Appendix B: NIST Purge

Provides guidance on embedded MultiMediaCard (eMMC) data removal on 7215 IXS-A1 and 7215 IXS-C1 platforms.

The eMMC storage on these platforms is not normally removable. Software-based methods can remove the NOS and its associated data while preserving ONIE, or erase the entire eMMC device, including ONIE. Because eMMC storage uses wear-leveling, deleted NOS data can remain in unallocated space after the NOS partitions are removed.

The procedures described in this section start from the ONIE boot menu.

The ONIE: Uninstall OS menu option removes the NOS partitions but does not securely purge the eMMC storage. Data can remain recoverable after the partitions are removed.

See the Removing the NOS with ONIE Uninstall procedure to remove the NOS partitions. This procedure preserves ONIE and is not a secure purge.

See the Purging NOS data while preserving ONIE procedure to purge NOS data while preserving ONIE.

See the Purging the entire eMMC device, including ONIE procedure to purge the entire eMMC device, including ONIE.

Removing the NOS with ONIE Uninstall

Remove the NOS partitions while preserving ONIE. This procedure is not a secure purge.

To reach the ONIE boot menu, see Recovery using ONIE. Go to step 1 and stop when the ONIE boot menu is displayed. Do not go to step 2.

This procedure removes the NOS partitions but does not securely purge the eMMC storage. Data can remain recoverable after the NOS is removed.

Remove the NOS using one of the following methods.

  • From the ONIE boot menu, select ONIE: Uninstall OS.

  • From the ONIE boot menu, select ONIE: Rescue. At the ONIE prompt, run the following command:

    ONIE:/ # onie-uninstaller

The NOS is removed and ONIE remains installed.

See the Purging NOS data while preserving ONIE procedure to securely purge eMMC data while preserving ONIE.

Purging NOS data while preserving ONIE

Purge SONiC data from the eMMC storage while preserving ONIE.

To reach the ONIE boot menu, see Recovery using ONIE. Go to step 1 and stop when the ONIE boot menu is displayed. Do not go to step 2.

This procedure uses the eMMC secure-trim commands to remove SONiC data while preserving the ONIE partitions.

WARNING:

This procedure permanently removes data from the selected eMMC sectors. Verify the partition layout and sector range before running the commands.

  1. Boot the device to ONIE: Rescue.
  2. Display the eMMC partition table.
    Record the start sector of the SONiC OS partition and the last sector immediately before the SWAP partition. Do not delete the SWAP partition. The NOS partitions are before the SWAP partition.
    ONIE:/ # sgdisk -p /dev/mmcblk0
  3. Delete the SONiC OS partition and any other partitions created by the NOS, and then update the partition table.
    The following example uses partition 3. Replace it with the NOS partition number from the partition table.
    ONIE:/ # sgdisk -d 3 /dev/mmcblk0
ONIE:/ # partprobe
  4. Run the eMMC secure-trim commands for the identified sector range.
    The sector values shown are examples only. Replace them with the sector range identified for the device. Run secure-trim1, and then run secure-trim2.
    ONIE:/ # mmc erase secure-trim1 788480 76543999 /dev/mmcblk0
ONIE:/ # mmc erase secure-trim2 788480 76543999 /dev/mmcblk0
  5. Check the content of the selected eMMC sectors.
    Replace the skip value shown in the example with the start sector recorded for the device.
    ONIE:/ # dd if=/dev/mmcblk0 bs=512 skip=788480 count=100 | od

See Purging the entire eMMC device, including ONIE to purge the entire eMMC device, including ONIE.

Purging the entire eMMC device, including ONIE

Purge all data from the eMMC device, including ONIE.

Have the required USB ONIE recovery image available before starting this procedure.

To reach the ONIE boot menu, see Recovery using ONIE. Go to step 1 and stop when the ONIE boot menu is displayed. Do not go to step 2.

WARNING:

This procedure permanently removes all data from the eMMC device, including the SONiC image, customer data, and ONIE. Only the U-Boot image in the boot PROM remains. After the purge, the device can recover only by reinstalling ONIE from a USB drive.

  1. Boot the device to ONIE: Rescue.
  2. Verify that the eMMC device supports secure erase operations. 
    ONIE:/ # mmc extcsd read /dev/mmcblk0 | grep Secure
  3. Unmount the ONIE partitions and disable swap. 
    ONIE:/ # umount /dev/mmcblk0p1
ONIE:/ # umount /dev/mmcblk0p2
ONIE:/ # swapoff -a
  4. Erase the partition table and sanitize the entire eMMC device. 
    ONIE:/ # dd if=/dev/zero of=/dev/mmcblk0 bs=512 count=34
ONIE:/ # mmc sanitize /dev/mmcblk0
  5. Check the content of the selected eMMC sectors.
    The skip value is an example from the NOS partition. Replace it with a sector range that was erased on the device.
    ONIE:/ # dd if=/dev/mmcblk0 bs=512 skip=788480 count=100 | od
  6. Reinstall ONIE from a USB drive.