System and method for secure switching of ai models in embedded multi-core processors

Abstract

The application discloses a kind of safety switching system and method of AI model in embedded multicore processor, belong to embedded system field.The method includes: in non-blocking mode, the inference result notification in the task notification queue of first processor core is consumed;Inference function pointer and model context pointer are set to NULL;With preset interval time polling busy flag and setting bounded timeout time, it is judged whether busy flag is changed from true to false within bounded timeout time, if yes, then directly release old model memory and load new model, if not, then forcibly terminate inference task, and rebuild inference task with the same parameters, then clear busy flag, release old model memory and load new model.The application realizes safely blocking new inference task submission, waiting or forcibly terminating current inference, and releasing old model memory under the premise of not depending on inference core cooperation, lock-free and within bounded time.

Description

Technical Field

[0001] This invention relates to the field of embedded systems, and more particularly to a secure switching system and method for AI models in an embedded multi-core processor. Background Technology

[0002] In a typical deployment architecture for running AI inference models on embedded multi-core processors (such as dual-core MCUs like the ESP32-P4), the first processor core is responsible for image acquisition, user interface, and model management (loading / unloading), while the second processor core is dedicated to forward inference of the AI ​​model. The first processor core sends inference requests to the second processor core's inference task via the FreeRTOS task notification API (xTaskNotifyGive); after inference is complete, the second processor core notifies the first processor core to retrieve the results using the same mechanism. When the system needs to switch AI models at runtime (e.g., from a target object confirmation model to a defect classification model), the first processor core must release the memory occupied by the old model (usually the model weights and tensor buffers in PSRAM) and then load the new model. If the second tensor buffer core is currently using the old model for inference, the release operation will cause a use-after-free crash.

[0003] The existing technologies mainly include the following solutions: 1. This approach adopts the FreeRTOS community's "graceful exit" paradigm, sending an exit signal to the target task via xTaskNotify(handle, STOP_BIT). The target task checks the exit flag within a loop; if it's set, it exits the loop and then calls vTaskDelete(NULL) to self-destruct. The management side waits for the target task to exit before releasing resources. The security of this approach relies entirely on the cooperation of the managed task—the target task must actively check the exit flag and reach the checkpoint normally. If the target task gets stuck in an infinite loop, deadlocks, or is in an uncontrollable state, the management side will wait indefinitely. Furthermore, within the time window from sending the stop signal to the task's actual exit, new work requests can still be submitted to the task queue, creating a race condition window where "a stop signal has been sent, but new tasks are still entering."

[0004] 2. CN103257864A discloses an embedded software task scheduling method. It searches for tasks to be deleted in the waiting task queue and sets their corresponding task function pointers to null. The waiting time is refreshed periodically; when the waiting time reaches zero, the task is submitted to the activation queue. In the activation queue, the function pointer is checked for nullability; if not null, it is executed (if null, it is skipped). This scheme sets the function pointer to null after the task has been added to the waiting queue, representing a post-event soft deletion on the consumer / activation side, rather than creating an entry control at the task submission point (pre-event blocking on the producer side). This scheme does not involve dual-core architecture, timing windows for asynchronous release of shared memory across cores, AI model inference scenarios, busy flag polling, timeout forced termination, or task reconstruction.

[0005] 3. A time-triggered cooperative scheduler is used to disable tasks. The function pointer field of the target task in the task table is set to 0x0000 to disable the task. The dispatcher checks if the function pointer is not null before execution. This scheme is a single-core cooperative scheduling, with no concurrency or cross-core race conditions. Setting it to null is to disable the task table entry, not to block new requests on the submission side.

[0006] 4. US20230252328A1 discloses an inference model scheduling method based on preemptible boundaries. When a model switch is required, the processor checks whether the current inference has reached the preemptible boundary (usually the inter-layer boundary of a neural network); introduces a "breathing time" to determine whether to force preemption; and pauses the old model and activates the new model at the safe boundary. This scheme is a cooperative preemption, which assumes that the model exists and will reach the preemptible boundary, and relies on the cooperation of the model architecture. If the model inference gets stuck in a long computation within a single layer, an infinite loop, or the fusion operator cannot be interrupted, the scheme fails. It does not involve submission-side function pointer gating, nor does it involve timeout-based forced termination and reconstruction.

[0007] 5. US8327383B2 discloses a framework for canceling concurrent worker objects. In a multi-threaded environment, when canceling a callback, the callback entry is first removed from the lock-free sparse array to make it unusable, and then the process spins to wait for the currently executing callback to complete before releasing resources. This solution targets lock-free array operations for specific callback entries, rather than using a single pointer to nullify and block all new submissions; it is designed for general multi-threaded runtime environments, not embedded dual-core AI scenarios; its waiting is an unbounded spin, without timeout-based forced termination or task reconstruction.

[0008] 6. The RCU / QSBR lock-free delayed reclamation paradigm is adopted. Readers need to actively report their silent state (depending on the cooperation of the managed party); the waiting grace period is unbounded. If a reader does not enter the silent state for a long time, the infinite delay will be reclaimed; there is no submission-side function pointer gating, and there is no fallback of forced termination and reconstruction of the user after timeout.

[0009] 7. US12039170B2 discloses a hardware revocation engine for sequential memory safety, which marks dangling pointers to freed memory regions as invalid (hardware tag bit is cleared) through a dedicated hardware revocation pipeline. This requires a dedicated CPU with CHERI instruction set support and cannot be deployed on general-purpose MCUs.

[0010] 8. Adopting SEI CERT C MEM01-C / MISRA C:2012 Rule 18.6, immediately set the pointer to NULL after free() to prevent use-after-free and double-free caused by dangling pointers. This approach is for single-threaded memory hygiene (avoid dereferencing the pointer after freeing it) and is a defensive coding common sense. It is not a basic requirement for cross-core task submissions, nor does it constitute a cross-core cooperative release protocol. Summary of the Invention

[0011] The technical problem to be solved by this invention is: This invention provides a safe switching system and method for AI models in an embedded multi-core processor. When the first processor core (management core) needs to release the AI ​​model memory currently being used by the second processor core (inference core) and load a new model, it can safely block the submission of new inference tasks, wait for or forcibly terminate the current inference, and release the old model memory without relying on the cooperation of the second processor core, without locking, and within bounded time, thereby fundamentally eliminating use-after-free crashes caused by asynchronous model unloading.

[0012] The technical solution adopted by this invention to solve its technical problem is: On one hand, this invention provides a method for securely switching AI models in an embedded multi-core processor, comprising: S1. Consume the pending inference result notifications in the task notification queue of the first processor core in a non-blocking manner; S2. Set the inference function pointer and model context pointer to NULL to disable submission-side access control; S3. Poll the busy flag at a preset interval and set a bounded timeout period. Determine whether the busy flag changes from true to false within the bounded timeout period. If yes, proceed to step S5; otherwise, proceed to step S4. S4. Forcefully terminate the inference task of the second processor core, rebuild the inference task with the same parameters, and then clear the busy flag; S5. Release the memory of the old model and load the new model.

[0013] Furthermore, step S2 also includes: After the second processor core is woken up, it checks whether the inference function pointer and the image buffer are both valid. If not, it discards the wake-up and returns to the blocked waiting state; if so, it executes the forward inference of the AI ​​model, copies the inference result to the result isolation buffer, and notifies the first processor core to take the inference result.

[0014] Furthermore, the busy flag is limited by volatile, and is exclusively written by the inference task of the second processor core and exclusively read by the model management module of the first processor core.

[0015] Furthermore, the inference function pointer and model context pointer are exclusively written by the first processor core and read by the second processor core when the inference task is woken up.

[0016] Furthermore, step S4 includes: The inference task on the second processor core is forcibly terminated via vTaskDelete, and then rebuilt with the same parameters via xTaskCreatePinnedToCore.

[0017] Furthermore, the preset interval is 5ms, and the bounded timeout is 30s.

[0018] On the other hand, the present invention provides a secure switching system, including a first processor core, a second processor core and a PSRAM memory; The PSRAM memory includes an image buffer, inference function pointers, model context pointers, and a busy flag; The first processor core is used to send inference requests to the second processor core, and before sending the request, it checks whether the inference function pointer and the image buffer are both valid to block new tasks from entering from the production side, and consumes the pending inference result notifications in the task notification queue in a non-blocking manner when performing AI model switching, and sets the inference function pointer and the model context pointer to NULL to close the submission side access control, and then polls the busy flag and sets a bounded timeout. The second processor core is used to re-examine the inference function pointer and image buffer after receiving an inference request and being woken up.

[0019] Furthermore, the PSRAM memory also includes a result isolation buffer and an AI model memory area, wherein the result isolation buffer is used to store inference results.

[0020] Furthermore, the first processor core includes an inference submission module and a model management module; The inference submission module is used to send an inference request to the second processor core, and checks whether the inference function pointer and the image buffer are both valid before sending the request; The model management module is used to consume the inference result notifications to be processed in the task notification queue in a non-blocking manner when performing AI model switching, and to close the submission-side access control through the inference function pointer and model context pointer, and then poll the busy flag and set a bounded timeout.

[0021] Furthermore, the second processor core includes a task inference module and an AI inference engine; The AI ​​inference engine is used to perform task inference based on the inference request from the first processor core; The task inference module is used to check whether the inference function pointer and image buffer are valid after receiving an inference request and being woken up. If not, it discards the wake-up and returns to the blocked waiting state. If yes, it executes the forward inference of the AI ​​model, copies the inference result to the result isolation buffer, and notifies the first processor core to take the inference result.

[0022] The beneficial effects of this invention are: 1. By setting the inference function pointer to null, `infer_core_submit()` is rejected due to the invalid pointer before the inter-core notification API is called. This gating mechanism does not require the inference core to check flags, reach a safe point, or even be in a normal state. Even if the second processor core still holds the old function pointer (in the stack frame of its current inference call), a new submission is impossible. Unlike FreeRTOS's graceful exit (which relies on the target task checking exit flags), model preemption (which relies on the model reaching preemptible boundaries), and RCU (which relies on readers reporting quiescent states), this scheme's security guarantee is obtained unilaterally by the management core, achieving submission-side admission blocking that does not rely on the cooperation of the inference core.

[0023] 2. After the inference function pointer is set to null, if (!s_fn) return false in infer_core_submit() makes all subsequent submissions invalid after a single pointer assignment operation, eliminating the race window of "stop signal has been issued but new tasks are still entering".

[0024] 3. Replacing unbounded waiting with "bounded timeout polling + forced termination and reconstruction" ensures that the system can be forcibly restored within a bounded time even if the inference kernel falls into any uninterruptible state. The three-pronged design of gating, single-writer locklessness, and forced reconstruction overcomes the insecurity issue of potential forced interruption during lock holding.

[0025] 4. It ensures the consistency of shared state between cores in a lock-free manner, eliminating the competition among multiple writers. The entire secure handover protocol does not introduce mutexes or semaphores, fundamentally eliminating the possibility of deadlock.

[0026] 5. The core mechanism of this invention only requires FreeRTOS's task notification API (xTaskNotifyGive / ulTaskNotifyTake), task management API (vTaskDelay / vTaskDelete / xTaskCreatePinnedToCore), C language function pointers, and volatile qualifiers, and can be implemented on any commercial embedded multi-core processor running FreeRTOS. Attached Figure Description

[0027] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0028] Figure 1 This is a schematic diagram of the secure switching system for AI models in an embedded multi-core processor according to the present invention. Figure 2 This is a flowchart of the secure switching method for AI models in an embedded multi-core processor according to the present invention. Detailed Implementation

[0029] The present invention will now be described in further detail with reference to the accompanying drawings. These drawings are simplified schematic diagrams, illustrating only the basic structure of the invention, and therefore only show the components relevant to the invention.

[0030] Example 1: like Figure 1 As shown, this embodiment provides a secure switching system for AI models in an embedded multi-core processor, including a first processor core, a second processor core, and a PSRAM memory.

[0031] The PSRAM memory includes an image buffer (s_rgb), an inference function pointer (s_fn), a model context pointer (s_ctx), a busy flag (s_busy), a result isolation buffer (s_result_boxes), and an AI model memory area. The image buffer (s_rgb) stores frame data from the upstream image acquisition module (written via memcpy), the inference function pointer (s_fn) points to the current model's inference entry function, the model context pointer (s_ctx) points to the current detector object, the result isolation buffer stores inference results, and the AI ​​model memory area contains model weights and tensors. The data in the PSRAM memory is shared by the first and second processor cores. The busy flag (s_busy) is volatile to implement cross-core status publishing. It is exclusively written by the inference task of the second processor core (set to true before inference and false after inference), and exclusively read (polled) by the model management module of the first processor core. It provides the model management module with the sole true source of "whether inference is being executed," and volatile ensures that each read is taken from memory (PSRAM) rather than the register cache. The inference function pointer s_fn and the model context pointer s_ctx are exclusively written by the first processor core, and read only by the second processor core when the inference task is woken up. Therefore, there is no contention among multiple writers for the busy flag s_busy, the inference function pointer s_fn, and the model context pointer s_ctx. The entire safe switching protocol does not introduce mutexes or semaphores, fundamentally eliminating the possibility of deadlock and avoiding circular waits.

[0032] The first processor core includes an inference submission module and a model management module. The inference submission module serves as the unified entry point for inference requests, sending them to the second processor core. Before calling `xTaskNotifyGive` to send the request, it checks if the inference function pointer `s_fn` and the image buffer `s_rgb` are both valid. If either is NULL, it returns false directly and does not send the inference request, thus blocking new tasks from entering at the source on the producer side. The model management module executes the AI ​​model safe switching protocol: first, it consumes the pending result notifications (inference result notifications sent by the second processor core but not yet retrieved by the first processor core) in the first processor core's own task notification queue in a non-blocking manner; then, it sets the inference function pointer `s_fn` and the model context pointer `s_ctx` to NULL to disable entry control on the submission side; then, it polls the busy flag `s_busy` at 5ms intervals, waiting for the current inference task of the second processor core to complete naturally within a bounded timeout period (preferably 30s). If a timeout occurs, it forcibly terminates the inference task using `vTaskDelete`, reconstructs the inference task with the same parameters `xTaskCreatePinnedToCore`, and clears the busy flag. The aforementioned model management module and the inference task of the second processor core form a one-way "wait-confirm" relationship through the busy flag s_busy. The management core (first processor core) only needs to passively observe the value of the busy flag and does not need any active cooperation from the inference task.

[0033] The second processor core includes a task inference module and an AI inference engine. The AI ​​inference engine is used to perform task inference based on the inference request from the first processor core. The task inference module waits for the inference request from the first processor core by blocking through ulTaskNotifyTake. Specifically, after being woken up by the inference request, it first defensively checks whether the inference function pointer s_fn and the image buffer s_rgb are both valid. If either is set to null, the wake-up is discarded and the system returns to the blocked waiting state to prevent the inference of the revoked model from being executed after the submission-side gating takes effect. If both are valid, the check passes, the busy flag s_busy is set to true, the forward inference of the AI ​​model is executed, and the inference result is copied to the result isolation buffer s_result_boxes via memcpy. Then, the first processor core is notified to retrieve the inference result via xTaskNotifyGive, and finally the busy flag s_busy is set to false. The above scheme communicates bidirectionally and asynchronously with the inference submission module (submission → inference) and the polling module (inference → result) through a task notification mechanism. It publishes its own running status to the model management module unidirectionally through a busy flag and accesses the AI ​​model memory area through the inference function pointer s_fn and the model context pointer s_ctx.

[0034] Example 2: like Figure 2 As shown, this embodiment provides a secure switching method for AI models in embedded multi-core processors. It implements a complete five-step tightly coupled protocol: "emptying result notification → submission-side gating to block new tasks → bounded timeout polling of busy flags → forced termination and reconstruction after timeout → secure release." This differs from the consumer-side post-deletion, unbounded waiting, and reliance on the managed party's cooperation paradigm found in all existing technologies. Specifically, it includes the following steps: S1. In a non-blocking manner, ulTaskNotifyTake(pdTRUE, 0) is called repeatedly to consume the pending inference result notifications (inference result notifications sent by the second processor core but not yet retrieved by the first processor core) in the task notification queue of the first processor core. This step clears the backlog of old result notifications to prevent results associated with the old model that is about to be released from being mixed into the subsequent process, ensuring that it is not interfered with by old results.

[0035] S2. Set both the inference function pointer s_fn and the model context pointer s_ctx to NULL to disable submission-side access control. Submission-side access control conditions are... Equation (1) indicates that inference submission can only succeed when both the inference function pointer and the image buffer are valid. When the model management module sets s_fn to NULL, it evaluates to false before calling the inter-core notification API, and rejects the submission without any cooperation from the second processor core.

[0036] After this, any call to `infer_core_submit()` (the inference submission module) will return false before `xTaskNotifyGive` (send inference request) is called due to `!s_fn` (invalid inference function pointer). This invalidates all subsequent submissions after a single pointer assignment operation, preventing new tasks from entering the system. This atomically blocks submissions from the producer side, eliminating the race condition window where a stop signal has been issued but new tasks are still entering. This gating mechanism does not require the inference core to check flags, reach a safe point, or even be in a normal state. Even if the second processor core still holds the old function pointer (in the stack frame of its current inference call), new submissions are impossible. The security guarantee of this scheme is obtained unilaterally by the management core and does not depend on the cooperation of the inference core.

[0037] In other embodiments, when the second processor core is woken up, a defensive check is performed to verify whether the inference function pointer s_fn and the image buffer s_rgb are both valid. If not, the wake-up is discarded and the system returns to a blocked waiting state. If so, the forward inference of the AI ​​model is executed, and the inference result is copied to the result isolation buffer, notifying the first processor core to retrieve the inference result. In the above scheme, even if the task inference module of the second processor core receives an inference request during step S1 (the last request enqueued before the inference function pointer is set to null), the inference task of the revoked model will not be executed through the check operation of the second processor core, forming a cross-core bidirectional security check of "submission-side blocking + inference-side check".

[0038] S3. Poll the busy flag s_busy at preset intervals (e.g., 5ms) and set a bounded timeout (e.g., 30s). Set the busy flag s_busy to true before executing the inference task and set it to false after inference is completed. Determine whether the busy flag s_busy changes from true to false within the bounded timeout. If yes, it means that the current inference task has been completed naturally, and jump to step S5 to directly enter the model release stage; if no, it means that the inference task may be in an abnormal state (infinite loop, infinite waiting for peripherals or fusion operators), and in this case, jump to step S4 to perform the bounded timeout fallback operation.

[0039] For example, a bounded timeout recovery constraint is represented as This indicates that the busy flag is continuously set to true and the accumulated waiting time reaches the threshold. When this occurs, a forced termination and reconstruction are triggered to ensure the system's availability boundaries.

[0040] S4. The inference task of the second processor core is forcibly terminated using vTaskDelete(s_core1_task), and the inference task is rebuilt with the same parameters using xTaskCreatePinnedToCore(infer_task, "infer", 16384, NULL, 1,&s_core1_task,1), and then the busy flag is manually cleared. This fallback mechanism is a bounded mechanism, replacing unbounded waiting with "bounded timeout polling + forced termination and reconstruction," ensuring that the system can recover availability within a bounded time under any abnormal situation. Under the existing RCU paradigm, forced termination is considered unsafe (it may be interrupted during lock holding). This embodiment overcomes this obstacle through a three-in-one design of gating + single-writer locklessness + forced reconstruction.

[0041] S5. Release the old model memory and load the new model. After confirming that the busy flag has been cleared, the first processor core can safely execute the release of the old model memory (delete model, delete preprocessor) and the loading of the new model (new model, new preprocessor). At this point, the second processor core has determined that it will no longer touch the old model memory area, and the use-after-free risk is completely eliminated.

[0042] The safe release condition for the old model memory is This indicates that the three prerequisites for releasing the old model memory are: the submission gating is in effect (new tasks cannot enter), the second processor core is not currently performing inference (busy flag B = false), and the result notification issued by the second processor core and not yet retrieved by the first processor core has been consumed. When all three conditions are met, the second processor core is certain that it will not access the old model memory in any way.

[0043] It should be noted that the busy flag s_busy is volatile, meaning it is exclusively written to by the second processor core and exclusively read from by the first processor core. This single-writer mode ensures no contention among multiple writers, and volatile guarantees that each read is retrieved from main memory (PSRAM) rather than the register cache. s_fn / s_ctx are exclusively written to by the first processor core, and the second core only reads them once after being notified to wake up (if (!s_fn || !s_rgb) continue;). By this time, the first processor core has already completed the write operation, and the serialization of S1 emptying → S2 setting ensures that the write-first behavior occurs before the read behavior.

[0044] As shown in Tables 1 and 2, these are preferred embodiments for the system status symbol description and key technical parameters, respectively.

[0045] Table 1

[0046] Table 2

[0047] The following is the specific implementable pseudocode for this embodiment. Based on the actual working code, it has been simplified by removing log output and statistical counting, while retaining the core logic of the protocol:

[0048]

[0049]

[0050] In this embodiment, the submission-side gate control setting, bounded timeout forced reconstruction, and single-writer lock-free state determination are functionally mutually supportive and indispensable: the gate control ensures that no new task will immediately enter during forced reconstruction (avoiding race conditions during reconstruction); the forced reconstruction ensures that existing inference will inevitably terminate after the gate is closed (avoiding infinite waiting); and the single-writer lock-free state determination ensures that there are no deadlock paths between gated writing and state reading. These three elements work together to achieve the safe release of the old model within a bounded timeframe under any circumstances, without relying on the cooperation of a second processor core.

[0051] For example, in an offline PCB defect detection device based on a dual-core embedded processor, multiple AI detection models need to be run sequentially (e.g., PCB board type classification model → IC chip missing detection model → SMD surface mount component missing detection model → solder bridge detection model) to inspect the same frame or consecutive frames of images. The system configuration includes a processor (dual-core FreeRTOS MCU (ESP32-P4): first processor core and second processor core), memory (32MB PSRAM: shared by model weights + image buffer + runtime tensors + inference result isolation buffer), AI models (4 quantized neural network models, total weight approximately 1.7MB, input resolution 224×224, INT8 quantization), and image acquisition (USB camera, 640×480 RGB, approximately 500 ms / frame submission). The inspection process is as follows: User-triggered inspection: The first processor core calls infer_core_stop() to execute the safe switching protocol, and then loads the first detection model; Perform inference on the current frame: call infer_core_submit() → Core1 inference → Core1 result memcpy to the isolation buffer → Core0 reads and displays the result; Call infer_core_stop() → release the old model → load the next model... and so on to complete all stages; The inspection is complete, and the statistical results are displayed.

[0052] In the above PCB defect detection, the model switching process had zero use-after-free crashes: the infer_core_stop() protocol ensured that the inference core was no longer accessed when the old model's memory was released; the peak memory usage was reduced by about 75%, and only one model resided in PSRAM (about 0.5MB) at any given time, instead of all four models being loaded simultaneously (about 1.7MB + runtime tensors); the entire inspection process was controlled within 2 seconds (including 4 model switches + inference frames at each stage); the average switching protocol time was about 35 ms (the most common case where inference has been completed), and the worst case was a bounded 30 seconds (forced termination due to timeout).

[0053] Based on the above-described preferred embodiments of the present invention, and through the foregoing description, those skilled in the art can make various changes and modifications without departing from the inventive concept. The technical scope of this invention is not limited to the contents of the specification, but must be determined according to the scope of the claims.

Claims

1. A method for securely switching AI models in an embedded multi-core processor, characterized in that, include: S1. Consume the pending inference result notifications in the task notification queue of the first processor core in a non-blocking manner; S2. Set the inference function pointer and model context pointer to NULL to disable submission-side access control; S3. Poll the busy flag at a preset interval and set a bounded timeout period. Determine whether the busy flag changes from true to false within the bounded timeout period. If yes, proceed to step S5; otherwise, proceed to step S4. S4. Forcefully terminate the inference task of the second processor core, rebuild the inference task with the same parameters, and then clear the busy flag; S5. Release the memory of the old model and load the new model.

2. The secure switching method for AI models in an embedded multi-core processor according to claim 1, characterized in that, Step S2 further includes: After the second processor core is woken up, it checks whether the inference function pointer and the image buffer are both valid. If not, it discards the wake-up and returns to the blocked waiting state; if so, it executes the forward inference of the AI ​​model, copies the inference result to the result isolation buffer, and notifies the first processor core to take the inference result.

3. The secure switching method for AI models in an embedded multi-core processor according to claim 1, characterized in that, The busy flag is volatile and is exclusively written by the inference task of the second processor core and exclusively read by the model management module of the first processor core.

4. The secure switching method for AI models in an embedded multi-core processor according to claim 1, characterized in that, The inference function pointer and model context pointer are exclusively written by the first processor core and read by the second processor core when the inference task is woken up.

5. The secure switching method for AI models in an embedded multi-core processor according to claim 1, characterized in that, Step S4 includes: The inference task on the second processor core is forcibly terminated via vTaskDelete, and then rebuilt with the same parameters via xTaskCreatePinnedToCore.

6. The secure switching method for AI models in an embedded multi-core processor according to claim 1, characterized in that, The preset interval is 5ms, and the bounded timeout is 30s.

7. A secure switching system that applies the secure switching method for AI models in an embedded multi-core processor as described in any one of claims 1 to 6, characterized in that, Includes a first processor core, a second processor core, and PSRAM memory; The PSRAM memory includes an image buffer, inference function pointers, model context pointers, and a busy flag; The first processor core is used to send inference requests to the second processor core, and before sending the request, it checks whether the inference function pointer and the image buffer are both valid to block new tasks from entering from the production side, and consumes the pending inference result notifications in the task notification queue in a non-blocking manner when performing AI model switching, and sets the inference function pointer and the model context pointer to NULL to close the submission side access control, and then polls the busy flag and sets a bounded timeout. The second processor core is used to re-examine the inference function pointer and image buffer after receiving an inference request and being woken up.

8. The secure switching system according to claim 7, characterized in that, The PSRAM memory also includes a result isolation buffer and an AI model memory area, wherein the result isolation buffer is used to store inference results.

9. The secure switching system according to claim 7, characterized in that, The first processor core includes an inference submission module and a model management module; The inference submission module is used to send an inference request to the second processor core, and checks whether the inference function pointer and the image buffer are both valid before sending the request; The model management module is used to consume the inference result notifications to be processed in the task notification queue in a non-blocking manner when performing AI model switching, and to close the submission-side access control through the inference function pointer and model context pointer, and then poll the busy flag and set a bounded timeout.

10. The secure switching system according to claim 8, characterized in that, The second processor core includes a task inference module and an AI inference engine; The AI ​​inference engine is used to perform task inference based on the inference request from the first processor core; The task inference module is used to check whether the inference function pointer and image buffer are valid after receiving an inference request and being woken up. If not, it discards the wake-up and returns to the blocked waiting state. If yes, it executes the forward inference of the AI ​​model, copies the inference result to the result isolation buffer, and notifies the first processor core to take the inference result.

Images