feat: add confidential compute gpu certificate functionality

nvml-wrapper/src/device.rs

@@ -791,6 +791,39 @@
         }
     }
 
+    /**
+    Gets the confidential compute GPU certificate for this `Device`.
+
+    # Errors
+
+    * `Uninitialized` if the library has not been successfully initialized
+    * `InvalidArg` if device is invalid or memory is NULL
+    * `NotSupported` if this query is not supported by the device
+    * `Unknown` on any unexpected error
+    */
+    pub fn confidential_compute_gpu_certificate(
+        &self,
+    ) -> Result<ConfidentialComputeGpuCertificate, NvmlError> {
+        let sym = nvml_sym(
+            self.nvml
+                .lib
+                .nvmlDeviceGetConfComputeGpuCertificate
+                .as_ref(),
+        )?;
+
+        unsafe {
+            let mut certificate_chain: nvmlConfComputeGpuCertificate_t = mem::zeroed();
+            nvml_try(sym(self.device, &mut certificate_chain))?;
+
+            Ok(ConfidentialComputeGpuCertificate {
+                cert_chain_size: certificate_chain.certChainSize,
+                attestation_cert_chain_size: certificate_chain.attestationCertChainSize,
+                cert_chain: certificate_chain.certChain.to_vec(),
+                attestation_cert_chain: certificate_chain.attestationCertChain.to_vec(),
+            })
+        }
+    }
+
     /**
     Gets the current PCIe link generation.
 
@@ -3167,7 +3200,7 @@
 
     * `Uninitialized`, if the library has not been successfully initialized
     * `IncorrectBits`, if NVML returns any bits that do not correspond to flags in
     `ThrottleReasons`
     * `GpuLost`, if this `Device` has fallen off the bus or is otherwise inaccessible
     * `Unknown`, on any unexpected error
 
@@ -4162,7 +4195,7 @@
     * `Uninitialized`, if the library has not been successfully initialized
     * `InvalidArg`, if the `Device` is invalid
     * `NotSupported`, if this `Device` does not support this feature or accounting mode
     is disabled
     * `Unknown`, on any unexpected error
 
     # Device Support
@@ -4224,7 +4257,7 @@
     * `Uninitialized`, if the library has not been successfully initialized
     * `InvalidArg`, if the `Device` is invalid
     * `NotSupported`, if this `Device` does not support this feature or accounting
     mode is disabled
     * `Unknown`, on any unexpected error
     */
     // Checked against local
@@ -4281,9 +4314,9 @@
     Note:
     * Accounting mode needs to be on. See `.is_accounting_enabled()`.
     * Only compute and graphics applications stats can be queried. Monitoring
     applications can't be queried since they don't contribute to GPU utilization.
     * If a PID collision occurs, the stats of the latest process (the one that
     terminated last) will be reported.
 
     # Errors
 
@@ -4291,7 +4324,7 @@
     * `InvalidArg`, if the `Device` is invalid
     * `NotFound`, if the process stats were not found
     * `NotSupported`, if this `Device` does not support this feature or accounting
     mode is disabled
     * `Unknown`, on any unexpected error
 
     # Device Support
@@ -4325,8 +4358,8 @@
 
     Note:
     * This setting is not persistent and will default to disabled after the driver
     unloads. Enable persistence mode to be sure the setting doesn't switch off
     to disabled.
     * Enabling accounting mode has no negative impact on GPU performance.
     * Disabling accounting clears accounting information for all PIDs
 
@@ -4399,8 +4432,8 @@
     * `Uninitialized`, if the library has not been successfully initialized
     * `InvalidArg`, if the `Device` is invalid or `api_type` is invalid (shouldn't occur?)
     * `NotSupported`, if this `Device` does not support changing API restrictions or
     this `Device` does not support the feature that API restrictions are being set for
     (e.g. enabling/disabling auto boosted clocks is not supported by this `Device`).
     * `NoPermission`, if the user doesn't have permission to perform this operation
     * `GpuLost`, if this `Device` has fallen off the bus or is otherwise inaccessible
     * `Unknown`, on any unexpected error

nvml-wrapper/src/structs/device.rs

@@ -22,6 +22,22 @@ pub struct ConfidentialComputeGpuAttestationReport {
     pub cec_attestation_report: Vec<u8>,
 }
 
+/// Returned from `Device.confidential_compute_gpu_certificate()`
+#[derive(Debug, Clone, Eq, PartialEq, Hash)]
+#[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]
+pub struct ConfidentialComputeGpuCertificate {
+    /// The size of the certificate chain.
+    pub cert_chain_size: u32,
+    /// The size of the attestation certificate chain.
+    pub attestation_cert_chain_size: u32,
+    /// The certificate chain, of size
+    /// `ffi::bindings::NVML_GPU_CERT_CHAIN_SIZE` == 4096 bytes.
+    pub cert_chain: Vec<u8>,
+    /// The attestation certificate chain, of size
+    /// `ffi::bindings::NVML_GPU_ATTESTATION_CERT_CHAIN_SIZE` == 5120 bytes.
+    pub attestation_cert_chain: Vec<u8>,
+}
+
 /// Returned from `Device.auto_boosted_clocks_enabled()`
 #[derive(Debug, Clone, Eq, PartialEq, Hash)]
 #[cfg_attr(feature = "serde", derive(Serialize, Deserialize))]