erofs-freebsd-out-tree/docs/pre15-stage0/P15-081.md

P15-081 Stage0 Decision

Status: GO. B11 is authorized; no production source was modified by this decision.

The authoritative G11 replay uses frozen B25 BASE e2e3fb86b6fffcb01d6fd29c17dd95628ad070de, FreeBSD source HEAD 106727738dcfb6c001b46f25363b91cece970085, and mkfs.erofs (erofs-utils) 1.8.6. The gate script and input SHA256 values are 6215a3005214ba8d25dacd63e039320a0c63308d2334b5faff99a3927cad7d2e and a887fad56927545adb48462b770100d1e64b22b32554ed8ffad14c72b8febfc3.

Real Disk and Normal Entrypoint

The gate independently materializes a deterministic source tree containing regular, directory, character-device, block-device, FIFO, socket, symlink, and two hardlink names. It invokes mkfs twice with fixed UUID, time, ownership, worker count, xattr policy, and inline-data policy. It also fixes and restores the process umask and explicitly sets every source-node mode. Complete replays under outer umask 022 and 077, including both seed generations in each replay, are byte-identical.

The gate parses the actual superblock, checksum range, root inode, inline root directory, 12-byte dirents, NIDs, and compact inode modes without using DUT helpers. Every derived image changes one real dirent byte and recomputes the superblock CRC32C. dump.erofs --ls --path=/ observes the mutated on-disk file_type, while dump.erofs --path=/NAME reaches the same NID and reports the inode kind from its mode. This gives 13 normal namespace resolutions from real disk fields: eight known mismatches and five forward-compatibility cases.

All eight known mismatches are checksum-valid, fsck-clean images and yield positive FreeBSD EINTEGRITY in the independent candidate oracle. Type zero, nonzero dirent reserved bytes, and out-of-range type 8/255 remain accepted by the DUT policy and candidate oracle. erofs-utils fsck separately rejects 8/255; the evidence records that as policy-reject rather than falsely claiming fsck-clean. P15-093 already freezes the FreeBSD behavior for these extension values as DT_UNKNOWN, so fsck's stricter userspace policy does not override the G11 compatibility boundary.

Cache and Lock Boundary

regular and regular-hard are different namespace keys with the same real NID. The first normal lookup can instantiate the vnode; the second name misses that namecache key and reaches the existing erofs_vget() path, whose frozen body checks vfs_hash_get() before inode decode. Mutating only the second dirent to known directory type therefore provides the required cached-vnode trigger without adding a readdir-time vget.

The generated candidate patch adds no lock, vget, hash, or recursive lookup call. It reads immutable vtype after the existing child lookup, returns positive EINTEGRITY for a known mismatch, drops the locked child with vput(), and runs before a_vpp and namecache publication. Dotdot's existing vn_vget_ino() path explicitly bypasses the validator because root .. can return the directory vnode itself; this preserves its parent-lock contract. The parent/child lock order, readdir cookies, and VFS/VOP entrypoints are unchanged. Readdir still contains no vnode lookup.

Linux supplies the format mapping: EROFS file type values match generic Linux FT_*, and Linux readdir maps those values with fs_ftype_to_dtype(). The candidate aligns that known-type mapping while retaining FreeBSD vnode types, the FreeBSD 15 __enum_uint8(vtype) ABI type, positive errno, VFS locks, and forward handling for unknown values.

Replay Result

The authoritative command was:

timeout -k 10 240 tests/pre15/gates/P15-081.sh \
    --base e2e3fb86b6fffcb01d6fd29c17dd95628ad070de \
    --output OWNED_OUTPUT

It exits zero with GO: 14 generated images, eight known-match records including the hardlink alias, eight known mismatches, five compatibility cases, 13 normal entrypoint observations, one cached-vnode sequence, and 21 compiled prototype records. Two fresh output directories are byte-identical. The fixture-set SHA256 is b562a7e42e139b16f3ce399d585aa7c373a66aa478a084bfed67b2b2aa9f2bd3.

Key immutable evidence SHA256 values are:

• result.json: 4ec8e053c60ae75ae2fc4580a3d820a0452cf519f6b85376953135e18a7ec0ec
• oracle.json: 932e558d3ead05572f38c89635bb10cae45393e42028031f81dfc7a56f2093f6
• lock-ledger.json: e8c2e6ba797fbcc83d832af6583d3f74f344750f6897111e7fe501130e577c13
• fixture-index.json: 1a46b8ebfec16109c5d193001dc650a1b56000045e5d9e1e9b145fe7c5df9a16
• candidate.patch: 427097da9304f5bedb770be8cab5f589706d316fb18a152ca16cb9d0663713fd
• prototype.c: 1a295d18830c61a9708d465c3b1e415efb3ff8276100e4e32139bfa715195d8b
• normal-entry.tsv: b2841448068f70633ed0c02d901177a639cfed150f0e1c58977cc6c7b1e7313e
• SHA256SUMS: 36b486617920b04ca87e88016e2fc0f519cda3a5f99dc675c9a89549615a02e3

QEMU and the full feature suite were not run for this pre-source gate. The gate uses host-created real EROFS images, independent binary parsing, normal userspace namespace resolution, frozen DUT/FreeBSD control flow, and a compiled prototype that is not linked into the DUT KLD.