nRF54L15 - unable to provision key

[Igor]

I get error provisioning key on nRF54L15 and NCS 3.0.1. I tried using "Erase all" in nRF connect SDK Programmer, but it doesn't help. Please check also the attached log.
nrf54l15dk/nrf54l15/cpuapp/ns is used.

PS H:\cup> python H:/ncs/v3.0.1/bootloader/mcuboot/scripts/imgtool.py keygen -t ed25519 -k private_key.pem
PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem                                                                                                                    
nrfutil device x-provision-keys --key-file C:\Users\IgorGorjanc\AppData\Local\Temp\nrfutil_j8mc7y15\keyfile.json --traits jlink
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)


Uploading failed!
PS H:\cup> nrfutil device x-provision-keys --key-file C:\Users\IgorGorjanc\AppData\Local\Temp\nrfutil_j8mc7y15\keyfile.json --traits jlink --log-level trace --log-output stdout --json > log.txt                              
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)

sysbuild.conf:

SB_CONFIG_BOOTLOADER_MCUBOOT=y
SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APP_DIR}/private_key.pem"
SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU=y
SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y

prj.conf:

CONFIG_NCS_SAMPLES_DEFAULTS=y

CONFIG_BT=y
CONFIG_BT_PERIPHERAL=y
CONFIG_BT_DEVICE_NAME="nRF54L15-PDK"

# Enable the LBS service
CONFIG_BT_LBS=y
CONFIG_BT_LBS_POLL_BUTTON=y
CONFIG_DK_LIBRARY=y

CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=2048

# Enable FOTA over Bluetooth LE
CONFIG_NCS_SAMPLE_MCUMGR_BT_OTA_DFU=y

Output on a virtual COM port:

*** Booting MCUboot v2.1.0-dev-ae1ee57f3906 ***
*** Using nRF Connect SDK v3.0.1-9eb5615da66b ***
*** Using Zephyr OS v4.0.99-77f865b8f8d0 ***
I: Starting bootloader
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
E: ED25519 signature verification failed -136
E: Image in the primary slot is not valid!
E: Unable to find bootable image

4628.log.txt

[AHaug]

Hello,

Looks like you're missing a command in https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf54l/kmu_provision.html, i.e the erase command in between generating the key and uploading the key

Let me know if this changes anything.

Kind regards,
Andreas

[Igor]

Erase does not help.

PS H:\cup> python H:\ncs\v3.0.1\bootloader/mcuboot/scripts/imgtool.py keygen -t ed25519 -k private_key.pem
PS H:\cup> nrfutil device erase --all
v Erased 1057746146
PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem
nrfutil device x-provision-keys --key-file C:\Users\IgorGorjanc\AppData\Local\Temp\nrfutil_2twnst4d\keyfile.json --traits jlink
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)


Uploading failed!

[AHaug]

Fair enough, you also mentioned that you used the erase in VS Code as well.

Could you go through the steps you used to generate the JSON-key-file in the last step "nrfutil device x-provision-keys --serial-number <snr> --key-file <JSON-key-file>" just so we have the same foundation for recreating if the docs works or not?

Kind regards,
Andreas

[Igor]

I still get the same error.

PS H:\cup> nrfutil device erase --all                                                                                          
v Erased 1057746146
PS H:\cup> openssl genpkey -algorithm Ed25519 -out private_key.pem                                           
PS H:\cup> openssl pkey -in private_key.pem -pubout -out public_key.pem
PS H:\cup> python H:\ncs\v3.0.1\nrf\scripts\generate_psa_key_attributes.py --usage VERIFY_MESSAGE_EXPORT --id 0x40022100 --type ECC_TWISTED_EDWARDS --size 255 --algorithm EDDSA_PURE --location LOCATION_CRACEN --key-from-file public_key.pem  --file keys.json --cracen_usage RAW --lifetime PERSISTENCE_DEFAULT
PS H:\cup> nrfutil device x-provision-keys --serial-number 1057746146 --key-file keys.json    
x Failed to provision keys on 1057746146, [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)

[AHaug]

Hi again,

I'm struggling with recreating this from my end i.e it does not fail here. 

I'm sorry to ask you once more, but could you retrace this from the start and following the details in details.

If it does not work, I suspect there might be an issue with the OS used and I'll file a 

Kind regards,
Andreas