NVIDIA / NVIDIA/nvtrust

Fetch_rim_file call timed out cause GPU Attestation failed

Open
#99 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

lifecycle/stale
Dominant language
Python
Stars
323
Forks
61
PR merge metrics
No merged PRs in 30d

Description

When i following the link(https://github.com/NVIDIA/nvtrust/tree/main/guest_tools) to execute GPU attestation. It reports errors as below:
(nvAttest) root@tdx:/share/nvtrust/guest_tools/attestation_sdk/tests/end_to_end/hardware# ls
attestation_sdk.log LocalSwitchTest.py SmallCombinedTest.py
AttestationTest.py RemoteGPUTest.py SmallFauxTest.py
LocalGPUTest.py RemoteMultiGpuSwitchTest.py verifier.log
LocalMultiGpuSwitchTest.py RemoteSwitchTest.py
(nvAttest) root@gmitdx:/share/nvtrust/guest_tools/attestation_sdk/tests/end_to_end/hardware# python LocalGPUTest.py
[LocalGPUTest] node name : thisNode1
[['LOCAL_GPU_CLAIMS', <Devices.GPU: 2>, <Environment.LOCAL: 2>, '', '', '', 'https://ocsp.ndis.nvidia.com/', 'https://rim.attestation.nvidia.com/v1/rim/']]
[LocalGPUTest] call get_evidence()
Nonce generated: 931d8dd0add203ac3d8b4fbde75e115278eefcdceac5b87671a748f32364dfcb
Number of GPUs available : 1
Fetching GPU 0 information from GPU driver.
All GPU Evidences fetched successfully
[LocalGPUTest] call attest() - expecting True

Verifying GPU: GPU-6fd16e94-92dc-ef85-96ff-5713adb4f774
Driver version fetched : 550.144.03
VBIOS version fetched : 96.00.99.00.01
Validating GPU certificate chains.
The firmware ID in the device certificate chain is matching with the one in the attestation report.
GPU attestation report certificate chain validation successful.
The certificate chain revocation status verification successful.
Authenticating attestation report
The nonce in the SPDM GET MEASUREMENT request message is matching with the generated nonce.
Driver version fetched from the attestation report : 550.144.03
VBIOS version fetched from the attestation report : 96.00.99.00.01
Attestation report signature verification successful.
Attestation report verification successful.
Authenticating the RIMs.
Authenticating Driver RIM
Fetching the driver RIM from the RIM service.
RIM Schema validation passed.
driver RIM certificate chain verification successful.
The certificate chain revocation status verification successful.
driver RIM signature verification successful.
Driver RIM verification successful
Authenticating VBIOS RIM.
Fetching the VBIOS RIM from the RIM service.
Could not fetch RIM file from RIM service with id : NV_GPU_VBIOS_G520_0200_885_9600990001
Error occurred while fetching the vbios RIM from the RIM service due to The fetch_rim_file call timed out.
GPU Attestation failed.
[LocalGPUTest] call attest() - result : False
[LocalGPUTest] token : [["JWT", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJOVi1BdHRlc3RhdGlvbi1TREsiLCJpYXQiOjE3NDM1OTc4OTQsImV4cCI6MTc0MzYwMTQ5NCwibmJmIjoxNzQzNTk3Nzc0LCJqdGkiOiI2ZWYzNjUwOS1iZWZhLTQwMjUtYWNiNi04Nzc4MTdiYTk0OWEifQ.4zYxq-BKITdnG6Za0TRmQiqTm7lzv2dlUU14QJUvQaI"], {"LOCAL_GPU_CLAIMS": [["JWT", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJOVklESUEtUExBVEZPUk0tQVRURVNUQVRJT04iLCJuYmYiOjE3NDM1OTc3NzQsImV4cCI6MTc0MzYwMTQ5NCwiaWF0IjoxNzQzNTk3ODk0LCJqdGkiOiI3ODk5OWZmMS02MjNlLTQ4Y2QtYmZhZi1iOGE5YmM1NTUyN2EiLCJ4LW52aWRpYS12ZXIiOiIyLjAiLCJpc3MiOiJMT0NBTF9HUFVfVkVSSUZJRVIiLCJ4LW52aWRpYS1vdmVyYWxsLWF0dC1yZXN1bHQiOmZhbHNlLCJzdWJtb2RzIjp7fSwiZWF0X25vbmNlIjoiOTMxZDhkZDBhZGQyMDNhYzNkOGI0ZmJkZTc1ZTExNTI3OGVlZmNkY2VhYzViODc2NzFhNzQ4ZjMyMzY0ZGZjYiJ9.eNFGzn3XERTpnwDyz6YYssGh-VfnLeinm6Iu0REv69k"], {}]}]
[LocalGPUTest] call validate_token() - expecting True
[ERROR] Invalid token. Authorized claims does not match the appraisal policy: x-nvidia-overall-att-result
[LocalGPUTest] call validate_token() - result: False

Environment:
Host OS: Ubuntu 24.04 TDX(6.9.0.rc5 kernel);
Guest OS: Ubuntu 24.04.02 TDX guest(6.8.05 kernel);
nvtrust version: Release/v2.3.0 (#96)

root@tdx:/share/nvtrust# git log
commit c04e5ace8cbbd9a714055f62d12db924f271fd82 (HEAD -> main, origin/main, origin/HEAD)
Author: thisiskarthikj <kjayaraman@nvidia.com>
Date: Wed Mar 26 16:38:05 2025 -0700
Added licensing clauses to the README files (#98)
* Added licensing clauses to the README files
commit 368b9f95cf6a33e161ca8c0aac8a4c9528ea6ae7 (tag: 2025.2.27.001)
Author: thisiskarthikj <kjayaraman@nvidia.com>
Date: Thu Feb 27 16:54:03 2025 -0800
Release/v2.3.0 (#96)
-Add ability to disable OCSP nonce validation via command line flag

Could you please help give any hint to this issue?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with attestation_sdk/tests/end_to_end/hardware/LocalGPUTest.py and follow its get_evidence(), attest(), and validate_token() calls. Investigate the VBIOS RIM fetch for NV_GPU_VBIOS_G520_0200_885_9600990001 and the reported timeout from the RIM service. Done means the VBIOS RIM is fetched successfully and GPU attestation completes without the invalid-token result.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.