Data processing device and data processing method

Abstract

The invention discloses a data processing device and a data processing method, and relates to the technical field of data processing.The device comprises a processor, a memory unit and an input and output interface, the processor comprises a kernel, a memory management unit, a register, a first-level cache unit and a second-level cache unit, and the device further comprises a cache division control module, a first-level cache division module and a second-level cache division module, the determining module is used for determining a second target cache block in the first-level cache unit corresponding to the security computing program and a first target cache block in the second-level cache unit when the general computing program and the security computing program are executed in parallel; the memory division control module is used for determining a target memory block corresponding to the security calculation program; the input and output interface division control module is used for determining a target input and output interface corresponding to the security calculation program; wherein the register comprises a first register corresponding to the general-purpose computing program and a second register corresponding to the security computing program, so that the kernel runs the general-purpose computing program and the security computing program in parallel.

Description

Technical Field

[0001] This application relates to the technical field of data processing, and in particular, to a data processing device and a data processing method. Background Art

[0002] The computing programs of a CPU with a RISC-V architecture are divided into two categories: general computing programs and secure computing programs. General computing programs are general programs running on a CPU with a RISC-V architecture. Such programs have low requirements for security, and the memory, input / output (I / O) interfaces, etc. they access also have low security requirements. Secure computing programs are secure computing programs running on a CPU with a RISC-V architecture. Such programs have high requirements for security, such as entering passwords, face recognition, and transferring critical data with external devices through the I / O interface on the CPU.

[0003] To ensure the operation of secure computing, in traditional solutions, a separate secure execution environment is physically isolated in a CPU with a RISC-V architecture. That is, in traditional solutions, the CPU with a RISC-V architecture is isolated into two physical environments, a general computing environment and a secure computing environment. Through time-sharing multiplexing of the CPU, physical separate partitioning of the cache, double data rate synchronous dynamic random access memory (DDR), and I / O interface, when general computing is running, after saving the context of the general computing program, it enters the secure computing environment to execute the secure computing program.

[0004] However, the traditional implementation mode of secure computing in a RISC-V CPU has great drawbacks. That is, during the execution of a secure computing program, the CPU is time-sharing multiplexed, and at this time, the CPU cannot run general computing programs, which may cause some critical general computing programs to stop running and may bring catastrophic consequences. Summary of the Invention

[0005] In view of this, embodiments of this application provide a data processing device and a data processing method.

[0006] According to the first aspect of this application, embodiments of this application provide a data processing device, including a processor, a memory unit, and an input / output interface. The processor includes a core, a memory management unit, registers, a level-1 cache unit, and a level-2 cache unit. The device further includes: The cache partition control module is used to obtain the instructions corresponding to the secure computing program when it monitors that the kernel is executing the instructions of the general computing program. Based on the access frequencies of the data in each cache block of the secondary cache unit and the preset cache space partition configuration information, it determines the first target cache block and moves the first data in the first target cache block to the memory partition control module. Based on the access frequencies of the data in each cache block of the primary cache unit and the preset cache space partition configuration information, it determines the second target cache block and moves the second data in the second target cache block to the third target cache block in the secondary cache unit, where the third target cache block is different from the first target cache block. After completing the data transfer, it sends a first notification message to the memory management unit so that the memory management unit determines the mapping relationship between the virtual addresses corresponding to the general computing program and the secure computing program and the physical addresses corresponding to the primary cache unit and the secondary cache unit based on the first notification message, so that the second target cache block in the primary cache unit is used to cache the data corresponding to the secure computing program, and the first target cache block in the secondary cache unit is used to cache the data corresponding to the secure computing program; The memory partition control module is used to receive the first data sent by the cache partition control module and write the first data into the memory unit. It counts the idle space of the memory unit and the data access frequencies of the memory blocks in the memory unit, and determines the target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequencies of the memory blocks in the memory unit, the preset memory space partition configuration information, and the first preset policy. It sends a second notification message to the memory management unit so that the memory management unit determines the mapping relationship between the virtual addresses corresponding to the general computing program and the secure computing program and the physical address corresponding to the memory unit based on the second notification message, so that the target memory block in the memory unit is used to store the data corresponding to the secure computing program; The input / output interface partition control module is used to count the idle status and load of each input / output interface, and obtain the input / output interface information required by the secure computing program sent by the kernel. It determines the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface, the input / output interface information required by the secure computing program, and the second preset policy. It sends a third notification message to the kernel so that the kernel divides the target input / output interface for the secure computing program to use based on the third notification message; Among them, the memory management unit performs unified virtual address and physical address management on the general computing program and the security computing program; the virtual address corresponding to the general computing program is different from the virtual address corresponding to the security computing program; the physical address corresponding to the general computing program is different from the physical address corresponding to the security computing program; the register includes a first register corresponding to the general computing program and a second register corresponding to the security computing program, so that the kernel can run the general computing program and the security computing program in parallel.

[0007] Optionally, the cache partitioning control module includes a cache partitioning comprehensive control module, a first-level cache space adjustment module, and a second-level cache space adjustment module; The cache partitioning comprehensive control module is used to obtain the instructions corresponding to the security computing program when monitoring that the kernel is executing the instructions of the general computing program, and send a first control signal to the second-level cache space adjustment module; the first control signal includes the access frequency of the data in each cache block of the second-level cache unit, and the preset cache space partitioning configuration information; The second-level cache space adjustment module is used to determine the first target cache block based on the access frequency of the data in each cache block of the second-level cache unit and the preset cache space partitioning configuration information, move the first data in the first target cache block to the memory partitioning control module, and send a fourth notification message to the cache partitioning comprehensive control module after the movement is completed; The cache partitioning comprehensive control module is further used to send a second control signal to the first-level cache space adjustment module based on the fourth notification message, and the second control signal includes the access frequency of the data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information; The first-level cache space adjustment module is used to determine the second target cache block based on the access frequency of the data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information, move the second data in the second target cache block to the third target cache block in the second-level cache unit, and send a fifth notification message to the cache partitioning comprehensive control module after the movement is completed; The cache partitioning comprehensive control module is further used to send a first notification message to the memory management unit based on the fourth notification message and the fifth notification message.

[0008] Optionally, the cache partitioning control module further includes a cache space adaptive allocation module; The cache space adaptive allocation module is used to count the access rate of the first-level cache unit, the loss rate of the first-level cache unit, the access rate of the second-level cache unit, and the loss rate of the second-level cache unit corresponding to the general computing program, as well as the access rate of the first-level cache unit, the loss rate of the first-level cache unit, the access rate of the second-level cache unit, and the loss rate of the second-level cache unit corresponding to the secure computing program; based on the access rate of the first-level cache unit, the loss rate of the first-level cache unit, the access rate of the second-level cache unit, and the loss rate of the second-level cache unit corresponding to the general computing program, as well as the access rate of the first-level cache unit, the loss rate of the first-level cache unit, the access rate of the second-level cache unit, and the loss rate of the second-level cache unit corresponding to the secure computing program, and the third preset policy, adjust the first-level cache unit space and the second-level cache unit space corresponding to the general computing program and the secure computing program.

[0009] Optionally, the cache partitioning control module is further configured to send a sixth notification message to the memory management unit when it detects that the secure computing program stops running, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical addresses corresponding to the first-level cache unit and the second-level cache unit based on the sixth notification message, so that each cache block of the first-level cache unit and the second-level cache unit is used to cache the data corresponding to the general computing program.

[0010] Optionally, the memory partitioning control module includes a second-level cache receiving control module and a memory statistics control module; The second-level cache receiving control module is used to receive the first data sent by the cache partitioning control module and write the first data into the memory unit; The memory statistics control module is used to count the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit, and determine the target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space partitioning configuration information, and the second preset policy; and send a second notification message to the memory management unit.

[0011] Optionally, the memory partitioning control module further includes a memory and hard disk interaction module; The memory statistics control module is further configured to send a seventh notification message to the memory and hard disk interaction module if it determines that the data corresponding to the general computing program is stored in the target memory block; The memory and hard disk interaction module is used to move the data corresponding to the general computing program stored in the target memory block to the hard disk based on the seventh notification message.

[0012] Optionally, the memory partitioning control module is further configured to send an eighth notification message to the memory management unit when it detects that the secure computing program has stopped running, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit based on the eighth notification message, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

[0013] Optionally, the input / output interface partitioning control module includes an input / output live statistics module and an input / output partitioning comprehensive control module; The input / output live statistics module is configured to statistically analyze the idle status and load of each input / output interface and send them to the input / output partitioning comprehensive control module; The input / output partitioning comprehensive control module is configured to obtain the input / output interface information required by the secure computing program sent by the kernel; and determine the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface, the input / output interface information required by the secure computing program, and a second preset policy; and send a third notification message to the kernel.

[0014] Optionally, the input / output interface partitioning control module further includes an input / output task migration control module; The input / output partitioning comprehensive control module is further configured to send a ninth notification message to the input / output task migration control module if it determines that there is an interface among the target input / output interfaces that is called by the general computing program; The input / output task migration control module is configured to perform time-division multiplexing partitioning on the other input / output interfaces except the target input / output interfaces based on the ninth notification message, and send the obtained partitioning result to the kernel, so that the kernel modifies the interfaces of the general computing program that calls the target input / output interfaces based on the partitioning result.

[0015] Optionally, the input / output interface partitioning control module is further configured to send a tenth notification message to the kernel when it detects that the secure computing program has stopped running, so that the kernel determines the mapping relationship between the general computing program and the input / output interface based on the tenth notification message, so that each input / output interface is used for the general computing program.

[0016] Optionally, the apparatus further includes: A cache access control module, configured to encrypt the data corresponding to the secure computing program and store it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit; A memory access control module, configured to encrypt the data corresponding to the secure computing program and store it in the target memory block of the memory unit; The input / output interface access control module is used to encrypt the data corresponding to the secure computing program and then call it through the target input / output interface of the input / output interface.

[0017] According to the second aspect of the present application, embodiments of the present application provide a data processing method, which is applied to a device. The device includes a processor, a memory unit, an input / output interface, a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module. The processor includes a kernel, a memory management unit, registers, a first-level cache unit, and a second-level cache unit. The method includes: When the cache partitioning control module monitors that the kernel is executing an instruction of a general computing program, it obtains the instruction corresponding to the secure computing program, determines the first target cache block based on the access frequency of the data in each cache block of the second-level cache unit and the preset cache space partitioning configuration information, and moves the first data in the first target cache block to the memory partitioning control module; determines the second target cache block based on the access frequency of the data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information, and moves the second data in the second target cache block to the third target cache block in the second-level cache unit, where the third target cache block is different from the first target cache block; and after completing the data transfer, sends a first notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical addresses corresponding to the first-level cache unit and the second-level cache unit, so that the second target cache block in the first-level cache unit is used to cache the data corresponding to the secure computing program, and the first target cache block in the second-level cache unit is used to cache the data corresponding to the secure computing program; The memory partitioning control module receives the first data sent by the cache partitioning control module and writes the first data into the memory unit; counts the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit, and determines the target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space partitioning configuration information, and the first preset policy; and sends a second notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the memory unit, so that the target memory block in the memory unit is used to store the data corresponding to the secure computing program; The input / output interface division control module counts the idle status and load of each input / output interface, and obtains the input / output interface information required for the secure computing program sent by the kernel; and determines the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface, the input / output interface information required for the secure computing program, and a second preset policy; and sends a third notification message to the kernel, so that the kernel divides the target input / output interface for the secure computing program to use based on the third notification message; Among them, the memory management unit performs unified virtual address and physical address management on the general computing program and the secure computing program; the virtual address corresponding to the general computing program is different from the virtual address corresponding to the secure computing program; the physical address corresponding to the general computing program is different from the physical address corresponding to the secure computing program; the registers include a first register corresponding to the general computing program and a second register corresponding to the secure computing program, so that the kernel can run the general computing program and the secure computing program in parallel.

[0018] Optionally, the device further includes a cache access control module, a memory access control module, and an input / output interface access control module, and the method further includes: The cache access control module encrypts the data corresponding to the secure computing program and stores it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit; The memory access control module encrypts the data corresponding to the secure computing program and stores it in the target memory block of the memory unit; The input / output interface access control module encrypts the data corresponding to the secure computing program and invokes it through the target input / output interface of the input / output interface.

[0019] Optionally, the data processing method further includes: When the cache division control module detects that the secure computing program stops running, it sends a sixth notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical addresses corresponding to the first-level cache unit and the second-level cache unit based on the sixth notification message, so that each cache block of the first-level cache unit and the second-level cache unit is used to cache the data corresponding to the general computing program.

[0020] Optionally, the data processing method further includes: When the memory division control module detects that the secure computing program stops running, it sends an eighth notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit based on the eighth notification message, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

[0021] The device and data processing method provided by the embodiments of the present application can, by adding three hardware function modules, namely a cache division control module, a memory division control module, and an input / output interface division control module, enable the kernel to, during the execution of a general computing program, if the kernel also receives instructions for a secure computing program, the cache division control module, the memory division control module, and the input / output interface division control module can timely divide the target cache block, target memory block, and target input / output interface corresponding to the secure computing program from the cache unit, memory unit, and input / output interface, so that the general computing program and the secure computing program each have corresponding hardware resources and ensure that the data of the general computing program is not lost; and by adding registers for the secure computing program in the kernel, the instructions of the secure computing program and the general computing program are independent of each other, the general registers are independent of each other, and a memory management unit is used to uniformly manage the virtual addresses and physical addresses of the hardware resources of the general computing program and the secure computing program; it can ensure the parallel execution of the general computing program and the secure computing program in one kernel and reduce the impact of secure computing on general computing; and, when the kernel only executes the general computing program, the cache unit, memory unit, and input / output interface are all allocated for the general computing program to use, and when the kernel needs to execute the general computing program and the secure computing program in parallel, the cache unit, memory unit, and input / output interface are only then allocated for the two computing programs to use, so that there is no need to separately isolate the hardware resources corresponding to the secure computing program, and the utilization rate of the CPU hardware resources can be maximized.

[0022] The above description is only an overview of the technical solution of the present application. In order to be able to understand the technical means of the present application more clearly, it can be implemented in accordance with the content of the specification. And in order to make the above and other purposes, features, and advantages of the present application more obvious and understandable, the following specifically illustrates the specific embodiments of the present application. Brief Description of the Drawings

[0023] Figure 1 It is a schematic diagram of the hardware structure of a data processing device in an embodiment of the present application; Figure 2 It is a schematic diagram of the structure of the cache division control module in an embodiment of the present application; Figure 3 It is a schematic diagram of the structure of the memory division control module in an embodiment of the present application; Figure 4 It is a schematic diagram of the structure of the input / output interface division control module in an embodiment of the present application; Figure 5 It is a schematic diagram of the flow of a data processing method in an embodiment of the present application. Detailed Description of the Embodiments

[0024] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the following will clearly and completely describe the technical solutions in the embodiments of this application with reference to the accompanying drawings in the embodiments of this application. Obviously, the described embodiments are some, but not all, of the embodiments of this application. All other embodiments obtained by those of ordinary skill in the art based on the embodiments in this application without creative efforts shall fall within the protection scope of this application.

[0025] An embodiment of this application provides a data processing device, as Figure 1 shown, including a processor 11, a memory unit 12, and an input / output interface 13. The processor 11 includes a kernel 111, a memory management unit 112, registers 113, a level-1 cache unit 114, and a level-2 cache unit 115. The device further includes: A cache partitioning control module 14, configured to, when it monitors that the kernel 111 is executing an instruction of a general computing program, obtain an instruction corresponding to a secure computing program, determine a first target cache block based on the access frequency of data in each cache block of the level-2 cache unit 115 and the preset cache space partitioning configuration information, and move the first data in the first target cache block to a memory partitioning control module 15; determine a second target cache block based on the access frequency of data in each cache block of the level-1 cache unit 114 and the preset cache space partitioning configuration information, and move the second data in the second target cache block to a third target cache block in the level-2 cache unit 115, where the third target cache block is different from the first target cache block; and after completing the data movement, send a first notification message to the memory management unit 112, so that the memory management unit 112 determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical addresses corresponding to the level-1 cache unit 114 and the level-2 cache unit 115, so that the second target cache block in the level-1 cache unit 114 is used to cache data corresponding to the secure computing program, and the first target cache block in the level-2 cache unit 115 is used to cache data corresponding to the secure computing program; The memory division control module 15 is configured to receive the first data sent by the cache division control module 14, and write the first data into the memory cell 12; count the idle space of the memory cell 12 and the data access frequency of the memory blocks in the memory cell 12, and determine a target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequency of the memory blocks in the memory cell 12, the preset memory space division configuration information, and the first preset policy; and send a second notification message to the memory management unit 112, so that the memory management unit 112 determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the memory cell 12 based on the second notification message, so that the target memory block in the memory cell 12 is used to store the data corresponding to the secure computing program.

[0026] The input / output interface division control module 16 is configured to count the idle status and load of each input / output interface 13, and obtain the input / output interface information required for the secure computing program sent by the kernel 111; and determine the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface 13, the input / output interface information required for the secure computing program, and the second preset policy; and send a third notification message to the kernel 111, so that the kernel 111 divides the target input / output interface for the secure computing program to use based on the third notification message.

[0027] Wherein, the memory management unit 112 performs unified virtual address and physical address management on the general computing program and the secure computing program; the virtual address corresponding to the general computing program is different from the virtual address corresponding to the secure computing program; the physical address corresponding to the general computing program is different from the physical address corresponding to the secure computing program; the register 113 includes a first register corresponding to the general computing program and a second register corresponding to the secure computing program, so that the kernel 111 can run the general computing program and the secure computing program in parallel.

[0028] In this embodiment, as Figure 1 shown, the device may further include a system bus 17. The processor 11, the input / output interface 13, and the memory cell 12 are connected through the system bus.

[0029] In this embodiment, as Figure 1 shown, the processor 11 may be a central processing unit (CPU), the first-level cache unit 114 may include an L1 Cache, and the second-level cache unit 115 may be an L2 Cache. The memory cell 12 may be a double data rate synchronous dynamic random access memory (DDR). The input / output interface (IO) 13 may include an Ethernet (network unit) interface, a UART (serial port unit) interface, a USB (universal serial bus) interface, and a PCIe (a high-speed serial computer expansion bus standard) interface.

[0030] In this embodiment, the main function of the cache partitioning control module 14 is to quickly partition the L1 Cache and L2 Cache spaces running the general computing program when the security program is running, partition out independent areas, and run the general computing program and the security computing program respectively.

[0031] In this embodiment, the same core 111 can execute the general computing program and the security computing program in parallel. Therefore, the virtual address partitioning and physical address partitioning at the system software level can be continuous. Therefore, a memory management unit (MMU) 112 can be used to uniformly manage the virtual addresses and physical addresses of the hardware resources for general computing and security computing, and only need to continuously partition the virtual addresses at the system software level. For example, the virtual address space allocated to the general computing program A is 0x1000_0000 - 0x2000_0000, and the virtual address space of the security computing program B is 0x3000_0000---0x5000_0000.

[0032] In this embodiment, the registers 113 in the core 111 include not only the first registers x0 - x31, but also the second registers x32 - x63. Among them, x0 - x31 are used by the general computing program, and x32 - x63 are used by the security computing program. When compiling the general computing program, x0 - x31 are used, and when compiling the security computing program, x32 - x63 are used; in this way, the instruction structures of the compiled general computing program and security computing program, as well as the registers 113 related to the instructions, are also independent of each other, facilitating the core 111 to execute the general computing program and the security computing program in parallel.

[0033] In some embodiments, as Figure 1 shown, the apparatus further includes: A cache access control module 18, configured to encrypt the data corresponding to the security computing program and store it in the second target cache block of the first-level cache unit 114 and the first target cache block of the second-level cache unit 115.

[0034] A memory access control module 19, configured to encrypt the data corresponding to the security computing program and store it in the target memory block of the memory unit 12.

[0035] An input / output interface access control module 20, configured to encrypt the data corresponding to the security computing program and call it through the target input / output interface in the input / output interface 13.

[0036] In this embodiment, the data of the Cache, DDR, and IO corresponding to the secure computing program is encrypted and then decoded by the secure computing program before use. Taking Cache as an example, the data corresponding to the secure computing program is encrypted and stored in the Cache. After the core 111 of the processor 11 reads back the data, it is first decrypted and then calculated. This ensures that even if the data of the secure computing program is stolen, it cannot be recognized and parsed, further improving the security of the data and processes in secure computing.

[0037] The device provided by the embodiment of the present application can, by adding three hardware function modules, namely a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module, enable the core to, during the execution of a general computing program, if the core also receives an instruction of a secure computing program, the cache partitioning control module, the memory partitioning control module, and the input / output interface partitioning control module can timely partition out the target cache block, the target memory block, and the target input / output interface corresponding to the secure computing program from the cache unit, the memory unit, and the input / output interface, so that the general computing program and the secure computing program each have corresponding hardware resources and ensure that the data of the general computing program is not lost; and by adding registers for the secure computing program in the core, the instructions of the secure computing program and the general computing program are independent of each other, and the general registers are independent of each other, and a memory management unit is used to uniformly manage the virtual addresses and physical addresses of the hardware resources of the general computing program and the secure computing program; it can ensure the parallel execution of the general computing program and the secure computing program in one core, reducing the impact of secure computing on general computing; and when the core only executes the general computing program, the cache unit, the memory unit, and the input / output interface are all allocated for the general computing program to use, and when the core needs to execute the general computing program and the secure computing program in parallel, the cache unit, the memory unit, and the input / output interface are allocated for the two computing programs to use, so that the hardware resources corresponding to the secure computing program do not need to be separately isolated, and the utilization rate of the CPU hardware resources can be maximized.

[0038] In an optional embodiment, as Figure 2 shown, the cache partitioning control module includes a cache partitioning comprehensive control module 141, a primary cache space adjustment module 142, and a secondary cache space adjustment module 143.

[0039] The cache partitioning comprehensive control module 141 is used to, when detecting that the core is executing an instruction of a general computing program and obtaining an instruction corresponding to the secure computing program, send a first control signal to the secondary cache space adjustment module 143; the first control signal includes the access frequency of the data in each cache block of the secondary cache unit and the preset cache space partitioning configuration information.

[0040] The secondary cache space adjustment module 143 is used to determine a first target cache block based on the access frequencies of the data in the cache blocks of the secondary cache unit and the preset cache space division configuration information, move the first data in the first target cache block to the memory division control module, and send a fourth notification message to the cache division comprehensive control module 141 after the movement is completed.

[0041] The cache division comprehensive control module 141 is further used to send a second control signal to the primary cache space adjustment module based on the fourth notification message. The second control signal includes the access frequencies of the data in the cache blocks of the primary cache unit and the preset cache space division configuration information.

[0042] The primary cache space adjustment module 142 is used to determine a second target cache block based on the access frequencies of the data in the cache blocks of the primary cache unit and the preset cache space division configuration information, move the second data in the second target cache block to a third target cache block in the secondary cache unit, and send a fifth notification message to the cache division comprehensive control module 141 after the movement is completed.

[0043] The cache division comprehensive control module 141 is further used to send a first notification message to the memory management unit based on the fourth notification message and the fifth notification message.

[0044] In this embodiment, when the cache division comprehensive control module 141 detects that a secure computing program is to be run, it can first control the pipeline in the kernel that is running a general computing program to suspend the pipeline after executing the currently executing instruction, and at the same time control the instruction fetch unit in the kernel to pause fetching values from the primary cache unit. After moving the second data in the second target cache block to the third target cache block in the secondary cache unit, it then controls the pipeline in the kernel that is running the general computing program to continue execution, and at the same time controls the instruction fetch unit in the kernel to continue fetching values from the primary cache unit to ensure the division of the secondary cache unit and the primary cache unit and ensure the continued execution of the general computing program.

[0045] In this embodiment, the preset cache space division configuration information may include the percentage of the space in the primary cache unit and the secondary cache unit allocated for use by the secure computing program. For example, 50% of the L1 Cache space is used for general computing, 50% of the space is used for secure computing, 50% of the L2 Cache space is used for general computing, and 50% of the L2 Cache space is used for secure computing.

[0046] In specific implementation, the secondary cache space adjustment module 143 can combine the preset cache space division configuration information according to the access frequencies of the data in each cache block of the secondary cache unit, and move the data of the corresponding cache block to the memory unit in the form of direct memory access (DMA). For example, in the cache space division, the L2 cache space reserved for secure computing is 256 KB, and the size of the L2 cache block is 64 KB. Then, the secondary cache space adjustment module 143 migrates the data of the 4 (256 / 64 = 4) L2 cache blocks with the lowest access frequencies to the DDR.

[0047] After obtaining the division of the L2 cache space used by the secure computing program, the division of the L1 cache space used by the secure computing program is obtained. This order ensures that the relevant data in the L1 cache can be safely and stably migrated to the L2 cache to ensure the stability of the entire system. The primary cache space adjustment module 142 migrates the corresponding L1 cache data to the L2 cache according to the preset cache space division configuration information. Similarly, it is also based on the access frequencies of the data in each cache block of the primary cache unit obtained from the cache division comprehensive control module 141, and combines the preset cache space division configuration information, and moves the data of the corresponding L1 cache block to the L2 cache in the form of DMA. For example, in the cache space division, the L1 cache space reserved for secure computing is 64 KB, and the size of the L1 cache block is 32 KB. Then, the primary cache space adjustment module 142 migrates the data of the 2 (64 / 32 = 4) L1 cache blocks with the lowest access frequencies to the L2 cache.

[0048] In some embodiments, as Figure 2 shown, the cache division control module further includes a cache space adaptive allocation module 144.

[0049] The cache space adaptive allocation module 144 is used to count the access rate, miss rate of the first-level cache unit, access rate and miss rate of the second-level cache unit corresponding to the general computing program, as well as the access rate, miss rate of the first-level cache unit, access rate and miss rate of the second-level cache unit corresponding to the security computing program; based on the access rate, miss rate of the first-level cache unit, access rate and miss rate of the second-level cache unit corresponding to the general computing program, the access rate, miss rate of the first-level cache unit, access rate and miss rate of the second-level cache unit corresponding to the security computing program, and the third preset policy, adjust the first-level cache unit space and the second-level cache unit space corresponding to the general computing program and the security computing program.

[0050] Specifically, the cache space adaptive allocation module 144 counts the access rate and miss rate of the L1 Cache of the general computing program. The so-called miss means that the accessed data is not in the L1 Cache and needs to be queried in the L2 Cache, denoted as L1_access_freq_normal and L1_access_miss_normal. It counts the access rate and miss rate of the L2 Cache of the general computing program, denoted as L2_access_freq_normal and L2_access_miss_normal.

[0051] At the same time, it counts the access rate and miss rate of the L1 Cache of the security computing program, denoted as L1_access_freq_security and L1_access_miss_security; it counts the access rate and miss rate of the L2 Cache of the security computing program, denoted as L2_access_freq_security and L2_access_miss_security. And different treatments are carried out according to the following different situations.

[0052] 1) If L1_access_freq_normal and L1_access_miss_normal are high, and L1_access_freq_security and L1_access_miss_security are not high, then the cache space adaptive allocation module 144 raises the control signal enhance_L1_normal to the first-level cache space adjustment module 142. The first-level cache space adjustment module 142 re-adjusts and divides the space of the L1 Cache (the direction is to reduce the L1 Cache space occupied by the security computing program and expand the L1 Cache space occupied by the general computing program), and performs different levels of L1 Cache re-partitioning according to the order of magnitude of L1_access_freq_normal and L1_access_miss_normal. The principle is that the higher the values of L1_access_freq_normal and L1_access_miss_normal, the larger the L1 Cache space re-allocated to the general computing without affecting the security computing.

[0053] 2) If L1_access_freq_security and L1_access_miss_security are not high, and L1_access_freq_normal and L1_access_miss_normal are high, then the cache space adaptive allocation module 144 raises the control signal enhance_L1_security to the first-level cache space adjustment module 142. The first-level cache space adjustment module 142 re-adjusts and divides the space of the L1 (the direction is to reduce the L1 space occupied by the general computing program and expand the L1 space occupied by the security computing program), and performs different levels of L1 Cache re-partitioning according to the order of magnitude of L1_access_freq_security and L1_access_miss_security. The principle is that the higher the values of L1_access_freq_security and L1_access_miss_security, the larger the L1 Cache space re-allocated to the security computing without affecting the general computing.

[0054] 3) If L1_access_freq_security and L1_access_miss_security are high, and L1_access_freq_normal and L1_access_miss_normal are also high, then the cache space adaptive allocation module 144 raises the control signal enhance_L1_security to the first-level cache space adjustment module 142. The first-level cache space adjustment module 142 re-adjusts and divides the space of L1 (the direction is to reduce the L1 Cache space occupied by the general computing program and expand the L1 Cache space occupied by the security computing program), and re-divides different levels of L1 Cache according to the order of magnitude of L1_access_freq_security and L1_access_miss_security. The principle is that the higher the values of L1_access_freq_security and L1_access_miss_security, in order to ensure the performance of security computing, some performance of general computing will be sacrificed, and the larger the L1 space re-allocated to general computing will be. It should be noted that when reducing the L1 Cache space of general / security computing, the corresponding data should be synchronized to the L2 Cache first and then proceed.

[0055] Use a similar control method to control the adaptive division of L2.

[0056] 4) If L2_access_freq_normal and L2_access_miss_normal are high, and L2_access_freq_security and L2_access_miss_security are not high, then the cache space adaptive allocation module 144 raises the control signal enhance_L2_normal to the second-level cache space adjustment module 143. The second-level cache space adjustment module 143 re-adjusts and divides the space of L2 Cache (the direction is to reduce the L2 Cache space occupied by the security computing program and expand the L2 Cache space occupied by the general computing program), and re-divides different levels of L2 Cache according to the order of magnitude of L2_access_freq_normal and L2_access_miss_normal. The principle is that the higher the values of L2_access_freq_normal and L2_access_miss_normal, the larger the L2 Cache space re-allocated to general computing will be without affecting the security computing.

[0057] 5) If the L2_access_freq_security and L2_access_miss_security are not high, and the L2_access_freq_normal and L2_access_miss_normal are high, then the cache space adaptive allocation module 144 raises the control signal enhance_L2_security to the secondary cache space adjustment module 143. The secondary cache space adjustment module 143 re-adjusts and divides the space of the L2Cache (the direction is to reduce the L2 Cache space occupied by the general computing program and expand the L2 Cache space occupied by the security computing program), and performs different levels of L2 Cache re-partitioning according to the order of magnitude of L2_access_freq_security and L2_access_miss_security. The principle is that the higher the values of L2_access_freq_security and L2_access_miss_security, the larger the L2 Cache space re-allocated to the security computing without affecting the general computing.

[0058] 6) If the L2_access_freq_security and L2_access_miss_security are high, and the L2_access_freq_normal and L2_access_miss_normal are also high, then the cache space adaptive allocation module 144 raises the control signal enhance_L2_security to the secondary cache space adjustment module 143. The secondary cache space adjustment module 143 re-adjusts and divides the space of the L2Cache (the direction is to reduce the L2 Cache space occupied by the general computing program and expand the L2 Cache space occupied by the security computing program), and performs different levels of L2 re-partitioning according to the order of magnitude of L2_access_freq_security and L2_access_miss_security. The principle is that the higher the values of L2_access_freq_security and L2_access_miss_security, in order to ensure the performance of the security computing, some performance of the general computing will be sacrificed, and the larger the L2 Cache space re-allocated to the general computing. It should be noted that when reducing the L2 Cache space of the general / security computing, the corresponding data should be synchronized to the DDR first and then proceed.

[0059] In this embodiment, by setting the cache space adaptive allocation module 144, the preset cache space division configuration can be adaptively adjusted to achieve the best performance balance between secure computing and general computing, thereby improving the balanced performance of the RISC-V architecture CPU.

[0060] In some embodiments, the cache division control module is further configured to send a sixth notification message to the memory management unit when it detects that the secure computing program has stopped running, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical addresses corresponding to the first-level cache unit and the second-level cache unit based on the sixth notification message, so that each cache block of the first-level cache unit and the second-level cache unit is used to cache the data corresponding to the general computing program.

[0061] In this embodiment, when the secure computing program stops running, the spaces of all the first-level cache unit and the second-level cache unit are left for the general computing program to use, which can avoid the long-term interference of secure computing on general computing and improve the hardware utilization rate.

[0062] In this embodiment, by setting the cache division comprehensive control module, the first-level cache space adjustment module, and the second-level cache space adjustment module, the cache division control module can be subdivided into multiple sub-modules, which is convenient for quickly implementing the functions of the cache division control module.

[0063] In an alternative embodiment, as Figure 3 shown, the memory division control module includes a second-level cache reception control module 151 and a memory statistics control module 152.

[0064] The second-level cache reception control module 151 is configured to receive the first data sent by the cache division control module and write the first data into the memory unit.

[0065] The memory statistics control module 152 is configured to count the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit, and determine the target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space division configuration information, and the second preset policy; and send a second notification message to the memory management unit.

[0066] Specifically, the function of the memory statistics control module 152 is to count the idle space DDR_free_space of the DDR and the access frequency DDR_access_freq of the data in the DDR. At the same time, there is preset memory space division configuration information DDR_space_security in this module.

[0067] 1) If DDR_free_space >= DDR_space_security, the idle space of the DDR is used as the dedicated memory space for the security computing program without affecting the operation of the general computing program.

[0068] 2) If DDR_free_space < DDR_space_security, the DDR data in the memory blocks with the lowest DDR_access_freq and a size of (DDR_space_security - DDR_free_space) is moved to the external hard disk space to form the dedicated memory space for the security computing program. For example, if DDR_free_space = 512MB, DDR_space_security = 1024MB, and the space of one memory block is 128MB, then the data in the 4 memory blocks with the lowest DDR_access_freq ((1024 - 512) / 128) is moved to the external hard disk.

[0069] In some embodiments, as Figure 3 shown, the memory partition control module further includes a memory and hard disk interaction module 153.

[0070] The memory statistics control module 152 is further configured to send a seventh notification message to the memory and hard disk interaction module if it is determined that the data corresponding to the general computing program is stored in the target memory block.

[0071] The memory and hard disk interaction module 153 is configured to move the data corresponding to the general computing program stored in the target memory block to the hard disk based on the seventh notification message.

[0072] In some embodiments, the memory partition control module is further configured to send an eighth notification message to the memory management unit when it monitors that the security computing program stops running, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit based on the eighth notification message, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

[0073] In this embodiment, when the security computing program stops running, leaving the space of all memory units for the general computing program can avoid the long-term interference of the security computing on the general computing and improve the hardware utilization rate.

[0074] In this embodiment, by setting the secondary cache reception control module and the memory statistics control module, the memory partition control module can be subdivided into multiple sub-modules, which is convenient for quickly implementing the functions of the memory partition control module.

[0075] In an alternative embodiment, as Figure 4As shown in the figure, the input / output interface division control module includes an input / output live statistics module 161 and an input / output division comprehensive control module 162.

[0076] The input / output live statistics module 161 is used to count the idle status and load of each input / output interface and send them to the input / output division comprehensive control module 162.

[0077] The input / output division comprehensive control module 162 is used to obtain the input / output interface information required by the security computing program sent by the kernel; and based on the idle status and load of each input / output interface, the input / output interface information required by the security computing program, and the second preset policy, determine the target input / output interface corresponding to the security computing program; and send a third notification message to the kernel.

[0078] In this embodiment, the input / output interface may include an Ethernet (network unit) interface, a UART (serial port unit) interface, a USB (universal serial bus) interface, and a PCIe (a high-speed serial computer expansion bus standard) interface. The idle status can be obtained by reading the status register inside the above IO interface. There are various methods for monitoring the load of the software tasks running on it. For example, the frequency of sending and receiving data by the above IO interface can be monitored, or the frequency of interacting data between the IO interface and the DDR can be monitored, or even the number of times of the interrupt frequency reported by the IO interface to the kernel can be monitored.

[0079] Specifically, the second preset policy may include: 1) If the number of idle IOs (IO_IDLE) is greater than or equal to the demand of the security computing program for IOs (for example, the general computing program uses 2 USB interfaces, and there are 4 USB interfaces in the entire chip system. The demand quantity of the security computing program for USB interfaces is 1, then the idle quantity of USB is 4 - 2 = 2, which is greater than the demand of the security computing program for USB), the system software will allocate the idle IO resources to the security computing program for use.

[0080] 2) If the number of idle IOs (IO_IDLE) is less than the demand of the security computing program for IOs (for example, the general computing program uses 2 PCIe interfaces, and there are 3 PCIe interfaces in the entire chip system. The demand quantity of the security computing program for PCIe interfaces is 2, then the idle quantity of PCIe is 3 - 2 = 1, which is less than the demand of the security computing program for PCIe). At this time, the system tasks need to be migrated to the IO with a lighter software task load. For example, among PCIe_0 and PCIe_1, the one with a lighter task is PCIe_0. Then the software task of PCIe_0 is migrated to PCIe_1 to run, and PCIe_0 is freed up, so that PCIe_0 and PCIe_2 are reserved for the security computing program to use.

[0081] 3) If the idle IO (IO_IDLE) is 0 (for example, if a general computing program uses 2 UART interfaces, and there are a total of 2 UART interfaces in the entire chip system, and the number of UART interfaces required by the secure computing program is 1, then the number of idle UARTs is 2 - 2 = 0, which is less than the PCIe requirement of the secure computing program), at this time, according to the load situation of the software tasks of the UART interface, the general computing program of the UART port with a lighter task load should be paused first, so as to reserve the UART interface for the secure computing program to use.

[0082] In some embodiments, as Figure 4 shown, the input / output interface division control module further includes an input / output task migration control module 163.

[0083] The input / output division comprehensive control module 162 is further configured to send a ninth notification message to the input / output task migration control module 163 if it is determined that there is an interface in the target input / output interface that is called by the general computing program; The input / output task migration control module 163 is configured to perform time-division multiplexing division on other input / output interfaces except the target input / output interface in the input / output interface based on the ninth notification message, and send the obtained division result to the kernel, so that the kernel modifies the interface of the general computing program that calls the target input / output interface based on the division result.

[0084] In some embodiments, the input / output interface division control module is further configured to send a tenth notification message to the kernel when it monitors that the secure computing program stops running, so that the kernel determines the mapping relationship between the general computing program and the input / output interface based on the tenth notification message, so that each input / output interface is used for the general computing program.

[0085] In this embodiment, when the secure computing program stops running, all input / output interfaces are left for the general computing program to use, which can avoid the long-term intervention of secure computing on general computing and improve the hardware utilization rate.

[0086] In this embodiment, by setting the input / output live condition statistics module and the input / output division comprehensive control module, the input / output interface division control module can be subdivided into multiple sub-modules, which is convenient for quickly implementing the functions of the input / output interface division control module.

[0087] An embodiment of the present application provides a data processing method, which is applied to the data processing device in any of the above embodiments. The device includes a processor, a memory unit, an input / output interface, a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module. The processor includes a kernel, a memory management unit, registers, a first-level cache unit, and a second-level cache unit. As Figure 5 shown, the method includes: S501. When the cache partitioning control module detects that the kernel is executing an instruction of a general computing program and obtains an instruction corresponding to a secure computing program, it determines a first target cache block based on the access frequency of data in each cache block of the second-level cache unit and the preset cache space partitioning configuration information, and moves the first data in the first target cache block to the memory partitioning control module; determines a second target cache block based on the access frequency of data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information, and moves the second data in the second target cache block to a third target cache block in the second-level cache unit, where the third target cache block is different from the first target cache block; and after completing the data transfer, sends a first notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the first-level cache unit and the second-level cache unit, so that the second target cache block in the first-level cache unit is used to cache the data corresponding to the secure computing program, and the first target cache block in the second-level cache unit is used to cache the data corresponding to the secure computing program.

[0088] S502. The memory partitioning control module receives the first data sent by the cache partitioning control module and writes the first data into the memory unit; counts the idle space of the memory unit and the access frequency of the data in the memory blocks in the memory unit, and determines a target memory block for storing the data corresponding to the secure computing program based on the idle space, the access frequency of the data in the memory blocks in the memory unit, the preset memory space partitioning configuration information, and the first preset policy; and sends a second notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the memory unit, so that the target memory block in the memory unit is used to store the data corresponding to the secure computing program.

[0089] The input / output interface division control module S503 counts the idle status and load of each input / output interface, and obtains the input / output interface information required for the security computing program sent by the kernel; and based on the idle status and load of each input / output interface, the input / output interface information required for the security computing program, and the second preset policy, determines the target input / output interface corresponding to the security computing program; and sends a third notification message to the kernel, so that the kernel, based on the third notification message, divides the target input / output interface for the security computing program to use.

[0090] Among them, the memory management unit performs unified virtual address and physical address management on the general computing program and the security computing program; the virtual address corresponding to the general computing program is different from the virtual address corresponding to the security computing program; the physical address corresponding to the general computing program is different from the physical address corresponding to the security computing program; the register includes a first register corresponding to the general computing program and a second register corresponding to the security computing program, so that the kernel can run the general computing program and the security computing program in parallel.

[0091] In some embodiments, the device further includes a cache access control module, a memory access control module, and an input / output interface access control module, and the method further includes: The cache access control module encrypts the data corresponding to the security computing program and stores it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit; the memory access control module encrypts the data corresponding to the security computing program and stores it in the target memory block of the memory unit; the input / output interface access control module encrypts the data corresponding to the security computing program and calls it through the target input / output interface of the input / output interface.

[0092] The method provided by the embodiment of the present application can, by adding three hardware functional modules, namely a cache partition control module, a memory partition control module, and an input / output interface partition control module, enable the kernel to, during the execution of a general computing program, if the kernel also receives instructions of a secure computing program, the cache partition control module, the memory partition control module, and the input / output interface partition control module can timely partition the target cache block, the target memory block, and the target input / output interface corresponding to the secure computing program from the cache unit, the memory unit, and the input / output interface, so that the general computing program and the secure computing program each have corresponding hardware resources and ensure that the data of the general computing program will not be lost; and by adding registers for the secure computing program in the kernel, the instructions of the secure computing program and the general computing program are independent of each other, the general registers are independent of each other, and a memory management unit is used to uniformly manage the virtual addresses and physical addresses of the hardware resources of the general computing program and the secure computing program; it can ensure the parallel execution of the general computing program and the secure computing program in one kernel and reduce the impact of secure computing on general computing; and when the kernel only executes the general computing program, the cache unit, the memory unit, and the input / output interface are all allocated for the general computing program to use, and when the kernel needs to execute the general computing program and the secure computing program in parallel, the cache unit, the memory unit, and the input / output interface are allocated for the two computing programs to use, so that there is no need to separately isolate the hardware resources corresponding to the secure computing program, which can ensure the maximization of the CPU hardware resource utilization rate.

[0093] In an optional embodiment, the data processing method further includes: When the cache partition control module detects that the secure computing program stops running, it sends a sixth notification message to the memory management unit, so that the memory management unit, based on the sixth notification message, determines the mapping relationship between the virtual address corresponding to the general computing program and the physical addresses corresponding to the level-1 cache unit and the level-2 cache unit, so that each cache block of the level-1 cache unit and the level-2 cache unit is used to cache the data corresponding to the general computing program.

[0094] In an optional embodiment, the data processing method further includes: When the memory partition control module detects that the secure computing program stops running, it sends an eighth notification message to the memory management unit, so that the memory management unit, based on the eighth notification message, determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

[0095] The program code for implementing the method of the present application can be written in any combination of one or more programming languages. These program codes can be provided to the processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing devices, such that when the program codes are executed by the processor or controller, the functions / operations specified in the flowchart and / or block diagram are implemented. The program codes can be executed entirely on the machine, partially on the machine, executed partially on the machine and partially on a remote machine as an independent software package, or executed entirely on a remote machine or server.

[0096] It should be understood that various forms of the flow shown above can be used, with steps reordered, added, or deleted. For example, the steps described in the present application can be executed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution disclosed in the present application can be achieved. No limitations are set forth herein.

[0097] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the quantity of the indicated technical features. Thus, the features defined with "first" and "second" may explicitly or implicitly include at least one of such features. In the description of the present application, "a plurality of" means two or more, unless otherwise specifically defined.

[0098] As described above, the above is only the specific implementation manner of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art within the technical scope disclosed by the present application can easily think of changes or substitutions, which should be covered by the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A data processing device, comprising a processor, a memory unit, and an input / output interface, wherein the processor includes a core, a memory management unit, registers, a level-1 cache unit, and a level-2 cache unit, characterized in that, It further includes: A cache partition control module, which is configured to, when detecting that the kernel is executing an instruction of a general computing program, obtain an instruction corresponding to a secure computing program, determine a first target cache block based on the access frequency of data in each cache block of the secondary cache unit and preset cache space partition configuration information, and move the first data in the first target cache block to the memory partition control module; Determine a second target cache block based on the access frequency of data in each cache block of the primary cache unit and preset cache space partition configuration information, and move the second data in the second target cache block to a third target cache block in the secondary cache unit, where the third target cache block is different from the first target cache block; And after completing the data transfer, send a first notification message to the memory management unit, so that the memory management unit, based on the first notification message, determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical addresses corresponding to the primary cache unit and the secondary cache unit, so that the second target cache block in the primary cache unit is used to cache the data corresponding to the secure computing program, and the first target cache block in the secondary cache unit is used to cache the data corresponding to the secure computing program; A memory partition control module, which is configured to receive the first data sent by the cache partition control module and write the first data into the memory unit; Statistically analyze the idle space of the memory unit and the data access frequency of memory blocks in the memory unit, and determine a target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequency of memory blocks in the memory unit, preset memory space partition configuration information, and a first preset policy; And send a second notification message to the memory management unit, so that the memory management unit, based on the second notification message, determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the memory unit, so that the target memory block in the memory unit is used to store the data corresponding to the secure computing program; An input / output interface partition control module, which is configured to statistically analyze the idle status and load of each input / output interface, and obtain the input / output interface information required for the secure computing program sent by the kernel; And determine the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface, the input / output interface information required for the secure computing program, and a second preset policy; And send a third notification message to the kernel, so that the kernel, based on the third notification message, allocates the target input / output interface to the secure computing program for use; Among them, the memory management unit performs unified virtual address and physical address management on the general computing program and the security computing program; the virtual address corresponding to the general computing program is different from the virtual address corresponding to the security computing program; the physical address corresponding to the general computing program is different from the physical address corresponding to the security computing program; the register includes a first register corresponding to the general computing program and a second register corresponding to the security computing program, so that the kernel runs the general computing program and the security computing program in parallel.

2. The device according to claim 1, wherein The cache partitioning control module includes a cache partitioning comprehensive control module, a first-level cache space adjustment module, and a second-level cache space adjustment module; The cache partitioning comprehensive control module is used for obtaining the instruction corresponding to the security computing program when monitoring that the kernel is executing the instruction of the general computing program, and sending a first control signal to the second-level cache space adjustment module; the first control signal includes the access frequency of the data in each cache block of the second-level cache unit and the preset cache space partitioning configuration information; The second-level cache space adjustment module is used for determining a first target cache block based on the access frequency of the data in each cache block of the second-level cache unit and the preset cache space partitioning configuration information, moving the first data in the first target cache block to the memory partitioning control module, and sending a fourth notification message to the cache partitioning comprehensive control module after the movement is completed; The cache partitioning comprehensive control module is further used for sending a second control signal to the first-level cache space adjustment module based on the fourth notification message, and the second control signal includes the access frequency of the data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information; The first-level cache space adjustment module is used for determining a second target cache block based on the access frequency of the data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information, moving the second data in the second target cache block to a third target cache block in the second-level cache unit, and sending a fifth notification message to the cache partitioning comprehensive control module after the movement is completed; The cache partitioning comprehensive control module is further used for sending a first notification message to the memory management unit based on the fourth notification message and the fifth notification message.

3. The device according to claim 2, characterized in that, The cache partitioning control module further includes a cache space adaptive allocation module; The cache space adaptive allocation module is used to count the access rate of the first-level cache units, the miss rate of the first-level cache units, the access rate of the second-level cache units, and the miss rate of the second-level cache units corresponding to the general computing program, as well as the access rate of the first-level cache units, the miss rate of the first-level cache units, the access rate of the second-level cache units, and the miss rate of the second-level cache units corresponding to the security computing program; based on the access rate of the first-level cache units, the miss rate of the first-level cache units, the access rate of the second-level cache units, and the miss rate of the second-level cache units corresponding to the general computing program, as well as the access rate of the first-level cache units, the miss rate of the first-level cache units, the access rate of the second-level cache units, and the miss rate of the second-level cache units corresponding to the security computing program, and the third preset policy, adjust the first-level cache unit space and the second-level cache unit space corresponding to the general computing program and the security computing program.

4. The device according to claim 1, wherein the cache partitioning control module is further configured to send a sixth notification message to the memory management unit when it detects that the security computing program stops running, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical addresses corresponding to the first-level cache unit and the second-level cache unit based on the sixth notification message, so that each cache block of the first-level cache unit and the second-level cache unit is used to cache the data corresponding to the general computing program.

5. The device according to claim 1, characterized in that, The memory partitioning control module includes a second-level cache reception control module and a memory statistics control module; The second-level cache reception control module is configured to receive the first data sent by the cache partitioning control module and write the first data into the memory unit; The memory statistics control module is configured to count the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit, and determine a target memory block for storing the data corresponding to the security computing program based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space partitioning configuration information, and the second preset policy; and send a second notification message to the memory management unit.

6. The device according to claim 5, characterized in that, The memory partitioning control module further includes a memory and hard disk interaction module; The memory statistics control module is further configured to send a seventh notification message to the memory and hard disk interaction module if it determines that the data corresponding to the general computing program is stored in the target memory block; The memory and hard disk interaction module is configured to move the data corresponding to the general computing program stored in the target memory block to the hard disk based on the seventh notification message.

7. The device according to claim 1, characterized in that The memory partitioning control module is further configured to send an eighth notification message to the memory management unit when it detects that the security computing program stops running, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit based on the eighth notification message, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

8. The device according to claim 1, characterized in that, The input / output interface partitioning control module includes an input / output live statistics module and an input / output partitioning comprehensive control module; The input / output live statistics module is used to count the idle status and load of each input / output interface and send them to the input / output division comprehensive control module; The input / output division comprehensive control module is used to obtain the input / output interface information required for the security computing program sent by the kernel; And based on the idle status and load of each input / output interface, the input / output interface information required for the security computing program, and the second preset policy, determine the target input / output interface corresponding to the security computing program; and send a third notification message to the kernel.

9. The device according to claim 8, wherein The input / output interface division control module further includes an input / output task migration control module; The input / output division comprehensive control module is further used to send a ninth notification message to the input / output task migration control module if it is determined that there is an interface called by the general computing program among the target input / output interfaces; The input / output task migration control module is used to perform time-division multiplexing division on other input / output interfaces except the target input / output interfaces based on the ninth notification message, and send the obtained division result to the kernel, so that the kernel modifies the interface of the general computing program that calls the target input / output interface based on the division result.

10. The device according to claim 1, wherein, The input / output interface division control module is further used to send a tenth notification message to the kernel when it monitors that the security computing program stops running, so that the kernel determines the mapping relationship between the general computing program and the input / output interface based on the tenth notification message, so that each input / output interface is used for the general computing program.

11. The device according to claim 1, wherein It further includes: A cache access control module, which is used to encrypt the data corresponding to the security computing program and store it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit; A memory access control module, which is used to encrypt the data corresponding to the security computing program and store it in the target memory block of the memory unit; An input / output interface access control module, which is used to encrypt the data corresponding to the security computing program and call it through the target input / output interface of the input / output interface.

12. A data processing method, applied to a device, the device includes a processor, a memory unit, an input / output interface, a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module, the processor includes a kernel, a memory management unit, registers, a level-1 cache unit, and a level-2 cache unit, characterized in that, The method includes: When the cache partition control module detects that the kernel is executing instructions of a general computing program, it obtains the instructions corresponding to the secure computing program. Based on the access frequencies of the data in each cache block of the secondary cache unit and the preset cache space partition configuration information, it determines the first target cache block, and moves the first data in the first target cache block to the memory partition control module. Based on the access frequencies of the data in each cache block of the primary cache unit and the preset cache space partition configuration information, it determines the second target cache block, and moves the second data in the second target cache block to the third target cache block in the secondary cache unit, where the third target cache block is different from the first target cache block. After completing the data transfer, it sends a first notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual addresses corresponding to the general computing program and the secure computing program and the physical addresses corresponding to the primary cache unit and the secondary cache unit based on the first notification message, so that the second target cache block in the primary cache unit is used to cache the data corresponding to the secure computing program, and the first target cache block in the secondary cache unit is used to cache the data corresponding to the secure computing program. The memory partition control module receives the first data sent by the cache partition control module and writes the first data into the memory unit. It counts the idle space of the memory unit and the data access frequencies of the memory blocks in the memory unit, and determines the target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequencies of the memory blocks in the memory unit, the preset memory space partition configuration information, and the first preset policy. It sends a second notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual addresses corresponding to the general computing program and the secure computing program and the physical address corresponding to the memory unit based on the second notification message, so that the target memory block in the memory unit is used to store the data corresponding to the secure computing program. The input / output interface partition control module counts the idle status and load of each input / output interface, and obtains the input / output interface information required for the secure computing program sent by the kernel. It determines the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface, the input / output interface information required for the secure computing program, and the second preset policy. It sends a third notification message to the kernel, so that the kernel assigns the target input / output interface to the secure computing program for use based on the third notification message. Among them, the memory management unit performs unified virtual address and physical address management on the general computing program and the security computing program; the virtual address corresponding to the general computing program is different from the virtual address corresponding to the security computing program; the physical address corresponding to the general computing program is different from the physical address corresponding to the security computing program; the register includes a first register corresponding to the general computing program and a second register corresponding to the security computing program, so that the kernel can run the general computing program and the security computing program in parallel.

13. The data processing method according to claim 12, characterized in that, The device further includes a cache access control module, a memory access control module, and an input / output interface access control module, and the method further includes: The cache access control module encrypts the data corresponding to the security computing program and stores it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit; The memory access control module encrypts the data corresponding to the security computing program and stores it in the target memory block of the memory unit; The input / output interface access control module encrypts the data corresponding to the security computing program and invokes it through the target input / output interface of the input / output interface.

14. The data processing method according to claim 12, characterized in that, It further includes: When the cache partitioning control module detects that the security computing program stops running, it sends a sixth notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the first-level cache unit and the second-level cache unit based on the sixth notification message, so that each cache block of the first-level cache unit and the second-level cache unit is used to cache the data corresponding to the general computing program.

15. The data processing method according to claim 12, wherein It further includes: When the memory partitioning control module detects that the security computing program stops running, it sends an eighth notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit based on the eighth notification message, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

Images