nrf desktop autoprovisioning #23509

zycz · 2025-07-29T09:56:24Z

Updated the configurations of the nRF Desktop application for
board targets that store the MCUboot verification key in the KMU
peripheral. These nRF54L-based targets now use the automatic
provisioning feature that makes it possible to perform the KMU
provisioning together with the west flash operation. The provisioning
is only performed if the west flash command is executed with the
--erase or --recover flag.

NordicBuilder · 2025-07-29T09:59:27Z

CI Information

^{To view the history of this post, clich the 'edited' button above}
Build number: 12

Inputs:

Sources:

sdk-nrf: PR head: d6143a58ee58b5a0b1a013e0999723f208c51d1e

more details

sdk-nrf:

PR head: d6143a58ee58b5a0b1a013e0999723f208c51d1e
merge base: 2eaf262a3dafbcf9cfe417e608e878d65be34883
target head (main): 2eaf262a3dafbcf9cfe417e608e878d65be34883
Diff

Github labels

Enabled	Name	Description
	ci-disabled	Disable the ci execution
	ci-all-test	Run all of ci, no test spec filtering will be done
	ci-force-downstream	Force execution of downstream even if twister fails
	ci-run-twister	Force run twister
	ci-run-zephyr-twister	Force run zephyr twister

List of changed files detected by CI (18)

applications
│  ├── nrf_desktop
│  │  ├── bootloader_dfu.rst
│  │  ├── configuration
│  │  │  ├── nrf54l15dk_nrf54l05_cpuapp
│  │  │  │  ├── sysbuild_release.conf
│  │  │  │  ├── sysbuild_release_fast_pair.conf
│  │  │  │  │ sysbuild_release_keyboard.conf
│  │  │  ├── nrf54l15dk_nrf54l10_cpuapp
│  │  │  │  ├── sysbuild.conf
│  │  │  │  ├── sysbuild_fast_pair.conf
│  │  │  │  ├── sysbuild_keyboard.conf
│  │  │  │  │ sysbuild_release.conf
│  │  │  ├── nrf54l15dk_nrf54l15_cpuapp
│  │  │  │  ├── sysbuild.conf
│  │  │  │  ├── sysbuild_fast_pair.conf
│  │  │  │  ├── sysbuild_keyboard.conf
│  │  │  │  │ sysbuild_release.conf
│  │  ├── description.rst
│  │  ├── pytest
│  │  │  │ test_mcuboot_kmu.py
│  │  ├── sample.yaml
│  │  ├── sysbuild
│  │  │  │ CMakeLists.txt
doc
│  ├── nrf
│  │  ├── releases_and_maturity
│  │  │  ├── releases
│  │  │  │  │ release-notes-changelog.rst
scripts
│  │ quarantine_llvm.yaml

Outputs:

Toolchain

Version: 8ea1732c3a
Build docker image: docker-dtr.nordicsemi.no/sw-production/ncs-build:8ea1732c3a_bba2ea5f2e

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

◻️ Toolchain - Skipped: existing toolchain is used
✅ Build twister
- sdk-nrf test count: 49
✅ Integration tests
- ✅ desktop52_verification

Disabled integration tests

- doc-internal
- test_ble_nrf_config
- test-fw-nrfconnect-apps
- test-fw-nrfconnect-ble_mesh
- test-fw-nrfconnect-ble_samples
- test-fw-nrfconnect-chip
- test-fw-nrfconnect-fem
- test-fw-nrfconnect-nfc
- test-fw-nrfconnect-nrf-iot_cloud
- test-fw-nrfconnect-nrf-iot_libmodem-nrf
- test-fw-nrfconnect-nrf-iot_lwm2m
- test-fw-nrfconnect-nrf-iot_samples
- test-fw-nrfconnect-nrf-iot_serial_lte_modem
- test-fw-nrfconnect-nrf-iot_thingy91
- test-fw-nrfconnect-nrf-iot_zephyr_lwm2m
- test-fw-nrfconnect-nrf_crypto
- test-fw-nrfconnect-ps-main
- test-fw-nrfconnect-rpc
- test-fw-nrfconnect-rs
- test-fw-nrfconnect-tfm
- test-fw-nrfconnect-thread-main
- test-low-level
- test-sdk-audio
- test-sdk-dfu
- test-sdk-find-my
- test-sdk-mcuboot
- test-sdk-pmic-samples
- test-sdk-wifi
- test-secdom-samples-public

Note: This message is automatically posted and updated by the CI

peknis · 2025-07-29T09:59:01Z

applications/nrf_desktop/description.rst

Suggested change

For this purpose a set of private and public keys is needed.

For this purpose, a set of private and public keys is needed.

peknis · 2025-07-29T09:59:50Z

applications/nrf_desktop/description.rst

Suggested change

In this application, the application image is automatically signed with private key by the |NCS| build system.

In this application, the application image is automatically signed with a private key by the |NCS| build system.

you already mentioned in L1024 that the private key is used to sign the image so you can drop the "with a private key" i think

peknis · 2025-07-29T10:00:36Z

applications/nrf_desktop/description.rst

Suggested change

To store public key in KMU public key must first be provisioned.

To store the public key in the KMU, it must first be provisioned.

peknis · 2025-07-29T10:01:44Z

applications/nrf_desktop/description.rst

Suggested change

This ensures that both the firmware and the MCUboot public key are correctly programmed onto the target device using KMU-based key storage.

This ensures that both the firmware and the MCUboot public key are correctly programmed onto the target device using the KMU-based key storage.

github-actions · 2025-07-29T10:22:08Z

You can find the documentation preview for this PR here.

Preview links for modified nRF Connect SDK documents:

https://ncsdoc.z6.web.core.windows.net/PR-23509/nrf/releases_and_maturity/releases/release-notes-changelog.html
https://ncsdoc.z6.web.core.windows.net/PR-23509/nrf/applications/nrf_desktop/bootloader_dfu.html
https://ncsdoc.z6.web.core.windows.net/PR-23509/nrf/applications/nrf_desktop/description.html

mkapala-nordic · 2025-07-29T10:14:27Z

applications/nrf_desktop/description.rst

you already mentioned in L1024 that the private key is used to sign the image so you can drop the "with a private key" i think

applications/nrf_desktop/description.rst

mkapala-nordic · 2025-07-29T10:22:22Z

applications/nrf_desktop/sample.yaml

it is already in the applications.nrf_desktop.zdebug, is it needed also here?

Remove L05 from here.

It will fail during tests due to the missing log:

"dfu: Secondary image slot is clean"

applications.nrf_desktop.zdebug is build only - here we run tests with harness, so I intended it. However if we you think we should forfeit those tests we can talk it over.

applications/nrf_desktop/sample.yaml

kapi-no · 2025-07-29T10:45:11Z

applications/nrf_desktop/sample.yaml

Remove L05 from here.

It will fail during tests due to the missing log:

"dfu: Secondary image slot is clean"

applications/nrf_desktop/sysbuild/CMakeLists.txt

applications/nrf_desktop/bootloader_dfu.rst

applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/sysbuild.conf

applications/nrf_desktop/pytest/test_mcuboot_kmu.py

zycz · 2025-07-29T11:25:42Z

Couldn't respond to your comment directly :(
@mkapala-nordic

you already mentioned in L1024 that the private key is used to sign the image so you can drop the "with a private key" i think

I wanted in first place show what keys there are so user won't confuse them.
Second sentence tells that action of signing is conducted automatically.

If you strongly disagree with it please propose alternative :)

peknis · 2025-07-29T12:07:04Z

applications/nrf_desktop/bootloader_dfu.rst

Suggested change

See the :ref:`ug_nrf54l_developing_provision_kmu` documenta`tion for details.

See the :ref:`ug_nrf54l_developing_provision_kmu` documentation for details.

peknis · 2025-07-29T12:07:43Z

applications/nrf_desktop/bootloader_dfu.rst

Suggested change

To use automatic provisioning, enable the ``SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE``

To use automatic provisioning, enable the ``SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE`` Kconfig option.

peknis · 2025-07-29T12:08:32Z

applications/nrf_desktop/bootloader_dfu.rst

Suggested change

The automatic provisioning is only performed if the west flash command is executed with the --erase or --recover flag.

The automatic provisioning is only performed if the west flash command is executed with the ``--erase`` or ``--recover`` flag.

peknis · 2025-07-29T12:09:18Z

applications/nrf_desktop/description.rst

Suggested change

.. parsed-literal::

:class: highlight

west flash --recover

.. parsed-literal::

:class: highlight

west flash --recover

nordicjm · 2025-07-29T12:44:10Z

applications/nrf_desktop/bootloader_dfu.rst

Suggested change

To use automatic provisioning, enable the ``SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE`` Kconfig option.

To use automatic provisioning, enable the :kconfig:option:`SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE` sysbuild Kconfig option.

The rendered docs still do not allow me to click on the option label and navigate to the Kconfig search page. @nordicjm, are you sure that it works?

See.

https://ncsdoc.z6.web.core.windows.net/PR-23509/nrf/applications/nrf_desktop/bootloader_dfu.html

and the SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE label in the incorrectly rendered ..note::

it won't be searchable because only non-sysbuild Kconfigs are shown in the search, that's a different issue, however it highlights that it is a Kconfig option

@nordicjm : All the sysbuild configurations are represented in double backticks, unlike the other normal Kconfig options, because these options are not in the Kconfig search and hence don't link. Please see some examples here:

https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/app_dev/config_and_build/sysbuild/zephyr_samples_sysbuild.html

https://docs.nordicsemi.com/bundle/ncs-latest/page/nrf/releases_and_maturity/migration/migration_sysbuild.html#network_core

The earlier representation was correct.

That is used for sysbuild Kconfigs too in zephyr, see https://github.com/zephyrproject-rtos/zephyr/blob/main/doc/releases/release-notes-4.2.rst?plain=1#L261

@divipillai https://builds.zephyrproject.io/zephyr/pr/93861/docs/kconfig.html#!%5ESB_CONFIG_BOO so let's not continue with the wrong usage of backticks

Do we plan to implement the same for the Kconfig search in NCS as well in the future - https://docs.nordicsemi.com/bundle/ncs-latest/page/kconfig/index.html?

https://ncsdoc.z6.web.core.windows.net/PR-23535/kconfig/index.html#!%5ESB_CONFIG_
feel free to review/approve:
nrfconnect/sdk-zephyr#3106
#23535

Thank you @nordicjm. This was quick. The sysbuild Kconfig options now link as well. Tested a few doc pages and works fine. We will fix the syntax to ":kconfig:option:`SB" for other sysbuild config options in a separate PR. We already have a Jira open by Jan for nRF desktop.

nordicjm · 2025-07-29T12:44:26Z

applications/nrf_desktop/bootloader_dfu.rst

fix here too

nordicjm · 2025-07-29T12:45:42Z

applications/nrf_desktop/description.rst

fix as above

nordicjm · 2025-07-29T12:46:01Z

doc/nrf/releases_and_maturity/releases/release-notes-changelog.rst

fix as above

applications/nrf_desktop/bootloader_dfu.rst

applications/nrf_desktop/sysbuild/CMakeLists.txt

kapi-no · 2025-07-29T13:32:33Z

@nordicjm, can we convert documentation mentions of sysbuild Kconfig options in a dedicated PR using the scheme you requested?

Currently, @zycz changed a few sysbuild Kconfigs in the nRF Desktop documentation. However, docs still contain hundreds sysbuild Kconfig mentions formatted with the old syntax. It would be good to align this in one go. @zycz, could you create a ticket for that?

nordicjm · 2025-07-29T13:34:46Z

We shouldn't be adding new wrong usage of options, the old ones exist because previously :kconfig:option: could only reference non-sysbuild Kconfigs and would error out, but that has been fixed

zycz · 2025-07-29T14:48:30Z

@nordicjm, can we convert documentation mentions of sysbuild Kconfig options in a dedicated PR using the scheme you requested?

Currently, @zycz changed a few sysbuild Kconfigs in the nRF Desktop documentation. However, docs still contain hundreds sysbuild Kconfig mentions formatted with the old syntax. It would be good to align this in one go. @zycz, could you create a ticket for that?

ticket: https://nordicsemi.atlassian.net/browse/NCSDK-34617

applications/nrf_desktop/bootloader_dfu.rst

nordicjm · 2025-07-30T12:26:08Z

applications/nrf_desktop/description.rst

fix this reference in a separate pr

github-actions · 2025-07-31T13:54:12Z

Since quarantine was modified, please make sure you are following the process described in Quarantine Process.

Updated the configurations of the nRF Desktop application for board targets that store the MCUboot verification key in the KMU peripheral. These nRF54L-based targets now use the automatic provisioning feature that makes it possible to perform the KMU provisioning together with the west flash operation. The provisioning is only performed if the ``west flash`` command is executed with the ``--erase`` or ``--recover`` flag. Aligned the sample documentation with this change. JIRA: NCSDK-34240 Signed-off-by: Jan Zyczkowski <[email protected]>

Remove obsolete test_mcuboot_kmu.py used for KMU key provisioning. The pytest file `test_mcuboot_kmu.py`, previously used to provision KMU keys, has been removed. KMU key provisioning is now handled automatically when running the `west flash --recover` command. Additionally, the `sample.yaml` file was updated to reflect this change. JIRA: NCSDK-34240 Signed-off-by: Jan Zyczkowski <[email protected]>

kapi-no · 2025-08-01T06:43:26Z

applications/nrf_desktop/description.rst

-The public key that MCUboot uses to validate the application image is securely stored in the hardware Key Management Unit (KMU).
-In this use case, the application image is automatically signed by the |NCS| build system.
-However, the public key is not automatically provisioned to the device when programming the bootloader and the application images using the ``west flash`` command.
+For this purpose, a set of private and public keys is needed.


Enabling hardware crypto does not require the bootloader to use a private/public key. The bootloader uses it regardless of whether HW crypto is used or not.

It may be improved in a follow-up PR. Merging this one at @zycz request

zycz requested review from a team as code owners July 29, 2025 09:56

github-actions bot added the doc-required PR must not be merged without tech writer approval. label Jul 29, 2025

peknis requested changes Jul 29, 2025

View reviewed changes

mkapala-nordic reviewed Jul 29, 2025

View reviewed changes

kapi-no requested changes Jul 29, 2025

View reviewed changes

kapi-no reviewed Jul 29, 2025

View reviewed changes

applications/nrf_desktop/configuration/nrf54l15dk_nrf54l15_cpuapp/sysbuild.conf Outdated Show resolved Hide resolved

kapi-no reviewed Jul 29, 2025

View reviewed changes

applications/nrf_desktop/pytest/test_mcuboot_kmu.py Outdated Show resolved Hide resolved

zycz force-pushed the issue34240_autoprovisioning branch from 320b6f1 to d4a9db6 Compare July 29, 2025 12:03

zycz requested review from kapi-no, mkapala-nordic and peknis July 29, 2025 12:03

peknis requested changes Jul 29, 2025

View reviewed changes

mkapala-nordic approved these changes Jul 29, 2025

View reviewed changes

zycz force-pushed the issue34240_autoprovisioning branch from d4a9db6 to ab2763b Compare July 29, 2025 12:17

zycz requested a review from peknis July 29, 2025 12:17

peknis approved these changes Jul 29, 2025

View reviewed changes

nordicjm requested changes Jul 29, 2025

View reviewed changes

zycz force-pushed the issue34240_autoprovisioning branch from ab2763b to 8496243 Compare July 29, 2025 13:05

zycz requested a review from nordicjm July 29, 2025 13:05

kapi-no reviewed Jul 29, 2025

View reviewed changes

applications/nrf_desktop/bootloader_dfu.rst Outdated Show resolved Hide resolved

applications/nrf_desktop/sysbuild/CMakeLists.txt Outdated Show resolved Hide resolved

zycz force-pushed the issue34240_autoprovisioning branch from 8496243 to 6261716 Compare July 29, 2025 15:03

zycz force-pushed the issue34240_autoprovisioning branch from 6261716 to cea2e2b Compare July 29, 2025 15:06

zycz requested a review from kapi-no July 29, 2025 15:06

kapi-no approved these changes Jul 30, 2025

View reviewed changes

applications/nrf_desktop/bootloader_dfu.rst Outdated Show resolved Hide resolved

zycz force-pushed the issue34240_autoprovisioning branch 3 times, most recently from d6e92e5 to da2ae4b Compare July 30, 2025 09:11

nordicjm approved these changes Jul 30, 2025

View reviewed changes

applications/nrf_desktop/description.rst Outdated

Copy link

Contributor

nordicjm Jul 30, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

fix this reference in a separate pr

kapi-no added this to the 3.1.0 milestone Jul 31, 2025

zycz force-pushed the issue34240_autoprovisioning branch from da2ae4b to ced0ca8 Compare July 31, 2025 13:53

zycz requested a review from a team as a code owner July 31, 2025 13:53

zycz added 2 commits July 31, 2025 17:48

zycz force-pushed the issue34240_autoprovisioning branch from ced0ca8 to d6143a5 Compare July 31, 2025 15:49

miha-nordic approved these changes Jul 31, 2025

View reviewed changes

nordic-piks approved these changes Aug 1, 2025

View reviewed changes

kapi-no approved these changes Aug 1, 2025

View reviewed changes

kapi-no merged commit 9b5a8c2 into nrfconnect:main Aug 1, 2025
20 checks passed

zycz deleted the issue34240_autoprovisioning branch August 1, 2025 06:44

	For this purpose a set of private and public keys is needed.
	For this purpose, a set of private and public keys is needed.

	In this application, the application image is automatically signed with private key by the \|NCS\| build system.
	In this application, the application image is automatically signed with a private key by the \|NCS\| build system.

	To store public key in KMU public key must first be provisioned.
	To store the public key in the KMU, it must first be provisioned.

	This ensures that both the firmware and the MCUboot public key are correctly programmed onto the target device using KMU-based key storage.
	This ensures that both the firmware and the MCUboot public key are correctly programmed onto the target device using the KMU-based key storage.

	See the :ref:`ug_nrf54l_developing_provision_kmu` documenta`tion for details.
	See the :ref:`ug_nrf54l_developing_provision_kmu` documentation for details.

	To use automatic provisioning, enable the ``SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE``
	To use automatic provisioning, enable the ``SB_CONFIG_MCUBOOT_GENERATE_DEFAULT_KMU_KEYFILE`` Kconfig option.

	The automatic provisioning is only performed if the west flash command is executed with the --erase or --recover flag.
	The automatic provisioning is only performed if the west flash command is executed with the ``--erase`` or ``--recover`` flag.

-   .. parsed-literal::
-      :class: highlight
-      west flash --recover
+.. parsed-literal::
+   :class: highlight
+   west flash --recover

Uh oh!

nrf desktop autoprovisioning #23509

nrf desktop autoprovisioning #23509

Uh oh!

Conversation

zycz commented Jul 29, 2025

Uh oh!

NordicBuilder commented Jul 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CI Information

Inputs:

Sources:

Github labels

Outputs:

Toolchain

Test Spec & Results: ✅ Success; ❌ Failure; 🟠 Queued; 🟡 Progress; ◻️ Skipped; ⚠️ Quarantine

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jul 29, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

zycz commented Jul 29, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

divipillai Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

NordicBuilder commented Jul 29, 2025 •

edited

Loading

divipillai Jul 30, 2025 •

edited

Loading

kapi-no Aug 1, 2025 •

edited

Loading