boards: nordic: Add initial support for nRF54LM20A/ns

boards/nordic/nrf54lm20dk/Kconfig

@@ -0,0 +1,28 @@
+# Copyright (c) 2025 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+DT_NRF_MPC := $(dt_nodelabel_path,nrf_mpc)
+
+if BOARD_NRF54LM20DK_NRF54LM20A_CPUAPP_NS
+
+config NRF_TRUSTZONE_FLASH_REGION_SIZE
+	hex
+	default $(dt_node_int_prop_hex,$(DT_NRF_MPC),override-granularity)
+	help
+	  This defines the flash region size from the TrustZone perspective.
+	  It is used when configuring the TrustZone and when setting alignments
+	  requirements for the partitions.
+	  This abstraction allows us to configure TrustZone without depending
+	  on peripheral-specific symbols.
+
+config NRF_TRUSTZONE_RAM_REGION_SIZE
+	hex
+	default $(dt_node_int_prop_hex,$(DT_NRF_MPC),override-granularity)
+	help
+	  This defines the RAM region size from the TrustZone perspective.
+	  It is used when configuring the TrustZone and when setting alignments
+	  requirements for the partitions.
+	  This abstraction allows us to configure TrustZone without depending
+	  on peripheral specific symbols.
+
+endif  # BOARD_NRF54LM20DK_NRF54LM20A_CPUAPP_NS

boards/nordic/nrf54lm20dk/Kconfig.defconfig

@@ -7,3 +7,12 @@ config HW_STACK_PROTECTION
 	default ARCH_HAS_STACK_PROTECTION
 
 endif # BOARD_NRF54LM20DK_NRF54LM20A_CPUAPP
+
+if BOARD_NRF54LM20DK_NRF54LM20A_CPUAPP_NS
+
+# By default, if we build for a Non-Secure version of the board,
+# enable building with TF-M as the Secure Execution Environment.
+config BUILD_WITH_TFM
+	default y
+
+endif # BOARD_NRF54LM20DK_NRF54LM20A_CPUAPP_NS

boards/nordic/nrf54lm20dk/Kconfig.nrf54lm20dk

@@ -2,5 +2,5 @@
 # SPDX-License-Identifier: Apache-2.0
 
 config BOARD_NRF54LM20DK
-	select SOC_NRF54LM20A_ENGA_CPUAPP if BOARD_NRF54LM20DK_NRF54LM20A_CPUAPP
+	select SOC_NRF54LM20A_ENGA_CPUAPP if BOARD_NRF54LM20DK_NRF54LM20A_CPUAPP || BOARD_NRF54LM20DK_NRF54LM20A_CPUAPP_NS
 	select SOC_NRF54LM20A_ENGA_CPUFLPR if BOARD_NRF54LM20DK_NRF54LM20A_CPUFLPR

boards/nordic/nrf54lm20dk/board.cmake

@@ -7,5 +7,13 @@ elseif(CONFIG_SOC_NRF54LM20A_ENGA_CPUFLPR)
   board_runner_args(jlink "--speed=4000")
 endif()
 
+if(CONFIG_BOARD_NRF54LM20DK_NRF54LM20A_CPUAPP_NS)
+  set(TFM_PUBLIC_KEY_FORMAT "full")
+endif()
+
+if(CONFIG_TFM_FLASH_MERGED_BINARY)
+  set_property(TARGET runners_yaml_props_target PROPERTY hex_file tfm_merged.hex)
+endif()
+
 include(${ZEPHYR_BASE}/boards/common/nrfutil.board.cmake)
 include(${ZEPHYR_BASE}/boards/common/jlink.board.cmake)

boards/nordic/nrf54lm20dk/board.yml

@@ -5,6 +5,8 @@ board:
   socs:
   - name: nrf54lm20a
     variants:
+    - name: ns
+      cpucluster: cpuapp
     - name: xip
       cpucluster: cpuflpr
 runners:
@@ -17,6 +19,7 @@ runners:
       groups:
       - boards:
         - nrf54lm20dk/nrf54lm20a/cpuapp
+        - nrf54lm20dk/nrf54lm20a/cpuapp/ns
         - nrf54lm20dk/nrf54lm20a/cpuflpr
         - nrf54lm20dk/nrf54lm20a/cpuflpr/xip
     '--erase':
@@ -28,6 +31,7 @@ runners:
       groups:
       - boards:
         - nrf54lm20dk/nrf54lm20a/cpuapp
+        - nrf54lm20dk/nrf54lm20a/cpuapp/ns
         - nrf54lm20dk/nrf54lm20a/cpuflpr
         - nrf54lm20dk/nrf54lm20a/cpuflpr/xip
     '--reset':
@@ -39,5 +43,6 @@ runners:
       groups:
       - boards:
         - nrf54lm20dk/nrf54lm20a/cpuapp
+        - nrf54lm20dk/nrf54lm20a/cpuapp/ns
         - nrf54lm20dk/nrf54lm20a/cpuflpr
         - nrf54lm20dk/nrf54lm20a/cpuflpr/xip

boards/nordic/nrf54lm20dk/nrf54lm20a_cpuapp_common.dtsi

@@ -58,44 +58,6 @@
 	status = "okay";
 };
 
-&cpuapp_rram {
-	partitions {
-		compatible = "fixed-partitions";
-		#address-cells = <1>;
-		#size-cells = <1>;
-
-		boot_partition: partition@0 {
-			label = "mcuboot";
-			reg = <0x0 DT_SIZE_K(64)>;
-		};
-
-		slot0_partition: partition@10000 {
-			label = "image-0";
-			reg = <0x10000 DT_SIZE_K(449)>;
-		};
-
-		slot0_ns_partition: partition@80400 {
-			label = "image-0-nonsecure";
-			reg = <0x80400 DT_SIZE_K(449)>;
-		};
-
-		slot1_partition: partition@f0800 {
-			label = "image-1";
-			reg = <0xf0800 DT_SIZE_K(449)>;
-		};
-
-		slot1_ns_partition: partition@160c00 {
-			label = "image-1-nonsecure";
-			reg = <0x160c00 DT_SIZE_K(449)>;
-		};
-
-		storage_partition: partition@1d1000 {
-			label = "storage";
-			reg = <0x1d1000 DT_SIZE_K(36)>;
-		};
-	};
-};
-
 &uart20 {
 	status = "okay";
 };
@@ -136,10 +98,6 @@
 	status = "okay";
 };
 
-&bt_hci_controller {
-	status = "okay";
-};
-
 &ieee802154 {
 	status = "okay";
 };

boards/nordic/nrf54lm20dk/nrf54lm20dk_nrf54lm20a_cpuapp.dts

@@ -7,6 +7,7 @@
 /dts-v1/;
 
 #include "nrf54lm20a_cpuapp_common.dtsi"
+#include <nordic/nrf54lm20a_partition.dtsi>
 
 / {
 	compatible = "nordic,nrf54lm20dk_nrf54lm20a-cpuapp";
@@ -22,5 +23,9 @@
 	status = "okay";
 };
 
+&uart30 {
+	status = "okay";
+};
+
 /* Get a node label for wi-fi spi to use in shield files */
 wifi_spi: &spi22 {};

boards/nordic/nrf54lm20dk/nrf54lm20dk_nrf54lm20a_cpuapp_ns.dts

@@ -0,0 +1,62 @@
+/*
+ * Copyright (c) 2025 Nordic Semiconductor ASA
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+/dts-v1/;
+
+#define USE_NON_SECURE_ADDRESS_MAP 1
+
+#include "nrf54lm20a_cpuapp_common.dtsi"
+
+/ {
+	compatible = "nordic,nrf54lm20dk_nrf54lm20a-cpuapp-ns";
+	model = "Nordic nRF54LM20 DK nRF54LM20A Application MCU Non-Secure";
+
+	chosen {
+		zephyr,code-partition = &slot0_ns_partition;
+		zephyr,sram = &sram0_ns;
+		zephyr,entropy = &psa_rng;
+	};
+
+	psa_rng: psa-rng {
+		status = "okay";
+	};
+};
+
+/ {
+	/*
+	 * Default SRAM planning when building for nRF54LM20A with ARM TrustZone-M support
+	 * - Lowest 208 kB SRAM allocated to Secure image (sram0_s).
+	 * - Upper 208 kB SRAM allocated to Non-Secure image (sram0_ns).
+	 *
+	 * nRF54LM20A has 512 kB of volatile memory (SRAM), but 96kB is allocated for the FLPR MCU.
+	 * This static layout needs to be the same with the upstream TF-M layout in the
+	 * header flash_layout.h of the relevant platform. Any updates in the layout
+	 * needs to happen both in the flash_layout.h and in this file at the same time.
+	 */
+	reserved-memory {
+		#address-cells = <1>;
+		#size-cells = <1>;
+		ranges;
+
+		sram0_s: image_s@20000000 {
+			/* Secure image memory */
+			reg = <0x20000000 DT_SIZE_K(208)>;
+		};
+
+		sram0_ns: image_ns@20034000 {
+			/* Non-Secure image memory */
+			reg = <0x20034000 DT_SIZE_K(208)>;
+		};
+	};
+};
+
+&uart30 {
+	/* Disable so that TF-M can use this UART */
+	status = "disabled";
+};
+
+/* Include default memory partition configuration file */
+#include <nordic/nrf54lm20a_ns_partition.dtsi>

boards/nordic/nrf54lm20dk/nrf54lm20dk_nrf54lm20a_cpuapp_ns.yaml

@@ -0,0 +1,22 @@
+identifier: nrf54lm20dk/nrf54lm20a/cpuapp/ns
+name: nRF54lm20-DK-nRF54lm20a-Application-Non-Secure
+type: mcu
+arch: arm
+toolchain:
+  - gnuarmemb
+  - zephyr
+ram: 208
+flash: 1356
+supported:
+  - adc
+  - counter
+  - dmic
+  - gpio
+  - i2c
+  - i2s
+  - pwm
+  - spi
+  - usbd
+  - watchdog
+vendor: nordic
+sysbuild: true

boards/nordic/nrf54lm20dk/nrf54lm20dk_nrf54lm20a_cpuapp_ns_defconfig

@@ -0,0 +1,42 @@
+# Copyright (c) 2025 Nordic Semiconductor ASA
+# SPDX-License-Identifier: Apache-2.0
+
+# Enable MPU
+CONFIG_ARM_MPU=y
+CONFIG_NULL_POINTER_EXCEPTION_DETECTION_NONE=y
+
+# Enable TrustZone-M
+CONFIG_ARM_TRUSTZONE_M=y
+
+# This Board implies building Non-Secure firmware
+CONFIG_TRUSTED_EXECUTION_NONSECURE=y
+
+# Enable UART driver
+CONFIG_SERIAL=y
+
+# Enable console
+CONFIG_CONSOLE=y
+CONFIG_UART_CONSOLE=y
+
+# Enable GPIO
+CONFIG_GPIO=y
+
+# Don't enable the cache in the non-secure image as it is a
+# secure-only peripheral on 54l
+CONFIG_CACHE_MANAGEMENT=n
+CONFIG_EXTERNAL_CACHE=n
+
+# Start SYSCOUNTER on driver init
+CONFIG_NRF_GRTC_START_SYSCOUNTER=y
+
+# Disable TFM BL2 since it is not supported
+CONFIG_TFM_BL2=n
+# Support for silence logging is not supported at the moment
+# Tracked by: NCSDK-31930
+CONFIG_TFM_LOG_LEVEL_SILENCE=n
+
+# The oscillators are configured as secure and cannot be configured
+# from the non secure application directly. This needs to be set
+# otherwise nrfx will try to configure them, resulting in a bus
+# fault.
+CONFIG_SOC_NRF54LX_SKIP_CLOCK_CONFIG=y

dts/arm/nordic/nrf54lm20a_enga_cpuapp.dtsi

@@ -66,7 +66,11 @@ nvic: &cpuapp_nvic {};
 };
 
 &grtc {
+#ifdef USE_NON_SECURE_ADDRESS_MAP
+	interrupts = <227 NRF_DEFAULT_IRQ_PRIORITY>,
+#else
 	interrupts = <228 NRF_DEFAULT_IRQ_PRIORITY>,
+#endif
 		     <229 NRF_DEFAULT_IRQ_PRIORITY>; /* reserved for Zero Latency IRQs */
 };
 

dts/vendor/nordic/nrf54lm20a.dtsi

@@ -96,10 +96,14 @@
 			#nordic,ficr-cells = <1>;
 		};
 
+#ifdef USE_NON_SECURE_ADDRESS_MAP
+		/* intentionally empty because UICR is hardware fixed to Secure */
+#else
 		uicr: uicr@ffd000 {
 			compatible = "nordic,nrf-uicr";
 			reg = <0xffd000 0x1000>;
 		};
+#endif
 
 		cpuapp_sram: memory@20000000 {
 			compatible = "mmio-sram";
@@ -117,11 +121,19 @@
 			ranges = <0x0 0x20067c00 DT_SIZE_K(96)>;
 		};
 
+#ifdef USE_NON_SECURE_ADDRESS_MAP
+		global_peripherals: peripheral@40000000 {
+			reg = <0x40000000 0x10000000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			ranges = <0x0 0x40000000 0x10000000>;
+#else
 		global_peripherals: peripheral@50000000 {
 			reg = <0x50000000 0x10000000>;
 			ranges = <0x0 0x50000000 0x10000000>;
 			#address-cells = <1>;
 			#size-cells = <1>;
+#endif
 
 			dppic00: dppic@42000 {
 				compatible = "nordic,nrf-dppic";
@@ -748,12 +760,16 @@
 				interrupts = <262 NRF_DEFAULT_IRQ_PRIORITY>;
 			};
 
+#ifdef USE_NON_SECURE_ADDRESS_MAP
+			/* intentionally empty because WDT30 is hardware fixed to Secure */
+#else
 			wdt30: watchdog@108000 {
 				compatible = "nordic,nrf-wdt";
 				reg = <0x108000 0x620>;
 				interrupts = <264 NRF_DEFAULT_IRQ_PRIORITY>;
 				status = "disabled";
 			};
+#endif
 
 			wdt31: watchdog@109000 {
 				compatible = "nordic,nrf-wdt";
@@ -852,6 +868,15 @@
 			};
 		};
 
+		nrf_mpc: memory@50041000 {
+			compatible = "nordic,nrf-mpc";
+			reg = <0x50041000 0x1000>;
+			#address-cells = <1>;
+			#size-cells = <1>;
+			override-num = <5>;
+			override-granularity = <4096>;
+		};
+
 		cpuapp_ppb: cpuapp-ppb-bus {
 			#address-cells = <1>;
 			#size-cells = <1>;