From ff9e8864ce34a11e24641d4739f99560bc23dc5e Mon Sep 17 00:00:00 2001
From: Jamie McCrae <jamie.mccrae@nordicsemi.no>
Date: Fri, 20 Dec 2024 10:31:05 +0000
Subject: [PATCH] sysbuild: Add Kconfig to load microcode once only on nRF54L
 devices

Prevents the microcode for CRACEN being loaded multiple times per
image if the Kconfig is enabled by only loading it in the first
image that uses it

Signed-off-by: Jamie McCrae <jamie.mccrae@nordicsemi.no>
---
 sysbuild/CMakeLists.txt   | 17 +++++++++++++++++
 sysbuild/Kconfig.cracen   | 39 +++++++++++++++++++++++++++++++++++++++
 sysbuild/Kconfig.sysbuild |  1 +
 3 files changed, 57 insertions(+)
 create mode 100644 sysbuild/Kconfig.cracen

diff --git a/sysbuild/CMakeLists.txt b/sysbuild/CMakeLists.txt
index 2763eeddf753..46876673dd1e 100644
--- a/sysbuild/CMakeLists.txt
+++ b/sysbuild/CMakeLists.txt
@@ -618,6 +618,23 @@ function(${SYSBUILD_CURRENT_MODULE_NAME}_pre_cmake)
     set(network_images)
   endif()
 
+  if(SB_CONFIG_CRACEN_MICROCODE_LOAD_ONCE)
+    if(SB_CONFIG_CRACEN_MICROCODE_LOAD_B0)
+      set_config_bool(b0 CONFIG_CRACEN_LOAD_MICROCODE y)
+
+      if(SB_CONFIG_BOOTLOADER_MCUBOOT)
+        set_config_bool(mcuboot CONFIG_CRACEN_LOAD_MICROCODE n)
+      endif()
+    elseif(SB_CONFIG_CRACEN_MICROCODE_LOAD_MCUBOOT)
+      if(SB_CONFIG_SECURE_BOOT_APPCORE)
+        set_config_bool(b0 CONFIG_CRACEN_LOAD_MICROCODE n)
+      endif()
+
+      set_config_bool(mcuboot CONFIG_CRACEN_LOAD_MICROCODE y)
+    endif()
+
+    set_config_bool(${DEFAULT_IMAGE} CONFIG_CRACEN_LOAD_MICROCODE n)
+  endif()
 endfunction(${SYSBUILD_CURRENT_MODULE_NAME}_pre_cmake)
 
 function(${SYSBUILD_CURRENT_MODULE_NAME}_pre_image_cmake)
diff --git a/sysbuild/Kconfig.cracen b/sysbuild/Kconfig.cracen
new file mode 100644
index 000000000000..7c65ebe2cb62
--- /dev/null
+++ b/sysbuild/Kconfig.cracen
@@ -0,0 +1,39 @@
+# Copyright (c) 2024 Nordic Semiconductor
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+config SUPPORT_CRACEN
+	bool
+	default y if SOC_SERIES_NRF54LX
+	help
+	  Hidden symbol indicating if CRACEN is supported on the device.
+
+if SUPPORT_CRACEN
+
+menu "CRACEN"
+
+config CRACEN_MICROCODE_LOAD_B0
+	bool
+	depends on SECURE_BOOT_APPCORE && SECURE_BOOT_SIGNATURE_TYPE_ED25519
+	default y
+	help
+	  Hidden symbol indicating if b0 is using CRACEN.
+
+config CRACEN_MICROCODE_LOAD_MCUBOOT
+	bool
+	depends on BOOTLOADER_MCUBOOT && BOOT_SIGNATURE_TYPE_ED25519
+	default y
+	help
+	  Hidden symbol indicating if MCUboot is using CRACEN.
+
+config CRACEN_MICROCODE_LOAD_ONCE
+	bool "Load CRACEN microcode once only"
+	depends on CRACEN_MICROCODE_LOAD_B0 || CRACEN_MICROCODE_LOAD_MCUBOOT
+	default y
+	help
+	  If enabled, will only load microcode for CRACEN in the first system bootable image,
+	  which will be either b0 or MCUboot, depending on project configuration.
+
+endmenu
+
+endif # SUPPORT_CRACEN
diff --git a/sysbuild/Kconfig.sysbuild b/sysbuild/Kconfig.sysbuild
index 958e7080ffcd..18b3a8ec30f1 100644
--- a/sysbuild/Kconfig.sysbuild
+++ b/sysbuild/Kconfig.sysbuild
@@ -83,3 +83,4 @@ rsource "Kconfig.suit_provisioning"
 rsource "Kconfig.sdp"
 rsource "Kconfig.approtect"
 rsource "Kconfig.lwm2m_carrier"
+rsource "Kconfig.cracen"