diff --git a/default.nix b/default.nix
index e159298..d92c5eb 100644
--- a/default.nix
+++ b/default.nix
@@ -16,13 +16,19 @@ let
   kernel = callPackage ./kernel {
     inherit (config.kernel) config checkedConfig;
   };
+
   outputs = rec {
     inherit squashfs kernel;
+    dtb =  kernel.dtb {
+      dts = "qca9531_glinet_gl-ar750.dts";
+
+    };
     uimage = kernel.uimage {
+      commandLine = "earlyprintk=serial,ttyS0 console=ttyS0,115200 panic=10 oops=panic init=/bin/init loglevel=8 rootfstype=squashfs";
       inherit (device.boot) loadAddress entryPoint;
       inherit (kernel) vmlinux;
+      inherit dtb;
     };
-
     combined-image = nixpkgs.pkgs.runCommand "firmware.bin" {
       nativeBuildInputs = [ nixpkgs.buildPackages.ubootTools ];
     } ''
diff --git a/devices/gl-ar750.nix b/devices/gl-ar750.nix
index f86b5d1..62d4d0b 100644
--- a/devices/gl-ar750.nix
+++ b/devices/gl-ar750.nix
@@ -28,9 +28,11 @@
   };
   kernel = {
     checkedConfig = {
-      "MIPS_RAW_APPENDED_DTB" = "y";
+      "MIPS_ELF_APPENDED_DTB" = "y";
     };
     config = {
+      MIPS_ELF_APPENDED_DTB = "y";
+
       # this is all copied from nixwrt ath79 config. Clearly not all
       # of it is device config, some of it is wifi config or
       # installation method config or ...
@@ -46,7 +48,6 @@
       "IMAGE_CMDLINE_HACK" = "n";
       "IP_PNP" = "y";
       "JFFS2_FS" = "n";
-      "MIPS_RAW_APPENDED_DTB" = "y";
       "MODULE_SIG" = "y";
       "MTD_CMDLINE_PARTS" = "y";
       "MTD_SPLIT_FIRMWARE" = "y";
diff --git a/kernel/default.nix b/kernel/default.nix
index cafe6d7..c460b1c 100644
--- a/kernel/default.nix
+++ b/kernel/default.nix
@@ -34,9 +34,24 @@ let
       cp -a . $out
     '';
   };
+
+  openwrtSource = fetchFromGitHub {
+    repo = "openwrt";
+    owner = "openwrt";
+    rev = "a5265497a4f6da158e95d6a450cb2cb6dc085cab";
+    hash = "sha256-YYi4gkpLjbOK7bM2MGQjAyEBuXJ9JNXoz/JEmYf8xE8=";
+  };
+
+
 in rec {
   vmlinux = callPackage ./vmlinux.nix {
     inherit tree config checkedConfig;
   };
+
   uimage = callPackage ./uimage.nix { };
+
+  dtb = callPackage ./dtb.nix {
+    openwrt = openwrtSource;
+    kernel = tree;
+  };
 }
diff --git a/kernel/uimage.nix b/kernel/uimage.nix
index d8a5af5..c09b50b 100644
--- a/kernel/uimage.nix
+++ b/kernel/uimage.nix
@@ -2,41 +2,47 @@
   lzma
 , stdenv
 , ubootTools
+, dtc
 } :
 let
   objcopy = "${stdenv.cc.bintools.targetPrefix}objcopy";
 in {
   vmlinux
-# , commandLine
-# , fdt ? null
+, commandLine
 , entryPoint
-# , extraName ? ""                # e.g. socFamily
+, extraName ? ""                # e.g. socFamily
 , loadAddress
+, dtb ? null
 } :
-  # patchDtbCommand = if (fdt != null) then ''
-  #   ( cat vmlinux.stripped ${fdt} > vmlinux.tmp ) && mv vmlinux.tmp vmlinux.stripped
-  # '' else ''
-  #   echo patch-cmdline vmlinux.stripped '${commandLine}'
-  #   patch-cmdline vmlinux.stripped '${commandLine}'
-  #   echo
-  # '';
 stdenv.mkDerivation {
   name = "kernel.image";
-  phases = [ "buildPhase" "installPhase" ];
+  phases = [
+    "preparePhase"
+    (if dtb != null then "dtbPhase" else ":")
+    "buildPhase"
+    "installPhase" ];
   nativeBuildInputs = [
-    # patchImage
     lzma
+    dtc
     stdenv.cc
     ubootTools
   ];
+  preparePhase = ''
+    cp ${vmlinux} vmlinux.elf; chmod +w vmlinux.elf
+  '';
+  dtbPhase = ''
+    dtc -I dtb -O dts -o tmp.dts ${dtb}
+    echo '/{ chosen { bootargs = ${builtins.toJSON commandLine}; }; };'  >> tmp.dts
+    dtc -I dts -O dtb -o tmp.dtb tmp.dts
+	  ${objcopy} --update-section .appended_dtb=tmp.dtb vmlinux.elf || ${objcopy} --add-section .appended_dtb=${dtb} vmlinux.elf
+  '';
+
   buildPhase = ''
-    ${objcopy} -O binary -R .reginfo -R .notes -R .note -R .comment -R .mdebug -R .note.gnu.build-id -S ${vmlinux} vmlinux.stripped
-    # {patchDtbCommand}
-    rm -f vmlinux.stripped.lzma
-    lzma -k -z  vmlinux.stripped
-    mkimage -A mips -O linux -T kernel -C lzma -a ${loadAddress} -e ${entryPoint} -n 'MIPS Liminix Linux ' -d vmlinux.stripped.lzma kernel.image
+    ${objcopy} -O binary -R .reginfo -R .notes -R .note -R .comment -R .mdebug -R .note.gnu.build-id -S vmlinux.elf vmlinux.bin
+    rm -f vmlinux.bin.lzma ; lzma -k -z  vmlinux.bin
+    mkimage -A mips -O linux -T kernel -C lzma -a ${loadAddress} -e ${entryPoint} -n 'MIPS Liminix Linux ${extraName}' -d vmlinux.bin.lzma kernel.uimage
   '';
   installPhase = ''
-    cp kernel.image $out
+    cp kernel.uimage $out
   '';
 }