boards: nordic: Add non-secure targets for nRF7120

rob-robinson-14 · nordicjm · commit 14c7de2ed912 · 2025-02-19T09:37:20.000Z
This adds the nrf7120pdk/cpuapp/ns board variant to sdk-zephyr. It allows to build nrf7120pdk with TF-M in nRF Connect SDK. Once upstreamed to zephyr, commit will become a noup within sdk-zephyr. This is done as a noup as the out-of-tree board extension feature is not available. When zephyrproject-rtos/zephyr#69548 is completed this commit can be reverted and the variant be placed in sdk-nrf. Signed-off-by: Robert Robinson <robert.robinson@nordicsemi.no>
diff --git a/boards/nordic/nrf7120pdk/Kconfig.defconfig b/boards/nordic/nrf7120pdk/Kconfig.defconfig
@@ -6,4 +6,26 @@ if BOARD_NRF7120PDK_NRF7120_CPUAPP
 config BT_CTLR
 	default BT
 
+config ROM_START_OFFSET
+	default 0 if PARTITION_MANAGER_ENABLED
+	default 0x800 if BOOTLOADER_MCUBOOT
+
 endif # BOARD_NRF7120PDK_NRF7120_CPUAPP
+
+if BOARD_NRF7120PDK_NRF7120_CPUAPP_NS
+
+config BT_CTLR
+	default BT
+
+# By default, if we build for a Non-Secure version of the board,
+# enable building with TF-M as the Secure Execution Environment.
+config BUILD_WITH_TFM
+	default y
+
+# By default, if we build with TF-M, instruct build system to
+# flash the combined TF-M (Secure) & Zephyr (Non Secure) image
+config TFM_FLASH_MERGED_BINARY
+	default y
+	depends on BUILD_WITH_TFM
+
+endif # BOARD_NRF7120PDK_NRF7120_CPUAPP_NS
diff --git a/boards/nordic/nrf7120pdk/Kconfig.nrf7120pdk b/boards/nordic/nrf7120pdk/Kconfig.nrf7120pdk
@@ -1,6 +1,7 @@
 # Copyright (c) 2025 Nordic Semiconductor ASA
-# SPDX-License-Identifier: Apache-2.0
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
 config BOARD_NRF7120PDK
-	select SOC_NRF7120_ENGA_CPUAPP if BOARD_NRF7120PDK_NRF7120_CPUAPP
+	select SOC_NRF7120_ENGA_CPUAPP if BOARD_NRF7120PDK_NRF7120_CPUAPP  || \
+						BOARD_NRF7120PDK_NRF7120_CPUAPP_NS
 	select SOC_NRF7120_ENGA_CPUFLPR if BOARD_NRF7120PDK_NRF7120_CPUFLPR || \
 					    BOARD_NRF7120PDK_NRF7120_CPUFLPR_XIP
diff --git a/boards/nordic/nrf7120pdk/board.cmake b/boards/nordic/nrf7120pdk/board.cmake
@@ -7,6 +7,14 @@ elseif(CONFIG_SOC_NRF7120_ENGA_CPUFLPR)
   board_runner_args(jlink "--speed=4000")
 endif()
 
+if(BOARD_NRF7120PDK_NRF7120_CPUAPP_NS)
+  set(TFM_PUBLIC_KEY_FORMAT "full")
+endif()
+
+if(CONFIG_TFM_FLASH_MERGED_BINARY)
+  set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
+endif()
+
 include(${ZEPHYR_BASE}/boards/common/nrfjprog.board.cmake)
 include(${ZEPHYR_BASE}/boards/common/nrfutil.board.cmake)
 include(${ZEPHYR_BASE}/boards/common/jlink.board.cmake)
diff --git a/boards/nordic/nrf7120pdk/board.yml b/boards/nordic/nrf7120pdk/board.yml
@@ -6,3 +6,5 @@ board:
     variants:
     - name: xip
       cpucluster: cpuflpr
+    - name: ns
+      cpucluster: cpuapp
diff --git a/boards/nordic/nrf7120pdk/nrf7120pdk_nrf7120_cpuapp_ns.dts b/boards/nordic/nrf7120pdk/nrf7120pdk_nrf7120_cpuapp_ns.dts
@@ -0,0 +1,25 @@
+/*
+ * Copyright (c) 2025 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/dts-v1/;
+
+#define USE_NON_SECURE_ADDRESS_MAP 1
+
+#include "nrf7120_cpuapp_common.dtsi"
+
+/ {
+	compatible = "nordic,nrf7120pdk_nrf7120-cpuapp";
+	model = "Nordic nRF7120 PDK nRF7120 Application MCU";
+
+	chosen {
+		zephyr,sram = &cpuapp_sram;
+	};
+};
+
+&uart30 {
+	/* Disable so that TF-M can use this UART */
+	status = "disabled";
+};
diff --git a/boards/nordic/nrf7120pdk/nrf7120pdk_nrf7120_cpuapp_ns.yaml b/boards/nordic/nrf7120pdk/nrf7120pdk_nrf7120_cpuapp_ns.yaml
@@ -0,0 +1,22 @@
+# Copyright (c) 2025 Nordic Semiconductor ASA
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+identifier: nrf7120pdk/nrf7120/cpuapp/ns
+name: nRF7120-PDK-nRF7120-Application-Non-Secure
+type: mcu
+arch: arm
+toolchain:
+  - gnuarmemb
+  - xtools
+  - zephyr
+ram: 896
+flash: 4088
+supported:
+  - adc
+  - gpio
+  - i2c
+  - spi
+  - counter
+  - watchdog
+  - adc
+  - i2s
diff --git a/boards/nordic/nrf7120pdk/nrf7120pdk_nrf7120_cpuapp_ns_defconfig b/boards/nordic/nrf7120pdk/nrf7120pdk_nrf7120_cpuapp_ns_defconfig
@@ -0,0 +1,31 @@
+# Copyright (c) 2025 Nordic Semiconductor ASA
+# SPDX-License-Identifier: LicenseRef-Nordic-5-Clause
+
+# Enable MPU
+CONFIG_ARM_MPU=y
+
+# Enable hardware stack protection
+CONFIG_HW_STACK_PROTECTION=y
+
+CONFIG_NULL_POINTER_EXCEPTION_DETECTION_NONE=y
+
+# Enable TrustZone-M
+CONFIG_ARM_TRUSTZONE_M=y
+
+# This Board implies building Non-Secure firmware
+CONFIG_TRUSTED_EXECUTION_NONSECURE=y
+
+# Don't enable the cache in the non-secure image as it is a
+# secure-only peripheral on 71x series
+CONFIG_CACHE_MANAGEMENT=n
+CONFIG_EXTERNAL_CACHE=n
+
+CONFIG_UART_CONSOLE=y
+CONFIG_CONSOLE=y
+CONFIG_SERIAL=y
+
+# Enable GPIO
+CONFIG_GPIO=y
+
+# Start SYSCOUNTER on driver init
+CONFIG_NRF_GRTC_START_SYSCOUNTER=y
diff --git a/soc/nordic/nrf71/Kconfig b/soc/nordic/nrf71/Kconfig
@@ -23,3 +23,25 @@ config SOC_NRF7120_ENGA_CPUAPP
 
 config SOC_NRF7120_ENGA_CPUFLPR
 	select RISCV_CORE_NORDIC_VPR
+
+DT_MPC_REGION_SIZE := $(dt_nodelabel_path,nrf_mpc_region)
+
+config NRF_TRUSTZONE_FLASH_REGION_SIZE
+	hex
+	default $(dt_node_int_prop_hex,$(DT_MPC_REGION_SIZE),protection-region-size)
+	help
+	  This defines the flash region size from the TRUSTZONE perspective.
+	  It is used when configuring the TRUSTZONE and when setting alignments
+	  requirements for the partitions.
+	  This abstraction allows us to configure TRUSTZONE without depending
+	  on peripheral specific symbols.
+
+config NRF_TRUSTZONE_RAM_REGION_SIZE
+	hex
+	default $(dt_node_int_prop_hex,$(DT_MPC_REGION_SIZE),protection-region-size)
+	help
+	  This defines the RAM region size from the TRUSTZONE perspective.
+	  It is used when configuring the TRUSTZONE and when setting alignments
+	  requirements for the partitions.
+	  This abstraction allows us to configure TRUSTZONE without depending
+	  on peripheral specific symbols.
diff --git a/soc/nordic/nrf71/soc.c b/soc/nordic/nrf71/soc.c
@@ -12,11 +12,19 @@
  * for the Nordic Semiconductor nRF71 family processor.
  */
 
+#ifdef __NRF_TFM__
+#include <zephyr/autoconf.h>
+#endif
+
 #include <zephyr/kernel.h>
 #include <zephyr/devicetree.h>
 #include <zephyr/init.h>
 #include <zephyr/logging/log.h>
 
+#ifndef __NRF_TFM__
+#include <zephyr/cache.h>
+#endif
+
 #if defined(NRF_APPLICATION)
 #include <cmsis_core.h>
 #include <hal/nrf_glitchdet.h>
@@ -29,8 +37,22 @@ LOG_MODULE_REGISTER(soc, CONFIG_SOC_LOG_LEVEL);
 
 void soc_early_init_hook(void)
 {
+	/* Update the SystemCoreClock global variable with current core clock
+	 * retrieved from hardware state.
+	 */
+#if !defined(CONFIG_TRUSTED_EXECUTION_NONSECURE) || defined(__NRF_TFM__)
+	/* Currently not supported for non-secure */
+	SystemCoreClockUpdate();
+#endif
+
+#ifdef __NRF_TFM__
+	/* TF-M enables the instruction cache from target_cfg.c, so we
+	 * don't need to enable it here.
+	 */
+#else
 	/* Enable ICACHE */
 	sys_cache_instr_enable();
+#endif
 }
 
 void arch_busy_wait(uint32_t time_us)
