eric_metricspace.net (Eric McCorkle)
User

Projects

User does not belong to any projects.

User Details

User Since
Nov 7 2015, 11:25 PM (145 w, 3 d)

Recent Activity

Yesterday

eric_metricspace.net updated the diff for D16576: System trust configuration and local root keygen.

Fixed signing of local cert, and added default DN generation

Tue, Aug 21, 11:48 AM
eric_metricspace.net updated the diff for D16576: System trust configuration and local root keygen.

Added machine vs. local keys, fixed errors in the scripts, added checking for key expiry, fixed some other issues.

Tue, Aug 21, 1:43 AM

Wed, Aug 8

eric_metricspace.net added a comment to D16576: System trust configuration and local root keygen.

Note: I want to let this sit for a while, and I'd prefer to commit this along with other components of the trust framework.

Wed, Aug 8, 11:05 PM

Fri, Aug 3

eric_metricspace.net added a comment to D16563: Add signelf utility.

Note, the man page for trust-config is moved to D16576

Fri, Aug 3, 2:25 AM
eric_metricspace.net added a child revision for D16576: System trust configuration and local root keygen: D16563: Add signelf utility.
Fri, Aug 3, 2:23 AM
eric_metricspace.net added a parent revision for D16563: Add signelf utility: D16576: System trust configuration and local root keygen.
Fri, Aug 3, 2:23 AM
eric_metricspace.net added a comment to D16576: System trust configuration and local root keygen.

An alternative I'm considering: have a seldom-used master key named something like "machine", "master", "root", etc. which is the local trust root key. Have "local" be an intermediate keypair, signed by this master key. The master key acts only as a key-signing certificate; it cannot sign code or issue general signatures. The local key can issue more general signatures.

Fri, Aug 3, 1:59 AM
eric_metricspace.net created D16576: System trust configuration and local root keygen.
Fri, Aug 3, 1:54 AM

Thu, Aug 2

eric_metricspace.net created D16563: Add signelf utility.
Thu, Aug 2, 1:48 AM

Wed, Aug 1

eric_metricspace.net added a comment to D10486: Bug 218860 - libelf doesn't reload section headers after update with ELF_C_WRITE.

Background on this (and the other related change): I ran into both issues implementing signelf. They caused anomalous bugs, and I tracked them down and fixed them. So they're definitely issues, and the fixes definitely work.

Wed, Aug 1, 1:55 PM
eric_metricspace.net updated the diff for D12698: Add EFI KMS and keybuf integration.

Cut down to just the KMS API

Wed, Aug 1, 1:20 AM

Jul 18 2018

eric_metricspace.net added a comment to D12698: Add EFI KMS and keybuf integration.

Some part of this ought to be committed, as it enables TPM support in EFI. It's worth discussing exactly which parts are necessary.

Jul 18 2018, 10:55 AM
eric_metricspace.net abandoned D12732: Revert efipart to use EFI_HANDLEs for partitions.

This is no longer necessary.

Jul 18 2018, 10:54 AM
eric_metricspace.net abandoned D10512: GELI support for EFI loader.

An alternate approach to GELI was merged.

Jul 18 2018, 10:53 AM
eric_metricspace.net abandoned D12692: Add boot crypto framework.

Alternate approach to GELI was merged. This is no longer needed.

Jul 18 2018, 10:53 AM

Jul 4 2018

eric_metricspace.net added a comment to D15743: Extend loader(8) geli support to all architectures and all disk-like devices..

I get compile errors trying to build the latest

Jul 4 2018, 3:21 AM

Jun 16 2018

eric_metricspace.net added a comment to D15743: Extend loader(8) geli support to all architectures and all disk-like devices..

Some thoughts here:

Jun 16 2018, 3:03 PM

Jun 8 2018

eric_metricspace.net updated the diff for D12698: Add EFI KMS and keybuf integration.

Rebased from HEAD

Jun 8 2018, 8:22 PM

Jun 7 2018

eric_metricspace.net updated the diff for D12732: Revert efipart to use EFI_HANDLEs for partitions.

Rebase from master and tried on real hardware

Jun 7 2018, 8:10 PM

Apr 22 2018

eric_metricspace.net updated the diff for D12698: Add EFI KMS and keybuf integration.

Rebase to HEAD

Apr 22 2018, 2:18 PM
eric_metricspace.net updated the diff for D12692: Add boot crypto framework.

Rebase to HEAD

Apr 22 2018, 2:16 PM
eric_metricspace.net updated the diff for D12732: Revert efipart to use EFI_HANDLEs for partitions.

Confirmed working on UFS, ZFS, and real hardware.

Apr 22 2018, 2:13 PM
eric_metricspace.net abandoned D13497: Dual-purpose loader.efi.
Apr 22 2018, 2:10 PM

Mar 30 2018

eric_metricspace.net added a comment to D12732: Revert efipart to use EFI_HANDLEs for partitions.

Still looking quite nice, but there is a bit of competition still, have you checked on https://reviews.freebsd.org/D13784 and how much those 2 updates are conflicting and in which order should we implement them to cause the least amount of issues on integration?

Mar 30 2018, 12:30 PM

Mar 29 2018

eric_metricspace.net updated the diff for D12698: Add EFI KMS and keybuf integration.

Rebase from HEAD

Mar 29 2018, 12:21 PM
eric_metricspace.net updated the diff for D12692: Add boot crypto framework.

Rebase from HEAD

Mar 29 2018, 12:11 PM
eric_metricspace.net updated the diff for D12732: Revert efipart to use EFI_HANDLEs for partitions.

Rebase from HEAD

Mar 29 2018, 12:05 PM
eric_metricspace.net updated the diff for D13497: Dual-purpose loader.efi.

Accidental early rebase

Mar 29 2018, 11:57 AM
eric_metricspace.net updated the diff for D13497: Dual-purpose loader.efi.

Rebase to HEAD

Mar 29 2018, 11:51 AM

Feb 2 2018

eric_metricspace.net added a comment to D12690: Add GELI partition types.

This review actually needs more work. Turns out there's more places where things need to be added.

Feb 2 2018, 12:24 PM

Jan 11 2018

eric_metricspace.net added a comment to D8575: Verified execution (veriexec) fingerprint loader.

I'd like to get an author list for this work (and any related coming patches), as well as for the NetBSD system if possible for the bibliography.

Jan 11 2018, 12:30 PM
eric_metricspace.net added a comment to D8575: Verified execution (veriexec) fingerprint loader.

Just as a note, I'm going to be editing a paper on a larger FreeBSD trust system for submission to BSDCan. I plan on incorporating this work into the overall design.

Jan 11 2018, 12:29 PM

Jan 7 2018

eric_metricspace.net added a comment to D10512: GELI support for EFI loader.

This is now deployed on a laptop with a multi-device, all-GELI ZFS pool. It boots with loader.efi depolyed to the ESP (a no-boot1 configuration).

Jan 7 2018, 9:16 PM
eric_metricspace.net updated the diff for D10512: GELI support for EFI loader.

Fix error that prevented ZFS preferred pool detection

Jan 7 2018, 8:47 PM
eric_metricspace.net updated the diff for D13497: Dual-purpose loader.efi.

Fixed efi_zfs_is_preferred so ZFS preferred volumes are correctly detected again.

Jan 7 2018, 8:43 PM

Jan 4 2018

eric_metricspace.net added a child revision for D13497: Dual-purpose loader.efi: D10512: GELI support for EFI loader.
Jan 4 2018, 11:33 PM
eric_metricspace.net added a parent revision for D10512: GELI support for EFI loader: D13497: Dual-purpose loader.efi.
Jan 4 2018, 11:33 PM
eric_metricspace.net updated the diff for D10512: GELI support for EFI loader.

The current state of things combines all the GELI precursors and the dual-purpose loader patch, then applies the GELI driver. This is placed here for testing.

Jan 4 2018, 11:32 PM

Dec 31 2017

eric_metricspace.net updated the diff for D12698: Add EFI KMS and keybuf integration.

Updated to reflect move to /stand

Dec 31 2017, 2:31 AM

Dec 29 2017

eric_metricspace.net updated the diff for D12692: Add boot crypto framework.

Update to reflect move to /stand

Dec 29 2017, 2:01 PM

Dec 23 2017

eric_metricspace.net updated the diff for D12732: Revert efipart to use EFI_HANDLEs for partitions.

(Sorry for the extreme delay on this one)

Dec 23 2017, 5:22 PM

Dec 19 2017

eric_metricspace.net updated the diff for D13497: Dual-purpose loader.efi.

Simplified search procedure.

Dec 19 2017, 2:48 AM

Dec 16 2017

eric_metricspace.net added inline comments to D13497: Dual-purpose loader.efi.
Dec 16 2017, 12:52 AM
eric_metricspace.net added inline comments to D13497: Dual-purpose loader.efi.
Dec 16 2017, 12:38 AM
eric_metricspace.net added a comment to D13497: Dual-purpose loader.efi.

I'm taking the broader architecture discussion here to -arch

Dec 16 2017, 12:27 AM

Dec 15 2017

eric_metricspace.net added inline comments to D13497: Dual-purpose loader.efi.
Dec 15 2017, 1:29 PM
eric_metricspace.net added a comment to D13497: Dual-purpose loader.efi.

The idea here is to implement what will eventually be a last-resort fallback mechanism (in the case of a blank install, or someone's EFI vars getting wiped, or something) as a means of starting the transition away from boot1. The legacy search behavior *should* be subsumed into the find_currdev_all path, but I'm unwilling to remove the legacy path completely at this point.

Dec 15 2017, 12:56 PM
eric_metricspace.net created D13497: Dual-purpose loader.efi.
Dec 15 2017, 3:36 AM

Nov 17 2017

eric_metricspace.net updated the diff for D12698: Add EFI KMS and keybuf integration.

Rebased to HEAD

Nov 17 2017, 3:32 AM
eric_metricspace.net updated the diff for D12692: Add boot crypto framework.

Rebased to HEAD.

Nov 17 2017, 2:31 AM

Oct 23 2017

eric_metricspace.net added a comment to D12732: Revert efipart to use EFI_HANDLEs for partitions.

OK, I know how to deal with the partition info from disks. I'm going to add a field to the pdinfo_list which contains the partition type, and I'll pluck it out of the devpaths when we register the partitions. The partition relationships can be obtained from the pdinfo list already.

Oct 23 2017, 11:36 PM
eric_metricspace.net added inline comments to D12732: Revert efipart to use EFI_HANDLEs for partitions.
Oct 23 2017, 11:01 PM
eric_metricspace.net added a comment to D12690: Add GELI partition types.

Turns out this one is nowhere near complete. Need to add more stuff.

Oct 23 2017, 1:14 AM
eric_metricspace.net added a comment to D10512: GELI support for EFI loader.

This one breaks up much easier, since it's mostly new code. Be aware, however, that the changes will introduce dead code until the GELI driver itself goes in.

Hi Eric. I would like to merge in this work as is into TrueOS if it still works. Are there any merges besides the 4 commits from 10-17-17 that are needed for us to merge as is? Is there a separate commit for the "GELI driver"?

Oct 23 2017, 12:50 AM

Oct 19 2017

eric_metricspace.net added a child revision for D12732: Revert efipart to use EFI_HANDLEs for partitions: D10512: GELI support for EFI loader.
Oct 19 2017, 9:47 PM
eric_metricspace.net added a parent revision for D10512: GELI support for EFI loader: D12732: Revert efipart to use EFI_HANDLEs for partitions.
Oct 19 2017, 9:47 PM
eric_metricspace.net created D12732: Revert efipart to use EFI_HANDLEs for partitions.
Oct 19 2017, 9:47 PM

Oct 17 2017

eric_metricspace.net removed a parent revision for D12690: Add GELI partition types: D12698: Add EFI KMS and keybuf integration.
Oct 17 2017, 12:51 PM
eric_metricspace.net removed a child revision for D12698: Add EFI KMS and keybuf integration: D12690: Add GELI partition types.
Oct 17 2017, 12:51 PM
eric_metricspace.net added child revisions for D12698: Add EFI KMS and keybuf integration: D12690: Add GELI partition types, D10512: GELI support for EFI loader.
Oct 17 2017, 12:49 PM
eric_metricspace.net added a parent revision for D10512: GELI support for EFI loader: D12698: Add EFI KMS and keybuf integration.
Oct 17 2017, 12:49 PM
eric_metricspace.net added a parent revision for D12690: Add GELI partition types: D12698: Add EFI KMS and keybuf integration.
Oct 17 2017, 12:49 PM
eric_metricspace.net created D12698: Add EFI KMS and keybuf integration.
Oct 17 2017, 12:49 PM
eric_metricspace.net added a parent revision for D10512: GELI support for EFI loader: D12692: Add boot crypto framework.
Oct 17 2017, 12:47 AM
eric_metricspace.net added a child revision for D12692: Add boot crypto framework: D10512: GELI support for EFI loader.
Oct 17 2017, 12:47 AM
eric_metricspace.net created D12692: Add boot crypto framework.
Oct 17 2017, 12:47 AM
eric_metricspace.net added a child revision for D12690: Add GELI partition types: D10512: GELI support for EFI loader.
Oct 17 2017, 12:40 AM
eric_metricspace.net added a parent revision for D10512: GELI support for EFI loader: D12690: Add GELI partition types.
Oct 17 2017, 12:40 AM
eric_metricspace.net created D12690: Add GELI partition types.
Oct 17 2017, 12:34 AM
eric_metricspace.net added a comment to D10512: GELI support for EFI loader.

This one breaks up much easier, since it's mostly new code. Be aware, however, that the changes will introduce dead code until the GELI driver itself goes in.

Oct 17 2017, 12:07 AM

Oct 16 2017

eric_metricspace.net added a comment to D10512: GELI support for EFI loader.

This one is finally on deck. I am currently running a build/test cycle after merging from HEAD following the commit of boot1_refactor. I don't anticipate breakage, but it's best to be sure. Allan should run his tests once I get through mine, since he found some issues I didn't.

Oct 16 2017, 11:56 AM

Oct 13 2017

eric_metricspace.net added a comment to D12659: [[ my current integration branch, that also has refactor work ]] Unify boot1 with loader.

Is this applied against some branch? I'm getting complaints about sys/boot/ficl.mk not being there

Oct 13 2017, 4:00 PM
eric_metricspace.net added a comment to D10447: Unify boot1 with loader.
In D10447#262876, @imp wrote:

Addressed review comments

Thanks for the updated. I'll pull this into the work I've done (I did that with a previous revision as well)

I'll look closely to see if there's anything else that's a show stopper. My quick spot check just shows niggles that can be handled after the commit and/or cleaned up prior to the commit. I'll get this in front of the boot1/loader changes I'm planning for efi boot manager. Though I'm wondering more and more why we even have boot1.... But that question isn't quite ripe to explore.

  • Looking at the symbols defined / referenced in boot1 there's the full ficl/forth interpreter as well... (I have this code rebased, with some of the removals reinserted).. will need to check further... - [edited: this was due to the refactor I've done, fixed]
Oct 13 2017, 3:13 PM
eric_metricspace.net added a comment to D10447: Unify boot1 with loader.

That's how the EFI boot stuff originally functioned. At some point, boot1.efi got added, but in the very beginning, you just installed loader.efi to the ESP.

Oct 13 2017, 11:02 AM

Oct 12 2017

eric_metricspace.net added a comment to D10447: Unify boot1 with loader.

Note: this needs to get a test before it's merged, because I did modify the code. But a basic smoke-test ought to do it.

Oct 12 2017, 12:17 AM

Oct 11 2017

eric_metricspace.net updated the diff for D10447: Unify boot1 with loader.

Addressed review comments

Oct 11 2017, 11:46 PM

Oct 7 2017

eric_metricspace.net added a comment to D10447: Unify boot1 with loader.

Do you want me to fix these, or do you want me to just sit tight?

Oct 7 2017, 8:29 PM

Oct 6 2017

eric_metricspace.net updated the diff for D10447: Unify boot1 with loader.

Merged from current and updated. No conflicts, so I think the tests are still good.

Oct 6 2017, 12:33 PM

Oct 2 2017

eric_metricspace.net added a comment to D12564: Abstract ZFS preferred device detection.

Confirmed this works in QEMU

Oct 2 2017, 10:24 PM
eric_metricspace.net added a parent revision for D10447: Unify boot1 with loader: D12564: Abstract ZFS preferred device detection.
Oct 2 2017, 11:33 AM
eric_metricspace.net added a child revision for D12564: Abstract ZFS preferred device detection: D10447: Unify boot1 with loader.
Oct 2 2017, 11:33 AM
eric_metricspace.net created D12564: Abstract ZFS preferred device detection.
Oct 2 2017, 11:31 AM

Oct 1 2017

eric_metricspace.net added a comment to D10447: Unify boot1 with loader.
In D10447#260527, @imp wrote:

We can't land this first and then do my stuff. That would break already committed work in boot1's copy of efi_main.c.

This commit is also kinda too big to land all at once still, but I'll pull in as much as I can as I merge the efi_main's together to make the changes more bite-sized and bisectable should there be issues. There's been much grumbling of late about huge commits landing that break things that are impossible to bisect, so I'll have to break this up to ensure I won't be fielding complaints like that.

Oct 1 2017, 10:35 PM
eric_metricspace.net added a comment to D10447: Unify boot1 with loader.
In D10447#260523, @imp wrote:

I'll take another look at it this week. I have on my plate unifying the efi_main routines that we have in the tree and I have for my uefi boot manager work since they are somewhat similar. Once that's complete, I think the biggest obstacle to getting this into the tree will be behind us since that's the biggest source of conflicts at the moment.

Oct 1 2017, 10:13 PM
eric_metricspace.net added a comment to D10447: Unify boot1 with loader.

Also, just deployed to my laptop (multi-disk ZFS pool), and obviously it works.

Oct 1 2017, 10:09 PM
eric_metricspace.net updated the diff for D10447: Unify boot1 with loader.

Fixed issues with setting image_handle->DeviceHandle incorrectly. Correct behavior confirmed on all my QEMU tests.

Oct 1 2017, 9:59 PM
eric_metricspace.net added a comment to D10447: Unify boot1 with loader.

Finally got time to do QEMU tests on this. Found some issues with setting the DeviceHandle on the loaded image. I fixed it for UFS detection. I also seem to have introduced a regression in ZFS preferred device detection, which I'm working to fix.

Oct 1 2017, 9:22 PM

Sep 29 2017

eric_metricspace.net updated the diff for D10447: Unify boot1 with loader.

Merged from HEAD, corrected a trivial merge conflict

Sep 29 2017, 1:27 AM

Sep 19 2017

eric_metricspace.net added a comment to D10447: Unify boot1 with loader.

Also, someone please do a check for stray debug printfs. I am notoriously bad at spotting those.

Sep 19 2017, 2:50 AM
eric_metricspace.net updated the diff for D10447: Unify boot1 with loader.

Fixed issues with preferred device detection. This includes detailed analysis of the code via debug messages to make sure it's doing the right thing. Preferred devices should now be correctly detected.

Sep 19 2017, 2:49 AM

Sep 12 2017

eric_metricspace.net added a comment to D10931: boot1 generate-fat: generate all templates at once.

I'm unsure as to what needs to happen now. Do I need to do anything to my patches yet?

Sep 12 2017, 11:24 PM

Sep 10 2017

eric_metricspace.net accepted D10931: boot1 generate-fat: generate all templates at once.
Sep 10 2017, 2:57 AM
eric_metricspace.net added a comment to D10931: boot1 generate-fat: generate all templates at once.

If I'm not mistaken, this should work as a precursor to my GELI patch series. I will apply this, then attempt a build with boot1_refactor also applied. That should tell us whether it does the job.

Sep 10 2017, 2:02 AM

Sep 9 2017

eric_metricspace.net updated the diff for D10447: Unify boot1 with loader.

Overhauled preferred device detection

Sep 9 2017, 9:38 PM
eric_metricspace.net added inline comments to D10447: Unify boot1 with loader.
Sep 9 2017, 2:52 AM
eric_metricspace.net added a comment to D10447: Unify boot1 with loader.
In D10447#252525, @imp wrote:

I forwarded ported this, but we're missing functionality that's been added in the past year.
See https://reviews.freebsd.org/D12161 for my forward port.
Functionality added in the year that's not in this forward port (or this current review):
o fallback to any device, that's not present.

Sep 9 2017, 2:46 AM
eric_metricspace.net updated the diff for D10447: Unify boot1 with loader.
Sep 9 2017, 2:24 AM

Aug 13 2017

eric_metricspace.net added inline comments to D10447: Unify boot1 with loader.
Aug 13 2017, 1:39 PM

Aug 4 2017

eric_metricspace.net added inline comments to D10447: Unify boot1 with loader.
Aug 4 2017, 9:48 PM
eric_metricspace.net updated the diff for D10447: Unify boot1 with loader.

Rebased to HEAD after committing portions of it as independent patches.

Aug 4 2017, 9:18 PM