Modular Verification of Order-Preserving Write-Back Caches

Abstract

File systems not only have to be functionally correct, they also have to be crash-safe: a power cut while an operation is running must be guaranteed to lead to a consistent state after restart that loses as little information as possible. Specification and verification of crashsafety is particularly difficult for non-redundant write-back caches. This paper defines a novel crash-safety criterion that facilitates specification and verification of order-preserving caches. A power cut is basically observationally equivalent to a retraction of a few of the last executed operations. The approach is modular: It gives simple proof obligations for each individual component and for each refinement in the development. The theory is supported by our interactive theorem prover KIV and proof obligations for crash-safety have been verified for the Flashix flash file system.

Modular Integration of Crashsafe Caching into a Verified Virtual File System Switch

“…On this abstract level, the operation does nothing. Its implementation, which uses an order-preserving write-back cache (see [13]) must empty this cache. -afs truncate is used to change the file size to n, checking that there are no junk data that would end up being part of the file below the new file size.…”

“…For reasons of space we could not formally address how caching of VFS interacts with the order-preserving cache (called "write buffer" in [13]) as used by lower levels of the implementation. However, informally the answer is as follows.…”

“…We have discussed lots of related work on verified file systems in general in earlier work [13,16], here we discuss two related approaches, that generate running code and have addressed the correctness of write-back caching in file systems. These are BilbyFS [1] and DFSCQ [3].…”

“…On a crash, nothing is lost, and an invariant stating that cached data are always identical to a part of the persistent data will suffice for verification. In [13] we have looked at order-preserving write-back caches that are used near the hardware level to queue data before persisting them in larger chunks. We have shown that these can be integrated into the hierarchy of components still allowing modular verification of each component separately.…”

“…Caching in VFS is rather different, since it is not order-preserving, so for the top-level POSIX operations, a new weaker crash safety criterion compared to [13] is necessary. We define write-prefix crash consistency, which states, that individual files still satisfy a prefix property: On a crash, all writes since the last fsync (that cleared the cache of this individual file) are retracted.…”