LAN969X OTP Configuration from Linux userspace

# ls -l /sys/bus/nvmem/devices/lan9662-otp0/nvmem
-rw-r--r--    1 root     root         16384 Jan  3 01:10 /sys/bus/nvmem/devices/lan9662-otp0/nvmem

# otp --help
This tool can be used to access and modify the OTP in the following SoCs:
 - LAN9662
 - LAN9668
 - LAN969X

Usage:
 otp field list
 otp field get [<NAME>]
 otp field set [--merge] <NAME> (ascii|hex|dec|3ascii-dec) <VALUE>
 otp addr get <ADDRESS> <BYTE-LENGTH>
 otp addr set [--merge] <ADDRESS> <BYTE-LENGTH> (ascii|hex|dec) <VALUE>
 otp tag list-tag-names
 otp tag print
 otp tag info
 otp tag get (<tag-number>|<tag-name>)
 otp tag del (<tag-number>|<tag-name>)
 otp tag set (<tag-number>|<tag-name>) (ascii|hex|dec) <VALUE>
 otp nvcnt get (trusted|nontrusted)
 otp nvcnt set <VALUE> (trusted|nontrusted)
 otp import-keys [--no-randomize-huk] <FILE>
 otp region show
 otp region write-protect <REGION-NUMBER>
 otp region non-secure <REGION-NUMBER>
 otp init pcb <PCB> ethaddr (random-ethaddr|<ETHADDR-ADDRESS>) ethaddr_count <COUNT>

Options:
 -h --help             Show this screen.
 --version             Show version.
 --verbose             Enable verbose traces on console
 -d DEV --device DEV   NVRAM device
                       This can also be a normal block device, or even a file.
 -i ID --chip-id ID    Specify OTP layout coresponding to the given chip ID.
                       NOTE: This setting is only allowed on devices where the
                       part-ID at byte address 0x5-0x6 is not programmed, or if
                       the programmed part-ID matches the provided ID.
 --chip-id-force       Force usage of the ID given with --chip-id=ID, even
                       though a different part ID is programmed in the OTP.
 --no-confirm          Do not require the user to confirm write operations.

General:

 The OTP in these products are accessed by various elements including: discrete
 logic in the chip, TF-A bootrom (BL1), Secure Boot loader (BL2), EL3 Runtime
 software (BL31/BL32), UBoot, Linux kernel and this user-space application.
 The OTP has a concept of regions, which can be used to configure access
 control (read and write protection). The regions and write protect mask is in
 the OTP it self and need to be provisioned.

 This tool support 3 different kind of content:
   Fields:                This is fixed-length data at fixed positions in the
                          OTP. The tool has a build in template for each of the
                          supported SoC with name, address, length and
                          description.

   Non volatile counters: This is counters which can only be incremented. This
                          is used to do rollback protection. This is
                          implemented as a bitfields, and the max value is
                          therefore the number of allocated bits for a given
                          counter.

   Tagged data:           This is semi-one-time-programmable data. The purpose
                          of this is to allow store various data such as:
                          mac-addresses, board-ID, ECO level, uniq default
                          password which may be printed on the device, etc.
                          This is implemented as an array of 64-bits records
                          with the following layout:

                           +--------+--------+--------+----------+
                           | size:3 | cont:1 | tag:12 | value:48 |
                           +--------+--------+--------+----------+

                          Where:
                            size:   specify the number of valid bytes in value.
                                    0 and 0b111 (7) are invalid. If a record
                                    needs to be invalidated, then it is a
                                    matter of writing 0b111 in this field.
                            cont:   specify that the content continues in the
                                    next valid record with the given tag value.
                            tag:    This is a number from 0-2047 specifying the
                                    type of data (the implementation has a list
                                    of named tags which may be used).
                            value:  Value associated to the tag.


Note:
 All commands writing ('field set', 'addr set', 'tag del|set') to OTP shall do:
 - Read out existing content.
 - If '--merge' flag is not set, confirm that the specified value is possible
   to set. Abort if not.
 - Print in hex what is about the be written where
 - Let use user confirm.

Command details:
 otp help:
   Print this message

 otp field list:
   List all fields recognized by the implementation template.

 otp field get [<NAME>]
   Get the content of a specific fields, or all fields if non is provided.
   NOTE: This shall skip fields in areas being read-protected, but will happily
   print secrets if not proper protected.

 otp field set [--merge] <NAME> (ascii|hex|dec) <VALUE>
   Set the content of a given field.
   - If the --merge option is provided, then the content is bit-wised OR with
     what is in the OTP field already. If not, a check is performed to confirm
     that the desired value can be written as-is.
   - The value can either be provided in ascii format, or as a hex-string.
     - A hex string must always provide an equal number of chars (no half
       bytes).
   - The length of the value must match what is find in the template.

 otp addr get <address> <BYTE-LENGTH>
   Read the raw content in OTP. If the requested area is (partly)
   read-protected, then return error.

 otp addr set [--merge] <address> <BYTE-LENGTH> (ascii|hex|dec) <VALUE>
   Write raw content in the OTP. If the requested area is (partly)
   write-protected, then return error before any content is written.

 otp nvcnt (trusted|nontrusted) get
 otp nvcnt (trusted|nontrusted) set <VALUE>
   Get/set the value of either the trusted or nontrusted
   non-volatile-ever-incrementing-counter.
   This is implemented as a bit-field, and a given implementation will have
   limited capacity.
   NOTE: This is used by the secure boot-ROM to implement rollback protection.

 otp tag list-tag-names
   List all the tag names and associated numbers know by the implementation.

 otp tag info
   Print statistics on tag usages.
 otp tag print
   Print all valid tags in the otp.

 otp tag get (bin|hex) [(<tag-number>|<tag-name>)]
   Read out the value of a given tag (either by name or by number) or dump all
   tags if no name/number is provided.
   If no valid tag with matching name/number was found, then return an error.

 otp tag [--merge] set (<tag-number>|<tag-name>) (ascii|hex) <VALUE>
   Set a tagged value. If the --merge flag was set, then the content provided
   must be of exact same length as the length of existing content in the OTP.
   If this tag already exists, then it shall be replaced (meaning invalidating
   the existing tag).

 otp tag append (<tag-number>|<tag-name>)
   Append more data to a tag. This will always create a new record and set the
   'cont' flag in existing tags.

 otp tag del (<tag-number>|<tag-name>)
   Invalidate an existing tag in the OTP.

 otp import-keys [--no-randomize-huk] <FILE>:
   This shall read the content from a file (or stdin if '-' is provided as
   file-name).
   The content is binary and length must match the platform expected length.
   It can only be used to program the region with TF-A keys (on LAN966x
   this is region 4). The region will not be defined when the tool is called,
   and a per platform hard-coded offset/size will be used.
   Unless the --no-randomize-huk flag is set, then the OTP_TBBR_HUK field will
   be set with randomized content using /dev/random.

otp region show:
  Show the start-address, end-address and write-protect bit of all regions.
  Some regions may be displayed with start- and end-address equal to 0, which
  means that this region is still not defined.

otp region write-protect <REGION-NUMBER>:
  This shall check if the region <REGION-NUMBER> is defined (in
  `PROTECT_REGION_ADDR`).  If not, the region shall be defined using the
  per-chip-id defined template.  Once the region is defined it shall be marked
  as write-protected in `PROTECT_OTP_WRITE`.

otp init pcb <PCBNO> ethaddr (random-ethaddr|<ETHADDR-ADDRESS>) ethaddr_count <COUNT>
  NOTE: This shall only be called during board manufacturing!
        Do not call more than once.

  This sub-command will do the following:
  - Do the equivalent of: $ opt tag set pcb dec <PCBNO>
  - Do the equivalent of: $ opt tag set ethaddr_count dec <COUNT>
  - Do the equivalent of: $ opt tag set ethaddr ascii <ETHADDR-ADDRESS>
    - If the ethaddr-address is `random-ethaddr`, then generate a random ETHADDR with the
      following limitation:
      - Broadcast bit is 0
      - Local-administrated bit is 1
      - It must not be all zero and not all ff.