diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/DxeRing3.c b/MdeModulePkg/Core/Dxe/DxeRing3/DxeRing3.c
index 0090023f88..579d86f9df 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/DxeRing3.c
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/DxeRing3.c
@@ -26,8 +26,8 @@ EFI_BOOT_SERVICES  mBootServices = {
   (EFI_ALLOCATE_PAGES)Ring3AllocatePages,                                                  // AllocatePages
   (EFI_FREE_PAGES)Ring3FreePages,                                                          // FreePages
   (EFI_GET_MEMORY_MAP)Ring3GetMemoryMap,                                                   // GetMemoryMap
-  (EFI_ALLOCATE_POOL)CoreAllocatePool,                                                     // AllocatePool
-  (EFI_FREE_POOL)CoreFreePool,                                                             // FreePool
+  (EFI_ALLOCATE_POOL)Ring3AllocatePool,                                                    // AllocatePool
+  (EFI_FREE_POOL)Ring3FreePool,                                                            // FreePool
   (EFI_CREATE_EVENT)Ring3CreateEvent,                                                      // CreateEvent
   (EFI_SET_TIMER)Ring3SetTimer,                                                            // SetTimer
   (EFI_WAIT_FOR_EVENT)Ring3WaitForEvent,                                                   // WaitForEvent
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3.h b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3.h
index 20d6fa15c3..77ba5e4e70 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3.h
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3.h
@@ -132,6 +132,44 @@ Ring3GetMemoryMap (
      OUT UINT32                 *DescriptorVersion
   );
 
+/**
+  Allocate pool of a particular type.
+
+  @param  PoolType               Type of pool to allocate
+  @param  Size                   The amount of pool to allocate
+  @param  Buffer                 The address to return a pointer to the allocated
+                                 pool
+
+  @retval EFI_INVALID_PARAMETER  Buffer is NULL.
+                                 PoolType is in the range EfiMaxMemoryType..0x6FFFFFFF.
+                                 PoolType is EfiPersistentMemory.
+  @retval EFI_OUT_OF_RESOURCES   Size exceeds max pool size or allocation failed.
+  @retval EFI_SUCCESS            Pool successfully allocated.
+
+**/
+EFI_STATUS
+EFIAPI
+Ring3AllocatePool (
+  IN  EFI_MEMORY_TYPE  PoolType,
+  IN  UINTN            Size,
+  OUT VOID             **Buffer
+  );
+
+/**
+  Frees pool.
+
+  @param  Buffer                 The allocated pool entry to free
+
+  @retval EFI_INVALID_PARAMETER  Buffer is not a valid value.
+  @retval EFI_SUCCESS            Pool successfully freed.
+
+**/
+EFI_STATUS
+EFIAPI
+Ring3FreePool (
+  IN VOID  *Buffer
+  );
+
 /**
   Creates an event.
 
diff --git a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiBootServices.c b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiBootServices.c
index 6cb6fd063d..8047fa314e 100644
--- a/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiBootServices.c
+++ b/MdeModulePkg/Core/Dxe/DxeRing3/Ring3UefiBootServices.c
@@ -18,6 +18,34 @@
 
 BOOLEAN  mOnGuarding = FALSE;
 
+STATIC UINTN  mMemoryTypes[EfiMaxMemoryType];
+STATIC UINTN  mNumberOfUsers = 0;
+
+STATIC
+UINTN
+EFIAPI
+GetMemoryType (
+  IN UINTN  UserPageTable
+  )
+{
+  UINTN  Index;
+
+  for (Index = 0; Index < mNumberOfUsers; ++Index) {
+    if (mMemoryTypes[Index] == UserPageTable) {
+      break;
+    }
+  }
+
+  if (Index == mNumberOfUsers) {
+    ++mNumberOfUsers;
+    mMemoryTypes[Index] = UserPageTable;
+  }
+
+  ASSERT (mNumberOfUsers <= EfiMaxMemoryType);
+
+  return Index;
+}
+
 STATIC
 EFI_STATUS
 EFIAPI
@@ -179,6 +207,32 @@ Ring3GetMemoryMap (
   return EFI_UNSUPPORTED;
 }
 
+EFI_STATUS
+EFIAPI
+Ring3AllocatePool (
+  IN  EFI_MEMORY_TYPE  PoolType,
+  IN  UINTN            Size,
+  OUT VOID             **Buffer
+  )
+{
+  UINTN  CurrentUser;
+
+  CurrentUser = (UINTN)SysCall (SysCallGetUserPageTable, 0);
+
+  PoolType = GetMemoryType (CurrentUser);
+
+  return CoreAllocatePool (PoolType, Size, Buffer);
+}
+
+EFI_STATUS
+EFIAPI
+Ring3FreePool (
+  IN VOID  *Buffer
+  )
+{
+  return CoreFreePool (Buffer);
+}
+
 EFI_STATUS
 EFIAPI
 Ring3CreateEvent (
@@ -606,7 +660,7 @@ Ring3LocateHandleBuffer (
     && (Buffer != NULL) && (*Buffer != NULL)) {
     PoolSize = *NumberHandles * sizeof (EFI_HANDLE *);
 
-    Status = CoreAllocatePool (EfiRing3MemoryType, PoolSize, &Pool);
+    Status = Ring3AllocatePool (EfiRing3MemoryType, PoolSize, &Pool);
     if (EFI_ERROR (Status)) {
       return Status;
     }
@@ -672,7 +726,7 @@ Ring3InstallMultipleProtocolInterfaces (
   }
   VA_END (Marker);
 
-  Status = CoreAllocatePool (
+  Status = Ring3AllocatePool (
              EfiRing3MemoryType,
              NumberOfArguments * sizeof (VOID *),
              (VOID **)&Arguments
@@ -695,8 +749,8 @@ Ring3InstallMultipleProtocolInterfaces (
              Arguments
              );
 
-  CoreFreePool (Arguments);
-  return Status;
+  Ring3FreePool (Arguments);
+  return Status;
 }
 
 EFI_STATUS
diff --git a/MdeModulePkg/Core/Dxe/Mem/Page.c b/MdeModulePkg/Core/Dxe/Mem/Page.c
index bcb41780d1..f7506d5427 100644
--- a/MdeModulePkg/Core/Dxe/Mem/Page.c
+++ b/MdeModulePkg/Core/Dxe/Mem/Page.c
@@ -63,6 +63,7 @@ EFI_MEMORY_TYPE_STATISTICS  mMemoryTypeStatistics[EfiMaxMemoryType + 1] = {
   { 0, MAX_ALLOC_ADDRESS, 0, 0, EfiMaxMemoryType, TRUE,  TRUE  },  // EfiPalCode
   { 0, MAX_ALLOC_ADDRESS, 0, 0, EfiMaxMemoryType, FALSE, FALSE },  // EfiPersistentMemory
   { 0, MAX_ALLOC_ADDRESS, 0, 0, EfiMaxMemoryType, TRUE,  FALSE },  // EfiUnacceptedMemoryType
+  { 0, MAX_ALLOC_ADDRESS, 0, 0, EfiMaxMemoryType, FALSE, FALSE },  // EfiRing3MemoryType
   { 0, MAX_ALLOC_ADDRESS, 0, 0, EfiMaxMemoryType, FALSE, FALSE }   // EfiMaxMemoryType
 };
 
@@ -86,6 +87,7 @@ EFI_MEMORY_TYPE_INFORMATION  gMemoryTypeInformation[EfiMaxMemoryType + 1] = {
   { EfiPalCode,                 0 },
   { EfiPersistentMemory,        0 },
   { EfiGcdMemoryTypeUnaccepted, 0 },
+  { EfiRing3MemoryType,         0 },
   { EfiMaxMemoryType,           0 }
 };
 //
diff --git a/MdeModulePkg/Core/Dxe/SysCall/BootServices.c b/MdeModulePkg/Core/Dxe/SysCall/BootServices.c
index 9b4b1f087e..7de1460e06 100644
--- a/MdeModulePkg/Core/Dxe/SysCall/BootServices.c
+++ b/MdeModulePkg/Core/Dxe/SysCall/BootServices.c
@@ -317,12 +317,11 @@ FreeUserSpaceDriver (
     UserDriver = BASE_CR (Link, USER_SPACE_DRIVER, Link);
 
     if (UserDriver->CoreWrapper == CoreWrapper) {
-      break;
+      RemoveEntryList (&UserDriver->Link);
+      FreePool (UserDriver);
+      return;
     }
   }
-
-  RemoveEntryList (&UserDriver->Link);
-  FreePool (UserDriver);
 }
 
 EFI_STATUS
@@ -1457,6 +1456,13 @@ CallBootService (
         FreePool ((VOID *)Argument5);
       }
 
+      break;
+    case SysCallGetUserPageTable:
+      //
+      // No Arguments
+      //
+      Status = (EFI_STATUS)gUserPageTable;
+
       break;
     default:
       DEBUG ((DEBUG_ERROR, "Ring0: Unknown syscall type.\n"));
diff --git a/MdePkg/Include/Uefi/UefiSpec.h b/MdePkg/Include/Uefi/UefiSpec.h
index 9b2fb726ee..e1891c177e 100644
--- a/MdePkg/Include/Uefi/UefiSpec.h
+++ b/MdePkg/Include/Uefi/UefiSpec.h
@@ -2048,6 +2048,10 @@ typedef enum {
   SysCallUnicodeStrUpr,
   SysCallUnicodeFatToStr,
   SysCallUnicodeStrToFat,
+  //
+  // Helper functions
+  //
+  SysCallGetUserPageTable,
   SysCallMax
 } SYS_CALL_TYPE;