diff --git a/keymaster/4.0/support/Keymaster.cpp b/keymaster/4.0/support/Keymaster.cpp
index 9325cc0699..e8db0744e1 100644
--- a/keymaster/4.0/support/Keymaster.cpp
+++ b/keymaster/4.0/support/Keymaster.cpp
@@ -106,6 +106,19 @@ std::vector<std::unique_ptr<Keymaster>> enumerateDevices(
     return result;
 }
 
+void Keymaster::logIfKeymasterVendorError(ErrorCode ec) const {
+    static constexpr int32_t k_keymaster_vendor_error_code_range_max = -10000;
+    if (static_cast<int32_t>(ec) <= k_keymaster_vendor_error_code_range_max) {
+        const auto& versionInfo = halVersion();
+        LOG(ERROR) << "Keymaster reported error: " << static_cast<int32_t>(ec) << "\n"
+                   << "NOTE: This is an error in the vendor specific error range.\n"
+                   << "      Refer to the vendor of the implementation for details.\n"
+                   << "      Implementation name: " << versionInfo.keymasterName << "\n"
+                   << "      Vendor name:         " << versionInfo.authorName << "\n"
+                   << "      MajorVersion:        " << versionInfo.majorVersion;
+    }
+}
+
 Keymaster::KeymasterSet Keymaster::enumerateAvailableDevices() {
     auto serviceManager = IServiceManager::getService();
     CHECK(serviceManager) << "Could not retrieve ServiceManager";
diff --git a/keymaster/4.0/support/include/keymasterV4_0/Keymaster.h b/keymaster/4.0/support/include/keymasterV4_0/Keymaster.h
index 458053a4ea..43a34b055b 100644
--- a/keymaster/4.0/support/include/keymasterV4_0/Keymaster.h
+++ b/keymaster/4.0/support/include/keymasterV4_0/Keymaster.h
@@ -64,6 +64,12 @@ class Keymaster : public IKeymasterDevice {
     const hidl_string& descriptor() const { return descriptor_; }
     const hidl_string& instanceName() const { return instanceName_; }
 
+    /**
+     * If ec is in the vendor error code range (<-10000), logs the fact to logcat.
+     * There are no side effects otherwise.
+     */
+    void logIfKeymasterVendorError(ErrorCode ec) const;
+
     /**
      * Returns all available Keymaster3 and Keymaster4 instances, in order of most secure to least
      * secure (as defined by VersionResult::operator<).