kernel build: use %U+1 for dm-verity booting

mod_image_for_recovery.sh

 #!/bin/bash
 
 # Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 # This script modifies a base image to act as a recovery installer.
 # If no kernel image is supplied, it will build a devkeys signed recovery
 # kernel.  Alternatively, a signed recovery kernel can be used to
 # create a Chromium OS recovery image.
@@ skipping 167 matching lines @@
   local root_size=$(partsize "$FLAGS_image" 3)
 
   sudo losetup \
        -o $((root_offset * 512)) \
        --sizelimit $((root_size * 512)) \
        "$root_dev" \
        "$FLAGS_image"
 
   trap "sudo losetup -d $root_dev" EXIT
 
-  cros_root=/dev/sd%D%P
+  cros_root=/dev/sd%D%P  # only used for non-verified images
   if [[ "${ARCH}" = "arm" ]]; then
     cros_root='/dev/${devname}${rootpart}'
   fi
   if grep -q enable_rootfs_verification "${IMAGE_DIR}/boot.desc"; then
     cros_root=/dev/dm-0
   fi
   # TODO(wad) LOAD FROM IMAGE KERNEL AND NOT BOOT.DESC
   local verity_args=$(grep -- '--verity_' "${IMAGE_DIR}/boot.desc")
   # Convert the args to the right names and clean up extra quoting.
   # TODO(wad) just update these everywhere
@@ skipping 239 matching lines @@
 
 trap cleanup EXIT
 
 maybe_resize_stateful  # Also copies the image if needed.
 
 install_recovery_kernel
 
 echo "Recovery image created at $RECOVERY_IMAGE"
 print_time_elapsed
 trap - EXIT