diff --git a/docs/firmware-design.md b/docs/firmware-design.md
index bc075da..e40ca96 100644
--- a/docs/firmware-design.md
+++ b/docs/firmware-design.md
@@ -1270,9 +1270,40 @@
 Loading the TSP image in Trusted DRAM doesn't change the memory layout of the
 other boot loader images in Trusted SRAM.
 
+
 ####  Memory layout on Juno ARM development platform
 
+The following list describes the memory layout on Juno:
+
+*   Trusted SRAM at 0x04000000 contains the MHU page, BL1 r/w section, BL2
+    image, BL3-1 image and, optionally, the BL3-2 image.
+
+*   The MHU 4 KB page is used as communication channel between SCP and AP. It
+    also contains the entrypoint mailboxes for the AP. Mailboxes are stored in
+    the first 128 bytes of the MHU page.
+
+*   BL1 resides in flash memory at address `0x0BEC0000`. Its read-write data
+    section is relocated to the top of the Trusted SRAM at runtime.
+
+*   BL3-1 is loaded at the top of the Trusted SRAM, such that its NOBITS
+    sections will overwrite BL1 R/W data. This implies that BL1 global variables
+    will remain valid only until execution reaches the BL3-1 entry point during
+    a cold boot.
+
+*   BL2 is loaded below BL3-1.
+
+*   BL3-0 is loaded temporarily into the BL3-1 memory region and transfered to
+    the SCP before being overwritten by BL3-1.
+
-**TSP in Trusted SRAM (default option):**
+*   The BL3-2 image is optional and can be loaded into one of these two
+    locations: Trusted SRAM (right after the MHU page) or DRAM (14 MB starting
+    at 0xFF000000 and secured by the TrustZone controller). When loaded into
+    Trusted SRAM, its NOBITS sections are allowed to overlap BL2.
+
+Depending on the location of the BL3-2 image, it will result in different memory
+maps, illustrated by the following diagrams.
+
+**BL3-2 in Trusted SRAM (default option):**
 
                   Flash0
     0x0C000000 +----------+
@@ -1281,30 +1312,30 @@
                | BL1 (ro) |
     0x0BEC0000 |----------|
                :          :
-               |  Bypass  |
-    0x08000000 +----------+
-
-               Trusted SRAM
-    0x04040000 +----------+
-               |   BL2    |                 BL3-1 is loaded
-    0x04033000 |----------|                 after BL3-0 has
-               |  BL3-2   |                 been sent to SCP
-    0x04023000 |----------|                 ------------------
-               |  BL3-0   |  <<<<<<<<<<<<<  |     BL3-1      |
-    0x04009000 |----------|                 ------------------
-               | BL1 (rw) |
-    0x04001000 |----------|
+    0x08000000 +----------+                  BL3-1 is loaded
+                                             after BL3-0 has
+               Trusted SRAM                  been sent to SCP
+    0x04040000 +----------+  loaded by BL2  ------------------
+               | BL1 (rw) |  <<<<<<<<<<<<<  |  BL3-1 NOBITS  |
+               |----------|  <<<<<<<<<<<<<  |----------------|
+               |  BL3-0   |  <<<<<<<<<<<<<  | BL3-1 PROGBITS |
+               |----------|                 ------------------
+               |   BL2    |  <<<<<<<<<<<<<  |  BL3-2 NOBITS  |
+               |----------|  <<<<<<<<<<<<<  |----------------|
+               |          |  <<<<<<<<<<<<<  | BL3-2 PROGBITS |
+    0x04001000 +----------+                 ------------------
                |   MHU    |
     0x04000000 +----------+
 
+
-**TSP in the secure region of DRAM:**
+**BL3-2 in the secure region of DRAM:**
 
                    DRAM
     0xFFE00000 +----------+
-               |  BL3-2   |
+               |  BL3-2   |  (secure)
     0xFF000000 |----------|
                |          |
-               :          :
+               :          :  (non-secure)
                |          |
     0x80000000 +----------+
 
@@ -1315,29 +1346,23 @@
                | BL1 (ro) |
     0x0BEC0000 |----------|
                :          :
-               |  Bypass  |
-    0x08000000 +----------+
-
-               Trusted SRAM
-    0x04040000 +----------+
-               |   BL2    |                 BL3-1 is loaded
-    0x04033000 |----------|                 after BL3-0 has
-               |          |                 been sent to SCP
-    0x04023000 |----------|                 ------------------
-               |  BL3-0   |  <<<<<<<<<<<<<  |     BL3-1      |
-    0x04009000 |----------|                 ------------------
-               | BL1 (rw) |
-    0x04001000 |----------|
+    0x08000000 +----------+                  BL3-1 is loaded
+                                             after BL3-0 has
+               Trusted SRAM                  been sent to SCP
+    0x04040000 +----------+  loaded by BL2  ------------------
+               | BL1 (rw) |  <<<<<<<<<<<<<  |  BL3-1 NOBITS  |
+               |----------|  <<<<<<<<<<<<<  |----------------|
+               |  BL3-0   |  <<<<<<<<<<<<<  | BL3-1 PROGBITS |
+               |----------|                 ------------------
+               |   BL2    |
+               |----------|
+               |          |
+    0x04001000 +----------+
                |   MHU    |
     0x04000000 +----------+
 
-The Message Handling Unit (MHU) page contains the entrypoint mailboxes and a
-shared memory area. This shared memory is used as a communication channel
-between the AP and the SCP.
-
-BL1 code starts at `0x0BEC0000`. The BL1 data section is copied to trusted SRAM
-at `0x04001000`, right after the MHU page. Entrypoint mailboxes are stored in
-the first 128 bytes of the MHU page.
+Loading the BL3-2 image in DRAM doesn't change the memory layout of the other
+images in Trusted SRAM.
 
 
 9.  Firmware Image Package (FIP)
diff --git a/plat/juno/include/platform_def.h b/plat/juno/include/platform_def.h
index e746d02..ee77b83 100644
--- a/plat/juno/include/platform_def.h
+++ b/plat/juno/include/platform_def.h
@@ -76,38 +76,29 @@
 #define MAX_IO_HANDLES			4
 
 /*******************************************************************************
- * Platform memory map related constants
- ******************************************************************************/
-#define FLASH_BASE		0x08000000
-#define FLASH_SIZE		0x04000000
-
-/* Bypass offset from start of NOR flash */
-#define BL1_ROM_BYPASS_OFFSET	0x03EC0000
-
-#ifndef TZROM_BASE
-/* Use the bypass address */
-#define TZROM_BASE		FLASH_BASE + BL1_ROM_BYPASS_OFFSET
-#endif
-#define TZROM_SIZE		0x00010000
-
-#define TZRAM_BASE		0x04001000
-#define TZRAM_SIZE		0x0003F000
-
-/*******************************************************************************
  * BL1 specific defines.
  * BL1 RW data is relocated from ROM to RAM at runtime so we need 2 base
  * addresses.
  ******************************************************************************/
 #define BL1_RO_BASE			TZROM_BASE
 #define BL1_RO_LIMIT			(TZROM_BASE + TZROM_SIZE)
-#define BL1_RW_BASE			TZRAM_BASE
-#define BL1_RW_LIMIT			BL31_BASE
+
+/*
+ * Put BL1 RW at the top of the Trusted SRAM. BL1_RW_BASE is calculated using
+ * the current BL1 RW debug size plus a little space for growth.
+ */
+#define BL1_RW_BASE			(TZRAM_BASE + TZRAM_SIZE - 0x6000)
+#define BL1_RW_LIMIT			(TZRAM_BASE + TZRAM_SIZE)
 
 /*******************************************************************************
  * BL2 specific defines.
  ******************************************************************************/
-#define BL2_BASE			(TZRAM_BASE + TZRAM_SIZE - 0xd000)
-#define BL2_LIMIT			(TZRAM_BASE + TZRAM_SIZE)
+/*
+ * Put BL2 just below BL3-1. BL2_BASE is calculated using the current BL2 debug
+ * size plus a little space for growth.
+ */
+#define BL2_BASE			(BL31_BASE - 0xC000)
+#define BL2_LIMIT			BL31_BASE
 
 /*******************************************************************************
  * Load address of BL3-0 in the Juno port
@@ -119,8 +110,13 @@
 /*******************************************************************************
  * BL3-1 specific defines.
  ******************************************************************************/
-#define BL31_BASE			(TZRAM_BASE + 0x8000)
-#define BL31_LIMIT			BL32_BASE
+/*
+ * Put BL3-1 at the top of the Trusted SRAM. BL31_BASE is calculated using the
+ * current BL3-1 debug size plus a little space for growth.
+ */
+#define BL31_BASE			(TZRAM_BASE + TZRAM_SIZE - 0x1D000)
+#define BL31_PROGBITS_LIMIT		BL1_RW_BASE
+#define BL31_LIMIT			(TZRAM_BASE + TZRAM_SIZE)
 
 /*******************************************************************************
  * BL3-2 specific defines.
@@ -128,8 +124,9 @@
 #if (PLAT_TSP_LOCATION_ID == PLAT_TRUSTED_SRAM_ID)
 # define TSP_SEC_MEM_BASE		TZRAM_BASE
 # define TSP_SEC_MEM_SIZE		TZRAM_SIZE
-# define BL32_BASE			(TZRAM_BASE + TZRAM_SIZE - 0x1d000)
-# define BL32_LIMIT			BL2_BASE
+# define BL32_BASE			TZRAM_BASE
+# define BL32_LIMIT			BL31_BASE
+# define BL32_PROGBITS_LIMIT		BL2_BASE
 #elif (PLAT_TSP_LOCATION_ID == PLAT_DRAM_ID)
 # define TSP_SEC_MEM_BASE		DRAM_SEC_BASE
 # define TSP_SEC_MEM_SIZE		(DRAM_SEC_SIZE - DRAM_SCP_SIZE)
diff --git a/plat/juno/juno_def.h b/plat/juno/juno_def.h
index 88e35b0..cfcbe0b 100644
--- a/plat/juno/juno_def.h
+++ b/plat/juno/juno_def.h
@@ -37,6 +37,21 @@
 /*******************************************************************************
  * Juno memory map related constants
  ******************************************************************************/
+#define FLASH_BASE		0x08000000
+#define FLASH_SIZE		0x04000000
+
+/* Bypass offset from start of NOR flash */
+#define BL1_ROM_BYPASS_OFFSET	0x03EC0000
+
+#ifndef TZROM_BASE
+/* Use the bypass address */
+#define TZROM_BASE		FLASH_BASE + BL1_ROM_BYPASS_OFFSET
+#endif
+#define TZROM_SIZE		0x00010000
+
+#define TZRAM_BASE		0x04001000
+#define TZRAM_SIZE		0x0003F000
+
 #define PLAT_TRUSTED_SRAM_ID	0
 #define PLAT_DRAM_ID		1