plat-qcom: hoya: lemans: wire up fuse PTA and QFPROM for PAS authentication

Signature authentication reads device fuses at runtime, so enabling
CFG_QCOM_PAS_AUTH is not enough on its own - the fuse PTA and the
qfprom driver behind it (and the CMD_DB/RPMH client its fuse-write
path needs) have to come up with it. Force that whole chain from
CFG_QCOM_PAS_AUTH so a stock Lemans build brings up the complete PAS
authentication stack end to end.

Fold the existing fuse-provisioning enable into the same block so
provisioning and the new fuse-PTA consumer share one QFPROM enable
and cannot drift apart.

Signed-off-by: Selvam Sathappan Periakaruppan <speriaka@qti.qualcomm.com>
Assisted-by: Claude:sonnet-5

Author: zelvam95

core/arch/arm/plat-qcom/hoya/lemans/target.mk

@@ -7,12 +7,6 @@ ifneq ($(CFG_INSECURE),y)
 CFG_QCOM_QFPROM_FUSEPROV ?= y
 endif
 
-ifeq ($(CFG_QCOM_QFPROM_FUSEPROV),y)
-$(call force,CFG_QCOM_CMD_DB,y)
-$(call force,CFG_QCOM_RPMH_CLIENT,y)
-$(call force,CFG_QCOM_QFPROM,y)
-endif
-
 CFG_QCOM_PAS_PTA ?= y
 
 ifeq ($(CFG_QCOM_PAS_PTA),y)
@@ -22,12 +16,30 @@ ifeq ($(CFG_QCOM_PAS_PTA),y)
 CFG_RESERVED_VASPACE_SIZE ?= (256 * 1024 * 1024)
 CFG_IN_TREE_EARLY_TAS += qcom_pas/cff7d191-7ca0-4784-af13-48223b9a4fbe
 
-# Verify PIL firmware at AUTH_AND_RESET: re-hash the segments the REE loaded
-# and compare them against the per-segment hash table in the image metadata,
-# before releasing the peripheral from reset.
-#
-# TODO: signature authentication of that hash table (certificate chain and
-# fuse bindings) will be added incrementally.
+# Authenticate PIL firmware: at INIT_IMAGE validate the certificate chain,
+# signature and fuse bindings, then at AUTH_AND_RESET re-hash the loaded
+# segments against the authenticated per-segment hash table before releasing
+# the peripheral from reset.
 CFG_QCOM_PAS_AUTH ?= y
 endif
 CFG_QCOM_HWKM ?= y
+
+# Signature authentication reads the OEM root-of-trust anchor, anti-rollback
+# version, device identity and other fuses via the fuse PTA; enable it (and
+# therefore the underlying qfprom driver) whenever PAS authentication is on.
+ifeq ($(CFG_QCOM_PAS_AUTH),y)
+$(call force,CFG_QCOM_FUSE_PTA,y)
+endif
+
+# QFPROM backs fuse provisioning (writes) and the fuse PTA (reads) alike;
+# enable the driver whenever either consumer is on.
+ifneq ($(filter y,$(CFG_QCOM_QFPROM_FUSEPROV) $(CFG_QCOM_FUSE_PTA)),)
+$(call force,CFG_QCOM_QFPROM,y)
+endif
+
+# CMD_DB/RPMH_CLIENT back the qfprom driver's fuse-write path (voltage rail
+# sequencing), needed whenever qfprom itself is enabled.
+ifeq ($(CFG_QCOM_QFPROM),y)
+$(call force,CFG_QCOM_CMD_DB,y)
+$(call force,CFG_QCOM_RPMH_CLIENT,y)
+endif