Modular Integration of Crashsafe Caching into a Verified Virtual File System Switch

Abstract

When developing file systems, caching is a common technique to achieve a performant implementation. Integrating write-back caches into a file system does not only affect functional correctness but also impacts crash safety properties of the file system. As parts of written data are only stored in volatile memory, special care has to be taken when integrating write-back caches to guarantee that a power cut during running operations leads to a consistent state. This paper shows how non-order-preserving caches can be added to a virtual file system switch (VFS) and gives a novel crash-safety criterion matching the characteristics of such caches. Broken down to individual files, a power cut can be explained by constructing an alternative run, where all writes since the last synchronization of that file have written a prefix. VFS caches have been integrated modularly into Flashix, a verified file system for flash memory, and both functional correctness and crash-safety of this extension have been verified with the interactive theorem prover KIV.

Flashix: Modular Verification of a Concurrent and Crash-Safe Flash File System

“…However, write-back caching can have significant effects on the crash behavior of a system. In [4] we presented a novel correctness criterion for this sort of file system caches and proved that Flashix complies with it. We sketch the most important concepts of this addition and the proof idea in Sec.…”

“…In [29] we presented a crash-safety criterion for order-preserving caches: basically a crash has the effect of retracting a few of the last executed operations. But this criterion is too strong for non-order-preserving caches and so in [4] we proposed a more relaxed criterion and proved that our VFS caches comply with it. We will now give an overview over the crucial aspects of this latest extension.…”

“…So we use a new criterion called Write-Prefix Crash Consistency (WPCC). It states that for any file a crash has the effect of retracting all write and truncate operations since the last synchronization of that file and re-executing them, potentially resulting in writing prefixes of the original runs [4].…”

“…Hence an alternative run can be found on the level of POSIX, but this required to extend the proof work to another layer of abstraction. More details on the difficulties and the concrete proof strategy involving multiple commuting diagrams can be found in [4].…”

“…We then highlight two of the new features of Flashix. File content is now cached as described in Section 4, and write-prefix crash consistency has been proved [4]. Like wear leveling (described in [36]) garbage collection is now concurrent (Section 5).…”