Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #66043 > unrolled thread

Bug#948519: insufficient boot-time entropy on arm64 virtual machines

Back to article view | Back to linux.debian.kernel

Contents

  Bug#948519: insufficient boot-time entropy on arm64 virtual machines Noah Meyerhans <noahm@debian.org> - 2020-01-09 20:30 +0100
    Bug#948519: insufficient boot-time entropy on arm64 virtual machines Noah Meyerhans <noahm@debian.org> - 2020-01-10 00:30 +0100
    Bug#948519: Info received (Bug#948519: insufficient boot-time entropy on arm64 virtual machines) Noah Meyerhans <noahm@debian.org> - 2020-01-11 00:30 +0100
    Processed: Re: Bug#948519: Info received (Bug#948519:  insufficient boot-time entropy on arm64 virtual machines) "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-01-11 00:30 +0100

#66043 — Bug#948519: insufficient boot-time entropy on arm64 virtual machines

Package: src:linux
Version: 4.19.67-2+deb10u2
Severity: important 

See the thread at
https://lists.debian.org/debian-cloud/2020/01/threads.html#00013 for
some context.

When launching arm64 VMs on Amazon EC2, a lack of entropy at boot
results in the full boot process taking several minutes, when the
expectation is that it take a small number of seconds (<10).

Analysis of the boot process shows the ssh key generation is the
culprit, taking nearly 3 minutes.

admin@ip-10-0-1-87:~$ cloud-init analyze blame
-- Boot Record 01 --
     165.77300s (init-network/config-ssh)

The 5.4 kernel currently in sid does not experience this lack of
entropy.  It has been suggested that upstream commit 50ee7529ec45
("random: try to actively add entropy rather than passively wait for
it") may be the difference here, but I have not confirmed this.

A suggested workaround has been to install haveged in the image, but
this tends to make crypto people frown.

[toc] | [next] | [standalone]

#66050

On Thu, Jan 09, 2020 at 02:00:01PM -0500, Noah Meyerhans wrote:
> The 5.4 kernel currently in sid does not experience this lack of
> entropy.  It has been suggested that upstream commit 50ee7529ec45
> ("random: try to actively add entropy rather than passively wait for
> it") may be the difference here, but I have not confirmed this.

I've tested 4.19 with the changes from 50ee7529ec45, and it appears to
do the expected thing.  The kernel claims to have enough entropy at boot
that ssh host key generation happens quickly.

This change is likely to also address #931644.  I've asked the submitter
of that bug if they'd be able to test a proposed fix.

I will prepare a merge request and note it here when it's available.

noah

[toc] | [prev] | [next] | [standalone]

#66055 — Bug#948519: Info received (Bug#948519: insufficient boot-time entropy on arm64 virtual machines)

Control: tags -1 + patch

Proposed solution submitted as https://salsa.debian.org/kernel-team/linux/merge_requests/202

[toc] | [prev] | [next] | [standalone]

#66056 — Processed: Re: Bug#948519: Info received (Bug#948519: insufficient boot-time entropy on arm64 virtual machines)

Processing control commands:

> tags -1 + patch
Bug #948519 [src:linux] insufficient boot-time entropy on arm64 virtual machines
Added tag(s) patch.

-- 
948519: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=948519
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web