X-Kernel v0.1.0-2606 is the first milestone release from the openKylin XTeeOS SIG. This version focuses on the engineering implementation of a secure and trusted Rust-based kernel, initially establishing a baseline of core kernel capabilities that are sustainably maintainable, verifiable, and releasable.

1. Consolidating Rust Kernel Core Capabilities to Support Stable Long-Running Real Workloads

The version's testing and CI system makes kernel capabilities measurable and continuously optimizable. 

Figure 1 fio File System I/O Performance Trend

Figure 2 schbench Scheduling Latency Observation Metrics Chart

Figure 3  Network iperf3 Performance Chart

Figure 4 XTEEOS Multi-architecture Continuous Integration and TEE Test Verification Flow

The improvement of these foundational capabilities enables X-Kernel to begin verifying the collaborative capabilities of kernel subsystems against real system workloads. This version uses the long-duration operation of Prometheus TSDB as a typical scenario, comprehensively verifying the network, file system, scheduling, memory management, and I/O paths. Tests show that X-Kernel can support Prometheus running stably for over 35 consecutive hours, validating the system's foundational support capabilities in monitoring services, data writing, resource management, and long-duration operation scenarios. This verification also provides a foundation for system-level security operations capabilities like the Black Box.

Figure 5 Supporting Long-term Stable Operation of Prometheus TSDB

Figure 6 System Capability Layout for Dual-Architecture Trusted Computing

The X-Kernel v0.1.0-2606 version continuously improves capabilities related to the TEE Trusted Execution Environment, extending the Rust kernel's support from basic runtime operation to secure and trusted scenarios.

This version focuses on enhancements in areas such as trusted application execution, secure storage, cryptographic algorithms, and loading authentication. By developing TA lifecycle management capabilities, it supports the creation, execution, exit, and resource cleanup of trusted applications, reducing security risks from abnormal exits, resource residue, and state inconsistencies. By improving secure storage capabilities, it supports the secure storage of trusted data such as keys, certificates, and sensitive configurations. By introducing RustCrypto related components, it enhances cryptographic algorithm capabilities like ECC, SM2, and RSA, providing foundational support for key protection, signature verification, and building trusted chains. By improving TA signature authentication and loading path verification, it supports the verification of the source and integrity of trusted applications, enhancing the security of the trusted application loading process.

Based on the above capabilities, X-Kernel can further support core security scenarios such as key storage, biometric data protection, trusted authentication, sensitive business data processing, and secure service isolation, providing a verifiable, customizable, and sustainably evolving secure and trusted kernel foundation for the construction of openKylin's trusted computing capabilities.

In terms of code security and quality, the version continuously cleans up unsafe usage, supplements unit tests, and strengthens input validation for host-side build tools, further enhancing the security and maintainability of the Rust kernel engineering implementation.

3. Supporting Multiple Architectures, Platforms, and Flexible Customization to Form an Evolvable Trusted Computing Foundation

Targeting different hardware platforms, virtualization environments, and trusted computing scenarios, X-Kernel v0.1.0-2606 establishes flexible configuration and multi-platform adaptation capabilities. The current version supports AArch64, x86_64, RISC-V 64, and LoongArch64 architectures, and is adapted for platforms and runtime environments such as QEMU, Hygon CSV Environment, and pKVM.

In terms of engineering configuration, X-Kernel introduces a configuration system similar to Linux Xconfig, supporting configuration and customization based on dimensions such as architecture, platform, build type, log level, CPU count, and kernel functional modules. Developers can select corresponding platform configurations and functional combinations for different targets like QEMU verification, CSV confidential computing environment, CCA security extension environment, and pKVM virtualization environment, reducing the introduction of unnecessary modules and improving adaptation efficiency across different security scenarios.

This capability of "multi-architecture support + multi-platform adaptation + modular customization" is an important foundation for X-Kernel to become a trusted computing base. It allows the same set of Rust kernel capabilities to evolve continuously for different scenarios such as simulation verification, confidential computing, virtualization isolation, and trusted application execution. It also provides an engineering foundation for subsequently supporting more hardware platforms, security product forms, and industry trusted applications.

4. Next Steps

In the next phase, the XTeeOS SIG will continue to advance efforts focused on long-duration operational stability, support for the secure and trusted ecosystem, and engineering quality improvement.

In terms of basic capabilities, it will continuously optimize the file system, network protocol stack, scheduling, memory management, and I/O paths to support stable operation under longer durations and more complex workloads. In terms of security and trustworthiness, it will continue to improve TEE, TA secure loading, secure storage, cryptographic algorithms, and trusted application runtime mechanisms, enhancing support capabilities for scenarios like key protection, biometrics, trusted authentication, and sensitive business isolation. In terms of ecosystem support,it will continuously improve multi-architecture, multi-platform adaptation, and POSIX compatibility capabilities, promoting the operational verification of more real-world applications and security services on X-Kernel.In terms of the engineering system, it will continue to build performance baselines, automated regression testing, multi-architecture CI, and observability capabilities, driving the system from "functionally available" to "stable, measurable, and continuouslyevolving".

In the future, the XTeeOS SIG will continue to collaborate with community developers to jointly promote the construction of the openKylin trusted computing foundation.