SMMUv3.2 supports secure Stage-2 translations and that's the feature we intend to enable as a first step.
The IP also supports "nested translations" aka S-EL1 SMMU paravirtualization although we're not looking at this option immediately.

We're considering the SMMUv3.2 support which covers the Secure Stage-2 mappings (https://developer.arm.com/documentation/ihi0070/latest).
This is still in initial investigation phases, but we hope to share design details and early patches by end of Q4'20.

Pursuing Jose's early work through Google's gerrit interface.
We'll provide more design details in the shared SPM doc.

Nerver mind :) Glad if it works now. Cheers, Olivier.

The log seems to show additional options versus the regular TF-A build:
-march=armv8-a -O2 -pipe -fstack-protector-strong -fno-plt

I installed manjaro-arm on an rpi3 and cloned TF-A commit 0348ee49135c

Unfortunately the option won't show on asm files, but only on C files.

I tried on an arm64 machine (using gcc8.3) but did not reproduce the issue.

I suspect this problem arises because of building natively (although I agree this should normally work).

I'm not too much versed into RAS error handling, so please take my explanation below with care.
I suggest you send the question to the TF-A ML to get more sensible insights.

https://review.trustedfirmware.org/c/TF-A/trusted-firmware-a/+/2675/