Add "kern_guid=%U" to the secure boot kernel command-line template.

build_kernel_image.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # Helper script that generates the signed kernel image
 
 . "$(dirname "$0")/common.sh"
 
@@ skipping 110 matching lines @@
 init=/sbin/init
 add_efi_memmap
 boot=local
 rootwait
 ro
 noresume
 noswap
 i915.modeset=1
 loglevel=7
 cros_secure
+kern_guid=%U
 EOF
   WORK="${WORK} ${FLAGS_working_dir}/config.txt"
 
   # We sign the image with the recovery_key, because this is what goes onto the
   # USB key. We can only boot from the USB drive in recovery mode.
 
   # Create and sign the kernel blob
   vbutil_kernel \
     --pack "${FLAGS_to}" \
     --keyblock "${FLAGS_keys_dir}/recovery_kernel.keyblock" \
@@ skipping 47 matching lines @@
   info "Cleaning up temporary files: ${WORK}"
   rm ${WORK}
   rmdir ${FLAGS_working_dir}
 fi
 
 info "Kernel partition image emitted: ${FLAGS_to}"
 
 if [[ -f ${FLAGS_rootfs_hash} ]]; then
   info "Root filesystem hash emitted: ${FLAGS_rootfs_hash}"
 fi