* [OE-Core][master][PATCH] openssh: remove RRECOMMENDS to rng-tools for sshd package
@ 2022-12-09 7:05 Xiangyu Chen
2022-12-09 8:50 ` Randy MacLeod
2022-12-09 17:02 ` Khem Raj
0 siblings, 2 replies; 5+ messages in thread
From: Xiangyu Chen @ 2022-12-09 7:05 UTC (permalink / raw)
To: openembedded-core
It appears that rngd is not needed as of linux-5.6 and later[1]
and should not be installed by default since the purpose of rngd
is to provide additional trusted sources of entropy.
We did some testing on real hardware, the result seems to support that
we no longer need rngd by default on kernel v5.6 and later.
Testing result as below:
1. observing the crng init stage.
the "random: crng init done" always available before fs being mounted.
2. generating random number without rngd.
testing command: dd if=/dev/random of=/dev/null status=progress
on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block
on NXP i.mx6q board, speed almost 31.9 MB/s without block
on qemu x86-64, speed almost 2.6MB/s without block
3. using rngtest command without rngd
testing command: rngtest -c 1000 </dev/random
on Marvell CN96xx RDB board:
rngtest: input channel speed: (min=4.340; avg=135.364; max=146.719)Mibits/s
rngtest: FIPS tests speed: (min=8.197; avg=69.020; max=72.800)Mibits/s
rngtest: Program run time: 418771 microseconds
on NXP i.mx6q board:
rngtest: input channel speed: (min=96.820; avg=326.769; max=340.598)Mibits/s
rngtest: FIPS tests speed: (min=15.090; avg=37.543; max=40.324)Mibits/s
rngtest: Program run time: 570229 microseconds
on qemu x86-64:
rngtest: input channel speed: (min=37.769; avg=101.136; max=136.239)Mibits/s
rngtest: FIPS tests speed: (min=10.288; avg=30.682; max=40.155)Mibits/s
rngtest: Program run time: 836800 microseconds
4. observing sshd service.
using "systemctl disable rng-tools" disable service and reboot system.
system boot up normal, sshd service also start in normal time without
block.
Reference:
[1] https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32
Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
---
meta/recipes-connectivity/openssh/openssh_9.1p1.bb | 9 +--------
1 file changed, 1 insertion(+), 8 deletions(-)
diff --git a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
index 85f97b1bbb..23ae8d5b0c 100644
--- a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
+++ b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
@@ -52,15 +52,12 @@ SYSTEMD_SERVICE:${PN}-sshd = "sshd.socket"
inherit autotools-brokensep ptest
-PACKAGECONFIG ??= "rng-tools"
+PACKAGECONFIG ??= ""
PACKAGECONFIG[kerberos] = "--with-kerberos5,--without-kerberos5,krb5"
PACKAGECONFIG[ldns] = "--with-ldns,--without-ldns,ldns"
PACKAGECONFIG[libedit] = "--with-libedit,--without-libedit,libedit"
PACKAGECONFIG[manpages] = "--with-mantype=man,--with-mantype=cat"
-# Add RRECOMMENDS to rng-tools for sshd package
-PACKAGECONFIG[rng-tools] = ""
-
EXTRA_AUTORECONF += "--exclude=aclocal"
# login path is hardcoded in sshd
@@ -160,10 +157,6 @@ FILES:${PN}-keygen = "${bindir}/ssh-keygen"
RDEPENDS:${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen ${PN}-sftp-server"
RDEPENDS:${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
-RRECOMMENDS:${PN}-sshd:append:class-target = "\
- ${@bb.utils.filter('PACKAGECONFIG', 'rng-tools', d)} \
-"
-
# gdb would make attach-ptrace test pass rather than skip but not worth the build dependencies
RDEPENDS:${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed sudo coreutils"
--
2.34.1
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [OE-Core][master][PATCH] openssh: remove RRECOMMENDS to rng-tools for sshd package
2022-12-09 7:05 [OE-Core][master][PATCH] openssh: remove RRECOMMENDS to rng-tools for sshd package Xiangyu Chen
@ 2022-12-09 8:50 ` Randy MacLeod
2022-12-09 17:02 ` Khem Raj
1 sibling, 0 replies; 5+ messages in thread
From: Randy MacLeod @ 2022-12-09 8:50 UTC (permalink / raw)
To: Xiangyu Chen, Randy MacLeod
Cc: Patches and discussions about the oe-core layer
[-- Attachment #1: Type: text/plain, Size: 4629 bytes --]
On Fri., Dec. 9, 2022, 02:05 Xiangyu Chen, <xiangyu.chen@eng.windriver.com>
wrote:
> It appears that rngd is not needed as of linux-5.6 and later[1]
> and should not be installed by default since the purpose of rngd
> is to provide additional trusted sources of entropy.
>
> We did some testing on real hardware, the result seems to support that
> we no longer need rngd by default on kernel v5.6 and later.
>
> Testing result as below:
>
> 1. observing the crng init stage.
> the "random: crng init done" always available before fs being mounted.
>
Super.
> 2. generating random number without rngd.
> testing command: dd if=/dev/random of=/dev/null status=progress
> on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block
> on NXP i.mx6q board, speed almost 31.9 MB/s without block
> on qemu x86-64, speed almost 2.6MB/s without block
>
> 3. using rngtest command without rngd
> testing command: rngtest -c 1000 </dev/random
> on Marvell CN96xx RDB board:
> rngtest: input channel speed: (min=4.340; avg=135.364;
> max=146.719)Mibits/s
> rngtest: FIPS tests speed: (min=8.197; avg=69.020;
> max=72.800)Mibits/s
> rngtest: Program run time: 418771 microseconds
>
> on NXP i.mx6q board:
> rngtest: input channel speed: (min=96.820; avg=326.769;
> max=340.598)Mibits/s
> rngtest: FIPS tests speed: (min=15.090; avg=37.543;
> max=40.324)Mibits/s
> rngtest: Program run time: 570229 microseconds
>
> on qemu x86-64:
> rngtest: input channel speed: (min=37.769; avg=101.136;
> max=136.239)Mibits/s
> rngtest: FIPS tests speed: (min=10.288; avg=30.682;
> max=40.155)Mibits/s
> rngtest: Program run time: 836800 microseconds
>
> 4. observing sshd service.
> using "systemctl disable rng-tools" disable service and reboot system.
> system boot up normal, sshd service also start in normal time without
> block.
>
Nice.
Does openssh have more quantitative tests that can be run?
For the YP autobuilder tests that run in qemu, do we need, or do we already
have, virtio-rng or is that also obsolete ( here's an old link from 2015:
https://www.redhat.com/en/blog/red-hat-enterprise-linux-virtual-machines-access-random-numbers-made-easy
).
Maybe the thing to do is to just try this change in master-next as usual
and see it we get any timeouts from the YP test suite.
Thanks,
../Randy
> Reference:
> [1]
> https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32
>
> Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
> ---
> meta/recipes-connectivity/openssh/openssh_9.1p1.bb | 9 +--------
> 1 file changed, 1 insertion(+), 8 deletions(-)
>
> diff --git a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
> b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
> index 85f97b1bbb..23ae8d5b0c 100644
> --- a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
> +++ b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
> @@ -52,15 +52,12 @@ SYSTEMD_SERVICE:${PN}-sshd = "sshd.socket"
>
> inherit autotools-brokensep ptest
>
> -PACKAGECONFIG ??= "rng-tools"
> +PACKAGECONFIG ??= ""
> PACKAGECONFIG[kerberos] = "--with-kerberos5,--without-kerberos5,krb5"
> PACKAGECONFIG[ldns] = "--with-ldns,--without-ldns,ldns"
> PACKAGECONFIG[libedit] = "--with-libedit,--without-libedit,libedit"
> PACKAGECONFIG[manpages] = "--with-mantype=man,--with-mantype=cat"
>
> -# Add RRECOMMENDS to rng-tools for sshd package
> -PACKAGECONFIG[rng-tools] = ""
> -
>
EXTRA_AUTORECONF += "--exclude=aclocal"
>
> # login path is hardcoded in sshd
> @@ -160,10 +157,6 @@ FILES:${PN}-keygen = "${bindir}/ssh-keygen"
>
> RDEPENDS:${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen
> ${PN}-sftp-server"
> RDEPENDS:${PN}-sshd += "${PN}-keygen
> ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit
> pam-plugin-loginuid', '', d)}"
> -RRECOMMENDS:${PN}-sshd:append:class-target = "\
> - ${@bb.utils.filter('PACKAGECONFIG', 'rng-tools', d)} \
> -"
> -
> # gdb would make attach-ptrace test pass rather than skip but not worth
> the build dependencies
> RDEPENDS:${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed
> sudo coreutils"
>
> --
> 2.34.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#174434):
> https://lists.openembedded.org/g/openembedded-core/message/174434
> Mute This Topic: https://lists.openembedded.org/mt/95556189/953399
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [
> rwmacleod@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
>
[-- Attachment #2: Type: text/html, Size: 7737 bytes --]
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-Core][master][PATCH] openssh: remove RRECOMMENDS to rng-tools for sshd package
2022-12-09 7:05 [OE-Core][master][PATCH] openssh: remove RRECOMMENDS to rng-tools for sshd package Xiangyu Chen
2022-12-09 8:50 ` Randy MacLeod
@ 2022-12-09 17:02 ` Khem Raj
2022-12-11 18:35 ` Mark Hatle
1 sibling, 1 reply; 5+ messages in thread
From: Khem Raj @ 2022-12-09 17:02 UTC (permalink / raw)
To: Xiangyu Chen; +Cc: openembedded-core
would be good to know some numbers on non-arm/non-x86 systems too.
On Thu, Dec 8, 2022 at 11:05 PM Xiangyu Chen
<xiangyu.chen@eng.windriver.com> wrote:
>
> It appears that rngd is not needed as of linux-5.6 and later[1]
> and should not be installed by default since the purpose of rngd
> is to provide additional trusted sources of entropy.
>
> We did some testing on real hardware, the result seems to support that
> we no longer need rngd by default on kernel v5.6 and later.
>
> Testing result as below:
>
> 1. observing the crng init stage.
> the "random: crng init done" always available before fs being mounted.
>
> 2. generating random number without rngd.
> testing command: dd if=/dev/random of=/dev/null status=progress
> on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block
> on NXP i.mx6q board, speed almost 31.9 MB/s without block
> on qemu x86-64, speed almost 2.6MB/s without block
>
> 3. using rngtest command without rngd
> testing command: rngtest -c 1000 </dev/random
> on Marvell CN96xx RDB board:
> rngtest: input channel speed: (min=4.340; avg=135.364; max=146.719)Mibits/s
> rngtest: FIPS tests speed: (min=8.197; avg=69.020; max=72.800)Mibits/s
> rngtest: Program run time: 418771 microseconds
>
> on NXP i.mx6q board:
> rngtest: input channel speed: (min=96.820; avg=326.769; max=340.598)Mibits/s
> rngtest: FIPS tests speed: (min=15.090; avg=37.543; max=40.324)Mibits/s
> rngtest: Program run time: 570229 microseconds
>
> on qemu x86-64:
> rngtest: input channel speed: (min=37.769; avg=101.136; max=136.239)Mibits/s
> rngtest: FIPS tests speed: (min=10.288; avg=30.682; max=40.155)Mibits/s
> rngtest: Program run time: 836800 microseconds
>
> 4. observing sshd service.
> using "systemctl disable rng-tools" disable service and reboot system.
> system boot up normal, sshd service also start in normal time without
> block.
>
> Reference:
> [1] https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32
>
> Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
> ---
> meta/recipes-connectivity/openssh/openssh_9.1p1.bb | 9 +--------
> 1 file changed, 1 insertion(+), 8 deletions(-)
>
> diff --git a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
> index 85f97b1bbb..23ae8d5b0c 100644
> --- a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
> +++ b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
> @@ -52,15 +52,12 @@ SYSTEMD_SERVICE:${PN}-sshd = "sshd.socket"
>
> inherit autotools-brokensep ptest
>
> -PACKAGECONFIG ??= "rng-tools"
> +PACKAGECONFIG ??= ""
> PACKAGECONFIG[kerberos] = "--with-kerberos5,--without-kerberos5,krb5"
> PACKAGECONFIG[ldns] = "--with-ldns,--without-ldns,ldns"
> PACKAGECONFIG[libedit] = "--with-libedit,--without-libedit,libedit"
> PACKAGECONFIG[manpages] = "--with-mantype=man,--with-mantype=cat"
>
> -# Add RRECOMMENDS to rng-tools for sshd package
> -PACKAGECONFIG[rng-tools] = ""
> -
> EXTRA_AUTORECONF += "--exclude=aclocal"
>
> # login path is hardcoded in sshd
> @@ -160,10 +157,6 @@ FILES:${PN}-keygen = "${bindir}/ssh-keygen"
>
> RDEPENDS:${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen ${PN}-sftp-server"
> RDEPENDS:${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
> -RRECOMMENDS:${PN}-sshd:append:class-target = "\
> - ${@bb.utils.filter('PACKAGECONFIG', 'rng-tools', d)} \
> -"
> -
> # gdb would make attach-ptrace test pass rather than skip but not worth the build dependencies
> RDEPENDS:${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed sudo coreutils"
>
> --
> 2.34.1
>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#174434): https://lists.openembedded.org/g/openembedded-core/message/174434
> Mute This Topic: https://lists.openembedded.org/mt/95556189/1997914
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [raj.khem@gmail.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-Core][master][PATCH] openssh: remove RRECOMMENDS to rng-tools for sshd package
2022-12-09 17:02 ` Khem Raj
@ 2022-12-11 18:35 ` Mark Hatle
2022-12-16 4:17 ` Xiangyu Chen
0 siblings, 1 reply; 5+ messages in thread
From: Mark Hatle @ 2022-12-11 18:35 UTC (permalink / raw)
To: openembedded-core
In the kernel is the jitter entropy system. It should work on all platforms
that have high res timers available. (This is the same mechanism that haveged
was using before as well. So no change in the RNG quality, just now built into
the kernel itself.)
The only place we've observed an issue with the new approach is on a qemu
machine that was moderately loaned. The jitter was apparently too large (our
theory) and caused the crng init to happen VERY slowly. (This would not have
been resolved using rngd.)
All-in-all, I thought this change had already been made, and think it should go in.
(We tested this on microblaze, and performance with and without haveged was the
same. I don't have number, but I expect the same behaviors on any architecture.)
--Mark
On 12/9/22 11:02 AM, Khem Raj wrote:
> would be good to know some numbers on non-arm/non-x86 systems too.
>
> On Thu, Dec 8, 2022 at 11:05 PM Xiangyu Chen
> <xiangyu.chen@eng.windriver.com> wrote:
>>
>> It appears that rngd is not needed as of linux-5.6 and later[1]
>> and should not be installed by default since the purpose of rngd
>> is to provide additional trusted sources of entropy.
>>
>> We did some testing on real hardware, the result seems to support that
>> we no longer need rngd by default on kernel v5.6 and later.
>>
>> Testing result as below:
>>
>> 1. observing the crng init stage.
>> the "random: crng init done" always available before fs being mounted.
>>
>> 2. generating random number without rngd.
>> testing command: dd if=/dev/random of=/dev/null status=progress
>> on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block
>> on NXP i.mx6q board, speed almost 31.9 MB/s without block
>> on qemu x86-64, speed almost 2.6MB/s without block
>>
>> 3. using rngtest command without rngd
>> testing command: rngtest -c 1000 </dev/random
>> on Marvell CN96xx RDB board:
>> rngtest: input channel speed: (min=4.340; avg=135.364; max=146.719)Mibits/s
>> rngtest: FIPS tests speed: (min=8.197; avg=69.020; max=72.800)Mibits/s
>> rngtest: Program run time: 418771 microseconds
>>
>> on NXP i.mx6q board:
>> rngtest: input channel speed: (min=96.820; avg=326.769; max=340.598)Mibits/s
>> rngtest: FIPS tests speed: (min=15.090; avg=37.543; max=40.324)Mibits/s
>> rngtest: Program run time: 570229 microseconds
>>
>> on qemu x86-64:
>> rngtest: input channel speed: (min=37.769; avg=101.136; max=136.239)Mibits/s
>> rngtest: FIPS tests speed: (min=10.288; avg=30.682; max=40.155)Mibits/s
>> rngtest: Program run time: 836800 microseconds
>>
>> 4. observing sshd service.
>> using "systemctl disable rng-tools" disable service and reboot system.
>> system boot up normal, sshd service also start in normal time without
>> block.
>>
>> Reference:
>> [1] https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32
>>
>> Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
>> ---
>> meta/recipes-connectivity/openssh/openssh_9.1p1.bb | 9 +--------
>> 1 file changed, 1 insertion(+), 8 deletions(-)
>>
>> diff --git a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
>> index 85f97b1bbb..23ae8d5b0c 100644
>> --- a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
>> +++ b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
>> @@ -52,15 +52,12 @@ SYSTEMD_SERVICE:${PN}-sshd = "sshd.socket"
>>
>> inherit autotools-brokensep ptest
>>
>> -PACKAGECONFIG ??= "rng-tools"
>> +PACKAGECONFIG ??= ""
>> PACKAGECONFIG[kerberos] = "--with-kerberos5,--without-kerberos5,krb5"
>> PACKAGECONFIG[ldns] = "--with-ldns,--without-ldns,ldns"
>> PACKAGECONFIG[libedit] = "--with-libedit,--without-libedit,libedit"
>> PACKAGECONFIG[manpages] = "--with-mantype=man,--with-mantype=cat"
>>
>> -# Add RRECOMMENDS to rng-tools for sshd package
>> -PACKAGECONFIG[rng-tools] = ""
>> -
>> EXTRA_AUTORECONF += "--exclude=aclocal"
>>
>> # login path is hardcoded in sshd
>> @@ -160,10 +157,6 @@ FILES:${PN}-keygen = "${bindir}/ssh-keygen"
>>
>> RDEPENDS:${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen ${PN}-sftp-server"
>> RDEPENDS:${PN}-sshd += "${PN}-keygen ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit pam-plugin-loginuid', '', d)}"
>> -RRECOMMENDS:${PN}-sshd:append:class-target = "\
>> - ${@bb.utils.filter('PACKAGECONFIG', 'rng-tools', d)} \
>> -"
>> -
>> # gdb would make attach-ptrace test pass rather than skip but not worth the build dependencies
>> RDEPENDS:${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server make sed sudo coreutils"
>>
>> --
>> 2.34.1
>>
>>
>>
>>
>>
>>
>> -=-=-=-=-=-=-=-=-=-=-=-
>> Links: You receive all messages sent to this group.
>> View/Reply Online (#174469): https://lists.openembedded.org/g/openembedded-core/message/174469
>> Mute This Topic: https://lists.openembedded.org/mt/95556189/3616948
>> Group Owner: openembedded-core+owner@lists.openembedded.org
>> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [mark.hatle@kernel.crashing.org]
>> -=-=-=-=-=-=-=-=-=-=-=-
>>
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [OE-Core][master][PATCH] openssh: remove RRECOMMENDS to rng-tools for sshd package
2022-12-11 18:35 ` Mark Hatle
@ 2022-12-16 4:17 ` Xiangyu Chen
0 siblings, 0 replies; 5+ messages in thread
From: Xiangyu Chen @ 2022-12-16 4:17 UTC (permalink / raw)
To: Steve Sakoman; +Cc: openembedded-core
On 12/12/22 02:35, Mark Hatle wrote:
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender
> and know the content is safe.
>
> In the kernel is the jitter entropy system. It should work on all
> platforms
> that have high res timers available. (This is the same mechanism that
> haveged
> was using before as well. So no change in the RNG quality, just now
> built into
> the kernel itself.)
>
> The only place we've observed an issue with the new approach is on a qemu
> machine that was moderately loaned. The jitter was apparently too
> large (our
> theory) and caused the crng init to happen VERY slowly. (This would
> not have
> been resolved using rngd.)
>
> All-in-all, I thought this change had already been made, and think it
> should go in.
>
> (We tested this on microblaze, and performance with and without
> haveged was the
> same. I don't have number, but I expect the same behaviors on any
> architecture.)
>
> --Mark
>
> On 12/9/22 11:02 AM, Khem Raj wrote:
>> would be good to know some numbers on non-arm/non-x86 systems too.
>>
>> On Thu, Dec 8, 2022 at 11:05 PM Xiangyu Chen
>> <xiangyu.chen@eng.windriver.com> wrote:
>>>
>>> It appears that rngd is not needed as of linux-5.6 and later[1]
>>> and should not be installed by default since the purpose of rngd
>>> is to provide additional trusted sources of entropy.
>>>
>>> We did some testing on real hardware, the result seems to support that
>>> we no longer need rngd by default on kernel v5.6 and later.
>>>
>>> Testing result as below:
>>>
>>> 1. observing the crng init stage.
>>> the "random: crng init done" always available before fs being
>>> mounted.
>>>
>>> 2. generating random number without rngd.
>>> testing command: dd if=/dev/random of=/dev/null status=progress
>>> on Marvell CN96xx RDB board, speed almost 20.4 MB/s without block
>>> on NXP i.mx6q board, speed almost 31.9 MB/s without block
>>> on qemu x86-64, speed almost 2.6MB/s without block
>>>
>>> 3. using rngtest command without rngd
>>> testing command: rngtest -c 1000 </dev/random
>>> on Marvell CN96xx RDB board:
>>> rngtest: input channel speed: (min=4.340; avg=135.364;
>>> max=146.719)Mibits/s
>>> rngtest: FIPS tests speed: (min=8.197; avg=69.020;
>>> max=72.800)Mibits/s
>>> rngtest: Program run time: 418771 microseconds
>>>
>>> on NXP i.mx6q board:
>>> rngtest: input channel speed: (min=96.820; avg=326.769;
>>> max=340.598)Mibits/s
>>> rngtest: FIPS tests speed: (min=15.090; avg=37.543;
>>> max=40.324)Mibits/s
>>> rngtest: Program run time: 570229 microseconds
>>>
>>> on qemu x86-64:
>>> rngtest: input channel speed: (min=37.769; avg=101.136;
>>> max=136.239)Mibits/s
>>> rngtest: FIPS tests speed: (min=10.288; avg=30.682;
>>> max=40.155)Mibits/s
>>> rngtest: Program run time: 836800 microseconds
>>>
>>> 4. observing sshd service.
>>> using "systemctl disable rng-tools" disable service and reboot
>>> system.
>>> system boot up normal, sshd service also start in normal time
>>> without
>>> block.
>>>
>>> Reference:
>>> [1]
>>> https://github.com/torvalds/linux/commit/30c08efec8884fb106b8e57094baa51bb4c44e32
>>>
>>> Signed-off-by: Xiangyu Chen <xiangyu.chen@windriver.com>
Hello Steve,
According to oe release kernel
version(https://wiki.yoctoproject.org/wiki/Linux_Yocto), the kirkstone
and langdale is also using linux v5.6 later version kernel, so could you
help to cherry pick this commit on master to kirkstone and langdale
branch? Thanks!
The commit now on master:
commit: 868dfb46d96a27ec9041cb902fb769330277257d
https://git.openembedded.org/openembedded-core/commit/?id=868dfb46d96a27ec9041cb902fb769330277257d
Thanks,
Xiangyu
>>> ---
>>> meta/recipes-connectivity/openssh/openssh_9.1p1.bb | 9 +--------
>>> 1 file changed, 1 insertion(+), 8 deletions(-)
>>>
>>> diff --git a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
>>> b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
>>> index 85f97b1bbb..23ae8d5b0c 100644
>>> --- a/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
>>> +++ b/meta/recipes-connectivity/openssh/openssh_9.1p1.bb
>>> @@ -52,15 +52,12 @@ SYSTEMD_SERVICE:${PN}-sshd = "sshd.socket"
>>>
>>> inherit autotools-brokensep ptest
>>>
>>> -PACKAGECONFIG ??= "rng-tools"
>>> +PACKAGECONFIG ??= ""
>>> PACKAGECONFIG[kerberos] = "--with-kerberos5,--without-kerberos5,krb5"
>>> PACKAGECONFIG[ldns] = "--with-ldns,--without-ldns,ldns"
>>> PACKAGECONFIG[libedit] = "--with-libedit,--without-libedit,libedit"
>>> PACKAGECONFIG[manpages] = "--with-mantype=man,--with-mantype=cat"
>>>
>>> -# Add RRECOMMENDS to rng-tools for sshd package
>>> -PACKAGECONFIG[rng-tools] = ""
>>> -
>>> EXTRA_AUTORECONF += "--exclude=aclocal"
>>>
>>> # login path is hardcoded in sshd
>>> @@ -160,10 +157,6 @@ FILES:${PN}-keygen = "${bindir}/ssh-keygen"
>>>
>>> RDEPENDS:${PN} += "${PN}-scp ${PN}-ssh ${PN}-sshd ${PN}-keygen
>>> ${PN}-sftp-server"
>>> RDEPENDS:${PN}-sshd += "${PN}-keygen
>>> ${@bb.utils.contains('DISTRO_FEATURES', 'pam', 'pam-plugin-keyinit
>>> pam-plugin-loginuid', '', d)}"
>>> -RRECOMMENDS:${PN}-sshd:append:class-target = "\
>>> - ${@bb.utils.filter('PACKAGECONFIG', 'rng-tools', d)} \
>>> -"
>>> -
>>> # gdb would make attach-ptrace test pass rather than skip but not
>>> worth the build dependencies
>>> RDEPENDS:${PN}-ptest += "${PN}-sftp ${PN}-misc ${PN}-sftp-server
>>> make sed sudo coreutils"
>>>
>>> --
>>> 2.34.1
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>>>
>
> -=-=-=-=-=-=-=-=-=-=-=-
> Links: You receive all messages sent to this group.
> View/Reply Online (#174478): https://lists.openembedded.org/g/openembedded-core/message/174478
> Mute This Topic: https://lists.openembedded.org/mt/95556189/7175143
> Group Owner: openembedded-core+owner@lists.openembedded.org
> Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [xiangyu.chen@eng.windriver.com]
> -=-=-=-=-=-=-=-=-=-=-=-
>
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2022-12-16 4:18 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-12-09 7:05 [OE-Core][master][PATCH] openssh: remove RRECOMMENDS to rng-tools for sshd package Xiangyu Chen
2022-12-09 8:50 ` Randy MacLeod
2022-12-09 17:02 ` Khem Raj
2022-12-11 18:35 ` Mark Hatle
2022-12-16 4:17 ` Xiangyu Chen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).