Yes, that was it, thanks! Coming from KVM, I wrongly assumed HVF would set the vCPU registers on reset to a coherent state. After setting PSTATE (and a couple more registers) to reasonable values for EL2, got Linux booting in hyp mode.