Ampere/aarch64 bring-up changes

* Refactor the efi-secure-boot feature (in order for it to be
disabled for certain targets)
* Add support for emag8180 compilation target (used as Enea NFV Access host)
* Add emag8180 support in ostree
* Add support for qemuarm64 compilation target (used as Enea NFV Access VNF)

Note:
The aarch64 family does not support the secure-boot feature yet, so the
"efi-secure-boot" has been disabled.

Change-Id: I32336761d322102a07d065c9ab02ea5051854609
Signed-off-by: Adrian Stratulat <adrian.stratulat@enea.com>

13 files changed, 604 insertions, 5 deletions

diff --git a/classes/override_image_types_ostree.inc b/classes/override_image_types_ostree.inc
index 241afcd..34d2d1f 100644
--- a/classes/override_image_types_ostree.inc
+++ b/classes/override_image_types_ostree.inc
@@ -12,6 +12,7 @@ do_image_ostree[cleandirs] = "${OSTREE_ROOTFS}"
 do_image_ostree[subimages] = "rootfs.ostree.tar.bz2"
 do_image_ostree[imgsuffix] = "."
 export OSTREE_ROOTFS
+SECURE_BOOT_ENABLED = "${@bb.utils.contains("DISTRO_FEATURES", "efi-secure-boot", "1", "0", d)}"
 
 IMAGE_CMD_ostree () {
     if [ -z "$OSTREE_REPO" ]; then
@@ -128,11 +129,14 @@ IMAGE_CMD_ostree () {
 
     checksum=`sha256sum ${DEPLOY_DIR_IMAGE}/${OSTREE_KERNEL} | cut -f 1 -d " "`
 
-    # Copy kernel and initramfs and their signature files
     cp ${DEPLOY_DIR_IMAGE}/${OSTREE_KERNEL} boot/vmlinuz-${checksum}
-    cp ${DEPLOY_DIR_IMAGE}/${OSTREE_KERNEL}.p7b boot/vmlinuz-${checksum}.p7b
     cp ${DEPLOY_DIR_IMAGE}/${OSTREE_INITRAMFS_IMAGE}-${MACHINE}${RAMDISK_EXT} boot/initramfs-${checksum}
-    cp ${DEPLOY_DIR_IMAGE}/${OSTREE_INITRAMFS_IMAGE}-${MACHINE}${RAMDISK_EXT}.p7b boot/initramfs-${checksum}.p7b
+
+    if [ "${SECURE_BOOT_ENABLED}" == "1" ]; then
+        # Copy kernel and initramfs and their signature files
+        cp ${DEPLOY_DIR_IMAGE}/${OSTREE_KERNEL}.p7b boot/vmlinuz-${checksum}.p7b
+        cp ${DEPLOY_DIR_IMAGE}/${OSTREE_INITRAMFS_IMAGE}-${MACHINE}${RAMDISK_EXT}.p7b boot/initramfs-${checksum}.p7b
+    fi
 
     # Copy image manifest
     cat ${IMAGE_MANIFEST} | cut -d " " -f1,3 > usr/package.manifest
diff --git a/classes/sota_emag8180.bbclass b/classes/sota_emag8180.bbclass
new file mode 100644
index 0000000..dff4294
--- /dev/null
+++ b/classes/sota_emag8180.bbclass
@@ -0,0 +1,13 @@
+OSTREE_BOOTLOADER ?= "grub"
+EFI_PROVIDER_sota = "grub-efi"
+PREFERRED_PROVIDER_virtual/bootloader_sota = "grub-efi"
+
+WKS_FILE_sota = "efiimage-sota.wks"
+
+OSTREE_INITRAMFS_FSTYPES ?= "ext4.gz"
+
+# Set .otaimg to be used as source for generating hddimg
+ROOTFS_sota = "${IMGDEPLOYDIR}/${IMAGE_LINK_NAME}.otaimg"
+
+# OSTree initrd needs 'ramdisk_size' and 'rw' parameters in order to boot
+OSTREE_KERNEL_ARGS ?= "rw"
diff --git a/conf/distro/eneanfvaccess.conf b/conf/distro/eneanfvaccess.conf
index 629adfb..565a8e3 100644
--- a/conf/distro/eneanfvaccess.conf
+++ b/conf/distro/eneanfvaccess.conf
@@ -2,7 +2,7 @@ require conf/distro/enea.conf
 
 DISTRO_NAME = "Enea NFV Access"
 DISTRO_VERSION_MAJOR = "2.2"
-DISTRO_VERSION_MINOR ??= ".2"
+DISTRO_VERSION_MINOR ??= ".2-aarch64"
 DISTRO_VERSION = "${DISTRO_VERSION_MAJOR}${DISTRO_VERSION_MINOR}"
 
 SDK_VERSION := "${@'${DISTRO_VERSION}'.replace('snapshot-${DATE}','snapshot')}"
@@ -11,6 +11,9 @@ INHERIT += "distrooverrides"
 DISTRO_FEATURES_append = " odm efi-secure-boot"
 DISTRO_FEATURES_OVERRIDES += "odm efi-secure-boot"
 
+DISTRO_FEATURES_remove_aarch64 = "efi-secure-boot"
+DISTRO_FEATURES_OVERRIDES_remove_aarch64 = "efi-secure-boot"
+
 PREFERRED_PROVIDER_virtual/java-initial-native = "cacao-initial-native"
 PREFERRED_PROVIDER_virtual/java-native = "jamvm-native"
 PREFERRED_PROVIDER_virtual/javac-native = "ecj-bootstrap-native"
diff --git a/conf/template.emag8180/bblayers.conf.sample b/conf/template.emag8180/bblayers.conf.sample
new file mode 100644
index 0000000..fe25bf7
--- /dev/null
+++ b/conf/template.emag8180/bblayers.conf.sample
@@ -0,0 +1,27 @@
+# POKY_BBLAYERS_CONF_VERSION is increased each time build/conf/bblayers.conf
+# changes incompatibly
+POKY_BBLAYERS_CONF_VERSION = "2"
+
+BBPATH = "${TOPDIR}"
+BBFILES ?= ""
+
+BBLAYERS ?= " \
+  ##OEROOT##/meta \
+  ##OEROOT##/meta-poky \
+  ##OEROOT##/meta-intel \
+  ##OEROOT##/meta-dpdk \
+  ##OEROOT##/meta-enea-bsp-common \
+  ##OEROOT##/meta-enea-bsp-arm \
+  ##OEROOT##/meta-virtualization \
+  ##OEROOT##/meta-enea-virtualization \
+  ##OEROOT##/meta-el-common \
+  ##OEROOT##/meta-el-nfv-access \
+  ##OEROOT##/meta-openembedded/meta-oe \
+  ##OEROOT##/meta-openembedded/meta-networking \
+  ##OEROOT##/meta-openembedded/meta-filesystems \
+  ##OEROOT##/meta-openembedded/meta-python \
+  ##OEROOT##/meta-openembedded/meta-webserver \
+  ##OEROOT##/meta-java \
+  ##OEROOT##/meta-updater \
+  ##OEROOT##/meta-openembedded/meta-perl \
+  "
diff --git a/conf/template.emag8180/conf-notes.txt b/conf/template.emag8180/conf-notes.txt
new file mode 100644
index 0000000..ebd6162
--- /dev/null
+++ b/conf/template.emag8180/conf-notes.txt
@@ -0,0 +1,2 @@
+Common targets are:
+    enea-nfv-access
diff --git a/conf/template.emag8180/local.conf.sample b/conf/template.emag8180/local.conf.sample
new file mode 100644
index 0000000..b33f431
--- /dev/null
+++ b/conf/template.emag8180/local.conf.sample
@@ -0,0 +1,249 @@
+#
+# This file is your local configuration file and is where all local user settings
+# are placed. The comments in this file give some guide to the options a new user
+# to the system might want to change but pretty much any configuration option can
+# be set in this file. More adventurous users can look at local.conf.extended
+# which contains other examples of configuration which can be placed in this file
+# but new users likely won't need any of them initially.
+#
+# Lines starting with the '#' character are commented out and in some cases the
+# default values are provided as comments to show people example syntax. Enabling
+# the option is a question of removing the # character and making any change to the
+# variable as required.
+
+#
+# Machine Selection
+#
+# You need to select a specific machine to target the build with. There are a selection
+# of emulated machines available which can boot and run in the QEMU emulator:
+#
+#MACHINE ?= "qemuarm"
+#MACHINE ?= "qemuarm64"
+#MACHINE ?= "qemumips"
+#MACHINE ?= "qemumips64"
+#MACHINE ?= "qemuppc"
+#MACHINE ?= "qemux86"
+#MACHINE ?= "qemux86-64"
+#
+# There are also the following hardware board target machines included for
+# demonstration purposes:
+#
+#MACHINE ?= "beaglebone"
+#MACHINE ?= "genericx86"
+#MACHINE ?= "genericx86-64"
+#MACHINE ?= "mpc8315e-rdb"
+#MACHINE ?= "edgerouter"
+#
+# This sets the default machine to be qemux86 if no other machine is selected:
+MACHINE ?= "emag8180"
+
+#
+# Where to place downloads
+#
+# During a first build the system will download many different source code tarballs
+# from various upstream projects. This can take a while, particularly if your network
+# connection is slow. These are all stored in DL_DIR. When wiping and rebuilding you
+# can preserve this directory to speed up this part of subsequent builds. This directory
+# is safe to share between multiple builds on the same machine too.
+#
+# The default is a downloads directory under TOPDIR which is the build directory.
+#
+#DL_DIR ?= "${TOPDIR}/downloads"
+
+#
+# Where to place shared-state files
+#
+# BitBake has the capability to accelerate builds based on previously built output.
+# This is done using "shared state" files which can be thought of as cache objects
+# and this option determines where those files are placed.
+#
+# You can wipe out TMPDIR leaving this directory intact and the build would regenerate
+# from these files if no changes were made to the configuration. If changes were made
+# to the configuration, only shared state files where the state was still valid would
+# be used (done using checksums).
+#
+# The default is a sstate-cache directory under TOPDIR.
+#
+#SSTATE_DIR ?= "${TOPDIR}/sstate-cache"
+
+#
+# Where to place the build output
+#
+# This option specifies where the bulk of the building work should be done and
+# where BitBake should place its temporary files and output. Keep in mind that
+# this includes the extraction and compilation of many applications and the toolchain
+# which can use Gigabytes of hard disk space.
+#
+# The default is a tmp directory under TOPDIR.
+#
+#TMPDIR = "${TOPDIR}/tmp"
+
+#
+# Default policy config
+#
+# The distribution setting controls which policy settings are used as defaults.
+# The default value is fine for general Yocto project use, at least initially.
+# Ultimately when creating custom policy, people will likely end up subclassing
+# these defaults.
+#
+DISTRO ?= "eneanfvaccess"
+# As an example of a subclass there is a "bleeding" edge policy configuration
+# where many versions are set to the absolute latest code from the upstream
+# source control systems. This is just mentioned here as an example, its not
+# useful to most new users.
+# DISTRO ?= "poky-bleeding"
+
+#
+# Package Management configuration
+#
+# This variable lists which packaging formats to enable. Multiple package backends
+# can be enabled at once and the first item listed in the variable will be used
+# to generate the root filesystems.
+# Options are:
+#  - 'package_deb' for debian style deb files
+#  - 'package_ipk' for ipk files are used by opkg (a debian style embedded package manager)
+#  - 'package_rpm' for rpm style packages
+# E.g.: PACKAGE_CLASSES ?= "package_rpm package_deb package_ipk"
+# We default to rpm:
+PACKAGE_CLASSES ?= "package_deb"
+
+#
+# SDK/ADT target architecture
+#
+# This variable specifies the architecture to build SDK/ADT items for and means
+# you can build the SDK packages for architectures other than the machine you are
+# running the build on (i.e. building i686 packages on an x86_64 host).
+# Supported values are i686 and x86_64
+#SDKMACHINE ?= "i686"
+
+#
+# Extra image configuration defaults
+#
+# The EXTRA_IMAGE_FEATURES variable allows extra packages to be added to the generated
+# images. Some of these options are added to certain image types automatically. The
+# variable can contain the following options:
+#  "dbg-pkgs"       - add -dbg packages for all installed packages
+#                     (adds symbol information for debugging/profiling)
+#  "dev-pkgs"       - add -dev packages for all installed packages
+#                     (useful if you want to develop against libs in the image)
+#  "ptest-pkgs"     - add -ptest packages for all ptest-enabled packages
+#                     (useful if you want to run the package test suites)
+#  "tools-sdk"      - add development tools (gcc, make, pkgconfig etc.)
+#  "tools-debug"    - add debugging tools (gdb, strace)
+#  "eclipse-debug"  - add Eclipse remote debugging support
+#  "tools-profile"  - add profiling tools (oprofile, lttng, valgrind)
+#  "tools-testapps" - add useful testing tools (ts_print, aplay, arecord etc.)
+#  "debug-tweaks"   - make an image suitable for development
+#                     e.g. ssh root access has a blank password
+# There are other application targets that can be used here too, see
+# meta/classes/image.bbclass and meta/classes/core-image.bbclass for more details.
+# We default to enabling the debugging tweaks.
+EXTRA_IMAGE_FEATURES = "debug-tweaks"
+
+#
+# Additional image features
+#
+# The following is a list of additional classes to use when building images which
+# enable extra features. Some available options which can be included in this variable
+# are:
+#   - 'buildstats' collect build statistics
+#   - 'image-mklibs' to reduce shared library files size for an image
+#   - 'image-prelink' in order to prelink the filesystem image
+#   - 'image-swab' to perform host system intrusion detection
+# NOTE: if listing mklibs & prelink both, then make sure mklibs is before prelink
+# NOTE: mklibs also needs to be explicitly enabled for a given image, see local.conf.extended
+USER_CLASSES ?= "buildstats image-mklibs image-prelink"
+
+#
+# Runtime testing of images
+#
+# The build system can test booting virtual machine images under qemu (an emulator)
+# after any root filesystems are created and run tests against those images. To
+# enable this uncomment this line. See classes/testimage(-auto).bbclass for
+# further details.
+#TEST_IMAGE = "1"
+#
+# Interactive shell configuration
+#
+# Under certain circumstances the system may need input from you and to do this it
+# can launch an interactive shell. It needs to do this since the build is
+# multithreaded and needs to be able to handle the case where more than one parallel
+# process may require the user's attention. The default is iterate over the available
+# terminal types to find one that works.
+#
+# Examples of the occasions this may happen are when resolving patches which cannot
+# be applied, to use the devshell or the kernel menuconfig
+#
+# Supported values are auto, gnome, xfce, rxvt, screen, konsole (KDE 3.x only), none
+# Note: currently, Konsole support only works for KDE 3.x due to the way
+# newer Konsole versions behave
+#OE_TERMINAL = "auto"
+# By default disable interactive patch resolution (tasks will just fail instead):
+PATCHRESOLVE = "noop"
+
+#
+# Disk Space Monitoring during the build
+#
+# Monitor the disk space during the build. If there is less that 1GB of space or less
+# than 100K inodes in any key build location (TMPDIR, DL_DIR, SSTATE_DIR), gracefully
+# shutdown the build. If there is less that 100MB or 1K inodes, perform a hard abort
+# of the build. The reason for this is that running completely out of space can corrupt
+# files and damages the build in ways which may not be easily recoverable.
+# It's necesary to monitor /tmp, if there is no space left the build will fail
+# with very exotic errors.
+BB_DISKMON_DIRS = "\
+    STOPTASKS,${TMPDIR},1G,100K \
+    STOPTASKS,${DL_DIR},1G,100K \
+    STOPTASKS,${SSTATE_DIR},1G,100K \
+    STOPTASKS,/tmp,100M,100K \
+    ABORT,${TMPDIR},100M,1K \
+    ABORT,${DL_DIR},100M,1K \
+    ABORT,${SSTATE_DIR},100M,1K \
+    ABORT,/tmp,10M,1K"
+
+#
+# Shared-state files from other locations
+#
+# As mentioned above, shared state files are prebuilt cache data objects which can
+# used to accelerate build time. This variable can be used to configure the system
+# to search other mirror locations for these objects before it builds the data itself.
+#
+# This can be a filesystem directory, or a remote url such as http or ftp. These
+# would contain the sstate-cache results from previous builds (possibly from other
+# machines). This variable works like fetcher MIRRORS/PREMIRRORS and points to the
+# cache locations to check for the shared objects.
+# NOTE: if the mirror uses the same structure as SSTATE_DIR, you need to add PATH
+# at the end as shown in the examples below. This will be substituted with the
+# correct path within the directory structure.
+#SSTATE_MIRRORS ?= "\
+#file://.* http://someserver.tld/share/sstate/PATH;downloadfilename=PATH \n \
+#file://.* file:///some/local/dir/sstate/PATH"
+
+
+#
+# Qemu configuration
+#
+# By default qemu will build with a builtin VNC server where graphical output can be
+# seen. The two lines below enable the SDL backend too. By default libsdl-native will
+# be built, if you want to use your host's libSDL instead of the minimal libsdl built
+# by libsdl-native then uncomment the ASSUME_PROVIDED line below.
+PACKAGECONFIG_append_pn-qemu-native = " sdl"
+PACKAGECONFIG_append_pn-nativesdk-qemu = " sdl"
+#ASSUME_PROVIDED += "libsdl-native"
+
+# CONF_VERSION is increased each time build/conf/ changes incompatibly and is used to
+# track the version of this file when it was generated. This can safely be ignored if
+# this doesn't mean anything to you.
+CONF_VERSION = "1"
+
+SKIP_META_VIRT_SANITY_CHECK = "1"
+
+#
+# OSTree integration
+#
+
+SOTA_MACHINE ?= "${MACHINE}"
+
+DISTRO_FEATURES_append = " sota"
+DISTRO_FEATURES_NATIVE_append = " sota"
+INHERIT += " sota"
diff --git a/conf/template.qemuarm64/bblayers.conf.sample b/conf/template.qemuarm64/bblayers.conf.sample
new file mode 100644
index 0000000..1506900
--- /dev/null
+++ b/conf/template.qemuarm64/bblayers.conf.sample
@@ -0,0 +1,26 @@
+# POKY_BBLAYERS_CONF_VERSION is increased each time build/conf/bblayers.conf
+# changes incompatibly
+POKY_BBLAYERS_CONF_VERSION = "2"
+
+BBPATH = "${TOPDIR}"
+BBFILES ?= ""
+
+BBLAYERS ?= " \
+  ##OEROOT##/meta \
+  ##OEROOT##/meta-poky \
+  ##OEROOT##/meta-intel \
+  ##OEROOT##/meta-dpdk \
+  ##OEROOT##/meta-enea-bsp-common \
+  ##OEROOT##/meta-enea-bsp-arm \
+  ##OEROOT##/meta-virtualization \
+  ##OEROOT##/meta-enea-virtualization \
+  ##OEROOT##/meta-el-common \
+  ##OEROOT##/meta-el-nfv-access \
+  ##OEROOT##/meta-openembedded/meta-oe \
+  ##OEROOT##/meta-openembedded/meta-networking \
+  ##OEROOT##/meta-openembedded/meta-filesystems \
+  ##OEROOT##/meta-openembedded/meta-python \
+  ##OEROOT##/meta-openembedded/meta-webserver \
+  ##OEROOT##/meta-cloud-services \
+  ##OEROOT##/meta-cloud-services/meta-openstack \
+  "
diff --git a/conf/template.qemuarm64/conf-notes.txt b/conf/template.qemuarm64/conf-notes.txt
new file mode 100644
index 0000000..e55e538
--- /dev/null
+++ b/conf/template.qemuarm64/conf-notes.txt
@@ -0,0 +1,2 @@
+Common targets are:
+    enea-nfv-access-vnf
diff --git a/conf/template.qemuarm64/local.conf.sample b/conf/template.qemuarm64/local.conf.sample
new file mode 100644
index 0000000..afb56dd
--- /dev/null
+++ b/conf/template.qemuarm64/local.conf.sample
@@ -0,0 +1,243 @@
+#
+# This file is your local configuration file and is where all local user settings
+# are placed. The comments in this file give some guide to the options a new user
+# to the system might want to change but pretty much any configuration option can
+# be set in this file. More adventurous users can look at local.conf.extended
+# which contains other examples of configuration which can be placed in this file
+# but new users likely won't need any of them initially.
+#
+# Lines starting with the '#' character are commented out and in some cases the
+# default values are provided as comments to show people example syntax. Enabling
+# the option is a question of removing the # character and making any change to the
+# variable as required.
+
+#
+# Machine Selection
+#
+# You need to select a specific machine to target the build with. There are a selection
+# of emulated machines available which can boot and run in the QEMU emulator:
+#
+#MACHINE ?= "qemuarm"
+#MACHINE ?= "qemuarm64"
+#MACHINE ?= "qemumips"
+#MACHINE ?= "qemumips64"
+#MACHINE ?= "qemuppc"
+#MACHINE ?= "qemux86"
+#MACHINE ?= "qemux86-64"
+#
+# There are also the following hardware board target machines included for
+# demonstration purposes:
+#
+#MACHINE ?= "beaglebone"
+#MACHINE ?= "genericx86"
+#MACHINE ?= "genericx86-64"
+#MACHINE ?= "mpc8315e-rdb"
+#MACHINE ?= "edgerouter"
+#
+# This sets the default machine to be qemux86 if no other machine is selected:
+MACHINE ?= "qemuarm64"
+
+#
+# Where to place downloads
+#
+# During a first build the system will download many different source code tarballs
+# from various upstream projects. This can take a while, particularly if your network
+# connection is slow. These are all stored in DL_DIR. When wiping and rebuilding you
+# can preserve this directory to speed up this part of subsequent builds. This directory
+# is safe to share between multiple builds on the same machine too.
+#
+# The default is a downloads directory under TOPDIR which is the build directory.
+#
+#DL_DIR ?= "${TOPDIR}/downloads"
+
+#
+# Where to place shared-state files
+#
+# BitBake has the capability to accelerate builds based on previously built output.
+# This is done using "shared state" files which can be thought of as cache objects
+# and this option determines where those files are placed.
+#
+# You can wipe out TMPDIR leaving this directory intact and the build would regenerate
+# from these files if no changes were made to the configuration. If changes were made
+# to the configuration, only shared state files where the state was still valid would
+# be used (done using checksums).
+#
+# The default is a sstate-cache directory under TOPDIR.
+#
+#SSTATE_DIR ?= "${TOPDIR}/sstate-cache"
+
+#
+# Where to place the build output
+#
+# This option specifies where the bulk of the building work should be done and
+# where BitBake should place its temporary files and output. Keep in mind that
+# this includes the extraction and compilation of many applications and the toolchain
+# which can use Gigabytes of hard disk space.
+#
+# The default is a tmp directory under TOPDIR.
+#
+#TMPDIR = "${TOPDIR}/tmp"
+
+#
+# Default policy config
+#
+# The distribution setting controls which policy settings are used as defaults.
+# The default value is fine for general Yocto project use, at least initially.
+# Ultimately when creating custom policy, people will likely end up subclassing
+# these defaults.
+#
+DISTRO ?= "eneanfvaccess"
+# As an example of a subclass there is a "bleeding" edge policy configuration
+# where many versions are set to the absolute latest code from the upstream
+# source control systems. This is just mentioned here as an example, its not
+# useful to most new users.
+# DISTRO ?= "poky-bleeding"
+
+#
+# Package Management configuration
+#
+# This variable lists which packaging formats to enable. Multiple package backends
+# can be enabled at once and the first item listed in the variable will be used
+# to generate the root filesystems.
+# Options are:
+#  - 'package_deb' for debian style deb files
+#  - 'package_ipk' for ipk files are used by opkg (a debian style embedded package manager)
+#  - 'package_rpm' for rpm style packages
+# E.g.: PACKAGE_CLASSES ?= "package_rpm package_deb package_ipk"
+# We default to rpm:
+PACKAGE_CLASSES ?= "package_deb"
+
+#
+# SDK/ADT target architecture
+#
+# This variable specifies the architecture to build SDK/ADT items for and means
+# you can build the SDK packages for architectures other than the machine you are
+# running the build on (i.e. building i686 packages on an x86_64 host).
+# Supported values are i686 and x86_64
+#SDKMACHINE ?= "i686"
+
+#
+# Extra image configuration defaults
+#
+# The EXTRA_IMAGE_FEATURES variable allows extra packages to be added to the generated
+# images. Some of these options are added to certain image types automatically. The
+# variable can contain the following options:
+#  "dbg-pkgs"       - add -dbg packages for all installed packages
+#                     (adds symbol information for debugging/profiling)
+#  "dev-pkgs"       - add -dev packages for all installed packages
+#                     (useful if you want to develop against libs in the image)
+#  "ptest-pkgs"     - add -ptest packages for all ptest-enabled packages
+#                     (useful if you want to run the package test suites)
+#  "tools-sdk"      - add development tools (gcc, make, pkgconfig etc.)
+#  "tools-debug"    - add debugging tools (gdb, strace)
+#  "eclipse-debug"  - add Eclipse remote debugging support
+#  "tools-profile"  - add profiling tools (oprofile, lttng, valgrind)
+#  "tools-testapps" - add useful testing tools (ts_print, aplay, arecord etc.)
+#  "debug-tweaks"   - make an image suitable for development
+#                     e.g. ssh root access has a blank password
+# There are other application targets that can be used here too, see
+# meta/classes/image.bbclass and meta/classes/core-image.bbclass for more details.
+# We default to enabling the debugging tweaks.
+EXTRA_IMAGE_FEATURES = "debug-tweaks"
+
+#
+# Additional image features
+#
+# The following is a list of additional classes to use when building images which
+# enable extra features. Some available options which can be included in this variable
+# are:
+#   - 'buildstats' collect build statistics
+#   - 'image-mklibs' to reduce shared library files size for an image
+#   - 'image-prelink' in order to prelink the filesystem image
+#   - 'image-swab' to perform host system intrusion detection
+# NOTE: if listing mklibs & prelink both, then make sure mklibs is before prelink
+# NOTE: mklibs also needs to be explicitly enabled for a given image, see local.conf.extended
+USER_CLASSES ?= "buildstats image-mklibs image-prelink"
+
+#
+# Runtime testing of images
+#
+# The build system can test booting virtual machine images under qemu (an emulator)
+# after any root filesystems are created and run tests against those images. To
+# enable this uncomment this line. See classes/testimage(-auto).bbclass for
+# further details.
+#TEST_IMAGE = "1"
+#
+# Interactive shell configuration
+#
+# Under certain circumstances the system may need input from you and to do this it
+# can launch an interactive shell. It needs to do this since the build is
+# multithreaded and needs to be able to handle the case where more than one parallel
+# process may require the user's attention. The default is iterate over the available
+# terminal types to find one that works.
+#
+# Examples of the occasions this may happen are when resolving patches which cannot
+# be applied, to use the devshell or the kernel menuconfig
+#
+# Supported values are auto, gnome, xfce, rxvt, screen, konsole (KDE 3.x only), none
+# Note: currently, Konsole support only works for KDE 3.x due to the way
+# newer Konsole versions behave
+#OE_TERMINAL = "auto"
+# By default disable interactive patch resolution (tasks will just fail instead):
+PATCHRESOLVE = "noop"
+
+#
+# Disk Space Monitoring during the build
+#
+# Monitor the disk space during the build. If there is less that 1GB of space or less
+# than 100K inodes in any key build location (TMPDIR, DL_DIR, SSTATE_DIR), gracefully
+# shutdown the build. If there is less that 100MB or 1K inodes, perform a hard abort
+# of the build. The reason for this is that running completely out of space can corrupt
+# files and damages the build in ways which may not be easily recoverable.
+# It's necesary to monitor /tmp, if there is no space left the build will fail
+# with very exotic errors.
+BB_DISKMON_DIRS = "\
+    STOPTASKS,${TMPDIR},1G,100K \
+    STOPTASKS,${DL_DIR},1G,100K \
+    STOPTASKS,${SSTATE_DIR},1G,100K \
+    STOPTASKS,/tmp,100M,100K \
+    ABORT,${TMPDIR},100M,1K \
+    ABORT,${DL_DIR},100M,1K \
+    ABORT,${SSTATE_DIR},100M,1K \
+    ABORT,/tmp,10M,1K"
+
+#
+# Shared-state files from other locations
+#
+# As mentioned above, shared state files are prebuilt cache data objects which can
+# used to accelerate build time. This variable can be used to configure the system
+# to search other mirror locations for these objects before it builds the data itself.
+#
+# This can be a filesystem directory, or a remote url such as http or ftp. These
+# would contain the sstate-cache results from previous builds (possibly from other
+# machines). This variable works like fetcher MIRRORS/PREMIRRORS and points to the
+# cache locations to check for the shared objects.
+# NOTE: if the mirror uses the same structure as SSTATE_DIR, you need to add PATH
+# at the end as shown in the examples below. This will be substituted with the
+# correct path within the directory structure.
+#SSTATE_MIRRORS ?= "\
+#file://.* http://someserver.tld/share/sstate/PATH;downloadfilename=PATH \n \
+#file://.* file:///some/local/dir/sstate/PATH"
+
+
+#
+# Qemu configuration
+#
+# By default qemu will build with a builtin VNC server where graphical output can be
+# seen. The two lines below enable the SDL backend too. By default libsdl-native will
+# be built, if you want to use your host's libSDL instead of the minimal libsdl built
+# by libsdl-native then uncomment the ASSUME_PROVIDED line below.
+PACKAGECONFIG_append_pn-qemu-native = " sdl"
+PACKAGECONFIG_append_pn-nativesdk-qemu = " sdl"
+#ASSUME_PROVIDED += "libsdl-native"
+
+# CONF_VERSION is increased each time build/conf/ changes incompatibly and is used to
+# track the version of this file when it was generated. This can safely be ignored if
+# this doesn't mean anything to you.
+CONF_VERSION = "1"
+
+SKIP_META_VIRT_SANITY_CHECK = "1"
+
+PREFERRED_PROVIDER_virtual/kernel_qemuarm64 = "linux-ampere-guest"
+MACHINE_FEATURES += " efi"
+DPDK_TARGET_MACHINE = "armv8a"
diff --git a/images/enea-nfv-access-host-common.inc b/images/enea-nfv-access-host-common.inc
index 1cde827..370a3a8 100644
--- a/images/enea-nfv-access-host-common.inc
+++ b/images/enea-nfv-access-host-common.inc
@@ -2,9 +2,15 @@ REQUIRE_FILES = " \
     images/enea-nfv-access-common.inc \
     classes/override_grub-efi.inc \
     "
-REQUIRE_FILES_append_df-efi-secure-boot = " \
+
+# override_image_types_ostree - has some secure-boot changes
+# but we guarded them
+REQUIRE_FILES_append_sota = " \
     classes/override_image_types_ostree.inc \
     classes/override_image_types_ota.inc \
+                       "
+
+REQUIRE_FILES_append_df-efi-secure-boot = " \
     classes/override_grub-efi_secureboot.inc \
     images/secure-boot.inc \
     "
@@ -20,14 +26,21 @@ IMAGE_INSTALL += " \
 LABELS_LIVE = "installer live-boot"
 
 GRUB_GFXSERIAL_x86-64 = "1"
+GRUB_GFXSERIAL_aarch64 = "1"
+GRUB_SERIAL_aarch64 = "console=ttyAMA0,115200"
+
 # Append default parameters for x86-64 targets
 APPEND_x86-64 = "quiet"
 SYSLINUX_DEFAULT_CONSOLE_x86-64 = "console=ttyS0,115200"
 
+APPEND_aarch64 = "quiet"
+
 # Skip menu and boot installer immediately
 GRUB_TIMEOUT_x86-64 = "0"
 AUTO_SYSLINUXMENU_x86-64 = "0"
 
+GRUB_TIMEOUT_aarch64 = "5"
+
 # grub-efi-native is needed in recipe-sysroot-native to generate the initial
 # configuration file for grub
 DEPENDS_append += " grub-efi-native"
diff --git a/images/enea-nfv-access-vnf.bb b/images/enea-nfv-access-vnf.bb
index a3902c2..ebbb08d 100644
--- a/images/enea-nfv-access-vnf.bb
+++ b/images/enea-nfv-access-vnf.bb
@@ -4,6 +4,7 @@ require images/enea-nfv-access-common.inc
 
 IMAGE_FSTYPES += "wic.qcow2"
 WKS_FILE = "enea-nfv-access-vnf-qemux86-64.wks"
+WKS_FILE_aarch64 = "enea-nfv-access-vnf-qemuarm64.wks"
 
 CLOUDINITPKGS = "cloud-init util-linux-blkid"
 CLOUDINITPKGS += " ${@bb.utils.contains('DISTRO_FEATURES', 'systemd', 'cloud-init-systemd', '', d)}"
diff --git a/images/enea-nfv-access.bb b/images/enea-nfv-access.bb
index 9311992..845e668 100644
--- a/images/enea-nfv-access.bb
+++ b/images/enea-nfv-access.bb
@@ -1,7 +1,18 @@
 DESCRIPTION = "Image for the host side of the Enea NFV Access Platform with ODM and NETCONF Edgelink customizations"
 
+IMAGE_FSTYPES_append_aarch64 = " live"
+IMAGE_TYPES_MASKED_append_aarch64 = " hddimg iso"
+NOISO_aarch64 = "1"
+NOHDD_aarch64 = "0"
+
 require images/enea-nfv-access-host-common.inc
 
 IMAGE_INSTALL += " \
     element-vcpe \
     "
+
+# On AARCH64, the OVMF firmware images are required by KVM, but these images are not
+# pulled explicitly by other recipes.
+IMAGE_INSTALL_append_aarch64 = "\
+    ovmf \
+    "
diff --git a/scripts/lib/wic/canned-wks/enea-nfv-access-vnf-qemuarm64.wks b/scripts/lib/wic/canned-wks/enea-nfv-access-vnf-qemuarm64.wks
new file mode 100644
index 0000000..1495f17
--- /dev/null
+++ b/scripts/lib/wic/canned-wks/enea-nfv-access-vnf-qemuarm64.wks
@@ -0,0 +1,5 @@
+# short-description: Create an MBR partition table with PCBIOS
+# long-description: Create an MBR partition table with PCBIOS
+part /boot --source bootimg-efi --sourceparams="loader=grub-efi" --label boot --active --part-type C12A7328-F81F-11D2-BA4B-00A0C93EC93B --use-uuid --align 1024
+part / --source rootfs --fstype=ext4 --label access --part-type 0FC63DAF-8483-4772-8E79-3D69D8477DE4 --use-uuid --align 1024
+bootloader --ptable gpt --timeout=5 --append="console=ttyS0,115200 hugepagesz=2M hugepages=256 isolcpus=1 nohz_full=1 rcu_nocbs=1 audit=0 quiet"