doc: tfm: Add documentation regarding configurable build

Add documentation regarding CONFIG_TFM_PROFILE_TYPE_NOT_SET
and various TF-M partitions that user need to configure.

Move SPM migration guide to own page

Current user guide does not need this information anymore.
It should be moved to a separate migration guide.

Restructure sections

Move building, configuring and limitations to
appear before background information on TF-M user
guide.

Co-authored-by: Grzegorz Ferenc <[email protected]>
Signed-off-by: Seppo Takalo <[email protected]>
Signed-off-by: Markus Lassila <[email protected]>

doc/nrf/app_dev/device_guides/nrf53/logging_nrf5340.rst

@@ -67,3 +67,30 @@ To use the middle COM port in the nRF5340 DK v1.0.0, complete the following step
       };
 
 #. Wire the previously mapped pins to **TxD**, **RxD**, **CTS**, and **RTS** on the **P24** connector.
+
+
+.. _nrf5430_tfm_log:
+
+Log output from TF-M on nRF5340 DK
+**********************************
+
+By default, the nRF5340 DK v1.0.0 requires that you connect specific wires on the kit to receive secure logs on the host PC.
+Specifically, wire the pins **P0.25** and **P0.26** of the **P2** connector to **RxD** and **TxD** of the **P24** connector respectively.
+
+On the nRF5340 DK v2.0.0, only two virtual COM ports are available.
+By default, one of the ports is used by the non-secure UART0 peripheral from the application and the other by the UART1 peripheral from the network core.
+
+There are several options to get UART output from the secure TF-M:
+
+* Disable the output for the network core and change the pins used by TF-M.
+  The network core usually has a child image.
+  To configure logging in an |NCS| image, see :ref:`ug_logging`.
+  To change the pins used by TF-M, set the RXD (:kconfig:option:`CONFIG_TFM_UART1_RXD_PIN`) and TXD (:kconfig:option:`CONFIG_TFM_UART1_TXD_PIN`) Kconfig options in the application image to **P1.00** (32) and **P1.01** (33).
+
+* You can wire the secure and non-secure UART peripherals to the same pins.
+  Specifically, physically wire together the pins **P0.25** and **P0.26** to **P0.20** and **P0.22**, respectively.
+
+* If the non-secure application, network core, and TF-M outputs are all needed simultaneously, additional UART <-> USB hardware is needed.
+  You can use a second DK if available.
+  Connect the **P0.25** pin to the TXD pin, and **P0.26** to the RXD pin of the external hardware.
+  These pins provide the secure TF-M output, while the two native COM ports of the DK are used for the non-secure application and the network core output.