---
title: 启动机密虚拟机
description: "当前virtCCA仅支持Kernel+rootfs分离方式启动，云上场景下，虚拟机的启动主要采用grub boot的方式（需要将EDK2+Kernel挂载到同一个qcow镜像中），通过这种方式满足客户的使用方式。"
url: https://www.hikunpeng.com/document/detail/zh/kunpengboostkithistory/250rc2/confidt/kunpengtee_16_0046.html
sourcePath: /source/zh/kunpengboostkithistory/250rc2/confidt/kunpengtee_16_0046.html
indexId: a59f909dfc330e6880853e1a54251429fa3e537dbfd93f8d313121f5c09bcdc672
---
# 启动机密虚拟机

当前virtCCA仅支持Kernel+rootfs分离方式启动，云上场景下，虚拟机的启动主要采用grub boot的方式（需要将EDK2+Kernel挂载到同一个qcow镜像中），通过这种方式满足客户的使用方式。

在启动机密虚拟机前请您先查看宿主机是否有virbr0网桥，如果没有可使用如下命令添加网桥virbr0。
```
brctl addbr virbr0
```


#### 方式一：使用QEMU命令行启动机密虚拟机

新建run-qemu.sh文件并将以下内容拷贝进文件。- launch_uefi为启动机密虚拟机，launch_uefi_normal为启动普通虚拟机。
- QEMU、efi.fd、qcow2的文件路径需替换为实际路径。
- 虚拟机如果需要连接网络，新建qemu-ifup文件并将以下内容拷贝进文件，其中“switch = virbr0”中的网桥根据实际配置。

```
#!/bin/sh
set -x
switch=virbr0
if [ -n "$1" ];then
ip tuntap add $1 mode tap user `whoami`
ip link set $1 up
sleep 1s
ip link set $1 master $switch
exit 0
else
echo "Error: no interface specified"
exit 1
fi
```


```
#!/bin/sh
MAC_ADDR_0=DE:AD:BE:EF:FA:28
function launch_uefi()
{
cd /home/uefi/qemu/build
taskset -c 0 ./qemu-system-aarch64 \
-M virt,usb=off,gic-version=host,accel=kvm,kvm-type=cvm \
--enable-kvm \
-bios /home/uefi/QEMU_EFI.fd \
-cpu host \
-m 2048 \
-smp 1 \
-no-user-config \
-nographic \
--no-reboot \
-object tmm-guest,id=tmm0,num-pmu-counters=1 \
-drive if=none,file=/home/uefi/openEuler-24.03-SP1-aarch64.qcow2,format=qcow2,id=disk01 \
-device virtio-blk-pci-non-transitional,drive=disk01,num-queues=1,bootindex=1,iommu_platform=on \
-netdev tap,id=vnet,ifname=tap0,script=/home/uefi/qemu-ifup,queues=2 \
-device virtio-net-pci-non-transitional,netdev=vnet,iommu_platform=on
}
function launch_uefi_normal()
{
cd /home/uefi/qemu/build
./qemu-system-aarch64 \
-M virt,usb=off,gic-version=host,accel=kvm \
--enable-kvm \
-bios /home/uefi/QEMU_EFI.fd \
-cpu host \
-m 2048 \
-smp 1\
-no-user-config \
-nographic \
--no-reboot \
-drive if=none,file=/home/uefi/openEuler-24.03-SP1-aarch64.qcow2,format=qcow2,id=disk01 \
-device virtio-blk-pci-non-transitional,drive=disk01,num-queues=1,bootindex=1 \
-netdev tap,id=vnet,ifname=tap0,script=/home/uefi/qemu-ifup,queues=2 \
-device virtio-net-pci,netdev=vnet,mac=${MAC_ADDR_0}
}
if [ "$1" == "u" ]
then
launch_uefi
fi
# Launch cVM to test KATA
if [ "$1" == "nu" ]
then
launch_uefi_normal
fi
```


#### 方式二：使用libvirt启动机密虚拟机

新建cvm.xml文件，拷贝如下内容并将QEMU、efi.fd、qcow2文件路径替换为实际路径。
```
<domain type='kvm' xmlns:qemu="http://libvirt.org/schemas/domain/qemu/1.0">
<name>cvm-uefi</name>
<memory unit='GiB'>8</memory>
<vcpu placement='static'>4</vcpu>
<cputune>
<vcpupin vcpu='0' cpuset='0'/>
<vcpupin vcpu='1' cpuset='1'/>
<vcpupin vcpu='2' cpuset='2'/>
<vcpupin vcpu='3' cpuset='3'/>
<emulatorpin cpuset='0-3'/>
</cputune>
<numatune>
<memnode cellid='0' mode='strict' nodeset='0'/>
</numatune>
<os>
<type arch='aarch64' machine='virt'>hvm</type>
<loader readonly='yes' type='rom'>/home/uefi/QEMU_EFI.fd</loader>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<gic version='3'/>
</features>
<cpu mode='host-passthrough'>
<topology sockets='1' dies='1' clusters='1' cores='4' threads='1'/>
<numa>
<cell id='0' cpus='0-3' memory='8' unit='GiB'/>
</numa>
</cpu>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<devices>
<emulator>/home/uefi/qemu/build/qemu-system-aarch64</emulator>
<console type='pty'/>
<disk type='file' device='disk' model='virtio-non-transitional'>
<driver name='qemu' type='qcow2' queues='2' cache='none' iommu='on'/>
<source file='/home/uefi/openEuler-24.03-SP1-aarch64.qcow2'/>
<target dev='vda' bus='virtio'/>
</disk>
<interface type='bridge'>
<source bridge='virbr0'/>
<driver iommu='on'/>
<model type='virtio-non-transitional'/>
</interface>
</devices>
<launchSecurity type='cvm'/>
<qemu:commandline>
<qemu:arg value='-object'/>
<qemu:arg value='tmm-guest,id=tmm0,num-pmu-counters=1'/>
</qemu:commandline>
</domain>
```