Organizations across industries increasingly rely on sharing data to drive collaboration, innovation, and business performance. However, securely and efficiently sharing live data across diverse platforms and adhering to varying governance requirements remains a significant challenge. Traditional approaches, such as FTP and proprietary in-data-warehouse solutions, often fail to meet the demands of interoperability, cost, scalability, and low overhead. This paper introduces Delta Sharing, an open protocol we developed in collaboration with industry partners, to overcome these limitations. Delta Sharing leverages open formats like Delta Lake and Apache Parquet alongside simple HTTP APIs to enable seamless, secure, and live data sharing across heterogeneous systems. Since its launch in 2021, Delta Sharing has been adopted by over 4000 enterprises and supported by hundreds of major software and data vendors. We discuss the key challenges in developing Delta Sharing and how our design addresses them. We also present, to our knowledge, the first large-scale study of production data sharing workloads offering insights into this emerging data platform capability.

In an IaaS cloud, the dynamic VM scheduler observes and mitigates resource hotspots to maintain performance in an oversubscribed environment. Most systems are focused on schedulers that fit very large infrastructures, which lead to workload-dependent optimisations, thereby limiting their portability. However, while the number of massive public clouds is very small, there is a countless number of private clouds running very different workloads. In that context, we consider that it is essential to look for schedulers that overcome the workload diversity observed in private clouds to benefit as many use cases as possible.

Enterprises today increasingly rely on IT for their day-to-day processes. Newer application types (such as web, mobile, social, and big data applications) and the advent of public cloud computing have further increased the role of IT in enterprises. The result is that a typical enterprise data center today can have thousands of workloads spanning tens of thousands of nodes and hundreds of thousands of virtual machines. This makes day-to-day IT management tasks challenging for enterprise IT administrators, since they need to manage multiple types of hardware and software entities that can interact with each other in complex ways, and can span private data centers and public clouds. The problem is made worse by the management interfaces of current data center solutions, which work poorly at such a large scale, as they are navigational in nature and require administrators to learn a variety of tools and their myriad workflows. This can result in administrators spending too much time learning the tools and understanding when to use which tool, otherwise, they run the risk of making costly mistakes. In this paper we present the design and implementation of QUEST, a search-driven data center management system that provides an easy-to-use interface to search for data center entities, get information about them, and perform actions on them, all from a single pane of glass. QUEST allows administrators to express their intent through a semi-structured query language, and interfaces with multiple management components behind the scenes to return the most relevant information, this eliminates the need for administrators having to learn and remember the workflows of multiple data center management interfaces. We built QUEST [1] as a part of the Nutanix data center management solution [2] and it is currently used by 25% of Nutanix's customers [3] to manage tens of thousands of nodes. Initial customer feedback is positive and validates our hypothesis that search-based management interfaces are superior to traditional navigational interfaces in reducing administrator burden and making them more effective. Our evaluation shows that QUEST can support interactive use in real data centers, and a case study with a real customer performance trouble ticket shows that QUEST can reduce the number of steps by 6× compared to state-of-the-art management tools in troubleshooting scenarios.

Recovering from attacks in an interconnected system is difficult, because an adversary that gains access to one part of the system may propagate to many others, and tracking down and recovering from such an attack requires significant manual effort. Web services are an important example of an interconnected system, as they are increasingly using protocols such as OAuth and REST APIs to integrate with one another. This paper presents Aire, an intrusion recovery system for such web services. Aire addresses several challenges, such as propagating repair across services when some servers may be unavailable, and providing appropriate consistency guarantees when not all servers have been repaired yet. Experimental results show that Aire can recover from four realistic attacks, including one modeled after a recent Facebook OAuth vulnerability; that porting existing applications to Aire requires little effort; and that Aire imposes a 19--30% CPU overhead and 6--9 KB/request storage cost for Askbot, an existing web application.

Warp is a system that helps users and administrators of web applications recover from intrusions such as SQL injection, cross-site scripting, and clickjacking attacks, while preserving legitimate user changes. Warp repairs from an intrusion by rolling back parts of the database to a version before the attack, and replaying subsequent legitimate actions. Warp allows administrators to retroactively patch security vulnerabilities---i.e., apply new security patches to past executions---to recover from intrusions without requiring the administrator to track down or even detect attacks. Warp's time-travel database allows fine-grained rollback of database rows, and enables repair to proceed concurrently with normal operation of a web application. Finally, Warp captures and replays user input at the level of a browser's DOM, to recover from attacks that involve a user's browser. For a web server running MediaWiki, Warp requires no application source code changes to recover from a range of common web application vulnerabilities with minimal user input at a cost of 24--27% in throughput and 2--3.2 GB/day in storage.

Almost all SoC designs today use hardware prototyping at some point of the development cycle to perform hardware/software validation or test interfaces to real-world stimulus. Recently, virtual prototypes have emerged as a way to run system level tests and perform hardware/software co-simulation before silicon or hardware prototypes are available. Does the emergence of virtual prototyping mean the end for FPGA-based prototypes? Will the hardware prototype continue to live on as an integral part of the SoC design cycle? Will hybrids of virtual and hardware prototypes be the answer? Join our expert panelists in a spirited discussion on the best approach for speeding the verification and validation of complex SoC using system prototypes. Virtual, hardware or hybrid -- which will reign supreme?

This panel will bring six speakers relating their success stories about design starting at the system-level. The format is an educational Panel aimed at informing DAC attendees of the challenges (difficulties and pitfalls) and opportunities (sizable benefits and lessons learned from these experiences).

Validation of the dependability of distributed systems via fault injection is gaining importance because distributed systems are being increasingly used in environments with high dependability requirements. The fact that distributed systems can fail in subtle ways that depend on the state of multiple parts of the system suggests that a global-state-based fault injection mechanism should be used to validate them. However, global-state-based fault injection is challenging since it is very difficult in practice to maintain the global state of a distributed system at runtime with minimal intrusion into the system execution. We present Loki, a global-state-based fault injector, which has been designed with the goals of low intrusion, high precision, and high flexibility. Loki achieves these goals by utilizing the ideas of partial view of global state, optimistic synchronization, and offline analysis. In Loki, faults are injected based on a partial, view of the global state of the system, and a post-runtime analysis is performed to place events and injections into a single global timeline and to discard experiments with incorrect fault injections. Finally, the experiments with correct fault injections are used to estimate user-specified performance and dependability measures. A flexible measure language has been designed that facilitates the specification of a wide range of measures.

The focus of this panel is on issues surrounding the use of C++ in modeling, integration of silicon IP and system-on-chip designs. In the last two years there have been several announcements promoting C++ based solutions and of multiple consortia (SystemC, Cynapps, Accellera, SpecC) that represent increasing commercial interest both from tool vendors as well as perhaps expression of genuine needs from the design houses. There are, however, serious questions about what value proposition does a C++ based design methodology bring to the IC or system designer? What has changed in the modeling technology (and/or available tools) that gives a new capability? Is synthesis the right target? or VAlidation? Tester modeling or testbench generation? This panel brings together advocates and opponents from the user community to highlight the achievements and the challenges that remain in use C++ for use in microelectronic circuits and systems.

Distributed applications can fail in subtle ways that depend on the state of multiple parts of a system. This complicates the validation of such systems via fault injection, since it suggests that faults should be injected based on the global state of the system. In Loki, fault injection is performed based on a partial view of the global state of a distributed system, i.e. faults injected in one node of the system can depend on the state of other nodes. Once faults are injected, a post-runtime analysis, using off-line clock synchronization, is used to place events and injections on a single global timeline and to determine whether the intended faults were properly injected. Finally, experiments containing successful fault injections are used to estimate the specified measures. In addition to briefly reviewing the concepts behind Loki and its organization, we detail Loki's user interface. In particular, we describe the graphical user interfaces for specifying state machines and faults, for executing a campaign and for verifying whether the faults were properly injected.

Validation of distributed systems using fault injection is difficult because of their inherent complexity, lack of a global clock, and lack of an easily accessible notion of a global state. To address these challenges, the Loki fault injector injects faults based on a partial view of the global state of a distributed system, and performs a post-runtime analysis using an off-line clock synchronization algorithm to determine whether the faults were properly injected. In this paper, we first describe an enhanced runtime architecture for the Loki fault injector and then present a new method for obtaining measures in Loki. The enhanced runtime allows dynamic entry and exit of nodes in the system. It also offers more efficient multicast of notification messages and more efficient communication between state machines on the same host, and is more scalable than the previous runtime. We then detail a new and flexible method for obtaining a wide range of performance and dependability measures in Loki.

Feedback control is one of the most common applications of real time systems. However, the design of controller frequencies, task scheduling and reliability engineering are often done separately, resulting in suboptimal results. The article provides an overview of an integrated approach to reliable real time controller design by optimizing the system control performance subject to schedulability and software reliability constraints. In control applications, the software reliability challenges goes beyond the specification, design, development and verification considerations. Advanced control techniques such as a neural net learns by example and can perform sophisticated nonlinear control. Indeed, the properties of certain advanced controllers can be difficult to analyze and verify. This problem can be addressed by using analytically redundant controllers, where the sophisticated but less reliable controller is "supervised" by a simple and reliable controller. An example of using analytically redundant controllers to enhance system reliability is the Boeing 777 flight control, where the normal controller is the new 777 controller, whereas the secondary controller is based on the well understood 747 control technology. The aircraft's state under the normal controller should be within the stability envelope of the 747 controller (Y.C. Yeh, 1995).

This paper describes the basis for and preliminary implementation of a new fault injector, called Loki, developed specifically for distributed systems. Loki addresses issues related to injecting correlated faults in distributed systems. In Loki, fault injection is performed based on a partial view of the global state of an application. In particular, facilities are provided to pass user-specified state information between nodes to provide a partial view of the global state in order to try to inject complex faults successfully. A post-runtime analysis, using an off-line clock synchronization and a bounding technique, is used to place events and injections on a single global time-line and determine whether the intended faults were properly injected. Finally, observations containing successful fault injections are used to estimate specified dependability measures. In addition to describing the details of our new approach, we present experimental results obtained from a preliminary implementation in order to illustrate Loki's ability to inject complex faults predictably.