[PATCH 1/2] efi: loader: in-place patch the runtime services on ExitBootServices

[Johannes Schauer Marin Rodrigues]

Tested-by: Johannes Schauer Marin Rodrigues <josch at mister-muffin.de>

Quoting Ahmad Fatoum (2026-10-17 13:50:14)
> ExitBootServices() repoints systab->runtime at a separate table with the
> detached runtime services. If an EFI application caches RT, it may end
> up calling into the stale boot-time runtime services object.
> 
> Fix this by keeping the systab->runtime pointer the same and do a
> "deep copy" by rewriting the object including its callbacks instead.
> 
> Cc: Johannes Schauer Marin Rodrigues <josch at debian.org>
> Fixes: 699145f1cb22 ("efi: runtime: add runtime service support after ExitBootServices")
> Signed-off-by: Ahmad Fatoum <a.fatoum at barebox.org>
> ---
>  efi/loader/boot.c      | 5 ++++-
>  efi/loader/runtime.c   | 2 +-
>  efi/loader/watchdog.c  | 4 ++--
>  efi/runtime/services.c | 3 ++-
>  include/efi/loader.h   | 2 +-
>  5 files changed, 10 insertions(+), 6 deletions(-)
> 
> diff --git a/efi/loader/boot.c b/efi/loader/boot.c
> index 2d98c95b5c34..ddfbf33bff69 100644
> --- a/efi/loader/boot.c
> +++ b/efi/loader/boot.c
> @@ -3879,6 +3879,8 @@ static struct efi_boot_services efi_boot_services = {
>  
>  static __efi_runtime_data u16 firmware_vendor[] = L"barebox";
>  
> +static __efi_runtime_data struct efi_runtime_services efi_runtime_services;
> +
>  __efi_runtime_data struct efi_system_table systab = {
>         .hdr = {
>                 .signature = EFI_SYSTEM_TABLE_SIGNATURE,
> @@ -3925,8 +3927,9 @@ efi_status_t efi_initialize_system_table(void)
>         systab.boottime = &efi_boot_services;
>  
>         /*
> -        * This will be overwritten dynamically at detach time.
> +        * This must be overwritten dynamically at detach time.
>          */
> +       efi_runtime_services = efi_runtime_services_boot;
>         systab.runtime = &efi_runtime_services;
>  
>         /* Set CRC32 field in table headers */
> diff --git a/efi/loader/runtime.c b/efi/loader/runtime.c
> index a8f872f23b48..329e1077889f 100644
> --- a/efi/loader/runtime.c
> +++ b/efi/loader/runtime.c
> @@ -293,7 +293,7 @@ static efi_status_t EFIAPI efi_set_time_boottime(struct efi_time *time)
>   * the runtime services will be replaced by the detached implementation,
>   * so we need not take any special consideration here.
>   */
> -struct efi_runtime_services efi_runtime_services = {
> +struct efi_runtime_services efi_runtime_services_boot = {
>         .hdr = {
>                 .signature = EFI_RUNTIME_SERVICES_SIGNATURE,
>                 .revision = EFI_SPECIFICATION_VERSION,
> diff --git a/efi/loader/watchdog.c b/efi/loader/watchdog.c
> index a4715c149add..c29f91a0aa07 100644
> --- a/efi/loader/watchdog.c
> +++ b/efi/loader/watchdog.c
> @@ -35,8 +35,8 @@ static void EFIAPI efi_watchdog_timer_notify(struct efi_event *event,
>         EFI_ENTRY("%p, %p", event, context);
>  
>         pr_emerg("\nEFI: Watchdog timeout\n");
> -       EFI_CALL_VOID(efi_runtime_services.reset_system(EFI_RESET_COLD,
> -                                                       EFI_SUCCESS, 0, NULL));
> +       EFI_CALL_VOID(systab.runtime->reset_system(EFI_RESET_COLD,
> +                                                  EFI_SUCCESS, 0, NULL));
>  
>         EFI_EXIT(EFI_UNSUPPORTED);
>  }
> diff --git a/efi/runtime/services.c b/efi/runtime/services.c
> index 5044e16c7c5c..dc4960ac4763 100644
> --- a/efi/runtime/services.c
> +++ b/efi/runtime/services.c
> @@ -293,7 +293,8 @@ void efi_runtime_detach(struct efi_system_table *systab)
>         systab->std_err = NULL;
>         systab->boottime = NULL;
>  
> -       systab->runtime = &efi_runtime_services_detached;
> +       /* Payloads may have cached systab->runtime, so patch it in place */
> +       *systab->runtime = efi_runtime_services_detached;
>  
>         /* Recalculate CRC32 */
>         efi_update_table_header_crc32(&systab->hdr);
> diff --git a/include/efi/loader.h b/include/efi/loader.h
> index 4dcd15854560..0ccc0a720a90 100644
> --- a/include/efi/loader.h
> +++ b/include/efi/loader.h
> @@ -19,7 +19,7 @@ struct efi_table_hdr;
>  /* Key identifying current memory map */
>  extern efi_uintn_t efi_memory_map_key;
>  
> -extern struct efi_runtime_services efi_runtime_services;
> +extern struct efi_runtime_services efi_runtime_services_boot;
>  extern struct efi_system_table systab;
>  
>  extern struct efi_simple_text_output_protocol efi_con_out;
> -- 
> 2.47.3
>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 833 bytes
Desc: signature
URL: <http://lists.infradead.org/pipermail/barebox/attachments/20261017/ce31e4b5/attachment.sig>