If you can still boot to Ubuntu with an older kernel (one that is signed), here's what you can do:
1) Download http://archive.ubuntu.com/ubuntu/dists/xenial-updates/main/uefi/grub2-amd64/2.02~beta2-36ubuntu3.20/grubx64.efi.signed.
2) Copy grubx64.efi.signed over /boot/efi/EFI/ubuntu/grubx64.efi: sudo cp grubx64.efi.signed /boot/efi/EFI/ubuntu/grubx64.efi
3) Reboot; you should now be able to load the new unsigned kernel that allows fixing firmware / SPI.
4) Once you're satisfied that things work; boot to Ubuntu with a standard, signed kernel, and re-install the right GRUB version for your system:
sudo grub-install
If you can still boot to Ubuntu with an older kernel (one that is signed), here's what you can do:
1) Download http:// archive. ubuntu. com/ubuntu/ dists/xenial- updates/ main/uefi/ grub2-amd64/ 2.02~beta2- 36ubuntu3. 20/grubx64. efi.signed.
2) Copy grubx64.efi.signed over /boot/efi/ EFI/ubuntu/ grubx64. efi: EFI/ubuntu/ grubx64. efi
sudo cp grubx64.efi.signed /boot/efi/
3) Reboot; you should now be able to load the new unsigned kernel that allows fixing firmware / SPI.
4) Once you're satisfied that things work; boot to Ubuntu with a standard, signed kernel, and re-install the right GRUB version for your system:
sudo grub-install