NVIDIA nvTrust

The NVIDIA Attestation SDK provides Python APIs for integrating attestation capabilities into applications. It is used to ensure the authenticity, integrity, and trustworthiness of a system through:

• Local and Remote GPU Attestation
• Local and Remote NVSwitch Attestation

The host_tools directory contains utilities designed to run on the host machine to manage NVIDIA GPU Confidential Computing (CC) configurations and orchestrate Confidential Virtual Machines (CVMs).

Key capabilities include:

• GPU CC Mode Configuration: Scripts to set the operating modes for NVIDIA GPUs to support Confidential Computing.
• CVM Orchestration: KVM sample scripts used to launch and manage Confidential VMs from the host environment.
• Deployment Staging: Folders containing assets and configurations required for following the official Deployment Guides located in the docs/ directory.

The Linux kernel source used for NVIDIA Confidential Compute is forked from the AMDSEV repository. Specifically, it is based on the following branch:

https://github.com/AMDESE/linux/tree/sev-snp-iommu-avic_5.19-rc6_v4

The Protected PCIE (PPCIE) Verifier is used in multi-GPU Confidential Computing (CC) setups to minimize performance impact.

In standard CC mode, all data flowing over NVLink/NVSwitches must be encrypted/decrypted by the GPU Copy Engine (CE), which can add latency. PPCIE mode adjusts the security model to trust NVLink data, allowing plain-text traffic without CEs while still preserving a Confidential Virtual Machine.

Supported GPU Configurations:

• CC Mode: All GPUs are in CC mode. Each GPU can be assigned to one Confidential VM. Use the CC verifier for this.
• PPCIE Mode: All GPUs are in PPCIE mode. All GPUs must be assigned to a single Confidential VM. Use the PPCIE verifier for this.

In multi-GPU Confidential Computing (CC) setups, NVLink and NVSwitches are typically outside the trust boundary. Standard CC mode requires all data flowing over NVLink to be encrypted/decrypted by the GPU Copy Engine (CE), which can introduce latency and performance drops.

PPCIE mode adjusts the security model to trust NVLink data. This enables plain-text traffic without requiring CEs, minimizing performance impact while still preserving a Confidential Virtual Machine.

GPU Usage Configurations:

• CC Mode: Use the CC verifier when all GPUs are in CC mode (each GPU can be assigned to one Confidential VM).
• PPCIE Mode: Use the PPCIE verifier when all GPUs are in PPCIE mode (all GPUs must be assigned to one single Confidential VM).

To begin working with NVIDIA Attestation, use the following resources:

• General Documentation: NVIDIA Attestation docs
• Quick Start: Quick Start Guide for rapid setup.
• Production Deployment: Deployment Guide for moving from POC to production.
• Python SDK Docs: Attestation SDK (Python) Documentation.
• PPCIE Verifier Docs: PPCIE Verifier Documentation.

NVTrust requires all contributors to "sign-off" on their commits to certify the Developer Certificate of Origin (DCO). Any contribution containing commits that are not Signed-Off will not be accepted.

To sign off on a commit, use the --signoff or -s flag during the commit process. This appends a Signed-off-by: Your Name <your@email.com> line to your commit message.

git commit -s -m "Add cool feature."

The following patches are provided to address issues related to IOMMU (specifically addressing AMDSEV issue #109) within the Linux kernel source:

• iommu_pagefault.patch
• iommu_pagesize.patch

For detailed technical information, use the following resources:

• Comprehensive Documentation: Visit the RIM Service Documentation for in-depth details on RIM architecture, API specifications, and deployment procedures.
• Usage Examples: Refer to the RIM Guide for practical examples, including how to request RIM bundles using curl and how to work with sample RIM files.

To install the deprecated version 1.x of the PPCIE Verifier, you must have root privileges to set the GPU ready state. It is recommended to use a Python virtual environment.

Prerequisites:

• HGX system with 8 GPUs and 4 switches assigned to the single tenant
• python >= 3.9
• git installed
• Nvidia GPU driver installed
• Nvidia Switch driver installed
• Nvidia Fabric Manager installed

Note: Version 1.x only supports the Python SDK. For the latest version 2.x with enhanced features, use the PPCIE Verifier SDK CPP instead.

# Elevate to root to set GPU ready state
sudo -i

# Create and activate virtual environment
python3 -m venv venv
source venv/bin/activate

# Install version 1.x from PyPi
pip3 install "nv-ppcie-verifier>=1.0,<2.0"