[PATCH 0/3] media: qcom: Skip SCM secure memory protection with OP-TEE PAS backend

[PATCH 0/3] media: qcom: Skip SCM secure memory protection with OP-TEE PAS backend

[Sumit Garg]

The Qualcomm peripheral authentication service (PAS) can be serviced by
either the SCM (TrustZone) backend or, on OP-TEE based platforms, by the
OP-TEE backend. qcom_scm_mem_protect_video_var() is only implemented by
the SCM backend; with OP-TEE the TEE itself owns secure memory
protection and does not service this call. Issuing it unconditionally on
an OP-TEE backend fails firmware bring-up for the venus and iris video
codecs.

To let consumers make this distinction, patch 1 exposes the name of the
active PAS backend via a new qcom_pas_get_backend() helper and adds
QCOM_PAS_BACKEND_SCM/QCOM_PAS_BACKEND_TEE identifiers for them to match
against.

Patches 2 and 3 use this helper in the iris and venus drivers to skip
the SCM-only qcom_scm_mem_protect_video_var() call when a non-SCM
backend (e.g. OP-TEE) is active, leaving the SCM path unchanged.

No functional change is intended for the SCM backend.

Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
Jorge Ramirez-Ortiz (2):
      firmware: qcom: pas: Expose the active PAS backend name
      media: iris: Skip SCM call for non-SCM PAS backend

Sumit Garg (1):
      media: venus: Skip SCM call for non-SCM PAS backend

 drivers/firmware/qcom/qcom_pas.c                 |  8 ++++++++
 drivers/firmware/qcom/qcom_pas_tee.c             |  2 +-
 drivers/firmware/qcom/qcom_scm.c                 |  2 +-
 drivers/media/platform/qcom/iris/iris_firmware.c | 11 +++++++++++
 drivers/media/platform/qcom/venus/firmware.c     | 10 ++++++++++
 include/linux/firmware/qcom/qcom_pas.h           |  5 +++++
 6 files changed, 36 insertions(+), 2 deletions(-)
---
base-commit: 08df884136f1c1197bab2a27814404fd329d9aac
change-id: 20260911-video-optee-pas-v1-c69298e840ca

Best regards,
-- 
Sumit Garg <sumit.garg@kernel.org>

[PATCH 1/3] firmware: qcom: pas: Expose the active PAS backend name

[Sumit Garg]

From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>

Consumers may need to know which PAS backend is active, e.g. to decide
whether SCM-specific calls apply.

Add qcom_pas_get_backend() returning the active backend name (or NULL),
and define QCOM_PAS_BACKEND_SCM/QCOM_PAS_BACKEND_TEE for consumers to
match against. Use them in the SCM and OP-TEE backends too.

Assisted-by: Copilot:claude-opus-4.8
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez.ortiz@gmail.com>
Co-developed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
 drivers/firmware/qcom/qcom_pas.c       | 8 ++++++++
 drivers/firmware/qcom/qcom_pas_tee.c   | 2 +-
 drivers/firmware/qcom/qcom_scm.c       | 2 +-
 include/linux/firmware/qcom/qcom_pas.h | 5 +++++
 4 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/drivers/firmware/qcom/qcom_pas.c b/drivers/firmware/qcom/qcom_pas.c
index 24485dd0fa10..eb9e8ac85860 100644
--- a/drivers/firmware/qcom/qcom_pas.c
+++ b/drivers/firmware/qcom/qcom_pas.c
@@ -253,6 +253,14 @@ bool qcom_pas_supported(u32 pas_id)
 }
 EXPORT_SYMBOL_GPL(qcom_pas_supported);
 
+const char *qcom_pas_get_backend(void)
+{
+	struct qcom_pas_ops *ops = ops_ptr;
+
+	return ops ? ops->drv_name : NULL;
+}
+EXPORT_SYMBOL_GPL(qcom_pas_get_backend);
+
 /**
  * qcom_pas_is_available() - Check if the peripheral authentication service is
  *			     available. Note that it is mandatory for any PAS
diff --git a/drivers/firmware/qcom/qcom_pas_tee.c b/drivers/firmware/qcom/qcom_pas_tee.c
index ac33a00687aa..397f11aea3b4 100644
--- a/drivers/firmware/qcom/qcom_pas_tee.c
+++ b/drivers/firmware/qcom/qcom_pas_tee.c
@@ -396,7 +396,7 @@ static void qcom_pas_tee_metadata_release(struct device *dev,
 }
 
 static struct qcom_pas_ops qcom_pas_ops_tee = {
-	.drv_name		= "qcom-pas-tee",
+	.drv_name		= QCOM_PAS_BACKEND_TEE,
 	.supported		= qcom_pas_tee_supported,
 	.init_image		= qcom_pas_tee_init_image,
 	.mem_setup		= qcom_pas_tee_mem_setup,
diff --git a/drivers/firmware/qcom/qcom_scm.c b/drivers/firmware/qcom/qcom_scm.c
index 3eaa4c9ccf3c..d556f357fecb 100644
--- a/drivers/firmware/qcom/qcom_scm.c
+++ b/drivers/firmware/qcom/qcom_scm.c
@@ -1057,7 +1057,7 @@ bool qcom_scm_pas_supported(u32 pas_id)
 EXPORT_SYMBOL_GPL(qcom_scm_pas_supported);
 
 static struct qcom_pas_ops qcom_pas_ops_scm = {
-	.drv_name		= "qcom_scm",
+	.drv_name		= QCOM_PAS_BACKEND_SCM,
 	.supported		= __qcom_scm_pas_supported,
 	.init_image		= __qcom_scm_pas_init_image2,
 	.mem_setup		= __qcom_scm_pas_mem_setup,
diff --git a/include/linux/firmware/qcom/qcom_pas.h b/include/linux/firmware/qcom/qcom_pas.h
index fb2ec3be6a16..6e23b806259f 100644
--- a/include/linux/firmware/qcom/qcom_pas.h
+++ b/include/linux/firmware/qcom/qcom_pas.h
@@ -13,6 +13,10 @@
 #include <linux/io.h>
 #include <linux/types.h>
 
+/* Names reported by qcom_pas_get_backend() for the active PAS backend. */
+#define QCOM_PAS_BACKEND_SCM	"qcom_scm"
+#define QCOM_PAS_BACKEND_TEE	"qcom-pas-tee"
+
 struct qcom_pas_context {
 	struct device *dev;
 	u32 pas_id;
@@ -34,6 +38,7 @@ static inline void __iomem *qcom_pas_ctx_map(struct qcom_pas_context *ctx)
 	return ptr;
 }
 
+const char *qcom_pas_get_backend(void);
 bool qcom_pas_is_available(void);
 struct qcom_pas_context *devm_qcom_pas_context_alloc(struct device *dev,
 						     u32 pas_id,

-- 
2.53.0

[PATCH 2/3] media: iris: Skip SCM call for non-SCM PAS backend

[Sumit Garg]

From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>

qcom_scm_mem_protect_video_var() is only serviced by the SCM backend;
with OP-TEE the TEE owns secure memory protection. Use
qcom_pas_get_backend() to issue the SCM call only for the SCM backend.

Assisted-by: Copilot:claude-opus-4.8
Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez.ortiz@gmail.com>
Co-developed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
 drivers/media/platform/qcom/iris/iris_firmware.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c
index 21cdf1c39835..7fbe71e21bcb 100644
--- a/drivers/media/platform/qcom/iris/iris_firmware.c
+++ b/drivers/media/platform/qcom/iris/iris_firmware.c
@@ -9,6 +9,7 @@
 #include <linux/of_address.h>
 #include <linux/of_reserved_mem.h>
 #include <linux/soc/qcom/mdt_loader.h>
+#include <linux/string.h>
 
 #include "iris_core.h"
 #include "iris_firmware.h"
@@ -158,6 +159,7 @@ static int iris_load_fw_to_memory(struct iris_core *core)
 int iris_fw_load(struct iris_core *core)
 {
 	const struct tz_cp_config *cp_config;
+	const char *pas_backend;
 	int i, ret;
 
 	ret = iris_load_fw_to_memory(core);
@@ -172,6 +174,15 @@ int iris_fw_load(struct iris_core *core)
 		return ret;
 	}
 
+	/*
+	 * qcom_scm_mem_protect_video_var() only applies to the SCM backend;
+	 * other backends (e.g. OP-TEE) own secure memory protection and do
+	 * not service this call.
+	 */
+	pas_backend = qcom_pas_get_backend();
+	if (!pas_backend || strcmp(pas_backend, QCOM_PAS_BACKEND_SCM))
+		return 0;
+
 	for (i = 0; i < core->iris_platform_data->tz_cp_config_data_size; i++) {
 		cp_config = &core->iris_platform_data->tz_cp_config_data[i];
 		ret = qcom_scm_mem_protect_video_var(cp_config->cp_start,

-- 
2.53.0

[PATCH 3/3] media: venus: Skip SCM call for non-SCM PAS backend

[Sumit Garg]

From: Sumit Garg <sumit.garg@oss.qualcomm.com>

qcom_scm_mem_protect_video_var() is only serviced by the SCM backend;
with OP-TEE the TEE owns secure memory protection. Use
qcom_pas_get_backend() to issue the SCM call only for the SCM backend.

Assisted-by: Copilot:claude-opus-4.8
Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
---
 drivers/media/platform/qcom/venus/firmware.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c
index 3a38ff985822..719dda290606 100644
--- a/drivers/media/platform/qcom/venus/firmware.c
+++ b/drivers/media/platform/qcom/venus/firmware.c
@@ -16,6 +16,7 @@
 #include <linux/firmware/qcom/qcom_scm.h>
 #include <linux/sizes.h>
 #include <linux/soc/qcom/mdt_loader.h>
+#include <linux/string.h>
 
 #include "core.h"
 #include "firmware.h"
@@ -214,6 +215,7 @@ int venus_boot(struct venus_core *core)
 	struct device *dev = core->dev;
 	const struct venus_resources *res = core->res;
 	const char *fwpath = NULL;
+	const char *pas_backend;
 	phys_addr_t mem_phys;
 	size_t mem_size;
 	int ret;
@@ -245,6 +247,14 @@ int venus_boot(struct venus_core *core)
 		return ret;
 
 	if (core->use_tz && res->cp_size) {
+		/*
+		 * qcom_scm_mem_protect_video_var() only applies to the SCM
+		 * backend; other backends (e.g. OP-TEE) own secure memory
+		 * protection and do not service this call.
+		 */
+		pas_backend = qcom_pas_get_backend();
+		if (!pas_backend || strcmp(pas_backend, QCOM_PAS_BACKEND_SCM))
+			return ret;
 		/*
 		 * Clues for porting using downstream data:
 		 * cp_start = 0

-- 
2.53.0

Re: [PATCH 2/3] media: iris: Skip SCM call for non-SCM PAS backend

[Konrad Dybcio]

On 9/11/26 2:38 PM, Sumit Garg wrote:
> From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
> 
> qcom_scm_mem_protect_video_var() is only serviced by the SCM backend;
> with OP-TEE the TEE owns secure memory protection. Use
> qcom_pas_get_backend() to issue the SCM call only for the SCM backend.
> 
> Assisted-by: Copilot:claude-opus-4.8
> Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez.ortiz@gmail.com>
> Co-developed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> ---

[...]

> +	/*
> +	 * qcom_scm_mem_protect_video_var() only applies to the SCM backend;
> +	 * other backends (e.g. OP-TEE) own secure memory protection and do
> +	 * not service this call.

Can you not just stub it out in TF-A then?

Konrad

Re: [PATCH 2/3] media: iris: Skip SCM call for non-SCM PAS backend

[Sumit Garg]

Hey Konrad,

On Fri, Sep 11, 2026 at 7:54 PM Konrad Dybcio
<konrad.dybcio@oss.qualcomm.com> wrote:
>
> On 9/11/26 2:38 PM, Sumit Garg wrote:
> > From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
> >
> > qcom_scm_mem_protect_video_var() is only serviced by the SCM backend;
> > with OP-TEE the TEE owns secure memory protection. Use
> > qcom_pas_get_backend() to issue the SCM call only for the SCM backend.
> >
> > Assisted-by: Copilot:claude-opus-4.8
> > Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez.ortiz@gmail.com>
> > Co-developed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> > Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> > ---
>
> [...]
>
> > +     /*
> > +      * qcom_scm_mem_protect_video_var() only applies to the SCM backend;
> > +      * other backends (e.g. OP-TEE) own secure memory protection and do
> > +      * not service this call.
>
> Can you not just stub it out in TF-A then?
>

Please don't, we don't want to support these random SCM calls ABI per
subsystem with the open boot stack. All the config in this case for
video is handled by OP-TEE itself.

Instead we want to mostly support any subsystem specific TZ use-cases
as proper client drivers for the TEE subsystem.

-Sumit

Re: [PATCH 2/3] media: iris: Skip SCM call for non-SCM PAS backend

[Vikash Garodia]

Hi Sumit,

On 9/14/2026 11:44 AM, Sumit Garg wrote:
> Hey Konrad,
> 
> On Fri, Sep 11, 2026 at 7:54 PM Konrad Dybcio
> <konrad.dybcio@oss.qualcomm.com> wrote:
>>
>> On 9/11/26 2:38 PM, Sumit Garg wrote:
>>> From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
>>>
>>> qcom_scm_mem_protect_video_var() is only serviced by the SCM backend;
>>> with OP-TEE the TEE owns secure memory protection. Use
>>> qcom_pas_get_backend() to issue the SCM call only for the SCM backend.
>>>
>>> Assisted-by: Copilot:claude-opus-4.8
>>> Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez.ortiz@gmail.com>
>>> Co-developed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
>>> Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
>>> ---
>>
>> [...]
>>
>>> +     /*
>>> +      * qcom_scm_mem_protect_video_var() only applies to the SCM backend;
>>> +      * other backends (e.g. OP-TEE) own secure memory protection and do
>>> +      * not service this call.
>>
>> Can you not just stub it out in TF-A then?
>>
> 
> Please don't, we don't want to support these random SCM calls ABI per
> subsystem with the open boot stack. All the config in this case for
> video is handled by OP-TEE itself.

Could you please help me understand the demerit in stubbing it out and 
let that be a dummy ABI in OPTEE world ? that way client driver can 
remain agnostic of the calls being routed to OPTEE or QTEE

> 
> Instead we want to mostly support any subsystem specific TZ use-cases
> as proper client drivers for the TEE subsystem.
> 
> -Sumit

Regards,
Vikash

Re: [PATCH 2/3] media: iris: Skip SCM call for non-SCM PAS backend

[Sumit Garg]

Hey Vikash,

On Thu, Sep 17, 2026 at 5:11 PM Vikash Garodia
<vikash.garodia@oss.qualcomm.com> wrote:
>
> Hi Sumit,
>
> On 9/14/2026 11:44 AM, Sumit Garg wrote:
> > Hey Konrad,
> >
> > On Fri, Sep 11, 2026 at 7:54 PM Konrad Dybcio
> > <konrad.dybcio@oss.qualcomm.com> wrote:
> >>
> >> On 9/11/26 2:38 PM, Sumit Garg wrote:
> >>> From: Jorge Ramirez-Ortiz <jorge.ramirez@oss.qualcomm.com>
> >>>
> >>> qcom_scm_mem_protect_video_var() is only serviced by the SCM backend;
> >>> with OP-TEE the TEE owns secure memory protection. Use
> >>> qcom_pas_get_backend() to issue the SCM call only for the SCM backend.
> >>>
> >>> Assisted-by: Copilot:claude-opus-4.8
> >>> Signed-off-by: Jorge Ramirez-Ortiz <jorge.ramirez.ortiz@gmail.com>
> >>> Co-developed-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> >>> Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> >>> ---
> >>
> >> [...]
> >>
> >>> +     /*
> >>> +      * qcom_scm_mem_protect_video_var() only applies to the SCM backend;
> >>> +      * other backends (e.g. OP-TEE) own secure memory protection and do
> >>> +      * not service this call.
> >>
> >> Can you not just stub it out in TF-A then?
> >>
> >
> > Please don't, we don't want to support these random SCM calls ABI per
> > subsystem with the open boot stack. All the config in this case for
> > video is handled by OP-TEE itself.
>
> Could you please help me understand the demerit in stubbing it out and
> let that be a dummy ABI in OPTEE world ? that way client driver can
> remain agnostic of the calls being routed to OPTEE or QTEE
>

The main disadvantage is that we don't want to carry these custom SCM
ABIs per kernel subsystem with the open source TF-A/OP-TEE boot stack.
ABIs always come with maintenance burdens, especially the custom ones
we have in this case.

Since we started from scratch for the open source boot stack, the
motivation is to keep the TZ ABI minimal and that too with
discoverable OP-TEE services like the PAS service.

-Sumit