[4/4] doc: fit: add dm-verity boot parameter documentation

[Simon Glass]

Hi Daniel,

On 2026-04-02T03:08:27, Daniel Golle <daniel at makrotopia.org> wrote:
> doc: fit: add dm-verity boot parameter documentation
> doc: fit: add dm-verity boot parameter documentation
>
> Add documentation for CONFIG_FIT_VERITY which allows U-Boot to
> construct dm-mod.create= and dm-mod.waitfor= kernel command-line
> parameters from dm-verity metadata embedded in FIT filesystem
> sub-images.
>
> The new document covers the relationship between FIT loadable indices
> and the /dev/fitN block devices that the Linux uImage.FIT block driver
> creates, provides a complete .its example with a dm-verity-protected
> SquashFS root filesystem, describes all required and optional dm-verity
> subnode properties and explains how mkimage generates the verity
> metadata automatically.
>
> dm-verity is only supported for external-data FIT images (mkimage -E);
> mkimage aborts with an error if the flag is omitted.
>
> Signed-off-by: Daniel Golle <daniel at makrotopia.org>

> diff --git a/doc/usage/fit/dm-verity.rst b/doc/usage/fit/dm-verity.rst
> @@ -0,0 +1,279 @@
> +Below is a minimal ``.its`` file showing a kernel and a dm-verity-protected
> +root filesystem packaged as a FIT. Only the three user-provided properties
> +(``algo``, ``data-block-size``, ``hash-block-size``) are included; ``mkimage``
> +computes and fills in ``digest``, ``salt``, ``num-data-blocks``, and
> +``hash-start-block`` automatically (see `Generating verity metadata`_ below)::
> +
> +                dm-verity {
> +                    data-block-size = <4096>;
> +                    hash-block-size = <4096>;
> +                    num-data-blocks = <3762>;
> +                    hash-start-block = <3762>;
> +                    algo = "sha256";
> +                    digest = [8e 67 91 63 7f 93 cb b8 ...];
> +                    salt = [aa 7b 11 f8 db 8f e2 e5 ...];
> +                };

The text says only the three user-provided properties are included,
but the example shows all properties including the computed ones.
Please can you either:

- Show a minimal .its with only algo, data-block-size, and
hash-block-size (matching what the user actually writes), or
- Add a note that this is the output after mkimage processing and show
the minimal input separately.

> diff --git a/doc/usage/fit/dm-verity.rst b/doc/usage/fit/dm-verity.rst
> @@ -0,0 +1,279 @@
> +4. Reads back the expanded file (original data + verity superblock +
> +   Merkle hash tree) and replaces the image's ``data`` property.

This contradicts the note at line 264-265 which correctly states that
--no-superblock is used. Please can you remove the reference to the
superblock here, since the code passes --no-superblock to veritysetup.

Regards,
Simon