fix(mkfs): lay out the devbox rootfs for cheap offline grows

[adam-rl]

What

Reworks the Photon do_mkfs patch that formats the devbox rootfs base layer.

Measured on a filesystem built by do_mkfs's own call sequence, grown 64→128GiB with the statically-linked resize2fs the guest execs:

	grow	blocks written	e2fsck -fn
before	602 ms	1057 (4.2 MiB)	corrupt — Block bitmap differences: +16745481
after	166 ms	89 (356 KiB)	clean

Four changes:

• Drop sparse_super2. Its second backup superblock lives in the last block group. Growing the filesystem relocates that backup and frees one block too many, leaving the group descriptor pointing at a block bitmap the allocator believes is free — the next workload to allocate that far writes user data over the bitmap.
• meta_bg instead of resize_inode. resize_inode's reserved GDT area gets rewritten in full on every grow, which is essentially the entire delta today. meta_bg reserves nothing.
• gdt_csum → metadata_csum. Measured identical grow cost (both keep appended inode tables uninitialized), and adds checksums on every metadata structure — the only damage signal on a filesystem with no journal and no fsck.
• 16 block groups per flex group (was 1, making flex_bg a no-op — which is what put the bitmaps in the blast radius of the sparse_super2 relocation).

Plus two things ext2fs_initialize does not do for us and mke2fs does: set s_checksum_type, and guard ext2fs_create_resize_inode behind its feature.

The baked size stays 64GiB — existing customer builds may depend on it.

Why it matters

The sparse_super2 bug is not theoretical. It fires on every grow — 64→65GiB corrupts as reliably as 64→256GiB — and the block numbers it produces match those seen in production byte for byte.

Existing images already carry sparse_super2 permanently; this only fixes newly built ones.

Verification

• sparse_super2 on/off × flex_bg / has_journal / metadata_csum / 64bit / resize_inode: clean separation, sparse_super2 is the only variable that corrupts
• new format, built through do_mkfs's own call sequence against libext2fs: 7 target sizes to 1TiB and 4 sequential grows on one filesystem, all clean; plus, via equivalent mke2fs geometry, 52 target sizes to 2TiB, 8 baked sizes each doubled, and a populated image grown then filled past the old end-of-filesystem
• patch applies to pristine v0.6.17 and is idempotent under the PATCH_COMMAND reverse-check
• every symbol used exists in the pinned data-accelerator/e2fsprogs (1.47.0)

The missing s_checksum_type was caught by the E2E job on the first push — ext2fs_open rejected the image with EXT2_ET_UNKNOWN_CSUM. That gap existed because mke2fs sets the field itself, so validating against mke2fs-built images could not surface it; the do_mkfs replication above now covers it and reproduces the exact error code.

Not covered

Everything above is offline resize2fs and libext2fs. Mounted kernel behaviour on the new format has not been exercised — worth a read/write/fill pass on a real devbox before this reaches customer builds.

🤖 Generated with Claude Code