GELI with UEFI supporting Boot Environments goes to HEAD when?

[Eric McCorkle]

FYI, I just IFC'ed everything, and the current patches are still fine.

Also, the full GELI + standalone loader has been deployed on one of my
laptops for some time now.

On 02/21/2018 18:15, Eric McCorkle wrote:
> The GELI work could be merged at this point, though it won't be usable
> without an additional patch to enable loader-only operation.  The
> patches are currently up for review:
> 
> This is the order in which they'd need to be merged:
> 
> 
> https://reviews.freebsd.org/D12732
> 
> This one changes the efipart device.  Toomas Soome identified some
> problems, which I have addressed.  He has not re-reviewed it, however.
> 
> 
> https://reviews.freebsd.org/D12692
> 
> This adds some crypto code needed for GELI.  It simply adds new code,
> and doesn't conflict with anything.
> 
> 
> https://reviews.freebsd.org/D12698
> 
> This adds the EFI KMS interface code, and has the EFI loader pass keys
> into the keybuf interface.
> 
> 
> I can't post the main GELI driver until those get merged, as it depends
> on them.  It can be found on the geli branch on my github freebsd
> repository, however.
> 
> 
> Additionally, you need this patch, which allows loader.efi to function
> when installed directly to the ESP:
> 
> https://reviews.freebsd.org/D13497
> 
> On 02/20/2018 22:56, Tommi Pernila wrote:
>> Hi Eric,
>>
>> could you provide a brief update how the work is going?
>>
>>
>> Br,
>>
>> Tommi
>>
>>
>> On Nov 16, 2017 04:29, "Eric McCorkle" <eric at metricspace.net
>> <mailto:eric at metricspace.net>> wrote:
>>
>>     Right, so basically, the remaining GELI patches are against loader, and
>>     most of them can go in independently of the work on removing boot1.
>>     There's a unanimous consensus on getting rid of boot1 which includes its
>>     original author, so that's going to happen.
>>
>>
>>     For GELI, we have the following (not necessarily in order):
>>
>>     a) Adding the KMS interfaces, pseudo-device, and kernel keybuf
>>     interactions
>>     b) Modifications to the efipart driver
>>     c) boot crypto
>>     d) GELI partition types (not strictly necessary)
>>
>>     Then there's the GELI driver itself.  (a) and (c) are good to land, (b)
>>     needs some more work after Toomas Soome pointed out a legitimate
>>     problem, and (d) actually needs a good bit more code (but again, it's
>>     more cosmetic).  Additionally, the GELI driver will need further mods to
>>     efipart to be written (nothing too big).  But we could go ahead with (a)
>>     and (c), as they've already been proven to work.
>>
>>     I'd wanted to have this stuff shaped up sooner, but I'm preoccupied with
>>     the 7th RISC-V workshop at the end of the month.
>>
>>     Once this stuff is all in, loader should handle any GELI volumes it
>>     finds, and it should Just Work once boot1 is gone.
>>
>>
> _______________________________________________
> freebsd-current at freebsd.org mailing list
> https://lists.freebsd.org/mailman/listinfo/freebsd-current
> To unsubscribe, send any mail to "freebsd-current-unsubscribe at freebsd.org"
>