From owner-freebsd-hackers@freebsd.org  Sat May 28 08:37:03 2016
Return-Path: <owner-freebsd-hackers@freebsd.org>
Delivered-To: freebsd-hackers@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 2A3E7B4D986
 for <freebsd-hackers@mailman.ysv.freebsd.org>;
 Sat, 28 May 2016 08:37:03 +0000 (UTC)
 (envelope-from kostikbel@gmail.com)
Received: from kib.kiev.ua (kib.kiev.ua [IPv6:2001:470:d5e7:1::1])
 (using TLSv1 with cipher DHE-RSA-CAMELLIA256-SHA (256/256 bits))
 (Client did not present a certificate)
 by mx1.freebsd.org (Postfix) with ESMTPS id B9F871D7F
 for <freebsd-hackers@freebsd.org>; Sat, 28 May 2016 08:37:02 +0000 (UTC)
 (envelope-from kostikbel@gmail.com)
Received: from tom.home (kib@localhost [127.0.0.1])
 by kib.kiev.ua (8.15.2/8.15.2) with ESMTPS id u4S8avaY058022
 (version=TLSv1 cipher=DHE-RSA-CAMELLIA256-SHA bits=256 verify=NO);
 Sat, 28 May 2016 11:36:57 +0300 (EEST)
 (envelope-from kostikbel@gmail.com)
DKIM-Filter: OpenDKIM Filter v2.10.3 kib.kiev.ua u4S8avaY058022
Received: (from kostik@localhost)
 by tom.home (8.15.2/8.15.2/Submit) id u4S8avGs058021;
 Sat, 28 May 2016 11:36:57 +0300 (EEST)
 (envelope-from kostikbel@gmail.com)
X-Authentication-Warning: tom.home: kostik set sender to kostikbel@gmail.com
 using -f
Date: Sat, 28 May 2016 11:36:57 +0300
From: Konstantin Belousov <kostikbel@gmail.com>
To: Eric McCorkle <eric@metricspace.net>
Cc: "freebsd-hackers@freebsd.org" <freebsd-hackers@freebsd.org>
Subject: Re: EFI GELI support ready for testers
Message-ID: <20160528083656.GT38613@kib.kiev.ua>
References: <519CC1FC-84DF-4710-8E62-AF26D8AED2CF@metricspace.net>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <519CC1FC-84DF-4710-8E62-AF26D8AED2CF@metricspace.net>
User-Agent: Mutt/1.6.1 (2016-04-27)
X-Spam-Status: No, score=-2.0 required=5.0 tests=ALL_TRUSTED,BAYES_00,
 DKIM_ADSP_CUSTOM_MED,FREEMAIL_FROM,NML_ADSP_CUSTOM_MED autolearn=no
 autolearn_force=no version=3.4.1
X-Spam-Checker-Version: SpamAssassin 3.4.1 (2015-04-28) on tom.home
X-BeenThere: freebsd-hackers@freebsd.org
X-Mailman-Version: 2.1.22
Precedence: list
List-Id: Technical Discussions relating to FreeBSD
 <freebsd-hackers.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-hackers/>
List-Post: <mailto:freebsd-hackers@freebsd.org>
List-Help: <mailto:freebsd-hackers-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-hackers>, 
 <mailto:freebsd-hackers-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 28 May 2016 08:37:03 -0000

On Fri, May 27, 2016 at 07:39:57PM -0400, Eric McCorkle wrote:
> I am pleased to announce that my work to add support for GELI in the EFI boot loader (as well as perform more general refactoring) is now ready for testing.  I am able to successfully detect multiple GELI partitions in boot1 and pass the keys into the kernel.

Can somebody explain in which way this is useful ?
Same question for the GELI code for non-EFI loader.

BIOS cannot read raw data from the encrypted partition, so you need
either old boot or the loader and some additional data on EFI boot
partition anyway.

Features adds significant amount of code, which must be maintained in
parallel with the kernel code.