A data processing device and a data processing method

Abstract

This application discloses a data processing apparatus and a data processing method, relating to the field of data processing technology. The apparatus includes a processor, memory units, and input / output interfaces. The processor includes a kernel, a memory management unit, registers, a level 1 cache unit, and a level 2 cache unit. The apparatus further includes: a cache partitioning control module, used to determine a second target cache block in the level 1 cache unit corresponding to the secure computing program and a first target cache block in the level 2 cache unit when the general computing program and the secure computing program are executed in parallel; a memory partitioning control module, used to determine a target memory block corresponding to the secure computing program; and an input / output interface partitioning control module, used to determine a target input / output interface corresponding to the secure computing program. The registers include a first register corresponding to the general computing program and a second register corresponding to the secure computing program, enabling the kernel to run the general computing program and the secure computing program in parallel.

Description

Technical Field

[0001] This application relates to the field of data processing technology, and in particular to a data processing apparatus and a data processing method. Background Technology

[0002] RISC-V architecture CPUs run on two types of programs: general-purpose computing programs and secure computing programs. General-purpose computing programs are programs that run on RISC-V architecture CPUs and have low security requirements, including for accessing memory and input / output (I / O) interfaces. Secure computing programs, on the other hand, are programs that run on RISC-V architecture CPUs and have very high security requirements, such as password entry, facial recognition, and critical data transfer with external devices via the CPU's I / O interfaces.

[0003] To ensure secure computing, the traditional approach involves physically isolating a separate secure execution environment within the RISC-V architecture CPU. In this traditional approach, the RISC-V CPU is isolated into two physical environments: a general-purpose computing environment and a secure computing environment. This is achieved through time-sharing of the CPU, and the separate physical partitioning of the cache, double-data-rate synchronous dynamic random access memory (DDR), and I / O interfaces. This allows the general-purpose computing program to save its context during execution and then transition to the secure computing environment to execute the secure computing program.

[0004] However, the traditional secure computing implementation mode of RISC-V CPU has a major drawback: during the execution of secure computing programs, the CPU is time-multiplexed, and the CPU cannot run general-purpose computing programs at this time. This will cause some critical general-purpose computing programs to stop running, which may lead to catastrophic consequences. Summary of the Invention

[0005] In view of this, embodiments of this application provide a data processing apparatus and a data processing method.

[0006] According to a first aspect of this application, embodiments of this application provide a data processing apparatus, including a processor, a memory unit, and an input / output interface. The processor includes a core, a memory management unit, registers, a level 1 cache unit, and a level 2 cache unit. The apparatus further includes:

[0007] The cache partitioning control module is used to, when detecting that the kernel is executing instructions for a general computing program, obtain the instructions corresponding to the secure computing program, determine the first target cache block based on the access frequency of data in each cache block of the secondary cache unit and the preset cache space partitioning configuration information, and move the first data in the first target cache block to the memory partitioning control module; based on the access frequency of data in each cache block of the primary cache unit and the preset cache space partitioning configuration information, determine the second target cache block, and move the second data in the second target cache block to the third target cache block in the secondary cache unit, which is different from the first target cache block; and after completing the data movement, send a first notification message to the memory management unit, so that the memory management unit can determine the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the primary and secondary cache units, so that the second target cache block in the primary cache unit is used to cache the data corresponding to the secure computing program, and the first target cache block in the secondary cache unit is used to cache the data corresponding to the secure computing program;

[0008] The memory partitioning control module receives first data sent by the cache partitioning control module and writes the first data into a memory unit; it calculates the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit, and determines the target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space partitioning configuration information, and the first preset strategy; and it sends a second notification message to the memory management unit so that the memory management unit can determine the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the memory unit based on the second notification message, so that the target memory block in the memory unit can be used to store the data corresponding to the secure computing program.

[0009] The input / output interface allocation control module is used to count the idle status and load of each input / output interface, obtain the input / output interface information required by the secure computing program sent by the kernel, and determine the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface, the input / output interface information required by the secure computing program, and the second preset strategy; and send a third notification message to the kernel so that the kernel can allocate the target input / output interface to the secure computing program based on the third notification message.

[0010] The memory management unit manages the virtual and physical addresses of the general-purpose computing program and the secure computing program in a unified manner. The virtual address corresponding to the general-purpose computing program is different from that of the secure computing program. The physical address corresponding to the general-purpose computing program is different from that of the secure computing program. The registers include a first register corresponding to the general-purpose computing program and a second register corresponding to the secure computing program, so that the kernel can run the general-purpose computing program and the secure computing program in parallel.

[0011] Optionally, the cache partitioning control module includes a cache partitioning comprehensive control module, a first-level cache space adjustment module, and a second-level cache space adjustment module;

[0012] The cache partitioning control module is used to obtain the instructions corresponding to the secure computing program when it detects that the kernel is executing instructions for a general computing program, and send a first control signal to the secondary cache space adjustment module. The first control signal includes the access frequency of data in each cache block of the secondary cache unit, as well as preset cache space partitioning configuration information.

[0013] The secondary cache space adjustment module is used to determine the first target cache block based on the access frequency of data in each cache block of the secondary cache unit and the preset cache space partitioning configuration information, and move the first data in the first target cache block to the memory partitioning control module, and send a fourth notification message to the cache partitioning comprehensive control module after the move is completed.

[0014] The cache partitioning integrated control module is also used to send a second control signal to the first-level cache space adjustment module based on the fourth notification message. The second control signal includes the access frequency of data in each cache block in the first-level cache unit, as well as the preset cache space partitioning configuration information.

[0015] The first-level cache space adjustment module is used to determine the second target cache block based on the access frequency of data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information, and move the second data in the second target cache block to the third target cache block in the second-level cache unit, and send the fifth notification message to the cache partitioning integrated control module after the move is completed.

[0016] The cache partitioning control module is also used to send the first notification message to the memory management unit based on the fourth and fifth notification messages.

[0017] Optionally, the cache partitioning control module also includes a cache space adaptive allocation module;

[0018] The cache space adaptive allocation module is used to statistically analyze the access rate, miss rate, and level 2 cache unit access rate and miss rate of the general computing program, as well as the access rate, miss rate, and miss rate of the secure computing program. Based on these metrics and a third preset strategy, the module adjusts the level 1 cache unit space and level 2 cache unit space for the general computing program and the secure computing program.

[0019] Optionally, the cache partitioning control module is also used to send a sixth notification message to the memory management unit when it detects that the secure computing program has stopped running, so that the memory management unit can determine the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the first-level cache unit and the second-level cache unit based on the sixth notification message, so that each cache block of the first-level cache unit and the second-level cache unit can be used to cache the data corresponding to the general computing program.

[0020] Optionally, the memory partitioning control module includes a level 2 cache receiving control module and a memory statistics control module;

[0021] The secondary cache receiving control module is used to receive the first data sent by the cache partitioning control module and write the first data into the memory unit;

[0022] The memory statistics control module is used to count the idle space of memory units and the data access frequency of memory blocks in memory units. Based on the idle space, the data access frequency of memory blocks in memory units, the preset memory space partitioning configuration information and the second preset strategy, it determines the target memory block for storing the data corresponding to the secure computing program; and sends a second notification message to the memory management unit.

[0023] Optionally, the memory partitioning control module may also include a memory-hard disk interaction module;

[0024] The memory statistics control module is also used to send a seventh notification message to the memory and hard disk interaction module if it is determined that the target memory block stores data corresponding to a general computing program.

[0025] The memory-to-disk interaction module is used to move the data corresponding to the general computing program stored in the target memory block to the hard disk based on the seventh notification message.

[0026] Optionally, the memory partitioning control module is also used to send an eighth notification message to the memory management unit when it detects that the secure computing program has stopped running, so that the memory management unit can determine the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit based on the eighth notification message, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

[0027] Optionally, the input / output interface partitioning control module includes an input / output real-time statistics module and an input / output partitioning comprehensive control module;

[0028] The input / output real-time statistics module is used to count the idle status and load of each input / output interface and send the data to the input / output partitioning integrated control module.

[0029] The input / output partitioning and comprehensive control module is used to obtain the input / output interface information required by the secure computing program sent by the kernel; and based on the idle status and load of each input / output interface, the input / output interface information required by the secure computing program, and the second preset strategy, determine the target input / output interface corresponding to the secure computing program; and send a third notification message to the kernel.

[0030] Optionally, the input / output interface partitioning control module may also include an input / output task migration control module;

[0031] The input / output partitioning integrated control module is also used to send a ninth notification message to the input / output task migration control module if it is determined that there is an interface in the target input / output interface that is called by a general computing program.

[0032] The input / output task migration control module is used to perform time-division multiplexing of input / output interfaces other than the target input / output interface based on the ninth notification message, and send the partitioning results to the kernel so that the kernel can modify the interface of the general computing program that calls the target input / output interface based on the partitioning results.

[0033] Optionally, the input / output interface partitioning control module is also used to send a tenth notification message to the kernel when it detects that the secure computing program has stopped running, so that the kernel can determine the mapping relationship between the general computing program and the input / output interface based on the tenth notification message, so that each input / output interface is used for the general computing program.

[0034] Optionally, the device further includes:

[0035] The cache access control module is used to encrypt the data corresponding to the secure computing program and store it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit.

[0036] The memory access control module is used to encrypt the data corresponding to the secure computing program and then store it in the target memory block of the memory unit.

[0037] The input / output interface access control module is used to encrypt the data corresponding to the secure computing program and then call it through the target input / output interface of the input / output interface.

[0038] According to a second aspect of this application, embodiments of this application provide a data processing method applied to an apparatus. The apparatus includes a processor, a memory unit, an input / output interface, a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module. The processor includes a core, a memory management unit, registers, a level 1 cache unit, and a level 2 cache unit. The method includes:

[0039] When the cache partitioning control module detects that the kernel is executing instructions for a general computing program, it obtains the instructions corresponding to the secure computing program. Based on the access frequency of data in each cache block of the L2 cache unit and the preset cache space partitioning configuration information, it determines the first target cache block and moves the first data in the first target cache block to the memory partitioning control module. Based on the access frequency of data in each cache block of the L1 cache unit and the preset cache space partitioning configuration information, it determines the second target cache block and moves the second data in the second target cache block to the third target cache block in the L2 cache unit. The third target cache block is different from the first target cache block. After completing the data movement, it sends a first notification message to the memory management unit, so that the memory management unit can determine the mapping relationship between the virtual addresses corresponding to the general computing program and the secure computing program, and the physical addresses corresponding to the L1 and L2 cache units, so that the second target cache block in the L1 cache unit is used to cache the data corresponding to the secure computing program, and the first target cache block in the L2 cache unit is used to cache the data corresponding to the secure computing program.

[0040] The memory partitioning control module receives the first data sent by the cache partitioning control module and writes the first data into the memory unit; it counts the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit, and based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space partitioning configuration information and the first preset strategy, it determines the target memory block for storing the data corresponding to the secure computing program; and it sends a second notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the memory unit, so that the target memory block in the memory unit is used to store the data corresponding to the secure computing program.

[0041] The input / output interface allocation control module counts the idle status and load of each input / output interface, obtains the input / output interface information required by the secure computing program sent by the kernel, and determines the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface, the input / output interface information required by the secure computing program, and the second preset strategy; and sends a third notification message to the kernel so that the kernel can allocate the target input / output interface to the secure computing program based on the third notification message.

[0042] The memory management unit manages the virtual and physical addresses of the general-purpose computing program and the secure computing program in a unified manner. The virtual address corresponding to the general-purpose computing program is different from that of the secure computing program. The physical address corresponding to the general-purpose computing program is different from that of the secure computing program. The registers include a first register corresponding to the general-purpose computing program and a second register corresponding to the secure computing program, so that the kernel can run the general-purpose computing program and the secure computing program in parallel.

[0043] Optionally, the device further includes a cache access control module, a memory access control module, and an input / output interface access control module, and the method further includes:

[0044] The cache access control module encrypts the data corresponding to the secure computing program and stores it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit.

[0045] The memory access control module encrypts the data corresponding to the secure computing program and then stores it in the target memory block of the memory unit.

[0046] The input / output interface access control module encrypts the data corresponding to the secure computing program and then calls it through the target input / output interface of the input / output interface.

[0047] Optionally, the data processing method further includes:

[0048] When the cache partitioning control module detects that the secure computing program has stopped running, it sends a sixth notification message to the memory management unit. Based on the sixth notification message, the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the first-level cache unit and the second-level cache unit, so that each cache block of the first-level cache unit and the second-level cache unit can be used to cache the data corresponding to the general computing program.

[0049] Optionally, the data processing method further includes:

[0050] When the memory partitioning control module detects that the secure computing program has stopped running, it sends an eighth notification message to the memory management unit. Based on the eighth notification message, the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

[0051] The apparatus and data processing method provided in this application, by adding three hardware functional modules—a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module—enables the kernel to promptly allocate target cache blocks, target memory blocks, and target input / output interfaces corresponding to the secure computing program from cache units, memory units, and input / output interfaces during the execution of a general computing program. This ensures that both the general computing program and the secure computing program have their corresponding hardware resources, and guarantees that the data of the general computing program is not lost. Furthermore, a register for the secure computing program is added within the kernel, enabling the secure computing program and the secure computing program to... The instructions and general-purpose registers of the general-purpose computing program are independent of each other. A single memory management unit manages the virtual and physical addresses of the hardware resources of both the general-purpose and secure computing programs. This ensures the parallel execution of the general-purpose and secure computing programs within a single kernel, reducing the impact of secure computing on general-purpose computing. Furthermore, when the kernel executes only the general-purpose computing program, cache units, memory units, and input / output interfaces are allocated to the general-purpose computing program. Only when the kernel needs to execute both the general-purpose and secure computing programs in parallel are cache units, memory units, and input / output interfaces allocated to both types of computing programs. This eliminates the need to isolate the hardware resources corresponding to the secure computing program separately, maximizing the utilization of CPU hardware resources.

[0052] The above description is only an overview of the technical solution of this application. In order to better understand the technical means of this application and to implement it in accordance with the contents of the specification, and to make the above and other objects, features and advantages of this application more obvious and understandable, the following are specific embodiments of this application. Attached Figure Description

[0053] Figure 1 This is a schematic diagram of the hardware structure of a data processing device according to an embodiment of this application;

[0054] Figure 2 This is a schematic diagram of the cache partitioning control module in an embodiment of this application;

[0055] Figure 3 This is a schematic diagram of the memory partitioning control module in an embodiment of this application;

[0056] Figure 4 This is a schematic diagram of the input / output interface partitioning control module in an embodiment of this application;

[0057] Figure 5 This is a flowchart illustrating a data processing method according to an embodiment of this application. Detailed Implementation

[0058] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0059] This application provides a data processing apparatus, such as... Figure 1 As shown, the device includes a processor 11, a memory unit 12, and an input / output interface 13. The processor 11 includes a core 111, a memory management unit 112, registers 113, a level 1 cache unit 114, and a level 2 cache unit 115. The device also includes:

[0060] The cache partitioning control module 14 is used to, when detecting that the kernel 111 is executing instructions for a general computing program, obtain the instructions corresponding to the secure computing program, determine a first target cache block based on the access frequency of data in each cache block of the secondary cache unit 115 and preset cache space partitioning configuration information, and move the first data in the first target cache block to the cache partitioning control module 15; and determine a second target cache block based on the access frequency of data in each cache block of the primary cache unit 114 and preset cache space partitioning configuration information, and move the second data in the second target cache block to the secondary cache unit 115. The third target cache block is different from the first target cache block; and after the data transfer is completed, a first notification message is sent to the memory management unit 112 so that the memory management unit 112 determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the first-level cache unit 114 and the second-level cache unit 115 based on the first notification message, so that the second target cache block in the first-level cache unit 114 is used to cache the data corresponding to the secure computing program, and the first target cache block in the second-level cache unit 115 is used to cache the data corresponding to the secure computing program.

[0061] The memory partitioning control module 15 is used to receive the first data sent by the cache partitioning control module 14 and write the first data into the memory unit 12; to count the idle space of the memory unit 12 and the data access frequency of the memory blocks in the memory unit 12, and to determine the target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequency of the memory blocks in the memory unit 12, the preset memory space partitioning configuration information and the first preset strategy; and to send a second notification message to the memory management unit 112, so that the memory management unit 112 determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program and the physical address corresponding to the memory unit 12 based on the second notification message, so that the target memory block in the memory unit 12 is used to store the data corresponding to the secure computing program.

[0062] The input / output interface allocation control module 16 is used to count the idle status and load of each input / output interface 13, obtain the input / output interface information required by the secure computing program sent by the kernel 111; and determine the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface 13, the input / output interface information required by the secure computing program, and the second preset strategy; and send a third notification message to the kernel 111 so that the kernel 111 allocates the target input / output interface to the secure computing program based on the third notification message.

[0063] The memory management unit 112 performs unified virtual and physical address management for the general-purpose computing program and the secure computing program; the virtual address corresponding to the general-purpose computing program is different from the virtual address corresponding to the secure computing program; the physical address corresponding to the general-purpose computing program is different from the physical address corresponding to the secure computing program; the register 113 includes a first register corresponding to the general-purpose computing program and a second register corresponding to the secure computing program, so that the kernel 111 can run the general-purpose computing program and the secure computing program in parallel.

[0064] In this embodiment, as Figure 1 As shown, the device may also include a system bus 17. The processor 11, input / output interface 13, and memory unit 12 are connected via the system bus.

[0065] In this embodiment, as Figure 1 As shown, processor 11 can be a central processing unit (CPU), level 1 cache unit 114 can include L1 cache, and level 2 cache unit 115 can be L2 cache. Memory unit 12 can be double data rate synchronous dynamic random access memory (DDR). Input / output interface (I / O) 13 can include Ethernet interface, UART interface, USB interface, and PCIe interface.

[0066] In this embodiment, the main function of the cache partitioning control module 14 is to quickly partition the L1 Cache and L2 Cache spaces that are running general computing programs when running the security program, and divide them into independent areas to run the general computing program and the security computing program respectively.

[0067] In this embodiment, the same kernel 111 can execute general-purpose computing programs and secure computing programs in parallel. Therefore, the virtual address space and physical address space at the system software level can be continuous. Thus, a single memory management unit (MMU) 112 can be used to uniformly manage the virtual and physical addresses of the hardware resources for general-purpose computing and secure computing, and the virtual addresses can be continuously allocated at the system software level. For example, the virtual address space allocated to general-purpose computing program A is 0x1000_0000—0x2000_0000, and the virtual address space allocated to secure computing program B is 0x3000_0000—0x5000_0000.

[0068] In this embodiment, registers 113 within kernel 111 include not only first registers x0-x31 but also second registers x32-x63. x0-x31 are used by the general-purpose computing program, while x32-x63 are used by the secure computing program. When compiling the general-purpose computing program, x0-x31 are used, and when compiling the secure computing program, x32-x63 are used. Thus, the instruction structures of the compiled general-purpose and secure computing programs, as well as the instruction-related registers 113, are independent of each other, facilitating the parallel execution of the general-purpose and secure computing programs by kernel 111.

[0069] In some implementations, such as Figure 1 As shown, the device also includes:

[0070] The cache access control module 18 is used to encrypt the data corresponding to the secure computing program and store it in the second target cache block of the first-level cache unit 114 and the first target cache block of the second-level cache unit 115.

[0071] The memory access control module 19 is used to encrypt the data corresponding to the secure computing program and then store it in the target memory block of the memory unit 12.

[0072] The input / output interface access control module 20 is used to encrypt the data corresponding to the secure computing program and then call it through the target input / output interface in the input / output interface 13.

[0073] In this embodiment, the data in the cache, DDR, and I / O corresponding to the secure computing program is encrypted, and then decoded by the secure computing program before use. Taking the cache as an example, the data corresponding to the secure computing program is encrypted and stored in the cache. Then, after the processor 11's core 111 reads the data back, it decrypts it before performing the calculation. This ensures that even if the data of the secure computing program is stolen, it cannot be identified and parsed, further improving the security of data and processes in secure computing.

[0074] The apparatus provided in this application, by adding three hardware functional modules—a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module—enables the kernel to promptly allocate target cache blocks, target memory blocks, and target input / output interfaces corresponding to the secure computing program from cache units, memory units, and input / output interfaces during the execution of a general-purpose computing program. This ensures that both the general-purpose and secure computing programs have their corresponding hardware resources, and guarantees that the data of the general-purpose computing program is not lost. Furthermore, a register for the secure computing program is added within the kernel, enabling the secure computing program and the general-purpose computing program to operate in a coordinated manner. The program's instructions and general-purpose registers are independent of each other. A single memory management unit manages the hardware resources of both general-purpose and secure computing programs using unified virtual and physical addresses. This ensures the parallel execution of general-purpose and secure computing programs within a single kernel, reducing the impact of secure computing on general-purpose computing. Furthermore, when the kernel executes only the general-purpose computing program, cache units, memory units, and input / output interfaces are allocated to the general-purpose computing program. Only when the kernel needs to execute both general-purpose and secure computing programs in parallel are cache units, memory units, and input / output interfaces allocated to both types of computing programs. This eliminates the need to isolate the hardware resources corresponding to the secure computing program separately, maximizing the utilization of CPU hardware resources.

[0075] In an optional embodiment, such as Figure 2 As shown, the cache partitioning control module includes a cache partitioning comprehensive control module 141, a first-level cache space adjustment module 142, and a second-level cache space adjustment module 143.

[0076] The cache partitioning control module 141 is used to obtain the instructions corresponding to the secure computing program when it detects that the kernel is executing instructions of a general computing program, and send a first control signal to the secondary cache space adjustment module 143; the first control signal includes the access frequency of data in each cache block of the secondary cache unit, and the preset cache space partitioning configuration information.

[0077] The secondary cache space adjustment module 143 is used to determine the first target cache block based on the access frequency of data in each cache block of the secondary cache unit and the preset cache space partitioning configuration information, and move the first data in the first target cache block to the memory partitioning control module, and send a fourth notification message to the cache partitioning comprehensive control module 141 after the move is completed.

[0078] The cache partitioning integrated control module 141 is also used to send a second control signal to the first-level cache space adjustment module based on the fourth notification message. The second control signal includes the access frequency of data in each cache block in the first-level cache unit, as well as preset cache space partitioning configuration information.

[0079] The first-level cache space adjustment module 142 is used to determine the second target cache block based on the access frequency of data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information, and move the second data in the second target cache block to the third target cache block in the second-level cache unit, and send a fifth notification message to the cache partitioning integrated control module 141 after the relocation is completed.

[0080] The cache partitioning control module 141 is also used to send a first notification message to the memory management unit based on the fourth and fifth notification messages.

[0081] In this embodiment, the cache partitioning control module 141, upon detecting that a secure computing program is about to run, first controls the pipeline running the general-purpose computing program in the kernel to suspend the pipeline after executing the currently executing instruction, and simultaneously controls the instruction fetch unit in the kernel to pause fetching values ​​from the L1 cache. After the second data in the second target cache block is moved to the third target cache block in the L2 cache, the pipeline running the general-purpose computing program in the kernel is then controlled to continue execution, and the instruction fetch unit in the kernel continues to fetch values ​​from the L1 cache, thus ensuring the partitioning of the L2 and L1 cache units and ensuring the continued execution of the general-purpose computing program.

[0082] In this embodiment, the preset cache space allocation configuration information may include the percentage of space allocated to secure computing programs in the first-level cache unit and the second-level cache unit. For example, 50% of the L1 cache space is used for general computing and 50% is used for secure computing; 50% of the L2 cache space is used for general computing and 50% is used for secure computing.

[0083] In practice, the L2 cache space adjustment module 143 can, based on the access frequency of data in each cache block of the L2 cache unit, and in ascending order of access frequency, combine preset cache space allocation configuration information to move the data of the corresponding cache blocks to the memory unit in the form of direct memory access (DMA). For example, if the L2 cache space reserved for secure computing in the cache space allocation is 256KB and the size of the L2 cache block is 64KB, then the L2 cache space adjustment module 143 will migrate the data of the four L2 cache blocks with the lowest access frequency (256 / 64=4) to DDR.

[0084] After the L2 cache space used by the secure computing program is partitioned and acquired, the L1 cache space used by the secure computing program is partitioned and acquired next. This order ensures that the relevant data in the L1 cache can be safely and stably migrated to the L2 cache to ensure the stability of the entire system. The L1 cache space adjustment module 142 migrates the corresponding L1 cache data to the L2 cache according to the preset cache space partitioning configuration information. Similarly, based on the access frequency of data in each cache block of the L1 cache unit obtained from the cache partitioning comprehensive control module 141, the module combines the preset cache space partitioning configuration information in order of access frequency from low to high, and moves the data of the corresponding L1 cache block to the L2 cache in the form of DMA. For example, if the L1 cache space reserved for secure computing in the cache space partitioning is 64KB, and the size of the L1 cache block is 32KB, then the L1 cache space adjustment module 142 will migrate the data of the two L1 cache blocks with the lowest access frequency (64 / 32=4) to the L2 cache.

[0085] In some implementations, such as Figure 2 As shown, the cache partitioning control module also includes a cache space adaptive allocation module 144.

[0086] The cache space adaptive allocation module 144 is used to statistically analyze the access rate, loss rate, and cache miss rate of the first-level cache unit corresponding to the general computing program, as well as the access rate, loss rate, and cache miss rate of the first-level cache unit corresponding to the secure computing program; based on the access rate, loss rate, and cache miss rate of the first-level cache unit corresponding to the general computing program, the access rate, loss rate, and cache miss rate of the second-level cache unit corresponding to the secure computing program, and a third preset strategy, adjust the first-level cache unit space and the second-level cache unit space corresponding to the general computing program and the secure computing program.

[0087] In specific implementation, the cache space adaptive allocation module 144 counts the L1 cache access rate and miss rate of the general computing program. A miss means that the accessed data is not in the L1 cache and needs to be queried in the L2 cache, denoted as L1_access_freq_normal and L1_access_miss_normal. The L2 cache access rate and miss rate of the general computing program are counted and denoted as L2_access_freq_normal and L2_access_miss_normal.

[0088] Simultaneously, the L1 cache access rate and miss rate of the secure computing program are calculated and denoted as L1_access_freq_security and L1_access_miss_security; the L2 cache access rate and miss rate of the secure computing program are also calculated and denoted as L2_access_freq_security and L2_access_miss_security. Different processing is applied according to the following different situations.

[0089] 1) If L1_access_freq_normal and L1_access_miss_normal are high, but L1_access_freq_security and L1_access_miss_security are not high, then the cache space adaptive allocation module 144 raises the control signal enhance_L1_normal to the first-level cache space adjustment module 142. The first-level cache space adjustment module 142 then re-allocates the L1 cache space (increasing the L1 cache space occupied by the secure computing program and increasing the L1 cache space occupied by the general computing program), and re-allocates the L1 cache to different levels according to the order of magnitude of L1_access_freq_normal and L1_access_miss_normal. The principle is that the higher the values ​​of L1_access_freq_normal and L1_access_miss_normal, the larger the L1 cache space re-allocated to the general computing program without affecting the secure computing.

[0090] 2) If L1_access_freq_security and L1_access_miss_security are not high, but L1_access_freq_normal and L1_access_miss_normal are high, then the cache space adaptive allocation module 144 raises the control signal enhance_L1_security to the first-level cache space adjustment module 142. The first-level cache space adjustment module 142 then re-allocates the L1 space (increasing the L1 space occupied by general computing programs and increasing the L1 space occupied by secure computing programs), and re-allocates different levels of L1 cache based on the order of magnitude of L1_access_freq_security and L1_access_miss_security. The principle is that the higher the values ​​of L1_access_freq_security and L1_access_miss_security, the larger the L1 cache space re-allocated to secure computing without affecting general computing.

[0091] 3) If L1_access_freq_security and L1_access_miss_security are high, and L1_access_freq_normal and L1_access_miss_normal are also high, then the cache space adaptive allocation module 144 raises the control signal enhance_L1_security to the first-level cache space adjustment module 142. The first-level cache space adjustment module 142 then re-allocates the L1 cache space (reducing the L1 cache space occupied by general-purpose computing programs and increasing the L1 cache space occupied by secure computing programs), and re-allocates the L1 cache to different levels based on the order of magnitude of L1_access_freq_security and L1_access_miss_security. The principle is that the higher the values ​​of L1_access_freq_security and L1_access_miss_security, the more general-purpose computing performance will be sacrificed to ensure the performance of secure computing, and the larger the L1 space reallocated to general-purpose computing will be. It is worth noting that when reducing the general / secure computing L1 cache space, the corresponding data must first be synchronized to the L2 cache before proceeding.

[0092] A similar control method is used to control the adaptive partitioning of L2.

[0093] 4) If L2_access_freq_normal and L2_access_miss_normal are high, but L2_access_freq_security and L2_access_miss_security are not high, then the cache space adaptive allocation module 144 raises the control signal enhance_L2_normal to the secondary cache space adjustment module 143. The secondary cache space adjustment module 143 then re-allocates the L2 cache space (increasing the L2 cache space occupied by the secure computing program and increasing the L2 cache space occupied by the general computing program), and re-allocates the L2 cache to different levels according to the order of magnitude of L2_access_freq_normal and L2_access_miss_normal. The principle is that the higher the values ​​of L2_access_freq_normal and L2_access_miss_normal, the larger the L2 cache space re-allocated to the general computing program without affecting secure computing.

[0094] 5) If L2_access_freq_security and L2_access_miss_security are not high, but L2_access_freq_normal and L2_access_miss_normal are high, then the cache space adaptive allocation module 144 raises the control signal enhance_L2_security to the secondary cache space adjustment module 143. The secondary cache space adjustment module 143 then re-allocates the L2 Cache space (increasing the L2 Cache space occupied by general computing programs and increasing the L2 Cache space occupied by secure computing programs), and re-allocates the L2 Cache to different levels based on the order of magnitude of L2_access_freq_security and L2_access_miss_security. The principle is that the higher the values ​​of L2_access_freq_security and L2_access_miss_security, the larger the L2 Cache space re-allocated to secure computing without affecting general computing.

[0095] 6) If L2_access_freq_security and L2_access_miss_security are high, and L2_access_freq_normal and L2_access_miss_normal are also high, then the cache space adaptive allocation module 144 raises the control signal enhance_L2_security to the L2 cache space adjustment module 143. The L2 cache space adjustment module 143 then re-allocates the L2 cache space (reducing the L2 cache space occupied by general-purpose computing programs and increasing the L2 cache space occupied by secure computing programs), and performs different levels of L2 cache re-allocation based on the order of magnitude of L2_access_freq_security and L2_access_miss_security. The principle is that the higher the values ​​of L2_access_freq_security and L2_access_miss_security, the more general-purpose computing performance will be sacrificed to ensure the performance of secure computing, and the larger the L2 cache space re-allocated to general-purpose computing. It is worth noting that when reducing the general-purpose / secure computing L2 cache space, the corresponding data must first be synchronized to DDR before proceeding.

[0096] In this embodiment, by setting the cache space adaptive allocation module 144, the preset cache space partitioning configuration can be adaptively adjusted to achieve the best performance balance between secure computing and general computing, thereby improving the balanced performance of the RISC-V architecture CPU.

[0097] In some implementations, the cache partitioning control module is also used to send a sixth notification message to the memory management unit when it detects that the secure computing program has stopped running. This allows the memory management unit to determine the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the first-level cache unit and the second-level cache unit based on the sixth notification message. This ensures that each cache block of the first-level cache unit and the second-level cache unit is used to cache the data corresponding to the general computing program.

[0098] In this embodiment, when the secure computing program stops running, all the space in the first-level cache unit and the second-level cache unit is reserved for the general computing program. This can avoid the secure computing program from interfering with the general computing program for a long time and improve the hardware utilization rate.

[0099] In this embodiment, by setting up a cache partitioning comprehensive control module, a first-level cache space adjustment module, and a second-level cache space adjustment module, the cache partitioning control module can be subdivided into multiple sub-modules, which facilitates the rapid implementation of the cache partitioning control module's functions.

[0100] In an optional embodiment, such as Figure 3 As shown, the memory partitioning control module includes a secondary cache receiving control module 151 and a memory statistics control module 152.

[0101] The secondary cache receiving control module 151 is used to receive the first data sent by the cache partitioning control module and write the first data into the memory unit.

[0102] The memory statistics control module 152 is used to count the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit. Based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space partitioning configuration information and the second preset strategy, it determines the target memory block for storing the data corresponding to the secure computing program; and sends a second notification message to the memory management unit.

[0103] In specific implementation, the function of the memory statistics control module 152 is to count the free space of DDR (DDR_free_space) and the access frequency of data in DDR (DDR_access_freq). At the same time, this module has preset memory space partitioning configuration information (DDR_space_security).

[0104] 1) If DDR_free_space >= DDR_space_security, the idle space of the DDR is used as the dedicated memory space for the secure computing program without affecting the operation of the general computing program.

[0105] 2) If DDR_free_space < DDR_space_security, the DDR data in the memory blocks with the lowest DDR_access_freq and a size of (DDR_space_security - DDR_free_space) is moved to the external hard disk space to form the dedicated memory space for the secure computing program. For example, if DDR_free_space = 512MB, DDR_space_security = 1024MB, and the space of one memory block is 128MB, then the data in the 4 memory blocks with the lowest DDR_access_freq ((1024 - 512) / 128) is moved to the external hard disk.

[0106] In some embodiments, as Figure 3 shown, the memory partitioning control module further includes a memory - hard disk interaction module 153.

[0107] The memory statistics control module 152 is further configured to send a seventh notification message to the memory - hard disk interaction module if it is determined that the target memory block stores data corresponding to the general computing program.

[0108] The memory - hard disk interaction module 153 is configured to move the data corresponding to the general computing program stored in the target memory block to the hard disk based on the seventh notification message.

[0109] In some embodiments, the memory partitioning control module is further configured to send an eighth notification message to the memory management unit when it monitors that the secure computing program stops running, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit based on the eighth notification message, so that each memory block of the memory unit is used to store data corresponding to the general computing program.

[0110] In this embodiment, when the secure computing program stops running, leaving the space of all memory units for the general computing program to use can avoid the long - term interference of secure computing on general computing and improve the hardware utilization rate.

[0111] In this embodiment, by setting up the secondary cache reception control module and the memory statistics control module, the memory partitioning control module can be subdivided into multiple sub - modules, which is convenient for quickly implementing the functions of the memory partitioning control module.

[0112] In an optional embodiment, as Figure 4As shown, the input / output interface partitioning control module includes an input / output real-time statistics module 161 and an input / output partitioning comprehensive control module 162.

[0113] The input / output real-time statistics module 161 is used to count the idle status and load of each input / output interface and send it to the input / output partitioning integrated control module 162.

[0114] The input / output partitioning integrated control module 162 is used to obtain the input / output interface information required by the secure computing program sent by the kernel; and based on the idle state and load of each input / output interface, the input / output interface information required by the secure computing program, and the second preset strategy, determine the target input / output interface corresponding to the secure computing program; and send a third notification message to the kernel.

[0115] In this embodiment, the input / output interfaces may include an Ethernet (network unit) interface, a UART (serial unit) interface, a USB (Universal Serial Bus) interface, and a PCIe (a high-speed serial computer expansion bus standard) interface. The idle state can be determined by reading the status registers inside the aforementioned I / O interfaces, indicating the load of the software tasks running on them. There are various methods for monitoring this, such as monitoring the frequency of data transmission and reception by the I / O interfaces, the frequency of data interaction between the I / O interfaces and the DDR, or even the number of times the I / O interfaces report kernel interrupts.

[0116] In specific implementation, the second preset strategy may include:

[0117] 1) If the number of idle IOs (IO_IDLE) is greater than or equal to the IO requirements of the secure computing program (e.g., the general computing program uses 2 USB interfaces, while the entire chip system has 4 USB interfaces, and the secure computing program requires 1 USB interface, then the number of idle USBs is 4-2=2, which is greater than the secure computing program's requirement for USBs), then the system software will allocate the idle IO resources to the secure computing program.

[0118] 2) If the number of idle IOs (IO_IDLE) is less than the IO requirements of the secure computing program (e.g., a general computing program uses 2 PCIe interfaces, while the entire chip system has 3 PCIe interfaces, and the secure computing program requires 2 PCIe interfaces, then the number of idle PCIes is 3-2=1, which is less than the secure computing program's PCIe requirements), then the system tasks of IOs with lighter software workloads need to be migrated. For example, among PCIe_0 and PCIe_1, PCIe_0 has a lighter workload, so the software tasks of PCIe_0 are migrated to PCIe_1 to run, leaving PCIe_0 idle, thus reserving PCIe_0 and PCIe_2 for the secure computing program to use.

[0119] 3) If the number of idle IOs (IO_IDLE) is 0 (e.g., the general computing program uses 2 UART interfaces, and there are a total of 2 UART interfaces in the entire chip system, and the security computing program requires 1 UART interface, then the number of idle UARTs is 2-2=0, which is less than the security computing program's requirement for PCIe), then the general computing program on the UART port with the lighter task load should be paused first, based on the software task load of the UART interface, so as to reserve the UART interface for the security computing program.

[0120] In some implementations, such as Figure 4 As shown, the input / output interface partitioning control module also includes an input / output task migration control module 163.

[0121] The input / output partitioning integrated control module 162 is also used to send a ninth notification message to the input / output task migration control module 163 if it is determined that there is an interface in the target input / output interface that is called by a general computing program.

[0122] The input / output task migration control module 163 is used to perform time-division multiplexing of other input / output interfaces in the input / output interface except the target input / output interface based on the ninth notification message, and send the partitioning result to the kernel so that the kernel can modify the interface of the general computing program that calls the target input / output interface based on the partitioning result.

[0123] In some implementations, the input / output interface partitioning control module is also used to send a tenth notification message to the kernel when it detects that the secure computing program has stopped running, so that the kernel can determine the mapping relationship between the general computing program and the input / output interface based on the tenth notification message, so that each input / output interface is used for the general computing program.

[0124] In this embodiment, when the secure computing program stops running, all input / output interfaces are left for use by the general computing program. This avoids long-term interference of secure computing with general computing and improves hardware utilization.

[0125] In this embodiment, by setting up an input / output real-time statistics module and an input / output partitioning comprehensive control module, the input / output interface partitioning control module can be subdivided into multiple sub-modules, which facilitates the rapid implementation of the input / output interface partitioning control module's functions.

[0126] This application provides a data processing method applicable to the data processing apparatus in any of the above embodiments. The apparatus includes a processor, a memory unit, an input / output interface, a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module. The processor includes a core, a memory management unit, registers, a level 1 cache unit, and a level 2 cache unit. Figure 5 As shown, the method includes:

[0127] S501, when the cache partitioning control module detects that the kernel is executing instructions for a general-purpose computing program, it obtains the instructions corresponding to the secure computing program. Based on the access frequency of data in each cache block of the secondary cache unit and the preset cache space partitioning configuration information, it determines a first target cache block and moves the first data in the first target cache block to the memory partitioning control module. Based on the access frequency of data in each cache block of the primary cache unit and the preset cache space partitioning configuration information, it determines a second target cache block and moves the second data in the second target cache block to a third target cache block in the secondary cache unit. The third target cache block is different from the first target cache block. After completing the data movement, it sends a first notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual addresses corresponding to the general-purpose computing program and the virtual addresses corresponding to the secure computing program, and the physical addresses corresponding to the primary and secondary cache units, so that the second target cache block in the primary cache unit is used to cache the data corresponding to the secure computing program, and the first target cache block in the secondary cache unit is used to cache the data corresponding to the secure computing program.

[0128] S502, the memory partitioning control module receives the first data sent by the cache partitioning control module and writes the first data into the memory unit; it counts the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit, and based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space partitioning configuration information and the first preset strategy, it determines the target memory block for storing the data corresponding to the secure computing program; and sends a second notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the memory unit based on the second notification message, so that the target memory block in the memory unit is used to store the data corresponding to the secure computing program.

[0129] S503, the input / output interface allocation control module counts the idle status and load of each input / output interface, obtains the input / output interface information required by the secure computing program sent by the kernel; and determines the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface, the input / output interface information required by the secure computing program, and the second preset strategy; and sends a third notification message to the kernel so that the kernel allocates the target input / output interface to the secure computing program based on the third notification message.

[0130] The memory management unit manages the virtual and physical addresses of the general-purpose computing program and the secure computing program in a unified manner. The virtual address corresponding to the general-purpose computing program is different from that of the secure computing program. The physical address corresponding to the general-purpose computing program is different from that of the secure computing program. The registers include a first register corresponding to the general-purpose computing program and a second register corresponding to the secure computing program, so that the kernel can run the general-purpose computing program and the secure computing program in parallel.

[0131] In some embodiments, the apparatus further includes a cache access control module, a memory access control module, and an input / output interface access control module, and the method further includes:

[0132] The cache access control module encrypts the data corresponding to the secure computing program and stores it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit; the memory access control module encrypts the data corresponding to the secure computing program and stores it in the target memory block of the memory unit; the input / output interface access control module encrypts the data corresponding to the secure computing program and calls it through the target input / output interface of the input / output interface.

[0133] The method provided in this application, by adding three hardware functional modules—a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module—enables the kernel to promptly allocate target cache blocks, target memory blocks, and target input / output interfaces corresponding to the secure computing program from cache units, memory units, and input / output interfaces during the execution of a general-purpose computing program. This ensures that both the general-purpose and secure computing programs have their corresponding hardware resources, and guarantees that the data of the general-purpose computing program is not lost. Furthermore, by adding registers for the secure computing program within the kernel, the secure computing program and the general-purpose computing program can achieve seamless integration. The program's instructions and general-purpose registers are independent of each other. A single memory management unit manages the hardware resources of both general-purpose and secure computing programs using unified virtual and physical addresses. This ensures the parallel execution of general-purpose and secure computing programs within a single kernel, reducing the impact of secure computing on general-purpose computing. Furthermore, when the kernel executes only the general-purpose computing program, cache units, memory units, and input / output interfaces are allocated to the general-purpose computing program. Only when the kernel needs to execute both general-purpose and secure computing programs in parallel are cache units, memory units, and input / output interfaces allocated to both types of computing programs. This eliminates the need to isolate the hardware resources corresponding to the secure computing program separately, maximizing the utilization of CPU hardware resources.

[0134] In an optional embodiment, the data processing method further includes:

[0135] When the cache partitioning control module detects that the secure computing program has stopped running, it sends a sixth notification message to the memory management unit. Based on the sixth notification message, the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the first-level cache unit and the second-level cache unit, so that each cache block of the first-level cache unit and the second-level cache unit can be used to cache the data corresponding to the general computing program.

[0136] In an optional embodiment, the data processing method further includes:

[0137] When the memory partitioning control module detects that the secure computing program has stopped running, it sends an eighth notification message to the memory management unit. Based on the eighth notification message, the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

[0138] The program code used to implement the methods of this application may be written in any combination of one or more programming languages. This program code may be provided to a processor or controller of a general-purpose computer, special-purpose computer, or other programmable data processing device, such that when executed by the processor or controller, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The program code may be executed entirely on a machine, partially on a machine, as a standalone software package partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0139] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution disclosed in this application can be achieved, and this is not limited herein.

[0140] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of technical features indicated. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one of that feature. In the description of this application, "a plurality of" means two or more, unless otherwise explicitly specified.

[0141] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A data processing apparatus, comprising a processor, a memory unit, and an input / output interface, wherein the processor includes a core, a memory management unit, registers, a level 1 cache unit, and a level 2 cache unit, characterized in that, Also includes: The cache partitioning control module is used to obtain the instructions corresponding to the secure computing program when the kernel is executing instructions of the general computing program, and determine the first target cache block based on the access frequency of data in each cache block of the secondary cache unit and the preset cache space partitioning configuration information, and move the first data in the first target cache block to the memory partitioning control module. Based on the access frequency of data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information, a second target cache block is determined, and the second data in the second target cache block is moved to the third target cache block in the second-level cache unit. The third target cache block is different from the first target cache block. After the data migration is completed, a first notification message is sent to the memory management unit so that the memory management unit can determine the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the first-level cache unit and the second-level cache unit, based on the first notification message. This allows the second target cache block in the first-level cache unit to be used to cache the data corresponding to the secure computing program, and the first target cache block in the second-level cache unit to be used to cache the data corresponding to the secure computing program. A memory partitioning control module is used to receive the first data sent by the cache partitioning control module and write the first data into the memory unit; The idle space of the memory unit and the data access frequency of the memory blocks in the memory unit are statistically analyzed. Based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space partitioning configuration information and the first preset strategy, the target memory block for storing the data corresponding to the secure computing program is determined. And send a second notification message to the memory management unit so that the memory management unit can determine the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the memory unit based on the second notification message, so that the target memory block in the memory unit can be used to store the data corresponding to the secure computing program; The input / output interface partitioning control module is used to count the idle status and load of each input / output interface and obtain the input / output interface information sent by the kernel regarding the secure computing program. Based on the idle state and load of each input / output interface, the input / output interface information required by the secure computing program, and the second preset strategy, the target input / output interface corresponding to the secure computing program is determined. And send a third notification message to the kernel, so that the kernel, based on the third notification message, allocates the target input / output interface to the secure computing program for use; The memory management unit performs unified virtual and physical address management for the general-purpose computing program and the secure computing program; the virtual address corresponding to the general-purpose computing program is different from the virtual address corresponding to the secure computing program; the physical address corresponding to the general-purpose computing program is different from the physical address corresponding to the secure computing program; the register includes a first register corresponding to the general-purpose computing program and a second register corresponding to the secure computing program, so that the kernel can run the general-purpose computing program and the secure computing program in parallel.

2. The apparatus according to claim 1, characterized in that, The cache partitioning control module includes a cache partitioning comprehensive control module, a first-level cache space adjustment module, and a second-level cache space adjustment module. The cache partitioning control module is used to obtain the instructions corresponding to the secure computing program when it detects that the kernel is executing instructions of a general computing program, and send a first control signal to the secondary cache space adjustment module; the first control signal includes the access frequency of data in each cache block of the secondary cache unit, and preset cache space partitioning configuration information; The secondary cache space adjustment module is used to determine the first target cache block based on the access frequency of data in each cache block of the secondary cache unit and the preset cache space partitioning configuration information, and move the first data in the first target cache block to the memory partitioning control module, and send a fourth notification message to the cache partitioning comprehensive control module after the move is completed. The cache partitioning integrated control module is also used to send a second control signal to the first-level cache space adjustment module based on the fourth notification message. The second control signal includes the access frequency of data in each cache block in the first-level cache unit, as well as preset cache space partitioning configuration information. The first-level cache space adjustment module is used to determine the second target cache block based on the access frequency of data in each cache block of the first-level cache unit and the preset cache space partitioning configuration information, and move the second data in the second target cache block to the third target cache block in the second-level cache unit, and send a fifth notification message to the cache partitioning integrated control module after the move is completed. The cache partitioning control module is also used to send a first notification message to the memory management unit based on the fourth notification message and the fifth notification message.

3. The apparatus according to claim 2, characterized in that, The cache partitioning control module also includes a cache space adaptive allocation module; The adaptive cache space allocation module is used to statistically analyze the access rate, loss rate, and cache miss rate of the first-level cache unit corresponding to the general computing program, as well as the access rate, loss rate, and cache miss rate of the first-level cache unit corresponding to the secure computing program. Based on these metrics, and a third preset strategy, the module adjusts the first-level cache space and cache space of the general computing program and the secure computing program.

4. The apparatus according to claim 1, characterized in that, The cache partitioning control module is also used to send a sixth notification message to the memory management unit when it detects that the secure computing program has stopped running, so that the memory management unit can determine the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the first-level cache unit and the second-level cache unit based on the sixth notification message, so that each cache block of the first-level cache unit and the second-level cache unit can be used to cache the data corresponding to the general computing program.

5. The apparatus according to claim 1, characterized in that, The memory partitioning control module includes a secondary cache receiving control module and a memory statistics control module; The secondary cache receiving control module is used to receive the first data sent by the cache partitioning control module and write the first data into the memory unit; The memory statistics control module is used to count the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit, and based on the idle space, the data access frequency of the memory blocks in the memory unit, the preset memory space partitioning configuration information and the second preset strategy, determine the target memory block for storing the data corresponding to the secure computing program; and send a second notification message to the memory management unit.

6. The apparatus according to claim 5, characterized in that, The memory partitioning control module also includes a memory-hard disk interaction module; The memory statistics control module is also used to send a seventh notification message to the memory and hard disk interaction module if it is determined that the target memory block stores data corresponding to the general computing program. The memory-to-disk interaction module is used to move the data corresponding to the general computing program stored in the target memory block to the hard disk based on the seventh notification message.

7. The apparatus according to claim 1, characterized in that, The memory partitioning control module is also used to send an eighth notification message to the memory management unit when it detects that the secure computing program has stopped running, so that the memory management unit can determine the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit based on the eighth notification message, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

8. The apparatus according to claim 1, characterized in that, The input / output interface partitioning control module includes an input / output real-time statistics module and an input / output partitioning comprehensive control module. The input / output real-time statistics module is used to count the idle status and load of each input / output interface and send the data to the input / output partitioning and comprehensive control module. The input / output partitioning and comprehensive control module is used to obtain the input / output interface information sent by the kernel regarding the secure computing program; Based on the idle status and load of each input / output interface, the input / output interface information required by the secure computing program, and the second preset strategy, the target input / output interface corresponding to the secure computing program is determined; and a third notification message is sent to the kernel.

9. The apparatus according to claim 8, characterized in that, The input / output interface partitioning control module also includes an input / output task migration control module; The input / output partitioning integrated control module is also used to send a ninth notification message to the input / output task migration control module if it is determined that there is an interface in the target input / output interface that is called by the general computing program. The input / output task migration control module is used to perform time-division multiplexing on the input / output interfaces other than the target input / output interface based on the ninth notification message, and send the partitioning result to the kernel so that the kernel can modify the interface of the general computing program that calls the target input / output interface based on the partitioning result.

10. The apparatus according to claim 1, characterized in that, The input / output interface partitioning control module is also used to send a tenth notification message to the kernel when it detects that the secure computing program has stopped running, so that the kernel can determine the mapping relationship between the general computing program and the input / output interface based on the tenth notification message, so that each input / output interface is used for the general computing program.

11. The apparatus according to claim 1, characterized in that, Also includes: The cache access control module is used to encrypt the data corresponding to the secure computing program and store it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit. A memory access control module is used to encrypt the data corresponding to the secure computing program and then store it in the target memory block of the memory unit. The input / output interface access control module is used to encrypt the data corresponding to the secure computing program and then call it through the target input / output interface of the input / output interface.

12. A data processing method applied to an apparatus, the apparatus comprising a processor, a memory unit, an input / output interface, a cache partitioning control module, a memory partitioning control module, and an input / output interface partitioning control module, wherein the processor comprises a core, a memory management unit, registers, a level 1 cache unit, and a level 2 cache unit, characterized in that, The method includes: When the cache partitioning control module detects that the kernel is executing instructions for a general computing program, it obtains the instructions corresponding to the secure computing program. Based on the access frequency of data in each cache block of the secondary cache unit and the preset cache space partitioning configuration information, it determines a first target cache block and moves the first data in the first target cache block to the memory partitioning control module. Based on the access frequency of data in each cache block of the primary cache unit and the preset cache space partitioning configuration information, it determines a second target cache block and moves the second data in the second target cache block to a third target cache block in the secondary cache unit. The third target cache block is different from the first target cache block. After completing the data movement, it sends a first notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual addresses corresponding to the general computing program and the secure computing program, and the physical addresses corresponding to the primary cache unit and the secondary cache unit, so that the second target cache block in the primary cache unit is used to cache the data corresponding to the secure computing program, and the first target cache block in the secondary cache unit is used to cache the data corresponding to the secure computing program. The memory partitioning control module receives the first data sent by the cache partitioning control module and writes the first data into a memory unit; it calculates the idle space of the memory unit and the data access frequency of the memory blocks in the memory unit, and determines the target memory block for storing the data corresponding to the secure computing program based on the idle space, the data access frequency of the memory blocks in the memory unit, preset memory space partitioning configuration information, and a first preset strategy; and sends a second notification message to the memory management unit, so that the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the virtual address corresponding to the secure computing program, and the physical address corresponding to the memory unit based on the second notification message, so that the target memory block in the memory unit is used to store the data corresponding to the secure computing program. The input / output interface allocation control module statistically analyzes the idle status and load of each input / output interface, obtains the input / output interface information required by the secure computing program sent by the kernel, and determines the target input / output interface corresponding to the secure computing program based on the idle status and load of each input / output interface, the input / output interface information required by the secure computing program, and a second preset strategy; and sends a third notification message to the kernel so that the kernel allocates the target input / output interface to the secure computing program based on the third notification message. The memory management unit performs unified virtual and physical address management for the general-purpose computing program and the secure computing program; the virtual address corresponding to the general-purpose computing program is different from the virtual address corresponding to the secure computing program; the physical address corresponding to the general-purpose computing program is different from the physical address corresponding to the secure computing program; the register includes a first register corresponding to the general-purpose computing program and a second register corresponding to the secure computing program, so that the kernel can run the general-purpose computing program and the secure computing program in parallel.

13. The data processing method according to claim 12, characterized in that, The device further includes a cache access control module, a memory access control module, and an input / output interface access control module; the method further includes: The cache access control module encrypts the data corresponding to the secure computing program and stores it in the second target cache block of the first-level cache unit and the first target cache block of the second-level cache unit; The memory access control module encrypts the data corresponding to the secure computing program and stores it in the target memory block of the memory unit; The input / output interface access control module encrypts the data corresponding to the secure computing program and then calls it through the target input / output interface of the input / output interface.

14. The data processing method according to claim 12, characterized in that, Also includes: When the cache partitioning control module detects that the secure computing program has stopped running, it sends a sixth notification message to the memory management unit. Based on the sixth notification message, the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the first-level cache unit and the second-level cache unit, so that each cache block of the first-level cache unit and the second-level cache unit is used to cache the data corresponding to the general computing program.

15. The data processing method according to claim 12, characterized in that, Also includes: When the memory partitioning control module detects that the secure computing program has stopped running, it sends an eighth notification message to the memory management unit. Based on the eighth notification message, the memory management unit determines the mapping relationship between the virtual address corresponding to the general computing program and the physical address corresponding to the memory unit, so that each memory block of the memory unit is used to store the data corresponding to the general computing program.

Images