Building NVIDIA Yocto Project-based Components#

You can build NVIDIA Yocto project-based components by performing the following steps.

Prerequisites#

Users on Ubuntu 24.04 hosts must disable AppArmor restrictions for unprivileged user namespaces to effectively run the bitbake tool by executing the following as root before continuing with steps below:
```
$ echo 0 > /proc/sys/kernel/apparmor_restrict_unprivileged_userns
```
For more information, see Ubuntu Release Notes.
Optional: If the system on which the Yocto build is performed is low on system RAM, additional swap space should be allocated to increase system’s virtual memory to avoid out-of-memory failures by running the following commands:
```
$ sudo dd if=/dev/zero of=/mnt/swapfile bs=1M count=16384
```
```
$ sudo chmod 600 /mnt/swapfile
```
```
$ sudo mkswap /mnt/swapfile
```
```
$ sudo swapon /mnt/swapfile
```

Procedure#

Because Yocto does not allow launching builds as root, switch to a non-root userid by running the following command:
```
$ sudo su nvidia
```
When prompted, use the password nvidia.
Set up the Yocto environment in Docker by using the automated setup_yocto_env.sh script, which must be executed prior to launching the bitbake tool:
1. Set the NV_WORKSPACE environment variable:
```
$ export NV_WORKSPACE=/drive/
```
2. Change to the following directory:
```
$ cd $NV_WORKSPACE/drive-linux_src/yocto/scripts
```
3. Run the script:
```
$ source setup_yocto_env.sh
```
Optional: If you are building compute bits like CUDA, CUDNN, and TRT, run the Artifactory Download Tool to setup the toolkits as mentioned in Downloading and Copying Additional DriveOS Packages for Yocto Project Builds.
Set the IMAGE_TYPE, KERNEL_CONFIG_TYPE, and COPYTARGET_VARIANT environment variables:

Note

For a complete set of valid combinations for these environment variables, see Reference.
1. Select the type of image by setting the IMAGE_TYPE environment variable:
```
$ export IMAGE_TYPE=<type>
```
  Replace <type> with one of the following:
  
  prod
  Rootfs with upstream OSS (baseline Yocto distro) and Tegra software libraries
  
  samples
  Rootfs with contents of prod plus NVIDIA DriveOS samples (NVmedia, Gfx, and other samples)
  
  debug-utils
  Rootfs with contents of prod plus utilities to support debugging and profiling (OSS and NV-proprietary debug utilities)
  
  full (default)
  Superset rootfs with everything in prod, samples, and debug-utils packaged
2. Select the flavor of kernel to build by setting the KERNEL_CONFIG_TYPE environment variable:
```
$ export KERNEL_CONFIG_TYPE=<type>
```
  Replace <type> with one of the following: standard (default), production, safety, production_debug, or safety_debug.
3. Set the COPYTARGET_VARIANT environment variable to either rfs (default for tegra-drive-os-av-image) or boot_initramfs (for initramfs builds):
```
$ export COPYTARGET_VARIANT=<rfs|boot_initramfs>
```
4. (Optional) To build kernel modules from source (default method is to package prebuilt kernel) with the Yocto build:
```
$ export K_BUILD_SOURCE=1
```
Build the component or image, depending on the recipe, by running the following command:
```
$ bitbake <recipe>
```
For example, you can replace <recipe> with one of the following BitBake recipes of interest:

tegra-initramfs-boot
Cold boot initramfs

tegra-prod-initramfs-boot
Cold boot initramfs with production config

tegra-drive-os-av-image
Yocto DRIVE AV rootfs
For kernel security feature configurations, see the following steps:
1. The default kernel recipe uses prebuilt components to account for signature matching of the base kernel and Tegra kernel modules. To rebuild the base kernel from the source, launch bitbake on the linux-nvidia recipe manually.
2. SELinux support is enabled in Yocto with default mode as permissive. If you need to begin testing system behavior in enforcing mode, you must modify the DEFAULT_ENFORCING to enforcing in the following file:
```
${NV_WORKSPACE}/drive-linux_yocto/yocto/layers/meta-drive/recipes-security/refpolicy/refpolicy-minimum_%.bbappend
```
3. To enable read-only root filesystem and dm-verity kernel security features, see DM-Verity and Read-Only File System Support.
Note

To disable Auto IP Assignment (APIPA) on the target, append LinkLocalAddressing=no in the [Network] section of the /etc/systemd/networkd.conf file.

Reference#

The following table documents valid combinations for the IMAGE_TYPE, KERNEL_CONFIG_TYPE, COPYTARGET_VARIANT, and PCT environment variables:

`IMAGE_TYPE`	`KERNEL_CONFIG_TYPE`	`COPYTARGET_VARIANT`	`PCT`
`full`	`standard`	`rfs`	`dev_nsr`
`prod`	`standard`	`rfs`
`samples`	`standard`	`rfs`
`debug-utils`	`standard`	`rfs`
`prod`	`production`	`rfs`	`prod_nsr`
`samples`	`production`	`rfs`	`prod_nsr`
`full`	`production_debug`	`rfs`	`test_nsr`
`samples`	`production_debug`	`rfs`
`debug-utils`	`production_debug`	`rfs`
N/A	`standard`	`boot_initramfs`	any
N/A	`production`	`boot_initramfs`	any