diff --git a/hw/arm-misc.h b/hw/arm-misc.h
index 010acb4..ef1d61d 100644
--- a/hw/arm-misc.h
+++ b/hw/arm-misc.h
@@ -28,6 +28,7 @@ struct arm_boot_info {
      const char *initrd_filename;
      target_phys_addr_t loader_start;
      target_phys_addr_t smp_loader_start;
+    target_phys_addr_t smp_startaddr;
      target_phys_addr_t smp_priv_base;
      int nb_cpus;
      int board_id;
diff --git a/hw/arm_boot.c b/hw/arm_boot.c
index 620550b..4557bbd 100644
--- a/hw/arm_boot.c
+++ b/hw/arm_boot.c
@@ -31,17 +31,17 @@ static uint32_t bootloader[] = {
  /* Entry point for secondary CPUs.  Enable interrupt controller and
     Issue WFI until start address is written to system controller.  */
  static uint32_t smpboot[] = {
-  0xe59f0020, /* ldr     r0, privbase */
-  0xe3a01001, /* mov     r1, #1 */
-  0xe5801100, /* str     r1, [r0, #0x100] */
-  0xe3a00201, /* mov     r0, #0x10000000 */
-  0xe3800030, /* orr     r0, #0x30 */
+  0xe59f201c, /* ldr r2, privbase */
+  0xe59f001c, /* ldr r0, startaddr */
+  0xe3a01001, /* mov r1, #1 */
+  0xe5821100, /* str r1, [r2, #256] */
    0xe320f003, /* wfi */
    0xe5901000, /* ldr     r1, [r0] */
    0xe1110001, /* tst     r1, r1 */
    0x0afffffb, /* beq     <wfi> */
    0xe12fff11, /* bx      r1 */
-  0 /* privbase: Private memory region base address.  */
+  0,          /* privbase: Private memory region base address.  */
+  0           /* startaddr: Where to find start address */
  };

  #define WRITE_WORD(p, value) do { \
@@ -269,7 +269,11 @@ void arm_load_kernel(CPUState *env, struct 
arm_boot_info *info)
          rom_add_blob_fixed("bootloader", bootloader, sizeof(bootloader),
                             info->loader_start);
          if (info->nb_cpus > 1) {
-            smpboot[10] = info->smp_priv_base;
+            if (!info->smp_startaddr) {
+                info->smp_startaddr = 0x10000030;
+            }
+            smpboot[(sizeof(smpboot) - 8)/4] = info->smp_priv_base;
+            smpboot[(sizeof(smpboot) - 4)/4] = info->smp_startaddr;
              for (n = 0; n < sizeof(smpboot) / 4; n++) {
                  smpboot[n] = tswap32(smpboot[n]);