diff --git a/hw/flash.h b/hw/flash.h
index c000d33..2e6b61e 100644
--- a/hw/flash.h
+++ b/hw/flash.h
@@ -13,7 +13,8 @@
                                 BlockDriverState *bs, uint32_t sector_len,
                                 int nb_blocs, int width,
                                 uint16_t id0, uint16_t id1,
-                                uint16_t id2, uint16_t id3);
+                                uint16_t id2, uint16_t id3,
+                                uint16_t unlock_addr0, uint16_t unlock_addr1);
 
 /* nand.c */
 struct nand_flash_s;
diff --git a/hw/pflash_cfi02.c b/hw/pflash_cfi02.c
index bc90d24..d4d5a9f 100644
--- a/hw/pflash_cfi02.c
+++ b/hw/pflash_cfi02.c
@@ -63,6 +63,7 @@
     uint8_t cmd;
     uint8_t status;
     uint16_t ident[4];
+    uint16_t unlock_addr[2];
     uint8_t cfi_len;
     uint8_t cfi_table[0x52];
     QEMUTimer *timer;
@@ -246,9 +247,9 @@
             pfl->cmd = 0x98;
             return;
         }
-        if (boff != 0x555 || cmd != 0xAA) {
+        if (boff != pfl->unlock_addr[0] || cmd != 0xAA) {
             DPRINTF("%s: unlock0 failed " TARGET_FMT_lx " %02x %04x\n",
-                    __func__, boff, cmd, 0x555);
+                    __func__, boff, cmd, pfl->unlock_addr[0]);
             goto reset_flash;
         }
         DPRINTF("%s: unlock sequence started\n", __func__);
@@ -256,7 +257,7 @@
     case 1:
         /* We started an unlock sequence */
     check_unlock1:
-        if (boff != 0x2AA || cmd != 0x55) {
+        if (boff != pfl->unlock_addr[1] || cmd != 0x55) {
             DPRINTF("%s: unlock1 failed " TARGET_FMT_lx " %02x\n", __func__,
                     boff, cmd);
             goto reset_flash;
@@ -265,7 +266,7 @@
         break;
     case 2:
         /* We finished an unlock sequence */
-        if (!pfl->bypass && boff != 0x555) {
+        if (!pfl->bypass && boff != pfl->unlock_addr[0]) {
             DPRINTF("%s: command failed " TARGET_FMT_lx " %02x\n", __func__,
                     boff, cmd);
             goto reset_flash;
@@ -361,7 +362,7 @@
     case 5:
         switch (cmd) {
         case 0x10:
-            if (boff != 0x555) {
+            if (boff != pfl->unlock_addr[0]) {
                 DPRINTF("%s: chip erase: invalid address " TARGET_FMT_lx "\n",
                         __func__, offset);
                 goto reset_flash;
@@ -528,7 +529,8 @@
                                 BlockDriverState *bs, uint32_t sector_len,
                                 int nb_blocs, int width,
                                 uint16_t id0, uint16_t id1,
-                                uint16_t id2, uint16_t id3)
+                                uint16_t id2, uint16_t id3,
+                                uint16_t unlock_addr0, uint16_t unlock_addr1)
 {
     pflash_t *pfl;
     int32_t total_len;
@@ -573,6 +575,8 @@
     pfl->ident[1] = id1;
     pfl->ident[2] = id2;
     pfl->ident[3] = id3;
+    pfl->unlock_addr[0] = unlock_addr0;
+    pfl->unlock_addr[1] = unlock_addr1;
     /* Hardcoded CFI table (mostly from SG29 Spansion flash) */
     pfl->cfi_len = 0x52;
     /* Standard "QRY" string */
diff --git a/hw/ppc405_boards.c b/hw/ppc405_boards.c
index b96a188..ca986a0 100644
--- a/hw/ppc405_boards.c
+++ b/hw/ppc405_boards.c
@@ -236,7 +236,7 @@
 #endif
         pflash_cfi02_register((uint32_t)(-bios_size), bios_offset,
                               drives_table[index].bdrv, 65536, fl_sectors, 2,
-                              0x0001, 0x22DA, 0x0000, 0x0000);
+                              0x0001, 0x22DA, 0x0000, 0x0000, 0x555, 0x2AA);
         fl_idx++;
     } else
 #endif
@@ -553,7 +553,7 @@
 #endif
         pflash_cfi02_register((uint32_t)(-bios_size), bios_offset,
                               drives_table[index].bdrv, 65536, fl_sectors, 4,
-                              0x0001, 0x22DA, 0x0000, 0x0000);
+                              0x0001, 0x22DA, 0x0000, 0x0000, 0x555, 0x2AA);
         fl_idx++;
     } else
 #endif
@@ -589,7 +589,7 @@
 #endif
         pflash_cfi02_register(0xfc000000, bios_offset,
                               drives_table[index].bdrv, 65536, fl_sectors, 4,
-                              0x0001, 0x22DA, 0x0000, 0x0000);
+                              0x0001, 0x22DA, 0x0000, 0x0000, 0x555, 0x2AA);
         fl_idx++;
     }
     /* Register CLPD & LCD display */