[monocasa]

WRT SMC, I guess I figured it'd be used to put some firmware code in EL2, but not be the exclusive owner of EL2 if that's possible. Cut out a reserved region of mem in m1n1 or u-boot, and an EL2 SMC call would simply be a jump to that code without a mode switch. You'd see that kinda thing in some older ARM RTOSes which would run everything at the same privilege level, but use SWI as a core executive invoke. Of course now that I've typed this all out I realize that I was kinda assuming that there'd be some SMC-hack specific vector table that it could own, but it probably traps to the normal EL2 one which I think is what you're hinting at...

Anyways, is there anything that a systems engineer with RE experience and isn't looking for any of y'all's donations can do to help out? I'm between jobs and it seems like fun.