[PATCH 1/2] efi: payload: image: exit if kernel image returned

[PATCH 1/2] efi: payload: image: exit if kernel image returned

[Ahmad Fatoum]

EFI applications can exit and return to the EFI application that started
them and barebox can handle that, except for the case that it was a
EFI-stubbed kernel and barebox has already called shutdown_barebox().

In that case, the safest way is to just propagate the exit code instead
of attempting to execute code as if nothing happened.

Starting EFI applications via bin format continues to work as before.

Cc: Chali Anis <chalianis1@gmail.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 efi/payload/image.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/efi/payload/image.c b/efi/payload/image.c
index 83094cda6d89..378709b6de95 100644
--- a/efi/payload/image.c
+++ b/efi/payload/image.c
@@ -104,7 +104,7 @@ int efi_execute_image(efi_handle_t handle,
 {
 	efi_status_t efiret;
 	const char *options;
-	bool is_driver;
+	bool is_driver, is_kernel = false;
 
 	is_driver = (loaded_image->image_code_type == EFI_BOOT_SERVICES_CODE) ||
 		(loaded_image->image_code_type == EFI_RUNTIME_SERVICES_CODE);
@@ -123,17 +123,24 @@ int efi_execute_image(efi_handle_t handle,
 		efi_set_variable_usec("LoaderTimeExecUSec", &efi_systemd_vendor_guid,
 				      ktime_to_us(ktime_get()));
 
+		is_kernel = true;
 		shutdown_barebox();
 	}
 
 	efi_pause_devices();
 
 	efiret = BS->start_image(handle, NULL, NULL);
-	if (EFI_ERROR(efiret))
-		pr_err("failed to StartImage: %s\n", efi_strerror(efiret));
 
 	efi_continue_devices();
 
+	if (is_kernel) {
+		pr_emerg("Kernel image has unexpectedly returned\n");
+		BS->exit(efi_parent_image, efiret, 0, NULL);
+	}
+
+	if (EFI_ERROR(efiret))
+		pr_err("failed to StartImage: %s\n", efi_strerror(efiret));
+
 	if (!is_driver)
 		BS->unload_image(handle);
 
-- 
2.47.3

[PATCH 2/2] efi: payload: bootm: fix potential double-unload for image

[Ahmad Fatoum]

efi_execute_image() already takes care to unload the image if it returns,
so adapt the single caller that tries to unload the image again
accordingly.

Cc: Chali Anis <chalianis1@gmail.com>
Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 efi/payload/bootm.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/efi/payload/bootm.c b/efi/payload/bootm.c
index aba643b2c59d..801c0202ae83 100644
--- a/efi/payload/bootm.c
+++ b/efi/payload/bootm.c
@@ -235,6 +235,7 @@ static int do_bootm_efi_stub(struct image_data *data)
 {
 	struct efi_loaded_image *loaded_image;
 	void *fdt = NULL, *initrd = NULL;
+	bool image_freed = false;
 	efi_handle_t handle;
 	enum filetype type;
 	int ret;
@@ -257,6 +258,13 @@ static int do_bootm_efi_stub(struct image_data *data)
 		goto unload_ramdisk;
 
 	ret = efi_execute_image(handle, loaded_image, type);
+
+	/* efi_execute_image takes care to unload the image on error,
+	 * so we set image_freed and fall through to freeing ramdisk
+	 * and oftree.
+	 */
+	image_freed = true;
+
 unload_ramdisk:
 	if (initrd) {
 		efi_initrd_unregister();
@@ -265,7 +273,8 @@ static int do_bootm_efi_stub(struct image_data *data)
 unload_oftree:
 	efi_unload_fdt(fdt);
 unload_os:
-	BS->unload_image(handle);
+	if (!image_freed)
+		BS->unload_image(handle);
 
 	return ret;
 }
-- 
2.47.3

Re: [PATCH 1/2] efi: payload: image: exit if kernel image returned

[Sascha Hauer]

On Tue, 14 Apr 2026 16:26:29 +0200, Ahmad Fatoum wrote:
> EFI applications can exit and return to the EFI application that started
> them and barebox can handle that, except for the case that it was a
> EFI-stubbed kernel and barebox has already called shutdown_barebox().
> 
> In that case, the safest way is to just propagate the exit code instead
> of attempting to execute code as if nothing happened.
> 
> [...]

Applied, thanks!

[1/2] efi: payload: image: exit if kernel image returned
      https://git.pengutronix.de/cgit/barebox/commit/?id=7ffcd41e49f2 (link may not be stable)
[2/2] efi: payload: bootm: fix potential double-unload for image
      https://git.pengutronix.de/cgit/barebox/commit/?id=a8e1ff641524 (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>