UEFI doesn't load fwupd on Lenovo X1 Carbon 7th

[Roland Dreier]

I have a 7th gen Lenovo X1 Carbon with Ubuntu up-to-date on 21.04, and fwupdmgr shows:

$ fwupdmgr update
Devices with no available firmware updates:
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI Device Firmware
 • UEFI dbx
Devices with the latest available firmware version:
 • Thunderbolt host controller
Upgrade available for Embedded Controller from 0.1.15 to 0.1.16

however, if I answer yes to the update and reboot:

20R1000SUS must remain plugged into a power source for the duration of the update to avoid damage. Continue with update? [Y|n]: y
Downloading… [***************************************]
Decompressing… [***************************************]
Authenticating… [***************************************]
Authenticating… [***************************************]
Updating Embedded Controller…************************************]
Scheduling… [***************************************]
Successfully installed firmware
 • KXG6AZNV512G TOSHIBA
 • Prometheus
 • Prometheus IOTA Config
 • System Firmware
 • UEFI Device Firmware

An update requires a reboot to complete. Restart now? [y|N]: y

then the system reboots, but UEFI / grub just boots back into Ubuntu. Even if I select the Linux firmware update manually from the UEFI boot menu, the system just drops into a grub menu and I can only boot back into Linux. After rebooting the EC is not updated and fwupdmgr offers the same upgrade again.

ProblemType: Bug
DistroRelease: Ubuntu 21.04
Package: shim (not installed)
ProcVersionSignature: Ubuntu 5.11.0-18.19-generic 5.11.17
Uname: Linux 5.11.0-18-generic x86_64
.proc.sys.kernel.moksbstate_disabled: Error: [Errno 2] No such file or directory: '/proc/sys/kernel/moksbstate_disabled'
ApportVersion: 2.20.11-0ubuntu65.1
Architecture: amd64
CasperMD5CheckResult: unknown
CurrentDesktop: ubuntu:GNOME
Date: Tue Jun 1 08:14:43 2021
InstallationDate: Installed on 2020-02-27 (460 days ago)
InstallationMedia: Ubuntu 20.04 LTS "Focal Fossa" - Alpha amd64 (20200220)
ProcEnviron:
 TERM=xterm-256color
 PATH=(custom, no user)
 XDG_RUNTIME_DIR=<set>
 LANG=en_US.UTF-8
 SHELL=/bin/bash
SecureBoot: 6 0 0 0 1
SourcePackage: shim
UpgradeStatus: Upgraded to hirsute on 2021-05-14 (18 days ago)