sysbuild: Add Kconfig to load microcode once only on nRF54L devices

sysbuild/CMakeLists.txt

@@ -618,6 +618,23 @@ function(${SYSBUILD_CURRENT_MODULE_NAME}_pre_cmake)
     set(network_images)
   endif()
 
+  if(SB_CONFIG_CRACEN_MICROCODE_LOAD_ONCE)
+    if(SB_CONFIG_CRACEN_MICROCODE_LOAD_B0)
+      set_config_bool(b0 CONFIG_CRACEN_LOAD_MICROCODE y)
+
+      if(SB_CONFIG_BOOTLOADER_MCUBOOT)
+        set_config_bool(mcuboot CONFIG_CRACEN_LOAD_MICROCODE n)
+      endif()
+    elseif(SB_CONFIG_CRACEN_MICROCODE_LOAD_MCUBOOT)
+      if(SB_CONFIG_SECURE_BOOT_APPCORE)
+        set_config_bool(b0 CONFIG_CRACEN_LOAD_MICROCODE n)
+      endif()
+
+      set_config_bool(mcuboot CONFIG_CRACEN_LOAD_MICROCODE y)
+    endif()
+
+    set_config_bool(${DEFAULT_IMAGE} CONFIG_CRACEN_LOAD_MICROCODE n)
+  endif()
 endfunction(${SYSBUILD_CURRENT_MODULE_NAME}_pre_cmake)
 
 function(${SYSBUILD_CURRENT_MODULE_NAME}_pre_image_cmake)

sysbuild/Kconfig.cracen

@@ -0,0 +1,39 @@
+# Copyright (c) 2024 Nordic Semiconductor
+#
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+config SUPPORT_CRACEN
+	bool
+	default y if SOC_SERIES_NRF54LX
+	help
+	  Hidden symbol indicating if CRACEN is supported on the device.
+
+if SUPPORT_CRACEN
+
+menu "CRACEN"
+
+config CRACEN_MICROCODE_LOAD_B0
+	bool
+	depends on SECURE_BOOT_APPCORE && SECURE_BOOT_SIGNATURE_TYPE_ED25519
+	default y
+	help
+	  Hidden symbol indicating if b0 is using CRACEN.
+
+config CRACEN_MICROCODE_LOAD_MCUBOOT
+	bool
+	depends on BOOTLOADER_MCUBOOT && BOOT_SIGNATURE_TYPE_ED25519
+	default y
+	help
+	  Hidden symbol indicating if MCUboot is using CRACEN.
+
+config CRACEN_MICROCODE_LOAD_ONCE
+	bool "Load CRACEN microcode once only"
+	depends on CRACEN_MICROCODE_LOAD_B0 || CRACEN_MICROCODE_LOAD_MCUBOOT
+	default y
+	help
+	  If enabled, will only load microcode for CRACEN in the first system bootable image,
+	  which will be either b0 or MCUboot, depending on project configuration.
+
+endmenu
+
+endif # SUPPORT_CRACEN

sysbuild/Kconfig.sysbuild

@@ -83,3 +83,4 @@ rsource "Kconfig.suit_provisioning"
 rsource "Kconfig.sdp"
 rsource "Kconfig.approtect"
 rsource "Kconfig.lwm2m_carrier"
+rsource "Kconfig.cracen"