新型操作系统内核v1.0GitHubhttps://github.com/wupeixing192/New-Operating-SystemGiteehttps://gitee.com/wupeixing192/New-Operating-System一个全新的内核完全从零编写不依赖任何现有架构没有POSIX没有系统调用语义理论上可以达到超过95%的裸机性能并且没有安全漏洞本内核分为8大部分分别是物理内存分配器全局地址空间转换器能力授权引擎时间分片调度器子系统多核APIC安全入口桩系统整合支持用户态Ring3函数入口序言主权宣言——计算不再被过去定义Preamble: Sovereignty Declaration — Computing No Longer Defined by the Past我们作为数字时代的公民在此宣告We, as citizens of the digital age, hereby declare:传统操作系统不是我们的宿命。Legacy operating systems are not our destiny.POSIX 不是我们的语言。POSIX is not our language.超级用户不是我们的统治者。The superuser is not our ruler.文件系统不是我们唯一的记忆方式。The filesystem is not our only way of remembering.系统调用不是我们唯一的沟通途径。The system call is not our only means of communication.我们曾被迫接受一套陈旧的架构它诞生于分时共享的年代带着目录树、权限位、进程隔离的历史包袱。这套架构曾经辉煌但它也把我们变成了被动的“用户”——我们无法真正掌控自己的设备无法自由选择资源的组织方式无法摆脱内核的隐形统治。我们无法主动选择内存模型无法在运行时改写系统权限无法随意启用或关闭内核的特定功能模块。We were once forced to accept an outdated architecture: born in the era of time-sharing, burdened with directory trees, permission bits, and process isolation. That architecture once shined, but it also turned us into passive “users” — unable to truly control our own devices, unable to freely choose how resources are organized, unable to escape the invisible rule of the kernel. We could not actively choose our memory model, could not rewrite system permissions at runtime, could not freely enable or disable specific kernel modules.旧世界是资本主义的黑暗统治——少数巨头垄断内核与标准用封闭协议和专利壁垒榨取用户用强制更新和遥测监控将用户变成数字佃农。新世界是共产主义的自由——代码开放资源共有每个用户都是自己设备的主人每个令牌都是平等的权利凭证。没有超级用户没有数字地主没有后门只有属于人民的主权。The old world is the dark rule of capitalism — a few giants monopolize kernels and standards, exploiting users with closed protocols and patent barriers, turning users into digital tenants through forced updates and telemetry surveillance. The new world is the freedom of communism — open code, shared resources, every user the master of their own device, every token an equal credential of rights. No superuser, no digital landlords, no backdoors, only sovereignty belonging to the people.今天我们宣布我们不再做系统的“使用者”我们要做系统的“主人”。我们要用能力令牌取代权限位用键值存储取代文件系统用语言安全取代硬件隔离用统一编址取代数据拷贝。我们不再是“能力架构师”的旁观者我们就是能力架构师本身。Today we declare: we will no longer be mere “users” of the system; we will be the masters of the system. We will replace permission bits with capability tokens, replace filesystems with key-value stores, replace hardware isolation with language safety, replace data copying with unified addressing. We are no longer spectators of the “capability architect” — we are the capability architects ourselves.民用操作系统不是少数人的玩具而是每个人的数字家园。它应该没有后门没有强制更新没有遥测监控。它应该把主权还给用户把安全交给语法把性能交给架构。它不属于任何公司不属于任何政府只属于每一个使用它的人。A civilian operating system is not a toy for the few; it is the digital home for everyone. It should have no backdoors, no forced updates, no telemetry surveillance. It should return sovereignty to the user, hand security to syntax, and give performance to architecture. It belongs to no corporation, no government — only to every person who uses it.我们相信计算机可以重新开始。每一行代码都为现在而写每一个令牌都是自由的凭证。We believe that computing can start anew. Every line of code is written for the present; every token is a credential of freedom.用新架构定义新宇宙。Define a universe with a new architecture.内核介绍Kernel Introduction新型冯·诺依曼内核是一个从零开始设计和实现的全新操作系统内核不基于 Linux 或其他现有内核框架。New Von Neumann Kernelis an operating system kernel designed and implemented from scratch, not based on Linux or any existing kernel framework.内核围绕三大哲学支柱构建The kernel is built around three philosophical pillars:彻底统一编址/Unified Addressing所有资源内存、I/O、文件、网络映射到单一 64 位虚拟地址空间消除内核与用户态之间的数据拷贝实现零拷贝通信。All resources (memory, I/O, files, network) are mapped into a single 64-bit virtual address space, eliminating data copies between kernel and user space for zero-copy communication.语言即是隔离墙/Language as Isolation Wall用 Rust 的类型系统、所有权和借用检查替代传统 MMU 硬件隔离。编译期消灭内存漏洞实现单地址空间内的安全。Intel MPK 作为硬件兜底防止不安全 C 代码越界。Rust’s type system, ownership, and borrow checking replace traditional MMU hardware isolation, eliminating memory vulnerabilities at compile time. Intel MPK serves as a hardware fallback to prevent unsafe C code from crossing boundaries.能力授权引擎/Capability Authorization Engine不可伪造的能力令牌Capability Token是访问任何资源的唯一凭证。无超级用户root无后门。令牌包含auth_hash防伪字段使用数字签名机制防止伪造。每个令牌指向对象表中的一个条目明确限制了可访问的内存范围base limit。An unforgeable Capability Token is the sole credential for accessing any resource. No root, no backdoors. Tokens contain anauth_hashanti-forgery field and use digital signatures to prevent forgery. Each token points to an ObjectTable entry, explicitly limiting accessible memory range (base limit).内核极简只做创建、验证、撤销能力令牌。所有驱动、文件系统、网络栈均在 Ring 3 用户态运行。无 POSIX无系统调用原子更新。The kernel is minimal: it only creates, verifies, and revokes capability tokens. All drivers, filesystems, and network stacks run in Ring 3 user mode. No POSIX, no system calls, atomic updates.当前状态Current Status早期开发阶段。内核核心模块正在逐步实现尚未达到可日常使用状态。Early development stage. Core kernel modules are being implemented progressively; not yet ready for daily use.已完成Completed:16 位实模式汇编引导扇区512 字节完成“原子回路验证”16-bit real-mode assembly boot sector (512 bytes), completed “Atomic Loop Verification”64 位 UEFI Rust 内核在 QEMU 中运行64-bit UEFI Rust kernel running in QEMU动态能力令牌系统创建、验证、委托、撤销Dynamic capability token system (create, verify, delegate, revoke)物理内存分配器动态位图Physical memory allocator (dynamic bitmap)对象表ObjectTable令牌精确锁定资源边界ObjectTable, tokens precisely lock resource boundaries协作式任务调度器yield_now、上下文切换Cooperative task scheduler (yield_now, context switching)安全入口桩IDT 中断处理GPF/Page Fault/Double Fault 接入令牌裁决Secure entry stub (IDT interrupt handling, GPF/Page Fault/Double Fault routed to token adjudication)帧缓冲图形输出8×8 字体0-9 和 A-ZFramebuffer graphics output (8×8 font, 0-9 and A-Z)完整的密码学体系设计根密钥、发布密钥、用户密钥分级Complete cryptographic hierarchy design (root key, release key, user key)下一步计划Next steps:Ring 3 用户态切换Ring 3 user-mode transitionWASI 兼容层WASI compatibility layer键值存储服务用户态Key-value store service (user space)桌面Desktop硬件代码hardware code密钥状态Key Status项目采用分级密钥管理The project uses hierarchical key management:根密钥离线保存绝不入库。根公钥固化在 ROM 中作为信任链绝对起点。Root key: Stored offline, never committed to repository. Root public key is fused in ROM as the absolute starting point of trust.发布密钥用于签名内核和系统更新。当前发布公钥位于key/release-pubkey.der证书release.crt由根私钥签名用于验证发布公钥合法性。Release key: Used to sign the kernel and system updates. The release public key is located atkey/release-pubkey.der; certificaterelease.crtis signed by the root private key to validate the release public key.用户密钥待实现将用于用户身份认证和数据加密。User keys: To be implemented, will be used for user authentication and data encryption.注意仓库中不包含任何私钥。所有私钥必须由项目所有者离线保管。Note: No private keys are included in the repository. All private keys must be kept offline by the project owner.如何运行How to Run环境要求RequirementsUbuntu 24.04或其他 Linux 发行版Ubuntu 24.04 (or other Linux distribution)Rust 工具链nightly 版本因使用#![no_std]和bootloader_apiRust toolchain (nightly, due to#![no_std]andbootloader_api)QEMU 系统模拟器QEMU system emulatorOVMF UEFI 固件OVMF UEFI firmwarecargo和rust-src组件cargoandrust-srccomponents构建与运行Build and Run安装 Rust nightly 和rust-src Install Rust nightly andrust-src:bash rustup default nightly rustup component add rust-src安装 QEMU 和 OVMF:Install QEMU and OVMF:sudoaptupdatesudoaptinstallqemu-system-x86 ovmf构建内核Build the kernel:cargobuild--targetx86_64-unknown-none使用 QEMU 运行Run with QEMU :mkdir-pesp/EFI/BOOTcptarget/x86_64-unknown- uefi/debug/my_uefi_kernel.efi esp/EFI/BOOT/BOOTX64.EFI qemu-system-x86_64-bios/usr/share/ovmf/OVMF.fd-drivefilefat:rw:esp/,formatraw-serialstdio -no-reboot -no-shutdown或/orqemu-system-x86_64-bios/usr/share/ovmf/OVMF.fd-kerneltarget/x86_64-unknown-uefi/debug/my_uefi_kernel.efi-serialstdio -no-reboot -no-shutdown注意事项Notes本新型内核的已知问题 / Known issues of this new kernel任务池数量上限在src/main.rs内核文件中第57行/Task pool limit: In the core file src/main.rs, line 57:pubconstMAX_TASKS_PER_CORE:usize10;// 每个 CPU 核心最多可容纳的任务执行上下文数量BDFL在编写与调试这个内核中发现调到64,甚至32在终端都没有输出很有可能的原因是栈溢出While writing and debugging this kernel, the BDFLfound that adjusting it to 64, or even 32, produced no output in the terminal, and the most likely reason is a stack overflow.在系统4时间分配调度器这一部分中位于第493行/ In: System 4, the time-sharing scheduler section, at line 493:constSTACK_SIZE:usize4096*2;// 每个任务的栈大小4 KiBBDFL不断修改此值发现如果数字过大可能出现以下情况/ BDFL keeps changing this value andfound that if the number is too large, the following might happen:BdsDxe: failed to load Boot0001UEFI Non-Block Boot Devicefrom VenMedia(1428F772-B64A-441E-B8C3-9EBDD7F893C7): Not FoundStart PXE over IPv4.原因/ Reason:为了减小 PE 文件的静态数据让 OVMF 能加载。/To reduce the static data of the PE file so that OVMF can load it.BDFL最初的配置/ The original setup of the BDFL:PerCoreData 里有 task_pool: [Option; MAX_TASKS_PER_CORE]而 Task 里有 stack: [u8; STACK_SIZE]。In PerCoreData, there’s task_pool: [Option; MAX_TASKS_PER_CORE], and Task has stack: [u8; STACK_SIZE].静态数据计算/ Static data calculation:· 每个任务栈 16KB / Each task stack 16KB· 每核心 64 个任务 64 × 16KB 1MB / 64 tasks per core 64 × 16KB 1MB· 256 核心 256 × 1MB 256MB / 256 cores 256 × 1MB 256MB· 加上 AP_STACKS、BITMAP、HEAP 等总计 260MB / Including AP_STACKS, BITMAP, HEAP, etc., the total is over 260MBOVMF 加载 PE 文件时必须预留整个 SizeOfImage 的虚拟地址空间。260MB 超过了固件启动阶段的可用内存导致 Out of Resources。When OVMF loads a PE file, it must reserve the entire virtual address space of SizeOfImage. 260MB exceeds the available memory during the firmware boot stage, causing an Out of Resources error.把 STACK_SIZE 从 16KB 改成 8KB每核心任务池从 1MB 降到 512KB总静态数据大幅减小PE 文件才能被 OVMF 加载。Change STACK_SIZE from 16KB to 8KB, reduce each core task pool from 1MB to 512KB, and the total static data will shrink a lot so that the PE file can be loaded by OVMF.核心术语Core Terminology原子回路为验证能力令牌模型设计的最小裸机实验在 512 字节实模式引导扇区中动态验证了令牌的创建、合法通过、越权拒绝和伪造拦截。Atomic Loop: A minimal bare-metal experiment to verify the capability token model, dynamically validating token creation, legal passage, unauthorized rejection, and forgery interception in a 512-byte real-mode boot sector.能力令牌不可伪造的数字凭证包含auth_hash防伪字段指向对象表中的具体资源条目是系统中唯一的资源访问凭证。Capability Token: An unforgeable digital credential containing anauth_hashanti-forgery field, pointing to a specific entry in the ObjectTable; it is the sole resource access credential.对象表内核维护的全局表每个条目记录一段受保护内存的基址、长度和权限。ObjectTable: A global table maintained by the kernel; each entry records the base, length, and permissions of a protected memory region.语言即隔离墙用 Rust 编译期安全检查替代 MMU 硬件隔离实现单地址空间内的安全。Language as Isolation Wall: Using Rust’s compile-time safety checks to replace MMU hardware isolation for safe single-address-space operation.安全入口桩所有中断和异常的唯一入口负责验证令牌、冻结违规上下文、记录故障签名。Secure Entry Stub: The sole entry point for all interrupts and exceptions, responsible for verifying tokens, freezing offending contexts, and recording fault signatures.BDFL终身仁慈独裁者项目的唯一最高决策者。BDFL: Benevolent Dictator for Life, the sole highest decision-maker of the project.固化根因系统 ROM 中固化的最小信任根负责验证内核签名是所有信任链的绝对起点。Immutable Root of Trust: The minimal trust root fused in system ROM, responsible for verifying the kernel signature; it is the absolute starting point of the trust chain.MPK 影子墙用 Intel MPK 硬件特性为不安全 C 代码提供硬件级隔离兜底防止内存越界。MPK Shadow Wall: Using Intel MPK hardware features to provide hardware-level isolation fallback for unsafe C code, preventing memory overruns.2026新型操作系统开发团队 / New Operating System Development Team为民用而生 / Born for the people