Need to remove memory dump commands from sdk-linux-AM437

Raju Tiwari

Hi,

Need to remove memory dump commands as part of security hardening from code based used [u-boot-2019.01+gitAUTOINC+333c3e72d3-g333c3e72d3 .following memory dump commands should be disabled.

can you confirm if these commands are part of uboot code based delivered from TI-SDK-ti-processor-sdk-linux-am437x-hs-evm-06.03.00.106

In u boot commands , following memory dump commands should be disabled.

md : Memory Display command.

mm : Memory modify command - auto incrementing address.

nm : Memory modify command - constant address.

mw : Memory write.

cp : Memory copy.

mwc : Memory write cyclic.

mdc : Memory display cyclic.

mtest : Simple ram read/write test.

loopw : Infinite write loop on address range.

FYI-

The source code for most of the commands in the u-boot can be found at u-boot/common/. These files usually start with cmd_*

over 1 year ago

0 Andreas Dannenberg over 1 year ago

TI__Guru 69602 points

Yes those commands are usually enabled in our U-Boot builds as they are helpful for board bringup/debugging purposes. Are you looking for a way to disable those?

Regards, Andreas

0 Raju Tiwari over 1 year ago

Prodigy 70 points

Can you please share the latest U boot code with the steps mentioned to remove these Memory commands - considering this is U boot Production code, also share the release note so that we get to know the CVEs status if any? the above code need to be validated on Production board. Kindly speed up.

0 Andreas Dannenberg over 1 year ago in reply to Raju Tiwari

TI__Guru 69602 points

Raju Tiwari said:
Can you please share the latest U boot code

Latest U-Boot code as of today for AM437x is delivered as part of the AM437x Linux SDK v8.2, see here: https://www.ti.com/tool/PROCESSOR-SDK-AM437X

You can also access the source directly on the ti-u-boot-2021.01 tree using tag 08.02.00.006, see https://git.ti.com/cgit/ti-u-boot/ti-u-boot/tree/?h=08.02.00.006

Raju Tiwari said:
md : Memory Display command.

mm : Memory modify command - auto incrementing address.

nm : Memory modify command - constant address.

mw : Memory write.

cp : Memory copy.

mwc : Memory write cyclic.

mdc : Memory display cyclic.

mtest : Simple ram read/write test.

loopw : Infinite write loop on address range.

To disable all those features, you'll need to disable the below listed config options using `make menuconfig` after loading the default config (found by doing a few `git grep` searches):

CONFIG_CMD_MEMORY
CONFIG_CMD_MX_CYCLIC
CONFIG_CMD_MEMTEST
CONFIG_LOOPW

What you'd probably then want to do is to save your updated defconfig for later use by using `make savedefconfig`, and the copying the resulting defconfig file into the configs/ folder of your own U-Boot tree and check it into Git, or save/preserve it through some other means.

If you need guidance on how to re-configure and build U-Boot, please see below U-Boot user's guide as part of that SDK: https://software-dl.ti.com/processor-sdk-linux/esd/AM437X/08_02_00_24/exports/docs/linux/Foundational_Components/U-Boot/UG-General-Info.html

Regards, Andreas

0 Raju Tiwari over 1 year ago in reply to Andreas Dannenberg

Prodigy 70 points

is there anyway we can disable these memory commands from U-boot source repo, as these configs by defaults are not available in defconfig? which configs are used to disables these commands and which one to build.if you can mention the steps

1- Latest U-Boot source

2- Build commands to disable these memory commands

0 Andreas Dannenberg over 1 year ago in reply to Raju Tiwari

TI__Guru 69602 points

Raju Tiwari said:
1- Latest U-Boot source

See my last postt.

Raju Tiwari said:
2- Build commands to disable these memory commands

You can use `make menuconfig`, and then search (pressing '/') for the CONFIG_* options I discussed earlier, and then disable them one by one. Like this...

Regards, Andreas

0 Raju Tiwari over 1 year ago in reply to Andreas Dannenberg

Prodigy 70 points

Thanks Andreas for your input, i am following the below steps to config/build

make distclean

make am43xx_hs_evm_config ---------------------------> In this config I don't find any of memory dump commands as you mentioned like

CONFIG_CMD_MEMORY
CONFIG_CMD_MX_CYCLIC
CONFIG_CMD_MEMTEST
CONFIG_LOOPW

the above am43xx_hs_evm_config is the one which is used for our HW and will be booted with uboot code. -----> is my understand correct? if you think we can have call?

0 Andreas Dannenberg over 1 year ago in reply to Raju Tiwari

TI__Guru 69602 points

Hi Raju,

please allow a couple of days for a response. Thanks for your patience.

Regards, Andreas

Arm-based microcontrollers

Arm-based microcontrollers forum

Need to remove memory dump commands from sdk-linux-AM437