summaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* sign_official_build: disable gsetup for revenstabilize-14217.BJack Neus2021-09-081-1/+5
| | | | | | | | | | | | | More permanent fix todo, need to unblock reven-release. BUG=b:199136347 TEST=shellcheck BRANCH=none Change-Id: I2b124f88aa2c5c70124888e2d64bd5a2c41f1a96 Signed-off-by: Jack Neus <jackneus@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3149594 Reviewed-by: George Engelbrecht <engeg@google.com>
* vboot/sign_offical_build: Unused variableJae Hoon Kim2021-09-081-1/+1
| | | | | | | | | | | | | | | | partnum variable isn't defined. BUG=none TEST=none Signed-off-by: Jae Hoon Kim <kimjae@chromium.org> BRANCH=none Change-Id: Ie4ce809e4331d04c10c60f0e9c1b883124018038 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3146295 Tested-by: Jae Hoon Kim <kimjae@chromium.org> Auto-Submit: Jae Hoon Kim <kimjae@chromium.org> Reviewed-by: George Engelbrecht <engeg@google.com> Commit-Queue: George Engelbrecht <engeg@google.com>
* Revert "reven signing: skip install_gsetup_certs"Jack Neus2021-09-071-7/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 1376cfbfdd3b0cbc14da190c744604c4f3d29a23. Reason for revert: bad code (missing [[) Original change's description: > reven signing: skip install_gsetup_certs > > BUG=b:199136347,b:194500280 > TEST=none > BRANCH=none > > Change-Id: Iba90c1f4dcc2fadf9cbadac1948d5037b0feb278 > Signed-off-by: Jack Neus <jackneus@google.com> > Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3145774 > Reviewed-by: George Engelbrecht <engeg@google.com> Bug: b:199136347,b:194500280 Change-Id: I9b1df358a18d043eb0d20d18ed17e1bafbd9e5f3 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3146076 Auto-Submit: Jack Neus <jackneus@google.com> Commit-Queue: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: George Engelbrecht <engeg@google.com> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Reviewed-by: George Engelbrecht <engeg@google.com> Tested-by: George Engelbrecht <engeg@google.com> Tested-by: Jack Neus <jackneus@google.com>
* reven signing: skip install_gsetup_certsJack Neus2021-09-071-2/+7
| | | | | | | | | | | BUG=b:199136347,b:194500280 TEST=none BRANCH=none Change-Id: Iba90c1f4dcc2fadf9cbadac1948d5037b0feb278 Signed-off-by: Jack Neus <jackneus@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3145774 Reviewed-by: George Engelbrecht <engeg@google.com>
* vboot/sign_official_build: Skip re-signing empty miniOS partitionsJae Hoon Kim2021-09-071-7/+16
| | | | | | | | | | | | | | | | | | Reasons that miniOS partitions might be empty is that the feature is not enabled yet, but the partitions exist as it's using the newer disk_layout_v3. BUG=b:199021334 TEST=# run tests Signed-off-by: Jae Hoon Kim <kimjae@chromium.org> BRANCH=none Change-Id: I2a6b68240428ab2f01394230840ff116c720b3df Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3145770 Tested-by: Jae Hoon Kim <kimjae@chromium.org> Auto-Submit: Jae Hoon Kim <kimjae@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Julius Werner <jwerner@chromium.org>
* 2lib/2ec_sync: Clear VB2_CONTEXT_EC_TRUSTED before jumping to RWHsuan Ting Chen2021-09-042-0/+21
| | | | | | | | | | | | | | | | | | | | | | | | Currently the EC is trusted if any of the conditions are met: * The ctx flag VB2_CONTEXT_EC_TRUSTED is set. * vb2ex_ec_trusted() returns trusted. With introducing the boot mode area in ctx, the vb2ex_ec_trusted will be deprecated and the VB2_CONTEXT_EC_TRUSTED will become the only condition to decide if EC is trusted. This CL clears the flag while EC jumps to RW, which is the prerequisite before landing the coreboot changes. Also update the tests of ec_sync() BRANCH=none BUG=b:181931817 TEST=emerge-trogdor coreboot vboot_reference depthcharge Signed-off-by: Hsuan Ting Chen <roccochen@chromium.org> Change-Id: I4711093353f5a92157c4c00c859c01f08fc3607f Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3139538 Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* checkpatch: Ignore SPDX_LICENSE_TAGYu-Ping Wu2021-09-031-0/+1
| | | | | | | | | | | | | | Vboot doesn't use SPDX license header. The cros_license_check hook already checks for Chromium license. BUG=none TEST=none BRANCH=none Change-Id: Ibf222f8a95ce0d1242d7f0fee3a96b85b754fa48 Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3139454 Reviewed-by: Hung-Te Lin <hungte@chromium.org>
* run2tests: fix more compilation problemsVadim Bendebury2021-09-022-4/+8
| | | | | | | | | | | | | | | | | | | | | | The compiler is too zealous when deciding which addresses are allowed to be accessed. While it is correct in principal, in some controlled cases the code indeed needs to calculate addresses which are beyond the structures boundaries. This patch modifies the code to placate the compiler. BRANCH=none BUG=none TEST='make run2tests' inside chroot does not fail to compile and passes. Change-Id: Iba99714da569a5f28ae95939e93ee1d09da20caa Signed-off-by: Vadim Bendebury <vbendeb@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3133544 Tested-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org> Commit-Queue: Vadim Bendebury <vbendeb@chromium.org>
* vboot/sign_official_build: Fix missing backslashYu-Ping Wu2021-09-011-2/+2
| | | | | | | | | | | | | | | Add the missing line continuation backslash, caused by CL:3046439. BUG=b:198232639 TEST=./sign_official_build.sh recovery ${IMAGE} tests/devkeys/ ${OUTPUT} TEST=./sign_official_build.sh factory ${IMAGE} tests/devkeys/ ${OUTPUT} BRANCH=none Change-Id: I587747e33c47afc85264052c9ca59081d5524a72 Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3134894 Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Julius Werner <jwerner@chromium.org>
* cmd_sign: drop an unnecessary includeVadim Bendebury2021-09-011-1/+0
| | | | | | | | | | | | | | This was discovered when browsing the code, there could be more instances of this in this tree. BRANCH=none BUG=none TEST='make futil' still succeeds Change-Id: Ied3cd13f05ea19091abb6752fd23e7bf9fa562fb Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3120001 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* crossystem: add a hwid override mechanism from chromeos-configJack Rosenthal2021-08-311-1/+14
| | | | | | | | | | | | | | | | | | | | | | Devices which do not use chromeos firmware (e.g., reven) do not have a GBB section nor firmware to expose this data via ACPI/device-tree. However, a hwid is still required for auto-update, UMA, etc. CL:3118810 adds a new property to the schema for /:hwid-override. This CL makes it so when that property is set, ACPI/device-tree is not probed for the HWID, and it is instead set via cros_config. BUG=b:195007267 BRANCH=none TEST=build image for reven with a hwid override # crossystem hwid REVEN-ANAE A6A-A7I Signed-off-by: Jack Rosenthal <jrosenth@chromium.org> Change-Id: I3c1255b257f914b02dfb8ba53dd275892df1a526 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3119046 Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Yong Hong <yhong@chromium.org>
* vboot/ui: Show error box on internal boot failureYu-Ping Wu2021-08-313-4/+14
| | | | | | | | | | | | | | | | | | | | | | | | CL:2917623 changes the behavior when failing to boot from internal disk in developer UI. However, it causes the device to potentially enter a reboot loop (b/197216832). Instead of either triggering recovery or returning an error from the UI loop, change the behavior to showing an error message in a dialog box and staying in the UI. This is similar to the behavior when booting from an invalid external disk, where an error screen will be shown to the user. Add VB2_UI_ERROR_INTERNAL_BOOT_FAILED to vb2_ui_error enum. BUG=b:197216832, b:197911901 TEST=make runtests BRANCH=none Cq-Depend: chromium:3123160 Change-Id: Ic5ace55fc8b93ba0836e5722b7c5011fd490c35e Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3124395 Reviewed-by: Julius Werner <jwerner@chromium.org>
* Allow use of fallthrough directlystabilize-14189.BSimon Glass2021-08-271-3/+3
| | | | | | | | | | | | | | | | | | | There is a standard way of handling fallthrough, at least in linux and U-Boot, of defining 'fallthrough' as the required attribute. At present, vboot always defines this itself, which is incompatible with this convention. Use double underscores around the definition of VBOOT_FALLTHROUGH to maintain compatibility. BUG=b:191646387 BRANCH=none TEST=FEATURES=test sudo -E emerge vboot_reference Signed-off-by: Simon Glass <sjg@chromium.org> Change-Id: Id62f126f77311360fb7859ee956f1476378d87c0 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3032350 Reviewed-by: Julius Werner <jwerner@chromium.org>
* tests: fix compilation failuresVadim Bendebury2021-08-263-20/+34
| | | | | | | | | | | | | | | | | | | | | | Attempts to access array of fixed size beyond the boundary now trigger compilation warnings, even though there is room beyond the array boundary in due to data layout. Let's modify the code to declare the array size explicitly to calm the compiler. Also needed to add en explicit return value in a function where all returns happened inside a case statement. BRANCH=none BUG=none TEST='make run2tests' does not fail to compile any more and succeeds running tests. Change-Id: Ib2158145233a0e8641c5b9b95499928f18390a8d Signed-off-by: Vadim Bendebury <vbendeb@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3120000 Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
* crossystem: arm: support active-high WP and RECOVERY GPIOsstabilize-14179.Bstabilize-14178.BBrian Norris2021-08-231-0/+8
| | | | | | | | | | | | | | | | | | Some systems have an active-high GPIO for reading WP status, so support an inverted name for that. While we're at it, do this for recovery too, just in case someone needs it. BRANCH=none BUG=b:197258688 TEST=play with servo's `fw_wp_state`, check `crossystem wpsw_cur` on kevin-kernelnext + DTS change Signed-off-by: Brian Norris <briannorris@chromium.org> Change-Id: I28ad566568d6dc62843d0bc9b75cca1fc1a35633 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3108068 Reviewed-by: Julius Werner <jwerner@chromium.org>
* signer: Handle zstd squashfs compressionstabilize-14163.Bfactory-keeby-14162.Bfactory-14162.BSatoshi Niwa2021-08-171-0/+2
| | | | | | | | | | | | | | | | BUG=b:193618692 TEST=sign_official_build.sh can handle zstd-compressed Android image BRANCH=none Signed-off-by: Satoshi Niwa <niwa@google.com> Cq-Depend: chrome-internal:4024687 Change-Id: Ie01e93e49da9b32245055f7e4b6fa4fb3fbefd8e Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3066801 Tested-by: Satoshi Niwa <niwa@chromium.org> Reviewed-by: Kazuhiro Inaba <kinaba@chromium.org> Reviewed-by: Yury Khmel <khmel@chromium.org> Auto-Submit: Satoshi Niwa <niwa@chromium.org> Commit-Queue: Satoshi Niwa <niwa@chromium.org>
* vboot/sign_official_build: fix verity path in commentNicholas Bishop2021-08-131-1/+1
| | | | | | | | | | | | | verity is now in platform2. BUG=chromium:886953 TEST=none BRANCH=none Change-Id: I55b8a88540b781658a02819de749ab2d20984658 Signed-off-by: Nicholas Bishop <nicholasbishop@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3087641 Reviewed-by: Julius Werner <jwerner@chromium.org>
* 2nvstorage: Clear FIRMWARE_SETTINGS_RESET flag on a clean bootJulius Werner2021-08-131-0/+5
| | | | | | | | | | | | | | | | | | | The FIRMWARE_SETTINGS_RESET flag was intended to show when nvdata was forcibly reset due to CRC failures. However, in practice it is useless because it never gets cleared again and just stays set forever. This patch fixes that by clearing it on every normal boot (i.e. a boot where the existing nvdata was valid and didn't need to be reset). BRANCH=None BUG=None TEST=Booted CoachZ, confirmed flag got cleared. Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I8c88ea134bf92ccb5f1d9a710d86c5ec5198def8 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3063692 Reviewed-by: Yu-Ping Wu <yupingso@chromium.org> Tested-by: Yu-Ping Wu <yupingso@chromium.org> Commit-Queue: Yu-Ping Wu <yupingso@chromium.org>
* firmware: 2sysincludes: Remove byteswap.h and memory.hJulius Werner2021-08-131-5/+0
| | | | | | | | | | | | | | | | | | | | These have always been in here but I don't think anyone remembers what they are for. The firmware library doesn't require endian accesses (other than the TPM2 marshalling code which provides its own... and I guess the GPT code isn't actually safe for big-endian systems, which is probably bad, but a topic for another patch). As far as I can tell, none of our environments actually define the macros that these two are guarded by. Let's get rid of them and see what breaks. BRANCH=none BUG=none TEST=none Signed-off-by: Julius Werner <jwerner@chromium.org> Change-Id: I277336cf768d7d9f5aaf7c032632e4a299b4bb51 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3063691 Commit-Queue: Yu-Ping Wu <yupingso@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* PRESUBMIT.cfg: Enable checkpatch_checkstabilize-14151.BYu-Ping Wu2021-08-132-0/+24
| | | | | | | | | | | | | | | | | | | Since vboot code uses kernel coding style, enable checkpatch_check. The checkpatch.pl script already checks for long lines, so disable long_line_check. The latter is inaccurate anyways (a tab is considered of length 1). Copy .checkpatch.conf from depthcharge and also ignore MACRO_WITH_FLOW_CONTROL for the VB2_TRY macro. BUG=none TEST=repo upload . --cbr BRANCH=none Change-Id: I60d78c47a6723062718d23dc1e74137a56d0d28c Signed-off-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3067205 Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot_reference: Add GPT GUID for hibernateEvan Green2021-08-122-0/+4
| | | | | | | | | | | | | | Add a known partition type guid for hibernate partitions, so that they can be uniquely distinguished from other data partitions. BUG=b:196224292 TEST=build volteer with disk_layout_v4 BRANCH=main Change-Id: I62d969671ee1f80388c2c0cc5982051f5cb1bd0c Signed-off-by: Evan Green <evgreen@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3088839 Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot: Remove unnecessary flag unset operationsstabilize-14150.882.Bstabilize-14150.881.Bstabilize-14150.74.Bstabilize-14150.734.Bstabilize-14150.64.Bstabilize-14150.43.Bstabilize-14150.376.Brelease-R94-14150.Brelease-R94-14150.49.Bedisonhello2021-08-124-13/+6
| | | | | | | | | | | | | | | | | | Since all flags are initialized as 0 in vb2api_init(), some flag unset operations are not needed. Edit few comments to make it more accurate. BUG=none TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1; \ make -j32 test_setup && make -j32 runtests; BRANCH=none Signed-off-by: edisonhello <edisonhello@google.com> Change-Id: I0129f43342598195800ff671b965100d3d568564 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3066803 Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* vboot/misc: Add validity check in vb2api_enable_developer_modeedisonhello2021-08-126-9/+39
| | | | | | | | | | | | | | | | | | | | | | | Check vb2api_allow_recovery before actual changes in vb2api_enable_developer_mode. Add new API error type VB2_ERROR_API_ENABLE_DEV_NOT_ALLOWED in vb2_error_t. Add spaces in the output message of vb2_misc_tests for indentation. BUG=b:172339016 TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1 DETACHABLE=0; \ make -j32 test_setup && make -j32 runtests; TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1 DETACHABLE=1; \ make -j32 test_setup && make -j32 runtests; TEST=Hayato booted into developer mode BRANCH=none Change-Id: Ifebdd01ca87cf944c394907eca73a09fc3bf5457 Signed-off-by: edisonhello <edisonhello@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3056240 Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot/ui: Check allocated pointer before using the pointerstabilize-14149.Bedisonhello2021-08-101-1/+1
| | | | | | | | | | | | | | | | | Change the order of checking whether the allocated pointer is null and memset the allocated pointer. Prevent using a null pointer, which may cause segmentation fault. BUG=none TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1 \ make -j32 test_setup && make -j32 runtests; TEST=emerge-asurada depthcharge BRANCH=none Signed-off-by: edisonhello <edisonhello@google.com> Change-Id: I5fc91b5157b32b6b7263d580998eceb6efe9a63a Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3077962 Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* vboot/tests: Add test_fail function and TEST_FAIL macroedisonhello2021-08-042-0/+25
| | | | | | | | | | | | | | | | | | | Add test_fail function that will check whether the result value is not 0. Add TEST_FAIL macro that will call test_fail. BUG=none TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1; \ make -j32 test_setup && make -j32 runtests; BRANCH=none Change-Id: I4dfe6a887780f70fbcb753828cfb5500ed810b72 Signed-off-by: edisonhello <edisonhello@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3060562 Reviewed-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Yu-Ping Wu <yupingso@chromium.org>
* vboot: Publicize and create functions for UI migrationedisonhello2021-07-3022-92/+98
| | | | | | | | | | | | | | | | | | | | | | Publicize vb2api_enable_developer_mode, vb2api_allow_recovery and VbTryLoadKernel, and modify corresponding parts in tests. Create vb2api_disable_dev_request, vb2api_request_diagnostics for wrapping vb2_nv_set(ctx, VB2_NV_DISABLE_DEV_REQUEST, 1) and vb2_nv_set(ctx, VB2_NV_DIAG_REQUEST, 1). BUG=b:172339016 TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1 DETACHABLE=0; \ make -j32 test_setup && make -j32 runtests; TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1 DETACHABLE=1; \ make -j32 test_setup && make -j32 runtests; TEST=Hayato booted into developer mode BRANCH=none Change-Id: I0211a63ed58ce862ee3e17b4835c675544f773a4 Signed-off-by: edisonhello <edisonhello@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3053541 Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* vboot: Add DEV_BOOT_*ALLOWED in ctx->flagsedisonhello2021-07-309-169/+144
| | | | | | | | | | | | | | | | | | | | | | | | | | Add DEV_BOOT_ALLOWED, DEV_BOOT_ALTFW_ALLOWED, DEV_BOOT_EXTERNAL_ALLOWED in ctx->flags, which can be used by external functions. These flags will be filled in VbSelectAndLoadKernel, before calling any menu function. In 2ui.c and 2ui_screen.c, all function calls to vb2_dev_boot_*allowed are replaced with corresponding flags in ctx->flags. Remove the parts of mocking these functions in unit tests, and set ctx->flags instead in reset_common_data. BUG=b:172339016 TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1 DETACHABLE=0; \ make -j32 test_setup && make -j32 runtests; TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1 DETACHABLE=1; \ make -j32 test_setup && make -j32 runtests; TEST=Hayato booted into developer mode BRANCH=none Signed-off-by: edisonhello <edisonhello@google.com> Change-Id: Ida9f03557a92a1522d631fc04b281ce85f5049c7 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3041498 Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* vboot: add new OWNERSJoel Kitching2021-07-301-2/+3
| | | | | | | | | | | | | | | BUG=none TEST=none BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: I70f3de0edeeeabc31b97e4320e7ea420e8bdd2cb Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3060276 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Reviewed-by: Furquan Shaikh <furquan@chromium.org> Reviewed-by: Hung-Te Lin <hungte@chromium.org> Commit-Queue: Julius Werner <jwerner@chromium.org>
* signer: Implement retry logic for signing Android imageYury Khmel2021-07-291-15/+53
| | | | | | | | | | | | | | | | This retries signing android image in case of integrity check failure. The reason of failure is still unknown. BUG=b:175081695 TEST=Locally image signing passed with adding temporary code that emulates random diff file error. Confirmed recovery happened and signing finished successfully. BRANCH=none Signed-off-by: Yury Khmel <khmel@google.com> Change-Id: Iffc23145cae21f4f468b987d015f45fec95f29d0 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3057193 Reviewed-by: Mike Frysinger <vapier@chromium.org>
* vboot: Add vb2api_set_locale_idedisonhello2021-07-274-2/+15
| | | | | | | | | | | | | | | | | | | Add vb2api_set_locale_id to vboot2 API. Replace the direct access to vb2_nv_get and vb2_nv_set in ui functions with vb2api_get_locale_id and vb2api_set_locale_id. BUG=b:172339016 TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1 DIAGNOSTIC_UI=1 \ MINIMAL=1; make -j32 test_setup && make -j32 runtests; TEST=Hayato booted into developer mode BRANCH=none Signed-off-by: edisonhello <edisonhello@google.com> Change-Id: I5a92e571eceed6a402d0d80caa567bb9d77341a3 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3041506 Commit-Queue: Yu-Ping Wu <yupingso@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* vboot/ui: Use vb2api_gbb_get_flags instead of vb2_get_gbbedisonhello2021-07-272-5/+4
| | | | | | | | | | | | | | | | | | | Replace direct calls to vb2_get_gbb with vb2api_gbb_get_flags. This is a preparation work for migrating ui codes from vboot to depthcharge. BUG=b:172339016 TEST=export CC=x86_64-pc-linux-gnu-clang DEBUG=1; \ make -j32 test_setup && make -j32 runtests; TEST=Hayato booted into developer mode BRANCH=none Change-Id: I69b1504c236df1c0b656cb1e6e28a4066d9fad63 Signed-off-by: edisonhello <edisonhello@google.com> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3041504 Commit-Queue: Yu-Ping Wu <yupingso@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* Reland "vboot/sign_official_build: re-sign miniOS partitions"Joel Kitching2021-07-231-3/+62
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This is a reland of 43325cb9b2568c4a03c849f3474fcee8de3ae893 Looks like this was reverted incorrectly in CL:3044633, culprit turned out to be an unrelated flake (see b/194293181). Original change's description: > vboot/sign_official_build: re-sign miniOS partitions > > sign_official_build.sh needs to be taught how to re-sign miniOS > partitions, depending on whether the particular image at hand > contains them or not. > > BUG=b:188121855 > TEST=make clean && make runtests > BRANCH=none > > Cq-Depend: chromium:3027786 > Signed-off-by: Joel Kitching <kitching@google.com> > Change-Id: Iaf847e14588011dd0fea6b59405091ae36ef038f > Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2989640 > Tested-by: Joel Kitching <kitching@chromium.org> > Reviewed-by: Mike Frysinger <vapier@chromium.org> > Commit-Queue: Joel Kitching <kitching@chromium.org> Bug: b:188121855 Signed-off-by: Julius Werner <jwerner@google.com> Change-Id: I2e29a6e85f7d41ad365365ffb7e694f0c291d4f3 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3046439 Reviewed-by: Sergey Frolov <sfrolov@google.com> Reviewed-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Tested-by: Julius Werner <jwerner@chromium.org> Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com>
* Revert "vboot/sign_official_build: re-sign miniOS partitions"stabilize-14106.BSergey Frolov2021-07-221-62/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This reverts commit 43325cb9b2568c4a03c849f3474fcee8de3ae893. Reason for revert: b/194293181 suspect Original change's description: > vboot/sign_official_build: re-sign miniOS partitions > > sign_official_build.sh needs to be taught how to re-sign miniOS > partitions, depending on whether the particular image at hand > contains them or not. > > BUG=b:188121855 > TEST=make clean && make runtests > BRANCH=none > > Cq-Depend: chromium:3027786 > Signed-off-by: Joel Kitching <kitching@google.com> > Change-Id: Iaf847e14588011dd0fea6b59405091ae36ef038f > Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2989640 > Tested-by: Joel Kitching <kitching@chromium.org> > Reviewed-by: Mike Frysinger <vapier@chromium.org> > Commit-Queue: Joel Kitching <kitching@chromium.org> Bug: b:188121855 Change-Id: Ieb936a21d5ae09ed84eb65c9a3a3198a5b5b22a5 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3044633 Bot-Commit: Rubber Stamper <rubber-stamper@appspot.gserviceaccount.com> Commit-Queue: Sergey Frolov <sfrolov@google.com>
* vboot/vboot_kernel: split gpt tests out of vboot_kernel_testsJoel Kitching2021-07-213-332/+392
| | | | | | | | | | | | | | | | | | | These don't really belong together. We can get two cleaner test files by splitting them apart. This CL is part of a series to merge vboot1 and vboot2.0 kernel verification code; see b/181739551. BUG=b:181739551, b:172337800, b:124141368 TEST=make clean && make runtests BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: Idaa4c36214cc98bffdc50bdb5c071673829250ee Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3039164 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot: add MINIOS_PRIORITY flag to nvstorageJoel Kitching2021-07-195-6/+26
| | | | | | | | | | | | | | | | Flag decides whether MINIOS-A or MINIOS-B is booted. BUG=b:186682292 TEST=make clean && make runtests TEST=Deploy and run `crossystem minios_priority` commands BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: I11460bf1522cde8e98e680b0f00a417e2b4ef9a1 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2998513 Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot/crossystem: remove "vboot2" annotationsJoel Kitching2021-07-191-6/+6
| | | | | | | | | | | | | | | | vboot 1 is deprecated, so remove "vboot2" annotations in crossystem help text. BUG=none TEST=make clean && make runtests BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: Ic46576b34d3f1ea611d574e5566479b8d29c1e81 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3028643 Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot/sign_official_build: re-sign miniOS partitionsJoel Kitching2021-07-191-3/+62
| | | | | | | | | | | | | | | | | | sign_official_build.sh needs to be taught how to re-sign miniOS partitions, depending on whether the particular image at hand contains them or not. BUG=b:188121855 TEST=make clean && make runtests BRANCH=none Cq-Depend: chromium:3027786 Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: Iaf847e14588011dd0fea6b59405091ae36ef038f Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2989640 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* Makefile: deprecate config DIAGNOSTIC_UIHsuan Ting Chen2021-07-165-61/+36
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | DIAGNOSTIC_UI is indirectly decided by the diag_payload and minidiag use flag from depthcharge. But with introducing the diagnostic boot mode, coreboot also needs to build minidiag utility functions and enable this building flag. Therefore we consider to deprecate DIAGNOSTIC_UI and always build them. For diag_payload: It is for a diagnostic tool which based on legacy UI and deprecated For minidiag: Mini-diag is set default enabled for newer devices, and we could still use kernel secdata in runtime if we decide to disable it on certain platforms. In conclusion, deprecating DIAGNOSTIC_UI will not affect newer devices. BUG=b:190796342, b:181931817 BRANCH=none TEST=emerge-volteer depthcharge TEST=emerge-volteer coreboot TEST=CC=x86_64-pc-linux-gnu-clang; make clean && make runtests Cq-Depend: chromium:3004223 Signed-off-by: Hsuan Ting Chen <roccochen@chromium.org> Change-Id: I0d804bcd9d31d3952c744a1926ac59cde7b7f841 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3006114 Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* Add comments to make it easier to decode return codesstabilize-14094.Bstabilize-14093.Bstabilize-14092.66.Bstabilize-14092.57.Brelease-R93-14092.BSimon Glass2021-07-121-53/+53
| | | | | | | | | | | | | | | At present in some cases it takes quite a while to figure out what enum an error code corresponds to. Add a few comments to make this a little faster. BUG=b:191646387 BRANCH=none TEST=FEATURES=test sudo -E emerge vboot_reference Signed-off-by: Simon Glass <sjg@chromium.org> Change-Id: I72311d6fdf3c95284f26f28341f2d7d103f6a616 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2975085 Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot_reference: Add GUID type for miniOSJae Hoon Kim2021-07-092-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | MiniOS partitions should not be using the same GUID as the kernel. Refer to bug as to reasons on why. ``` Using disk_layout_v3.json w/ types as "minios" instead of "kernel" and checking the GUID uses the new type. $ /build/zork-minios/usr/bin/cgpt show testimage start size part contents 0 1 PMBR 1 1 Pri GPT header 2 32 Pri GPT table 40 1 1 Label: "" Type: ChromeOS miniOS UUID: 8A23CFDA-316E-B847-ADF2-80C4D1DF6F93 67 32 Sec GPT table 99 1 Sec GPT header $ /build/zork-minios/usr/bin/cgpt show -n testimage start size part contents 0 1 PMBR 1 1 Pri GPT header 2 32 Pri GPT table 40 1 1 Label: "" Type: 09845860-705F-4BB5-B16C-8A8A099CAF52 UUID: 8A23CFDA-316E-B847-ADF2-80C4D1DF6F93 Attr: [0] 67 32 Sec GPT table 99 1 Sec GPT header ``` BUG=b:193182769 TEST=# comment above BRANCH=none Signed-off-by: Jae Hoon Kim <kimjae@google.com> Change-Id: I18beb0c79762d838e580f6af7f4a2601e2980de6 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3017301 Tested-by: Jae Hoon Kim <kimjae@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Jae Hoon Kim <kimjae@chromium.org>
* Detect compression type and use the same one for re-packing the imageSatoshi Niwa2021-07-081-6/+14
| | | | | | | | | | | | | | | | | | | | | After crrev/i/3949327, compression type is not simply determined by ARC type. BUG=b:180894807 TEST=sign_official_build.sh and check the log message BRANCH=none Signed-off-by: Satoshi Niwa <niwa@google.com> Cq-Depend: chromium:2999963 Cq-Depend: chrome-internal:3949327 Change-Id: I4b1bf452e0d033b4bb8c2f2c1f91819741f9885c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2999823 Tested-by: Satoshi Niwa <niwa@chromium.org> Reviewed-by: Yury Khmel <khmel@chromium.org> Reviewed-by: Satoshi Niwa <niwa@chromium.org> Reviewed-by: Kazuhiro Inaba <kinaba@chromium.org> Auto-Submit: Satoshi Niwa <niwa@chromium.org> Commit-Queue: Satoshi Niwa <niwa@chromium.org>
* vboot: introduce minios_kernel.keyblockJoel Kitching2021-07-0519-13/+48
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | miniOS requires a distinct kernel data key, whose dev key pair is added in this CL as minios_kernel_data_key.vb{pub,priv}k. A distinct keyblock is also required. The keyblock should set the kernel keyblock flag MINIOS_1. Other keyblocks are modified appropriately to set MINIOS_0. Keyblocks were generated using the following commands: $ futility vbutil_keyblock --flags 23 --datapubkey tests/devkeys/ec_data_key.vbpubk --signprivate tests/devkeys/ec_root_key.vbprivk --pack tests/devkeys/ec.keyblock Keyblock file: tests/devkeys/ec.keyblock Signature valid Flags: 23 !DEV DEV !REC !MINIOS Data key algorithm: 7 RSA4096 SHA256 Data key version: 1 Data key sha1sum: 5833470fe934be76753cb6501dbb8fbf88ab272b $ futility vbutil_keyblock --flags 23 --datapubkey tests/devkeys/firmware_data_key.vbpubk --signprivate tests/devkeys/root_key.vbprivk --pack tests/devkeys/firmware.keyblock Keyblock file: tests/devkeys/firmware.keyblock Signature valid Flags: 23 !DEV DEV !REC !MINIOS Data key algorithm: 7 RSA4096 SHA256 Data key version: 1 Data key sha1sum: e2c1c92d7d7aa7dfed5e8375edd30b7ae52b7450 $ futility vbutil_keyblock --flags 27 --datapubkey tests/devkeys/recovery_kernel_data_key.vbpubk --signprivate tests/devkeys/recovery_key.vbprivk --pack tests/devkeys/recovery_kernel.keyblock Keyblock file: tests/devkeys/recovery_kernel.keyblock Signature valid Flags: 27 !DEV DEV REC !MINIOS Data key algorithm: 11 RSA8192 SHA512 Data key version: 1 Data key sha1sum: e78ce746a037837155388a1096212ded04fb86eb $ futility vbutil_keyblock --flags 43 --datapubkey tests/devkeys/minios_kernel_data_key.vbpubk --signprivate tests/devkeys/recovery_key.vbprivk --pack tests/devkeys/minios_kernel.keyblock Keyblock file: tests/devkeys/minios_kernel.keyblock Signature valid Flags: 43 !DEV DEV REC MINIOS Data key algorithm: 8 RSA4096 SHA512 Data key version: 1 Data key sha1sum: 65441886bc54cbfe3a7308b650806f4b61d8d142 $ futility vbutil_keyblock --flags 23 --datapubkey tests/devkeys/kernel_data_key.vbpubk --signprivate tests/devkeys/kernel_subkey.vbprivk --pack tests/devkeys/kernel.keyblock Keyblock file: tests/devkeys/kernel.keyblock Signature valid Flags: 23 !DEV DEV !REC !MINIOS Data key algorithm: 4 RSA2048 SHA256 Data key version: 1 Data key sha1sum: d6170aa480136f1f29cf339a5ab1b960585fa444 $ futility vbutil_keyblock --flags 26 --datapubkey tests/devkeys/installer_kernel_data_key.vbpubk --signprivate tests/devkeys/recovery_key.vbprivk --pack tests/devkeys/installer_kernel.keyblock Keyblock file: tests/devkeys/installer_kernel.keyblock Signature valid Flags: 26 DEV REC !MINIOS Data key algorithm: 11 RSA8192 SHA512 Data key version: 1 Data key sha1sum: e78ce746a037837155388a1096212ded04fb86eb BUG=b:188121855 TEST=make clean && make runtests BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: I5b3e4def83ff29ca156b3c84dfcb8398f4985e67 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2965485 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot/minidiag: add *log assignment in diag_get_storage_test_log mockJoel Kitching2021-07-041-0/+1
| | | | | | | | | | | | | | | | Subsequent code can potentially access the *log variable after being set by vb2ex_diag_get_storage_test_log. BUG=none TEST=make clean && make runtests BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: I9c8ed20efecbb4eaff8a8fcdf1f467f7df5147a0 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2917624 Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Yu-Ping Wu <yupingso@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@chromium.org>
* vboot/sign_official_build: fix up dependenciesJoel Kitching2021-07-031-24/+23
| | | | | | | | | | | | | | | | Update dependencies list, and use ${FUTILITY} rather than calling futility directly. BUG=b:188121855 TEST=make clean && make runtests BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: I8a28465937ca82ea9e18edc5d613570a561a3e0e Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2989639 Reviewed-by: Joel Kitching <kitching@chromium.org> Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* vboot/sign_official_build: remove kernel and recovery_kernelJoel Kitching2021-07-031-60/+0
| | | | | | | | | | | | | | | | | These two types are simply thin wrappers around vbutil_kernel and are no longer used. BUG=b:188121855 TEST=make clean && make runtests BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: Ia9a13f2992eb9de9f6c65525739da5f8e945cb3e Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2989638 Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot/sign_official_build: merge ssd+base and remove usbJoel Kitching2021-07-031-11/+3
| | | | | | | | | | | | | | | | | | | Merge aliases "ssd" and "base", since they do the same thing but only "base" is used in chromite scripts. Remove "usb" since it is not used anywhere. BUG=b:188121855 TEST=make clean && make runtests BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: Ief610387fc1b6d72fe8674b0e4d51d74e6173ddd Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2989637 Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot/vboot_kernel: clean up vb2_load_partitionJoel Kitching2021-07-031-19/+18
| | | | | | | | | | | | | | | | | | | | - Re-order arguments for consistency with LoadKernel() - Rename `flags` to `lpflags` for clarity - Move enum and friends to top of vboot_kernel.c This CL is part of a series to merge vboot1 and vboot2.0 kernel verification code; see b/181739551. BUG=b:181739551, b:188121855 TEST=make clean && make runtests BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: I4a1e1eba9f2c72a1393bba29523fc22944a2d73e Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2917625 Tested-by: Joel Kitching <kitching@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org>
* vboot/vboot_kernel: store kparams pointer instead of copying dataJoel Kitching2021-07-034-49/+21
| | | | | | | | | | | | | | | | | | | | Store kparams as a pointer in vboot_api_kernel.c, rather than a full struct passed around as a "buffer copy". This CL is part of a series to merge vboot1 and vboot2.0 kernel verification code; see b/181739551. BUG=b:181739551 TEST=make clean && make runtests BRANCH=none Signed-off-by: Joel Kitching <kitching@google.com> Change-Id: I7be7280761564c35e928bc947177b3fce61d6215 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2856360 Tested-by: Joel Kitching <kitching@chromium.org> Reviewed-by: Yu-Ping Wu <yupingso@chromium.org> Reviewed-by: Julius Werner <jwerner@chromium.org> Commit-Queue: Joel Kitching <kitching@chromium.org>
* Replace an old VB2_CONTEXT_SECDATA_CHANGEDSimon Glass2021-07-021-2/+2
| | | | | | | | | | | | | This enum has changed. Update the one remaining reference. BUG=b:191646387 BRANCH=none TEST=FEATURES=test sudo -E emerge vboot_reference Signed-off-by: Simon Glass <sjg@chromium.org> Change-Id: If22fa8cdd9a327e9a54dee01caf423caf7ba4efe Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/3002419 Reviewed-by: Julius Werner <jwerner@chromium.org>
* Show error code when kernel is invalidSimon Glass2021-07-011-1/+1
| | | | | | | | | | | | | | | It seems useful to provide a bit more information about why the kernel failed to load. We have a suitable error code, so show it. BUG=b:191646387 BRANCH=none TEST=run through the flow with a VB2_ERROR_LOAD_PARTITION_WORKBUF error, see it is shown Signed-off-by: Simon Glass <sjg@chromium.org> Change-Id: I426f571e1a4f947c97ccf99a399b4c3ab1c32047 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/vboot_reference/+/2975086 Reviewed-by: Joel Kitching <kitching@chromium.org>