[nrf fromtree] west: runners: nrfutil: Add key file when present to west flash command

[gchwier]

Added automatic KMU key provisioning for both NSIB and MCUboot.

Changes in zephyr allows to provision KMU keys with west flash command, if keyfile.json (generated by west ncs-provision) is in build directory.

In sdk-nrf (PR with manifest) added examples and Kconfigs to enable automatic keyfile generation during build process.

If Kconfig flas to automaticaly create keyfile.json is not enabled, one can still generate/modify keyfile.json in build directory and keys will be provisioned after flash

Build app with NSIB (can be added MCUboot with KMU etc)
west build -p -b nrf54l15dk/nrf54l15/cpuapp $ZEPHYR_BASE/samples/hello_world -d build-54l-nsib -- -DSB_CONFIG_SECURE_BOOT_APPCORE=y

Generate keyfile.json in build dir (west ncs-provision with --dry-run)
west ncs-provision upload --keyname BL_PUBKEY --key build-54l-nsib/GENERATED_NON_SECURE_SIGN_KEY_PRIVATE.pem --build-dir build-54l-nsib --dry-run

and flash (with --erase or --recover option)
west flash --skip-rebuild --erase -d build-54l-nsib

[carlescufi]

I really do not want this amount of out-of-tree code in this file. It will be a nightmare to keep in sync.
Our options are:

• Have everything, including provisioning, upstream (we could call it --provision instead). We already did something similar with the H20 SUIT support, where it was upstream although only needed for downstream
• Use an extension command west ncs-provision
• Change the bare minimum in this file, put the logic elsewhere

[gchwier]

I really do not want this amount of out-of-tree code in this file. It will be a nightmare to keep in sync. Our options are:

• Have everything, including provisioning, upstream
• Use an extension command west ncs-provision
• Change the bare minimum in this file, put the logic elsewhere

I fully agree, which is why I added the DNM label (unfortunately, I can't change the PR to draft status).

I created this as a POC to demonstrate how we can test a simple application without manual steps, eliminating the need for pytest harness in Twister.

Where is the issue with west ncs-provision?
west flash executes a reset after flashing, the application is then marked as "permanently invalidated". Calling west ncs-provision doesn't resolve the problem. Users need to flash with nrfutil (without reset), then call west ncs-provision, and finally reset the device.
This process will likely result in a poor user experience when trying to enable NSIB on the nRF54L.

FYI @nvlsianpu

[carlescufi]

west flash executes a reset after flashing,

There is a --no-reset option to west flash. Why can't you have a west ncs-provision that invokes west flash --no-reset and then does whatever you need to do?

[gchwier]

There is a --no-reset option to west flash. Why can't you have a west ncs-provision that invokes west flash --no-reset and then does whatever you need to do?

I forgot about --no-reset, it is an option for customer, then he can use:

1. west flash --erase/--recover --no-reset
2. west ncs-provision
3. nrfutil device reset

or

1. nrfutil device erase/recover
2. west ncs-provision
3. west flash

An option would be to extend west ncs-provision in sdk-nrf to call also west flash ... but it will not work with Twister .

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud