docs/cosa/run: Add PXE with Shim and UEFI Secure Boot example

Fixes: coreos#3804

docs/cosa/run.md

@@ -257,6 +257,40 @@ $ cosa run -c --netboot tmp/pxelinux/pxelinux.0 -m 4096
 
 See [this section](https://docs.fedoraproject.org/en-US/fedora-coreos/live-booting/#_booting_via_pxe) of the official docs for more info.
 
+### PXE with Shim and UEFI Secure Boot
+
+1. Download a kernel, initramfs, rootfs and shim binary
+2. Combine initramfs + roots into a single file: `cat kernel.img initramfs.img > combined.img`
+3. Create an empty disk image (bug in kola): `touch disk.img`
+4. Setup `grub.cfg`
+5. Netboot the result
+
+```
+$ tree pxe
+pxe
+├── disk.img
+├── grub.cfg
+├── pxelinux.cfg
+│   └── default
+├── rhcos-4.14.0-x86_64-live-combined.x86_64.img
+├── rhcos-4.14.0-x86_64-live-initramfs.x86_64.img
+├── rhcos-4.14.0-x86_64-live-kernel-x86_64
+├── rhcos-4.14.0-x86_64-live-rootfs.x86_64.img
+└── shim.efi
+
+$ cat pxe/grub.cfg
+default=0
+timeout=1
+menuentry "CoreOS (BIOS/UEFI)" {
+        echo "Loading kernel"
+        linux /rhcos-4.14.0-x86_64-live-kernel-x86_64 ignition.firstboot ignition.platform.id=metal console=ttyS0
+        echo "Loading initrd"
+        initrd rhcos-4.14.0-x86_64-live-combined.x86_64.img
+}
+
+$ cosa run -c --netboot pxe/shimx64.efi -m 4096 --qemu-firmware uefi-secure --qemu-image pxe/disk.img
+```
+
 ### GRUB
 
 Create the netboot dir if not already created: