Open Stack

Hello Laszlo,


Happy New Year!

I may need to pick your brain a little regarding an issue someone testing
AMD SEV ran into with Kata.

Basically, here are the questions I have:

1) Is it OK to pass an OVMF firmware to the -boot option of qemu?
   What about SecureBoot in that case?

2) Are there any expected behavioral differences between booting with the
   -bios option and using a -drive if=pflash option? In particular, anything
   that could prevent SEV from activating in the guest kernel?

3) Knowing that in the Kata case, we don't care about anything persisting
   across reboots, is there any problem passing only the OVMF_CODE.fd image
   readonly using the -drive option, without having an OVMF_VARS.fd? Asking
   to see if we need to create an OVMF_VARS.fd for each container.

If you need a bit of context:
https://github.com/kata-containers/kata-containers/issues/1231 and
http://lists.katacontainers.io/pipermail/kata-dev/2021-January/001638.html

Thanks!

--
Cheers,
Christophe de Dinechin (IRC c3d)