Skip to content

Conversation

@AnsenHuangMSFT
Copy link
Contributor

@AnsenHuangMSFT AnsenHuangMSFT commented Oct 30, 2025

Description

Problem:
The Variable PEIM's index table optimization search path incorrectly returns deleted variables instead of valid variables when duplicate variables exist with different states. This occurs when:

One variable has deleted state (VAR_IN_DELETED_TRANSITION & VAR_ADDED, value 0x3C)
One variable has valid state (VAR_ADDED, value 0x3F)
Both variables have the same name and GUID
The function should prioritize and return the valid variable, but the index table search was returning the first match regardless of state validity.

Root Cause:
In the FindVariableEx() index table traversal, the function was not properly validating variable states before returning a match. When CompareWithValidVariable() found a matching variable name and GUID, it would return immediately without checking if the variable state was valid (0x3F) or deleted (0x3C).

This issue only affects the index table optimization search path and does not impact the linear traversal search path. The Variable PEIM has two main search mechanisms:

Linear traversal search - Walks through the entire variable store checking each header sequentially. This path has correct state validation logic and is unaffected by this issue.

Index table optimization search - Uses a gEfiVariableIndexTableGuid HOB to quickly jump to variable locations. This optimization is only active when the platform produces this HOB. This is the path affected by the bug.

Solution:
Added explicit state validation in FindVariableEx() to skip variables with deleted state (0x3C) and only return valid variables:

  • Impacts functionality?
  • Impacts security?
  • Breaking change?
  • Includes tests?
  • Includes documentation?

How This Was Tested

Create variable with delete and valid in NVRAM.
Call FindVariableEx() and check the variable address.
It only return valid variable address

Integration Instructions

N/A

@AnsenHuangMSFT
Copy link
Contributor Author

@microsoft-github-policy-service agree [company="Microsoft"]

@codecov-commenter
Copy link

codecov-commenter commented Oct 30, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (release/202502@defba0f). Learn more about missing BASE report.

Additional details and impacted files
@@                Coverage Diff                @@
##             release/202502    #1551   +/-   ##
=================================================
  Coverage                  ?    1.55%           
=================================================
  Files                     ?      636           
  Lines                     ?   233982           
  Branches                  ?      370           
=================================================
  Hits                      ?     3649           
  Misses                    ?   230320           
  Partials                  ?       13           
Flag Coverage Δ
MdeModulePkg 1.55% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Copy link
Member

@makubacki makubacki left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Marking PR as changes requested until the logic is clarified.

@AnsenHuangMSFT AnsenHuangMSFT force-pushed the PeiDeletedVariableFix branch 2 times, most recently from 758a165 to a79453a Compare October 30, 2025 22:04
When two identical variables exist in NVRAM with different states, FindVariableEx() incorrectly returns the deleted variable address instead of the valid variable address. This occurs when:

One variable has deleted state (0x3C)
One variable has valid state (0x3F)
The function should prioritize and return the valid variable, but the original logic was returning the first match regardless of state validity.

Root Cause:
In the FindVariableEx() index table traversal, the function was not properly validating variable states before returning a match. When CompareWithValidVariable() found a matching variable name and GUID, it would return immediately without checking if the variable state was valid (0x3F) or deleted (0x3C).

Solution:
Added explicit state validation in FindVariableEx() to skip variables with deleted state (0x3C) and only return valid variables:
@apop5 apop5 merged commit 2503a1b into microsoft:release/202502 Nov 3, 2025
30 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants