Measuring GPU device firmware
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 35/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Stale
- Domain
- operating-systems, security
Research direction
Start by reviewing the related Dasharo issue 1087 and the linked OptionROM discussion before assessing the proposed approach. The request considers an authenticated Nvidia flash reader, GPU ROM/flash measurement, TPM authentication, and user notification on failure; done would require a decided implementation path for these steps.
Written by the indexing model from the issue text.
Description
Is your feature request related to a problem? Please describe.
I was thinking about buying a new laptop with a GPU and use it with Qubes.
But in the https://github.com/Dasharo/dasharo-issues/issues/1087 @marmarek is rightfully concerned that a VM which has control over the GPU could flash the firmware of it.
I was wondering if it would be possible to authenticate the GPU ROM/flash content hash as well.
I assume reading the GPU flash requires a proprietary Nvidia binary. But it could be authenticated as well before it is run.
Describe the solution you'd like
- Add Nvidia flash reader as blob
- On boot:
- authenticate flash reader
- read and hash GPU ROM/flash content
- authenticate hash with TPM
- On failure inform the user about it.
Describe alternatives you've considered
- Measuring the OptionROM (vendor provided driver on the PCI device for UEFI (intro: https://blog.davidv.dev/posts/pcie-option-rom/ and
EFI_DEFERRED_IMAGE_LOAD_PROTOCOLdocs: https://uefi.org/specs/UEFI/2.10/36_User_Identification.html?highlight=efi_deferred_image_load_protocol#deferred-execution)): https://github.com/linuxboot/heads/issues/2004#issuecomment-3362712961 - Trust the authentication the GPU does before it writes it's flash.
- Yolo into it and ignore the security hole.
Additional context
- Dominant language
- Makefile
- Stars
- 1.6k
- Forks
- 211
- Avg merge
- 3d 19h
- Merged PRs (30d)
- 5
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from linuxboot/heads
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Difficulty 1/5 Under an hour Newbie friendliness 90/100
-
Difficulty 1/5 Under an hour Newbie friendliness 65/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
-
help wanted security SMM upstream
Difficulty 5/5 Over a week Newbie friendliness 25/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 62/100
AiursoftWeb/AnduinOS-2#19 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
C-API-request
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100