Interrupt control method, artificial intelligence chip, system, device, medium and program product

Abstract

This invention relates to the field of artificial intelligence chip technology, providing an interrupt control method, an artificial intelligence chip, a system, a device, a medium, and a program product. The method includes: receiving interrupt request information initiated by a target user; performing a first-stage verification on the interrupt request information; if the first-stage verification passes, performing a second-stage verification on the interrupt request information; and distributing the interrupt request information or corresponding generated abnormal interrupt information to the corresponding interrupt storage area of ​​the host based on the combined verification results of the first and second stages. This invention, by performing multi-level verification of the legality and security attributes of each user-initiated interrupt request at the source end, and combining the verification results with physical isolation-level distribution, not only achieves bidirectional defense from the source end to the underlying target storage end, but also allows for independent checking of the security of each user-initiated interrupt, thereby maximizing the data security and operational compliance of the entire chip system.

Description

Technical Field

[0001] This invention relates to the field of artificial intelligence chip technology, and in particular to an interrupt control method, an artificial intelligence chip, a system, a device, a medium, and a program product. Background Technology

[0002] With the widespread application of chip virtualization technology, interrupts, as the core communication mechanism for interaction between the host and the artificial intelligence chip, are responsible for promptly informing the host to perform corresponding processing actions when specific events occur. In scenarios where multiple users share chip resources, related technologies typically rely on host-side software (such as a hypervisor) to achieve interrupt isolation and resource distribution for multiple users.

[0003] However, in complex multi-user, multi-tasking environments, relying on software-level interrupt isolation mechanisms presents significant security vulnerabilities. Due to the lack of effective verification at a lower level, traditional software isolation often fails to intercept interrupt requests from users in a timely manner if they are forged, tampered with, or hijacked by malicious programs. Once such untrusted interrupts are sent to the host, they will cause severe cross-user interference, directly leading to chip malfunction, data corruption, or even system crashes, making it difficult to meet the functional safety and compliance standards of high-security scenarios (such as automotive electronics and industrial control). Summary of the Invention

[0004] This invention provides an interrupt control method, an artificial intelligence chip, a system, a device, a medium, and a program product to address the shortcomings of related technologies that rely solely on host-side software for interrupt isolation, which makes it difficult to effectively prevent malicious tampering or hijacking of interrupts in multi-user scenarios, thereby causing system data corruption and security compliance risks.

[0005] This invention provides an interrupt control method applied to an artificial intelligence chip, comprising: Receive interruption request information initiated by the target user, wherein the interruption request information includes at least a first security attribute; The interruption request information is subjected to a first-stage verification, which includes at least a legality check on the source of the interruption request information. If the first stage verification passes, the interrupt request information is subjected to a second stage verification. The second stage verification is used to determine whether the first security attribute matches the second security attribute of the host's target interrupt storage area. Based on the combined verification results of the first stage verification and the second stage verification, the interrupt request information or the corresponding generated abnormal interrupt information is distributed to the corresponding interrupt storage area of ​​the host. If all stages of verification pass, the interrupt request information is sent to the normal interrupt storage area of ​​the host; if any stage verification fails, the generated abnormal interrupt information is sent to the abnormal interrupt storage area of ​​the host.

[0006] According to an interruption control method provided by the present invention, the interruption request information further includes a user identifier and a resource identifier, and the first-stage verification of the interruption request information includes: Based on the user identifier and the resource identifier, the source of the interruption request information is checked for legality. If the legality check passes, a consistency check is performed based on the first security attribute and the global context security attribute.

[0007] According to an interruption control method provided by the present invention, the legitimacy check includes a user legitimacy check and a resource legitimacy check. The legitimacy check of the source of the interruption request information based on the user identifier and the resource identifier includes: The user identifier is compared with the number of legal users configured in the system. If the user identifier exceeds the number of legal users, the user's legality check is determined to have failed, and a first type of exception interruption information is generated. If the user identifier does not exceed the number of legitimate users, then the user's legitimacy check is deemed to have passed, and the resource identifier is compared with the total number of resources allocated to the target user; If the number of resource identifiers exceeds the total number of resources, the resource validity check is determined to have failed, and a second type of abnormal interruption information is generated.

[0008] According to an interruption control method provided by the present invention, the step of performing a consistency check based on the first security attribute and the global context security attribute when the legality check passes includes: If both the user legitimacy check and the resource legitimacy check pass, the corresponding global context identifier is obtained by mapping based on the user identifier and the resource identifier; Retrieve the global context security attribute configured for the global context identifier from the system register; Compare whether the first security attribute is consistent with the global context security attribute. If they are inconsistent, it is determined that the security attribute check has failed, and a third type of exception interruption information is generated.

[0009] According to an interrupt control method provided by the present invention, the second-stage verification of the interrupt request information includes: Obtain the second security attribute of the target interrupt storage area configured by the system for the target user; Compare whether the first security attribute and the second security attribute are consistent. If they are inconsistent, it is determined that the second-stage verification has failed, and a fourth type of exception interruption information is generated.

[0010] According to an interrupt control method provided by the present invention, the abnormal interrupt information includes a verification failure reason code, and the abnormal interrupt information is any one of a first type of abnormal interrupt information, a second type of abnormal interrupt information, a third type of abnormal interrupt information, and a fourth type of abnormal interrupt information.

[0011] The present invention also provides an artificial intelligence chip, comprising: An interruption security attribute checking module is used to receive interruption request information initiated by a target user and perform a first-stage verification on the interruption request information. The interruption request information includes at least a first security attribute, and the first-stage verification includes at least a legality check on the source of the interruption request information. An interrupt sending module, connected to the interrupt security attribute checking module, is used to perform a second-stage verification on the interrupt request information if the first-stage verification passes, and to distribute the interrupt request information or the corresponding generated abnormal interrupt information to the corresponding interrupt storage area of ​​the host based on the comprehensive verification results of the first-stage verification and the second-stage verification. The second stage verification is used to determine whether the first security attribute matches the second security attribute of the target interrupt storage area of ​​the host. If all stages of verification pass, the interrupt request information is sent to the normal interrupt storage area of ​​the host; if any stage verification fails, the generated abnormal interrupt information is sent to the abnormal interrupt storage area of ​​the host.

[0012] According to an artificial intelligence chip provided by the present invention, the interrupt security attribute checking module is specifically used for: If the first stage verification passes, the interrupt request information is output to the interrupt sending module; If the first-stage verification fails, an abnormal interruption message containing the verification failure reason code will be output to the interruption sending module.

[0013] The present invention also provides an interrupt control system, including a host and an artificial intelligence chip as described in any of the above. The host includes an interrupt storage area, which is divided into a normal interrupt storage area and an abnormal interrupt storage area, and the interrupt storage area is configured with corresponding security attributes. The artificial intelligence chip is communicatively connected to the host and is used to perform multi-level hardware verification of legality and security attributes before the interrupt is sent. Based on the verification results, it sends compliant interrupt request information to the normal interrupt storage area or abnormal interrupt information to the abnormal interrupt storage area.

[0014] The present invention also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and running on the processor, wherein the processor implements the interrupt control method described above when executing the computer program.

[0015] The present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the interrupt control method as described above.

[0016] The present invention also provides a computer program product, including a computer program that, when executed by a processor, implements any of the interrupt control methods described above.

[0017] The interrupt control method, artificial intelligence chip, system, device, medium, and program products provided by this invention can, upon receiving an interrupt request information initiated by a target user, first perform a first-stage verification including source legitimacy checks, thereby effectively preventing unauthorized or forged users from sending malicious interrupt requests and ensuring the reliability of interrupt triggering from the hardware level. Based on this, a second-stage verification is further performed to determine whether the first security attribute of the interrupt request matches the second security attribute of the host's target interrupt storage area, strictly blocking unauthorized writes and unauthorized accesses from unsecured interrupts to the host's secure memory area. Finally, based on the comprehensive verification results of the multi-stage verification, compliant interrupts and abnormal interrupts are routed to the host's normal or abnormal interrupt storage area, respectively. This protects the purity and data security of the host's normal interrupt storage area and provides a basis for subsequent anomaly handling and fault tracing, thereby avoiding cross-user malicious interference and system crash risks in multi-user, multi-tasking scenarios. Attached Figure Description

[0018] To more clearly illustrate the technical solutions in this invention or related technologies, the accompanying drawings used in the description of the embodiments or related technologies will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0019] Figure 1This is one of the flowcharts illustrating the interrupt control method provided by the present invention; Figure 2 This is the second flowchart of the interrupt control method provided by the present invention; Figure 3 This is the third flowchart of the interrupt control method provided by the present invention; Figure 4 This is a schematic diagram of the structure of the artificial intelligence chip provided by the present invention; Figure 5 This is a schematic diagram of the interrupt control system provided by the present invention; Figure 6 This is a schematic diagram of the structure of the electronic device provided by the present invention. Detailed Implementation

[0020] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention. It should be noted that all actions involving the acquisition of signals, information, or data in this invention are performed in accordance with the relevant data protection laws and policies of the country where the invention is located, and with authorization from the owner of the corresponding device.

[0021] With the rapid development of artificial intelligence and computing technology, the importance of AI chips in computing systems is increasing daily. Here, AI chips refer to hardware devices specifically designed to handle the massive computational tasks in AI applications. These can include GPUs (Graphics Processing Units), GPGPUs (General-purpose computing on Graphics Processing Units), TPUs (Tensor Processing Units), and ASICs (Application Specific Integrated Circuits). In the daily operation of GPUs and other AI chips, GPU interrupts are the core communication mechanism for interaction between the host and the GPU. Their main function is to promptly notify the host when a specific event occurs, prompting the host to execute corresponding processing actions.

[0022] Currently, in multi-user, multi-tasking scenarios, virtualization technology is typically used to partition a single physical GPU card and allocate it to multiple users or virtual machines. To ensure that each user does not interfere with the others, existing technologies mainly rely on host-side hypervisor software to achieve multi-user sharing and isolation of the GPU. Isolation of core system resources such as interrupt vector tables and priority configurations is fundamental to ensuring secure multi-user operation. Related technologies generally configure mapping tables at the host-side software level to achieve independent distribution of interrupts for multiple users, thereby avoiding cross-user interference to some extent. They also attempt to address malicious attacks through security mechanisms that prevent interrupt tampering and hijacking, thus ensuring system data security and overall chip security.

[0023] However, long-term research and practice have revealed certain flaws and shortcomings in the aforementioned interrupt control and isolation mechanisms implemented using host-side software. Firstly, existing mechanisms struggle to guarantee absolute reliability of interrupts from the source. In high-concurrency scenarios with multiple users and tasks, each user's generated and sent interrupts need to remain highly independent. If the timing, source, or behavior of an interrupt does not meet expectations, or if it is forged or sent without authorization by malicious programs, existing software-layer isolation often fails to provide timely and effective identification and interception at the chip level. Once an untrusted interrupt is received, the system will use it as a point of entry for malicious attacks.

[0024] Secondly, abnormal interruptions can easily trigger serious system-level failures and compliance risks. Once a user's interruption is maliciously tampered with or hijacked and sent to the host, it will directly lead to chip malfunction, contamination of the host's secure storage area, data corruption, or even the collapse of the entire system. Especially in application scenarios with extremely high functional safety requirements, such as automotive electronics and industrial control, such malicious interference across users or tasks may cause serious security incidents and compliance risks.

[0025] To address this, the present invention provides an interrupt control method. By performing multi-level fine-grained verification of the legality and security attributes of each user-initiated interrupt request before interrupt transmission (i.e., at the hardware transmission link layer), it can effectively prevent each user's interrupt from being tampered with or hijacked. At the same time, by combining the verification results to distribute and route interrupts at the physical isolation level, it can prevent unsafe interrupts from being illegally written to the host's secure storage area, thereby ensuring system data security and improving the functional security of the entire chip system, thus overcoming the above-mentioned defects.

[0026] It should be noted that the interrupt control method provided by this invention is applied to artificial intelligence chips, which can be, but are not limited to, GPUs, GPGPUs, TPUs, or other types of acceleration chips used to perform artificial intelligence computing tasks. In actual deployment scenarios, the artificial intelligence chip is typically connected to a host, which can be a server, personal computer, embedded controller, or other computing device. The host may run virtualization management software such as a hypervisor to virtualize the computing resources of a physical chip into multiple virtual functions (VFs) and allocate them to different virtual machines or users.

[0027] In multi-user, multi-tasking virtualization scenarios, various hardware execution units within AI chips, such as DMA (Direct Memory Access) controllers and SPC (Streaming Processor Cluster) computing units, need to notify the host to perform corresponding processing actions via interrupt mechanisms when completing tasks or encountering specific events. Interrupts are a core communication mechanism between the chip and the host, and their security and reliability directly affect the stable operation of the entire system. Traditional solutions rely heavily on host-side hypervisor software for interrupt isolation and management. However, the method of this invention is implemented directly on the hardware transmission link at the AI ​​chip level. That is, before the interrupt is sent from the chip, the chip's internal hardware modules perform multi-level legality and security attribute verification.

[0028] Specifically, the execution logic of the method of this invention is jointly completed by an interrupt security attribute checking module and an interrupt sending module set within the artificial intelligence chip. The interrupt security attribute checking module is responsible for receiving interrupt request information and performing the first-stage verification of source legitimacy and security attributes; the interrupt sending module is responsible for performing the second-stage target storage area security attribute matching verification based on the successful verification in the first stage, and routing the interrupt to the corresponding storage area of ​​the host according to the comprehensive verification result. This hardware-level verification mechanism implemented at the chip level has higher execution efficiency and anti-attack capability compared to a pure software solution, and can fundamentally prevent interrupts from being tampered with or hijacked before they are sent. The technical solution provided by this invention will be described in detail below.

[0029] Figure 1 This is one of the flowcharts illustrating the interrupt control method provided by the present invention, such as... Figure 1 As shown, this method is applied to an artificial intelligence chip, and the method includes: Step S10: Receive interruption request information initiated by the target user, wherein the interruption request information includes at least a first security attribute.

[0030] Specifically, in a multi-user virtualization environment, a physical AI chip (such as a GPU) is virtualized into multiple virtual functions and allocated to different users. Each user independently possesses a set of hardware resources (such as computing units, DMA controllers, etc.). When a user's hardware resources trigger a specific event during task execution (such as task completion, exception occurrence, data transfer completion, etc.), the hardware resource will initiate an interrupt request to notify the host to perform corresponding processing. This interrupt request is transmitted to the verification module inside the AI ​​chip in the form of an interrupt request message.

[0031] It is understood that the interrupt request information includes at least a first security attribute. Here, the first security attribute is a security level identifier carried by the interrupt request information itself, used to characterize whether the interrupt request belongs to a secure or insecure type. For example, in one implementation, the first security attribute can be represented by a single bit, where 0 represents secure and 1 represents insecure, or vice versa. The specific encoding method can be flexibly configured according to the system design requirements. The first security attribute is carried by the hardware resource initiating the interrupt request when the interrupt occurs. It is used to compare with the system's pre-configured security attributes in the subsequent verification process to determine whether the security level of the interrupt request is consistent with the system's expectations.

[0032] In addition to the primary security attribute, the interrupt request information may also include, but is not limited to, user identifier (identifying the user number to which the interrupt originates), resource identifier (identifying the specific hardware resource number that initiated the interrupt), interrupt type information, and other auxiliary information. The interrupt request information can be transmitted from various hardware resources to the verification module via the chip's internal bus, such as the AXI (Advanced eXtensible Interface) bus. It should be understood that the specific fields included in the interrupt request information can be added or removed according to the system architecture and actual needs, but it should at least include the primary security attribute to ensure that subsequent security attribute verification can be performed correctly.

[0033] Step S20: Perform a first-stage verification on the interruption request information. The first-stage verification includes at least a legality check on the source of the interruption request information.

[0034] Specifically, upon receiving an interruption request, the AI ​​chip performs a first-stage verification. The purpose of this first-stage verification is to validate the credibility of the interruption request from the perspective of its source, ensuring that the interruption request does indeed originate from a legitimate user and resource configured within the system, rather than from an unauthorized, forged, or unauthorized source.

[0035] Specifically, the first-stage verification includes at least a legitimacy check on the source of the interruption request information. This legitimacy check verifies the identity of the source initiating the interruption request, determining whether it belongs to a legitimate source pre-configured and authorized by the system. In practice, this legitimacy check can be to authenticate the user source of the interruption request, checking whether the user initiating the interruption request is a legitimate, authorized user existing in the system; or it can be to verify the scope of the resource source involved in the interruption request, checking whether the resource initiating the interruption request is within the resource range allocated to the user by the system, i.e., whether there is any out-of-bounds behavior. Through source legitimacy checks, interruption requests forged by unauthorized users and illegal interruption requests initiated by legitimate users through out-of-bounds behavior can be effectively intercepted.

[0036] Furthermore, in some implementations, the first-stage verification, in addition to the aforementioned source legitimacy check, may further include a consistency check based on security attributes. For example, the first security attribute carried by the interruption request information itself may be compared with the security attributes pre-configured by the system for the interruption source to determine whether the interruption request has been forged or tampered with in terms of security level. It should be noted that the specific combination and execution order of the sub-steps of the first-stage verification can be flexibly configured according to actual security requirements, as long as it at least includes a legitimacy check on the source of the interruption request information.

[0037] If all sub-checks in the first phase of verification pass, the first phase of verification is considered successful, and the interruption request information will be passed to the subsequent second phase of verification. If any sub-check in the first phase of verification fails, the first phase of verification is considered unsuccessful, and an exception interruption message containing the corresponding verification failure information will be generated.

[0038] Step S30: If the first stage verification passes, the interrupt request information is subjected to a second stage verification. The second stage verification is used to determine whether the first security attribute matches the second security attribute of the host's target interrupt storage area.

[0039] Specifically, after the first stage of verification passes, indicating that the source of the interruption request information has been confirmed as legitimate and trustworthy, the AI ​​chip further performs a second stage of verification on the interruption request information. The second stage of verification shifts from the source of the interruption to the destination of the interruption, that is, it performs security attribute matching verification on the target storage area of ​​the host to which the interruption request information is to be sent.

[0040] Specifically, the host memory is divided into interrupt storage areas for receiving interrupt information. Different interrupt storage areas are configured with different security attributes (i.e., secondary security attributes). Here, the secondary security attribute is a security level identifier pre-configured by the system for each interrupt storage area on the host side, indicating whether the storage area belongs to a secure storage area or a non-secure storage area. For example, some interrupt storage areas may be configured as secure storage areas, specifically for receiving secure interrupt information; others may be configured as non-secure storage areas, for receiving non-secure interrupt information. The system can configure the corresponding target interrupt storage area and its security attributes for each user's interrupt through a configuration interface.

[0041] During the second-stage verification of interrupt request information, the first security attribute carried by the interrupt request information itself can be compared with the second security attribute of the target interrupt storage area configured by the system for the target user to determine whether the two match. If the first security attribute and the second security attribute are consistent, for example, a secure interrupt corresponds to a secure storage area and a non-secure interrupt corresponds to a non-secure storage area, it indicates that the interrupt request information will be sent to the target area that matches its security level, and the second-stage verification passes. If the first security attribute and the second security attribute are inconsistent, for example, a non-secure interrupt attempts to be sent to a secure storage area, it indicates a risk of security level overreach, the second-stage verification fails, and corresponding abnormal interrupt information will be generated.

[0042] Understandably, the significance of performing a second-stage verification on interrupt request information is that even if an interrupt request has passed legitimacy verification at the source end, it is still not allowed to be directly written to the target storage area if its security level does not match the security level of the target storage area. This two-way matching mechanism of security attributes between the source and destination ends can effectively prevent unsecured interrupts from making unauthorized writes or unauthorized access to the host's secure storage area, thereby protecting the data integrity of the host's secure storage area.

[0043] Step S40: Based on the combined verification results of the first stage verification and the second stage verification, the interrupt request information or the corresponding generated abnormal interrupt information is distributed to the corresponding interrupt storage area of ​​the host. If all stages of verification pass, the interrupt request information is sent to the normal interrupt storage area of ​​the host; if any stage verification fails, the generated abnormal interrupt information is sent to the abnormal interrupt storage area of ​​the host.

[0044] Specifically, after completing the first and second phases of verification, the AI ​​chip performs the final distribution and routing of interrupt request information based on the combined verification results of the two phases. The interrupt storage area on the host side is divided into two physically isolated areas: a normal interrupt storage area and an abnormal interrupt storage area, which are used to receive interrupt information with different verification results, respectively.

[0045] When both the first and second stage verifications pass, it indicates that the interrupt request information meets the system's security requirements in all dimensions, including source legitimacy, security attribute consistency, and target memory attribute matching. At this point, the AI ​​chip sends the interrupt request information to the host's normal interrupt storage area without modification, and the host performs subsequent interrupt processing according to the normal procedure.

[0046] If either the first or second stage of verification fails, it indicates an anomaly in the interruption request information at some security level, potentially stemming from security risks such as unauthorized user forgery, out-of-bounds resource access, security attribute tampering, or unauthorized writes to the target storage area. In this case, the AI ​​chip will not send the original interruption request information to the normal interruption storage area. Instead, it will generate abnormal interruption information containing verification failure details and send this abnormal interruption information to the host's abnormal interruption storage area. This abnormal interruption information may include auxiliary data such as the cause code for the verification failure and the user information that triggered the anomaly, allowing the host to subsequently use the information recorded in the abnormal interruption storage area for fault tracing or anomaly handling.

[0047] Understandably, the normal interrupt storage area and the abnormal interrupt storage area are physically isolated. Abnormal interrupts will not pollute the storage space of normal interrupts (i.e., compliant interrupts), and normal interrupts will not be routed to the abnormal storage area. This hardware-level isolation routing mechanism ensures that even if a user in the system is compromised or engages in malicious behavior, the illegal interrupts they generate will be intercepted and isolated at the chip level, without interfering with the interrupt processing of other normal users or threatening the data security of the host's normal storage area.

[0048] The method provided in this invention, upon receiving an interrupt request from a target user, first performs a first-stage verification including a source legitimacy check, effectively preventing unauthorized or forged users from sending malicious interrupt requests and ensuring the reliability of interrupt triggering from the hardware level. Based on this, a second-stage verification further determines whether the first security attribute of the interrupt request matches the second security attribute of the host's target interrupt storage area, strictly blocking unauthorized writes and unauthorized accesses from insecure interrupts to the host's secure memory area. Finally, based on the comprehensive verification results from multiple stages, compliant interrupts and abnormal interrupts are routed to the host's normal or abnormal interrupt storage area, respectively. This protects the purity and data security of the host's normal interrupt storage area and provides a basis for subsequent anomaly handling and fault tracing, thereby avoiding cross-user malicious interference and system crash risks in multi-user, multi-tasking scenarios.

[0049] Based on the above embodiments, the interruption request information further includes a user identifier and a resource identifier, and step S20 specifically includes: Step S21: Based on the user identifier and the resource identifier, perform a legality check on the source of the interruption request information; Step S22: If the legality check passes, perform a consistency check based on the first security attribute and the global context security attribute.

[0050] Specifically, in a multi-user virtualization environment, a physical AI chip is divided into multiple virtual functions (VFs) using virtualization technology, and each VF is assigned to an independent user. Each user independently owns several hardware resources (such as DMA controllers, computing units, etc.) within the chip. When these hardware resources trigger an interrupt, the interrupt request information carries the user identifier and resource identifier.

[0051] Here, the user identifier (denoted as vf_id) identifies the user number that initiated the interrupt request, i.e., which virtual function the interrupt originated from. The resource identifier (denoted as client_id) identifies the specific hardware resource number that initiated the interrupt request within that user; it is a local identifier within the user, and each user has its own independent resource identifier number space. The interrupt request information, carrying the user identifier, resource identifier, and first security attribute fields, is transmitted via the chip's internal bus (e.g., AXI bus) to the interrupt security attribute check module for the first stage of verification.

[0052] The legitimacy check is the first step in the first-phase verification, aiming to verify the legitimacy of the interruption request's origin from both user and resource perspectives. Specifically, it uses the user identifier to determine if the user initiating the interruption request is a legitimate, authorized user in the system; and it uses the resource identifier to determine if the hardware resources involved in the interruption request are within the resource range allocated to that user by the system. The legitimacy check can include one or more sub-checks, such as performing a user-level check first and then a resource-level check. The check can take the form of comparing the user identifier or resource identifier with the system's pre-configured legitimate range. Only when all sub-checks in the legitimacy check pass is the legitimacy check considered passed, and the process proceeds to the subsequent security attribute consistency check. If any sub-check in the legitimacy check fails, the first-phase verification is considered failed, and corresponding abnormal interruption information is generated.

[0053] After the legality check passes, it means that both the user and resource from which the interruption request originated are within the scope of the system's legitimate configuration. At this point, the first phase of verification enters the security attribute consistency check stage. The purpose of this stage is to further verify whether the primary security attribute carried by the interruption request information itself is consistent with the security attribute preset for the interruption source from a global system perspective, thereby preventing attacks that forge or tamper with the security level of local resources.

[0054] Understandably, in multi-user virtualization scenarios, different users may possess local resource identifiers with the same number (e.g., user A and user B may each possess a DMA controller numbered 1). To uniquely distinguish and manage each user's resources globally, the system needs to jointly map the local user identifier and resource identifier to a globally unique global context identifier (represented as context_id). Here, the global context identifier is a resource identifier from the global perspective of the entire system (i.e., the Host or Hypervisor layer). The system register pre-configures a corresponding global context security attribute for each global context identifier, indicating the security level (e.g., secure or insecure) recognized by the system at the system level.

[0055] Specifically, when performing a consistency check based on the first security attribute and the global context security attribute, the system first obtains the corresponding global context identifier based on the user identifier and resource identifier through a mapping relationship. Then, it obtains the global context security attribute pre-configured for this global context identifier. Finally, it compares the first security attribute carried in the interrupt request information with this global context security attribute. If they match, it indicates that the security level declaration of the interrupt request conforms to the system's global configuration, the consistency check passes, the entire first-stage verification passes, and the interrupt request information is passed to the second-stage verification stage. If they do not match, it indicates that the interrupt request may have security attribute forgery or tampering behavior, the consistency check fails, the first-stage verification fails, and corresponding abnormal interrupt information is generated.

[0056] The method provided in this invention achieves a progressive verification from identity verification to security level verification by sequentially performing two steps in the first-stage verification: source legitimacy check and security attribute consistency check. The source legitimacy check ensures that the interrupt request comes from a legitimate user and a legitimate resource, while the security attribute consistency check further ensures that the security level claimed by the interrupt request is consistent with the system's global configuration. The two work together to form a multi-dimensional verification of the interrupt source, which can effectively intercept interrupts forged by unauthorized users, resource out-of-bounds interrupts by legitimate users, and malicious interrupts by tampering with security attributes. This significantly improves the reliability and security of interrupt communication in multi-user shared scenarios.

[0057] Based on any of the above embodiments, the legitimacy check includes user legitimacy check and resource legitimacy check, and step S21 specifically includes: Step S211: Compare the user identifier with the number of legal users configured in the system. If the user identifier exceeds the number of legal users, it is determined that the user legality check has failed, and a first type of abnormal interruption information is generated. Step S212: If the user identifier does not exceed the number of legitimate users, then the user legitimacy check is determined to be passed, and the resource identifier is compared with the total number of resources allocated to the target user; Step S213: If the resource identifier exceeds the total number of resources, it is determined that the resource validity check has failed, and a second type of abnormal interruption information is generated.

[0058] Specifically, the first step in the legitimacy check is the user legitimacy check, which aims to prevent unauthorized or forged users from sending interruptions and to ensure that the user from which the interruption originates is a legitimate user who actually exists in the system.

[0059] During system initialization or virtualization configuration, the Hypervisor sets the number of legitimate users (i.e., the total number of virtual functions) supported by the current chip through the system configuration interface. The execution logic of user legitimacy check is as follows: the user identifier (vf_id) carried in the interrupt request information is compared with the number of legitimate users configured by the system (e.g., n). If the user identifier exceeds the number of legitimate users, that is, the user number indicated by the user identifier is greater than the total number of virtual functions actually partitioned and allocated by the system (vf_id>n), it indicates that the interrupt request may come from a non-existent forged user. In this case, the user legitimacy check is determined to have failed, and a first-type abnormal interrupt message (i.e., an interrupt message with fault type 1) is generated. Here, the first-type abnormal interrupt message represents an abnormality of illegal user identity, which will be subsequently routed to the host's abnormal interrupt storage area.

[0060] For example, suppose the system is configured with 4 virtual functions (the number of legitimate users is 4, and the user ID number ranges from 1 to 4). If a malicious program attempts to forge an interrupt request with user ID 5 and send it through the bus, the inspection module will find that user ID 5 exceeds the number of legitimate users of 4 when comparing, and directly intercept it and generate the first type of abnormal interrupt information.

[0061] If the user ID does not exceed the system's configured number of legitimate users (i.e., vf_id ≤ n), it indicates that the interrupt request comes from a legitimate user, and the user legitimacy check passes. Based on this, the legitimacy check proceeds to the second step: resource legitimacy check. The purpose of the resource legitimacy check is to prevent legitimate users from accessing resources outside their designated boundaries, ensuring that users can only use the local resources allocated to them by the system to trigger interrupts.

[0062] During the system configuration phase, the system registers independently configure the total number of resources owned by each user, for example, VFi_ctx_num (representing the total number of resources independently owned by the i-th user). Each user's resource identifier number starts from a primary value and is sequentially numbered within the user's total resource count. The execution logic for resource validity checking is as follows: the resource identifier (client_id) carried in the interrupt request information is compared with the total number of resources (VFi_ctx_num) allocated by the system for the target user (i.e., the user corresponding to the user identifier) ​​to determine whether the resource identifier is within the range of resource numbers authorized for the user's use.

[0063] If the resource identifier exceeds the total number of resources allocated to the target user by the system (client_id > VFi_ctx_num), meaning the resource number indicated by the resource identifier exceeds the range of resources authorized for the user, it indicates that the interruption request involves resource out-of-bounds behavior. This means that a legitimate user is attempting to initiate an interruption using resources they are not authorized to access. In this case, the resource legitimacy check fails, and a second type of exception interruption message (i.e., an interruption message with fault type 2) is generated. Here, the second type of exception interruption message represents the resource out-of-bounds exception and has a different exception code than the first type of exception interruption message, so that the host can distinguish between different types of security violations during subsequent exception handling.

[0064] For example, suppose the system allocates a total of 8 hardware resources to user 1 (the legal resource identifier range is 1 to 8). If user 1 attempts to send an interrupt request with resource identifier 10 by tampering with the instruction, the checking module will find that resource identifier 10 exceeds the user's total resource limit of 8, which is an out-of-bounds behavior. It will immediately intercept the request and generate a second type of abnormal interrupt information.

[0065] If the resource identifier does not exceed the total number of resources for the target user (i.e., client_id ≤ VFi_ctx_num), it indicates that the resources involved in the interruption request are within the legal range allocated to the user by the system, and the resource legality check passes. At this point, both the user legality check and the resource legality check have passed, and the entire legality check process is complete. The next step is to proceed to the security attribute consistency check process.

[0066] Understandably, there is a sequential dependency between user legitimacy checks and resource legitimacy checks; resource legitimacy checks will only be performed after the user legitimacy check passes. This is because if the user is illegitimate, checking their resource scope becomes meaningless. This step-by-step checking method ensures both the rigor of the verification and avoids unnecessary computational overhead.

[0067] The method provided in this invention refines the legitimacy check into two sequentially executed sub-steps: user legitimacy check and resource legitimacy check. Different types (first type and second type) of abnormal interruption information are defined for each type of check failure, achieving fine-grained hierarchical verification of the interruption source identity. The user legitimacy check filters out forged, illegal user interruptions at the user level, while the resource legitimacy check filters out out-of-bounds interruptions within legitimate users at the resource level. Working together, these two methods can accurately pinpoint the specific violation type of each illegal interruption, thus providing a clear basis for subsequent fault tracing and anomaly handling on the host side.

[0068] Based on any of the above embodiments, step S22 specifically includes: Step S221: If both the user legitimacy check and the resource legitimacy check pass, the corresponding global context identifier is obtained by mapping based on the user identifier and the resource identifier. Step S222: Obtain the global context security attribute configured for the global context identifier in the system register; Step S223: Compare whether the first security attribute is consistent with the global context security attribute. If they are inconsistent, it is determined that the security attribute check has failed, and a third type of abnormal interruption information is generated.

[0069] Specifically, once both user and resource legitimacy checks pass, it is confirmed that the interrupt request originated from a legitimate user and that the resource number used by that user is within its allocated range. However, since resource identifiers are local identifiers within each user, different users may possess resource identifiers with the same number (e.g., user A and user B may each possess a DMA controller with the number 1). Therefore, user identifiers and resource identifiers alone cannot uniquely distinguish a specific resource instance globally. To achieve unified permission management and security attribute configuration at the global level, the system needs to jointly map local user identifiers and resource identifiers to a globally unique global context identifier.

[0070] Here, the global context identifier is a unique number assigned to each resource instance of each user from a global system perspective. During the system configuration phase, the Hypervisor or system management software allocates a certain number of context resources to each user. The sum of the context resources owned by each user constitutes the total number of context resources in the system. For example, assuming the system is configured with 3 users, user 1 has 4 context resources (global context identifiers 1-4), user 2 has 8 context resources (global context identifiers 5-12), and user 3 has 6 context resources (global context identifiers 13-18), then the total number of context resources in the system is 18. During the mapping process, the system calculates the global context identifier corresponding to the resource based on each user's context start identifier and the resource identifier within the user. For example, when user 2's resource identifier is 3, its mapped global context identifier is user 2's global context start identifier 5 plus resource identifier 3 minus 1, resulting in a global context identifier of 7. It should be understood that the mapping relationship can be provided by a pre-configured mapping table or offset register in the system registers, and the mapping process is completed in real time in the hardware logic of the interrupt security attribute check module.

[0071] After obtaining the global context identifier through mapping, the interrupt security attribute checking module reads the global context security attribute corresponding to that identifier from the system register. It should be noted that each global context identifier is pre-configured with a corresponding security attribute value in the system register. This security attribute value represents the security level recognized by the global context at the system level. For example, in one implementation, the security attribute value is represented by a single bit, with 0 representing secure and 1 representing insecure. The global context security attribute is uniformly configured by the hypervisor or system management software during the virtualization initialization phase according to the security policies of each user and their resources, reflecting the system's true authorization of the resource at the security level. Once configured, this attribute is maintained by hardware registers during runtime and cannot be arbitrarily modified by user-side software, thus ensuring the reliability of the global security attribute.

[0072] After obtaining the global context security attributes, the interrupt security attribute checking module compares the first security attribute carried by the interrupt request information itself (i.e., the security attribute of the hardware resource client_id that initiated the interrupt request) with the global context security attributes read from the system register. If they match, for example, if the first security attribute carried by the interrupt request is 1, and the global context security attribute configured by the system for its mapped global context identifier is also 1, it indicates that the security level claimed by the interrupt request is consistent with the security level configured globally by the system. The security attribute consistency check passes, the entire first-stage verification passes, and the interrupt request information is passed to the interrupt sending module to perform the subsequent second-stage verification.

[0073] If the two are inconsistent, it indicates that the security level claimed by the interrupt request does not match the system's global configuration, and there is a risk of security attribute forgery or tampering. In this case, the security attribute check is determined to have failed, and a third type of abnormal interruption information (i.e., an interruption information with fault type 3) is generated. Here, the third type of abnormal interruption information represents an exception where the security attribute does not match the global context security attribute, and its exception code is distinguished from the aforementioned first type (illegal user identity) and second type (resource out of bounds) abnormal interruption information.

[0074] For example, suppose a computing unit of user 3 (resource identifier 3) is mapped by the system to global context identifier 15, and the security attribute of global context identifier 15 is configured as insecure (e.g., 1) in the system register. If a malicious program attempts to send the interrupt request with the first security attribute marked as secure (e.g., 0), the checking module will find that the first security attribute 0 carried by the interrupt is inconsistent with the global context security attribute 1 configured by the system. Therefore, it will determine that the interrupt request has security attribute forgery behavior, generate third-type abnormal interrupt information, and route it to the abnormal interrupt storage area.

[0075] The method provided in this embodiment of the invention achieves hardware-level verification of the authenticity of interrupt security level declarations by jointly mapping user identifiers and resource identifiers to global context identifiers and using the pre-configured global context security attributes in the system registers as a trusted benchmark to compare the consistency with the first security attribute carried by the interrupt request information itself.

[0076] Based on any of the above embodiments, step S30 specifically includes: Step S31: Obtain the second security attribute of the target interrupt storage area configured by the system for the target user; Step S32: Compare whether the first security attribute and the second security attribute are consistent. If they are inconsistent, it is determined that the second stage verification has failed, and a fourth type of abnormal interruption information is generated.

[0077] It should be noted that after the first stage of verification, if the verification passes, the interrupt security attribute checking module will pass the interrupt request information sent by the user to the interrupt sending module unchanged, and the interrupt sending module will then perform the second stage of verification. If the first stage of verification fails, the interrupt security attribute checking module will pass the generated abnormal interrupt information of the corresponding type to the interrupt sending module, so that it can be transmitted to the host through the interrupt sending module.

[0078] Specifically, when the interrupt sending module performs the second-stage verification, it first needs to determine the target interrupt storage area on the host side to which the interrupt request information will be sent, and obtain the security attributes configured in that area.

[0079] On the host side, the host memory used to receive interrupt information is divided into interrupt storage areas with different security attributes, including secure and insecure storage areas. The system pre-configures the target interrupt storage area for each user's interrupt through a configuration interface and sets a second security attribute for that area. Here, the second security attribute is a security level identifier set by the system management software (such as the hypervisor) during the initialization phase through the system configuration register for each user's interrupt target storage area, indicating whether the storage area belongs to a secure or insecure area. For example, in one implementation, if a user's target interrupt storage area is configured as a secure storage area, its second security attribute is secure (e.g., 0); if it is configured as an insecure storage area, its second security attribute is insecure (e.g., 1). The interrupt sending module obtains the second security attribute of the target interrupt storage area by reading the interrupt storage area configuration information corresponding to the target user from the system configuration register.

[0080] After obtaining the second security attribute, the interrupt sending module compares the first security attribute carried in the interrupt request information with the second security attribute of the target interrupt storage area. The purpose of this comparison is to ensure that secure interrupts are sent to secure storage areas and non-secure interrupts are sent to insecure storage areas; that is, the security level of the interrupt itself must be consistent with the security level of the target storage area to which it is about to be written.

[0081] Specifically, if the first security attribute and the second security attribute are consistent—for example, if the first security attribute carried by the interrupt request is secure (e.g., 0), and the second security attribute of the target interrupt storage area configured by the system for the user is also secure (e.g., 0)—then the interrupt request will be sent to the target area matching its security level, and the second-phase verification passes. In this case, the interrupt sending module directly sends the interrupt request information to the target interrupt storage area corresponding to the host, i.e., the secure storage area under the normal interrupt storage area. It should be understood that if both the first and second security attributes are insecure (e.g., 1), it also means the second-phase verification passes, and the interrupt request information will be sent to the insecure storage area under the normal interrupt storage area.

[0082] If the first security attribute is inconsistent with the second security attribute, it indicates a risk of unauthorized write access. In this case, the second-stage verification fails, and a fourth type of exception interruption message (i.e., an interruption message with fault type 4) is generated. Here, the fourth type of exception interruption message represents an exception where the interruption security attribute does not match the target storage area's security attribute. Its exception encoding is distinct from the aforementioned first type (illegal user identity), second type (resource out of bounds), and third type (security attribute does not match global context security attribute) exception interruption messages.

[0083] The method provided in this invention implements a bidirectional matching and verification mechanism between the source and destination security attributes by adding a comparison and verification of the security attributes of the destination storage area in the interrupt transmission module. The first-stage verification ensures the legitimacy of the interrupt request's identity and the authenticity of its security level at the source end. The second-stage verification further ensures that the interrupt request will not cause unauthorized writes due to security level mismatches when sent to the destination end. These two stages of verification form a closed-loop security verification from the source to the destination, eliminating the possibility of unsecured interrupts illegally writing to the host's secure storage area and providing security for the entire interrupt transmission link.

[0084] Based on any of the above embodiments, the abnormal interruption information includes a verification failure reason code, and the abnormal interruption information is any one of the first type of abnormal interruption information, the second type of abnormal interruption information, the third type of abnormal interruption information, and the fourth type of abnormal interruption information.

[0085] Specifically, in the multi-level verification process, a corresponding exception interruption message is generated when any level of verification fails. To enable the host to accurately identify the specific reason for the verification failure after receiving the exception interruption message, and thus perform targeted exception handling and fault tracing, each exception interruption message contains a verification failure reason code.

[0086] Here, the verification failure reason code is a predefined code value used to uniquely identify the specific verification failure type corresponding to the abnormal interruption information. Different types of verification failures correspond to different code values. When the host reads the abnormal interruption information recorded in the abnormal interruption storage area, it can quickly locate the nature and source of the abnormality based on the verification failure reason code. For example, it can determine whether the verification failure is caused by illegal user identity, resource out-of-bounds access, security attribute forgery, or target memory attribute mismatch, and then take corresponding security response measures, such as isolating malicious users, recording security logs, and triggering alarms.

[0087] Specifically, the types of abnormal interruption information correspond one-to-one with the aforementioned verification stages. Abnormal interruption information can be any one of four types: Type 1, Type 2, Type 3, and Type 4. Type 1 abnormal interruption information corresponds to a failed user legitimacy check, with the reason code indicating an illegitimate user identity. Type 2 abnormal interruption information corresponds to a failed resource legitimacy check, with the reason code indicating a resource out of bounds. Type 3 abnormal interruption information corresponds to a failed check for consistency between security attributes and global context security attributes, with the reason code indicating a mismatch between security attributes and global context security attributes. Type 4 abnormal interruption information corresponds to a failed check for matching interruption security attributes with target storage region security attributes in the second-stage verification, with the reason code indicating a mismatch between interruption security attributes and target memory region security attributes. These four types cover all possible exception categories in the complete verification process from interruption source authentication to target memory security attribute matching.

[0088] In actual operation, when a certain level of verification fails, the interrupt security attribute check module or the interrupt sending module immediately generates an abnormal interrupt message carrying the corresponding verification failure reason code, and routes this abnormal interrupt message to the host's abnormal interrupt storage area. Since all types of abnormal interrupt messages are sent to the same abnormal interrupt storage area, and different types of abnormal interrupt messages are distinguished by their respective verification failure reason codes, the host does not need to set up multiple independent abnormal storage areas. It can achieve accurate identification and classification management of different types of abnormalities in a single abnormal storage area.

[0089] Based on any of the above embodiments Figure 2 This is the second flowchart of the interrupt control method provided by the present invention, as shown below. Figure 2 As shown, in a multi-user, multi-tasking GPU virtualization scenario, the physical GPU is divided into multiple virtual functions (VFs) for different users. Each independent virtual machine or user resource, such as the client to which VF1 belongs (i.e., the hardware resources independently owned by user 1) and the client to which VF2 belongs (i.e., the hardware resources independently owned by user 2), can independently initiate interrupt requests.

[0090] When the GPU receives these concurrent or independent interrupt requests, it first enters the verification module to determine if the validity and security attribute checks have passed. If all validity and security attribute checks for the interrupt pass, it is determined to be a compliant interrupt, and a compliant interrupt is sent, directly routed, and written to the normal interrupt storage area in host memory for the host to handle as usual. If any non-compliance is found during the check (such as exceeding boundaries, tampering, etc.), the interrupt is intercepted, an abnormal interrupt is sent, and it is forcibly isolated and routed to the abnormal interrupt storage area in host memory to prevent unauthorized interrupts from polluting the normal operating environment of the system.

[0091] Figure 3 This is the third flowchart of the interrupt control method provided by the present invention, as shown below. Figure 3 As shown, to achieve the aforementioned strict security isolation, the system incorporates a multi-level verification mechanism. When any client belonging to a VF experiences an interruption, the following logical steps are executed: S1, User Validity Check. The system first verifies whether the user identifier (vf_id) initiating the interrupt is within the valid range allocated by the system. If the check result is negative, it indicates malicious behavior by forging a user, and the system immediately generates a first-type abnormal interrupt message and sends it directly to the abnormal interrupt storage area through the interrupt sending module. If the check result is positive, it proceeds to the next level of verification.

[0092] S2, Resource Validity Check. The system then verifies whether the resource identifier (client_id) carried by the interrupt exceeds the total number of local resources allocated to the user, thus determining whether the resource validity check passes. If the check result is negative, it indicates that the resource identifier carried by the interrupt exceeds the total number of local resources allocated to the user, meaning that the user is attempting to use unallocated resources without authorization. The system generates a second type of abnormal interrupt information and sends it to the abnormal interrupt storage area. If the check result is positive, it indicates that both the user and the resource source are legitimate, and the system proceeds to the mapping stage.

[0093] S3, Identifier Mapping Phase. The system performs the operation of mapping user identifiers and resource identifiers to global context identifiers. Through this conversion, the user's local identifiers are unified to the context_id from the system's global perspective, so as to perform globally unified attribute comparisons.

[0094] S4, Global Context Security Attribute Check. The system determines whether the security attributes carried by the interrupt are consistent with the security attributes identified by the global context. If the check result is negative, it indicates that the interrupt source has forged a security level (e.g., disguising a non-secure resource as a secure interrupt). The system generates a third-type abnormal interrupt message and sends it to the abnormal interrupt storage area. If the check result is positive, all hardware verifications at the source have passed, and the system is ready to send the message to the host.

[0095] S5, Secondary Security Attribute Verification. Before sending an interrupt, the interrupt sending module performs a final verification check, determining whether the security attributes carried by the interrupt match the security attributes of the target interrupt storage area. If the check result is negative, it indicates that even if the source interrupt itself is legitimate, it is attempting to write to a host storage area with mismatched security attributes (e.g., a non-secure interrupt attempting to write to a secure storage area). The system generates a fourth type of abnormal interrupt information and sends it to the abnormal interrupt storage area. If the check result is positive, the interrupt passes all checks and is safely and reliably allowed to proceed to the normal interrupt storage area.

[0096] The method provided in this invention achieves accurate identification and classification isolation of abnormal interrupts through a progressive four-level hardware verification logic. It can independently check whether the interrupt generated by each user is safe, thereby maximizing the data security of the entire chip system and host.

[0097] Based on any of the above embodiments Figure 4 This is a schematic diagram of the structure of the artificial intelligence chip provided by the present invention, as shown below. Figure 4 As shown, the chip includes: Interruption security attribute checking module 410 is used to receive interruption request information initiated by the target user and perform a first-stage verification on the interruption request information. The interruption request information includes at least a first security attribute, and the first-stage verification includes at least a legality check on the source of the interruption request information. Interrupt sending module 420, connected to the interrupt security attribute checking module, is used to perform a second-stage verification on the interrupt request information if the first-stage verification passes, and distribute the interrupt request information or the corresponding generated abnormal interrupt information to the corresponding interrupt storage area of ​​the host according to the comprehensive verification result of the first-stage verification and the second-stage verification. The second stage verification is used to determine whether the first security attribute matches the second security attribute of the target interrupt storage area of ​​the host. If all stages of verification pass, the interrupt request information is sent to the normal interrupt storage area of ​​the host; if any stage verification fails, the generated abnormal interrupt information is sent to the abnormal interrupt storage area of ​​the host.

[0098] Specifically, the AI ​​chip can be a GPU, GPGPU, TPU, or other acceleration chip used to perform AI computing tasks. In actual deployment, the AI ​​chip communicates with the host via interfaces such as PCIe (Peripheral Component Interconnect express, a high-speed serial computer expansion bus standard). The host memory on the host side is divided into normal interrupt storage areas and abnormal interrupt storage areas to receive compliant and abnormal interrupts, respectively. The chip is divided into multiple virtual functions through virtualization technology and allocated to different users. Each user independently owns a set of hardware resources, which can trigger interrupt requests during operation. The interrupt security attribute checking module 410 and the interrupt sending module 420 work together to complete multi-level verification and routing distribution using hardware logic before the interrupt request is sent from the chip to the host, forming the core of interrupt security protection on the chip side.

[0099] Specifically, the interrupt security attribute checking module receives interrupt request information initiated by the target user and performs a first-stage verification on the interrupt request information. Here, the interrupt request information is generated by the hardware resources owned by each user within the chip when a specific event is triggered, and is transmitted to the interrupt security attribute checking module via the chip's internal bus (e.g., the AXI bus). The interrupt request information includes at least a first security attribute, which is a security level identifier carried by the interrupt request itself, used to indicate whether the interrupt request belongs to a secure or non-secure type. In addition, the interrupt request information may also carry auxiliary information such as user identifier and resource identifier.

[0100] The interrupt security attribute check module performs a first-stage verification on the received interrupt request information. This first-stage verification includes at least a legitimacy check on the source of the interrupt request information. The legitimacy check verifies whether the source of the interrupt request belongs to a legitimate source pre-configured and authorized by the system. For example, it verifies whether the user of the interrupt source is a legitimate, authorized user in the system, and whether the resources involved in the interrupt are within the resource range allocated to that user by the system. In some implementations, the first-stage verification may also include a security attribute consistency check performed after the legitimacy check passes, comparing the first security attribute carried in the interrupt request with the globally configured security attributes of the system. Internally, the interrupt security attribute check module can use a hardware state machine to implement the sequential execution of the above checks and the integration of results. The required system configuration parameters (such as the number of legitimate users, the total number of resources for each user, and global context security attributes) can be read from the system configuration register.

[0101] The interrupt sending module and the interrupt security attribute checking module are connected through the data path inside the chip. The interrupt security attribute checking module transmits the results of the first-stage verification and the interrupt request information (or the generated abnormal interrupt information) to the interrupt sending module.

[0102] The second-stage verification performed by the interrupt sending module is used to determine whether the first security attribute carried in the interrupt request information matches the second security attribute of the target interrupt storage area on the host. The second security attribute is a security level identifier pre-configured by the system for each interrupt storage area on the host side. The interrupt sending module obtains the second security attribute by reading the interrupt storage area configuration information corresponding to the target user in the system configuration register and compares it with the first security attribute.

[0103] The interrupt sending module performs the final interrupt routing distribution based on the comprehensive verification results of the two stages. If each stage of verification passes, that is, the source legality and security attributes meet the requirements in the first stage verification, and the interrupt security attributes match the target storage area security attributes in the second stage verification, then the interrupt sending module sends the interrupt request information to the host's normal interrupt storage area, and the host performs subsequent processing according to the normal process. If any stage of verification fails, the interrupt sending module sends the corresponding abnormal interrupt information to the host's abnormal interrupt storage area, and the normal interrupt storage area will not be contaminated.

[0104] The artificial intelligence chip provided in this invention implements multi-level legality verification and security attribute matching verification logic for interrupts entirely in hardware at the chip level by coordinating the work of two hardware modules: an interrupt security attribute checking module and an interrupt sending module. This ensures that interrupt requests undergo complete security verification and classification routing before being sent from the chip. Compared to traditional solutions that rely on host-side software for interrupt isolation management, this chip architecture has higher verification execution efficiency and resistance to software-level attacks. It can guarantee the security and isolation of interrupt communication in multi-user virtualization scenarios at the hardware level, effectively preventing security risks such as interrupt tampering, hijacking, and cross-user interference.

[0105] Based on any of the above embodiments, the interruption security attribute checking module is specifically used for: If the first stage verification passes, the interrupt request information is output to the interrupt sending module; If the first-stage verification fails, an abnormal interruption message containing the verification failure reason code will be output to the interruption sending module.

[0106] Based on any of the above embodiments, the interruption request information further includes a user identifier and a resource identifier, and the interruption security attribute checking module is specifically used for: Based on the user identifier and the resource identifier, the source of the interruption request information is checked for legality. If the legality check passes, a consistency check is performed based on the first security attribute and the global context security attribute.

[0107] Based on any of the above embodiments, the legitimacy check includes user legitimacy check and resource legitimacy check, and the interruption security attribute check module is specifically used for: The user identifier is compared with the number of legal users configured in the system. If the user identifier exceeds the number of legal users, the user's legality check is determined to have failed, and a first type of exception interruption information is generated. If the user identifier does not exceed the number of legitimate users, then the user's legitimacy check is deemed to have passed, and the resource identifier is compared with the total number of resources allocated to the target user; If the number of resource identifiers exceeds the total number of resources, the resource validity check is determined to have failed, and a second type of abnormal interruption information is generated.

[0108] Based on any of the above embodiments, the interruption security attribute checking module is specifically used for: If both the user legitimacy check and the resource legitimacy check pass, the corresponding global context identifier is obtained by mapping based on the user identifier and the resource identifier; Retrieve the global context security attribute configured for the global context identifier from the system register; Compare whether the first security attribute is consistent with the global context security attribute. If they are inconsistent, it is determined that the security attribute check has failed, and a third type of exception interruption information is generated.

[0109] Based on any of the above embodiments, the interrupt sending module is specifically used for: Obtain the second security attribute of the target interrupt storage area configured by the system for the target user; Compare whether the first security attribute and the second security attribute are consistent. If they are inconsistent, it is determined that the second-stage verification has failed, and a fourth type of exception interruption information is generated.

[0110] Based on any of the above embodiments, the abnormal interruption information includes a verification failure reason code, and the abnormal interruption information is any one of the first type of abnormal interruption information, the second type of abnormal interruption information, the third type of abnormal interruption information, and the fourth type of abnormal interruption information.

[0111] Based on any of the above embodiments Figure 5 This is a schematic diagram of the interrupt control system provided by the present invention, as shown below. Figure 5 As shown, the system includes a host computer and an artificial intelligence chip as described in any of the above embodiments; The host includes an interrupt storage area, which is divided into a normal interrupt storage area and an abnormal interrupt storage area, and the interrupt storage area is configured with corresponding security attributes. The artificial intelligence chip is communicatively connected to the host and is used to perform multi-level hardware verification of legality and security attributes before the interrupt is sent. Based on the verification results, it sends compliant interrupt request information to the normal interrupt storage area or abnormal interrupt information to the abnormal interrupt storage area.

[0112] Specifically, the interrupt control system provided in this embodiment of the invention includes a host and an artificial intelligence chip, which are communicatively connected and work together to perform security verification, classification routing, and reception processing of interrupts. This interrupt control system is suitable for virtualized deployment scenarios with multiple users and multiple tasks. In this scenario, the artificial intelligence chip is divided into multiple virtual functions through virtualization technology and allocated to different users. Interrupt requests generated by each user's hardware resources during operation must be sent to the host for further processing after security verification. The overall security protection logic of the system is jointly composed of the hardware verification module on the artificial intelligence chip and the interrupt storage area division mechanism on the host. That is, the artificial intelligence chip is responsible for multi-level verification and classification routing before interrupts are sent, and the host is responsible for receiving and storing compliant interrupts and abnormal interrupts respectively according to the verification results.

[0113] The host is a computing device that communicates with the artificial intelligence chip. It can be a server, personal computer, embedded controller, or other electronic device with computing and storage capabilities. The host can run an operating system and virtualization management software such as a hypervisor, which is responsible for configuring and allocating virtual functions, handling interrupts, and managing the overall system security policy.

[0114] The host includes an interrupt storage area located in the host memory. This area is specifically designed to receive and store interrupt information from the AI ​​chip. The interrupt storage area is divided into two physically isolated sub-areas: a normal interrupt storage area and an abnormal interrupt storage area. The normal interrupt storage area receives interrupt requests that have been verified as compliant by the AI ​​chip at multiple levels. The host-side interrupt handler reads the interrupt information from this area and executes the corresponding processing actions (such as task scheduling and data transfer completion confirmation) according to the normal process. The abnormal interrupt storage area receives abnormal interrupt information that has failed verification by the AI ​​chip. The host-side security management program can read abnormal interrupt information from this area and perform abnormal handling operations such as fault tracing, alarm triggering, or malicious user isolation based on the verification failure reason code carried within. The normal and abnormal interrupt storage areas are isolated from each other; abnormal interrupt information will not enter the normal interrupt storage area, and normal interrupt request information will not be misrouted to the abnormal interrupt storage area, thus ensuring the purity of the normal interrupt handling process and the integrity of the abnormal information recording.

[0115] Furthermore, the interrupt storage area is configured with corresponding security attributes. During system initialization or virtualization configuration, the hypervisor or system management software sets security attributes for each interrupt storage area through the system configuration interface, indicating whether the storage area belongs to a secure storage area or a non-secure storage area. Secure storage areas are specifically used to receive secure interrupt information, while non-secure storage areas are used to receive non-secure interrupt information. The security attributes configured for the interrupt storage areas are the second security attributes described in the aforementioned embodiments. This attribute serves as the comparison benchmark for the target-side security attributes during the second-stage verification performed on the AI ​​chip. The system can configure corresponding target interrupt storage areas and security attributes for different users to meet their varying security level requirements.

[0116] The AI ​​chip communicates with the host computer, and the communication link between them can be implemented through a PCIe bus or other suitable high-speed interconnect channels. The AI ​​chip internally includes an interrupt security attribute checking module and an interrupt transmission module, which perform multi-level hardware verification of legality and security attributes before interrupt transmission. The specific verification process can be referred to the above embodiments and will not be repeated here.

[0117] The interrupt control system provided in this invention constructs a secure protection architecture encompassing interrupt generation, verification, routing, and reception storage through the collaborative efforts of the AI ​​chip and the host. The AI ​​chip handles multi-level hardware verification before interrupt transmission, performing core interception, verification, mapping, classification, and routing logic in hardware on the chip itself. This eliminates the need for host software to participate in verification decisions, thus avoiding potential software-level attacks or bypasses. The host provides structured storage support for receiving chip-side verification results by dividing the interrupt storage area into physically isolated sub-regions (normal and abnormal) and configuring corresponding security attributes. This system architecture enables each user-generated interrupt to undergo independent security checks in multi-user, multi-tasking virtualization scenarios, thereby maximizing the data security, functional safety, and compliance of the entire chip system.

[0118] Figure 6 An example is a schematic diagram of the physical structure of an electronic device, such as... Figure 6 As shown, the electronic device may include: a processor 610, a communication interface 620, a memory 630, and a communication bus 640, wherein the processor 610, the communication interface 620, and the memory 630 communicate with each other through the communication bus 640. The processor 610 can call logical instructions in the memory 630 to execute an interrupt control method, which includes: receiving interrupt request information initiated by a target user, the interrupt request information including at least a first security attribute; performing a first-stage verification on the interrupt request information, the first-stage verification including at least a legality check on the source of the interrupt request information; if the first-stage verification passes, performing a second-stage verification on the interrupt request information, the second-stage verification being used to determine whether the first security attribute matches a second security attribute of a target interrupt storage area of ​​the host; and, based on the combined verification result of the first-stage verification and the second-stage verification, distributing the interrupt request information or corresponding generated abnormal interrupt information to the corresponding interrupt storage area of ​​the host, wherein if all stages of verification pass, the interrupt request information is sent to the normal interrupt storage area of ​​the host; if any stage verification fails, the generated abnormal interrupt information is sent to the abnormal interrupt storage area of ​​the host.

[0119] Furthermore, the logical instructions in the aforementioned memory 630 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to related technologies, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0120] On the other hand, the present invention also provides a computer program product, which includes a computer program that can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the interrupt control method provided by the above methods. The method includes: receiving interrupt request information initiated by a target user, the interrupt request information including at least a first security attribute; performing a first-stage verification on the interrupt request information, the first-stage verification including at least a legality check on the source of the interrupt request information; if the first-stage verification passes, performing a second-stage verification on the interrupt request information, the second-stage verification being used to determine whether the first security attribute matches a second security attribute of a target interrupt storage area of ​​the host; and distributing the interrupt request information or corresponding generated abnormal interrupt information to the corresponding interrupt storage area of ​​the host according to the comprehensive verification result of the first-stage verification and the second-stage verification, wherein if all stages of verification pass, the interrupt request information is sent to the normal interrupt storage area of ​​the host; if any stage verification fails, the generated abnormal interrupt information is sent to the abnormal interrupt storage area of ​​the host.

[0121] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon, which, when executed by a processor, implements the interrupt control method provided by the above methods. The method includes: receiving interrupt request information initiated by a target user, the interrupt request information including at least a first security attribute; performing a first-stage verification on the interrupt request information, the first-stage verification including at least a legality check on the source of the interrupt request information; if the first-stage verification passes, performing a second-stage verification on the interrupt request information, the second-stage verification being used to determine whether the first security attribute matches a second security attribute of a target interrupt storage area of ​​the host; and distributing the interrupt request information or corresponding generated abnormal interrupt information to the corresponding interrupt storage area of ​​the host according to the comprehensive verification result of the first-stage verification and the second-stage verification, wherein if all stage verifications pass, the interrupt request information is sent to the normal interrupt storage area of ​​the host; if any stage verification fails, the generated abnormal interrupt information is sent to the abnormal interrupt storage area of ​​the host.

[0122] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0123] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the parts that contribute to the related technology, can be embodied in the form of software products. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0124] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An interrupt control method characterized by, Applications in artificial intelligence chips, including: Receive interruption request information initiated by the target user, wherein the interruption request information includes at least a first security attribute; The interruption request information is subjected to a first-stage verification, which includes at least a legality check on the source of the interruption request information. If the first stage verification passes, the interrupt request information is subjected to a second stage verification. The second stage verification is used to determine whether the first security attribute matches the second security attribute of the host's target interrupt storage area. Based on the combined verification results of the first stage verification and the second stage verification, the interrupt request information or the corresponding generated abnormal interrupt information is distributed to the corresponding interrupt storage area of ​​the host. If all stages of verification pass, the interrupt request information is sent to the normal interrupt storage area of ​​the host; if any stage verification fails, the generated abnormal interrupt information is sent to the abnormal interrupt storage area of ​​the host.

2. The interrupt control method according to claim 1, characterized by, The interruption request information also includes a user identifier and a resource identifier. The first-stage verification of the interruption request information includes: Based on the user identifier and the resource identifier, the source of the interruption request information is checked for legality. If the legality check passes, a consistency check is performed based on the first security attribute and the global context security attribute.

3. The interrupt control method according to claim 2, wherein The legitimacy check includes user legitimacy check and resource legitimacy check. The legitimacy check of the source of the interruption request information based on the user identifier and the resource identifier includes: The user identifier is compared with the number of legal users configured in the system. If the user identifier exceeds the number of legal users, the user's legality check is determined to have failed, and a first type of exception interruption information is generated. If the user identifier does not exceed the number of legitimate users, then the user's legitimacy check is deemed to have passed, and the resource identifier is compared with the total number of resources allocated to the target user; If the number of resource identifiers exceeds the total number of resources, the resource validity check is determined to have failed, and a second type of abnormal interruption information is generated.

4. The interrupt control method according to claim 3, wherein If the legality check passes, the consistency check based on the first security attribute and the global context security attribute includes: If both the user legitimacy check and the resource legitimacy check pass, the corresponding global context identifier is obtained by mapping based on the user identifier and the resource identifier; Retrieve the global context security attribute configured for the global context identifier from the system register; Compare whether the first security attribute is consistent with the global context security attribute. If they are inconsistent, it is determined that the security attribute check has failed, and a third type of exception interruption information is generated.

5. The interrupt control method according to claim 1, characterized in that, The second-stage verification of the interruption request information includes: Obtain the second security attribute of the target interrupt storage area configured by the system for the target user; Compare whether the first security attribute and the second security attribute are consistent. If they are inconsistent, it is determined that the second-stage verification has failed, and a fourth type of exception interruption information is generated.

6. The interruption control method according to any one of claims 1 to 5, characterized in that, The abnormal interruption information includes a verification failure reason code, and the abnormal interruption information is any one of the first type of abnormal interruption information, the second type of abnormal interruption information, the third type of abnormal interruption information, and the fourth type of abnormal interruption information.

7. An artificial intelligence chip, characterized in that, include: An interruption security attribute checking module is used to receive interruption request information initiated by a target user and perform a first-stage verification on the interruption request information. The interruption request information includes at least a first security attribute, and the first-stage verification includes at least a legality check on the source of the interruption request information. An interrupt sending module, connected to the interrupt security attribute checking module, is used to perform a second-stage verification on the interrupt request information if the first-stage verification passes, and to distribute the interrupt request information or the corresponding generated abnormal interrupt information to the corresponding interrupt storage area of ​​the host based on the comprehensive verification results of the first-stage verification and the second-stage verification. The second stage verification is used to determine whether the first security attribute matches the second security attribute of the target interrupt storage area of ​​the host. If all stages of verification pass, the interrupt request information is sent to the normal interrupt storage area of ​​the host; if any stage verification fails, the generated abnormal interrupt information is sent to the abnormal interrupt storage area of ​​the host.

8. The artificial intelligence chip according to claim 7, characterized in that, The interrupt security attribute checking module is specifically used for: If the first stage verification passes, the interrupt request information is output to the interrupt sending module; If the first-stage verification fails, an abnormal interruption message containing the verification failure reason code will be output to the interruption sending module.

9. An interrupt control system, characterized in that, Includes the host computer and the artificial intelligence chip as described in claim 7 or 8; The host includes an interrupt storage area, which is divided into a normal interrupt storage area and an abnormal interrupt storage area, and the interrupt storage area is configured with corresponding security attributes. The artificial intelligence chip is communicatively connected to the host and is used to perform multi-level hardware verification of legality and security attributes before the interrupt is sent. Based on the verification results, it sends compliant interrupt request information to the normal interrupt storage area or abnormal interrupt information to the abnormal interrupt storage area.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the interrupt control method as described in any one of claims 1 to 6.

11. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the interrupt control method as described in any one of claims 1 to 6.

12. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the interrupt control method as described in any one of claims 1 to 6.

Images