Monolithic Kernels

# Why a monolithic call is cheap: it IS a call. No message, no copy,
# no context switch -- and no boundary either.

class MonolithicKernel:
    def __init__(self):
        # every subsystem lives in ONE address space
        self.state = {"scheduler": "ok", "vfs": "ok", "block": "ok"}
        self.modules = {}

    def sys_read(self):
        calls = ["vfs.resolve", "block.plan", "driver.read"]
        return calls                      # all direct calls, ~2ns each

    def insmod(self, name, module):
        # A loaded module is LINKED INTO this address space. It is
        # dynamically loaded, NOT isolated. Full kernel privilege.
        self.modules[name] = module
        module(self.state)                # hands it everything

def buggy_driver(kernel_state):
    # off-by-one write: the byte lands in whatever is adjacent
    kernel_state["scheduler"] = "CORRUPT"

k = MonolithicKernel()
print("one syscall, direct calls:", " -> ".join(k.sys_read()))
k.insmod("badnet", buggy_driver)
print("after loading one buggy driver:", k.state)
print("a module is dynamically loaded, never isolated")

// One address space: a subsystem call is a function call, and a buggy
// module writes wherever it likes. Both facts have the same cause.
#include <iostream>
#include <cstring>
#include <string>
struct KernelState {
    char rx_buf[16]; // a driver's receive buffer
    std::string scheduler; // whatever the allocator placed next to it
};
static KernelState kernel {
    {
    }, "ok"
};
// Direct call: no message, no copy, no context switch -- and no boundary.
const char* sys_read() {
    return "vfs.resolve -> block.plan -> driver.read";
}
// A loaded module runs INSIDE this address space with full privilege.
// Dynamically loaded is not the same thing as isolated.
void buggy_driver(const char* frame, std::size_t len) {
    if (len > sizeof(kernel.rx_buf)) {
        // The real bug writes past the buffer. Shown as the effect it has:
        // whatever sits after rx_buf in the slab is corrupted.
        kernel.scheduler = "CORRUPT";
    }
}
int main() {
    std::cout << "one syscall: " << sys_read() << '\n';
    buggy_driver("....................", 20); // a jumbo frame
    std::cout << "scheduler state after one driver bug: "
    << kernel.scheduler << '\n';
}

// Expressed as a Java program, the structure is obvious: one process,
// shared references, no isolation anywhere.
class MonolithicKernel {
    Scheduler scheduler = new Scheduler();
    VFS vfs = new VFS();
    BlockLayer blockLayer = new BlockLayer();
    Map<String, Driver> drivers = new HashMap<>();
    byte[] sysRead(int fd, int count) {
        Inode inode = vfs.resolve(fd); // direct invocation
        var plan = blockLayer.plan(inode, count);
        return drivers.get(inode.device()).read(plan);
    }
    void insmod(Driver d) {
        d.init(this); // hands the module a reference to EVERYTHING
        drivers.put(d.device(), d);
    }
}
// The analogy holds exactly where it matters: passing `this` gives the
// module reach into the scheduler, the VFS, and every other driver.
// Java would at least keep it memory-safe -- C does not, which is why
// Rust was merged into the kernel specifically for new driver code.