Black BIOS screen after enabling Secure Boot?

Question

I am not sure if I have understood the underlying concept clearly. I have MSI B450M Pro board and MSI GT710 GPU based graphics card. Windows 10 installed in UEFI Boot mode on an SSD.

I thought to enable Secure Boot in BIOS. However, there’s a dependent option called Advanced Windows OS Configuration (options CSM/UEFI) which needs to be set to choice 'UEFI' before Secure Boot can be enabled. In earlier BIOS versions same setting was called Windows 10 OS (options were 'Other OS/Windows 10') now its options are called CSM/UEFI though.

(This CSM here under OS Config, I believe is not to be confused with Boot mode that is already set to UEFI.) Then it enables GOP. However, under GOP it says ‘Unknown Driver’. Now, Windows 10 boots fine but when I supposedly enter BIOS, all I see is a black screen. ALT CTL DEL works fine as such and system can reboot even from that black screen, which I believe is resting in BIOS. After BIOS reset (Shorting the mobo pins) when this OS Config setting is back to default CSM, boot logo & BIOS are visible again.

I opened a ticket with MSI and they said that my graphics card does not support GOP.

When I run GPU-Z I see that my card is UEFI capable, so why does not it work with GOP (If that's correct interpretation) and how do I know if a GPU can support GOP? Is there some other reason for black BIOS screen when Secure Boot is enabled? Below are some relevant screenshots. I also tried updating Motherboard BIOS to the latest version but nothing changed. It still behaves the same way.

Update - Even before Secure Boot just changing the OS Mode to UEFI under OS Config gives the same result. Black screen at BIOS. I reiterate that this is not OS Boot mode but OS Configuration mode as termed by MSI. Windows 10 is already installed in UEFI Boot Mode. Legacy Boot (also called CSM) is disabled therein. The term CSM & UEFI appears in 2 different places in this BIOS. Once in Boot Mode (CSM + UEFI) and another in advanced OS Config Mode (CSM or UEFI).

Solution 1

Under Secure Boot every running code must be signed with the key which root is trusted by the UEFI BIOS. Usually everything is signed with a "user key", which is usually Microsoft's key (so Microsoft is your computer user, not you. You thought you own your computer? Poor you). Every code and even OS boot loader is signed with that key. Yes, even Linux boot loader (shim) is signed by Microsoft.

UEFI GOP is a graphics standard for UEFI. It must be 1) supported by the card 2) code signed to run under UEFI Secure Boot. If that't not a case, sorry, black screen.

But under that black screen OS might boot and when it boots successfully and runs its own (signed) graphics drivers it may re-enable screen, because at that stage OS taken control on hardware.

UEFI Compatibiliy Support Module (CSM) essentially represents services that legacy BIOS provides. So it enables to run systems not supporting UEFI.

If OS was installed under CSM, it thinks this machine is not UEFI compartible and installs in legacy mode. If you switch to UEFI it won't boot because this is not UEFI loader expects to see. If system was installed under UEFI, it detects that and configures BIOS so it wouldn't boot if you switch to CSM afterwards, because this is not legacy BIOS loader expects to see. It is possible to configure a system to boot either way, but it's not very easy and I don't know how to do this in Windows.

I don't know what this checkbox in CPU-Z means. But "Unknown Device" and "Unknown Driver" in the BIOS screen make me suspect that BIOS doesn't recognize card's UEFI support.

To further investigate, you can try to switch to UEFI mode, but don't enable Secure Boot yet. That'll enable you to run unsigned code in UEFI mode. If your card is UEFI capable but code is unsigned, that'll work. This will allow you to boot OS installer or recovery. On this stage, configure OS boot in UEFI mode, and only then enable Secure Boot.

In theory it is possible to roll over own keys, but it is cumbersome, because you need to extract all used binaries, sign, roll that into BIOS, and there is still no Windows software that does that. There is Linux software for that, though, but countless BIOS bugs make this path very painful. This is what why there was all that hum when UEFI and Secure Boot were introduced, but, you know, Microsoft monopolized a computer market, and users happily eat that pill and ask for more. Like Windows? Live with that and don't try rioting.

Solution 2

If you have an NVIDIA card using DisplayPort connection, there is an additional possibility. UEFI support on some Nvidia cards out of the box only includes HDMI and not DisplayPort. The following vendor firmware update can expand the existing UEFI support to include the DisplayPort GPU plug.

NVIDIA GRAPHICS FIRMWARE UPDATE TOOL FOR DISPLAYPORT 1.3 AND 1.4 DISPLAYS https://www.nvidia.com/en-us/drivers/nv-uefi-update-x64/

Solution 3

Last 2 days with lots of thinking and tryouts I have advanced one step further in this issue. While the issue is not 100% solved, at least I am now convinced that my GT710 is indeed UEFI & GOP capable and that GPU-Z reporting is correct.

The unresolved issue seems to be some incompatibility somewhere between monitor/board/GPU & HDMI when UEFI GOP is enabled. I do not know exactly what is incompatible at the moment.

After I connected the monitor to the VGA out (the traditional 15 pin connector) of my GT710 (It has 3 options D-Sub, HDMI & DVI) I got the BIOS visible and then I could even see the GOP driver correctly detected when ‘Advanced OS Configuration’ setting was set to UEFI. Then further I also enabled Secure boot and even then, everything worked fine.

Now on VGA out, I can ‘see’ the BIOS whenever needed by hitting Del key and system also correctly detects GOP even if the ‘Advanced OS Configuration’ setting is UEFI (Actually GOP) but ‘UEFI’ term used by MSI seems a bit misnomer here. It can confuse one into believing that OS is booting in CSM or UEFI mode! A better convention for this setting probably could have been ‘VGA BIOS’ or ‘UEFI GOP’

See the BIOS screenshot now. Now GOP driver is detected on VGA. All I need is get the output from VGA & not HDMI.

So, there’s some incompatibility with HDMI out which I cannot explain. I tried changing HDMI cable but that did not help. Ideally it should not have happened. I have no explanation for now. All I know is GT710 card supports HDMI 1.4 whereas my monitor is HDMI 1.3.

Put it on HDMI, and the whole issue reoccurs, Black BIOS, It’s very much there though. I can hit F6 then F10 on that black screen and BIOS successfully resets to defaults and restarts with default values & it’s back to non-GOP and all good!

Indeed, the response given by MSI tech support (Even though both the board and the Graphics cards are designed by them) was not that correct. I will open a new ticket with this new observation, I am sure they will now say that your card (which in fact is designed by them) does not support HDMI (?)and close the ticket!

Comments

[rajeev]

Thanks. More details added to the question. Also it seems 5th para in your answer (If OS was installed under CSM, ...) is not applicable in this context. Windows 10 is already installed in UEFI mode. The GPU-Z checkbox is not editable to user. It automatically ticks as UEFI supported for this card.

[Ramhound]

@rajeev - So this answer is correct except that it’s not UEFI that requires everything be signed but Secure Boot. Since that isn’t the case, and you have a screenshot (response from MS) that stated that’s the case, you are out of luck with regards to Secure Boot. You want to check Windows actually believe it was installed in UEFI mode.

[rajeev]

As per the update in the question, forget about secure boot, even switching to Windows 10 OS setting (that I believe enables GOP and MSI calls it UEFI in their BIOS) gives the same result. Black BIOS screen. Irony is that my MSI GT710 card claims it's UEFI capable. That leads me to some more questions, that I will probably ask after further analysis of this issue. Windows 10 is installed in UEFI mode. Still if you want to check, msinfo32.exe does show BIOS Mode as UEFI.

[Nikita Kipriyanov]

@Ramhound Secure Boot is a UEFI feature. Think of it as of one of possible UEFI configurable security modes or levels. So if Secure Boot requires something it is because that was required by the UEFI specification and so it is the UEFI requirement in that mode. This mode specifies that signature checks and decisions where to run or not to run this binary code must be performed by the UEFI firmware.

[Ramhound]

I already know what secure boot is

[Community]

Please provide additional details in your answer. As it's currently written, it's hard to understand your solution.

[Toto]

While this link may answer the question, it is better to include the essential parts of the answer here and provide the link for reference. Link-only answers can become invalid if the linked page changes.

[Nikita Kipriyanov]

The black screen in typical output if you try to play a protected content to non-HDCP-capable screen. Does your monitor support HDCP? Could this be a cause of an issue? Had you tried another HDMI monitor?

[Barett]

This worked for me.