Post

Work has started on the Radiant Kernel. * It’s an exokernel. Very minimal. * It uses ring buffers as the only syscall interface (think io_uring). * There is no virtual memory — protection works via static analysis. * There are no device drivers, software has direct hardware access.

The kernel loader only accepts typed binaries (Radiance IL) that it can statically verify. Pointer fabrication or laundering can therefore be rejected at load time. The trade-off is that raw RV64 binaries are not accepted by the kernel.

This in turn means that virtual memory and paging are not necessary. For protection from untrusted binaries, it’s possible to use PMP (Physical Memory Protection) still, but this won’t be the default.

This is certainly an interesting approach, though, with (I assume) an IL interpreter in the kernel and no virtual memory... what's left that needs a user mode? (Or are you just not using user mode?)