Re: [PATCH] hab: writing the same srk hash is not an error

[Ahmad Fatoum <a.fatoum@pengutronix.de>]

On 09.07.25 09:42, Stefan Kerkmann wrote:
> Before this commit writing the same srk hash twice failed with an error.
> This is inconsistent with other invocations of the hab tool e.g.: `hab
> -l -p` doesn't fail if the lockdown bit is already set.
> 
> So let's align the behavior by only throwing an error if we attempt to
> write a srk hash that is different from the one that is already burned.
> 
> Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>

Reviewed-by: Ahmad Fatoum <a.fatoum@pengutronix.de>

> ---
>  drivers/hab/hab.c | 9 +++++----
>  1 file changed, 5 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/hab/hab.c b/drivers/hab/hab.c
> index 4e9f96c98b619d12d069986aa688b92d48f3442c..1c747e8a3e52fdfc0240b5794fbffe9a2a562bb2 100644
> --- a/drivers/hab/hab.c
> +++ b/drivers/hab/hab.c
> @@ -470,12 +470,13 @@ int imx_hab_write_srk_hash(const void *buf, unsigned flags)
>  	}
>  
>  	if (imx_hab_srk_hash_valid(cursrk)) {
> -		char *str = "Current SRK hash is valid";
> -
>  		if (flags & IMX_SRK_HASH_FORCE) {
> -			pr_warn("%s, ignoring\n", str);
> +			pr_warn("Current SRK hash is valid, ignoring\n");
> +		} else if (memcmp(cursrk, buf, SRK_HASH_SIZE) == 0) {
> +			pr_info("Current SRK hash is equal, nothing to do\n");
> +			return 0;
>  		} else {
> -			pr_err("%s, refusing to burn again\n", str);
> +			pr_err("Current SRK hash is different, refusing to burn again\n");
>  			return -EEXIST;
>  		}
>  	}
> 
> ---
> base-commit: f49c873d7ec78a2df7bd3c7a86f5372fb1666517
> change-id: 20250709-fix-hab-equal-hash-writes-87c28792acf4
> 
> Best regards,


-- 
Pengutronix e.K.                           |                             |
Steuerwalder Str. 21                       | http://www.pengutronix.de/  |
31137 Hildesheim, Germany                  | Phone: +49-5121-206917-0    |
Amtsgericht Hildesheim, HRA 2686           | Fax:   +49-5121-206917-5555 |