μEFI: A Microkernel-Style UEFI with Isolation and Transparency
summary
A microkernel-style UEFI isolates drivers by deprivileging modules to user mode and placing each in its own address space, implements trampoline injection and protocol analysis to redirect calls without rewriting binaries, and applies a seccomp-like mechanism plus automated input validation to limit capabilities. A prototype on x86 and Raspberry Pi 4 requires under 100 lines of core changes, runs unmodified complex modules, and shows a measured 1.91% overhead in the UEFI boot phase with data synchronization as the main cost.
AI-written summary · about
chapters (11)
- 0:00Introduction to μEFI
- 1:00Firmware vulnerabilities
- 2:46Why UEFI bugs are dangerous
- 3:51Microkernel principles for UEFI
- 4:55Transparent isolation challenges
- 6:21Shadow services for control flow
- 7:45Dynamic protocol injection
- 9:10Cross-isolation data transfer
- 11:59Implementation and performance
- 13:45Summary and future
- 14:07Q&A
related talks
39mRunning Linux on Tiny Peripherals
28mExtending EFI support in Linux to new architectures
22mBoot Requirements and Strategies for the Edge
38mReplace Your Exploit-Ridden Firmware with Linux
21mOak stage0: a minimal firmware for (confidential) virtual machines
53mMarrying U-Boot, uEFI and grub2
43mTowards Secure Unified Kernel Images for Generic Linux Distributions and Every...
38mUEFI Secure Boot in U-Boot