Provisioning KMU data

nRF54L Series Production Programming

The key management unit (KMU) manages provisioning data and permission policy by copying from RAM to SICR.

Note: This procedure applies only to devices with a KMU. Skip it for nRF54LS05A and nRF54LS05B as they do not have a KMU.

Different nRF54L Series devices have different base address for the KMU and Resistive Random-Access Memory Controller (RRAMC). The following table lists the addresses for the different devices.

Table 1. Register overview
Register name nRF54L05, nRF54L10, nRF54L15 nRF54LM20A, nRF54LM20B, nRF54LV10A
KMU.SRC 0x50045504 0x50049504
KMU.KEYSLOT 0x50045500 0x50049500
KMU.TASKS_PROVISION 0x50045000 0x50049000
KMU.EVENTS_PROVISIONED 0x50045100 0x50049100
RRAMC.CONFIG 0x5004B500 0x5004E500
RRAMC.READY 0x5004B400 0x5004E400

Complete the following steps:

  1. Write the KMU SRC data struct as an array to RAM.
  2. Write the RAM address of the KMU SRC data to the KMU.SRC register.
  3. Write the target key slot ID to the KMU.KEYSLOT register.
  4. Set the CONFIG register of the RRAMC to WEN.Enabled by writing 0x1 to the RRAMC.CONFIG register.
  5. Read the RRAMC.READY register until the value is 0x1.
  6. Trigger KMU provision by writing 0x1 to the KMU.TASKS_PROVISION task.
  7. Read the KMU.EVENTS_PROVISIONED event until the value is 0x1.
  8. Clear the event by writing 0x0 to the KMU.EVENTS_PROVISIONED register.
  9. Repeat steps 1 to 8 for the required number of key slots to be provisioned.
  10. Write 0x0 to the RRAMC.CONFIG register.

The KMU data and permission policies are write-only and can therefore be verified only through a cryptographic operation during production testing.

The KMU data and permission policies can be erased only by using the CTRL-AP erase all operation.