===== Acknowledgements =====
This tutorial is mainly based on the great & exhaustive work of Nicole Reid - http://cooltrainer.org/projects/freebsd-kirkwood/ and the patch and script for embedding a geli master key directly into the %%FreeBSD%% Kernel provided by Olivier Houchard %%<%%cognet@%%FreeBSD%%.org> (cognet@ at IRC) . Special thanks also go out to the folks at #bsdmips chatroom @efnet.xs4all.nl and ##freebsd @freenode.net.

===== What we will have =====
An USB-Stick with two partitions:
  - Fat Partition with the kernel (& embedded Master Key) (this can be put onto an SD-Card as well, which can be removed after booting)
  - Encrypted UFS Root Partition with %%FreeBSD%% 8.2 Stable 

===== Prerequisites =====
  * Marvell Sheevaplug
  * 2GB USB Drive
  * Working %%FreeBSD%% 8.2 (e.g. in a VM) with sources at /usr/src for Building

===== Prepare a Drive =====
Delete any existing partitions on USB Stick

<code>
# gpart delete -i 1 da0
da0s1 deleted
# gpart destroy da0
da0 destroyed
</code>

Then create a 32MiB FAT partition (for booting the kernel) and fill the rest of the drive with a %%FreeBSD%% slice (this will be the root partition).

<code>
# gpart create -s MBR da0
da0 created
# gpart add -s 32M -t freebsd da0
da0s1 added
# newfs_msdos /dev/da0s1 ### create fat partition
# gpart add -t freebsd da0
da0s2 added
</code>

Init encrypted root Partition

<code>
# dd if=/dev/random of=/dev/da0s2 bs=1m  ### write random data on the partition (obfuscating encrypted data space)
# kldload geom_eli ### load geli kernel module
# dd if=/dev/random of=/root/da0s2.key bs=256 count=1    ###  prepare Master Key File 256bit key; 128bit or else is possible too
# geli init -b -s 4096 -K /root/da0s2.key /dev/da0s2  ### init encrypted partition with Key File
Enter new passphrase:
Reenter new passphrase:
# geli attach -k /root/da0s2.key /dev/da0s2  ### attach encrypted partition
Enter passphrase:
# ls /dev/da0s2*
/dev/da0s2  /dev/da0s2.eli  ### The new plaintext device will be named /dev/da0s2.eli.
# newfs /dev/da0s2.eli ### new fs inside encrypted partition
</code>

* TODO: use bsdlabel to label the encrypted partition ...
===== Patching the source =====
apply the patches from https://github.com/okeeblow/FreeBSD-kirkwood

===== Build world =====
Build it, but don't install anything

<code>
# cd /usr/src
# make -j 8 buildworld TARGET_ARCH=arm
</code>

===== Patching the Kernel =====
use this Kernel Conf [[MichaelSchöne/SHEEVAPLUG_ELI|SHEEVAPLUG_ELI]]

<code>
# cp /root/SHEEVAPLUG_ELI /usr/src/sys/arm/conf/
</code>

Patches from cognet@bsdmips cognet@freebsd.freenode.org. You will be able to define
option GELI_PROVIDER & GELI_KEY_SIZE in the kernel conf. GELI_PROVIDER is the name of the partition we initialised with geli init (da0s2 in this case) and GELI_KEY_SIZE is to be set to the size of the Master Key File you created earlier.

[[MichaelSchöne/hardcode_geli_key.patch]] ### based on http://people.freebsd.org/~cognet/hardcode_geli_key.diff

===== Build the Kernel =====

<code>
# cd /usr/src
# make buildkernel TARGET_ARCH=arm KERNCONF=SHEEVAPLUG_ELI
</code>

==== embed geli key into the kernel ====
get the [[MichaelSchöne/embed_gelikey.sh|script]] from cognet to embed the geli key into the kernel ### http://people.freebsd.org/~cognet/embed_gelikey.sh

<code>
# cd /root
# cp /usr/obj/arm/usr/src/sys/SHEEVAPLUG_ELI/kernel.bin ./
# sh embed_gelikey.sh kernel.bin /root/da0s2.key
</code>

===== Install the Kernel =====

<code>
# mount -tmsdosfs /dev/da0s1 /mnt
# cp kernel.bin /mnt
# umount /mnt
</code>

===== Install World =====

<code>
# mount /dev/da0s2.eli /mnt ### mount encrypted partition
# setenv DESTDIR /mnt
# cd /usr/src
# make installworld distrib-dirs distribution TARGET_ARCH=arm
</code>

===== Configure some Niceties =====
Set the hostname, turn on DHCP, and enable SSHd.

<code>
# echo 'hostname="my_preferred_hostname"' >> $DESTDIR/etc/rc.conf
# echo 'ifconfig_mge0="DHCP"' >> $DESTDIR/etc/rc.conf
# echo 'sshd_enable="YES"' >> $DESTDIR/etc/rc.conf
</code>

Enable automatic fsck, so we can get back into the OS in the event of power loss or an unclean shutdown.

<code>
# echo 'fsck_y_enable="YES"' >> $DESTDIR/etc/rc.conf
# echo 'background_fsck="NO"' >> $DESTDIR/etc/rc.conf
# echo 'force_fsck="YES"' >> $DESTDIR/etc/rc.conf
# echo 'force_fsck_list="/"' >> $DESTDIR/etc/rc.conf
</code>

<code>
# echo 'ntpd_enable="YES"' >> $DESTDIR/etc/rc.conf
# echo 'ntpd_sync_on_start="YES"' >> $DESTDIR/etc/rc.conf
</code>

Tell Ports not to build X11.

<code>
# echo 'WITHOUT_X11=yes' >> $DESTDIR/etc/make.conf
</code>

Set some mount options for our root filesystem. Disabling clustered reads and writes is Reccommended on ARM

<code>
# echo '# Device  Mountpoint  FStype  Options                 Dump    Pass#' > $DESTDIR/etc/fstab
# echo '/dev/da0s2.eli /           ufs     rw,noclusterr,noclusterw    1       1' >> $DESTDIR/etc/fstab
# umount /mnt 
</code>

===== Setting up U-boot to boot from USB Stick =====
Connect your Sheevaplug to your Computer via miniUSB and start a console.
Update the boot command:
(as i memorize it ...)

<code>
set bootcmd 'usb start; fatload usb 0:1 0x900000 kernel.bin; go 0x900000;'
</code>