diff --git a/examples/simple_system/README.md b/examples/simple_system/README.md
index da04fe26..9a921b9a 100644
--- a/examples/simple_system/README.md
+++ b/examples/simple_system/README.md
@@ -131,7 +131,7 @@ binary.
 | Address             | Description                                                                                            |
 |---------------------|--------------------------------------------------------------------------------------------------------|
 | 0x20000             | ASCII Out, write ASCII characters here that will get output to the log file                            |
-| 0x20004             | Simulator Halt, write 1 here to halt the simulation                                                    |
+| 0x20008             | Simulator Halt, write 1 here to halt the simulation                                                    |
 | 0x30000             | RISC-V timer `mtime` register                                                                          |
 | 0x30004             | RISC-V timer `mtimeh` register                                                                         |
 | 0x30008             | RISC-V timer `mtimecmp` register                                                                       |
diff --git a/examples/sw/simple_system/common/link.ld b/examples/sw/simple_system/common/link.ld
index 2b4d689b..b1c23076 100644
--- a/examples/sw/simple_system/common/link.ld
+++ b/examples/sw/simple_system/common/link.ld
@@ -19,6 +19,16 @@ _stack_start   = ORIGIN(stack) + LENGTH(stack);
 _entry_point = _vectors_start + 0x80;
 ENTRY(_entry_point)
 
+/* The tohost address is used by Spike for a magic "stop me now" message. This
+   is set to equal SIM_CTRL_CTRL (see simple_system_regs.h), which has that
+   effect in simple_system simulations. Note that it must be 8-byte aligned.
+
+   We don't read data back from Spike, so fromhost is set to some dummy value:
+   we place it just above the top of the stack.
+ */
+tohost   = 0x20008;
+fromhost = _stack_start + 0x10;
+
 SECTIONS
 {
     .vectors :
diff --git a/examples/sw/simple_system/common/simple_system_regs.h b/examples/sw/simple_system/common/simple_system_regs.h
index d28d473a..36b1e6bc 100644
--- a/examples/sw/simple_system/common/simple_system_regs.h
+++ b/examples/sw/simple_system/common/simple_system_regs.h
@@ -7,7 +7,7 @@
 
 #define SIM_CTRL_BASE 0x20000
 #define SIM_CTRL_OUT 0x0
-#define SIM_CTRL_CTRL 0x4
+#define SIM_CTRL_CTRL 0x8
 
 #define TIMER_BASE 0x30000
 #define TIMER_MTIME 0x0
diff --git a/shared/rtl/sim/simulator_ctrl.sv b/shared/rtl/sim/simulator_ctrl.sv
index 555025e7..81d03e2d 100644
--- a/shared/rtl/sim/simulator_ctrl.sv
+++ b/shared/rtl/sim/simulator_ctrl.sv
@@ -10,7 +10,13 @@
  *
  * * 0x0 - CHAR_OUT_ADDR - [7:0] of write data output via output_char DPI call
  * and SimOutputManager (see dv/common/cpp/sim_output_manager.cc)
- * * 0x4 - SIM_CTRL_ADDR - Write 1 to bit 0 to halt sim
+ *
+ * * 0x8 - SIM_CTRL_ADDR - Write 1 to bit 0 to halt sim
+ *
+ * The slightly odd spacing is because we also use SIM_CTRL_ADDR when
+ * simulating simple_system code with Spike, which requires the address to be
+ * 64-bit aligned.
+ *
  */
 
 module simulator_ctrl #(
@@ -33,7 +39,7 @@ module simulator_ctrl #(
 );
 
   localparam CHAR_OUT_ADDR = 0;
-  localparam SIM_CTRL_ADDR = 1;
+  localparam SIM_CTRL_ADDR = 2;
 
   logic [7:0] ctrl_addr;
   logic [2:0] sim_finish = 3'b000;