diff --git a/plat/nvidia/tegra/soc/t210/plat_psci_handlers.c b/plat/nvidia/tegra/soc/t210/plat_psci_handlers.c
index 4e9206f..b6a0b69 100644
--- a/plat/nvidia/tegra/soc/t210/plat_psci_handlers.c
+++ b/plat/nvidia/tegra/soc/t210/plat_psci_handlers.c
@@ -15,6 +15,7 @@
 
 #include <bpmp.h>
 #include <flowctrl.h>
+#include <memctrl.h>
 #include <pmc.h>
 #include <platform_def.h>
 #include <security_engine.h>
@@ -404,6 +405,7 @@
 	const plat_params_from_bl2_t *plat_params = bl31_get_plat_params();
 	uint32_t cfg;
 	uint32_t val, entrypoint = 0;
+	uint64_t offset;
 
 	/* platform parameter passed by the previous bootloader */
 	if (plat_params->l2_ecc_parity_prot_dis != 1) {
@@ -450,6 +452,13 @@
 			entrypoint = tegra_pmc_read_32(PMC_SCRATCH39);
 			tegra_fc_bpmp_on(entrypoint);
 		}
+
+		/* sc7entry-fw is part of TZDRAM area */
+		if (plat_params->sc7entry_fw_base != 0U) {
+			offset = plat_params->tzdram_base - plat_params->sc7entry_fw_base;
+			tegra_memctrl_tzdram_setup(plat_params->sc7entry_fw_base,
+				plat_params->tzdram_size + offset);
+		}
 	}
 
 	/*
diff --git a/plat/nvidia/tegra/soc/t210/plat_setup.c b/plat/nvidia/tegra/soc/t210/plat_setup.c
index 0aeb9ff..d6b0853 100644
--- a/plat/nvidia/tegra/soc/t210/plat_setup.c
+++ b/plat/nvidia/tegra/soc/t210/plat_setup.c
@@ -18,6 +18,7 @@
 
 #include <bpmp.h>
 #include <flowctrl.h>
+#include <memctrl.h>
 #include <platform.h>
 #include <security_engine.h>
 #include <tegra_def.h>
@@ -154,7 +155,7 @@
 void plat_late_platform_setup(void)
 {
 	const plat_params_from_bl2_t *plat_params = bl31_get_plat_params();
-	uint64_t tzdram_start, tzdram_end, sc7entry_end;
+	uint64_t sc7entry_end, offset;
 	int ret;
 
 	/* memmap TZDRAM area containing the SC7 Entry Firmware */
@@ -164,16 +165,24 @@
 
 		/*
 		 * Verify that the SC7 entry firmware resides inside the TZDRAM
-		 * aperture, _after_ the BL31 code.
+		 * aperture, _before_ the BL31 code and the start address is
+		 * exactly 1MB from BL31 base.
 		 */
-		tzdram_start = plat_params->tzdram_base;
-		tzdram_end = plat_params->tzdram_base + plat_params->tzdram_size;
+
+		/* sc7entry-fw must be _before_ BL31 base */
+		assert(plat_params->tzdram_base > plat_params->sc7entry_fw_base);
+
 		sc7entry_end = plat_params->sc7entry_fw_base +
 			       plat_params->sc7entry_fw_size;
-		if ((plat_params->sc7entry_fw_base < (tzdram_start + BL31_SIZE)) ||
-		    (sc7entry_end > tzdram_end)) {
-			panic();
-		}
+		assert(sc7entry_end < plat_params->tzdram_base);
+
+		/* sc7entry-fw start must be exactly 1MB behind BL31 base */
+		offset = plat_params->tzdram_base - plat_params->sc7entry_fw_base;
+		assert(offset == 0x100000);
+
+		/* secure TZDRAM area */
+		tegra_memctrl_tzdram_setup(plat_params->sc7entry_fw_base,
+			plat_params->tzdram_size + offset);
 
 		/* power off BPMP processor until SC7 entry */
 		tegra_fc_bpmp_off();
@@ -182,7 +191,7 @@
 		ret = mmap_add_dynamic_region(plat_params->sc7entry_fw_base,
 				plat_params->sc7entry_fw_base,
 				plat_params->sc7entry_fw_size,
-				MT_NS | MT_RO | MT_EXECUTE_NEVER);
+				MT_SECURE | MT_RO_DATA);
 		assert(ret == 0);
 	}
 }