The updates have trashed windows and also dell's recovery software. HP do that via the bios. Win seem to have made changes to make people use update. Also taken steps to prevent people changing passwords via back doors. No problem if their accounts system worked properly and it was possible to talk to some one. A legal reinstall can mess this area up.

My next dual boot will be on a newer far far more recent HP model. It looks like the bios will just warn about boot changes as the win10 machine did. The previous post suggests I may have other problems. My main beef is no win installation media as the machine uses digitally signed. Also HP do not support 2 OS's on the same machine.

[ian-weisser]

Well said. Thank you for explaining some good reasons to dual-boot.

[ajohnl]

Dual boot problems? I am using a laptop to try out 2 versions of Ubuntu, straight and Studio. So I have straight installed UEFI and used a UEFI boot option to install Studio from USB. I selected mount to / in free space as there is an EFI partition. It said no can do, a boot efi partition is needed. So selected an auto install and pointed it at free space. It showed before and after correctly so went ahead. I now find I've lost the option to boot straight ubuntu, It just goes to studio, I can't copy past the output from this command on that machine. This is from the one I am using

efibootmgr -v
BootCurrent: 0001
Timeout: 5 seconds
BootOrder: 0004,0001,0000,0005,0003
Boot0000* Windows Boot Manager  HD(1,GPT,60ad8d5d-3aee-4a2f-bef7-147f3cafa2f2,0x800,0xb4000)/File(\EFI\Microsoft\Boot\bootmgfw.efi)WINDOWS.........x...B.C.D.O.B.J.E.C.T.=.{.9.d.e.a.8.6.2.c.-.5.c.d.d.-.4.e.7.0.-.a.c.c.1.-.f.3.2.b.3.4.4.d.4.7.9.5.}...o....................ISPH
Boot0001* opensuse-secureboot   HD(1,GPT,384d9607-06e3-46dc-8a68-fcb39ea9c2af,0x800,0xc8000)/File(\EFI\opensuse\shim.efi)....ISPH
Boot0003* SAMSUNG MZVLB1T0HALR-000H1-S3WSNX0M105127     BBS(HD,SAMSUNG MZVLB1T0HALR-000H1-S3WSNX0M105127,0x400)/PciRoot(0x0)/Pci(0x1b,0x0)/Pci(0x0,0x0)/NVMe(0x1,00-25-38-81-91-B6-73-D8)......ISPH
Boot0004* Generic USB Storage 000000000830      PciRoot(0x0)/Pci(0x14,0x0)/USB(24,0)/USB(2,0)/USB(2,0)N.....YM....R,Y.....ISPH
Boot0005  USB:          BBS(65535,,0x0)/PciRoot(0x0)/Pci(0x14,0x0)......ISPH

The entries state where the boot managers are. LOL Trust win to have the longest entry. The laptop just shows one Ubuntu when there should be 2..

All win problems / hp. I wonder.

[TheFu]

I thought all versions of Ubuntu were basically the same, just with different DEs and default applications. To test different DEs, install them all, but create new userids for each and prior to login, pick the DE you want running. This will avoid personalized config file file collisions. No need to dual boot at all.

When done, remove the DEs you don't like and delete the extra userids with their HOME directories.

I suppose, some DEs are tightly coupled to the login manager, so reinstalling the login-manager tool that is most common to the selected DE might be necessary, but that should be it.

Oh ... and run sudo apt autoremove --purge when all done to remote the hundreds of packages installed that you don't want.

At least, that's my expectation and how I'd attempt the goal of picking a new DE. YMMV. I stopped desktop switching a few years ago and returned to the pure WM-only setup I'd used first in the 1990s. Different DEs just slow me down looking for the 50 things I actually use whereas my WM setup has those things all at my fingertips. Everyone needs to find their happy place. Hope you find yours.