Inside a Verified Flash File System: Transactions and Garbage Collection

Ernst, Gerhard; Pfähler, Jörg; Schellhorn, Gerhard; Reif, Wolfgang

doi:10.1007/978-3-319-29613-5_5

Cited by 12 publications

(13 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The closest effort in this area is work in progress by Schellhorn, Pfähler, and others to verify a flash file system called Flashix [20,54,58]. They aim to produce a verified file system for raw flash, to support a POSIX-like interface, and to handle crashes.…”

Section: Related Workmentioning

confidence: 99%

Using Crash Hoare logic for certifying the FSCQ file system

Chen¹,

Ziegler²,

Chajed³

et al. 2015

Proceedings of the 25th Symposium on Operating Systems Principles

174

144

View full text Add to dashboard Cite

FSCQ is the first file system with a machine-checkable proof (using the Coq proof assistant) that its implementation meets its specification and whose specification includes crashes. FSCQ provably avoids bugs that have plagued previous file systems, such as performing disk writes without sufficient barriers or forgetting to zero out directory blocks. If a crash happens at an inopportune time, these bugs can lead to data loss. FSCQ's theorems prove that, under any sequence of crashes followed by reboots, FSCQ will recover the file system correctly without losing data. To state FSCQ's theorems, this paper introduces the Crash Hoare logic (CHL), which extends traditional Hoare logic with a crash condition, a recovery procedure, and logical address spaces for specifying disk states at different abstraction levels. CHL also reduces the proof effort for developers through proof automation. Using CHL, we developed, specified, and proved the correctness of the FSCQ file system. Although FSCQ's design is relatively simple, experiments with FSCQ running as a user-level file system show that it is sufficient to run Unix applications with usable performance. FSCQ's specifications and proofs required significantly more work than the implementation, but the work was manageable even for a small team of a few researchers.

show abstract

Section: Related Workmentioning

confidence: 99%

Using Crash Hoare logic for certifying the FSCQ file system

Chen¹,

Ziegler²,

Chajed³

et al. 2015

Proceedings of the 25th Symposium on Operating Systems Principles

174

144

View full text Add to dashboard Cite

show abstract

“…Altogether we get a refinement tower with 11 layers. In earlier work, we have verified the various components [6,14] to be crash-safe refinements according to the theory in [7,16]. The bottom layer of this development is the MTD interface, that Linux uses to access raw flash memory.…”

Section: Formal Approachmentioning

confidence: 81%

“…Within these limitations, however, our result enables to write applications that use the file system in a crash-safe way: check-sums written before the actual data can be used to detect writes, that have not been persisted completely. Such a transaction concept would be similar to using group nodes for order-preserving caches as used by the file system itself [6].…”

Section: Introductionmentioning

confidence: 99%

Modular Integration of Crashsafe Caching into a Verified Virtual File System Switch

Bodenmüller

Schellhorn

Reif

2020

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

When developing file systems, caching is a common technique to achieve a performant implementation. Integrating write-back caches into a file system does not only affect functional correctness but also impacts crash safety properties of the file system. As parts of written data are only stored in volatile memory, special care has to be taken when integrating write-back caches to guarantee that a power cut during running operations leads to a consistent state. This paper shows how non-order-preserving caches can be added to a virtual file system switch (VFS) and gives a novel crash-safety criterion matching the characteristics of such caches. Broken down to individual files, a power cut can be explained by constructing an alternative run, where all writes since the last synchronization of that file have written a prefix. VFS caches have been integrated modularly into Flashix, a verified file system for flash memory, and both functional correctness and crash-safety of this extension have been verified with the interactive theorem prover KIV.

show abstract

“…Our work is similar to verify a file system (a similar system API like open, read and write etc.) Pioneering work in file system direction includes FSCQ [30], COGENT [31, 32] and Flashix [33, 34], which are all successful engineering achievements. However, almost all of these jobs need a developer to construct a proof of implementation correctness using theorem tools such as Coq or Isabelle.…”

Section: Related Workmentioning

confidence: 99%