Skip to main content
added 610 characters in body; added 43 characters in body
Source Link

Under Secure Boot every running code must be signed with the key which root is trusted by the UEFI BIOS. Usually everything is signed with a Microsoft key"user key", which is called "user key"usually Microsoft's key (so Microsoft is your computer user, not you. You thought you own your computer? Poor you), and they sign UEFI. Every code for BIOS drivers and so oneven OS boot loader is signed with that key. Yes, even Linux boot loader (shim) is signed by Microsoft.

UEFI GOP is a graphics standard for UEFI. It must be 1) supported by the card 2) code signed to run under UEFI Secure Boot. If that't not a case, sorry, black screen.

But under that black screen OS might boot and when it boots successfully and runs its own (signed) graphics drivers it may re-enable screen, because at that stage OS taken control on hardware.

UEFI Compatibiliy Support Module (CSM) essentially represents services that legacy BIOS provides. So it enables to run systems not supporting UEFI.

If OS was installed under CSM, it thinks this machine is not UEFI compartible and installs in legacy mode. If you switch to UEFI it won't boot because this is not UEFI loader expects to see. If system was installed under UEFI, it detects that and configures BIOS so it wouldn't boot if you switch to CSM afterwards, because this is not legacy BIOS loader expects to see. It is possible to configure a system to boot either way, but it's not very easy and I don't know how to do this in Windows.

I don't know what this checkbox in CPU-Z means. But "Unknown Device" and "Unknown Driver" in the BIOS screen make me suspect that BIOS doesn't recognize card's UEFI support.

To further investigate, you can try to switch to UEFI mode, but don't enable Secure Boot yet. That'll enable you to run unsigned code in UEFI mode. If your card is UEFI capable but code is unsigned, that'll work. This will allow you to boot OS installer or recovery. On this stage, configure OS boot in UEFI mode, and only then enable Secure Boot.

In theory it is possible to roll over own keys, but it is cumbersome, because you need to extract all used binaries, sign, roll that into BIOS, and there is still no Windows software that does that. There is Linux software for that, though, but countless BIOS bugs make this path very painful. This is what why there was all that hum when UEFI and Secure Boot were introduced, but, you know, Microsoft monopolized a computer market, and users happily eat that pill and ask for more. Like Windows? Live with that and don't try rioting.

Under Secure Boot every running code must be signed with the key which root is trusted by the UEFI BIOS. Usually everything is signed with a Microsoft key, which is called "user key" (so Microsoft is your computer user, not you), and they sign UEFI code for BIOS drivers and so on.

UEFI GOP is a graphics standard for UEFI. It must be 1) supported by the card 2) code signed to run under UEFI Secure Boot. If that't not a case, sorry, black screen.

But under that black screen OS might boot and when it boots successfully and runs its own (signed) graphics drivers it may re-enable screen, because at that stage OS taken control on hardware.

UEFI Compatibiliy Support Module (CSM) essentially represents services that legacy BIOS provides. So it enables to run systems not supporting UEFI.

If OS was installed under CSM, it thinks this machine is not UEFI compartible and installs in legacy mode. If you switch to UEFI it won't boot because this is not UEFI loader expects to see. If system was installed under UEFI, it detects that and configures BIOS so it wouldn't boot if you switch to CSM afterwards, because this is not legacy BIOS loader expects to see. It is possible to configure a system to boot either way, but it's not very easy and I don't know how to do this in Windows.

I don't know what this checkbox in CPU-Z means. But "Unknown Device" and "Unknown Driver" in the BIOS screen make me suspect that BIOS doesn't recognize card's UEFI support.

To further investigate, you can try to switch to UEFI mode, but don't enable Secure Boot yet. That'll enable you to run unsigned code in UEFI mode. If your card is UEFI capable but code is unsigned, that'll work. This will allow you to boot OS installer or recovery. On this stage, configure OS boot in UEFI mode, and only then enable Secure Boot.

Under Secure Boot every running code must be signed with the key which root is trusted by the UEFI BIOS. Usually everything is signed with a "user key", which is usually Microsoft's key (so Microsoft is your computer user, not you. You thought you own your computer? Poor you). Every code and even OS boot loader is signed with that key. Yes, even Linux boot loader (shim) is signed by Microsoft.

UEFI GOP is a graphics standard for UEFI. It must be 1) supported by the card 2) code signed to run under UEFI Secure Boot. If that't not a case, sorry, black screen.

But under that black screen OS might boot and when it boots successfully and runs its own (signed) graphics drivers it may re-enable screen, because at that stage OS taken control on hardware.

UEFI Compatibiliy Support Module (CSM) essentially represents services that legacy BIOS provides. So it enables to run systems not supporting UEFI.

If OS was installed under CSM, it thinks this machine is not UEFI compartible and installs in legacy mode. If you switch to UEFI it won't boot because this is not UEFI loader expects to see. If system was installed under UEFI, it detects that and configures BIOS so it wouldn't boot if you switch to CSM afterwards, because this is not legacy BIOS loader expects to see. It is possible to configure a system to boot either way, but it's not very easy and I don't know how to do this in Windows.

I don't know what this checkbox in CPU-Z means. But "Unknown Device" and "Unknown Driver" in the BIOS screen make me suspect that BIOS doesn't recognize card's UEFI support.

To further investigate, you can try to switch to UEFI mode, but don't enable Secure Boot yet. That'll enable you to run unsigned code in UEFI mode. If your card is UEFI capable but code is unsigned, that'll work. This will allow you to boot OS installer or recovery. On this stage, configure OS boot in UEFI mode, and only then enable Secure Boot.

In theory it is possible to roll over own keys, but it is cumbersome, because you need to extract all used binaries, sign, roll that into BIOS, and there is still no Windows software that does that. There is Linux software for that, though, but countless BIOS bugs make this path very painful. This is what why there was all that hum when UEFI and Secure Boot were introduced, but, you know, Microsoft monopolized a computer market, and users happily eat that pill and ask for more. Like Windows? Live with that and don't try rioting.

Source Link

Under Secure Boot every running code must be signed with the key which root is trusted by the UEFI BIOS. Usually everything is signed with a Microsoft key, which is called "user key" (so Microsoft is your computer user, not you), and they sign UEFI code for BIOS drivers and so on.

UEFI GOP is a graphics standard for UEFI. It must be 1) supported by the card 2) code signed to run under UEFI Secure Boot. If that't not a case, sorry, black screen.

But under that black screen OS might boot and when it boots successfully and runs its own (signed) graphics drivers it may re-enable screen, because at that stage OS taken control on hardware.

UEFI Compatibiliy Support Module (CSM) essentially represents services that legacy BIOS provides. So it enables to run systems not supporting UEFI.

If OS was installed under CSM, it thinks this machine is not UEFI compartible and installs in legacy mode. If you switch to UEFI it won't boot because this is not UEFI loader expects to see. If system was installed under UEFI, it detects that and configures BIOS so it wouldn't boot if you switch to CSM afterwards, because this is not legacy BIOS loader expects to see. It is possible to configure a system to boot either way, but it's not very easy and I don't know how to do this in Windows.

I don't know what this checkbox in CPU-Z means. But "Unknown Device" and "Unknown Driver" in the BIOS screen make me suspect that BIOS doesn't recognize card's UEFI support.

To further investigate, you can try to switch to UEFI mode, but don't enable Secure Boot yet. That'll enable you to run unsigned code in UEFI mode. If your card is UEFI capable but code is unsigned, that'll work. This will allow you to boot OS installer or recovery. On this stage, configure OS boot in UEFI mode, and only then enable Secure Boot.