X-LINUX-AWS Distribution Package

Revision as of 08:52, 14 May 2024 by Registered User (→‎Main software modifications)
(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Applicable for STM32MP13x lines

1. Generate X-LINUX-AWS OpenSTLinux distribution[edit source]

With the following procedure, you can generate the complete distribution enabling the X-LINUX-AWS Expansion Package.
This procedure is mandatory to use TPM on the X-LINUX-AWS Expansion Package.

1.1. Download the Distribution Package[edit source]

  • Install the OpenSTLinux Distribution Package by following the dedicated article (STM32MP1 Distribution Package) but do not initialize the OpenEmbedded environment (do not source the envsetup.sh).

1.2. Install X-LINUX-AWS environment[edit source]

  • Clone the meta-st-x-linux-aws git repository
Warning white.png Warning
The software package is provided AS IS, and by downloading it, you agree to be bound to the terms of the software license agreement (SLA0048). The detailed content licenses can be found here.
For X-LINUX-AWS v5.0.0:
 cd <Distribution Package installation directory>/layers/meta-st
 git clone https://github.com/STMicroelectronics/meta-st-x-linux-aws.git -b v5.0.0

  • Clone the meta-st-x-linux-tpm git repository
 cd <Distribution Package installation directory>/layers/meta-st
 git clone https://github.com/STMicroelectronics/meta-st-x-linux-tpm.git -b 5.0.0
  • Clone the meta-aws git repository
 cd <Distribution Package installation directory>/layers
 git clone https://github.com/aws4embeddedlinux/meta-aws.git -b mickledore
Info white.png Information
Validated on commit b288fb9d29f67af79de07f039429fcf921e2abd3
  • Clone the meta-security git repository
 cd <Distribution Package installation directory>/layers
 git clone https://git.yoctoproject.org/meta-security -b mickledore
Info white.png Information
Validated on commit d7db0a3bd1a8639df7570483f003ce00cbe274a2
  • For a new environment

Source the build environment with the correct board and layer:

 cd ../..
 MACHINE=stm32mp13-disco DISTRO=openstlinux-weston BSP_DEPENDENCY='layers/meta-st/meta-st-x-linux-tpm layers/meta-st/meta-st-x-linux-aws layers/meta-aws' source layers/meta-st/scripts/envsetup.sh
  • For an already installed environment

Add the layers to the Yocto environment:

 cd ../..
 source layers/meta-st/scripts/envsetup.sh
 bitbake-layers add-layer ../layers/meta-st/meta-st-x-linux-aws/ ../layers/meta-st/meta-st-x-linux-tpm/ ../layers/meta-aws/ ../layers/meta-security

1.3. Build the image[edit source]

 bitbake st-image-aws
Info white.png Information
Note that building the image might take a long time depending on the host computer performance.

1.4. Program the built image[edit source]

Follow this link to see how to program the built image.

2. Main software modifications[edit source]

Through the X-LINUX-AWS Distribution Package, the OpenSTLinux distribution is mainly changed at two levels:

  • The Linux® kernel configuration and Device tree level with the X-LINUX-TPM Expansion Package integration.
  • User space bringing necessary libraries and tools to use AWS Greengrass, OP-TEE, and the TPM expansion board features.

List of modifications:

  • recipes-iot/aws-iot-greengrass/greengrass-bin_%.bbappend
    • Installation of Greengrass core software into directory /opt/greengrass/v2/
    • Download and installation of AmazonRootCA1 certificate
    • Download and installation of Pkcs11Provider 2.0.6 to use (hard or soft) Security Module at first connection
    • Configuration file modifications
  • recipes-security/optee/optee-os-stm32mp_3.19.0.bbappend
    • Installation of PKCS11 OP-TEE Trusted Application
  • recipes-security/latchset/pkcs11-provider.bb
    • Installation of PKCS#11provider for OpenSSL 3.x
    • Installation of OpenSSL PKCS#11 provider configuration file
  • recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_%.bbappend
    • Creation of a directory /etc/tpm2_pkcs11/ to store some metadata to make the tpm2-pkcs11 library operate correctly.
Info white.png Information
You can also define that location with the TPM2_PKCS11_STORE environment variable.

In that case, the TPM2_PKCS11_STORE environment variable must be set in the /lib/systemd/system/greengrass.service file

Check the tpm2-software documentation for more details.

  • recipes-samples/demo-application/demo-application-aws.bb
    • Grant user weston the right to perform some operations
    • Creation of a demonstration application to:
      • Visualize current Greengrass Core Device configuration
      • Show Greengrass component status
      • Interact with an MQTT network by subscribing and publishing to topics
  • recipes-st/images/st-image-aws.bb
    • Creation of a custom build image