diff --git a/ipl/hos.c b/ipl/hos.c
index 86afb6d..d7256cb 100755
--- a/ipl/hos.c
+++ b/ipl/hos.c
@@ -398,16 +398,15 @@ int hos_launch(ini_sec_t *cfg)
 	if (!ctxt.warmboot || !ctxt.secmon)
 	{
 		pkg1_decrypt(ctxt.pkg1_id, ctxt.pkg1);
-		pkg1_unpack((void *)0x8000D000, (void *)ctxt.pkg1_id->secmon_base, ctxt.pkg1_id, ctxt.pkg1);
-		//gfx_hexdump(&gfx_con, 0x8000D000, (void *)0x8000D000, 0x100);
-		//gfx_hexdump(&gfx_con, ctxt.pkg1_id->secmon_base, (void *)ctxt.pkg1_id->secmon_base, 0x100);
+		pkg1_unpack((void *)ctxt.pkg1_id->warmboot_base, (void *)ctxt.pkg1_id->secmon_base, ctxt.pkg1_id, ctxt.pkg1);
 		gfx_printf(&gfx_con, "Decrypted and unpacked package1\n");
 	}
 	//Replace 'warmboot.bin' if requested.
 	if (ctxt.warmboot)
-		memcpy((void *)0x8000D000, ctxt.warmboot, ctxt.warmboot_size);
-	//Set warmboot address in PMC.
-	PMC(APBDEV_PMC_SCRATCH1) = 0x8000D000;
+		memcpy((void *)ctxt.pkg1_id->warmboot_base, ctxt.warmboot, ctxt.warmboot_size);
+	//Set warmboot address in PMC if required.
+	if (ctxt.pkg1_id->set_warmboot)
+		PMC(APBDEV_PMC_SCRATCH1) = 0x8000D000;
 	//Replace 'SecureMonitor' if requested.
 	if (ctxt.secmon) {
 		memcpy((void *)ctxt.pkg1_id->secmon_base, ctxt.secmon, ctxt.secmon_size);
@@ -528,6 +527,7 @@ int hos_launch(ini_sec_t *cfg)
 	//*mb_in = 1;
 	//sleep(100);
 
+	//TODO: pkg1.1 locks PMC scratches, we can do that too at some point.
 	/*PMC(0x4) = 0x7FFFF3;
 	PMC(0x2C4) = 0xFFFFFFFF;
 	PMC(0x2D8) = 0xFFAFFFFF;
diff --git a/ipl/pkg1.c b/ipl/pkg1.c
index 1145001..c3855be 100755
--- a/ipl/pkg1.c
+++ b/ipl/pkg1.c
@@ -106,12 +106,12 @@ PATCHSET_DEF(_kernel_5_patchset,
 */
 
 static const pkg1_id_t _pkg1_ids[] = {
-	{ "20161121183008", 0, 0x1900, 0x3FE0, { 2, 1, 0 }, SM_100_ADR, _secmon_1_patchset, _kernel_1_patchset }, //1.0.0 (Patched relocator)
-	{ "20170210155124", 0, 0x1900, 0x3FE0, { 0, 1, 2 }, 0x4002D000, _secmon_2_patchset, _kernel_2_patchset }, //2.0.0 - 2.3.0
-	{ "20170519101410", 1, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, _secmon_3_patchset, _kernel_3_patchset }, //3.0.0
-	{ "20170710161758", 2, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, _secmon_3_patchset, _kernel_3_patchset }, //3.0.1 - 3.0.2
-	{ "20170921172629", 3, 0x1800, 0x3FE0, { 1, 2, 0 }, 0x4002B000, _secmon_4_patchset, _kernel_4_patchset }, //4.0.0 - 4.1.0
-	{ "20180220163747", 4, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, _secmon_5_patchset, _kernel_5_patchset }, //5.0.0 - 5.0.2
+	{ "20161121183008", 0, 0x1900, 0x3FE0, { 2, 1, 0 }, SM_100_ADR, 0x8000D000, 1, _secmon_1_patchset, _kernel_1_patchset }, //1.0.0 (Patched relocator)
+	{ "20170210155124", 0, 0x1900, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, 1, _secmon_2_patchset, _kernel_2_patchset }, //2.0.0 - 2.3.0
+	{ "20170519101410", 1, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, 1, _secmon_3_patchset, _kernel_3_patchset }, //3.0.0
+	{ "20170710161758", 2, 0x1A00, 0x3FE0, { 0, 1, 2 }, 0x4002D000, 0x8000D000, 1, _secmon_3_patchset, _kernel_3_patchset }, //3.0.1 - 3.0.2
+	{ "20170921172629", 3, 0x1800, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, 0, _secmon_4_patchset, _kernel_4_patchset }, //4.0.0 - 4.1.0
+	{ "20180220163747", 4, 0x1900, 0x3FE0, { 1, 2, 0 }, 0x4002B000, 0x4003B000, 0, _secmon_5_patchset, _kernel_5_patchset }, //5.0.0 - 5.0.2
 	{ NULL, 0, 0, 0, 0 } //End.
 };
 
diff --git a/ipl/pkg1.h b/ipl/pkg1.h
index 52e0d27..ef2c2d8 100755
--- a/ipl/pkg1.h
+++ b/ipl/pkg1.h
@@ -39,6 +39,8 @@ typedef struct _pkg1_id_t
 	u32 pkg11_off;
 	u32 sec_map[3];
 	u32 secmon_base;
+	u32 warmboot_base;
+	int set_warmboot;
 	patch_t *secmon_patchset;
 	patch_t *kernel_patchset;
 } pkg1_id_t;
diff --git a/ipl/sdram_lp0.c b/ipl/sdram_lp0.c
index ecffab8..7417eec 100755
--- a/ipl/sdram_lp0.c
+++ b/ipl/sdram_lp0.c
@@ -23,7 +23,7 @@
  */
 void sdram_lp0_save_params(const void *params)
 {
-	const struct sdram_params *sdram = (const struct sdram_params *)params;
+	struct sdram_params *sdram = (struct sdram_params *)params;
 	struct tegra_pmc_regs *pmc = (struct tegra_pmc_regs *)PMC_BASE;
 
 #define pack(src, src_bits, dst, dst_bits) { \
@@ -44,6 +44,78 @@ void sdram_lp0_save_params(const void *params)
 /* 32 bits version c macro */
 #define c32(value, pmcreg) pmc->pmcreg = value
 
+	//TODO: pkg1.1 reads them from MC.
+	sdram->McGeneralizedCarveout1Bom = 0;
+	sdram->McGeneralizedCarveout1BomHi = 0;
+	sdram->McGeneralizedCarveout1Size128kb = 0;
+	sdram->McGeneralizedCarveout1Access0 = 0;
+	sdram->McGeneralizedCarveout1Access1 = 0;
+	sdram->McGeneralizedCarveout1Access2 = 0;
+	sdram->McGeneralizedCarveout1Access3 = 0;
+	sdram->McGeneralizedCarveout1Access4 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout1ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout1Cfg0 = 0;
+	sdram->McGeneralizedCarveout2Bom = 0x80020000;
+	sdram->McGeneralizedCarveout2BomHi = 0;
+	sdram->McGeneralizedCarveout2Size128kb = 2;
+	sdram->McGeneralizedCarveout2Access0 = 0;
+	sdram->McGeneralizedCarveout2Access1 = 0;
+	sdram->McGeneralizedCarveout2Access2 = 0x3000000;
+	sdram->McGeneralizedCarveout2Access3 = 0;
+	sdram->McGeneralizedCarveout2Access4 = 0x300;
+	sdram->McGeneralizedCarveout2ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout2ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout2ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout2ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout2ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout2Cfg0 = 0x440167E;
+	sdram->McGeneralizedCarveout3Bom = 0;
+	sdram->McGeneralizedCarveout3BomHi = 0;
+	sdram->McGeneralizedCarveout3Size128kb = 0;
+	sdram->McGeneralizedCarveout3Access0 = 0;
+	sdram->McGeneralizedCarveout3Access1 = 0;
+	sdram->McGeneralizedCarveout3Access2 = 0x3000000;
+	sdram->McGeneralizedCarveout3Access3 = 0;
+	sdram->McGeneralizedCarveout3Access4 = 0x300;
+	sdram->McGeneralizedCarveout3ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout3ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout3ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout3ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout3ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout3Cfg0 = 0x4401E7E;
+	sdram->McGeneralizedCarveout4Bom = 0;
+	sdram->McGeneralizedCarveout4BomHi = 0;
+	sdram->McGeneralizedCarveout4Size128kb = 0;
+	sdram->McGeneralizedCarveout4Access0 = 0;
+	sdram->McGeneralizedCarveout4Access1 = 0;
+	sdram->McGeneralizedCarveout4Access2 = 0;
+	sdram->McGeneralizedCarveout4Access3 = 0;
+	sdram->McGeneralizedCarveout4Access4 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout4ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout4Cfg0 = 0x8F;
+	sdram->McGeneralizedCarveout5Bom = 0;
+	sdram->McGeneralizedCarveout5BomHi = 0;
+	sdram->McGeneralizedCarveout5Size128kb = 0;
+	sdram->McGeneralizedCarveout5Access0 = 0;
+	sdram->McGeneralizedCarveout5Access1 = 0;
+	sdram->McGeneralizedCarveout5Access2 = 0;
+	sdram->McGeneralizedCarveout5Access3 = 0;
+	sdram->McGeneralizedCarveout5Access4 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess0 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess1 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess2 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess3 = 0;
+	sdram->McGeneralizedCarveout5ForceInternalAccess4 = 0;
+	sdram->McGeneralizedCarveout5Cfg0 = 0x8F;
+
 	s(EmcClockSource, 7:0, scratch6, 15:8);
 	s(EmcClockSourceDll, 7:0, scratch6, 23:16);
 	s(EmcClockSource, 31:29, scratch6, 26:24);
@@ -715,7 +787,8 @@ void sdram_lp0_save_params(const void *params)
 	s32(EmcBctSpare5, scratch42);
 	s32(EmcBctSpare4, scratch44);
 	s32(SwizzleRankByteEncode, scratch45);
-	s32(EmcBctSpare2, scratch46);
+	//s32(EmcBctSpare2, scratch46);
+	pmc->scratch46 = 0x40000DD8;
 	s32(EmcBctSpare1, scratch47);
 	s32(EmcBctSpare0, scratch48);
 	s32(EmcBctSpare9, scratch50);
@@ -1004,11 +1077,6 @@ void sdram_lp0_save_params(const void *params)
 	s32(McGeneralizedCarveout5ForceInternalAccess2, secure_scratch106);
 	s32(McGeneralizedCarveout5ForceInternalAccess3, secure_scratch107);
 
-	/* Locking PMC secure scratch register (8 ~ 15) for writing */
-	//c(0x5555, sec_disable2, 15:0);
-	/* Locking PMC secure scratch register (4~ 7) for both reading and writing */
-	//c(0xff, sec_disable, 19:12);
-
 	c32(0, scratch2);
 	s(PllMInputDivider, 7:0, scratch2, 7:0);
 	s(PllMFeedbackDivider, 7:0, scratch2, 15:8);