Nouveau - Mar 2019 - Questions about envytools: reading card VBIOS

To whom it may concern

I hope here is the right place to ask about envytools.

I am working on securing our GPUs in the case of an OpenStack
infrastructure, where GPUs can be bound and unbound to VMs from
different clients.

I wanted to use envytools to retrieve the VBIOS our cards, then check
after each VM deletion if somebody changed the VBIOS (potentially a
threat). The VBIOS would be read again and compared to the previously
stored one.

So we would like to know:

  * is the card harmed in any way by reading the BIOS (I guess not, as
    we simply read**);
  * the utility also suggests that the cards have a second VBIOS. Is
    this second VBIOS also read at the same time? If not, how to read it?
  * the VBIOS file read is larger than the one that could be read using
    the NVFlash utility (1 Mo for envytools, against 230 ko for
    NVFlash). I guess it is not an issue, but could you explain why this
    difference occurs?

Thanks for your help.

Best regards,

Jean Chorin

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20190320/76e1ba47/attachment.html>