nRF54L15 - unable to provision key

[Igor]

I get error provisioning key on nRF54L15 and NCS 3.0.1. I tried using "Erase all" in nRF connect SDK Programmer, but it doesn't help. Please check also the attached log.
nrf54l15dk/nrf54l15/cpuapp/ns is used.

PS H:\cup> python H:/ncs/v3.0.1/bootloader/mcuboot/scripts/imgtool.py keygen -t ed25519 -k private_key.pem
PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem                                                                                                                    
nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_j8mc7y15\keyfile.json --traits jlink
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)


Uploading failed!
PS H:\cup> nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_j8mc7y15\keyfile.json --traits jlink --log-level trace --log-output stdout --json > log.txt                              
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)

sysbuild.conf:

SB_CONFIG_BOOTLOADER_MCUBOOT=y
SB_CONFIG_BOOT_SIGNATURE_KEY_FILE="\${APP_DIR}/private_key.pem"
SB_CONFIG_MCUBOOT_SIGNATURE_USING_KMU=y
SB_CONFIG_BOOT_SIGNATURE_TYPE_ED25519=y

prj.conf:

CONFIG_NCS_SAMPLES_DEFAULTS=y

CONFIG_BT=y
CONFIG_BT_PERIPHERAL=y
CONFIG_BT_DEVICE_NAME="nRF54L15-PDK"

# Enable the LBS service
CONFIG_BT_LBS=y
CONFIG_BT_LBS_POLL_BUTTON=y
CONFIG_DK_LIBRARY=y

CONFIG_SYSTEM_WORKQUEUE_STACK_SIZE=2048

# Enable FOTA over Bluetooth LE
CONFIG_NCS_SAMPLE_MCUMGR_BT_OTA_DFU=y

Output on a virtual COM port:

*** Booting MCUboot v2.1.0-dev-ae1ee57f3906 ***
*** Using nRF Connect SDK v3.0.1-9eb5615da66b ***
*** Using Zephyr OS v4.0.99-77f865b8f8d0 ***
I: Starting bootloader
I: Primary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Secondary image: magic=unset, swap_type=0x1, copy_done=0x3, image_ok=0x3
I: Boot source: none
I: Image index: 0, Swap type: none
E: ED25519 signature verification failed -136
E: Image in the primary slot is not valid!
E: Unable to find bootable image

0675.log.txt

[AHaug]

Hello,

Looks like you're missing a command in https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/device_guides/nrf54l/kmu_provision.html, i.e the erase command in between generating the key and uploading the key

Let me know if this changes anything.

Kind regards,
Andreas

[Igor]

Erase does not help.

PS H:\cup> python H:\ncs\v3.0.1\bootloader/mcuboot/scripts/imgtool.py keygen -t ed25519 -k private_key.pem
PS H:\cup> nrfutil device erase --all
v Erased 1057746146
PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem
nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_2twnst4d\keyfile.json --traits jlink
Error: One or more key provisioning tasks failed:
 * 1057746146: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)


Uploading failed!

[sbarnowski]

I am also on ENGB silicon. Trying to do this on NCS v3.0.2.

[AHaug]

Hi,

Igor said:

According to your link, this seems to be Engineering B and NOT supported in NCS 3.

This is correct, Engineering B is not supported. Apologies for not suggesting this before and simply assuming you were using Rev 1... Again thank you Sebastian for bringing this up.

Igor said:

This SoC is part of PCA10156 0.8.1 2024.41. I would like to point out that some other person from Nordic assured me it is compatible, but obviously isn't....

Ah, I see where the fault has happened. There's a mismatch in https://docs.nordicsemi.com/bundle/ncs-3.0.0/page/nrf/app_dev/device_guides/nrf54l/index.html w.r.t the supported device.

1. This link comp matrix for DK and SDK states that 0.8.1 DK/PDK uses engineering B, i.e it's a PDK
2. This link Comp matrix for SoC version and SDK says that 0.8.1 is not usable after NCS v2.8.0
3. The documentation/guide for getting started with 54L15, i.e https://docs.nordicsemi.com/bundle/ncs-3.0.0/page/nrf/app_dev/device_guides/nrf54l/index.html states that you can use nRF54L15 PDK, which is a fault in the documentation. I believe you (as well as potentially other including myself) have been mislead by this..

Igor said:

I downgraded to NCS 2.9.1 and it works. So it seems to be something related to NCS 3.0
SoC is N54L15 QFAABB 2433AA.

The fact that it works for NCS v2.9.1 is interesting though... My best hypothesis is that rev 0.8.1 was not tested/tagged to be supported in NCS v2.9.1 (hence the lack of mentioning this device in the support matrix), but that the silicon on 0.8.1 and 0.9.1 are similar enough that it's still compatible (for atleast some things) in NSC v2.9.1

I will create a Tech doc ticket to review and update this immediately and verify if my reasoning based on the Datasheet docs (1. and 2.) overrules the development guide doc (3.)

Kind regards,
Andreas

[Igor]

According to Developing with nRF54L Series there is also a nRF54L15 DK v0.9.3 but it is not even mentioned in compatibility matrix. Please fix also that.

[AHaug]

I've added that to the tech doc ticket now,

Kind regards,
andreas

[Igor]

Now I got a new DK ver 0.9.3 (not even mentioned in compatibility matrix). It has SoC QFAAC0 (also missing in compatibility matrix). 
However, it still doesn't work with NCS 3.0.1. I tried also with NCS 3.0.2 (also not mentioned in compatibility matrix) but I get the same result.
After manual nrfutil upgrade it seems to work, despite the fact that the nrfutil version seems to be the same.

 AHaug  Please:
- update compatibility matrix with the mentioned DK, SoC and NCS versions
- clarify documentation regarding nrfutil version

PS H:\cup> imgtool keygen -t ed25519 -k private_key3.pem

PS H:\cup> nrfjprog --recover
Recovering device. This operation might take 30s.
Erasing user code and UICR flash areas.

PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem 
nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_mu8r74uh\keyfile.json --traits jlink
Error: One or more key provisioning tasks failed:
 * 1057783423: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)

Uploading failed!

PS H:\cup> nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_mu8r74uh\keyfile.json --traits jlink --log-level trace --log-output stdout --json > log.txt
Error: One or more key provisioning tasks failed:
 * 1057783423: [Probe] Device error: Tried to provision 1 keys, 1 keyslot(s) failed to be provisioned (Generic)

PS H:\cup> nrfutil --version                                                                                                                                           
nrfutil 7.13.0 (8289424 2024-07-01)
commit-hash: 82894242d19ff24a1541712312b3ea3af0ca8f85
commit-date: 2024-07-01
host: x86_64-pc-windows-msvc
build-timestamp: 2024-07-01T07:37:50.864803700Z
classification: nrf-external

PS H:\cup> nrfutil upgrade  
Downloading nrfutil-device-x86_64-pc-windows-msvc-2.11.2
Verifying nrfutil-device-x86_64-pc-windows-msvc-2.11.2
Updating nrfutil-device to 2.11.2
nrfutil-nrf5sdk-tools is already the newest version (1.1.0)
Downloading nrfutil-suit-x86_64-pc-windows-msvc-0.9.0
Verifying nrfutil-suit-x86_64-pc-windows-msvc-0.9.0
Updating nrfutil-suit to 0.9.0
nrfutil-toolchain-manager is already the newest version (0.15.0)
[00:00:04] ###### 100% [Upgrade packages] Upgrade packages       

PS H:\cup> nrfutil --version
nrfutil 7.13.0 (8289424 2024-07-01)
commit-hash: 82894242d19ff24a1541712312b3ea3af0ca8f85
commit-date: 2024-07-01
host: x86_64-pc-windows-msvc
build-timestamp: 2024-07-01T07:37:50.864803700Z
classification: nrf-external

PS H:\cup> west ncs-provision upload -s nrf54l15 -k private_key.pem
nrfutil device x-provision-keys --key-file [redacted]\Temp\nrfutil_w7l429m0\keyfile.json --traits jlink
Uploaded

[AHaug]

Hello,

Maybe the SoC version vs SDK was a red herring and the issue was nrfutil device version (tool used by nrfutil for programming). I see in L29 in the terminal window attached that nrfutil-device is uppgraded to v2.11.2, meaning that you might've had a nrfutil device version that were too old. 

I don't assume that you do, but do you know the version you previously had? sbarnowski do you know which version of nrfutil device you're running that does not work for NCS v3.0.0 but did work for NCS 2.9.1 (check with 'nrfutil device --version')?

Nonetheless I will add a comment w.r.t to the internal ticket.

Kind regards,
Andreas

[Igor]

In my previous post you can see:

1. get version
2. manual upgrade
3. get version

I don't see the difference in nrfutil versions. But you can see that nrfutil-device-x86_64-pc-windows-msvc-2.11.2  and nrfutil-suit-x86_64-pc-windows-msvc-0.9.0 was downloaded.
I don't know why versions of all installed components are not displayed.

Here is the version of the current nrfutil device. I have no idea what was the version before. The only thing that I can tell you is that, according to my logs, it was installed between 10th and 20th March this year.

PS H:\cup\build_1> nrfutil device --version
nrfutil-device 2.11.2 (481d897 2025-05-26)
commit-hash: 481d897514d9cdb5b565c726e709cca667a0985c
commit-date: 2025-05-26
host: x86_64-pc-windows-msvc
build-timestamp: 2025-05-26T11:20:01.692223900Z
classification: nrf-external

Detected SEGGER J-Link version: JLink_V8.40

The device command version you are currently using was tested with a different J-Link version (JLink_V8.18) than the one you have installed (JLink_V8.40). The tested version is not required, and your J-Link version will most likely work fine. If you get issues related to J-Link with your devices, use the tested version.