Dozens of different ways. New instructions, new privilege modes, VHE mode in EL2 can't be turned off, etc.
Obviously some of those are intentional architectural deviations, but is there a good reason to believe the stuck HCR_EL2.E2H bit isn't just an errata?
None of those are exposed to applications or in open source, are they?