What do "Driver" measurements from NVIDIA RIM Service actually measure?

[abrandao]

I am currently investigating the Confidential Compute capabilities of the Hopper architecture and trying to understand the full attestation flow. Based on my understanding, the general attestation process works as follows:

1. Generate a nonce.
2. Request NVML/driver to generate an attestation report:
   1. NVML forwards the request to the driver.
   2. The driver requests the GSP to provide signed measurements via libspdm_get_measurement_ex
3. Request the GPU certificate from NVML/driver.
4. Validate the GPU certificate chain (e.g., check OCSP, etc.).
5. Verify the attestation report’s signature against the GPU certificate.
6. Validate the measurements (driver + VBIOS) in the attestation report against the RIM manifest files.

From reviewing the attestation SDK source code at NVIDIA/nvtrust, it appears that the attestation report includes measurements for both the driver and VBIOS. I understand why and how VBIOS measurements would be included, as they come directly from the GPU, but it’s unclear to me on how the driver measurements would come from the GPU’s attestation report.

I initially assumed that the driver manifest contained simple hashes (or some derivative) of the NVIDIA kernel modules. However, after compiling and loading a modified kernel module (to investigate another area), I was surprised to find that RIM verification still passed. This led me to question how the driver measurements are generated.

Is there a step in the SPDM negotiation process that I may have overlooked? More specifically, what exactly (or even vaguely, if full disclosure isn’t possible) does the driver RIM manifest refer to? Additionally, is there any way to reproduce these measurements independently without querying the GPU?

[sbellock]

@abrandao

it appears that the attestation report includes measurements for both the driver and VBIOS.

GPU microcontrollers run firmware that is loaded via FLASH (VBIOS) and loaded via the kernel driver (nvidia.ko). The GPU firmware (usually in /lib/firmware/nvidia/) loaded by the kernel driver is included in the VM image and is presumably part of the measurement of the VM image. The driver-loaded firmware is loaded onto the GPU, and the GPU measurements, including VBIOS, fuses, and driver-loaded firmware, are signed by the GPU and retrieved by the kernel driver. NVIDIA Attestation does not check the kernel driver directly.

[abrandao]

This makes sense, thank you for the clarification.

So, to ensure the integrity and authenticity of the kernel driver itself, it would need to be verified as part of the CPU attestation process—potentially through mechanisms like IMA or dm-verity. This would be necessary to guarantee that the kernel driver hasn’t been tampered with, ensuring the confidentiality of the derived keys when the SPDM session is established.