Key Features ​

Scenario-specific AI Innovations ​

AI is redefining OSs by powering intelligent development, deployment, and O&M. openEuler supports general-purpose architectures like Arm, x86, and RISC-V, and next-gen AI processors like NVIDIA and Ascend. Further, openEuler is equipped with extensive AI capabilities that have made it a preferred choice for diversified computing power.

OS for AI ​

Ready-to-Use Availability ​

openEuler offers an efficient development and runtime environment that containerizes software stacks of AI platforms with out-of-the-box availability. It also provides various AI frameworks to facilitate AI development.

openEuler supports TensorFlow, PyTorch, and MindSpore frameworks and software development kits (SDKs) of major computing architectures, such as Compute Architecture for Neural Networks (CANN) and Compute Unified Architecture (CUDA), to make it easy to develop and run AI applications.

Environment setup is further simplified by containerizing software stacks. openEuler provides three types of container images:

• SDK images: Use openEuler as the base image and install the SDK of a computing architecture, for example, Ascend CANN and NVIDIA CUDA.
• AI framework images: Use an SDK image as the base and install AI framework software, such as PyTorch and TensorFlow. Users can use an AI framework image to quickly build a distributed AI framework, such as Ray.
• Model application images: Provide a complete set of toolchains and model applications.

For details, see openEuler AI Container Image User Guide.

sysHAX ​

The sysHAX large language model (LLM) heterogeneous acceleration runtime enhances model inference performance in single-server, multi-xPU setups by optimizing Kunpeng + xPU (GPU/NPU) resource synergy.

• CPU inference acceleration: Improves CPU throughput via NUMA-aware scheduling, parallelized matrix operations, and SVE-optimized inference operators.
• Heterogeneous converged scheduling: When GPUs are fully loaded, the prefill phase of an inference request can be executed on GPUs while the decode phase is handled by CPUs.

GMEM ​

In the post-Moore era, there have been breakthroughs in GPUs, TPUs, FPGAs, and other dedicated heterogeneous accelerators. Similar to CPUs, these devices increase computing speeds by storing data in local memory (such as LPDDR SDRAM or HBM), but such design catalyzes more complicated memory systems. Modern memory systems have the following defects:

• Memory management is split between CPUs and accelerators. Explicit data migration makes it difficult to balance the usability and performance of accelerators' memory.
• The high bandwidth memory (HBM) available on accelerators is often insufficient for foundation models. Manual swapping is only feasible in limited scenarios and typically results in significant performance degradation.
• A large number of invalid data migrations occur in search & recommendation and big data scenarios, and no efficient memory pooling solution is available.

Heterogeneous Memory Management (HMM) is a Linux feature that is plagued by issues of poor programming, performance, and portability, while also relying heavily on manual tuning. As such, it is unfavored by most OS communities, and has fueled demand for an efficient solution for heterogeneous accelerators. Generalized Memory Management (GMEM) is one new option, which offers a centralized management mechanism for heterogeneous memory connections. GMEM APIs are compatible with native Linux APIs, and feature high usability, performance, and portability. After an accelerator calls GMEM APIs to connect its memory to the unified address space, the accelerator automatically obtains the programming optimization capability for heterogeneous memory, and does not need to execute the memory management framework multiple times. This greatly reduces development and maintenance costs. Developers can apply for and release a unified set of APIs to achieve heterogeneous memory programming without memory migrations. If the HBM of an accelerator is insufficient, GMEM can use the CPU memory as the accelerator cache to transparently over-allocate the HBM without manual swapping. GMEM offers an efficient memory pooling solution thanks to a shared memory pool that eliminates the need for duplicate migrations.

ModelFS ​

ModelFS addresses the model loading bottleneck during the startup phase of large language model (LLM) inference. While existing approaches often sacrifice compatibility for performance, real-world industrial deployment demands seamless integration with existing ecosystems. ModelFS bridges this gap by achieving state-of-the-art loading performance through optimized file system cache policies, without compromising compatibility. Specifically, it introduces a non-intrusive, flexible, and lightweight programmable page cache framework in the kernel, enabling users to customize file system page cache policies. Building on this framework, we provide a reference implementation optimized to accelerate model loading.

• ModelFS-K: The kernel module of ModelFS provides a programmable framework for the file system page cache. Its core design is a stacked file system that can be mounted on top of an existing file system. ModelFS-K redirects the logic of the underlying file system to user-space prefetch() and evict() functions via user-space procedure calls (UPCs).
• ModelFS-U:The user-space module of ModelFS provides the runtime environment for cache policies. It offers a VFS-like programming framework in user space, allowing model implementers and I/O optimizers to customize cache policies based on the I/O characteristics of model loading. Users need to implement the init(), exit(), prefetch(), and evict() functions. ModelFS-U registers these functions with ModelFS-K and is responsible for parsing I/O events as well as performing asynchronous data prefetching and eviction at runtime.

AI for OS ​

AI makes openEuler more intelligent. openEuler Intelligence is an AI-powered Q&A platform built on openEuler data. It enables workflow orchestration through semantic interfaces and agent building through MCP. Additionally, it integrates some system services to further improve the intelligence of openEuler.

Intelligent Q&A ​

The openEuler Intelligence system is accessible via web or shell.

• Intelligent planning, scheduling, and recommendation

  • Intelligent planning: The agent applications of openEuler Intelligence can plan steps in real time based on user input and available tools, continuing until the user's objective is achieved or the maximum number of steps is reached.
  • Intelligent scheduling: openEuler Intelligence allows users to define multiple workflows within a workflow application. When a query request is made, openEuler Intelligence automatically extracts the relevant parameters and selects the most suitable workflow to execute the query task.
  • Intelligent recommendation: Based on users' query requests and workflow execution results, openEuler Intelligence recommends workflows that may be useful in future tasks, increasing the likelihood of task completion and making applications easier to use.

• Workflow applications

  • Semantic interfaces: A semantic interface contains natural language comments. openEuler Intelligence supports two methods for registering semantic interfaces.
  • Workflow orchestration and invocation: openEuler Intelligence enables users to visually connect built-in semantic interfaces and user-registered interfaces to create workflows. Users can debug these workflows, and then release and use them as applications. When workflows are debugged and executed, intermediate results are displayed to help lower debugging costs and enhance the overall user experience.

• Agent applications

  • MCP registration, installation, and activation: MCP is a mainstream AI-related protocol. It uses SDKs to encapsulate complex and diverse services with natural semantic information, allowing AI to easily invoke tools and services reconstructed based on MCP.

  • Agent building and use: openEuler Intelligence allows building agents based on MCP and various foundation models. These agents can decompose a user's objective into phased tasks using the configured model information and the user-provided objective. MCP tools are then used to complete each task until the user's objective is achieved.

• RAG

  Retrieval-augmented generation (RAG) extends LLM long-term memory while significantly reducing training overhead. openEuler Intelligence optimizes the end-to-end RAG pipeline, from pre-processing and knowledge indexing to advanced retrieval algorithms and post-processing.

• Team management

  Team management is a fundamental capability of the RAG technology in openEuler Intelligence. It leverages role-based access control (RBAC) to manage team members' access to roles, users, and assets, thereby enhancing the overall usability of the knowledge base.

• Corpus governance

  Corpus governance is one of the basic RAG capabilities in the openEuler Intelligence system. It imports corpuses into the knowledge base in a supported format using context location extraction, text summarization, and OCR, increasing the retrieval hit rate.

• Automated testing

  Automated testing is a core RAG capability in openEuler Intelligence. It detects shortcomings in the knowledge base and retrieval augmentation algorithms through automated dataset generation and evaluation.

Intelligent Tuning ​

The openEuler Intelligence system supports the intelligent shell entry. Through this entry, users can interact with openEuler Intelligence using a natural language and perform heuristic tuning operations such as performance profiling, system performance analysis, and system performance tuning. The MCP protocol can be used to detect tuning intents.

Intelligent Diagnosis ​

• Interference detection: The container interference detection tool monitors nodes over a specified period, identifies interference, and reports the affected containers along with the corresponding metrics.
• Interference source analysis: The container interference source analysis tool identifies all affected containers on a node and reports the top three suspected interference source containers, along with the associated metrics (such as CPU run delay) for each affected container.
• Interference recovery suggestion: Based on the results of interference source analysis, the interference recovery suggestion tool analyzes the interference and generates a report with recommended recovery actions, including the rationale and example commands for each suggestion.

AI Cluster Slow-Node Demarcation ​

Performance degradation during AI cluster training is inevitable and often results from a wide range of complex factors. Existing solutions rely on log analysis after performance degradation occurs. However, it can take 3 to 4 days from log collection to root cause diagnosis and issue resolution on the live network. To address these pain points, an online slow node detection solution is offered. This solution allows for real-time monitoring of key system metrics and uses model- and data-driven algorithms to analyze the observed data and pinpoint slow or degraded nodes. This facilitates system self-healing and fault rectification by O&M personnel.

Grouped metric comparison helps detect slow nodes and cards in AI cluster training. This technology is built on Systrace and includes a configuration file, an algorithm library, and a slow node analysis mechanism based on both time and space dimensions. It outputs the exception timestamp, abnormal metrics, and IP addresses of slow nodes and cards. This technology enhances overall system stability and reliability.

Intelligent Container Images ​

The openEuler Intelligence system can invoke environment resources through a natural language, assist in pulling container images for local physical resources, and establish a development environment suitable for debugging on existing compute devices. This system supports three types of containers, and container images have been released on Docker Hub. Users can manually pull and run these container images.

• SDK layer: encapsulates only the component libraries that enable AI hardware resources, such as CUDA and CANN.
• SDKs + training/inference frameworks: accommodates TensorFlow, PyTorch, and other frameworks (for example, tensorflow2.15.0-cuda12.2.0 and pytorch2.1.0.a1-cann7.0.RC1) in addition to the SDK layer.
• SDKs + training/inference frameworks + LLMs: encapsulates several models (for example, llama2-7b and chatglm2-13b) based on the second type of containers.

Embedded ​

openEuler 24.03 LTS SP3 is suited for embedded applications, offering significant progress in southbound and northbound ecosystems, technical features, infrastructure, and implementation over previous generations.

openEuler Embedded provides a closed loop framework often found in operational technology (OT) applications such as manufacturing and robotics, whereby innovations help optimize its embedded system software stack and ecosystem. openEuler Embedded enhances its software package ecosystem by incorporating the oeBridge feature, which supports online software installation from an openEuler mirror site. When building Yocto images, oeBridge can be used to install openEuler RPM packages for easy image customization. openEuler Embedded also supports the oeDeploy feature for quick deployment of AI and cloud-native software stacks. Kernel support in openEuler is enhanced by optimizing the meta-openEuler kernel configuration and the oeAware real-time tuning feature. These updates help control interference and improve real-time system responsiveness.

Future versions of openEuler Embedded will integrate contributions from ecosystem partners, users, and community developers, increase support for chip architectures such as LoongArch and more southbound hardware, and optimize industrial middleware, embedded AI, embedded edge, and simulation system capabilities.

• Southbound ecosystem: openEuler Embedded Linux supports mainstream processor architectures like AArch64, x86_64, AArch32, and RISC-V, and will extend support to LoongArch in the future. openEuler 24.03 and later versions have a rich southbound ecosystem and support chips from Raspberry Pi, HiSilicon, Rockchip, Renesas, TI, Phytium, StarFive, and Allwinner.
• Embedded virtualization base: openEuler Embedded uses an elastic virtualization base that enables multiple OSs to run on a system-on-a-chip (SoC). The base incorporates a series of technologies including bare metal, embedded virtualization, lightweight containers, LibOS, trusted execution environment (TEE), and heterogeneous deployment.
• MICA deployment framework: The MICA deployment framework is a unified environment that masks the differences between technologies that comprise the embedded elastic virtualization base. The multi-core capability of hardware combines the universal Linux OS and a dedicated real-time operating system (RTOS) to make full use of all OSs.
• Northbound ecosystem
  • Over 700 common embedded software packages can be built using openEuler.
  • Soft real-time kernel helps respond to soft real-time interrupts within microseconds.
  • The distributed soft bus system (DSoftBus) of openEuler Embedded integrates the DSoftBus and point-to-point authentication module of OpenHarmony. It implements interconnection between openEuler-based embedded devices and OpenHarmony-based devices as well as between openEuler-based embedded devices.
  • With iSula containers, openEuler and other OS containers can be deployed on embedded devices to simplify application porting and deployment. Embedded container images can be compressed to 5 MB, and can be easily deployed into the OS on another container.
• UniProton: An RTOS that features ultra-low latency and flexible MICA deployments. It is suited for industrial control because it supports both microcontroller units and multi-core CPUs. UniProton provides the following capabilities:
  • Compatible with processor architectures like Cortex-M, AArch64, x86_64, and riscv64, and supports M4, RK3568, RK3588, x86_64, Hi3093, Raspberry Pi 4B, Kunpeng 920, Ascend 310, and Allwinner D1s.
  • Connects with openEuler Embedded Linux on Raspberry Pi 4B, Hi3093, RK3588, and x86_64 devices in bare metal mode.
  • Can be debugged using GDB on openEuler Embedded Linux.

SuperPoD Innovation ​

The exponential growth in computing power requirements, coupled with breakthroughs in high-speed interconnect technologies, is driving the evolution of hardware from standalone nodes to SuperPoDs. Going forward, the core requirements for data, resources, and services will exhibit the following characteristics:

• Resource pooling: Compute, memory, interconnect, and storage resources can be pooled to support many-to-many collaboration.

• Scale expansion: On-demand, flexible expansion is supported, ensuring high utilization. A unified addressing mechanism is used across the entire system, reducing static transfer and dynamic latency.

• Long-term stability and reliability: The system's long-term stable runtime is improved tenfold. It supports automatic recovery, is easy to deploy, and adapts to various equipment room environments. The system can also be expanded from modules to full cabinets.

To meet the requirements for SuperPoD scheduling, pooling, communication, and virtualization, openEuler has been upgraded to support SuperPoDs, unleashing heterogeneous computing.

SuperPoD OS Architecture ​

During the implementation of SuperPoD applications, the industry faces three core challenges: streamlining the development process and enabling smooth migration of services with zero modifications, accurately matching diversified computing power supply and achieving on-demand, efficient resource release, and managing increasing system complexity while ensuring high application availability. The openEuler heterogeneous convergence system addresses the preceding challenges as follows:

• It introduces advanced system services to streamline service migration, enabling zero-modification deployment and greatly reducing development and migration costs.

• It strengthens the core subsystems for heterogeneous convergence, providing communication and virtualization capabilities that accurately match computing power requirements and maximize resource utilization.

• It enhances device pooling to support flexible SuperPoD expansion. Reliable pooling prevents fault propagation and ensures stable service operation.

UnifiedBus Architecture ​

SuperPoDs are the core of UnifiedBus-powered computing systems. They redefine computing systems, break the boundaries of computing hosts, and enable the expansion of intelligent and general-purpose computing capabilities, thereby achieving substantial performance gains. UnifiedBus represents the target computing system architecture for the future AI era. Within a SuperPoD, UnifiedBus provides an ultra-low-latency, unified multi-protocol interconnect. It fully pools and connects computing resources via peer-to-peer links, enabling flexible resource composition, ultra-large-scale networking, and high system availability. This reference consists of four layers:

• The UnifiedBus hardware implements composable computing for SuperPoDs.

  • UnifiedBus: It forms the foundation of a UnifiedBus-powered SuperPoD computing system. UnifiedBus provides bus-level unified interconnect, peer-to-peer collaboration, full resource pooling, large-scale networking, and high availability for computing clusters.
  • UB Fabric Manager (UBFM): It completes the UnifiedBus interconnect configuration, enables flexible and efficient aggregation of computing resources, optimizes computing interconnect SLAs (including latency, bandwidth, and reliability), and delivers flexible SuperPoD computing power.

• UB OS Component enables UnifiedBus and devices, and provides unified abstraction and management.

  • UB OS Component extends the Linux kernel to natively support SuperPoDs, providing unified abstraction and management of UnifiedBus devices.
  • It also maintains compatibility with POSIX interfaces to enable fast migration of existing applications.

• UB Service Core enables peak SuperPoD performance.

  A UnifiedBus-powered computing system fully leverages its advantages in memory pooling, communication, and distributed operations. It simplifies UnifiedBus resource management and scheduling, and provides high-level UnifiedBus services (via UB Service Core) to support computing applications.

UB OS Component ​

UB OS Component enhances the original OS framework of memory management, communication, device management, and virtualization to provide improved support for UB. The feature enhancements include:

• Device Mgmt: It provides UB device management capabilities, allowing hot-plug and configuration of UB devices on compute nodes. It consists of UB Device Mgmt, sysfs, udev, and UB User Driver.
• Memory Mgmt: It enables memory-semantic access for memory borrowing and sharing across compute nodes and devices within UB Domain. It consists of DMA/SVA Memory Mgmt, Pooled Memory Mgmt, UBMM Lib, and Memory Allocator.
• Communication: It implements communication and remote procedure calls (RPCs) across compute nodes and UB devices. It consists of Connection Mgmt & Communication, UBComm Lib, and Socket.
• Virtualization: It enables UB devices to be passed through to VMs. It consists of QEMU, libvirt, and vfio-ub.

Device Mgmt ​

UB device management involves UBus Driver, vfio-ub, and ubutils, which together provide a set of UB device service management interfaces. These services include device discovery, device registration, and interrupt enabling for UB device drivers; user-space passthrough to UB devices; and querying UB device information and configurations. Various UB devices can be registered with UB to perform their functions.

In the OS, UB device management functions, such as device discovery, registration, and driver loading, can be used in both single-server and cluster deployments.

• Single-server scenarios: Each server operates independently and exclusively manages its local UB devices. UBus Driver discovers and enables these devices, while vfio-ub enables user-space passthrough for direct device access.
• Cluster scenarios: In a SuperPoD, UBus Driver discovers and enables UB Entities allocated to compute nodes, supports the addition and removal of pooled devices, and works with vfio-ub to enable user-space passthrough for direct device access.

Memory Mgmt ​

In general, existing bus architectures follow a host-device model, where the host (CPU) manages each device and three independent memory access paths exist: host-to-device, device-to-host, and device-to-device. UB streamlines this model. It categorizes UB nodes as Users and Homes in the memory access model. Users can access the memory resources of Homes either synchronously (via load/store) or asynchronously (via DMA).

Based on UnifiedBus capabilities, the Ownership-Based Memory Management (OBMM) module provides inter-node data path configuration and cross-node data consistency maintenance. After the configuration is complete, users can access the memory of another node from within a UnifiedBus cluster, enabling cross-node memory sharing, memory pooling, and inter-node memory borrowing.

Communication ​

UnifiedBus Memory Development Kit (UMDK) is a distributed communication software library that provides high-performance communication interfaces for inter-card communication within data center networks, SuperPoD environments, and servers, fully utilizing UB hardware capabilities.

• UB Memory-based Socket (UMS): It can connect to the Socket abstraction layer. It is a kernel network protocol stack compatible with the Socket programming interface in the northbound direction and transmits data over the UnifiedBus network in the southbound direction. It transparently accelerates TCP applications to improve performance.
• Unified Remote Memory Access (URMA): It is a software library for communication over UnifiedBus. It masks hardware differences and provides remote memory access semantics, such as read/write, send/receive, and atomic operations. URMA serves as the foundation for UnifiedBus communication applications.
• Unified Remote Procedure Call (URPC): It is the native RPC of UnifiedBus. It supports high-performance communication between hosts and devices, accelerating remote procedure calls.

Virtualization ​

In cloud computing scenarios, hardware resources on a physical machine are isolated and provisioned to VMs through virtualization, significantly enhancing resource utilization. As a next-generation high-speed interconnect, UB natively supports virtualization.

Mainstream device virtualization technologies include I/O full virtualization, I/O paravirtualization, and hardware-assisted I/O virtualization. Under traditional architectures, each server connects to the Top of Rack (TOR) switch through its own NIC, meaning its maximum supported bandwidth is fixed. This can lead to several issues in real-world applications, as illustrated below.

A UB Entity acts as an isolated functional unit within a UB device. Virtualization in UB supports direct device assignment to VMs, delivering native-level performance. Compared to traditional hardware-assisted I/O virtualization, UB device virtualization not only supports passthrough to local UB devices but also to pooled UB devices. The preceding problems can be solved by pooling NIC and DPU resources. All device resources are aggregated in a shared device pool, allowing servers to dynamically request NIC resources based on their actual network load. This approach improves overall resource utilization and helps prevent network bandwidth bottlenecks. In addition, UnifiedBus provides unique memory management and high-bandwidth communication features, enabling flexible memory overcommitment and fast live migration for VMs.

• UBNative: It is a high-performance device virtualization solution built on the UnifiedBus protocol. It simulates the UnifiedBus device model to enable seamless VM access to UnifiedBus devices. Based on Virtual Function I/O (VFIO) technology, UnifiedBus devices are passed through to VMs, ensuring native device performance in virtual environments. This achieves hardware-level efficiency and resource utilization, providing stable support for high-throughput, latency-sensitive scenarios.
• Memory overcommitment: As host memory capacity increases, memory accounts for a larger share of the total cost of ownership (TCO). Improving memory utilization in cloud scenarios is therefore becoming increasingly important. The memory overcommitment function is implemented based on the UnifiedBus-powered SuperPoD architecture. A memory reclamation solution for hugepage and passthrough VMs fully reclaims unused VM memory, improving virtual memory utilization and reducing cloud vendors' TCO.
• Ultra-fast live migration: URMA memory read/write semantics are used with the UnifiedBus high-performance network to migrate memory data. This reduces downtime and resource overhead, and improves the success rate of VMs under high memory pressure.

UB Service Core ​

For SuperPoDs, UnifiedBus builds the UB Service Core to encapsulate underlying capabilities and cluster topologies. This allows applications to use SuperPoD resources like local resources, streamlining development and maintaining compatibility with the existing ecosystem.

UB Service Core enables five cluster-level system services, leveraging the advantages of the peer-to-peer interconnect and accelerating applications by 30% to 50%. UB Service Core consists of five components:

• UB Service Core Engine (UBS Engine): It provides resource pooling and dynamic scheduling for memory and data processing units (DPUs), supports distributed automatic primary node election, and implements N–1 high availability. It serves as the core control-plane reference implementation for a UnifiedBus-powered computing system.
• UB Service Core Memory (UBS Mem): It supports unified memory programming and enables memory sharing and pooling within a UnifiedBus-powered SuperPoD.
• UB Service Core Communication (UBS Comm): It is a high-performance, highly reliable communication protocol with ecosystem compatibility (user-space Socket/Verbs over UnifiedBus) for SuperPoDs.
• UB Service Core IO (UBS IO): It provides high-level I/O services for the global data read/write cache system for SuperPoDs.
• UB Service Core Virt (UBS Virt): It supports virtualization pooling, live migration policy decision-making, quick disaster recovery, and efficient VM/container communication, improving virtualization performance.

Kernel Innovations ​

openEuler 24.03 LTS SP3 runs on Linux kernel 6.6 and inherits the competitive advantages of community versions and innovative features released in the openEuler community.

• Programmable page cache for file systems: A programmable page cache framework is implemented to address inefficient I/O during model loading in model inference scenarios. The framework is stacked on an existing file system in a transparent manner and forwards file system page faults to user space. This allows applications to implement custom page cache based on load characteristics in user space, significantly improving I/O efficiency for loading different models.

• Cross-process zero-copy data transfer: It provides efficient inter-process data transfer within a node. Applications can map pages from a specified virtual memory space in the source process to the virtual memory space of the destination process. It supports both page middle directory (PMD) hugepage mapping and page table entry (PTE) smallpage mapping. The mapped destination addresses are accessible with the same permissions as their corresponding source addresses.

• Filesystem in Userspace (FUSE) over io_uring: In the current FUSE architecture, communication between the user-space daemon and the kernel-space driver module via the character device /dev/fuse suffers from performance bottlenecks.

• I/O QoS controller IOInflight for I/O hybrid deployments: In high-density hybrid deployments, I/O resource contention can cause the interference rate of online services to exceed 40%. Traditional blk-throttle static I/O throttling reduces interference but wastes drive bandwidth. To address this issue, the IOInflight controller is introduced. It employs a dynamic I/O control mechanism based on latency monitoring and queue depth to precisely preempt online services. The controller keeps the interference rate and memory overhead below 5%, ensuring low latency for online services, while providing offline workloads with up to twice the bandwidth compared to traditional hard-limit approaches.

• epoll_wait asynchronous prefetch based on Xcall: In performance optimization scenarios targeting specific system calls, dynamic Xcall leverages an interception mechanism to execute customized system calls. This allows users to intercept system calls at the granularity of application ELF files, without intrusive kernel modifications. Based on this mechanism, a kernel module for epoll-based asynchronous prefetch is implemented. It can achieve notable performance benefits in scenarios such as Redis.

High-Density Many-Core Container Isolation ​

Server chips have evolved from multi-core to many-core architectures (typically exceeding 256 cores), posing new challenges to OSs. To boost rack-level computing density and reduce data center TCO, many-core servers have become the mainstream in the Internet industry. As cloud technologies and service scales advance, containerized deployment has also become the dominant model. Against this backdrop, serialization and synchronization overheads hinder system scalability, while interference and low resource utilization become increasingly prominent. These scalability issues in container deployments arise from contention for shared hardware and software resources.

Lightweight virtualization is used to partition resources by NUMA domain and enforce container-level resource isolation within each domain. This approach minimizes performance interference caused by hardware and software resource contention and enhances the container deployment scalability. Key features include VM memory QoS control, NUMA affinity of virtual devices, lightweight virtualization, CPU scheduling by domain, interference isolation in file system block allocation, efficient slab reclamation, TCP hash interference isolation, enhanced control group (cgroup) isolation, interference monitoring, Kunpeng memory and cache QoS control, dynamic QoS policy configuration, and I/O QoS controller IOInflight for I/O hybrid deployments.

DevStation ​

DevStation is an intelligent developer workstation built on openEuler, designed for geeks and innovators. It provides an out-of-the-box, efficient, and secure development environment that streamlines the entire workflow from deployment and coding to compilation, building, and releasing. By integrating a one-click runtime environment with a full-stack development toolchain, it enables a seamless transition from system boot to code execution. The new MCP AI engine allows for quick invocation of community toolchains, offering a significant leap in efficiency from infrastructure setup to application development, all without complex installation.

• Developer-friendly integrated environment: Pre-installed with a wide range of development tools and IDEs like VSCodium, this distribution supports multiple programming languages to meet the needs of front-end, back-end, and full-stack developers.
• Intelligent CVE fixing and security O&M: A CVE fixing system is integrated. It uses LLM analysis, code similarity algorithm (Levenshtein distance), and automated backporting to intelligently identify and resolve code conflicts during patch application. While retaining the core fixing logic, the average time required for manual conflict resolution is reduced from 4 hours to about 10 minutes, greatly improving the response and fixing efficiency for security vulnerabilities.
• Native community tool ecosystem: New tools like oeDeploy (a one-click deployment tool), epkg (an extended package manager), DevKit (a development toolchain), and openEuler Intelligence (DevStation intelligent assistant) provide full-lifecycle support from environment configuration to code deployment. oeDevPlugin and oeGitExt are VSCodium plugins designed for the openEuler community. They provide visual management for issues and pull requests (PRs), facilitating code repository cloning, PR submission, and real-time task status synchronization. openEuler Intelligence supports natural language for generating code snippets, creating API references, and explaining Linux commands.
• GUI-based programming environment: DevStation integrates graphical programming tools to streamline coding for beginners while offering powerful visual programming capabilities for veterans. It also comes pre-installed with productivity tools like Thunderbird.
• MCP-based intelligent application ecosystem: DevStation deeply integrates the MCP framework to build a complete intelligent toolchain ecosystem. It includes pre-installed MCP servers like oeGitExt and rpm-builder, which provide capabilities for community task management and RPM packaging. It intelligently wraps conventional development tools like Git and RPM builders using the MCP protocol, offering a natural language interaction interface. It also provides an MCP conversion and quality assurance toolchain that can automatically generate high-quality and testable MCP servers based on existing tools and test suite (mugen) in the community. This toolchain works with the mcp-testkit test framework to ensure service reliability.
• Enhanced system deployment and compatibility: DevStation offers extensive hardware support, especially seamless compatibility with mainstream laptop and PC hardware (such as touchpads, Wi-Fi, and Bluetooth), and a restructured kernel build script (kernel-extra-modules) to ensure bare metal deployment experience. It also supports flexible deployment options, including Live CD (instant run without installation), bare metal installation, and VM deployment.
• New installation tool: heolleo is a modern client tool designed specifically to simplify the DevStation installation process. Built with a modular design, it easily supports feature expansion across various hardware architectures (like x86 and Arm), file systems, and bootloaders (like GRUB). It offers flexible installation modes, supporting system file acquisition from both local ISO images and network sources (HTTP/FTP). It supports both local ISO installation and network installation.

openEuler Intelligence ​

openEuler Intelligence is a built-in desktop AI assistant of DevStation. It provides a dialogue window to actively identify user intent, enabling interaction with the OS through natural language, greatly facilitating development and O&M.

• Interaction UI: openEuler Intelligence provides a natural language interaction UI, through which user requests are transmitted to the agent runtime for processing.
• Agent runtime: As the brain of the AI assistant, the agent runtime understands user intent, decomposes it into sub-tasks, and delegates the sub-tasks to the agents and MCP servers integrated in DevStation. The sub-tasks are scheduled cyclically until all of them are complete
• Agents inside DevStation: Leveraging the extensive MCP server and agent repositories of openEuler, DevStation is evolving into an agentic OS composed of agents. In addition to built-in agents, openEuler Intelligence supports the installation of relevant MCP servers and agents via DevStore.

oeDeploy ​

oeDeploy is a lightweight software deployment tool that accelerates environment setup across single-node and distributed systems with unmatched efficiency.

• Multi-scenario support and quick software deployment: oeDeploy facilitates quick deployment for both single-node applications and clustered software environments. It includes quick deployment capabilities for openEuler community toolchains, popular cloud-native software, AI development components, and RAG tools. It also extends support for the CANN development kit and Ascend NPU driver.
• Flexible plugin management and excellent deployment experience: oeDeploy provides an extensible plugin architecture for flexible management of diverse deployment capabilities, empowering developers to quickly release custom deployment plugins. It now optimizes plugin source management and supports one-click generation of local plugin sources. Available on DevStore, oeDeploy features both a streamlined CLI and visual operations, promising efficient software deployment experience with less code.
• Efficient deployment and intelligent development: oeDeploy introduces MCP servers, offering an out-of-the-box experience within DevStation. It leverages LLM inference to deploy software with natural language, boosting deployment efficiency by 2x. It can also convert user documents into executable oeDeploy plugins, increasing development efficiency by 5x.

DevStore ​

DevStore is the application store for the openEuler desktop version, acting as a developer-centric software distribution platform. It supports the search and rapid deployment of MCP servers and oeDeploy plugins. DevStore is provided out-of-the-box on the DevStation platform.

• Rapid installation of MCP servers: Leveraging openEuler community's extensive software ecosystem, DevStore packages the software dependencies required for MCP server operations as standard RPM files. Using built-in service management tools, DevStore quickly deploys MCP servers in agent applications. It automatically solves software dependency and MCP configuration issues for users, greatly improving user experience. Currently, DevStore supports the deployment of over 80 MCP servers.
• Quick plugin deployment: DevStore utilizes the oeDeploy tool to enable the rapid deployment of mainstream software, substantially reducing the setup time. The supported software categories include AI software (like Kubernetes, KubeRay, PyTorch, TensorFlow, and DeepSeek), toolchains (like EulerMaker and openEuler Intelligence), and RAG tools (like RAGFlow, Dify, and AnythingLLM).

LLVM for openEuler Compiler ​

LLVM for openEuler is a high-performance compiler based on open-source LLVM software. It is crafted for compute-intensive scenarios such as server and Internet industries, cutting-edge data center applications, AI computing systems, and video encoding and decoding. In addition, it establishes an LLVM baseline within the openEuler community, providing a stable downstream LLVM distribution that is secure, reliable, and easily innovated upon. It currently supports mainstream languages (C and C++) and chip architectures (x86, AArch64, RISC-V, and LoongArch).

LLVM for openEuler introduces the following compilation features in openEuler 24.03 LTS SP3, optimizing the running efficiency of database and compression/decompression applications to unlock the ultimate software performance.

• AArch64 endianness conversion acceleration: In common database applications such as MySQL, data is stored in big-endian format. When loaded into memory for processing, it must first be converted to little-endian format. This involves iterative operations consisting of byte-by-byte loading, shifting, and bitwise OR, which incurs significant performance overhead. This optimization enables the AArch64 REV series instructions and increases the load width to reduce the frequency of loading, shifting, and bitwise OR, thereby enhancing application performance.
• Machine sinking enhancement: During compiler optimization, iteration operations on pointer-type loop variables (such as ptr++ within a loop) are typically sunk to the end of the loop. If a load operation at the beginning of the subsequent iteration depends on the updated value of that pointer, a data dependency occurs, leading to an instruction stall. This optimization mitigates such stalls by scheduling instruction positions to resolve the dependency bottleneck.
• AArch64 loop idiom optimization: This optimization is used to identify common loop patterns in diverse applications. By leveraging flexible AArch64 SVE instruction capabilities, these patterns are transformed into optimized loop implementations, significantly enhancing loop execution efficiency.

Go for openEuler Compiler ​

Go for openEuler is a high-performance Go distribution designed for reliability and developer friendliness. It features an optimized compiler that offers wide ecosystem compatibility, openEuler affinity, and superior user experience. Primarily targeted at container cloud scenarios that require agile development and high performance, such as cloud native and microservice applications, Go for openEuler addresses native Go performance limitations to enhance efficiency for mainstream Go workloads. The compiler adapts to hardware platforms such as LoongArch and Kunpeng to unleash their computing power.

• Continuous feature guided optimization (CFGO): While ensuring the functional integrity of the program, this technique collects the program's runtime profile to make more accurate optimization decisions, resulting in a refined program with better performance. Based on the principle of program locality, it arranges hot instructions closely to improve cache/translation lookaside buffer (TLB) hits, effectively reducing front-end bottlenecks.
• Arm atomic instruction optimization: In certain service scenarios, the Go runtime incurs significant overhead when invoking compare-and-swap (CAS) operations and load/store instructions. Adopting an Arm-affinity instruction sequence delivers notable performance gains.。
• Runtime garbage collection (GC) optimization: This optimization involves the insertion of software prefetch instructions based on identified program characteristics. Parameters governing the GC coroutine overhead are extracted as runtime parameters supporting dynamic adjustment according to varying service characteristics.
• Memory page partitioning optimization: Go utilizes an 8 KB page as its fundamental unit by default. When small objects are managed using single 8 KB pages, frequent creation and retrieval of memory objects may occur. Partitioning by size classes and utilizing optimal-granularity pages for allocation and deallocation significantly improve memory management efficiency. In Go malloc benchmarking, this optimization yields an average performance increase of 10%, with the MallocLargeStruct test case showing a significant increase of 50.29%.

Heap Resizing by BiSheng JDK ​

In modern containerized deployments, most container environments support resource scale-up. However, OpenJDK 8 limits maximum heap size configuration to the startup stage only. This restriction prevents Java applications from utilizing additional memory provided by container scaling without a process restart. To address this issue, BiSheng JDK introduces online heap memory resizing for the Garbage-First Garbage Collector (G1GC) and Parallel Scavenge Garbage Collector (PSGC) across BiSheng JDK 8/21/integrated version. This feature allows users to dynamically update the Java heap memory limit during runtime, eliminating the need for a JVM restart.

UDF Automatic Native Framework ​

The UDF automatic native framework addresses the inefficient JVM execution often seen in open-source big data systems. It automatically converts Java user-defined functions (UDFs) into C/C++ native UDFs, significantly boosting big data processing performance through efficient memory management and hardware affinity. Essentially, the framework implements a seamless, automatic Java UDF native acceleration mechanism. It comprises the UDF parser, UDF IR optimizer, UDF code generator, and UDF code compiler modules.

The UDF parser automatically converts the bytecode of a service JAR package into Intermediate Representation (IR) code and extracts UDF code by identifying specific features. The UDF IR optimizer optimizes the IR through automatic memory object management and hardware-affinity acceleration. The UDF code generator translates the optimized IR into native code, and the UDF code compiler compiles the native code into native binaries online. Finally, these native binaries are deployed to big data execution nodes, where the native execution engine dynamically loads and executes the native binaries to enhance processing performance.

De-optimization Observability in BiSheng JDK 17 ​

The JDK Flight Recorder (JFR) Streaming API of JDK 17 is a key feature that enables JFR to move from post-event static analysis to real-time monitoring.

In conventional JFR usage, a user must start recording, stop recording, dump contents into a .jfr file, and finally use Java Mission Control (JMC) tools for offline analysis. This is a post-event analysis mode, which is effective for troubleshooting problems that have occurred.

The Streaming API introduces a new mode, which allows a Java application to continuously subscribe to and consume JFR event streams from the JVM in real time without interrupting JFR recording or generating a complete .jfr file.

// 1. Create a recording stream.
RecordingStream rs = new RecordingStream();
// 2. Enable events of interest and configure related settings.
rs.enable("jdk.GCPhasePause").withPeriod(Duration.ofSeconds(1));
rs.enable("jdk.Deoptimization").withPeriod(Duration.ofSeconds(1));
// 3. Subscribe to an event and set the corresponding event handler (callback function).
rs.onEvent("jdk.GCPhasePause", event -> {
// Read the following fields from the event.
Duration duration = event.getDuration("duration");
String name = event.getString("name"); // For example, "GC Pause".
*****************
shell:   jcmd JFR.start delay=-1 filename=xxx.jfr
*****************
});
// 4. Start the stream (non-blocking call).
rs.startAsync();

KAE Enhancements in BiSheng JDK 21 ​

KAE encryption and decryption is a module of the Kunpeng Accelerator Engine (KAE). It invokes the underlying KAE hardware by modifying the OpenSSL library. Therefore, application code only needs to call the OpenSSL library, and KAE offers acceleration capabilities as the underlying engine of OpenSSL. KAEProvider is located between the application and OpenSSL and provides a convenient way to use the OpenSSL library and enable KAE acceleration.

The KAE compression module supports compression of zlib and gzip data formats, increasing the compression bandwidth. In Java applications, compression and decompression features are extensively utilized. Especially in data storage and HTTP services, the CPU usage for compression can exceed 70%, making the compression speed of open-source zlib a significant bottleneck. If KAEZlib is enabled for Java applications, service performance will be greatly improved.

KAEProvider supports OpenSSL 1.x. In 2021, OpenSSL 3.0 is released, with significant enhancements made to its architecture, scalability, and security, making it a better choice for secure communication applications. However, OpenSSL 3.0 has deprecated, added, or modified several APIs. KAEProvider cannot directly support OpenSSL 3.0 and code adaptation is required.

After this feature is added, the KAEProvider build result remains unchanged, but the build process does not depend on a local OpenSSL library in the build environment (previously, building the target libj2kae.so required a local OpenSSL 1.x environment). Instead, the specific OpenSSL version to be used is dynamically determined and loaded at runtime.

The usage of KAEProvider remains unchanged. Users need to manually enable the feature by modifying the OPENSSL_ENGINES environment variable and the kae.useOpenSSLVersion configuration. The original encryption and decryption logic remains unchanged, and the original functions and usage patterns of the JDK are not affected.

For KAEZip support, the libzip.so dynamic library is split into libzip.so and libz.so in the JDK, which contain the JNI and zlib code, respectively. To enable KAEZlib, use the -DGZIP_USE_KAE parameter. During compression and decompression, the Java side does not process the file header and tail. The generation and parsing of the compressed data structure depend on the zlib and gzip compression algorithms of the underlying zlib library.

Metadata Compression in BiSheng JDK 21 ​

The storage of Java objects incurs additional overhead known as the object header, which is used to store metadata associated with an object. With the increase of live objects and the existence of a large number of small objects, the issue of space occupied by object headers becomes increasingly severe. This feature compresses the object header size from 128/96 bits to 64 bits on the AArch64 platform.

In a 64-bit hotspot, a Java object has a 128-bit object header: a 64-bit mark word and a 64-bit class pointer. The average object size is typically 5 to 6 words, two of which are consistently occupied by the object header. This feature capitalizes on the fact that the high-order bits of the mark word are unused in normal cases. By relocating the class pointer into the high-order bits and shortening hash code while modifying tag bits, the object header is compressed to 64 bits.

JIT Warmup in BiSheng JDK 21 ​

This feature enables Java processes to reach peak performance rapidly after startup. The transition from process initiation to peak performance is traditionally a lengthy procedure, involving interpreter execution, profiling, C1 compilation, further profiling, and C2 compilation. This workflow integrates profiling and online just-in-time (JIT) compilation, and constitutes a critical part of application warmup. This feature effectively accelerates VM startup and warmup by streamlining this workflow, helping applications reach peak performance faster. The JProfilecache solution of the BiSheng JDK divides application release into two phases:

• Recording: At the conclusion of program execution, the profiling information of hotspot methods—primarily method invocation counts and back-edge counts—along with the associated classes (including parent classes) are exported to a specified file.
• Pre-compilation: In the next startup, the JVM reads the classes containing the hotspot methods and performs pre-loading. Simultaneously, these hotspot methods are added to the compilation queue for ahead-of-time (AOT) compilation. This approach bypasses the profiling stage and compiles the hotspot methods into high-performance native code before a user request arrives, thereby reducing the warmup overhead.

BiSheng JDK 8 Enhancements ​

Compact Strings is a significant memory optimization feature introduced in Java 9, designed to improve string storage and reduce memory footprint. In Java 8 and earlier versions, strings were internally stored using a char array, where each character occupied 2 bytes (UTF-16 encoding), regardless of the actual content. This led to inefficient memory utilization when processing large volumes of strings containing only ASCII characters. Currently, Compact Strings has been backported from JDK 17 to BiSheng JDK 8, further enhancing the overall performance of BiSheng JDK 8.

Compact Strings replaces the internal representation of the string object from a UTF-16 char array to a byte array coupled with a coder field. This updated string class encodes characters as either Latin-1 (1 byte per character) or UTF-16 (2 bytes per character) based on the content of the string. The coder field indicates the specific encoding used for the string, as detailed below:

• Strings that contain only Latin-1 characters are stored in byte arrays. Each character occupies only one byte.

• Strings that contain non-Latin-1 characters (such as Chinese and Japanese) are still stored in char arrays. Each character occupies two bytes.

• Each string object contains a coder field, which indicates the encoding of this string. The coder field value can be:

  • 0 (Latin-1): Contains only Latin-1 characters.
  • 1 (UTF-16): Contains non-Latin-1 characters.

CFGO Enhancements in GCC for openEuler ​

Continuous feature guided optimization (CFGO) in GCC for openEuler refers to continuous feedback-directed optimization for multimodal files (source code and binaries) and the full lifecycle (compilation, linking, post-linking, runtime, OS, and libraries). The following techniques are included:

• Code layout optimization: Techniques such as basic block reordering, function rearrangement, and hot/cold separation are used to optimize the binary layout of the target program, improving I-cache and I-TLB hit rates.

• Advanced compiler optimization: Techniques such as inlining, loop unrolling, vectorization, and indirect calls enable the compiler to make more accurate optimization decisions.

CFGO comprises CFGO-PGO, CFGO-CSPGO, and CFGO-BOLT. Enabling these sub-features in sequence helps mitigate front-end bound execution and improve program runtime performance. To further enhance the optimization, you are advised to add the -flto=auto compilation option during CFGO-PGO and CFGO-CSPGO processes.

• CFGO-PGO: Unlike conventional profile-guided optimization (PGO), CFGO-PGO uses AI for Compiler (AI4C) to enhance certain optimizations, including inlining, constant propagation, and devirtualization, to further improve performance.
• CFGO-CSPGO: The profile in conventional PGO is context-insensitive, which may result in suboptimal optimization. By adding an additional CFGO-CSPGO instrumentation phase after PGO, runtime information from the inlined program is collected. This provides more accurate execution data for compiler optimizations such as code layout and register optimizations, leading to enhanced performance.
• CFGO-BOLT: CFGO-BOLT adds optimizations such as software instrumentation for the AArch64 architecture and inlining optimization on top of the baseline version, driving further performance gains.

ANNC ​

Accelerated Neural Network Compiler (ANNC) is an AI compiler designed for accelerating neural network computations. It focuses on computation graph optimization, high-performance fused operator generation, and efficient code generation and optimization to boost the inference performance of models like recommendation systems and LLMs. It can integrate with mainstream open-source inference frameworks and various hardware backends to enhance software extensibility.

Computation graph optimization refines the neural network's computational flow. From an algorithmic perspective, it reduces redundant operations, performs mixed-precision rewriting, and automatically schedules subgraphs to lower the computational load and improve cache utilization. From a hardware architecture perspective, it optimizes the tensor data layout, operator fusion and conversion, and subgraph partitioning and scheduling to further lower the load and fully utilize hardware resources.

Generating and integrating a high-performance fused operator library comprises three parts: front-end computation graph pattern recognition and conversion, high-performance operator library query and integration, and automated operator library generation. At the assembly instruction level, it reduces memory access and accelerate parallel computations through optimization techniques like data prefetch, model parallelism, and new instruction sets.

ANNC aims to accelerate AI inference and reduce power consumption through graph compilation optimization and high-performance operator generation and integration, thereby improving inference efficiency per unit cost. In addition, its software compatibility and ease-of-use design reduce operational costs and environmental impact.

CCA ​

Arm Confidential Compute Architecture (CCA) is a specification newly introduced in Armv9. It is designed to define a standard confidential computing solution for next-gen computing devices. CCA establishes realms as TEEs to protect the confidentiality and integrity of data and code in use, ensuring effective protection even against privileged infrastructure software or cloud service providers.

Based on the Arm CCA specification, openEuler has implemented support for CCA across its relevant OS components, including KVM, QEMU, libvirt, and the guest kernel. The openEuler community edition provides native support for realm cVMs, fulfilling the security requirement to protect data in use. Crucially, this implementation also offers the ease-of-use and compatibility necessary for seamless integration with traditional application ecosystems and existing VM management software.

Arm CCA utilizes the following core components working in synergy to construct a realm, an isolated and protected execution space. The realm is completely segregated from the normal world in terms of code execution and data access.

• Realm: A realm is the core abstraction of CCA. It is a new execution environment that runs parallel to the normal world and secure world (TrustZone). It is hardware-isolated and designed to host sensitive code and data. It is independent of the host OS and Hypervisor, which can manage a realm but cannot access the content within.

• Dynamic management: Hypervisor can dynamically create realms and allocate memory and CPU resources to them as required. However, once a realm is initialized, Hypervisor hands over control to the realm management monitor (RMM), a protected secure virtualization module, and can no longer access the data within the realm.

• Memory management: CCA extends the system memory management unit (MMU) to identify and isolate realm memory. Any access attempt from outside the realm (including Hypervisor) is blocked by the hardware, ensuring data confidentiality.

• Remote attestation: Each CCA-enabled processor has a unique, hardware-based identity. When a realm starts, it can generate an attestation token that is cryptographically signed by the hardware. Users can obtain this report, verify its signature, and check the component measurements to ensure that their workloads are running in a genuine, unaltered Arm CCA environment.

virtCCA Enhancements ​

The current virtCCA architecture has this constraint: it only supports a boot mode where the kernel and rootfs are mounted separately. However, in mainstream cloud platforms, VMs typically rely on a GRUB bootloader. This requires integrating the Unified Extensible Firmware Interface (UEFI) firmware (like EDK2), kernel, and initial RAM file system (initramfs) into a single image, such as a QCOW2 file. The enhanced virtCCA addresses this by providing the following functions:

• Single image encapsulation

  • Unified boot stack: virtCCA integrates the EDK2 firmware, GRUB bootloader, kernel, and initramfs into a QCOW2 image, creating a complete boot stack.
  • Streamlined boot process: GRUB uses a configuration file (grub.cfg) to locate the kernel path, which requires the kernel and initramfs to reside on the same file system, for example, ext4 or XFS.

• Secure boot chain

  • Secure boot: EDK2 verifies the digital signatures of GRUB and the kernel, ensuring that the boot components have not been tampered with.
  • Hardware resource collaboration: virtCCA leverages UEFI runtime services to enumerate hardware devices, providing a virtualized resource pool for VM monitors like KVM.

• Cloud native optimization

  virtCCA supports snapshot cloning and dynamic rootfs expansion (depending on cloud-init in initramfs).

virtCCA cVM Live Migration ​

cVM live migration refers to the secure transfer of a running cVM from one confidential computing environment to another verified confidential environment without interrupting services. This process ensures that sensitive data within the cVM remains encrypted or isolated at all stages—before, during, and after the migration.

This feature ensures the confidentiality and integrity of a cVM's state in live migration. This is achieved through the MigCVM component (migration management) and the TMM component (secure world hypervisor). The functional highlights include:

• The source platform authenticates the target platform, and the TMM component performs trustworthiness measurement on MigCVM.

• After the identity authentication is successful, the source platform completes migration key negotiation with the target platform MigCVM.

• An encrypted session is established between the source and target platforms to ensure the security of data migration.

• MigCVM traces the migration status to secure the migration process and handle abnormal status.

• TMM is responsible for exporting and importing the memory status and vCPU status of the virtCCA cVM.

• TMM encrypts the cVM's status data based on the migration key and verifies the data integrity.

oeAware Enhancements ​

oeAware is a framework that provides low-load collection, sensing, and tuning upon detecting defined system behaviors on openEuler. The framework divides the tuning process into three layers: collection, sensing, and tuning. Each layer is developed as plugins and associated through subscription, overcoming the limitations of traditional tuning techniques that run independently and are statically enabled or disabled.

Each oeAware plugin is a dynamic library built on standard interfaces. A plugin consists of several instances, each acting as an independent functional set for data collection, perception, or tuning. Within these instances are topics, which output the processed data. This data is then shared with other plugins or external applications for further analysis and optimization.

• The SDK enables subscription to plugin topics, with a callback function handling data from oeAware. This allows external applications to create tailored functionalities, such as cross-node information collection or local node analysis.

• The performance monitoring unit (PMU) information collection plugin gathers performance records from the system PMU.

• The Docker information collection plugin retrieves specific parameter details about Docker containers in the environment.

• The system information collection plugin captures kernel parameters, thread details, and resource information (CPUs, memory, I/Os, network) from the current environment.

• The thread sensing plugin monitors key information about threads.

• The evaluation plugin examines NUMA and network information during service operations, suggesting optimal tuning methods.

• The system tuning plugins comprise stealtask for enhanced CPU tuning, smc_tune (SMC-D) which leverages shared memory communication in the kernel space to boost network throughput and reduce latency, and xcall_tune which offers code paths that bypass non-critical processes to minimize system call processing overhead.

• The Docker tuning plugin addresses CPU performance issues during sudden load spikes by utilizing the CPU burst feature.

Constraints

• smc_tune: SMC acceleration must be enabled before the server-client connection is established. This plugin is most effective in scenarios with numerous persistent connections.

• Docker tuning: This plugin is not compatible with Kubernetes containers.

• xcall_tune: The FAST_SYSCALL kernel configuration option must be activated.

• realtime_tune: This plugin must be used together with the Preempt-RT kernel.

• net_hard_irq_tune: This plugin applies only to network communication over TCP.

vKAE Passthrough Live Migration ​

The Kunpeng Accelerator Engine (KAE) is a hardware acceleration solution based on the new Kunpeng 920 processor model, featuring HPRE, SEC, and ZIP components for encryption, decryption, compression, and decompression. This enables KAE to significantly reduce processor overhead and boost efficiency. KAE passthrough live migration addresses the scenario where VMs are configured with KAE passthrough devices, offering enhanced operational flexibility and continuous service availability.

SMMU dirty page tracking is a key technology for efficient and reliable live migration of passthrough devices. In the Arm architecture, a purely software-based approach to dirty page tracking incurs significant performance overhead. Hardware Translation Table Update (HTTU) solves this by allowing the hardware to automatically update the SMMU page table status. During a write operation, the write permission bit of the corresponding page table entry is automatically set. During a live migration, the write permission bit of the page table is scanned to collect statistics on dirty pages.

Global Trust Authority for Remote Attestation ​

The Global Trust Authority (GTA) remote attestation component adopts a client-server architecture, supporting remote attestation of TPM/vTPM, VirtCCA, and IMA.

• The server provides the remote attestation service framework, which is compatible with trusted computing and confidential computing. It supports the addition, deletion, modification, and query of certificates and policies, quote verification, random number generation, and JWT token generation.

• The client collects local TPM evidence and interacts with the server to verify quotes.

This component provides various capabilities in terms of security and usability.

GTA provides differentiated security competitiveness such as database integrity protection, data link encryption, anti-replay, SQL injection prevention, user isolation, and key rotation.

The passport and background-check models are available. The client supports multiple verification modes, such as scheduled reporting and challenge response. Both the client and server can be deployed using RPM packages and within Docker containers.

Kuasar Confidential Container ​

Kuasar has expanded its capabilities to include confidential container support while maintaining its existing secure container functionality. This support can be enabled through iSulad runtime configuration.

The current Kuasar confidential container implementation leverages the iSulad+Kuasar solution to significantly accelerate boot times and drastically reduce memory overhead. On the one hand, the Sandbox API eliminates the need to create a separate pause container during container creation, saving time spent on preparing the pause container image snapshot. On the other hand, the 1:N management model allows the Sandboxer process to be persistent. This avoids the cold-start time of the Shim process, greatly accelerating container boot and bringing memory benefits proportional to the number of pods. Finally, Kuasar is implemented in Rust. Compared to Go, Rust provides inherent advantages in memory safety and contributes to overall memory efficiency.

Key functions include:

• Native integration with the iSulad container engine preserves Kubernetes ecosystem compatibility.

• Hardware-level protection via Kunpeng virtCCA technology ensures confidential workloads are deployed in trusted environments.

• The secGear remote attestation framework, which complies with the remote attestation procedures (RATS) (RFC9334), allows containers running in a confidential computing environment to prove their trustworthiness to external trusted services.

• Container images can be pulled and decrypted in confidential containers to protect their confidentiality and integrity.

sysSentry ​

sysSentry provides a fault inspection framework. By offering a unified northbound fault reporting interface and southbound plugins that support various inspection and diagnostic capabilities, the framework enables the inspection and diagnosis of hardware faults across CPUs, memory, drives, NPUs, and other components.

• Unified alarm/event notification service: Receives fault information reported by various plugins and forwards the information in a unified manner. This enables different subscriber services to receive specific fault notifications tailored to their operational needs.

• Unified log service: Aggregates and records fault information from all plugins, improving fault location efficiency.

• Fault diagnosis/inspection framework: Supports the development and configuration of inspection and diagnostic tasks using a pluggable approach. It allows plugins written in C/C++, Python, or Shell to be managed independently, including start/stop operations and status/result queries.

• Lightweight data collection service: Retrieves hardware status information via kernel, BIOS, and BMC interfaces for analysis and use by various plugins. It is designed for high adaptability, supporting a wide range of underlying architectures, software versions, and data collection requirements.

Slow I/O or Drive Detection ​

Slow I/O detection utilizes a sliding window to analyze the I/O latency data of various drives. A slow I/O event is triggered for a drive when the number of abnormal cycles within the sliding window exceeds a predefined threshold.

Currently, two slow I/O detection plugins are supported: avg_block_io, which calculates abnormal thresholds based on average I/O latency, and ai_block_io, which utilizes AI clustering algorithms to determine thresholds. Both plugins support monitoring for up to 10 I/O phases: blk-throttle, wbt, iocost, get_tag, plug, deadline, bfq, kyber, hctx, and driver.

Supported drive types include NVMe SSDs, SATA SSDs, and SATA HDDs.

UBPRM ​

When critical events such as OOM, panic, or reboot occur, sysSentry blocks these events and reports them to UBPRM to prevent data loss or service interruption. It also provides centralized management for UB event reports.

• Node fault detection and recovery: When a node on the home side experiences a panic or reboot, the memory it has lent becomes inaccessible, which directly impacts the service processes on the user side. To mitigate this, the data stored in the memory on the home side needs to be migrated.
• OOM detection, prevention, and recovery: In memory borrowing scenarios, UBPRM monitors memory usage watermarks at fixed intervals. These watermarks are configurable, enabling the system to dynamically apply memory return or borrowing policy based on actual demand. When a large volume of memory is consumed in a short period, the standard periodic detection mechanism may fail to respond in time. This can lead to the OOM killer terminating critical processes or causing node reboots, resulting in service interruptions. To mitigate this risk, the OOM prevention mechanism is implemented to report impending OOM events to UBPRM and trigger the emergency borrowing policy.

Raspberry Pi ​

Raspberry Pi is a series of single-board computers developed by the Raspberry Pi Foundation and Broadcom. They are widely used in industrial automation, robotics, Internet of Things (IoT), education, and enthusiast projects due to their low price, small size, low power consumption, high programmability, and abundant ecosystem. Raspberry Pi 4B and Raspberry Pi 5 are classic products, both using Arm processors. Raspberry Pi 4B is a cost-effective entry-level computer, and Raspberry Pi 5 is an innovative product with significant performance breakthroughs and extended capabilities, making it competitive in high-performance edge computing.

As typical open-source hardware products, Raspberry Pi 4B and Raspberry Pi 5 support multiple Linux distributions such as Raspberry Pi OS, Ubuntu, and openEuler. They have extensive peripherals, powerful video encoding and decoding capabilities, LAN on motherboard (LOM), and can be used as independent computer systems.

RISC-V Enhancements ​

ISA-L ​

Intel® Intelligent Storage Acceleration Library (ISA-L) is an open-source function library optimized for storage applications. It features optimized computing code for erasure coding (EC), cyclic redundancy check (CRC), RAID, and compression/decompression.

Originally, ISA-L's acceleration was limited to the x86 architecture, with other platforms relying on standard C implementations that lack optimization. While recent updates have introduced assembly acceleration for Arm, support for RISC-V remains largely restricted to basic C implementations. Consequently, ISA-L cannot yet fully leverage the hardware capabilities of the RISC-V platform, leaving significant room for performance improvements.

To enhance the performance of the ISA-L library on the RISC-V platform, we have made the CRC optimizations.

Snappy Algorithm ​

Snappy is a high-speed data compression and decompression library developed by Google. It is designed to strike a balance between extreme processing speeds and reasonable compression ratios. It prioritizes speed over the compression ratio.

• Fast compression and decompression: Snappy's core advantage lies in its extremely fast speed. It mainly utilizes a combination of dictionary coding and literal copying to compress data. During compression, Snappy scans the input data for duplicate byte sequences. When a match is found, Snappy replaces the duplicate sequences with a reference consisting of an offset (distance to the previous occurrence) and a length. Data with no identifiable matches is stored as literals.
• Low CPU overhead: Due to its focus on speed, Snappy maintains low computational complexity and minimal CPU resource demand. This makes it ideal for scenarios requiring high-speed processing of large datasets in low-latency environments.
• Speed-first design: Unlike algorithms such as gzip or bzip2 that prioritize maximum compression ratio, Snappy is designed for use cases where high processing speeds are prioritized over achieving the highest possible compression ratio.
• Stream-friendly design: Snappy's data format is inherently suited for streaming compression and decompression.
• RISC-V SIMD and vector optimization: To further enhance Snappy's performance, the Vector Extension and Packed SIMD (P-Extension) instructions are leveraged to vectorize core bottlenecks such as sequence searching and bulk data copying. This significantly boosts search efficiency and data throughput.
• RISC-V memory optimization: Memory access patterns are refined to maximize the efficiency of the RISC-V cache hierarchy. This involves data alignment and prefetching for literal copies and reference jumps to minimize cache misses.

LZ4 Algorithm ​

LZ4 is a high-performance, real-time data compression algorithm. It is essential for performance-critical scenarios such as OS kernels, file systems, and network transfers. This white paper details unaligned memory access optimization for LZ4 on the RISC-V architecture. By leveraging hardware detection and targeted optimization policies, these improvements significantly boost compression performance on RISC-V platforms.

Unaligned Memory Access Optimization

LZ4 relies heavily on unaligned memory access during data compression. Performance for these operations varies significantly across CPU architectures. Following optimization patterns from Arm (such as ARMv6), direct memory access provides a major performance boost over standard memcpy(), provided the hardware natively supports it.

This optimization focuses on the RISC-V architecture, specifically for processors supporting the Zicclsm extension. It implements an intelligent memory access selection mechanism, including:

• Intelligent hardware detection

• Tiered optimization policy

• Security and compatibility

OpenSSL Encryption and Decryption ​

OpenSSL is the world's most widely used cryptography library. The performance of its core algorithms directly determines the efficiency of critical security operations, including digital signatures, identity authentication, and data encryption and decryption.

With the rapid growth of the RISC-V open standard instruction set architecture (ISA), OpenSSL still primarily relies on generic C implementations. This lack of architecture-specific optimization prevents cryptographic algorithms from reaching their theoretical hardware limits. Consequently, there is significant potential for performance gains and an urgent need for technical improvements.

To enhance OpenSSL performance on RISC-V, we have made the following optimizations:

• RSA optimizations

• AES-128-CBC optimizations

• SM2 optimizations

Go Backport: RVA23 Profile ​

openEuler 24.03 LTS SP3 introduces the GORISCV64 environment variable and RVA profile support (up to RVA23) for Go 1.21. This enables Go to leverage advanced RISC-V extensions like Zbb and V, significantly boosting performance on RISC-V.

OpenSSL Backport: SHA-2 Assembly Optimization on RISC-V ​

openEuler 24.03 LTS SP3 uses OpenSSL 3.0.12 as its baseline, while the upstream has advanced to the 3.6 series. To enhance OpenSSL performance on RISC-V, we backported key cryptographic assembly optimizations from the upstream mainline.

Specifically, the backported SHA-2 assembly optimization now leverages the hwprobe interface to detect CPU instruction extensions at runtime. This enables OpenSSL to dynamically select the most efficient optimized function for specific hardware, significantly boosting SHA-2 performance.

OpenSSL Backport: MD5 Assembly Optimization on RISC-V ​

openEuler 24.03 LTS SP3 uses OpenSSL 3.0.12 as its baseline, while the latest upstream version has progressed to the 3.6 series. To further optimize performance on RISC-V, we backported key cryptographic assembly optimizations from the upstream mainline to version 3.0.12.

Following the backport of MD5 assembly optimization for the RISC-V architecture, OpenSSL now utilizes the hwprobe interface to detect supported instruction extensions at runtime. This enables the dynamic selection of optimal functions tailored to the specific CPU, resulting in a significant performance boost for MD5 cryptographic operations.

OpenJDK 21 Backport: RISC-V Optimizations ​

As the backbone of enterprise and large-scale distributed systems, Java powers critical infrastructure across finance, telecommunications, and the Internet. We have backported key RISC-V optimizations from the OpenJDK master branch into OpenJDK 21. This includes integrating RVA23 profile instruction extensions, assembly-level optimizations for cryptographic and encoding algorithms, and intrinsic implementations for core Java operations. These enhancements significantly improve OpenJDK 21's efficiency on RISC-V across networking, storage, and concurrency, providing a high-performance, production-grade Java runtime for the openEuler RISC-V ecosystem.

• Backporting RVA23 profile instruction extensions

  We have backported support for the RVA23 profile instruction extensions, including Zfa, Zacas, Zabha, Zvkn, and Zicond from the OpenJDK master branch to OpenJDK 21. Building on this, we integrated the Linux hwprobe system call mechanism. This enables the Java virtual machine (JVM) to dynamically detect the processor's actual instruction set capabilities during startup and just-in-time (JIT) compilation, ensuring that optimized code paths are only enabled when the hardware explicitly supports them. For RISC-V platforms without these extensions or in environments where detection fails, the system automatically falls back to generic implementations, maintaining full functional correctness and cross-platform compatibility.

• Backporting assembly optimizations for cryptographic algorithms

  We have introduced high-performance, RISC-V-specific assembly implementations for core cryptographic and encoding algorithms, including SHA-1, SHA-2, ChaCha20, Poly1305, CRC32, Adler32, and Base64. By leveraging advanced instruction extensions such as Zvkn (vector crypto), these implementations maximize the synergy between RISC-V vector and scalar instructions. This results in multi-fold performance improvements under typical workloads. Furthermore, runtime capability detection ensures that these optimized paths are only activated in environments with the necessary hardware support.

• Backporting intrinsic implementations for core Java operations

  We have implemented intrinsic optimizations for high-frequency Java operations, including Object.hashCode(), Math.copySign(), BigInteger, and lightweight fastlock. By utilizing specific RISC-V instructions to generate more compact and efficient machine code, these optimizations significantly reduce method call overhead and computational latency while ensuring full compatibility with Java semantics.

utpam ​

utpam is a Linux authentication framework. It allows system administrators to define and combine authentication methods for various services across the system as needed. By providing a unified interface, utpam streamlines user authentication for applications.

libutpam is the core library of utpam. It initializes authentication based on configuration files provided by the application. By default, these files are located in /etc/utpam and named after their respective services. utpam provides two types of interfaces:

• APIs (northbound): Enable applications to select from four authentication types: user authentication, account management, session management, and password management.

• SPIs (southbound): Allow developers to implement the specific authentication logic corresponding to each API.

secScanner ​

secScanner is a Linux security scanner that provides system management, vulnerability scan, and rootkit detection to keep your OS protected.

Built on a "3 core + 3 common capabilities" architecture, secScanner provides comprehensive, automated, and flexible proactive protection.

• Security management: Addresses complex configurations and varying security needs across different scenarios. It supports multiple or custom security baselines with fine-grained parameter control. Key features include one-click security detection, system hardening, and configuration restoration to ensure robust protection.

• Vulnerability scan: Provides comprehensive and timely protection against known CVE threats in OS components. It downloads security advisories from openEuler Security Center to maintain an up-to-date local vulnerability database. It supports both full system scans and lightweight, targeted scans of key components. It identifies high-risk areas and provides specific upgrade recommendations to block potential attack paths.

• Intrusion detection: Provides generalized protection against unknown threats. To defend against advanced intrusion methods, it utilizes secDetector to identify potential malicious rootkit modules and offers specific cleanup recommendations to ensure system security.

VMAnalyzer ​

VMAnalyzer is a lightweight virtualization monitoring and analysis tool designed with two core objectives:

• Virtualization environment monitoring: real-time tracking of CPUs, memory, and drive I/Os to identify performance bottlenecks.

• High reliability assurance: analyzing QEMU processes and physical configurations to predict risks and deliver proactive maintenance policies for failure prevention.

VMAnalyzer consists of two primary modules: the monitoring center and the diagnostic center.

• Monitoring center: Provides real-time data collection and granular analysis of VM health. It offers flexible visualization of performance metrics across all cloud hosts via integration with platforms such as the Console, OPS, and DW.

• Diagnosis center: Conducts deep-dive diagnostics of the virtualization layer. By executing targeted commands to analyze configurations, system status, and VM resource consumption, it identifies complex issues and exports detailed findings into comprehensive log files.