diff --git a/modules/tftpboot.nix b/modules/tftpboot.nix
index 2034aca..bfbee17 100644
--- a/modules/tftpboot.nix
+++ b/modules/tftpboot.nix
@@ -42,27 +42,39 @@ in {
           ln -s ${o.manifest} manifest
           ln -s ${o.kernel.headers} build
           ln -s ${o.uimage} uimage
-          ln -s ${o.boot-scr} boot.scr
+          ln -s ${o.boot-scr}/dtb dtb
+          ln -s ${o.boot-scr}/script boot.scr
        '';
 
       boot-scr =
         let
           inherit (pkgs.lib.trivial) toHexString;
           o = config.system.outputs;
+          cmdline = concatStringsSep " " config.boot.commandLine;
         in
-          pkgs.buildPackages.runCommand "boot-scr" {} ''
+          pkgs.buildPackages.runCommand "boot-scr" { nativeBuildInputs = [ pkgs.pkgsBuildBuild.dtc ];  } ''
             uimageSize=$(($(stat -L -c %s ${o.uimage}) + 0x1000 &(~0xfff)))
-            rootfsStart=0x$(printf %x $((${cfg.loadAddress} + 0x100000 + $uimageSize)))
+            rootfsStart=0x$(printf %x $((${cfg.loadAddress} + 0x100000 + $uimageSize   &(~0xfffff) )))
             rootfsBytes=$(($(stat -L -c %s ${o.rootfs}) + 0x100000 &(~0xfffff)))
+            rootfsMb=$(($rootfsBytes >> 20))
             rootfsBytes=$(($rootfsBytes + ${toString cfg.freeSpaceBytes} ))
-            cmd="mtdparts=phram0:''${rootfsMb}M(rootfs) phram.phram=phram0,''${rootfsStart},''${rootfsBytes},${config.hardware.flash.eraseBlockSize} memmap=''${rootfsBytes}\$''${rootfsStart} root=/dev/mtdblock0";
+            cmd="mtdparts=phram0:''${rootfsMb}M(rootfs) phram.phram=phram0,''${rootfsStart},''${rootfsBytes},${config.hardware.flash.eraseBlockSize} root=/dev/mtdblock0";
 
-            cat > $out << EOF
+            dtbStart=$(printf %x $((${cfg.loadAddress} + $rootfsBytes + 0x100000 + $uimageSize )))
+
+            mkdir $out
+            cat ${o.dtb} > $out/dtb
+            fdtput -p -t s $out/dtb /reserved-memory/phram-rootfs compatible phram
+            fdtput -p -t lx $out/dtb /reserved-memory/phram-rootfs reg 0 $rootfsStart 0 $rootfsBytes
+
+            dtbBytes=$(($(stat -L -c %s $out/dtb) + 0x1000 &(~0xfff)))
+
+            cat > $out/script << EOF
             setenv serverip ${cfg.serverip}
             setenv ipaddr ${cfg.ipaddr}
-            setenv bootargs 'liminix $cmd'
-            tftp 0x$(printf %x ${cfg.loadAddress}) result/uimage ; tftp 0x$(printf %x $rootfsStart) result/rootfs
-            bootm 0x$(printf %x ${cfg.loadAddress})
+            setenv bootargs 'liminix ${cmdline} $cmd'
+            tftp 0x$(printf %x ${cfg.loadAddress}) result/uimage ; tftp 0x$(printf %x $rootfsStart) result/rootfs ; tftp 0x$dtbStart result/dtb
+            bootm 0x$(printf %x ${cfg.loadAddress}) - 0x$dtbStart
             EOF
           '';
     };
diff --git a/pkgs/kernel/default.nix b/pkgs/kernel/default.nix
index d2fec55..b6eb19f 100644
--- a/pkgs/kernel/default.nix
+++ b/pkgs/kernel/default.nix
@@ -54,6 +54,7 @@ stdenv.mkDerivation rec {
 
   patches = [
     ./cmdline-cookie.patch
+    ./phram-allow-cached-mappings.patch
   ];
 
   # this is here to work around what I think is a bug in nixpkgs
diff --git a/pkgs/kernel/phram-allow-cached-mappings.patch b/pkgs/kernel/phram-allow-cached-mappings.patch
new file mode 100644
index 0000000..070502c
--- /dev/null
+++ b/pkgs/kernel/phram-allow-cached-mappings.patch
@@ -0,0 +1,47 @@
+From bb7e7aeb3d832059e33b1e76eb85d4680f77abf2 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Fri, 3 Jun 2016 01:08:36 +0100
+Subject: [PATCH] phram: Use memremap() to allow mapping of system RAM
+
+Using memremap() instead of ioremap() allows mapping a disk image in
+system RAM that has somehow been reserved.  It should fall back
+to ioremap() where necessary.
+
+Entirely untested, and I'm not convinced this is a good idea at all.
+---
+ drivers/mtd/devices/phram.c | 7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+diff --git a/drivers/mtd/devices/phram.c b/drivers/mtd/devices/phram.c
+index 8b66e52ca3cc..0ea254e2ba51 100644
+--- a/drivers/mtd/devices/phram.c
++++ b/drivers/mtd/devices/phram.c
+@@ -88,7 +88,7 @@ static void unregister_devices(void)
+ 
+ 	list_for_each_entry_safe(this, safe, &phram_list, list) {
+ 		mtd_device_unregister(&this->mtd);
+-		iounmap(this->mtd.priv);
++		memunmap(this->mtd.priv);
+ 		kfree(this->mtd.name);
+ 		kfree(this);
+ 	}
+@@ -104,7 +104,8 @@ static int register_device(char *name, phys_addr_t start, size_t len)
+ 		goto out0;
+ 
+ 	ret = -EIO;
+-	new->mtd.priv = ioremap(start, len);
++	new->mtd.priv = memremap(start, len,
++				 MEMREMAP_WB | MEMREMAP_WT | MEMREMAP_WC);
+ 	if (!new->mtd.priv) {
+ 		pr_err("ioremap failed\n");
+ 		goto out1;
+@@ -134,7 +135,7 @@ static int register_device(char *name, phys_addr_t start, size_t len)
+ 	return 0;
+ 
+ out2:
+-	iounmap(new->mtd.priv);
++	memunmap(new->mtd.priv);
+ out1:
+ 	kfree(new);
+ out0:
+