Disk sync at shutdown and fusefs filesystems

[Csaba Henk]

On 2007-12-11, Alejandro Pulver <alepulver at FreeBSD.org> wrote:
> The problem with NTFS-3G (and all other FUSE based drivers maybe) is
> that it doesn't flush the cache data to the disk at shutdown, but it
> does when unmounted (and I guess this doesn't happen automatically). I
> noticed this when files I write before manually unmounting persist, and
> otherwise sometimes they don't.

I just happen to discuss this issue with Szaka (ntfs-3g developer) and
Miklos Szeredi (FUSE developer). At least, we're discussing something
which might have a relevance here.

They have already discovered issues with system shutdown on Linux, and
Miklos has implemented a solution for this dubbed as "synchronous
umount". According to this, the protocol is enhanced with a new message
called DESTROY. Upon unmounting the fs, the kernel sends a DESTROY to
the daemon and waits for answer. That is, unmount(2) won't complete
until the fs says to the kernel "OK, I'm done".

This was introduced in the following commit (as seen in my HG mirror):

  http://mercurial.creo.hu/repos/fuse-hg/?rev/a5df6fb4a0e6

and it's already included in the current sysutils/fusefs-libs port.

And it wouldn't be hard to add kernel side support for FreeBSD. There
are some questions though:

 - Do you think it could be actually useful for solving the shutdown
   issue on FreeBSD?

 - Some "got hung in unmount" issues are to be sorted out (these
   appeared on Linux, and they might or might not appear on FreeBSD).

 - Security issue: with synch unmount, any user who can mount (w/ synch
   unmount), is capable of making the unmount stuck (which is easy to
   fix when the system is up -- just kill the fs daemon -- but can
   make the shutdown process hopelessly stuck). So we'd have to
   decide who/when shall be able to do mounts for which the unmount is 
   synchronous. (The current criteria for this on Linux -- ie.,
   is the fuseblk fs variant being used? -- is N/A to FreeBSD for
   reasons which are OT here. However, Miklos decided to
   change this so that sych unmount will be tied to the "allow_other"
   option, which is tied to root privileges, and does make sense
   on FreeBSD, too. I'd be happy to hear more suitable criteria.

Regards,
Csaba