> I find it quite interesting how they whitelisted their own Surface devices but not, say, Thinkpads, despite them having the same CPUs

Because Lenovo did not bother writing DCH drivers, given DCH drivers are the baseline requirement.

> Could you explain in what way "DCH driver support" is a "hardware security mitigation" as you wrote?

I was recalling a 2 year old blog post in my head, but the point is still that much of the requirement is around baseline security. If you watch the video I linked, the speaker does go over all of this.

> basically let hardware vendors decide which otherwise-capable CPUs they'd like to make obsolete through software updates?

I'm not sure what you're getting at. DCH drivers were already the default for current-gen hardware _before_ W11 even came out, W11 just made it a requirement. Vendors clearly aren't going to go write some greenfield drivers for a years-old 6th gen intel product just to support W11, as those devices will be 10 years old by the time W10 support ends.

> note that the OS isn't even turning on the CPU features they require by default

Note that you're still referencing a blog post from 2021. W11 22H2 enables core isolation by default for new installations, and HVCI is enabled by default when using the Windows Enterprise security baseline.

https://techcommunity.microsoft.com/t5/microsoft-security-ba...