A multi-algorithm core high-performance SR-IOV encryption and decryption system and method

Abstract

The present invention discloses a multi-algorithm core high-performance SR-IOV encryption and decryption system and method, comprising a host, a PCIE chip with a multi-algorithm IP core and a plurality of clients, wherein a corresponding shared memory is created between the host and the client, the host comprises a VF algorithm core manager and a PF driver, the PF driver is responsible for receiving a VF mailbox MSI interrupt signal and an algorithm IP core completion MSI interrupt signal from a VF mailbox interrupt register and an algorithm IP core interrupt status register of the PCIE chip, and sending the algorithm IP core completion status to the VF algorithm core manager of the host; the VF algorithm core manager is responsible for configuring and managing the algorithm IP core and the VF of the client, and writing the algorithm IP core completion status message into a shared memory message queue in the corresponding client, the client obtains the algorithm IP core running completion status through the shared memory message queue, thereby realizing that the encryption and decryption operation program is completed after the thread created in the client is awakened.

Description

Technical Field

[0001] The present invention relates to the technical field of encryption and decryption chips, and in particular to a multi-algorithm core high-performance SR-IOV encryption and decryption system and method. Background Art

[0002] In PCIe encryption and decryption multi-algorithm core chips, the encryption and decryption performance and efficiency of PCIE virtualization encryption cards become particularly important.

[0003] It is inefficient for the host computer to use queries to check the completion status of the chip encryption and decryption work, and the encryption and decryption performance is not high; using the MSI-X interrupt method to report the completion status of the chip algorithm will make the internal hardware design of the chip more complicated, increase the chip area, and the internal chip and host computer PCIe driver design will also be more complicated, resulting in a high R&D cost for realizing the notification status function.

[0004] It is easier to use MSI interrupts to report the completion status of chip algorithms. When developing PCIe device drivers, the Mask Bits and Pending Bits fields are sometimes needed to prevent the processor from losing interrupt requests. When the number of continuous interrupts available to the host computer is small, when multiple algorithm IP cores generate multiple MSI interrupts almost at the same time, due to the delay in PCIe system interrupt processing, there will still be MSI interrupt losses. If MSI interrupts are used in the conventional way, the interrupt delay is large, which will make the host computer CPU handle MSI interrupts with a heavy load, and the performance efficiency of PCIe encryption and decryption will be greatly reduced.

[0005] The interrupt notification overhead of single-root I / O virtualization is very large because the virtual machine monitor still needs to intervene when processing interrupts, which is interrupt virtualization. Due to the physical interrupt processing and the simulation of the virtual interrupt controller operation, the entire interrupt process includes a high frequency of context switching, resulting in a long interrupt processing path. At the same time, in a single-root I / O virtualization environment, the interrupt frequency will increase linearly with the increase in the number of virtual machines, because each virtual function encryption card will generate an interrupt independently.

[0006] In a virtualized environment, the cost of processing an interrupt is much higher than that of a native machine. Unlike native machines, which only need to make two context switches in the interrupt processing path, interrupt virtualization has a longer processing path, including context switches between the virtual machine monitor and the virtual machine. The process of virtual interrupt is that the first physical interrupt will be processed by the interrupt service program in the virtual machine monitor, and then a virtual interrupt will be implanted in the interrupt service program of the virtual machine. During the execution of the virtual machine interrupt service program, there will be several context switches due to the trap simulation of the virtual interrupt controller. It is obvious that the interrupt processing overhead in a virtualized environment is much higher than that of a native machine. In fact, the large number of interrupt processing in the SR-IOV encryption card adds additional delays and has an unnecessary negative impact on high-speed encryption and decryption.

[0007] In the current market, some PCIe interface SR-IOV encryption cards use a client VF driver that must be bound to the underlying VF hardware. The algorithm IP core assigned to the client VM is fixed. When the client does not use the encryption and decryption function, the computing power of the algorithm IP core will be wasted, and the encryption and decryption performance of other client VMs will be affected, which is not flexible enough. The client obtains cryptographic device resources through VF to complete cryptographic operations. Since VFs are isolated from each other, each virtual cryptographic machine does not affect each other when performing cryptographic operations. Since SR-IOV encryption cards share hardware resources, when multiple algorithm IP cores send a large number of interrupt requests at the same time, the host will not be able to process the interrupt requests in time, so optimization is required. Summary of the invention

[0008] The object of the present invention is to provide a multi-algorithm core high-performance SR-IOV encryption and decryption system and method, so as to solve the above-mentioned problems existing in the prior art.

[0009] In order to achieve the above object, the technical solution adopted by the present invention is as follows:

[0010] A multi-algorithm core high-performance SR-IOV encryption and decryption system comprises a host, a PCIE chip with a multi-algorithm IP core and a plurality of clients, wherein a corresponding shared memory is created between the host and the client, the host comprises a VF algorithm core manager and a PF driver, the PCIE chip with the multi-algorithm IP core comprises an algorithm controller provided with a VF mailbox interrupt register, an algorithm IP core interrupt status register and an algorithm IP core idle status register, the PF driver is responsible for receiving a VF mailbox MSI interrupt signal and an algorithm IP core completion MSI interrupt signal from the VF mailbox interrupt register and the algorithm IP core interrupt status register of the PCIE chip, and sending the algorithm IP core completion status to the VF algorithm core manager of the host; the VF algorithm core manager is responsible for configuring and managing the algorithm IP core and the VF of the client, and is used for writing the algorithm IP core completion status message into the shared memory message queue in the corresponding client, the client obtains the algorithm IP core operation completion status through the shared memory message queue, thereby realizing that the encryption and decryption operation program is completed after the thread created in the client is awakened.

[0011] Preferably, the VF mailbox interrupt register has a read operation clearing attribute, is connected to the interrupt output signal of the VF mailbox, and each bit is connected to a VF mailbox. When the client a writes the shared memory VFDev address information into the VFx mailbox register, a high level is generated for the bit X of the VF mailbox interrupt register. When the upper host PF driver reads the VF mailbox interrupt register of the PCIe encryption and decryption chip in the MSI ISR, the bit X value is 1, and then the bit X becomes a low level, that is, the value of the bit X becomes 0;

[0012] Each algorithm IP core in the algorithm IP core idle status register corresponds to a bit therein. When an algorithm IP core b generates encryption and decryption services, the corresponding bit X is cleared to 0, indicating a busy state; when an algorithm IP core b generates a job completion state, its corresponding bit X will be set to 1, indicating an idle and available state;

[0013] The algorithm IP core interrupt status register has a read operation clearing attribute and is connected to the interrupt output signal of the algorithm IP core. Each bit corresponds to an algorithm IP core. When the algorithm IP core b completes the operation, a high level is output to the bit X of the algorithm IP core interrupt status register. When the bit X corresponding to a certain algorithm IP core b in the algorithm IP core interrupt status register is at a high level, the algorithm controller in the PCIE chip reads the interrupt vector number of the algorithm IP core b and writes it into the MSI interrupt vector number register. Each algorithm IP core generates an MSI message interrupt request to the host in real time according to the interrupt vector number assigned by the privileged domain host system. The host PF drives the MSI ISR to uniformly process the completion status interrupt of the algorithm IP core, and notifies the upper host PF driver chip that the algorithm core has completed the encryption and decryption operation.

[0014] Preferably, the PCIe encryption and decryption chip host PF driver software reads the Multiple MessageEnable field in the MSIMessage Control register of the PCIe3.0 core of the PCIe encryption and decryption chip from the MSI-related registers in the PCIe configuration space to obtain the number of consecutive interrupts that the PCIe encryption and decryption chip host PF can use.

[0015] Preferably, the shared memory refers to a memory buffer of the shared message VF_Dev_ShareMsg structure type pointed to by the VFDev of client a, wherein the shared message structure includes the corresponding client number dom_index, the encryption and decryption VF priority propriety, the corresponding encryption and decryption VF number vf_index, the encryption and decryption thread number thread_Num, the encryption and decryption VF request algorithm IP core message AlgKernal_Req_Msg and the algorithm IP core completion status message AlgKernal_Done_Msg.

[0016] Another object of the present invention is to provide a multi-algorithm core high-performance SR-IOV encryption and decryption method, which is implemented based on the multi-algorithm core high-performance SR-IOV encryption and decryption system, and includes the following steps:

[0017] S1, the host PF driver SR-IOV encryption and decryption system is initialized, at this time all algorithm IP cores are in idle state; create client m, and assign it to use the corresponding encryption card VFm; initialize the client m and its VF driver, and assign it to communicate with the PF driver shared memory VFDevm; synchronize the shared memory VFDevm address to the host PF driver;

[0018] S2, the client m requests the currently available algorithm IP core b from the host through the shared memory VFDevm, creates an encryption and decryption thread Thread_m_X, and simultaneously creates message queues VM_m_Thread_Msg_Q and VM_m_ReqAlgKernal_Msg_Q for completing status communication between client kernel RTOS algorithm threads for obtaining the request result of the algorithm IP core b;

[0019] S3, when VM_m_Thread_Msg_Q obtains the completion status message of the algorithm IP core b, the encryption and decryption thread Thread_m_X is awakened to complete the encryption and decryption process performed by the PCIE encryption chip algorithm controller;

[0020] S4, after the encryption and decryption operation is completed, the bit X in the idle status register of the algorithm IP core is set to 1, and the corresponding bit X in the interrupt status register of the algorithm IP core is high, and an MSI message interrupt is generated to the host PF driver, so that each algorithm IP core generates an MSI message interrupt request to the host in real time according to the interrupt vector number assigned by the host, and the host PF drives the MSI ISR to uniformly handle the completion status interrupt of the algorithm IP core.

[0021] Preferably, step S1 specifically includes:

[0022] S11, configure space, memory space mapping, and allocate MSI interrupt vector for host PF driver, read the value of algorithm IP core idle state register ALG_KERNEL_IDLE_Reg from memory space, and assign the value to algorithm manager global variable ALG_KERNEL_IDLE, the number of bits corresponds to the number of algorithm IP cores; 32 algorithm IP cores are used in this application, so its 32 bits correspond to 32 algorithm IP cores;

[0023] S12, create client m, and assign it to use the corresponding encryption card VFm; initialize client m, initialize VF driver, and assign shared memory VFDevm to communicate with PF driver, the shared memory VFDevm includes the corresponding client number dom_index, encryption and decryption VF priority propriety, the corresponding encryption and decryption VF number vf_index, encryption and decryption thread number thread_Num, encryption and decryption VF request algorithm IP core message AlgKernal_Req_Msg and algorithm IP core completion status message AlgKernal_Done_Msg; wherein the client number in the dom_index field is set to m, and the encryption and decryption VF number in the vf_index field is set to m;

[0024] S13, the VFm driver writes the VFDevm first address information into the VF mailbox interrupt register array corresponding to the client VFx driver of the SR-IOV encryption and decryption chip through the PCIE interface, and then generates an MSI interrupt to notify the host PF driver. The host PF driver MSI ISR takes out the VFDevm address information and converts the VFDevm address into a host logical address for use by the host VF algorithm core manager.

[0025] Preferably, step S2 specifically includes:

[0026] S21, when client m has a need for encryption and decryption process, the client m requests the host PF driver VF algorithm core manager through the AlgKernal_Req_Msg field in the shared memory VFDevm to obtain the number of the currently available algorithm IP core d, and to create an encryption and decryption thread Thread_m_X;

[0027] S22, create message queues VM_m_Thread_Msg_Q and VM_m_ReqAlgKernal_Msg_Q for client kernel RTOS algorithm thread completion status communication for obtaining the request result of the algorithm IP core b, and client m creates a process with a higher priority: VF algorithm core management task VM_m_VF_AlgKernal_Task:

[0028] (a) If there is a response message requesting the algorithm IP core b in AlgKernal_Req_Msg, a C message will be written to VM_m_ReqAlgKernal_Msg_Q to wake up the thread that will use the algorithm IP core to continue running.

[0029] (b) If there is a completion status message of the algorithm IP core b in AlgKernal_Done_Msg, a message with a value of 2^X will be written to VM_m_Thread_Msg_Q to wake up the client m thread Thread_m to continue running.

[0030] Preferably, step S3 specifically includes:

[0031] S31, organize the key information of the selected algorithm into a data packet, the host starting PCIE bus address StartAddr_X and length Size_X of the user data to be encrypted and decrypted, set the read and write Offset to 0, and the register configuration information of the algorithm IP core b and its algorithm type into a data packet, and send it to the algorithm IP core b of the encryption chip through the PCIe interface;

[0032] S32, Thread_m_X obtains a message with a value of 2^X from VM_m_Thread_Msg_Q, is blocked, and actively gives up the right to run this thread;

[0033] S33, after the algorithm IP core b completes the encryption and decryption operation on the data to be encrypted and decrypted, the encryption chip issues a PCIe MSI interrupt, and VM_m_VF_AlgKernal_Task of client m writes a 2^X message to the client m kernel message queue VM_m_Thread_Msg_Q, and thread Thread_m_X is awakened by the client m system kernel scheduling;

[0034] S34, thread Thread_m_X refreshes the data cache content at the host starting PCIE bus address StartAddr_X of the data to be encrypted, and then reads the encrypted data from the address, thereby completing this encryption task, and finally releasing the related resources of the middleware thread Thread_m_X.

[0035] Preferably, the step S33 of waiting for the algorithm IP core b to complete the encryption and decryption operation on the data to be encrypted and decrypted specifically includes:

[0036] 1) The algorithm controller inside the PCIe encryption chip sets the bit X corresponding to ALG_KERNEL_IDLE_Reg to 0 to indicate busy;

[0037] 2) The algorithm controller inside the PCIe encryption chip cooperates with the algorithm IP core b and uses the DMA module to complete the encryption and decryption operations and the transfer of the result data. When all encryption operations are completed, the algorithm IP core b sets the bit X corresponding to ALG_KERNEL_INT_STATUS_Reg to a high level state;

[0038] 3) When the encryption operation of all the target source data to be encrypted and decrypted is completed, the algorithm controller first sets the bit X corresponding to the ALG_KERNEL_IDLE_Reg register to 1 to indicate idle; at the same time, when the bit X corresponding to the ALG_KERNEL_INT_STATUS_Reg is high, the interrupt vector number of the algorithm IP core b is read out and written into the MSI interrupt "Message Data" register, generating a corresponding MSI message interrupt for the algorithm IP core b, notifying the upper host PF driver chip that the algorithm kernel has completed the encryption and decryption operation.

[0039] Preferably, step S1 and step S2 further include: reading the AlgKernal_Req_Msg field from the shared memory for the created client m to check whether there is a request algorithm IP core message.

[0040] The beneficial effects of the present invention are:

[0041] The present invention provides a multi-algorithm core high-performance SR-IOV encryption and decryption system and method. Under the design scheme of the present invention, all encryption and decryption services of the PCIE encryption and decryption chip are driven based on the algorithm IP core b. The state register ALG_KERNEL_IDLE_Reg of the available algorithm core inside the chip is located in the PCIe memory space, which is convenient for the host computer PCIe driver to use and configure. The user's encryption and decryption source data is stored in the host computer system memory. The DMA inside the PCIE encryption and decryption chip actively reads the source data, and the algorithm IP core performs encryption and decryption operations. After completion, the internal DMA actively writes the encrypted and decrypted data back to the same memory until all the target source data are processed. Finally, a PCIe MSI message interrupt, the privileged domain host system kernel handles all algorithm kernel MSI interrupts, and is not related to the privileged domain host user space process, eliminating the VF encryption and decryption interrupt events and the virtual machine monitor and client operating system's processing overhead for physical interrupts and client interrupts; the client's high-priority process monitors the shared memory AlgKernal_Done_Msg state and wakes up related threads, which can maximize the performance of the SR-IOV encryption and decryption card; it can adapt to different systems and application scenarios without modifying and compiling the host computer operating system kernel; the algorithm IP core inside the chip is dynamically allocated to maximize the client VF performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] Figure 1 It is composed of the multi-algorithm core high-performance SR-IOV encryption and decryption system provided in Example 1;

[0043] Figure 2 This is a schematic diagram of the algorithm controller provided in Example 1 generating an MSI interrupt processing for the algorithm IP core b and MAILBOX;

[0044] Figure 3 This is a schematic diagram of the encryption and decryption process performed by any client m provided in Example 2;

[0045] Figure 4 This is a schematic diagram of the encryption and decryption processing flow of the PCIe encryption chip algorithm controller in Example 2;

[0046] Figure 5 This is a schematic diagram of the upper host PF driving MSI ISR processing flow in Example 2;

[0047] Figure 6 This is a schematic diagram of the processing flow of the host PF driving the VF algorithm core manager in Example 2. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below in conjunction with the accompanying drawings. It should be understood that the specific implementation methods described herein are only used to explain the present invention and are not used to limit the present invention.

[0049] Example 1

[0050] This embodiment provides a multi-algorithm core high-performance SR-IOV encryption and decryption system, such as Figure 1 As shown, it includes a host, a PCIE chip with multiple algorithm IP cores and several clients, and a corresponding shared memory is created between the host and the client. The host includes a VF algorithm core manager and a PF driver. The PCIE chip with multiple algorithm IP cores includes an algorithm controller provided with a VF mailbox interrupt register, an algorithm IP core interrupt status register and an algorithm IP core idle status register. The PF driver is responsible for receiving a VF mailbox MSI interrupt signal and an algorithm IP core completion MSI interrupt signal from the VF mailbox interrupt register and the algorithm IP core interrupt status register of the PCIE chip, and sending the algorithm IP core completion status to the VF algorithm core manager of the host; the VF algorithm core manager is responsible for configuring and managing the algorithm IP core and the VF of the client, and is used to write the algorithm IP core completion status message into the shared memory message queue in the corresponding client. The client obtains the algorithm IP core running completion status through the shared memory message queue, thereby realizing that the thread created in the client is awakened and the encryption and decryption operation program is completed.

[0051] The PCIE chip with multiple algorithm IP cores in this embodiment includes a PCIe3.0 core, an algorithm controller, and multiple algorithm IP cores. The algorithm controller includes a VF mailbox interrupt register, an algorithm IP core interrupt status register, and an algorithm IP core idle status register. The principle is as follows Figure 2 As shown;

[0052] The VF mailbox interrupt register has a read operation clearing attribute, is connected to the interrupt output signal of the VF mailbox, and each bit is connected to a VF mailbox. When the client a writes the shared memory VFDev address information into the VFx mailbox register, a high level is generated for the bit X of the VF mailbox interrupt register. When the upper host PF driver reads the VF mailbox interrupt register of the PCIe encryption and decryption chip in the MSI ISR, the bit X value is 1, and then the bit X becomes a low level, that is, the value of the bit X becomes 0;

[0053] Each algorithm IP core in the algorithm IP core idle status register corresponds to a bit therein. When an algorithm IP core b generates encryption and decryption services, the corresponding bit X is cleared to 0, indicating a busy state; when an algorithm IP core b generates a job completion state, its corresponding bit X will be set to 1, indicating an idle and available state;

[0054] The algorithm IP core interrupt status register has a read operation clearing attribute and is connected to the interrupt output signal of the algorithm IP core. Each bit corresponds to an algorithm IP core. When the algorithm IP core b completes the operation, a high level is output to the bit X of the algorithm IP core interrupt status register. When the bit X corresponding to a certain algorithm IP core b in the algorithm IP core interrupt status register is at a high level, the algorithm controller reads the interrupt vector number of the algorithm IP core b and writes it into the MSI interrupt vector number register. Each algorithm IP core generates an MSI message interrupt request to the host in real time according to the interrupt vector number assigned by the privileged domain host system. The host PF drives the MSI ISR to uniformly process the completion status interrupt of the algorithm IP core and notify the upper host PF driver chip that the algorithm core has completed the encryption and decryption operation.

[0055] The PCIe encryption and decryption chip host PF driver software of this design will read the Multiple MessageEnable field in the MSIMessage Control register of the PCIe3.0 core of the PCIe encryption and decryption chip from the MSI related registers in the PCIe configuration space, and obtain the number of consecutive interrupts that the PCIe encryption and decryption chip host PF can use. Assuming that there are 4 consecutive interrupt numbers, read the MSI Message Data field of the PCIe core. Assuming that the read interrupt vector number value is 0x8800, then the 4 interrupt vector numbers available to the PCIe encryption and decryption chip PF are 0x8800, 0x8801, 0x8802, and 0x8803. The PCIe encryption and decryption chip can write these four values ​​into the PCIe MSI message Message Data field at the appropriate time, thereby sending the MSI message interrupts of different algorithm IP cores / VF mailboxes to the privileged domain host PF driver. See Figure 6 .The upper host PF drives the MSIISR processing flow.

[0056] The shared memory described in this embodiment refers to the memory buffer of the shared message VF_Dev_ShareMsg structure type pointed to by the VFDev of client a, wherein the shared message structure includes the corresponding client number dom_index, the encryption and decryption VF priority propriety, the corresponding encryption and decryption VF number vf_index, the encryption and decryption thread number thread_Num, the encryption and decryption VF request algorithm IP core message AlgKernal_Req_Msg and the algorithm IP core completion status message AlgKernal_Done_Msg.

[0057] According to the design scheme of the present invention in this embodiment, the number of algorithm IP cores X can be customized according to the encryption and decryption performance requirements. The number of virtual encryption and decryption cards VF X can be customized according to the virtualization application requirements.

[0058] In the design of the present invention, it is assumed that the maximum value of the algorithm IP core b is 32, that is, 32 hardware algorithm cores are used inside the chip, and these 32 algorithm hardware IP cores are exactly the same. Each algorithm IP core can support hardware algorithms such as DES / AES / SM1 / SM4 / HASH / UCAA, and each algorithm IP core uses the 4KB first storage unit and 4KB second storage unit inside the algorithm IP core in a ping-pong manner. PCIe adopts a full-duplex transmission design. The PCIe 3.0 core contains 8 DMA sending channels and 8 DMA receiving channels, allowing the DMA Tx channel to send encryption and decryption result data and the Rx channel to receive the source data to be processed at the same time. Assuming that the maximum value of VF on the virtual encryption and decryption card is 32, that is, a maximum of 32 PCIE virtual encryption and decryption cards can be used inside the chip.

[0059] The specific encryption and decryption process of the algorithm IP core in this embodiment is:

[0060] The algorithm controller inside the PCIe encryption chip receives the idle signal of the first storage unit of the algorithm IP core b, and is configured to use DMA Rx1 Channel to read the first package of 4KB to-be-encrypted data from the PCIE bus address 0x8000000 to the algorithm 4KB first storage unit of the chip SM1 encryption core. SM1 starts to encrypt the data of the first storage unit and writes the encryption result back to the first storage unit. The algorithm controller inside the PCIe encryption chip receives the idle signal of the second storage unit of the algorithm IP core b, and is configured to use DMA Rx2 Channel to read the second package of 4KB to-be-encrypted data from the PCIE bus address 0x8000000+4K to the algorithm 4KB second storage unit of the chip SM1 encryption core; when the 4KB of data to be encrypted in the first storage unit is completed, the algorithm controller inside the PCIe encryption chip receives the encryption and decryption completion signal of the algorithm IP core b, and is configured to use DMA Tx1Channel to write the 4KB of encrypted data in the first storage unit to the system PCIE bus address 0x8000000, thereby completing the encryption of the first package of data. SM1 starts to encrypt the data in the second storage unit and writes the encryption result back to the second storage unit.

[0061] The PCIe encryption chip uses DMA Rx1 Channel to read the third package of 4KB of data to be encrypted from the PCIE bus address 0x8000000+8K to the algorithm 4KB first storage unit of the chip SM1 encryption core. When the 4KB of data to be encrypted in the second storage unit is completed, the PCIe encryption chip uses DMA Tx1 Channel to write the 4KB of encrypted data in the second storage unit to the system PCIE bus address 0x8000000+4K, thereby completing the encryption of the second package of data.

[0062] Repeat the above steps until all 1000K data are encrypted. At the same time, in the last packet of this operation, after DMA Tx1 Channel writes the encrypted result data to the system memory, the algorithm controller first sets the bit X corresponding to ALG_KERNEL_IDLE_Reg to 1 to indicate idle, and at the same time generates a remote MSI message interrupt according to the interrupt request hardware signal control of the algorithm IP core b.

[0063] It should be noted that the interrupt service routine of MSI interrupt is abbreviated as MRI ISR.

[0064] In this embodiment, when the SR-IOV encryption and decryption card is inserted into the PCIe slot, when the host computer PF / VF driver is initialized, the PCIe encryption card driver of this design will create an "algorithm core completion status message queue VM_X_Thread_Msg_Q" that can store 32 algorithm core completion status messages. The message is the 2-to-X value of the bit corresponding to each algorithm IP core b. For example, when the algorithm IP core 2 completes encryption and decryption and completes the data transmission, the hardware first sets the bit 2 corresponding to ALG_KERNEL_IDLE_Reg to 1, and then the algorithm controller generates a message for the algorithm IP core 2. The MSI message interrupt is sent to the host PF. In the MSI interrupt service program in the privileged domain host PF driver, different processing is performed according to the type of host computer to which the algorithm IP core 2 currently belongs. If it belongs to the privileged domain host PF, a message with a value of 2^2=4 is written to the "algorithm core completion status message queue" to wake up the thread Thread_2 using the algorithm IP core 2; if it belongs to VF1 on client 1, the VF algorithm core manager in the host PF driver will write a message with a value of 2^2=4 to the shared memory AlgKernal_Done_Msg of client 1. At this point, the host PF driver MSI interrupt processing is completed. Client 1 continues to execute. When the higher priority task "VF algorithm core management task" in client 1 detects that there is a message with a value of 4 in AlgKernal_Done_Msg, it will take out and write a message with a value of 4 to VM_1_Thread_Mg_Q to wake up the encryption and decryption thread Thread_2 in client 1.

[0065] Example 2

[0066] This embodiment provides a multi-algorithm core high-performance SR-IOV encryption and decryption method, which is implemented based on the multi-algorithm core high-performance SR-IOV encryption and decryption system described in Embodiment 1, and includes the following steps:

[0067] S1, the host PF driver SR-IOV encryption and decryption system is initialized, at this time all algorithm IP cores are in idle state; create client m, and assign it to use the corresponding encryption card VFm; initialize the client m and its VF driver, and assign it to communicate with the PF driver shared memory VFDevm; synchronize the shared memory address VFDevm to the host PF driver;

[0068] Read the AlgKernal_Req_Msg field from the shared memory for the created client m to check whether there is a request algorithm IP core message, if yes, go to step S2, if no, go back to step S1;

[0069] S2, the client m requests the currently available algorithm IP core b from the host through the shared memory VFDevm, creates an encryption and decryption thread Thread_m_X, and simultaneously creates message queues VM_m_Thread_Msg_Q and VM_m_ReqAlgKernal_Msg_Q for completing status communication between client kernel RTOS algorithm threads for obtaining the request result of the algorithm IP core b;

[0070] S3, when VM_m_Thread_Msg_Q obtains the completion status message of the algorithm IP core b, the encryption and decryption thread Thread_m_X is awakened to complete the encryption and decryption process performed by the PCIE encryption chip algorithm controller;

[0071] S4, after the encryption and decryption operation is completed, the bit X in the idle status register of the algorithm IP core is set to 1, and the corresponding bit X in the interrupt status register of the algorithm IP core is high, and an MSI message interrupt is generated to the host PF driver, so that each algorithm IP core generates an MSI message interrupt request to the host in real time according to the interrupt vector number assigned by the host, and the host PF drives the MSI ISR to uniformly handle the completion status interrupt of the algorithm IP core.

[0072] Step S1 in this embodiment specifically includes:

[0073] S11, configure space, memory space mapping, and allocate MSI interrupt vector for host PF driver, read algorithm IP core idle state register ALG_KERNEL_IDLE_Reg from memory space, and assign the value to algorithm manager global variable ALG_KERNEL_IDLE, whose 32 bits correspond to 32 algorithm IP cores;

[0074] S12, create client m, and assign it to use the corresponding encryption card VFm; initialize client m, initialize VF driver, and assign shared memory VFDevm to communicate with PF driver, the shared memory VFDevm includes the corresponding client number dom_index, encryption and decryption VF priority propriety, the corresponding encryption and decryption VF number vf_index, encryption and decryption thread number thread_Num, encryption and decryption VF request algorithm IP core message AlgKernal_Req_Msg and algorithm IP core completion status message AlgKernal_Done_Msg; wherein the client number in the dom_index field is set to m, and the encryption and decryption VF number in the vf_index field is set to m;

[0075] S13, the VFm driver writes the VFDevm first address information into the VF mailbox interrupt register array corresponding to the client VFx driver of the SR-IOV encryption and decryption chip through the PCIE interface, and then generates an MSI interrupt to notify the host PF driver, takes out the VFDevm address information, and converts the VFDevm address into a host logical address for use by the host VF algorithm core manager. The specific principle steps are as follows: Figure 5 As shown:

[0076] The upper host PF drives the ISR, reads the VF_MAILBOX_INT_STATUS_Reg register from the memory space and assigns it to IntStatus. At this time, the value of the VF_MAILBOX_INT_STATUS_Reg register is cleared by the upper computer CPU read operation. For each bit X of IntStatus, the value of X is between 1 and 32. Shift 1 left by X bits and assign it to IntXMsg. If IntXMsg is non-zero, it indicates a VF mailbox synchronization information operation. The client shared memory address is taken out and converted into a privileged domain host logical address for use by the PF driver and the VF algorithm core manager;

[0077] The host PF drives the ISR, reads the ALG_KERNEL_INT_STATUS_Reg register from the memory space and assigns it to IntStatus. At this time, the value of the ALG_KERNEL_INT_STATUS_Reg register is cleared by the host CPU read operation. At this moment, the completion status information of another algorithm core Y may be synchronized to the host PCIe driver. Because of the processing time difference, the algorithm core Y will not generate an MSI message interrupt.

[0078] For each bit X of IntStatus, the value of X is between 1 and 32. Shift 1 left by X bits and assign it to IntXMsg. If IntXMsg is non-zero, it means that the encryption and decryption operation of the algorithm IP core b is completed, and the corresponding client m is found according to the value of X.

[0079] If the algorithm IP core b corresponds to the client m operation, then write the IntXMsg message to the shared memory AlgKernal_Done_Msg field corresponding to the client m, and clear the slot value corresponding to the algorithm IP core number X in the AlgKernal_Req_Msg field to zero. Otherwise, write the IntXMsg message to the host VM_Thread_Msg_Q to wake up the host thread Thread_X to continue running.

[0080] Finally, the bit X of ALG_KERNEL_IDLE is set to 1, indicating that the algorithm IP core b is idle.

[0081] Step S2 in this embodiment specifically includes:

[0082] S21, when client m has a need for encryption and decryption process, the client m requests the host PF driver VF algorithm core manager through the AlgKernal_Req_Msg field in the shared memory VFDevm to obtain the number of the currently available algorithm IP core d, and to create an encryption and decryption thread Thread_m_X;

[0083] S22, create message queues VM_m_Thread_Msg_Q and VM_m_ReqAlgKernal_Msg_Q for client kernel RTOS algorithm thread completion status communication for obtaining the request result of the algorithm IP core b, and client m creates a process with a higher priority: VF algorithm core management task VM_m_VF_AlgKernal_Task:

[0084] (a) If there is a response message requesting the algorithm IP core b in AlgKernal_Req_Msg, a C message will be written to VM_m_ReqAlgKernal_Msg_Q to wake up the thread that will use the algorithm IP core to continue running.

[0085] (b) If there is a completion status message of the algorithm IP core b in AlgKernal_Done_Msg, a message with a value of 2^X will be written to VM_m_Thread_Msg_Q to wake up the client m thread Thread_m to continue running.

[0086] In this embodiment, the encryption and decryption process of any client m in step S3 is as follows: Figure 3 As shown, specifically including:

[0087] S31, organize the key information of the selected algorithm into a data packet, the host starting PCIE bus address StartAddr_X and length Size_X of the user data to be encrypted and decrypted, set the read and write Offset to 0, the algorithm IP core number X and its algorithm type and other register configuration information into a data packet, and send it to the algorithm IP core b of the encryption chip through the PCIe interface;

[0088] S32, Thread_m_X obtains a message with a value of 2^X from VM_m_Thread_Msg_Q, is blocked, and actively gives up the right to run this thread;

[0089] S33, after the algorithm IP core b completes the encryption and decryption operation on the data to be encrypted and decrypted, the encryption chip issues a PCIe MSI interrupt, and VM_m_VF_AlgKernal_Task of client m writes a 2^X message to the client m kernel message queue VM_m_Thread_Msg_Q, and thread Thread_m_X is awakened by the client m system kernel scheduling;

[0090] S34, thread Thread_m_X refreshes the data cache content at the host starting PCIE bus address StartAddr_X of the data to be encrypted, and then reads the encrypted data from the address, thereby completing this encryption task, and finally releasing the related resources of the middleware thread Thread_m_X.

[0091] The waiting algorithm IP core b in step S33 completes the encryption and decryption operation on the data to be encrypted and decrypted. Figure 4 As shown, specifically including:

[0092] 1) The algorithm controller inside the PCIe encryption chip sets the bit X corresponding to ALG_KERNEL_IDLE_Reg to 0 to indicate busy;

[0093] 2) The algorithm controller inside the PCIe encryption chip cooperates with the algorithm IP core b and uses the DMA module to complete the encryption and decryption operations and the transfer of the result data. When all encryption operations are completed, the algorithm IP core b sets the bit X corresponding to ALG_KERNEL_INT_STATUS_Reg to a high level state;

[0094] 3) When the encryption operation of all the target source data to be encrypted and decrypted is completed, the algorithm controller first sets the bit X corresponding to the ALG_KERNEL_IDLE_Reg register to 1 to indicate idle; at the same time, when the bit X corresponding to the ALG_KERNEL_INT_STATUS_Reg is high, the interrupt vector number of the algorithm IP core b is read out and written into the MSI interrupt "Message Data" register, generating a corresponding MSI message interrupt for the algorithm IP core b, notifying the upper host PF driver chip that the algorithm kernel has completed the encryption and decryption operation.

[0095] Under the design scheme of the present invention, all encryption and decryption services of the PCIE encryption and decryption chip are driven based on the algorithm IP core b. The status register ALG_KERNEL_IDLE_Reg of the available algorithm core inside the chip is located in the PCIe memory space, which is convenient for the host computer PCIe driver to use and configure. The user's encryption and decryption source data is stored in the host computer system memory. The DMA inside the PCIE encryption and decryption chip actively reads the source data, and the algorithm IP core performs encryption and decryption operations. After completion, the internal DMA actively writes the encrypted and decrypted data back to the same memory until all the target source data are processed. Finally, a PCIe MSI message interrupt is generated, and the privileged domain host system kernel processes all algorithm core MSI interrupts, and is not related to the process of the privileged domain host user space, thereby removing the VF encryption and decryption interrupt event and the virtual machine monitor and client operating system processing overhead of physical interrupts and client interrupts; the client high-priority process monitors the shared memory AlgKernal_Done_Msg state and wakes up the relevant threads, which can maximize the performance of the SR-IOV encryption and decryption card; without modifying and compiling the host computer operating system kernel, it can adapt to different systems and application scenarios.

[0096] The SR-IOV encryption and decryption card designed by the present invention has the following advantages:

[0097] 1. The PCIe encryption and decryption chip driver software of this design writes these n interrupt vectors into the ALG_KERNEL_X_MSI_IV_Reg register of each algorithm IP core inside the chip in a sequential manner, in groups of n, according to the number of continuous interrupts n assigned by the upper host PF driver. Each algorithm IP core generates an MSI message interrupt request to the host in real time according to the interrupt vector number assigned by the privileged domain host system. The host PF drives the MSI ISR to uniformly handle the completion status interrupt of the algorithm IP core, and it will not be related to the user process in the privileged domain host. In order to avoid interrupt sharing and virtual interrupt overhead, the client VF encryption and decryption will not generate interrupts to the client VF. In the design of the present invention, a small amount of MSI interrupts can be used to ensure the normal operation of the SR-IOV encryption card, solve the problem of interrupt vector shortage of SR-IOV virtualization, avoid the virtual machine monitor's overhead on the client VF, and ensure the scalability of the SR-IOV system.

[0098] 2. After each PCIe encryption and decryption algorithm core completes the encryption and decryption operation, it finally generates an MSI message interrupt to notify the upper host PF driver of the completion status of the job. Because the design uses the ALG_KERNEL_INT_STATUS_Reg register with a read-clear attribute, it can reduce the MSI interrupt-related register read and write transactions on the PCIe interface, so it is more efficient than the conventional MSI interrupt mask method. In response to the interrupt processing overhead problem faced by SR-IOV encryption and decryption high-performance virtualization, no interrupt is generated during the use of the client VF, and the host PF driver handles all algorithm core MSI interrupts, eliminating the VF device interrupt event and the virtual machine monitor and client operating system's processing overhead for physical interrupts and client interrupts, thereby further greatly improving performance.

[0099] 3. In the application environment of PCIe multi-algorithm IP core, the completion status of each PCIe encryption algorithm core can be uploaded and synchronized to the upper host PF driver at the first time, because the algorithm core completion status information is synchronized to the upper computer by other MSI interrupt ISR. The algorithm controller uniformly manages and writes the interrupt vector number into the MSI interrupt "Message Data" register to generate an MSI message interrupt. Due to the processing time difference in the system, the number of MSI message interrupts issued by the PCIe encryption and decryption chip can be reduced, which reduces the MSI interrupt processing load of the privileged domain host system kernel, improves the efficiency of the host system in processing MSI interrupts, and improves the multi-threaded job processing efficiency of the upper computer host / client.

[0100] 4. The completion status of each PCIe encryption algorithm core can be synchronized to the host computer PCIe driver. In any scenario, there will be no inconsistency between the completion status of the host computer and the PCIe chip algorithm IP core. Therefore, each thread of the host computer can work normally and efficiently and release system resources.

[0101] 5. The MSI interrupt usage scheme designed according to the present invention has relatively simple hardware and software designs, and can provide an efficient working mode for PCIe encryption and decryption operations, thereby reducing overall R&D costs and shortening R&D time.

[0102] 6. The host PF drives the dynamic management algorithm IP core, which can be dynamically allocated and used according to the client's usage requirements. The client VF thread encryption and decryption can maximize the performance indicators of the native PCIe encryption and decryption card.

[0103] 7 The design and implementation of the present invention does not require modification and compilation of the upper host operating system kernel. The SR-IOV encryption and decryption chip has better adaptability. The MSI interrupt is processed in the host PF ISR, and the client VF does not generate an encryption and decryption interrupt.

[0104] By adopting the above technical solution disclosed in the present invention, the following beneficial effects are obtained:

[0105] The present invention discloses a multi-algorithm core high-performance SR-IOV encryption and decryption system and method based on a PCIE port. The SR-IOV encryption and decryption card can improve the MSI interrupt processing efficiency to the greatest extent, and provide efficient PCIe encryption and decryption operations for PF and VF according to the state of the algorithm IP core. Since all encryption and decryption services of the PCIe encryption and decryption chip of the present design are driven based on the algorithm IP core b, as long as the completion status of the internal algorithm IP core of the PCIe encryption and decryption chip is synchronized to the host PF driver of the upper computer, and real-time management is performed. In the host PF driver ISR, the algorithm core operation completion status register is read through the PCIe interface, and the completion status of all algorithm cores can be obtained, and the completion status register is automatically cleared at the same time. Such a design can avoid using MSI in a conventional manner: interrupt delay is large, MSI interrupt loss problems, and when multi-threading uses multi-algorithm IP cores for intensive encryption and decryption operations, the number of upper-layer host PCIe encryption and decryption MSI interrupts will be greatly reduced, and the load of host system kernel interrupt processing will be reduced, thereby improving the performance of system encryption and decryption and solving the problem of interrupt vector shortage faced by the scalability of SR-IOV virtualization. In view of the interrupt processing overhead problem faced by high-performance SR-IOV virtualization, no interruption is generated during the use of client VF encryption and decryption, and the host PF driver processes all algorithm IP core MSI interrupts, eliminating VF device interrupt events and the processing overhead of the virtual machine monitor and the client operating system for physical interrupts and client interrupts, thereby further improving performance. The host PF driver algorithm core manager manages the algorithm IP core status for the created client through a shared memory message queue, and can dynamically allocate and use the algorithm IP core according to the client's usage requirements. The client VF encryption and decryption can achieve the maximum performance index of the native PCIe encryption and decryption card. The software implementation designed by the present invention does not need to modify and compile the host computer system kernel, and the SR-IOV encryption and decryption chip has better adaptability to different application environments.

[0106] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principle of the present invention. These improvements and modifications should also be considered as the scope of protection of the present invention.

Claims

1. A multi-algorithm core high-performance SR-IOV encryption and decryption system, characterized in that: The invention comprises a host, a PCIE chip with multiple algorithm IP cores and several clients, wherein a corresponding shared memory is created between the host and the clients, wherein the host comprises a VF algorithm core manager and a PF driver, wherein the PCIE chip with multiple algorithm IP cores comprises an algorithm controller provided with a VF mailbox interrupt register, an algorithm IP core interrupt status register and an algorithm IP core idle status register, wherein the PF driver is responsible for receiving a VF mailbox MSI interrupt signal and an algorithm IP core completion MSI interrupt signal from the VF mailbox interrupt register and the algorithm IP core interrupt status register of the PCIE chip, and sending the algorithm IP core completion status to the VF algorithm core manager of the host; wherein the VF algorithm core manager is responsible for configuring and managing the algorithm IP core and the VF of the client, and is used for writing the algorithm IP core completion status message into the shared memory message queue in the corresponding client, wherein the client obtains the algorithm IP core operation completion status through the shared memory message queue, thereby realizing that the encryption and decryption operation program is completed after the thread created in the client is awakened; The VF mailbox interrupt register has a read operation clearing attribute, is connected to the interrupt output signal of the VF mailbox, and each bit is connected to a VF mailbox. When the client a writes the shared memory VFDev address information into the VFx mailbox register, a high level is generated for the bit X of the VF mailbox interrupt register. When the upper host PF driver reads the VF mailbox interrupt register of the PCIe encryption and decryption chip in the MSI ISR, the bit X value is 1, and then the bit X becomes a low level, that is, the value of the bit X becomes 0; Each algorithm IP core in the algorithm IP core idle status register corresponds to a bit therein. When an algorithm IP core b generates encryption and decryption services, the corresponding bit X is cleared to 0, indicating a busy state; when an algorithm IP core b generates a job completion state, its corresponding bit X will be set to 1, indicating an idle and available state; The algorithm IP core interrupt status register has a read operation clearing attribute and is connected to the interrupt output signal of the algorithm IP core. Each bit corresponds to an algorithm IP core. When the algorithm IP core b completes the operation, a high level is output to the bit X of the algorithm IP core interrupt status register. When the bit X corresponding to a certain algorithm IP core b in the algorithm IP core interrupt status register is at a high level, the algorithm controller in the PCIE chip reads the interrupt vector number of the algorithm IP core b and writes it into the MSI interrupt vector number register. Each algorithm IP core generates an MSI message interrupt request to the host in real time according to the interrupt vector number assigned by the privileged domain host system. The host PF drives the MSI ISR to uniformly process the completion status interrupt of the algorithm IP core, and notifies the upper host PF driver chip that the algorithm core has completed the encryption and decryption operation.

2. The multi-algorithm core high-performance SR-IOV encryption and decryption system according to claim 1, characterized in that: The PCIe encryption and decryption chip host PF driver software reads the Multiple Message Enable field in the MSIMessage Control register of the PCIe3.0 core of the PCIe encryption and decryption chip from the MSI-related registers in the PCIe configuration space to obtain the number of consecutive interrupts that the PCIe encryption and decryption chip host PF can use.

3. The multi-algorithm core high-performance SR-IOV encryption and decryption system according to claim 2, characterized in that: The shared memory refers to a memory buffer of the shared message VF_Dev_ShareMsg structure type pointed to by the VFDev of client a, wherein the shared message structure includes the corresponding client number dom_index, the encryption and decryption VF priority propriety, the corresponding encryption and decryption VF number vf_index, the encryption and decryption thread number thread_Num, the encryption and decryption VF request algorithm IP core message AlgKernal_Req_Msg and the algorithm IP core completion status message AlgKernal_Done_Msg.

4. A multi-algorithm core high-performance SR-IOV encryption and decryption method, implemented based on the multi-algorithm core high-performance SR-IOV encryption and decryption system according to any one of claims 1 to 3, characterized in that: The following steps are involved: S1, the host PF driver SR-IOV encryption and decryption system is initialized, at which time all algorithm IP cores are in idle state; client m is created, and the corresponding encryption card VFm is assigned to it; the client m and its VF driver are initialized, and the shared memory VFDevm for communication with the PF driver is assigned; the client m generates an MSI interrupt through the VFm mailbox, and synchronizes the shared memory address VFDevm to the host PF driver; S2, the client m requests the currently available algorithm IP core b from the host through the shared memory VFDevm, creates an encryption and decryption thread Thread_m_X, and simultaneously creates message queues VM_m_Thread_Msg_Q and VM_m_ReqAlgKernal_Msg_Q for completing status communication between client kernel RTOS algorithm threads for obtaining the request result of the algorithm IP core b; S3, when VM_m_Thread_Msg_Q obtains the completion status message of the algorithm IP core b, the encryption and decryption thread Thread_m_X is awakened to complete the encryption and decryption process performed by the PCIE encryption chip algorithm controller; S4, after the encryption and decryption operation is completed, the bit X in the idle status register of the algorithm IP core is set to 1, and the corresponding bit X in the interrupt status register of the algorithm IP core is high level, generating an MSI message interrupt to the host PF driver, so that each algorithm IP core can generate an MSI message interrupt request to the host in real time according to the interrupt vector number assigned by the host, and the host PF drives the MSIISR to uniformly handle the completion status interrupt of the algorithm IP core.

5. The multi-algorithm core high-performance SR-IOV encryption and decryption method according to claim 4, characterized in that: Step S1 specifically includes: S11, configure the space, memory space mapping, and allocate the MSI interrupt vector for the host PF driver, read the value of the algorithm IP core idle state register ALG_KERNEL_IDLE_Reg from the memory space, and assign the value to the algorithm manager global variable ALG_KERNEL_IDLE, the number of bits corresponds to the number of algorithm IP cores; S12, create client m, and assign it to use the corresponding encryption card VFm; initialize client m, initialize VF driver, and assign shared memory VFDevm to communicate with PF driver, the shared memory VFDevm includes the corresponding client number dom_index, encryption and decryption VF priority propriety, the corresponding encryption and decryption VF number vf_index, encryption and decryption thread number thread_Num, encryption and decryption VF request algorithm IP core message AlgKernal_Req_Msg and algorithm IP core completion status message AlgKernal_Done_Msg; wherein the client number in the dom_index field is set to m, and the encryption and decryption VF number in the vf_index field is set to m; S13, the VFm driver writes the VFDevm first address information into the VF mailbox interrupt register array corresponding to the client VFx driver of the SR-IOV encryption and decryption chip through the PCIE interface, and then generates an MSI interrupt to notify the host PF driver. The host PF driver MSI ISR takes out the VFDevm address information and converts the VFDevm address into a host logical address for use by the host VF algorithm core manager.

6. The multi-algorithm core high-performance SR-IOV encryption and decryption method according to claim 5, characterized in that: Step S2 specifically includes: S21, when client m has a need for encryption and decryption process, the client m requests the host PF driver VF algorithm core manager through the AlgKernal_Req_Msg field in the shared memory VFDevm to obtain the number of the currently available algorithm IP core d, and to create an encryption and decryption thread Thread_m_X; S22, create message queues VM_m_Thread_Msg_Q and VM_m_ReqAlgKernal_Msg_Q for client kernel RTOS algorithm thread completion status communication for obtaining the request result of the algorithm IP core b, and client m creates a process with a higher priority: VF algorithm core management task VM_m_VF_AlgKernal_Task: (a) If there is a response message from the requesting algorithm IP core b in AlgKernal_Req_Msg, a C message will be written to VM_m_ReqAlgKernal_Msg_Q to wake up the thread that will use the algorithm IP core to continue running; (b) If there is a completion status message of the algorithm IP core b in AlgKernal_Done_Msg, a message with a value of 2^X will be written to VM_m_Thread_Msg_Q to wake up the client m thread Thread_m to continue running.

7. The multi-algorithm core high-performance SR-IOV encryption and decryption method according to claim 5, characterized in that: Step S3 specifically includes: S31, organize the key information of the selected algorithm into a data packet, the host starting PCIE bus address StartAddr_X and length Size_X of the user data to be encrypted and decrypted, set the read and write Offset to 0, and the register configuration information of the algorithm IP core b and its algorithm type into a data packet, and send it to the algorithm IP core b of the encryption chip through the PCIe interface; S32, Thread_m_X obtains a message with a value of 2^X from VM_m_Thread_Msg_Q, is blocked, and actively gives up the right to run this thread; S33, after the algorithm IP core b completes the encryption and decryption operation on the data to be encrypted and decrypted, the encryption chip issues a PCIe MSI interrupt, and VM_m_VF_AlgKernal_Task of client m writes a 2^X message to the client m kernel message queue VM_m_Thread_Msg_Q, and thread Thread_m_X is awakened by the client m system kernel scheduling; S34, thread Thread_m_X refreshes the data cache content at the starting address StartAddr_X of the host PCIE bus of the data to be encrypted, and then reads the encrypted data from the address, thereby completing this encryption task, and finally releasing the related resources of the middleware thread Thread_m_X.

8. The multi-algorithm core high-performance SR-IOV encryption and decryption method according to claim 7, characterized in that: The waiting algorithm IP core b in step S33 completes the encryption and decryption operation on the data to be encrypted and decrypted, specifically including: (1) The algorithm controller inside the PCIe encryption chip sets the bit X corresponding to ALG_KERNEL_IDLE_Reg to 0 to indicate busy; (2) The algorithm controller inside the PCIe encryption chip cooperates with the algorithm IP core b and uses the DMA module to complete the encryption and decryption operations and the transfer of the result data. When all encryption operations are completed, the algorithm IP core b sets the bit X corresponding to ALG_KERNEL_INT_STATUS_Reg to a high level state; (3) When the encryption operation of all the target source data to be encrypted and decrypted is completed, the algorithm controller first sets the bit X corresponding to the ALG_KERNEL_IDLE_Reg register to 1 to indicate idle; at the same time, when the bit X corresponding to the ALG_KERNEL_INT_STATUS_Reg is high, the interrupt vector number of the algorithm IP core b is read out and written into the MSI interrupt "Message Data" register, generating a corresponding MSI message interrupt for the algorithm IP core b, notifying the upper host PF driver chip that the algorithm kernel has completed the encryption and decryption operation.

9. The multi-algorithm core high-performance SR-IOV encryption and decryption method according to claim 4, characterized in that: Step S1 and step S2 also include: reading the AlgKernal_Req_Msg field from the shared memory of the created client m to check whether there is a request algorithm IP core message, if yes, proceeding to step S2, if no, returning to step S1.

Images