diff --git a/board/aarch64/rpi/bcm2711_defconfig b/board/aarch64/rpi/bcm2711_defconfig
index 4832957d..b1936503 100644
--- a/board/aarch64/rpi/bcm2711_defconfig
+++ b/board/aarch64/rpi/bcm2711_defconfig
@@ -622,7 +622,6 @@ CONFIG_B43=m
 CONFIG_B43LEGACY=m
 CONFIG_BRCMFMAC=m
 CONFIG_BRCMFMAC_USB=y
-CONFIG_BRCMDBG=y
 CONFIG_IWLWIFI=m
 CONFIG_IWLDVM=m
 CONFIG_IWLMVM=m
@@ -1510,7 +1509,8 @@ CONFIG_HFSPLUS_FS=m
 CONFIG_JFFS2_FS=m
 CONFIG_JFFS2_SUMMARY=y
 CONFIG_UBIFS_FS=m
-CONFIG_SQUASHFS=m
+CONFIG_SQUASHFS=y
+CONFIG_SQUASHFS_COMPILE_DECOMP_MULTI_PERCPU=y
 CONFIG_SQUASHFS_XATTR=y
 CONFIG_SQUASHFS_LZO=y
 CONFIG_SQUASHFS_XZ=y
diff --git a/board/aarch64/rpi/cmdline.txt b/board/aarch64/rpi/cmdline.txt
index 01d86f7d..155a5469 100644
--- a/board/aarch64/rpi/cmdline.txt
+++ b/board/aarch64/rpi/cmdline.txt
@@ -1 +1 @@
-root=/dev/mmcblk1p2 rootwait 8250.nr_uarts=1 console=tty1 console=ttyS0,115200 quiet
+root=/dev/mmcblk0p2 rootwait console=tty1 console=ttyAMA0,115200
diff --git a/board/aarch64/rpi/config.txt b/board/aarch64/rpi/config.txt
index 390769b4..0308a05c 100644
--- a/board/aarch64/rpi/config.txt
+++ b/board/aarch64/rpi/config.txt
@@ -7,8 +7,11 @@
 start_file=start4.elf
 fixup_file=fixup4.dat
 
+kernel=u-boot.bin
+
 device_tree=bcm2711-rpi-4-b.dtb
-kernel=Image
+dtoverlay=rpi-env
+dtoverlay=infix-key
 
 # To use an external initramfs file
 #initramfs rootfs.cpio.gz
@@ -28,5 +31,11 @@ enable_uart=1
 force_turbo=1
 #dtoverlay=miniuart-bt
 
+# Run as fast as firmware / board allows
+arm_boost=1
+
 # enable 64bits support
 arm_64bit=1
+
+# Enable early debugging info
+uart_2ndstage=1
diff --git a/board/aarch64/rpi/genimage.cfg.in b/board/aarch64/rpi/genimage.cfg.in
new file mode 100644
index 00000000..b2c0b5b4
--- /dev/null
+++ b/board/aarch64/rpi/genimage.cfg.in
@@ -0,0 +1,71 @@
+image boot.vfat {
+	vfat {
+		files = {
+#BOOT_FILES#
+		}
+	}
+
+	size = 32M
+}
+
+image cfg.ext4 {
+	empty = true
+	temporary = true
+	size = 16M
+
+	ext4 {
+		label = "cfg"
+	}
+}
+
+image var.ext4 {
+	empty = true
+	temporary = true
+	size = 512M
+
+	ext4 {
+		label = "var"
+		use-mke2fs = true
+	}
+}
+
+image sdcard.img {
+	hdimage {
+		partition-table-type = "gpt"
+	}
+
+	partition boot {
+		partition-type-uuid = EBD0A0A2-B9E5-4433-87C0-68B6B72699C7
+		bootable = "true"
+		image = "boot.vfat"
+	}
+
+	partition aux {
+		partition-uuid = D4EF35A0-0652-45A1-B3DE-D63339C82035
+		image = "aux.ext4"
+	}
+
+	partition primary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
+	}
+
+	partition secondary {
+		partition-type-uuid = 0FC63DAF-8483-4772-8E79-3D69D8477DE4
+		bootable = true
+		size = 200M
+		image = "rootfs.squashfs"
+	}
+
+	partition cfg {
+		partition-uuid = 7aa497f0-73b5-47e5-b2ab-8752d8a48105
+		image = "cfg.ext4"
+	}
+
+	partition var {
+		partition-uuid = 8046A06A-E45A-4A14-A6AD-6684704A393F
+		image = "var.ext4"
+	}
+}
diff --git a/board/aarch64/rpi/post-build.sh b/board/aarch64/rpi/post-build.sh
new file mode 100755
index 00000000..8e9d6006
--- /dev/null
+++ b/board/aarch64/rpi/post-build.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+# Armbian firmware installs to /lib/firmware but driver wants the
+# file(s) in /lib/firmware/brcm/
+if [ -f "${TARGET_DIR}/lib/firmware/BCM4345C0.hcd" ]; then
+    mv "${TARGET_DIR}/lib/firmware/BCM4345C0.hcd" "${TARGET_DIR}/lib/firmware/brcm/"
+fi
diff --git a/board/aarch64/rpi/post-image.sh b/board/aarch64/rpi/post-image.sh
new file mode 100755
index 00000000..b38c3857
--- /dev/null
+++ b/board/aarch64/rpi/post-image.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+set -e
+
+BOARD_DIR=$(dirname "$0")
+GENIMAGE_CFG="${BUILD_DIR}/genimage.cfg"
+GENIMAGE_TMP="${BUILD_DIR}/genimage.tmp"
+
+# Device trees are installed for distro boot (syslinux.conf), but on RPi
+# we need them for the SPL, which feeds the TPL (U-Boot) for use instead
+# of the (built-in) control DT other platforms use.
+find "${TARGET_DIR}/boot" -type f -name '*.dtb' -exec cp '{}' "${BINARIES_DIR}/" \;
+
+# We've asked U-Boot previously to build overlays for us: Infix signing
+# key and our ixboot scripts.  Make sure here they are installed in the
+# proper directory so genimage can create the DOS partition the SPL
+# reads config.txt from.
+find "${BINARIES_DIR}" -type f -name '*.dtbo' -exec mv '{}' "${BINARIES_DIR}/rpi-firmware/overlays/" \;
+
+# Create FILES array for the genimage.cfg generation
+FILES=""
+for f in "${BINARIES_DIR}"/*.dtb "${BINARIES_DIR}"/rpi-firmware/*; do
+    case "$f" in
+        *~|*.bak) continue ;;
+    esac
+    FILES="${FILES}\t\t\t\"${f#"${BINARIES_DIR}/"}\",\n"
+done
+
+KERNEL=$(sed -n 's/^kernel=//p' "${BINARIES_DIR}/rpi-firmware/config.txt")
+FILES="${FILES}\t\t\t\"${KERNEL}\""
+
+sed "s|#BOOT_FILES#|${FILES}|" "${BOARD_DIR}/genimage.cfg.in" > "${GENIMAGE_CFG}"
+
+ROOTPATH_TMP=$(mktemp -d)
+trap 'rm -rf \"$ROOTPATH_TMP\"' EXIT
+
+rm -rf "${GENIMAGE_TMP}"
+
+genimage					\
+    --rootpath   "${ROOTPATH_TMP}"		\
+    --tmppath    "${GENIMAGE_TMP}"		\
+    --inputpath  "${BINARIES_DIR}"		\
+    --outputpath "${BINARIES_DIR}"		\
+    --config     "${GENIMAGE_CFG}"
diff --git a/board/aarch64/rpi/rootfs/boot/syslinux/syslinux.conf b/board/aarch64/rpi/rootfs/boot/syslinux/syslinux.conf
new file mode 100644
index 00000000..76a62f9b
--- /dev/null
+++ b/board/aarch64/rpi/rootfs/boot/syslinux/syslinux.conf
@@ -0,0 +1,16 @@
+default rpi4b
+menu title Boot Menu
+prompt 1
+timeout 30
+
+label rpi4b
+        menu label Infix on Raspberry Pi 4B
+	kernel /boot/Image
+	devicetree /boot/broadcom/bcm2711-rpi-4-b.dtb
+	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}
+
+label rpi400
+	menu label Infix on Raspberry Pi 400
+	kernel /boot/Image
+	devicetree /boot/broadcom/bcm2711-rpi-400.dtb
+	append ${bootargs_root} 8250.nr_uarts=1 console=ttyS0,115200 ${bootargs_log} -- ${bootargs_user}
diff --git a/board/aarch64/rpi/rootfs/etc/factory-config.cfg b/board/aarch64/rpi/rootfs/etc/factory-config.cfg
new file mode 100644
index 00000000..68f2112d
--- /dev/null
+++ b/board/aarch64/rpi/rootfs/etc/factory-config.cfg
@@ -0,0 +1,193 @@
+{
+  "ieee802-dot1ab-lldp:lldp": {
+    "infix-lldp:enabled": true
+  },
+  "ietf-interfaces:interfaces": {
+    "interface": [
+      {
+        "name": "lo",
+        "type": "infix-if-type:loopback",
+        "ietf-ip:ipv4": {
+          "address": [
+            {
+              "ip": "127.0.0.1",
+              "prefix-length": 8
+            }
+          ]
+        },
+        "ietf-ip:ipv6": {
+          "address": [
+            {
+              "ip": "::1",
+              "prefix-length": 128
+            }
+          ]
+        }
+      },
+      {
+        "name": "eth0",
+        "type": "infix-if-type:ethernet"
+      }
+    ]
+  },
+  "ietf-keystore:keystore": {
+    "asymmetric-keys": {
+      "asymmetric-key": [
+        {
+          "name": "genkey",
+          "public-key-format": "ietf-crypto-types:ssh-public-key-format",
+          "public-key": "",
+          "private-key-format": "ietf-crypto-types:rsa-private-key-format",
+          "cleartext-private-key": "",
+          "certificates": {}
+        }
+      ]
+    }
+  },
+  "ietf-netconf-acm:nacm": {
+    "enable-nacm": true,
+    "groups": {
+      "group": [
+        {
+          "name": "admin",
+          "user-name": [
+            "admin"
+          ]
+        }
+      ]
+    },
+    "rule-list": [
+      {
+        "name": "admin-acl",
+        "group": [
+          "admin"
+        ],
+        "rule": [
+          {
+            "name": "permit-all",
+            "module-name": "*",
+            "access-operations": "*",
+            "action": "permit",
+            "comment": "Allow 'admin' group complete access to all operations and data."
+          }
+        ]
+      },
+      {
+        "name": "default-deny-all",
+        "group": [
+          "*"
+        ],
+        "rule": [
+          {
+            "name":  "deny-password-read",
+            "module-name": "ietf-system",
+            "path": "/ietf-system:system/authentication/user/password",
+            "access-operations": "*",
+            "action": "deny"
+          }
+        ]
+      }
+    ]
+  },
+  "ietf-netconf-server:netconf-server": {
+    "listen": {
+      "endpoints": {
+        "endpoint": [
+          {
+            "name": "default-ssh",
+            "ssh": {
+              "tcp-server-parameters": {
+                "local-address": "::"
+              },
+              "ssh-server-parameters": {
+                "server-identity": {
+                  "host-key": [
+                    {
+                      "name": "default-key",
+                      "public-key": {
+                        "central-keystore-reference": "genkey"
+                      }
+                    }
+                  ]
+                }
+              }
+            }
+          }
+        ]
+      }
+    }
+  },
+  "ietf-system:system": {
+    "hostname": "rpi4",
+    "ntp": {
+      "enabled": true,
+      "server": [
+        {
+          "name": "ntp.org",
+          "udp": {
+            "address": "pool.ntp.org"
+          },
+	  "iburst": true
+        }
+      ]
+    },
+    "authentication": {
+      "user": [
+        {
+          "name": "admin",
+          "password": "$factory$",
+          "infix-system:shell": "bash"
+        }
+      ]
+    },
+    "infix-system:motd-banner": "Li0tLS0tLS0uCnwgIC4gLiAgfCBJbmZpeCAtLSBhIE5ldHdvcmsgT3BlcmF0aW5nIFN5c3RlbQp8LS4gdiAuLXwgaHR0cHM6Ly9rZXJuZWxraXQuZ2l0aHViLmlvCictJy0tLSctJwo="
+  },
+  "infix-dhcp-client:dhcp-client": {
+    "client-if": [
+      {
+        "if-name": "eth0",
+        "option": [
+          {
+            "id": "netmask"
+          },
+          {
+            "id": "broadcast"
+          },
+          {
+            "id": "router"
+          },
+          {
+            "id": "domain"
+          },
+          {
+            "id": "hostname"
+          },
+          {
+            "id": "dns-server"
+          },
+          {
+            "id": "ntp-server"
+          }
+        ]
+      }
+    ]
+  },
+  "infix-meta:meta": {
+    "infix-meta:version": "1.2"
+  },
+  "infix-services:mdns": {
+    "enabled": true
+  },
+  "infix-services:web": {
+    "enabled": true,
+    "console": {
+      "enabled": true
+    },
+    "netbrowse": {
+      "enabled": true
+    },
+    "restconf": {
+      "enabled": true
+    }
+  }
+}
diff --git a/board/aarch64/rpi/uboot/extras.config b/board/aarch64/rpi/uboot/extras.config
new file mode 100644
index 00000000..f9b51ba9
--- /dev/null
+++ b/board/aarch64/rpi/uboot/extras.config
@@ -0,0 +1,3 @@
+# CONFIG_MMC_PCI is not set
+CONFIG_OF_OVERLAY_LIST="rpi-env infix-key"
+# CONFIG_ENV_IS_IN_FAT is not set
diff --git a/board/aarch64/rpi/uboot/rpi-env.dtso b/board/aarch64/rpi/uboot/rpi-env.dtso
new file mode 100644
index 00000000..10502a3e
--- /dev/null
+++ b/board/aarch64/rpi/uboot/rpi-env.dtso
@@ -0,0 +1,27 @@
+/dts-v1/;
+/plugin/;
+
+&{/} {
+	config {
+		environment {
+			vendor = "infix";
+			preboot = "run ixpreboot";
+			ixbootdelay = "0.5";
+			bootdelay = "-2";
+			bootmenu_delay = "10";
+			boot_targets = "mmc1";
+			ethprime = "eth0";
+			bootcmd = "run ixboot";
+
+			ixpreboot     = /incbin/("scripts/ixpreboot.sh");
+			ixbtn-devmode = "setenv dev_mode yes; echo Enabled";
+			ixbtn-factory = "echo \"No button available, use bootmenu\"";
+			ixfactory     = /incbin/("scripts/ixfactory.sh");
+
+			ixboot      = /incbin/("scripts/ixboot.sh");
+			ixbootslot  = /incbin/("scripts/ixbootslot.sh");
+			ixprepblk   = /incbin/("scripts/ixprepblk.sh");
+			ixprepdhcp  = /incbin/("scripts/ixprepdhcp.sh");
+		};
+	};
+};
diff --git a/configs/rpi4_defconfig b/configs/rpi4_defconfig
index 584f3522..ac58c1a3 100644
--- a/configs/rpi4_defconfig
+++ b/configs/rpi4_defconfig
@@ -15,6 +15,7 @@ BR2_INIT_FINIT=y
 BR2_ROOTFS_DEVICE_CREATION_DYNAMIC_EUDEV=y
 BR2_ROOTFS_DEVICE_TABLE="system/device_table.txt ${BR2_EXTERNAL_INFIX_PATH}/board/common/xattrs"
 BR2_ROOTFS_MERGED_USR=y
+# BR2_TARGET_ENABLE_ROOT_LOGIN is not set
 BR2_SYSTEM_BIN_SH_BASH=y
 BR2_TARGET_GENERIC_GETTY_PORT="@console"
 BR2_TARGET_GENERIC_GETTY_TERM="xterm"
@@ -24,8 +25,8 @@ BR2_ENABLE_LOCALE_WHITELIST="C en_US en_CA C.UTF-8"
 BR2_GENERATE_LOCALE="en_US en_CA C.UTF-8"
 BR2_TARGET_TZ_INFO=y
 BR2_ROOTFS_OVERLAY="${BR2_EXTERNAL_INFIX_PATH}/board/common/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rootfs ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/rootfs"
-BR2_ROOTFS_POST_BUILD_SCRIPT="board/raspberrypi4-64/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh"
-BR2_ROOTFS_POST_IMAGE_SCRIPT="board/raspberrypi4-64/post-image.sh"
+BR2_ROOTFS_POST_BUILD_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-build.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-build.sh"
+BR2_ROOTFS_POST_IMAGE_SCRIPT="${BR2_EXTERNAL_INFIX_PATH}/board/common/post-image.sh ${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/post-image.sh"
 BR2_LINUX_KERNEL=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION=y
 BR2_LINUX_KERNEL_CUSTOM_VERSION_VALUE="6.12.30"
@@ -34,6 +35,8 @@ BR2_LINUX_KERNEL_USE_CUSTOM_CONFIG=y
 BR2_LINUX_KERNEL_CUSTOM_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/bcm2711_defconfig"
 BR2_LINUX_KERNEL_DTS_SUPPORT=y
 BR2_LINUX_KERNEL_INTREE_DTS_NAME="broadcom/bcm2711-rpi-4-b broadcom/bcm2711-rpi-400"
+BR2_LINUX_KERNEL_DTB_KEEP_DIRNAME=y
+BR2_LINUX_KERNEL_INSTALL_TARGET=y
 BR2_LINUX_KERNEL_NEEDS_HOST_OPENSSL=y
 BR2_PACKAGE_BUSYBOX_CONFIG="$(BR2_EXTERNAL_INFIX_PATH)/board/common/busybox_defconfig"
 BR2_PACKAGE_XZ=y
@@ -41,6 +44,8 @@ BR2_PACKAGE_STRACE=y
 BR2_PACKAGE_STRESS_NG=y
 BR2_PACKAGE_JQ=y
 BR2_PACKAGE_E2FSPROGS=y
+BR2_PACKAGE_ARMBIAN_FIRMWARE=y
+BR2_PACKAGE_ARMBIAN_FIRMWARE_AP6255=y
 BR2_PACKAGE_BRCMFMAC_SDIO_FIRMWARE_RPI=y
 BR2_PACKAGE_LINUX_FIRMWARE=y
 BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM43XX=y
@@ -49,6 +54,7 @@ BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366B1=y
 BR2_PACKAGE_LINUX_FIRMWARE_BRCM_BCM4366C0=y
 BR2_PACKAGE_RPI_FIRMWARE=y
 BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4=y
+BR2_PACKAGE_RPI_FIRMWARE_VARIANT_PI4_X=y
 BR2_PACKAGE_RPI_FIRMWARE_CONFIG_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/config.txt"
 BR2_PACKAGE_RPI_FIRMWARE_CMDLINE_FILE="${BR2_EXTERNAL_INFIX_PATH}/board/aarch64/rpi/cmdline.txt"
 BR2_PACKAGE_DBUS_CXX=y
@@ -60,8 +66,13 @@ BR2_PACKAGE_EVEMU=y
 BR2_PACKAGE_EVTEST=y
 BR2_PACKAGE_GPTFDISK=y
 BR2_PACKAGE_GPTFDISK_SGDISK=y
+BR2_PACKAGE_INPUT_EVENT_DAEMON=y
 BR2_PACKAGE_MDIO_TOOLS=y
 BR2_PACKAGE_RNG_TOOLS=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
+BR2_PACKAGE_UBOOT_TOOLS_FIT_CHECK_SIGN=y
+BR2_PACKAGE_UBOOT_TOOLS_MKENVIMAGE=y
 BR2_PACKAGE_PYTHON3=y
 BR2_PACKAGE_PYTHON_GUNICORN=y
 BR2_PACKAGE_LIBSSH_OPENSSL=y
@@ -83,10 +94,12 @@ BR2_PACKAGE_DNSMASQ=y
 BR2_PACKAGE_ETHTOOL=y
 BR2_PACKAGE_FPING=y
 BR2_PACKAGE_FRR=y
+BR2_PACKAGE_HOSTAPD=y
 # BR2_PACKAGE_IFUPDOWN_SCRIPTS is not set
 BR2_PACKAGE_IPROUTE2=y
 BR2_PACKAGE_IPTABLES_NFTABLES=y
 BR2_PACKAGE_IPUTILS=y
+BR2_PACKAGE_IW=y
 BR2_PACKAGE_LLDPD=y
 BR2_PACKAGE_MSTPD=y
 BR2_PACKAGE_NETCALC=y
@@ -129,18 +142,25 @@ BR2_PACKAGE_WATCHDOGD=y
 BR2_PACKAGE_LESS=y
 BR2_PACKAGE_MG=y
 BR2_PACKAGE_NANO=y
-BR2_TARGET_ROOTFS_EXT2=y
-BR2_TARGET_ROOTFS_EXT2_4=y
-BR2_TARGET_ROOTFS_EXT2_SIZE="384M"
 BR2_TARGET_ROOTFS_SQUASHFS=y
 # BR2_TARGET_ROOTFS_TAR is not set
+BR2_TARGET_UBOOT=y
+BR2_TARGET_UBOOT_BOARD_DEFCONFIG="rpi_arm64"
+BR2_TARGET_UBOOT_CONFIG_FRAGMENT_FILES="$(BR2_EXTERNAL_INFIX_PATH)/board/common/uboot/extras.config $(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/extras.config"
+BR2_TARGET_UBOOT_FORMAT_CUSTOM=y
+BR2_TARGET_UBOOT_FORMAT_CUSTOM_NAME="arch/arm/dts/infix-key.dtbo arch/arm/dts/rpi-env.dtbo"
+BR2_TARGET_UBOOT_CUSTOM_DTS_PATH="$(BR2_EXTERNAL_INFIX_PATH)/board/aarch64/rpi/uboot/rpi-env.dtso"
 BR2_PACKAGE_HOST_DOSFSTOOLS=y
+BR2_PACKAGE_HOST_E2FSPROGS=y
 BR2_PACKAGE_HOST_ENVIRONMENT_SETUP=y
 BR2_PACKAGE_HOST_GENEXT2FS=y
 BR2_PACKAGE_HOST_GENIMAGE=y
 BR2_PACKAGE_HOST_KMOD_XZ=y
 BR2_PACKAGE_HOST_MTOOLS=y
 BR2_PACKAGE_HOST_RAUC=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SUPPORT=y
+BR2_PACKAGE_HOST_UBOOT_TOOLS_FIT_SIGNATURE_SUPPORT=y
 INFIX_VENDOR_HOME="https://github.com/kernelkit"
 INFIX_IMAGE_ID="${INFIX_ID}-rpi4"
 INFIX_DESC="Infix is a Network Operating System based on Linux.  It can be set up both as a switch, with offloading using switchdev, and a router with firewalling."