diff --git a/README b/README
index eba6378..719cc20 100644
--- a/README
+++ b/README
@@ -3384,6 +3384,12 @@ within that device.
 	Specifies that QE/FMAN firmware is located on the primary SPI
 	device.  CONFIG_SYS_FMAN_FW_ADDR is the byte offset on that device.
 
+- CONFIG_SYS_QE_FMAN_FW_IN_REMOTE
+	Specifies that QE/FMAN firmware is located in the remote (master)
+	memory space.	CONFIG_SYS_FMAN_FW_ADDR is a virtual address which
+	can be mapped from slave TLB->slave LAW->slave SRIO outbound window
+	->master inbound window->master LAW->the ucode address in master's
+	NOR flash.
 
 Building the Software:
 ======================
diff --git a/board/freescale/common/p_corenet/law.c b/board/freescale/common/p_corenet/law.c
index 09ef561..1fbab4d 100644
--- a/board/freescale/common/p_corenet/law.c
+++ b/board/freescale/common/p_corenet/law.c
@@ -48,6 +48,15 @@ struct law_entry law_table[] = {
 #ifdef CONFIG_SYS_NAND_BASE_PHYS
 	SET_LAW(CONFIG_SYS_NAND_BASE_PHYS, LAW_SIZE_1M, LAW_TRGT_IF_LBC),
 #endif
+#ifdef CONFIG_SRIOBOOT_SLAVE
+#if defined(CONFIG_SRIOBOOT_SLAVE_PORT0)
+	SET_LAW(CONFIG_SYS_SRIOBOOT_SLAVE_ADDR_PHYS,
+				LAW_SIZE_1M, LAW_TRGT_IF_RIO_1),
+#elif defined(CONFIG_SRIOBOOT_SLAVE_PORT1)
+	SET_LAW(CONFIG_SYS_SRIOBOOT_SLAVE_ADDR_PHYS,
+				LAW_SIZE_1M, LAW_TRGT_IF_RIO_2),
+#endif
+#endif
 };
 
 int num_law_entries = ARRAY_SIZE(law_table);
diff --git a/board/freescale/common/p_corenet/tlb.c b/board/freescale/common/p_corenet/tlb.c
index 6a0026a..a8c8b3c 100644
--- a/board/freescale/common/p_corenet/tlb.c
+++ b/board/freescale/common/p_corenet/tlb.c
@@ -66,6 +66,15 @@ struct fsl_e_tlb_entry tlb_table[] = {
 	SET_TLB_ENTRY(1, CONFIG_SYS_INIT_L3_ADDR, CONFIG_SYS_INIT_L3_ADDR,
 			MAS3_SX|MAS3_SW|MAS3_SR, MAS2_I|MAS2_G,
 			0, 0, BOOKE_PAGESZ_1M, 1),
+#elif defined(CONFIG_SRIOBOOT_SLAVE)
+	/*
+	 * SRIOBOOT-SLAVE. When slave boot, the address of the
+	 * space is at 0xfff00000, it covered the 0xfffff000.
+	 */
+	SET_TLB_ENTRY(1, CONFIG_SYS_SRIOBOOT_SLAVE_ADDR,
+			CONFIG_SYS_SRIOBOOT_SLAVE_ADDR_PHYS,
+			MAS3_SX|MAS3_SW|MAS3_SR, MAS2_W|MAS2_G,
+			0, 0, BOOKE_PAGESZ_1M, 1),
 #else
 	SET_TLB_ENTRY(1, 0xfffff000, 0xfffff000,
 		      MAS3_SX|MAS3_SW|MAS3_SR, MAS2_I|MAS2_G,
diff --git a/boards.cfg b/boards.cfg
index 30b9b51..11f9ef2 100644
--- a/boards.cfg
+++ b/boards.cfg
@@ -757,6 +757,7 @@ P3041DS_SDCARD		     powerpc     mpc85xx     corenet_ds          freescale
 P3041DS_SECURE_BOOT          powerpc     mpc85xx     corenet_ds          freescale      -           P3041DS:SECURE_BOOT
 P3041DS_SPIFLASH	     powerpc     mpc85xx     corenet_ds          freescale      -           P3041DS:RAMBOOT_PBL,SPIFLASH,SYS_TEXT_BASE=0xFFF80000
 P3041DS_SRIOBOOT_MASTER		     powerpc     mpc85xx     corenet_ds          freescale      -           P3041DS:SRIOBOOT_MASTER
+P3041DS_SRIOBOOT_SLAVE          powerpc     mpc85xx     corenet_ds          freescale      -           P3041DS:SRIOBOOT_SLAVE,SYS_TEXT_BASE=0xFFF80000
 P3060QDS		     powerpc	 mpc85xx     p3060qds		 freescale
 P3060QDS_NAND		     powerpc     mpc85xx     p3060qds		 freescale	-	    P3060QDS:RAMBOOT_PBL,NAND,SYS_TEXT_BASE=0xFFF80000
 P3060QDS_SECURE_BOOT         powerpc     mpc85xx     p3060qds            freescale      -           P3060QDS:SECURE_BOOT
@@ -765,12 +766,14 @@ P4080DS_SDCARD		     powerpc     mpc85xx     corenet_ds          freescale
 P4080DS_SECURE_BOOT          powerpc     mpc85xx     corenet_ds          freescale      -           P4080DS:SECURE_BOOT
 P4080DS_SPIFLASH	     powerpc     mpc85xx     corenet_ds          freescale      -           P4080DS:RAMBOOT_PBL,SPIFLASH,SYS_TEXT_BASE=0xFFF80000
 P4080DS_SRIOBOOT_MASTER		     powerpc     mpc85xx     corenet_ds          freescale      -           P4080DS:SRIOBOOT_MASTER
+P4080DS_SRIOBOOT_SLAVE          powerpc     mpc85xx     corenet_ds          freescale      -           P4080DS:SRIOBOOT_SLAVE,SYS_TEXT_BASE=0xFFF80000
 P5020DS                      powerpc     mpc85xx     corenet_ds          freescale
 P5020DS_NAND		     powerpc     mpc85xx     corenet_ds          freescale      -           P5020DS:RAMBOOT_PBL,NAND,SYS_TEXT_BASE=0xFFF80000
 P5020DS_SDCARD		     powerpc     mpc85xx     corenet_ds          freescale      -           P5020DS:RAMBOOT_PBL,SDCARD,SYS_TEXT_BASE=0xFFF80000
 P5020DS_SECURE_BOOT          powerpc     mpc85xx     corenet_ds          freescale      -           P5020DS:SECURE_BOOT
 P5020DS_SPIFLASH	     powerpc     mpc85xx     corenet_ds          freescale      -           P5020DS:RAMBOOT_PBL,SPIFLASH,SYS_TEXT_BASE=0xFFF80000
 P5020DS_SRIOBOOT_MASTER		     powerpc     mpc85xx     corenet_ds          freescale      -           P5020DS:SRIOBOOT_MASTER
+P5020DS_SRIOBOOT_SLAVE          powerpc     mpc85xx     corenet_ds          freescale      -           P5020DS:SRIOBOOT_SLAVE,SYS_TEXT_BASE=0xFFF80000
 stxgp3                       powerpc     mpc85xx     stxgp3              stx
 stxssa                       powerpc     mpc85xx     stxssa              stx            -           stxssa
 stxssa_4M                    powerpc     mpc85xx     stxssa              stx            -           stxssa:STXSSA_4M
diff --git a/drivers/net/fm/fm.c b/drivers/net/fm/fm.c
index 0b8c33f..49c74c2 100644
--- a/drivers/net/fm/fm.c
+++ b/drivers/net/fm/fm.c
@@ -408,6 +408,8 @@ int fm_init_common(int index, struct ccsr_fman *reg)
 		/* flush cache after read */
 		flush_cache((ulong)addr, cnt * 512);
 	}
+#elif defined(CONFIG_SYS_QE_FMAN_FW_IN_REMOTE)
+	void *addr = (void *)CONFIG_SYS_QE_FMAN_FW_ADDR;
 #endif
 
 	/* Upload the Fman microcode if it's present */
diff --git a/include/configs/corenet_ds.h b/include/configs/corenet_ds.h
index e7a4c5a..d5295fe 100644
--- a/include/configs/corenet_ds.h
+++ b/include/configs/corenet_ds.h
@@ -33,6 +33,15 @@
 #define CONFIG_RESET_VECTOR_ADDRESS	0xfffffffc
 #endif
 
+#ifdef CONFIG_SRIOBOOT_SLAVE
+/* Set 1M boot space */
+#define CONFIG_SYS_SRIOBOOT_SLAVE_ADDR (CONFIG_SYS_TEXT_BASE & 0xfff00000)
+#define CONFIG_SYS_SRIOBOOT_SLAVE_ADDR_PHYS \
+		(0x300000000ull | CONFIG_SYS_SRIOBOOT_SLAVE_ADDR)
+#define CONFIG_RESET_VECTOR_ADDRESS 0xfffffffc
+#define CONFIG_SYS_NO_FLASH
+#endif
+
 /* High Level Configuration Options */
 #define CONFIG_BOOKE
 #define CONFIG_E500			/* BOOKE e500 family */
@@ -400,6 +409,15 @@
 #endif
 
 /*
+ * SRIOBOOT - SLAVE
+ */
+#ifdef CONFIG_SRIOBOOT_SLAVE
+/* slave port for srioboot */
+#define CONFIG_SRIOBOOT_SLAVE_PORT0
+/* #define CONFIG_SRIOBOOT_SLAVE_PORT1 */
+#endif
+
+/*
  * eSPI - Enhanced SPI
  */
 #define CONFIG_FSL_ESPI
@@ -519,6 +537,16 @@
 #elif defined(CONFIG_NAND)
 #define CONFIG_SYS_QE_FMAN_FW_IN_NAND
 #define CONFIG_SYS_QE_FMAN_FW_ADDR	(6 * CONFIG_SYS_NAND_BLOCK_SIZE)
+#elif defined(CONFIG_SRIOBOOT_SLAVE)
+/*
+ * Slave has no ucode locally, it can fetch this from remote. When implementing
+ * in two corenet boards, slave's ucode could be stored in master's memory
+ * space, the address can be mapped from slave TLB->slave LAW->
+ * slave SRIO outbound window->master inbound window->master LAW->
+ * the ucode address in master's NOR flash.
+ */
+#define CONFIG_SYS_QE_FMAN_FW_IN_REMOTE
+#define CONFIG_SYS_QE_FMAN_FW_ADDR	NULL
 #else
 #define CONFIG_SYS_QE_FMAN_FW_IN_NOR
 #define CONFIG_SYS_QE_FMAN_FW_ADDR		0xEF000000
