ovmf: add secureboot bits from refkit

This patch adds a couple secureboot elements to ovmf that originated
from refkit. It includes a patch that adds a certificate to the ovmf's
enrolled keys, and an image recipe which calls the enrollkeys app.

Original work by Mikko Ylinen and Patrick Ohly.

Signed-off-by: California Sullivan <california.l.sullivan@intel.com>
Signed-off-by: Saul Wold <sgw@linux.intel.com>

1 files changed, 13 insertions, 0 deletions

diff --git a/common/recipes-core/ovmf/ovmf-shell-image-enrollkeys.bb b/common/recipes-core/ovmf/ovmf-shell-image-enrollkeys.bb
new file mode 100644
index 00000000..b20f6e58
--- /dev/null
+++ b/common/recipes-core/ovmf/ovmf-shell-image-enrollkeys.bb
@@ -0,0 +1,13 @@
+require recipes-core/ovmf/ovmf-shell-image.bb
+
+WKS_SEARCH_PATH_append = ":${COREBASE}/meta/recipes-core/ovmf"
+
+QB_DRIVE_TYPE = "/dev/vd"
+
+do_image_append() {
+    cat > ${IMAGE_ROOTFS}/startup.nsh << EOF
+EnrollDefaultKeys
+reset
+EOF
+
+}