However, the crux of the problem is the Android manufacturer. You can't solve a human and incentive problem with a technical solution. Project Treble makes manufacturer easier to support their device, but they still don't motivate to do it. Google needs a tighter control on what device manufacturer should release.
Android One is a good approach, only qualify certain devices to be include for meeting certain criteria. They could actually create a watermark on unsecured device for not updating Android version, just like chromium do it to website not using https. I think this is more effective than creating a new OS just to let the manufacturer being lazy.
Their "Explore our latest phones" section shows 2 years old devices :/
There are no incentives for the manufacturers to make these devices, as customers don't care and don't want to pay premium for them, while the manufacturers can get money from adding crapware to their phones.
Could you elaborate? I'm simply curious why people would feel that way about Android. By the ecosystem, do you mean the fact that apps are primarily Java? That they're poorly made? What makes the drivers unsalvageable? Proprietary blobs interacting with the Linux kernel? Something else?
It seems like a new kernel would have minimal drivers, but maybe it would offer a better way of having proprietary drivers? Linux doesn't have a stable device driver ABI so maybe that is making it hard for Google to update Android without the phone manufacturer being involved in the updating?
I'm just curious what people see as the problems with Android that would require a new OS to fix. For example, if the problem is poorly made apps, that problem will follow you to a new OS if you let them publish for the new OS - and if you truly don't want them, you could remove them from the Play Store.
Compare this to Windows. Drivers were once the bane of Windows and a huge problem for stability. Microsoft invested heavily in this and it seems to have worked. The Windows driver interface is I believe stable and has been for many years at this point and drivers themselves are more insulated from the kernel. Not completely but it's better in many aays.
Android really has its hands tied here by what Linux does. You may agree or disagree with that but the above is a view held by influential people within Fuchsia.
The ecosystem is really around the process by which updates are released. This is a tedious process of maintaining many Android trees and updating them with new Android releases. These need to be patched onto the existing trees or the changes made to the existing trees need to be ported onto the new Android tree. This is a nontrivial task either way. It's why Android phones get limited updates and those updates can lag behind the official release by months or even years.
This isn't a situation Google likes so some want to make the manufacturer responsible for less, most notably the drivers.
Remember that Samsung is motivated to sell handsets, not update existing handsets.
I've never heard anyone in real life say "I bought a Samsung phone last time and it was good but it didn't get any updates after 3 years so I'm never buying one again."
Few years ago it was not like that, I don't remember there were official promises and you typically got a year or two of updates. Until recently, long support was always mentioned as a big plus for iPhones.
Now every review I look mentions years of support as a big thing. I also see quite often on forums "I still have year of updates for my device, I'll skip this year's model" so people do think about it.
It's possible only techies look at these things (and read reviews and online discussions), but even so it's still better than it was.
[1] https://www.gsmarena.com/samsung_pledges_4_os_updates_5_year...
> Android really has its hands tied here by what Linux does. You may agree or disagree with that but the above is a view held by influential people within Fuchsia.
I don't really think driver robustness is an issue here. The number of phones I've seen, used or heard about with driver problems is zero.
Add in the fact that phones are almost never rebooted (compared to desktops/laptops and other computers), and the driver situation looks incredibly stable.
I was disappointed to find that on many models of phone, there was not a single active user who had not experienced at least one random reboot caused by a kernel panic a year after purchase.
The fact it boots straight back up to the lockscreen means many users will never notice that it's happened though.
The actual stats here will help; across a few million devices, random reboots unrelated to software or drivers will be expected.
You're saying that, one some models, the device never crashed. On others, there was at least one crash. That's at least a 0.00001% crash rate. That's unbelievably good. At that rate it's probably a hardware error, not a driver error.
If you used a different threshold we'd have a better idea - how many models have a crash rate of 10%? 5%?
> The fact it boots straight back up to the lockscreen means many users will never notice that it's happened though.
That provides further evidence that the money being poured into a new kernel to alleviate a problem that happens so rarely it can't be distinguished from statistical noise, and when it does happen, is almost never noticed by the user, is money being wasted.
The return here is not proportionate to the problem being experienced, and the solution is definitely not proportionate to the money being spent.
For at least one user, yes.
But there are many users who maybe only turn the phone on 5 minutes a day to check messages - so it isn't really odd for a few users to never see a crash.
I don't really know anyone who uses their smartphone for less than 5m per day, but that's irrelevant anyway.
The question is still: is the money being put into preventing this problem at all proportionate to the size of the problem?
If there's a problem that no one notices[1], is a solution really worth spending millions of dollars per year over five years?
[1] So few users complained about this it's not even a statistical rounding error.
edit: sure, bit flips will happen at scale, but they’re not as common as bad threaded programming.
But also yes some drivers don't run in kernel space! https://docs.microsoft.com/en-us/windows-hardware/drivers/wd...
This is often clear in graphics cards, the main problem is old cards don't get support for newer versions of DirectX, but otherwise continue to work.
Linux explictly doesn't support this -- that means when some hardware manufacturer makes a closed source driver, it's very hard to update the kernel. Unfortunately it seems many bits of important phone hardware (like stuff Qualcomm makes) only have closed source drivers.
Don’t get me wrong. Windows did a lot of work on driver stability. But I think cletus is too narrowly focused, and misunderstanding the context around Android and Fuschia.
Fuschia has been described as a replacement for both ChromeOS and Android, with a goal of solving a range of problems (not just driver compatibility) and unifying the target development platform (beyond the somewhat-limited Android-for-ChromeOS options that exist today).
It does not seem to me that it’s primarily about fixing Android driver compat, which could probably be done in simpler ways (and, as others have noted, Treble sort of kind of exists to mitigate).
(I also was amused that Cletus claimed that Windows drivers run in userspace—generally not true—while claiming that there are no real-world microkernel OSes.)
Even though this is true, they still offer the longest updates.
Most drivers in the embedded world come from the BSPs (board support packages) of the SoC vendor. And holy hell wherever you look at leaked source code (cough Mediatek) it's madness. Nothing is upstreamed because the quality is so shoddy that you'd get Linus Torvalds into a proper ragepost if you dared to post it for submission, and as a result Android and most of embedded Linux is stuck at outright fossilized kernels where it's extremely hard to backport anything from newer kernels - which is also the reason why so few Android phones are supported for longer than two or three years after initial release. The SoC vendors simply won't provide BSP updates because of the effort involved.
And forget about copyright requiring vendors to open-source everything in Linux kernel space... most simply do not care and there is absolutely no will of enforcing it on a large scale - to the contrary, people trying to do so got booted off [1].
The proprietary blobs for components like WiFi/BT/GPU are only the icing on the cake. Barely any effort made to ensure it actually holds up in real world usage, only enough to pass qualification testing. IIRC Apple had at least one RF vendor make a completely new firmware for their chips because the official one was riddled with bugs.
[1]: https://sfconservancy.org/blog/2016/jul/19/patrick-mchardy-g...
Software Freedom Conservancy's approach on the other hand is to require compliance. Through their lawsuit against Vizio they are also aiming to make it possible for any user of GPLed but non-compliant software to sue for compliance. Hopefully this will change the amount of spontaneous GPL compliance for Linux in the industry.
https://sfconservancy.org/copyleft-compliance/vizio.html https://sfconservancy.org/copyleft-compliance/principles.htm...
Got a link for that Apple firmware thing? Sounds interesting. We really need open firmware for hardware devices. There is some for very old hardware though.
So what? If it makes them comply then I'm fine with it. No one else has taken on the fight except for a handful of large companies (Vizio and a settop-box-manufacturer whose name I forgot are the only cases I remember). Everyone else, particularly in the phone and embedded sector, outright shits on the GPL for decades now.
Particularly Google would be in an excellent position - they possess the Android trademark, they could require manufacturers and SoC vendors to properly open-source their stuff as part of the Android license, even for AOSP-powered devices.
Governments could also step in, similarly to enforcement of patents, but no government in the world has done anything to establish legal protection for open source that does not rely on open-source authors filing lawsuits on their own! Just imagine customs going on a trade fair and confiscating every device where the GPL and other OSS licenses are not obliged. After two rounds, no one would dare mess around any longer.
> Got a link for that Apple firmware thing?
Unfortunately not, that was many years ago and I might be remembering it wrong :(
Conservancy are doing the Vizio lawsuit, do a lot of behind-the-scenes work, supported the VMware lawsuit, did a lawsuit against Best Buy/Samsung/Westinghouse/JVC and did one of the earliest compliance actions against Linksys resulting in the OpenWRT project:
https://sfconservancy.org/copyleft-compliance/past-lawsuits.... https://sfconservancy.org/copyleft-compliance/enforcement-st...
Harald Welte of gpl-violations.org did a lot of GPL compliance actions in Germany, admittedly none recently.
It would be great if Google could do GPL compliance actions against Android vendors, but they seem to be moving away from GPL projects instead of embracing them, so that seems very unlikely.
There was already a case where a Linux copyright holder got the USA customs department to withhold import of some GPL violating tablets. I think that eventually resulted in compliance, the details are somewhere on LWN, I forget the URL though.
I think if the Vizio lawsuit is concluded in favor of Conservancy, that is probably the best chance for widespread GPL compliance.
An infringement lawsuit can't make anyone comply because a court will only ever order an infringer to pay monetary damages. An infringer might settle a lawsuit by agreeing to comply with GPL terms instead of paying damages, but that's not something a court would order.
Theoretically, if the GPL were a contract (an exchange of promises) and not a license (a grant subject to conditions), then a court could order a party in breach to comply with its terms. A court would only do that, however, if monetary damages were insufficient to compensate the non-breaching party.
https://en.wikipedia.org/wiki/Legal_remedy
The Conservancy lawsuit against Vizio contends that the GPL is also a contract and that downstream users are third-party beneficiaries of that contract, so they should be able to sue for compliance with the contract. Its a really interesting approach and I hope they win. I encourage you to read the court documents, they make for interesting reading.
https://sfconservancy.org/copyleft-compliance/vizio.html
Also, monetary damages are pretty much always insufficient in GPL cases, since money doesn't get you source code. I guess if the money was enough to pay for reverse engineering and reimplementation of the fixes/features present in the non-compliant codebase, then they could be enough.
Exactly.
True, but the community does clean up and upstream stuff over time. It's just very slow work, made even more confusing by how much SoC hardware components are duplicated with small variations in different platforms. De-duplicating and merging drivers for some random IP block can involve pretty serious effort
For example, this allows Windows to restart a crashed GPU driver.
Windows (and I think macOS as well) also has a stable kernel ABI/API for drivers, a fact that's probably appreciated by the hardware vendors.
The bad name attached to microkernels I think stems from the debate between Tanenbaum and Linus in the 90s, where Tanenbaum's microkernel was sorely lacking in performance, mostly owning to the incredibly resource intensive context switches on the CPUs of the time.
However, on newer CPUs, this cost is much less significant as CPUs are better optimized for this, making it worthwhile to revisit this issue.
QNX is an example of a real-world microkernel OS that Blackberry purchased for use in mobile phones. One could argue it had superior peformance to Linux, not because of throughput, but due to its real-time guarantees.
Real time guarantee: When a hook for an event is called it transfers all computation to that call within a time limit predictably and deterministically
Please correct me if I am wrong.
So it depends on the cost of context switching, which is typically very high, and the frequency of context switches. Real time OSes are really important for applications where you have lots of lightweight tasks that need to be handled very promptly. If you have long running tasks (long running in CPU world, which can be fractions of a second) constantly getting interrupted and context switched can brutalise performance.
When I write something here, I've already done it, and often on multiple occasions in multiple scenarios at multiple companies, therefore I don't need a lesson.
Think about it this way: if the TCP stack is in user space then how does another process talk to it to send a packet? Is it directly? Well that has issues. If it's via the kernel then you're already translating to the kernel and then out to user space.
If this is an issue, will the temptation be to make some performance-related bypasses?
Linus of course favours monolithic kernels [1] so consider that a disclaimer.
[1]: https://en.wikipedia.org/wiki/Tanenbaum%E2%80%93Torvalds_deb...
There are many ways to make microkernels nearly as fast as monokernels, while being much safer and modular with all advantages that entails. See QNX or Sel4 for modern implementations.
Meanwhile, Linux itself has been getting more and more microkernel-y with things like eBPF which because of the monolithic design make the whole kernel much more vulnerable than warranted.
In a microkernel system, if a process holds a handle to a TCP stack then it can make calls like create_socket() and then use a socket. For better performance such calls can be executed without visiting the kernel, via call gates. If a process doesn't have a TCP handle, then it cannot access the network which is the best choice for most applications. And of course a privileged enough process can tap into other processes' inter-process calls and see what they are sending and receiving, or even intercept those calls and modify requests and responses, for example, to emulate a network card or to act as a firewall.
In legacy systems like Linux or Windows every process has excess privileges - for example, access to network, to filesystem, to information about other processes, to shared memory, to hardware serial numbers. Linux has several hundreds system calls and they are available to any process. In a microkernel system I am describing the process would have the minimal privileges necessary for its job. For example, a TCP daemon would only have a handle to a router daemon (that redirects packets to a network interface) and no access to filesystem, information about kernel, and so on. Even if this daemon had a vulnerability it wouldn't be of much use for an attacker.
UNIX FOSS clones abhor microkernels, and then run containers everywhere with a monolithic kernel stuck accessing the real hardware via a type 1 hypervisor.
It isn´t a theory for about several years already.
Citation needed
1000 engineers will give you a burn rate of $500m/year. I guarantee you the head count associated with Fuchsia is higher than this, probably much higher.
Again, I have no official information on the current resource allocation but you can figure these things out by, for example, looking at the leadership structure. At a company like Google, certain positions will indicate head counts. An engineering director probably averages ~100 engineers rolled up through 2-3 layers of managers. A VP means 200-500.
Familiarity with how Google staffs projects, how much Fuchsia was staffed while I was still there and the costs innvolved gets you easily into the billions of dollars over 5+ years.
I find your “much higher than 1000” estimate a bit surprising.
Since my Nest Hub received the update to Fuchsia it's been generally more laggy and unresponsive. Occasionally it needs a power cycle. I wish there was a way to downgrade to whatever it had pre-Fuchsia :(
This is an issue only because today CPUs are optimized for legacy monolith kernels which rarely switch and not for microkernels.
Microkernels are very important because they allow to reduce privileged code size and move most things out of kernel. Legacy kernels like Linux or Windows are just an endless source of vulnerabilities, use legacy programming languages and have zero security. Linux doesn't even use static code analysis.
For example, in Linux a network card driver runs at kernel with maximum privileges. In a microkernel it would be a separate process without access to anything in the system (even to a file system) so exploiting it wouldn't give much to attacker.
Modern CPUs (well Intel CPUs at least) have lots of features to try and mitigate these costs but they aren't widely used. For instance memory protection keys.
Single address space OS's in a broader sense have been made unviable by Spectre vulnerabilities; these days you need an address space flush at every transition from a "more private" to a "less private" information domain, which is basically every context switch when applications can't trust one another and have mutually private information that they're trying not to disclose to other apps.
This is valid only for current CPUs and probably can be fixed. For example, current CPUs do not do speculative accesses for memory-mapped IO, and it means that similar method could be used to prevent access to kernel or other processes memory. There could be registers that contain lower and upper bounds of accessible memory, and they could be checked before accessing it.
Most of this thread has been focused on how Fuchsia will supplant Linux on Nest, Android and ChromeOS devices. However I immediately think about it will be used for Automobiles where RTOSes and prioritizing/scheduling operations deterministically is critical.
I'm sure Fuchsia could be leveraged for autonomous robots too, but since they gave up Boston Dynamics, not so sure anymore. Perhaps they extracted what they needed from BD before selling them off. Again I wonder what OS Tesla uses for their robots, both Grohmann and Optimus.
I have for many years thought that there was or so will be a battle in the RTOS space where Blackberry (QNX) would find themselves in a very similar situation they were in back when the iPhone and Android came onto the scene. (I know they were very different departments. Don't even know if they owned QNX at the time. Don't even know if you could consider them the same company anymore.)
There is obviously a paradigm shift taking place in the automotive industry where the incumbent/ICE manufacturers have to make a choice of continuing down the path to oblivion or pivot to compete with the likes of Tesla, NIO, Polestar, etc... The RTOS will play an important part in the transition, and Google knows this.
Google wants to be part of the stack and I believe they believe Fuchsia is the answer. Actually, I'd go so far as to say they want to own (or be the linchpin) the stack and again Fuchsia combined with Android Automobile (not Android Auto) is their attempt to move in while the incumbents are preoccupied with the other difficulties involved in this transition.
If I was QNX/BB, I would be very concerned. Imagine the world of Automobiles resembling that of the Smartphone... You basically have two choices; Apple or a myriad of others all running their own flavor of Android... think Tesla or all the others running Android Automotive (Fuchsia).
NVidia uses a mix of QNX (for production) and GNU/Linux (for development) for their vehicles software.
https://developer.nvidia.com/drive/driveos
Note the safety critical remark for QNX, when human lifes are at stake, one gets to use OSes where safety matters as first priority.
Who will show in court from Linux RTOS contributors?
https://blackberry.qnx.com/en/industries/connected-autonomou...
The amount of context-switching can be reduced these days by devoting cores to tasks/processes instead of tasks on a single core.
Its not a free ride however as you pay with cache efficiency. For some systems, however I think it would pay off, the efficiency would increase with the number of cores until you get to 1 core per userspace task. At that point, its just IPC cost.
I don't know if this is still the case but the mission was absolutely to replace Android. Many at Google believe Android to be unsalvageable on two fronts: drivers and the general ecosystem.
It has been pitched internally at various products and (AFAIK) only found traction thus far on Nest hubs. It was heavily pushed for Chromecast but I guess nothing came of that.
I'm not an OS expert by any means but I am unconvinced about the viability of a microkernel architecture beyond theory. Security is an often-cited issue with context switching between user and kernel space.