GIGABYTE Latest Beta BIOS

[Bcknee]

thanks krato, i'm not expecting there to be a user accessible fix, but my expectations can be wrong, each oem firmware has its quirks


hey waltc, to simplify

gigabyte uefi says secure boot is enabled

os say secure boot is enabled

howeverrrrr: secure boot is not actually enabled

secure boot being disabled is okay (i'm not worried :)

secure boot being disabled when its meant to be enabled? that means gigabyte uefi is broken

my question is essentially just "does anybody know a fix?" (maybe i didnt set it up right, maybe i broke it, maybe somebody asked gigabyte to fix it before me)

not understanding me is okay!

I had it off for a long time not realizing I found these steps on reddit and it fixed it for me

Make sure you are booting OK with CSM disabled before changing Secure Boot settings. People have bricked their system by following the wrong steps.

I also had it saying enabled not Active - this is a BIOS glitch it's not really enabled

On the secure boot settings if it says Mode:User you should be able to simply Enable Secure Boot

Otherwise (if it says Mode:Setup)

- Disable Secure Boot if it says Enabled

- If it says Standard change to Custom

- Change Custom to Standard accepting Factory Defaults

- Enable Secure Boot

[Waltc]

I had it off for a long time not realizing I found these steps on reddit and it fixed it for me

Make sure you are booting OK with CSM disabled before changing Secure Boot settings. People have bricked their system by following the wrong steps.

I also had it saying enabled not Active - this is a BIOS glitch it's not really enabled

On the secure boot settings if it says Mode:User you should be able to simply Enable Secure Boot

Otherwise (if it says Mode:Setup)

- Disable Secure Boot if it says Enabled

- If it says Standard change to Custom

- Change Custom to Standard accepting Factory Defaults

- Enable Secure Boot

All of that is correct...it figures that people who use it would know how to use it...;) It's eminently Googleable. But your instructions here may be very helpful to some people!

@amEliza-- hope you get it sorted, Bcknee may have nailed it for you.

[amEliza]

you still haven't understood my post

secure boot is fully "enabled" and "active" but it can be disabled from within the os, that means it isn't secure boot, there's no boundary being enforced as physical access is no longer required, its a security vulnerability

its the same as having a locked door but a button to disable the lock is on both sides of the door, the door lock is engaged, the door lock works, but it doesn't actually keep anybody out
i don't need any help turning on the lock, the lock itself "works", but it serves no purpose because of the implementation

gigabyte has secure boot settings in the "published" hii, which they should not, other oems let you toggle publishing on or off, but it shouldn't be included at all
password protection would mitigate it but their uefi doesn't support password protection, trying to set one i get "Warning: BIOS does not support password feature"

what i dont know is how to remove a setting from the hii database, how to disable publishing of the hii database, or how to enable password protection of the nvram containing the database
i can do these things on other oem uefi but not gigabyte

update on this:

just got this tested on a similar board before reproducing same result my own, the secure boot settings specifically are blocked and don't actually take effect upon reboot

so i am wrong in that secure boot settings i hand waved about as a "big obvious issue" are actually fine on these boards (no doubt thanks to AMI)

that said, there are other security sensitive settings that can be changed and have similar or worse msi-incompetence level implications, i can still point them out to gigabyte and I will continue asking them to enable uefi password protection and a toggle for publishing hii resources (similar to asus intel boards)

ofc my ask of any mitigation for this issue in the mean time remains the same while waiting on gigabyte

[jwsg]

AMD Chipset drivers 5.05.16.529 https://www.amd.com/en/support/chips...ocket-am4/b550

Realtek 2.5Gb/s LAN drivers 1125.13 https://www.realtek.com/en/component...press-software

[diabetes]

According to Reddit, AM4 300/400/500 series chipset AGESA version 1.2.0.A finally fixes the dreaded VID_LIMIT (1.425/1.45V depending on the SKU) that nonsensically gets set when increasing EDC with PBO and was introduced with AGESA 1.2.0.4. Let's hope that Gigabyte manages to roll it out soonish!

[krato]

thanks krato, i'm not expecting there to be a user accessible fix, but my expectations can be wrong, each oem firmware has its quirks

What you try to say, I guess, is that it should not be possible to disable secure boot in any kind by os, or altering the keys? Dunno if this is still the expected behavior, or ever was. Like Walt said if you have physical access to someones running pc its over, even though secure boot is enabled. But what do you mean by "resetting to factory"? Do you have some self generated pk that is getting deleted? R u in setup mode again? Have you som good ol' "serious business" gigabyte software installed?

According to the specification, this results in the following scheme: PK and KEK can only be changed if:

In Setup Mode, when PKpub is signed with its associated PKpriv.
In User Mode, if the PKpub is signed with the current PKpriv of the firmware.

Im quoting from this, hopefully translatable, german url, https://www.thomas-krenn.com/de/wiki/UEFI_Secure_Boot, but my guess is that windows is allowed to do so since its in the db. If you dont want anybody being able to alter secure boot you should consider using full disk encryption. Also, you could create your own PK and use daisy chain loading of bootloaders, with refind perhaps. If u have some kind of linux installed you could investigate better, also reading linux wiki is always good https://wiki.archlinux.org/title/Uni...ce/Secure_Boot
But in the end, im just guessing here, since im noob.

Best regards, hope I could help

[xlollomanx]

According to Reddit, AM4 300/400/500 series chipset AGESA version 1.2.0.A finally fixes the dreaded VID_LIMIT (1.425/1.45V depending on the SKU) that nonsensically gets set when increasing EDC with PBO and was introduced with AGESA 1.2.0.4. Let's hope that Gigabyte manages to roll it out soonish!

I wonder if it fixes the CPU voltage drop after going to sleep too.

[stasio]

Hmmm, I wonder when Gigabyte will release bios updates for this:
https://thehackernews.com/2023/05/cr...bility-in.html

Already started.....Z790...X670...Z690

.....Addresses Download Assistant Vulnerabilities Reported by Eclypsium Research

[jwsg]

Although there's a long list of motherboards "affected" I don't recall seeing the "App center download and installation" option on my B550i which is still on BIOS F15 so I wonder if this issue was introduced in one of the later Betas BIOS for B550 X570 era boards - there's nothing listing which BIOS versions are affected only motherboard names and revisions

[krato]

Although there's a long list of motherboards "affected" I don't recall seeing the "App center download and installation" option on my B550i which is still on BIOS F15 so I wonder if this issue was introduced in one of the later Betas BIOS for B550 X570 era boards - there's nothing listing which BIOS versions are affected only motherboard names and revisions

I've read on reddit, https://www.reddit.com/r/MSI_Gaming/...e_b550_boards/, that this ocurred with the latest bios including new agesa 1.2.0.A. But its MSI, so gigabyte doesnt seem to be alone with this.

[jwsg]

On another thread Ive seen it mentioned as appearing on B550 Aorus Pro AX with F17c which was the update for AGESA V2 1.2.0.8 a couple of months ago

This reinforces the idea that the issue was added in recent beta BIOS but there's nothing on the internet (or from Gigabyte) to say it only affects certain BIOS versions despite the number of news items posted - I don't want to flash a new beta (when it appears for B550i) to fix a problem that's not there on my F15 from last year.

[krato]

I wonder if it fixes the CPU voltage drop after going to sleep too.

For me, ReBar is also not working. This always 3400 Mhz at 41° is kind of nice i think. No 70 degrees celcius at summer :D. If final bios is out I might give the eco mode a trie with optimization.

[baldersz]

New F17e BIOS posted for B550I AORUS PRO AX (rev. 1.0):

• Dated Jun 01, 2023
• Addresses download assistant vulnerabilities reported by Eclypsium Research

No mention of AGESA update to 1.2.0.A

https://download.gigabyte.com/FileLi...ro-ax_f17e.zip

Edit: more info on the vulnerability here https://www.tomshardware.com/news/gi...pdate-backdoor

[AdiSimpson]

I wonder if it fixes the CPU voltage drop after going to sleep too.

No, its not fixed. AMD doesn't care.

[pilsener69]

GIGABYTE Fortifies System Security with Latest BIOS Updates and Enhanced Verification

https://www.gigabyte.com/Press/News/2091