Claude review: firmware: qcom: Add a PAS TEE service

[Claude Code Review Bot <claude-review@example.com>]

Patch Review

Adds the OP-TEE backed PAS service driver (`qcom_pas_tee.c`) as a TEE bus client driver.

**Observation on `qcom_pas_tee_get_rsc_table()`:**

The first `tee_client_invoke_func` call at line 239 is made with `param[1].u.memref.shm = NULL` (zero-initialized) and `param[1].u.memref.size = input_rt_size`. This appears to be a probe-then-allocate pattern -- the first call returns the required buffer size via `param[1].u.memref.size`, then a second call provides the actual buffer. This is a valid TEE convention but deserves a brief inline comment since the NULL shm with MEMREF_INOUT is unusual.

**Observation on `DEFINE_FREE(shm_free, ...)`:**

```c
DEFINE_FREE(shm_free, struct tee_shm *, tee_shm_free(_T))
```

This is file-scoped and creates an automatic cleanup helper. The `__free(shm_free)` usage in `qcom_pas_tee_get_rsc_table` is correct and the scope-based cleanup works well with the early returns.

**Minor:** `qcom_pas_tee_init_image` stores a `tee_shm` pointer in `ctx->ptr` (which is typed as `void *`), while the SCM backend stores a DMA buffer pointer there. The differentiation is handled cleanly via separate `metadata_release` callbacks, so this is fine.

**Kconfig note:**

```
config QCOM_PAS_TEE
	...
	depends on !CPU_BIG_ENDIAN
	default m if ARCH_QCOM
```

The `!CPU_BIG_ENDIAN` dependency should have a comment explaining why (presumably TEE shared memory ABI assumes little-endian layout). The `default m` is reasonable.

---

---
Generated by Claude Code Patch Reviewer