verify: add --verify_type option for crash-consistent verification

This patch introduces a new --verify_type option to support crash-consistent
offline verification scenarios. The primary motivation is to handle cases where
write operations are interrupted by device failures or unexpected power loss
during the write phase, requiring verification to be limited to data that was
properly persisted before the interruption.

Key features:
- New --verify_type=flush option filters verification candidates based on
  fsync completion timing
- Tracks fsync completion timestamps during write phase
- During verification, excludes writes that completed after the last fsync
- Always includes FUA (Force Unit Access) writes regardless of timing, as
  they bypass cache and are immediately persistent
- Works with existing verify_state_save mechanism for offline verification

Use case:
This is particularly useful for testing storage durability guarantees in
scenarios such as:
1. Simulated power failures during write workloads
2. Device error injection testing

and espeically with such ioengines which directly communicates with the
device directly as io_uring_cmd does.

This enhancement enables more realistic testing of data durability in storage
systems by ensuring only properly synchronized data is verified after
simulated failures.

Examples:

1. write phase

[global]
ioengine=io_uring_cmd
cmd_type=nvme
filename=/dev/ng0n1
rw=write
bs=4k
verify=pattern
verify_pattern=%o

iodepth=32
size=32k
fsync=3

[test]
verify_type=flush
do_verify=0
verify_state_save=1

2. read phase

[global]
ioengine=io_uring_cmd
cmd_type=nvme
filename=/dev/ng0n1
rw=write
bs=4k
verify=pattern
verify_pattern=%o

iodepth=32
size=32k
fsync=3

[test]
verify_type=flush
do_verify=1
verify_only=1
verify_state_load=1

Signed-off-by: Minwoo Im <[email protected]>
Signed-off-by: Minwoo Im <[email protected]>

Author: minwooim

HOWTO.rst

@@ -3989,6 +3989,33 @@ Verification
         used to speed up the process of writing each block on a device with its
         offset. Default: 0 (disabled).
 
+.. option:: verify_type=str
+
+        Controls which write operations are included during the verification
+        phase.  This option only affects offline verification when using
+        :option:`verify_state_save` to save completion state and later verify
+        with a separate job. The allowed values are:
+
+		**flush**
+                        Only verify writes that completed at or before the last
+                        fsync operation.  This mode filters out writes that
+                        completed after the last fsync, which may not be
+                        persistent on storage. Writes with the Force Unit
+                        Access (FUA) flag are always included regardless of
+                        fsync timing, as they bypass the cache and are
+                        immediately persistent. This is useful for testing data
+                        persistence guarantees across power failures or system
+                        crashes. fio tracks fsync completion times and write
+                        completion times during the write phase. During
+                        verification, only writes that meet the fsync timing
+                        criteria are verified. This allows testing scenarios
+                        where only data that was properly synced before a
+                        simulated failure should be verified.
+                        This option requires :option:`verify_state_save` to be
+                        enabled and is only effective during offline
+                        verification (separate verify job). Default: none
+                        (verify all completed writes).
+
 .. option:: verify_fatal=bool
 
 	Normally fio will keep checking the entire contents before quitting on a

backend.c

@@ -1259,7 +1259,7 @@ static int init_file_completion_logging(struct thread_data *td,
 
 	for_each_file(td, f, i) {
 		f->last_write_comp = scalloc(td->last_write_comp_depth,
-					     sizeof(uint64_t));
+					     sizeof(struct fio_write_comp));
 		if (!f->last_write_comp)
 			goto cleanup;
 	}

cconv.c

@@ -177,6 +177,7 @@ int convert_thread_options_to_cpu(struct thread_options *o,
 	o->sync_io = le32_to_cpu(top->sync_io);
 	o->write_hint = le32_to_cpu(top->write_hint);
 	o->verify = le32_to_cpu(top->verify);
+	o->verify_type = le32_to_cpu(top->verify_type);
 	o->do_verify = le32_to_cpu(top->do_verify);
 	o->experimental_verify = le32_to_cpu(top->experimental_verify);
 	o->verify_state = le32_to_cpu(top->verify_state);
@@ -441,6 +442,7 @@ void convert_thread_options_to_net(struct thread_options_pack *top,
 	top->sync_io = cpu_to_le32(o->sync_io);
 	top->write_hint = cpu_to_le32(o->write_hint);
 	top->verify = cpu_to_le32(o->verify);
+	top->verify_type = cpu_to_le32(o->verify_type);
 	top->do_verify = cpu_to_le32(o->do_verify);
 	top->experimental_verify = cpu_to_le32(o->experimental_verify);
 	top->verify_state = cpu_to_le32(o->verify_state);

engines/io_uring.c

@@ -556,6 +556,10 @@ static int fio_ioring_cmd_prep(struct thread_data *td, struct io_u *io_u)
 		io_u_set(td, io_u, IO_U_F_VER_IN_DEV);
 	}
 
+	/* Mark FUA writes for verification state tracking */
+	if (io_u->ddir == DDIR_WRITE && o->writefua)
+		io_u_set(td, io_u, IO_U_F_FUA);
+
 	return fio_nvme_uring_cmd_prep(cmd, io_u,
 			o->nonvectored ? NULL : &ld->iovecs[io_u->index],
 			dsm, read_opcode, ld->write_opcode,

engines/sg.c

@@ -668,6 +668,10 @@ static int fio_sgio_prep(struct thread_data *td, struct io_u *io_u)
 			fio_sgio_rw_lba(hdr, lba, nr_blocks,
 				o->write_mode == FIO_SG_WRITE_SAME_NDOB);
 
+		/* Mark FUA writes for verification state tracking */
+		if (o->writefua)
+			io_u_set(td, io_u, IO_U_F_FUA);
+
 	} else if (io_u->ddir == DDIR_TRIM) {
 		struct sgio_trim *st;
 

file.h

@@ -37,6 +37,9 @@ enum fio_file_flags {
 	FIO_FILE_smalloc	= 1 << 9,	/* smalloc file/file_name */
 };
 
+/* Flags for fio_write_comp.flags */
+#define FIO_WRITE_COMP_FUA	0x1	/* Write had Force Unit Access flag */
+
 enum file_lock_mode {
 	FILE_LOCK_NONE,
 	FILE_LOCK_EXCLUSIVE,
@@ -126,8 +129,15 @@ struct fio_file {
 	 * Tracks the last iodepth number of completed writes, if data
 	 * verification is enabled
 	 */
-	uint64_t *last_write_comp;
+	struct fio_write_comp {
+		uint64_t offset;
+		uint64_t completion_time_nsec;
+		uint32_t flags;  /* I/O flags including FUA */
+		uint32_t flush_count; /* FLUSH count at completion time */
+	} *last_write_comp;
 	unsigned int last_write_idx;
+	uint64_t last_flush_time_nsec;  /* Last FLUSH completion timestamp */
+	unsigned int flush_count;       /* Count of completed FLUSH operations */
 
 	/*
 	 * For use by the io engine to store offset

fio.1

@@ -3712,6 +3712,34 @@ Recreate an instance of the \fBverify_pattern\fR every
 up the process of writing each block on a device with its offset. Default:
 0 (disabled).
 .TP
+.BI verify_type \fR=\fPstr
+Controls which write operations are included during the verification phase.
+This option only affects offline verification when using \fBverify_state_save\fR
+to save completion state and later verify with a separate job. The allowed
+values are:
+.RS
+.RS
+.TP
+.B flush
+Only verify writes that completed at or before the last fsync operation.
+This mode filters out writes that completed after the last fsync, which may
+not be persistent on storage. Writes with the Force Unit Access (FUA) flag
+are always included regardless of fsync timing, as they bypass the cache and
+are immediately persistent. This is useful for testing data persistence
+guarantees across power failures or system crashes.
+.RE
+.P
+When \fBverify_type=flush\fR is used, fio tracks fsync completion times and
+write completion times during the write phase. During verification, only
+writes that meet the fsync timing criteria are verified. This allows testing
+scenarios where only data that was properly synced before a simulated
+failure should be verified.
+.P
+This option requires \fBverify_state_save\fR to be enabled and is only
+effective during offline verification (separate verify job). Default: none
+(verify all completed writes).
+.RE
+.TP
 .BI verify_fatal \fR=\fPbool
 Normally fio will keep checking the entire contents before quitting on a
 block verification failure. If this option is set, fio will exit the job on

io_u.c

@@ -2063,7 +2063,7 @@ static void account_io_completion(struct thread_data *td, struct io_u *io_u,
 }
 
 static void file_log_write_comp(const struct thread_data *td, struct fio_file *f,
-				uint64_t offset, unsigned int bytes)
+				uint64_t offset, unsigned int bytes, struct io_u *io_u)
 {
 	int idx;
 
@@ -2079,11 +2079,31 @@ static void file_log_write_comp(const struct thread_data *td, struct fio_file *f
 		return;
 
 	idx = f->last_write_idx++;
-	f->last_write_comp[idx] = offset;
+	f->last_write_comp[idx].offset = offset;
+	f->last_write_comp[idx].completion_time_nsec = ntime_since_now(&io_u->start_time);
+	f->last_write_comp[idx].flags = 0;
+	f->last_write_comp[idx].flush_count = f->flush_count;
+
+	/* Check if this is a FUA write */
+	if (io_u && (io_u->flags & IO_U_F_FUA))
+		f->last_write_comp[idx].flags |= FIO_WRITE_COMP_FUA;
+
 	if (f->last_write_idx == td->last_write_comp_depth)
 		f->last_write_idx = 0;
 }
 
+static void file_log_flush_comp(struct fio_file *f, struct io_u *io_u)
+{
+	if (!f)
+		return;
+
+	/* Track the last FLUSH completion timestamp */
+	f->last_flush_time_nsec = ntime_since_now(&io_u->start_time);
+
+	/* Increment FLUSH counter */
+	f->flush_count++;
+}
+
 static bool should_account(struct thread_data *td)
 {
 	return ramp_time_over(td) && (td->runstate == TD_RUNNING ||
@@ -2125,7 +2145,10 @@ static void io_completed(struct thread_data *td, struct io_u **io_u_ptr,
 	if (ddir_sync(ddir)) {
 		if (io_u->error)
 			goto error;
+
+		/* Log flush completion */
 		if (f) {
+			file_log_flush_comp(f, io_u);
 			f->first_write = -1ULL;
 			f->last_write = -1ULL;
 		}
@@ -2164,7 +2187,7 @@ static void io_completed(struct thread_data *td, struct io_u **io_u_ptr,
 		}
 
 		if (ddir == DDIR_WRITE)
-			file_log_write_comp(td, f, io_u->offset, bytes);
+			file_log_write_comp(td, f, io_u->offset, bytes, io_u);
 
 		if (should_account(td))
 			account_io_completion(td, io_u, icd, ddir, bytes);
@@ -2464,6 +2487,10 @@ int do_io_u_sync(const struct thread_data *td, struct io_u *io_u)
 
 	if (ret < 0)
 		io_u->error = errno;
+	else {
+		/* Record FLUSH completion timing for verification state */
+		file_log_flush_comp(io_u->file, io_u);
+	}
 
 	return ret;
 }

io_u.h

@@ -24,6 +24,7 @@ enum {
 	IO_U_F_PATTERN_DONE	= 1 << 8,
 	IO_U_F_DEVICE_ERROR	= 1 << 9,
 	IO_U_F_VER_IN_DEV	= 1 << 10, /* Verify data in device */
+	IO_U_F_FUA		= 1 << 11, /* Force Unit Access flag */
 };
 
 /*

options.c

@@ -3240,6 +3240,28 @@ struct fio_option fio_options[FIO_MAX_OPTS] = {
 		.category = FIO_OPT_C_IO,
 		.group	= FIO_OPT_G_VERIFY,
 	},
+	{
+		.name	= "verify_type",
+		.lname	= "Verify type",
+		.type	= FIO_OPT_STR,
+		.off1	= offsetof(struct thread_options, verify_type),
+		.help	= "Verification filter type",
+		.def	= "none",
+		.parent = "verify",
+		.hide	= 1,
+		.category = FIO_OPT_C_IO,
+		.group	= FIO_OPT_G_VERIFY,
+		.posval = {
+			  { .ival = "none",
+			    .oval = VERIFY_NONE,
+			    .help = "No verification filtering",
+			  },
+			  { .ival = "flush",
+			    .oval = VERIFY_TYPE_FLUSH,
+			    .help = "Verify only writes that completed before flush",
+			  },
+		},
+	},
 	{
 		.name	= "verifysort",
 		.lname	= "Verify sort",