Solved Dual boot with encrypted zfs using rEFInd

B

bsd_user_1234

I am reading "FreeBSD Mastery: Storage essentials", trying to dual boot windows 11 and FreeBSD 14.0 RELEASE using rEFInd as the boot manager, with an ecrypted zfs root;
So far, I've:
(1) Partitioned my disk like so:
Code: 
=>        34  2000409197  nda0  GPT  (954G)
          34        2014        - free -  (1.0M)
        2048      204800     1  efi  (100M)
      206848       32768     2  ms-reserved  (16M)
      239616  1433640960     3  ms-basic-data  (684G)
  1433880576     1280000     4  ms-recovery  (625M)
  1435160576     2097152     5  freebsd-ufs  (1.0G)
  1437257728    39845888     6  freebsd-swap  (19G)
  1477103616   523304960     7  freebsd-zfs  (250G)
  2000408576         655        - free -  (328K)

(2) Encrypted the zfs partition using geli (no key, just a passphrase);
(3) Installed rEFInd by downloading refind-0.14.0-bin.zip and copying the appropriate parts (the executable, icons folder, and refind.conf) to the efi partition;
(4) Set the contents of the refind.conf file like so:
Code: 
timeout 10

menuentry "FreeBSD/amd64 14.0 RELEASE" {
    icon /EFI/refind/icons/os_freebsd.png
    volume gptid/70d6c47d-9605-11ee-a60d-2cf05dff819c
    load /EFI/Boot/freebsd.efi
}
menuentry "Windows 11" {
    icon /EFI/refind/icons/os_win.png
    load /EFI/Boot/bootx64.efi
}

(5) Copied the /boot/loader.efi to /EFI/Boot/freebsd.efi;
I rebooted, and booting via refind into windows works; (Halfway done, ufff);
In the book it is mentioned that a ufs partition is required (that booting from an encrypted zfs partition alone isn't supported or something like that);

(That is my first question, why do I need the ufs partition?)
I created a pool:
zpool create -R /mnt -O compress=lz4 -O atime=off zroot nda0p7.eli
I created some datasets (the default way, namely the: zroot/ROOT, zroot/ROOT/default, and a couple of others);
Then I installed the base.txz and kernel.txz after attaching and mounting the zfs and ufs partitions (I mounted the ufs partition after mounting the zfs partition under /mnt/boot);

I configured the /mnt/boot/loader.conf and /mnt/etc/rc.conf files like so:

Code: 
geom_eli_load="YES"
zfs_load="YES"

geli_nda0p7_keyfile0_load="NO"
geli_nda0p7_keyfile0_type=""
geli_nda0p7_keyfile0_name=""

vfs.root.mountfrom="zfs:zroot/ROOT/default"

Code: 
zfs_enable="YES"
geli_swap_flags="-e blowfish -l 128 -s 4096 -d"
wlans_iwlwifi0="wlan0"
ifconfig_wlan0="WPA DHCP"

And here is where I got a little bit confused;
I was writing the /mnt/etc/fstab file and I realized I wasn't sure what to put in there (apart from the encrypted swap);
I saw online somewhere that people were putting the /boot (ufs partition in there as well), so I did that too;


When I rebooted and tried to launch freebsd, the loader complained something like this:
Code: 
consoles: efi console
reading loader env vars from /efi/freebsd/loader.env
setting currdev to disk1p1
FreeBSD/amd64 EFI loader, revision 1.1
command line arguments: loader.efi
image base: 0x5f0aa000
efi version: 2.80
efi firmware: american megatrends
console efi (0)
load path: \EFI\Boot\freebsd.efi
load device: PciRoot(0x0)/Pci(0xE,0x0)/NVMe(0x1,F1-4F-.....)/HD(1,GPT,....)
Bootcurrent: 0000

Ignoring boot0000: only one dp found
trying esp
setting currdev to disk1p1
...
setting currdev to disk1pn
failed to find bootable partition


So my questions are the following:
(1) Is this error due to the loader not being able to locate the kernel?
(2) How does the booting process work exactly (because I've read the handbook, wikipedia, and some other sources, and quite frankly I am slightly confused);
I understand that rEFInd calls -> the freebsd loader -> which should load the kernel and mount the filesystem? But what I don't understand is this,
how is the freebsd loader supposed to know which partition to mount after being invoked by refind?
Will I have to move the kernel to the (first) efi partition? It's only a 100MB, so I am not sure that would work;

Also, I have marked the zfs partition as bootable (geli configure -b part);
 
Hahaha, I've done it! I've figured it out; So, the ufs partition is supposed to hold a copy of /boot from the installer image (cp -Rp /boot <ufspart-mountpoint>);
You can basically delete the contents of the /boot directory on the main zfs partition, then mount the ufs partition under, let's say /clear, and then symlink it to /boot (you'll have to reinstall modules like nvidia-driver if you've done it before deleting the /boot dir);
Other than that, I figured out that rEFInd needed the ufs driver (which can be obtained here: https://efi.akeo.ie) to be inserted into the drivers_x64 directory to not print "invalid loader" when trying to launch the loader.
Of course, I also didn't realize the menuentry was incorrect because rEFInd was automatically detecting windows (see the scanfor option);
So, that was the major stuff; But now that I've got what I wanted, I've come to a startling, but exciting realization; The freebsd installer was capable of encrypting the entire disk somehow (when using the zfs encryption option); In such a way that even when inserting the installer on a usb stick, the password was required! I still don't know how that was done, but I will get to the bottom of this! I bet the secret lies somewhere in the installer scripts.
 
You must log in or register to reply here.
Back
Top