TITLE It depends on what you mean by title p y y 2 WOULD YOU - - PowerPoint PPT Presentation

TITLE

• It depends on what you mean by ‘title’

p y y

2

WOULD YOU RUN WINDOWS ON YOUR GRANDMOTHER’S PACEMAKER?

Andrew S. Tanenbaum Vrije Universiteit Amsterdam

3

LINUX IS STILL OBSOLETE

Andrew S. Tanenbaum Vrije Universiteit Amsterdam

4

HOW DO WE GET OUT OF THIS MESS?

Andrew S. Tanenbaum Vrije Universiteit Amsterdam

5

COMPUTING ERAS

• Jurassic Era

ENIAC BRONTIAC STEGIAC

6

OUTLINE OF TALK

• Vague generalities

g g

• Mode switch
• Nitty-gritty details of my research and related research

tty g tty deta s o y esea c a d e ated esea c

• New stuff

7

MORE ERAS OF COMPUTING

Era Example OS Goal of OS Jurassic ENIAC

• (none)

Mainframe IBM 360 OS/360 Make it work Mini PDP-11 UNIX Make it fast PC x86 Windows Make it pretty Embedded Camera QNX (?) Make it invisible Embedded Camera QNX (?) Make it invisible Ubiquitous ? ? Make it helpful Up until now, goal of OS was overcoming hardware limitations (e.g., virtual memory to pretend there was enough memory)

8

MAKING PREDICTIONS

• Making predictions is hard

g p

• Especially about the future
• People keep trying though

eop e eep t y g t oug

9

FAMOUS PREDICTIONS

• “Heavier than air flying machines are impossible”

L d K l i P id t f th R l S i t (1895) – Lord Kelvin, President of the Royal Society (1895)

“Th ti ill h hild ill b t ht

• “The time will come when children will be taught

everything by moving pictures. They will never be

• bliged to read history again”
• bliged to read history again

– D.W. Griffith, director of Birth of a Nation (1915)

• “There will be only one orchestra left on earth, giving

nightly worldwide concerts”

10

g y

– Bruce Bliven EiC of The New Republic on radio (1922)

MORE FAMOUS PREDICTIONS

• “The problem with television is that people must sit

p p p and keep their eyes glued to the screen; the average American family hasn't time for it.”

– New York Times editorial (1939)

“I hi k h i ld k f fi ”

• “I think there is a world market for five computers”

– T.J. Watson, Chairman of IBM (1945)

• “In the future, computers may weigh only 1.5 tons”

Popular Mechanics magazine (1949)

11

– Popular Mechanics magazine (1949)

YET MORE FAMOUS PREDICTIONS

• “Nobody needs a computer in their house”

y p

– Ken Olson, President of DEC (1957)

– (DEC no longer exists. Watch out when the boss says something really dumb)

• “640K ought to be enough for anyone”

Bill Gates CEO of Microsoft (1981) – Bill Gates, CEO of Microsoft (1981)

• “In 5 years everyone will be running GNU”
• In 5 years, everyone will be running GNU

– Andy Tanenbaum, village idiot (1992)

12

MOORE’S LAW

• Conservative approach: Use Moore’s Law

pp

13

THE VRIJE UNIVERSITEIT IN 1973

• PDP-11/45

14

OUR PDP-11/45 IN 1973

Item Description CPU PDP 11/45 CPU PDP-11/45 Clock 1 MHz RAM 16 KB (1 byte = $1) S

3

Size 2 m3 Disk 2.5 MB (14-inch RK05) Modem 300 bps (via acoustic couplers) p ( p ) Wireless

• Price

$80,000

15

MY HOME PC IN 2003

Item Description 2003/1973 CPU Pentium 4 CPU Pentium 4 Clock 3 GHz 3,000x faster RAM 1 GB 60,000x bigger Si 0 2

3

Size 0.2 m3 Disk 1.2 TB 500,000x bigger Modem 8 Mbps (ADSL) 30,000x faster p ( ) Wireless 54 Mbps Price $3000 30x cheaper 3000 x 60,000 x 500,000 x 30,000 x 30 = 1020

16

MOORE’S LAW FOR AIRCRAFT

• Suppose aircraft obeyed Moore’s law 1973-2003

pp y

• Range, seating capacity, speed, cost each 105x better
• In 2003 a high-end plane would have

003 a g e d p a e

• u d

a e

• Range: fly nonstop around the world 20,000 times
• Seating capacity: 2 million people

g p y p p

• Speed: fly from San Francisco to London in 400 msec
• Cost: San Francisco-London ticket would be 5 cents
• Probably have to wait six months for your baggage in London
• One out of every 500 flights would crash

f f f

17

• Aircraft engineers would be proud of this safety record

THE WORLD ACCORDING TO MOORE (IN 2033) ( )

Item Description 2033/2003 CPU P ti 12 CPU Pentium 12 Clock 10 THz 3,000x faster RAM 16 PB 60,000x bigger gg Size Book Disk 600 PB 500,000x bigger Modem 160 Gbps 30 000x faster Modem 160 Gbps 30,000x faster Wireless ? Price $100 30 x cheaper

18

REALITY CHECK

• Heat problem: Pentium 4 uses ca. 100 watts

p

• Consequence: Can’t improve clock speed much
• Memory access time is not improving much

e

• y access t

e s

• t

p o g uc

• Likely scenario: multicore chips

Shared cache Multicore chip CPU

19

CPU

SOFTWARE

• I just bought a new mouse

j g

• It came with a CD-ROM containing four programs
• I installed the first one: it was 22 MB

sta ed t e st o e t as

• I didn’t dare install the rest
• Who needs a 90-MB mouse?

Who needs a 90 MB mouse?

20

SOFTWARE BLOAT

• Put 50 lines/page, 800-page books, 25 to a shelf

p g , p g ,

NT 3.1 1993 1993 6M LoC

21

SOFTWARE BLOAT

• Put 50 lines/page, 800-page books, 25 to a shelf

p g , p g ,

NT 3.5 1994 1994 10M LoC

22

SOFTWARE BLOAT

• Put 50 lines/page, 800-page books, 25 to a shelf

p g , p g ,

NT 4 1996 1996 16M LoC

23

SOFTWARE BLOAT

• Put 50 lines/page, 800-page books, 25 to a shelf

p g , p g ,

W2000 2000 2000 29M LoC

24

SOFTWARE BLOAT

• Put 50 lines/page, 800-page books, 25 to a shelf

p g , p g ,

XP 2002 2002 50M LoC

25

MOORE MEETS SOFTWARE

Year 1973 OS UNIX V6 OS UNIX V6 Lines of code 13,000 Boot time 10 sec Year 2003 30 years later Year 2003 30 years later OS Windows XP Lines of code 50 million 4000x bigger Boot time 2 min 12x slower Boot time 2 min 12x slower

20

26

Are current OSes 1020x better than UNIX V6? We have VM, GUIs, Web, but is this 1020x?

SOFTWARE IN 2033

• Windows NT grew from 6 to 50 MLoc in 9 years
• In 2033 Windows 33 will occupy 1 6 million books
• In 2033, Windows-33 will occupy 1.6 million books
• That is 3x the size of the Caltech library
• Windows won’t pass Harvard library until 2043
• Windows won’t pass Harvard library until 2043

27

MYHRVOLD’S LAWS

• “Software is a gas. It expands to fill its container.”

g p

• “Software is getting slower faster than hardware

So t a e s gett g s o e aste t a a d a e is getting faster”

28

LIFE IN THE REAL WORLD

My computer is broken

29

LIFE IN THE REAL WORLD

You are a

E = mc2

computer genius

30

LIFE IN THE REAL WORLD

E = mc2

Please fix it Please fix it

• Mr. Fixit

Note: I didn’t think of E = mc2 It was a guy with much more hair

31

g y Besides, I’m not a physicist any more

LIFE IN THE REAL WORLD

100101011 Please fix it Please fix it

• Mr. Fixit

32

LIFE IN THE REAL WORLD

P = NP Please fix it Please fix it

• Mr. Fixit

33

LIFE IN THE REAL WORLD

Please fix it Windows Please fix it @#!%&%

• Mr. Fixit

Of course, it is never a hardware problem. It is always the operating system

34

It is always the operating system. And Linux is just almost as bad as Windows.

MY FRIEND

• I taught him about the CONTROL key in Windows

g y

• Has masters in engineering from Cornell
• Has masters from the MIT Sloane School

as aste s

• t e

S oa e Sc oo

• Uses computers 8 hours a day for his business
• Not a dummy and not a beginner

Not a dummy and not a beginner

• He didn’t know about the CONTROL key
• Imagine what people lacking Ivy League
• Imagine what people lacking Ivy League

engineering degrees don’t know

35

MORE COUSINS

• April 2005: My cousin had a computer full of spyware

p y p py

• It ran in the background, consumed 90% of CPU
• She was about to throw out the computer

S e as about to t

• ut t e co

pute

• I formatted the disk and reinstalled Windows
• June 2005: Another cousin same thing

June 2005: Another cousin, same thing

36

JULY 17, 2005

• “On a recent Sunday morning when Lew Tucker's

Dell desktop computer was overrun by spyware and adware - stealth software that delivers intrusive advertising messages and even gathers intrusive advertising messages and even gathers data from the user's machine - he did not simply get rid of the offending programs. He threw out the whole computer.” T k h Ph D i t i !!!

• Tucker has a Ph.D. in computer science !!!
• NYT article went on to give many more examples
• Nice to know my family is not weird

37

• Nice to know my family is not weird

THE TELEVISION MODEL

• 1. You buy the television

y

• 2. You plug it in
• 3. It works perfectly for the next 10 years

3 t

• s pe ect y o t e

e t 0 yea s

38

THE COMPUTER MODEL

• 1. You buy the computer
• 2. You plug it in
• 3. You install service packs 1 through 9f
• 4. You install 18 new emergency security patches
• 5. You find and install 7 new device drivers
• 6. You install antivirus software
• 7. You install antispyware software
• 8. You install antihacker software (firewall)
• 9. You install antispam software

39

p

• 10. You reboot the computer

THE COMPUTER MODEL (2)

• 11. It doesn’t work

12 You call the helpdesk

• 12. You call the helpdesk
• 13. You wait on hold for 30 minutes

14 Th t ll t i t ll Wi d

• 14. They tell you to reinstall Windows

40

TYPICAL USER REACTION

The New York Times recently reported that 25% of The New York Times recently reported that 25% of computer users have gotten so angry at their computer that they physically hit it.

41

Have you ever punched your car? Spanked your stereo?

A NEED TO RETHINK OPERATING SYSTEMS

• Operating systems research need to be refocused

– We have nearly infinite hardware on PC-class machines We have nearly infinite hardware on PC class machines – Plenty of CPU cycles, RAM, bandwidth – Current software has tons of (useless) features – Consequently, the software is slow, bloated, and buggy

f OS

• To achieve the TV model, future OSes, must be

– Small – Simple – Simple – Modular – Reliable

42

– Secure

THIS TALK IN A NUTSHELL

• Current software is full of useless features
• This makes the code bloated and unreliable
• Future software should be simple, reliable, secure

utu e so t a e s ou d be s p e, e ab e, secu e

• Our research should be aimed at achieving this

43

WHAT AM I DOING ABOUT ALL THIS?

• Royal Dutch Academy of Sciences thinks there are too

y y many old fogies wandering the halls of academia

• Every year 5 fogies are targeted for garbage collection

e y yea 5 og es a e ta geted o ga bage co ect o

• Last year I was one of them
• Told: go off in a corner and stop blocking youngsters

Told: go off in a corner and stop blocking youngsters

• Consolation prize: grant of $2.5 million for research
• So I am not accountable to anyone now
• So I am not accountable to anyone now

44

MODE SWITCH

45

MY RESEARCH TO ACHIEVE THESE GOALS

• Remember MINIX?
• Released in 1987
• Everyone was bugging me to add more features

e yo e as bugg g e to add

• e eatu es
• I wanted to keep it simple while waiting for the messiah

Richard Stallman

46

Richard Stallman

MINIX 3 DESIGN

• Modularity is the most important idea

y p

• Kernel is tiny (3800 LoC vs. 2½ million for Linux)
• Bug rates: 5-16 bugs per 1000 LoC

ug ates 5 6 bugs pe 000

• C
• Low interrupt latency (10 microsec) for real time
• Each driver & server is a separate user process
• Each driver & server is a separate user process
• API of 35 kernel calls (e.g., I/O) for drivers, servers

Jorrit Herder

47

Jorrit Herder

ARCHITECTURE OF MINIX 3

Process

Shell make User

...

FS 1 FS 2 Proc. Other

... Servers User mode

Disk TTY Net Print Other

... Drivers Microkernel handles interrupts, processes, scheduling, IPC

Sys Clock

48

SOME MINIX 3 RELIABILITY PRINCIPLES

• Small kernel means fewer kernel bugs

g

• Put the bugs in cages
• Drivers cannot touch kernel data structures

e s ca

• t touc

e e data st uctu es

• Bit map to restrict driver’s use of kernel API calls
• Bit map to restrict driver’s use of I/O ports

Bit map to restrict driver s use of I/O ports

• Bad pointers/infinite loops affect only 1 user module
• Reincarnation server for (transparent) driver restarts
• Reincarnation server for (transparent) driver restarts
• Buffer overruns: fixed messages and I & D space

49

PERFORMANCE OVERHEAD

• Disk intensive tests: 5-10%
• Network intensive tests: 0% with Fast Ethernet
• CPU intensive tests: 0%

C U te s e tests 0%

• Boot time from multiboot loader: 5 sec
• Time to build kernel servers and drivers: 7 sec

Time to build kernel, servers and drivers: 7 sec.

• Time to build 300 /usr/bin programs: 2½ min

50

POSITIONING OF MINIX

• Show that microkernel-based systems are reliable

y

• Demonstrate that drivers belong in user mode
• High-reliability and fault-tolerant applications

g e ab ty a d au t to e a t app cat o s

• $100 single-chip, small-RAM laptops for 3rd world
• Embedded systems:

Embedded systems:

– DVD players, cell phones, digital cameras, TVs, etc.

MINIX 3 is available: www.minix3.org

51

MINIX 3 CD-ROMS

• I have MINIX 3 CD-ROMs with me
• Get one after my talk (saves a 25-MB download)

Get one after my talk (saves a 25 MB download)

• Two versions: IDE CD-ROM and USB CD-ROM

52

If you want to be the first person to tell Slashdot, move fast

MINIX 3 LOGO

• Why a raccoon?

Small – Small – Cute – Clever Clever – Agile – Eats bugs

53

– More likely to visit your house than a penguin

WEBSITE DEMO ALMOST DIDN’T MAKE IT

• Would it be possible to have the wireless network

turned on during my keynote talk so I can use it to turned on during my keynote talk so I can use it to show something live from the web?

• <Your e-mail was rejected by an anti-spam

content filter on gateway Reasons for rejection content filter on gateway ... Reasons for rejection may be: obscene language, graphics, or spam- like characteristics.>

54

OTHER APPROACH TO RELIABILITY: L4LINUX

• L4: microkernel written by the late Jochen Liedtke
• L4Linux is from Tech Univ of Dresden (Härtig)
• L4Linux is from Tech. Univ. of Dresden (Härtig)
• Linux runs as a big user process
• However any bug in Linux still crashes it
• However, any bug in Linux still crashes it
• Reboot is faster

Linux User Linux User

55

L4

OTHER APPROACH: NOOKS

• Research project at UW (Levy, Bershad, students)

p j ( y, , )

• Nooks wraps device drivers inside Linux
• Shadow drivers (U. of Washington)

S ado d e s (U o as gto )

• Practical: improves reliability of legacy drivers

User

Nooks Li Driver

56

Linux

OTHER APPROACH: VIRTUAL MACHINES

• Research at Univ. of Karlsruhe (LeVasseur et al.)

( )

• Run each driver in a different VM
• If a driver crashes, only its VM dies

a d e c as es, o y ts d es

New VM

User

Li

57

Linux Driver

OTHER MICROKERNEL APPROACHES

• Mach

Mach

• Chorus
• EROS
• QNX Neutrino
• VxWorks
• Exokernel
• GNU Hurd (Mach/L4)

Darwin (Apple Mac OS X)

• Darwin (Apple Mac OS X)
• Nexus (Microsoft)

58

LINUX IS STILL OBSOLETE

• Big bloated monolithic kernel

g

• Not as bloated as Windows
• Trying hard to correct this deficiency

y g a d to co ect t s de c e cy

• It is the wrong way to go

59

NEXT COMPUTER ERA

• Key areas of next era computing are merging

y p g g g

– Embedded – Sensor – Ubiquitous

• 26 Billion CPUs sold in 2001
• Most of them were Intel 8051s and similar chips

60

“NORMAL” EMBEDDED SYSTEMS

• My 2-year-old still camera (Nikon D100) has:

y y ( )

– 3 CPUs – LAN – 128 MB RAM – 1 GB hard disk with a hierarchical file system N WiFi (802 11) b t th d l d – No WiFi (802.11), but other models do

• These devices need full blown operating systems
• These devices need full-blown operating systems

including file systems

61

SOFTWARE BLOAT IS FOLLOWING US

• My camcorder can make videos in sepia

y p

• Who would use this feature twice?
• Sepia mode is only software. What’s the harm?

Sep a

• de s o y so t a e

at s t e a

– Feature bloat makes the device hard to use – More code = more bugs = more product recalls

62

RELIABILITY IN REAL-WORLD SYSTEMS

• Embedded SW has real-world consequences

Thi k b t b d d

• Think about bugs and upgrades

63

WOULD YOU RUN WINDOWS ON YOUR GRANDMOTHER’S PACEMAKER?

• Straw poll

p

64

GRANDMA

65

GRANDMA

66

GRANDMA

67

GRANDMA

68

GRANDMA

69

GRANDMA

70

GRANDMA

71

BLUE SCREEN OF DEATH

• The “Blue screen of death” gets a new meaning

g g

Grandma terminated Press any key to reboot grandma

72

HACKING GRANDMA

• Next generation pacemakers and other medical

g p appliances will have Internet connectivity

• Doctor will have access to grandma via wireless
• Will people be infected with computer viruses?
• What about worms, spyware, spam?

, py , p

• DoS attacks may be fatal
• Blackmail (Pay or I will hack into your grandma)

Blackmail (Pay or I will hack into your grandma)

73

JUNE 18, 2005

“Th G id t C ti id t d th t it

JU 8, 005

• “The Guidant Corporation said yesterday that it was

recalling about 29,000 implanted heart devices because of flaws that might cause them to short- because of flaws that might cause them to short circuit when they are supposed to deliver a potentially life-saving shock.” p y g

• Straw poll

p

74

RELIABILITY REQUIREMENT

• Suppose P(failure in a year) is 1/1,000,000

pp ( y ) , ,

• Suppose 10 million pacemakers worldwide
• Then 10 people will die per year due to software

e 0 peop e d e pe yea due to so t a e

• This sets the bar for SW reliability pretty high

75

SENSOR RELIABILITY/SECURITY

• Forest fire detection
• Vehicle accident alerting
• DoS attacks trick network into relaying bogus
• S attac s t c

et o to e ay g bogus messages, which results in battery exhaustion

• One-time sensors (ask Google)

( g )

76

UBIQUITOUS COMPUTING

Mark Weiser Mark Weiser

• Computers everywhere

– Smart rooms, buildings, cars that drive themselves Smart rooms, buildings, cars that drive themselves – In clothes, toys, blackboards, cameras – Refrigerators, TVs, stereos (HomeNets)

• Everything talks to everything by wireless

77

– Bluetooth, WiFi, WiMax, GSM, UMTS

RFID TAGS

• Radio Frequency IDentification tags

q y g

• Very cheap (10 cents)
• Initially for antitheft

Initially for antitheft

• Passive (no battery)
• Powered by remote reader

Powered by remote reader

• Can contain 1024 unique bits

78

RFID APPLICATIONS

• Killer App: use in stores

pp

– Antitheft measure – Bar code replacement/automated checkout – Transportation payment (e.g., EZ-pass for tolls) – Animal tracking (pets, livestock, dolphins at sea)

• Will interact with ubiquitous computers, sensors
• Smart washing machine

G d ’t k thi b t h k h t t ll h t t – Guys don’t know this, but you can check; you have to tell w.m. what temp

Fatal error: Red sock detected with white shirts

79

Press any key to reboot washing machine

RFID IS A MASSIVE PARADIGM SHIFT

• By adding an RFID to any object, it can

y g y j , communicate with computers, even be on the Web

• This merges the real-world with cyberspace
• Putting real-world (physical) objects online is as

revolutionary as the idea of a personal computer

80

RFID THREATS

RFID reader

find( product=“bra”, mfg=“Victoria’s Secret”, size >= “38DD” size >= 38DD , event=“beep” );

81

• RFID tags will be in: clothes, passports, money

RFID GUARDIAN

• Monitors existing and new tags within range

g g g

• Checks for scans
• Manages your privacy according to your profile

a ages you p acy acco d g to you p o e

• It can alert you to new tags suddenly present
• It can reply to or block scans of your tags

It can reply to or block scans of your tags

• www.rfidguardian.org

82

Melanie Rieback

SUMMARY

• We are moving from PC era to embedded era

g

• Key issues are reliability and security
• Less emphasis on performance and tricks

ess e p as s o pe o a ce a d t c s

• To achieve reliability, need smaller, simpler code
• The future lies at the low-end (sensors RFID etc)

The future lies at the low end (sensors, RFID, etc)

83

THE END

To get MINIX, get the CD-ROM from me now g , g

• r go to: www.minix3.org

84