[nrf noup] bootutil: Add error log on KMU not provisioned #435
Conversation
hellesvik-nordic
force-pushed
the
kmu_no_key_error_log
branch
from
c5c2466 to
01efde1
Compare
boot/bootutil/src/ed25519_psa.c
Outdated
| @@ -126,6 +126,9 @@ int ED25519_verify(const uint8_t *message, size_t message_len, | |||
| } | |||
|
|
|||
| BOOT_LOG_ERR("ED25519 signature verification failed %d", status); | |||
| if(status == PSA_ERROR_INVALID_HANDLE) { | |||
| BOOT_LOG_ERR("PSA_ERROR_INVALID_HANDLE(-136) could mean that the KMU slot is not provisioned."); | |||
There was a problem hiding this comment.
| BOOT_LOG_ERR("PSA_ERROR_INVALID_HANDLE(-136) could mean that the KMU slot is not provisioned."); | |
| BOOT_LOG_ERR("PSA ED25519 signature failed (-136), unknown key ID"); |
Are you sure we want to be that verbose? Non KMU specific message could actually be brought upstream too.
There was a problem hiding this comment.
I would argue that we want users to think "Oh I need to provision the KMU" when reading the message, so at the very least the KMU should be mentioned.
This function is also KMU specific (inside the elif) so I think it makes sense to mention the KMU in the log.
hellesvik-nordic
force-pushed
the
kmu_no_key_error_log
branch
from
01efde1 to
ade6a05
Compare
|
@de-nordic, I added CONFIG_MCUBOOT_SETUP_VALIDATION, which might be what we talked about. What do you think about this? |
hellesvik-nordic
force-pushed
the
kmu_no_key_error_log
branch
from
ade6a05 to
70ddb36
Compare
|
After discussing with @de-nordic directly, we concluded that this change will not need a Kconfig option, as this is a one-off extra log to catch a very common error case. |
Checks if the KMU has been provisioned, and add extra log if it has not. Error 136 could theoretically be caused by something else, so the extra logs is not phrased in a absolute manner. Fixes: NCSDK-33559 Signed-off-by: Sigurd Hellesvik <sigurd.hellesvik@nordicsemi.no>
hellesvik-nordic
force-pushed
the
kmu_no_key_error_log
branch
from
70ddb36 to
3a6fbc1
Compare
|
An unprovisioned KMU can cause confusion, so improve the logs for this case.