feat(U-Boot): Add OTP Key Writer User Guide

[Harsha-VM]

Add a KeyWriter guide describing the procedure to program customer keys into the eFuses using U-Boot's fuse writebuff command, enabling HS-FS to HS-SE device conversion.

The guide covers:

• Background on HS-FS and HS-SE device sub-types
• The fuse_otp binary blob structure with a diagram illustrating the layout
• Step-by-step key writer example flow
• Post-programming note that eFuse changes require a full SoC power cycle to take effect

Register the new page in the AM62LX Linux TOC and U-Boot Users Guide index.

[sadik-smd]

@shiva-ti @jsuhaas22 to review

[StaticRocket]

@Harsha-VM this was opened as a draft and never marked ready for review. Is there any additional pending work for this or should it go through proper review now?

[Harsha-VM]

@Harsha-VM this was opened as a draft and never marked ready for review. Is there any additional pending work for this or should it go through proper review now?

@StaticRocket Marked it ready for review now

[StaticRocket]

What's actually the difference between Key Writer Lite and Key Writer ? The two files are almost exactly the same. This just seems to explicitly change the i2c dev to 2 instead of 1 for AM62L specifically. Seems odd.

[cshilwant]

@shiva-ti @jsuhaas22 for review

[Harsha-VM]

What's actually the difference between Key Writer Lite and Key Writer ? The two files are almost exactly the same.

@StaticRocket These are 2 different methods of secure key provisioning offered by TIFS. Keywriter Lite is used to convert the device to a HS-SE lite device(without encryption support) where Keywriter is used to convert the device to a HS-SE device(with encryption support). So, the structure layout and method of preparation differ between the both.

This just seems to explicitly change the i2c dev to 2 instead of 1 for AM62L specifically. Seems odd.

On this, 1 is the right bus, and it has been updated in the keywriter lite doc as well!

[StaticRocket]

@Harsha-VM could we add this information to the introduction paragraph? I feel like that's an important distinction to make up front. Also, there's currently mixed use of key writer and keywriter. The TI-SCI documentation has a similar problem. What did we actually call this?

[StaticRocket]

@liubiin this also feels like it's reaching into academy territory as it's more of a how-to guide

[Harsha-VM]

@Harsha-VM could we add this information to the introduction paragraph? I feel like that's an important distinction to make up front. Also, there's currently mixed use of key writer and keywriter. The TI-SCI documentation has a similar problem. What did we actually call this?

@StaticRocket This information is already included in the High Security device sub types introductory section which comes up right at the start and how keywriter helps in the conversion of the same. The right word to use is keywriter, updating the PR to consistently use that!

[shiva-ti]

@Harsha-VM it would be good to add one more line/note here, telling - use OTP Keywriter to convert the device to a HS-SE device with encryption support (probably in BOLD). and similar note for KW lite in the beginning.

Also please see if you can add the OTP KW info in the security centric page table (it currently has KWLite):
https://software-dl.ti.com/processor-sdk-linux/esd/AM62LX/12_00_00_07_04/exports/docs/linux/Foundational_Components/System_Security/Security_overview.html#security-features-at-a-glance

this table too should have a clear distinction among KW and KWlite called out

[Harsha-VM]

@shiva-ti Done

[shiva-ti]

LGTM