My log file shows what appears to be a successful switch to runtime:
2020-01-22T17:57:38.993Z| vcpu-0| I125: Guest: Firmware has transitioned to runtime.
2020-01-22T17:57:39.936Z| vcpu-0| I125: Tools: Running status rpc handler: 0 => 1.
2020-01-22T17:57:39.936Z| vcpu-0| I125: Tools: Changing running status: 0 => 1.
However, it never called the notification routine that you suggested setting a breakpoint on.
There was a minor difference in offsets. My PcRtc base address was: CFAD000 + 255B = CFAF55B
But the assy code in your example appears at CFAF57B, so there is a minor difference in
the builds we are using. Nonetheless, I set both breakpoint addresses and it didn't hit
either location. Stepping through the code it was in the vicinity, but never hit the routine.
The memory range containing PcRtc is marked as Runtime Code, which seems correct.
So it seems that the notification event is not firing. I will look through the UDK code and
see if I can spot anything. I have noticed that there is some relationship with TPL level.
If I call RaiseTPL to either NOTIFY or APPLICATION, ExitBootServices at least completes. If
I don't call RaiseTPL first, ExitBootServices hangs.