This paper presents Unico, a storage platform that presents users with a single view of all their data, independently of the device they are using. Each of the user's devices has full and up-to-date information about the entire data structure and metadata, and is able to retrieve any file transparently as needed. File content is efficiently distributed among the user's own devices according to where it is used, with no need for centralized storage and no data stored in devices that are not owned by the user. Peers communicate with each other directly to maintain a consistent state. Users also have no need to know where the data is stored, or to remember in which device the latest update to a file has been performed. Unico is able to work with devices with different storage characteristics, and provides mechanisms for applications to adapt to data availability.

Operating systems represent large pieces of complex software that are carefully tested and broadly deployed. Despite this, developers frequently have little more than their source code to understand how they behave. This static representation of a system results in limited insight into execution dynamics, such as what code is important, how data flows through a system, or how threads interact with one another. We describe Tralfamadore, a system that preserves complete traces of machine execution as an artifact that can be queried and analyzed with a library of simple, reusable operators, making it easy to develop and run new dynamic analyses. We demonstrate the benefits of this approach with several example applications, including a novel unified source and execution browser.

Program source is an intermediate representation of software; it lies between a developer's intention and the hardware's execution. Despite advances in languages and development tools, source itself and the applications we use to view it remain an essentially static representation of software, from which developers can spend considerable energy postulating actual behavior.Emerging techniques in execution logging promise to provide large shared repositories containing high-fidelity recordings of deployed, production software. Tralfamadore(1) is a system that combines source and execution trace analysis to capitalize on these recordings, and to expose information from the "experience" of real execution within the software development environment, allowing developers to inform their understanding of source based on how it behaves during real execution.

In densely packed 802.11 environments, access-point domains significantly overlap and wireless hosts interfere with each other in complex ways. Knowing which devices interfere is an essential first step to minimizing this interference, improving efficiency and delivering quality connectivity throughout the network. This knowledge, however, is extremely difficult to obtain without either taking a running network offline for measurements or having client hosts monitor and report airspace anomalies, something typically outside the control of network administrators. In this paper we describe a technique we have developed to reveal wireless-network interference relationships by examining the network traffic at wired routers that connects wireless domains to the Internet. This approach, which we call VOID (Vvirless Online Interference Detection), searches for correlated throughput changes that occur when traffic from one node causes a throughput drop at other nodes in its radio range. In one analysis round we identify each node's interference neighbours using a single set of performance data collected from a wired-network router. We have evaluated VOID in Emulab testbeds consisting of tens of nodes as well as a six-node testbed in a live wireless network. The initial results have shown the promise of VOID to accurately correlate interfering devices together and effectively discriminate interfering devices from non-interfering ones.

Parallax is a distributed storage system that uses virtualization to provide storage facilities specifically for virtual environments. The system employs a novel architecture in which storage features that have traditionally been implemented directly on high-end storage arrays and switches are relocated into a federation of storage VMs, sharing the same physical hosts as the VMs that they serve. This architecture retains the single administrative domain and OS agnosticism achieved by array- and switch-based approaches, while lowering the bar on hardware requirements and facilitating the development of new features. Parallax offers a comprehensive set of storage features including frequent, low-overhead snapshot of virtual disks, the 'gold-mastering' of template images, and the ability to use local disks as a persistent cache to dampen burst demand on networked storage.

Parallax is a distributed storage system that uses virtualization to provide storage facilities specifically for virtual environments. The system employs a novel architecture in which storage features that have traditionally been implemented directly on high-end storage arrays and switches are relocated into a federation of storage VMs, sharing the same physical hosts as the VMs that they serve. This architecture retains the single administrative domain and OS agnosticism achieved by array- and switch-based approaches, while lowering the bar on hardware requirements and facilitating the development of new features. Parallax offers a comprehensive set of storage features including frequent, low-overhead snapshot of virtual disks, the 'gold-mastering' of template images, and the ability to use local disks as a persistent cache to dampen burst demand on networked storage.

Allowing applications to survive hardware failure is an expensive undertaking, which generally involves reengineering software to include complicated recovery logic as well as deploying special-purpose hardware; this represents a severe barrier to improving the dependability of large or legacy applications. We describe the construction of a general and transparent high availability service that allows existing, unmodified software to be protected from the failure of the physical machine on which it runs. Remus provides an extremely high degree of fault tolerance, to the point that a running system can transparently continue execution on an alternate physical host in the face of failure with only seconds of downtime, while completely preserving host state such as active network connections. Our approach encapsulates protected software in a virtual machine, asynchronously propagates changed state to a backup host at frequencies as high as forty times a second, and uses speculative execution to concurrently run the active VM slightly ahead of the replicated system state.

It is well known that 802.11 suffers from both inefficiency and unfairness in the face of competition and interference. This paper provides a detailed analysis of the impact of topology and traffic type on network performance when two flows compete with each other for airspace. We consider both TCP and UDP flows and a comprehensive set of node topologies. We vary these topologies to consider all combinations of the following four node-to-node interactions: (1) nodes unable to read or sense each other, (2) nodes able to sense each other but not able to read each other's packets and nodes able to communicate with (3) weak and with (4) strong signal. We evaluate all possible cases through simulation and show that the cases can be reduced to 9 UDP and 10 TCP 802.11g models with similar efficiency/fairness characteristics. We also validate our simulation results with extensive experiments conducted in a laboratory testbed. These more detailed models improve on previous work such as hidden-/exposed-terminal categorization and are thus better suited as a basis for adaptive techniques to improve performance in 802.11 multi-hop WLAN or Mesh Networks.

As mobile computing becomes ubiquitous and airspace more congested, it is increasingly important to fairly distribute bandwidth between competing wireless devices in order to ensure predictable and satisfactory performance for end users. In prior work, we have proposed a cross-layer approach called Shaper [3, 4] that uses TCP and a central router rather than the 802.11 protocol to decide the outcome of bandwidth allocation. The key idea is to avoid airspace congestion from happening in the first place. Shaper is effective and also easy to deploy. However, its implementation faces many fundamentally difficult challenges. This paper details these challenges and possible solutions.

It is well known that competition between 802.11 wireless flows can lead to severe unfairness problems. In this paper we show that certain flows can be denied from their fair share of network access for long periods of time due toinequitable channel conditions. We argue that this unfairness problem is likely to get worse as the use of wireless in terms of number of devices and bandwidth continues to grow. To address unfairness, we rely on a common network management technique called traffic shaping. Instead of designing new MAC protocols or introducing complex wireless fair queuing or adaptation algorithms, we argue that 802.11, TCP and a well-understood wired fair queuing scheme can provide fairness even in unfavourable network topologies as long as we can prevent MAC-layer congestion from happening. This shaping approach has the advantage of being easily deployed in existing network management systems, requiring no change to the end-user devices or access points. We have proven the effectiveness of this cross-layer approach using a wireless testbed, and are currently in the process of incorporating this scheme into a large-scale campus wireless network.

All systems are a product of their histories. Events over time shape the state of OS and application software both for good and bad; while users make forward progress on productive work, bugs and malicious software may destabilize and corrupt their efforts. The notion of considering system state as mutable through time has been the subject of many recent projects. As examples, efforts have considered replaying slight permutations of recent events to recover fro m timing-related crashes[5], revisiting historical system states to identify the introduction of configuration errors[6], an d rewinding execution to assist in debugging[2]. In all of these examples, revisiting—and in some cases even modifying—history allows the exploration of a system’s state space of which the “current” incarnation is but one instance. We believe that there is broad benefit in providing general techniques to allow the more thorough exploration and analysis of the execution states of a given sys tem. We are developing a tool to assist this exploration, which we have dubbed the Difference Engine. The difference engine is primarily concerned with understanding thedivergence between alternate states of a given system. For example, we may choose to create an alternate instance of a desktop OS in which a malicious network packet had never arrived, but for which the remainder of history had proceeded identically. The engine allows the controlled creation, and thorough analysis, of such divergence. It exploits the ability of virtual machines (VMs) to be check-pointed, rolled back and replayed to create alternate but plausible new outcomes. This set of outcomes, each represented by an independent VM instance, can be viewed as parallel universes where history occurred in subtly different ways. In the case of the malicious packet just mentioned, the engine allows us to consider a large number of alternate universes that might result as a consequence of the packet’s delivery being prevented, and to build insight into the specific mutations that its arrival induced. The operation of the difference engine involves two phases, generational and analytical. In the generational stage, the difference engine allows the replay of logged external events to a historical version of a virtual machine. Replay is intentionally non-deterministic, and may be parametrized as to modify the stream of events that are delivered. In the second, analysis stage, the engine provides tools to assist with semantic comparisons between the resulting alternate states. These two stages are illustrat ed in Figure 1. We are currently developing the difference engine as a tool based on the Xen virtual machine monitor. To date, we have had to grapple with two fundamental challenges: nondeterminism of replay, and system semantics. These issues are closely related and introduce interesting obstacl e in both the replay and analysis stages. Non-determinism is clearly necessary in order for replay to explore alternat e states, but it demands that the replay support be tolerant of externally visible permutations of a system that impact the event log. Similarly, presenting a meaningful understanding of the divergence between a set of alternate instances requires sufficient semantic comprehension of a systems state as to recognize and summarize its differences. We now discuss some specific challenges that nondeterminism and semantics present in the replay and analysis stages and then provides an overview of some example applications. Broadly speaking, we believe that the differ ence engine represents a broadly useful tool for assisting in the exploration of “What if...” questions for large and complex software systems.

This paper presents the initial results of our experiment using an aspect-oriented approach to simplify operating system code. The intuition behind this work is that complexity comes from crosscutting concerns. In this experiment, we re-implemented prefetching for page fault handling and file system read requests using a hypothetical language, AspectC – a variant of AspectJ for C – and hand-compiled the code to C. We believe that the aspect-oriented code is easier to understand, and in particular that it is easier to understand the interaction between the virtual memory and file system prefetching mechanisms.

In typical file systems, valuable data is vulnerable to being accidentally or maliciously deleted or overwritten. Versioning file systems protect data from accidents by transparently retaining old versions, but do less well in protecting data from malicious attack. These systems remain vulnerable to attackers who gain unauthorized access to prune old file versions, who bypass the file system to directly manipulate storage, or who exploit bugs in any part of the operating system. This paper presents VDisk, a secure, block-level versioning system that adds file-grain versioning to a standard, unmodified file system. VDisk consists of a set of untrusted user-mode tools and a trusted, secure kernel that is implemented within an isolated Xen virtual machine domain. The secure kernel is designed to be simple and thus trustworthy. This kernel logs file-system updates to a secure log, exports a read-only view of the log to the rest of the system and securely removes unwanted versions from the log. Secure cleaning is implemented in a two-level manner. An untrusted, user-mode cleaner selects log entries for reclamation and submits cleaning requests to the trusted VDisk kernel along with a proof that the request satisifies the device's version-retention policy. The secure kernel verifies the proof and updates the log.

Recent research shows that the traffic in public wireless networks is mostly transient and bursty. There is good reason to believe that ad-hoc traffic will follow the same pattern as its popularity grows. Unfortunately transient traffic generates route discoveries much more frequently than the long-term, constant-bit-rate traffic, causing network congestion problems for existing routing protocols. This paper describes the design of a new routing algorithm, called ECBR, that uses hybrid backbone routing in a manner that is well suited to workloads that include transient traffic. We explain three key features of our algorithm and demonstrate their roles in greatly improving the performance compared to existing reactive and backbone routing techniques.

As the disks typically found in personal computers grow larger, protecting data by replicating it on a collection of "peer" systems rather than on dedicated high performance storage systems can provide comparable reliability and availability guarantees but at reduced cost and complexity. In order to be adopted, peer-to-peer storage systems must be able to replicate data on hosts that are trusted, secure, and available. However, recent research has shown that the traditional model, where nodes are assumed to have identical levels of trust, to behave independently, and to have similar failure modes, is over simplified. Thus, there is a need for a mechanism that automatically and efficiently selects replica nodes from a large number of available hosts with varying capabilities and trust levels. In this paper we present an algorithm to handle replica node selection either for new replica groups or to replace failed replicas in a peer-to-peer storage system. We show through simulation that our algorithm maintains the node inter-connection topology minimizing the cost of recovery from a failed replica, measured by the number of nodes affected by the failure and the number of inter-node messages

The current ad-hoc routing algorithms perform poorly when dealing with spontaneous, transient communication. This traffic pattern generates route discoveries much more frequently than long-term communication and thus causes the reactive component of flat routing algorithms to flood the network. Similarly, the increased number of route discoveries also makes the backbone a bottleneck for the hierarchical algorithms.We designed a backbone routing protocol, called DCDS, that handles both short-term and long-term traffic well. This paper compares it extensively with three other algorithms, two variants of DSR and a model hierarchical algorithm. Our results show that DCDS performs substantially better than these other algorithms for the transient workloads we studied.

Peer-to-peer storage systems organize a collection of symmetric nodes to store data without the use of centralized data structures or operations. As a result, they can scale to many thousands of nodes and can be formed directly by clients. This paper describes the design and implementation Mammoth, which implements a traditional UNIX-like hierarchical file system in a peer-to-peer fashion. Each Mammoth node stores a potentially arbitrary collection of directories and files that may be replicated on multiple nodes. The only thing that links these nodes together is that each metadata object encodes the network addresses of the nodes that store it. Data is replicated by a background process whose operation is simplified by the fact that files are stored as journals of immutable versions. An optimistic replication technique is used to allow nodes to read and write whatever version of data they can access, while also ensuring consistency when nodes are connected. In the event of temporary failure, eventual consistency is achieved by ensuring that every replica of a directory or file metadata object receives all updates to the object, irrespective of delivery order. While an update is being propagated every node that receives it cooperates to ensure that the update is delivered, even if the original sender fails. Our prototype is implemented as a user-level NFS server. Its performance is comparable to a standard NFS server and it will be publicly available soon.

This paper describes key issues for building an energy efficient peer-to-peer (P2P) storage system. Current P2P systems waste large amounts of energy because of the false assumption that participating nodes’ resources are free. Environmentally and economically, this is not true. Instead this paper argues that idle nodes in a P2P system should sleep to save energy. We derive an upper bound on the time an idle node can sleep without affecting the durability of the data stored in the system. This upper bound is parameterized by the replication factor and expected failure rates. We also outline a protocol for failure detection in an environment where only a small fraction of the nodes are alive at any time.