一个从零编写的独立 64 位操作系统。单地址空间 Ring0 内核，封缄内存（UTSM）、带标记读写器（UTRW）、专用恢复根（DRR）与可加载驱动模块系统（DKM），内置 Linux / PE 双兼容层。 An independent 64-bit OS written from scratch. Single address-space Ring0 kernel, sealed memory (UTSM), tagged read/write mediator (UTRW), dedicated recovery root (DRR), and loadable driver module system (DKM), with built-in Linux / PE compatibility layers.
x86_64 long mode · Limine · C11 + ASM · LLVM · SAS-R0 · UTSM · UTRW · DRR · DKM
Deshab 不假装安全，只声明边界；不假装完成，只标 。Deshab does not pretend to be secure, it only declares boundaries; it does not pretend to be finished, it only marks .
docs/PHILOSOPHY.md
Deshab 的灵魂是自相矛盾：一边封圣一边爆粗，一边敞开门一边焊死锁——疯的是姿态，稳的是时序。 Deshab's soul is self-contradiction: it canonizes while it curses, it opens the door while it welds the lock shut — mad in posture, disciplined in sequencing.
最自由的系统，需要最隆重的仪式来证明它本不需要仪式。The freest system needs the most solemn ritual to prove it never needed ritual.
单地址空间里，隔离是一种修辞，不是一种机制。In a single address space, isolation is rhetoric, not a mechanism.
0bug 不是没有错，是错也错得有 B0–B4 的章法。Zero bugs isn't "no mistakes" — it's failing with the discipline of B0–B4.
不承诺安全（环境假设无攻击者），不承诺完成（ 是坦白），但承诺可演示（每个里程碑都有 QEMU 证据）、承诺边界（// 三层分离）。No promise of security (zero-attacker assumption), no promise of completion ( is honesty), but a promise of demonstrability (every milestone has QEMU evidence) and of boundaries (// separation).
Deshab-OS：一个把锁焊在敞开的门上、用莲花崩溃屏收殓每一次 panic 的毛坯神殿。敞开工坊，不是赛博保险柜——一把扳手走天下，卡了按时光键。Deshab-OS: a raw temple that welds the lock onto an open door, collecting every panic in a lotus crash screen. An open workshop, not a cyber vault — one wrench for everything, and when it stalls, press the time-key.
气质定位Positioning
Deshab-OS 采用双阶段内核架构：UTSM（首阶段内核）负责平台初始化、封缄内存与驱动加载，DSK（主内核）负责运行时调度与用户交互。两者通过版本化的 dsk_boot_context 结构体交接（RDI=ctx，magic DSK1BOOT）。
Deshab-OS uses a dual-stage kernel: UTSM (first-stage) handles platform init, sealed memory and driver loading; DSK (main kernel) handles runtime scheduling and user interaction. They hand off via a versioned dsk_boot_context (RDI=ctx, magic DSK1BOOT).
单地址空间 Ring0 + Per-CPU O(1) 位图调度队列。调度切换只加载加密上下文指针，绝不扫描 capability、不计算 MAC、不写 checkpoint。当前 BSP-only。Single Address Space Ring0 + Per-CPU O(1) bitmap queues. Context switches only load encrypted pointers — no capability scans, MAC calculations, or checkpoint writes. Currently BSP-only.
UUID 调谐封缄内存。内存默认密文形态，明文读写须经 UTRW。每 CPU 密钥缓存 (PCKC)，capability O(1) 定位。epoch 过期 / MAC 失败 → Slow Path 异常恢复。chacha20 KAT 已对拍 RFC 8439。UUID-tuned sealed memory. Memory is ciphertext by default; plaintext access requires UTRW. Per-CPU Key Cache (PCKC), O(1) capability lookup. Epoch expiry / MAC failure → Slow Path recovery. chacha20 KAT verified against RFC 8439.
带标记读写器。所有明文内存访问必须经过 UTRW。读写分 Fast Path (PCKC 命中) / Slow Path (密钥缺失) / Raw Path (直接读密文)。Tagged Read/Write mediator. All plaintext memory access must go through UTRW. Three paths: Fast (PCKC hit) / Slow (key miss) / Raw (direct ciphertext).
专用恢复根。独立 Emergency Pool（普通 OOM 不阻断恢复），checkpoint 只处理 dirty shard/page。A/B 双槽 + CRC64 + active slot 原子切换，杜绝半写 checkpoint。Dedicated Recovery Root. Independent Emergency Pool (normal OOM can't block recovery), checkpoint only dirty shards/pages. A/B dual-slot + CRC64 + atomic active-slot swap — no half-written checkpoints.
驱动 ELF64 .drv，通过 driver_desc / driver_init / driver_exit ABI 与内核解耦。通过 dkm_kernel_api 调用内核服务，不直接依赖内核符号。ELF64 .drv modules decoupled via driver_desc / driver_init / driver_exit ABI. Kernel services via dkm_kernel_api, no direct symbol dependency.
启动配置文件 SYSTEM/system/deshab64/FUCK 采用 INI 格式，控制启动行为、驱动开关、UTSM 参数、桌面行为。UTSM 阶段经 Limine boot module 读取，DSK 阶段经 FAT32 读取。Boot config FUCK in INI format. Controls boot behavior, driver toggles, UTSM params, desktop behavior. Read via Limine module (UTSM) or FAT32 (DSK).
Deshab Boot Sequence (DBS) 每阶段有明确的 Entry / Exit / Fail 承诺与可验证串口锚点。 Each stage has clear Entry / Exit / Fail contracts and verifiable serial anchors.
| 阶段Stage | 代号Codename | 含义Meaning | 锚点Anchor |
|---|---|---|---|
| B0 | Ignis 火种 | 固件 → Limine → utsm.elf 入内存Firmware → Limine → utsm.elf loaded | [UTSM] boot |
| B1 | Sigillum 封缄解封 | UTSM 建立封缄内存 + 14 驱动 ACTIVEUTSM sealed memory + 14 drivers ACTIVE | [UTSM] SELFTEST PASS |
| B2 | Transitus 交接 | UTSM → DSK 版本化 context 传递UTSM → DSK versioned context handoff | [UTSM] jumping to DSK |
| B3 | Origo 溯源 | DSK 判定首次 / 正常启动DSK determines first/normal boot | [DSK] context ok |
| B4 | Excitas 唤醒 | FirstInit 向导或登录 → 桌面FirstInit wizard or login → desktop | [DSK] loading desktop |
| Stage | 类别Class | 驱动Driver | 能力Capability | 状态Status |
|---|---|---|---|---|
| 0 | platform | timer | PIT 校准 + 精确延时PIT calibration + precise delay | 完成 |
| interrupt | apic | CPUID / MADT / LAPIC MMIO 只读 + PIC IRQCPUID / MADT / LAPIC MMIO + PIC IRQ | 完成 | |
| platform | acpi | RSDP → XSDT，ACPI 表枚举RSDP → XSDT, ACPI table enumeration | 完成 | |
| bus | pci | PCI config space 扫描，设备枚举PCI config space scan, device enumeration | 完成 | |
| 1 | console | console_fb | Limine framebuffer，图形清屏Limine framebuffer, graphical clear | 完成 |
| block | ahci | PCI AHCI + IDENTIFY/READ/WRITE DMA + ahci0 providerPCI AHCI + IDENTIFY/READ/WRITE DMA + ahci0 provider | 完成 | |
| block | nvme | PCI NVMe 探测（BAR0>4G 待高位 MMIO）PCI NVMe discovery (high MMIO pending) | 进行中 | |
| fs | bootfs | Limine boot module 内存文件系统Limine boot module in-memory filesystem | 完成 | |
| 2 | fs | vfs | 挂载 bootfs，文件查找 / 读取Mount bootfs, file lookup / read | 完成 |
| fs | fat32 | 只读 FAT32（DSK 侧可写，用于持久化）Read-only FAT32 (DSK side writable for persistence) | 进行中 | |
| fs | devfs | /dev/version /dev/platform /dev/fb0 /dev/modules /dev/boot/Virtual device filesystem | 完成 | |
| 3 | net | e1000 | PCI + MAC + RX/TX ring + DHCP/ARP/UDP/DNS (polling)PCI + MAC + RX/TX ring + DHCP/ARP/UDP/DNS (polling) | 完成 |
| net | virtio_net | PCI + modern virtio capability 枚举（未做 virtqueue）PCI + modern virtio capability enumeration (no virtqueue) | 进行中 | |
| input | ps2kbd | IRQ1，scancode set 1 → ASCIIIRQ1, scancode set 1 → ASCII | 完成 |
驱动状态机：DISCOVERED → QUEUED → DEP_WAIT → LOADING → ELF_CHECKED → MEMORY_ALLOCATED → RELOCATED → ABI_CHECKED → INITING → ACTIVE Driver FSM: DISCOVERED → QUEUED → DEP_WAIT → LOADING → ELF_CHECKED → MEMORY_ALLOCATED → RELOCATED → ABI_CHECKED → INITING → ACTIVE
DHCP 四步握手获取 IP → ARP 解析网关 MAC → DNS A 记录查询外部域名。netman 网络管理器由 DSK 调度，完成早期联网闭环。DHCP 4-step handshake → ARP gateway MAC resolution → DNS A record query. netman network manager scheduled by DSK for early networking.
Atheros AR928x 芯片组，EEPROM 解析、被动扫描、802.11 beacon 帧解析。需真实硬件测试（QEMU 不支持 WiFi 模拟）。Atheros AR928x chipset, EEPROM parsing, passive scanning, 802.11 beacon parsing. Requires real hardware (QEMU cannot emulate WiFi).
PCI + modern virtio capability 枚举。支持 QEMU virtio-net-pci 设备 (1af4:1001)，virtqueue 数据路径待落地。PCI + modern virtio capability enumeration. Supports QEMU virtio-net-pci (1af4:1001); virtqueue data path pending.
desktop.elf — 全屏独占 framebuffer，复刻 Winux-Kate 布局，提供完整桌面体验。 desktop.elf — Full-screen exclusive framebuffer, Winux-Kate-inspired layout, complete desktop experience.
DASHBOARD（四面板）/ IDE（多标签）/ DESKTOP（图标网格 + 浮动窗口）/ CUSTOM（外部 ELF 宿主）DASHBOARD (4-panel) / IDE (multi-tab) / DESKTOP (icon grid + floating windows) / CUSTOM (external ELF host)
最多 8 个窗口，支持拖拽 / 聚焦 / 最小化 / 关闭，6 个工作区。Up to 8 windows, drag / focus / minimize / close, 6 workspaces.
shell（25+ 命令，Linux 风格）/ cmd（Windows 风格）/ editor / fileman / calc / browser / curl / ping / settings / sysinfoshell (25+ commands) / cmd / editor / fileman / calc / browser / curl / ping / settings / sysinfo
双缓冲 + 脏矩形合并 + 行级脏标记增量渲染。"Sealed Arc" 设计语言（Arc 弧 / Seal 封 / Flow 流），暗色主题。Double-buffered + dirty rect merging + line-level dirty incremental rendering. "Sealed Arc" design language, dark theme.
DBF 格式 8bpp 灰度位图字体。GB2312 6763 汉字 + ASCII 全覆盖，16/24/32px 三档字号。索引按 codepoint 升序二分查找。DBF format 8bpp grayscale bitmap. GB2312 6763 Hanzi + ASCII full coverage, 16/24/32px sizes. Binary search by codepoint.
圆角卡片 UI，PS/2 键盘 + 鼠标输入。引导用户设置计算机名 / 用户名 / 密码 → 网络配置（WiFi）。SHA256 + XOR 加密写入 USER.CONF。Rounded card UI, PS/2 keyboard + mouse. Guides through computer name / username / password → network setup (WiFi). SHA256 + XOR → USER.CONF.
Park-and-Resume 双内核（类 WSL）。UTSM 充当 VMM (VMX root)，Linux 6.6 LTS 作为 guest (VMX non-root) 常驻内存。IPC 委托执行：共享内存 ring + VMCALL hypercall + IPI。Shell 提供 dsl 命令。代码全链路就绪，VMX 实机验证待嵌套虚拟化环境。Park-and-Resume dual-kernel (WSL-like). UTSM as VMM (VMX root), Linux 6.6 LTS guest (VMX non-root) parked in memory. IPC delegation: shared memory ring + VMCALL hypercall + IPI. dsl shell commands. Full code path ready; VMX hw verification pending nested virt env.
极简 Wine。UTSM 内置 PE 加载器 + Windows API shim + x86-32 解释器。PE32+ (64 位) 重定位加载 → IAT 填 ms_abi shim → Ring0 原生执行。PE32 (32 位) 加载 → 合成 IAT → x86emu32 解释执行。Minimal Wine. UTSM built-in PE loader + Windows API shim + x86-32 interpreter. PE32+ (64-bit): relocate → IAT ms_abi shim → Ring0 native. PE32 (32-bit): load → synthetic IAT → x86emu32 interpreted.
| 工具Tool | 版本Version | 用途Purpose |
|---|---|---|
| LLVM Clang | 14+ | C11 / 汇编编译C11 / ASM compilation |
| ld.lld | 14+ | 链接器Linker |
| make | 任意Any | 各模块构建Module builds |
| Python 3 + Pillow | 3.8+ | 字体生成Font generation |
| QEMU | 7+ | UEFI 启动验证UEFI boot verification |
| PowerShell / WSL | 5.1+ | 构建脚本 / mkfs 打包Build script / mkfs packaging |
build.ps1 会自动扫描 C:\Program Files\LLVM\bin 等常见目录发现 clang / ld.lld，即使不在 PATH 也可用。
build.ps1 auto-scans common directories for clang/ld.lld, so they work even when not in PATH.
预期启动锚点： Expected boot anchors:
状态唯一来源是仓库 docs/STATUS.md。 已实现 · 演示级（注明边界）· 仅设计。
Single source of truth: docs/STATUS.md. implemented · demo-grade · design-only.
| 子系统Subsystem | 状态Status | 备注Notes |
|---|---|---|
| 早期启动 / IDT / PIC / IOAPIC-LAPIC 路由Early boot / IDT / PIC / IOAPIC-LAPIC routing | 完成 | |
| DKM 驱动加载 (14/14)DKM driver loading (14/14) | 完成 | |
| UTSM 封缄内存（Fast/Slow Path + @sealed）UTSM sealed memory (Fast/Slow Path + @sealed) | 完成 | chacha20 KAT 对拍 RFC 8439chacha20 KAT vs RFC 8439 |
| AHCI 块设备 (读/写)AHCI block device (R/W) | 完成 | |
| ext4 读写驱动ext4 read/write driver | 完成 | extent 树 + 块/inode 分配回收extent tree + block/inode alloc |
| e1000 网络 (DHCP/ARP/DNS)e1000 network (DHCP/ARP/DNS) | 完成 | polling 轮询polling |
| 字体系统 (GB2312 全覆盖)Font system (GB2312 full coverage) | 完成 | |
| 桌面 / shell / cmd / loginDesktop / shell / cmd / login | 完成 | |
| PE/EXE 兼容层PE/EXE compatibility layer | 完成 | PE32+ 原生 / PE32 走 x86emu32PE32+ native / PE32 x86emu32 |
| 真实加密原语Real crypto primitives | 演示级 | chacha20/KDF/MAC 已落，PCKC schedule 待接chacha20/KDF/MAC done, PCKC schedule pending |
| SAS-R0-PCQ 调度器SAS-R0-PCQ scheduler | 演示级 | BSP-only，per-cpu 多核待做BSP-only, multi-core pending |
| Linux 兼容层Linux compatibility layer | 演示级 | 代码全链路；VMX 实机验证待 VT-x/KVMcode complete; VMX hw verify pending |
| FirstInit 首次启动向导FirstInit wizard | 演示级 | 输入+SHA256+写盘闭环input+SHA256+persist loop |
| NVMe | PCI discovery | 待高位 MMIO 映射high MMIO mapping pending |
| Pacman 包管理器Package Manager | 五阶段方案 | |
| DRR 回滚 (segment/system 级)Rollback (segment/system) | 待验证 | page 级 + 看门狗 page-level + watchdog |
Deshab 不假装是它不是的东西。以下为 v1 明确不做的目标： Deshab does not pretend to be what it is not. These are explicitly out of scope for v1:
SAS-R0 单地址空间 Ring0，无 per-process 页表、无 ring3。驱动 bug = 内核全盘崩，这是接受的代价。SAS-R0 single address space Ring0, no per-process page tables, no ring3. A driver bug = full kernel crash, an accepted cost.
UTSM 无硬件信任根（无 IOMMU/MPK/TEE），封缄防的是「自己手滑」，不是攻击者（本环境假设无攻击者）。UTSM has no hardware root of trust (no IOMMU/MPK/TEE); sealing guards against self-slip, not attackers (zero-attacker assumption).
0bug 靠 QEMU 演示证据 + DRR 回滚兜底，不靠证明。Zero bugs relies on QEMU evidence + DRR rollback, not proofs.
同地址空间插件，「能加载」≠「能安全卸载」；热卸载为待办。Same-address-space plugins: "can load" ≠ "can safely unload"; hot-unload is TODO.
| 文档Document | 内容Content |
|---|---|
| STATUS.md | 单一状态源（全子系统三色表 + 证据）Single source of truth (three-color table + evidence) |
| PHILOSOPHY.md | 疯圣典：矛盾美学与「疯但好使」物理学The Mad Scripture: contradiction aesthetics |
| ARCHITECTURE.md | 架构设计 + 非目标章Architecture + non-goals |
| BOOT_SEQUENCE.md | B0–B4 五阶段启动序列（演示版）B0–B4 five-stage boot (demo) |
| ROADMAP_INSANE.md | 五期填补计划（F/U/D/R/E 唯一任务编号）Five-phase fill plan (F/U/D/R/E task IDs) |
| TASKBOARD.md | 可勾选任务表Checkable task board |
