Bootable system with UEFI + GELI + ZFS?

`Orum

`Orum

From reading other posts, it looks like a UEFI + GELI + ZFS root system should be possible with 12.1. I used both the -b and the -g flags when setting up GELI, but I'm not even prompted for a password at boot. It looks like there might be an error, but it flashes by so quickly I can't read it before my system kicks me into a BIOS menu.

What's interesting is that if I boot from the USB drive I used to install it, I am prompted for the password, but still have to manually decrypt/import the pool after it has booted to the installer. Am I doing something wrong, or is this setup simply not possible yet?
 
Are you planning to use the entire disk or partial disk for installation? If it's the entire disk follow "Auto (ZFS) Guided Root-on ZFS" in the Partitoning menu of the installation image. If you want to use only partial disk for installation, please report back.
 
Ah, I didn't realize that had been added to bsdinstall, as I'm used to using the shell due to other limitations with the guided options. Anyway, it did work, but now I'm trying to figure out why, as I can't always use the guided partitioning. I suspect it's the fact that I forgot to put geom_eli_load="YES" in /boot/loader.conf, but that leaves me with more questions. How is /boot/ decrypted to even read that configuration in the first place? The handbook section on it doesn't explain the UEFI boot process or mention encryption at all.
 
Okay. I would think that even without that line in the configuration, I should have been asked for a password, as it would still need that to decrypt the config. So in that sense, I'm still not sure why it wasn't asking me for one before, and I probably messed something else up when partitioning in the shell.
 
`Orum said:
Okay. I would think that even without that line in the configuration, I should have been asked for a password, as it would still need that to decrypt the config. So in that sense, I'm still not sure why it wasn't asking me for one before, and I probably messed something else up when partitioning in the shell.
Click to expand...
Yes, you probably did something wrong as bsdinstall works fine on your system.
With ZFS + GELI + ENCRYPTED BOOT POOL you are limited to a password, unless your keys are on an unencrypted medium.
Because FreeBSD is opensource you can always read the code behind it for which command you exactly missed. Happy reading! :D
 
Last edited:
No issues here with UEFI + GELI + ZFS. Use both -b and -g (-bg) when initialising geli. This is how I run my installs:

gpart add -t freebsd-zfs -s 200G -a 4k -l system ada0
geli init -bg -e AES-XTS -s 4096 -l 256 /dev/gpt/system
geli attach /dev/gpt/system
 
That's almost identical to the commands I ran as well, but for some reason it wouldn't ask for a password. I'm looking through the source code/scripts to try and figure out why my manual configuration wasn't working, but haven't found anything yet.

I suspect I must have screwed up the efi partitioning, but that seems relatively hard to do as you simply dd /boot/boot1.efifat on to it. I really wish I could have seen the error message on the loader, but with it only there for a fraction of a second there was no time for me to read it.
 
Apologies, I read your message as you having issued -b and -g in separate instances.

Try creating your EFI partition manually as well:
gpart add -t efi -s 200M -a 4k -l efi ada0
newfs_msdos -F 32 -c 1 /dev/gpt/efi
mount -t msdosfs /dev/gpt/efi /mnt
mkdir -p /mnt/EFI/BOOT
cp /boot/loader.efi /mnt/EFI/BOOT/BOOTX64.efi
echo 'BOOTx64.efi' > /mnt/EFI/BOOT/startup.nsh
umount /mnt
 
unixhost said:
Apologies, I read your message as you having issued -b and -g in separate instances.

Try creating your EFI partition manually as well:
gpart add -t efi -s 200M -a 4k -l efi ada0
newfs_msdos -F 32 -c 1 /dev/gpt/efi
mount -t msdosfs /dev/gpt/efi /mnt
mkdir -p /mnt/EFI/BOOT
cp /boot/loader.efi /mnt/EFI/BOOT/BOOTX64.efi
echo 'BOOTx64.efi' > /mnt/EFI/BOOT/startup.nsh
umount /mnt
Click to expand...
Unixhost just showed you how to create the EFI boot. Luckily, it does not have to réside in the first or second partition. And you could use the second partition for legacy boot I you ever want to start afresh. He has added the lines for GELI in his anti-penultimate post.

You can use the bsdinstall with unguided partition via shell. In this case do create an additional partition for future use. After installation, manually add EFI to drive as shown above.
 
Was this ever resolved? I am having the same issue. I don't want to use "Auto (ZFS) Guided Root-on ZFS" since I don't want to wipe out my other os. So I manually installed, but I can't get freebsd to boot. Here is the error I am seeing:
Code: 
Starting BOOTX64-FREEBSD.EFI
Using load options ''
Consoles: EFI console
FreeBSD/amd64 EFI loader, Revision 1.1

   Command line arguments: \\EFI\BOOT\BOOTX64-FREEBSD.EFI
   EFI version: 1.10
   EFO Firmware: Apple (rev 1.1)
   Console: efi (0)
   BootCurrent: 0000
   BootOrder: 0000[*] 0080
Ignoring Boot0000: Only one DP found
Setting currdev to disk0p1:
Setting currdev to disk0p2:
Setting currdev to disk0p3:
Setting currdev to disk0`:
Setting currdev to disk0`:
Setting currdev to disk0`:
Setting currdev to disk0`:
Failed to find bootable partition
Startup error in /boot/lua/loader.lua: seconds
LUA ERROR: cannot open /boot/lua/loader.lua no such file or directory.

can't load 'kernel'

Type '?' for a list of commands, 'help' for more detailed help.
OK
I have tried using refind as my boot manager. And I have also deleted the efi partition and recreated it as unixhost suggests above. Same error regardless.
 
I haven't revisited the problem yet as I was able to get by with the guided install last time. I've done plenty of UEFI/BIOS + UFS/ZFS partitioning by hand in the past, but rarely do I have the need for GELI. The worst part is, I wasn't even able to see the error I was getting, so you're already doing at least one better than I was. So while I haven't yet needed to do manual with UEFI+GELI+ZFS, they really should make things better in bsdinstall. A first step would be to document what that does in the handbook, so we can at least follow along on an official source. Better still would be making bsdinstall more flexible, primarily by allowing us to limit how much of our disk(s) we give it. Best of all would be to do all of the above.

Since none of those is an option right now, I was looking through the source tree to try and figure out exactly what it was doing. Assuming you have that installed, I suspect everything we need to know is buried in /usr/src/usr.sbin/bsdinstall/scripts/, with the obvious one for zfs being zfsboot (as Duffyx mentioned). I'm not sure where the GELI / UEFI stuff is, but probably in one or more of the other scripts. Alternatively, if you don't have or want the whole source tree, you can browse & view it online.

If you do figure out the secret sauce to get it working, please consider writing up a tutorial in the tutorials section. The other guides I've found are for pre-12.x, and thus still have unencrypted boot partitions, or avoid UEFI, or are just plain out of date.
 
I will have to write something up. I was able to get it all working. In my case the problem happened to be in the loader.efi. I don't know the details, but thanks to some wonderful people in irc it was determined that between the 12.1 iso I had and the current 12.1 branch there were changes made to generate the loader.efi which solved my issues.
 
`Orum said:
So while I haven't yet needed to do manual with UEFI+GELI+ZFS, they really should make things better in [BGCOLOR=#dee3e7] bsdinstall[/BGCOLOR].
...
Better still would be making bsdinstall more flexible, primarily by allowing us to limit how much of our disk(s) we give it.
Click to expand...

I'm not sure how high the chances are, but that might be the case in future FreeBSD installers. A few weeks ago, while browsing through the freebsd-sysinstall list, a mail caught my attention: "[Bug 242983] bsdinstall: Allow to set ZROOT partition size". Following all the links ended at Phabricator # D22969.

There, on Dez 30 2019 a proposal and a patch was submitted to integrate into the partitioning menu of the FreeBSD installer to the "Auto (ZFS) Guided Root-on-ZFS" setup the option "ZROOT pool Size". The shell script to configure that setup is /usr/libexec/bsdinstall/zfsboot on the installation medium. A patched version of zfsboot is available for download.

I can confirm, replacing zfsboot with the patched version on 12.1-RELEASE and 12-STABLE memstick installer images allows to set the partition size in the FreeBSD installer ZFS configuration menu. The resulting installation, encrypted or unencrypted, has a pool partition in size of what was set in the menu.
 
codedmart said:
I will have to write something up. I was able to get it all working. In my case the problem happened to be in the loader.efi. I don't know the details, but thanks to some wonderful people in irc it was determined that between the 12.1 iso I had and the current 12.1 branch there were changes made to generate the loader.efi which solved my issues.
Click to expand...

Bingo, that did the trick, along with the manual EFI partition from unixhost .

I migrated a root-on-ZFS partition to a geli encrypted partition and it wouldn't boot. However, following the steps above from a 12.1-STABLE snapshot USB drive it all works now. Thank you!
 
You must log in or register to reply here.
Back
Top