这是indexloc提供的服务,不要输入任何密码
Skip to content

Fetch_rim_file call timed out cause GPU Attestation failed #99

@zhiminghufighting

Description

@zhiminghufighting

When i following the link(https://github.com/NVIDIA/nvtrust/tree/main/guest_tools) to execute GPU attestation. It reports errors as below:
(nvAttest) root@tdx:/share/nvtrust/guest_tools/attestation_sdk/tests/end_to_end/hardware# ls
attestation_sdk.log LocalSwitchTest.py SmallCombinedTest.py
AttestationTest.py RemoteGPUTest.py SmallFauxTest.py
LocalGPUTest.py RemoteMultiGpuSwitchTest.py verifier.log
LocalMultiGpuSwitchTest.py RemoteSwitchTest.py
(nvAttest) root@gmitdx:/share/nvtrust/guest_tools/attestation_sdk/tests/end_to_end/hardware# python LocalGPUTest.py
[LocalGPUTest] node name : thisNode1
[['LOCAL_GPU_CLAIMS', <Devices.GPU: 2>, <Environment.LOCAL: 2>, '', '', '', 'https://ocsp.ndis.nvidia.com/', 'https://rim.attestation.nvidia.com/v1/rim/']]
[LocalGPUTest] call get_evidence()
Nonce generated: 931d8dd0add203ac3d8b4fbde75e115278eefcdceac5b87671a748f32364dfcb
Number of GPUs available : 1
Fetching GPU 0 information from GPU driver.
All GPU Evidences fetched successfully
[LocalGPUTest] call attest() - expecting True

Verifying GPU: GPU-6fd16e94-92dc-ef85-96ff-5713adb4f774
Driver version fetched : 550.144.03
VBIOS version fetched : 96.00.99.00.01
Validating GPU certificate chains.
The firmware ID in the device certificate chain is matching with the one in the attestation report.
GPU attestation report certificate chain validation successful.
The certificate chain revocation status verification successful.
Authenticating attestation report
The nonce in the SPDM GET MEASUREMENT request message is matching with the generated nonce.
Driver version fetched from the attestation report : 550.144.03
VBIOS version fetched from the attestation report : 96.00.99.00.01
Attestation report signature verification successful.
Attestation report verification successful.
Authenticating the RIMs.
Authenticating Driver RIM
Fetching the driver RIM from the RIM service.
RIM Schema validation passed.
driver RIM certificate chain verification successful.
The certificate chain revocation status verification successful.
driver RIM signature verification successful.
Driver RIM verification successful
Authenticating VBIOS RIM.
Fetching the VBIOS RIM from the RIM service.
Could not fetch RIM file from RIM service with id : NV_GPU_VBIOS_G520_0200_885_9600990001
Error occurred while fetching the vbios RIM from the RIM service due to The fetch_rim_file call timed out.
GPU Attestation failed.
[LocalGPUTest] call attest() - result : False
[LocalGPUTest] token : [["JWT", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJOVi1BdHRlc3RhdGlvbi1TREsiLCJpYXQiOjE3NDM1OTc4OTQsImV4cCI6MTc0MzYwMTQ5NCwibmJmIjoxNzQzNTk3Nzc0LCJqdGkiOiI2ZWYzNjUwOS1iZWZhLTQwMjUtYWNiNi04Nzc4MTdiYTk0OWEifQ.4zYxq-BKITdnG6Za0TRmQiqTm7lzv2dlUU14QJUvQaI"], {"LOCAL_GPU_CLAIMS": [["JWT", "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiJOVklESUEtUExBVEZPUk0tQVRURVNUQVRJT04iLCJuYmYiOjE3NDM1OTc3NzQsImV4cCI6MTc0MzYwMTQ5NCwiaWF0IjoxNzQzNTk3ODk0LCJqdGkiOiI3ODk5OWZmMS02MjNlLTQ4Y2QtYmZhZi1iOGE5YmM1NTUyN2EiLCJ4LW52aWRpYS12ZXIiOiIyLjAiLCJpc3MiOiJMT0NBTF9HUFVfVkVSSUZJRVIiLCJ4LW52aWRpYS1vdmVyYWxsLWF0dC1yZXN1bHQiOmZhbHNlLCJzdWJtb2RzIjp7fSwiZWF0X25vbmNlIjoiOTMxZDhkZDBhZGQyMDNhYzNkOGI0ZmJkZTc1ZTExNTI3OGVlZmNkY2VhYzViODc2NzFhNzQ4ZjMyMzY0ZGZjYiJ9.eNFGzn3XERTpnwDyz6YYssGh-VfnLeinm6Iu0REv69k"], {}]}]
[LocalGPUTest] call validate_token() - expecting True
[ERROR] Invalid token. Authorized claims does not match the appraisal policy: x-nvidia-overall-att-result
[LocalGPUTest] call validate_token() - result: False

Environment:
Host OS: Ubuntu 24.04 TDX(6.9.0.rc5 kernel);
Guest OS: Ubuntu 24.04.02 TDX guest(6.8.05 kernel);
nvtrust version: Release/v2.3.0 (#96)

root@tdx:/share/nvtrust# git log
commit c04e5ac (HEAD -> main, origin/main, origin/HEAD)
Author: thisiskarthikj <kjayaraman@nvidia.com>
Date: Wed Mar 26 16:38:05 2025 -0700
Added licensing clauses to the README files (#98)
* Added licensing clauses to the README files
commit 368b9f9 (tag: 2025.2.27.001)
Author: thisiskarthikj <kjayaraman@nvidia.com>
Date: Thu Feb 27 16:54:03 2025 -0800
Release/v2.3.0 (#96)
-Add ability to disable OCSP nonce validation via command line flag

Could you please help give any hint to this issue?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions