Skip to content

[nrf noup] bootutil: Add error log on KMU not provisioned #435

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

[nrf noup] bootutil: Add error log on KMU not provisioned #435

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions boot/bootutil/src/ed25519_psa.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -126,6 +126,9 @@ int ED25519_verify(const uint8_t *message, size_t message_len,
}

BOOT_LOG_ERR("ED25519 signature verification failed %d", status);
if(status == PSA_ERROR_INVALID_HANDLE) {
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

space between if and bracket in c

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

will only appear on someone's board who doesn't know what they are doing or doesn't read documentation

For these two, I would say that we should still warn for this case, as users who just program a sample can get this error. But then you say:

or doesn't use the new (default) kconfig that is being added to automatically provision things

And with this, Im not sure that this warning is needed after all.
The use-case for this PR is the following:

"I think that users should be able to enable a bootloader in any project without having to have a full overview over everything that happens. If the default case is that they need to provision manually, then pretty much everyone will get an error first time they try, and we should then tell them that they need to provision, so not everyone has to spend an hour reading docs to find the line saying they should provision."

However, if the devices will be automatically provisioned by default, then I think we can expect users that set CONFIG_MANUAL_PROVISION or whatever should understand the consequence of this, and the use-case for this PR is no longer valid.

@nordicjm Do I understand correctly that from v3.1.0 and onwards, the nRF54L15 KMU will be provisioned when I run "west flash", so that both MCUboot and NSIB will run without any issues first try?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if it's 3.1.0 or how it fully works because not tried running it manually myself but PR is nrfconnect/sdk-nrf#22516

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That is good enough for me.
I will close this PR, and then test the new provisioning feature with "west flash" when that is ready to verify that it indeed solves the problem I see.

BOOT_LOG_ERR("This error(-136) could mean that the KMU slot is not provisioned.");
}
}

return ret;
Expand Down