Shim bootloader hangs before Grub menu with 4K monitor

[Stephen Gildea]

I recently swapped out my WUXGA monitor for a much bigger 4K monitor.
Most unexpectedly, I found that this prevented my workstation from booting.

When I start up, I see the power-on splash screen from the workstation
motherboard. I should next see the Grub menu, but instead I get a
blank screen, and the boot-up hangs indefinitely.

If I unplug my monitor for the first few seconds of a power-up, until
the Grub menu has come and gone, I can re-plug the monitor and watch
the rest of the boot-up into the initramfs and my system.

If I use my old, small monitor, boot-up works.

I solved the problem by using efibootmgr to change the boot loader
from /EFI/ubuntu/shimx64.efi to /EFI/ubuntu/grubx64.efi. With this
change, the system boots properly with the new monitor: I see power-on
splash screen, Grub menu, initramfs messages, etc.

For all the above, Secure Boot is enabled by my firmware.
Another way I can fix the boot hang is to turn off Secure Boot.
Then my workstation boots normally with shimx64.efi.
(It is counter-intuitive to me that Shim is the boot loader blocked
by Secure Boot, but that's what I observe.)

To summarize: of the 3 variables I explored, the only combination
that fails is Secure Boot, a 4K monitor, and shimx64.efi.

It seems someone else had the same problem with a new monitor in 2016:
https://ubuntuforums.org/showthread.php?t=2301071&page=37

I am running Ubuntu 18.04.4 ("Bionic").
My motherboard is an ASUS P10S WS, firmware version 3801.
grubx64.efi is from grub-efi-amd64-signed version 1.93.16+2.02-2ubuntu8.15
shimx64.efi is from shim-signed version 1.37~18.04.3+15+1533136590.3beb971-0ubuntu1
I also have shim version 15+1533136590.3beb971-0ubuntu1 installed.

I am happy to run experiments on my hardware for you.

[Julian Andres Klode (juliank)]

Is this still an issue with shim 15+1552672080.a4a1fbe-0ubuntu2 from the proposed pocket/groovy?

[Stephen Gildea (stepheng+launchpad)]

The new shim works for me.

I presume comment #1 is asking me to test the *signed* shim from
groovy package shim-signed, since the unsigned shim will not boot
in Secure Boot mode, the interesting case to test.

Thus, I tested shimx64.efi.signed from groovy's shim-signed package,
version 1.43+15+1552672080.a4a1fbe-0ubuntu2. It boots for me, even in
the case where the older (2018, Bionic) shim-signed EFI file would not.

Since this new version boots system configurations that would otherwise
hang, I encourage you to backport it to Focal.

[Julian Andres Klode (juliank)]

It's already in focal-proposed, hence I mentioned proposed pocket. Anyway it's fixed in groovy, so marking done.