[RFC PATCH 0/3] Delay switch to Non-Secure Hyp until kernel entry