GPU-PPCIE-01: GPU fabric runs a protected PCIe/NVLink path¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | Hardware fleets (collector) |
| Lifecycle stage | hardware |
| Evaluated from | Evidence sent to the service (collector bundles or registry scans), not from a cloud API scan. |
What it checks¶
It passes when:
- NVIDIA appraised all … NVSwitch reports for this challenge (signature, FWID, BIOS RIM and measurements, cert chains valid with OCSP good, debug off), each naming the switch verified here, over a signed topology that agrees in both directions.
How to fix¶
- Enable protected PCIe (PPCIe) mode on multi-GPU systems so the links between GPUs are encrypted and attested, and treat this domain as untrusted until every NVSwitch passes NVIDIA's appraisal for a fresh challenge.
After the fix, scan again: the check should report PASS.
Evidence recorded¶
Keys in the finding's evidence: single_gpu_fleet, switches_appraised, switches_collected
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).