fix(security): Clarify TRNG engine ownership by OPTEE

The SDK by default provides control of TRNG engine to OP-TEE, which
also firewalls the associated MMR regions.
Document this design choice for clarity.

Signed-off-by: Shiva Tripathi <s-tripathi1@ti.com>

Author: shiva-ti

source/linux/Foundational_Components/Kernel/Kernel_Drivers/Crypto/DTHEv2.rst

@@ -216,9 +216,14 @@ software only implementation can be compared to the previous test.
 Using the True Random Number Generator (TRNG) Hardware Accelerator
 ******************************************************************
 
-The pre-built kernel included within the SDK already has the OP-TEE TRNG
-driver enabled. You do not need any further configuration.
-
+The TRNG engine can be configured through the Linux kernel or OP‑TEE
+drivers. By default, the SDK provides TRNG hardware control to OP‑TEE,
+which firewalls its associated MMRs, restricting any non‑secure access 
+to the hardware. To access TRNG from Linux, the OP‑TEE driver should be
+disabled and the RNG node enabled in the Linux device tree (reserved by 
+default).
+
+To use the TRNG driver from OP‑TEE, no further configuration is required.
 Verify that the optee-rng driver is loaded:
 
 .. code-block:: console

source/linux/Foundational_Components/Kernel/Kernel_Drivers/Crypto/SA2UL_OMAP.rst

@@ -304,8 +304,13 @@ software only implementation can be compared to the previous test.
 Using the TRNG Hardware Accelerator
 ***********************************
 
-The pre built kernel that come with the SDK already has the TRNG driver
-built into the kernel. No further configuration is required.
+The TRNG engine can be configured through the Linux kernel or OP-TEE
+drivers. By default, the SDK provides TRNG hardware control to OP-TEE,
+which firewalls its associated MMRs, restricting any non-secure access to
+the hardware. To access TRNG from Linux, the OP-TEE driver should be
+disabled and RNG node enabled in the Linux device tree (reserved by default).
+
+To use TRNG driver from OP-TEE, no further configuration is required.
 
 .. ifconfig:: CONFIG_crypto in ('sa2ul')