[RyanTheTide]

What changed

This branch adds the J700/T8140 Aura monitor support required to run Linux at virtual EL2 and use KVM, while preserving the normal physical-EL1 boot path.

• Adds PSCI 1.1 over trapped SMC for the EL1 OS, including CPU bring-up, hotplug, suspend, reset and power-off paths.
• Adds opt-in FEAT_NV2 support for Linux at virtual EL2. aura-nv2 or an NV2_BOOT=1 development image arms the path; ordinary boots leave NV2 disabled.
• Keeps the implementation VHE-only: NV and NV2 are enabled together, NV1 is never set, and the exposed ID state reports the supported NV2/VHE contract.
• Implements the ERET fast path, trapped EL2-register handling, EL1 register-bank switching, guest stage-2 entry/exit, timers, vGIC state, TLBI/AT handling, nested guest-hypervisor state, and exception reflection.
• Preserves the T8140 PMU contract across guest exits. Apple PMU trap syndromes are forwarded through AFSR1, and guest PMCR1 filters are loaded and restored around guest execution.
• Adds an opt-in NV2 trace ring for development builds. It is not enabled or printed synchronously on the production path.

The Linux-side fixed-counter T8140 PMU registration and stage-2 invalidation optimization are in the companion Linux PR #731.

Validation

Proxy and J700 validation covered the monitor behavior before Linux boot, including PMU syndrome forwarding and PMCR1 restoration on both CPU clusters. The Aura release chainloading build passes, and the changed C/H files pass clang-format checks.

On J700, the NV2 image was validated with:

• all six host CPUs at virtual EL2 with VHE KVM initialized;
• raw KVM and Fedora Linux guests, including 1/2/4/6-vCPU runs, VM lifecycle stress and a five-minute concurrent stress run;
• recursive Linux KVM (L1 → L2 virtual EL2 → L3 Linux userspace) with timers, IPIs, fixed counters and exception-state checks;
• Windows 11 Pro Arm64 10.0.26300.9457 installed and booted to its desktop, then repeat-booted with six vCPUs using unrestricted host scheduling, arithmetic and disk write/readback checks, benchmark rounds and clean shutdown.

Measured performance

The trace-disabled NV2 runs measured 1.31–1.37 μs per in-kernel HVC exit on a P-core and 2.55–2.57 μs on an E-core. Userspace MMIO exits measured 2.68–2.70 μs on P-cores and 4.16–4.95 μs on E-cores. The ERET gate itself measured 168 ns per round trip in the proxy. These are measured NV2 costs; they are not a comparison against real-EL2 KVM or a claim of zero overhead.

Known limits

The emulated TPM reports Windows TPM/attestation errors. EFI runtime-service behavior during the diskless EDK2 shutdown path and suspend/resume at virtual EL2 remain unverified. High-rate PMU sampling in recursive guests can be throttled by Linux; the diagnostic unthrottled mode is disposable test configuration only. Unsupported T8140 programmable PMU events remain rejected rather than mapped from unverified event numbers.

[AxxzyWasTaken]

Some notes from implementing PSCI CPU_ON/CPU_OFF (over HVC, Linux at EL1 under the monitor) on M4 Max (T6041, J616C). They may save time for whoever takes this PR to M4.

Two bugs that made bringing a core back kill the whole machine. Linux's offline/online looked fine until the core re-entered the kernel, and then every CPU died at once with nothing printed:

1. Hand the core back with its EL1 MMU off. After CPU_OFF the core still has SCTLR_EL1.M=1 and the OS's old TTBRs. Linux's secondary_entry is a physical address and expects the MMU off, as from reset (TF-A does the same on CPU_ON). Without resetting SCTLR_EL1 (SCTLR_EL12 from EL2 with E2H) the first fetch goes through stale page tables. Writing SCTLR_EL12 = 0x30d00800 (RES1 only) before the ERET fixed it.
2. Clean+invalidate the core's caches before parking it (DC CISW over all levels, IC IALLU, then TLBI ALLE1 before re-entry). Dirty lines left from before CPU_OFF otherwise overwrite kernel data later.

With both, offline/online works on every core, including the iBoot boot core.

M4-specific things we hit:

• A power-gated WFI at EL2 loses state on M4, consistent with unsafe_wfi. Linux at EL1 only needs x18–x30 saved across WFI (apple_cpu_wfi), but waking a core that was waiting in WFI at EL2 by fast IPI was not survivable here. Parking offline cores in WFE at EL2 (powered), as this PR does, works.
• Restarting a core through CPU_START (+0x4/+0x8) after a CPU_START +0x0 stop request hung the SoC in every variant we tried, including clearing the stop bit first. The +0x0 bit stays latched after the core powers off (read back e.g. 0xe040 for P0 core 2). This was before the two fixes above, so it may be worth retrying with them.
• Linux reports IRQnn: set affinity failed(-38) for a few IRQs on offline (AICv3 has no per-IRQ affinity). Harmless here.

SYSTEM_SUSPEND, in case anyone tries it: doing what XNU's system sleep does on the last core (S3_5_C15_C6_2 |= 1 | 1<<63, then WFI) is not enough on its own. Battery drain showed the SoC stayed awake (~3–5 W) with the other cores parked powered. Details: aurora-silicon/linux#791