On 9/25/2026 9:27 PM, Mukesh Ojha wrote: > venus_load_fw() uses qcom_mdt_load() for the TZ path and a bare > memremap()/qcom_mdt_load_no_init()/memunmap() sequence for the non-TZ > path. venus_boot() then calls qcom_pas_auth_and_reset() which skips the > shmbridge prepare step required before TrustZone authentication. > > For the TZ path, add a pas_ctx pointer to struct video_firmware so the > context can be threaded from venus_load_fw() where it is allocated to > venus_boot() where authentication happens. Replace qcom_mdt_load() with > devm_qcom_pas_context_alloc() and qcom_mdt_pas_load(), storing the > context in core->fw.pas_ctx, then pass it to > qcom_pas_prepare_and_auth_reset() in venus_boot(). > > For the non-TZ path, pass NULL to qcom_mdt_load_no_init() directly, > removing the explicit memremap()/memunmap() since qcom_mdt_load_no_init() > handles the mapping internally when mem_region is NULL. That is only true after patch 7/8, which adds the NULL mem_region handling to qcom_mdt_load_no_init(). Until then a NULL mem_region is rejected, so the !use_tz path fails between patches 4 and 7, which breaks bisection. I would suggest rearranging/splitting the patches so the qcom_mdt_load_no_init() change comes before this one. Gourav Kumar > > Signed-off-by: Mukesh Ojha <[email protected]> > --- > drivers/media/platform/qcom/venus/core.h | 2 ++ > drivers/media/platform/qcom/venus/firmware.c | 29 +++++++++----------- > 2 files changed, 15 insertions(+), 16 deletions(-) > > diff --git a/drivers/media/platform/qcom/venus/core.h > b/drivers/media/platform/qcom/venus/core.h > index 46705a666776..adcf67043bf6 100644 > --- a/drivers/media/platform/qcom/venus/core.h > +++ b/drivers/media/platform/qcom/venus/core.h > @@ -9,6 +9,7 @@ > > #include <linux/bitops.h> > #include <linux/list.h> > +#include <linux/firmware/qcom/qcom_pas.h> > #include <media/videobuf2-v4l2.h> > #include <media/v4l2-ctrls.h> > #include <media/v4l2-device.h> > @@ -223,6 +224,7 @@ struct venus_core { > size_t mapped_mem_size; > phys_addr_t mem_phys; > size_t mem_size; > + struct qcom_pas_context *pas_ctx; > } fw; > struct mutex lock; > struct list_head instances; > diff --git a/drivers/media/platform/qcom/venus/firmware.c > b/drivers/media/platform/qcom/venus/firmware.c > index 3a38ff985822..4ea4c7769ac3 100644 > --- a/drivers/media/platform/qcom/venus/firmware.c > +++ b/drivers/media/platform/qcom/venus/firmware.c > @@ -86,7 +86,6 @@ static int venus_load_fw(struct venus_core *core, const > char *fwname, > struct resource res; > struct device *dev; > ssize_t fw_size; > - void *mem_va; > int ret; > > *mem_phys = 0; > @@ -117,21 +116,19 @@ static int venus_load_fw(struct venus_core *core, const > char *fwname, > goto err_release_fw; > } > > - mem_va = memremap(*mem_phys, *mem_size, MEMREMAP_WC); > - if (!mem_va) { > - dev_err(dev, "unable to map memory region %pa size %#zx\n", > mem_phys, *mem_size); > - ret = -ENOMEM; > - goto err_release_fw; > - } > - > - if (core->use_tz) > - ret = qcom_mdt_load(dev, mdt, fwname, VENUS_PAS_ID, > - mem_va, *mem_phys, *mem_size, NULL); > - else > - ret = qcom_mdt_load_no_init(dev, mdt, fwname, mem_va, > + if (core->use_tz) { > + core->fw.pas_ctx = devm_qcom_pas_context_alloc(dev, > VENUS_PAS_ID, > + *mem_phys, > *mem_size); > + if (IS_ERR(core->fw.pas_ctx)) { > + ret = PTR_ERR(core->fw.pas_ctx); > + core->fw.pas_ctx = NULL; > + goto err_release_fw; > + } > + ret = qcom_mdt_pas_load(core->fw.pas_ctx, mdt, fwname, NULL); qcom_mdt_pas_load() passes the ctx to qcom_pas_init_image(), which keeps the metadata buffer in ctx->ptr, and qcom_pas_prepare_and_auth_reset() does not free it. Who is expected to call qcom_pas_metadata_release() for venus? Gourav Kumar > + } else { > + ret = qcom_mdt_load_no_init(dev, mdt, fwname, NULL, > *mem_phys, *mem_size, NULL); > - > - memunmap(mem_va); > + } > err_release_fw: > release_firmware(mdt); > return ret; > @@ -237,7 +234,7 @@ int venus_boot(struct venus_core *core) > core->fw.mem_phys = mem_phys; > > if (core->use_tz) > - ret = qcom_pas_auth_and_reset(VENUS_PAS_ID); > + ret = qcom_pas_prepare_and_auth_reset(core->fw.pas_ctx); ctx->use_tzmem is not set for venus, so the shmbridge creation in qcom_scm_pas_prepare_and_auth_reset() is skipped and the behaviour is the same as the old qcom_pas_auth_and_reset(). Please reword the commit message accordingly, since it currently implies that the prepare step is now performed by the new API as a fix. Gourav Kumar > else > ret = venus_boot_no_tz(core, mem_phys, mem_size); >
