Top Qs
Timeline
Chat
Perspective
HongMeng Kernel
Distributed operating system kernel From Wikipedia, the free encyclopedia
Remove ads
HongMeng Kernel (Chinese: 鸿蒙内核; pinyin: Hóngméng nèihé) is a proprietary distributed operating system kernel developed by Huawei. It is used in current HarmonyOS NEXT iterative versions of the HarmonyOS operating system, replacing previous versions that relied on the AOSP compatibility layer, Linux kernel, and LiteOS kernel.[1][2] The HongMeng Kernel adopts a microkernel architecture, designed to enhance security and performance by isolating critical system components.[1][2]
Remove ads
Design
Summarize
Perspective
The HongMeng Kernel is a microkernel at rich executed environment level for software outside hardware-based HarmonyOS TEE kernel, enabling greater modularity and larger portions of the OS to benefit from memory protection at kernel mode while retaining the speed of monolithic kernel. The kernel can adapt to it's real-time kernel module functionality for modular OpenHarmony's small and mini level systems which is ideal for wearables and router device types.
The kernel has Linux ABI compatibility by placing an ABI-compatible shim in IC0 (kernel space), which redirects Linux system calls to IPC and serves as a central repository for global state. The kernel also reuses Linux drivers through driver containers, which balances between compatibility and critical path performance, while having control plane and data plane separation to improve performance while coexisting with native HongMeng kernel drivers for HarmonyOS ABI.[3] It also contains a security hardening architecture for the Linux API/ABI compatibility module utilising a SELinux module adapter. HongMeng Kernel capabilities in context switching, network, application startup time, load, frame loss, interrupt latency, etc., and also performance optimised in smart routers and smart vehicles.[4][5][6] As of November 25, 2025[update], HongMeng Kernel runs on ARM64 devices on HarmonyOS 6.0.0.115 version with current version 1.11.0.[7]
HongMeng Kernel objects used as carriers for data transmission during IPC communication. The capability system ensures only the capability to read from or write to kernel objects can receive or send messages through these objects. As a result, the content of messages has inability to insert malicious processes.[8][9]
HongMeng Kernel adopts a microkernel architecture that reduces the kernel TCB (Trusted Code Base). Compared to traditional monolithic kernels such as Linux kernel,[10] the kernel code in HongMeng Kernel is less than one-fourth in size, significantly reducing occurrence of vulnerabilities on the kernel.[9][11]
On HongMeng Kernel, the HKIP module provides various protection mechanisms. Other than code, the read-only data, and kernel page table, other critical structures within the kernel are not protected by HKIP. The finer-grained kernel module isolation featured in HongMeng kernel, which divides kernel resources into multiple types, different types are managed by corresponding modules, and modules communicate with each other through the IPC mechanism, which has a better effect on multiple modules defense against attacks. Then it divides the permissions between modules in a fine-grained manner and communicates between modules through IPC, making it difficult for attackers to evolve the attack results of one module into the attack results of the entire system. HongMeng Kernel loads the driver in user mode, making it difficult to trigger an attack against drivers to an attack against the kernel EL1 layer by strictly obtaining only EL0 permissions.[6][9]
HongMeng Kernel has file system protection in place, using different keys for different contexts to protect the confidentiality and integrity of code and data files, and key management with the Secure Enclave (TrustZone, security chip) isolated from the kernel. Manufacturers and system developers can use hardware security primitives alongside third-party to first-party chip designs provided by processors to achieve a higher level of security privileges than the kernel. Even after an attacker compromises the HongMeng Kernel, the system relies on a hypervisor or secure monitor that is lower than the kernel and has a smaller TCB. The TrustZone and security chip, which are isolated from the rich executed environment REE kernel, ensures the security of users' sensitive data.[9][12]
The Star Shield Security Architecture in OpenHarmony-based systems with HarmonyOS operates at both system level and kernel level, with a comprehensive approach that spans multiple layers. OpenHarmony's security architecture inherently relies on kernel-level security as the foundation for Process isolation and memory protection, Mandatory Access Control (MAC) systems, Secure boot and system integrity verification, Hardware-based security features, Comprehensive Layered Approach. The architecture implements "defense in depth" with security hardening measures at Hardware level (trusted execution environments), Kernel level (fundamental isolation and access control), System level (application framework security, permissions) Access Token Manager (ATM)[13] access control which is a combination of RBAC and Capability-based and Application level (sandboxing, data protection) that is a unified security model that adapts to different hardware capabilities while maintaining consistent security principles from kernel to application layer.[14]
The HongMeng Kernel's L5 certification represents the highest security level for OpenHarmony-based devices. This level requires formal verification of core system software modules, hardware components resilient to physical and laboratory-simulated attacks, and dedicated security chips to establish a hardware-rooted trust chain during boot, storage, and execution.[15]
Remove ads
History
On 15 August 2023, Huawei's HongMeng Kernel achieved Evaluation Assurance Level 6 Augmented (EAL6+) certification under the Common Criteria for Information Technology Security Evaluation (CC), becoming the first operating system kernel certified to this level for general-purpose operating systems.[16][17]
Additionally, the HongMeng Kernel has attained the TÜV Rheinland Functional Safety Certification for Safety RTOS according to ISO 26262 ASIL D and the IEC 61508 SIL 3 certification.[18][19]
Remove ads
See also
- Kernel (operating system)
- OpenHarmony
- HarmonyOS NEXT – iterative operating system released by Huawei, with HarmonyOS as kernel
- HarmonyOS – operating system released by Huawei, with HarmonyOS kernel as kernel
Further reading
- Haibo, Chen Huawei Central Software Institute and Shanghai Jiao Tong University (21 June 2024), Microkernel Goes General:
Performance and Compatibility in the HongMeng Production Microkernel from the original on June 21, 2024. Retrieved 2024-07-10.[20]
References
External links
Wikiwand - on
Seamless Wikipedia browsing. On steroids.
Remove ads