X-LINUX-AWS Distribution Package

Applicable for

1. Generate X-LINUX-AWS OpenSTLinux distribution[edit source]

With the following procedure, you can generate the complete distribution enabling the X-LINUX-AWS Expansion Package.
This procedure is mandatory to use TPM on the X-LINUX-AWS Expansion Package.

1.1. Download the Distribution Package[edit source]

Install the OpenSTLinux Distribution Package by following the dedicated article (STM32MPU Distribution Package) but do not initialize the OpenEmbedded environment (do not source the envsetup.sh).

1.2. Install X-LINUX-AWS environment[edit source]

1.2.1. Clone the meta-st-x-linux-aws git repository[edit source]

Warning

The software package is provided AS IS, and by downloading it, you agree to be bound to the terms of the software license agreement (SLA0048). The detailed content licenses can be found here.

For ecosystem release v5.1.0 , use X-LINUX-AWS v5.1.0:

 cd <Distribution Package installation directory>/layers/meta-st
 git clone https://github.com/STMicroelectronics/meta-st-x-linux-aws.git -b v5.1.0

For ecosystem release v5.0.0 , use X-LINUX-AWS v5.0.0:

 cd <Distribution Package installation directory>/layers/meta-st
 git clone https://github.com/STMicroelectronics/meta-st-x-linux-aws.git -b v5.0.0

1.2.2. Clone the meta-st-x-linux-tpm git repository[edit source]

For ecosystem release v5.1.0 , use and X-LINUX-TPM v5.1.0:

 cd <Distribution Package installation directory>/layers/meta-st
 git clone https://github.com/STMicroelectronics/meta-st-x-linux-tpm.git -b 5.1.0

For ecosystem release v5.0.0 , use and X-LINUX-TPM v5.0.0:

 cd <Distribution Package installation directory>/layers/meta-st
 git clone https://github.com/STMicroelectronics/meta-st-x-linux-tpm.git -b 5.0.0

1.2.3. Clone the meta-aws git repository[edit source]

 cd <Distribution Package installation directory>/layers
 git clone https://github.com/aws4embeddedlinux/meta-aws.git -b mickledore

Information

Validated on commit b288fb9d29f67af79de07f039429fcf921e2abd3

1.2.4. Clone the meta-security git repository[edit source]

 cd <Distribution Package installation directory>/layers
 git clone https://git.yoctoproject.org/meta-security -b mickledore

Information

Validated on commit d7db0a3bd1a8639df7570483f003ce00cbe274a2

1.2.5. Configure Yocto project[edit source]

For a new environment

Source the build environment with the correct board and layers:

For STM32MP257x-EV1

 cd <Distribution Package installation directory>
 MACHINE=stm32mp25-eval DISTRO=openstlinux-weston BSP_DEPENDENCY='layers/meta-st/meta-st-x-linux-tpm layers/meta-st/meta-st-x-linux-aws layers/meta-aws' source layers/meta-st/scripts/envsetup.sh

For STM32MP135x-DK

 cd <Distribution Package installation directory>
 MACHINE=stm32mp13-disco DISTRO=openstlinux-weston BSP_DEPENDENCY='layers/meta-st/meta-st-x-linux-tpm layers/meta-st/meta-st-x-linux-aws layers/meta-aws' source layers/meta-st/scripts/envsetup.sh

For an already installed environment

Add the layers to the Yocto environment:

 cd <Distribution Package installation directory>
 source layers/meta-st/scripts/envsetup.sh
 bitbake-layers add-layer ../layers/meta-st/meta-st-x-linux-aws/ ../layers/meta-st/meta-st-x-linux-tpm/ ../layers/meta-aws/ ../layers/meta-security

1.3. Build the image[edit source]

 bitbake st-image-aws

Information

Note that building the image might take a long time depending on the host computer performance.

1.4. Program the built image[edit source]

Follow this link to see how to program the built image.

2. Main software modifications[edit source]

Through the X-LINUX-AWS Distribution Package, the OpenSTLinux distribution is mainly changed at two levels:

The Linux^® kernel configuration and Device tree level with the X-LINUX-TPM Expansion Package integration.
User space bringing necessary libraries and tools to use AWS Greengrass, OP-TEE, and the TPM expansion board features.

List of modifications:

recipes-iot/aws-iot-greengrass/greengrass-bin_%.bbappend
- Installation of Greengrass core software into directory /opt/greengrass/v2/
- Download and installation of AmazonRootCA1 certificate
- Download and installation of Pkcs11Provider 2.0.6 to use (hard or soft) Security Module at first connection
- Configuration file modifications

recipes-security/latchset/pkcs11-provider.bb
- Installation of PKCS#11provider for OpenSSL 3.x
- Installation of OpenSSL PKCS#11 provider configuration file

recipes-tpm2/tpm2-pkcs11/tpm2-pkcs11_%.bbappend
- Creation of a directory /etc/tpm2_pkcs11/ to store some metadata to make the tpm2-pkcs11 library operate correctly.

Information

You can also define that location with the TPM2_PKCS11_STORE environment variable.

In that case, the TPM2_PKCS11_STORE environment variable must be set in the /lib/systemd/system/greengrass.service file

Check the tpm2-software documentation for more details.

recipes-samples/demo-application/demo-application-aws.bb
- Grant user weston the right to perform some operations
- Creation of a demonstration application to:
  - Visualize current Greengrass Core Device configuration
  - Show Greengrass component status
  - Interact with an MQTT network by subscribing and publishing to topics

recipes-st/images/st-image-aws.bb
- Creation of a custom build image