Check EFI Size and Device Limit with Trusted Boot

When you use Trusted Boot, your Operating System (OS) becomes part of the Extensible Firmware Interface (EFI) file that gets loaded by the firmware of the Edge host and booted directly. This means that the EFI file may grow quite large due to the size of the OS and any customizations you may make, and you must ensure that your Edge host has the capacity to boot the large EFI file.

This page guides you through how to estimate the bootable EFI limit of your Edge host as well as the EFI size of your installer ISO. You need to ensure that the bootable EFI size limit is greater than the size of the EFI partition in your ISO file.

Prerequisites

The host machine (not the Edge host) used to build the software that will verify the EFI boot limit meets the following hardware requirements:
- Processor architecture: X86_64
- Minimum CPU: 4
- Minimum RAM: 8
- Minimum Storage: 100 GB
The ability to modify the boot order settings to boot from a USB drive and to enter the BIOS interface. Typically this requires you to have a wired keyboard and a monitor to display the interface connected to the Edge device.
Your Edge host supports UEFI boot options.
You have already built the installer ISO file as well as the provider image that you will use to provision clusters on your Edge host. For more information, refer to EdgeForge with Trusted Boot.
You can only perform the actions in this guide prior to enrolling keys in your Edge host. The ISO that is used to check the EFI boot limit will not have your keys on it. If your device has already enrolled your custom keys and have secure boot enabled, the Edge host will not be able to boot from the unsigned volume.
Git. You can ensure git installation by issuing the git --version command.

Instructions

Follow the instructions below to determine if your Edge host is capable of booting the ISO and the provider image.

Check Bootable EFI Size Limit for Hardware

Check out the CanvOS GitHub repository containing the starter code.
```
git clone https://github.com/spectrocloud/CanvOS.git
```
Change to the CanvOS/ directory.
```
cd CanvOS
```
View the available git tag.
```
git tag
```
Check out the newest available tag. This guide uses v4.4.0 tag as an example.
```
git checkout v4.4.0
```
Issue the following command to build the ISO image that is used to check your hardware EFI boot limit.
```
./earthly +iso-efi-size-check
```
This will generate an ISO image located at ./build/efi-size-check.iso.
Flash the ISO onto a USB drive. You can use balena Etcher or any other similar tool to flash volumes.
Plug the USB drive into your Edge host. Have a keyboard ready and connected to the Edge host before you boot it up.
Boot up the Edge host. Use the keyboard to enter the boot menu. Usually you can press the F1, F2, or F10 key to enter the boot menu, but the exact key varies by hardware.
Select the USB as the boot volume.

As the Edge host boots up, the console will produce output similar to the following on the screen.

BdsDxe: loading Boot0001 "UEFI QEMU DVD-ROM QM00003 " from PciRoot(0x0)/Pci(0x1,0x1)/Ata(Secondary,Master,0x0)
BdsDxe: starting Boot0001 "UEFI QEMU DVD-ROM QM00003 " from PciRoot(0x0)/Pci(0x1,0x1)/Ata(Secondary,Master,0x0)
[ INFO]:  src/main.rs@032: Starting EFI size checker...
[ INFO]:  src/main.rs@042: start to do file read check...
[ INFO]:  src/main.rs@056: Reading 100.00 MB bytes into buffer
[ INFO]:  src/main.rs@065: Successfully read 100.00 MB into buffer
[ INFO]:  src/main.rs@056: Reading 200.00 MB bytes into buffer
[ INFO]:  src/main.rs@065: Successfully read 200.00 MB into buffer
[ INFO]:  src/main.rs@056: Reading 300.00 MB bytes into buffer
[ INFO]:  src/main.rs@065: Successfully read 300.00 MB into buffer
[ INFO]:  src/main.rs@056: Reading 400.00 MB bytes into buffer
[ INFO]:  src/main.rs@065: Successfully read 400.00 MB into buffer
[ INFO]:  src/main.rs@056: Reading 500.00 MB bytes into buffer
[ INFO]:  src/main.rs@065: Successfully read 500.00 MB into buffer
[ INFO]:  src/main.rs@056: Reading 600.00 MB bytes into buffer
[ INFO]:  src/main.rs@065: Successfully read 600.00 MB into buffer
[ INFO]:  src/main.rs@056: Reading 700.00 MB bytes into buffer

Pay close attention to the output on the screen. At a certain point, the output will break and produce a large number of new lines before producing the same output as the beginning again. In some hardware, the Edge host will reboot and start the process again, so you will need to monitor the output closely to catch the last line before the reboot happens.

The last line before the white space or reboot indicates the upper bound of your EFI boot limit. For example, in the following output, the EFI boot limit of your Edge host is between 600 and 700 MB.

[ INFO]:  src/main.rs@056: Reading 600.00 MB bytes into buffer
[ INFO]:  src/main.rs@065: Successfully read 600.00 MB into buffer
[ INFO]:  src/main.rs@056: Reading 700.00 MB bytes into buffer

BdsDxe: loading Boot0001 "UEFI QEMU DVD-ROM QM00003 " from PciRoot(0x0)/Pci(0x1,0x1)/Ata(Secondary,Master,0x0) BdsDxe:
starting Boot0001 "UEFI QEMU DVD-ROM QM00003 " from PciRoot(0x0)/Pci(0x1,0x1)/Ata(Secondary,Master,0x0) [ INFO]:
src/main.rs@032: Starting EFI size checker... [ INFO]: src/main.rs@042: start to do file read check... [ INFO]:
src/main.rs@056: Reading 100.00 MB bytes into buffer [ INFO]: src/main.rs@065: Successfully read 100.00 MB into buffer

Check EFI Size of Installer ISO

From the CanvOS directory, issue the following commands to make two directories.
```
mkdir -p image
mkdir -p image-efi
```

Issue the following command to mount the installer ISO to the directories you created in the previous step.

sudo mount --options loop build/palette-edge-installer.iso image/
sudo mount --options loop image/efiboot.img image-efi

Issue the following command to find out the size of the EFI file.

ls -ltrh image-efi/EFI/kairos/*.efi

In the following example, the size of the EFI file in the ISO image is 722 MB.

-rwxr-xr-x 1 root root 722M May 14 18:52 image-efi/EFI/kairos/norole_install-mode_stylus.registration.efi

Check EFI Size of Provider Images

Issue the following command to find the size of your provider image. Replace image-tag with the tag of your provider image.
```
docker run --interactive --tty image-tag ls -ltrh /trusted-boot/EFI/kairos
```
In the following example, the size of the EFI file in the provider image is 767 MB.
```
total 767M
-rw-r--r-- 1 root root 767M Apr 16  2020 norole.efi
```

Compare Hardware Boot Limit with EFI Size

To ensure that the Edge host is able to boot, the hardware limit must be greater than the EFI size of both the ISO and the provider image.

In the examples used through out this guide, the hardware limit is between 600 - 700 MB. The EFI of the ISO is 722 MB, and the EFI of the provider image is 767 MB. The hardware limit is smaller than the EFI of both the ISO and the provider image. Therefore, the Edge host will not be able to boot and an Edge host with a higher EFI boot limit is needed.

To resolve this issue, you can acquire a device that has a higher boot limit, or make the EFI of the ISO smaller by removing inessential layers of your base image by editing the Dockerfile in the CanvOS repository. For example, if you have the following Dockerfile.
```
ARG BASE
FROM $BASE

ARG OS_DISTRIBUTION
ARG PROXY_CERT_PATH
ARG HTTP_PROXY
ARG HTTPS_PROXY
ARG NO_PROXY

COPY sc.cr[t] /tmp/sc.crt
RUN if [ "${OS_DISTRIBUTION}" = "ubuntu" ] && [ "${PROXY_CERT_PATH}" != "" ]; then \
    cp /tmp/sc.crt /etc/ssl/certs && \
    update-ca-certificates; \
    fi
RUN if [ "${OS_DISTRIBUTION}" = "opensuse-leap" ] && [ "${PROXY_CERT_PATH}" != "" ]; then \
    cp /tmp/sc.crt /usr/share/pki/trust/anchors && \
    update-ca-certificates; \
    fi

###########################Add any other image customizations here #######################

RUN apt-get update && apt-get install nginx -y
```
You can remove the last line of the Dockerfile to reduce the EFI size. If you want to include software packages in your built ISO without increasing the EFI size, refer to Add Static Binaries to Persistent Partition.

If you cannot make the EFI file size small enough to meet the boot limit, contact sales@spectrocloud.com for customized solutions.

Validate

If the hardware EFI boot limit is greater than the EFI size of both the ISO and the provider image. Proceed to install Palette on the Edge host and provision a cluster. For more information, refer to Installation with Trusted Boot and Cluster Creation for more information.

Prerequisites​

Instructions​

Check Bootable EFI Size Limit for Hardware​

Check EFI Size of Installer ISO​

Check EFI Size of Provider Images​

Compare Hardware Boot Limit with EFI Size​

Validate​