[PATCH 0/4] fit: dm-verity support

[Daniel Golle]

Hi,

This series adds dm-verity support to U-Boot's FIT image infrastructure.
It is the first logical subset of the larger OpenWrt boot method series
posted as an RFC in February 2026 [1], extracted here for independent
review and merging.

OpenWrt's firmware model embeds a read-only squashfs or erofs root
filesystem directly inside a uImage.FIT container as a FILESYSTEM-type
loadable FIT image. At boot the kernel maps this sub-image directly from
the underlying block device via the fitblk driver (/dev/fit0, /dev/fit1,
...), the goal is that the bootloader never even copies it to RAM.

dm-verity enables the kernel to verify the integrity of those mapped
filesystems at read time, with a Merkle hash tree stored contiguously in
the same sub-image just after the data. Two kernel command-line
parameters are required:

  dm-mod.create=   -- the device-mapper target table for the verity device
  dm-mod.waitfor=  -- a comma-separated list of block devices to wait for
                      before dm-init sets up the targets (needed when fitblk
                      probes late, e.g. because it depends on NVMEM
                      calibration data)

The FIT dm-verity node schema was upstreamed into the flat-image-tree
specification [2], which this implementation tries to follow exactly.

The runtime feature is guarded behind CONFIG_FIT_VERITY. If not
enabled the resulting binary size remains unchanged. If enabled the
binary size increases by about 3kB.

[1] RFC/v2: https://www.mail-archive.com/u-boot@lists.denx.de/msg565945.html
[2] flat-image-tree dm-verity node spec:
    https://github.com/open-source-firmware/flat-image-tree/commit/795fd5fd7f0121d0cb03efb1900aafc61c704771

Daniel Golle (4):
  image: fit: add dm-verity property name constants
  boot: fit: support generating DM verity cmdline parameters
  tools: mkimage: add dm-verity Merkle-tree generation
  doc: fit: add dm-verity boot parameter documentation

 boot/Kconfig                |  21 ++
 boot/bootm.c                |   7 +
 boot/image-board.c          |   5 +
 boot/image-fit.c            | 336 ++++++++++++++++++++++++++++++++
 doc/usage/fit/dm-verity.rst | 279 +++++++++++++++++++++++++++
 doc/usage/fit/index.rst     |   1 +
 include/image.h             |  97 +++++++++-
 tools/fit_image.c           | 111 ++++++++++-
 tools/image-host.c          | 369 +++++++++++++++++++++++++++++++++++-
 9 files changed, 1215 insertions(+), 11 deletions(-)
 create mode 100644 doc/usage/fit/dm-verity.rst

-- 
2.53.0