diff --git a/import-layers/meta-raspberrypi/recipes-bsp/bootfiles/rpi-config_git.bb b/import-layers/meta-raspberrypi/recipes-bsp/bootfiles/rpi-config_git.bb
index 4bc8eb7..f610718 100644
--- a/import-layers/meta-raspberrypi/recipes-bsp/bootfiles/rpi-config_git.bb
+++ b/import-layers/meta-raspberrypi/recipes-bsp/bootfiles/rpi-config_git.bb
@@ -13,12 +13,14 @@
 
 S = "${WORKDIR}/git"
 
-PR = "r4"
+PR = "r5"
 
 PITFT="${@bb.utils.contains("MACHINE_FEATURES", "pitft", "1", "0", d)}"
 PITFT22="${@bb.utils.contains("MACHINE_FEATURES", "pitft22", "1", "0", d)}"
 PITFT28r="${@bb.utils.contains("MACHINE_FEATURES", "pitft28r", "1", "0", d)}"
 
+VC4GRAPHICS="${@bb.utils.contains("MACHINE_FEATURES", "vc4graphics", "1", "0", d)}"
+
 inherit deploy
 
 do_deploy() {
@@ -102,6 +104,12 @@
         echo "# Enable UART" >>${DEPLOYDIR}/bcm2835-bootfiles/config.txt
         echo "enable_uart=1" >>${DEPLOYDIR}/bcm2835-bootfiles/config.txt
     fi
+
+    # VC4 Graphics support
+    if [ "${VC4GRAPHICS}" = "1" ]; then
+        echo "# Enable VC4 Graphics" >> ${DEPLOYDIR}/bcm2835-bootfiles/config.txt
+        echo "dtoverlay=vc4-kms-v3d,${VC4_CMA_SIZE}" >> ${DEPLOYDIR}/bcm2835-bootfiles/config.txt
+    fi
 }
 
 addtask deploy before do_package after do_install
diff --git a/import-layers/meta-raspberrypi/recipes-bsp/common/firmware.inc b/import-layers/meta-raspberrypi/recipes-bsp/common/firmware.inc
index 9df6156..1961b48 100644
--- a/import-layers/meta-raspberrypi/recipes-bsp/common/firmware.inc
+++ b/import-layers/meta-raspberrypi/recipes-bsp/common/firmware.inc
@@ -1,8 +1,10 @@
-RPIFW_SRCREV ?= "390f53ed0fd79df274bdcc81d99e09fa262f03ab"
-RPIFW_DATE ?= "20160622"
-RPIFW_SRC_URI ?= "git://github.com/raspberrypi/firmware.git;protocol=git;branch=master"
-RPIFW_S ?= "${WORKDIR}/git"
+RPIFW_DATE ?= "20161125"
+RPIFW_SRC_URI ?= "https://github.com/raspberrypi/firmware/archive/1.${RPIFW_DATE}.tar.gz"
+RPIFW_S ?= "${WORKDIR}/firmware-1.${RPIFW_DATE}"
 
 SRC_URI = "${RPIFW_SRC_URI}"
-SRCREV = "${RPIFW_SRCREV}"
+SRC_URI[md5sum] = "a9281d2869e2d7673a83d41bacfa66c2"
+SRC_URI[sha256sum] = "744e050630621c70991c91e0ee8663dc2f579e743583ca762b13b00bc75859bc"
+
 PV = "${RPIFW_DATE}"
+
diff --git a/import-layers/meta-raspberrypi/recipes-bsp/rpi-u-boot-scr/files/boot.cmd b/import-layers/meta-raspberrypi/recipes-bsp/rpi-u-boot-scr/files/boot.cmd
new file mode 100644
index 0000000..2e8452e
--- /dev/null
+++ b/import-layers/meta-raspberrypi/recipes-bsp/rpi-u-boot-scr/files/boot.cmd
@@ -0,0 +1,3 @@
+fdt addr ${fdt_addr} && fdt get value bootargs /chosen bootargs
+fatload mmc 0:1 ${kernel_addr_r} uImage
+bootm ${kernel_addr_r} - ${fdt_addr}
diff --git a/import-layers/meta-raspberrypi/recipes-bsp/rpi-u-boot-scr/rpi-u-boot-scr.bb b/import-layers/meta-raspberrypi/recipes-bsp/rpi-u-boot-scr/rpi-u-boot-scr.bb
new file mode 100644
index 0000000..4936dcf
--- /dev/null
+++ b/import-layers/meta-raspberrypi/recipes-bsp/rpi-u-boot-scr/rpi-u-boot-scr.bb
@@ -0,0 +1,21 @@
+SUMMARY = "U-boot boot scripts for Raspberry Pi"
+LICENSE = "MIT"
+LIC_FILES_CHKSUM = "file://${COREBASE}/meta/COPYING.MIT;md5=3da9cfbcb788c80a0384361b4de20420"
+COMPATIBLE_MACHINE = "rpi"
+
+DEPENDS = "u-boot-mkimage-native"
+
+SRC_URI = "file://boot.cmd"
+
+do_compile() {
+    mkimage -A arm -T script -C none -n "Boot script" -d "${WORKDIR}/boot.cmd" boot.scr
+}
+
+inherit deploy
+
+do_deploy() {
+    install -d ${DEPLOYDIR}
+    install -m 0644 boot.scr ${DEPLOYDIR}
+}
+
+addtask do_deploy after do_compile before do_build
diff --git a/import-layers/meta-raspberrypi/recipes-bsp/u-boot/files/0001-arm-add-save_boot_params-for-ARM1176.patch b/import-layers/meta-raspberrypi/recipes-bsp/u-boot/files/0001-arm-add-save_boot_params-for-ARM1176.patch
new file mode 100644
index 0000000..a5ebff5
--- /dev/null
+++ b/import-layers/meta-raspberrypi/recipes-bsp/u-boot/files/0001-arm-add-save_boot_params-for-ARM1176.patch
@@ -0,0 +1,56 @@
+From 3e10fcde3f3c24a488866dd33fa3f5d46ff3d7a3 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Schieli?= <cschieli@gmail.com>
+Date: Fri, 11 Nov 2016 11:59:06 +0100
+Subject: [PATCH] arm: add save_boot_params for ARM1176
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Implement a hook to allow boards to save boot-time CPU state for later
+use. When U-Boot is chain-loaded by another bootloader, CPU registers may
+contain useful information such as system configuration information. This
+feature mirrors the equivalent ARMv7 feature.
+
+Signed-off-by: Cédric Schieli <cschieli@gmail.com>
+Acked-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Paul Barker <paul@paulbarker.me.uk>
+Upstream-status: Backport
+---
+ arch/arm/cpu/arm1176/start.S | 10 ++++++++++
+ 1 file changed, 10 insertions(+)
+
+diff --git a/arch/arm/cpu/arm1176/start.S b/arch/arm/cpu/arm1176/start.S
+index a602d4e..7c00201 100644
+--- a/arch/arm/cpu/arm1176/start.S
++++ b/arch/arm/cpu/arm1176/start.S
+@@ -16,6 +16,7 @@
+ 
+ #include <asm-offsets.h>
+ #include <config.h>
++#include <linux/linkage.h>
+ 
+ #ifndef CONFIG_SYS_PHY_UBOOT_BASE
+ #define CONFIG_SYS_PHY_UBOOT_BASE	CONFIG_SYS_UBOOT_BASE
+@@ -37,6 +38,11 @@
+ 	.globl reset
+ 
+ reset:
++	/* Allow the board to save important registers */
++	b	save_boot_params
++.globl	save_boot_params_ret
++save_boot_params_ret:
++
+ 	/*
+ 	 * set the cpu to SVC32 mode
+ 	 */
+@@ -110,3 +116,7 @@ mmu_disable_phys:
+ c_runtime_cpu_setup:
+ 
+ 	mov	pc, lr
++
++WEAK(save_boot_params)
++	b	save_boot_params_ret	/* back to my caller */
++ENDPROC(save_boot_params)
+-- 
+2.1.4
+
diff --git a/import-layers/meta-raspberrypi/recipes-bsp/u-boot/files/0002-rpi-passthrough-of-the-firmware-provided-FDT-blob.patch b/import-layers/meta-raspberrypi/recipes-bsp/u-boot/files/0002-rpi-passthrough-of-the-firmware-provided-FDT-blob.patch
new file mode 100644
index 0000000..323b7ab
--- /dev/null
+++ b/import-layers/meta-raspberrypi/recipes-bsp/u-boot/files/0002-rpi-passthrough-of-the-firmware-provided-FDT-blob.patch
@@ -0,0 +1,156 @@
+From ade243a211d62327e9ebadce27bbbff7981e37f0 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?C=C3=A9dric=20Schieli?= <cschieli@gmail.com>
+Date: Fri, 11 Nov 2016 11:59:07 +0100
+Subject: [PATCH] rpi: passthrough of the firmware provided FDT blob
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+Raspberry firmware used to pass a FDT blob at a fixed address (0x100),
+but this is not true anymore. The address now depends on both the
+memory size and the blob size [1].
+
+If one wants to passthrough this FDT blob to the kernel, the most
+reliable way is to save its address from the r2/x0 register in the
+U-Boot entry point and expose it in a environment variable for
+further processing.
+
+This patch just does this:
+- save the provided address in the global variable fw_dtb_pointer
+- expose it in ${fdt_addr} if it points to a a valid FDT blob
+
+There are many different ways to use it. One can, for example, use
+the following script which will extract from the tree the command
+line built by the firmware, then hand over the blob to a previously
+loaded kernel:
+
+fdt addr ${fdt_addr}
+fdt get value bootargs /chosen bootargs
+bootz ${kernel_addr_r} - ${fdt_addr}
+
+Alternatively, users relying on sysboot/pxe can simply omit any FDT
+statement in their extlinux.conf file, U-Boot will automagically pick
+${fdt_addr} and pass it to the kernel.
+
+[1] https://www.raspberrypi.org/forums//viewtopic.php?f=107&t=134018
+
+Upstream-Status: Backport
+
+Signed-off-by: Cédric Schieli <cschieli@gmail.com>
+Acked-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Jonathan Liu <net147@gmail.com>
+---
+ board/raspberrypi/rpi/Makefile        |  1 +
+ board/raspberrypi/rpi/lowlevel_init.S | 36 +++++++++++++++++++++++++++++++++++
+ board/raspberrypi/rpi/rpi.c           | 29 ++++++++++++++++++++++++++++
+ 3 files changed, 66 insertions(+)
+ create mode 100644 board/raspberrypi/rpi/lowlevel_init.S
+
+diff --git a/board/raspberrypi/rpi/Makefile b/board/raspberrypi/rpi/Makefile
+index 4ce2c98..dcb25ac 100644
+--- a/board/raspberrypi/rpi/Makefile
++++ b/board/raspberrypi/rpi/Makefile
+@@ -5,3 +5,4 @@
+ #
+ 
+ obj-y	:= rpi.o
++obj-y	+= lowlevel_init.o
+diff --git a/board/raspberrypi/rpi/lowlevel_init.S b/board/raspberrypi/rpi/lowlevel_init.S
+new file mode 100644
+index 0000000..cdbd8e1
+--- /dev/null
++++ b/board/raspberrypi/rpi/lowlevel_init.S
+@@ -0,0 +1,36 @@
++/*
++ * (C) Copyright 2016
++ * Cédric Schieli <cschieli@gmail.com>
++ *
++ * SPDX-License-Identifier:	GPL-2.0+
++ */
++
++#include <config.h>
++
++.align 8
++.global fw_dtb_pointer
++fw_dtb_pointer:
++#ifdef CONFIG_ARM64
++	.dword 0x0
++#else
++	.word 0x0
++#endif
++
++/*
++ * Routine: save_boot_params (called after reset from start.S)
++ * Description: save ATAG/FDT address provided by the firmware at boot time
++ */
++
++.global save_boot_params
++save_boot_params:
++
++	/* The firmware provided ATAG/FDT address can be found in r2/x0 */
++#ifdef CONFIG_ARM64
++	adr	x8, fw_dtb_pointer
++	str	x0, [x8]
++#else
++	str	r2, fw_dtb_pointer
++#endif
++
++	/* Returns */
++	b	save_boot_params_ret
+diff --git a/board/raspberrypi/rpi/rpi.c b/board/raspberrypi/rpi/rpi.c
+index 6245b36..ffd6d31 100644
+--- a/board/raspberrypi/rpi/rpi.c
++++ b/board/raspberrypi/rpi/rpi.c
+@@ -25,6 +25,9 @@
+ 
+ DECLARE_GLOBAL_DATA_PTR;
+ 
++/* From lowlevel_init.S */
++extern unsigned long fw_dtb_pointer;
++
+ static const struct bcm2835_gpio_platdata gpio_platdata = {
+ 	.base = BCM2835_GPIO_BASE,
+ };
+@@ -285,6 +288,31 @@ static void set_fdtfile(void)
+ 	setenv("fdtfile", fdtfile);
+ }
+ 
++/*
++ * If the firmware provided a valid FDT at boot time, let's expose it in
++ * ${fdt_addr} so it may be passed unmodified to the kernel.
++ */
++static void set_fdt_addr(void)
++{
++	if (getenv("fdt_addr"))
++		return;
++
++	if (fdt_magic(fw_dtb_pointer) != FDT_MAGIC)
++		return;
++
++	setenv_hex("fdt_addr", fw_dtb_pointer);
++}
++
++/*
++ * Prevent relocation from stomping on a firmware provided FDT blob.
++ */
++unsigned long board_get_usable_ram_top(unsigned long total_size)
++{
++	if ((gd->ram_top - fw_dtb_pointer) > SZ_64M)
++		return gd->ram_top;
++	return fw_dtb_pointer & ~0xffff;
++}
++
+ static void set_usbethaddr(void)
+ {
+ 	ALLOC_CACHE_ALIGN_BUFFER(struct msg_get_mac_address, msg, 1);
+@@ -356,6 +384,7 @@ static void set_serial_number(void)
+ 
+ int misc_init_r(void)
+ {
++	set_fdt_addr();
+ 	set_fdtfile();
+ 	set_usbethaddr();
+ #ifdef CONFIG_ENV_VARS_UBOOT_RUNTIME_CONFIG
+-- 
+2.10.2
+
diff --git a/import-layers/meta-raspberrypi/recipes-bsp/u-boot/files/0003-Include-lowlevel_init.o-for-rpi2.patch b/import-layers/meta-raspberrypi/recipes-bsp/u-boot/files/0003-Include-lowlevel_init.o-for-rpi2.patch
new file mode 100644
index 0000000..1431a2e
--- /dev/null
+++ b/import-layers/meta-raspberrypi/recipes-bsp/u-boot/files/0003-Include-lowlevel_init.o-for-rpi2.patch
@@ -0,0 +1,25 @@
+From 1eb01436bc57ad32519a4567a1c9ec82d52d60a1 Mon Sep 17 00:00:00 2001
+From: Paul Barker <paul@paulbarker.me.uk>
+Date: Tue, 29 Nov 2016 19:47:49 +0000
+Subject: [PATCH] Include lowlevel_init.o for rpi2
+
+Signed-off-by: Paul Barker <paul@paulbarker.me.uk>
+Upstream-status: Inappropriate
+    (not needed upstream as rpi_2 board directory is removed in latest
+    version)
+---
+ board/raspberrypi/rpi_2/Makefile | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/board/raspberrypi/rpi_2/Makefile b/board/raspberrypi/rpi_2/Makefile
+index d82cd21..9f865c5 100644
+--- a/board/raspberrypi/rpi_2/Makefile
++++ b/board/raspberrypi/rpi_2/Makefile
+@@ -5,3 +5,4 @@
+ #
+
+ obj-y	:= ../rpi/rpi.o
++obj-y	+= ../rpi/lowlevel_init.o
+--
+2.1.4
+
diff --git a/import-layers/meta-raspberrypi/recipes-bsp/u-boot/u-boot_%.bbappend b/import-layers/meta-raspberrypi/recipes-bsp/u-boot/u-boot_%.bbappend
new file mode 100644
index 0000000..a4545f0
--- /dev/null
+++ b/import-layers/meta-raspberrypi/recipes-bsp/u-boot/u-boot_%.bbappend
@@ -0,0 +1,7 @@
+FILESEXTRAPATHS_prepend_rpi := "${THISDIR}/files:"
+RDEPENDS_${PN}_append_rpi = " rpi-u-boot-scr"
+SRC_URI_append_rpi = " \
+    file://0001-arm-add-save_boot_params-for-ARM1176.patch \
+    file://0002-rpi-passthrough-of-the-firmware-provided-FDT-blob.patch \
+    file://0003-Include-lowlevel_init.o-for-rpi2.patch \
+    "