1. © DEEDS – OS Systems & Software Dependability

2. © DEEDS – OS Outline for today Peek at OS2 topics Some DEEDS research introduction 1.Efficient Model Checking of Fault-tolerant Distributed Algorithms 2.OS testing & hardening 3.Dissecting AUTOSAR - Inside future automotive software

3. © DEEDS – OS OS testing & hardening

4. © DEEDS – OS OSs are large & complex beasts! Windows versionSLOC NT 1.0 19934-5 Million NT 2.019947-8 Million NT 3.019959-10 Million NT 4.0199611-12 Million Win2k199929+ Million WinXP200140 Million Server 200350 Million

5. © DEEDS – OS OSs are large & complex beasts! Linux kernelSLOC 2.6.1420057.1 Million 2.6.2320078.6 Million 2.6.2720089.6 Million 2.6.32200912.5 Million 2.6.35201013.5 Million 3.0201114.6 Million 3.32012>15 Million And that‘s just the kernel... Debian Lenny „code base“: 54 Million SLOC Debian Lenny total: 324 Million SLOC

6. © DEEDS – OS Where are the bugs (2001)?

7. © DEEDS – OS Where are the bugs (10 years later)?

8. © DEEDS – OS Why are the bugs where they are? Sources of outage in Windows XP Sources of outage in Windows 2k Device drivers –Numerous: 250 installed (100 active) drivers in XP/Vista –Large & complex: 70% of Linux code base –Immature: every day 25 new / 100 revised versions Vista drivers –Access Rights: kernel mode operation in monolithic OSs Device drivers are the dominant cause of OS failures despite sustained testing efforts

9. © DEEDS – OS What can we do about the bugs? Detect upfront (static analyses, testing: white vs black box) Detect & recover at runtime (Sandboxing, e.g. Nooks, BGI) Nothing?  make kernels robust!

10. © DEEDS – OS Two sample approaches Problem statement: Driver failures lead to OS API failures Mitigation approaches 1.Improve driver reliability 2.Harden OS robustness

11. © DEEDS – OS Some terminology

12. © DEEDS – OS A different view The problem in terms of error propagation The effect of testing in terms of error propagation The effect of robustness hardening in terms of error propagation

13. © DEEDS – OS Issues with the testing approach What if the driver is not the root cause? What if we cannot remove defects (e.g. commercial OSs)?

14. © DEEDS – OS Issues with the hardening approach What if we cannot remove robustness vulnerabilities?

15. © DEEDS – OS Research @ DEEDS: Driver testing Total State Space Operational State Space Testing

16. © DEEDS – OS Research @ DEEDS: Kernel hardening Test App OS Drivers Target Driver Manager Interceptor Drivers Host