How do I fix broken boot after shim update?

Question

I have a MacBook Pro (15-inch, Late 2008) that was running Kubuntu 20.04 until yesterday.

The system prompted me that a software update was available. As best I can recall, the packages updated were shim, shim-(something) and maybe one more. I waited for both the software updater and the separate grub updater to finish and prompt me to restart before I did so. Now when I try to boot, I get a black screen that reads:

Failed to set MokListRT: Invalid Parameter
Could not create MokListRT: Invalid Parameter
Importing MOK states has failed: import_mok_state() failed
: Invalid Parameter
Continuing boot since secure mode is disabled_

But the boot does not continue.

I have spent much of today searching high and low for possible solutions. The one that seems most promising to me is this comment on an Ubuntu grub2 package bug. The comment says to remove "shim/shim-signed/mokutil", by which I think the commenter means to remove all three of those packages. They seem to be related to UEFI secure boot, something a MacBook Pro of mine's vintage does not support. I don't know why my system would even have those packages in the first place, to then be prompting me to update them.

But I can't boot into Kubuntu to remove them. The boot process does not even show me the grub menu, which I usually do see briefly before being prompted for the encryption key. I'm assuming disk encryption is not the issue here since the process does not seem to be getting that far.

I still have an OS X partition as well, which I can boot into via by holding down the option key to get to the Mac boot loader (and which does not show my Kubuntu partition as an option). In OS X, I downloaded the latest Kubuntu .iso file, verified its SHA256 hash and carefully followed the instructions in the Ubuntu Create a bootable USB stick on macOS tutorial.

When I restart, hold down the option key to get to the Mac boot loader and choose this supposedly bootable USB stick I've created, I do get the grub menu. When I choose either the default Kubuntu or the safe graphics mode option, I get:

[    1.142769] Initramfs unpacking failed: Decoding failed
[   61.214455] rcu: INFO: rcp_sched detected stalls on CPUs/tasks:
[   61.214508] rcu: o1-...!: (0 ticks this GP) idle=894/0/0x0 softirq=355/355 fqs=0
[   61.215558] rcu: rcp_sched kthread starved for 15002 jiffies! g=835 f0x0 RCU_GP_WAIT_FQS(5) ->state=0x402 ->cpu=1
[   61.215620] rcu: RCU grace-period thread stack dump:

The last four lines repeat every few minutes until I power down.

So I can't boot my regular Kubuntu partition, and I can't boot the USB stick.

How do I get booted back into my Kubuntu system?

Solution

The process of carefully writing up and posting my question must have jarred something in my brain that allowed me to actually see something that had been appearing in search results multiple times yesterday:

0015522: Machine with older uefi fw doesn't boot with newer shim (like on Apple 2008 iMac) - CentOS Bug Tracker

Specifically, I did what was in essence his Workaround #2, except I had to modify it to boot into my OS X partition, and then as root create /Volumes/efi, use diskutil to identify the EFI partition, mount it and cd into /Volumes/efi/EFI/ubuntu. And rather than copy grub64x.efi over shimx64.efi, as he wrote, I first moved shimx64.efi to my Desktop directory for temporary safe-keeping, just in case I wanted to revert this change I was making. Then I copied grub64x.efi to shimx64.efi. Then umount gave me some kind of error but suggested I try diskutil unmount, which I did, and which worked. Then I rebooted and got the usual (for me) grub menu, encryption password prompt and finally back to Kubuntu, where I have now removed the shim and shim-signed packages.

It appears that removing the shim package did not remove the files it put in /boot/efi/EFI/ubuntu/ and /boot/efi/EFI/Boot-backup/. I am going to leave them for now.

I am also going to post a comment on the Ubuntu bug I linked to in my question. I called it a grub2 package bug, but I now see its status has been changed to invalid in grub2, while also having a status of incomplete in shim and confirmed in shim-signed. There have been many comments, but there's still seemingly a lot of confusion, and no one seems to have made the connection yet to the fix the CentOS bug reporter figured out. So I will post my experience to the Ubuntu bug, and surely they'll get it fixed for everyone else.

Comments

[Yuri Sucupira]

I had a similar issue with my 13" mid-2009 Apple Macbook Pro and solved it by doing what I explain here