Application Crash Consistency and Performance with CCFS THANUMALAYAN SANKARANARAYANA PILLAI, RAMNATTHAN ALAGAPPAN, and LANYUE LU, University of Wisconsin – Madison 19 VIJAY CHIDAMBARAM, The University of Texas at Austin ANDREA C. ARPACI-DUSSEAU and REMZI H. ARPACI-DUSSEAU, University of Wisconsin – Madison Recent research has shown that applications often incorrectly implement crash consistency. We present the Crash-Consistent File System (ccfs), a file system that improves the correctness of application-level crash consistency protocols while maintaining high performance. A key idea in ccfs is the abstraction of a stream. Within a stream, updates are committed in program order, improving correctness; across streams, there are no ordering restrictions, enabling scheduling flexibility and high performance. We empirically demonstrate that applications running atop ccfs achieve high levels of crash consistency. Further, we show that ccfs per- formance under standard file-system benchmarks is excellent, in the worst case on par with the highest per- forming modes of Linux ext4, and in some cases notably better. Overall, we demonstrate that both application correctness and high performance can be realized in a modern file system. CCS Concepts: • General and reference → Reliability; Performance;•Information systems → File systems;•Software and its engineering → File systems management; Additional Key Words and Phrases: File systems, crash consistency, reordering, performance ACM Reference format: Thanumalayan Sankaranarayana Pillai, Ramnatthan Alagappan, Lanyue Lu, Vijay Chidambaram, Andrea C. Arpaci-Dusseau, and Remzi H. Arpaci-Dusseau. 2017. Application Crash Consistency and Performance with CCFS. ACM Trans. Storage 13, 3, Article 19 (September 2017), 29 pages. https://doi.org/10.1145/3119897 The research herein was supported by funding from NSF grants CNS-1419199, CNS-1421033, CNS-1319405, and CNS-1218405, DOE grant DE-SC0014935, as well as donations from EMC, Facebook, Google, Huawei, Microsoft, NetApp, Samsung, Seagate, Veritas, and VMware. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and may not reflect the views of NSF, DOE, or other institutions. This article isan extended version of a FAST ’17 paper by T.S. Pillai et al. [37]. The additional material here includes a detailed description of the stream API, detailed discussion of the limitations of the stream abstraction and the ccfs file system, more thorough discussion of developer effort required to make applications crash consistent atop ccfs, more figures and code snippetsto illustrate usage of streams, and several other minor edits and updates. Authors’ addresses: T. S. Pillai, R. Alagappan, and L. Lu, 1210 W. Dayton St., Madison, WI 53706; V. Chidambaram, 2317 Speedway, Austin, TX 78712; A. C. Arpaci-Dusseau and R. H. Arpaci-Dusseau, 1210 W. Dayton St., Madison, WI 53706; emails: {madthanu, ra, ll}@cs.wisc.edu, [email protected], {dusseau, remzi}@cs.wisc.edu. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) mustbe honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. 2017 Copyright is held by the owner/author(s). Publication rights licensed to ACM. ACM 1553-3077/2017/09-ART19 $15.00 https://doi.org/10.1145/3119897 ACM Transactions on Storage, Vol. 13, No. 3, Article 19. Publication date: September 2017. 19:2 T. S. Pillai et al. 1 INTRODUCTION “Filesystem people should aim to make ‘badly written’ code ‘just work.’ ” —Linus Torvalds [56] The constraint of ordering is a common technique applied throughout all levels of computer systems to ease the construction of correct programs. For example, locks and condition variables limit how multi-threaded programs run, making concurrent programming simpler [3]; memory consistency models with stricter constraints (e.g., sequential consistency) generally make reason- ing about program behavior easier [51]; fsync calls in data management applications ensure pre- ceding I/O operations complete before later operations [6, 38]. Unfortunately, constraining ordering imposes a fundamental cost: poor performance. Adding synchronization primitives to concurrent programs adds overhead and reduces performance [20, 22]; stronger multiprocessor memory models are known to yield lower throughput [17]; forcing writes to a disk or SSD can radically reduce I/O performance [6, 7].Whileinrarecaseswecan achieve both correctness and performance [43],inmostcaseswemustmakeanunsavorychoice to sacrifice one. Within modern storage systems, this same tension arises. A file system, for example, could commit all updates in order, adding constraints to ease the construction of applications (and their crash-recovery protocols) atop them [4, 38]. Many file system developers have determined that such ordering is performance prohibitive; as a result, most modern file systems reduce internal ordering constraints. For example, many file systems (including ext4, xfs, btrfs, and the 4.4BSD fast file system) re-order application writes2 [ ], and some file systems commit directory operations out of order (e.g., btrfs [38]). Lower levels of the storage stack also re-order aggressively, to reduce seeks and obtain grouping benefits [23, 24, 45, 47]. However, research has shown that user-level applications are often incorrect because of re- ordering [1, 38, 60]. Many applications use a specialized write protocol to maintain crash consis- tency of their persistent data structures. The protocols, by design or accident, frequently require all file-system updates to commit in their issued order39 [ ]. The main hypothesis in this article is that a carefully designed and implemented file system can achieve both ordering and high performance. We explore this hypothesis in the context of the Crash-Consistent File System (ccfs), a new file system that enables crash-consistent applications while delivering excellent performance. The key new abstraction provided by ccfs, which enables the goals of high performance and correctness to be met simultaneously, is the stream. Each application’s file-system updates are logically grouped into a stream; updates within a stream, including file data writes, are guaranteed to commit to disk in order. Streams thus enable an application to ensure that commits are ordered (making recovery simple); separating updates between streams prevents false write dependencies and enables the file system to re-order sufficiently for performance. Underneath this abstraction, ccfs contains numerous mechanisms for high performance. Criti- cally, while ordering updates would seem to overly restrict file-system implementations, we show that the journaling machinery found in many modern systems can be adapted to yield high perfor- mance while maintaining order. More specifically, ccfs uses a novel hybrid-granularity journaling approach that separately preserves the order of each stream; hybrid granularity further enables other needed optimizations, including delta journaling and pointer-less metadata structures. Ccfs takes enough care to retain optimizations in modern file systems (like ext4) that appear at first to be incompatible with strict ordering, with new techniques such as order-preserving delayed allocation. ACM Transactions on Storage, Vol. 13, No. 3, Article 19. Publication date: September 2017. Application Crash Consistency and Performance with CCFS 19:3 Fig. 1. Journaling Update Protocol. Pseudo-code for a simple version of write-ahead journaling; each statement is a system call. The normal text corresponds directly to the protocol’s logic, while the bold parts are additional measures needed for portability. Italicized comments show which measures are needed under the default modes of ext2, ext3, ext4, xfs, and btrfs, and the writeback mode of ext3/4 (ext3-wb, ext4-wb). We show that the ordering maintained by ccfs improves correctness by testing five widely used applications (Git, LevelDB, ZooKeeper, Mercurial, and SQLite), four of which (all except SQLite) are inconsistent on ext4 and other modern file systems38 [ ]. We also show that the performance of standard benchmarks on ccfs are on par with ext4. We compare the performance of three real-world applications (Git, LevelDB, and SQLite) on ccfs and ext4; SQLite and LevelDB perform similarly on both file systems and Git has a80× performance improvement on ccfs, when modified on ext4 to achieve the same correctness as on ccfs. Furthermore, with additional developer effort, the per- formance of SQLite and LevelDB on ccfs can be improved by factors of 685× and 5×, respectively. We analyze in detail the developer effort required for applications to use the stream abstraction and conclude it is trivial; for instance, we added a single line of code to Git to achieve both crash consistency and efficiency atop ccfs, while many complicated changes to many source filesare required to make Git crash-consistent atop re-ordering file systems. The article is structured as follows. We provide motivation and background (Section 2), present ccfs (Section 3), and evaluate it (Section