[RFC 10/11] efi, arm64: Sandbox Runtime Services in a VM

2017-08-25 Thread Florent Revest
EFI Runtime Services are binary blobs currently executed in a special memory context but with the privileges of the kernel. This can potentially cause security or stability issues (registers corruption for example). This patch adds a CONFIG_EFI_SANDBOX option that can be used on arm64 to enclose

[RFC 10/11] efi, arm64: Sandbox Runtime Services in a VM

2017-08-25 Thread Florent Revest
EFI Runtime Services are binary blobs currently executed in a special memory context but with the privileges of the kernel. This can potentially cause security or stability issues (registers corruption for example). This patch adds a CONFIG_EFI_SANDBOX option that can be used on arm64 to enclose