Slide 1/5 · OpenBSD-src fork · xsub/OpenBSD-src

What is this project for? Native zoned storage for OpenBSD.

Modern high-capacity drives — host-managed SMR and NVMe ZNS — refuse random writes: data may only land on each zone's write pointer. OpenBSD had no native support for them at all.

ZBD layer

A native kernel ABI: zone reports, zone management (reset/finish), a sequential-write safety gate in sd(4), both SCSI ZBC and NVMe ZNS paths.

ZLFS

A log-structured filesystem designed from scratch for the zone contract: writes only at write pointers, nothing overwritten, commit = an appended generation-N+1 superblock.

Business case: append-only appliances

Security appliances on big, cheap media: surveillance recorders (DVR/NVR), network flight recorders capturing packets, long-retention audit and syslog archives. These workloads are sequential by nature — exactly what SMR does best — and the circular log turns retention into zone recycling. OpenBSD’s security stack on capacity-class drives, with no translation layer in the way.

Slide 2/5 · Where it stands

It works — and every feature has hardware evidence

The roadmap is complete. Method: implement → multi-agent adversarial verification → push → validate on a QEMU NVMe ZNS VM. Every shipped feature is VM-validated — the "awaiting evidence" table in functional_testing.md is empty; the architecture is documented in docs/zlfs-design.md.

Full namespace

create / read / write / truncate, mkdir / rmdir, unlink, rename — including directories across parents with subtree-cycle rejection.

GC + circular log

The cleaner reclaimed ~6.6 GB in one pass (df 98%→18%); 150 zone-fills on a 126-zone device with zero ENOSPC. Superblock zones recycle by ping-pong reset.

Per-block commit

A 10-byte splice in a 1 MB file rewrites one block, not 250. Files to ~1 GB via double-indirect trees. mmap views stay coherent (UVM invalidation).

Concurrency-safe

All-or-nothing commits under held vnode locks; trylock + retry avoids the fsync deadlock. Validated under 8-way concurrent writers with GC running under load.

Slide 3/5 · Architecture in a nutshell

Never overwrite. Append and switch.

full zones · log head at the write pointer · empty zones (recycled by GC)

Superblock = generation log

Ping-pong across zones 0–1; the highest valid generation wins at mount. A crash before the append leaves the previous checkpoint in force — the log is the journal, so recovery is just mounting.

Checkpoint → map → inodes

The checkpoint carries a multi-block inode map (~256k inodes); everything little-endian with CRC32C.

GC in 3 passes

Liveness = union of the durable checkpoint (re-read from disk), the in-core map, and open vnodes. Fully dead zones are reset; mixed zones are compacted (live blocks relocated) — all crash-safe by construction.

Slide 4/5 · Numbers (fork point 2026-07-04 → 07-20)

16 days from zero to a working filesystem

103commits above mainline (39 ZLFS-prefixed)
11 299lines added · 64 files
4 230lines of ZLFS kernel (sys/zlfs + format)
1 774lines in sd(4)/NVMe/dkzone (ZBD layer)
714lines of userland: newfs_zlfs, mount_zlfs
15regress scripts (6 ZLFS suites)
18defects logged — every one caught before a user could hit it
v2on-disk format; rebased onto mainline 07-13

Best catches: GC liveness diverging from the durable checkpoint (silent data loss), stale buffer cache after zone recycling, truncated bytes resurrected by RMW, stale mmap pages, an fsync that could return success without persisting — all stopped by adversarial review or the VM suite, none by a user.

Slide 5/5 · Roadmap

Where we are, what remains

1 / 5