diff --git a/maintainers/maintainer-list.nix b/maintainers/maintainer-list.nix
index 9b311f81be4f2..3a1df13e39858 100644
--- a/maintainers/maintainer-list.nix
+++ b/maintainers/maintainer-list.nix
@@ -106,6 +106,12 @@
     githubId = 7755101;
     name = "Aaron Andersen";
   };
+  aarapov = {
+    email = "anton@deadbeef.mx";
+    github = "arapov";
+    githubId = 1823164;
+    name = "Anton Arapov";
+  };
   aaronjanse = {
     email = "aaron@ajanse.me";
     github = "aaronjanse";
diff --git a/pkgs/misc/gxlimg/default.nix b/pkgs/misc/gxlimg/default.nix
new file mode 100644
index 0000000000000..004b915d26dc2
--- /dev/null
+++ b/pkgs/misc/gxlimg/default.nix
@@ -0,0 +1,29 @@
+{ lib, stdenv, fetchFromGitHub, openssl }:
+
+stdenv.mkDerivation rec {
+  pname = "gxlimg";
+  version = "unstable-2020-10-30";
+
+  src = fetchFromGitHub {
+    owner = "repk";
+    repo = pname;
+    rev = "c545568fdd6a0470da4265a3532f5e652646707f";
+    sha256 = "05799f3gdxjqcv0s7bba724n8pxr0hldcj0p5n9ab92vgasgnpcq";
+  };
+
+  buildInputs = [
+    openssl
+  ];
+
+  installPhase = ''
+    mkdir -p "$out/bin"
+    mv gxlimg "$out/bin"
+  '';
+
+  meta = with lib; {
+    homepage = "https://github.com/repk/gxlimg";
+    description = "Boot Image creation tool for amlogic s905x (GXL)";
+    license = licenses.bsd2;
+    maintainers = with maintainers; [ samueldr ];
+  };
+}
diff --git a/pkgs/misc/meson64-tools/default.nix b/pkgs/misc/meson64-tools/default.nix
new file mode 100644
index 0000000000000..5aa5224efa5e5
--- /dev/null
+++ b/pkgs/misc/meson64-tools/default.nix
@@ -0,0 +1,40 @@
+{ lib, stdenv, fetchFromGitHub, buildPackages }:
+
+stdenv.mkDerivation rec {
+  pname = "meson64-tools";
+  version = "unstable-2020-08-03";
+
+  src = fetchFromGitHub {
+    owner = "angerman";
+    repo = pname;
+    rev = "a2d57d11fd8b4242b903c10dca9d25f7f99d8ff0";
+    sha256 = "1487cr7sv34yry8f0chaj6s2g3736dzq0aqw239ahdy30yg7hb2v";
+  };
+
+  buildInputs = with buildPackages; [ openssl bison yacc flex bc python3 ];
+
+  preBuild = ''
+    patchShebangs .
+    substituteInPlace mbedtls/programs/fuzz/Makefile --replace "python2" "python"
+    substituteInPlace mbedtls/tests/Makefile --replace "python2" "python"
+  '';
+
+  # Also prefix tool names since some names are really generic (e.g. `pkg`).
+  # Otherwise something could shadow those generic names in other builds.
+  postInstall = ''
+    (cd $out/bin
+      for bin in *; do
+        ln -s $bin meson64-$bin
+      done
+    )
+  '';
+
+  makeFlags = [ "PREFIX=$(out)/bin" ];
+
+  meta = with lib; {
+    homepage = "https://github.com/angerman/meson64-tools";
+    description = "Tools for Amlogic Meson ARM64 platforms";
+    license = licenses.unfree; # https://github.com/angerman/meson64-tools/issues/2
+    maintainers = with maintainers; [ aarapov ];
+  };
+}
diff --git a/pkgs/misc/uboot/amlogic-firmware.nix b/pkgs/misc/uboot/amlogic-firmware.nix
new file mode 100644
index 0000000000000..fe44467d960da
--- /dev/null
+++ b/pkgs/misc/uboot/amlogic-firmware.nix
@@ -0,0 +1,34 @@
+{ stdenv
+, lib
+, fetchpatch
+, fetchFromGitHub
+}:
+
+stdenv.mkDerivation {
+  pname = "amlogic-firmware";
+  version = "2021-01-29";
+
+  src = fetchFromGitHub {
+    owner = "LibreELEC";
+    repo = "amlogic-boot-fip";
+    rev = "ac20772f44b2b74c8f55331b5c91a277d0bfbc37";
+    sha256 = "1z739644655w1wbfi3456qg9k1izrmn2xci6vjh4sb55cxydja15";
+  };
+
+  installPhase = ''
+    # We're lazy... this will allow us to *just* copy everything in $out
+    rm -v LICENSE README.md
+    # Remove unneeded files; we're not re-using the downstream build infra.
+    rm -v */aml_encrypt* */fip_create
+    mkdir -p $out
+    mv -t $out/ *
+  '';
+
+  dontFixup = true;
+
+  meta = with lib; {
+    description = "Firmware Image Package (FIP) sources used to sign Amlogic U-Boot binaries";
+    license = licenses.unfreeRedistributableFirmware;
+    maintainers = with maintainers; [ samueldr ];
+  };
+}
diff --git a/pkgs/misc/uboot/amlogic.nix b/pkgs/misc/uboot/amlogic.nix
new file mode 100644
index 0000000000000..c4b3c1e1124c4
--- /dev/null
+++ b/pkgs/misc/uboot/amlogic.nix
@@ -0,0 +1,258 @@
+{ buildUBoot
+, armTrustedFirmwareS905
+, armTrustedFirmwareTools
+, firmwareAmlogic
+, gxlimg
+, libfaketime
+, meson-tools
+, meson64-tools
+}:
+
+# The Amlogic builds of U-Boot are more involved than the usual other simpler 
+# upstream U-Boot builds.
+#
+# Amlogic uses a set of signed binary firmware files as an initial boot stage,
+# and there is no Free Libre or Open source replacement available.
+
+# Identifying the SoC family
+#
+# The "linux-meson" development community wiki will tell you which family the
+# SoC for your board is using.
+#
+#  - https://linux-meson.com/doku.php#target_hardware
+#
+# Additionally, the build instructions generally hint at it through the binary
+# tools names, e.g. `aml_encrypt_gxl` is for `GXL`.
+
+let
+  # Recognizable by the use of `aml_encrypt_g12a` or `aml_encrypt_g12b`
+  buildUBootMesonG12A = { FIPDIR, ... } @ args: buildUBoot ({
+    nativeBuildInputs = [
+      libfaketime
+      meson64-tools
+    ];
+
+    postBuild = ''
+      meson64-pkg --type bl30 --output bl30_new.bin \
+        $FIPDIR/bl30.bin $FIPDIR/bl301.bin
+
+      meson64-pkg --type bl2 --output bl2_new.bin \
+        $FIPDIR/bl2.bin $FIPDIR/acs.bin
+
+      meson64-bl30sig --input bl30_new.bin \
+        --output bl30_new.bin.g12a.enc --level v3
+
+      meson64-bl3sig --input  bl30_new.bin.g12a.enc \
+        --output bl30_new.bin.enc --level v3 --type bl30
+
+      meson64-bl3sig --input $FIPDIR/bl31.img \
+        --output bl31.img.enc --level v3 --type bl31
+
+      # The lz4 compression here introduces a timestamp in the build.
+      faketime -f "1970-01-01 00:00:01" \
+      meson64-bl3sig --input u-boot.bin --compress lz4 \
+        --output bl33.bin.enc --level v3 --type bl33 --compress lz4
+
+      meson64-bl2sig --input bl2_new.bin \
+        --output bl2.n.bin.sig
+
+      bootmk_args=(
+        --bl2 bl2.n.bin.sig
+        --bl30 bl30_new.bin.enc
+        --bl31 bl31.img.enc
+        --bl33 bl33.bin.enc
+
+        --ddrfw1 $FIPDIR/ddr4_1d.fw
+        --ddrfw2 $FIPDIR/ddr4_2d.fw
+        --ddrfw3 $FIPDIR/ddr3_1d.fw
+        --ddrfw4 $FIPDIR/piei.fw
+        --ddrfw5 $FIPDIR/lpddr4_1d.fw
+        --ddrfw6 $FIPDIR/lpddr4_2d.fw
+        --ddrfw7 $FIPDIR/diag_lpddr4.fw
+      )
+
+      # ddrfw 8 through 9, according to U-Boot documentation, are not always
+      # present.
+
+      if test -e $FIPDIR/aml_ddr.fw; then
+        bootmk_args+=( --ddrfw8 $FIPDIR/aml_ddr.fw )
+      fi
+
+      if test -e $FIPDIR/lpddr3_1d.fw; then
+        bootmk_args+=( --ddrfw9 $FIPDIR/lpddr3_1d.fw )
+      fi
+
+      bootmk_args+=( --level v3 )
+
+      meson64-bootmk --output u-boot.bin \
+        "''${bootmk_args[@]}"
+
+      # Help out the user a little.
+      cat > README.md <<EOF
+      The boot firmware is installed in the "unused" space after the MBR.
+
+          $ dd if=u-boot.bin of=... conv=fsync,notrunc bs=512 seek=1
+      EOF
+    '';
+
+    filesToInstall = [ "u-boot.bin" "README.md" ];
+    extraMeta.platforms = ["aarch64-linux"];
+  } // args);
+
+  # Recognizable by the use of `aml_encrypt_gxl`
+  buildUBootMesonGXL =
+    { FIPDIR, ... } @ args: buildUBoot ({
+    nativeBuildInputs = [
+      gxlimg
+    ];
+    
+    postBuild = ''
+      # Sign BL2
+      python3 $FIPDIR/acs_tool.py $FIPDIR/bl2.bin ./bl2_acs.bin $FIPDIR/acs.bin 0
+      sh $FIPDIR/blx_fix.sh \
+        ./bl2_acs.bin \
+        ./tmp.zero \
+        ./tmp.bl2.zero.bin \
+        $FIPDIR/bl21.bin \
+        ./tmp.bl21.zero.bin \
+        ./bl2_new.bin \
+        bl2
+      gxlimg -t bl2 -s bl2_new.bin bl2.bin.enc
+
+      # Sign Bl3*
+      sh $FIPDIR/blx_fix.sh \
+        $FIPDIR/bl30.bin \
+        ./tmp.zero \
+        ./tmp.bl30.zero.bin \
+        $FIPDIR/bl301.bin \
+        ./tmp.bl301.zero.bin \
+        ./bl30_new.bin \
+        bl30
+      gxlimg -t bl3x -c bl30_new.bin     bl30.bin.enc
+      gxlimg -t bl3x -c $FIPDIR/bl31.img bl31.img.enc
+
+      # Encrypt U-Boot
+      gxlimg -t bl3x -c u-boot.bin u-boot.bin.enc
+      gxlimg -t fip \
+        --bl2 ./bl2.bin.enc \
+        --bl30 ./bl30.bin.enc \
+        --bl31 ./bl31.img.enc \
+        --bl33 ./u-boot.bin.enc \
+        ./gxl-boot.bin
+      mv -v gxl-boot.bin u-boot.bin
+
+      # Prepare USB boot files
+      dd if=u-boot.bin of=u-boot.bin.usb.bl2 bs=49152 count=1
+      dd if=u-boot.bin of=u-boot.bin.usb.tpl skip=49152 bs=1
+
+      # Help out the user a little.
+      cat > README.md <<EOF
+      This firmware can be installed to the SPI Flash if your board has one.
+      Installing to the SPI Flash is preferred.
+
+      Alternatively, the boot firmware can be installed in the "unused" space
+      after the MBR of either the SD card or the eMMC.
+
+          $ dd if=u-boot.bin of=... conv=fsync,notrunc bs=512 seek=1
+
+      * * *
+
+      The `u-boot.bin.usb.*` files are meant to be booted through USB.
+      Look at [pyamlboot](https://github.com/superna9999/pyamlboot) for more
+      information. End-users generally don't need to care about these files.
+      EOF
+    '';
+
+    filesToInstall = [ "u-boot.bin" "u-boot.bin.usb.bl2" "u-boot.bin.usb.tpl" "README.md" ];
+    extraMeta.platforms = ["aarch64-linux"];
+  } // args);
+in
+{
+  inherit buildUBootMesonG12A;
+
+  ubootLibretechAC = buildUBootMesonGXL {
+    # Amlogic S805X
+    defconfig = "libretech-ac_defconfig";
+    FIPDIR = "${firmwareAmlogic}/lafrite";
+  };
+
+  ubootOdroidC2 = buildUBoot {
+    # Amlogic S905 / GXBB
+    # This uses a bespoke build because while it's GXBB, the binaries from the
+    # vendor are not as expected.
+    defconfig = "odroid-c2_defconfig";
+
+    nativeBuildInputs = [
+      armTrustedFirmwareTools
+      meson-tools
+    ];
+
+    FIPDIR = "${firmwareAmlogic}/odroid-c2";
+    BL31 = "${armTrustedFirmwareS905}/bl31.bin";
+
+    postBuild = ''
+      # BL301 image needs at least 64 bytes of padding after it to place
+      # signing headers (with amlbootsig)
+      truncate -s 64 bl301.padding.bin
+      cat $FIPDIR/bl301.bin bl301.padding.bin > bl301.padded.bin
+
+      # The downstream fip_create tool adds a custom TOC entry with UUID
+      # AABBCCDD-ABCD-EFEF-ABCD-12345678ABCD for the BL301 image. It turns out
+      # that the firmware blob does not actually care about UUIDs, only the
+      # order the images appear in the file. Because fiptool does not know
+      # about the BL301 UUID, we would have to use the --blob option, which adds
+      # the image to the end of the file, causing the boot to fail. Instead, we
+      # take advantage of the fact that UUIDs are ignored and just put the
+      # images in the right order with the wrong UUIDs. In the command below,
+      # --tb-fw is really --scp-fw and --scp-fw is the BL301 image.
+      #
+      # See https://github.com/afaerber/meson-tools/issues/3 for more
+      # information.
+      fiptool create \
+        --align 0x4000 \
+        --tb-fw $FIPDIR/bl30.bin \
+        --scp-fw bl301.padded.bin \
+        --soc-fw $BL31 \
+        --nt-fw u-boot.bin \
+        fip.bin
+      cat $FIPDIR/bl2.package fip.bin > boot_new.bin
+      amlbootsig boot_new.bin u-boot.img
+
+      # Extract u-boot from the image
+      dd if=u-boot.img of=u-boot.bin bs=512 skip=96
+
+      # Ensure we're not accidentally re-using this transient u-boot image
+      rm u-boot.img
+
+      # Pick bl1.bin.hardkernel from FIPDIR so it can be installed in filesToInstall.
+      cp $FIPDIR/bl1.bin.hardkernel ./
+
+      # Create the .img file to flash from sector 0x01 (bs=512 seek=1)
+      # It contains the remainder of bl1.bin.hardkernel and u-boot
+      dd if=bl1.bin.hardkernel of=u-boot.img conv=notrunc bs=512 skip=1 seek=0
+      dd if=u-boot.bin         of=u-boot.img conv=notrunc bs=512 seek=96
+
+      # Help out the user a little.
+      cat > README.md <<EOF
+      Since the GXB boot flow starts at sector 0x00, the user needs to
+      flash the first 442 bytes themselves.
+
+          $ dd if=bl1.bin.hardkernel of=... conv=fsync,notrunc bs=1 count=442
+          $ dd if=u-boot.img         of=... conv=fsync,notrunc bs=512 seek=1
+      EOF
+    '';
+
+    filesToInstall = [
+      "README.md"
+      "u-boot.img"
+      "bl1.bin.hardkernel"
+    ];
+    extraMeta.platforms = ["aarch64-linux"];
+  };
+
+  ubootOdroidC4 = buildUBootMesonG12A {
+    # Amlogic S905X3 / SM1, G12A compatible build
+    defconfig = "odroid-c4_defconfig";
+    FIPDIR = "${firmwareAmlogic}/odroid-c4";
+  };
+}
diff --git a/pkgs/misc/uboot/default.nix b/pkgs/misc/uboot/default.nix
index 6c59c13d12e2a..bca904218536c 100644
--- a/pkgs/misc/uboot/default.nix
+++ b/pkgs/misc/uboot/default.nix
@@ -1,7 +1,6 @@
 { stdenv
 , lib
 , fetchurl
-, fetchpatch
 , fetchFromGitHub
 , bc
 , bison
@@ -9,14 +8,13 @@
 , flex
 , openssl
 , swig
-, meson-tools
 , armTrustedFirmwareAllwinner
 , armTrustedFirmwareRK3328
 , armTrustedFirmwareRK3399
-, armTrustedFirmwareS905
 , buildPackages
 }:
 
+# For Amlogic U-Boot builds, look at the `amlogic.nix` expression.
 let
   defaultVersion = "2021.01";
   defaultSrc = fetchurl {
@@ -33,6 +31,7 @@ let
   , extraPatches ? []
   , extraMakeFlags ? []
   , extraMeta ? {}
+  , nativeBuildInputs ? []
   , ... } @ args: stdenv.mkDerivation ({
     pname = "uboot-${defconfig}";
 
@@ -60,7 +59,7 @@ let
         p.setuptools # for pkg_resources
       ]))
       swig
-    ];
+    ] ++ nativeBuildInputs;
     depsBuildBuild = [ buildPackages.stdenv.cc ];
 
     hardeningDisable = [ "all" ];
@@ -102,7 +101,7 @@ let
       license = licenses.gpl2;
       maintainers = with maintainers; [ dezgeg samueldr lopsided98 ];
     } // extraMeta;
-  } // removeAttrs args [ "extraMeta" ]);
+  } // removeAttrs args [ "extraMeta" "nativeBuildInputs" ]);
 
 in {
   inherit buildUBoot;
@@ -206,52 +205,6 @@ in {
     filesToInstall = ["u-boot-dtb.img" "SPL"];
   };
 
-  # Flashing instructions:
-  # dd if=bl1.bin.hardkernel of=<device> conv=fsync bs=1 count=442
-  # dd if=bl1.bin.hardkernel of=<device> conv=fsync bs=512 skip=1 seek=1
-  # dd if=u-boot.gxbb of=<device> conv=fsync bs=512 seek=97
-  ubootOdroidC2 = let
-    firmwareBlobs = fetchFromGitHub {
-      owner = "armbian";
-      repo = "odroidc2-blobs";
-      rev = "47c5aac4bcac6f067cebe76e41fb9924d45b429c";
-      sha256 = "1ns0a130yxnxysia8c3q2fgyjp9k0nkr689dxk88qh2vnibgchnp";
-      meta.license = lib.licenses.unfreeRedistributableFirmware;
-    };
-  in buildUBoot {
-    defconfig = "odroid-c2_defconfig";
-    extraMeta.platforms = ["aarch64-linux"];
-    filesToInstall = ["u-boot.bin" "u-boot.gxbb" "${firmwareBlobs}/bl1.bin.hardkernel"];
-    postBuild = ''
-      # BL301 image needs at least 64 bytes of padding after it to place
-      # signing headers (with amlbootsig)
-      truncate -s 64 bl301.padding.bin
-      cat '${firmwareBlobs}/gxb/bl301.bin' bl301.padding.bin > bl301.padded.bin
-      # The downstream fip_create tool adds a custom TOC entry with UUID
-      # AABBCCDD-ABCD-EFEF-ABCD-12345678ABCD for the BL301 image. It turns out
-      # that the firmware blob does not actually care about UUIDs, only the
-      # order the images appear in the file. Because fiptool does not know
-      # about the BL301 UUID, we would have to use the --blob option, which adds
-      # the image to the end of the file, causing the boot to fail. Instead, we
-      # take advantage of the fact that UUIDs are ignored and just put the
-      # images in the right order with the wrong UUIDs. In the command below,
-      # --tb-fw is really --scp-fw and --scp-fw is the BL301 image.
-      #
-      # See https://github.com/afaerber/meson-tools/issues/3 for more
-      # information.
-      '${buildPackages.armTrustedFirmwareTools}/bin/fiptool' create \
-        --align 0x4000 \
-        --tb-fw '${firmwareBlobs}/gxb/bl30.bin' \
-        --scp-fw bl301.padded.bin \
-        --soc-fw '${armTrustedFirmwareS905}/bl31.bin' \
-        --nt-fw u-boot.bin \
-        fip.bin
-      cat '${firmwareBlobs}/gxb/bl2.package' fip.bin > boot_new.bin
-      '${buildPackages.meson-tools}/bin/amlbootsig' boot_new.bin u-boot.img
-      dd if=u-boot.img of=u-boot.gxbb bs=512 skip=96
-    '';
-  };
-
   ubootOdroidXU3 = buildUBoot {
     defconfig = "odroid-xu3_defconfig";
     extraMeta.platforms = ["armv7l-linux"];
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 5b99669220f62..46dfb0d160f3c 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -2597,6 +2597,8 @@ in
 
   gti = callPackage ../tools/misc/gti { };
 
+  gxlimg = callPackage ../misc/gxlimg { };
+
   hdate = callPackage ../applications/misc/hdate { };
 
   heatseeker = callPackage ../tools/misc/heatseeker { };
@@ -2749,6 +2751,8 @@ in
 
   meson-tools = callPackage ../misc/meson-tools { };
 
+  meson64-tools = callPackage ../misc/meson64-tools { };
+
   metabase = callPackage ../servers/metabase { };
 
   midicsv = callPackage ../tools/audio/midicsv { };
@@ -20712,7 +20716,6 @@ in
     ubootJetsonTK1
     ubootNanoPCT4
     ubootNovena
-    ubootOdroidC2
     ubootOdroidXU3
     ubootOrangePiPc
     ubootOrangePiZeroPlus2H5
@@ -20741,6 +20744,17 @@ in
     ubootWandboard
     ;
 
+  # Upstream U-Boot, for Amlogic
+  inherit (callPackage ../misc/uboot/amlogic.nix {})
+    buildUBootMesonG12A
+    buildUBootMesonGXL
+    ubootLibretechAC
+    ubootOdroidC2
+    ubootOdroidC4
+  ;
+
+  firmwareAmlogic = callPackage ../misc/uboot/amlogic-firmware.nix {};
+
   # Upstream Barebox:
   inherit (callPackage ../misc/barebox {})
     buildBarebox