Re: [PATCH 0/5] dm: Initial work on a device mapper

[Sascha Hauer <s.hauer@pengutronix.de>]

Hi Tobias,

On Thu, Aug 28, 2025 at 05:05:25PM +0200, Tobias Waldekranz wrote:
> Start work on adding a device mapper that is compatible with the
> corresponding subsystem in Linux.
> 
> This is the foundation of several higher level abstractions, for
> example:
> 
> - LVM: Linux Volume manager. Dynamically allocates logical volumes
>   from one or more storage devices, manages RAID arrays, etc.
> 
> - LUKS: Linux Unified Key Setup. Transparent disk
>   encryption/decryption.
> 
> - dm-verity: Transparent integrity checking of block devices.

That's great stuff. We are also interested especially in dm-verity as
that would allow us to get rid of separate partitions for the Kernel
image and maybe even the FIT image format we currently use whenever we
need signed Kernel images.

> 
> This is part of an exploratory project for investigating how we could
> boot Infix[1] in a more platform-independent way. I.e., my intention
> is to eventually add support for some of the features mentioned above,
> assuming we don't hit any major road blocks. The rest of this letter
> just gives context for how we got here and where we would like to take
> Barebox. If that is not interesting, feel free to stop reading here :)
> 
> Our idea is to relegate U-Boot to serve only as a UEFI firmware on the
> platforms where we can't escape it, and then do most of our boot logic
> in Barebox instead. Primarily we want to do this for two reasons:
> 
> 1. Being able to ship barebox as an EFI app means we can use the same
>    boot logic on x86 machines as we to on everything else.
> 
> 2. Barebox is a much higher quality code base to work in than
>    U-Boot. I'm sorry, but it just is.
> 
> Barebox would thus take the place occupied by systemd-boot in many
> distro setups. So why not go with systemd-boot?
> 
> 1. Infix does not run systemd as PID 1, so reusing their bootloader is
>    awkward.
> 
> 2. Infix ships as a single immutable filesystem image, including
>    kernel, DTBs, etc. So we want to extract these files from the
>    filesystem before booting the kernel. This is not supported by
>    systemd-boot, AFAIK - all boot files must live on the ESP.
> 
> 3. We would like to manage our devices' non-volatile storage with LVM,
>    and not be bound to a fixed partition table. This will give us more
>    flexibility in growing our image, efficiently having images of
>    varying sizes installed, etc.
> 
> Therefore, our plan is (roughly):
> 
> 1. Add dm-verity support
> 2. Add dm-verity root-hash-signature verification support
> 
> With that, we can securely extract kernel+DTB from our filesystem
> without having to sign them individually.

Ok, it seems we have the same goals ;)

> 
> 3. Add basic LVM support, no RAID or anything, just basic (linear)
>    logical volumes.
> 
> This will allow us to install multiple versions of Infix on individual
> logical volumes, which Barebox can then find and boot from.
> 
> 4. Add high-level helpers for working with DPS disks and DDI images.
> 
> I really like the Linux Userspace API Group's thinking around
> Discoverable Partitions Specification (DPS) and Discoverable Disk
> Images (DDI). I think it would be great if Barebox had knowledge about
> these patterns, and could automatically set up the dm-verity
> configuration for a partition when available, for example.

I haven't looked into this yet, but it sounds good. It's a good thing
when barebox can just do the right thing without much configuration.

> 
> My hope is that this plan sparks some ideas and reflections. If so, I
> would love to hear them. If not, sorry for the wall of text :)

Well I am very open for adding DM and dm-verity support to barebox. We
would likely have done it anyway at some point, but that could have
taken some time.

Sascha

-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |