diff --git a/exosphere/src/bootconfig.c b/exosphere/src/bootconfig.c
index 36f83a9..f7352bd 100644
--- a/exosphere/src/bootconfig.c
+++ b/exosphere/src/bootconfig.c
@@ -64,6 +64,10 @@
     return (LOADED_BOOTCONFIG->unsigned_config.data[0x10] & 2) != 0;
 }
 
+bool bootconfig_should_set_scr_el3_bit(void) {
+    return (LOADED_BOOTCONFIG->unsigned_config.data[0x10] & 6) != 6;
+}
+
 uint64_t bootconfig_get_memory_arrangement(void) {
     if (bootconfig_is_debug_mode()) {
         if (fuse_get_dram_id() == 4) {
diff --git a/exosphere/src/bootconfig.h b/exosphere/src/bootconfig.h
index 6dd99a8..593a1f0 100644
--- a/exosphere/src/bootconfig.h
+++ b/exosphere/src/bootconfig.h
@@ -43,6 +43,8 @@
 bool bootconfig_disable_program_verification(void);
 bool bootconfig_is_debug_mode(void);
 
+bool bootconfig_should_set_scr_el3_bit(void);
+
 uint64_t bootconfig_get_memory_arrangement(void);
 uint64_t bootconfig_get_kernel_memory_configuration(void);
 
diff --git a/exosphere/src/coldboot_init.c b/exosphere/src/coldboot_init.c
index 23867bb..a2e60e9 100644
--- a/exosphere/src/coldboot_init.c
+++ b/exosphere/src/coldboot_init.c
@@ -171,7 +171,6 @@
     /* TODO: 4.x does slightly different init. How should we handle this? We can't detect master key revision yet. */
     coldboot_init_dma_controllers();
 
-    /* TODO: initialize DMA controllers, etc. */
     configure_ttbls();
     func_list->funcs.set_memory_registers_enable_mmu();
 
diff --git a/exosphere/src/interrupt.c b/exosphere/src/interrupt.c
index e020cdd..9ab8343 100644
--- a/exosphere/src/interrupt.c
+++ b/exosphere/src/interrupt.c
@@ -14,7 +14,7 @@
     return GICC_IAR;
 }
 
-/* Initializes the GIC. TODO: This must be called during wakeup. */
+/* Initializes the GIC. This must be called during wakeup. */
 void intr_initialize_gic(void) {
     /* Setup interrupts 0-0x1F as nonsecure with highest non-secure priority. */
     GICD_IGROUPR[0] = 0xFFFFFFFF;
diff --git a/exosphere/src/interrupt.h b/exosphere/src/interrupt.h
index a3fd878..30ab578 100644
--- a/exosphere/src/interrupt.h
+++ b/exosphere/src/interrupt.h
@@ -47,7 +47,7 @@
 /* To be called by FIQ handler. */
 void handle_registered_interrupt(void);
 
-/* Initializes the GIC. TODO: This must be called during wakeup. */
+/* Initializes the GIC. This must be called during wakeup. */
 void intr_initialize_gic(void);
 void intr_initialize_gic_nonsecure(void);
 
diff --git a/exosphere/src/lp0.c b/exosphere/src/lp0.c
index abaa866..cca8174 100644
--- a/exosphere/src/lp0.c
+++ b/exosphere/src/lp0.c
@@ -17,6 +17,7 @@
 #include "se.h"
 #include "smc_api.h"
 #include "timers.h"
+#include "misc.h"
 
 extern const uint8_t bpmpfw_bin[];
 extern const uint32_t bpmpfw_bin_size;
@@ -144,7 +145,7 @@
     /* Prepare to boot the BPMP running our deep sleep firmware. */
     
     /* Mark PMC registers as not secure-world only, so BPMP can access them. */
-    (*((volatile uint32_t *)(MMIO_GET_DEVICE_ADDRESS(MMIO_DEVID_MISC) + 0xC00))) &= 0xFFFFDFFF; /* TODO: macro */
+    APB_MISC_SECURE_REGS_APB_SLAVE_SECURITY_ENABLE_REG0_0 &= 0xFFFFDFFF;
     
     /* Setup BPMP vectors. */
     BPMP_VECTOR_RESET = 0x40003000; /* lp0_entry_firmware_crt0 */
diff --git a/exosphere/src/package2.c b/exosphere/src/package2.c
index 1931cef..940f4f7 100644
--- a/exosphere/src/package2.c
+++ b/exosphere/src/package2.c
@@ -441,16 +441,28 @@
     /* Synchronize with NX BOOTLOADER. */
     sync_with_nx_bootloader(NX_BOOTLOADER_STATE_FINISHED);
 
-    /* TODO: lots of boring MMIO */
-
     if (mkey_get_revision() >= MASTERKEY_REVISION_400_CURRENT) {
         sync_with_nx_bootloader(NX_BOOTLOADER_STATE_FINISHED_4X);
-        setup_4x_mmio();
+        setup_4x_mmio(); /* TODO */
     } else {
         sync_with_nx_bootloader(NX_BOOTLOADER_STATE_FINISHED);
     }
 
-    /* TODO: Update SCR_EL3 depending on value in Bootconfig. */
+    /* Update SCR_EL3 depending on value in Bootconfig. */
+    do {
+        uint64_t temp_scr_el3;
+        __asm__ __volatile__ ("mrs %0, scr_el3" : "=r"(temp_scr_el3) :: "memory");
+        
+        temp_scr_el3 &= 0xFFFFFFF7;
+        
+        if (bootconfig_should_set_scr_el3_bit()) {
+            temp_scr_el3 |= 8;
+        }
+        
+        __asm__ __volatile__ ("msr scr_el3, %0" :: "r"(temp_scr_el3) : "memory");
+        
+        __asm__ __volatile__("isb");
+    } while(false);
 
     if (MAILBOX_NX_BOOTLOADER_IS_SECMON_AWAKE) {
         panic(0x7A700001);