Using Crash Hoare logic for certifying the FSCQ file system

Abstract

FSCQ is the first file system with a machine-checkable proof (using the Coq proof assistant) that its implementation meets its specification and whose specification includes crashes. FSCQ provably avoids bugs that have plagued previous file systems, such as performing disk writes without sufficient barriers or forgetting to zero out directory blocks. If a crash happens at an inopportune time, these bugs can lead to data loss. FSCQ's theorems prove that, under any sequence of crashes followed by reboots, FSCQ will recover the file system correctly without losing data. To state FSCQ's theorems, this paper introduces the Crash Hoare logic (CHL), which extends traditional Hoare logic with a crash condition, a recovery procedure, and logical address spaces for specifying disk states at different abstraction levels. CHL also reduces the proof effort for developers through proof automation. Using CHL, we developed, specified, and proved the correctness of the FSCQ file system. Although FSCQ's design is relatively simple, experiments with FSCQ running as a user-level file system show that it is sufficient to run Unix applications with usable performance. FSCQ's specifications and proofs required significantly more work than the implementation, but the work was manageable even for a small team of a few researchers.

Refinement through restraint: bringing down the cost of verification

“…Like us, Charguéraud [2010Charguéraud [ , 2011 generates shallow embeddings to facilitate mechanical proofs, but unlike us they do not prove compilation correctness. Chen et al [2015] formally show in Coq [Bertot and Castéran 2004] full crash-resilience of FSCQ. FSCQ is smaller than ext2 and BilbyFs, and an order of magnitude slower than asynchronous ext4.…”

“…Its implementation relies on generating Haskell code from Coq, and executing that code with a full Haskell runtime in userspace. We focus on bridging high-level specification and lowlevel implementation, on efficiency, and on providing a small trusted computing base, while Chen et al [2015] assume all these are given and focus on crash resilience. The approaches are complementary, i.e.…”

Towards Proving Optimistic Multicore Schedulers

“…Frost et al (Frost et al 2007) present abstractions to make file-system dependencies explicit (e.g., a read must be done after a write). Formal specifications of file systems (Chen et al 2015;Amani et al 2016) are a recent breakthrough in the formal specification of operating systems. Like these works, we aim to prove high level properties of systems, with the added difficulty of handling concurrent operations.…”

Fault-Tolerant Resource Reasoning

“…In independent work, Chen et al introduced Crash Hoare Logic (CHL) to reason about host failures and applied it to a substantial sequential journaling file system (FSCQ) written in Coq [2]. CHL extends Hoare triples with faultconditions and provides highly automated reasoning about host failures.…”