Warning about the new "Secure Boot" BIOS when using an older graphics card!

citay

Pro
SERGEANT
Joined
Oct 12, 2016
Messages
7,934
Recently, there have been several reports where people updated to the latest BIOS for their MSI motherboard and encountered various - but similar - problems.
The most common problems being a blank screen when trying to enter the BIOS, and/or a blank screen until Windows is loaded, or not even getting a picture or a POST at all.
When a PC speaker is connected, there may also be three beeps to be heard.

I tried to find the common denominator for the cause of these problems, and two things caught my attention:
- The BIOS changelog for the MSI boards that this happens with (both Intel- and AMD-based) includes the following: "Change the default setting of Secure Boot".
- All the affected users had an older graphics card (at least four or five years old).

Due to previous troubleshooting of similar issues when using an old graphics card in a modern motherboard, my suspicion immediately fell on that configuration as the trigger for the problems.
Some users have in fact confirmed my suspicion by now, which is why i'm writing this post, so i can warn more potentially affected users.

Which graphics cards can trigger the problems with the newest "Secure Boot" BIOS version? Possibly a lot of graphics cards from 2018/2017 or older.
One commonly mentioned card is the RX 580. That model (and models older than that, of course) can definitely have problems in combination with this new BIOS.
The only cards that will almost surely be safe from any potential issues are from 2019 and newer. But for some older cards, there are solutions, i will list them further down.

I will try to explain the technical reasons behind this all to the best of my knowledge:

The newest BIOS has the feature "Secure Boot" enabled by default, which requires pure UEFI mode. A modern BIOS can be in two modes: Legacy/CSM mode (Compatibility Support Module), and the newer, more modern UEFI mode (Unified Extensible Firmware Interface). To be precise, there can also be a hybrid mode of CSM and UEFI where the board chooses the "correct" one, but let's focus on the two pre-set modes.

UEFI mode is preferable nowadays for a modern operating system like Windows 10 or 11, and Windows 11 even requires UEFI mode for the BIOS. But when a modern mainboard's BIOS is in UEFI mode, that can already cause certain problems with older graphics cards.

Why? Many of those older graphics cards don't have a so-called GOP driver in their firmware yet, they will only have a VBIOS. GOP means "Graphics Output Protocol" driver, VBIOS means "Video BIOS". VBIOS-only was common until at least 2016 or 2017, and from then on they started adding a GOP driver to the graphics cards' firmwares. The term "GOP driver" can be misleading, it doesn't have anything to do with the graphics driver in Windows, it refers to part of the graphics card's firmware. An old graphics card that only has a VBIOS works well together with an old mainboard BIOS and an old OS such as Windows 7. But now, with the BIOS in UEFI mode and Windows 10 or 11, the missing GOP is causing problems.

Now for the new BIOS update: Since it enables the "Secure Boot" feature by default, it ups the requirements again, because now it wants the graphics card to have a GOP with a signature for the firmware. This is what is really triggering problems now, because the old cards often won't output a picture at all anymore in this environment. So there's no way of getting into the BIOS and changing settings to make the old card work again.

Why did MSI even change the default setting of Secure Boot from disabled to enabled?

Windows 11 has come along with some surprising new and strict requirements. MSI have reacted in several stages. First they decided to enable the firmware TPM 2.0 in recent BIOS versions (this is called "Windows 11 Supported" in the changelogs mostly found on Intel-based boards), and of course UEFI mode is the default for the BIOS for a while now. And now MSI also chose to enable Secure Boot by default. While UEFI mode is definitely a hard requirement for Windows 11, the enabled Secure Boot should still be somewhat optional for end users. But i guess MSI really want to make sure that the systems are as Windows-11-compatible as possible, with little to no extra work for the end user.

However, now with Secure Boot enabled, the graphics card not only needs to have a GOP in its firmware, the firmware also has to be properly signed to be allowed for Secure Boot, like i mentioned before. So by the motherboard having Secure Boot automatically enabled with the newest BIOS, it tries to enforce Secure Boot with a graphics card that's not properly prepared for it. The possible consequence of that is: No picture or POST anymore. This is not a fault or defect of the motherboard or BIOS! It is the consequence of enabling all the advanced settings and features that Windows 11 likes, and trying to enforce them with older graphics cards that are not fully compatible unless you modify their firmware.


So for now, with an old graphics card, one strategy could be to avoid updating to the latest BIOS (the one with "Change the default setting of Secure Boot" in the changelog).
But of course, this will prevent you from benefitting from the other bugfixes and improvements in this new BIOS and the following versions, so it's not ideal.
From MSI's side, the only fix would be to revert back to Secure Boot being disabled again in a newer BIOS, or not to fix it, and just add a warning to the new BIOS downloads on their site.

Another possibility is to prevent/fix it on the user side. To do that, these are the main options:

1)
Updating the BIOS to a version that works (either to the version before this problematic one, or to a newer beta version).
On motherboards with the Flash BIOS Button, the BIOS can be updated or downgraded to pretty much any version at any time.
So if there are such problems, they can be fixed using the Flash BIOS Button method (which is described in the motherboard manual) to downgrade to the BIOS version before the problematic one.
But: Not all motherboard models have this feature. The cheaper and older the board model, the less likely it is to have it.
If the board doesn't have it, then there's still a possibility to blind-flash the BIOS.

2) Updating the graphics card's BIOS/firmware with one that has a GOP. On AMD, this process can be slightly complicated, here is an example.
Sometimes you can find a firmware for an older graphics card that has already been updated with a GOP, for example from https://www.techpowerup.com/vgabios/
For older (but not too old) NVIDIA cards, there's a much more convenient firmware updater (they mention DisplayPort on there, but it simply adds a GOP which prevents these kinds of issues).
For NVIDIA GPUs that are too old to be supported by the firmware updater, they can still be manually updated with a GOP like so, or maybe there is a firmware with a GOP already for download.

3) Using a graphics card from 2019 or newer, which pretty much guarantees that it plays nice with the new BIOS.
This can also be done in case the BIOS was already updated and the first two options can't be used. Enter the BIOS with the new graphics card, disable Secure Boot, and try again with the old card.
If that doesn't fix it, then using the newer card, downgrade the BIOS to the one before this version via M-Flash in the BIOS if possible, and the old graphics card should work again too.

4) Using an older CPU to be able to enter the BIOS and disable Secure Boot, see here.

If M-Flash doesn't allow a BIOS downgrade, then it's also worth trying to set the BIOS to CSM mode. This might also work around a potential secondary problem: If Windows was installed with the BIOS in CSM/Legacy mode before, then the newer BIOS version that enforces UEFI mode can't boot that Windows anymore without some further work. In that case, the EZ Debug LEDs on the board will also show the BOOT LED. This is not critical, it can be solved in a few ways. The more detailed explanation is here.

However, setting the BIOS to CSM mode is not a good idea in the long run, because Windows 11 will require UEFI mode. And with the support for Windows 10 ending in October 2025, there will be a time when we all have to start using Windows 11 (since Windows 10 will become too unsafe to use without updates). So by the end of 2025, there will have to be a permanent fix applied to those older graphics cards, usually in the form of a firmware update for them, otherwise they might cause problems again as the BIOS will have to be in UEFI mode for Windows 11.


Here are the first confirmations that my theories from above are correct:
 
Last edited:

barbosapaul15b802e6

New member
Joined
Jun 22, 2022
Messages
6
I'm on the 2nd link and I confirm this. The issue happened on one board, and I was able to reproduce the issue on another board. Both working OK now, with the 2nd latest BIOS and secure boot disabled ( windows 10 ).
 

Svet

Well-known member
Administrator
Joined
Nov 20, 2003
Messages
79,341
MSI is aware of this issue:
The old auto switch to CSM mode when using non-GOP graphics card patch has issues after Enable "Secure Boot".
And they are working on those.
 

bobbysledge

NoNoBadDog
PRIVATE E-2
Joined
Nov 10, 2018
Messages
14
Never had an issue with my motherboard and my MSI Armour RX 580. I have upgraded to each new BIOS as they were released, and am currently running the latest BETA BIOS. Never had the black screen problem. Never had any issue going into the BIOS. I know that I am not in the minority here.
 

citay

Pro
SERGEANT
Joined
Oct 12, 2016
Messages
7,934
MSI is aware of this issue:
The old auto switch to CSM mode when using non-GOP graphics card patch has issues after Enable "Secure Boot".
And they are working on those.
Very good to hear.

Never had an issue with my motherboard and my MSI Armour RX 580.
That's easily explainable: Some later RX 580 models already have a fixed firmware with a GOP, i.e. fully UEFI compatible. But there are also a lot of older RX 580 cards around which are not truly UEFI-ready, and we are seeing problems from those. We've even been seeing problems before this Secure Boot issue with those cards.
 

Andrey3008

r5 3600, x470, GTX 1060
Joined
Jun 27, 2022
Messages
22
I have exactly the same problem after updating bios to 7B79vMD (this is the latest bios for my X470 GAMING PRO MAX)
I can get into the BIOS every other time, but m-flash does not start to flash the old one.
I have a GTX 1060 6gb GV-N1060AORUS-6GD
and it is connected via hdmi, it should not have problems like old cards.
and I updated the card via NVIDIA_DisplayPort_Firmware_Updater but it didn't help.
I also note that when the black screen lights up, I press "Ctrl + alt-del" the keyboard goes out, there is no POST code sound, I press Del and I get into the BIOS. Secure Boot turned off. problem still exists.
 

bvdbeldw157c02e3

New member
Joined
Jun 29, 2022
Messages
2
Just a quick post to confirm this is likely the issue.
MB: MAG X570 TOMAHAWK WIFI
CPU: AMD Ryzen 7 5800X 8-Core Processor
RAM: 32 GB
GPU: XFX Double D HD 7770 (yes, really old, temporarily in use)
OS: Windows 11 Pro, latest version, up to date.

Upgraded BIOS from 7C84v19 to 7C84v1A

Behaviour:
blank screen, no POST message; unable to enter the bios, at every (re)boot 3 beeps, EZ debug leds: off (no errors with CPU, DRAM, VGA, BOOT)
- When I don't touch the keyboard (trying) to enter the bios: Windows 11 will be loaded.
- When I do touch the keyboard to enter the bios: booting of Windows seems to be aborted, Windows 11 will not load.

Downgrading from 7C84v1A to 7C84v19 (using the flash BIOS button and renaming 7C84v19 to MSI.ROM) fixes all issues. Accessing the BIOS is possible again and Windows loads and runs as expected.
 

jfatoliveira

New member
Joined
Jun 9, 2017
Messages
2
I have the same issue but I'm in a pickle.

I updated bios on my b350m bazooka to the latest as I'm looking to upgrade from a ryzen 1600 to a 5800x, I have a rx 580 xtr

I had the same can't go to bios issue but I could use Windows.
I was doing some troubleshooting, updating drivers on motherboard and gpu. When I updated the GPU driver, image is gone.
now I have no image at all, can't go to BIOS to flash, can't reach Windows...

What can I do?
 

citay

Pro
SERGEANT
Joined
Oct 12, 2016
Messages
7,934
What can I do?
Use a more recent graphics card, ideally from 2019 or newer. This will allow you to see the BIOS again and use M-Flash to downgrade to the BIOS version before this new one.
Then your old card will show a picture again too.
 

bvdbeldw157c02e3

New member
Joined
Jun 29, 2022
Messages
2
I have the same issue but I'm in a pickle.

I updated bios on my b350m bazooka to the latest as I'm looking to upgrade from a ryzen 1600 to a 5800x, I have a rx 580 xtr

I had the same can't go to bios issue but I could use Windows.
I was doing some troubleshooting, updating drivers on motherboard and gpu. When I updated the GPU driver, image is gone.
now I have no image at all, can't go to BIOS to flash, can't reach Windows...

What can I do?
I googled "msi b350m bazooka" and found that this motherboard has a "Flash BIOS Button". So you could downgrade without entering the BIOS directly.
Just put the last working firmware version on a fat32 formatted usb stick and rename the bios file to MSI.ROM. Put in in the "Flash BIOS" usb port and restart the computer.
When the downgrade is done (this will take several minutes), the computer will automatically restart and you can unplug the usb stick and access the BIOS.
 

jfatoliveira

New member
Joined
Jun 9, 2017
Messages
2
Use a more recent graphics card, ideally from 2019 or newer. This will allow you to see the BIOS again and use M-Flash to downgrade to the BIOS version before this new one.
Then your old card will show a picture again too.
Any way I can reset the BIOS or do anything? I don't have a newer card...
 

citay

Pro
SERGEANT
Joined
Oct 12, 2016
Messages
7,934
No, the "B350M Bazooka" board model does not have a Flash BIOS Button or USB flashback function. That only became a thing with a lot of the B450 boards.
 

Andrey3008

r5 3600, x470, GTX 1060
Joined
Jun 27, 2022
Messages
22
- When I do touch the keyboard to enter the bios: booting of Windows seems to be aborted, Windows 11 will not load.
when you press Del to enter the BIOS and everything stops on a black screen, try pressing alt + ctrl + del, (I reboot again) and after it, when you press Del, it enters the BIOS. And if you do not touch anything at boot, then the black screen will not boot until windows.
in support they gave me a link to the program and an article on how to roll back the bios to the old bios. until I rolled back, I want to figure out what the problem is, I have a different and old GTX 1060, but the problems are the same.
 

j.e.labarr155102d7

New member
Joined
Feb 6, 2022
Messages
13
I was just looking at the ever-so-small "changelog" for the 7B86vMG(2022-06-09) BIOS update for the B450-A Pro Max motherboard, and noticed the ominous line "Change the default setting of Secure Boot". The ****ONLY**** correct setting for (in)Secure Boot is "Disabled". Anything else smacks of some company sucking up to Microsoft on OUR dime.

And forcing you to go all the way into MSWindows to change anything is a severe problem, considering that I run Linux (Fedora 36 currently) and not MSWindows. If the design of their BIOS update is designed to lock people into MSWindows, we have a serious issue here, and it might put MSI onto a "do not buy" list.
 
Joined
Jun 26, 2022
Messages
3
Recently, there have been several reports where people updated to the latest BIOS for their MSI motherboard and encountered various - but similar - problems.
The most common problems being a blank screen when trying to enter the BIOS, and/or a blank screen until Windows is loaded, or not even getting a picture or a POST at all.
When a PC speaker is connected, there may also be three beeps to be heard.

I tried to find the common denominator for the cause of these problems, and two things caught my attention:
- The BIOS changelog for the MSI boards that this happens with (both Intel- and AMD-based) includes the following: "Change the default setting of Secure Boot".
- All the affected users had an older graphics card (at least four or five years old).

Due to previous troubleshooting of similar issues when using an old graphics card in a modern motherboard, my suspicion immediately fell on that configuration as the trigger for the problems.
Some users have in fact confirmed my suspicion by now, which is why i'm writing this post, so i can warn more potentially affected users.

Which graphics cards can trigger the problems with the newest "Secure Boot" BIOS version? Possibly a lot of graphics cards from 2018/2017 or older.
One commonly mentioned card is the RX 580. That model (and models older than that, of course) can definitely have problems in combination with this new BIOS.
The only cards that will almost surely be safe from any potential issues are from 2019 and newer. But for some older cards, there are solutions, i will list them further down.

I will try to explain the technical reasons behind this all to the best of my knowledge:

The newest BIOS has the feature "Secure Boot" enabled by default, which requires pure UEFI mode. A modern BIOS can be in two modes: Legacy/CSM mode (Compatibility Support Module), and the newer, more modern UEFI mode (Unified Extensible Firmware Interface). To be precise, there can also be a hybrid mode of CSM and UEFI where the board chooses the "correct" one, but let's focus on the two pre-set modes.

UEFI mode is preferable nowadays for a modern operating system like Windows 10 or 11, and Windows 11 even requires UEFI mode for the BIOS. But when a modern mainboard's BIOS is in UEFI mode, that can already cause certain problems with older graphics cards.

Why? Many of those older graphics cards don't have a so-called GOP driver in their firmware yet, they will only have a VBIOS. GOP means "Graphics Output Protocol" driver, VBIOS means "Video BIOS". VBIOS-only was common until at least 2016 or 2017, and from then on they started adding a GOP driver to the graphics cards' firmwares. The term "GOP driver" can be misleading, it doesn't have anything to do with the graphics driver in Windows, it refers to part of the graphics card's firmware. An old graphics card that only has a VBIOS works well together with an old mainboard BIOS and an old OS such as Windows 7. But now, with the BIOS in UEFI mode and Windows 10 or 11, the missing GOP is causing problems.

Now for the new BIOS update: Since it enables the "Secure Boot" feature by default, it ups the requirements again, because now it wants the graphics card to have a GOP with a signature for the firmware. This is what is really triggering problems now, because the old cards often won't output a picture at all anymore in this environment. So there's no way of getting into the BIOS and changing settings to make the old card work again.

Why did MSI even change the default setting of Secure Boot from disabled to enabled?

Windows 11 has come along with some surprising new and strict requirements. MSI have reacted in several stages. First they decided to enable the firmware TPM 2.0 in recent BIOS versions (this is called "Windows 11 Supported" in the changelogs mostly found on Intel-based boards), and of course UEFI mode is the default for the BIOS for a while now. And now MSI also chose to enable Secure Boot by default. While UEFI mode is definitely a hard requirement for Windows 11, the enabled Secure Boot should still be somewhat optional for end users. But i guess MSI really want to make sure that the systems are as Windows-11-compatible as possible, with little to no extra work for the end user.

However, now with Secure Boot enabled, the graphics card not only needs to have a GOP in its firmware, the firmware also has to be properly signed to be allowed for Secure Boot, like i mentioned before. So by the motherboard having Secure Boot automatically enabled with the newest BIOS, it tries to enforce Secure Boot with a graphics card that's not properly prepared for it. The possible consequence of that is: No picture or POST anymore. This is not a fault or defect of the motherboard or BIOS! It is the consequence of enabling all the advanced settings and features that Windows 11 likes, and trying to enforce them with older graphics cards that are not fully compatible unless you modify their firmware.


So for now, with an old graphics card, one strategy could be to avoid updating to the latest BIOS (the one with "Change the default setting of Secure Boot" in the changelog).
But of course, this will prevent you from benefitting from the other bugfixes and also good for website and improvements in this new BIOS and the following versions, so it's not ideal.
From MSI's side, the only fix would be to revert back to Secure Boot being disabled again in a newer BIOS, or not to fix it, and just add a warning to the new BIOS downloads on their site.

Another possibility is to prevent/fix it on the user side. To do that, these are the main options:

1)
On motherboards with the Flash BIOS Button, the BIOS can be updated or downgraded to pretty much any version at any time.
So if there are such problems, they can be fixed using the Flash BIOS Button method (which is described in the motherboard manual) to downgrade to the BIOS version before the problematic one.
But: Not all motherboard models have this feature. The cheaper and older the board model, the less likely it is to have it.

2) Updating the graphics card's BIOS/firmware with one that has a GOP. On AMD, this process can be slightly complicated, here is an example.
For older (but not too old) NVIDIA cards, there's a much more convenient firmware updater (they mention DisplayPort on there, but it simply adds a GOP which prevents these kinds of issues).
For NVIDIA GPUs that are too old to be supported by the firmware updater, they can still be manually updated with a GOP like so.

3) Using a graphics card from 2019 or newer, which pretty much guarantees that it plays nice with the new BIOS.
This can also be done in case the BIOS was already updated and the first two options can't be used. Enter the BIOS with the new graphics card, disable Secure Boot, and try again with the old card.
If that doesn't fix it, then using the newer card, downgrade the BIOS to the one before this version via M-Flash in the BIOS if possible, and the old graphics card should work again too.

If M-Flash doesn't allow a BIOS downgrade, then it's also worth trying to set the BIOS to CSM mode. This might also work around a potential secondary problem: If Windows was installed with the BIOS in CSM/Legacy mode before, then the newer BIOS version that enforces UEFI mode can't boot that Windows anymore without some further work. In that case, the EZ Debug LEDs on the board will also show the BOOT LED. This is not critical, it can be solved in a few ways. The more detailed explanation is here.

However, setting the BIOS to CSM mode is not a good idea in the long run, because Windows 11 will require UEFI mode. And with the support for Windows 10 ending in October 2025, there will be a time when we all have to start using Windows 11 (since Windows 10 will become too unsafe to use without updates). So by the end of 2025, there will have to be a permanent fix applied to those older graphics cards, usually in the form of a firmware update for them, otherwise they might cause problems again as the BIOS will have to be in UEFI mode for Windows 11.


Here are the first confirmations that my theories from above are correct:

I'm awaiting several more confirmations, and i will update this thread accordingly.
Is it also creat issue with old bois setting?
 

citay

Pro
SERGEANT
Joined
Oct 12, 2016
Messages
7,934
Is it also creat issue with old bois setting?
I'm not sure what you mean, can you rephrase that question and be more precise? What old BIOS setting do you mean?

The new BIOS version that's available for many newer motherboards will enable Secure Boot, which requires UEFI mode.
So any time you install this new "Secure Boot enabled" BIOS and use an old graphics card, you could suffer from this issue. At least for the moment, until MSI change something in another new version.
 

plutomate

Well-known member
MAJOR GENERAL
Joined
Jul 30, 2015
Messages
5,397
And forcing you to go all the way into MSWindows to change anything is a severe problem, considering that I run Linux (Fedora 36 currently) and not MSWindows. If the design of their BIOS update is designed to lock people into MSWindows, we have a serious issue here, and it might put MSI onto a "do not buy" list.
Sooner or later, all the motherboard manufacture will be on your ban list :ROFLMAO: bu it doesn't mean you cannot change the option manually, it's not a hidden/forced option anyway.
 

Alan J T

🙈 🙉🐝 🤬😈
Global Moderator
Joined
Sep 11, 2020
Messages
9,177
I was just looking at the ever-so-small "changelog" for the 7B86vMG(2022-06-09) BIOS update for the B450-A Pro Max motherboard, and noticed the ominous line "Change the default setting of Secure Boot". The ****ONLY**** correct setting for (in)Secure Boot is "Disabled". Anything else smacks of some company sucking up to Microsoft on OUR dime.

And forcing you to go all the way into MSWindows to change anything is a severe problem, considering that I run Linux (Fedora 36 currently) and not MSWindows. If the design of their BIOS update is designed to lock people into MSWindows, we have a serious issue here, and it might put MSI onto a "do not buy" list.
Not when it is something the Majority of users want to happen the minority aka Linex users should know enough to be able to turn it off Set up the bios. as all of them claim to be super users.
 

j.e.labarr155102d7

New member
Joined
Feb 6, 2022
Messages
13
Sooner or later, all the motherboard manufacture will be on your ban list :ROFLMAO: bu it doesn't mean you cannot change the option manually, it's not a hidden/forced option anyway.
Yeah, laugh it up, fuzzball. The point was that the changes in the BIOS settings was **BREAKING** the ability to boot EVEN INTO THE BIOS SCREEN, if you had read the original part of the thread. That would require you to have paid attention though. Because you know eventually they will start pushing for the removal of the switch to disable it. But if you don't mind your freedoms being slowly but surely encroached upon, that's YOUR choice, but it isn't mine.
 
Last edited by a moderator:

j.e.labarr155102d7

New member
Joined
Feb 6, 2022
Messages
13
Not when it is something the Majority of users want to happen the minority aka Linex users should know enough to be able to turn it off Set up the bios. as all of them claim to be super users.
Had you *READ* the original post, the point was that the changes in the BIOS was BREAKING the ability to even get INTO the BIOS screen. Try to RTFM next time. Restrictions to your own freedoms should always be opt-IN, not opt-OUT.
 
Top