Hello Laszlo, Happy New Year! I may need to pick your brain a little regarding an issue someone testing AMD SEV ran into with Kata. Basically, here are the questions I have: 1) Is it OK to pass an OVMF firmware to the -boot option of qemu? What about SecureBoot in that case? 2) Are there any expected behavioral differences between booting with the -bios option and using a -drive if=pflash option? In particular, anything that could prevent SEV from activating in the guest kernel? 3) Knowing that in the Kata case, we don't care about anything persisting across reboots, is there any problem passing only the OVMF_CODE.fd image readonly using the -drive option, without having an OVMF_VARS.fd? Asking to see if we need to create an OVMF_VARS.fd for each container. If you need a bit of context: https://github.com/kata-containers/kata-containers/issues/1231 and http://lists.katacontainers.io/pipermail/kata-dev/2021-January/001638.html Thanks! -- Cheers, Christophe de Dinechin (IRC c3d)