---
title: 配置机密虚拟机
description: "按照上述流程搭建好环境后，就可以启动机密虚拟机。"
url: https://www.hikunpeng.com/document/detail/zh/kunpengcctrustzone/ccakit/fg-tz/kunpengtee_16_0054.html
sourcePath: /source/zh/kunpengcctrustzone/ccakit/fg-tz/kunpengtee_16_0054.html
indexId: 85afc64b7464873e275cadb2bf68d71132d7548831274e37c1e8097b4bcd2c8866
---
# 配置机密虚拟机

按照上述流程搭建好环境后，就可以启动机密虚拟机。

#### libvirt方式启动

1. 目标环境下载qcow2镜像。

```
cd /home
wget https://repo.openeuler.org/openEuler-24.03-LTS-SP3/virtual_machine_img/aarch64/openEuler-24.03-LTS-SP3-aarch64.qcow2.xz
```


2. 首先启动普通虚拟机的nvm.xml，修改guest内核启动参数。

```
<domain type='kvm' xmlns:qemu="http://libvirt.org/schemas/domain/qemu/1.0">
<name>nvm</name>
<memory unit='GiB'>8</memory>
<vcpu placement='static'>4</vcpu>
<cputune>
<vcpupin vcpu='0' cpuset='0'/>
<vcpupin vcpu='1' cpuset='1'/>
<vcpupin vcpu='2' cpuset='2'/>
<vcpupin vcpu='3' cpuset='3'/>
<emulatorpin cpuset='0-3'/>
</cputune>
<numatune>
<memnode cellid='0' mode='strict' nodeset='0'/>
</numatune>
<os>
<type arch='aarch64' machine='virt'>hvm</type>
<loader readonly='yes' type='rom'>/home/edk2/Build/ArmVirtQemu-AARCH64/RELEASE_GCC5/FV/QEMU_EFI.fd</loader>
<boot dev='hd'/>
</os>
<features>
<acpi/>
<gic version='3'/>
</features>
<cpu mode='host-passthrough'>
<topology sockets='1' dies='1' clusters='1' cores='4' threads='1'/>
<numa>
<cell id='0' cpus='0-3' memory='8' unit='GiB'/>
</numa>
</cpu>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<devices>
<emulator>/home/qemu/build/qemu-system-aarch64</emulator>
<console type='pty'/>
<disk type='file' device='disk' model='virtio-non-transitional'>
<driver name='qemu' type='qcow2' queues='2' cache='none' iommu='on'/>
<source file='/home/openEuler-24.03-SP3-cvm-aarch64.qcow2'/>
<target dev='vda' bus='virtio'/>
</disk>
<interface type='bridge'>
<source bridge='virbr0'/>
<driver iommu='on' event_idx='off'/>
<rom bar='off' file=''/>
<model type='virtio-non-transitional'/>
</interface>
</devices>
</domain>
```


3. 启动机密虚拟机。创建并编辑libvirt启动机密虚拟机的cvm.xml，编辑内容如下：

```
<domain type='kvm' xmlns:qemu="http://libvirt.org/schemas/domain/qemu/1.0">
<name>cvm</name>
<memory unit='GiB'>8</memory>
<vcpu placement='static'>4</vcpu>
<cputune>
<vcpupin vcpu='0' cpuset='0'/>
<vcpupin vcpu='1' cpuset='1'/>
<vcpupin vcpu='2' cpuset='2'/>
<vcpupin vcpu='3' cpuset='3'/>
<emulatorpin cpuset='0-3'/>
</cputune>
<numatune>
<memnode cellid='0' mode='strict' nodeset='0'/>
</numatune>
<os>
<type arch='aarch64' machine='virt'>hvm</type>
<loader readonly='yes' type='rom'>/home/edk2/Build/ArmVirtQemu-AARCH64/RELEASE_GCC5/FV/QEMU_EFI.fd</loader>
<boot dev='hd'/>
</os>
<features>
<gic version='3'/>
</features>
<cpu mode='host-passthrough'>
<topology sockets='1' dies='1' clusters='1' cores='4' threads='1'/>
<numa>
<cell id='0' cpus='0-3' memory='8' unit='GiB'/>
</numa>
</cpu>
<on_poweroff>destroy</on_poweroff>
<on_reboot>restart</on_reboot>
<on_crash>destroy</on_crash>
<devices>
<emulator>/home/qemu/build/qemu-system-aarch64</emulator>
<console type='pty'/>
<disk type='file' device='disk' model='virtio-non-transitional'>
<driver name='qemu' type='qcow2' queues='2' cache='none' iommu='on'/>
<source file='/home/openEuler-24.03-SP3-cvm-aarch64.qcow2'/>
<target dev='vda' bus='virtio'/>
</disk>
<interface type='bridge'>
<source bridge='virbr0'/>
<driver iommu='on' event_idx='off'/>
<rom bar='off' file=''/>
<model type='virtio-non-transitional'/>
</interface>
</devices>
<launchSecurity type='cca'/>
</domain>
```


  在nvm.xml配置的基础上，cvm.xml新增： <launchSecurity type='cca'/> 或使能鲲鹏CCA加速API，如使能内存大页： <launchSecurity type='cca' hisi-cca-enable='yes'/> 对于频繁启动销毁机密虚拟机等压力测试场景，推荐关闭virtio-net的event_idx机制以提升virtio网络稳定性，配置示例如下。 <interface type='bridge'> <source bridge='virbr0'/> <driver iommu='on' event_idx='off'/> <model type='virtio-non-transitional'/> </interface>

4. 使用virsh define定义虚拟机配置。

```
virsh define cvm.xml
```


5. 执行以下命令查看虚拟机定义。

```
virsh list --all
```


  Name与xml中<name>cvm</name>一致。

6. 关闭SELinux，详情可参见SELinux配置。
7. 执行以下命令启动机密虚拟机。

```
virsh start cvm
```


8. 执行以下命令进入机密虚拟机串口。

```
virsh console cvm
```


  镜像默认用户为root。


#### 使能多NUMA

在libvirt方式启动的步骤2创建的机密虚拟机xml基础上修改配置。

1. 支持虚拟NUMA node绑定一个物理NUMA范围。虚拟机安全内存将会在指定NUMA范围内分配，libvirt虚拟机配置中关于绑定物理NUMA范围示例如下。

```
<numatune>
<memnode cellid='0' mode='strict'
nodeset='1-3
' />
</numatune>
```


  对于上述配置，虚拟机安全内存将会尝试在NUMA 1、2、3上分配。等价写法为：nodeset='1,2,3'。

2. 支持在多NUMA上分配安全内存，以支持启动大虚拟机，配置示例如下。

```
<numatune>
<memnode cellid='0' mode='strict' nodeset='0' />
<memnode cellid='1' mode='strict' nodeset='3' />
</numatune>
<cpu mode='host-passthrough'>
<topology sockets='1' dies='1' clusters='1' cores='8' threads='1'/>
<numa>
<cell id='0' cpus='0-3' memory='4' unit='GiB'/>
<cell id='1' cpus='4-7' memory='4' unit='GiB'/>
</numa>
</cpu>
```


  - 对于上述配置，机密虚拟机将在NUMA 0和NUMA 3上各分配4GB安全内存。
  - 配置示例中vCPU的数量为8，cvm.xml中对应配置修改如下：<vcpu placement='static'>8</vcpu>。