Bug#997954: linux: Missing HW RNG on Pine64 on bullseye and bookworm

2021-10-27 Thread Zameer Manji
Source: linux
Severity: normal

Dear Maintainer,

Installing bullseye or bookworm on a Pine64 [0] results in a
system with very low entropy. After some light usage over the
serial console I see:

```
cat /proc/sys/kernel/random/entropy_avail
3
```

This device has a hardware RNG which could be used with rng-tools [1]
to increase entropy but the kernel configuration has it disabled.

Could the `CRYPTO_DEV_SUN8I_CE_PRNG` option be enabled? Then all
users of the A64 SOC could have access to more entropy. A practical
imediate impact is that boot times will decrease for users of
systemd since the systemd-random-seed.service [2] will be able
to gather entropy much faster. Currently on a Pine64
`systemd-analyze blame` shows the random seed service taking 3
seconds on boot.


[0]: https://wiki.debian.org/InstallingDebianOn/PINE64/PINEA64
[1]: https://packages.debian.org/bullseye/rng-tools5
[2]: 
https://manpages.debian.org/bullseye/systemd/systemd-random-seed.service.8.en.html

*** Reporter, please consider answering these questions, where appropriate ***

   * What led up to the situation?
   * What exactly did you do (or not do) that was effective (or
 ineffective)?
   * What was the outcome of this action?
   * What outcome did you expect instead?

*** End of the template - remove these template lines ***


-- System Information:
Debian Release: 11.1
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable-security'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 5.10.0-9-amd64 (SMP w/1 CPU thread)
Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled



Bug#997907: linux-image-arm64: CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER unset in 5.14 kernel

2021-10-26 Thread Zameer Manji
Hello Vincent,

I see and understand the rationale of upstream to deprecate this
functionality.
>From the commit you linked I see another commit [0] which says:

> Loading an initrd passed via the kernel command line is deprecated: it
> is limited to files that reside in the same volume as the one the kernel
> itself was loaded from, and we have more flexible ways to achieve the
> same. So make it configurable so new architectures can decide not to
> enable it.

I assume the 'more flexible ways' to do the same is referencing this
feature [1]
which is indeed more flexible. The problem is that the firmware/bootloader
must
support this new functionality, by populating the right EFI file with the
right GUID.

As far as I can see on arm64 there are three EFI bootloaders:
* GRUB2
* systemd-boot
* refind

Both systemd-boot and refind do not yet support this new mechanism,
although I see
that systemd has some unreleased code [2] to support the new way. I have
not been
able to test GRUB2 but my understanding is that this new method is still
under active
development [3].

The problem is that upstream has deprecated this functionality by assuming
the only
active use was x86, but was completely possible to use it on arm64 (it
works fine for me
on bullseye). Since EFI bootloaders have not yet implemented the new way,
and still
rely on this deprecated method on all architectures, it results in
unbootable systems
on arm64.

I would 100% think this should remain disabled on arm64 if most EFI
bootloaders
supported the new way, but unfortunately they do not.

I hope you would consider enabling this kernel configuration for arm64
until EFI
bootloaders catch up to the recommended way.


[0]
https://gitlab.com/linux-kernel/stable/-/commit/cf6b83664895a5c7e97710df282e220bd047f0f5
[1]
https://gitlab.com/linux-kernel/stable/-/commit/ec93fc371f014a6fb483e3556061ecad4b40735c
[2]
https://github.com/systemd/systemd/commit/a6089431d52adda93eec251a3df0dffa1fe0661a#diff-76eb4030e88f340c9133388f17c65774b0f17a0a8105500978f6ce18ca1deb5a
[3] https://www.mail-archive.com/grub-devel@gnu.org/msg32272.html

On Tue, Oct 26, 2021 at 5:05 PM Vincent Blut  wrote:

> Control: reassign -1 src:linux
>
> Hi,
>
> Le 2021-10-26 20:44, Zameer Manji a écrit :
> > Package: linux-image-arm64
> > Version: 5.14.9-2
> > Severity: important
> >
> > Dear Maintainer,
> >
> > In bullseye, version 5.10.70-1 has the
> CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER
> > kernel configuration set to 'y'. In bookworm it is unset which disable
> this feature.
> >
> > This kernel configuration parameter allows for the EFI stub of the
> kernel to
> > parse and use a 'initrd=' parameter to set up an initrd when booting
> from EFI.
> > Boot loaders like 'systemd-boot' or 'refind' set this parameter if
> configured
> > to pass an initrd. If the kernel configuration parameter is unset, the
> > `initrd=` paramater is ignored, and can result in an unbootable system
> because
> > the initrd has not setup the root filesystem.
> >
> > Without the kernel configuaration set, it is not possible to use
> 'systemd-boot'
> > or 'refind' on arm64 as both of these bootloaders assume the kernel will
> > handle the 'initrd=' flag and setup the initrd.
> >
> > Please consider enabling CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER on
> > arm64 so using 'systemd-boot' or 'refind' can continue to work. Until
> these
> > bootloaders have been updated to use an alternative method of passing the
> > initrd to the EFI stub, it is not possible to have a booting system.
>
> Except on X86, EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER is no longer enabled
> by
> default. Please see [1] for some details.
>
> Cheers,
> Vincent
>
> [1]
> https://gitlab.com/linux-kernel/stable/-/commit/6edcf9dc2e1aff3aa1f5a69ee420fb30dd0e968a
>


-- 
Zameer Manji


Bug#997907: linux-image-arm64: CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER unset in 5.14 kernel

2021-10-26 Thread Zameer Manji
Package: linux-image-arm64
Version: 5.14.9-2
Severity: important

Dear Maintainer,

In bullseye, version 5.10.70-1 has the 
CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER
kernel configuration set to 'y'. In bookworm it is unset which disable this 
feature.

This kernel configuration parameter allows for the EFI stub of the kernel to
parse and use a 'initrd=' parameter to set up an initrd when booting from EFI.
Boot loaders like 'systemd-boot' or 'refind' set this parameter if configured
to pass an initrd. If the kernel configuration parameter is unset, the
`initrd=` paramater is ignored, and can result in an unbootable system because
the initrd has not setup the root filesystem.

Without the kernel configuaration set, it is not possible to use 'systemd-boot'
or 'refind' on arm64 as both of these bootloaders assume the kernel will
handle the 'initrd=' flag and setup the initrd.

Please consider enabling CONFIG_EFI_GENERIC_STUB_INITRD_CMDLINE_LOADER on
arm64 so using 'systemd-boot' or 'refind' can continue to work. Until these
bootloaders have been updated to use an alternative method of passing the
initrd to the EFI stub, it is not possible to have a booting system.