Index: stand/efi/boot1/proto.c
===================================================================
--- stand/efi/boot1/proto.c
+++ stand/efi/boot1/proto.c
@@ -61,7 +61,8 @@
 	int preferred;
 
 	/* Figure out if we're dealing with an actual partition. */
-	status = BS->HandleProtocol(h, &DevicePathGUID, (void **)&devpath);
+	status = BS->OpenProtocol(h, &DevicePathGUID, (void **)&devpath,
+	    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 	if (status == EFI_UNSUPPORTED)
 		return (0);
 
@@ -77,7 +78,8 @@
 		efi_free_devpath_name(text);
 	}
 #endif
-	status = BS->HandleProtocol(h, &BlockIoProtocolGUID, (void **)&blkio);
+	status = BS->OpenProtocol(h, &BlockIoProtocolGUID, (void **)&blkio,
+	    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 	if (status == EFI_UNSUPPORTED)
 		return (0);
 
Index: stand/efi/gptboot/proto.c
===================================================================
--- stand/efi/gptboot/proto.c
+++ stand/efi/gptboot/proto.c
@@ -146,7 +146,8 @@
 	EFI_STATUS status;
 
 	/* Figure out if we're dealing with an actual partition. */
-	status = BS->HandleProtocol(h, &DevicePathGUID, (void **)&devpath);
+	status = BS->OpenProtocol(h, &DevicePathGUID, (void **)&devpath,
+	    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 	if (status != EFI_SUCCESS)
 		return;
 #ifdef EFI_DEBUG
@@ -169,7 +170,8 @@
 			return;
 		}
 	}
-	status = BS->HandleProtocol(h, &BlockIoProtocolGUID, (void **)&blkio);
+	status = BS->OpenProtocol(h, &BlockIoProtocolGUID, (void **)&blkio,
+	    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 	if (status != EFI_SUCCESS) {
 		DPRINTF("Can't get the block I/O protocol block\n");
 		return;
Index: stand/efi/libefi/devpath.c
===================================================================
--- stand/efi/libefi/devpath.c
+++ stand/efi/libefi/devpath.c
@@ -44,8 +44,8 @@
 	EFI_DEVICE_PATH *devpath;
 	EFI_STATUS status;
 
-	status = BS->HandleProtocol(handle, &ImageDevicePathGUID,
-	    (VOID **)&devpath);
+	status = BS->OpenProtocol(handle, &ImageDevicePathGUID,
+	    (VOID **)&devpath, IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 	if (EFI_ERROR(status))
 		devpath = NULL;
 	return (devpath);
@@ -57,7 +57,8 @@
 	EFI_DEVICE_PATH *devpath;
 	EFI_STATUS status;
 
-	status = BS->HandleProtocol(handle, &DevicePathGUID, (VOID **)&devpath);
+	status = BS->OpenProtocol(handle, &DevicePathGUID, (VOID **)&devpath,
+	    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 	if (EFI_ERROR(status))
 		devpath = NULL;
 	return (devpath);
Index: stand/efi/libefi/efinet.c
===================================================================
--- stand/efi/libefi/efinet.c
+++ stand/efi/libefi/efinet.c
@@ -286,7 +286,8 @@
 	}
 
 	h = nif->nif_driver->netif_ifs[nif->nif_unit].dif_private;
-	status = BS->HandleProtocol(h, &sn_guid, (VOID **)&nif->nif_devdata);
+	status = BS->OpenProtocol(h, &sn_guid, (VOID **)&nif->nif_devdata,
+	    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 	if (status != EFI_SUCCESS) {
 		printf("net%d: cannot fetch interface data (status=%lu)\n",
 		    nif->nif_unit, EFI_ERROR_CODE(status));
Index: stand/efi/libefi/efipart.c
===================================================================
--- stand/efi/libefi/efipart.c
+++ stand/efi/libefi/efipart.c
@@ -297,8 +297,9 @@
 		}
 
 		/* Make sure we do have the media. */
-		status = BS->HandleProtocol(efipart_handles[i],
-		    &blkio_guid, (void **)&blkio);
+		status = BS->OpenProtocol(efipart_handles[i], &blkio_guid,
+		    (void **)&blkio, IH, 0,
+		    EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 		if (EFI_ERROR(status))
 			return (false);
 
@@ -439,8 +440,9 @@
 		if (efipart_hdd(devpath))
 			continue;
 
-		status = BS->HandleProtocol(efipart_handles[i],
-		    &blkio_guid, (void **)&blkio);
+		status = BS->OpenProtocol(efipart_handles[i], &blkio_guid,
+		    (void **)&blkio, IH, 0,
+		    EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 		if (EFI_ERROR(status))
 			continue;
 		/*
@@ -691,8 +693,9 @@
 		if (!efipart_hdd(devpath))
 			continue;
 
-		status = BS->HandleProtocol(efipart_handles[i],
-		    &blkio_guid, (void **)&blkio);
+		status = BS->OpenProtocol(efipart_handles[i], &blkio_guid,
+		    (void **)&blkio, IH, 0,
+		    EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 		if (EFI_ERROR(status))
 			continue;
 
@@ -779,7 +782,8 @@
 		snprintf(line, sizeof(line),
 		    "    %s%d", dev->dv_name, pd->pd_unit);
 		printf("%s:", line);
-		status = BS->HandleProtocol(h, &blkio_guid, (void **)&blkio);
+		status = BS->OpenProtocol(h, &blkio_guid, (void **)&blkio,
+		    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 		if (!EFI_ERROR(status)) {
 			printf("    %llu",
 			    blkio->Media->LastBlock == 0? 0:
@@ -862,8 +866,9 @@
 		return (EIO);
 
 	if (pd->pd_blkio == NULL) {
-		status = BS->HandleProtocol(pd->pd_handle, &blkio_guid,
-		    (void **)&pd->pd_blkio);
+		status = BS->OpenProtocol(pd->pd_handle, &blkio_guid,
+		    (void **)&pd->pd_blkio, IH, 0,
+		    EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 		if (EFI_ERROR(status))
 			return (efi_status_to_errno(status));
 	}
Index: stand/efi/loader/efi_main.c
===================================================================
--- stand/efi/loader/efi_main.c
+++ stand/efi/loader/efi_main.c
@@ -103,7 +103,8 @@
 
 	/* Use efi_exit() from here on... */
 
-	status = BS->HandleProtocol(IH, &image_protocol, (VOID**)&img);
+	status = BS->OpenProtocol(IH, &image_protocol, (VOID**)&img,
+	    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 	if (status != EFI_SUCCESS)
 		efi_exit(status);
 
Index: stand/efi/loader/framebuffer.c
===================================================================
--- stand/efi/loader/framebuffer.c
+++ stand/efi/loader/framebuffer.c
@@ -244,7 +244,8 @@
 	/* Get the PCI I/O interface of the first handle that supports it. */
 	pciio = NULL;
 	for (hp = buf; hp < buf + bufsz; hp++) {
-		status = BS->HandleProtocol(*hp, &pciio_guid, (void **)&pciio);
+		status = BS->OpenProtocol(*hp, &pciio_guid, (void **)&pciio,
+		    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 		if (status == EFI_SUCCESS) {
 			free(buf);
 			return (pciio);
Index: stand/efi/loader/main.c
===================================================================
--- stand/efi/loader/main.c
+++ stand/efi/loader/main.c
@@ -128,7 +128,8 @@
 	 */
 	hin_end = &hin[sz / sizeof(*hin)];
 	for (walker = hin; walker < hin_end; walker++) {
-		status = BS->HandleProtocol(*walker, &devid, (VOID **)&path);
+		status = BS->OpenProtocol(*walker, &devid, (VOID **)&path,
+		    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 		if (EFI_ERROR(status))
 			continue;
 
@@ -864,7 +865,8 @@
 	archsw.arch_zfs_probe = efi_zfs_probe;
 
         /* Get our loaded image protocol interface structure. */
-	BS->HandleProtocol(IH, &imgid, (VOID**)&boot_img);
+	BS->OpenProtocol(IH, &imgid, (VOID**)&boot_img,
+	    IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 
 	/*
 	 * Chicken-and-egg problem; we want to have console output early, but
@@ -1004,7 +1006,8 @@
 		efi_free_devpath_name(text);
 	}
 
-	rv = BS->HandleProtocol(boot_img->DeviceHandle, &devid, (void **)&imgpath);
+	rv = BS->OpenProtocol(boot_img->DeviceHandle, &devid,
+	    (void **)&imgpath, IH, 0, EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 	if (rv == EFI_SUCCESS) {
 		text = efi_devpath_name(imgpath);
 		if (text != NULL) {
@@ -1464,8 +1467,9 @@
 		command_errmsg = "LoadImage failed";
 		return (CMD_ERROR);
 	}
-	status = BS->HandleProtocol(loaderhandle, &LoadedImageGUID,
-	    (void **)&loaded_image);
+	status = BS->OpenProtocol(loaderhandle, &LoadedImageGUID,
+	    (void **)&loaded_image, IH, 0,
+	    EFI_OPEN_PROTOCOL_BY_HANDLE_PROTOCOL);
 
 	if (argc > 2) {
 		int i, len = 0;