CARRIER GRADE PROFILE FOR WIND RIVER LINUX

Transcription

1 AN INTEL COMPANY CARRIER GRADE PROFILE FOR WIND RIVER LINUX Carrier Grade Profile for Wind River Linux meets the registration requirements of the Linux Foundation s Carrier Grade Linux 5.0 specification. As an add-on profile for Wind River Linux 9.0, this turnkey solution delivers all of the technologies essential to building a powerful, flexible, responsive, stable, and secure platform. Built on the Yocto Project Compatible Wind River Linux platform, Carrier Grade Profile provides complete architecture support across major BSPs, with increased interoperability allowing changes to fit your future business needs while reducing switching costs and development effort. Backed by our unrivaled global support and services, Carrier Grade Profile provides essential capabilities for all industries, enabling the next generation of embedded Linux designs that require secure, standards-based, and reliable solutions. TABLE OF CONTENTS Technical Specifications... 2 Key Features... 2 Carrier Grade Kernel... 2 Carrier Grade User Space... 3 Broader Testing... 4 Yocto Project Compatibility... 6 Wind River Professional Services... 7 Contact Support... 7 Product Note WHEN IT MATTERS, IT RUNS ON WIND RIVER

2 TECHNICAL SPECIFICATIONS Linux base: Wind River Linux 9 Supported processor architectures: Full architecture support for any BSP provided in the Wind River Linux 9 base Linux Foundation s Carrier Grade Linux registration: Specification 5.0 Yocto Project version: 2.2 (Wind River Linux 9.0) KEY FEATURES Carrier Grade Kernel The kernel updates in Wind River Linux form the basis of many features to support Carrier Grade Linux (CGL) registration, including the following: Error Detection and Correction (EDAC): A set of Linux kernel modules for reporting and handling hardware-related errors Security Enhanced Linux (SELinux): A full-featured Linux Security Module providing a reference monitor capable of providing multilayer security and multi-category security, implementing both mandatory access control (MAC) and role-based access control (RBAC) Interrupt threading: Configuring interrupt handling and scheduling handler routines as any other software thread, allowing for maximum flexibility and higher predictability when designing a system Logical Volume Management (LVM): The ability to dynamically resize disks on a system according to changing needs Low latency event monitoring: A variant of poll(2) that can be used as either an edge-or a level-triggered interface that scales well to large numbers of watched file descriptors Open Cryptographic Framework: Transparent hardware-accelerated cryptographic support for specific BSPs Redundant array of independent disks (RAID): Both software and hardware RAID support, including striping Reliable file system support: Various highly reliable file systems are supported (e.g., ext4, btrfs, ocfs2) Group management: Support for grouping sets of processes together, for use with process control subsystems such as cpusets, CFS, memory controls, and device isolation; includes net traffic controller, memrlimit controller, dm-ioband bio_tracking, and group scheduling controllers kdump: Kernel crash dump for analyzing the cause of a deployed kernel crash kexec: A system call that provides the ability to shut down the current kernel and start another without rebooting hardware Persistent data storage: Data storage that persists across reboots for storing debug and log information (e.g., pstore) Profiling: Support for kernel and system-call profiling through LTTng and perf (rich abstractions over hardware performance monitoring capabilities; per-task, per-cpu, and per-workload counters and counter groups and sampling capabilities) 2 Product Note

3 Carrier Grade User Space In addition to the kernel features, the Carrier Grade Profile for Wind River Linux user space is a hardened, reliable base on which to develop applications and systems, whether they are headless, remote systems or must support multiple concurrent users with varying levels of access and clearance. Supported features include the following: SELinux and the Reference Policy SELinux is a full-featured Linux Security Module providing a reference monitor capable of providing multilayer security and multi-category security, implementing both MAC and RBAC. Based on the SELinux official reference policy and the Yocto Project selinux layer, the Wind River SELinux reference policy is tailored to support both strict and mcs modes out of the box. Security Originally developed by the National Security Agency (NSA), SELinux is the gold standard of flexible and trusted computing environments. SELinux is both a Linux Security Module (LSM) a piece of the kernel that arbitrates access to all system resources based on the system policy and a collection of supporting user space tools for developing, applying, enforcing, auditing, and debugging the security policy used by the LSM. Wind River Linux includes three levels of security out of the box for SELinux-enabled configurations, based on the SELinux Reference Policy Project and configured specifically for Wind River Linux. Wind River Linux also includes advanced, preemptive security technologies such as multilevel run-time stack and buffer overflow protection and a suite of tools that together provide a complete intrusion detection and prevention system. Reliability, Availability, Manageability Carrier Grade Profile meets the SCOPE Alliance Linux profile and addresses key SCOPE Alliance gaps. Relevant features include persistent shared memory with the system black box, coherent user and kernel tracing framework with LTTng, run-time analysis tools, and common command-line tools such as strace and ltrace for doing system call and library tracing. The following Carrier Grade Profile features go beyond the existing CGL requirements: Coarse resource enforcement that allows memory and scheduling limits to be enforced on a group basis rather than per process or per object Layer 2 Tunneling Protocol (L2TP version 3) support File access tracing that provides extensive logging and notification options for monitoring file access and recording system events Redundant virtual routing support, based on the Common Address Redundancy Protocol, that provides the ability to create highly available dynamic routers and gateways 3 Product Note

4 Feature-rich IPsec environment ranging from simple certificate creation and management to cryptographic reliability and integrity self-tests Dynamic multi-category security management tools for virtual guests through libvirt and the SELinux svirt tools Support for advanced system architectures that leverage memory and processor latency domains with tools such as numactl and libnuma that enable application and system designers to get the best performance out of their real and virtual machines Reliable damage-resistant file system support, detailed in the CGL 5.0 specification, including data and metadata integrity checking mechanisms With support for standalone and clustered systems as well as the PICMG Advanced Telecommunications Computing Architecture (ATCA) specification, Carrier Grade Profile provides highly available solutions for devices at the network core and edge. Network-Based Storage Solutions Carrier Grade Profile provides functionality for centralized logging servers, centralized billing and accounting servers, and share file system servers by integrating technologies such as the distributed replicated block device (DRBD), multiple redundant communication paths to external storage over fiber channel links, ATA over Ethernet, the Oracle Cluster File System version 2 (OCFS2), and Internet Small Computer System Interface (iscsi). IP Security (IPsec) Carrier Grade Profile supports a number of mechanisms for establishing trust between two systems with IPsec, the most common being Internet Key Exchange (IKE, both version 1 and version 2). IKE sets up a shared session secret via a Diffie-Hellman key exchange, using either public key techniques or a pre-shared key. IKE functionality can come from the IPsec- Tools suite in the form of the racoon daemon or from a dedicated IPsec implementation provided by strongswan. All of the expected standards (for example, X.509 for single sign-on, AH and ESP for header and payload encapsulation, IKEv2 for mobile devices via MOBIKE RFC 4555, and HMAC-SHA-256+/RFC 4868 and Suite B cryptography/rfc 4869 for IPSec) are available through IPsec-Tools or the strongswan suite. Broader Testing Wind River is committed to implementing and conforming to standards wherever possible. That commitment extends well beyond the Linux Foundation s Carrier Grade specification. As with past releases of Wind River Linux, Carrier Grade Profile for Wind River Linux provides all the necessary tools to validate conformance to the Linux Standard Base 4.1 Specification. Wind River Linux 8.0 and Carrier Grade Profile are not certified but maintain the IPv6-Ready status and can be certified if required. Carrier Grade Profile is the first version of Wind River Linux to undergo IPv4/IPv6 conformance testing, resulting in a more complete, interoperable product, and a more complete view of platforms based on it. 4 Product Note

5 Wind River has developed a robust, scalable, and automated build and test infrastructure with more than 5,500 test cases and 650,000 test runs. This infrastructure supports many processor architectures and uses a combination of commercial, open source, and proprietary tests, including LTP Core, LTP Network, LSB, TAHI, IxANVL, and Open POSIX. Wind River uses coverage tools, such as gcov and lcov, to optimize test development and close gaps in existing test suites. Automated and manual tests include the following: Automated boot login: This tests the booting process of any target architecture for a given kernel and rootfs. The process is completely automated for a set of targets, which helps in determining the boot sanity of the target. CD sanity: This automation suite covers CD installation on a new release, followed by building the rootfs for various target combinations using prebuilt RPMs. It boots the target with the prebuilt kernel and rootfs and executes KGDB and user-mode tests on the target, then reports the results to the database. Linux Test Project (LTP): This test suite validates the reliability, robustness, and stability of the Linux kernel and its network components. Open Hardware Platform Interface (HPI): The Open HPI is an abstracted interface for managing computer hardware, typically chassis and rack-based servers. It includes resource modeling; access to and control over sensor, control, watchdog, and inventory data associated with resources; abstracted System Event Log interfaces; hardware events and alarms; and a managed hotswap interface. Open POSIX: This test suite is for POSIX 2001 APIs not tied to specific implementations. It provides conformance, functional, and stress testing, with an initial focus on threads, clocks and timers, signals, message queues, and semaphores. Real-Time Feature Testing with Lmbench: Real-Time Feature Testing tests performance. LMBench mainly measures two categories of system performance: latency and bandwidth. Saftest: Saftest tests the Open HPI package. Kernel Test Suite (KTS): This package tests kernel features against architecture and hardware configurations. User Space Test Suite: User space tests verify that user packages have compiled and operated correctly in target run-time systems. Toolchain: This verifies that toolchains comply and operate correctly in target run-time systems. nmap: This is a network exploration tool and security scanner. Netperf: This tool tests networking performance. CGL compliance: This tests more than 113 P1 requirements. kexec and core-dump, server-based install: This tests CGL features. TAHI IPv6 conformance: The TAHI Project is a joint effort to develop and provide verification technology for IPv6. The TAHI IPv6 conformance tests ensure interoperability with IPv6 protocols. 5 Product Note

6 iozone: This is a file system performance test tool. IxANVL: This is an IPv4 IPsec compliance test, including IKEv2, IPSEC-AH, IPSEC-EP, and IPSEC-IKE. Footprint: This tests the static kernel footprint. Static rootfs footprint: This tests the static rootfs footprint size. Dynamic footprint: This tests the run-time system footprint. Boot-time: This measures board boot-up time. BSP Test Suite (BTS): Along with new BSPs, there are board-specific tests mentioned in the board readme file. Documentation: Documentation for Wind River Linux 8.0 was tested to make sure all steps are properly recorded. Host OS: Installation is tested on various host operating systems supported for Wind River Linux 8.0, as well as sample application build and debugging from Wind River Workbench and platform build. HRT regression: HRT features for previous releases were tested for regression on the supported platforms. Out-of-box experience: Tests validate customers specialized workflows for installation and upgrades, so the customers can install and upgrade their products smoothly and rapidly. Regression testing (RT) regression: RT features in previous releases were tested for regression on the supported platforms. Use case: The use cases for Workbench, run-time analysis tools, and build system were tested on supported hosts and platforms. Workbench integration: Wind River tests the feature integration of Workbench with Wind Manage, System Viewer, and run-time analysis tools. Yocto Project Compatibility Similar to an OpenEmbedded metadata layer, Carrier Grade Profile for Wind River Linux builds on top of the Yocto Project Compatible base of Wind River Linux. The OpenEmbedded meta-networking layer is the foundation layer between the Yocto Project and Carrier Grade Profile. Meta-networking provides common services required in carrier grade systems (e.g. File Transfer Protocol (FTP) daemons and network configuration, and authentication tools like autofs and Network Information Service (NIS)). Carrier Grade Profile provides more complex components (e.g., Cluster management services like the Corosync Cluster Engine) that assume the presence of such infrastructure in the underlying layers. Carrier Grade Profile also draws upon the meta-selinux layer, leveraging the work done by the OpenEmbedded community to integrate SELinux features into the Yocto base. Carrier Grade Profile also extends meta-selinux upward in order to fully provide the features required by the Security Requirements Definition of the CGL specification. 6 Product Note

7 CONTACT SUPPORT North America, South America, and Asia/Pacific Toll-free: (800-USA-4WRS) Tel.: Fax: Hours: 6:00 a.m. 5:00 p.m. (Pacific time) Japan Tel.: Fax: Hours: 9:00 a.m.to 5:30 p.m. (local time) Europe, Middle East, Africa support-ec@windriver.com Toll-free: France tel.: France fax: Germany tel.: Germany fax: Italy tel.: Italy fax: Middle East region tel.: Middle East region fax: Nordic tel.: Nordic fax: UK tel.: UK fax: Hours: 9:00 a.m.to 6:00 p.m. (local time) WIND RIVER PROFESSIONAL SERVICES Wind River has the proven expertise to customize Carrier Grade Profile for Wind River Linux platforms to your unique device requirements and maintain the stack for the long term. Our embedded Linux experts can help you plan, build, and manage even the most advanced andmission-critical Yocto Project Compatible software. Take your product to the next level with these solutions: Embedded Linux architecture and design Yocto Project Compatible BSP factory BSP creation, compatibility submission, and maintenance Support for ARM, x86, Power, MIPS Yocto Project Compatible and carrier grade middleware and kernel development Networking, security, medical Real-time, graphics Migration from roll-your-own or hardware vendor provided Linux to Carrier Grade Profile for Wind River Linux Acceleration of embedded multi-core Linux designs using open source and Wind River Hypervisor based virtualization Benchmark, functional, and performance testing and documentation IP compliance and results documentation and analysis based on the Linux Foundation s Software Package Data Exchange (SPDX) specification Long-term support and maintenance of your Yocto Project Compatible custom software Wind River Professional Services can help you meet your robustness, functionality, and security requirements to rapidly and cost-efficiently deliver your next-generation embedded Carrier Grade Linux device. Wind River is a global leader in delivering software for the Internet of Things. The company s technology is found in more than 2 billion devices, backed by world-class professional services and customer support. Wind River delivers the software and expertise that enable the innovation and deployment of safe, secure, and reliable intelligent systems Wind River Systems, Inc. The Wind River logo is a trademark of Wind River Systems,Inc., and Wind River and VxWorks are registered trademarks of Wind River Systems, Inc. Rev. 06/2017