diff --git a/include/hw/arm/boot.h b/include/hw/arm/boot.h
index 80c492d742..3d1226ab00 100644
--- a/include/hw/arm/boot.h
+++ b/include/hw/arm/boot.h
@@ -206,13 +206,15 @@ typedef struct ARMInsnFixup {
 /**
  * arm_write_bootloader - write a bootloader to guest memory
  * @name: name of the bootloader blob
- * @as: AddressSpace to write the bootloader
+ * @cpu: handle to the first CPU object
+ * @info: handle to the boot info struct
  * @addr: guest address to write it
  * @insns: the blob to be loaded
  * @fixupcontext: context to be used for any fixups in @insns
  *
  * Write a bootloader to guest memory at address @addr in the address
- * space @as. @name is the name to use for the resulting ROM blob, so
+ * space returned by @arm_boot_address_space().
+ * @name is the name to use for the resulting ROM blob, so
  * it should be unique in the system and reasonably identifiable for debugging.
  *
  * @insns must be an array of ARMInsnFixup structs, each of which has
@@ -228,7 +230,8 @@ typedef struct ARMInsnFixup {
  * the entries that @insns refers to.
  */
 void arm_write_bootloader(const char *name,
-                          AddressSpace *as, hwaddr addr,
+                          ARMCPU *cpu, const struct arm_boot_info *info,
+                          hwaddr addr,
                           const ARMInsnFixup *insns,
                           const uint32_t *fixupcontext);
 
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index cf0c6c580b..cf5fb92238 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -217,7 +217,6 @@ struct AspeedMachineState {
 static void aspeed_write_smpboot(ARMCPU *cpu,
                                  const struct arm_boot_info *info)
 {
-    AddressSpace *as = arm_boot_address_space(cpu, info);
     static const ARMInsnFixup poll_mailbox_ready[] = {
         /*
          * r2 = per-cpu go sign value
@@ -244,7 +243,7 @@ static void aspeed_write_smpboot(ARMCPU *cpu,
     };
     static const uint32_t fixupcontext[FIXUP_MAX] = { 0 };
 
-    arm_write_bootloader("aspeed.smpboot", as, info->smp_loader_start,
+    arm_write_bootloader("aspeed.smpboot", cpu, info, info->smp_loader_start,
                          poll_mailbox_ready, fixupcontext);
 }
 
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 5301d8d318..6efd21f9c2 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -131,10 +131,12 @@ static const ARMInsnFixup smpboot[] = {
 };
 
 void arm_write_bootloader(const char *name,
-                          AddressSpace *as, hwaddr addr,
+                          ARMCPU *cpu, const struct arm_boot_info *info,
+                          hwaddr addr,
                           const ARMInsnFixup *insns,
                           const uint32_t *fixupcontext)
 {
+    AddressSpace *as = arm_boot_address_space(cpu, info);
     /* Fix up the specified bootloader fragment and write it into
      * guest memory using rom_add_blob_fixed(). fixupcontext is
      * an array giving the values to write in for the fixup types
@@ -185,7 +187,6 @@ static void default_write_secondary(ARMCPU *cpu,
                                     const struct arm_boot_info *info)
 {
     uint32_t fixupcontext[FIXUP_MAX];
-    AddressSpace *as = arm_boot_address_space(cpu, info);
 
     fixupcontext[FIXUP_GIC_CPU_IF] = info->gic_cpu_if_addr;
     fixupcontext[FIXUP_BOOTREG] = info->smp_bootreg_addr;
@@ -195,7 +196,7 @@ static void default_write_secondary(ARMCPU *cpu,
         fixupcontext[FIXUP_DSB] = CP15_DSB_INSN;
     }
 
-    arm_write_bootloader("smpboot", as, info->smp_loader_start,
+    arm_write_bootloader("smpboot", cpu, info, info->smp_loader_start,
                          smpboot, fixupcontext);
 }
 
@@ -1128,7 +1129,7 @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         fixupcontext[FIXUP_ENTRYPOINT_LO] = entry;
         fixupcontext[FIXUP_ENTRYPOINT_HI] = entry >> 32;
 
-        arm_write_bootloader("bootloader", as, info->loader_start,
+        arm_write_bootloader("bootloader", cpu, info, info->loader_start,
                              primary_loader, fixupcontext);
 
         if (info->write_board_setup) {
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index a7a662f40d..84fffe2a02 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -137,7 +137,7 @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
     QEMU_BUILD_BUG_ON((BOARDSETUP_ADDR & 0xf) != 0
                       || (BOARDSETUP_ADDR >> 4) >= 0x100);
 
-    arm_write_bootloader("raspi_smpboot", arm_boot_address_space(cpu, info),
+    arm_write_bootloader("raspi_smpboot", cpu, info,
                          info->smp_loader_start, smpboot, fixupcontext);
 }
 
@@ -172,7 +172,7 @@ static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
         0, 0, 0, 0
     };
 
-    arm_write_bootloader("raspi_smpboot", as, info->smp_loader_start,
+    arm_write_bootloader("raspi_smpboot", cpu, info, info->smp_loader_start,
                          smpboot, fixupcontext);
     rom_add_blob_fixed_as("raspi_spintables", spintables, sizeof(spintables),
                           SPINTABLE_ADDR, as);
