Service-oriented operating systems aim to reduce kernel trusted computing bases by moving device-class components into isolated user-space services, but this requires a principled and testable device-access boundary. This paper presents and validates a minimal substrate for userspace device services in NEURON, a capability-oriented Rust microkernel targeting RISC-V. Device register access is exposed via a bounded DeviceMmio capability and a dedicated mapping syscall that enforces window bounds and non-executable user mappings by construction, establishing WX at the device boundary without caller-controlled page flags. Device authority is distributed outside the kernel: init acts as the capability distributor, while a deny-by-default policy service (policyd) authorizes transfers based on a kernel-provided principal identity, yielding auditable outcomes without kernel name checks. To support timing-sensitive services during bring-up, the system provides a minimal deterministic timing spine consisting of a typed QoS hint ABI and a userspace timer-coalescing service with bounded registrations and fixed coalescing windows. Evidence is provided through syscall-level negative tests and full-system QEMU selftests with canonical pass markers. The results establish an enforceable foundation for userspace drivers while explicitly scoping out DMA isolation, userspace interrupt delivery, and kernel-enforced buffer sealing as future proof gates.
Jenning Schäfer (2026) studied this question.