Direct Access of cVMs to the KAE Device on OpenStack

OpenStack enables cVMs to directly access the KAE device on a server that is equipped with virtCCA and KAE capabilities.

1. Configure a certificate for compute nodes by following instructions in Importing the KAE License File.
2. Configure a QCOW2 image that has the KAE driver inside.
   1. If the current OS uses a user-compiled kernel, specify the kernel source code path.

      ln -s {kernel_path} /usr/src/kernels/$(uname -r)

   2. Download the QCOW2 image creation script.

      git clone https://gitee.com/openeuler/virtCCA_sdk.git

   3. Add the -k parameter when invoking the script, and then the KAE driver is downloaded and compiled. Add the KAE driver to the image and configure it to be loaded upon system startup.

      cd virtCCA_sdk/cvm-image-rewriter/ 
      sh create-oe-image.sh -v 24.03-LTS-SP2 -k

   4. Upload the image.

      openstack image create kae --file ./openEuler-24.03-LTS-SP2-cvm-aarch64.qcow2 --disk-format qcow2 --container-format bare --public

3. Create a cVM directly connected to the KAE device.
   1. Create a cVM flavor for the direct connection. Set the number of KAE VFs (${vf_nums}).

      openstack flavor create kae-flavor \
      --vcpus 4 --ram 8192 --disk 50 \
      --property trait:HW_CPU_AARCH64_HISI_VIRTCCA=required \
      --property trait:HW_CPU_AARCH64_HISI_KAE=required \
      --property hw:mem_secure=true \
      --property sw:qemu_cmdline="tmm-guest,id=tmm0,num-pmu-counters=1,kae=${vf_nums}"

      

      • Each cVM supports a maximum of 11 KAE VFs. The value of ${vf_nums} must be greater than 0 and less than or equal to 11.
      • A single compute node, that is, a single physical server, supports a maximum of 48 KAE VFs.
   2. Create a cVM that can directly access the KAE device.

      openstack server create --image kae \
      --flavor kae-flavor \
      --network public-network \
      kae_server

   3. After the cVM is deployed, run the virsh command on the compute node to access the VM console. The KAE device is displayed.

      virsh console ${domain_id}
      ll /sys/class/uacce/