[NRF54L15-KMU] Clarification on KMU slot-id

RE: [NRF54L15-KMU] Clarification on KMU slot-id

Hung Bui — Wed, 18 Feb 2026 12:55:39 GMT

Hi Alessandro,

Sorry for the late reply.

Thanks for pointing out. I agree that the documentation need to be clearer.
My understanding from this is that when both MCUBoot and NSIB are used then the keyname should follow what stated there (MCUBoot uses UROT_PUBKEY, NSIB uses BL_PUBKEY).
But when MCUBoot is used without NSIB, it's considered immutable bootloader and should use BL_PUBKEY.

RE: [NRF54L15-KMU] Clarification on KMU slot-id

longo92 — Mon, 16 Feb 2026 14:58:49 GMT

Don't worry, no emergency stuff :)

RE: [NRF54L15-KMU] Clarification on KMU slot-id

Elfving — Mon, 16 Feb 2026 14:57:31 GMT

Hi Alessandro, Hung is OOO for a few days.

Are you able to wait with this reply until he is back, or is this matter more urgent for you?

Regards,

Elfving

RE: [NRF54L15-KMU] Clarification on KMU slot-id

longo92 — Wed, 11 Feb 2026 11:54:45 GMT

Could you align https://docs.nordicsemi.com/bundle/ncs-3.2.1/page/nrf/app_dev/device_guides/nrf54l/kmu_provision.html with how is written in https://docs.nordicsemi.com/bundle/ncs-3.2.1/page/nrf/releases_and_maturity/releases/release-notes-3.2.0.html#mcuboot, still the following (wrong) sentence:

"For MCUboot, take note of the following:
- UROT_PUBKEY is the key name used by MCUboot."

RE: [NRF54L15-KMU] Clarification on KMU slot-id

Hung Bui — Tue, 10 Feb 2026 13:15:45 GMT

Thanks for the trick that helps 👍. Learned something today 👍
Now I can see the script.
I wasn't paying attention to the --dry-run argument in west ncs-provision upload, thought that it's the actual command to write the key to the KMU which should happen when we flash the chip not when building.

All good now. Let us know if you have any follow up question.

RE: [NRF54L15-KMU] Clarification on KMU slot-id

longo92 — Mon, 09 Feb 2026 14:33:46 GMT

If you want to see a cleaner output, after build,

delete the keyfile.json in build directory,
then triggers build from the GUI command: this should triggers only commands for missing files.

RE: [NRF54L15-KMU] Clarification on KMU slot-id

Hung Bui — Mon, 09 Feb 2026 14:05:37 GMT

Hi Alessandro,

Thanks for the tip. I have enabled the option and can see more log.
But still it's hard to catch the exact command. Could you please may be take a screenshot or show more on the log when you see the command ?

RE: [NRF54L15-KMU] Clarification on KMU slot-id

longo92 — Mon, 09 Feb 2026 13:11:37 GMT

Thank you for the details.

I am developing in VSCode using the nRF Connect extension.

By enabling the verbose mode in the extension ("nrf-connect.west.verbose": "-v" – very useful for understanding what is happening), you can see all the commands used during the build process. This is how I was able to see the west ncs-provision command mentioned.

I think that the VScode GUI build command do a sequence of commands (not only west build).

RE: [NRF54L15-KMU] Clarification on KMU slot-id

Hung Bui — Mon, 09 Feb 2026 13:01:54 GMT

Hi Alessandro,

It seems that we changed the slot used for MCUBoot from SDK v3.2.0
You can take a look here: https://docs.nordicsemi.com/bundle/ncs-3.2.1/page/nrf/releases_and_maturity/releases/release-notes-3.2.0.html#mcuboot

"Updated KMU mapping to BL_PUBKEY when MCUboot is used as the immutable bootloader for nRF54L Series devices. You can restore the previous KMU mapping (UROT_PUBKEY) with the SB_CONFIG_MCUBOOT_SIGNATURE_KMU_UROT_MAPPING Kconfig option."

Btw, could you let me know by which west -v command do you see the west ncs-provision upload \ --keyname BL_PUBKEY \ --key <path>/bootloader/mcuboot/root-ed25519.pem \ --build-dir <path>/samples/dfu/single script ?

I was not to be able to see it when I tried west -v build or west -v flash.

RE: [BRF54L15-KMU] Clarification on KMU slot-id

longo92 — Fri, 06 Feb 2026 15:46:31 GMT

I see that that mcuboot config is set here: https://github.com/nrfconnect/sdk-mcuboot/blob/ncs-v3.2.1/boot/zephyr/Kconfig#L449- and the values 226 (UROT_PUBKEY) is set only if NCS_BOOT_SIGNATURE_KMU_UROT_MAPPING is yes (which is DEPRECATED) or MCUBOOT_MCUBOOT_IMAGE_NUMBER is different from -1.

I do not know the meanings of those two KCONFIG (NCS_BOOT_SIGNATURE_KMU_UROT_MAPPING and MCUBOOT_MCUBOOT_IMAGE_NUMBER).

Could you clarify?