GenNCCfgData: add config XML hash check vs FW; gate MODCONFIG/DELVAR …

[kanechen66]

Description

GenNCCfgData.py previously modified/deleted system UEFI configuration variables and generated config binaries without verifying that the config XML being used actually matches the schema the running firmware was built with. This can silently produce mismatched or invalid configuration cause unexpected behavior on the systme

This change ports the config XML hash verification already used by ConfigEditor.py into GenNCCfgData.py:

• Added a compare_xml_hash_with_bios() method that computes the full XML hash via CommonUtility.get_xml_full_hash() and compares it against the FW-claimed hash from BoardMiscInfo.get_schema_xml_hash_from_bios() (the SCHEMA_XML_HASH UEFI variable). On mismatch it prints a warning with both hashes and returns non-zero.

• load_xml() now records self.config_xml_path so the loaded XML can be re-hashed.

• Added an optional --force flag to all commands. When the hash mismatches:

  • MODCONFIG and DELVAR abort (return 1) and do not touch system variables, unless --force is supplied.
  • GENBIN / GENCSV also abort on mismatch unless --force.

• The hash check runs once up front in the argparse path so MODCONFIG and DELVAR share a single check.

• Updated usage() to document [--force].

• Impacts functionality?

• Impacts security?

• Breaking change?

• Includes tests?

• Includes documentation?

How This Was Tested

positive case

python .\GenNCCfgData.py GENBIN PlatformCfgData.xml test.vl
python GenNCCfgData.py MODCONFIG --xml_file PlatformCfgData.xml --var Frb2Enabled --val 1
python GenNCCfgData.py DELVAR --xml_file PlatformCfgData.xml
python GenNCCfgData.py GENCSV "PlatformCfgData.xml ;test.vl" out.csv

negative cases with different ver of xml

python .\GenNCCfgData.py GENBIN PlatformCfgData_bad.xml test.vl
python GenNCCfgData.py MODCONFIG --xml_file PlatformCfgData_bad.xml --var Frb2Enabled --val 1
python GenNCCfgData.py DELVAR --xml_file PlatformCfgData_bad.xml
python GenNCCfgData.py GENCSV "PlatformCfgData_bad.xml ;test.vl" out.csv
the above 4 cmds shows xml hash mismatch with running FW.
WARNING: Config xml file hash mismatches with system FW
FW ConfigXml Hash = 0c56b29ae8fee33fa6f9e8786bd6fa1d
PlatformCfgData_mod.xml Hash = ef516f6dd19b7624ac05100e7d2bf367
Aborting MODCONFIG: config XML hash mismatches with system FW. Use --force to override.

also, --force is working as expected to by pass the xml hash check
only warnning msg is shown
PS C:\test_mu\Tools> python GenNCCfgData.py GENCSV "PlatformCfgData_bad.xml ;data.vl" out.csv --force
WARNING: Config xml file hash mismatches with system FW
FW ConfigXml Hash = 0c56b29ae8fee33fa6f9e8786bd6fa1d
PlatformCfgData_mod.xml Hash = ef516f6dd19b7624ac05100e7d2bf367

Integration Instructions

None

[apop5]

Can you please verify that this works under linux?