diff --git a/devices/qemu-aarch64/default.nix b/devices/qemu-aarch64/default.nix
index 275ce36..e9510b5 100644
--- a/devices/qemu-aarch64/default.nix
+++ b/devices/qemu-aarch64/default.nix
@@ -43,5 +43,9 @@
     boot.commandLine = [
       "console=ttyAMA0,38400"
     ];
+    hardware = let addr = lim.parseInt "0x40010000"; in {
+      loadAddress = addr;
+      entryPoint = addr;
+    };
   };
 }
diff --git a/modules/outputs/tftpboot.nix b/modules/outputs/tftpboot.nix
index 222af45..8ce3468 100644
--- a/modules/outputs/tftpboot.nix
+++ b/modules/outputs/tftpboot.nix
@@ -70,26 +70,30 @@ in {
         in
           pkgs.buildPackages.runCommand "boot-scr" { nativeBuildInputs = [ pkgs.pkgsBuildBuild.dtc ];  } ''
             uimageSize=$(($(stat -L -c %s ${o.uimage}) + 0x1000 &(~0xfff)))
-            rootfsStart=0x$(printf %x $((${toString cfg.loadAddress} + 0x100000 + $uimageSize   &(~0xfffff) )))
+            rootfsStart=$(printf %x $((${toString cfg.loadAddress} + 0x100000 + $uimageSize   &(~0xfffff) )))
             rootfsBytes=$(($(stat -L -c %s ${o.rootfs}) + 0x100000 &(~0xfffff)))
             rootfsBytes=$(($rootfsBytes + ${toString cfg.freeSpaceBytes} ))
             rootfsMb=$(($rootfsBytes >> 20))
-            cmd="mtdparts=phram0:''${rootfsMb}M(rootfs) phram.phram=phram0,''${rootfsStart},''${rootfsBytes},${toString config.hardware.flash.eraseBlockSize} root=/dev/mtdblock0";
+            cmd="mtdparts=phram0:''${rootfsMb}M(rootfs) phram.phram=phram0,0x''${rootfsStart},''${rootfsBytes},${toString config.hardware.flash.eraseBlockSize} root=/dev/mtdblock0";
 
             dtbStart=$(printf %x $((${toString cfg.loadAddress} + $rootfsBytes + 0x100000 + $uimageSize )))
 
             mkdir $out
             cat ${o.dtb} > $out/dtb
-            fdtput -p -t s $out/dtb /reserved-memory/phram-rootfs compatible phram
-            fdtput -p -t lx $out/dtb /reserved-memory/phram-rootfs reg 0 $rootfsStart 0 $(printf %x $rootfsBytes)
+            fdtput -p  $out/dtb /reserved-memory '#address-cells' 2
+            fdtput -p  $out/dtb /reserved-memory '#size-cells' 2
+            fdtput -p  $out/dtb /reserved-memory ranges
+            fdtput -p -t s $out/dtb /reserved-memory/phram-rootfs@$rootfsStart  compatible phram
+            fdtput -p -t lx $out/dtb /reserved-memory/phram-rootfs@$rootfsStart reg 0 0x$rootfsStart 0 $(printf %x $rootfsBytes)
 
+            # dtc -I dtb -O dts -o /dev/stdout $out/dtb; exit 1
             dtbBytes=$(($(stat -L -c %s $out/dtb) + 0x1000 &(~0xfff)))
 
             cat > $out/script << EOF
             setenv serverip ${cfg.serverip}
             setenv ipaddr ${cfg.ipaddr}
             setenv bootargs 'liminix ${cmdline} $cmd'
-            tftpboot 0x${lib.toHexString cfg.loadAddress} result/uimage ; tftpboot 0x$(printf %x $rootfsStart) result/rootfs ; tftpboot 0x$dtbStart result/dtb
+            tftpboot 0x${lib.toHexString cfg.loadAddress} result/uimage ; tftpboot 0x$rootfsStart result/rootfs ; tftpboot 0x$dtbStart result/dtb
             bootm 0x${lib.toHexString cfg.loadAddress} - 0x$dtbStart
             EOF
           '';
diff --git a/overlay.nix b/overlay.nix
index 5ce37a1..70018ea 100644
--- a/overlay.nix
+++ b/overlay.nix
@@ -200,6 +200,12 @@ extraPkgs // {
 
   strace = prev.strace.override { libunwind = null; };
 
+  ubootQemuAarch64 = final.buildUBoot {
+    defconfig = "qemu_arm64_defconfig";
+    extraMeta.platforms = ["aarch64-linux"];
+    filesToInstall = ["u-boot.bin"];
+  };
+
   ubootQemuArm = final.buildUBoot {
     defconfig = "qemu_arm_defconfig";
     extraMeta.platforms = ["armv7l-linux"];
diff --git a/pkgs/run-liminix-vm/run-liminix-vm.fnl b/pkgs/run-liminix-vm/run-liminix-vm.fnl
index e52c6d7..3c7b363 100644
--- a/pkgs/run-liminix-vm/run-liminix-vm.fnl
+++ b/pkgs/run-liminix-vm/run-liminix-vm.fnl
@@ -87,7 +87,7 @@
 (local bin {
             :mips ["qemu-system-mips" "-M" "malta"]
             :aarch64 ["qemu-system-aarch64" "-M" "virt"
-                      "-semihosting" "-cpu" "cortex-a72"]
+                      "-cpu" "cortex-a72"]
             :arm ["qemu-system-arm" "-M" "virt,highmem=off"
                   "-cpu" "cortex-a15"]
             })
diff --git a/tests/tftpboot/configuration.nix b/tests/tftpboot/configuration.nix
index 1601428..ef89e52 100644
--- a/tests/tftpboot/configuration.nix
+++ b/tests/tftpboot/configuration.nix
@@ -4,8 +4,13 @@ let
   dts = pkgs.runCommand "qemu.dts" {
     nativeBuildInputs = with pkgs.pkgsBuildBuild; [ dtc qemu ];
   } ''
-      qemu-system-arm -machine virt -machine dumpdtb=tmp.dtb
+      qemu-system-${pkgs.stdenv.hostPlatform.qemuArch} \
+        -machine virt -machine dumpdtb=tmp.dtb
       dtc -I dtb -O dts -o $out tmp.dtb
+      # https://stackoverflow.com/a/69890137,
+      # XXX try fdtput $out -p -t s /pl061@9030000 status disabled
+      # instead of using sed
+      sed -i $out -e 's/compatible = "arm,pl061.*/status = "disabled";/g'
     '';
 in {
   imports = [
@@ -15,7 +20,7 @@ in {
   config = {
     hardware.dts.src = lib.mkForce dts;
     boot.tftp = {
-      loadAddress = lim.parseInt "0x42000000";
+      loadAddress = lim.parseInt "0x44000000";
       serverip = "10.0.2.2";
       ipaddr = "10.0.2.15";
     };
diff --git a/tests/tftpboot/script.expect b/tests/tftpboot/script.expect
index 7cc1712..e024d9b 100644
--- a/tests/tftpboot/script.expect
+++ b/tests/tftpboot/script.expect
@@ -1,4 +1,4 @@
-set timeout 10
+set timeout 30
 
 spawn socat unix-connect:vm/console -
 expect "stop autoboot"
diff --git a/tests/tftpboot/test.nix b/tests/tftpboot/test.nix
index 468c476..0dfdcae 100644
--- a/tests/tftpboot/test.nix
+++ b/tests/tftpboot/test.nix
@@ -1,13 +1,15 @@
 {
   liminix
 }:
+let check = deviceName : ubootName :
 let derivation = (import liminix {
-      device = import "${liminix}/devices/qemu-armv7l/";
+      device = import "${liminix}/devices/${deviceName}/";
       liminix-config = ./configuration.nix;
     });
     img = derivation.outputs.tftpboot;
-    pkgs = derivation.pkgs;
-    pkgsBuild = pkgs.pkgsBuildBuild;
+    uboot = derivation.pkgs.${ubootName};
+    pkgsBuild = derivation.pkgs.pkgsBuildBuild;
+    phram = 240 * 1024 * 1024;
 in pkgsBuild.runCommand "check" {
   nativeBuildInputs = with pkgsBuild; [
     expect
@@ -17,15 +19,19 @@ in pkgsBuild.runCommand "check" {
 } ''
 mkdir vm
 ln -s ${img} result
+
 run-liminix-vm \
  --background ./vm \
- --u-boot ${pkgs.ubootQemuArm}/u-boot.bin \
- --arch arm \
- --flag -S \
- --phram-address 0x40200000 \
+ --u-boot ${uboot}/u-boot.bin \
+ --arch ${derivation.pkgs.stdenv.hostPlatform.qemuArch} \
+ --phram-address $(printf "0x%x" ${toString phram} ) \
  --lan "user,tftp=`pwd`" \
  --disk-image result/rootfs \
  result/uimage result/rootfs
 
 expect ${./script.expect} 2>&1 |tee $out
-''
+'';
+in {
+  arm = check  "qemu-armv7l" "ubootQemuArm";
+  aarch64 = check "qemu-aarch64" "ubootQemuAarch64";
+}