[PATCH 1/2] efi: loader: in-place patch the runtime services on ExitBootServices

[PATCH 1/2] efi: loader: in-place patch the runtime services on ExitBootServices

[Ahmad Fatoum]

ExitBootServices() repoints systab->runtime at a separate table with the
detached runtime services. If an EFI application caches RT, it may end
up calling into the stale boot-time runtime services object.

Fix this by keeping the systab->runtime pointer the same and do a
"deep copy" by rewriting the object including its callbacks instead.

Cc: Johannes Schauer Marin Rodrigues <josch@debian.org>
Fixes: 699145f1cb22 ("efi: runtime: add runtime service support after ExitBootServices")
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 efi/loader/boot.c      | 5 ++++-
 efi/loader/runtime.c   | 2 +-
 efi/loader/watchdog.c  | 4 ++--
 efi/runtime/services.c | 3 ++-
 include/efi/loader.h   | 2 +-
 5 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/efi/loader/boot.c b/efi/loader/boot.c
index 2d98c95b5c34..ddfbf33bff69 100644
--- a/efi/loader/boot.c
+++ b/efi/loader/boot.c
@@ -3879,6 +3879,8 @@ static struct efi_boot_services efi_boot_services = {
 
 static __efi_runtime_data u16 firmware_vendor[] = L"barebox";
 
+static __efi_runtime_data struct efi_runtime_services efi_runtime_services;
+
 __efi_runtime_data struct efi_system_table systab = {
 	.hdr = {
 		.signature = EFI_SYSTEM_TABLE_SIGNATURE,
@@ -3925,8 +3927,9 @@ efi_status_t efi_initialize_system_table(void)
 	systab.boottime = &efi_boot_services;
 
 	/*
-	 * This will be overwritten dynamically at detach time.
+	 * This must be overwritten dynamically at detach time.
 	 */
+	efi_runtime_services = efi_runtime_services_boot;
 	systab.runtime = &efi_runtime_services;
 
 	/* Set CRC32 field in table headers */
diff --git a/efi/loader/runtime.c b/efi/loader/runtime.c
index a8f872f23b48..329e1077889f 100644
--- a/efi/loader/runtime.c
+++ b/efi/loader/runtime.c
@@ -293,7 +293,7 @@ static efi_status_t EFIAPI efi_set_time_boottime(struct efi_time *time)
  * the runtime services will be replaced by the detached implementation,
  * so we need not take any special consideration here.
  */
-struct efi_runtime_services efi_runtime_services = {
+struct efi_runtime_services efi_runtime_services_boot = {
 	.hdr = {
 		.signature = EFI_RUNTIME_SERVICES_SIGNATURE,
 		.revision = EFI_SPECIFICATION_VERSION,
diff --git a/efi/loader/watchdog.c b/efi/loader/watchdog.c
index a4715c149add..c29f91a0aa07 100644
--- a/efi/loader/watchdog.c
+++ b/efi/loader/watchdog.c
@@ -35,8 +35,8 @@ static void EFIAPI efi_watchdog_timer_notify(struct efi_event *event,
 	EFI_ENTRY("%p, %p", event, context);
 
 	pr_emerg("\nEFI: Watchdog timeout\n");
-	EFI_CALL_VOID(efi_runtime_services.reset_system(EFI_RESET_COLD,
-							EFI_SUCCESS, 0, NULL));
+	EFI_CALL_VOID(systab.runtime->reset_system(EFI_RESET_COLD,
+						   EFI_SUCCESS, 0, NULL));
 
 	EFI_EXIT(EFI_UNSUPPORTED);
 }
diff --git a/efi/runtime/services.c b/efi/runtime/services.c
index 5044e16c7c5c..dc4960ac4763 100644
--- a/efi/runtime/services.c
+++ b/efi/runtime/services.c
@@ -293,7 +293,8 @@ void efi_runtime_detach(struct efi_system_table *systab)
 	systab->std_err = NULL;
 	systab->boottime = NULL;
 
-	systab->runtime = &efi_runtime_services_detached;
+	/* Payloads may have cached systab->runtime, so patch it in place */
+	*systab->runtime = efi_runtime_services_detached;
 
 	/* Recalculate CRC32 */
 	efi_update_table_header_crc32(&systab->hdr);
diff --git a/include/efi/loader.h b/include/efi/loader.h
index 4dcd15854560..0ccc0a720a90 100644
--- a/include/efi/loader.h
+++ b/include/efi/loader.h
@@ -19,7 +19,7 @@ struct efi_table_hdr;
 /* Key identifying current memory map */
 extern efi_uintn_t efi_memory_map_key;
 
-extern struct efi_runtime_services efi_runtime_services;
+extern struct efi_runtime_services efi_runtime_services_boot;
 extern struct efi_system_table systab;
 
 extern struct efi_simple_text_output_protocol efi_con_out;
-- 
2.47.3

[PATCH 2/2] efi: runtime: accept 1:1 mappings in SetVirtualAddressMap

[Ahmad Fatoum]

We do not support SetVirtualAddressMap() and UEFI v2.8 permits
this as long as our EFI_RT_PROPERTIES_TABLE doesn't claim
EFI_RT_SUPPORTED_SET_VIRTUAL_ADDRESS_MAP, which we adhere to[1].

NetBSD's efiboot doesn't seem to care for lack of this bit and
calls SetVirtualAddressMap() unconditionally[2]. This will return with
an error, which has NetBSD call printf() _after_ ExitBootServices[3]
leading to a crash[4].

Fortunately, barebox is not the only firmware that doesn't implement
a full-fledged SetVirtualAddressMap().
Quoting NetBSD commit 41096fd ("efiboot: Use 1:1 PA to VA mappings for
RT services.")[5]:

| UEFI firmware on Snapdragon X Elite devices crashes when
| SetVirtualAddressMap is called with runtime mappings that are not 1:1.
| Always do this on arm64 as it won't interfere with KVA and will help us
| avoid avoid a very common class of firmware bugs.

This means we have an easy way for barebox to workaround this:
Instead of returning EFI_UNSUPPORTED unconditionally, we can handle the
trivial identity mapping case specially and report EFI_SUCCESS for it.

While NetBSD doesn't need it, also implement a 1:1 ConvertPointer for
good measure.

[1]: https://uefi.org/specs/UEFI/2.10/04_EFI_System_Table.html
[2]: https://github.com/NetBSD/src/blob/41096fd/sys/stand/efiboot/efiboot.c#L135
[3]: https://github.com/NetBSD/src/blob/41096fd/sys/stand/efiboot/efifdt.c#L813
[4]: https://gnats.netbsd.org/60890
[5]: https://github.com/NetBSD/src/commit/41096fd4f7bac2ade3f29e9e6e00951aef9e16ce

Reported-by: Johannes Schauer Marin Rodrigues <josch@debian.org>
Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
---
 efi/runtime/services.c | 67 ++++++++++++++++++++++++++++++++++++++++--
 include/efi/memory.h   |  6 ++++
 include/efi/services.h |  2 ++
 3 files changed, 73 insertions(+), 2 deletions(-)

diff --git a/efi/runtime/services.c b/efi/runtime/services.c
index dc4960ac4763..ca60ae512a2d 100644
--- a/efi/runtime/services.c
+++ b/efi/runtime/services.c
@@ -171,17 +171,80 @@ static efi_status_t EFIAPI efirt_set_wakeup_time(char enabled,
 	return efirt_unimplemented();
 }
 
+/**
+ * efirt_set_virtual_address_map() - change from physical to virtual mapping
+ *
+ * This function implements the SetVirtualAddressMap() runtime service.
+ * The barebox runtime isn't relocated and only an identity mapping
+ * is accepted.
+ *
+ * We intentionally don't announce support via the EFI_RT_PROPERTIES_TABLE,
+ * so only operating systems that ignore the table would end up here.
+ * If they configure a 1:1 mapping like NetBSD, we tolerate it and return
+ * success.
+ *
+ * See the Unified Extensible Firmware Interface (UEFI) specification for
+ * details.
+ *
+ * @memory_map_size:	size of the virtual map
+ * @descriptor_size:	size of an entry in the map
+ * @descriptor_version:	version of the map entries
+ * @virtmap:		virtual address mapping information
+ * Return:		status code
+ */
 static efi_status_t EFIAPI efirt_set_virtual_address_map(size_t memory_map_size,
 							 size_t descriptor_size,
 							 uint32_t descriptor_version,
 							 struct efi_memory_desc *virtmap)
 {
-	return efirt_unimplemented();
+	static bool efirt_virtmap_set;
+
+	EFI_ENTRY(L"");
+
+	if (efirt_virtmap_set)
+		return EFI_EXIT(EFI_UNSUPPORTED);
+
+	if (descriptor_version != EFI_MEMORY_DESCRIPTOR_VERSION ||
+	    descriptor_size < sizeof(*virtmap))
+		return EFI_EXIT(EFI_INVALID_PARAMETER);
+
+	for (size_t off = 0; off < memory_map_size; off += descriptor_size) {
+		struct efi_memory_desc *md = (void *)virtmap + off;
+
+		if ((md->attrs & EFI_MEMORY_RUNTIME) &&
+		    efi_memory_desc_relocation_offset(md) != 0)
+			return EFI_EXIT(EFI_UNSUPPORTED);
+	}
+
+	efirt_virtmap_set = true;
+
+	return EFI_EXIT(EFI_SUCCESS);
 }
 
+/**
+ * efirt_convert_pointer() - convert pointer to virtual address
+ *
+ * This function implements the ConvertPointer() runtime service.
+ * Only identity mappings are accepted, so the pointer is left as-is.
+ *
+ * See the Unified Extensible Firmware Interface (UEFI) specification for
+ * details.
+ *
+ * @dbg:	EFI_OPTIONAL_PTR if the pointer may be NULL
+ * @address:	pointer to be converted
+ * Return:	status code
+ */
 static efi_status_t EFIAPI efirt_convert_pointer(unsigned long dbg, void **address)
 {
-	return efirt_unimplemented();
+	EFI_ENTRY(L"");
+
+	if (!address)
+		return EFI_EXIT(EFI_INVALID_PARAMETER);
+
+	if (!*address && !(dbg & EFI_OPTIONAL_PTR))
+		return EFI_EXIT(EFI_INVALID_PARAMETER);
+
+	return EFI_EXIT(EFI_SUCCESS);
 }
 
 static efi_status_t EFIAPI
diff --git a/include/efi/memory.h b/include/efi/memory.h
index 74e714099021..336d2a730c1c 100644
--- a/include/efi/memory.h
+++ b/include/efi/memory.h
@@ -91,4 +91,10 @@ struct efi_memory_desc {
 
 #define EFI_MEMORY_DESCRIPTOR_VERSION	1
 
+static inline ptrdiff_t
+efi_memory_desc_relocation_offset(const struct efi_memory_desc *md)
+{
+	return efi_virt_to_phys(md->virt_start) - md->phys_start;
+}
+
 #endif
diff --git a/include/efi/services.h b/include/efi/services.h
index 2d7167b25205..83dc56150a4e 100644
--- a/include/efi/services.h
+++ b/include/efi/services.h
@@ -162,6 +162,8 @@ enum efi_reset_type {
 #define EFI_RUNTIME_SERVICES_SIGNATURE ((u64)0x56524553544e5552ULL)
 #define EFI_RUNTIME_SERVICES_REVISION  0x00010000
 
+#define EFI_OPTIONAL_PTR	0x00000001
+
 struct efi_capsule_header;
 
 struct efi_runtime_services {
-- 
2.47.3

Re: [PATCH 2/2] efi: runtime: accept 1:1 mappings in SetVirtualAddressMap

[Johannes Schauer Marin Rodrigues]

[-- Attachment #1: Type: text/plain, Size: 6366 bytes --]

Tested-by: Johannes Schauer Marin Rodrigues <josch@mister-muffin.de>

Quoting Ahmad Fatoum (2026-10-17 13:50:15)
> We do not support SetVirtualAddressMap() and UEFI v2.8 permits
> this as long as our EFI_RT_PROPERTIES_TABLE doesn't claim
> EFI_RT_SUPPORTED_SET_VIRTUAL_ADDRESS_MAP, which we adhere to[1].
> 
> NetBSD's efiboot doesn't seem to care for lack of this bit and
> calls SetVirtualAddressMap() unconditionally[2]. This will return with
> an error, which has NetBSD call printf() _after_ ExitBootServices[3]
> leading to a crash[4].
> 
> Fortunately, barebox is not the only firmware that doesn't implement
> a full-fledged SetVirtualAddressMap().
> Quoting NetBSD commit 41096fd ("efiboot: Use 1:1 PA to VA mappings for
> RT services.")[5]:
> 
> | UEFI firmware on Snapdragon X Elite devices crashes when
> | SetVirtualAddressMap is called with runtime mappings that are not 1:1.
> | Always do this on arm64 as it won't interfere with KVA and will help us
> | avoid avoid a very common class of firmware bugs.
> 
> This means we have an easy way for barebox to workaround this:
> Instead of returning EFI_UNSUPPORTED unconditionally, we can handle the
> trivial identity mapping case specially and report EFI_SUCCESS for it.
> 
> While NetBSD doesn't need it, also implement a 1:1 ConvertPointer for
> good measure.
> 
> [1]: https://uefi.org/specs/UEFI/2.10/04_EFI_System_Table.html
> [2]: https://github.com/NetBSD/src/blob/41096fd/sys/stand/efiboot/efiboot.c#L135
> [3]: https://github.com/NetBSD/src/blob/41096fd/sys/stand/efiboot/efifdt.c#L813
> [4]: https://gnats.netbsd.org/60890
> [5]: https://github.com/NetBSD/src/commit/41096fd4f7bac2ade3f29e9e6e00951aef9e16ce
> 
> Reported-by: Johannes Schauer Marin Rodrigues <josch@debian.org>
> Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
> ---
>  efi/runtime/services.c | 67 ++++++++++++++++++++++++++++++++++++++++--
>  include/efi/memory.h   |  6 ++++
>  include/efi/services.h |  2 ++
>  3 files changed, 73 insertions(+), 2 deletions(-)
> 
> diff --git a/efi/runtime/services.c b/efi/runtime/services.c
> index dc4960ac4763..ca60ae512a2d 100644
> --- a/efi/runtime/services.c
> +++ b/efi/runtime/services.c
> @@ -171,17 +171,80 @@ static efi_status_t EFIAPI efirt_set_wakeup_time(char enabled,
>         return efirt_unimplemented();
>  }
>  
> +/**
> + * efirt_set_virtual_address_map() - change from physical to virtual mapping
> + *
> + * This function implements the SetVirtualAddressMap() runtime service.
> + * The barebox runtime isn't relocated and only an identity mapping
> + * is accepted.
> + *
> + * We intentionally don't announce support via the EFI_RT_PROPERTIES_TABLE,
> + * so only operating systems that ignore the table would end up here.
> + * If they configure a 1:1 mapping like NetBSD, we tolerate it and return
> + * success.
> + *
> + * See the Unified Extensible Firmware Interface (UEFI) specification for
> + * details.
> + *
> + * @memory_map_size:   size of the virtual map
> + * @descriptor_size:   size of an entry in the map
> + * @descriptor_version:        version of the map entries
> + * @virtmap:           virtual address mapping information
> + * Return:             status code
> + */
>  static efi_status_t EFIAPI efirt_set_virtual_address_map(size_t memory_map_size,
>                                                          size_t descriptor_size,
>                                                          uint32_t descriptor_version,
>                                                          struct efi_memory_desc *virtmap)
>  {
> -       return efirt_unimplemented();
> +       static bool efirt_virtmap_set;
> +
> +       EFI_ENTRY(L"");
> +
> +       if (efirt_virtmap_set)
> +               return EFI_EXIT(EFI_UNSUPPORTED);
> +
> +       if (descriptor_version != EFI_MEMORY_DESCRIPTOR_VERSION ||
> +           descriptor_size < sizeof(*virtmap))
> +               return EFI_EXIT(EFI_INVALID_PARAMETER);
> +
> +       for (size_t off = 0; off < memory_map_size; off += descriptor_size) {
> +               struct efi_memory_desc *md = (void *)virtmap + off;
> +
> +               if ((md->attrs & EFI_MEMORY_RUNTIME) &&
> +                   efi_memory_desc_relocation_offset(md) != 0)
> +                       return EFI_EXIT(EFI_UNSUPPORTED);
> +       }
> +
> +       efirt_virtmap_set = true;
> +
> +       return EFI_EXIT(EFI_SUCCESS);
>  }
>  
> +/**
> + * efirt_convert_pointer() - convert pointer to virtual address
> + *
> + * This function implements the ConvertPointer() runtime service.
> + * Only identity mappings are accepted, so the pointer is left as-is.
> + *
> + * See the Unified Extensible Firmware Interface (UEFI) specification for
> + * details.
> + *
> + * @dbg:       EFI_OPTIONAL_PTR if the pointer may be NULL
> + * @address:   pointer to be converted
> + * Return:     status code
> + */
>  static efi_status_t EFIAPI efirt_convert_pointer(unsigned long dbg, void **address)
>  {
> -       return efirt_unimplemented();
> +       EFI_ENTRY(L"");
> +
> +       if (!address)
> +               return EFI_EXIT(EFI_INVALID_PARAMETER);
> +
> +       if (!*address && !(dbg & EFI_OPTIONAL_PTR))
> +               return EFI_EXIT(EFI_INVALID_PARAMETER);
> +
> +       return EFI_EXIT(EFI_SUCCESS);
>  }
>  
>  static efi_status_t EFIAPI
> diff --git a/include/efi/memory.h b/include/efi/memory.h
> index 74e714099021..336d2a730c1c 100644
> --- a/include/efi/memory.h
> +++ b/include/efi/memory.h
> @@ -91,4 +91,10 @@ struct efi_memory_desc {
>  
>  #define EFI_MEMORY_DESCRIPTOR_VERSION  1
>  
> +static inline ptrdiff_t
> +efi_memory_desc_relocation_offset(const struct efi_memory_desc *md)
> +{
> +       return efi_virt_to_phys(md->virt_start) - md->phys_start;
> +}
> +
>  #endif
> diff --git a/include/efi/services.h b/include/efi/services.h
> index 2d7167b25205..83dc56150a4e 100644
> --- a/include/efi/services.h
> +++ b/include/efi/services.h
> @@ -162,6 +162,8 @@ enum efi_reset_type {
>  #define EFI_RUNTIME_SERVICES_SIGNATURE ((u64)0x56524553544e5552ULL)
>  #define EFI_RUNTIME_SERVICES_REVISION  0x00010000
>  
> +#define EFI_OPTIONAL_PTR       0x00000001
> +
>  struct efi_capsule_header;
>  
>  struct efi_runtime_services {
> -- 
> 2.47.3
>

[-- Attachment #2: signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEElFhU6KL81LF4wVq58sulx4+9g+EFAmrThZQACgkQ8sulx4+9
g+GDnQ/+K2nPv06Qew7pVxdXbQ6PLCzntg+NnbayP9TosZXWOaM2919qnlsHvCaS
Fng885Hf9Gwp+twIc0Vj20+jwakznQhL2nDb4/NBuwWis2NoTFcZKFo7dzLhAWAq
hFzwG5eLx5ZIzUiLgyaGefXOQVNroEu4xpEWGZX/70Jzo5NEm6QBAsj4WIqVFGnd
QHBWkLWUxsbhM3YHKF1Hd9vt1u0QynsqTQOQPinlsd4dMNsMCfa8GyG2gJ4KCait
9zbi905opZfQi4dVlqYyvlDg5qsMEg4UYX+tLx8MnLzUB7Gjo07zXtRU8x3mPDvT
dQb/4XtfdqUnG+LJzs/WUZe/dp2EmDeeS6m0o9RmVhztpUz3Y3m35Vvt0oHwJ5Wl
EkhU/PLK57NyTbh3KMA1CLQMyKefH0UGg26XV3TGXlR5sEtZKTgpGeYosgI+vBMM
kV0AGFWkr4xQ3dbNdpd9MwBh/js1BocuyNBSzoLNIvr7H5jgpP/N4ppkFViZT9Hd
Q9tZJCFuV+AF/S2K19k5lgoNu2Nhw/UJdAxJ4i4XNmSKgvTlW2YQF+FdOJFYI/jd
84aV3uQYYSsKYzzyf9pmcdunFO5iu13NbxpBFLUJin7Ih2XUKk3ci7U9wo70F5UM
uD8L1phwfC+aKFwMeWrxjyPJGw9d+7dGc/EPRx1Nb37kQiVIjqU=
=r+XL
-----END PGP SIGNATURE-----

Re: [PATCH 1/2] efi: loader: in-place patch the runtime services on ExitBootServices

[Johannes Schauer Marin Rodrigues]

[-- Attachment #1: Type: text/plain, Size: 4469 bytes --]

Tested-by: Johannes Schauer Marin Rodrigues <josch@mister-muffin.de>

Quoting Ahmad Fatoum (2026-10-17 13:50:14)
> ExitBootServices() repoints systab->runtime at a separate table with the
> detached runtime services. If an EFI application caches RT, it may end
> up calling into the stale boot-time runtime services object.
> 
> Fix this by keeping the systab->runtime pointer the same and do a
> "deep copy" by rewriting the object including its callbacks instead.
> 
> Cc: Johannes Schauer Marin Rodrigues <josch@debian.org>
> Fixes: 699145f1cb22 ("efi: runtime: add runtime service support after ExitBootServices")
> Signed-off-by: Ahmad Fatoum <a.fatoum@barebox.org>
> ---
>  efi/loader/boot.c      | 5 ++++-
>  efi/loader/runtime.c   | 2 +-
>  efi/loader/watchdog.c  | 4 ++--
>  efi/runtime/services.c | 3 ++-
>  include/efi/loader.h   | 2 +-
>  5 files changed, 10 insertions(+), 6 deletions(-)
> 
> diff --git a/efi/loader/boot.c b/efi/loader/boot.c
> index 2d98c95b5c34..ddfbf33bff69 100644
> --- a/efi/loader/boot.c
> +++ b/efi/loader/boot.c
> @@ -3879,6 +3879,8 @@ static struct efi_boot_services efi_boot_services = {
>  
>  static __efi_runtime_data u16 firmware_vendor[] = L"barebox";
>  
> +static __efi_runtime_data struct efi_runtime_services efi_runtime_services;
> +
>  __efi_runtime_data struct efi_system_table systab = {
>         .hdr = {
>                 .signature = EFI_SYSTEM_TABLE_SIGNATURE,
> @@ -3925,8 +3927,9 @@ efi_status_t efi_initialize_system_table(void)
>         systab.boottime = &efi_boot_services;
>  
>         /*
> -        * This will be overwritten dynamically at detach time.
> +        * This must be overwritten dynamically at detach time.
>          */
> +       efi_runtime_services = efi_runtime_services_boot;
>         systab.runtime = &efi_runtime_services;
>  
>         /* Set CRC32 field in table headers */
> diff --git a/efi/loader/runtime.c b/efi/loader/runtime.c
> index a8f872f23b48..329e1077889f 100644
> --- a/efi/loader/runtime.c
> +++ b/efi/loader/runtime.c
> @@ -293,7 +293,7 @@ static efi_status_t EFIAPI efi_set_time_boottime(struct efi_time *time)
>   * the runtime services will be replaced by the detached implementation,
>   * so we need not take any special consideration here.
>   */
> -struct efi_runtime_services efi_runtime_services = {
> +struct efi_runtime_services efi_runtime_services_boot = {
>         .hdr = {
>                 .signature = EFI_RUNTIME_SERVICES_SIGNATURE,
>                 .revision = EFI_SPECIFICATION_VERSION,
> diff --git a/efi/loader/watchdog.c b/efi/loader/watchdog.c
> index a4715c149add..c29f91a0aa07 100644
> --- a/efi/loader/watchdog.c
> +++ b/efi/loader/watchdog.c
> @@ -35,8 +35,8 @@ static void EFIAPI efi_watchdog_timer_notify(struct efi_event *event,
>         EFI_ENTRY("%p, %p", event, context);
>  
>         pr_emerg("\nEFI: Watchdog timeout\n");
> -       EFI_CALL_VOID(efi_runtime_services.reset_system(EFI_RESET_COLD,
> -                                                       EFI_SUCCESS, 0, NULL));
> +       EFI_CALL_VOID(systab.runtime->reset_system(EFI_RESET_COLD,
> +                                                  EFI_SUCCESS, 0, NULL));
>  
>         EFI_EXIT(EFI_UNSUPPORTED);
>  }
> diff --git a/efi/runtime/services.c b/efi/runtime/services.c
> index 5044e16c7c5c..dc4960ac4763 100644
> --- a/efi/runtime/services.c
> +++ b/efi/runtime/services.c
> @@ -293,7 +293,8 @@ void efi_runtime_detach(struct efi_system_table *systab)
>         systab->std_err = NULL;
>         systab->boottime = NULL;
>  
> -       systab->runtime = &efi_runtime_services_detached;
> +       /* Payloads may have cached systab->runtime, so patch it in place */
> +       *systab->runtime = efi_runtime_services_detached;
>  
>         /* Recalculate CRC32 */
>         efi_update_table_header_crc32(&systab->hdr);
> diff --git a/include/efi/loader.h b/include/efi/loader.h
> index 4dcd15854560..0ccc0a720a90 100644
> --- a/include/efi/loader.h
> +++ b/include/efi/loader.h
> @@ -19,7 +19,7 @@ struct efi_table_hdr;
>  /* Key identifying current memory map */
>  extern efi_uintn_t efi_memory_map_key;
>  
> -extern struct efi_runtime_services efi_runtime_services;
> +extern struct efi_runtime_services efi_runtime_services_boot;
>  extern struct efi_system_table systab;
>  
>  extern struct efi_simple_text_output_protocol efi_con_out;
> -- 
> 2.47.3
>

[-- Attachment #2: signature --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEElFhU6KL81LF4wVq58sulx4+9g+EFAmrThYQACgkQ8sulx4+9
g+FaDw/8Dn2GS5Se+JNIuVvL9Z/NhiBBRvIn6Ixww7pzzo9s/IrL0CBnGmJ+LJZ7
DgcEhyEKTfMKOLrbfkdfs7G2saOll6QvWQNkwTrBlfPlypzWqopXoyQ+uoAoPt+P
XjwnCSqzCLIgbU172avH3e3KzEKvqlaRsbY5iApzjvJGpikxX8o1ebVb5ErYSu4f
ooNBFVj+AncfyRL6qq3PgXib1IEiO9hIzc0SpRMEj0FSDmNbicyLGhCOvf3QR66y
k7l1+cfcEQ+3UOw3Me2K3uaH8aX07XUxVSHlrkDdMbYnpz4IIxQRko24hWF1sYkW
YWfEYUlLImci4U+3mloOA575uuYb5XG3F4tMNP0ZcAZEm4Pf8r6PfoPoBJOO5ma+
OVrEVaKxJtkYfzmFMx5ZawbQamFqy597g/QbJeAiTsqokS79sJ6ZbV63YjEfZbcj
y1AGT4KZGZu3nlhve+g+pINxBbtpAG2JPbctscItQ7UkVk/e8glIjhP5KBCEFZXX
1zn3bHx2AkWRVJDWBOMHvvpqmBGo8WrLCXPHyBozj2DquEdWQ3/SIbeaWeStvWcc
M1r2iDMJs+0dNtp1HQt9NXOxjIv3H6ljOdimqf4YBA+4opSmApWNu59RhhxOGqkm
vWXAI/C2hnYg11Q0UWe0kyrXibwlZaqv1OrPuIlB0waE2g/KsrM=
=w1Fd
-----END PGP SIGNATURE-----