Skip to content

ADR 0004 — Real read-only NVIDIA provider and GPU simulation

Status: accepted — consumer-card discovery + MIG child enumeration + sharing-config resolution · Date: 2026-10-02

Context

A real, read-only NVIDIA discovery adapter must run against actual hardware, record exact observed fields, leave missing fields unknown, and still let all other tests run without a GPU. The only card available is a consumer GeForce RTX 3070 (via WSL2) — no MIG, no datacenter attestation.

Decision

  1. Collector = bounded nvidia-smi query: nvidia-smi --query-gpu=uuid,name,pci.bus_id,driver_version,vbios_version,mig.mode.current --format=csv,noheader,nounits with a 5 s timeout and no CGO / NVML linkage. Read-only: no process env, command lines, GPU memory, or reconfiguration.
  2. Evidence source = host_observation, never mock and never attestation_verifier. A collector must not promote its own assertion to verified evidence.
  3. Honest field mapping. Known: UUID → physicalId, name → model, PCI, driver, VBIOS → firmware. mig.mode.current: Enabled → partitioning mig; Disabled or [N/A] → none, and mig is only listed in supportedCapabilities when MIG is actually present. timeSlicing, mps, virtualization are unknown — orchestration / host state a device query cannot resolve, and absence is not proof. Region and assigned tenant are administrator assertions, returned unknown.
  4. Missing / failed nvidia-smi → structured Unsupported, exit 0, never a crash; the mock workflow is unaffected.
  5. GPU simulation is explicit and separate. XILA_GUARD_NVIDIA_SMI can point the collector at a committed stub that emits a canned A100 + MIG CSV, to exercise the MIG path on hardware we do not have. Simulated output is software integration testing only — labeled SIMULATED, recorded as host_observation, never described as real hardware or attestation.

Validated on actual hardware

RTX 3070, driver 616.56, VBIOS 94.04.67.00.59, PCI 00000000:01:00.0, mig.mode.current = [N/A]. A no-time-slicing policy evaluates to indeterminate against the real card (sharing unknown → never allow). The simulated A100 + MIG profile evaluates to deny PARTITIONING_DISALLOWED against an allowedPartitioning:[none] policy.

MIG children and sharing resolution

  • MIG child enumeration via nvidia-smi -L: each MIG instance becomes a DeviceFacts with parentDeviceId = parent UUID and configGeneration = a stable FNV-1a over the parent's sorted child UUIDs. Reconfiguring the MIG layout changes the generation, fencing stale child identifiers. If MIG is Enabled but -L yields no children, a source_error records the gap — children are never fabricated. Per-instance slice sizing is derived into migProfile (name, gpuInstanceSlices, memoryGb; GI / CI ids correlated best-effort from mig -lgi / -lci, left unset when ambiguous).
  • time-slicing / MPS are resolved only from an administrator-provided GPU-operator device-plugin sharing config (XILA_GUARD_SHARING_CONFIG). A parsed config is node-authoritative: replicas >= 2 → known true, else known false, carried as source admin_inventory (not host_observation). With no config they stay unknown (absence ≠ disabled). MIG and time-slicing coexist.

Limits / not done

  • The sharing config is a node-authoritative assertion, not a hardware measurement; it is admin_inventory, never attestation.
  • Consumer-card discovery is not a substitute for MIG / confidential-computing validation on a supported datacenter configuration. The MIG path here is exercised via the simulator until a MIG-capable card is available.
  • Attestation remains unsupported (see ADR 0002).