X-LINUX-AWS Distribution Package

Applicable for

1. Generate X-LINUX-AWS OpenSTLinux distribution[edit | edit source]

With the following procedure, you can generate the complete distribution enabling the X-LINUX-AWS Expansion Package.
This procedure is mandatory to use TPM on the X-LINUX-AWS Expansion Package.

1.1. Download the Distribution Package[edit | edit source]

Install the OpenSTLinux Distribution Package by following the dedicated article (STM32MP1 Distribution Package) but do not initialize the OpenEmbedded environment (do not source the envsetup.sh).

1.2. Install X-LINUX-AWS environment[edit | edit source]

Clone the meta-st-x-linux-aws git repository

Warning

The software package is provided AS IS, and by downloading it, you agree to be bound to the terms of the [[unknown distribution|software license agreement (SLA0048)]]. The detailed content licenses can be found [[unknown distribution|here]].

For unknown expansion package:
 cd <Distribution Package installation directory>/layers/meta-st
 git clone https://github.com/STMicroelectronics/meta-st-x-linux-aws.git -b unknown expansion package

Clone the meta-st-x-linux-tpm git repository

 cd <Distribution Package installation directory>/layers/meta-st
 git clone https://github.com/STMicroelectronics/meta-st-x-linux-tpm.git -b 5.0.0

Clone the meta-aws git repository

 cd <Distribution Package installation directory>/layers
 git clone https://github.com/aws4embeddedlinux/meta-aws.git -b mickledore

Information

Validated on commit b288fb9d29f67af79de07f039429fcf921e2abd3

Clone the meta-security git repository

 cd <Distribution Package installation directory>/layers
 git clone https://git.yoctoproject.org/meta-security -b mickledore

Information

Validated on commit d7db0a3bd1a8639df7570483f003ce00cbe274a2

For a new environment

Source the build environment with the correct board and layer:

 cd ../..
 MACHINE=stm32mp13-disco DISTRO=openstlinux-weston BSP_DEPENDENCY='layers/meta-st/meta-st-x-linux-tpm layers/meta-st/meta-st-x-linux-aws layers/meta-aws' source layers/meta-st/scripts/envsetup.sh

For an already installed environment

Add the layers to the Yocto environment:

 cd ../..
 source layers/meta-st/scripts/envsetup.sh
 bitbake-layers add-layer ../layers/meta-st/meta-st-x-linux-aws/ ../layers/meta-st/meta-st-x-linux-tpm/ ../layers/meta-aws/ ../layers/meta-security

1.3. Build the image[edit | edit source]

 bitbake st-image-aws

Information

Note that building the image might take a long time depending on the host computer performance.

1.4. Program the built image[edit | edit source]

Follow this link to see how to program the built image.

2. Main software modifications[edit | edit source]

Through the X-LINUX-AWS Distribution Package, the OpenSTLinux distribution is mainly changed at two levels:

The Linux^® kernel configuration and Device tree level with the X-LINUX-TPM Expansion Package integration.
User space bringing necessary libraries and tools to use AWS Greengrass, OP-TEE, and the TPM expansion board features.

List of modifications:

recipes-iot/aws-iot-greengrass/greengrass-bin_%.bbappend
- Installation of Greengrass core software into directory /opt/greengrass/v2/
- Download and installation of AmazonRootCA1 certificate
- Download and installation of Pkcs11Provider 2.0.6 to use (hard or soft) Security Module at first connection
- Configuration file modifications

recipes-security/optee/optee-os-stm32mp_3.19.0.bbappend
- Installation of PKCS11 OP-TEE Trusted Application

recipes-security/latchset/pkcs11-provider.bb
- Installation of PKCS#11provider for OpenSSL 3.x
- Installation of OpenSSL PKCS#11 provider configuration file

recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_%.bbappend
- Creation of a directory /etc/tpm2_pkcs11/ to store some metadata to make the tpm2-pkcs11 library operate correctly.

Information

You can also define that location with the TPM2_PKCS11_STORE environment variable.

In that case, the TPM2_PKCS11_STORE environment variable must be set in the /lib/systemd/system/greengrass.service file

Check the tpm2-software documentation for more details.

recipes-samples/demo-application/demo-application-aws.bb
- Grant user weston the right to perform some operations
- Creation of a demonstration application to:
  - Visualize current Greengrass Core Device configuration
  - Show Greengrass component status
  - Interact with an MQTT network by subscribing and publishing to topics

recipes-st/images/st-image-aws.bb
- Creation of a custom build image