Signed-off-by: Johann Neuhauser <jneuhauser@dh-electronics.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Signed-off-by: Johann Neuhauser <jneuhauser@dh-electronics.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Signed-off-by: Johann Neuhauser <jneuhauser@dh-electronics.com>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

In order to use login methods `TEEC_LOGIN_USER` and `TEEC_LOGIN_GROUP`,
a user space application must initialize the tokens with the SHA1
hashed UUID of the user or group.

Select host-pkgconf, util-linux and libuuid in order to use `libuuid`
and add supporting libraries to optee_client for this type of ACL based
login initialization.

Signed-off-by: Eero Aaltonen <eero.aaltonen@vaisala.com>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

Buildroot parallel build is allowed when BR2_PER_PACKAGE_DIRECTORIES is
'y', see commit e9bff1c8 ("common.mk: buildroot: enable top-level
parallel build"). When disabled, Buildroot is not supposed to spawn
several make jobs simultaneously. However for some reason it seems it
can happen, see the IBART failure at [1]. The steps:
 >>> optee_client_ext 1.0 Fixing libtool files
and:
 >>> pcsc-lite 1.9.4 Fixing libtool files
...seem to be running simultaneously and touching the same path (since
per-package is disabled), which results in:
 mv: cannot stat '/home/optee/devel/qemu/out-br/host/arm-buildroot-linux-gnueabihf/sysroot/usr/lib/libpcsclite.la.fixed': No such file or directory
 package/pkg-generic.mk:331: recipe for target '/home/optee/devel/qemu/out-br/build/pcsc-lite-1.9.4/.stamp_staging_installed' failed

I confirmed the fact by adding a 'sleep 5' after "Fixing libtool files"
in package/pkg-generic.mk, as well as a 'ps -ef | grep sleep | grep -v
grep || :' just before the sleep. Then when building with
'make -j32 BR2_PER_PACKAGE_DIRECTORIES=n' (32 core machine) the 'sleep 5'
is displayed occasionally.

To avoid that, let's explicitly invoke make with -j1 when
BR2_PER_PACKAGE_DIRECTORIES is disabled.

Link: [1] https://optee.mooo.com:5000/logs/OP-TEE/optee_os/5487/1027234243/9147c347fb53612f62bf7de1c17e47a246d61ef2#02-qemu-build

 line 16398:
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

On an Aarch64 host, "make toolchains" does not use parallel jobs when
building the Aarch64 GCC and the following warning is shown:

 $ make -j32 toolchains
 [...]
 make[1]: warning: jobserver unavailable: using -j1.  Add `+' to parent make rule.

Therefore, add the '+' sign as recommended. This speeds up the build
quite a bit on a 32-core machine for example.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

The warning on option "-t" is remove in below commit.

https://gitlab.gnome.org/GNOME/gnome-terminal/-/commit/54da2fe919634e2d6a6aab392b36449947b812cd



And it seens work again, so add it back to make the
terminal title understandable.

Signed-off-by: Mark-PK Tsai <mark-pk.tsai@mediatek.com>
Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>

Increase the size of the guest (DomU) RAM from 128 to 160 MB to fix
an issue with xtest 6018:

  * regression_6018 Large object
  o regression_6018.1 Storage id: 00000001
  writing 0
  writing 1
  writing 2
  writing 3
  writing 4
  writing 5
  regression_6000.c:1895: fs_write(&sess, obj, block, block_size) has an unexpected value: 0xffff3024 = TEE_ERROR_TARGET_DEAD, expected 0x0 = TEEC_SUCCESS
    regression_6018.1 FAILED

For some reason, this test passes in CI [1] but not on my laptop
("make XEN_BOOT=y run", login: "root", run /bin/domu, login: "test"
then run "xtest 6018"). tee-supplicant receives error ENOSPC when
trying to write to /data/tee. Since the root FS in the guest is a
ramdisk, increasing the RAM seems to be the appropriate solution.

Link: [1] https://github.com/OP-TEE/optee_os/blob/578f89d28d2b66c35128f095989c355fbc2ef3ab/.azure-pipelines.yml#L256


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Configures U-Boot with stm32mp15_defconfig that was introduced in
U-Boot tag v2021.10 for devices booted with OP-TEE and U-Boot stored
in TF-A FIP container. From U-Boot v2021.10 onward,
stm32mp15_trusted_defconfig is dedicated to boot scheme that do not
use TF-A FIP format.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

The regular expression used to detect TEE core panics or assertion
failures must not allow multi-line text to match, otherwise the following
input may trigger it (test case: xtest 1007 with "make COMPILER=clang").

E/TC:? 0 TA panicked with code 0xbeef
E/LD:  Status of TA 5b9e0e40-2636-11e1-ad9e-0002a5d5c51b
E/LD:   arch: arm
E/LD:  region  0: va 0x00102000 pa 0x0e300000 size 0x002000 flags rw-s (ldelf)
E/LD:  region  1: va 0x00104000 pa 0x0e302000 size 0x00e000 flags r-xs (ldelf)
E/LD:  region  2: va 0x00112000 pa 0x0e310000 size 0x001000 flags rw-s (ldelf)
E/LD:  region  3: va 0x00113000 pa 0x0e311000 size 0x004000 flags rw-s (ldelf)
E/LD:  region  4: va 0x00117000 pa 0x0e315000 size 0x001000 flags r--s
E/LD:  region  5: va 0x00118000 pa 0x0e410000 size 0x003000 flags rw-s (stack)
E/LD:  region  6: va 0x00184000 pa 0x00001000 size 0x015000 flags r-xs [0]
E/LD:  region  7: va 0x00199000 pa 0x00016000 size 0x0e5000 flags rw-s [0]
E/LD:  assertion 'maps[map_idx].sz == sz' failed at ldelf/ta_elf.c:1451 in ta_elf_print_mappings()

In addition to using '[^n]*' instead of '.*', a couple of things need
fixing too:

- In Expect, `^` and `$` are the beginning and end of the current matching
buffer, not the beginning and end of a line. Therefore `^` is not
appropriate here.
- `\n` should not be matched because if it is consumed for example at the
end of an expression to mean "end of line", then it cannot be available to
another expression to mean "beginning of line".

Fixes: 09900ef9 ("qemu-check.exp: trap only OP-TEE Core assert or panic")
Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Etienne Carriere <etienne.carriere@linaro.org>

Build the Linux test applications used by Trusted Services to invoke the
services provided by Secure Partitions.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

Build the Linux drivers used by Trusted Services to access FF-A from
user space.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

Add support for building Secure Partitions implemented by the Trusted
Services project. The patch contains helper functions to invoke the TS
buildsystem in order to build SPs and include them into the OP-TEE bin.
It also adds a new top level Makefile which configures OP-TEE and TF-A
for the S-EL1 SPMC scenario on FVP platform.

Link: https://www.trustedfirmware.org/projects/trusted-services/


Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Reviewed-by: Gyorgy Szing <gyorgy.szing@arm.com>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

The Measured Boot option not only enables the relevant config options
for TF-A and optee_os, but also building the fTPM TA and its Linux
driver. This is unnecessary when the consumer of the Event Log is not
fTPM but e.g. the PSA Attestation SP (as introduced in the next commit).

This commit modifies the MEASURED_BOOT option to only set the TF-A and
optee_os config, and adds the MEASURED_BOOT_FTPM option for the fTPM
related components. To keep backwards compatibility if MEASURED_BOOT is
selected, by default MEASURED_BOOT_FTPM is enabled too.

Reviewed-by: Gyorgy Szing <gyorgy.szing@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

Add support for sharing a host directory with the FVP.

Reviewed-by: Gyorgy Szing <gyorgy.szing@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

Add support for running the Base Platform FVP. This model offers more
configuration options and more peripherals than the Foundation model.
It's available free of charge on the Arm Developer website.

Link: https://developer.arm.com/downloads/-/arm-ecosystem-models


Reviewed-by: Gyorgy Szing <gyorgy.szing@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

Refactor the FVP path and argument variables to prepare for adding a new
FVP platform in the next commit.

Reviewed-by: Gyorgy Szing <gyorgy.szing@arm.com>
Reviewed-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Balint Dobszay <balint.dobszay@arm.com>

Adds Xen upstream patch "optee: enable OPTEE_SMC_SEC_CAP_MEMREF_NULL
capability" ([1] present in Xen 4.16.0) in order to avoid failures in
the GlobalPlatform test suite [2]:

 optee/build $ export GP_PACKAGE=~/work/TEE_Initial_Configuration-Test_Suite_v2_0_0_2-2017_06_09.7z
 optee/build $ make -j10 XEN_BOOT=y run
 ...
 $ xtest gp_
 ...
 gp_10081 FAILED first error at gp_10000.c:1653
 gp_10082 FAILED first error at gp_10000.c:1673
 gp_10083 FAILED first error at gp_10000.c:1693
 gp_10155 FAILED first error at gp_10000.c:3346
 gp_10156 FAILED first error at gp_10000.c:3366
 gp_10157 FAILED first error at gp_10000.c:3386
 gp_10229 FAILED first error at gp_10000.c:5039
 gp_10230 FAILED first error at gp_10000.c:5059
 gp_10231 FAILED first error at gp_10000.c:5079
 gp_10303 FAILED first error at gp_10000.c:6732
 gp_10304 FAILED first error at gp_10000.c:6752
 gp_10305 FAILED first error at gp_10000.c:6772
 gp_10632 FAILED first error at gp_10000.c:15608
 gp_10633 FAILED first error at gp_10000.c:15629
 gp_10634 FAILED first error at gp_10000.c:15650
 gp_10706 FAILED first error at gp_10000.c:17375
 gp_10707 FAILED first error at gp_10000.c:17396
 gp_10708 FAILED first error at gp_10000.c:17417
 gp_10780 FAILED first error at gp_10000.c:19142
 gp_10781 FAILED first error at gp_10000.c:19163
 gp_10782 FAILED first error at gp_10000.c:19184
 gp_10854 FAILED first error at gp_10000.c:20909
 gp_10855 FAILED first error at gp_10000.c:20930
 gp_10856 FAILED first error at gp_10000.c:20951

For each failed test there is a TA log:

 E/TA:  checkUpdateParameterMemref:195 Received buffer is not NULL but expected to be NULL.

Link: [1] https://xenbits.xen.org/gitweb/?p=xen.git;a=commit;h=d4fb5f166c2b
Link: [2] https://github.com/OP-TEE/optee_os/issues/4897


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

"make optee-rust OPTEE_RUST_ENABLE=y" always runs the setup.sh script
in $(ROOT)/optee_rust. The script clones about 600 MB of data. That
can't be done each time especially since the check-rust target depends
on optee-rust.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Tested-by: Yuan Zhuang <zhuangyuan04@baidu.com>
Acked-by: Yuan Zhuang <zhuangyuan04@baidu.com>

Adds a Xen bug fix from upstream [1]. With this we will be able to get
rid of a revert in the linux kernel [2].

Link: [1] https://github.com/xen-project/xen/commit/1c3ed9c908732d19660fbe83580674d585464d4c
Link: [2] https://github.com/linaro-swg/linux/commit/665750f493d3fcf307952f19c0442c092b76d852


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Commit 8b808915 ("qemu_v8: xen: apply patch to fix issue with RPC
buffer release") really did only one part of the job. Only the Xen tools
are built with Buildroot; the hypervisor itself (which needs the patch
mentioned in the commit) is actually built from the top-level xen/
directory. As a result the issue is stil present.
This commit changes the QEMUv8 makefiles as well as the Buildroot
configuration for Xen so that both the hypervisor and the tools are
built. As for the Xen configuration (enabling OP-TEE support), it is
introduced via a patch to the defconfig file.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Adds a patch to revert a Xen commit [1] which causes a regression with
OP-TEE. There is no more logs to the secure console after these lines:

 I/TC: Added guest 1
 D/TC:2   tee_entry_exchange_capabilities:100 Asynchronous notifications are disabled
 D/TC:2   tee_entry_exchange_capabilities:109 Dynamic shared memory is enabled

...and TAs fail to open sessions with TEEC_ERROR_COMMUNICATION.

This is to prepare building Xen with Buildroot. The version of Xen
pulled by $(ROOT)/buildroot/package/xen is 4.14.3 and is affected by this
issue while the one we are currently using in $(ROOT)/xen is 4.14.1
and doesn't have the regression.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

When C source code is built into the Rust TA, the Rust crate `cc`[1]
uses gcc compiler defined in the env var `CC`. Setting `CC` in
`optee_rust_examples_ext.mk` fixes the building error of those Rust
TAs in buildroot.

[1] https://crates.io/crates/cc



Signed-off-by: Yuan Zhuang <zhuangyuan04@baidu.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

In the new version of Teaclave TrustZone SDK, OPTEE_DIR is checked
in setup.sh. If OPTEE_DIR is not set, it will download OP-TEE source
code.
Set OPTEE_DIR as the directory of OP-TEE repo.

Signed-off-by: Yuan Zhuang <zhuangyuan04@baidu.com>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

With LOG_LEVEL=50 and DEBUG=1, BL31 becomes too big, with LOG_LEVEL=40
we will miss a few debug prints, but it will at produce a valid binary
and more importantly, you'll get an elf-file with all debug symbols,
i.e., it's GDB makes up for the missing prints.

Signed-off-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome.forissier@linaro.org>

CFG_FLASH_SIZE can be used to generate only linux-4g or linux-8g instead
of both.

Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Adds a patch to be applied by Buildroot when building Xen. This fixes a
race condition in RPC buffer management, which causes random failures in
the OP-TEE CI jobs [1]. The patch is being upstreamed [2].

Link: [1] https://dev.azure.com/OPTEE/optee_os/_build/results?buildId=2827&view=logs&j=705748f3-7146-5e86-79af-1c0266d20a8c&t=d3458a7d-1a81-5639-8e63-8927d807e53a&l=7812
Link: [2] https://lists.xenproject.org/archives/html/xen-devel/2022-05/msg00245.html
Fixes: https://github.com/OP-TEE/optee_os/issues/5288


Signed-off-by: Jerome Forissier <jerome.forissier@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>

Introduces the option MEMTAG which enabled tagging of memory using the
ARM Memory Tagging Extension (MTE).

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Updates the matching rules to only trap OP-TEE Core assert or panic.
Panic or assert in a TA may very well be part of a test case.

Reviewed-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Adds a missing linux dependency for the flash-image target.

This should fix erros like:
  CC [M]  drivers/gpu/drm/nouveau/nvkm/subdev/i2c/bus.o
mformat -i .../build/../out/boot.img.fat -n 64 -h 255 -T 131072 -v "BOOT IMG" -C ::
mcopy -i .../build/../out/boot.img.fat .../build/../linux/arch/arm64/boot/Image ::
.../build/../linux/arch/arm64/boot/Image: No such file or directory

Acked-by: Jerome Forissier <jerome.forissier@linaro.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Provision a GPT partition for U-Boot to store its environment. U-Boot
expects this partition to be labeled u-boot-env.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

Changes stm32mp1 SDcard partitions to use a single FIP formatted image
to store U-Boot and OP-TEE binaries. The change also removes duplicated
fsbl partition that is not used.

Changes build directives to use standard OP-TEE binary images and embed
U-Boot DTB in the FIP image.

Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

Set BR2_PER_PACKAGE_DIRECTORIES=y to allow better parallelism when
building Buildroot packages [1] and therefore faster build times on
multi-core machines.

Link: [1] https://buildroot.org/downloads/manual/manual.html#top-level-parallel-build


Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

When BR2_PACKAGE_OPENSSL=y, OPENSC_DEPENDENCIES is overwritten with
'openssl' which is wrong. 'openssl' should be appended instead,
otherwise the dependency on 'pcsc-lite' is lost.

This issue was found when building with BR2_PER_PACKAGE_DIRECTORIES=y
which triggers a parallel build. It looks like the non-parallel build
works by chance (a matter of build order probably).

Signed-off-by: Jerome Forissier <jerome@forissier.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Steps to reproduce:
1)cd into the QEMU build directory
2)make CFG_TEE_BENCHMARK=y run

We end up in a compile error as mentioned in
https://github.com/OP-TEE/build/issues/489 and
https://github.com/linaro-swg/optee_benchmark/issues/17



Turns out the path to benchmark sources wasn't properly
defined and hence "BR2_PACKAGE_OPTEE_BENCHMARK_EXT_SITE"
was incorrect.

Signed-off-by: Sadiq Hussain <sadiq.muchumarri@intel.com>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

Adds support for building TF-A and OP-TEE the SPMC at EL3.

A special manifest is added to be consumed by the SPMC.

Acked-by: Jerome Forissier <jerome@forissier.org>
Signed-off-by: Jens Wiklander <jens.wiklander@linaro.org>

Introduces option PAUTH, which can be used to enable
Pointer Authentication for TA's.

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>

XEN fails to boot linux when cpu is selected as max with following
kernel crash. Hence revert to using cortex-a57 when XEN_BOOT is
selected.

[    0.000000] ------------[ cut here ]------------
[    0.000000] kernel BUG at arch/arm64/kernel/traps.c:498!
[    0.000000] Internal error: Oops - BUG: 0 [#1] PREEMPT SMP
[    0.000000] Modules linked in:
[    0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.16.0-gdbeb6ea978fc #1
[    0.000000] Hardware name: linux,dummy-virt (DT)
[    0.000000] pstate: 000000c5 (nzcv daIF -PAN -UAO -TCO -DIT -SSBS BTYPE=--)
[    0.000000] pc : do_undefinstr+0x2bc/0x2e0
[    0.000000] lr : do_undefinstr+0x2c8/0x2e0
[    0.000000] sp : ffffd399cddc3c60
[    0.000000] x29: ffffd399cddc3c60 x28: ffffd399cddd34c0 x27: 0000000000000000
[    0.000000] x26: 0000000000000000 x25: 0000000000000000 x24: ffffd399cd830008
[    0.000000] x23: 00000000000000c5 x22: ffffd399cd7810bc x21: ffffd399cddc3e30
[    0.000000] x20: 00000000d5182101 x19: ffffd399cddc3ce0 x18: 0000000000000014
[    0.000000] x17: 0000000049426f60 x16: 0000000056a84232 x15: 0000000099ac15ae
[    0.000000] x14: 00000000ab810c49 x13: 501bac190a4c3eb1 x12: 89c8a6a0aab2e7c5
[    0.000000] x11: 00000000c16d9c19 x10: 00000000e4fb46a5 x9 : 00000000d78a73db
[    0.000000] x8 : 0000000000000014 x7 : 501bac190a4c3eb1 x6 : 89c8a6a0aab2e7c5
[    0.000000] x5 : ffffd399cddd5910 x4 : 0000000000000000 x3 : ffffd399ce0e70f8
[    0.000000] x2 : 0000000000000000 x1 : ffffd399cddd34c0 x0 : 00000000000000c5
[    0.000000] Call trace:
[    0.000000]  do_undefinstr+0x2bc/0x2e0
[    0.000000]  el1_undef+0x2c/0x4c
[    0.000000]  el1h_64_sync_handler+0x84/0xd0
[    0.000000]  el1h_64_sync+0x78/0x7c
[    0.000000]  start_kernel+0x4c4/0x664
[    0.000000]  __primary_switched+0xc0/0xc8
[    0.000000] Code: 17ffff8d a9425bf5 17ffffb1 a9025bf5 (d4210000)
[    0.000000] ---[ end trace 32823fcd1957a64b ]---
[    0.000000] Kernel panic - not syncing: Attempted to kill the idle task!
[    0.000000] ---[ end Kernel panic - not syncing: Attempted to kill the idle task! ]---

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Reviewed-by: Jerome Forissier <jerome@forissier.org>

Explicitly enable platform config switch STM32MP_USE_STM32IMAGE to
enforce TF-A legacy boot of OP-TEE and U-Boot images in several storage
partitions. Platform stm32mp1 changed in TF-A v2.6 in that the default
configuration do enable use of a FIP image.

Upgrading platform build to use FIP is out of the scope of this change.

Acked-by: Jerome Forissier <jerome@forissier.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Signed-off-by: Etienne Carriere <etienne.carriere@linaro.org>

-cpu max provides support of maximum feature set available with
AArch64 architecture.This includes FEAT_PAuth and FEAT_BTI.

Additionally sve is turned off as linux fails to boot with sve=on
when -cpu max is enabled.

Signed-off-by: Ruchika Gupta <ruchika.gupta@linaro.org>
Acked-by: Joakim Bech <joakim.bech@linaro.org>
Acked-by: Jens Wiklander <jens.wiklander@linaro.org>
Acked-by: Jerome Forissier <jerome@forissier.org>