Artificial intelligence ai control apparatus and acceleration method

Abstract

The application discloses an artificial intelligence (AI) control device and an acceleration method. The AI control device comprises an AI controller and an interface circuit. The AI controller is configured to configure N acceleration units in an AI accelerator into at least first-type acceleration units and second-type acceleration units, wherein the security level of the first-type acceleration units is higher than that of the second-type acceleration units. The AI controller is further configured to receive, through the interface circuit, first-type tasks issued by a processor in a first execution environment, and distribute the first-type tasks to the first-type acceleration units; and receive second-type tasks issued by the processor in a second execution environment, and distribute the second-type tasks to the second-type acceleration units, wherein the security level of the first-type tasks is higher than that of the second-type tasks. According to the application, tasks of different security levels can be simultaneously run on one AI acceleration chip, and hardware-level isolation is provided for the tasks of different security levels.

Description

Technical Field

[0001] This application relates to the field of semiconductor technology, and in particular to an artificial intelligence (AI) control device and acceleration method. Background Technology

[0002] With the popularization of artificial intelligence (AI) applications, while providing convenience to users, AI applications also bring new challenges to data protection during the operation process: In order to accelerate AI operations, AI applications often use heterogeneous systems: that is, logical operations are performed on the central processing unit (CPU), and AI operations are performed on the graphics processing unit (GPU) or neural network processing unit (NPU).

[0003] Currently, CPUs have relatively mature isolation technologies such as TrustZone and Intel's Software Guard Extensions (SGX). For example, tasks with different security levels are run in execution environments with different security levels to protect the security of operations on the CPU, thereby preventing tasks with higher security levels from being accessed by tasks with other security levels.

[0004] However, computations on accelerators (consisting of at least one GPU and / or at least one NPU) cannot isolate tasks with different security levels. In other words, at present, to ensure task security, it is not possible to run computational tasks with different security levels simultaneously on accelerators. Summary of the Invention

[0005] This application provides an artificial intelligence (AI) control device and acceleration method that can run tasks with different security levels simultaneously on a single AI acceleration chip and provide hardware-level isolation for tasks with different security levels.

[0006] In a first aspect, this application provides an artificial intelligence (AI) control device, comprising: an AI controller and an interface circuit. The AI ​​controller is configured to configure N acceleration units in an AI accelerator as at least a first type of acceleration unit and a second type of acceleration unit, wherein the security level of the first type of acceleration unit is higher than the security level of the second type of acceleration unit, and N is a positive integer greater than or equal to 2. The AI ​​controller is also configured to receive a first type of task issued by a processor in a first execution environment through the interface circuit, and distribute the first type of task to the first type of acceleration unit; and to receive a second type of task issued by the processor in a second execution environment, and distribute the second type of task to the second type of acceleration unit, wherein the security level of the first type of task is higher than the security level of the second type of task.

[0007] From a technical perspective, in scenarios involving accelerated AI computation, after the processor distributes tasks of different security levels (i.e., first-class tasks and second-class tasks) through different execution environments, the AI ​​controller added in this application distributes them to acceleration units of corresponding security levels based on the task's security level. Finally, acceleration units of different security levels process the tasks of their respective security levels. The task distribution process in the processor, the task distribution process in the AI ​​controller, and the task execution process in the AI ​​accelerator are all conducted independently; that is, the processor, AI controller, and AI accelerator each have their own isolation mechanisms for tasks of different security levels. However, existing technologies, for scenarios involving accelerated AI computation, do not classify the acceleration units in the accelerator, nor do they completely isolate the distribution process of tasks of different security levels. To ensure security during task execution, it is impossible to distribute tasks of different security levels to a single accelerator. Therefore, compared to existing technologies, this application can execute tasks of different security levels simultaneously within a single accelerator while ensuring the security of the task execution process, effectively guaranteeing the security of high-security-level tasks (e.g., sensitive data processing tasks). Meanwhile, when the number of tasks is small, executing tasks of different security levels simultaneously in one accelerator can make full use of the acceleration units in the accelerator, avoid the waiting process of other security level tasks when the accelerator can only handle one security level task at a time, and improve the acceleration performance of the accelerator.

[0008] In one feasible implementation, the AI ​​controller is specifically used to receive configuration instructions issued by the processor, the configuration instructions including a security identifier and configuration information; under the condition that the security identifier indicates that the configuration instructions are issued by the processor in the first execution environment, the N acceleration units are configured as at least the first type of acceleration unit and the second type of acceleration unit based on the configuration information.

[0009] From a technical perspective, identifying the security level of configuration information in configuration instructions based on security identifiers ensures that the AI ​​controller can only configure the acceleration units in the accelerator in a first execution environment with a high security level (e.g., TEE), while not allowing the AI ​​controller to configure the acceleration units in the accelerator in a second execution environment with a lower security level (e.g., REE). This improves the security of the accelerator configuration process and prevents tampering.

[0010] In one feasible implementation, the aforementioned security identifier can be represented by a non-security bit (NS bit). For example, a security identifier of 0 indicates that the configuration instruction was issued by the processor 110 in a first execution environment, while a security identifier of 1 indicates that the configuration instruction was issued by the processor 110 in a second execution environment.

[0011] In one feasible implementation, the AI ​​controller is specifically used to read the first identifier carried by the first type of task, and send the first type of task to the first type of acceleration unit based on the first identifier; and to read the second identifier carried by the second type of task, and send the second type of task to the second type of acceleration unit based on the second identifier; wherein, the first identifier is used to indicate the security level of the first type of task, and the second identifier is used to indicate the security level of the second type of task.

[0012] From a technical perspective, the AI ​​controller identifies the security level of each task by the identifier it carries, and then distributes it to the acceleration unit of the corresponding security level. Since the acceleration unit only passively receives the tasks issued by the controller, the controller's distribution logic can be used to distribute the first type of tasks to the first type of acceleration unit and the second type of tasks to the second type of acceleration unit, so as to isolate the execution process of the first type of tasks and the second type of tasks, and ensure the security of tasks with different security levels during the execution process. That is, this application can provide hardware-level isolation for tasks with different security levels that are executed simultaneously in the same accelerator.

[0013] In one feasible implementation, the first identifier and the second identifier can be represented by non-security bits (NS bits). For example, the first identifier is 0 and the second identifier is 1.

[0014] In one feasible implementation, the AI ​​control device, the processor, and the AI ​​accelerator are integrated in the same system-on-a-chip (SoC), the AI ​​control device and the processor are connected via a bus, and the AI ​​control device and the AI ​​accelerator are connected via a bus.

[0015] From a technical perspective, this application integrates the AI ​​control device, processor, and AI accelerator onto a single SOC. Compared to the prior art where the host system and accelerator are interconnected via an open network, data transmission between the CPU and accelerator does not require frequent encryption and decryption, which can effectively improve the communication performance between the processor and accelerator.

[0016] In one feasible implementation, the AI ​​controller is specifically used to receive the first type of task and the second type of task issued by the processor through the bus; to distribute the first type of task to the first type of acceleration unit and to distribute the second type of task to the second type of acceleration unit through the bus.

[0017] It should be understood that the bus between the processor and the AI ​​control device, and the bus between the AI ​​accelerator and the AI ​​control device, can be a single bus or two separate buses; this application does not limit this.

[0018] From a technical perspective, this application integrates the processor, AI control device, and AI accelerator into a semiconductor chip, which effectively reduces communication overhead between hardware modules compared to the communication methods using open interconnect networks in existing technologies. Furthermore, by implementing communication between the processor and AI control device, and between the AI ​​control device and AI accelerator, through two independent buses, it prevents the processor from bypassing the AI ​​control device to directly control the AI ​​accelerator to execute acceleration tasks. That is, tasks issued by the processor need to be distributed to the acceleration units in the AI ​​accelerator through the task distribution logic of the AI ​​control device. As can be seen from the above embodiments, effective isolation can be achieved during task execution at different security levels within the AI ​​accelerator.

[0019] In one feasible implementation, the AI ​​controller is further configured to configure a first storage area and a second storage area in the memory, wherein the first storage area is used to store computational data corresponding to the first type of task, and the second storage area is used to store computational data corresponding to the second type of task.

[0020] It should be understood that the security level of the first storage area is higher than that of the second storage area.

[0021] From a technical perspective, by storing the computational data corresponding to tasks with different security levels in different security areas on the memory, the data access processes of different security levels can be isolated from each other when executing tasks with different security levels. This prevents the second type of task with a lower security level from accessing the data corresponding to the task with a higher security level during execution, thus ensuring data security.

[0022] In one feasible implementation, the AI ​​control device, the memory, the AI ​​accelerator, and the processor are integrated into the same system-on-a-chip (SoC).

[0023] From a technical perspective, integrating the processor with the AI ​​control device, and the processor and AI accelerator onto a single SoC can effectively reduce the communication overhead between various hardware modules.

[0024] In one feasible implementation, the memory, the AI ​​control device, the processor, and the AI ​​accelerator are connected via a bus; or the memory, the AI ​​control device, and the processor are connected via a first bus, and the memory, the AI ​​control device, and the AI ​​accelerator are connected via a second bus.

[0025] From a technical perspective, the memory is connected to the processor and the AI ​​accelerator via two buses respectively, allowing the processor and the AI ​​accelerator to access the memory through independent physical links. This method further ensures the physical isolation between the processor and the AI ​​accelerator, preventing the processor from directly controlling the AI ​​accelerator. This enables the AI ​​control device to distribute tasks to the AI ​​accelerator, thereby isolating the execution processes of tasks with different security levels on the AI ​​accelerator.

[0026] In one feasible implementation, the first storage area includes a first task queue, and the second storage area includes a second task queue. The AI ​​controller is further configured to store the first type of tasks in the first task queue based on the reception time of the first type of tasks, and to store the second type of tasks in the second task queue based on the reception time of the second type of tasks. Specifically, the first type of tasks with earlier reception times are ranked higher in the first task queue and are distributed to the first type of acceleration unit earlier; similarly, the second type of tasks with earlier reception times are ranked higher in the second task queue and are distributed to the second type of acceleration unit earlier.

[0027] From a technical perspective, based on the security level of the task, a first task queue and a second task queue are maintained in the first storage area and the second storage area respectively, thereby isolating the task distribution process for different security levels. In addition, by using queues to distribute tasks, tasks can be distributed when there are idle acceleration units, and stored in queues when there are no idle acceleration units, thus maximizing the utilization of the computing power of each acceleration unit and improving computing performance.

[0028] In one feasible implementation, the controller is specifically configured to configure M of the N acceleration units as the first type of acceleration units, and configure the remaining acceleration units of the N acceleration units other than the M acceleration units as the second type of acceleration units, where M is a positive integer less than or equal to N.

[0029] From a technical perspective, this application can meet the computing power requirements of different security level computing tasks in different AI acceleration tasks by dynamically configuring the number of high-security-level first-type acceleration units and low-security-level second-type acceleration units, thus offering high flexibility.

[0030] In one feasible implementation, the first type of task includes a first task, the second type of task includes a second task, the first task corresponds to a first virtual address, and the second task corresponds to a second virtual address; the first type of acceleration unit is used to access data in the first storage area according to the first virtual address and the first page table; the second type of acceleration unit is used to access data in the second storage area according to the second virtual address and the second page table.

[0031] From a technical perspective, when using virtual addresses for data access, isolation during the data access process is achieved by setting up two different sets of page tables for the first and second types of tasks with different security levels. This prevents the computational data corresponding to the first type of task from being accessed by the second type of task when using the same set of page tables.

[0032] In one feasible implementation, the first type of task includes a first task, the second type of task includes a second task, the first task corresponds to a first physical address, and the second task corresponds to a second physical address; when the first physical address is located in the first storage area, the first type of acceleration unit has the right to access the first storage area; when the second physical address is located in the second storage area, the second type of acceleration unit has the right to access the second storage area.

[0033] From a technical perspective, when accessing data using physical addresses, the system determines whether data access is allowed by judging whether the security level of the storage area where the physical address is located corresponds to the security level of the task being accessed. This ensures that the first type of task only accesses the first storage area during execution, and the second type of task only accesses the second storage area during execution, thereby achieving isolation of the access process when accessing data using physical addresses.

[0034] In one feasible implementation, the N acceleration units include a third acceleration unit; when the third acceleration unit is configured from the first type of acceleration unit to the second type of acceleration unit, or from the second type of acceleration unit to the first type of acceleration unit, the data cached inside the third acceleration unit is cleared.

[0035] The third acceleration unit can be any one of the acceleration units in the accelerator.

[0036] From a technical perspective, when the security level of the acceleration unit changes during the configuration process, the data cached inside the acceleration unit during the last execution of the computing task is cleared in a timely manner to ensure data security.

[0037] In one feasible implementation, each acceleration unit in the AI ​​accelerator may include at least one arithmetic logic unit (ALU) and at least one storage unit. The at least one storage unit is a readable and writable storage unit, such as a register.

[0038] In one feasible implementation, the first execution environment is a Trusted Execution Environment (TEE), and the second execution environment is a Rich Execution Environment (REE).

[0039] From a technical perspective, the mature TEE and REE technologies in the processor enable the isolation of tasks with different security levels during the distribution process, providing a basis for the subsequent isolation of the distribution process of tasks with different security levels by the controller.

[0040] Secondly, embodiments of this application provide a system-on-a-chip (SoC), which includes a processor, an AI controller, and an AI accelerator. The AI ​​controller is configured to configure at least N acceleration units in the AI ​​accelerator as a first type of acceleration unit and a second type of acceleration unit, wherein the security level of the first type of acceleration unit is higher than that of the second type of acceleration unit, and N is a positive integer greater than or equal to 2. The AI ​​controller is also configured to receive a first type of task issued by the processor in a first execution environment and distribute the first type of task to the first type of acceleration unit; and to receive a second type of task issued by the processor in a second execution environment and distribute the second type of task to the second type of acceleration unit, wherein the security level of the first type of task is higher than that of the second type of task.

[0041] In one feasible implementation, the AI ​​controller is specifically used to receive configuration instructions issued by the processor, the configuration instructions including a security identifier and configuration information; under the condition that the security identifier indicates that the configuration instructions are issued by the processor in the first execution environment, the N acceleration units are configured as at least the first type of acceleration unit and the second type of acceleration unit based on the configuration information.

[0042] In one feasible implementation, the AI ​​controller is specifically used to read the first identifier carried by the first type of task, and send the first type of task to the first type of acceleration unit based on the first identifier; and to read the second identifier carried by the second type of task, and send the second type of task to the second type of acceleration unit based on the second identifier; wherein, the first identifier is used to indicate the security level of the first type of task, and the second identifier is used to indicate the security level of the second type of task.

[0043] In one feasible implementation, the AI ​​control device and the processor are connected via a bus, and the AI ​​control device and the AI ​​accelerator are connected via a bus.

[0044] In one feasible implementation, the AI ​​controller is specifically used to receive the first type of task and the second type of task issued by the processor through the bus; to distribute the first type of task to the first type of acceleration unit and to distribute the second type of task to the second type of acceleration unit through the bus.

[0045] In one feasible implementation, the AI ​​controller is further configured to configure a first storage area and a second storage area in the memory, wherein the first storage area is used to store computational data corresponding to the first type of task, and the second storage area is used to store computational data corresponding to the second type of task.

[0046] In one feasible implementation, the memory is integrated into the system-on-a-chip. The memory, the AI ​​controller, the processor, and the AI ​​accelerator are connected via a bus; or the memory, the AI ​​controller, and the processor are connected via a first bus, and the memory, the AI ​​controller, and the AI ​​accelerator are connected via a second bus.

[0047] In one feasible implementation, the first storage area includes a first task queue, and the second storage area includes a second task queue. The AI ​​controller is further configured to: store the first type of tasks in the first task queue based on the reception time of the first type of tasks, and store the second type of tasks in the second task queue based on the reception time of the second type of tasks; wherein, the first type of tasks with earlier reception times are ranked higher in the first task queue and are distributed to the first type of acceleration unit earlier, and the second type of tasks with earlier reception times are ranked higher in the second task queue and are distributed to the second type of acceleration unit earlier.

[0048] In one feasible implementation, the first type of task includes a first task, the second type of task includes a second task, the first task corresponds to a first virtual address, and the second task corresponds to a second virtual address; the first type of acceleration unit is used to access data in the first storage area according to the first virtual address and the first page table; the second type of acceleration unit is used to access data in the second storage area according to the second virtual address and the second page table.

[0049] In one feasible implementation, the first type of task includes a first task, the second type of task includes a second task, the first task corresponds to a first physical address, and the second task corresponds to a second physical address; when the first physical address is located in the first storage area, the first type of acceleration unit has the right to access the first storage area; when the second physical address is located in the second storage area, the second type of acceleration unit has the right to access the second storage area.

[0050] In one feasible implementation, the N acceleration units include a third acceleration unit; when the third acceleration unit is configured from the first type of acceleration unit to the second type of acceleration unit, or from the second type of acceleration unit to the first type of acceleration unit, the data cached inside the third acceleration unit is cleared.

[0051] In one feasible implementation, the first execution environment is a Trusted Execution Environment (TEE), and the second execution environment is a Rich Execution Environment (REE).

[0052] Thirdly, embodiments of this application provide an AI acceleration method, the method comprising: configuring N acceleration units in an AI accelerator as at least a first type of acceleration unit and a second type of acceleration unit through an AI controller, wherein the security level of the first type of acceleration unit is higher than the security level of the second type of acceleration unit, and N is a positive integer greater than or equal to 2; receiving a first type of task issued by a processor in a first execution environment through the AI ​​controller, and distributing the first type of task to the first type of acceleration unit; and receiving a second type of task issued by the processor in the second execution environment, and distributing the second type of task to the second type of acceleration unit, wherein the security level of the first type of task is higher than the security level of the second type of task.

[0053] In one feasible implementation, configuring the N acceleration units in the AI ​​accelerator as at least a first type of acceleration unit and a second type of acceleration unit via the AI ​​controller includes: the AI ​​controller receiving a configuration instruction issued by the processor, the configuration instruction containing a security identifier and configuration information; and, based on the configuration information, configuring the N acceleration units as at least a first type of acceleration unit and a second type of acceleration unit, provided that the security identifier indicates that the configuration instruction was issued by the processor in the first execution environment.

[0054] In one feasible implementation, distributing the first type of task to the first type of acceleration unit includes: the AI ​​controller reading a first identifier carried by the first type of task, and distributing the first type of task to the first type of acceleration unit based on the first identifier; distributing the second type of task to the second type of acceleration unit includes: the AI ​​controller reading a second identifier carried by the second type of task, and distributing the second type of task to the second type of acceleration unit based on the second identifier; wherein, the first identifier is used to indicate the security level of the first type of task, and the second identifier is used to indicate the security level of the second type of task.

[0055] In one feasible implementation, the AI ​​controller, the processor, and the AI ​​accelerator are integrated in the same system-on-a-chip (SoC), with the AI ​​controller and the processor connected via a bus, and the AI ​​controller and the AI ​​accelerator connected via a bus.

[0056] In one feasible implementation, the step of receiving a first type of task issued by the processor in a first execution environment and distributing the first type of task to a first type of acceleration unit via the AI ​​controller, and receiving a second type of task issued by the processor in a second execution environment and distributing the second type of task to a second type of acceleration unit, includes: the AI ​​controller receiving the first type of task and the second type of task issued by the processor via the bus; and distributing the first type of task to the first type of acceleration unit and the second type of task to the second type of acceleration unit via the bus.

[0057] In one feasible implementation, the method further includes: configuring a first storage area and a second storage area in a memory by the AI ​​controller, wherein the first storage area is used to store computational data corresponding to the first type of task, and the second storage area is used to store computational data corresponding to the second type of task.

[0058] In one feasible implementation, the AI ​​controller, the memory, the AI ​​accelerator, and the processor are integrated into the same system-on-a-chip (SoC).

[0059] In one feasible implementation, the memory, the AI ​​controller, the processor, and the AI ​​accelerator are connected via a bus; or the memory, the AI ​​controller, and the processor are connected via a first bus, and the memory, the AI ​​controller, and the AI ​​accelerator are connected via a second bus.

[0060] In one feasible implementation, the first storage area includes a first task queue, and the second storage area includes a second task queue. The method further includes: the AI ​​controller storing the first type of tasks in the first task queue based on the reception time of the first type of tasks, and storing the second type of tasks in the second task queue based on the reception time of the second type of tasks; wherein, the first type of tasks with earlier reception times are ranked higher in the first task queue and are distributed to the first type of acceleration unit earlier, and the second type of tasks with earlier reception times are ranked higher in the second task queue and are distributed to the second type of acceleration unit earlier.

[0061] In one feasible implementation, the first type of task includes a first task, the second type of task includes a second task, the first task corresponds to a first virtual address, and the second task corresponds to a second virtual address; the first type of acceleration unit accesses data in the first storage area according to the first virtual address and the first page table; the second type of acceleration unit accesses data in the second storage area according to the second virtual address and the second page table.

[0062] In one feasible implementation, the first type of task includes a first task, the second type of task includes a second task, the first task corresponds to a first physical address, and the second task corresponds to a second physical address; when the first physical address is located in the first storage area, the first type of acceleration unit is allowed to access the first storage area; when the second physical address is located in the second storage area, the second type of acceleration unit is allowed to access the second storage area.

[0063] In one feasible implementation, the N acceleration units include a third acceleration unit; when the third acceleration unit is configured from the first type of acceleration unit to the second type of acceleration unit, or from the second type of acceleration unit to the first type of acceleration unit, the data cached inside the third acceleration unit is cleared.

[0064] In one feasible implementation, the first execution environment is a Trusted Execution Environment (TEE), and the second execution environment is a Rich Execution Environment (REE).

[0065] Fourthly, embodiments of this application provide a computer device, characterized in that the computer device includes at least one processor and interface circuitry; the at least one processor is configured to invoke instructions stored in a memory to execute the method described in any one of the third aspects above.

[0066] Fifthly, embodiments of this application provide a computer-readable storage medium storing a computer program, which, when executed, enables the implementation of the method described in any one of the third aspects above.

[0067] Sixthly, embodiments of this application provide a computer program including instructions that, when executed, implement the method described in any of the third aspects above. Attached Figure Description

[0068] The accompanying drawings used in the embodiments of this application are described below.

[0069] Figures 1a-1b This is a schematic diagram of the structure of the AI ​​acceleration device provided in the embodiments of this application;

[0070] Figure 2 A schematic diagram of the execution flow of an AI acceleration task provided in an embodiment of this application;

[0071] Figures 3a-3b This is a schematic diagram of another AI acceleration device provided in an embodiment of this application;

[0072] Figure 4 This application provides a schematic diagram of an acceleration unit accessing a memory process according to an embodiment of the present application.

[0073] Figure 5 This is a schematic diagram of the structure of an AI accelerator provided in an embodiment of this application;

[0074] Figure 6 This application provides a specific example of the task execution process of an AI acceleration device.

[0075] Figure 7 This is a schematic diagram of the structure of an AI control device provided in an embodiment of this application;

[0076] Figures 8a-8b These are schematic diagrams of the structures of two on-chip systems provided in the embodiments of this application;

[0077] Figure 9 This is a flowchart illustrating an AI acceleration method provided in an embodiment of this application. Detailed Implementation

[0078] The embodiments of this application are described below with reference to the accompanying drawings. In the description of the embodiments of this application, unless otherwise stated, " / " represents "or," for example, A / B can represent A or B; "and / or" in the text is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, and B existing alone. Furthermore, in the description of the embodiments of this application, "multiple" refers to two or more than two.

[0079] The terms "first," "second," "third," and "fourth," etc., used in the specification, claims, and accompanying drawings of this application are used to distinguish different objects, not to describe a particular order. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or apparatus that includes a series of steps or units is not limited to the listed steps or units, but may optionally include steps or units not listed, or may optionally include other steps or units inherent to these processes, methods, products, or apparatuses. The reference to "embodiment" herein means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places in the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0080] The following is a description of the technical terms used in this application.

[0081] (1) Rich Execution Environment (REE): Generally used to run feature-rich operating systems such as Android, iOS, and Linux. Programs running on this environment are called Client Applications (CAs). Its characteristics include providing system security through the operating system: 1) Application isolation: each application can only access its own data; 2) Access control: ordinary users and applications have restricted access to system data; 3) General-purpose and feature-rich, but both applications and the operating system can introduce vulnerabilities; 4) Open and extensible. In REEs, due to the extremely large and complex operating system (OS) code, system vulnerabilities are common. Furthermore, REEs are typically distinguished from platform technologies that support fully trusted execution environments (TEEs) as well as security-aware applications and security services.

[0082] (2) Trusted Execution Environment (TEE): This is a secure zone separated from the Rich Execution Environment (REE). The TEE consists of a Trusted Application (TA) and a Trusted Operating System (TOS). It is separate from the REE and the applications running on it, ensuring that sensitive data is stored, processed, and protected within a trusted environment. Simultaneously, the TEE provides a secure execution environment for the Trusted Application (TA) within it. The TEE provides hardware-level protection and security isolation for peripheral hardware resources. When the CPU is in REE state, no application can access secure hardware devices, nor can it access memory, cache, or other peripheral secure hardware devices that are in a secure state. Currently, mature technologies that can implement TEE and REE on the CPU include ARM's Trustzone, Intel's SGX, virtualization technology on the MIPS (Microprocessor Without Interlocked Piped Stages Architecture) architecture, and AMD's PSP (Platform Security Processor).

[0083] (3) Accelerator: Hardware used to accelerate AI computing. Accelerators may include Graphics Processing Units (GPUs) and / or Neural Network Processing Units (NPUs). Each GPU or NPU includes at least one accelerator unit, and each accelerator unit contains hardware modules such as an Arithmetic Logic Unit (ALU) and registers. According to the application scenario corresponding to the task processed by each accelerator unit, they can be divided into matrix operation accelerator units, vector computation accelerator units, image preprocessing accelerator units, etc.

[0084] Please see Figures 1a-1b , Figures 1a-1b This is a schematic diagram of the structure of the AI ​​acceleration device provided in an embodiment of this application. Figure 1aAs shown, the AI ​​acceleration device 100 includes a processor 110, an AI control device 120, an AI accelerator 130, a bus 140, and a bus 160. The processor 110, AI control device 120, and AI accelerator 130 are integrated within a semiconductor chip as a system-on-a-chip (SoC). The processor 110 and AI control device 120 are connected via bus 160, and the AI ​​control device 120 and AI accelerator 130 are connected via bus 140. Buses 160 and 140 are two independent buses.

[0085] After the AI ​​computing task is sent to the AI ​​acceleration device 100, the processor 110 first decomposes the AI ​​computing task into at least two types of tasks with different security levels (i.e., the first type of task and the second type of task in the following embodiment). The decomposed tasks with different security levels are sent to the AI ​​control device 120 through the bus 160. Then, the AI ​​control device 120 sends the tasks with different security levels to the corresponding acceleration units (i.e., the first type of acceleration unit and the second type of acceleration unit in the following embodiment) in the AI ​​accelerator 130 through the bus 140, so as to realize the simultaneous execution of tasks with different security levels in one AI accelerator.

[0086] This application can be applied to various scenarios with security requirements. For example, in a fingerprint unlocking task, the input is the user's fingerprint, and the output is the result of whether the user's fingerprint matches the fingerprint in the fingerprint database. In this scenario, the processor 110 decomposes the fingerprint unlocking task into sub-tasks with different security levels: 1) preprocessing of the input user fingerprint that does not require security processing (corresponding to the second type of task in the following embodiments); 2) fingerprint database scheduling calculation task and comparison task between the preprocessed fingerprint and the fingerprint in the fingerprint database that require security processing (corresponding to the first type of task in the following embodiments). Then, the tasks with different security levels are sent to the corresponding security level acceleration units (corresponding to the first type of acceleration unit and the second type of acceleration unit in the following embodiments) in the AI ​​accelerator 130 for task processing through the AI ​​control device 120.

[0087] Please see Figure 1b , Figure 1b A schematic diagram illustrating another connection method between the processor 110, the AI ​​control device 120, and the AI ​​accelerator 130 is shown. Figure 1b In the AI ​​acceleration device 100 shown, the processor 110, AI control device 120, and AI accelerator 130 are connected via a single bus 140. In addition, Figure 1b The AI ​​acceleration device 100 shown is Figure 1a The task execution process of the AI ​​acceleration device shown is the same, so it will not be described again. It should be understood that... Figure 1a and Figure 1bThe AI ​​control device 120 may include an AI controller and an interface circuit. In an optional case, if the AI ​​control device 120 does not have an interface circuit, the AI ​​control device may be considered equivalent to the AI ​​controller.

[0088] From a technical perspective, adopting Figure 1a The connection method shown, which uses two independent buses to realize communication between the processor and the AI ​​control device, and between the AI ​​control device and the AI ​​accelerator, can prevent the processor from bypassing the AI ​​control device to directly control the AI ​​accelerator to execute acceleration tasks. In other words, the tasks issued by the processor need to be distributed to the acceleration units in the AI ​​accelerator through the task distribution logic of the AI ​​control device, thereby distributing tasks of different security levels to acceleration units of corresponding security levels and thus isolating the execution process of tasks of different security levels.

[0089] Please see Figure 2 , Figure 2 This application provides a schematic diagram of the execution flow of an AI acceleration task, used to describe... Figures 1a-1b The specific task execution process of the AI ​​accelerator 100 is described, which also serves as a supplement to the software architecture and hardware structure of the AI ​​accelerator 100. For example... Figure 2 As shown, the AI ​​accelerator 130 includes N acceleration units, where N is a positive integer greater than or equal to 2. The AI ​​control device 120 includes an interface circuit 121 and an AI controller 122. Among them,

[0090] The AI ​​controller 122 is configured to configure at least the N acceleration units in the AI ​​accelerator 130 as first-type acceleration units and second-type acceleration units, wherein the security level of the first-type acceleration units is higher than that of the second-type acceleration units, and N is a positive integer greater than or equal to 2; the AI ​​controller 122 is also configured to receive a first-type task issued by the processor 110 in a first execution environment through the interface circuit, and distribute the first-type task to the first-type acceleration units; and to receive a second-type task issued by the processor 110 in a second execution environment, and distribute the second-type task to the second-type acceleration units, wherein the security level of the first-type task is higher than that of the second-type task.

[0091] The first and second execution environments mentioned above are two time-multiplexed execution environments in processor 110. At any given time, either the first or second execution environment runs on processor 110; that is, the first and second execution environments cannot run simultaneously on processor 110. At the software level, the first and second execution environments each contain their own independent operating systems and applications; at the hardware level, the first and second execution environments share the internal hardware of processor 110. The switching process between the first and second execution environments on processor 110 is as follows: Assuming processor 110 is currently running the first execution environment, before switching, a snapshot of the relevant data in the first execution environment is taken and saved in the internal storage unit of processor 110. Then, the snapshot of the second execution environment stored in the storage unit is loaded, and the second execution environment begins to run. This process achieves the effect of mutual isolation between the first and second execution environments. The security level of the first execution environment is higher than that of the second execution environment; that is, the security level of a first type of task sent through the first execution environment is higher than that of a second type of task sent through the second execution environment.

[0092] From a technical perspective, this application uses an AI controller to divide acceleration units within an accelerator into at least two different security levels. Tasks of different security levels received from the processor are then distributed to the corresponding security level acceleration units, enabling the simultaneous execution of acceleration tasks of different security levels within a single accelerator and improving its acceleration performance. Furthermore, since tasks of different security levels (i.e., first-type and second-type tasks) are distributed separately by the processor from different execution environments, and the controller distributes these tasks to the corresponding security level acceleration units according to a fixed distribution logic, the process from task distribution from the processor to the controller, and then to task execution within the accelerator, ensures that tasks of different security levels are isolated from each other. This effectively protects the security of high-security task execution during scenarios where tasks of different security levels are executed simultaneously within the accelerator.

[0093] Optionally, the first execution environment is a Trusted Execution Environment (TEE), and the second execution environment is a Rich Execution Environment (REE). The REE and TEE can be implemented in various ways (e.g., Trustzone, SGX, and MIPS), which will not be elaborated here. Furthermore, the first and second execution environments can also be other feasible mutually isolated environments, which are not limited in this application.

[0094] From a technical perspective, the mature TEE and REE technologies in the processor enable the isolation of tasks with different security levels during the distribution process, providing a basis for the subsequent isolation of the distribution process of tasks with different security levels by the controller.

[0095] Optionally, the AI ​​controller 122 is specifically configured to: receive a configuration instruction issued by the processor 110, the configuration instruction including a security identifier and configuration information; and, under the condition that the security identifier indicates that the configuration instruction was issued by the processor 110 in the first execution environment, configure the N acceleration units as at least the first type of acceleration unit and the second type of acceleration unit based on the configuration information.

[0096] From a technical perspective, identifying the security level of configuration information in configuration instructions based on security identifiers ensures that the configuration process of acceleration units in the accelerator is instructed by high-security configuration instructions issued by the first execution environment, thereby improving the security of the accelerator configuration process and preventing tampering.

[0097] Optionally, the aforementioned security flag can be represented by a non-security bit (NS bit). For example, a security flag of 0 indicates that the configuration instruction was issued by the processor 110 in a first execution environment, while a security flag of 1 indicates that the configuration instruction was issued by the processor 110 in a second execution environment.

[0098] Optionally, the above configuration information includes the number of different security level types, and the specific number of acceleration units included in each security level. For example, N acceleration units can be configured into 3 different security levels, with each security level including at least one acceleration unit.

[0099] Specifically, after the AI ​​controller 122 receives the configuration instruction issued by the processor 110, it first reads the security identifier in the configuration instruction and identifies the security identifier: when the security identifier indicates that the configuration instruction was issued by the processor 110 in the first execution environment, the AI ​​controller 122 identifies the configuration instruction as safe and configures at least the N acceleration units in the AI ​​accelerator 130 as first-type acceleration units and second-type acceleration units based on the configuration information in the configuration instruction; when the security identifier indicates that the configuration instruction was not issued by the processor 110 in the first execution environment (for example, it was issued by the processor 110 in the second execution environment), the AI ​​controller 122 identifies the configuration instruction as unsafe and will not perform configuration operations on the AI ​​accelerator 130.

[0100] The configuration information is sent through a first execution environment with a higher security level, which can ensure the security of the configuration information and prevent it from being tampered with.

[0101] Optionally, the AI ​​controller 122 configures the N acceleration units in the AI ​​accelerator 130 as at least a first type of acceleration unit and a second type of acceleration unit based on the configuration information in the configuration instruction. Specifically, the AI ​​controller 122 configures the N acceleration units in the AI ​​accelerator 130 as multiple different security levels based on the configuration information, such as 2, 3, or 5 different security levels, with each security level containing at least one acceleration unit.

[0102] The above configuration information can be set by the user based on the specific AI application scenario.

[0103] Among them, the various types of acceleration units with different safety levels include a first type of acceleration unit and a second type of acceleration unit. The safety level of the first type of acceleration unit is higher than that of the second type of acceleration unit, and the safety level of each acceleration unit contained in each type of acceleration unit is the same.

[0104] For example, the AI ​​controller 122 can configure the N acceleration units in the AI ​​accelerator 130 as first-type acceleration units and second-type acceleration units based on the configuration information in the configuration instruction: configure M acceleration units out of the N acceleration units as first-type acceleration units, and configure the remaining acceleration units out of the N acceleration units except for M acceleration units as second-type acceleration units, where M is a positive integer less than or equal to N.

[0105] The processor 110 mentioned above may be a central processing unit (CPU) or other processing core. The specific implementation scheme of the processor will not be elaborated in this embodiment.

[0106] After the processor 110 instructs the AI ​​controller 122 to configure the security level of the acceleration unit in the AI ​​accelerator 130, the processor 110 issues a first type of task to the AI ​​controller 122 through a first execution environment, and issues a second type of task to the AI ​​controller 122 through a second execution environment. The security level of the first type of task is higher than that of the second type of task.

[0107] Optionally, the AI ​​controller 122 is specifically configured to: read the first identifier carried by the first type of task, and send the first type of task to the first type of acceleration unit based on the first identifier; and read the second identifier carried by the second type of task, and send the second type of task to the second type of acceleration unit based on the second identifier; wherein the first identifier is used to indicate the security level of the first type of task, and the second identifier is used to indicate the security level of the second type of task.

[0108] From a technical perspective, the AI ​​controller identifies the security level of each task by the identifier it carries, and then distributes it to the acceleration unit of the corresponding security level. Since the acceleration unit only passively receives the tasks issued by the controller, the controller's distribution logic can be used to distribute the first type of tasks to the first type of acceleration unit and the second type of tasks to the second type of acceleration unit, so as to isolate the execution process of the first type of tasks and the second type of tasks, and ensure the security of tasks with different security levels during the execution process. That is, this application can provide hardware-level isolation for tasks with different security levels that are executed simultaneously in the same accelerator.

[0109] Optionally, the first and second identifiers can be represented by non-security bits (NSbits). For example, the first identifier is 0 and the second identifier is 1.

[0110] The first identifier indicates a higher security level than the second identifier.

[0111] Specifically, the above-mentioned reading of the first identifier carried by the first type of task and sending the first type of task to the first type of acceleration unit based on the first identifier includes: the AI ​​controller 122 reads the first identifier carried by each task in the first type of task, and based on the security level of the first type of task indicated by the first identifier (i.e., whether the first type of task is sent by the processor 110 through the first execution environment or through the second execution environment), when the first identifier indicates that the first type of task is sent by the processor 110 through the first execution environment, the AI ​​controller 122 sends the first type of task to the first type of acceleration unit based on the configuration information stored in the AI ​​controller 122.

[0112] Similarly, the above-mentioned reading of the second identifier carried by the second type of task and sending the second type of task to the second type of acceleration unit based on the second identifier specifically includes: the AI ​​controller 122 reads the second identifier carried by each task in the second type of task, and based on the security level of the second type of task indicated by the second identifier (i.e., whether the second type of task is sent by the processor 110 through the first execution environment or through the second execution environment), when the second identifier indicates that the second type of task is sent by the processor 110 through the first execution environment, the AI ​​controller 122 sends the second type of task to the second type of acceleration unit based on the configuration information stored in the AI ​​controller 122.

[0113] Optionally, the AI ​​control device 120, the processor 110, and the AI ​​accelerator 130 are integrated in the same system-on-a-chip (SoC). The AI ​​control device 120 and the processor 110 are connected via a bus 140, and the AI ​​control device 120 and the AI ​​accelerator 130 are connected via a bus 140.

[0114] It should be understood that the connection method between the AI ​​control device 120, the processor 110, and the AI ​​accelerator 130 described above is merely a specific example provided in this application, and this application does not limit it. For example, the AI ​​control device 120 can also achieve the functions of the above embodiments and the embodiments described below by integrating it inside the processor 110.

[0115] Optionally, the bus between the processor 110 and the AI ​​control device 120, and the bus between the AI ​​accelerator 130 and the AI ​​control device 120, can be a single bus or two independent buses, respectively as follows: Figures 1a-1b As shown, this application does not limit this.

[0116] Optionally, the bus in this application embodiment can be a bus that can transmit the security identifier, the first identifier and the second identifier (such as the non-security bit NS bit) in the above embodiments, such as a data bus, an address bus, etc. The specific type of bus is not limited in this application and will not be listed here.

[0117] Optionally, the AI ​​controller 122 is specifically configured to: receive the first type of task and the second type of task issued by the processor through the bus 140; distribute the first type of task to the first type of acceleration unit and distribute the second type of task to the second type of acceleration unit through the bus 140.

[0118] From a technical perspective, this application integrates the processor, AI controller, and AI accelerator into a semiconductor chip, which effectively reduces communication overhead between hardware modules compared to the open interconnect network communication method used in existing technologies. Furthermore, by implementing communication between the processor and AI controller, and between the AI ​​controller and AI accelerator, through two independent buses, it prevents the processor from bypassing the AI ​​controller to directly control the AI ​​accelerator to execute acceleration tasks. That is, tasks issued by the processor need to be distributed to the acceleration units in the AI ​​accelerator through the task distribution logic of the AI ​​controller. As can be seen from the above embodiments, isolation can be effectively achieved during the execution of tasks with different security levels within the AI ​​accelerator.

[0119] Please see Figures 3a-3b , Figures 3a-3b This is a schematic diagram of another AI acceleration device provided in an embodiment of this application. The AI ​​acceleration device 100 includes, in addition to... Figures 1a-1bIn addition to the processor 110, AI control device 120, AI accelerator 130, and bus 140, the system also includes a memory 150, and the processor 110, AI control device 120, AI accelerator 130, and memory 150 can be integrated into the same system-on-a-chip (SoC). The memory 150 is used to store the computational data required by the AI ​​accelerator 130 during the execution of the first and second types of tasks.

[0120] Optionally, the memory, the AI ​​control device, the processor, and the AI ​​accelerator are connected via a bus; or the memory, the AI ​​control device, and the processor are connected via a first bus, and the memory, the AI ​​control device, and the AI ​​accelerator are connected via a second bus.

[0121] Specifically, the following will be done through Figures 3a-3b The two connection methods of memory 150 are described respectively. These two connection methods are respectively connected to... Figures 1a-1b Corresponding. In Figure 3a In this configuration, the processor 110 and the AI ​​control device 120 are connected via bus 160 (i.e., the first bus), and the AI ​​control device 120 and the AI ​​accelerator 130 are connected via bus 140 (i.e., the second bus). The memory 150 is connected to both bus 160 and bus 140 to achieve connectivity with the processor 110, the AI ​​control device 120, and the AI ​​accelerator 130. Figure 3a for Figure 1a The expansion of the AI ​​acceleration device 100. Figure 3b In this system, the processor 110, AI control device 120, and AI accelerator 130 are connected via a bus 140, and the memory 150 is connected to the bus 140 to enable communication with the processor 110, AI control device 120, and AI accelerator 130.

[0122] Among them, memory 150 is a writable and readable storage unit, such as a register or random access memory (RAM), such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), dual data rate SDRAM (DDR SDRAM), etc.

[0123] Optionally, the memory 150 is connected to the AI ​​control device 120, the AI ​​accelerator 130, and the processor 110 via the bus 140.

[0124] Optionally, the AI ​​controller 122 is further configured to: configure a first storage area and a second storage area in the memory 150, wherein the first storage area is used to store computational data corresponding to the first type of task, and the second storage area is used to store computational data corresponding to the second type of task.

[0125] From a technical perspective, by storing the computational data corresponding to tasks with different security levels in different security areas on the memory, isolation can be achieved during data access when tasks with different security levels are executed. This prevents the second type of task with a lower security level from accessing the data corresponding to the task with a higher security level during execution, thus ensuring data security.

[0126] Optionally, the configuration information in the above configuration instructions may further include indications of first address information and second address information. The first address information is used to indicate a first storage region in the memory 150, and the second address information is used to indicate a second storage region in the memory 150.

[0127] Specifically, after receiving the configuration instruction issued by the processor 110, the AI ​​controller 122 first reads the security identifier in the configuration instruction and identifies it. When the security identifier indicates that the configuration instruction was issued by the processor 110 in the first execution environment, the AI ​​controller 122 identifies the configuration instruction as secure and configures a first storage region and a second storage region in the memory 150 based on the first address information and the second address information in the configuration information. The security level of the first storage region is higher than that of the second storage region. The first storage region is used to store the data required by each task in the first type of task during execution, and the second storage region is used to store the data required by each task in the second type of task.

[0128] It should be noted that the above configuration information includes not only the configuration information of the AI ​​accelerator 130 (indicating the number of different security levels of the acceleration units and the specific number of acceleration units included in each security level), but also the configuration information of the memory 150 (i.e. the above-mentioned first address information and second address information).

[0129] Optionally, the first storage region and the second storage region may constitute all or part of the storage space of the memory 150, and this application does not limit this.

[0130] Optionally, the first storage area includes a first task queue, and the second storage area includes a second task queue. The AI ​​controller 122 is further configured to: store the first type of task in the first task queue based on the reception time of the first type of task, and store the second type of task in the second task queue based on the reception time of the second type of task; wherein, the first type of task with an earlier reception time is ranked higher in the first task queue and is distributed to the first type of acceleration unit earlier, and the second type of task with an earlier reception time is ranked higher in the second task queue and is distributed to the second type of acceleration unit earlier.

[0131] Specifically, the AI ​​controller 122 establishes a first task queue in a first storage area of ​​the memory 150 and a second task queue in a second storage area. Then, it stores the first type of tasks in the first task queue based on the reception time of the first type of tasks, and stores the second type of tasks in the second task queue based on the reception time of the second type of tasks.

[0132] Optionally, after the AI ​​controller 122 establishes the first task queue and the second task queue, it maintains the first and second task queues based on the first-in, first-out (FIFO) principle: tasks of the first type received earlier are ranked higher in the first task queue than tasks of the first type received later, and tasks of the first type ranked higher in the first task queue are distributed to the AI ​​accelerator 130 by the AI ​​controller 122 first compared to tasks of the first type ranked later. The maintenance rules for the second task queue are the same as those for the first task queue, and will not be repeated here.

[0133] Taking the first task queue as an example, processor 110 sends K first-type tasks to AI controller 122 in the first execution environment. AI controller 122 distributes O first-type tasks to the first-type acceleration units in AI accelerator 130 based on their computing power, allowing these O first-type tasks to be executed in parallel within the first-type acceleration units. Then, AI controller 122 stores the remaining first-type tasks (excluding the O first-type tasks) in the first task queue based on their reception time. When an idle acceleration unit appears in the first-type acceleration unit, the first-type tasks ranked higher in the first task queue are sent to the idle first-type acceleration unit first. Similarly, the specific process of AI controller 122 maintaining the second task queue can be referred to the maintenance process of the first queue described above, and will not be repeated here.

[0134] The first category of tasks includes the first task, and the second category of tasks includes the second task. The first task is any one of the tasks in the first category, and the second task is any one of the tasks in the second category.

[0135] From a technical perspective, based on the security level of the task, a first task queue and a second task queue are maintained in the first storage area and the second storage area respectively, thereby isolating the task distribution process for different security levels. In addition, by using queues to distribute tasks, tasks can be distributed when there are idle acceleration units, and stored in queues when there are no idle acceleration units, thus maximizing the utilization of the computing power of each acceleration unit and improving computing performance.

[0136] The following describes in detail the access process of memory 150 by the first type of acceleration unit during the execution of the first task, and by the second acceleration unit during the execution of the second task. The access to memory by the first and second types of acceleration units can be performed using either virtual addresses or physical addresses.

[0137] (a) Accessing via virtual address

[0138] Optionally, the first type of task includes a first task, the second type of task includes a second task, the first task corresponds to a first virtual address, and the second task corresponds to a second virtual address; the first type of acceleration unit is used to access data in the first storage area according to the first virtual address and the first page table; the second type of acceleration unit is used to access data in the second storage area according to the second virtual address and the second page table.

[0139] The following will combine Figure 4 This section describes in detail the process by which the acceleration unit accesses memory 150 using virtual addresses. For example... Figure 4 As shown, during the execution of the first task, the first acceleration unit in the first type of acceleration unit will query the physical address corresponding to the first virtual address from the first page table, and then access the corresponding location in the first storage area based on the physical address; similarly, during the execution of the second task, the second acceleration unit in the second type of acceleration unit will query the physical address corresponding to the second virtual address from the second page table, and then access the corresponding location in the second storage area based on the physical address.

[0140] The first acceleration unit can be any one of the acceleration units in the first type of acceleration unit, and the second acceleration unit can be any one of the acceleration units in the second type of acceleration unit.

[0141] As can be seen, during the virtual address access to memory, the first and second type of acceleration units perform address translation based on two different sets of page tables (i.e., the first page table and the second page table). The physical address translated through the first page table is located in the first storage region, and the physical address translated through the second page table is located in the second storage region. By configuring two storage regions with different security levels in the memory 150, and then performing virtual address translation through two different sets of page tables, it is ensured that acceleration units with different security levels are isolated from each other during data access to the memory 150, thereby improving the security of the first type of task execution process.

[0142] It should be noted that Figure 4 The division of storage areas in memory 150 shown is only a specific example given in this application. The first storage area and the second storage area may only constitute part of the storage area in memory 150, and this application does not limit this.

[0143] (ii) Accessing via physical address

[0144] Optionally, the first type of task includes a first task, and the second type of task includes a second task. The first task corresponds to a first physical address, and the second task corresponds to a second physical address. When the first physical address is located in the first storage area, the first type of acceleration unit has the right to access the first storage area. When the second physical address is located in the second storage area, the second type of acceleration unit has the right to access the second storage area.

[0145] Specifically, the access request issued by the first acceleration unit in the first type of acceleration unit includes a first physical address and the aforementioned first identifier, whereby the first identifier indicates the security level of the access request. The memory 150 determines whether to allow the first acceleration unit to access the corresponding storage area in the memory 150 based on the first physical address, based on whether the security level of the first acceleration unit indicated by the first identifier corresponds to the security level of the storage area where the first physical address is located: when the first identifier indicates that the first acceleration unit is a first type of acceleration unit and the first physical address is located in the first storage area, the first acceleration unit has the right to access the area indicated by the first physical address in the first storage area; when the first identifier indicates that the first acceleration unit is a first type of acceleration unit and the first physical address is not located in the first storage area, the request of the first acceleration unit to access the first storage area is restricted. Similarly, the access request issued by the second acceleration unit includes a second physical address and the aforementioned second identifier. The process by which the second acceleration unit accesses the memory 150 based on the second identifier and the second physical address corresponds to the access process of the first acceleration unit, and will not be described again here.

[0146] From a technical perspective, when accessing data using physical addresses, the system determines whether data access is allowed by judging whether the security level of the storage area where the physical address is located corresponds to the security level of the task being accessed. This ensures that the first type of task only accesses the first storage area during execution, and the second type of task only accesses the second storage area during execution, thereby achieving isolation of the access process when accessing data using physical addresses.

[0147] Please see Figure 5 , Figure 5 This is a schematic diagram of the structure of an AI accelerator provided in an embodiment of this application. Figure 5 As shown, the AI ​​accelerator 130 may include at least one GPU (GPU-1, ..., GPU-E) and / or at least one NPU (NPU-1, ..., NPU-F). GPU-1 includes at least one acceleration unit: acceleration unit 1, ..., acceleration unit a. GPU-E includes at least one acceleration unit: acceleration unit 1, ..., acceleration unit b. NPU-1 includes at least one acceleration unit: acceleration unit 1, ..., acceleration unit c. NPU-F includes at least one acceleration unit: acceleration unit 1, ..., acceleration unit d. Where E, F, a, b, c, and d are positive integers.

[0148] Each acceleration unit in the AI ​​accelerator 130 may include at least one arithmetic logic unit (ALU) and at least one storage unit. For example, Figure 5 Acceleration unit 1 in the GPU-E includes arithmetic logic units ALU-1, ..., ALU-j, and storage units 1, ..., h. It should be understood that the specific hardware composition of each acceleration unit in the AI ​​accelerator 130 can differ and can be adapted based on specific task requirements.

[0149] Optionally, the storage unit included in each acceleration unit of the AI ​​accelerator 130 described above is a readable and writable storage unit, such as a register, etc., and this application does not limit it.

[0150] Optionally, the N acceleration units include a third acceleration unit; when the third acceleration unit is configured from the first type of acceleration unit to the second type of acceleration unit, or from the second type of acceleration unit to the first type of acceleration unit, the data cached inside the third acceleration unit is cleared.

[0151] The aforementioned third acceleration unit can be any one of the acceleration units in the AI ​​accelerator 130.

[0152] Specifically, during the process of AI controller 122 receiving instructions from processor 110 to configure the security level of each acceleration unit in AI accelerator 130, if the security level of the third acceleration unit changes, that is, from the first type of acceleration unit to the second type of acceleration unit or from the second type of acceleration unit to the first type of acceleration unit, the cached data in the internal storage unit of the third acceleration unit is cleared to ensure data security.

[0153] Please see Figure 6 , Figure 6 This is a specific example of the task execution process of an AI acceleration device provided in an embodiment of this application. It should be understood that this example is merely an illustration of the execution process of the AI ​​acceleration device 100 and does not constitute a specific limitation.

[0154] like Figure 6 As shown, processor 110 runs two mutually isolated execution environments: Trusted Execution Environment (TEE) 111 and Rich Execution Environment (REE) 112. TEE 111 runs a Trusted Application (TA), and REE 112 runs a Client Application (CA). First, the user can set corresponding configuration information based on specific application scenarios (e.g., image processing, speech semantic processing, etc.) and send this configuration information to the AI ​​control device 120 via TEE. Based on this configuration information, the AI ​​control device 120 configures the acceleration units in the AI ​​accelerator 130 as secure acceleration units and insecure acceleration units (corresponding to the first type of acceleration unit and the second type of acceleration unit in the aforementioned embodiments, respectively), and configures the memory 150 as a secure storage area and an insecure storage area (corresponding to the first storage area and the second storage area in the aforementioned embodiments, respectively).

[0155] After receiving a specific AI acceleration task, the processor 110 in the AI ​​acceleration device decomposes the AI ​​acceleration task into two types of sub-tasks with different security levels in REE 112: secure tasks and insecure tasks. The insecure tasks are sent to the AI ​​control device 120 via CA 1121, and the AI ​​controller 122 in the AI ​​control device 120 maintains an insecure task queue (corresponding to the second task queue in the aforementioned embodiment) in the insecure storage area. Based on the order in this insecure task queue, the insecure tasks are sent to the insecure acceleration units in the AI ​​accelerator 130. Secure tasks are transmitted to TA 1111 under TEE 111 via CA 1121, and TA 1111 sends the secure tasks to the AI ​​control device 120. The AI ​​controller 122 maintains a secure task queue (corresponding to the first task queue in the aforementioned embodiment) in the secure storage area, and based on the order in this secure task queue, the secure tasks are sent to the secure acceleration units in the AI ​​accelerator 130.

[0156] Upon receiving a specific task, each acceleration unit in the AI ​​accelerator 130 begins to execute the corresponding task and accesses the memory 150 for data during task execution based on the rules described in the foregoing embodiments.

[0157] It should be understood that Figure 6 The specific process of task execution by the AI ​​acceleration device in the embodiments can be found in the foregoing embodiments, and will not be repeated here.

[0158] Please see Figure 7 , Figure 7 This is a schematic diagram of the structure of an AI control device provided in an embodiment of this application. It serves as a supplementary explanation of the structure of the AI ​​control device 120 in the foregoing embodiments.

[0159] like Figure 7 As shown, the AI ​​control device 120 includes an interface circuit 121 and an AI controller 122, wherein the AI ​​controller 122 includes a central processing unit 1221 and a storage unit 1222.

[0160] Optionally, the storage unit 1222 can be a readable and writable storage unit, such as a register, etc., and this application does not limit it in this way.

[0161] It should be understood that Figure 7 The AI ​​control device 120 shown is merely a feasible example and does not constitute a limitation on the number of central processing unit 1221 and storage unit 1222. That is, the AI ​​controller 122 may include at least one central processing unit 1221 and at least one storage unit 1222.

[0162] Optionally, the AI ​​control device 120 may also be a hardware circuit with the functions described in the foregoing embodiments, and this application is not limited thereto.

[0163] Please see Figures 8a-8b , Figures 8a-8b These are schematic diagrams illustrating the structures of two on-chip systems provided in embodiments of this application. Figure 8a As shown, the system-on-a-chip includes: a processor 810, an AI controller 820, an AI accelerator 830, a bus 840, and a bus 860. The processor 810 and the AI ​​controller 820 are connected via bus 860, and the AI ​​controller 820 and the AI ​​accelerator 830 are connected via bus 840. Bus 860 and bus 840 are two independent buses.

[0164] Figure 8b and Figure 8a The difference lies in the different connection methods between the modules. Figure 8b In the system-on-a-chip shown, the processor 810, AI controller 820, and AI accelerator 830 are connected via a single bus 840. In addition, Figure 8b The system-on-chip shown Figure 8a The task execution process of the on-chip system shown is the same.

[0165] Figure 8a and Figure 8b The system on the chip is used to perform, for example Figure 9 The AI ​​acceleration method is shown in the relevant feasible implementations.

[0166] Please see Figure 9 , Figure 9 This is a flowchart illustrating an AI acceleration method provided in an embodiment of this application. Figure 9 As shown, the method includes steps S910 and S920.

[0167] S910: The AI ​​controller configures the N acceleration units in the AI ​​accelerator as at least a first type of acceleration unit and a second type of acceleration unit, wherein the security level of the first type of acceleration unit is higher than that of the second type of acceleration unit, and N is a positive integer greater than or equal to 2.

[0168] S920: The AI ​​controller receives a first type of task issued by the processor in a first execution environment and distributes the first type of task to the first type of acceleration unit; and receives a second type of task issued by the processor in a second execution environment and distributes the second type of task to the second type of acceleration unit, wherein the security level of the first type of task is higher than the security level of the second type of task.

[0169] In one feasible implementation, configuring the N acceleration units in the AI ​​accelerator as at least a first type of acceleration unit and a second type of acceleration unit via the AI ​​controller includes: the AI ​​controller receiving a configuration instruction issued by the processor, the configuration instruction containing a security identifier and configuration information; and, based on the configuration information, configuring the N acceleration units as at least a first type of acceleration unit and a second type of acceleration unit, provided that the security identifier indicates that the configuration instruction was issued by the processor in the first execution environment.

[0170] In one feasible implementation, distributing the first type of task to the first type of acceleration unit includes: the AI ​​controller reading a first identifier carried by the first type of task, and distributing the first type of task to the first type of acceleration unit based on the first identifier; distributing the second type of task to the second type of acceleration unit includes: the AI ​​controller reading a second identifier carried by the second type of task, and distributing the second type of task to the second type of acceleration unit based on the second identifier; wherein, the first identifier is used to indicate the security level of the first type of task, and the second identifier is used to indicate the security level of the second type of task.

[0171] In one feasible implementation, the AI ​​controller, the processor, and the AI ​​accelerator are integrated in the same system-on-a-chip (SoC), with the AI ​​controller and the processor connected via a bus, and the AI ​​controller and the AI ​​accelerator connected via a bus.

[0172] In one feasible implementation, the step of receiving a first type of task issued by the processor in a first execution environment and distributing the first type of task to a first type of acceleration unit via the AI ​​controller, and receiving a second type of task issued by the processor in a second execution environment and distributing the second type of task to a second type of acceleration unit, includes: the AI ​​controller receiving the first type of task and the second type of task issued by the processor via the bus; and distributing the first type of task to the first type of acceleration unit and the second type of task to the second type of acceleration unit via the bus.

[0173] In one feasible implementation, the method further includes: configuring a first storage area and a second storage area in a memory by the AI ​​controller, wherein the first storage area is used to store computational data corresponding to the first type of task, and the second storage area is used to store computational data corresponding to the second type of task.

[0174] In one feasible implementation, the memory, the AI ​​controller, the processor, and the AI ​​accelerator are connected via a bus; or the memory, the AI ​​controller, and the processor are connected via a first bus, and the memory, the AI ​​controller, and the AI ​​accelerator are connected via a second bus.

[0175] In one feasible implementation, the first storage area includes a first task queue, and the second storage area includes a second task queue. The method further includes: the AI ​​controller storing the first type of tasks in the first task queue based on the reception time of the first type of tasks, and storing the second type of tasks in the second task queue based on the reception time of the second type of tasks; wherein, the first type of tasks with earlier reception times are ranked higher in the first task queue and are distributed to the first type of acceleration unit earlier, and the second type of tasks with earlier reception times are ranked higher in the second task queue and are distributed to the second type of acceleration unit earlier.

[0176] In one feasible implementation, the first type of task includes a first task, the second type of task includes a second task, the first task corresponds to a first virtual address, and the second task corresponds to a second virtual address; the first type of acceleration unit accesses data in the first storage area according to the first virtual address and the first page table; the second type of acceleration unit accesses data in the second storage area according to the second virtual address and the second page table.

[0177] In one feasible implementation, the first type of task includes a first task, the second type of task includes a second task, the first task corresponds to a first physical address, and the second task corresponds to a second physical address; when the first physical address is located in the first storage area, the first type of acceleration unit is allowed to access the first storage area; when the second physical address is located in the second storage area, the second type of acceleration unit is allowed to access the second storage area.

[0178] In one feasible implementation, the N acceleration units include a third acceleration unit; when the third acceleration unit is configured from the first type of acceleration unit to the second type of acceleration unit, or from the second type of acceleration unit to the first type of acceleration unit, the data cached inside the third acceleration unit is cleared.

[0179] In one feasible implementation, the first execution environment is a Trusted Execution Environment (TEE), and the second execution environment is a Rich Execution Environment (REE).

[0180] It should be understood that the specific process of the AI ​​acceleration method in the above method embodiments is the same as the process in the aforementioned device method embodiments, and will not be repeated here.

[0181] This application provides a computer device, characterized in that the computer device includes at least one processor and interface circuitry; the at least one processor is configured to invoke instructions stored in a memory to execute the above-described... Figure 9 The method described in any one of the embodiments.

[0182] This application provides a computer-readable storage medium storing a computer program, which, when executed, performs the above-mentioned... Figure 9 The method described in any one of the embodiments is implemented.

[0183] This application provides a computer program that includes instructions, which, when executed, [are executed as described above]. Figure 9 The method described in any one of the embodiments is implemented.

[0184] In the above embodiments, the descriptions of each embodiment have their own emphasis. Parts not described in detail in a particular embodiment can be found in the relevant descriptions of other embodiments. It should be noted that, for the sake of simplicity, the foregoing method embodiments are all described as a series of actions. However, those skilled in the art should understand that this application is not limited to the described order of actions, as some steps may be performed in other orders or simultaneously according to this application. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions and modules involved are not necessarily essential to this application.

[0185] In the several embodiments provided in this application, it should be understood that the disclosed apparatus can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of the units described above is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical or other forms.

[0186] The units described above as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0187] The above-described embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. An artificial intelligence (AI) control device, characterized in that, The AI ​​control device includes: an AI controller and an interface circuit; The AI ​​controller is configured to receive configuration instructions issued by the processor. The configuration instructions include a security identifier and configuration information. The security identifier is used to identify the security level of the configuration information in the configuration instructions. Under the condition that the security identifier indicates that the configuration instructions are issued by the processor in the first execution environment, the controller configures the N acceleration units in the AI ​​accelerator as at least a first type of acceleration unit and a second type of acceleration unit based on the configuration information. The security level of the first type of acceleration unit is higher than that of the second type of acceleration unit, and N is a positive integer greater than or equal to 2. The AI ​​controller is further configured to receive a first type of task issued by the processor in the first execution environment through the interface circuit, and distribute the first type of task to the first type of acceleration unit; and to receive a second type of task issued by the processor in the second execution environment, and distribute the second type of task to the second type of acceleration unit, wherein the security level of the first execution environment is higher than the security level of the second execution environment, and the security level of the first type of task is higher than the security level of the second type of task.

2. The AI ​​control device according to claim 1, characterized in that, The AI ​​controller is specifically used for: Read the first identifier carried by the first type of task, and distribute the first type of task to the first type of acceleration unit based on the first identifier; and Read the second identifier carried by the second type of task, and send the second type of task to the second type of acceleration unit based on the second identifier; Wherein, the first identifier is used to indicate the security level of the first type of task, and the second identifier is used to indicate the security level of the second type of task.

3. The AI ​​control device according to any one of claims 1-2, characterized in that, The AI ​​control device, the processor, and the AI ​​accelerator are integrated in the same system-on-a-chip (SoC). The AI ​​control device and the processor are connected via a bus, and the AI ​​control device and the AI ​​accelerator are also connected via a bus.

4. The AI ​​control device according to claim 3, characterized in that, The AI ​​controller is specifically used for: The first type of task and the second type of task issued by the processor are received through the bus; The first type of task is distributed to the first type of acceleration unit and the second type of task is distributed to the second type of acceleration unit via the bus.

5. The AI ​​control device according to claim 1, characterized in that, The AI ​​controller is also used for: A first storage area and a second storage area are configured in the memory, wherein the first storage area is used to store the computation data corresponding to the first type of task, and the second storage area is used to store the computation data corresponding to the second type of task.

6. The AI ​​control device according to claim 5, characterized in that, The AI ​​control device, the memory, the AI ​​accelerator, and the processor are integrated into the same system-on-a-chip (SoC). The memory, the AI ​​control device, the processor, and the AI ​​accelerator are connected via a bus; or the memory, the AI ​​control device, and the processor are connected via a first bus, and the memory, the AI ​​control device, and the AI ​​accelerator are connected via a second bus.

7. The AI ​​control device according to claim 5 or 6, characterized in that, The first storage area includes a first task queue, the second storage area includes a second task queue, and the AI ​​controller is further configured to: The first type of task is stored in the first task queue based on the reception time of the first type of task, and the second type of task is stored in the second task queue based on the reception time of the second type of task; The earlier the first type of task is received, the higher its ranking in the first task queue and the earlier it is distributed to the first type of acceleration unit. Similarly, the earlier the second type of task is received, the higher its ranking in the second task queue and the earlier it is distributed to the second type of acceleration unit.

8. The AI ​​control device according to any one of claims 5-6, characterized in that, The first type of task includes a first task, and the second type of task includes a second task. The first task corresponds to a first virtual address, and the second task corresponds to a second virtual address. The first type of acceleration unit is used to access data in the first storage area according to the first virtual address and the first page table; The second type of acceleration unit is used to access data in the second storage area based on the second virtual address and the second page table.

9. The AI ​​control device according to any one of claims 5-6, characterized in that, The first type of task includes a first task, and the second type of task includes a second task. The first task corresponds to a first physical address, and the second task corresponds to a second physical address. When the first physical address is located in the first storage area, the first type of acceleration unit has the right to access the first storage area; When the second physical address is located in the second storage area, the second type of acceleration unit has the right to access the second storage area.

10. The AI ​​control device according to claim 1, 2, or 5, characterized in that, The N acceleration units include a third acceleration unit; When the third acceleration unit is configured from the first type of acceleration unit to the second type of acceleration unit, or from the second type of acceleration unit to the first type of acceleration unit, the data cached inside the third acceleration unit is cleared.

11. The AI ​​control device according to claim 1, 2, or 5, characterized in that, The first execution environment is a Trusted Execution Environment (TEE), and the second execution environment is a Rich Execution Environment (REE).

12. A system-on-a-chip, characterized in that, The system-on-a-chip includes a processor, an AI controller, and an AI accelerator; The AI ​​controller is used to receive configuration instructions issued by the processor. The configuration instructions include a security identifier and configuration information. The security identifier is used to identify the security level of the configuration information in the configuration instructions. Under the condition that the security identifier indicates that the configuration instruction is issued by the processor in the first execution environment, based on the configuration information, the N acceleration units in the AI ​​accelerator are configured as at least the first type of acceleration unit and the second type of acceleration unit, where the security level of the first type of acceleration unit is higher than that of the second type of acceleration unit, and N is a positive integer greater than or equal to 2. The AI ​​controller is further configured to receive a first type of task issued by the processor in a first execution environment and distribute the first type of task to the first type of acceleration unit; and to receive a second type of task issued by the processor in a second execution environment and distribute the second type of task to the second type of acceleration unit, wherein the security level of the first execution environment is higher than the security level of the second execution environment, and the security level of the first type of task is higher than the security level of the second type of task.

13. The system-on-a-chip according to claim 12, characterized in that, The system-on-chip also includes a memory; the AI ​​controller is further configured to: A first storage area and a second storage area are configured in the memory, wherein the first storage area is used to store the computation data corresponding to the first type of task, and the second storage area is used to store the computation data corresponding to the second type of task.

14. The system-on-a-chip according to claim 13, characterized in that, The first type of task includes a first task, and the second type of task includes a second task. The first task corresponds to a first virtual address, and the second task corresponds to a second virtual address. The first type of acceleration unit is used to access data in the first storage area according to the first virtual address and the first page table; The second type of acceleration unit is used to access data in the second storage area based on the second virtual address and the second page table.

15. The system-on-a-chip according to claim 13, characterized in that, The first type of task includes a first task, and the second type of task includes a second task. The first task corresponds to a first physical address, and the second task corresponds to a second physical address. When the first physical address is located in the first storage area, the first type of acceleration unit has the right to access the first storage area; When the second physical address is located in the second storage area, the second type of acceleration unit has the right to access the second storage area.

16. An artificial intelligence (AI) acceleration method, characterized in that, The method includes: The AI ​​controller receives configuration instructions from the processor, which include a security identifier and configuration information. The security identifier is used to identify the security level of the configuration information in the configuration instructions. Under the condition that the security identifier indicates that the configuration instructions are issued by the processor in the first execution environment, the N acceleration units in the AI ​​accelerator are configured as at least a first type of acceleration unit and a second type of acceleration unit based on the configuration information. The security level of the first type of acceleration unit is higher than that of the second type of acceleration unit, and N is a positive integer greater than or equal to 2. The AI ​​controller receives a first type of task issued by the processor in a first execution environment and distributes the first type of task to the first type of acceleration unit; and receives a second type of task issued by the processor in a second execution environment and distributes the second type of task to the second type of acceleration unit, wherein the security level of the first execution environment is higher than the security level of the second execution environment, and the security level of the first type of task is higher than the security level of the second type of task.

17. The method according to claim 16, characterized in that, The step of distributing the first type of task to the first type of acceleration unit includes: the AI ​​controller reading the first identifier carried by the first type of task, and distributing the first type of task to the first type of acceleration unit based on the first identifier; The step of distributing the second type of task to the second type of acceleration unit includes: the AI ​​controller reading the second identifier carried by the second type of task, and distributing the second type of task to the second type of acceleration unit based on the second identifier; Wherein, the first identifier is used to indicate the security level of the first type of task, and the second identifier is used to indicate the security level of the second type of task.

18. The method according to any one of claims 16-17, characterized in that, The AI ​​controller, the processor, and the AI ​​accelerator are integrated in the same system-on-a-chip (SoC). The AI ​​controller and the processor are connected via a bus, and the AI ​​controller and the AI ​​accelerator are also connected via a bus.

19. The method according to claim 18, characterized in that, The AI ​​controller receives a first type of task issued by the processor in a first execution environment and distributes the first type of task to the first type of acceleration unit. And receiving a second type of task issued by the processor in the second execution environment, and distributing the second type of task to the second type of acceleration unit, including: The AI ​​controller receives the first type of task and the second type of task issued by the processor via the bus; as well as The first type of task is distributed to the first type of acceleration unit and the second type of task is distributed to the second type of acceleration unit via the bus.

20. The method according to claim 16, characterized in that, The method further includes: The AI ​​controller configures a first storage area and a second storage area in the memory, wherein the first storage area is used to store the computational data corresponding to the first type of task, and the second storage area is used to store the computational data corresponding to the second type of task.

21. The method according to claim 20, characterized in that, The AI ​​controller, the memory, the AI ​​accelerator, and the processor are integrated into the same system-on-a-chip (SoC). The memory, the AI ​​controller, the processor, and the AI ​​accelerator are connected via a bus; or the memory, the AI ​​controller, and the processor are connected via a first bus, and the memory, the AI ​​controller, and the AI ​​accelerator are connected via a second bus.

22. The method according to claim 20 or 21, characterized in that, The first storage area includes a first task queue, the second storage area includes a second task queue, and the method further includes: The AI ​​controller stores the first type of tasks in the first task queue based on the reception time of the first type of tasks, and stores the second type of tasks in the second task queue based on the reception time of the second type of tasks; The earlier the first type of task is received, the higher its ranking in the first task queue and the earlier it is distributed to the first type of acceleration unit. Similarly, the earlier the second type of task is received, the higher its ranking in the second task queue and the earlier it is distributed to the second type of acceleration unit.

23. The method according to any one of claims 20-21, characterized in that, The first type of task includes a first task, and the second type of task includes a second task. The first task corresponds to a first virtual address, and the second task corresponds to a second virtual address. The first type of acceleration unit accesses the first storage area based on the first virtual address and the first page table; The second type of acceleration unit accesses the second storage area based on the second virtual address and the second page table.

24. The method according to any one of claims 20-21, characterized in that, The first type of task includes a first task, and the second type of task includes a second task. The first task corresponds to a first physical address, and the second task corresponds to a second physical address. When the first physical address is located in the first storage region, the first type of acceleration unit is allowed to access the first storage region; When the second physical address is located in the second storage area, the second type of acceleration unit is allowed to access the second storage area.

25. The method according to claim 16, 17 or 20, characterized in that, The N acceleration units include a third acceleration unit; When the third acceleration unit is configured from the first type of acceleration unit to the second type of acceleration unit, or from the second type of acceleration unit to the first type of acceleration unit, the data cached inside the third acceleration unit is cleared.

26. The method according to claim 16, 17 or 20, characterized in that, The first execution environment is a Trusted Execution Environment (TEE), and the second execution environment is a Rich Execution Environment (REE).

27. A computer device, characterized in that, The computer device includes at least one processor and interface circuitry; the at least one processor is configured to invoke instructions stored in memory to execute the method according to any one of claims 16-26.

28. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed, enables the implementation of the method according to any one of claims 16-26.

29. A computer program product, characterized in that, The computer program product includes instructions that, when executed, enable the method described in any one of claims 16-26.

Images