Jump to content

FileVault 2

vit9696

By vit9696,
in UEFI

 Share
496 posts in this topic

Recommended Posts

  • Popular Post
vit9696
vit9696
Posted
  • Popular Post
Posted (edited)

Alright, after a couple of weeks of hard work performed by: ath, Download-Fritz, slice, savvas, and myself FileVault 2 should work everywhere now. Additionally thanks to iNDi for help and initial discovery of certain FV aspects.

 

This means that everybody gets some pros for this but mainly Clover.

Everything works in test mode for the time being, so you better wreck your disk drives and tell us how much fun it was :)

Clover:
In brief you are required to install a set of drivers present at least in r3876. There are two driver categories, and each one will be addressed separately.

  • UI drawing.
    • Make sure that you remove all the legacy drivers implemented in the past. The list includes: AppleImageCodec-64.efi, AppleKeyAggregator-64.efi, AppleKeyMapAggregator.efi, AppleEvent.efi, AppleUITheme-64.efi, EnglishDxe-64.efi, FirmwareVolume-64.efi, HashServiceFix-64.efi
    • Avoid OsxAptioFix1/2/3, because they may cause boot hang during recovery entrance. Use AptioMemoryFix.
    • The following is mandatory:
  • Password input. To do that you need a keyboard driver, which knows about Apple key aggregation protocol.
    There are two input drivers for the time being:
     
    • AptioInputFix — my driver specific to AMI APTIO IV UEFI BIOS. Still in process of a rewrite and release.
      Pros:
      — works without keyboard reconnect or driver flash with USB and PS/2 keyboards in AMI UEFI BIOS;
      — fixes not working mouse input on Z87 and possibly newer;
      Cons:
      — some multisymbol hotkeys will not work (e.g. 3+2, 6+4);
      — key autorepeat might cause issues on some systems;
      — mouse might work a bit slowly on some systems (better than nothing).

      Recommendations:
      A lightweight solution that will mostly work well for some people. If it works for you and you have no desire to flash your BIOS, perhaps it is a good idea.
    • Modified UsbKbDxe, a slightly altered version is present in Clover.
      Pros:
      — works with any USB keyboard in any BIOS;
      — offers completely functional Apple boot keys (CMD+V, 3+2, CMD+R, etc.);
      Cons:
      — might require a physical keyboard reconnect after driver load with AMI UEFI BIOS;
      — might lead to a complete freeze of the system with AMI UEFI BIOS.

      Recommendations:
      It is recommended to use this driver from BIOS or via legacy clover boot. In this case you will have no issues with keyboard connection. To solve freezing issues you will need to rebuild UsbKbDxe with a forced controller disconnect at EXIT BS.
      In case of Clover use:
        
      ./ebuild.sh -D EXIT_USBKB=1
      In case of the original driver see these PCDs. Both should be set to TRUE.
      In case of Clover FixOwnership might help you, but I would not recommend this.
    • AppleKeyFeeder — a solution by Jief_Machak for very very broken systems, for e.g. PS/2 keyboards on laptops. It does not emulate all the keys and does not support key combination, but is definitely better than nothing.Link to a binary.

 

  • Hibernation is a no go for those having no hardware nvram and no StrictHibernate in clover config
    No solutions for the time being and no solutions planned.
  • Shutdown button on login screen may cause a restart
    No solutions for the time being.
  • Password change/reset during the volume encryption might cause issues when logging in
    Apple issue. Please refrain from changing or resetting the password before the encryption completes. In cases this is required use your generated recovery key to login into the system.
Edited by vit9696
  • Like 21
Link to comment
Share on other sites
D-an-W
D-an-W
Posted
Posted

:thumbsup_anim:  Great work everyone, many thanks I am excited to try it  :thumbsup_anim:

 

Can I please ask at what point of reboot is the password requested as I generally skip the Clover GUI (Login = 0 in Config.plist), would this be a problem?

 

I also use the Apple bluetooth Keyboard, Mouse and Trackpad which work fine both in the BIOS and Clover GUI as they connect with the Apple Broadcom Bluetooth would they be compatible?

Link to comment
Share on other sites
vit9696
vit9696
Posted
  • Author
Posted

The pw is requested by boot.efi, clover ui has nothing to do with it. You should choose the right boot entry at least once though.

(Boot macOS from Recovery HD)

 

As for your input devices that needs testing. I would say that they should work almost certainly though.

  • Like 1
Link to comment
Share on other sites
Slice
Slice
Posted
Posted

Thanks vit9696, it has been a while since FileVault was first tested with Clover (Back on ProjectOSX and it didn't work) so I will have to familiarise myself with the process again at the weekend when I get home.

Yes, it never worked before.

Link to comment
Share on other sites
smolderas
smolderas
Posted
Posted

I just tested it. It works as described.

You should choose recovery HD on that drive to be able to boot, which make sense if you think how file vault works.

One minor issue is, I had to replug my usb keyboard to be able to type my password, even though I've booted via legacy clover, as described in recommendation. I'll try the AppleKeyAggregator from Apple Firmware, just for test (I mean who would use closed source programs and want to encrypt the drive with it or better decrypt with that?!).

 

Everything else is perfect. Thanks again to all who contributed...

 

Edit: I've tried the original AppleKeyMapAggregator from Apple firmware, even the AptioInputFix. Nothing changed though, I still have to replug my keyboard :(

 

Edit2: Just had the idea, locking from find my mac should theoretically work, right?

Link to comment
Share on other sites
Slice
Slice
Posted
Posted

I'm using Intel+AMD (black screen during boot) solution for a working sleep. When I enable FV2 Will I have black screen while typing password ?

Yes, you will have black screen while typing password.

Moreover, there can be one caveat. I initially have two users on the screen and I have to choose one of them by mouse and only then type password.

But you can't use mouse on black screen.

I also using Intel+AMD for working sleep. And I have a monitor with two entry. First entry for Intel, second for AMD with a simple switch between two screens.

  • Like 1
Link to comment
Share on other sites
Slice
Slice
Posted
Posted

Does Clover now install all the files required in Drivers64UEFI meaning I just have to enable FileVault via System Preferences > Security and Privacy and reboot letting Clover do it's thing?

 

Files currently in Drivers64UEFI:

attachicon.gifScreen Shot 2016-10-30 at 05.19.07.png

No, UsbKbDxe or other special keyboard driver needed.

FV2 uses own keyboard interface and can't use UEFI BIOS keyboard driver.

  • Like 1
Link to comment
Share on other sites
D-an-W
D-an-W
Posted
Posted

How does it work with Bluetooth keyboards (for example Apple Magic Keyboard)?

 

You have to have AptioInputFix.efi present for Apple Bluetooth Keyboards to work, I just tested this (Not tested the alternative keyboard driver).

 

Once FV2 is enabled do you have to always boot from the "Boot macOS from Recovery HD" option that appears in the Clover menu?

Link to comment
Share on other sites
mhaeuser
mhaeuser
Posted
Posted

Once FV2 is enabled do you have to always boot from the "Boot macOS from Recovery HD" option that appears in the Clover menu?

 

Yes.

 

EDIT: Do I see it wrong or is UsbKbDxe placed in drivers64 for legacy boot? What sense does that make? Just replace the TianoCore one in the DUET image, that will solve the issue of having to reconnect the keyboard on every boot...

Link to comment
Share on other sites
 Share
Go to topic listing
×
×
  • Create New...