Does gnu-efi inside shim may cause incompatibility with gnu-efi used for compilation with grub when secure boot enabled?

[Dvergatal]

Hi all,
just like in the subject I have encountered strange behavior.

Namely I'm building my OS within yocto project scarthgap release with secure boot enabled. Now for that purpose I'm using meta-secure-core which has shim-15.8 and it contains gnu-efi-3.0.12 - which is really old - but in openembeded-core it is already 3.0.17.

Now, what I have encountered is this strange bug Wind-River/meta-secure-core#79

TL:DR - grub hangs when disconnecting USB HID device e.g. keyboard (in my case the issue is more dramatic as we are using LTE modem connected with m.2 slot which is behaving like some kind of USB hub and it reconnects automatically and after couple of seconds the hang is occuring)

Now what I did to fix it was reverting back shim package to 15.2 which still supports external gnu-efi package and downgraded gnu-efi package to 3.0.14 which was used before in yocto kirkstone release and everything was working properly in it and it started to work again.

Now I know that you stopped to use external gnu-efi, but is it possible that maybe due to the difference in gnu-efi between shim and grub it may behave like that?

[gmbr3]

GNU-EFI 3.0.17 is a broken release, please use 3.0.18+ (4.0 due soon)

[Dvergatal]

But shim is not compiling against 3.0.18... It only compiles against the one inside.

[gmbr3]

Yeah I know, just that openembedded needs to drop that gnu-efi version ASAP
Shim's gnu-efi is slightly a mess as it built on top of 3.0.11 but has backported some things from the main branch. This sounds like some kind of weird firmware bug to me but I'm not an expert in that area.

[Dvergatal]

Yeah I know, just that openembedded needs to drop that gnu-efi version ASAP

In master it is dropped not in scarthgap.

Shim's gnu-efi is slightly a mess as it built on top of 3.0.11 but has backported some things from the main branch. This sounds like some kind of weird firmware bug to me but I'm not an expert in that area.

With shim-15.2 and gnu-efi-3.0.14 it doesn't happen.... Only when shim uses this internal gnu-efi and openembedded 3.0.17 and this happens even on intel's NUC7.

I tested 3.0.18 and it hanged before even entering grub but i think i will try to test one more thing.