sysbuild: Add Kconfig to load microcode once only on nRF54L devices

Prevents the microcode for CRACEN being loaded multiple times per
image if the Kconfig is enabled by only loading it in the first
image that uses it

Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>

Author: nordicjm

sysbuild/CMakeLists.txt

@@ -618,6 +618,23 @@ function(${SYSBUILD_CURRENT_MODULE_NAME}_pre_cmake)
     set(network_images)
   endif()
 
+  if(SB_CONFIG_CRACEN_MICROCODE_LOAD_ONCE)
+    if(SB_CONFIG_CRACEN_MICROCODE_LOAD_B0)
+      set_config_bool(b0 CONFIG_CRACEN_LOAD_MICROCODE y)
+
+      if(SB_CONFIG_BOOTLOADER_MCUBOOT)
+        set_config_bool(mcuboot CONFIG_CRACEN_LOAD_MICROCODE n)
+      endif()
+    elseif(SB_CONFIG_CRACEN_MICROCODE_LOAD_MCUBOOT)
+      if(SB_CONFIG_SECURE_BOOT_APPCORE)
+        set_config_bool(b0 CONFIG_CRACEN_LOAD_MICROCODE n)
+      endif()
+
+      set_config_bool(mcuboot CONFIG_CRACEN_LOAD_MICROCODE y)
+    endif()
+
+    set_config_bool(${DEFAULT_IMAGE} CONFIG_CRACEN_LOAD_MICROCODE n)
+  endif()
 endfunction(${SYSBUILD_CURRENT_MODULE_NAME}_pre_cmake)
 
 function(${SYSBUILD_CURRENT_MODULE_NAME}_pre_image_cmake)

sysbuild/Kconfig.cracen

@@ -0,0 +1,39 @@
+# Copyright (c) 2024 Nordic Semiconductor
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+config SUPPORT_CRACEN
+	bool
+	default y if SOC_SERIES_NRF54LX
+	help
+	  Hidden symbol indicating if CRACEN is supported on the device.
+
+if SUPPORT_CRACEN
+
+menu "CRACEN"
+
+config CRACEN_MICROCODE_LOAD_B0
+	bool
+	depends on SECURE_BOOT_APPCORE && SECURE_BOOT_SIGNATURE_TYPE_ED25519
+	default y
+	help
+	  Hidden symbol indicating if b0 is using CRACEN.
+
+config CRACEN_MICROCODE_LOAD_MCUBOOT
+	bool
+	depends on BOOTLOADER_MCUBOOT && BOOT_SIGNATURE_TYPE_ED25519
+	default y
+	help
+	  Hidden symbol indicating if MCUboot is using CRACEN.
+
+config CRACEN_MICROCODE_LOAD_ONCE
+	bool "Load CRACEN microcode once only"
+	depends on CRACEN_MICROCODE_LOAD_B0 || CRACEN_MICROCODE_LOAD_MCUBOOT
+	default y
+	help
+	  If enabled, will only load microcode for CRACEN in the first system bootable image,
+	  which will be either b0 or MCUboot, depending on project configuration.
+
+endmenu
+
+endif # SUPPORT_CRACEN

sysbuild/Kconfig.sysbuild

@@ -83,3 +83,4 @@ rsource "Kconfig.suit_provisioning"
 rsource "Kconfig.sdp"
 rsource "Kconfig.approtect"
 rsource "Kconfig.lwm2m_carrier"
+rsource "Kconfig.cracen"