Merge pull request #26 from home-assistant/dev

Release 0.3

.gitattributes

@@ -1,3 +0,0 @@
-# Ensure Docker script files uses LF to support Docker for Windows.
-# Ensure "git config --global core.autocrlf input" before you clone
-*     text eol=lf

.github/move.yml

@@ -0,0 +1,13 @@
+# Configuration for move-issues - https://github.com/dessant/move-issues
+
+# Delete the command comment. Ignored when the comment also contains other content
+deleteCommand: true
+# Close the source issue after moving
+closeSourceIssue: true
+# Lock the source issue after moving
+lockSourceIssue: false
+# Set custom aliases for targets
+# aliases:
+#   r: repo
+#   or: owner/repo
+

.gitignore

@@ -1 +0,0 @@
-buildroot/ccache

Documentation/boards/raspberrypi.md

@@ -0,0 +1,5 @@
+# Raspberry PI
+
+## Serial console
+
+For access to terminal over serial console, add `console=ttyAMA0,115200` to `cmdline.txt`.

Documentation/configuration.md

@@ -0,0 +1,29 @@
+# Configuration
+
+## Automatic
+
+You can format a USB stick with FAT32 and name it with `hassos-config`. The layout could be look like:
+```
+network/
+modules/
+known_hosts
+hassos-xy.rauc
+```
+
+- On `network` folder can hold any kind of NetworkManager connections files.
+- The folder `modules` is for modules-load configuration files.
+- `known_hosts` file activate debug SSH access of port `22222`.
+- For firmware updates you can but the `hassos-*.rauc` OTA update they should be install. 
+
+## Local
+
+### Bootargs
+
+You can edit or create a `cmdline.txt` into your boot partition. That will be read from our bootloader.
+
+### Kernel-Module
+
+The kernel module folder `/etc/modules-load.d` is persistent and you can add your config files there. See [Systemd modules load][systemd-modules].
+
+
+[systemd-modules]: https://www.freedesktop.org/software/systemd/man/modules-load.d.html

README.md

@@ -1,54 +1,47 @@
-# WORK IN PROGRESS!
-
-# Hass.io OS
-Hass.io OS based on buildroot. It's a hypervisor for docker and support many kind of IoT hardware. It is also available as Virtual Appliance. It's optimazed for embedded system and high security. You can update the system simple with OTA updates or offline Updates.
+# HassOS
+Hass.io OS based on [buildroot](https://buildroot.org/). It's a hypervisor for Docker and supports various kind of IoT hardware. It is also available as virtual appliance. The whole system is optimized for embedded system and  security. You can update the system simple with OTA updates or offline updates.
 
 ## Focus
-- Linux kernel 4.15
+
+- Linux kernel 4.14 (LT)
 - Barebox as bootloader
 - RAUC for OTA updates
-- SquashFS LZ4 for filesystem
+- SquashFS LZ4 as filesystem
 - Docker 17.12.1
+- AppArmor protected
 - ZRAM LZ4 for /tmp, /var, swap
 - Run every supervisor
 
 ## Schemas
 ![](misc/hassio-os-partition.png?raw=true)
 
-## Config
-Create a USB stick with a partition "hassio-config". This partition can include follow files:
-
-- network-* (NetworkManager keyfiles)
-- known_hosts (SSH)
-- hassio-os-*.ota (Firmware updates)
-
 # Customize
 
-## Supervisor/Cli
+Provide a file with the name `hassos.json` in your data partition and the following structure:
 
-Provide a `hassio.json` on your data partition they can/need follow struct:
 ```json
 {
   "supervisor": "repo/image",
   "supervisor_args": "optional / custom docker arguments",
   "cli": "repo/image",
-  "cli_args": "optional / custom docker arguments"
+  "cli_args": "optional / custom docker arguments",
+  "hostname": "default hostname"
 }
 ```
 
 # Building
-Running sudo `./enter.sh` will get you into the build docker container.   
+Running `sudo ./enter.sh` will get you into the build Docker container.   
 `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external xy_defconfig`
 
-From outside the docker container, while it is still running you can use `./getimage.sh` to get the output image.
-
 ## Helpers
 
-- `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external defconfig BR2_DEFCONFIG=/build/buildroot-external/configs/xy_defconfig`
+- `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external xy_defconfig`
 - `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external menuconfig`
 - `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external linux-menuconfig`
 - `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external barebox-menuconfig`
+- `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external busybox-menuconfig`
 
-- `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external savedefconfig BR2_DEFCONFIG=/build/buildroot-external/configs/xy_defconfig`
+- `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external savedefconfig`
 - `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external linux-update-defconfig`
 - `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external barebox-update-defconfig`
+- `make -C /build/buildroot BR2_EXTERNAL=/build/buildroot-external busybox-update-config`

buildroot-external/Config.in

@@ -1,2 +1,3 @@
-source "$BR2_EXTERNAL_HASSIO_PATH/package/mingetty/Config.in"
-source "$BR2_EXTERNAL_HASSIO_PATH/package/hassio/Config.in"
+source "$BR2_EXTERNAL_HASSOS_PATH/package/hassos/Config.in"
+source "$BR2_EXTERNAL_HASSOS_PATH/package/libapparmor/Config.in"
+source "$BR2_EXTERNAL_HASSOS_PATH/package/apparmor/Config.in"

buildroot-external/apparmor/hassio-supervisor

@@ -0,0 +1,75 @@
+#include <tunables/global>
+
+profile hassio-supervisor flags=(attach_disconnected,mediate_deleted) {
+  #include <abstractions/base>
+  #include <abstractions/python>
+
+  network,
+  deny network raw,
+
+  signal (send) set=(kill,term),
+
+  /bin/busybox ix,
+  /usr/bin/python{,3,3.[0-9]} ix,
+  /usr/bin/git cx,
+  /usr/bin/socat cx,
+  /usr/bin/gdbus cx,
+
+  deny /proc/** wl,
+  deny /root/** wl,
+  deny /sys/** wl,
+
+  /** r,
+  /tmp/** rw,
+  /data/** rw,
+  /{,var/}run/docker.sock rw,
+
+  capability net_bind_service,
+
+  profile /usr/bin/socat flags=(attach_disconnected,mediate_deleted) {
+    #include <abstractions/base>
+
+    network inet udp,
+    network inet tcp,
+
+    deny network raw,
+    deny network packet,
+
+    signal (receive) set=(kill,term),
+    capability net_bind_service,
+
+    /lib/* mr,
+    /usr/bin/socat mr,
+  }
+
+  profile /usr/bin/gdbus flags=(attach_disconnected,mediate_deleted) {
+    #include <abstractions/base>
+    #include <abstractions/dbus>
+
+    unix (send, receive) type=stream,
+
+    /usr/bin/gdbus mr,
+    /lib/* mr,
+    /{,var/}run/dbus/system_bus_socket rw,
+  }
+
+  profile /usr/bin/git flags=(attach_disconnected,mediate_deleted) {
+    #include <abstractions/base>
+
+    network,
+    deny network raw,
+
+    /bin/busybox ix,
+    /usr/bin/git mr,
+    /usr/libexec/git-core/* ix,
+
+    deny /data/homeassistant rw,
+    deny /data/ssl rw,
+
+    /** r,
+    /lib/* mr,
+    /data/addons/** lrw,
+
+    capability dac_override,
+  }
+}

buildroot-external/barebox-env/bin/init

@@ -2,31 +2,20 @@
 
 export PATH=/env/bin
 
-global autoboot_timeout
-global boot.default
-global linux.bootargs.base
-global linux.bootargs.console
-#linux.bootargs.dyn.* will be cleared at the beginning of boot
-global linux.bootargs.dyn.root
-global editcmd
-
-[ -z "${global.autoboot_timeout}" ] && global.autoboot_timeout=3
-magicvar -a global.autoboot_timeout "timeout in seconds before automatic booting"
-[ -z "${global.boot.default}" ] && global.boot.default="system0"
-[ -z "${global.editcmd}" ] && global.editcmd=sedit
-
-[ -e /env/config-board ] && /env/config-board
-
 # Autostart
 for i in /env/init/*; do
 	. $i
 done
 
-echo -e -n "\nHit any key to stop autoboot: "
-timeout -a $global.autoboot_timeout
-autoboot="$?"
+# Overlays
+. /env/overlay/load
 
-if [ "$autoboot" = 0 ]; then
-	boot
+echo "- Hit m for menu or wait for autoboot -"
+timeout -a 1 -s -v key
+
+# Run menu
+if [ "${key}" != "m" ]; then
+    boot
 fi
 
+menutree

buildroot-external/barebox-env/boot/system0

@@ -0,0 +1,12 @@
+#!/bin/sh
+
+global linux.bootargs.dyn.root="root=PARTUUID=8d3d53e3-6d49-4c38-8349-aff6859e82fd rootfstype=squashfs ro"
+
+mkdir -p /mnt/system
+mount -t squashfs /dev/disk0.hassos-system0 /mnt/system
+
+if [ -f "/mnt/system/boot/bzImage" ]; then
+    global bootm.image="/mnt/system/boot/bzImage"
+else
+    global bootm.image="/mnt/system/boot/zImage"
+fi

buildroot-external/barebox-env/boot/system1

@@ -0,0 +1,13 @@
+#!/bin/sh
+
+global linux.bootargs.dyn.root="root=PARTUUID=a3ec664e-32ce-4665-95ea-7ae90ce9aa20 rootfstype=squashfs ro"
+
+mkdir -p /mnt/system
+mount -t squashfs /dev/disk0.hassos-system1 /mnt/system
+
+if [ -f "/mnt/system/boot/bzImage" ]; then
+    global bootm.image="/mnt/system/boot/bzImage"
+else
+    global bootm.image="/mnt/system/boot/zImage"
+fi
+

buildroot-external/barebox-env/init/cmdline

@@ -0,0 +1,6 @@
+#!/bin/sh
+
+global linux.bootargs.base=""
+if [ -f /boot/cmdline.txt ]; then
+	readf /boot/cmdline.txt global.linux.bootargs.base
+fi

buildroot-external/barebox-env/init/global_bootargs

@@ -1,3 +1,4 @@
 #!/bin/sh
 
 global linux.bootargs.zram="zram.enabled=1 zram.num_devices=3"
+global linux.bootargs.apparmor="apparmor=1 security=apparmor"

buildroot-external/barebox-env/menu/00-boot-auto/action

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+boot

buildroot-external/barebox-env/menu/00-boot-auto/title

@@ -0,0 +1 @@
+Autoboot

buildroot-external/barebox-env/menu/10-boot-system0/action

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+boot system0

buildroot-external/barebox-env/menu/10-boot-system0/title

@@ -0,0 +1 @@
+Boot System 0

buildroot-external/barebox-env/menu/20-boot-system1/action

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+boot system1

buildroot-external/barebox-env/menu/20-boot-system1/title

@@ -0,0 +1 @@
+Boot System 1

buildroot-external/barebox-env/menu/30-shell/action

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+echo "Enter 'exit' to get back to the menu"
+
+sh

buildroot-external/barebox-env/menu/30-shell/title

@@ -0,0 +1 @@
+Shell

buildroot-external/barebox-env/menu/title

@@ -0,0 +1 @@
+HassOS boot Menu:

buildroot-external/barebox-env/nv/autoboot_timeout

@@ -1 +0,0 @@
-2

buildroot-external/barebox-env/nv/editcmd

@@ -0,0 +1 @@
+sedit

buildroot-external/barebox-env/overlay/load

@@ -0,0 +1,5 @@
+#!/bin/sh
+
+for i in /env/overlay/*.dtbo; do
+	oftree -o $i
+done

buildroot-external/barebox.config

@@ -0,0 +1,46 @@
+# CONFIG_LOCALVERSION_AUTO is not set
+# CONFIG_CMD_VERSION is not set
+# CONFIG_TIMESTAMP is not set
+
+CONFIG_PROMPT="HassOS-boot:"
+CONFIG_CMDLINE_EDITING=y
+CONFIG_AUTO_COMPLETE=y
+CONFIG_MENU=y
+CONFIG_BOOTM_SHOW_TYPE=y
+CONFIG_BOOTM_OFTREE=y
+CONFIG_FLEXIBLE_BOOTARGS=y
+
+# CONFIG_PARTITION_DISK_DOS is not set
+CONFIG_PARTITION_DISK_EFI=y
+# CONFIG_PARTITION_DISK_EFI_GPT_NO_FORCE is not set
+# CONFIG_PARTITION_DISK_EFI_GPT_COMPARE is not set
+
+CONFIG_STATE=y
+CONFIG_STATE_DRV=y
+CONFIG_BOOTCHOOSER=y
+CONFIG_CMD_BOOT=y
+CONFIG_CMD_NV=y
+CONFIG_CMD_EXPORT=y
+CONFIG_CMD_GLOBAL=y
+CONFIG_CMD_BASENAME=y
+CONFIG_CMD_DIRNAME=y
+CONFIG_CMD_READLINK=y
+CONFIG_CMD_GETOPT=y
+CONFIG_CMD_MENUTREE=y
+CONFIG_CMD_TIMEOUT=y
+CONFIG_CMD_OFTREE=y
+CONFIG_CMD_STATE=y
+CONFIG_CMD_BOOTCHOOSER=y
+CONFIG_CMD_READF=y
+
+CONFIG_OFTREE=y
+CONFIG_OFTREE_OVERLAY=y
+
+CONFIG_DISK=y
+CONFIG_DISK_WRITE=y
+
+CONFIG_FS_FAT=y
+CONFIG_FS_FAT_WRITE=y
+CONFIG_FS_FAT_LFN=y
+CONFIG_FS_SQUASHFS=y
+CONFIG_LZ4_DECOMPRESS=y

buildroot-external/board/ova/barebox-env/boot/system0

@@ -1,5 +0,0 @@
-#!/bin/sh
-
-global bootm.image="/mnt/disk1/boot/bzImage"
-global linux.bootargs.dyn.root="root=/dev/sda2 rootfstype=squashfs ro"
-

buildroot-external/board/ova/barebox-env/boot/system1

@@ -1,4 +0,0 @@
-#!/bin/sh
-
-global bootm.image="/mnt/disk2/boot/bzImage"
-global linux.bootargs.dyn.root="root=/dev/sda3 rootfstype=squashfs ro"

buildroot-external/board/ova/barebox.config

@@ -1,37 +1,6 @@
-# CONFIG_LOCALVERSION_AUTO is not set
 CONFIG_MMU=y
 CONFIG_MALLOC_SIZE=0x0
 CONFIG_MALLOC_TLSF=y
-CONFIG_PROMPT="hassio-os:"
-CONFIG_GLOB=y
-CONFIG_GLOB_SORT=y
-CONFIG_CMDLINE_EDITING=y
-CONFIG_AUTO_COMPLETE=y
-CONFIG_BOOTM_SHOW_TYPE=y
-CONFIG_BOOTM_OFTREE=y
-CONFIG_FLEXIBLE_BOOTARGS=y
-# CONFIG_PARTITION_DISK_DOS is not set
-CONFIG_PARTITION_DISK_EFI=y
-# CONFIG_PARTITION_DISK_EFI_GPT_NO_FORCE is not set
-# CONFIG_PARTITION_DISK_EFI_GPT_COMPARE is not set
-CONFIG_DEFAULT_ENVIRONMENT_PATH="/build/buildroot-external/board/ova/barebox-env /build/buildroot-external/barebox-env"
-CONFIG_STATE=y
-CONFIG_BOOTCHOOSER=y
-CONFIG_CMD_BOOT=y
-CONFIG_CMD_UIMAGE=y
-CONFIG_CMD_AUTOMOUNT=y
-CONFIG_CMD_NV=y
-CONFIG_CMD_EXPORT=y
-CONFIG_CMD_GLOBAL=y
-CONFIG_CMD_MAGICVAR=y
-CONFIG_CMD_BASENAME=y
-CONFIG_CMD_DIRNAME=y
-CONFIG_CMD_READLINK=y
-CONFIG_CMD_GETOPT=y
-CONFIG_CMD_TIMEOUT=y
-CONFIG_CMD_DETECT=y
-CONFIG_CMD_STATE=y
-CONFIG_CMD_BOOTCHOOSER=y
 CONFIG_DRIVER_SERIAL_EFI=y
 CONFIG_DRIVER_SERIAL_EFI_STDIO=y
 # CONFIG_SPI is not set
@@ -40,8 +9,3 @@ CONFIG_DISK_WRITE=y
 CONFIG_CLOCKSOURCE_EFI=y
 CONFIG_FS_EFI=y
 CONFIG_FS_EFIVARFS=y
-CONFIG_FS_FAT=y
-CONFIG_FS_FAT_WRITE=y
-CONFIG_FS_FAT_LFN=y
-CONFIG_FS_SQUASHFS=y
-CONFIG_LZ4_DECOMPRESS=y

buildroot-external/board/ova/info

@@ -0,0 +1,3 @@
+BOARD_ID=ova
+BOARD_NAME="Open Virtual Appliance"
+CHASSIS=vm

buildroot-external/board/ova/kernel.config

@@ -1,254 +1 @@
-# CONFIG_LOCALVERSION_AUTO is not set
-CONFIG_KERNEL_LZ4=y
-CONFIG_SYSVIPC=y
-CONFIG_POSIX_MQUEUE=y
-CONFIG_NO_HZ=y
-CONFIG_HIGH_RES_TIMERS=y
-CONFIG_BSD_PROCESS_ACCT=y
-CONFIG_TASKSTATS=y
-CONFIG_TASK_DELAY_ACCT=y
-CONFIG_TASK_XACCT=y
-CONFIG_TASK_IO_ACCOUNTING=y
-CONFIG_LOG_BUF_SHIFT=18
-CONFIG_CGROUPS=y
-CONFIG_MEMCG=y
-CONFIG_MEMCG_SWAP=y
-CONFIG_BLK_CGROUP=y
-CONFIG_CGROUP_SCHED=y
-CONFIG_CFS_BANDWIDTH=y
-CONFIG_RT_GROUP_SCHED=y
-CONFIG_CGROUP_PIDS=y
-CONFIG_CGROUP_FREEZER=y
-CONFIG_CGROUP_HUGETLB=y
-CONFIG_CPUSETS=y
-CONFIG_CGROUP_DEVICE=y
-CONFIG_CGROUP_CPUACCT=y
-CONFIG_CGROUP_PERF=y
-CONFIG_USER_NS=y
-# CONFIG_COMPAT_BRK is not set
-CONFIG_PROFILING=y
-CONFIG_JUMP_LABEL=y
-CONFIG_BLK_DEV_THROTTLING=y
-CONFIG_PARTITION_ADVANCED=y
-CONFIG_BSD_DISKLABEL=y
-CONFIG_CFQ_GROUP_IOSCHED=y
-CONFIG_SMP=y
-CONFIG_CALGARY_IOMMU=y
-CONFIG_SCHED_SMT=y
-CONFIG_PREEMPT_VOLUNTARY=y
-CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
-CONFIG_MICROCODE_AMD=y
-CONFIG_X86_MSR=y
-CONFIG_X86_CPUID=y
-CONFIG_NUMA=y
-CONFIG_ZSMALLOC=y
-CONFIG_X86_CHECK_BIOS_CORRUPTION=y
-# CONFIG_MTRR_SANITIZER is not set
-CONFIG_EFI=y
-CONFIG_EFI_STUB=y
-CONFIG_HZ_1000=y
-CONFIG_KEXEC=y
-# CONFIG_SUSPEND is not set
-CONFIG_PM=y
-CONFIG_ACPI_DOCK=y
-CONFIG_CPU_FREQ_DEFAULT_GOV_USERSPACE=y
-CONFIG_CPU_FREQ_GOV_PERFORMANCE=y
-CONFIG_CPU_FREQ_GOV_ONDEMAND=y
-CONFIG_X86_ACPI_CPUFREQ=y
-CONFIG_PCI_MMCONFIG=y
-CONFIG_PCIEPORTBUS=y
-CONFIG_HOTPLUG_PCI=y
-CONFIG_PCCARD=y
-CONFIG_YENTA=y
-# CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
-CONFIG_BINFMT_MISC=y
-CONFIG_NET=y
-CONFIG_PACKET=y
-CONFIG_UNIX=y
-CONFIG_XFRM_USER=y
-CONFIG_INET=y
-CONFIG_IP_MULTICAST=y
-CONFIG_IP_ADVANCED_ROUTER=y
-CONFIG_IP_MULTIPLE_TABLES=y
-CONFIG_IP_ROUTE_MULTIPATH=y
-CONFIG_IP_ROUTE_VERBOSE=y
-CONFIG_IP_PNP=y
-CONFIG_IP_PNP_DHCP=y
-CONFIG_IP_PNP_BOOTP=y
-CONFIG_IP_PNP_RARP=y
-CONFIG_IP_MROUTE=y
-CONFIG_IP_PIMSM_V1=y
-CONFIG_IP_PIMSM_V2=y
-CONFIG_SYN_COOKIES=y
-CONFIG_INET_ESP=y
-# CONFIG_INET_XFRM_MODE_TRANSPORT is not set
-# CONFIG_INET_XFRM_MODE_TUNNEL is not set
-# CONFIG_INET_XFRM_MODE_BEET is not set
-# CONFIG_INET_DIAG is not set
-CONFIG_TCP_CONG_ADVANCED=y
-# CONFIG_TCP_CONG_BIC is not set
-# CONFIG_TCP_CONG_WESTWOOD is not set
-# CONFIG_TCP_CONG_HTCP is not set
-CONFIG_TCP_MD5SIG=y
-CONFIG_INET6_AH=y
-CONFIG_INET6_ESP=y
-CONFIG_NETLABEL=y
-CONFIG_NETWORK_SECMARK=y
-CONFIG_NETFILTER=y
-CONFIG_NF_CONNTRACK=y
-CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
-CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
-CONFIG_NETFILTER_XT_MATCH_IPVS=y
-CONFIG_IP_VS=y
-CONFIG_IP_VS_RR=y
-CONFIG_IP_VS_NFCT=y
-CONFIG_NF_CONNTRACK_IPV4=y
-CONFIG_IP_NF_IPTABLES=y
-CONFIG_IP_NF_FILTER=y
-CONFIG_IP_NF_NAT=y
-CONFIG_IP_NF_TARGET_MASQUERADE=y
-CONFIG_BRIDGE=y
-CONFIG_NET_SCHED=y
-CONFIG_NET_CLS_CGROUP=y
-CONFIG_NET_EMATCH=y
-CONFIG_NET_CLS_ACT=y
-CONFIG_DNS_RESOLVER=y
-CONFIG_NET_L3_MASTER_DEV=y
-CONFIG_CGROUP_NET_PRIO=y
-CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
-CONFIG_DEVTMPFS=y
-CONFIG_DEVTMPFS_MOUNT=y
-CONFIG_CONNECTOR=y
-CONFIG_OF=y
-CONFIG_ZRAM=y
-CONFIG_BLK_DEV_LOOP=y
-CONFIG_BLK_DEV_LOOP_MIN_COUNT=4
-CONFIG_BLK_DEV_SD=y
-CONFIG_BLK_DEV_SR=y
-CONFIG_BLK_DEV_SR_VENDOR=y
-CONFIG_CHR_DEV_SG=y
-CONFIG_SCSI_CONSTANTS=y
-CONFIG_SCSI_SPI_ATTRS=y
-# CONFIG_SCSI_LOWLEVEL is not set
-CONFIG_ATA=y
-CONFIG_SATA_AHCI=y
-CONFIG_ATA_PIIX=y
-CONFIG_PATA_AMD=y
-CONFIG_PATA_OLDPIIX=y
-CONFIG_PATA_SCH=y
-CONFIG_NETDEVICES=y
-CONFIG_DUMMY=y
-CONFIG_MACVLAN=y
-CONFIG_IPVLAN=y
-CONFIG_VXLAN=y
-CONFIG_NETCONSOLE=y
-CONFIG_VETH=y
-CONFIG_TIGON3=y
-CONFIG_NET_TULIP=y
-CONFIG_E100=y
-CONFIG_E1000=y
-CONFIG_E1000E=y
-CONFIG_SKY2=y
-CONFIG_FORCEDETH=y
-CONFIG_8139TOO=y
-CONFIG_R8169=y
-CONFIG_FDDI=y
-CONFIG_INPUT_POLLDEV=y
-CONFIG_INPUT_EVDEV=y
-CONFIG_INPUT_JOYSTICK=y
-CONFIG_INPUT_TABLET=y
-CONFIG_INPUT_TOUCHSCREEN=y
-CONFIG_INPUT_MISC=y
-# CONFIG_LEGACY_PTYS is not set
-CONFIG_SERIAL_NONSTANDARD=y
-CONFIG_SERIAL_8250=y
-CONFIG_SERIAL_8250_CONSOLE=y
-CONFIG_SERIAL_8250_NR_UARTS=32
-CONFIG_SERIAL_8250_EXTENDED=y
-CONFIG_SERIAL_8250_MANY_PORTS=y
-CONFIG_SERIAL_8250_SHARE_IRQ=y
-CONFIG_SERIAL_8250_DETECT_IRQ=y
-CONFIG_SERIAL_8250_RSA=y
-CONFIG_NVRAM=y
-CONFIG_HPET=y
-# CONFIG_HPET_MMAP is not set
-CONFIG_I2C_I801=y
-CONFIG_WATCHDOG=y
-CONFIG_AGP=y
-CONFIG_AGP_AMD64=y
-CONFIG_AGP_INTEL=y
-CONFIG_DRM=y
-CONFIG_DRM_I915=y
-CONFIG_FB_MODE_HELPERS=y
-CONFIG_FB_TILEBLITTING=y
-CONFIG_FB_EFI=y
-# CONFIG_LCD_CLASS_DEVICE is not set
-CONFIG_VGACON_SOFT_SCROLLBACK=y
-CONFIG_HIDRAW=y
-CONFIG_HID_GYRATION=y
-CONFIG_LOGITECH_FF=y
-CONFIG_HID_NTRIG=y
-CONFIG_HID_PANTHERLORD=y
-CONFIG_PANTHERLORD_FF=y
-CONFIG_HID_PETALYNX=y
-CONFIG_HID_SAMSUNG=y
-CONFIG_HID_SONY=y
-CONFIG_HID_SUNPLUS=y
-CONFIG_HID_TOPSEED=y
-CONFIG_HID_PID=y
-CONFIG_USB_HIDDEV=y
-CONFIG_USB=y
-CONFIG_USB_ANNOUNCE_NEW_DEVICES=y
-CONFIG_USB_MON=y
-CONFIG_USB_EHCI_HCD=y
-CONFIG_USB_OHCI_HCD=y
-CONFIG_USB_UHCI_HCD=y
-CONFIG_USB_PRINTER=y
-CONFIG_USB_STORAGE=y
-CONFIG_LEDS_TRIGGERS=y
-CONFIG_EDAC=y
-CONFIG_RTC_CLASS=y
-# CONFIG_RTC_HCTOSYS is not set
-CONFIG_DMADEVICES=y
-CONFIG_EEEPC_LAPTOP=y
-CONFIG_AMD_IOMMU=y
-CONFIG_INTEL_IOMMU=y
-# CONFIG_INTEL_IOMMU_DEFAULT_ON is not set
-CONFIG_DAX=y
-CONFIG_EFI_VARS=y
-CONFIG_EXT4_FS=y
-CONFIG_EXT4_FS_POSIX_ACL=y
-CONFIG_EXT4_FS_SECURITY=y
-CONFIG_AUTOFS4_FS=y
-CONFIG_OVERLAY_FS=y
-CONFIG_ISO9660_FS=y
-CONFIG_JOLIET=y
-CONFIG_ZISOFS=y
-CONFIG_MSDOS_FS=y
-CONFIG_VFAT_FS=y
-CONFIG_PROC_KCORE=y
-CONFIG_TMPFS_POSIX_ACL=y
-CONFIG_HUGETLBFS=y
-CONFIG_SQUASHFS=y
-CONFIG_SQUASHFS_XATTR=y
-CONFIG_SQUASHFS_LZ4=y
-# CONFIG_NETWORK_FILESYSTEMS is not set
-CONFIG_NLS_DEFAULT="utf8"
-CONFIG_NLS_CODEPAGE_437=y
-CONFIG_NLS_ASCII=y
-CONFIG_NLS_ISO8859_1=y
-CONFIG_NLS_UTF8=y
-CONFIG_PRINTK_TIME=y
-# CONFIG_ENABLE_WARN_DEPRECATED is not set
-# CONFIG_UNUSED_SYMBOLS is not set
-CONFIG_MAGIC_SYSRQ=y
-CONFIG_EARLY_PRINTK_DBGP=y
-CONFIG_OPTIMIZE_INLINING=y
-CONFIG_SECURITY=y
-CONFIG_SECURITY_APPARMOR=y
-CONFIG_CRYPTO_CCM=y
-CONFIG_CRYPTO_GCM=y
-CONFIG_CRYPTO_CMAC=y
-CONFIG_CRYPTO_ARC4=y
-CONFIG_CRYPTO_LZ4=y
-# CONFIG_VIRTUALIZATION is not set
+CONFIG_EFI_STUB=y

buildroot-external/board/ova/patches/dt-utils/0001-get-devicetree-from-file.patch

@@ -0,0 +1,123 @@
+From 405590bdb7ae434798010458e810c415e4e99db4 Mon Sep 17 00:00:00 2001
+From: Steffen Trumtrar <s.trumtrar@pengutronix.de>
+Date: Fri, 30 Jun 2017 16:53:34 +0200
+Subject: barebox-state: get devicetree from file
+
+Signed-off-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
+
+diff --git a/src/barebox-state.c b/src/barebox-state.c
+index e68b8cb..3622e76 100644
+--- a/src/barebox-state.c
++++ b/src/barebox-state.c
+@@ -308,7 +308,7 @@ static int state_set_var(struct state *state, const char *var, const char *val)
+ }
+ 
+ 
+-struct state *state_get(const char *name, bool readonly, bool auth)
++struct state *state_get(const char *name, const char *filename, bool readonly, bool auth)
+ {
+ 	struct device_node *root, *node, *partition_node;
+ 	char *path;
+@@ -320,11 +320,19 @@ struct state *state_get(const char *name, bool readonly, bool auth)
+ 	off_t offset;
+ 	size_t size;
+ 
+-	root = of_read_proc_devicetree();
+-	if (IS_ERR(root)) {
+-		pr_err("Unable to read devicetree. %s\n",
+-				strerror(-PTR_ERR(root)));
+-		return ERR_CAST(root);
++	if (filename) {
++		void *fdt;
++
++		fdt = read_file(filename, NULL);
++		if (fdt)
++			root = of_unflatten_dtb(fdt);
++	} else {
++		root = of_read_proc_devicetree();
++		if (IS_ERR(root)) {
++			pr_err("Unable to read devicetree. %s\n",
++			       strerror(-PTR_ERR(root)));
++			return ERR_CAST(root);
++		}
+ 	}
+ 
+ 	of_set_root_node(root);
+@@ -387,6 +395,7 @@ static struct option long_options[] = {
+ 	{"get",		required_argument,	0,	'g' },
+ 	{"set",		required_argument,	0,	's' },
+ 	{"name",	required_argument,	0,	'n' },
++	{"input",	required_argument,	0,	'i' },
+ 	{"dump",	no_argument,		0,	'd' },
+ 	{"dump-shell",	no_argument,		0,	OPT_DUMP_SHELL },
+ 	{"verbose",	no_argument,		0,	'v' },
+@@ -402,6 +411,7 @@ static void usage(char *name)
+ "-g, --get <variable>                      get the value of a variable\n"
+ "-s, --set <variable>=<value>              set the value of a variable\n"
+ "-n, --name <name>                         specify the state to use (default=\"state\"). Multiple states are allowed.\n"
++"-i, --input <name>                        load the devicetree from a file instead of using the system devicetree.\n"
+ "-d, --dump                                dump the state\n"
+ "--dump-shell                              dump the state suitable for shell sourcing\n"
+ "-v, --verbose                             increase verbosity\n"
+@@ -439,12 +449,13 @@ int main(int argc, char *argv[])
+ 	bool readonly = true;
+ 	int pr_level = 5;
+ 	int auth = 1;
++	const char *dtb = NULL;
+ 
+ 	INIT_LIST_HEAD(&sg_list);
+ 	INIT_LIST_HEAD(&state_list.list);
+ 
+ 	while (1) {
+-		c = getopt_long(argc, argv, "hg:s:dvn:qf", long_options, &option_index);
++		c = getopt_long(argc, argv, "hg:s:i:dvn:qf", long_options, &option_index);
+ 		if (c < 0)
+ 			break;
+ 		switch (c) {
+@@ -490,6 +501,9 @@ int main(int argc, char *argv[])
+ 			++nr_states;
+ 			break;
+ 		}
++		case 'i':
++			dtb = strdup(optarg);
++			break;
+ 		case ':':
+ 		case '?':
+ 		default:
+@@ -530,7 +544,7 @@ int main(int argc, char *argv[])
+ 	}
+ 
+ 	list_for_each_entry(state, &state_list.list, list) {
+-		state->state = state_get(state->name, readonly, auth);
++		state->state = state_get(state->name, dtb, readonly, auth);
+ 		if (!IS_ERR(state->state) && !state->name)
+ 			state->name = state->state->name;
+ 		if (IS_ERR(state->state)) {
+diff --git a/src/barebox-state.h b/src/barebox-state.h
+index bd89cf4..a0f49a5 100644
+--- a/src/barebox-state.h
++++ b/src/barebox-state.h
+@@ -1,7 +1,7 @@
+ #ifndef __BAREBOX_STATE__
+ #define __BAREBOX_STATE__
+ 
+-struct state *state_get(const char *name, bool readonly, bool auth);
++struct state *state_get(const char *name, const char *file, bool readonly, bool auth);
+ char *state_get_var(struct state *state, const char *var);
+ 
+ #endif /* __BAREBOX_STATE__ */
+diff --git a/src/keystore-blob.c b/src/keystore-blob.c
+index 028dd8b..4572431 100644
+--- a/src/keystore-blob.c
++++ b/src/keystore-blob.c
+@@ -30,7 +30,7 @@ int keystore_get_secret(const char *name, const unsigned char **key, int *key_le
+ 	if (!state) {
+ 		struct state *tmp;
+ 
+-		tmp = state_get(keystore_state_name, true, false);
++		tmp = state_get(keystore_state_name, NULL, true, false);
+ 		if (IS_ERR(tmp))
+ 			return  PTR_ERR(tmp);
+ 		state = tmp;
+-- 
+cgit v0.10.2

buildroot-external/board/ova/patches/dt-utils/0002-support-finding-devices-by-partuuid.patch

@@ -0,0 +1,33 @@
+From 26148417fab419a0c7f301fb8f2be015324d5374 Mon Sep 17 00:00:00 2001
+From: Steffen Trumtrar <s.trumtrar@pengutronix.de>
+Date: Fri, 30 Jun 2017 16:53:17 +0200
+Subject: libdt: support finding devices by partuuid
+
+Signed-off-by: Steffen Trumtrar <s.trumtrar@pengutronix.de>
+
+diff --git a/src/libdt.c b/src/libdt.c
+index 3adeed2..2bc6cc1 100644
+--- a/src/libdt.c
++++ b/src/libdt.c
+@@ -2393,6 +2393,18 @@ int of_get_devicepath(struct device_node *partition_node, char **devpath, off_t
+ 	 */
+ 	node = partition_node->parent;
+ 
++	if (of_device_is_compatible(node, "fixed-partitions")) {
++		const char *uuid;
++
++		/* when partuuid is specified short-circuit the search for the cdev */
++		ret = of_property_read_string(partition_node, "partuuid", &uuid);
++		if (!ret) {
++			*devpath = basprintf("/dev/disk/by-partuuid/%s", uuid);
++
++			return 0;
++		}
++	}
++
+ 	/*
+ 	 * Respect flash "partitions" subnode. Use parent of parent in this
+ 	 * case.
+-- 
+cgit v0.10.2
+

buildroot-external/board/ova/patches/rauc/0001-add-i-argument-to.patch

@@ -0,0 +1,36 @@
+From c9d56ea8fccf72e1c5d1f224f965e1a8e84d1b7f Mon Sep 17 00:00:00 2001
+From: Pascal Vizeli <pvizeli@syshack.ch>
+Date: Wed, 9 May 2018 21:54:58 +0200
+Subject: [PATCH 1/1] add -i argument to  barebox-state call
+
+---
+ src/bootchooser.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/src/bootchooser.c b/src/bootchooser.c
+index d5efc0c..c57c2f7 100644
+--- a/src/bootchooser.c
++++ b/src/bootchooser.c
+@@ -77,6 +77,9 @@ static gboolean barebox_state_get(const gchar* bootname, BareboxSlotState *bb_st
+ 	g_ptr_array_add(args, g_strdup_printf(BOOTSTATE_PREFIX ".%s.priority", bootname));
+ 	g_ptr_array_add(args, g_strdup("-g"));
+ 	g_ptr_array_add(args, g_strdup_printf(BOOTSTATE_PREFIX ".%s.remaining_attempts", bootname));
++
++	g_ptr_array_add(args, g_strdup("-i"));
++	g_ptr_array_add(args, g_strdup("/mnt/boot/EFI/barebox/state.dtb"));
+ 	g_ptr_array_add(args, NULL);
+ 
+ 	sub = g_subprocess_newv((const gchar * const *)args->pdata,
+@@ -170,6 +173,9 @@ static gboolean barebox_state_set(GPtrArray *pairs, GError **error)
+ 		g_ptr_array_add(args, g_strdup("-s"));
+ 		g_ptr_array_add(args, g_strdup(pairs->pdata[i]));
+ 	}
++
++	g_ptr_array_add(args, g_strdup("-i"));
++	g_ptr_array_add(args, g_strdup("/mnt/boot/EFI/barebox/state.dtb"));
+ 	g_ptr_array_add(args, NULL);
+ 
+ 	sub = g_subprocess_newv((const gchar * const *)args->pdata,
+-- 
+2.7.4
+

buildroot-external/board/ova/post-build.sh

@@ -1,13 +0,0 @@
-#!/bin/bash
-set -e
-
-SCRIPT_DIR=${BR2_EXTERNAL_HASSIO_PATH}/scripts
-BOARD_DIR="$(dirname $0)"
-
-. ${SCRIPT_DIR}/rootfs_layer.sh
-
-# HassioOS tasks
-fix_rootfs
-install_hassio_cli
-
-cp ${BOARD_DIR}/rauc.conf ${TARGET_DIR}/etc/rauc/system.conf

buildroot-external/board/ova/post-image.sh

@@ -1,11 +1,16 @@
 #!/bin/bash
 set -e
 
-SCRIPT_DIR=${BR2_EXTERNAL_HASSIO_PATH}/scripts
-BOARD_DIR="$(dirname $0)"
+SCRIPT_DIR=${BR2_EXTERNAL_HASSOS_PATH}/scripts
+BOARD_DIR=${2}
 BOOT_DATA=${BINARIES_DIR}/boot
 
-. ${SCRIPT_DIR}/hdd_image.sh
+. ${SCRIPT_DIR}/hdd-image.sh
+. ${BR2_EXTERNAL_HASSOS_PATH}/info
+. ${BOARD_DIR}/info
+
+# Filename
+IMAGE_FILE=${HASSOS_ID}_${BOARD_ID}-${VERSION_MAJOR}.${VERSION_BUILD}.vmdk
 
 # Init boot data
 rm -rf ${BOOT_DATA}
@@ -13,12 +18,14 @@ mkdir -p ${BOOT_DATA}/EFI/BOOT
 mkdir -p ${BOOT_DATA}/EFI/barebox
 
 cp ${BINARIES_DIR}/barebox.bin ${BOOT_DATA}/EFI/BOOT/BOOTx64.EFI
-cp ${BOARD_DIR}/barebox-state.dtb ${BOOT_DATA}/EFI/barebox/state.dtb
+cp ${BOARD_DIR}/barebox-state-efi.dtb ${BOOT_DATA}/EFI/barebox/state.dtb
+
+echo "console=tty1" > ${BOARD_DIR}/cmdline.txt
 
 # Create other layers
-hassio_boot_image ${BINARIES_DIR}
-hassio_overlay_image ${BINARIES_DIR}
+create_boot_image ${BINARIES_DIR}
+create_overlay_image ${BINARIES_DIR}
 
-hassio_hdd_image ${BINARIES_DIR} ${BINARIES_DIR}/harddisk.img 6
+create_disk_image ${BINARIES_DIR} ${BINARIES_DIR}/harddisk.img 6
 
-qemu-img convert -O vmdk ${BINARIES_DIR}/harddisk.img ${BINARIES_DIR}/hassio-os.vmdk
+qemu-img convert -O vmdk ${BINARIES_DIR}/harddisk.img ${BINARIES_DIR}/${IMAGE_FILE}

buildroot-external/board/ova/rauc.conf

@@ -1,21 +0,0 @@
-[system]
-compatible=Hass.io OS OVA
-bootloader=barebox
-
-[keyring]
-path=/etc/rauc/keyring.pem
-
-[slot.boot.0]
-device=/dev/sda0
-type=vfs
-bootname=boot
-
-[slot.rootfs.0]
-device=/dev/sda2
-type=raw
-bootname=system0
-
-[slot.rootfs.1]
-device=/dev/sda3
-type=raw
-bootname=system1

buildroot-external/board/rpi2/barebox-env/init/rpi_bootargs

@@ -0,0 +1,3 @@
+#!/bin/sh
+
+global linux.bootargs.rpi="bcm2708_fb.fbwidth=656 bcm2708_fb.fbheight=416 bcm2708_fb.fbswap=1 vc_mem.mem_base=0x3ec00000 vc_mem.mem_size=0x40000000"

buildroot-external/board/rpi2/barebox.config

@@ -0,0 +1,13 @@
+CONFIG_ARCH_BCM283X=y
+CONFIG_MACH_RPI2=y
+CONFIG_AEABI=y
+CONFIG_ARM_OPTIMZED_STRING_FUNCTIONS=y
+CONFIG_ARM_UNWIND=y
+CONFIG_MMU=y
+CONFIG_MALLOC_TLSF=y
+CONFIG_KALLSYMS=y
+# CONFIG_SPI is not set
+CONFIG_MCI=y
+CONFIG_MCI_BCM283X=y
+# CONFIG_PINCTRL is not set
+CONFIG_REGULATOR=y

buildroot-external/board/rpi2/info

@@ -0,0 +1,3 @@
+BOARD_ID=rpi2
+BOARD_NAME="RaspberryPi 2"
+CHASSIS=embedded

buildroot-external/board/rpi2/patches/barebox/0001-ARM-dts-bcm2836-rpi-2-re-enable-booting-from-SD-card.patch

@@ -0,0 +1,30 @@
+From 6344ec5c84a49c2df4c2f26b52d317a34e3bc0c7 Mon Sep 17 00:00:00 2001
+From: Pascal Vizeli <pvizeli@syshack.ch>
+Date: Mon, 4 Jun 2018 07:55:46 +0000
+Subject: [PATCH 1/2] ARM: dts: bcm2836-rpi-2: re-enable booting from SD card
+
+Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
+---
+ arch/arm/dts/bcm2836-rpi-2.dts | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+diff --git a/arch/arm/dts/bcm2836-rpi-2.dts b/arch/arm/dts/bcm2836-rpi-2.dts
+index 42b6abb18..2fa1c8bb4 100644
+--- a/arch/arm/dts/bcm2836-rpi-2.dts
++++ b/arch/arm/dts/bcm2836-rpi-2.dts
+@@ -9,3 +9,12 @@
+ 		reg = <0x0 0x0>;
+ 	};
+ };
++
++&sdhci {
++	status = "okay";
++};
++
++&sdhost {
++	status = "disabled";
++};
++
+-- 
+2.17.0
+

buildroot-external/board/rpi2/patches/barebox/0002-ARM-dts-add-more-functions.patch

@@ -0,0 +1,167 @@
+From 114c8fd0327f1c0f1bf886953c600e2a72a55df7 Mon Sep 17 00:00:00 2001
+From: Pascal Vizeli <pvizeli@syshack.ch>
+Date: Mon, 4 Jun 2018 09:17:25 +0000
+Subject: [PATCH 2/2] ARM: dts: add more functions
+
+Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
+---
+ arch/arm/dts/bcm2835-rpi.dts   |  4 ---
+ arch/arm/dts/bcm2836-rpi-2.dts |  4 ---
+ dts/src/arm/bcm2835-rpi.dtsi   | 46 ++++++++++++++++++++++++++++++++--
+ dts/src/arm/bcm283x.dtsi       | 12 +++------
+ 4 files changed, 48 insertions(+), 18 deletions(-)
+
+diff --git a/arch/arm/dts/bcm2835-rpi.dts b/arch/arm/dts/bcm2835-rpi.dts
+index c23e7c7c1..22d60e961 100644
+--- a/arch/arm/dts/bcm2835-rpi.dts
++++ b/arch/arm/dts/bcm2835-rpi.dts
+@@ -1,10 +1,6 @@
+ #include <arm/bcm2835-rpi-a.dts>
+ 
+ / {
+-	chosen {
+-		stdout-path = &uart0;
+-	};
+-
+ 	memory {
+ 		reg = <0x0 0x0>;
+ 	};
+diff --git a/arch/arm/dts/bcm2836-rpi-2.dts b/arch/arm/dts/bcm2836-rpi-2.dts
+index 2fa1c8bb4..bdee1296e 100644
+--- a/arch/arm/dts/bcm2836-rpi-2.dts
++++ b/arch/arm/dts/bcm2836-rpi-2.dts
+@@ -1,10 +1,6 @@
+ #include <arm/bcm2836-rpi-2-b.dts>
+ 
+ / {
+-	chosen {
+-		stdout-path = &uart0;
+-	};
+-
+ 	memory {
+ 		reg = <0x0 0x0>;
+ 	};
+diff --git a/dts/src/arm/bcm2835-rpi.dtsi b/dts/src/arm/bcm2835-rpi.dtsi
+index e36c392a2..d3dfb4b3e 100644
+--- a/dts/src/arm/bcm2835-rpi.dtsi
++++ b/dts/src/arm/bcm2835-rpi.dtsi
+@@ -27,6 +27,39 @@
+ 			firmware = <&firmware>;
+ 			#power-domain-cells = <1>;
+ 		};
++
++		fb: fb {
++			compatible = "brcm,bcm2708-fb";
++			firmware = <&firmware>;
++			status = "okay";
++		};
++
++		vchiq: vchiq {
++			compatible = "brcm,bcm2835-vchiq";
++			reg = <0x7e00b840 0xf>;
++			interrupts = <0 2>;
++			cache-line-size = <32>;
++			firmware = <&firmware>;
++		};
++
++		vcsm: vcsm {
++			compatible = "raspberrypi,bcm2835-vcsm";
++			firmware = <&firmware>;
++			status = "okay";
++		};
++
++		/* Onboard audio */
++		audio: audio {
++			compatible = "brcm,bcm2835-audio";
++			brcm,pwm-channels = <8>;
++			status = "okay";
++		};
++
++		/* External sound card */
++		sound: sound {
++			status = "disabled";
++		};
++
+ 	};
+ };
+ 
+@@ -91,12 +124,12 @@
+ 
+ &hdmi {
+ 	power-domains = <&power RPI_POWER_DOMAIN_HDMI>;
+-	status = "okay";
++	status = "disabled";
+ };
+ 
+ &vec {
+ 	power-domains = <&power RPI_POWER_DOMAIN_VEC>;
+-	status = "okay";
++	status = "disabled";
+ };
+ 
+ &dsi0 {
+@@ -106,3 +139,12 @@
+ &dsi1 {
+ 	power-domains = <&power RPI_POWER_DOMAIN_DSI1>;
+ };
++
++&v3d {
++	status = "disabled";
++};
++
++&vc4 {
++	status = "disabled";
++};
++
+diff --git a/dts/src/arm/bcm283x.dtsi b/dts/src/arm/bcm283x.dtsi
+index 9d293decf..0abb72a47 100644
+--- a/dts/src/arm/bcm283x.dtsi
++++ b/dts/src/arm/bcm283x.dtsi
+@@ -26,10 +26,6 @@
+ 		serial1 = &uart1;
+ 	};
+ 
+-	chosen {
+-		stdout-path = "serial0:115200n8";
+-	};
+-
+ 	thermal-zones {
+ 		cpu_thermal: cpu-thermal {
+ 			polling-delay-passive = <0>;
+@@ -426,13 +422,13 @@
+ 			status = "disabled";
+ 		};
+ 
+-		pixelvalve@7e206000 {
++		pixelvalve0: pixelvalve@7e206000 {
+ 			compatible = "brcm,bcm2835-pixelvalve0";
+ 			reg = <0x7e206000 0x100>;
+ 			interrupts = <2 13>; /* pwa0 */
+ 		};
+ 
+-		pixelvalve@7e207000 {
++		pixelvalve1: pixelvalve@7e207000 {
+ 			compatible = "brcm,bcm2835-pixelvalve1";
+ 			reg = <0x7e207000 0x100>;
+ 			interrupts = <2 14>; /* pwa1 */
+@@ -518,7 +514,7 @@
+ 			status = "disabled";
+ 		};
+ 
+-		hvs@7e400000 {
++		hvs: hvs@7e400000 {
+ 			compatible = "brcm,bcm2835-hvs";
+ 			reg = <0x7e400000 0x6000>;
+ 			interrupts = <2 1>;
+@@ -572,7 +568,7 @@
+ 			status = "disabled";
+ 		};
+ 
+-		pixelvalve@7e807000 {
++		pixelvalve2: pixelvalve@7e807000 {
+ 			compatible = "brcm,bcm2835-pixelvalve2";
+ 			reg = <0x7e807000 0x100>;
+ 			interrupts = <2 10>; /* pixelvalve */
+-- 
+2.17.0
+

buildroot-external/board/rpi2/patches/barebox/0003-Add-HassOS-bootchoiser-state.patch

@@ -0,0 +1,167 @@
+From 3fe92c12e01e35cc97fbd92d8ae098ac583cfa1f Mon Sep 17 00:00:00 2001
+From: Pascal Vizeli <pvizeli@syshack.ch>
+Date: Mon, 4 Jun 2018 09:25:40 +0000
+Subject: [PATCH 3/3] Add HassOS bootchoiser state
+
+Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
+---
+ arch/arm/dts/bcm2835-rpi.dts   | 69 ++++++++++++++++++++++++++++++++++
+ arch/arm/dts/bcm2836-rpi-2.dts | 68 +++++++++++++++++++++++++++++++++
+ 2 files changed, 137 insertions(+)
+
+diff --git a/arch/arm/dts/bcm2835-rpi.dts b/arch/arm/dts/bcm2835-rpi.dts
+index 22d60e961..3357d06b7 100644
+--- a/arch/arm/dts/bcm2835-rpi.dts
++++ b/arch/arm/dts/bcm2835-rpi.dts
+@@ -13,3 +13,72 @@
+ &sdhost {
+ 	status = "disabled";
+ };
++
++/ {
++
++	aliases {
++		state = &state;
++	};
++
++	state: state {
++		#address-cells = <1>;
++		#size-cells = <1>;
++                magic = <0xef98423f>;
++                compatible = "barebox,state";
++                backend = <&backend_state>;
++                backend-type = "raw";
++                backend-stridesize = <4048>;
++
++		bootstate {
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			system0 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				remaining_attempts@0 {
++					reg = <0x0 0x4>;
++					type = "uint32";
++					default = <3>;
++				};
++				priority@4 {
++					reg = <0x4 0x4>;
++					type = "uint32";
++					default = <20>;
++				};
++			};
++			system1 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				remaining_attempts@8 {
++					reg = <0x8 0x4>;
++					type = "uint32";
++					default = <0>;
++				};
++				priority@c {
++					reg = <0xc 0x4>;
++					type = "uint32";
++					default = <10>;
++				};
++			};
++			last_chosen@10 {
++				reg = <0x10 0x4>;
++				type = "uint32";
++			};
++		};
++	};
++};
++
++&sdhci {
++	partitions {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		compatible = "fixed-partitions";
++
++		backend_state: partition@22100000 {
++			label = "state";
++			reg = <0x22100000 0x800000>;
++		};
++	};
++};
++
+diff --git a/arch/arm/dts/bcm2836-rpi-2.dts b/arch/arm/dts/bcm2836-rpi-2.dts
+index bdee1296e..e41def570 100644
+--- a/arch/arm/dts/bcm2836-rpi-2.dts
++++ b/arch/arm/dts/bcm2836-rpi-2.dts
+@@ -14,3 +14,71 @@
+ 	status = "disabled";
+ };
+ 
++/ {
++
++	aliases {
++		state = &state;
++	};
++
++	state: state {
++		#address-cells = <1>;
++		#size-cells = <1>;
++                magic = <0xef98423f>;
++                compatible = "barebox,state";
++                backend = <&backend_state>;
++                backend-type = "raw";
++                backend-stridesize = <4048>;
++
++		bootstate {
++			#address-cells = <1>;
++			#size-cells = <1>;
++
++			system0 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				remaining_attempts@0 {
++					reg = <0x0 0x4>;
++					type = "uint32";
++					default = <3>;
++				};
++				priority@4 {
++					reg = <0x4 0x4>;
++					type = "uint32";
++					default = <20>;
++				};
++			};
++			system1 {
++				#address-cells = <1>;
++				#size-cells = <1>;
++				remaining_attempts@8 {
++					reg = <0x8 0x4>;
++					type = "uint32";
++					default = <0>;
++				};
++				priority@c {
++					reg = <0xc 0x4>;
++					type = "uint32";
++					default = <10>;
++				};
++			};
++			last_chosen@10 {
++				reg = <0x10 0x4>;
++				type = "uint32";
++			};
++		};
++	};
++};
++
++&sdhci {
++	partitions {
++		#address-cells = <1>;
++		#size-cells = <1>;
++		compatible = "fixed-partitions";
++
++		backend_state: partition@22100000 {
++			label = "state";
++			reg = <0x22100000 0x800000>;
++		};
++	};
++};
++
+-- 
+2.17.0
+

buildroot-external/board/rpi2/patches/barebox/0004-common-state-allow-to-overlay-state-backend.patch

@@ -0,0 +1,42 @@
+From 19ab0b433893cc7d16e8f4a6052f0f784131c43a Mon Sep 17 00:00:00 2001
+From: Pascal Vizeli <pvizeli@syshack.ch>
+Date: Sat, 2 Jun 2018 22:08:31 +0000
+Subject: [PATCH 1/1] common: state: allow to overlay state backend
+
+This allow to use overlay for state backends. I.e. on raspberry you need
+use barebox with SDHCI (slow) and after linux boot it will use SDHOST driver.
+But the problem now is, that the state is on SDHCI and dt-utils need it on
+SDHOST. Actual it is not possible to overwrite this.
+
+Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
+---
+ common/state/state.c | 13 +++++++++++--
+ 1 file changed, 11 insertions(+), 2 deletions(-)
+
+diff --git a/common/state/state.c b/common/state/state.c
+index 25d950211..e6259043f 100644
+--- a/common/state/state.c
++++ b/common/state/state.c
+@@ -494,8 +494,17 @@ static int of_state_fixup(struct device_node *root, void *ctx)
+ 	}
+ 
+ 	/* backend phandle */
+-	backend_node = of_find_node_by_reproducible_name(root,
+-						state->backend_reproducible_name);
++	if (node) {
++		ret = of_property_read_u32(node, "backend", &phandle);
++		if (ret)
++			goto out;
++
++		backend_node = of_find_node_by_phandle_from(phandle, root);
++	} else {
++		backend_node = of_find_node_by_reproducible_name(root,
++					state->backend_reproducible_name);
++	}
++
+ 	if (!backend_node) {
+ 		ret = -ENODEV;
+ 		goto out;
+-- 
+2.17.0
+

buildroot-external/board/rpi2/post-image.sh

@@ -0,0 +1,45 @@
+#!/bin/bash
+set -e
+
+SCRIPT_DIR=${BR2_EXTERNAL_HASSOS_PATH}/scripts
+BOARD_DIR=${2}
+BOOT_DATA=${BINARIES_DIR}/boot
+
+. ${SCRIPT_DIR}/hdd-image.sh
+. ${BR2_EXTERNAL_HASSOS_PATH}/info
+. ${BOARD_DIR}/info
+
+# Filename
+IMAGE_FILE=${BINARIES_DIR}/${HASSOS_ID}_${BOARD_ID}-${VERSION_MAJOR}.${VERSION_BUILD}.img
+
+# Init boot data
+rm -rf ${BOOT_DATA}
+mkdir -p ${BOOT_DATA}
+
+cp ${BINARIES_DIR}/barebox.bin ${BOOT_DATA}/
+cp -t ${BOOT_DATA} \
+    ${BINARIES_DIR}/bcm2709-rpi-2-b.dtb \
+    ${BINARIES_DIR}/rpi-firmware/bootcode.bin \
+    ${BINARIES_DIR}/rpi-firmware/fixup.dat \
+    ${BINARIES_DIR}/rpi-firmware/start.elf
+cp -r ${BINARIES_DIR}/rpi-firmware/overlays ${BOOT_DATA}/
+
+# Update Boot options
+(
+    echo "kernel=barebox.bin"
+    echo "disable_splash=1"
+    echo "dtparam=audio=on"
+    echo "enable_uart=1"
+) > ${BOOT_DATA}/config.txt
+
+echo "dwc_otg.lpm_enable=0 console=tty1 console=ttyAMA0,115200" > ${BOOT_DATA}/cmdline.txt
+
+# Create other layers
+create_boot_image ${BINARIES_DIR}
+create_overlay_image ${BINARIES_DIR}
+
+create_disk_image ${BINARIES_DIR} ${IMAGE_FILE} 2
+fix_disk_image_mbr ${IMAGE_FILE}
+
+rm -rf ${IMAGE_FILE}.gz
+gzip --best ${IMAGE_FILE}

buildroot-external/board/rpi3/barebox.config

@@ -0,0 +1,54 @@
+CONFIG_ARCH_BCM283X=y
+CONFIG_MACH_RPI3=y
+CONFIG_AEABI=y
+CONFIG_ARM_OPTIMZED_STRING_FUNCTIONS=y
+CONFIG_ARM_UNWIND=y
+# CONFIG_LOCALVERSION_AUTO is not set
+CONFIG_MMU=y
+CONFIG_MALLOC_SIZE=0x0
+CONFIG_MALLOC_TLSF=y
+CONFIG_KALLSYMS=y
+CONFIG_PROMPT="HassOS-boot:"
+CONFIG_CMDLINE_EDITING=y
+CONFIG_AUTO_COMPLETE=y
+CONFIG_MENU=y
+# CONFIG_TIMESTAMP is not set
+CONFIG_BOOTM_SHOW_TYPE=y
+CONFIG_BOOTM_OFTREE=y
+CONFIG_FLEXIBLE_BOOTARGS=y
+# CONFIG_PARTITION_DISK_DOS is not set
+CONFIG_PARTITION_DISK_EFI=y
+# CONFIG_PARTITION_DISK_EFI_GPT_NO_FORCE is not set
+# CONFIG_PARTITION_DISK_EFI_GPT_COMPARE is not set
+CONFIG_DEFAULT_ENVIRONMENT_PATH="/build/buildroot-external/barebox-env"
+CONFIG_STATE=y
+CONFIG_BOOTCHOOSER=y
+# CONFIG_CMD_VERSION is not set
+CONFIG_CMD_BOOT=y
+CONFIG_CMD_AUTOMOUNT=y
+CONFIG_CMD_NV=y
+CONFIG_CMD_EXPORT=y
+CONFIG_CMD_GLOBAL=y
+CONFIG_CMD_BASENAME=y
+CONFIG_CMD_DIRNAME=y
+CONFIG_CMD_READLINK=y
+CONFIG_CMD_GETOPT=y
+CONFIG_CMD_MENUTREE=y
+CONFIG_CMD_TIMEOUT=y
+CONFIG_CMD_DETECT=y
+CONFIG_CMD_STATE=y
+CONFIG_CMD_BOOTCHOOSER=y
+CONFIG_SERIAL_AMBA_PL011=y
+# CONFIG_SPI is not set
+CONFIG_MCI=y
+CONFIG_MCI_BCM283X=y
+CONFIG_WATCHDOG=y
+CONFIG_WATCHDOG_BCM2835=y
+CONFIG_GPIO_BCM283X=y
+# CONFIG_PINCTRL is not set
+CONFIG_REGULATOR=y
+CONFIG_FS_FAT=y
+CONFIG_FS_FAT_WRITE=y
+CONFIG_FS_FAT_LFN=y
+CONFIG_FS_SQUASHFS=y
+CONFIG_LZ4_DECOMPRESS=y

buildroot-external/board/rpi3/info

@@ -0,0 +1,3 @@
+BOARD_ID=rpi3
+BOARD_NAME="RaspberryPi 3"
+CHASSIS=embedded

buildroot-external/board/rpi3/patches/barebox/0001-HYP-mode-handling-and-RasPi-3-support.patch

@@ -0,0 +1,295 @@
+Those are needed to generate some of the ARM SEC and VIRT
+opcodes in a portable way.
+
+Signed-off-by: Lucas Stach <l.stach at pengutronix.de>
+---
+ arch/arm/include/asm/opcodes-virt.h |  39 ++++++
+ arch/arm/include/asm/opcodes.h      | 231 ++++++++++++++++++++++++++++++++++++
+ 2 files changed, 270 insertions(+)
+ create mode 100644 arch/arm/include/asm/opcodes-virt.h
+ create mode 100644 arch/arm/include/asm/opcodes.h
+
+diff --git a/arch/arm/include/asm/opcodes-virt.h b/arch/arm/include/asm/opcodes-virt.h
+new file mode 100644
+index 000000000000..efcfdf92d9d5
+--- /dev/null
++++ b/arch/arm/include/asm/opcodes-virt.h
+@@ -0,0 +1,39 @@
++/*
++ * opcodes-virt.h: Opcode definitions for the ARM virtualization extensions
++ * Copyright (C) 2012  Linaro Limited
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License as published by
++ * the Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
++ * GNU General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public License along
++ * with this program; if not, write to the Free Software Foundation, Inc.,
++ * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
++ */
++#ifndef __ASM_ARM_OPCODES_VIRT_H
++#define __ASM_ARM_OPCODES_VIRT_H
++
++#include <asm/opcodes.h>
++
++#define __HVC(imm16) __inst_arm_thumb32(				\
++	0xE1400070 | (((imm16) & 0xFFF0) << 4) | ((imm16) & 0x000F),	\
++	0xF7E08000 | (((imm16) & 0xF000) << 4) | ((imm16) & 0x0FFF)	\
++)
++
++#define __ERET	__inst_arm_thumb32(					\
++	0xE160006E,							\
++	0xF3DE8F00							\
++)
++
++#define __MSR_ELR_HYP(regnum)	__inst_arm_thumb32(			\
++	0xE12EF300 | regnum,						\
++	0xF3808E30 | (regnum << 16)					\
++)
++
++#endif /* ! __ASM_ARM_OPCODES_VIRT_H */
+diff --git a/arch/arm/include/asm/opcodes.h b/arch/arm/include/asm/opcodes.h
+new file mode 100644
+index 000000000000..a78bf5d2c518
+--- /dev/null
++++ b/arch/arm/include/asm/opcodes.h
+@@ -0,0 +1,231 @@
++/*
++ *  arch/arm/include/asm/opcodes.h
++ *
++ * This program is free software; you can redistribute it and/or modify
++ * it under the terms of the GNU General Public License version 2 as
++ * published by the Free Software Foundation.
++ */
++
++#ifndef __ASM_ARM_OPCODES_H
++#define __ASM_ARM_OPCODES_H
++
++#ifndef __ASSEMBLY__
++#include <linux/linkage.h>
++extern asmlinkage unsigned int arm_check_condition(u32 opcode, u32 psr);
++#endif
++
++#define ARM_OPCODE_CONDTEST_FAIL   0
++#define ARM_OPCODE_CONDTEST_PASS   1
++#define ARM_OPCODE_CONDTEST_UNCOND 2
++
++
++/*
++ * Assembler opcode byteswap helpers.
++ * These are only intended for use by this header: don't use them directly,
++ * because they will be suboptimal in most cases.
++ */
++#define ___asm_opcode_swab32(x) (	\
++	  (((x) << 24) & 0xFF000000)	\
++	| (((x) <<  8) & 0x00FF0000)	\
++	| (((x) >>  8) & 0x0000FF00)	\
++	| (((x) >> 24) & 0x000000FF)	\
++)
++#define ___asm_opcode_swab16(x) (	\
++	  (((x) << 8) & 0xFF00)		\
++	| (((x) >> 8) & 0x00FF)		\
++)
++#define ___asm_opcode_swahb32(x) (	\
++	  (((x) << 8) & 0xFF00FF00)	\
++	| (((x) >> 8) & 0x00FF00FF)	\
++)
++#define ___asm_opcode_swahw32(x) (	\
++	  (((x) << 16) & 0xFFFF0000)	\
++	| (((x) >> 16) & 0x0000FFFF)	\
++)
++#define ___asm_opcode_identity32(x) ((x) & 0xFFFFFFFF)
++#define ___asm_opcode_identity16(x) ((x) & 0xFFFF)
++
++
++/*
++ * Opcode byteswap helpers
++ *
++ * These macros help with converting instructions between a canonical integer
++ * format and in-memory representation, in an endianness-agnostic manner.
++ *
++ * __mem_to_opcode_*() convert from in-memory representation to canonical form.
++ * __opcode_to_mem_*() convert from canonical form to in-memory representation.
++ *
++ *
++ * Canonical instruction representation:
++ *
++ *	ARM:		0xKKLLMMNN
++ *	Thumb 16-bit:	0x0000KKLL, where KK < 0xE8
++ *	Thumb 32-bit:	0xKKLLMMNN, where KK >= 0xE8
++ *
++ * There is no way to distinguish an ARM instruction in canonical representation
++ * from a Thumb instruction (just as these cannot be distinguished in memory).
++ * Where this distinction is important, it needs to be tracked separately.
++ *
++ * Note that values in the range 0x0000E800..0xE7FFFFFF intentionally do not
++ * represent any valid Thumb-2 instruction.  For this range,
++ * __opcode_is_thumb32() and __opcode_is_thumb16() will both be false.
++ *
++ * The ___asm variants are intended only for use by this header, in situations
++ * involving inline assembler.  For .S files, the normal __opcode_*() macros
++ * should do the right thing.
++ */
++#ifdef __ASSEMBLY__
++
++#define ___opcode_swab32(x) ___asm_opcode_swab32(x)
++#define ___opcode_swab16(x) ___asm_opcode_swab16(x)
++#define ___opcode_swahb32(x) ___asm_opcode_swahb32(x)
++#define ___opcode_swahw32(x) ___asm_opcode_swahw32(x)
++#define ___opcode_identity32(x) ___asm_opcode_identity32(x)
++#define ___opcode_identity16(x) ___asm_opcode_identity16(x)
++
++#else /* ! __ASSEMBLY__ */
++
++#include <linux/types.h>
++#include <linux/swab.h>
++
++#define ___opcode_swab32(x) swab32(x)
++#define ___opcode_swab16(x) swab16(x)
++#define ___opcode_swahb32(x) swahb32(x)
++#define ___opcode_swahw32(x) swahw32(x)
++#define ___opcode_identity32(x) ((u32)(x))
++#define ___opcode_identity16(x) ((u16)(x))
++
++#endif /* ! __ASSEMBLY__ */
++
++
++#ifdef CONFIG_CPU_ENDIAN_BE8
++
++#define __opcode_to_mem_arm(x) ___opcode_swab32(x)
++#define __opcode_to_mem_thumb16(x) ___opcode_swab16(x)
++#define __opcode_to_mem_thumb32(x) ___opcode_swahb32(x)
++#define ___asm_opcode_to_mem_arm(x) ___asm_opcode_swab32(x)
++#define ___asm_opcode_to_mem_thumb16(x) ___asm_opcode_swab16(x)
++#define ___asm_opcode_to_mem_thumb32(x) ___asm_opcode_swahb32(x)
++
++#else /* ! CONFIG_CPU_ENDIAN_BE8 */
++
++#define __opcode_to_mem_arm(x) ___opcode_identity32(x)
++#define __opcode_to_mem_thumb16(x) ___opcode_identity16(x)
++#define ___asm_opcode_to_mem_arm(x) ___asm_opcode_identity32(x)
++#define ___asm_opcode_to_mem_thumb16(x) ___asm_opcode_identity16(x)
++#ifndef CONFIG_CPU_ENDIAN_BE32
++/*
++ * On BE32 systems, using 32-bit accesses to store Thumb instructions will not
++ * work in all cases, due to alignment constraints.  For now, a correct
++ * version is not provided for BE32.
++ */
++#define __opcode_to_mem_thumb32(x) ___opcode_swahw32(x)
++#define ___asm_opcode_to_mem_thumb32(x) ___asm_opcode_swahw32(x)
++#endif
++
++#endif /* ! CONFIG_CPU_ENDIAN_BE8 */
++
++#define __mem_to_opcode_arm(x) __opcode_to_mem_arm(x)
++#define __mem_to_opcode_thumb16(x) __opcode_to_mem_thumb16(x)
++#ifndef CONFIG_CPU_ENDIAN_BE32
++#define __mem_to_opcode_thumb32(x) __opcode_to_mem_thumb32(x)
++#endif
++
++/* Operations specific to Thumb opcodes */
++
++/* Instruction size checks: */
++#define __opcode_is_thumb32(x) (		\
++	   ((x) & 0xF8000000) == 0xE8000000	\
++	|| ((x) & 0xF0000000) == 0xF0000000	\
++)
++#define __opcode_is_thumb16(x) (					\
++	   ((x) & 0xFFFF0000) == 0					\
++	&& !(((x) & 0xF800) == 0xE800 || ((x) & 0xF000) == 0xF000)	\
++)
++
++/* Operations to construct or split 32-bit Thumb instructions: */
++#define __opcode_thumb32_first(x) (___opcode_identity16((x) >> 16))
++#define __opcode_thumb32_second(x) (___opcode_identity16(x))
++#define __opcode_thumb32_compose(first, second) (			\
++	  (___opcode_identity32(___opcode_identity16(first)) << 16)	\
++	| ___opcode_identity32(___opcode_identity16(second))		\
++)
++#define ___asm_opcode_thumb32_first(x) (___asm_opcode_identity16((x) >> 16))
++#define ___asm_opcode_thumb32_second(x) (___asm_opcode_identity16(x))
++#define ___asm_opcode_thumb32_compose(first, second) (			    \
++	  (___asm_opcode_identity32(___asm_opcode_identity16(first)) << 16) \
++	| ___asm_opcode_identity32(___asm_opcode_identity16(second))	    \
++)
++
++/*
++ * Opcode injection helpers
++ *
++ * In rare cases it is necessary to assemble an opcode which the
++ * assembler does not support directly, or which would normally be
++ * rejected because of the CFLAGS or AFLAGS used to build the affected
++ * file.
++ *
++ * Before using these macros, consider carefully whether it is feasible
++ * instead to change the build flags for your file, or whether it really
++ * makes sense to support old assembler versions when building that
++ * particular kernel feature.
++ *
++ * The macros defined here should only be used where there is no viable
++ * alternative.
++ *
++ *
++ * __inst_arm(x): emit the specified ARM opcode
++ * __inst_thumb16(x): emit the specified 16-bit Thumb opcode
++ * __inst_thumb32(x): emit the specified 32-bit Thumb opcode
++ *
++ * __inst_arm_thumb16(arm, thumb): emit either the specified arm or
++ *	16-bit Thumb opcode, depending on whether an ARM or Thumb-2
++ *	kernel is being built
++ *
++ * __inst_arm_thumb32(arm, thumb): emit either the specified arm or
++ *	32-bit Thumb opcode, depending on whether an ARM or Thumb-2
++ *	kernel is being built
++ *
++ *
++ * Note that using these macros directly is poor practice.  Instead, you
++ * should use them to define human-readable wrapper macros to encode the
++ * instructions that you care about.  In code which might run on ARMv7 or
++ * above, you can usually use the __inst_arm_thumb{16,32} macros to
++ * specify the ARM and Thumb alternatives at the same time.  This ensures
++ * that the correct opcode gets emitted depending on the instruction set
++ * used for the kernel build.
++ *
++ * Look at opcodes-virt.h for an example of how to use these macros.
++ */
++#include <linux/stringify.h>
++
++#define __inst_arm(x) ___inst_arm(___asm_opcode_to_mem_arm(x))
++#define __inst_thumb32(x) ___inst_thumb32(				\
++	___asm_opcode_to_mem_thumb16(___asm_opcode_thumb32_first(x)),	\
++	___asm_opcode_to_mem_thumb16(___asm_opcode_thumb32_second(x))	\
++)
++#define __inst_thumb16(x) ___inst_thumb16(___asm_opcode_to_mem_thumb16(x))
++
++#ifdef CONFIG_THUMB2_BAREBOX
++#define __inst_arm_thumb16(arm_opcode, thumb_opcode) \
++	__inst_thumb16(thumb_opcode)
++#define __inst_arm_thumb32(arm_opcode, thumb_opcode) \
++	__inst_thumb32(thumb_opcode)
++#else
++#define __inst_arm_thumb16(arm_opcode, thumb_opcode) __inst_arm(arm_opcode)
++#define __inst_arm_thumb32(arm_opcode, thumb_opcode) __inst_arm(arm_opcode)
++#endif
++
++/* Helpers for the helpers.  Don't use these directly. */
++#ifdef __ASSEMBLY__
++#define ___inst_arm(x) .long x
++#define ___inst_thumb16(x) .short x
++#define ___inst_thumb32(first, second) .short first, second
++#else
++#define ___inst_arm(x) ".long " __stringify(x) "\n\t"
++#define ___inst_thumb16(x) ".short " __stringify(x) "\n\t"
++#define ___inst_thumb32(first, second) \
++	".short " __stringify(first) ", " __stringify(second) "\n\t"
++#endif
++
++#endif /* __ASM_ARM_OPCODES_H */
+-- 
+2.16.1

buildroot-external/board/rpi3/patches/barebox/0002-safely-switch-from-HYP-to-SVC-mode-if-required.patch

@@ -0,0 +1,85 @@
+This is a port of the Linux safe_svcmode_maskall macro to
+the Barebox lowlevel init.
+
+Signed-off-by: Lucas Stach <l.stach at pengutronix.de>
+---
+ arch/arm/cpu/lowlevel.S       | 20 ++++++++++++++++----
+ arch/arm/include/asm/system.h | 26 ++++++++++++++++++++++++++
+ 2 files changed, 42 insertions(+), 4 deletions(-)
+
+diff --git a/arch/arm/cpu/lowlevel.S b/arch/arm/cpu/lowlevel.S
+index 7696a198e764..194ce0e7c274 100644
+--- a/arch/arm/cpu/lowlevel.S
++++ b/arch/arm/cpu/lowlevel.S
+@@ -1,16 +1,28 @@
+ #include <linux/linkage.h>
+ #include <init.h>
+ #include <asm/system.h>
++#include <asm/opcodes-virt.h>
+ 
+ .section ".text_bare_init_","ax"
+ ENTRY(arm_cpu_lowlevel_init)
+ 	/* save lr, since it may be banked away with a processor mode change */
+ 	mov	r2, lr
++
+ 	/* set the cpu to SVC32 mode, mask irq and fiq */
+-	mrs	r12, cpsr
+-	bic	r12, r12, #0x1f
+-	orr	r12, r12, #0xd3
+-	msr	cpsr, r12
++	mrs	r12 , cpsr
++	eor	r12, r12, #HYP_MODE
++	tst	r12, #MODE_MASK
++	bic	r12 , r12 , #MODE_MASK
++	orr	r12 , r12 , #(PSR_I_BIT | PSR_F_BIT | SVC_MODE)
++THUMB(	orr	r12 , r12 , #PSR_T_BIT	)
++	bne	1f
++	orr	r12, r12, #PSR_A_BIT
++	adr	lr, 2f
++	msr	spsr_cxsf, r12
++	__MSR_ELR_HYP(14)
++	__ERET
++1:	msr	cpsr_c, r12
++2:
+ 
+ #if __LINUX_ARM_ARCH__ >= 6
+ 	/*
+diff --git a/arch/arm/include/asm/system.h b/arch/arm/include/asm/system.h
+index 57c76186b499..55e0f4090295 100644
+--- a/arch/arm/include/asm/system.h
++++ b/arch/arm/include/asm/system.h
+@@ -60,6 +60,32 @@
+ #define CR_AFE  (1 << 29)	/* Access flag enable			*/
+ #define CR_TE   (1 << 30)	/* Thumb exception enable		*/
+ 
++/*
++ * PSR bits
++ */
++#define USR_MODE	0x00000010
++#define FIQ_MODE	0x00000011
++#define IRQ_MODE	0x00000012
++#define SVC_MODE	0x00000013
++#define ABT_MODE	0x00000017
++#define HYP_MODE	0x0000001a
++#define UND_MODE	0x0000001b
++#define SYSTEM_MODE	0x0000001f
++#define MODE32_BIT	0x00000010
++#define MODE_MASK	0x0000001f
++
++#define PSR_T_BIT	0x00000020
++#define PSR_F_BIT	0x00000040
++#define PSR_I_BIT	0x00000080
++#define PSR_A_BIT	0x00000100
++#define PSR_E_BIT	0x00000200
++#define PSR_J_BIT	0x01000000
++#define PSR_Q_BIT	0x08000000
++#define PSR_V_BIT	0x10000000
++#define PSR_C_BIT	0x20000000
++#define PSR_Z_BIT	0x40000000
++#define PSR_N_BIT	0x80000000
++
+ #ifndef __ASSEMBLY__
+ #if __LINUX_ARM_ARCH__ >= 7
+ static inline unsigned int current_el(void)
+-- 
+2.15.1

buildroot-external/board/rpi3/patches/barebox/0003-allow-secure-monitor-code-to-be-built-without-PSCI.patch

@@ -0,0 +1,33 @@
+The hyp mode handling added in the secure monitor code is also useful
+when Barebox doesn't have PSCI control. Allow to build without PSCI.
+
+Signed-off-by: Lucas Stach <l.stach at pengutronix.de>
+---
+ arch/arm/cpu/sm_as.S | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/arch/arm/cpu/sm_as.S b/arch/arm/cpu/sm_as.S
+index 09580e75de5f..0d01e1bf2435 100644
+--- a/arch/arm/cpu/sm_as.S
++++ b/arch/arm/cpu/sm_as.S
+@@ -129,7 +129,9 @@ secure_monitor:
+ 	sub	sp, sp, #4*4			@ allocate result structure on stack
+ 	mov	r12, sp
+ 	push	{r4-r6, r12}
++#ifdef CONFIG_ARM_PSCI
+ 	bl	psci_entry
++#endif
+ 	pop	{r4-r6, r12}
+ 	ldm	r12, {r0-r3}
+ 	add	sp, sp, #4*4
+@@ -163,6 +165,8 @@ ENTRY(psci_cpu_entry)
+ 	mcr	p15, 0, r0, c1, c0, 1	@ ACTLR
+ 
+ 	bl	secure_monitor_stack_setup
++#ifdef CONFIG_ARM_PSCI
+ 	bl	psci_cpu_entry_c
++#endif
+ 
+ ENDPROC(psci_cpu_entry)
+-- 
+2.15.1

buildroot-external/board/rpi3/patches/barebox/0004-add-file-for-HYP-mode-related-setup.patch

@@ -0,0 +1,192 @@
+From 6add848d66a7bdebed73416a3cf27b8bf10a2cd8 Mon Sep 17 00:00:00 2001
+From: Pascal Vizeli <pvizeli@syshack.ch>
+Date: Sat, 19 May 2018 17:58:01 +0200
+Subject: [PATCH 1/1] p2
+
+---
+ arch/arm/cpu/Makefile         |   7 +++
+ arch/arm/cpu/hyp.S            | 115 ++++++++++++++++++++++++++++++++++++++++++
+ arch/arm/cpu/sm_as.S          |  11 ----
+ arch/arm/include/asm/secure.h |   2 +
+ 4 files changed, 124 insertions(+), 11 deletions(-)
+ create mode 100644 arch/arm/cpu/hyp.S
+
+diff --git a/arch/arm/cpu/Makefile b/arch/arm/cpu/Makefile
+index 0316d25..6d67b42 100644
+--- a/arch/arm/cpu/Makefile
++++ b/arch/arm/cpu/Makefile
+@@ -9,6 +9,13 @@ obj-y += start.o entry.o
+ 
+ obj-pbl-y += setupc$(S64).o cache$(S64).o
+ 
++ifeq ($(CONFIG_CPU_64v8),)
++obj-y += hyp.o
++AFLAGS_hyp.o :=-Wa,-march=armv7-a
++pbl-y += hyp.o
++AFLAGS_pbl-hyp.o :=-Wa,-march=armv7-a
++endif
++
+ #
+ # Any variants can be called as start-armxyz.S
+ #
+diff --git a/arch/arm/cpu/hyp.S b/arch/arm/cpu/hyp.S
+new file mode 100644
+index 0000000..435d416
+--- /dev/null
++++ b/arch/arm/cpu/hyp.S
+@@ -0,0 +1,115 @@
++#include <linux/linkage.h>
++#include <asm/system.h>
++#include <asm/opcodes-virt.h>
++
++.arch_extension sec
++.arch_extension virt
++
++.section ".text_bare_init_","ax"
++
++.data
++	.align  2
++ENTRY(__boot_cpu_mode)
++	.long   0
++.text
++
++ENTRY(__hyp_install)
++	mrs	r12, cpsr
++	and	r12, r12, #MODE_MASK
++
++	@ Save the initial CPU state
++	adr	r0, .L__boot_cpu_mode_offset
++	ldr	r1, [r0]
++	str	r12, [r0, r1]
++
++	cmp	r12, #HYP_MODE
++	movne	pc, lr			@ give up if the CPU is not in HYP mode
++
++	@ Now install the hypervisor stub:
++	adr	r12, __hyp_vectors
++	mcr	p15, 4, r12, c12, c0, 0	@ set hypervisor vector base (HVBAR)
++
++	@ Disable all traps, so we don't get any nasty surprise
++	mov	r12, #0
++	mcr	p15, 4, r12, c1, c1, 0	@ HCR
++	mcr	p15, 4, r12, c1, c1, 2	@ HCPTR
++	mcr	p15, 4, r12, c1, c1, 3	@ HSTR
++
++THUMB(	orr	r12, #(1 << 30)	)	@ HSCTLR.TE
++	mcr	p15, 4, r12, c1, c0, 0	@ HSCTLR
++
++	mrc	p15, 4, r12, c1, c1, 1	@ HDCR
++	and	r12, #0x1f		@ Preserve HPMN
++	mcr	p15, 4, r12, c1, c1, 1	@ HDCR
++
++	@ Make sure NS-SVC is initialised appropriately
++	mrc	p15, 0, r12, c1, c0, 0	@ SCTLR
++	orr	r12, #(1 << 5)		@ CP15 barriers enabled
++	bic	r12, #(3 << 7)		@ Clear SED/ITD for v8 (RES0 for v7)
++	bic	r12, #(3 << 19)		@ WXN and UWXN disabled
++	mcr	p15, 0, r12, c1, c0, 0	@ SCTLR
++
++	mrc	p15, 0, r12, c0, c0, 0	@ MIDR
++	mcr	p15, 4, r12, c0, c0, 0	@ VPIDR
++
++	mrc	p15, 0, r12, c0, c0, 5	@ MPIDR
++	mcr	p15, 4, r12, c0, c0, 5	@ VMPIDR
++	bx	lr
++ENDPROC(__hyp_install)
++
++ENTRY(armv7_hyp_install)
++	mov	r2, lr
++
++	bl	__hyp_install
++
++	/* set the cpu to SVC32 mode, mask irq and fiq */
++	mrs	r12 , cpsr
++	eor	r12, r12, #HYP_MODE
++	tst	r12, #MODE_MASK
++	bic	r12 , r12 , #MODE_MASK
++	orr	r12 , r12 , #(PSR_I_BIT | PSR_F_BIT | SVC_MODE)
++THUMB(	orr	r12 , r12 , #PSR_T_BIT	)
++	bne	1f
++	orr	r12, r12, #PSR_A_BIT
++	adr	lr, 2f
++	msr	spsr_cxsf, r12
++	__MSR_ELR_HYP(14)
++	__ERET
++1:	msr	cpsr_c, r12
++2:
++	mov	pc, r2
++ENDPROC(armv7_hyp_install)
++
++ENTRY(armv7_switch_to_hyp)
++	mov	r0, lr
++	mov	r1, sp		@ save SVC copy of LR and SP
++	isb
++	hvc #0			@ for older asm: .byte 0x70, 0x00, 0x40, 0xe1
++	mov	sp, r1
++	mov	lr, r0		@ restore SVC copy of LR and SP
++
++	bx	lr
++ENDPROC(armv7_switch_to_hyp)
++
++.align 2
++.L__boot_cpu_mode_offset:
++	.long	__boot_cpu_mode - .
++
++/* The HYP trap is crafted to match armv7_switch_to_hyp() */
++__hyp_do_trap:
++	mov lr, r0
++	mov sp, r1
++	bx  lr
++ENDPROC(__hyp_do_trap)
++
++.align 5
++__hyp_vectors:
++__hyp_reset:	W(b)	.
++__hyp_und:	W(b)	.
++__hyp_svc:	W(b)	.
++__hyp_pabort:	W(b)	.
++__hyp_dabort:	W(b)	.
++__hyp_trap:	W(b)	__hyp_do_trap
++__hyp_irq:	W(b)	.
++__hyp_fiq:	W(b)	.
++ENDPROC(__hyp_vectors)
+diff --git a/arch/arm/cpu/sm_as.S b/arch/arm/cpu/sm_as.S
+index 0d01e1b..de6cd04 100644
+--- a/arch/arm/cpu/sm_as.S
++++ b/arch/arm/cpu/sm_as.S
+@@ -148,17 +148,6 @@ hyp_trap:
+         mov pc, lr                              @ do no switch modes, but
+                                                 @ return to caller
+ 
+-ENTRY(armv7_switch_to_hyp)
+-	mov	r0, lr
+-	mov	r1, sp		@ save SVC copy of LR and SP
+-	isb
+-	hvc #0			@ for older asm: .byte 0x70, 0x00, 0x40, 0xe1
+-	mov	sp, r1
+-	mov	lr, r0		@ restore SVC copy of LR and SP
+-
+-	bx	lr
+-ENDPROC(armv7_switch_to_hyp)
+-
+ ENTRY(psci_cpu_entry)
+ 	mrc	p15, 0, r0, c1, c0, 1	@ ACTLR
+ 	orr	r0, r0, #(1 << 6)	@ Set SMP bit
+diff --git a/arch/arm/include/asm/secure.h b/arch/arm/include/asm/secure.h
+index a4cb1f6..54cc052 100644
+--- a/arch/arm/include/asm/secure.h
++++ b/arch/arm/include/asm/secure.h
+@@ -6,8 +6,10 @@
+ int armv7_secure_monitor_install(void);
+ int __armv7_secure_monitor_install(void);
+ void armv7_switch_to_hyp(void);
++void armv7_hyp_install(void);
+ 
+ extern unsigned char secure_monitor_init_vectors[];
++extern int __boot_cpu_mode;
+ 
+ enum arm_security_state {
+ 	ARM_STATE_SECURE,
+-- 
+2.7.4
+

buildroot-external/board/rpi3/patches/barebox/0005-dont-try-to-install-secure-monitor-when-entered-in-HYP-mode.patch

@@ -0,0 +1,25 @@
+When Barebox has been entered in HYP mode, the CPU is already switched
+to the non-secure world and it's not possible for Barebox to install
+it's own secure monitor.
+
+Signed-off-by: Lucas Stach <l.stach at pengutronix.de>
+---
+ arch/arm/cpu/sm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/cpu/sm.c b/arch/arm/cpu/sm.c
+index 5808dfd92bdc..71bb394c8540 100644
+--- a/arch/arm/cpu/sm.c
++++ b/arch/arm/cpu/sm.c
+@@ -184,6 +184,9 @@ int armv7_secure_monitor_install(void)
+ 		return -EINVAL;
+ 	}
+ 
++	if (__boot_cpu_mode == HYP_MODE)
++		return 0;
++
+ 	mmuon = get_cr() & CR_M;
+ 
+ 	vbar = get_vbar();
+-- 
+2.15.1

buildroot-external/board/rpi3/patches/barebox/0006-default-to-starting-kernel-in-HYP-mode-when-entered-in-HYP.patch

@@ -0,0 +1,26 @@
+When Barebox has been entered in HYP mode, there is a high chance that
+the kernel is  intended to be started in HYP mode also. Get this
+default into place.
+
+Signed-off-by: Lucas Stach <l.stach at pengutronix.de>
+---
+ arch/arm/cpu/sm.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/arch/arm/cpu/sm.c b/arch/arm/cpu/sm.c
+index 71bb394c8540..3369fbb5ff1a 100644
+--- a/arch/arm/cpu/sm.c
++++ b/arch/arm/cpu/sm.c
+@@ -264,6 +264,9 @@ static int sm_init(void)
+ 				  bootm_secure_state_names,
+ 				  ARRAY_SIZE(bootm_secure_state_names));
+ 
++	if (__boot_cpu_mode == HYP_MODE)
++		bootm_secure_state = ARM_STATE_HYP;
++
+ 	return 0;
+ }
+ device_initcall(sm_init);
+\ No newline at end of file
+-- 
+2.15.1

buildroot-external/board/rpi3/patches/barebox/0007-install-HYP-vectors-at-PBL-and-Barebox-entry.patch

@@ -0,0 +1,84 @@
+From f984f8cf4c07f24af7855a4fd69afa3e656238c2 Mon Sep 17 00:00:00 2001
+From: Pascal Vizeli <pvizeli@syshack.ch>
+Date: Sat, 19 May 2018 17:24:42 +0200
+Subject: [PATCH 1/1] p4
+
+---
+ arch/arm/cpu/lowlevel.S   | 3 +++
+ arch/arm/cpu/start-pbl.c  | 3 +++
+ arch/arm/cpu/start.c      | 3 +++
+ arch/arm/cpu/uncompress.c | 4 ++++
+ 4 files changed, 13 insertions(+)
+
+diff --git a/arch/arm/cpu/lowlevel.S b/arch/arm/cpu/lowlevel.S
+index 194ce0e..28ad850 100644
+--- a/arch/arm/cpu/lowlevel.S
++++ b/arch/arm/cpu/lowlevel.S
+@@ -8,6 +8,9 @@ ENTRY(arm_cpu_lowlevel_init)
+ 	/* save lr, since it may be banked away with a processor mode change */
+ 	mov	r2, lr
+ 
++	/* careful: the hyp install corrupts r0 and r1 */
++	bl	__hyp_install
++
+ 	/* set the cpu to SVC32 mode, mask irq and fiq */
+ 	mrs	r12 , cpsr
+ 	eor	r12, r12, #HYP_MODE
+diff --git a/arch/arm/cpu/start-pbl.c b/arch/arm/cpu/start-pbl.c
+index 16159d7..3f9959e 100644
+--- a/arch/arm/cpu/start-pbl.c
++++ b/arch/arm/cpu/start-pbl.c
+@@ -98,5 +98,8 @@ __noreturn void barebox_single_pbl_start(unsigned long membase,
+ 	else
+ 		barebox = (void *)barebox_base;
+ 
++	if (__boot_cpu_mode == HYP_MODE)
++		armv7_switch_to_hyp();
++
+ 	barebox(membase, memsize, boarddata);
+ }
+diff --git a/arch/arm/cpu/start.c b/arch/arm/cpu/start.c
+index 68fff89..1ee13c0 100644
+--- a/arch/arm/cpu/start.c
++++ b/arch/arm/cpu/start.c
+@@ -24,6 +24,7 @@
+ #include <asm/barebox-arm-head.h>
+ #include <asm-generic/memory_layout.h>
+ #include <asm/sections.h>
++#include <asm/secure.h>
+ #include <asm/unaligned.h>
+ #include <asm/cache.h>
+ #include <asm/mmu.h>
+@@ -145,6 +146,8 @@ __noreturn void barebox_non_pbl_start(unsigned long membase,
+ 	unsigned long malloc_start, malloc_end;
+ 	unsigned long barebox_size = barebox_image_size + MAX_BSS_SIZE;
+ 
++	armv7_hyp_install();
++
+ 	if (IS_ENABLED(CONFIG_RELOCATABLE)) {
+ 		unsigned long barebox_base = arm_mem_barebox_image(membase,
+ 								   endmem,
+diff --git a/arch/arm/cpu/uncompress.c b/arch/arm/cpu/uncompress.c
+index b07087e..57f324b 100644
+--- a/arch/arm/cpu/uncompress.c
++++ b/arch/arm/cpu/uncompress.c
+@@ -27,6 +27,7 @@
+ #include <asm/barebox-arm-head.h>
+ #include <asm-generic/memory_layout.h>
+ #include <asm/sections.h>
++#include <asm/secure.h>
+ #include <asm/cache.h>
+ #include <asm/mmu.h>
+ #include <asm/unaligned.h>
+@@ -108,5 +109,8 @@ void __noreturn barebox_multi_pbl_start(unsigned long membase,
+ 
+ 	pr_debug("jumping to uncompressed image at 0x%p\n", barebox);
+ 
++	if (__boot_cpu_mode == HYP_MODE)
++		armv7_switch_to_hyp();
++
+ 	barebox(membase, memsize, boarddata);
+ }
+-- 
+2.7.4
+

buildroot-external/board/rpi3/patches/barebox/0009-add-revision-IDs-for-Pi-3-Model-B-and-Pi-Zero.patch

@@ -0,0 +1,38 @@
+From: Enrico Joerns <ejo at pengutronix.de>
+
+Signed-off-by: Enrico Joerns <ejo at pengutronix.de>
+---
+ arch/arm/boards/raspberry-pi/rpi-common.c | 2 ++
+ arch/arm/mach-bcm283x/include/mach/mbox.h | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+diff --git a/arch/arm/boards/raspberry-pi/rpi-common.c b/arch/arm/boards/raspberry-pi/rpi-common.c
+index 6e375bc984de..aec8cb27ed40 100644
+--- a/arch/arm/boards/raspberry-pi/rpi-common.c
++++ b/arch/arm/boards/raspberry-pi/rpi-common.c
+@@ -174,6 +174,8 @@ const struct rpi_model rpi_models_old_scheme[] = {
+ const struct rpi_model rpi_models_new_scheme[] = {
+ 	RPI_MODEL(0, "Unknown model", NULL),
+ 	RPI_MODEL(BCM2836_BOARD_REV_2_B, "2 Model B", rpi_b_plus_init),
++	RPI_MODEL(BCM2837_BOARD_REV_3_B, "3 Model B", rpi_b_plus_init),
++	RPI_MODEL(BCM2837_BOARD_REV_ZERO, "Zero", rpi_b_plus_init),
+ };
+ 
+ static int rpi_board_rev = 0;
+diff --git a/arch/arm/mach-bcm283x/include/mach/mbox.h b/arch/arm/mach-bcm283x/include/mach/mbox.h
+index 2b5aea88ee0a..4cddf99a8429 100644
+--- a/arch/arm/mach-bcm283x/include/mach/mbox.h
++++ b/arch/arm/mach-bcm283x/include/mach/mbox.h
+@@ -129,6 +129,10 @@ struct bcm2835_mbox_tag_hdr {
+ 
+ /* RPi 2 */
+ #define BCM2836_BOARD_REV_2_B		0x4
++/* RPi 3 */
++#define BCM2837_BOARD_REV_3_B		0x8
++/* Zero */
++#define BCM2837_BOARD_REV_ZERO		0x9
+ 
+ /*
+  * 0x2..0xf from:
+-- 
+2.15.1

buildroot-external/board/rpi3/patches/barebox/0010-rpi-add-raspberry-pi-3-support.patch

@@ -0,0 +1,136 @@
+This adds basic support at the same feature level as the other
+supported raspberry pi boards.
+
+Signed-off-by: Lucas Stach <l.stach at pengutronix.de>
+---
+ arch/arm/boards/raspberry-pi/lowlevel.c | 14 ++++++++++++--
+ arch/arm/configs/rpi_defconfig          |  2 ++
+ arch/arm/dts/Makefile                   |  1 +
+ arch/arm/dts/bcm2837-rpi-3.dts          | 15 +++++++++++++++
+ arch/arm/mach-bcm283x/Kconfig           |  6 ++++++
+ arch/arm/mach-bcm283x/core.c            |  1 +
+ images/Makefile.bcm283x                 |  4 ++++
+ 7 files changed, 41 insertions(+), 2 deletions(-)
+ create mode 100644 arch/arm/dts/bcm2837-rpi-3.dts
+
+diff --git a/arch/arm/boards/raspberry-pi/lowlevel.c b/arch/arm/boards/raspberry-pi/lowlevel.c
+index 4e71e29e0c0b..5ca0d3877069 100644
+--- a/arch/arm/boards/raspberry-pi/lowlevel.c
++++ b/arch/arm/boards/raspberry-pi/lowlevel.c
+@@ -1,7 +1,7 @@
++#include <asm/barebox-arm.h>
++#include <asm/cache.h>
+ #include <common.h>
+ #include <linux/sizes.h>
+-#include <asm/barebox-arm.h>
+-#include <asm/barebox-arm-head.h>
+ #include <mach/platform.h>
+ 
+ extern char __dtb_bcm2835_rpi_start[];
+@@ -23,3 +23,13 @@ ENTRY_FUNCTION(start_raspberry_pi2, r0, r1, r2)
+ 
+ 	barebox_arm_entry(BCM2835_SDRAM_BASE, SZ_512M, fdt);
+ }
++
++extern char __dtb_bcm2837_rpi_3_start[];
++ENTRY_FUNCTION(start_raspberry_pi3, r0, r1, r2)
++{
++	void *fdt = __dtb_bcm2837_rpi_3_start - get_runtime_offset();
++
++	arm_cpu_lowlevel_init();
++
++	barebox_arm_entry(BCM2835_SDRAM_BASE, SZ_512M, fdt);
++}
+diff --git a/arch/arm/configs/rpi_defconfig b/arch/arm/configs/rpi_defconfig
+index 6dc90c59b36d..34070a05abe7 100644
+--- a/arch/arm/configs/rpi_defconfig
++++ b/arch/arm/configs/rpi_defconfig
+@@ -1,9 +1,11 @@
+ CONFIG_ARCH_BCM283X=y
+ CONFIG_MACH_RPI=y
+ CONFIG_MACH_RPI2=y
++CONFIG_MACH_RPI3=y
+ CONFIG_AEABI=y
+ CONFIG_ARM_OPTIMZED_STRING_FUNCTIONS=y
+ CONFIG_ARM_UNWIND=y
++CONFIG_IMAGE_COMPRESSION_NONE=y
+ CONFIG_MMU=y
+ CONFIG_MALLOC_TLSF=y
+ CONFIG_KALLSYMS=y
+diff --git a/arch/arm/dts/Makefile b/arch/arm/dts/Makefile
+index 0526a6f40724..0eab313c5011 100644
+--- a/arch/arm/dts/Makefile
++++ b/arch/arm/dts/Makefile
+@@ -66,6 +66,7 @@ pbl-dtb-$(CONFIG_MACH_PHYTEC_SOM_RK3288) += rk3288-phycore-som.dtb.o
+ pbl-dtb-$(CONFIG_MACH_REALQ7) += imx6q-dmo-edmqmx6.dtb.o
+ pbl-dtb-$(CONFIG_MACH_RPI) += bcm2835-rpi.dtb.o
+ pbl-dtb-$(CONFIG_MACH_RPI2) += bcm2836-rpi-2.dtb.o
++pbl-dtb-$(CONFIG_MACH_RPI3) += bcm2837-rpi-3.dtb.o
+ pbl-dtb-$(CONFIG_MACH_SABRELITE) += imx6q-sabrelite.dtb.o imx6dl-sabrelite.dtb.o
+ pbl-dtb-$(CONFIG_MACH_SABRESD) += imx6q-sabresd.dtb.o
+ pbl-dtb-$(CONFIG_MACH_FREESCALE_IMX6SX_SABRESDB) += imx6sx-sdb.dtb.o
+diff --git a/arch/arm/dts/bcm2837-rpi-3.dts b/arch/arm/dts/bcm2837-rpi-3.dts
+new file mode 100644
+index 000000000000..f8c58c570137
+--- /dev/null
++++ b/arch/arm/dts/bcm2837-rpi-3.dts
+@@ -0,0 +1,15 @@
++#include <arm64/broadcom/bcm2837-rpi-3-b.dts>
++
++/ {
++	chosen {
++		stdout-path = &uart0;
++	};
++
++	memory {
++		reg = <0x0 0x0>;
++	};
++};
++
++&uart0 {
++	status = "okay";
++};
+diff --git a/arch/arm/mach-bcm283x/Kconfig b/arch/arm/mach-bcm283x/Kconfig
+index 1457f114ccaa..af2f88c47acb 100644
+--- a/arch/arm/mach-bcm283x/Kconfig
++++ b/arch/arm/mach-bcm283x/Kconfig
+@@ -19,6 +19,12 @@ config MACH_RPI2
+ 	select CPU_V7
+ 	select MACH_RPI_COMMON
+ 
++config MACH_RPI3
++	bool "RaspberryPi 3 (BCM2837/CORTEX-A53)"
++	select CPU_V7
++	select MACH_RPI_COMMON
++	select ARM_SECURE_MONITOR
++
+ endmenu
+ 
+ config MACH_RPI_DEBUG_UART_BASE
+diff --git a/arch/arm/mach-bcm283x/core.c b/arch/arm/mach-bcm283x/core.c
+index fddcb0d1a1d4..26f0996b1cb8 100644
+--- a/arch/arm/mach-bcm283x/core.c
++++ b/arch/arm/mach-bcm283x/core.c
+@@ -41,6 +41,7 @@ static int bcm2835_clk_init(void)
+ 	clk = clk_fixed("uart0-pl0110", 3 * 1000 * 1000);
+ 	clk_register_clkdev(clk, NULL, "uart0-pl0110");
+ 	clk_register_clkdev(clk, NULL, "20201000.serial");
++	clk_register_clkdev(clk, NULL, "3f201000.serial");
+ 
+ 	clk = clk_fixed("bcm2835-cs", 1 * 1000 * 1000);
+ 	clk_register_clkdev(clk, NULL, "bcm2835-cs");
+diff --git a/images/Makefile.bcm283x b/images/Makefile.bcm283x
+index d59ef043f05c..d14e648926ac 100644
+--- a/images/Makefile.bcm283x
++++ b/images/Makefile.bcm283x
+@@ -9,3 +9,7 @@ image-$(CONFIG_MACH_RPI) += barebox-raspberry-pi-1.img
+ pblx-$(CONFIG_MACH_RPI2) += start_raspberry_pi2
+ FILE_barebox-raspberry-pi-2.img = start_raspberry_pi2.pblx
+ image-$(CONFIG_MACH_RPI2) += barebox-raspberry-pi-2.img
++
++pblx-$(CONFIG_MACH_RPI3) += start_raspberry_pi3
++FILE_barebox-raspberry-pi-3.img = start_raspberry_pi3.pblx
++image-$(CONFIG_MACH_RPI3) += barebox-raspberry-pi-3.img
+\ No newline at end of file
+-- 
+2.15.1

buildroot-external/board/rpi3/post-image.sh

@@ -0,0 +1,50 @@
+#!/bin/bash
+set -e
+
+SCRIPT_DIR=${BR2_EXTERNAL_HASSOS_PATH}/scripts
+BOARD_DIR=${2}
+BOOT_DATA=${BINARIES_DIR}/boot
+
+. ${SCRIPT_DIR}/hdd-image.sh
+. ${BR2_EXTERNAL_HASSOS_PATH}/info
+. ${BOARD_DIR}/info
+
+# Filename
+IMAGE_FILE=${BINARIES_DIR}/${HASSOS_ID}_${BOARD_ID}-${VERSION_MAJOR}.${VERSION_BUILD}.img
+
+# Init boot data
+rm -rf ${BOOT_DATA}
+mkdir -p ${BOOT_DATA}
+
+cp ${BINARIES_DIR}/barebox.bin ${BOOT_DATA}/
+cp -t ${BOOT_DATA} \
+    ${BINARIES_DIR}/bcm2710-rpi-3-b.dtb \
+    ${BINARIES_DIR}/bcm2710-rpi-3-b-plus.dtb \
+    ${BINARIES_DIR}/bcm2710-rpi-cm3.dtb \
+    ${BINARIES_DIR}/rpi-firmware/bootcode.bin \
+    ${BINARIES_DIR}/rpi-firmware/fixup.dat \
+    ${BINARIES_DIR}/rpi-firmware/start.elf
+cp -r ${BINARIES_DIR}/rpi-firmware/overlays ${BOOT_DATA}/
+
+# Update Boot options
+(
+    echo "kernel=barebox.bin"
+    echo "cmdline=\"\""
+    echo "gpu_mem=16"
+    echo "disable_splash=1"
+    echo "dtparam=i2c_arm=on"
+    echo "dtparam=spi=on"
+    echo "dtparam=audio=on"
+) > ${BOOT_DATA}/config.txt
+
+touch ${BOOT_DATA}/cmdline.txt
+
+# Create other layers
+create_boot_image ${BINARIES_DIR}
+create_overlay_image ${BINARIES_DIR}
+
+create_disk_image ${BINARIES_DIR} ${IMAGE_FILE} 2
+fix_disk_image_mbr ${IMAGE_FILE}
+
+rm -rf ${IMAGE_FILE}.gz
+gzip ${IMAGE_FILE}

buildroot-external/busybox.config

@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Busybox version: 1.27.2
-# Tue Apr 17 18:57:21 2018
+# Fri May 18 17:09:42 2018
 #
 CONFIG_HAVE_DOT_CONFIG=y
 
@@ -511,7 +511,7 @@ CONFIG_FEATURE_DEFAULT_PASSWD_ALGO="des"
 # CONFIG_DELUSER is not set
 # CONFIG_DELGROUP is not set
 # CONFIG_FEATURE_DEL_USER_FROM_GROUP is not set
-# CONFIG_GETTY is not set
+CONFIG_GETTY=y
 CONFIG_LOGIN=y
 # CONFIG_LOGIN_SESSION_AS_CHILD is not set
 # CONFIG_LOGIN_SCRIPTS is not set
@@ -540,12 +540,12 @@ CONFIG_FEATURE_PASSWD_WEAK_CHECK=y
 # CONFIG_MODPROBE_SMALL is not set
 # CONFIG_DEPMOD is not set
 # CONFIG_INSMOD is not set
-# CONFIG_LSMOD is not set
-# CONFIG_FEATURE_LSMOD_PRETTY_2_6_OUTPUT is not set
-# CONFIG_MODINFO is not set
-# CONFIG_MODPROBE is not set
-# CONFIG_FEATURE_MODPROBE_BLACKLIST is not set
-# CONFIG_RMMOD is not set
+CONFIG_LSMOD=y
+CONFIG_FEATURE_LSMOD_PRETTY_2_6_OUTPUT=y
+CONFIG_MODINFO=y
+CONFIG_MODPROBE=y
+CONFIG_FEATURE_MODPROBE_BLACKLIST=y
+CONFIG_RMMOD=y
 
 #
 # Options common to multiple modutils
@@ -562,8 +562,8 @@ CONFIG_FEATURE_PASSWD_WEAK_CHECK=y
 # CONFIG_FEATURE_INSMOD_TRY_MMAP is not set
 # CONFIG_FEATURE_MODUTILS_ALIAS is not set
 # CONFIG_FEATURE_MODUTILS_SYMBOLS is not set
-CONFIG_DEFAULT_MODULES_DIR=""
-CONFIG_DEFAULT_DEPMOD_FILE=""
+CONFIG_DEFAULT_MODULES_DIR="/lib/modules"
+CONFIG_DEFAULT_DEPMOD_FILE="modules.dep"
 
 #
 # Linux System Utilities
@@ -606,13 +606,13 @@ CONFIG_GETOPT=y
 CONFIG_FEATURE_GETOPT_LONG=y
 CONFIG_HEXDUMP=y
 CONFIG_FEATURE_HEXDUMP_REVERSE=y
-CONFIG_HD=y
-CONFIG_XXD=y
-CONFIG_HWCLOCK=y
-CONFIG_FEATURE_HWCLOCK_LONG_OPTIONS=y
+# CONFIG_HD is not set
+# CONFIG_XXD is not set
+# CONFIG_HWCLOCK is not set
+# CONFIG_FEATURE_HWCLOCK_LONG_OPTIONS is not set
 # CONFIG_FEATURE_HWCLOCK_ADJTIME_FHS is not set
 CONFIG_IONICE=y
-CONFIG_IPCRM=y
+# CONFIG_IPCRM is not set
 CONFIG_IPCS=y
 # CONFIG_LAST is not set
 # CONFIG_FEATURE_LAST_FANCY is not set
@@ -648,9 +648,9 @@ CONFIG_FEATURE_MOUNT_FLAGS=y
 # CONFIG_FEATURE_MOUNT_FSTAB is not set
 # CONFIG_FEATURE_MOUNT_OTHERTAB is not set
 # CONFIG_MOUNTPOINT is not set
-CONFIG_NSENTER=y
-CONFIG_FEATURE_NSENTER_LONG_OPTS=y
-CONFIG_PIVOT_ROOT=y
+# CONFIG_NSENTER is not set
+# CONFIG_FEATURE_NSENTER_LONG_OPTS is not set
+# CONFIG_PIVOT_ROOT is not set
 CONFIG_RDATE=y
 CONFIG_RDEV=y
 CONFIG_READPROFILE=y
@@ -674,14 +674,14 @@ CONFIG_FEATURE_TASKSET_FANCY=y
 CONFIG_UEVENT=y
 CONFIG_UMOUNT=y
 CONFIG_FEATURE_UMOUNT_ALL=y
-CONFIG_UNSHARE=y
+# CONFIG_UNSHARE is not set
 # CONFIG_WALL is not set
 
 #
 # Common options for mount/umount
 #
 CONFIG_FEATURE_MOUNT_LOOP=y
-CONFIG_FEATURE_MOUNT_LOOP_CREATE=y
+# CONFIG_FEATURE_MOUNT_LOOP_CREATE is not set
 # CONFIG_FEATURE_MTAB_SUPPORT is not set
 CONFIG_VOLUMEID=y
 
@@ -750,10 +750,10 @@ CONFIG_FEATURE_CROND_DIR=""
 # CONFIG_FLASHCP is not set
 CONFIG_HDPARM=y
 CONFIG_FEATURE_HDPARM_GET_IDENTITY=y
-CONFIG_FEATURE_HDPARM_HDIO_SCAN_HWIF=y
-CONFIG_FEATURE_HDPARM_HDIO_UNREGISTER_HWIF=y
-CONFIG_FEATURE_HDPARM_HDIO_DRIVE_RESET=y
-CONFIG_FEATURE_HDPARM_HDIO_TRISTATE_HWIF=y
+# CONFIG_FEATURE_HDPARM_HDIO_SCAN_HWIF is not set
+# CONFIG_FEATURE_HDPARM_HDIO_UNREGISTER_HWIF is not set
+# CONFIG_FEATURE_HDPARM_HDIO_DRIVE_RESET is not set
+# CONFIG_FEATURE_HDPARM_HDIO_TRISTATE_HWIF is not set
 CONFIG_FEATURE_HDPARM_HDIO_GETSET_DMA=y
 # CONFIG_I2CGET is not set
 # CONFIG_I2CSET is not set
@@ -780,7 +780,7 @@ CONFIG_FEATURE_LESS_MAXLINES=0
 # CONFIG_MT is not set
 CONFIG_NANDWRITE=y
 CONFIG_NANDDUMP=y
-CONFIG_PARTPROBE=y
+# CONFIG_PARTPROBE is not set
 # CONFIG_RAIDAUTORUN is not set
 # CONFIG_READAHEAD is not set
 # CONFIG_RFKILL is not set
@@ -1069,7 +1069,7 @@ CONFIG_ASH_TEST=y
 CONFIG_ASH_HELP=y
 CONFIG_ASH_GETOPTS=y
 CONFIG_ASH_CMDCMD=y
-CONFIG_CTTYHACK=y
+# CONFIG_CTTYHACK is not set
 # CONFIG_HUSH is not set
 # CONFIG_HUSH_BASH_COMPAT is not set
 # CONFIG_HUSH_BRACE_EXPANSION is not set

buildroot-external/ca/dev-ca.pem

@@ -0,0 +1,272 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: O=HassOS, CN=HassOS Provisioning CA Root
+        Validity
+            Not Before: May 15 16:35:54 2018 GMT
+            Not After : May 14 16:35:54 2028 GMT
+        Subject: O=HassOS, CN=HassOS Provisioning CA Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a5:81:96:24:f6:eb:ac:0b:10:72:34:c8:41:70:
+                    f5:29:9c:1c:1e:d9:a6:68:a3:ea:c5:e4:68:e7:b5:
+                    76:2e:13:e0:0e:fe:8e:c4:2f:d2:76:2c:76:63:15:
+                    8d:7e:7f:8a:9f:d8:9a:66:94:b9:b4:6f:5e:bc:a9:
+                    59:59:12:fa:bb:7b:af:34:95:79:dd:2d:b1:3e:0e:
+                    16:27:92:40:9d:15:55:34:b9:7d:dd:63:2e:64:f9:
+                    65:46:e9:b2:de:66:d8:e5:12:9d:af:ca:db:3e:44:
+                    15:57:8f:15:17:58:9d:2d:9b:1e:79:7b:ec:eb:28:
+                    b3:11:81:a3:34:bb:b5:5d:08:a4:6b:4e:7e:7e:ec:
+                    d3:e3:b9:d9:2d:66:e8:04:be:09:d3:75:86:8f:86:
+                    94:01:aa:c1:0d:7e:28:74:27:da:c6:b8:d5:bf:94:
+                    a0:d2:f5:bf:88:72:40:21:fe:4c:aa:39:06:35:29:
+                    ee:c0:f5:f0:f0:85:d0:6b:ea:ee:c7:b7:54:aa:df:
+                    e9:e4:cf:cd:5a:1a:61:e5:63:be:3c:7f:4b:6c:ae:
+                    79:20:07:e0:44:c5:3d:c2:df:f8:04:64:22:2b:fb:
+                    11:cf:99:0e:ba:1f:6b:51:56:ea:27:ca:a6:70:76:
+                    19:2f:16:24:35:d9:0a:05:cf:b6:9d:ae:82:4a:e0:
+                    5a:c5
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                49:69:2D:A8:24:2F:B0:AC:E6:9A:02:6A:D0:FC:9A:AA:73:9B:62:71
+            X509v3 Authority Key Identifier: 
+                keyid:49:69:2D:A8:24:2F:B0:AC:E6:9A:02:6A:D0:FC:9A:AA:73:9B:62:71
+                DirName:/O=HassOS/CN=HassOS Provisioning CA Root
+                serial:01
+
+            X509v3 Basic Constraints: 
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         08:35:23:fd:fd:da:80:5a:c9:c5:b1:2e:9e:3d:b1:57:7e:ea:
+         72:cd:c4:df:b4:5f:a4:47:84:d5:25:6f:c2:27:66:6d:e5:fc:
+         91:99:7d:81:7e:38:09:1d:d9:7e:31:fd:db:4b:a3:52:f8:6a:
+         98:53:dd:dd:be:21:b3:de:af:01:b5:e4:b1:a6:e4:7b:40:27:
+         0c:dc:89:e4:34:78:56:1b:bb:01:e3:2e:90:ee:94:8b:9d:2e:
+         f7:37:da:4c:b1:02:ef:7d:53:62:7f:9b:3b:e7:70:44:aa:4e:
+         5f:d0:16:a5:1a:2b:62:0b:9e:55:07:12:25:3c:bf:c4:26:52:
+         5e:10:c5:b6:25:a7:f7:cd:3b:03:07:bb:66:8f:4a:e6:84:c3:
+         06:38:43:ab:2b:c3:29:7c:cb:aa:5f:23:2e:a7:e6:6b:5d:e5:
+         dd:d9:ea:2c:59:46:e5:f3:6c:73:9b:eb:ef:74:56:93:f0:e9:
+         3c:17:03:57:b6:17:3f:de:2f:2e:1d:6a:65:d8:71:88:6f:ad:
+         19:48:d3:3a:05:46:d2:65:71:fa:97:73:38:0c:1d:d2:83:48:
+         b1:16:61:7c:f1:db:b6:06:5b:46:8d:45:4c:f4:af:b2:da:b6:
+         ca:47:54:f6:e7:37:9e:7a:d6:0c:88:58:06:b0:49:b5:25:16:
+         a0:77:9b:5a
+-----BEGIN CERTIFICATE-----
+MIIDezCCAmOgAwIBAgIBATANBgkqhkiG9w0BAQsFADA3MQ8wDQYDVQQKDAZIYXNz
+T1MxJDAiBgNVBAMMG0hhc3NPUyBQcm92aXNpb25pbmcgQ0EgUm9vdDAeFw0xODA1
+MTUxNjM1NTRaFw0yODA1MTQxNjM1NTRaMDcxDzANBgNVBAoMBkhhc3NPUzEkMCIG
+A1UEAwwbSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSb290MIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEApYGWJPbrrAsQcjTIQXD1KZwcHtmmaKPqxeRo57V2
+LhPgDv6OxC/Sdix2YxWNfn+Kn9iaZpS5tG9evKlZWRL6u3uvNJV53S2xPg4WJ5JA
+nRVVNLl93WMuZPllRumy3mbY5RKdr8rbPkQVV48VF1idLZseeXvs6yizEYGjNLu1
+XQika05+fuzT47nZLWboBL4J03WGj4aUAarBDX4odCfaxrjVv5Sg0vW/iHJAIf5M
+qjkGNSnuwPXw8IXQa+rux7dUqt/p5M/NWhph5WO+PH9LbK55IAfgRMU9wt/4BGQi
+K/sRz5kOuh9rUVbqJ8qmcHYZLxYkNdkKBc+2na6CSuBaxQIDAQABo4GRMIGOMB0G
+A1UdDgQWBBRJaS2oJC+wrOaaAmrQ/Jqqc5ticTBfBgNVHSMEWDBWgBRJaS2oJC+w
+rOaaAmrQ/Jqqc5ticaE7pDkwNzEPMA0GA1UECgwGSGFzc09TMSQwIgYDVQQDDBtI
+YXNzT1MgUHJvdmlzaW9uaW5nIENBIFJvb3SCAQEwDAYDVR0TBAUwAwEB/zANBgkq
+hkiG9w0BAQsFAAOCAQEACDUj/f3agFrJxbEunj2xV37qcs3E37RfpEeE1SVvwidm
+beX8kZl9gX44CR3ZfjH920ujUvhqmFPd3b4hs96vAbXksabke0AnDNyJ5DR4Vhu7
+AeMukO6Ui50u9zfaTLEC731TYn+bO+dwRKpOX9AWpRorYgueVQcSJTy/xCZSXhDF
+tiWn9807Awe7Zo9K5oTDBjhDqyvDKXzLql8jLqfma13l3dnqLFlG5fNsc5vr73RW
+k/DpPBcDV7YXP94vLh1qZdhxiG+tGUjTOgVG0mVx+pdzOAwd0oNIsRZhfPHbtgZb
+Ro1FTPSvstq2ykdU9uc3nnrWDIhYBrBJtSUWoHebWg==
+-----END CERTIFICATE-----
+-----BEGIN X509 CRL-----
+MIIBfDBmMA0GCSqGSIb3DQEBCwUAMDcxDzANBgNVBAoMBkhhc3NPUzEkMCIGA1UE
+AwwbSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSb290Fw0xODA1MTUxNjM1NTRaFw0z
+MjAxMjIxNjM1NTRaMA0GCSqGSIb3DQEBCwUAA4IBAQAWfPq1Bchq5D2B+baE149H
+M9ozBTeICoZJ3xNyVPfce9F2VHQjuXngKCVzCgBxeUNJXVbFdDvd0ybs6SoOojeG
+WbIeAwzQ2uwluqy7rMx3bvn+QDVUfUP01e7Wd21m1aR+eas6FKCTwUw9CEHMr34s
+3TZOJ4av3vVlYcJbCk5mfRQ5xyf6qxsdi/tWHxchrJNi/X/e6AMy2sJmj8mBvPES
+JmjWx97JJISvMYuhWZpbycq+SlvISSbP4IcAYAekGJreHxAXuXr4ELZRQAHTeueH
+ID0K1fRJU+LVTaQCZohFoECEMqJhrBVs5CTMG2EyEeqlI3I5PTBAyjO362rNkSQz
+-----END X509 CRL-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: O=HassOS, CN=HassOS Provisioning CA Root
+        Validity
+            Not Before: May 15 16:35:54 2018 GMT
+            Not After : May 14 16:35:54 2028 GMT
+        Subject: O=HassOS, CN=HassOS Provisioning CA Release
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b9:38:00:71:51:61:eb:d5:91:87:78:1d:fd:a7:
+                    e9:4e:17:75:50:c7:86:2e:4d:64:e3:32:c6:3a:09:
+                    13:1a:5d:05:67:af:d5:da:75:c6:cc:b1:b8:c6:b8:
+                    86:05:bf:da:fe:62:62:81:c2:1a:34:d4:34:10:20:
+                    e3:91:7f:10:d7:f7:18:54:92:02:29:10:8c:39:6b:
+                    1f:42:87:60:08:15:92:03:1d:0e:da:88:7c:7e:0a:
+                    38:94:d3:d8:fc:8d:d7:7f:d7:0f:6c:94:5d:82:da:
+                    bd:b8:5e:26:37:72:6a:75:6d:84:05:f1:64:fa:78:
+                    48:98:33:3d:f9:ae:36:67:98:b9:51:19:8a:84:0b:
+                    00:18:20:d8:5e:55:22:7b:95:92:e7:81:dd:67:ac:
+                    a0:9d:2e:86:a0:79:ee:8d:00:f6:62:c0:9d:5a:99:
+                    ac:ec:f0:a6:66:af:b6:f5:05:64:66:34:1e:3d:7a:
+                    b4:f5:b5:18:9a:20:e7:d1:a4:36:81:4d:a3:f8:28:
+                    c7:3a:17:a3:c2:0f:a2:95:06:f7:a7:de:83:dd:82:
+                    72:50:62:b8:24:9d:cc:05:d5:0f:70:1d:98:7f:13:
+                    b2:f3:30:5b:dd:83:24:26:b3:af:ea:b3:5d:8b:b5:
+                    de:b8:0a:1e:13:ba:f6:1d:ae:08:ba:b2:b3:d7:7d:
+                    4f:af
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                E6:1B:A0:DC:7E:B3:8F:81:97:8B:01:83:86:D4:33:5D:A2:B4:F4:2B
+            X509v3 Authority Key Identifier: 
+                keyid:49:69:2D:A8:24:2F:B0:AC:E6:9A:02:6A:D0:FC:9A:AA:73:9B:62:71
+                DirName:/O=HassOS/CN=HassOS Provisioning CA Root
+                serial:01
+
+            X509v3 Basic Constraints: 
+                CA:TRUE, pathlen:0
+    Signature Algorithm: sha256WithRSAEncryption
+         63:d9:a4:26:89:fc:4d:0b:e0:51:2f:8e:82:8d:69:9f:1e:fc:
+         ed:be:73:a8:f4:8c:99:55:c8:36:af:57:80:9f:97:34:a7:47:
+         fb:ae:ee:8f:03:64:2e:88:59:25:c4:f7:e4:8d:85:4b:b3:4a:
+         e8:42:84:01:b9:c1:f4:ce:d4:9d:b1:54:34:8d:8d:0d:22:91:
+         48:a0:59:f0:ea:b9:f4:a1:0f:63:02:a1:52:cb:c7:92:c0:a7:
+         8f:d6:4a:d2:17:36:a5:16:5a:5f:09:1f:48:33:d1:0a:8b:d9:
+         41:e9:ae:0d:c6:15:36:63:0e:f8:7b:9d:ab:b0:49:4e:ab:a6:
+         1d:54:e5:3f:39:7a:d1:49:31:f7:bf:4f:31:9b:0d:1d:a8:91:
+         68:45:b0:fa:e7:e6:9e:2d:37:89:fc:5c:80:64:2c:bb:cd:19:
+         8c:d7:5d:d0:b6:76:97:a9:81:e4:2b:77:f9:a3:02:dc:81:d6:
+         fe:bd:24:0b:36:6a:c2:0f:b0:60:d9:0e:d3:03:ba:80:d4:50:
+         f1:59:dd:bf:c0:96:ee:2c:06:cc:00:2a:cf:dd:48:55:0d:81:
+         e6:76:06:92:df:46:29:10:d5:eb:5c:9c:81:75:2d:94:6b:5b:
+         2f:15:e3:62:0e:39:53:1c:1f:4a:82:c8:13:c6:ae:91:8c:58:
+         e7:70:9e:57
+-----BEGIN CERTIFICATE-----
+MIIDgTCCAmmgAwIBAgIBAjANBgkqhkiG9w0BAQsFADA3MQ8wDQYDVQQKDAZIYXNz
+T1MxJDAiBgNVBAMMG0hhc3NPUyBQcm92aXNpb25pbmcgQ0EgUm9vdDAeFw0xODA1
+MTUxNjM1NTRaFw0yODA1MTQxNjM1NTRaMDoxDzANBgNVBAoMBkhhc3NPUzEnMCUG
+A1UEAwweSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSZWxlYXNlMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuTgAcVFh69WRh3gd/afpThd1UMeGLk1k4zLG
+OgkTGl0FZ6/V2nXGzLG4xriGBb/a/mJigcIaNNQ0ECDjkX8Q1/cYVJICKRCMOWsf
+QodgCBWSAx0O2oh8fgo4lNPY/I3Xf9cPbJRdgtq9uF4mN3JqdW2EBfFk+nhImDM9
++a42Z5i5URmKhAsAGCDYXlUie5WS54HdZ6ygnS6GoHnujQD2YsCdWpms7PCmZq+2
+9QVkZjQePXq09bUYmiDn0aQ2gU2j+CjHOhejwg+ilQb3p96D3YJyUGK4JJ3MBdUP
+cB2YfxOy8zBb3YMkJrOv6rNdi7XeuAoeE7r2Ha4IurKz131PrwIDAQABo4GUMIGR
+MB0GA1UdDgQWBBTmG6DcfrOPgZeLAYOG1DNdorT0KzBfBgNVHSMEWDBWgBRJaS2o
+JC+wrOaaAmrQ/Jqqc5ticaE7pDkwNzEPMA0GA1UECgwGSGFzc09TMSQwIgYDVQQD
+DBtIYXNzT1MgUHJvdmlzaW9uaW5nIENBIFJvb3SCAQEwDwYDVR0TBAgwBgEB/wIB
+ADANBgkqhkiG9w0BAQsFAAOCAQEAY9mkJon8TQvgUS+Ogo1pnx787b5zqPSMmVXI
+Nq9XgJ+XNKdH+67ujwNkLohZJcT35I2FS7NK6EKEAbnB9M7UnbFUNI2NDSKRSKBZ
+8Oq59KEPYwKhUsvHksCnj9ZK0hc2pRZaXwkfSDPRCovZQemuDcYVNmMO+Hudq7BJ
+TqumHVTlPzl60Ukx979PMZsNHaiRaEWw+ufmni03ifxcgGQsu80ZjNdd0LZ2l6mB
+5Ct3+aMC3IHW/r0kCzZqwg+wYNkO0wO6gNRQ8Vndv8CW7iwGzAAqz91IVQ2B5nYG
+kt9GKRDV61ycgXUtlGtbLxXjYg45UxwfSoLIE8aukYxY53CeVw==
+-----END CERTIFICATE-----
+-----BEGIN X509 CRL-----
+MIIBfzBpMA0GCSqGSIb3DQEBCwUAMDoxDzANBgNVBAoMBkhhc3NPUzEnMCUGA1UE
+AwweSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSZWxlYXNlFw0xODA1MTUxNjM1NTRa
+Fw0zMjAxMjIxNjM1NTRaMA0GCSqGSIb3DQEBCwUAA4IBAQBOSgkmXR88VTMZfsjY
+NYHj2eYSSoFCLLW9CepoeCfIYeb81w6DUusZm4oqyvU+yFj5SBxV6X4ZEJaIaj8r
+jZtIbx6O6ocMQp9SX1O0OoG+/JJNm/9eezyhuMEK+OEbpVaPpjw6nvizOJMzAx3G
+hdW8u7xOVc004uDyCE0KT/5DTqQifsS1C5NhRZTrXSD4b6PY1d2wJx33zNUlD0B4
+7v4f+U9CzQJKY0og7krrlRHfwl8vpMUR4OL1Lxwju8RvcT4u5Do1gp3c7DJ/NJqr
+xHQjNseGewHQPrNe4Ix6inwIDRQLimQvF74RlmHf0G+Jf9+m5ixCOWH+ySfReCQ7
+fSiy
+-----END X509 CRL-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 3 (0x3)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: O=HassOS, CN=HassOS Provisioning CA Root
+        Validity
+            Not Before: May 15 16:35:54 2018 GMT
+            Not After : May 14 16:35:54 2028 GMT
+        Subject: O=HassOS, CN=HassOS Provisioning CA Development
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:e1:db:e7:26:03:db:fe:b8:87:bd:91:57:9a:27:
+                    ed:ed:f0:7f:5d:18:0a:5a:a0:18:7d:66:ab:4f:90:
+                    ed:c8:ab:de:53:b4:d7:a4:b2:87:e7:d6:28:40:32:
+                    11:84:b4:fc:0f:33:f3:97:0c:fe:7c:0e:04:5d:cf:
+                    c0:bf:0b:8a:cb:a0:b7:cb:75:e6:b3:76:d0:7b:60:
+                    b7:80:be:83:7a:ef:e0:32:fa:91:43:72:c3:2c:72:
+                    6c:c7:db:c6:a8:bf:6e:3b:9e:ce:e2:60:6a:b0:7f:
+                    38:c5:36:b2:32:f5:50:51:d1:0c:43:e1:b8:cf:b0:
+                    fe:10:83:f2:2d:e3:4e:c3:b6:83:e2:17:42:b9:f4:
+                    31:b4:b7:47:42:ba:b7:3e:91:f0:8a:90:8f:36:66:
+                    ca:6a:9a:6c:96:06:5b:f9:27:4d:ff:94:6b:d3:34:
+                    c2:ad:bc:d4:fa:30:0f:76:93:e4:5d:8d:ac:46:b9:
+                    ab:e3:7b:44:cc:07:7b:67:33:38:40:7a:73:f5:ef:
+                    cd:ab:3a:97:60:77:22:ff:25:83:e6:5f:d7:f6:f1:
+                    d1:f9:5d:63:fa:69:5c:9c:b3:b7:60:07:09:b4:78:
+                    7d:ca:af:0b:80:46:d5:ee:6e:b1:a4:14:03:ce:7d:
+                    62:98:e0:71:31:33:84:7d:65:f4:82:7c:6b:49:18:
+                    e6:15
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                A4:B8:E3:2A:38:E2:F4:A4:DC:67:71:E8:04:EC:05:4E:37:27:06:8F
+            X509v3 Authority Key Identifier: 
+                keyid:49:69:2D:A8:24:2F:B0:AC:E6:9A:02:6A:D0:FC:9A:AA:73:9B:62:71
+                DirName:/O=HassOS/CN=HassOS Provisioning CA Root
+                serial:01
+
+            X509v3 Basic Constraints: 
+                CA:TRUE, pathlen:0
+    Signature Algorithm: sha256WithRSAEncryption
+         8e:c0:e5:ae:72:94:a6:0c:22:53:27:b9:df:e8:01:60:8a:5b:
+         f1:90:4f:56:e1:63:d7:98:c5:1c:49:5f:98:11:79:62:02:b5:
+         49:51:1b:b2:38:df:89:c9:3e:35:63:23:48:5a:5c:b2:bf:4c:
+         5f:41:4e:75:b6:51:ce:1b:66:f7:85:96:b7:f2:33:7d:6e:42:
+         17:60:15:14:18:6f:9f:fb:9b:21:01:28:b5:c7:bd:0c:a4:2c:
+         2c:09:a6:5f:ca:b8:f9:02:65:97:30:22:3c:b9:3a:8f:04:31:
+         21:d0:ea:66:90:12:fa:e8:10:62:c4:ac:30:3a:e1:29:e1:e2:
+         f0:9b:5f:7f:1e:0d:e8:6b:a8:a4:3c:6c:09:97:b2:ab:bf:58:
+         16:cc:6f:62:0b:e7:a1:d6:06:f0:aa:7d:be:1f:e4:00:14:d0:
+         2a:9c:a7:7d:99:90:74:d2:97:76:f3:72:c0:bf:83:40:41:6b:
+         97:ee:ac:a0:ec:5e:79:ba:74:51:ef:d2:22:7f:c8:20:a7:39:
+         c6:8f:2b:a8:aa:ad:9e:1b:5e:fe:61:b0:d7:f8:94:6b:64:3c:
+         3d:9f:da:4e:59:e8:95:f9:58:81:55:4e:ca:dd:93:24:cf:97:
+         4a:0b:47:f2:8c:c8:49:c7:16:cd:69:c0:b6:62:91:19:ae:c9:
+         15:ba:99:78
+-----BEGIN CERTIFICATE-----
+MIIDhTCCAm2gAwIBAgIBAzANBgkqhkiG9w0BAQsFADA3MQ8wDQYDVQQKDAZIYXNz
+T1MxJDAiBgNVBAMMG0hhc3NPUyBQcm92aXNpb25pbmcgQ0EgUm9vdDAeFw0xODA1
+MTUxNjM1NTRaFw0yODA1MTQxNjM1NTRaMD4xDzANBgNVBAoMBkhhc3NPUzErMCkG
+A1UEAwwiSGFzc09TIFByb3Zpc2lvbmluZyBDQSBEZXZlbG9wbWVudDCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAOHb5yYD2/64h72RV5on7e3wf10YClqg
+GH1mq0+Q7cir3lO016Syh+fWKEAyEYS0/A8z85cM/nwOBF3PwL8Lisugt8t15rN2
+0Htgt4C+g3rv4DL6kUNywyxybMfbxqi/bjuezuJgarB/OMU2sjL1UFHRDEPhuM+w
+/hCD8i3jTsO2g+IXQrn0MbS3R0K6tz6R8IqQjzZmymqabJYGW/knTf+Ua9M0wq28
+1PowD3aT5F2NrEa5q+N7RMwHe2czOEB6c/Xvzas6l2B3Iv8lg+Zf1/bx0fldY/pp
+XJyzt2AHCbR4fcqvC4BG1e5usaQUA859YpjgcTEzhH1l9IJ8a0kY5hUCAwEAAaOB
+lDCBkTAdBgNVHQ4EFgQUpLjjKjji9KTcZ3HoBOwFTjcnBo8wXwYDVR0jBFgwVoAU
+SWktqCQvsKzmmgJq0PyaqnObYnGhO6Q5MDcxDzANBgNVBAoMBkhhc3NPUzEkMCIG
+A1UEAwwbSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSb290ggEBMA8GA1UdEwQIMAYB
+Af8CAQAwDQYJKoZIhvcNAQELBQADggEBAI7A5a5ylKYMIlMnud/oAWCKW/GQT1bh
+Y9eYxRxJX5gReWICtUlRG7I434nJPjVjI0haXLK/TF9BTnW2Uc4bZveFlrfyM31u
+QhdgFRQYb5/7myEBKLXHvQykLCwJpl/KuPkCZZcwIjy5Oo8EMSHQ6maQEvroEGLE
+rDA64Snh4vCbX38eDehrqKQ8bAmXsqu/WBbMb2IL56HWBvCqfb4f5AAU0Cqcp32Z
+kHTSl3bzcsC/g0BBa5furKDsXnm6dFHv0iJ/yCCnOcaPK6iqrZ4bXv5hsNf4lGtk
+PD2f2k5Z6JX5WIFVTsrdkyTPl0oLR/KMyEnHFs1pwLZikRmuyRW6mXg=
+-----END CERTIFICATE-----
+-----BEGIN X509 CRL-----
+MIIBgzBtMA0GCSqGSIb3DQEBCwUAMD4xDzANBgNVBAoMBkhhc3NPUzErMCkGA1UE
+AwwiSGFzc09TIFByb3Zpc2lvbmluZyBDQSBEZXZlbG9wbWVudBcNMTgwNTE1MTYz
+NTU0WhcNMzIwMTIyMTYzNTU0WjANBgkqhkiG9w0BAQsFAAOCAQEAhmHxjIYZ+J7U
+/Ih4vWTakmjSQgD+cvhOedUMxBBwxerZ2qKB2t3LGSBKjVgOThL84HppNP/Y1Hqs
+Kq3RD57aL2ZNdQeP3xXjotb/LXsO8KjNi1SeFFIdXkQ8qFVyXkrbqM2h8PJE3Cu5
+yeKJaQytPPl90scqmyS07bfI6akwNyg4W6dKQ8KDQrs3DV+Q1xGff6mUgH/6eTIa
+lg8OTjh6yI1+XZr0Yz9bNo0/3AOMTbNTYZMnZTapD6r8k2r3pr7FQ6lIyHaCAUVF
+TrWQsqmjuQ2uoj0VZvjKxje8VggNv0NFKg8W3l6p7ng1SVLdzw7i7RIVb+iF9BJC
+N373ui3HSw==
+-----END X509 CRL-----

buildroot-external/ca/provisioning-ca.pem

@@ -0,0 +1,112 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: O=HassOS, CN=HassOS Provisioning CA Root
+        Validity
+            Not Before: May 15 16:35:54 2018 GMT
+            Not After : May 14 16:35:54 2028 GMT
+        Subject: O=HassOS, CN=HassOS Provisioning CA Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a5:81:96:24:f6:eb:ac:0b:10:72:34:c8:41:70:
+                    f5:29:9c:1c:1e:d9:a6:68:a3:ea:c5:e4:68:e7:b5:
+                    76:2e:13:e0:0e:fe:8e:c4:2f:d2:76:2c:76:63:15:
+                    8d:7e:7f:8a:9f:d8:9a:66:94:b9:b4:6f:5e:bc:a9:
+                    59:59:12:fa:bb:7b:af:34:95:79:dd:2d:b1:3e:0e:
+                    16:27:92:40:9d:15:55:34:b9:7d:dd:63:2e:64:f9:
+                    65:46:e9:b2:de:66:d8:e5:12:9d:af:ca:db:3e:44:
+                    15:57:8f:15:17:58:9d:2d:9b:1e:79:7b:ec:eb:28:
+                    b3:11:81:a3:34:bb:b5:5d:08:a4:6b:4e:7e:7e:ec:
+                    d3:e3:b9:d9:2d:66:e8:04:be:09:d3:75:86:8f:86:
+                    94:01:aa:c1:0d:7e:28:74:27:da:c6:b8:d5:bf:94:
+                    a0:d2:f5:bf:88:72:40:21:fe:4c:aa:39:06:35:29:
+                    ee:c0:f5:f0:f0:85:d0:6b:ea:ee:c7:b7:54:aa:df:
+                    e9:e4:cf:cd:5a:1a:61:e5:63:be:3c:7f:4b:6c:ae:
+                    79:20:07:e0:44:c5:3d:c2:df:f8:04:64:22:2b:fb:
+                    11:cf:99:0e:ba:1f:6b:51:56:ea:27:ca:a6:70:76:
+                    19:2f:16:24:35:d9:0a:05:cf:b6:9d:ae:82:4a:e0:
+                    5a:c5
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                49:69:2D:A8:24:2F:B0:AC:E6:9A:02:6A:D0:FC:9A:AA:73:9B:62:71
+            X509v3 Authority Key Identifier: 
+                keyid:49:69:2D:A8:24:2F:B0:AC:E6:9A:02:6A:D0:FC:9A:AA:73:9B:62:71
+                DirName:/O=HassOS/CN=HassOS Provisioning CA Root
+                serial:01
+
+            X509v3 Basic Constraints: 
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         08:35:23:fd:fd:da:80:5a:c9:c5:b1:2e:9e:3d:b1:57:7e:ea:
+         72:cd:c4:df:b4:5f:a4:47:84:d5:25:6f:c2:27:66:6d:e5:fc:
+         91:99:7d:81:7e:38:09:1d:d9:7e:31:fd:db:4b:a3:52:f8:6a:
+         98:53:dd:dd:be:21:b3:de:af:01:b5:e4:b1:a6:e4:7b:40:27:
+         0c:dc:89:e4:34:78:56:1b:bb:01:e3:2e:90:ee:94:8b:9d:2e:
+         f7:37:da:4c:b1:02:ef:7d:53:62:7f:9b:3b:e7:70:44:aa:4e:
+         5f:d0:16:a5:1a:2b:62:0b:9e:55:07:12:25:3c:bf:c4:26:52:
+         5e:10:c5:b6:25:a7:f7:cd:3b:03:07:bb:66:8f:4a:e6:84:c3:
+         06:38:43:ab:2b:c3:29:7c:cb:aa:5f:23:2e:a7:e6:6b:5d:e5:
+         dd:d9:ea:2c:59:46:e5:f3:6c:73:9b:eb:ef:74:56:93:f0:e9:
+         3c:17:03:57:b6:17:3f:de:2f:2e:1d:6a:65:d8:71:88:6f:ad:
+         19:48:d3:3a:05:46:d2:65:71:fa:97:73:38:0c:1d:d2:83:48:
+         b1:16:61:7c:f1:db:b6:06:5b:46:8d:45:4c:f4:af:b2:da:b6:
+         ca:47:54:f6:e7:37:9e:7a:d6:0c:88:58:06:b0:49:b5:25:16:
+         a0:77:9b:5a
+-----BEGIN CERTIFICATE-----
+MIIDezCCAmOgAwIBAgIBATANBgkqhkiG9w0BAQsFADA3MQ8wDQYDVQQKDAZIYXNz
+T1MxJDAiBgNVBAMMG0hhc3NPUyBQcm92aXNpb25pbmcgQ0EgUm9vdDAeFw0xODA1
+MTUxNjM1NTRaFw0yODA1MTQxNjM1NTRaMDcxDzANBgNVBAoMBkhhc3NPUzEkMCIG
+A1UEAwwbSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSb290MIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEApYGWJPbrrAsQcjTIQXD1KZwcHtmmaKPqxeRo57V2
+LhPgDv6OxC/Sdix2YxWNfn+Kn9iaZpS5tG9evKlZWRL6u3uvNJV53S2xPg4WJ5JA
+nRVVNLl93WMuZPllRumy3mbY5RKdr8rbPkQVV48VF1idLZseeXvs6yizEYGjNLu1
+XQika05+fuzT47nZLWboBL4J03WGj4aUAarBDX4odCfaxrjVv5Sg0vW/iHJAIf5M
+qjkGNSnuwPXw8IXQa+rux7dUqt/p5M/NWhph5WO+PH9LbK55IAfgRMU9wt/4BGQi
+K/sRz5kOuh9rUVbqJ8qmcHYZLxYkNdkKBc+2na6CSuBaxQIDAQABo4GRMIGOMB0G
+A1UdDgQWBBRJaS2oJC+wrOaaAmrQ/Jqqc5ticTBfBgNVHSMEWDBWgBRJaS2oJC+w
+rOaaAmrQ/Jqqc5ticaE7pDkwNzEPMA0GA1UECgwGSGFzc09TMSQwIgYDVQQDDBtI
+YXNzT1MgUHJvdmlzaW9uaW5nIENBIFJvb3SCAQEwDAYDVR0TBAUwAwEB/zANBgkq
+hkiG9w0BAQsFAAOCAQEACDUj/f3agFrJxbEunj2xV37qcs3E37RfpEeE1SVvwidm
+beX8kZl9gX44CR3ZfjH920ujUvhqmFPd3b4hs96vAbXksabke0AnDNyJ5DR4Vhu7
+AeMukO6Ui50u9zfaTLEC731TYn+bO+dwRKpOX9AWpRorYgueVQcSJTy/xCZSXhDF
+tiWn9807Awe7Zo9K5oTDBjhDqyvDKXzLql8jLqfma13l3dnqLFlG5fNsc5vr73RW
+k/DpPBcDV7YXP94vLh1qZdhxiG+tGUjTOgVG0mVx+pdzOAwd0oNIsRZhfPHbtgZb
+Ro1FTPSvstq2ykdU9uc3nnrWDIhYBrBJtSUWoHebWg==
+-----END CERTIFICATE-----
+-----BEGIN X509 CRL-----
+MIIBfDBmMA0GCSqGSIb3DQEBCwUAMDcxDzANBgNVBAoMBkhhc3NPUzEkMCIGA1UE
+AwwbSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSb290Fw0xODA1MTUxNjM1NTRaFw0z
+MjAxMjIxNjM1NTRaMA0GCSqGSIb3DQEBCwUAA4IBAQAWfPq1Bchq5D2B+baE149H
+M9ozBTeICoZJ3xNyVPfce9F2VHQjuXngKCVzCgBxeUNJXVbFdDvd0ybs6SoOojeG
+WbIeAwzQ2uwluqy7rMx3bvn+QDVUfUP01e7Wd21m1aR+eas6FKCTwUw9CEHMr34s
+3TZOJ4av3vVlYcJbCk5mfRQ5xyf6qxsdi/tWHxchrJNi/X/e6AMy2sJmj8mBvPES
+JmjWx97JJISvMYuhWZpbycq+SlvISSbP4IcAYAekGJreHxAXuXr4ELZRQAHTeueH
+ID0K1fRJU+LVTaQCZohFoECEMqJhrBVs5CTMG2EyEeqlI3I5PTBAyjO362rNkSQz
+-----END X509 CRL-----
+-----BEGIN X509 CRL-----
+MIIBfzBpMA0GCSqGSIb3DQEBCwUAMDoxDzANBgNVBAoMBkhhc3NPUzEnMCUGA1UE
+AwweSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSZWxlYXNlFw0xODA1MTUxNjM1NTRa
+Fw0zMjAxMjIxNjM1NTRaMA0GCSqGSIb3DQEBCwUAA4IBAQBOSgkmXR88VTMZfsjY
+NYHj2eYSSoFCLLW9CepoeCfIYeb81w6DUusZm4oqyvU+yFj5SBxV6X4ZEJaIaj8r
+jZtIbx6O6ocMQp9SX1O0OoG+/JJNm/9eezyhuMEK+OEbpVaPpjw6nvizOJMzAx3G
+hdW8u7xOVc004uDyCE0KT/5DTqQifsS1C5NhRZTrXSD4b6PY1d2wJx33zNUlD0B4
+7v4f+U9CzQJKY0og7krrlRHfwl8vpMUR4OL1Lxwju8RvcT4u5Do1gp3c7DJ/NJqr
+xHQjNseGewHQPrNe4Ix6inwIDRQLimQvF74RlmHf0G+Jf9+m5ixCOWH+ySfReCQ7
+fSiy
+-----END X509 CRL-----
+-----BEGIN X509 CRL-----
+MIIBgzBtMA0GCSqGSIb3DQEBCwUAMD4xDzANBgNVBAoMBkhhc3NPUzErMCkGA1UE
+AwwiSGFzc09TIFByb3Zpc2lvbmluZyBDQSBEZXZlbG9wbWVudBcNMTgwNTE1MTYz
+NTU0WhcNMzIwMTIyMTYzNTU0WjANBgkqhkiG9w0BAQsFAAOCAQEAhmHxjIYZ+J7U
+/Ih4vWTakmjSQgD+cvhOedUMxBBwxerZ2qKB2t3LGSBKjVgOThL84HppNP/Y1Hqs
+Kq3RD57aL2ZNdQeP3xXjotb/LXsO8KjNi1SeFFIdXkQ8qFVyXkrbqM2h8PJE3Cu5
+yeKJaQytPPl90scqmyS07bfI6akwNyg4W6dKQ8KDQrs3DV+Q1xGff6mUgH/6eTIa
+lg8OTjh6yI1+XZr0Yz9bNo0/3AOMTbNTYZMnZTapD6r8k2r3pr7FQ6lIyHaCAUVF
+TrWQsqmjuQ2uoj0VZvjKxje8VggNv0NFKg8W3l6p7ng1SVLdzw7i7RIVb+iF9BJC
+N373ui3HSw==
+-----END X509 CRL-----

buildroot-external/ca/rel-ca.pem

@@ -0,0 +1,181 @@
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: O=HassOS, CN=HassOS Provisioning CA Root
+        Validity
+            Not Before: May 15 16:35:54 2018 GMT
+            Not After : May 14 16:35:54 2028 GMT
+        Subject: O=HassOS, CN=HassOS Provisioning CA Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:a5:81:96:24:f6:eb:ac:0b:10:72:34:c8:41:70:
+                    f5:29:9c:1c:1e:d9:a6:68:a3:ea:c5:e4:68:e7:b5:
+                    76:2e:13:e0:0e:fe:8e:c4:2f:d2:76:2c:76:63:15:
+                    8d:7e:7f:8a:9f:d8:9a:66:94:b9:b4:6f:5e:bc:a9:
+                    59:59:12:fa:bb:7b:af:34:95:79:dd:2d:b1:3e:0e:
+                    16:27:92:40:9d:15:55:34:b9:7d:dd:63:2e:64:f9:
+                    65:46:e9:b2:de:66:d8:e5:12:9d:af:ca:db:3e:44:
+                    15:57:8f:15:17:58:9d:2d:9b:1e:79:7b:ec:eb:28:
+                    b3:11:81:a3:34:bb:b5:5d:08:a4:6b:4e:7e:7e:ec:
+                    d3:e3:b9:d9:2d:66:e8:04:be:09:d3:75:86:8f:86:
+                    94:01:aa:c1:0d:7e:28:74:27:da:c6:b8:d5:bf:94:
+                    a0:d2:f5:bf:88:72:40:21:fe:4c:aa:39:06:35:29:
+                    ee:c0:f5:f0:f0:85:d0:6b:ea:ee:c7:b7:54:aa:df:
+                    e9:e4:cf:cd:5a:1a:61:e5:63:be:3c:7f:4b:6c:ae:
+                    79:20:07:e0:44:c5:3d:c2:df:f8:04:64:22:2b:fb:
+                    11:cf:99:0e:ba:1f:6b:51:56:ea:27:ca:a6:70:76:
+                    19:2f:16:24:35:d9:0a:05:cf:b6:9d:ae:82:4a:e0:
+                    5a:c5
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                49:69:2D:A8:24:2F:B0:AC:E6:9A:02:6A:D0:FC:9A:AA:73:9B:62:71
+            X509v3 Authority Key Identifier: 
+                keyid:49:69:2D:A8:24:2F:B0:AC:E6:9A:02:6A:D0:FC:9A:AA:73:9B:62:71
+                DirName:/O=HassOS/CN=HassOS Provisioning CA Root
+                serial:01
+
+            X509v3 Basic Constraints: 
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         08:35:23:fd:fd:da:80:5a:c9:c5:b1:2e:9e:3d:b1:57:7e:ea:
+         72:cd:c4:df:b4:5f:a4:47:84:d5:25:6f:c2:27:66:6d:e5:fc:
+         91:99:7d:81:7e:38:09:1d:d9:7e:31:fd:db:4b:a3:52:f8:6a:
+         98:53:dd:dd:be:21:b3:de:af:01:b5:e4:b1:a6:e4:7b:40:27:
+         0c:dc:89:e4:34:78:56:1b:bb:01:e3:2e:90:ee:94:8b:9d:2e:
+         f7:37:da:4c:b1:02:ef:7d:53:62:7f:9b:3b:e7:70:44:aa:4e:
+         5f:d0:16:a5:1a:2b:62:0b:9e:55:07:12:25:3c:bf:c4:26:52:
+         5e:10:c5:b6:25:a7:f7:cd:3b:03:07:bb:66:8f:4a:e6:84:c3:
+         06:38:43:ab:2b:c3:29:7c:cb:aa:5f:23:2e:a7:e6:6b:5d:e5:
+         dd:d9:ea:2c:59:46:e5:f3:6c:73:9b:eb:ef:74:56:93:f0:e9:
+         3c:17:03:57:b6:17:3f:de:2f:2e:1d:6a:65:d8:71:88:6f:ad:
+         19:48:d3:3a:05:46:d2:65:71:fa:97:73:38:0c:1d:d2:83:48:
+         b1:16:61:7c:f1:db:b6:06:5b:46:8d:45:4c:f4:af:b2:da:b6:
+         ca:47:54:f6:e7:37:9e:7a:d6:0c:88:58:06:b0:49:b5:25:16:
+         a0:77:9b:5a
+-----BEGIN CERTIFICATE-----
+MIIDezCCAmOgAwIBAgIBATANBgkqhkiG9w0BAQsFADA3MQ8wDQYDVQQKDAZIYXNz
+T1MxJDAiBgNVBAMMG0hhc3NPUyBQcm92aXNpb25pbmcgQ0EgUm9vdDAeFw0xODA1
+MTUxNjM1NTRaFw0yODA1MTQxNjM1NTRaMDcxDzANBgNVBAoMBkhhc3NPUzEkMCIG
+A1UEAwwbSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSb290MIIBIjANBgkqhkiG9w0B
+AQEFAAOCAQ8AMIIBCgKCAQEApYGWJPbrrAsQcjTIQXD1KZwcHtmmaKPqxeRo57V2
+LhPgDv6OxC/Sdix2YxWNfn+Kn9iaZpS5tG9evKlZWRL6u3uvNJV53S2xPg4WJ5JA
+nRVVNLl93WMuZPllRumy3mbY5RKdr8rbPkQVV48VF1idLZseeXvs6yizEYGjNLu1
+XQika05+fuzT47nZLWboBL4J03WGj4aUAarBDX4odCfaxrjVv5Sg0vW/iHJAIf5M
+qjkGNSnuwPXw8IXQa+rux7dUqt/p5M/NWhph5WO+PH9LbK55IAfgRMU9wt/4BGQi
+K/sRz5kOuh9rUVbqJ8qmcHYZLxYkNdkKBc+2na6CSuBaxQIDAQABo4GRMIGOMB0G
+A1UdDgQWBBRJaS2oJC+wrOaaAmrQ/Jqqc5ticTBfBgNVHSMEWDBWgBRJaS2oJC+w
+rOaaAmrQ/Jqqc5ticaE7pDkwNzEPMA0GA1UECgwGSGFzc09TMSQwIgYDVQQDDBtI
+YXNzT1MgUHJvdmlzaW9uaW5nIENBIFJvb3SCAQEwDAYDVR0TBAUwAwEB/zANBgkq
+hkiG9w0BAQsFAAOCAQEACDUj/f3agFrJxbEunj2xV37qcs3E37RfpEeE1SVvwidm
+beX8kZl9gX44CR3ZfjH920ujUvhqmFPd3b4hs96vAbXksabke0AnDNyJ5DR4Vhu7
+AeMukO6Ui50u9zfaTLEC731TYn+bO+dwRKpOX9AWpRorYgueVQcSJTy/xCZSXhDF
+tiWn9807Awe7Zo9K5oTDBjhDqyvDKXzLql8jLqfma13l3dnqLFlG5fNsc5vr73RW
+k/DpPBcDV7YXP94vLh1qZdhxiG+tGUjTOgVG0mVx+pdzOAwd0oNIsRZhfPHbtgZb
+Ro1FTPSvstq2ykdU9uc3nnrWDIhYBrBJtSUWoHebWg==
+-----END CERTIFICATE-----
+-----BEGIN X509 CRL-----
+MIIBfDBmMA0GCSqGSIb3DQEBCwUAMDcxDzANBgNVBAoMBkhhc3NPUzEkMCIGA1UE
+AwwbSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSb290Fw0xODA1MTUxNjM1NTRaFw0z
+MjAxMjIxNjM1NTRaMA0GCSqGSIb3DQEBCwUAA4IBAQAWfPq1Bchq5D2B+baE149H
+M9ozBTeICoZJ3xNyVPfce9F2VHQjuXngKCVzCgBxeUNJXVbFdDvd0ybs6SoOojeG
+WbIeAwzQ2uwluqy7rMx3bvn+QDVUfUP01e7Wd21m1aR+eas6FKCTwUw9CEHMr34s
+3TZOJ4av3vVlYcJbCk5mfRQ5xyf6qxsdi/tWHxchrJNi/X/e6AMy2sJmj8mBvPES
+JmjWx97JJISvMYuhWZpbycq+SlvISSbP4IcAYAekGJreHxAXuXr4ELZRQAHTeueH
+ID0K1fRJU+LVTaQCZohFoECEMqJhrBVs5CTMG2EyEeqlI3I5PTBAyjO362rNkSQz
+-----END X509 CRL-----
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: O=HassOS, CN=HassOS Provisioning CA Root
+        Validity
+            Not Before: May 15 16:35:54 2018 GMT
+            Not After : May 14 16:35:54 2028 GMT
+        Subject: O=HassOS, CN=HassOS Provisioning CA Release
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b9:38:00:71:51:61:eb:d5:91:87:78:1d:fd:a7:
+                    e9:4e:17:75:50:c7:86:2e:4d:64:e3:32:c6:3a:09:
+                    13:1a:5d:05:67:af:d5:da:75:c6:cc:b1:b8:c6:b8:
+                    86:05:bf:da:fe:62:62:81:c2:1a:34:d4:34:10:20:
+                    e3:91:7f:10:d7:f7:18:54:92:02:29:10:8c:39:6b:
+                    1f:42:87:60:08:15:92:03:1d:0e:da:88:7c:7e:0a:
+                    38:94:d3:d8:fc:8d:d7:7f:d7:0f:6c:94:5d:82:da:
+                    bd:b8:5e:26:37:72:6a:75:6d:84:05:f1:64:fa:78:
+                    48:98:33:3d:f9:ae:36:67:98:b9:51:19:8a:84:0b:
+                    00:18:20:d8:5e:55:22:7b:95:92:e7:81:dd:67:ac:
+                    a0:9d:2e:86:a0:79:ee:8d:00:f6:62:c0:9d:5a:99:
+                    ac:ec:f0:a6:66:af:b6:f5:05:64:66:34:1e:3d:7a:
+                    b4:f5:b5:18:9a:20:e7:d1:a4:36:81:4d:a3:f8:28:
+                    c7:3a:17:a3:c2:0f:a2:95:06:f7:a7:de:83:dd:82:
+                    72:50:62:b8:24:9d:cc:05:d5:0f:70:1d:98:7f:13:
+                    b2:f3:30:5b:dd:83:24:26:b3:af:ea:b3:5d:8b:b5:
+                    de:b8:0a:1e:13:ba:f6:1d:ae:08:ba:b2:b3:d7:7d:
+                    4f:af
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                E6:1B:A0:DC:7E:B3:8F:81:97:8B:01:83:86:D4:33:5D:A2:B4:F4:2B
+            X509v3 Authority Key Identifier: 
+                keyid:49:69:2D:A8:24:2F:B0:AC:E6:9A:02:6A:D0:FC:9A:AA:73:9B:62:71
+                DirName:/O=HassOS/CN=HassOS Provisioning CA Root
+                serial:01
+
+            X509v3 Basic Constraints: 
+                CA:TRUE, pathlen:0
+    Signature Algorithm: sha256WithRSAEncryption
+         63:d9:a4:26:89:fc:4d:0b:e0:51:2f:8e:82:8d:69:9f:1e:fc:
+         ed:be:73:a8:f4:8c:99:55:c8:36:af:57:80:9f:97:34:a7:47:
+         fb:ae:ee:8f:03:64:2e:88:59:25:c4:f7:e4:8d:85:4b:b3:4a:
+         e8:42:84:01:b9:c1:f4:ce:d4:9d:b1:54:34:8d:8d:0d:22:91:
+         48:a0:59:f0:ea:b9:f4:a1:0f:63:02:a1:52:cb:c7:92:c0:a7:
+         8f:d6:4a:d2:17:36:a5:16:5a:5f:09:1f:48:33:d1:0a:8b:d9:
+         41:e9:ae:0d:c6:15:36:63:0e:f8:7b:9d:ab:b0:49:4e:ab:a6:
+         1d:54:e5:3f:39:7a:d1:49:31:f7:bf:4f:31:9b:0d:1d:a8:91:
+         68:45:b0:fa:e7:e6:9e:2d:37:89:fc:5c:80:64:2c:bb:cd:19:
+         8c:d7:5d:d0:b6:76:97:a9:81:e4:2b:77:f9:a3:02:dc:81:d6:
+         fe:bd:24:0b:36:6a:c2:0f:b0:60:d9:0e:d3:03:ba:80:d4:50:
+         f1:59:dd:bf:c0:96:ee:2c:06:cc:00:2a:cf:dd:48:55:0d:81:
+         e6:76:06:92:df:46:29:10:d5:eb:5c:9c:81:75:2d:94:6b:5b:
+         2f:15:e3:62:0e:39:53:1c:1f:4a:82:c8:13:c6:ae:91:8c:58:
+         e7:70:9e:57
+-----BEGIN CERTIFICATE-----
+MIIDgTCCAmmgAwIBAgIBAjANBgkqhkiG9w0BAQsFADA3MQ8wDQYDVQQKDAZIYXNz
+T1MxJDAiBgNVBAMMG0hhc3NPUyBQcm92aXNpb25pbmcgQ0EgUm9vdDAeFw0xODA1
+MTUxNjM1NTRaFw0yODA1MTQxNjM1NTRaMDoxDzANBgNVBAoMBkhhc3NPUzEnMCUG
+A1UEAwweSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSZWxlYXNlMIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEAuTgAcVFh69WRh3gd/afpThd1UMeGLk1k4zLG
+OgkTGl0FZ6/V2nXGzLG4xriGBb/a/mJigcIaNNQ0ECDjkX8Q1/cYVJICKRCMOWsf
+QodgCBWSAx0O2oh8fgo4lNPY/I3Xf9cPbJRdgtq9uF4mN3JqdW2EBfFk+nhImDM9
++a42Z5i5URmKhAsAGCDYXlUie5WS54HdZ6ygnS6GoHnujQD2YsCdWpms7PCmZq+2
+9QVkZjQePXq09bUYmiDn0aQ2gU2j+CjHOhejwg+ilQb3p96D3YJyUGK4JJ3MBdUP
+cB2YfxOy8zBb3YMkJrOv6rNdi7XeuAoeE7r2Ha4IurKz131PrwIDAQABo4GUMIGR
+MB0GA1UdDgQWBBTmG6DcfrOPgZeLAYOG1DNdorT0KzBfBgNVHSMEWDBWgBRJaS2o
+JC+wrOaaAmrQ/Jqqc5ticaE7pDkwNzEPMA0GA1UECgwGSGFzc09TMSQwIgYDVQQD
+DBtIYXNzT1MgUHJvdmlzaW9uaW5nIENBIFJvb3SCAQEwDwYDVR0TBAgwBgEB/wIB
+ADANBgkqhkiG9w0BAQsFAAOCAQEAY9mkJon8TQvgUS+Ogo1pnx787b5zqPSMmVXI
+Nq9XgJ+XNKdH+67ujwNkLohZJcT35I2FS7NK6EKEAbnB9M7UnbFUNI2NDSKRSKBZ
+8Oq59KEPYwKhUsvHksCnj9ZK0hc2pRZaXwkfSDPRCovZQemuDcYVNmMO+Hudq7BJ
+TqumHVTlPzl60Ukx979PMZsNHaiRaEWw+ufmni03ifxcgGQsu80ZjNdd0LZ2l6mB
+5Ct3+aMC3IHW/r0kCzZqwg+wYNkO0wO6gNRQ8Vndv8CW7iwGzAAqz91IVQ2B5nYG
+kt9GKRDV61ycgXUtlGtbLxXjYg45UxwfSoLIE8aukYxY53CeVw==
+-----END CERTIFICATE-----
+-----BEGIN X509 CRL-----
+MIIBfzBpMA0GCSqGSIb3DQEBCwUAMDoxDzANBgNVBAoMBkhhc3NPUzEnMCUGA1UE
+AwweSGFzc09TIFByb3Zpc2lvbmluZyBDQSBSZWxlYXNlFw0xODA1MTUxNjM1NTRa
+Fw0zMjAxMjIxNjM1NTRaMA0GCSqGSIb3DQEBCwUAA4IBAQBOSgkmXR88VTMZfsjY
+NYHj2eYSSoFCLLW9CepoeCfIYeb81w6DUusZm4oqyvU+yFj5SBxV6X4ZEJaIaj8r
+jZtIbx6O6ocMQp9SX1O0OoG+/JJNm/9eezyhuMEK+OEbpVaPpjw6nvizOJMzAx3G
+hdW8u7xOVc004uDyCE0KT/5DTqQifsS1C5NhRZTrXSD4b6PY1d2wJx33zNUlD0B4
+7v4f+U9CzQJKY0og7krrlRHfwl8vpMUR4OL1Lxwju8RvcT4u5Do1gp3c7DJ/NJqr
+xHQjNseGewHQPrNe4Ix6inwIDRQLimQvF74RlmHf0G+Jf9+m5ixCOWH+ySfReCQ7
+fSiy
+-----END X509 CRL-----

buildroot-external/configs/ova_defconfig

@@ -1,29 +1,32 @@
 BR2_x86_64=y
+BR2_DL_DIR="/cache/dl"
 BR2_CCACHE=y
-BR2_CCACHE_DIR="$(TOPDIR)/ccache"
-BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_HASSIO_PATH)/patches"
+BR2_CCACHE_DIR="/cache/cc"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_HASSOS_PATH)/patches $(BR2_EXTERNAL_HASSOS_PATH)/board/ova/patches"
 BR2_TOOLCHAIN_BUILDROOT_GLIBC=y
+BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_4_14=y
 BR2_GCC_VERSION_7_X=y
 BR2_TOOLCHAIN_BUILDROOT_CXX=y
-BR2_TARGET_GENERIC_HOSTNAME="hassio.local"
-BR2_TARGET_GENERIC_ISSUE="Welcome to Hass.io"
+BR2_TARGET_GENERIC_HOSTNAME="hassio"
+BR2_TARGET_GENERIC_ISSUE="Welcome to HassOS"
 BR2_INIT_SYSTEMD=y
 BR2_TARGET_GENERIC_GETTY_PORT="tty1"
 # BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
-BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSIO_PATH)/rootfs-overlay/"
-BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSIO_PATH)/board/ova/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSIO_PATH)/board/ova/post-image.sh"
+BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
+BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/board/ova/post-image.sh"
+BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/ova"
 BR2_LINUX_KERNEL=y
-BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
-BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSIO_PATH)/board/ova/kernel.config"
+BR2_LINUX_KERNEL_CUSTOM_VERSION=y
+BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="4.14.41"
+BR2_LINUX_KERNEL_DEFCONFIG="x86_64"
+BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel.config $(BR2_EXTERNAL_HASSOS_PATH)/board/ova/kernel.config"
 BR2_LINUX_KERNEL_LZ4=y
 BR2_LINUX_KERNEL_INSTALL_TARGET=y
-BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
-BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSIO_PATH)/busybox.config"
+BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
 BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
-BR2_PACKAGE_ALSA_UTILS=y
-BR2_PACKAGE_LZ4=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_DOSFSTOOLS=y
 BR2_PACKAGE_E2FSPROGS=y
@@ -42,6 +45,7 @@ BR2_PACKAGE_DROPBEAR=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_NETWORK_MANAGER=y
 BR2_PACKAGE_NETWORK_MANAGER_MODEM_MANAGER=y
+BR2_PACKAGE_TINI=y
 BR2_PACKAGE_DOCKER_ENGINE=y
 BR2_PACKAGE_OPENVMTOOLS=y
 BR2_PACKAGE_RAUC=y
@@ -56,18 +60,24 @@ BR2_TARGET_ROOTFS_SQUASHFS=y
 BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
 # BR2_TARGET_ROOTFS_TAR is not set
 BR2_TARGET_BAREBOX=y
+BR2_TARGET_BAREBOX_CUSTOM_VERSION=y
+BR2_TARGET_BAREBOX_CUSTOM_VERSION_VALUE="2018.05.0"
 BR2_TARGET_BAREBOX_USE_CUSTOM_CONFIG=y
-BR2_TARGET_BAREBOX_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSIO_PATH)/board/ova/barebox.config"
-BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="$(BR2_EXTERNAL_HASSIO_PATH)/board/ova/barebox-env $(BR2_EXTERNAL_HASSIO_PATH)/barebox-env"
+BR2_TARGET_BAREBOX_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/ova/barebox.config"
+BR2_TARGET_BAREBOX_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/barebox.config"
+BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="$(BR2_EXTERNAL_HASSOS_PATH)/board/ova/barebox-env $(BR2_EXTERNAL_HASSOS_PATH)/barebox-env"
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
 BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_GPTFDISK=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_RAUC=y
-BR2_PACKAGE_MINGETTY=y
-BR2_PACKAGE_HASSIO=y
-BR2_PACKAGE_HASSIO_SUPERVISOR="homeassistant/amd64-hassio-supervisor"
-BR2_PACKAGE_HASSIO_SUPERVISOR_VERSION="0.101"
-BR2_PACKAGE_HASSIO_SUPERVISOR_ARGS="-e HOMEASSISTANT_REPOSITORY=homeassistant/qemux86-64-homeassistant"
-BR2_PACKAGE_HASSIO_CLI="homeassistant/amd64-hassio-cli"
-BR2_PACKAGE_HASSIO_CLI_VERSION="0.1"
+BR2_PACKAGE_HASSOS=y
+BR2_PACKAGE_HASSOS_SUPERVISOR="homeassistant/amd64-hassio-supervisor"
+BR2_PACKAGE_HASSOS_SUPERVISOR_VERSION="105"
+BR2_PACKAGE_HASSOS_SUPERVISOR_ARGS="-e HOMEASSISTANT_REPOSITORY=homeassistant/qemux86-64-homeassistant"
+BR2_PACKAGE_HASSOS_SUPERVISOR_PROFILE="hassio-supervisor"
+BR2_PACKAGE_HASSOS_CLI="homeassistant/amd64-hassio-cli"
+BR2_PACKAGE_HASSOS_CLI_VERSION="3"
+BR2_PACKAGE_HASSOS_CLI_PROFILE="docker-default"
+BR2_PACKAGE_HASSOS_APPARMOR_DIR="supervisor/apparmor"
+BR2_PACKAGE_APPARMOR=y

buildroot-external/configs/rpi2_defconfig

@@ -0,0 +1,89 @@
+BR2_arm=y
+BR2_cortex_a7=y
+BR2_ARM_FPU_VFPV4=y
+BR2_DL_DIR="/cache/dl"
+BR2_CCACHE=y
+BR2_CCACHE_DIR="/cache/cc"
+BR2_GLOBAL_PATCH_DIR="$(BR2_EXTERNAL_HASSOS_PATH)/patches $(BR2_EXTERNAL_HASSOS_PATH)/board/rpi2/patches"
+BR2_TOOLCHAIN_BUILDROOT_GLIBC=y
+BR2_PACKAGE_HOST_LINUX_HEADERS_CUSTOM_4_14=y
+BR2_GCC_VERSION_7_X=y
+BR2_TOOLCHAIN_BUILDROOT_CXX=y
+BR2_TARGET_GENERIC_HOSTNAME="hassio"
+BR2_TARGET_GENERIC_ISSUE="Welcome to HassOS"
+BR2_INIT_SYSTEMD=y
+BR2_TARGET_GENERIC_GETTY_PORT="tty1"
+# BR2_TARGET_GENERIC_REMOUNT_ROOTFS_RW is not set
+BR2_ROOTFS_OVERLAY="$(BR2_EXTERNAL_HASSOS_PATH)/rootfs-overlay"
+BR2_ROOTFS_POST_BUILD_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/scripts/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="$(BR2_EXTERNAL_HASSOS_PATH)/board/rpi2/post-image.sh"
+BR2_ROOTFS_POST_SCRIPT_ARGS="$(BR2_EXTERNAL_HASSOS_PATH)/board/rpi2"
+BR2_LINUX_KERNEL=y
+BR2_LINUX_KERNEL_CUSTOM_GIT=y
+BR2_LINUX_KERNEL_CUSTOM_REPO_URL="https://github.com/raspberrypi/linux"
+BR2_LINUX_KERNEL_CUSTOM_REPO_VERSION="rpi-4.14.y"
+BR2_LINUX_KERNEL_DEFCONFIG="bcm2709"
+BR2_LINUX_KERNEL_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/kernel.config"
+BR2_LINUX_KERNEL_LZ4=y
+BR2_LINUX_KERNEL_DTS_SUPPORT=y
+BR2_LINUX_KERNEL_INTREE_DTS_NAME="bcm2709-rpi-2-b"
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
+BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
+BR2_LINUX_KERNEL_NEEDS_HOST_LIBELF=y
+BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_HASSOS_PATH)/busybox.config"
+BR2_PACKAGE_BUSYBOX_INDIVIDUAL_BINARIES=y
+BR2_PACKAGE_JQ=y
+BR2_PACKAGE_DOSFSTOOLS=y
+BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_E2FSPROGS_RESIZE2FS=y
+BR2_PACKAGE_RPI_FIRMWARE=y
+BR2_PACKAGE_DT_UTILS=y
+BR2_PACKAGE_GPTFDISK=y
+BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_CA_CERTIFICATES=y
+BR2_PACKAGE_LIBDNET=y
+BR2_PACKAGE_LIBCGROUP=y
+BR2_PACKAGE_LIBCGROUP_TOOLS=y
+BR2_PACKAGE_AVAHI=y
+BR2_PACKAGE_AVAHI_DAEMON=y
+BR2_PACKAGE_AVAHI_LIBDNSSD_COMPATIBILITY=y
+BR2_PACKAGE_DROPBEAR=y
+# BR2_PACKAGE_DROPBEAR_CLIENT is not set
+# BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
+BR2_PACKAGE_NETWORK_MANAGER=y
+BR2_PACKAGE_NETWORK_MANAGER_MODEM_MANAGER=y
+BR2_PACKAGE_TINI=y
+BR2_PACKAGE_DOCKER_ENGINE=y
+BR2_PACKAGE_RAUC=y
+BR2_PACKAGE_RAUC_NETWORK=y
+# BR2_PACKAGE_SYSTEMD_HWDB is not set
+# BR2_PACKAGE_SYSTEMD_NETWORKD is not set
+BR2_PACKAGE_SYSTEMD_RANDOMSEED=y
+# BR2_PACKAGE_SYSTEMD_RESOLVED is not set
+BR2_PACKAGE_UTIL_LINUX_PARTX=y
+BR2_PACKAGE_UTIL_LINUX_ZRAMCTL=y
+BR2_TARGET_ROOTFS_SQUASHFS=y
+BR2_TARGET_ROOTFS_SQUASHFS4_LZ4=y
+# BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_BAREBOX=y
+BR2_TARGET_BAREBOX_CUSTOM_VERSION=y
+BR2_TARGET_BAREBOX_CUSTOM_VERSION_VALUE="2018.05.0"
+BR2_TARGET_BAREBOX_USE_CUSTOM_CONFIG=y
+BR2_TARGET_BAREBOX_CUSTOM_CONFIG_FILE="$(BR2_EXTERNAL_HASSOS_PATH)/board/rpi2/barebox.config"
+BR2_TARGET_BAREBOX_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_HASSOS_PATH)/barebox.config"
+BR2_TARGET_BAREBOX_CUSTOM_EMBEDDED_ENV_PATH="$(BR2_EXTERNAL_HASSOS_PATH)/barebox-env $(BR2_EXTERNAL_HASSOS_PATH)/board/rpi2/barebox-env"
+BR2_PACKAGE_HOST_DOSFSTOOLS=y
+BR2_PACKAGE_HOST_E2FSPROGS=y
+BR2_PACKAGE_HOST_GPTFDISK=y
+BR2_PACKAGE_HOST_MTOOLS=y
+BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HASSOS=y
+BR2_PACKAGE_HASSOS_SUPERVISOR="homeassistant/armhf-hassio-supervisor"
+BR2_PACKAGE_HASSOS_SUPERVISOR_VERSION="105"
+BR2_PACKAGE_HASSOS_SUPERVISOR_ARGS="-e HOMEASSISTANT_REPOSITORY=homeassistant/raspberrypi3-homeassistant"
+BR2_PACKAGE_HASSOS_SUPERVISOR_PROFILE="hassio-supervisor"
+BR2_PACKAGE_HASSOS_CLI="homeassistant/armhf-hassio-cli"
+BR2_PACKAGE_HASSOS_CLI_VERSION="3"
+BR2_PACKAGE_HASSOS_CLI_PROFILE="docker-default"
+BR2_PACKAGE_HASSOS_APPARMOR_DIR="supervisor/apparmor"
+BR2_PACKAGE_APPARMOR=y

buildroot-external/external.desc

@@ -1,2 +1,2 @@
-name: HASSIO
-desc: HassIO Buildroot tree
+name: HASSOS
+desc: HassOS Buildroot tree

buildroot-external/external.mk

@@ -1 +1 @@
-include $(sort $(wildcard $(BR2_EXTERNAL_HASSIO_PATH)/package/*/*.mk))
+include $(sort $(wildcard $(BR2_EXTERNAL_HASSOS_PATH)/package/*/*.mk))

buildroot-external/info

@@ -0,0 +1,7 @@
+VERSION_MAJOR=0
+VERSION_BUILD=3
+
+HASSOS_NAME="HassOS"
+HASSOS_ID="hassos"
+
+DEPLOYMENT="development"

buildroot-external/kernel.config

@@ -0,0 +1,99 @@
+CONFIG_KERNEL_LZ4=y
+CONFIG_CMDLINE=""
+
+CONFIG_ZRAM=y
+CONFIG_ZSMALLOC=y
+
+CONFIG_POSIX_MQUEUE=y
+CONFIG_CFQ_GROUP_IOSCHED=y
+CONFIG_CFS_BANDWIDTH=y
+CONFIG_FAIR_GROUP_SCHED=y
+CONFIG_RT_GROUP_SCHED=y
+CONFIG_NET_SCHED=y
+
+CONFIG_CGROUPS=y
+CONFIG_BLK_CGROUP=y
+CONFIG_BLK_DEV_THROTTLING=y
+CONFIG_CGROUP_SCHED=y
+CONFIG_CGROUP_PIDS=y
+CONFIG_CGROUP_FREEZER=y
+CONFIG_CGROUP_HUGETLB=y
+CONFIG_CGROUP_DEVICE=y
+CONFIG_CGROUP_CPUACCT=y
+CONFIG_CGROUP_PERF=y
+CONFIG_NET_CLS_CGROUP=y
+CONFIG_CGROUP_NET_PRIO=y
+
+CONFIG_MEMCG=y
+CONFIG_MEMCG_SWAP=y
+
+CONFIG_NAMESPACES=y
+CONFIG_USER_NS=y
+CONFIG_PID_NS=y
+CONFIG_IPC_NS=y
+CONFIG_UTS_NS=y
+
+CONFIG_NETDEVICES=y
+CONFIG_DUMMY=y
+CONFIG_MACVLAN=y
+CONFIG_IPVLAN=y
+CONFIG_VXLAN=y
+
+CONFIG_INET=y
+CONFIG_IPV6=y
+CONFIG_INET_ESP=y
+CONFIG_INET_XFRM_MODE_TRANSPORT=y
+CONFIG_NETCONSOLE=y
+CONFIG_VETH=y
+CONFIG_NETFILTER=y
+CONFIG_NF_CONNTRACK=y
+CONFIG_NF_NAT=y
+CONFIG_NF_NAT_NEEDED=y
+CONFIG_NF_CONNTRACK_IPV4=y
+CONFIG_NF_CONNTRACK_FTP=y
+CONFIG_NF_CONNTRACK_TFTP=y
+CONFIG_NETFILTER_ADVANCED=y
+CONFIG_NETFILTER_XT_MATCH_ADDRTYPE=y
+CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
+CONFIG_NETFILTER_XT_MATCH_IPVS=y
+CONFIG_IP_VS=y
+CONFIG_IP_VS_RR=y
+CONFIG_IP_VS_NFCT=y
+CONFIG_IP_NF_IPTABLES=y
+CONFIG_IP_NF_FILTER=y
+CONFIG_IP_NF_NAT=y
+CONFIG_IP_NF_TARGET_MASQUERADE=y
+CONFIG_BRIDGE=y
+CONFIG_BRIDGE_NETFILTER=y
+CONFIG_XFRM=y
+CONFIG_XFRM_USER=y
+CONFIG_XFRM_ALGO=y
+CONFIG_NET_L3_MASTER_DEV=y
+
+CONFIG_EXT4_FS=y
+CONFIG_EXT4_FS_POSIX_ACL=y
+CONFIG_EXT4_FS_SECURITY=y
+CONFIG_OVERLAY_FS=y
+CONFIG_MSDOS_FS=y
+CONFIG_VFAT_FS=y
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_XATTR=y
+CONFIG_SQUASHFS_LZ4=y
+
+# CONFIG_SECCOMP is not set
+CONFIG_SECURITY=y
+CONFIG_SECURITY_APPARMOR=y
+CONFIG_SECURITY_APPARMOR_BOOTPARAM_VALUE=1
+CONFIG_KEYS=y
+
+CONFIG_CRYPTO_CCM=y
+CONFIG_CRYPTO_GCM=y
+CONFIG_CRYPTO_CMAC=y
+CONFIG_CRYPTO_ARC4=y
+CONFIG_CRYPTO_LZ4=y
+
+CONFIG_PARTITION_ADVANCED=y
+CONFIG_EFI_PARTITION=y
+
+# CONFIG_LOGO is not set
+# CONFIG_VIRTUALIZATION is not set

buildroot-external/package/apparmor/Config.in

@@ -0,0 +1,9 @@
+config BR2_PACKAGE_APPARMOR
+	bool "apparmor"
+	select BR2_PACKAGE_LIBAPPARMOR
+	help
+	  AppArmor gives you network application security via mandatory 
+	  access control for programs, protecting against the exploitation 
+	  of software flaws and compromised systems.
+
+	  http://apparmor.net

buildroot-external/package/apparmor/apparmor.mk

@@ -0,0 +1,24 @@
+#############################################################
+#
+# apparmor
+#
+#############################################################
+APPARMOR_VERSION = v2.13
+APPARMOR_SITE = git://git.launchpad.net/apparmor
+APPARMOR_LICENSE = GPL-2
+APPARMOR_LICENSE_FILES = LICENSE
+APPARMOR_DEPENDENCIES = libapparmor
+
+define APPARMOR_BUILD_CMDS
+	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) PATH=$(BR_PATH) $(MAKE) -C $(@D)/parser USE_SYSTEM=1 YACC=bison LEX=flex 
+	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D)/profiles
+endef
+
+define APPARMOR_INSTALL_TARGET_CMDS
+	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D)/parser DESTDIR=$(TARGET_DIR) USE_SYSTEM=1 PREFIX=/usr install
+	$(TARGET_MAKE_ENV) $(TARGET_CONFIGURE_OPTS) $(MAKE) -C $(@D)/profiles DESTDIR=$(TARGET_DIR) PREFIX=/usr install
+
+	rm -rf $(TARGET_DIR)/usr/lib/apparmor
+endef
+
+$(eval $(generic-package))

buildroot-external/package/hassio/Config.in

@@ -1,41 +0,0 @@
-config BR2_PACKAGE_HASSIO
-	bool "hassio-app"
-	help
-	  This is the Application layer they build the
-	  data partition with configurations.
-
-	  https://github.com/home-assistant/hassio-os
-
-if BR2_PACKAGE_HASSIO
-
-config BR2_PACKAGE_HASSIO_SUPERVISOR
-	string "supervisor docker image"
-	help
-	  Name of supervisor docker image they will be build in.
-
-config BR2_PACKAGE_HASSIO_SUPERVISOR_VERSION
-	string "supervisor docker image version"
-	help
-	  Version of supervisor docker image they will be build in.
-
-config BR2_PACKAGE_HASSIO_SUPERVISOR_ARGS
-	string "supervisor docker arguments"
-	help
-	  Extended docker arguments to run the supervisor.
-
-config BR2_PACKAGE_HASSIO_CLI
-	string "cli docker image"
-	help
-	  Name of cli docker image they will be build in.
-
-config BR2_PACKAGE_HASSIO_CLI_VERSION
-	string "cli docker image version"
-	help
-	  Version of cli docker image they will be build in.
-
-config BR2_PACKAGE_HASSIO_CLI_ARGS
-	string "cli docker arguments"
-	help
-	  Extended docker arguments to run the cli.
-
-endif

buildroot-external/package/hassio/hassio.mk

@@ -1,27 +0,0 @@
-################################################################################
-#
-# hassio
-#
-################################################################################
-
-HASSIO_VERSION = 1.0.0
-HASSIO_LICENSE = Apache License 2.0
-HASSIO_LICENSE_FILES = $(BR2_EXTERNAL_HASSIO_PATH)/../LICENSE
-HASSIO_SITE = $(BR2_EXTERNAL_HASSIO_PATH)/package/hassio
-HASSIO_SITE_METHOD = local
-
-define HASSIO_BUILD_CMDS
-	docker build --tag hassio-hostapps $(@D)/builder
-endef
-
-define HASSIO_INSTALL_TARGET_CMDS
-	docker run --rm --privileged -v ${BINARIES_DIR}:/export hassio-hostapps \
-		--supervisor ${BR2_PACKAGE_HASSIO_SUPERVISOR} \
-		--supervisor-version ${BR2_PACKAGE_HASSIO_SUPERVISOR_VERSION} \
-		--supervisor-args ${BR2_PACKAGE_HASSIO_SUPERVISOR_ARGS} \
-		--cli ${BR2_PACKAGE_HASSIO_CLI} \
-		--cli-version ${BR2_PACKAGE_HASSIO_CLI_VERSION} \
-		--cli-args ${BR2_PACKAGE_HASSIO_CLI_ARGS}
-endef
-
-$(eval $(generic-package))

buildroot-external/package/hassos/Config.in

@@ -0,0 +1,56 @@
+menuconfig BR2_PACKAGE_HASSOS
+	bool "hassos-app"
+	help
+	  This is the Application layer they build the
+	  data partition with configurations.
+
+	  https://github.com/home-assistant/hassos
+
+if BR2_PACKAGE_HASSOS
+
+config BR2_PACKAGE_HASSOS_SUPERVISOR
+	string "supervisor docker image"
+	help
+	  Name of supervisor docker image they will be build in.
+
+config BR2_PACKAGE_HASSOS_SUPERVISOR_VERSION
+	string "supervisor docker image version"
+	help
+	  Version of supervisor docker image they will be build in.
+
+config BR2_PACKAGE_HASSOS_SUPERVISOR_ARGS
+	string "supervisor docker arguments"
+	help
+	  Extended docker arguments to run the supervisor.
+
+config BR2_PACKAGE_HASSOS_SUPERVISOR_PROFILE
+	string "AppArmor supervisor profile"
+	help
+	  AppArmor profile for supervisor.
+
+config BR2_PACKAGE_HASSOS_CLI
+	string "cli docker image"
+	help
+	  Name of cli docker image they will be build in.
+
+config BR2_PACKAGE_HASSOS_CLI_VERSION
+	string "cli docker image version"
+	help
+	  Version of cli docker image they will be build in.
+
+config BR2_PACKAGE_HASSOS_CLI_ARGS
+	string "cli docker arguments"
+	help
+	  Extended docker arguments to run the cli.
+
+config BR2_PACKAGE_HASSOS_CLI_PROFILE
+	string "AppArmor cli profile"
+	help
+	  AppArmor profile for cli.
+
+config BR2_PACKAGE_HASSOS_APPARMOR_DIR
+	string "AppArmor profiles folder"
+	help
+	  AppArmor profiles folder for supervisor.
+
+endif

buildroot-external/package/hassos/builder/hostapp.sh

@@ -4,9 +4,12 @@ set -e
 SUPERVISOR=""
 SUPERVISOR_VERSION=""
 SUPERVISOR_ARGS=""
+SUPERVISOR_PROFILE=""
 CLI=""
 CLI_VERSION=""
 CLI_ARGS=""
+CLI_PROFILE=""
+APPARMOR=""
 DATA_IMG="/export/data.ext4"
 
 # Parse
@@ -25,6 +28,10 @@ while [[ $# -gt 0 ]]; do
             SUPERVISOR_ARGS=$2
             shift
             ;;
+        --supervisor-profile)
+            SUPERVISOR_PROFILE=$2
+            shift
+            ;;
         --cli)
             CLI=$2
             shift
@@ -37,6 +44,14 @@ while [[ $# -gt 0 ]]; do
             CLI_ARGS=$2
             shift
             ;;
+        --cli-profile)
+            CLI_PROFILE=$2
+            shift
+            ;;
+        --apparmor)
+            APPARMOR=$2
+            shift
+            ;;
         *)
             exit 1
             ;;
@@ -46,20 +61,19 @@ done
 
 # Make image
 dd if=/dev/zero of=${DATA_IMG} bs=1G count=1
-mkfs.ext4 -L "hassio-data" -E lazy_itable_init=0,lazy_journal_init=0 ${DATA_IMG}
+mkfs.ext4 -L "hassos-data" -E lazy_itable_init=0,lazy_journal_init=0 ${DATA_IMG}
 
 # Mount / init file structs
-mount -o loop ${DATA_IMG} /mnt
-mkdir -p /mnt/docker
-mkdir -p /mnt/supervisor
-mkdir -p /mnt/cli
+mkdir -p /mnt/data/
+mount -o loop ${DATA_IMG} /mnt/data
+mkdir -p /mnt/data/docker
 
 # Run dockerd
-dockerd -s overlay2 -g /mnt/docker 2> /dev/null &
+dockerd -s overlay2 -g /mnt/data/docker &
 DOCKER_PID=$!
 
+DOCKER_COUNT=0
 until docker info >/dev/null 2>&1; do
-    DOCKER_COUNT=0
     if [ ${DOCKER_COUNT} -gt 30 ]; then
         exit 1
     fi
@@ -77,14 +91,23 @@ docker pull "${CLI}:${CLI_VERSION}"
 docker tag "${CLI}:${CLI_VERSION}" "${CLI}:latest"
 
 # Write config
-cat > /mnt/hassio.json <<- EOF
+cat > /mnt/data/hassos.json <<- EOF
 {
     "supervisor": "${SUPERVISOR}",
     "supervisor_args": "${SUPERVISOR_ARGS}",
+    "supervisor_apparmor": "${SUPERVISOR_PROFILE}",
     "cli": "${CLI}",
-    "cli_args": "${CLI_ARGS}"
+    "cli_args": "${CLI_ARGS}",
+    "cli_apparmor": "${CLI_PROFILE}",
+    "apparmor": "${APPARMOR}"
 }
 EOF
 
+# Setup AppArmor
+if [ ! -z "${APPARMOR}" ]; then
+    mkdir -p /mnt/data/${APPARMOR}
+    cp -f /apparmor/* /mnt/data/${APPARMOR}/
+fi
+
 # Finish
-kill -TERM $DOCKER_PID && wait $DOCKER_PID && umount /mnt
+kill -TERM $DOCKER_PID && wait $DOCKER_PID && umount /mnt/data

buildroot-external/package/hassos/hassos.mk

@@ -0,0 +1,33 @@
+################################################################################
+#
+# HassOS
+#
+################################################################################
+
+HASSOS_VERSION = 1.0.0
+HASSOS_LICENSE = Apache License 2.0
+HASSOS_LICENSE_FILES = $(BR2_EXTERNAL_HASSOS_PATH)/../LICENSE
+HASSOS_SITE = $(BR2_EXTERNAL_HASSOS_PATH)/package/hassos
+HASSOS_SITE_METHOD = local
+
+define HASSOS_BUILD_CMDS
+	docker build --tag hassos-hostapps $(@D)/builder
+endef
+
+define HASSOS_INSTALL_TARGET_CMDS
+	docker run --rm --privileged \
+		-v $(BINARIES_DIR):/export \
+		-v $(BR2_EXTERNAL_HASSOS_PATH)/apparmor:/apparmor \
+		hassos-hostapps \
+		--supervisor $(BR2_PACKAGE_HASSOS_SUPERVISOR) \
+		--supervisor-version $(BR2_PACKAGE_HASSOS_SUPERVISOR_VERSION) \
+		--supervisor-args $(BR2_PACKAGE_HASSOS_SUPERVISOR_ARGS) \
+		--supervisor-profile $(BR2_PACKAGE_HASSOS_SUPERVISOR_PROFILE) \
+		--cli $(BR2_PACKAGE_HASSOS_CLI) \
+		--cli-version $(BR2_PACKAGE_HASSOS_CLI_VERSION) \
+		--cli-args $(BR2_PACKAGE_HASSOS_CLI_ARGS) \
+		--cli-profile $(BR2_PACKAGE_HASSOS_CLI_PROFILE) \
+		--apparmor $(BR2_PACKAGE_HASSOS_APPARMOR_DIR)
+endef
+
+$(eval $(generic-package))

buildroot-external/package/libapparmor/Config.in

@@ -0,0 +1,8 @@
+config BR2_PACKAGE_LIBAPPARMOR
+	bool "libapparmor"
+	help
+	  AppArmor gives you network application security via mandatory 
+	  access control for programs, protecting against the exploitation 
+	  of software flaws and compromised systems.
+
+	  http://apparmor.net

buildroot-external/package/libapparmor/libapparmor.mk

@@ -0,0 +1,18 @@
+#############################################################
+#
+# libapparmor
+#
+#############################################################
+LIBAPPARMOR_VERSION = v2.13
+LIBAPPARMOR_SITE = git://git.launchpad.net/apparmor
+LIBAPPARMOR_LICENSE = GPL-2
+LIBAPPARMOR_LICENSE_FILES = LICENSE
+LIBAPPARMOR_INSTALL_STAGING = YES
+LIBAPPARMOR_INSTALL_TARGET = NO
+LIBAPPARMOR_DEPENDENCIES = host-flex
+LIBAPPARMOR_SUBDIR = libraries/libapparmor
+LIBAPPARMOR_CONF_ENV = ac_cv_func_reallocarray=no
+LIBAPPARMOR_AUTORECONF = YES
+LIBAPPARMOR_CONF_OPTS = --enable-static
+
+$(eval $(autotools-package))

buildroot-external/package/mingetty/0001-mingetty-utf8.patch

@@ -1,156 +0,0 @@
-diff -Nru mingetty-1.07.orig/mingetty.c mingetty-1.07/mingetty.c
---- mingetty-1.07.orig/mingetty.c	2004-01-03 15:15:56.000000000 +0200
-+++ mingetty-1.07/mingetty.c	2006-11-22 22:13:26.967910100 +0200
-@@ -16,10 +16,15 @@
-  * - autologin only at first login
-  * - /etc/mingetty.conf that can be used instead of /etc/inittab for
-  *   command line options
-- * - Can UTF-8 setup be done within mingetty?
-+ * - Can UTF-8 setup be done within mingetty? Let's try now :-) (VinzC)
-  * - Also add /bin/login-type functionality in here?
-  */
- 
-+/* Additional comments: Vincent Cadet <vcadet@hotmail.com> (2006-11-21)
-+ * - Attempt to make mingetty support UTF-8. Modifications were imported
-+ *   from Suse migetty.c 0.9.6s.
-+ */
-+
- #include <stdio.h>
- #include <stdlib.h>
- #include <unistd.h>
-@@ -39,6 +44,19 @@
- #include <syslog.h>
- #include <sys/utsname.h>
- #include <time.h>
-+#include <locale.h>
-+#include <iconv.h>
-+#include <wctype.h>
-+#include <sys/kd.h>
-+#include <sys/ttydefaults.h>
-+
-+#ifndef IUTF8
-+# ifndef ASM_IUTF8
-+#  error ASM_IUTF8 input flag not defined - Cannot define IUTF8
-+# else
-+#  define IUTF8	ASM_IUTF8
-+# endif
-+#endif
- 
- /* name of this program (argv[0]) */
- static char *progname;
-@@ -74,6 +92,8 @@
- static char *autologin = NULL;
- /* try to read a char before dropping to login prompt */
- static int loginpause = 0;
-+/* terminal mode */
-+static int mode = K_RAW;
- 
- /* error() - output error messages */
- static void error (const char *fmt, ...)
-@@ -187,10 +207,21 @@
- 	if (fd > 2)
- 		close (fd);
- 
-+	/* Detect mode of current keyboard setup, e.g. for UTF-8 */
-+	if (ioctl(0, KDGKBMODE, &mode) < 0)
-+		mode = K_RAW;
-+
- 	/* Write a reset string to the terminal. This is very linux-specific
- 	   and should be checked for other systems. */
- 	if (noclear == 0)
--		write (0, "\033c", 2);
-+		/* don't write a full reset (ESC c) because this leaves the 
-+		   unicode mode again if the terminal was in unicode mode
-+		   and also undos the ESC sequences in CONSOLE_MAGIC which
-+		   are needed for some languages/console-fonts.
-+		   Just put the cursor to the home position (ESC [ H),
-+		   erase everything below the cursor (ESC [ J), and set the
-+		   scrolling region to the full window (ESC [ r) */
-+		write (0, "\033[r\033[H\033[J", 9);
- 
- 	sigaction (SIGHUP, &sa_old, NULL);
- }
-@@ -292,32 +323,75 @@
- 
- static char *get_logname (void)
- {
--	static char logname[40];
-+	static char logname[4*UT_NAMESIZE];
- 	char *bp;
- 	unsigned char c;
-+	int ascii;
-+	iconv_t ic;
- 
- 	tcflush (0, TCIFLUSH);		/* flush pending input */
-+
-+	/* Check for UTF-8 mode */
-+	switch(mode) {
-+		case K_UNICODE:
-+			ascii = 0;
-+			setlocale(LC_CTYPE, "en_US.UTF-8");
-+			break;
-+		case K_RAW:
-+		case K_MEDIUMRAW:
-+		case K_XLATE:
-+		default:
-+			ascii = 1;
-+			setlocale(LC_CTYPE, "POSIX");
-+			break;
-+	}
-+
- 	for (*logname = 0; *logname == 0;) {
- 		do_prompt (1);
- 		for (bp = logname;;) {
- 			if (read (0, &c, 1) < 1) {
--				if (errno == EINTR || errno == EIO
--					|| errno == ENOENT)
-+				if (errno == EINTR || errno == EAGAIN) {
-+					usleep(1000);
-+					continue;
-+				}
-+				if (errno == EIO || errno == ENOENT)
- 					exit (EXIT_SUCCESS);
- 				error ("%s: read: %s", tty, strerror (errno));
- 			}
- 			if (c == '\n' || c == '\r') {
- 				*bp = 0;
- 				break;
--			} else if (!isprint (c))
--				error ("%s: invalid character 0x%x in login"
--					" name", tty, c);
-+			}
-+
-+			if (ascii && !isprint (c))
-+				error ("%s: invalid character 0x%x in login name", tty, c);
- 			else if ((size_t)(bp - logname) >= sizeof (logname) - 1)
- 				error ("%s: too long login name", tty);
--			else
--				*bp++ = c;
-+
-+			*bp++ = c;
- 		}
- 	}
-+
-+	if (!ascii && (ic = iconv_open("WCHAR_T", "UTF-8"))) {
-+		char tmpbuf[4*sizeof(logname)], *op, *lp;
-+		size_t len = bp - logname;
-+		size_t out = sizeof(tmpbuf) - 1;
-+		size_t wcl;
-+		wint_t *wcp;
-+
-+		op = tmpbuf;
-+		lp = logname;
-+		if ((wcl = iconv(ic , &lp, &len, &op, &out)) == (size_t)-1)
-+			error ("%s: invalid character conversion for login name", tty);
-+		iconv_close(ic);
-+
-+		wcp = (wint_t*)tmpbuf;
-+		wcp[wcl] = (wint_t)0;
-+		while (*wcp) {
-+			if (!iswprint(*wcp++))
-+				error ("%s: invalid character for login name found", tty);
-+ 		}
-+ 	}
- 	return logname;
- }
-

buildroot-external/package/mingetty/Config.in

@@ -1,7 +0,0 @@
-config BR2_PACKAGE_MINGETTY
-	bool "mingetty"
-	help
-	  mingetty is a minimal getty for use on virtual consoles and is not
-	  suitable for use on serial lines.
-
-	  http://sourceforge.net/projects/mingetty/

buildroot-external/package/mingetty/mingetty.hash

@@ -1 +0,0 @@
-sha1 283acd3dc9da2c9eb71d5d7cc01d1bd178254523 mingetty-1.08.tar.gz

buildroot-external/package/mingetty/mingetty.mk

@@ -1,22 +0,0 @@
-#############################################################
-#
-# mingetty
-#
-#############################################################
-MINGETTY_VERSION = 1.08
-MINGETTY_SOURCE  = mingetty-$(MINGETTY_VERSION).tar.gz
-MINGETTY_SITE    = http://downloads.sourceforge.net/project/mingetty/mingetty/$(MINGETTY_VERSION)
-
-define MINGETTY_BUILD_CMDS
-	$(MAKE) CC=$(TARGET_CC) -C $(@D)
-endef
-
-define MINGETTY_INSTALL_TARGET_CMDS
-	$(INSTALL) -D -m 0755 $(@D)/mingetty $(TARGET_DIR)/sbin
-endef
-
-define MINGETTY_CLEAN_CMDS
-	$(MAKE) -C $(@D) clean
-endef
-
-$(eval $(generic-package))

buildroot-external/patches/barebox/0003-drivers-of-bugfix-local-fixups-resolving.patch

@@ -0,0 +1,204 @@
+From 6c7c35474f066f53b6f63cc0cc5eaefac2bc69dd Mon Sep 17 00:00:00 2001
+From: Pascal Vizeli <pvizeli@syshack.ch>
+Date: Sat, 2 Jun 2018 20:53:51 +0000
+Subject: [PATCH 3/3] drivers: of: bugfix local fixups resolving
+
+Signed-off-by: Pascal Vizeli <pvizeli@syshack.ch>
+---
+ drivers/of/resolver.c | 147 +++++++++++++++++-------------------------
+ 1 file changed, 60 insertions(+), 87 deletions(-)
+
+diff --git a/drivers/of/resolver.c b/drivers/of/resolver.c
+index 62476093c..fbab565c5 100644
+--- a/drivers/of/resolver.c
++++ b/drivers/of/resolver.c
+@@ -66,108 +66,73 @@ static void of_adjust_tree_phandles(struct device_node *node,
+  * of the tree. Does not take any devtree locks so make sure you
+  * call this on a tree which is at the detached state.
+  */
+-static int of_adjust_tree_phandle_references(struct device_node *node,
+-		int phandle_delta)
++static int of_adjust_tree_phandle_references(struct device_node *local_fixups,
++		struct device_node *overlay, int phandle_delta)
+ {
+ 	phandle phandle;
+-	struct device_node *refnode, *child;
+-	struct property *rprop, *sprop;
+-	char *propval, *propcur, *propend, *nodestr, *propstr, *s;
+-	int offset, propcurlen;
+-	int err;
++	struct device_node *child, *overlay_child;
++	struct property *fixprop, *prop;
++	int i, count, err;
++	unsigned int off;
+ 	bool found = false;
+ 
+-	/* locate the symbols & fixups nodes on resolve */
+-	for_each_child_of_node(node, child)
+-		if (of_node_cmp(child->name, "__local_fixups__") == 0) {
+-			found = true;
+-			break;
+-		}
+-
+-	/* no local fixups */
+-	if (!found)
+-		return 0;
+-
+-	/* find the local fixups property */
+-	for_each_property_of_node(child, rprop) {
++	for_each_property_of_node(local_fixups, fixprop) {
+ 		/* skip properties added automatically */
+-		if (of_prop_cmp(rprop->name, "name") == 0)
++		if (!of_prop_cmp(fixprop->name, "name") ||
++		    !of_prop_cmp(fixprop->name, "phandle") ||
++		    !of_prop_cmp(fixprop->name, "linux,phandle"))
+ 			continue;
+ 
+-		/* make a copy */
+-		propval = kmalloc(rprop->length, GFP_KERNEL);
+-		if (propval == NULL) {
+-			pr_err("%s: Could not copy value of '%s'\n",
+-					__func__, rprop->name);
+-			return -ENOMEM;
+-		}
+-		memcpy(propval, rprop->value, rprop->length);
+-
+-		propend = propval + rprop->length;
+-		for (propcur = propval; propcur < propend;
+-				propcur += propcurlen + 1) {
++		if ((fixprop->length % 4) != 0 || fixprop->length == 0)
++			return -EINVAL;
++		count = fixprop->length / sizeof(uint32_t);
+ 
+-			propcurlen = strlen(propcur);
+-
+-			nodestr = propcur;
+-			s = strchr(propcur, ':');
+-			if (s == NULL) {
+-				pr_err("%s: Illegal symbol entry '%s' (1)\n",
+-					__func__, propcur);
+-				err = -EINVAL;
+-				goto err_fail;
+-			}
+-			*s++ = '\0';
+-
+-			propstr = s;
+-			s = strchr(s, ':');
+-			if (s == NULL) {
+-				pr_err("%s: Illegal symbol entry '%s' (2)\n",
+-					__func__, (char *)rprop->value);
+-				err = -EINVAL;
+-				goto err_fail;
++		for_each_property_of_node(overlay, prop) {
++			if (!of_prop_cmp(fixprop->name, prop->name)) {
++				found = true;
++				break;
+ 			}
++		}
+ 
+-			*s++ = '\0';
+-			offset = simple_strtoul(s, NULL, 10);
++		if (!found)
++			return -EINVAL;
+ 
+-			/* look into the resolve node for the full path */
+-			refnode = of_find_node_by_path_from(node, nodestr);
+-			if (refnode == NULL) {
+-				pr_warn("%s: Could not find refnode '%s'\n",
+-					__func__, (char *)rprop->value);
+-				continue;
+-			}
++		for (i=0; i < count; i++) {
++			off = be32_to_cpu(((uint32_t *)fixprop->value)[i]);
++			if ((off + 4) > prop->length)
++				return -EINVAL;
+ 
+-			/* now find the property */
+-			found = false;
+-			for_each_property_of_node(refnode, sprop)
+-				if (of_prop_cmp(sprop->name, propstr) == 0) {
+-					found = true;
+-					break;
+-				}
++			phandle = be32_to_cpu(*(uint32_t *)(prop->value + off));
++			phandle += phandle_delta;
++			*(uint32_t *)(prop->value + off) = cpu_to_be32(phandle);
++		}
++	}
+ 
+-			if (!found) {
+-				pr_err("%s: Could not find property '%s'\n",
+-					__func__, (char *)rprop->value);
+-				err = -ENOENT;
+-				goto err_fail;
++	/*
++	 * These nested loops recurse down two subtrees in parallel, where the
++	 * node names in the two subtrees match.
++	 *
++	 * The roots of the subtrees are the overlay's __local_fixups__ node
++	 * and the overlay's root node.
++	 */
++	for_each_child_of_node(local_fixups, child) {
++
++		for_each_child_of_node(overlay, overlay_child)
++			if (!of_node_cmp(child->name, overlay_child->name)) {
++				found = true;
++				break;
+ 			}
+ 
+-			phandle = be32_to_cpu(*(uint32_t *)
+-					(sprop->value + offset));
+-			*(uint32_t *)(sprop->value + offset) =
+-				cpu_to_be32(phandle + phandle_delta);
+-		}
++		if (!found)
++			return -EINVAL;
+ 
+-		kfree(propval);
++		err = of_adjust_tree_phandle_references(child, overlay_child,
++				phandle_delta);
++		if (err)
++			return err;
+ 	}
+ 
+ 	return 0;
+-
+-err_fail:
+-	kfree(propval);
+-	return err;
+ }
+ 
+ /**
+@@ -185,7 +150,7 @@ err_fail:
+  */
+ int of_resolve(struct device_node *resolve)
+ {
+-	struct device_node *child, *refnode;
++	struct device_node *child, *refnode, *local_fixups;
+ 	struct device_node *root_sym, *resolve_sym, *resolve_fix;
+ 	struct property *rprop, *sprop;
+ 	const char *refpath;
+@@ -203,9 +168,17 @@ int of_resolve(struct device_node *resolve)
+ 	/* first we need to adjust the phandles */
+ 	phandle_delta = of_get_tree_max_phandle(NULL) + 1;
+ 	of_adjust_tree_phandles(resolve, phandle_delta);
+-	err = of_adjust_tree_phandle_references(resolve, phandle_delta);
+-	if (err != 0)
+-		return err;
++
++	/* second we need lookup local fixups of phandles */
++	for_each_child_of_node(resolve, local_fixups) {
++		if (!of_node_cmp(local_fixups->name, "__local_fixups__")) {
++			err = of_adjust_tree_phandle_references(local_fixups,
++					resolve, phandle_delta);
++			if (err != 0)
++				return err;
++			break;
++		}
++	}
+ 
+ 	root_sym = NULL;
+ 	resolve_sym = NULL;
+-- 
+2.17.0
+

buildroot-external/patches/systemd/0001-Allow-hostname-on-ro.patch

@@ -0,0 +1,41 @@
+From 525b60af3320de3cc1f1145fe31a2de07b61faf6 Mon Sep 17 00:00:00 2001
+From: Pascal Vizeli <pvizeli@syshack.ch>
+Date: Sat, 28 Apr 2018 00:20:08 +0200
+Subject: [PATCH 1/1] Allow hostname on ro
+
+---
+ src/hostname/hostnamed.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+diff --git a/src/hostname/hostnamed.c b/src/hostname/hostnamed.c
+index d9ad2fb..87fae35 100644
+--- a/src/hostname/hostnamed.c
++++ b/src/hostname/hostnamed.c
+@@ -289,6 +289,7 @@ static int context_update_kernel_hostname(Context *c) {
+ static int context_write_data_static_hostname(Context *c) {
+ 
+         assert(c);
++        FILE *f = NULL;
+ 
+         if (isempty(c->data[PROP_STATIC_HOSTNAME])) {
+ 
+@@ -297,7 +298,15 @@ static int context_write_data_static_hostname(Context *c) {
+ 
+                 return 0;
+         }
+-        return write_string_file_atomic_label("/etc/hostname", c->data[PROP_STATIC_HOSTNAME]);
++
++        f = fopen("/etc/hostname", "w");
++        if (f == NULL)
++                return -ENOENT;
++
++        fputs(c->data[PROP_STATIC_HOSTNAME], f);
++        fclose(f);
++
++	return 0;
+ }
+ 
+ static int context_write_data_machine_info(Context *c) {
+-- 
+2.7.4
+

buildroot-external/rootfs-overlay/etc/rauc/keyring.pem

@@ -1,32 +0,0 @@
------BEGIN CERTIFICATE-----
-MIIFlTCCA32gAwIBAgIJAI6l4ha3dDFUMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNV
-BAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMRcwFQYDVQQKDA5Ib21lLUFzc2lz
-dGFudDESMBAGA1UECwwJSGFzc0lPLU9TMRAwDgYDVQQDDAdoYXNzLmlvMB4XDTE4
-MDMxOTIyMDUxMVoXDTE4MDQxODIyMDUxMVowYTELMAkGA1UEBhMCQVUxEzARBgNV
-BAgMClNvbWUtU3RhdGUxFzAVBgNVBAoMDkhvbWUtQXNzaXN0YW50MRIwEAYDVQQL
-DAlIYXNzSU8tT1MxEDAOBgNVBAMMB2hhc3MuaW8wggIiMA0GCSqGSIb3DQEBAQUA
-A4ICDwAwggIKAoICAQDimsS43XuZnjiGn1liLeVzTHPzeJP3cqUpHfjfh5UWZ57Y
-oQqMTmsC9t/5cbjiGj7RoSdv8P9KJzYoaPNOST+nflR5k0RM3EK2t/5nlUNTFKQi
-83xyECWeeOLypQRrT4oHFeURBkIExQwjEGMs1a3hZcS2cVjAe8qUjDNmQR+3AYB9
-aCt26cRgYGowJAgZwv2GGQTMLHxI+LQV7odSKhxY8L+GheeoyNHVyzBhrPBtA0B1
-/EPtfFLBgarBFUQAzlF0aNGbrnlev1iohYhny7LPh+PUkshmouIIHp7Z7nL5Gg6f
-yONu4fFeeyL7CHRxrk+hA9v+x+UFdOd25kTjcMQgo/q4tfjZ+4NqqZpYGSHSIMOd
-AJpuWRcbPT1UaTLvPxgBNIGBL3WkyLj9QunIZSMYuqmKh+Oga5cBLKcgzCjIjDbI
-q8+4uPyZboGk6BIOzso+bRnRHe9U8XE3OxkOKyKA8+bpVlM8UoPvXbByJIq6z0dQ
-CBgjIpMzY0SmC4Pn0GnjnDnK6ME03PYbM2/xlZHk6TpD03SWWgW7aM4jGUDNeL9R
-YVFIEqnx5o1Mt0116SPu1E6pbpmqVgfNrRRxvxReBAWvY4Ogh4JAWDVxUAdXJz41
-GbUkJrgJJbaTapAnFzjlP3ZVq9nWWlZU1WUyXEnV+d10A9ChFzw8YLBiWtD50QID
-AQABo1AwTjAdBgNVHQ4EFgQUwRzVpE3ZkFlfr/S6nKhGegO+XAwwHwYDVR0jBBgw
-FoAUwRzVpE3ZkFlfr/S6nKhGegO+XAwwDAYDVR0TBAUwAwEB/zANBgkqhkiG9w0B
-AQsFAAOCAgEAVkAVey2nFYRaXYwqccFyo0er20vSzYgyPImYkj05zcZPkdYaTQqF
-AS5KV3tKGlrToOWNIYx3/M8hkZxQZhps1+Jh//gYwJCPM/zaKognYKHVjF9ZoZk3
-RJf1eA4brcjXkkKmHfRKgY3XGBfIoZbsVIzNMEH9rANIkiqoBzWz/7QKdKIRxqYO
-HVyNXVv7mzWnhxBqDFQ/ahRfXbiYHcdc7n1mc4S2qD0up/20feAp+uoVAXid2/aV
-L6jCJMpIlusGZI6wtxf2YaZsh5pNat6uzaZsWTY6j+Ly7VVfRtY70PqQjlANVDnZ
-IjA2c0qwh7ccl1MAYAO5umW8zxsgY3ZBnz5RsHJpVoEZrZOkpgvp9EsAutqUhkhM
-/760yqcn7NjtH7Yqp/uh7DockXMDELEd1aiErXcPisVJ18zVlVdD1VXexQOGJF8k
-E4GynpsH+pos8nvHMWCOLLEQ6i/itRqHKYiA36WMDKxpNcXXviWIT4Mmb8usBns8
-cdYUxebkvk2ISXuyRfD8Ch5+JnkbXvev/Gm1grA+DYrX2leyd7FvoLl8pLVgQO2q
-omds3iwcKoMnvRKf8xHhoeFoBlCGCiCUhUEutT30xjruiVVdT6mdMz1zLAkQ8QeZ
-b2gbVi7SXorVEGjpMkkGXI4LLX3R29yzTJb93wdWvf+MpqDiS9UBeCc=
------END CERTIFICATE-----

buildroot-external/rootfs-overlay/etc/rauc/system.conf

@@ -0,0 +1,23 @@
+[system]
+compatible=%COMPATIBLE%
+mountprefix=/run/rauc
+statusfile=/mnt/data/rauc.db
+bootloader=barebox
+
+[keyring]
+path=/etc/rauc/keyring.pem
+
+[slot.boot.0]
+device=/dev/disk/by-partuuid/b3dd0952-733c-4c88-8cba-cab9b8b4377f
+type=vfs
+bootname=boot
+
+[slot.rootfs.0]
+device=/dev/disk/by-partuuid/8d3d53e3-6d49-4c38-8349-aff6859e82fd
+type=raw
+bootname=system0
+
+[slot.rootfs.1]
+device=/dev/disk/by-partuuid/a3ec664e-32ce-4665-95ea-7ae90ce9aa20
+type=raw
+bootname=system1

buildroot-external/rootfs-overlay/etc/systemd/system/getty@.service.d/hassos.conf

@@ -1,2 +1,3 @@
 [Unit]
+Requires=docker.service
 After=docker.service

buildroot-external/rootfs-overlay/etc/systemd/system/getty@tty1.service.d/mingetty.conf

@@ -1,3 +0,0 @@
-[Service]
-ExecStart=
-ExecStart=/sbin/mingetty --noclear %I

buildroot-external/rootfs-overlay/etc/systemd/system/hassos-bind.target.wants/etc-hostname.mount

@@ -0,0 +1 @@
+/usr/lib/systemd/system/etc-hostname.mount