diff --git a/board/qca/arm/common/cmd_runmulticore.c b/board/qca/arm/common/cmd_runmulticore.c
index d6ec16c..7990ccb 100644
--- a/board/qca/arm/common/cmd_runmulticore.c
+++ b/board/qca/arm/common/cmd_runmulticore.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2017, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2017-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -62,7 +62,7 @@
 	}
 
 	/* Update here as ncessary - secondary entry point */
-	*cmd_result = cli_simple_run_command(argv, 0);
+	*cmd_result = cli_simple_run_command(argv, CMD_FLAG_SEC_CORE);
 	*cmd_complete = 1;
 
 	state = CPU_POWER_DOWN;
@@ -92,7 +92,7 @@
 	return err;
 }
 
-static int do_runmulticore(cmd_tbl_t *cmdtp,
+int do_runmulticore(cmd_tbl_t *cmdtp,
 			   int flag, int argc, char *const argv[])
 {
 	int j;
diff --git a/common/command.c b/common/command.c
index 858e288..1cd1f9e 100644
--- a/common/command.c
+++ b/common/command.c
@@ -510,6 +510,13 @@
 		return 1;
 	}
 
+#if defined(CONFIG_SMP_PSCI_CMD)
+	if ((flag & CMD_FLAG_SEC_CORE) &&
+	    (cmdtp->cmd == do_runmulticore)) {
+		printf("Restricted command '%s' for secondary core\n", argv[0]);
+		return 1;
+	}
+#endif
 	/* found - check max args */
 	if (argc > cmdtp->maxargs)
 		rc = CMD_RET_USAGE;
diff --git a/include/command.h b/include/command.h
index 5ac71f2..94d053d 100644
--- a/include/command.h
+++ b/include/command.h
@@ -111,6 +111,11 @@
 
 extern int do_reset(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]);
 
+#if defined(CONFIG_SMP_PSCI_CMD)
+extern int do_runmulticore(cmd_tbl_t *cmdtp,
+			   int flag, int argc, char *const argv[]);
+#endif
+
 /*
  * Error codes that commands return to cmd_process(). We use the standard 0
  * and 1 for success and failure, but add one more case - failure with a
@@ -152,6 +157,7 @@
 #define CMD_FLAG_REPEAT		0x0001	/* repeat last command		*/
 #define CMD_FLAG_BOOTD		0x0002	/* command is from bootd	*/
 #define CMD_FLAG_ENV		0x0004	/* command is from the environment */
+#define CMD_FLAG_SEC_CORE	0x0008  /* command is from secondary core */
 
 #ifdef CONFIG_AUTO_COMPLETE
 # define _CMD_COMPLETE(x) x,