Comment # 7 on bug 961853 from James Fehlig

(In reply to Gary Ching-Pang Lin from comment #6)
> -drive
> if=pflash,format=raw,readonly,file=/usr/share/qemu/ovmf-x86_64-code.bin \
> -drive if=pflash,format=raw,file=ovmf-x86_64-vars.bin

This is exactly how libvirt invokes qemu when domain configuration contains
<loader> and <nvram>. E.g.

-drive
file=/usr/share/qemu/ovmf-x86_64-suse-code.bin,if=pflash,format=raw,unit=0,readonly=on
-drive
file=/var/lib/libvirt/qemu/nvram/test-uefi_VARS.fd,if=pflash,format=raw,unit=1

> Besides the code/vars, there are several different flavors of ovmf for
> secure boot.
> 
> ovmf-x86_64.bin is the "pure" OVMF without adding any keys.
> ovmf-x86_64-{ms,suse,opensuse,opensuse-4096}.bin are almost the same as
> ovmf-x86_64.bin except the preloaded vendor keys. ovmf-86_64-ms.bin is
> closest to the shipping machines since it's contains the Microsoft UEFI keys
> and the black list, so it's recommended to use "ms" if you want to emulate
> the environment of the shipping machines.

While a good description of the flavors, it doesn't answer the question of
which flavor is the best default for openSUSE and SLE. Being openSUSE, I
*think* the opensuse flavor is an appropriate default for openSUSE.

Antoine, can you recommend a default flavor for our SLE customers?