diff --git a/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c b/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c
index bd16b99..3b662a6 100644
--- a/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c
+++ b/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c
@@ -623,6 +623,20 @@
 	tegra_mc_write_32(MC_SECURITY_CFG1_0, size_in_bytes >> 20);
 
 	/*
+	 * When TZ encryption enabled,
+	 * We need setup TZDRAM before CPU to access TZ Carveout,
+	 * otherwise CPU will fetch non-decrypted data.
+	 * So save TZDRAM setting for retore by SC7 resume FW.
+	 */
+
+	mmio_write_32(TEGRA_SCRATCH_BASE + SECURE_SCRATCH_RSV55_LO,
+					tegra_mc_read_32(MC_SECURITY_CFG0_0));
+	mmio_write_32(TEGRA_SCRATCH_BASE + SECURE_SCRATCH_RSV55_HI,
+					tegra_mc_read_32(MC_SECURITY_CFG3_0));
+	mmio_write_32(TEGRA_SCRATCH_BASE + SECURE_SCRATCH_RSV54_HI,
+					tegra_mc_read_32(MC_SECURITY_CFG1_0));
+
+	/*
 	 * MCE propogates the security configuration values across the
 	 * CCPLEX.
 	 */
diff --git a/plat/nvidia/tegra/include/t186/tegra_def.h b/plat/nvidia/tegra/include/t186/tegra_def.h
index e0eddfd..a394a72 100644
--- a/plat/nvidia/tegra/include/t186/tegra_def.h
+++ b/plat/nvidia/tegra/include/t186/tegra_def.h
@@ -148,6 +148,9 @@
 #define  SECURE_SCRATCH_RSV11_HI	0x6AC
 #define  SECURE_SCRATCH_RSV53_LO	0x7F8
 #define  SECURE_SCRATCH_RSV53_HI	0x7FC
+#define  SECURE_SCRATCH_RSV54_HI	0x804
+#define  SECURE_SCRATCH_RSV55_LO	0x808
+#define  SECURE_SCRATCH_RSV55_HI	0x80C
 
 /*******************************************************************************
  * Tegra Memory Mapped Control Register Access Bus constants