Cryptographic module based on Linux kernel PCIe EP framework

Abstract

The invention discloses a cryptographic module based on a Linux kernel PCIe EP framework, and relates to the technical field of safety communication, the cryptographic module is based on a PCIe IP module in a DM mode in an SOC chip, a cryptographic algorithm engine and other modules, in the mode, SOC PCIe can be set to be in an RC mode or an EP mode, and through designing the Linux kernel-based PCIe EP framework, a DMA controller drive, a cryptographic algorithm engine drive, a service daemon process and a host drive, the safety of the system is improved. The basic functions of password module authority management, key management, password operation and the like are completed, and the extended functions of password module state monitoring, accurate fault positioning, timely abnormality processing, hot upgrading and the like are achieved.

Description

Technical Field

[0001] The present invention relates to the field of secure communication technology, and more particularly to a cryptographic module based on a Linux kernel PCIe EP framework. Background Art

[0002] The rapid development and widespread adoption of informatization, digitalization, AI, and deep learning have heightened demands for information and data security. Cryptography technology ensures data security throughout its entire lifecycle through measures such as identity authentication, data encryption, and trusted computing. Cryptographic products, such as PCIe cryptographic modules, are ideal for offloading cryptographic services.

[0003] The hardware architecture of traditional PCIe cryptographic modules is generally based on the PCIe high-speed bus interface, main control chip, and cryptographic algorithm chip as the core, and is based on peripheral circuits such as storage and power supply. Specifically, it includes FPGA, DSP, TRNG, storage, Prom chip, USB controller, cryptographic algorithm chip and power chip. Among them, FPGA and DSP are the core of the entire architecture, respectively assuming the roles of high-speed bus and main control. The FPGA chip implements the interface connecting to the PCIe bus, controls the cryptographic algorithm chip, built-in DMA controller and other logical functions, and is connected to the DSP parallel interface. As the main control of the cryptographic module, DSP controls the various modules on the cryptographic module to work in sequence. In the peripheral circuit, storage is used to store DSP firmware and keys, Prom chip is used to configure FPGA, and USB controller is used to connect to UKEY to realize authority management.

[0004] The existing PCIe cryptographic modules implemented using FPGA and main control chips have the following disadvantages:

[0005] 1) Complex hardware structure:

[0006] In addition to FPGA and DSP core chips, in order to support a full range of cryptographic algorithm types, multiple symmetric algorithm chips and multiple asymmetric chips are also required; a separate USB controller chip is also required for external UKEY; and an external Prom chip is also required to configure the FPGA chip.

[0007] 2) Insufficient real-time monitoring and diagnostic capabilities:

[0008] The main control firmware is mainly used to handle host request message parsing and cryptographic algorithm scheduling. Due to the limited resources such as RAM, storage space and processing power of the main control chip, it is very difficult to further implement real-time status monitoring and fine-grained logging of the cryptographic module.

[0009] 3) Poor maintainability:

[0010] The excessive number of external chips and the lack of unified exception handling standards increased the difficulty of fault location and exception handling. Hot-updating the main control firmware and then switching between the old and new firmware without affecting the cryptographic module's functionality was nearly impossible due to the limited resources of the main control.

[0011] Therefore, how to reduce the hardware complexity and cost of PCIe cryptographic modules and realize functions such as real-time status monitoring, precise fault location, timely exception handling, and hot upgrade is an urgent problem that technical personnel in this field need to solve. Summary of the Invention

[0012] In view of this, the present invention provides a cryptographic module based on the Linux kernel PCIe EP framework, which reduces the design difficulty and cost of the cryptographic module hardware, enhances the real-time monitoring and diagnosis capabilities of the cryptographic module, and improves subsequent maintainability.

[0013] In order to achieve the above object, the present invention adopts the following technical solutions:

[0014] A cryptographic module based on the Linux kernel PCIe EP framework includes a SOC chip, a DDR chip, and a memory chip. The memory chip is connected to the SOC chip. The SOC chip is provided with a DDR controller, which is connected to the DDR chip. The SOC chip is provided with a PCIe IP module and a cryptographic algorithm engine. The PCIe IP module is set to EP mode.

[0015] Among them, the SOC chip serves as the CPU of the cryptographic module; the storage chip stores the images generated by the software architecture (bootloader, kernel, application services), the generated logs, and the keys that need to be stored; the DDR chip serves as the running memory, providing temporary data storage and high-speed access to the storage chip for the operating system and application layer.

[0016] The technical solution described above achieves the following: the SOC chip supports PCIe Dual mode and an algorithm engine. Compared to traditional architectures, this invention eliminates the need for FPGA chips, a main control chip, multiple symmetrical and asymmetrical algorithm chips, and a USB controller. Instead of the four types of chips in traditional architectures, SOC chips and DDR chips are used, significantly reducing the difficulty and cost of hardware board design. The PCIe IP module includes a PCIe controller and DMA unit.

[0017] Preferably, the SOC chip is connected to the host via a PCIe gold finger; the PCIe IP module in EP mode serves as an EP device of the host and also as an EPF device of the Linux operating system running on the SOC chip.

[0018] Preferably, the storage chip can be an emmc chip, a nandflash chip or a UFS chip.

[0019] Preferably, the password module is also provided with an LED indicator light connected to the SOC chip.

[0020] Preferably, a Linux operating system runs on the SOC chip, building a PCIe operating framework. This framework is a software architecture consisting of a BootLoader layer, a kernel layer, and a service daemon. Both the BootLoader layer and the kernel layer configure and operate the PCIe IP module, while the service daemon provides cryptographic services. The algorithm services of the cryptographic module are upgraded from traditional main control chip firmware to a service daemon, fundamentally resolving the issues of insufficient real-time monitoring and diagnostic capabilities and poor maintainability of traditional PCIe cryptographic modules. The PCIe EP operating framework reduces the complexity and cost of cryptographic module hardware design, enhances real-time monitoring and diagnostic capabilities, and improves maintainability.

[0021] Preferably, the BootLoader layer uses bootloader open source software, and U-boot software can be selected.

[0022] Preferably, the kernel layer includes an EPC library, an EPF library, a configfs module and an EP framework, wherein the EP framework is a software architecture; the EPC library provides an API for driving the EPF device and operating the PCIe IP module in endpoint mode; the EPF library drives the EPF device by calling the API of the EPC library through the EP framework, and sets the PCIe IP module to EP mode by calling the function in the EPC library through the API; the configfs module provides an entry for configuring the EPF device function and binds the EPF library to the EPC library.

[0023] Preferably, the kernel layer uses the DMA unit in the PCIe IP module to implement DMA transmission, and the specific process is as follows:

[0024] Step 11: Add a dma_transfer function pointer to the struct pci_epc_ops data structure of the EPC library. The dma_transfer function pointer executes the registers set in the pci-ip.c file of the EPC library to operate the DMA unit.

[0025] Step 12: Add the pci_epc_dma_transfer export function to the pci-epc-core.c file of the EP framework and link the dma_transfer function pointer; provide an interface to the EPF library and call the specific implementation of DMA transfer in the EPC library;

[0026] Step 13: The EPF library calls the pci_epc_dma_transfer function in the EP framework to implement DMA transfer through the DMA unit and the host side.

[0027] Preferably, the service daemon process includes a self-check module, a message parsing module, an algorithm scheduling module, a log system module, a status monitoring module, an exception handling module, a hot upgrade module and a permission management module; the self-check module performs self-checks on the cryptographic algorithm; the message parsing module parses the request message sent by the host; the algorithm scheduling module schedules the cryptographic algorithm engine for encryption processing; the log system module manages the log system; the status monitoring module monitors the status of the cryptographic module; the exception handling module handles exceptions; the hot upgrade module performs hot upgrade processing; the permission management module connects to UKEY through the USB module interface set in the SOC chip to perform multi-level personnel role permission management.

[0028] Preferably, the workflow of the password module includes:

[0029] Step 1: Power on the host side, stimulate the power supply through the PCIe gold finger, and power on the cryptographic module simultaneously;

[0030] Step 2: The BootLoader layer starts, parses the device tree stored in the storage chip, configures the PCIe IP module to EP mode, facilitates timely recognition with the host BIOS, UEFI, or U-BOOT, and establishes a link with the host;

[0031] Step 3: If the configuration is successful, the BootLoader layer boots the Linux operating system kernel normally. The kernel parses the device tree, starts the EP framework, creates a virtual EPF device based on the EPC library and configfs module, connects the PCIe IP module, and proceeds to step 4. If the configuration fails, the BootLoader layer startup is terminated and the LED indicator indicates the fault.

[0032] Step 4: The kernel layer detects the link status. If the status is abnormal, the boot is terminated and the LED indicator indicates the fault. Otherwise, the kernel layer continues to load the EPF library and cryptographic algorithm engine driver in the Linux operating system.

[0033] Step 5: The kernel layer mounts the root file system of the Linux operating system, the cryptographic module service is started, the service daemon is started, the log system module initializes the log system, and the self-test module performs a cryptographic algorithm self-test;

[0034] Step 6: If the password algorithm self-test is abnormal, the exception handling module performs exception handling. After the exception handling, it is determined whether the password service is normal. If it is abnormal, the LED indicator will indicate the fault. If it is normal, it will go to step 7.

[0035] Step 7: The service daemon enters the state of waiting for the host to initiate a request message, and at the same time sets the PCIe BAR register in the PCIeIP module to the password module ready state; receives the request message and parses it, determines the message type, calls the corresponding module for processing, and generates a response message;

[0036] Step 8: The service daemon checks whether the response message is normal. If so, it sends the response message back to the host. If not, it calls the exception handling module for exception handling. If the response message does not belong to an algorithm, hot upgrade, or monitoring request, it is considered abnormal.

[0037] Preferably, the host loads the password module driver, reads the PCIe BAR register, and sends a request message to the SOC chip after determining that the password module enters the ready state.

[0038] As can be seen from the above technical solution, compared with the existing technology, the present invention provides a cryptographic module based on the Linux kernel PCIe EP framework. Based on the EP mode and cryptographic algorithm engine modules of the PCIe IP module in the SOC chip, this invention designs a Linux kernel-based PCIe operation framework, utilizes the DMA unit to implement DMA transmission driver, and combines the cryptographic algorithm engine driver, service daemon process, and cryptographic module driver to complete basic functions such as cryptographic module permission management, key management, and cryptographic operations. It also implements extended functions such as cryptographic module status monitoring, precise fault location, timely exception handling, and hot upgrades. In addition, compared with traditional solutions, this invention effectively reduces the difficulty and cost of cryptographic module hardware design due to the high integration of the SOC chip and the small number of peripheral chips used. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0040] Figure 1 A schematic diagram of the cryptographic module structure provided by the present invention;

[0041] Figure 2 A schematic diagram of the PCIe operating framework architecture provided by the present invention;

[0042] Figure 3 A schematic diagram of constructing DMA transmission in the kernel layer provided by the present invention;

[0043] Figure 4 A schematic diagram of the service daemon process structure provided by the present invention;

[0044] Figure 5 This is a schematic diagram of the password module workflow provided by the present invention. DETAILED DESCRIPTION

[0045] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0046] An embodiment of the present invention discloses a cryptographic module based on the Linux kernel PCIe EP framework, comprising a SOC chip, a DDR chip, and a memory chip. The memory chip is connected to the SOC chip, a DDR controller is provided in the SOC chip, and the DDR controller is connected to the DDR chip. A PCIe IP module and a cryptographic algorithm engine are provided on the SOC chip. The PCIe IP module is set to EP mode. The SOC chip serves as the CPU of the cryptographic module. The memory chip stores the image generated by the software framework, the generated logs, and the keys that need to be stored. The DDR chip calls the contents of the memory chip and runs the memory for use by the operating system and application layer services. The present invention uses fewer and more integrated SOC chips, which greatly reduces the design difficulty and hardware material costs of the hardware module.

[0047] Furthermore, the SOC chip also includes a CPU, a USB module, a power management module, a clock tree and a reset structure.

[0048] Furthermore, the SOC chip is connected to the host through the PCIe gold finger; the PCIe IP module in EP mode serves as the EP device of the host and also as the EPF device of the Linux operating system of the SOC chip.

[0049] Furthermore, the storage chip can be an emmc chip, a nandflash chip or a UFS chip.

[0050] Furthermore, the password module is also provided with an LED indicator light, which is connected to the SOC chip through the GPIO interface to realize the lighting control of the indicator light.

[0051] Furthermore, the Linux operating system runs on the SoC, building a PCIe operational framework consisting of a bootloader layer, kernel layer, and service daemon. The bootloader and kernel layers respectively configure and operate the PCIe IP module, while the service daemon provides cryptographic services. The cryptographic module's algorithm services have been upgraded from traditional main control chip firmware to a service daemon, fundamentally addressing the shortcomings of traditional PCIe cryptographic modules, including insufficient real-time monitoring and diagnostic capabilities and poor maintainability. The PCIe EP framework reduces the complexity and cost of cryptographic module hardware design, enhances real-time monitoring and diagnostic capabilities, and improves maintainability.

[0052] Furthermore, the password module is also provided with a fan for heat dissipation, thereby improving the operating efficiency and service life of the module.

[0053] This invention uses the Linux kernel PCIe operating framework as an EP device for SOC chips, expanding their application scenarios. The cryptographic module's algorithm service is upgraded from traditional main control chip firmware to a cryptographic module service daemon. This service daemon offers multiple debugging methods and rich inspection tools during development, making it easier to ensure code quality than traditional firmware, thereby improving the robustness of the cryptographic module. The service daemon enables real-time status monitoring, accurately monitoring the usage of each core, SOC operating frequency, SOC temperature, and controlling fan speed through PWM modulation based on temperature. It also enables precise fault analysis, with the log system recording more complete information, facilitating log analysis and auditing. Exception handling is standardized and unified with the algorithm engine interface, making the cryptographic module's handling of exceptions more complete. Hot upgrades are supported, enabling hot upgrades of the cryptographic module's services without affecting the module's functionality.

[0054] Furthermore, the BootLoader layer uses bootloader open source software, and U-boot software can be selected.

[0055] Furthermore, the kernel layer includes the EPC library, EPF library, configfs module and EP framework; the EPC library provides an API for driving EPF devices and operating PCIe IP modules in endpoint mode; the EPF library drives the EPF device by calling the EPC library's API through the EP framework, and implements the EP mode function settings of the PCIe IP module by calling the functions in the EPC library through the API; the configfs module provides entry configuration EPF device functions and binds the EPF library to the EPC library.

[0056] Furthermore, the kernel layer uses the DMA unit in the PCIe IP module to implement DMA transmission. The specific process is as follows:

[0057] S11: Add a dma_transfer function pointer to the struct pci_epc_ops data structure of the EPC library. The dma_transfer function pointer executes the registers set in the pci-ip.c file of the EPC library to operate the DMA unit. The IP of PCIe IP modules of different manufacturers varies greatly. Therefore, the pci-ip.c files corresponding to different PCIe IP modules are stored in the EPC library. The pci-ip.c file provides low-level DMA, interrupt, configuration space, resource application and other operations.

[0058] S12: Add the pci_epc_dma_transfer export function to the pci-epc-core.c file of the EP framework and link the dma_transfer function pointer; provide an interface to the PCIe EPF library and call the specific implementation of DMA transfer in the EPC library;

[0059] S13: The EPF library calls the pci_epc_dma_transfer function in the EP framework to implement DMA transmission through the DMA unit and the host side.

[0060] Furthermore, the service daemon process includes a self-check module, a message parsing module, an algorithm scheduling module, a log system module, a status monitoring module, an exception handling module, a hot upgrade module and a permission management module; the self-check module performs self-checks on the cryptographic algorithm; the message parsing module parses the request message sent by the host; the algorithm scheduling module schedules the cryptographic algorithm engine for encryption processing; the log system module manages the log system; the status monitoring module monitors the status of the cryptographic module; the exception handling module handles exceptions; the hot upgrade module performs hot upgrade processing; the permission management module connects to the UKEY through the USB module interface set in the SOC chip to perform multi-level personnel role permission management.

[0061] The further workflow of the password module is as follows Figure 5 Shown, including:

[0062] S1: The host side is powered on, and the cryptographic module is powered on synchronously through the PCIe gold finger power supply.

[0063] S2: The BootLoader layer starts, parses the device tree stored in the storage chip, configures the PCIe IP module to EP mode, facilitates timely recognition with the host BIOS, UEFI or U-BOOT, and establishes a link with the host;

[0064] S3: If the configuration is successful, the BootLoader layer boots the Linux operating system kernel normally. The kernel parses the device tree, starts the EP framework, creates a virtual EPF device based on the EPC library and configfs module, connects the PCIe IP module, and proceeds to step 4. If the configuration fails, the BootLoader layer startup is terminated and the LED indicator indicates the fault.

[0065] S4: The kernel layer detects the link status. If the status is abnormal, the boot is terminated and the LED indicator indicates the fault. Otherwise, the kernel layer continues to load the EPF library and cryptographic algorithm engine driver in the Linux operating system.

[0066] S5: The kernel layer mounts the root file system of the Linux operating system, the cryptographic module service is started, the service daemon is started, the log system module initializes the log system, and the self-test module performs a cryptographic algorithm self-test;

[0067] S6: If the password algorithm self-test is abnormal, the exception handling module performs exception handling. After the exception handling, it is determined whether the password service function can continue to be provided. If it is not available, the LED indicator light indicates the fault. If it is available, it enters S7;

[0068] S7: The service daemon enters the state of waiting for the host to initiate a request message, and at the same time sets the PCIeBAR register in the PCIe IP module to the ready state for the cryptographic module; receives the request message and parses it to determine whether it is a cryptographic algorithm request, hot upgrade, or status monitoring request. If so, it enters the processing flow of the algorithm scheduling module, hot upgrade module, or status monitoring module accordingly, and generates a response message;

[0069] S8: The service daemon determines whether the response message is normal. If it is normal, the response message is sent back to the host. If it is abnormal, the exception handling module is called to handle the exception.

[0070] The host then loads the EP device driver, which reads the PCIe BAR registers. Once the cryptographic module is ready, it sends a request message to the SoC chip. After the host sends the request message, the host-side cryptographic module driver reads the cryptographic module status from the PCIe BAR registers. If the module is ready, the EPF library's pci-ip.c program manipulates the registers to implement DMA transfers, then enters the service daemon process to begin receiving request messages. The algorithm scheduling module schedules the cryptographic algorithm engine driver to perform cryptographic operations; the cryptographic module driver drives the EP device.

[0071] On the other hand, in a specific embodiment, a cryptographic module based on the Linux kernel PCIe EP framework can be implemented using the Fangcun TIH64V690SOC chip that supports PCIe Dual mode and the national secret cryptographic algorithm engine, where the SOC chip is not restricted by the CPU architecture (both ARM and RISC-V are acceptable).

[0072] This paper describes the overall software architecture and approach for implementing a cryptographic module based on the Linux kernel's PCIe EP framework, implementing DMA transfers within the Linux kernel's PCIe EP framework, and leveraging the Linux operating system's strengths to address software issues such as insufficient real-time monitoring and diagnostic capabilities and poor maintainability. This implementation uses the National Security Level 2 certified TIH64V690 SoC as an example.

[0073] The specific process of implementing the cryptographic module based on the Linux kernel PCIe EP framework is as follows:

[0074] S1: Select appropriate RAM and storage chips according to the TIH64V690 SOC technical reference manual; design the PCIe cryptographic module hardware board;

[0075] S2: Added TIH64V690 SOC chip to U-BOOT to support PCIe EP function;

[0076] S21: Add support for TIH64V690 PCIe EP option and PCIe EP device tree node in U-BOOT;

[0077] S22: Ensure that the power management, clock tree, and reset structure that PCIe relies on in U-BOOT are available;

[0078] S23: Add support for TIH64V690 PCIe EP option driver implementation in U-BOOT;

[0079] S3: Added support for using PCIe IP for the TIH64V690 SoC chip in the Linux kernel PCIe operation framework;

[0080] S31: If the Linux kernel PCIe operation framework does not support the PCIe IP used by the SOC chip, add support for the SOC to use the PCIe IP in the Linux kernel PCIe operation framework;

[0081] S32: Enable the Linux kernel device tree PCIe EP node and the Linux kernel PCIe EP option;

[0082] S33: Added a DMA data transfer driver to the Linux kernel PCIe operation framework based on the DMA manual of the SOC PCIe IP;

[0083] S4: Start the service daemon process. When the cryptographic algorithm self-test is completed and the cryptographic service is available, set the PCIe BAR register to indicate that the cryptographic service has entered the ready state.

[0084] S5: parse the request sent by the host side, respond according to the request type, and return the processing result.

[0085] On the other hand, in a specific embodiment, the present invention can also be implemented using a SOC chip that supports PCIe Dual mode but does not support the national encryption algorithm, and is only externally connected to an FPGA or an external encryption algorithm chip that implements the encryption algorithm.

[0086] On the other hand, in a specific embodiment, the present invention may also adopt a SOC chip that supports PCIe Dual mode, and utilize a bus conversion chip or other means to convert the PCIe bus interface into a USB or miniPCie or other bus interface form for external exposure.

[0087] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0088] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A cryptographic module based on the Linux kernel PCIe EP framework, characterized in that: It includes a SOC chip, a DDR chip and a memory chip. The memory chip is connected to the SOC chip. The SOC chip is provided with a DDR controller, which is connected to the DDR chip. The SOC chip is provided with a PCIe IP module and a cryptographic algorithm engine. The PCIe IP module is set to EP mode.

2. A cryptographic module based on the Linux kernel PCIe EP framework according to claim 1, characterized in that: The SOC chip is connected to the host through the PCIe gold finger; the PCIe IP module in EP mode serves as the EP device of the host and also as the EPF device of the Linux operating system running on the SOC chip.

3. The cryptographic module based on the Linux kernel PCIe EP framework according to claim 1, characterized in that: The storage chip can be emmc chip, nandflash chip or UFS chip.

4. The cryptographic module based on the Linux kernel PCIe EP framework according to claim 1, characterized in that: An LED indicator light is also provided to connect to the SOC chip.

5. The cryptographic module based on the Linux kernel PCIe EP framework according to claim 2, characterized in that: The Linux operating system runs on the SOC chip, building a PCIe operation framework, including the BootLoader layer, kernel layer, and service daemon. Both the BootLoader layer and kernel layer configure and operate the PCIe IP module. The service daemon provides cryptographic services.

6. A cryptographic module based on the Linux kernel PCIe EP framework according to claim 5, characterized in that: The BootLoader layer uses bootloader open source software and U-boot software.

7. The cryptographic module based on the Linux kernel PCIe EP framework according to claim 5, characterized in that: The kernel layer includes the EPC library, EPF library, configfs module, and EP framework; the EPC library provides APIs for driving EPF devices and operating PCIe IP modules in endpoint mode; The EPF library drives the EPF device by calling the EPC library's API through the EP framework, and sets the PCIe IP module to EP mode by calling the EPC library's function through the API; the configfs module provides the entry point for configuring the EPF device function and binds the EPF library to the EPC library.

8. A cryptographic module based on the Linux kernel PCIe EP framework according to claim 7, characterized in that: The kernel layer uses the DMA unit in the PCIe IP module to implement DMA transmission. The specific process is as follows: Step 11: Add a dma_transfer function pointer to the struct pci_epc_ops data structure of the EPC library. The dma_transfer function pointer executes the registers set in the pci-ip.c file of the EPC library to operate the DMA unit. Step 12: Add the pci_epc_dma_transfer export function to the pci-epc-core.c file of the EP framework and link the dma_transfer function pointer; Step 13: The EPF library calls the pci_epc_dma_transfer function in the EP framework to implement DMA transfer through the DMA unit and the host side.

9. The cryptographic module based on the Linux kernel PCIe EP framework according to claim 5, characterized in that: The service daemon process includes a self-check module, a message parsing module, an algorithm scheduling module, a log system module, a status monitoring module, an exception handling module, a hot upgrade module, and a permission management module; the self-check module performs self-checks on the cryptographic algorithm; the message parsing module parses the request message sent by the host; the algorithm scheduling module schedules the cryptographic algorithm engine for encryption processing; The log system module manages the log system; the status monitoring module monitors the status of the password module; the exception handling module handles exceptions; The hot upgrade module performs hot upgrade processing; The authority management module is connected to UKEY via the USB module interface set in the SOC chip to perform multi-level personnel role authority management.

10. A cryptographic module based on the Linux kernel PCIe EP framework according to claim 9, characterized in that: The workflow of the cryptographic module includes: Step 1: Power on the password module; Step 2: The BootLoader layer starts, parses the device tree stored in the storage chip, configures the PCIe IP module to EP mode, and establishes a link with the host; Step 3: If the configuration is successful, the BootLoader layer boots the Linux operating system kernel normally. The kernel parses the device tree, starts the EP framework, creates a virtual EPF device based on the EPC library and configfs module, and connects the PCIe IP module, then proceeds to step 4. If the configuration fails, the BootLoader layer startup is terminated and a fault prompt is displayed. Step 4: The kernel layer detects the link status. If the status is abnormal, the boot is terminated and the LED indicator indicates the fault. Otherwise, the kernel layer continues to load the EPF library and cryptographic algorithm engine driver in the Linux operating system. Step 5: The kernel layer mounts the root file system of the Linux operating system, the cryptographic module service is started, the service daemon is started, the log system module initializes the log system, and the self-test module performs a cryptographic algorithm self-test; Step 6: If the password algorithm self-test is abnormal, the exception handling module performs exception handling. After the exception handling, it is determined whether the password service is normal. If it is abnormal, a fault is prompted. If it is normal, it goes to step 7; Step 7: The service daemon enters the state of waiting for the host to initiate a request message, and at the same time sets the PCIeBAR register in the PCIeIP module to the password module to enter the ready state; receives the host's request message and parses it, determines the message type, calls the corresponding module for processing, and generates a response message; Step 8: The service daemon determines whether the response message is normal. If it is normal, the response message is sent back to the host. If it is abnormal, the exception handling module is called to handle the exception.

Images