GPUCC-NVLINK-01: The NVLink domain stays within the attested GPUs¶
| Property | Value |
|---|---|
| Severity | high |
| Platform | NVIDIA GPU Confidential Computing |
| Lifecycle stage | runtime |
| Trust boundary | memory |
| Assurance | operator-declared |
| Mode | Passive: reads only the files and values you pass to the scan. |
What it checks¶
It passes when:
- Signed SPDM reports from … GPU(s) and … NVSwitch(es), all for this challenge and chained to NVIDIA Device Identity CA, form one protected-PCIe domain: every GPU is in PPCIe mode, every NVLink port leads to an attested switch, and every switch reports the same attested GPUs. Link encryption is not established (NVLink is plaintext under protected PCIe); revocation was not rechecked offline.
How to fix¶
- Run every GPU and NVSwitch in the domain in CC mode (protected PCIe / multi-GPU CC) and attest each one, so every active NVLink connects attested devices; disable links to anything else.
- Attest every GPU and NVSwitch in the domain and disable NVLinks to anything that did not attest.
After the fix, scan again: the check should report PASS.
When it is not assessed¶
SKIP:
- No --gpu-attestation-report specified; skipping check.
- A single GPU with no NVLink or NVSwitch evidence: no NVLink domain to assess.
ERROR:
- Could not read/parse attestation report or policy: …
Scan inputs¶
The untrust scan options this check reads:
| Option | Description |
|---|---|
--gpu-attestation-report |
Path to a captured NVIDIA GPU attestation report (JSON). |
--gpu-verifier-policy |
Verifier policy JSON: pinned RIM measurements, cert chain, revocation. |
Permissions¶
None. The check reads only the files or values you pass to the scan.
Generated from untrust 1.3.0 (commit 7ef462d9a0c3).