diff --git a/drivers/arm/tzc400/tzc400.c b/drivers/arm/tzc400/tzc400.c
index c1716db..715ea6c 100644
--- a/drivers/arm/tzc400/tzc400.c
+++ b/drivers/arm/tzc400/tzc400.c
@@ -103,7 +103,7 @@
 	tmp = (tzc_read_gate_keeper(base) >> GATE_KEEPER_OS_SHIFT) &
 		GATE_KEEPER_OS_MASK;
 
-	return tmp >> filter;
+	return (tmp >> filter) & GATE_KEEPER_FILTER_MASK;
 }
 
 /* This function is not MP safe. */
@@ -241,6 +241,13 @@
 	for (filter = 0; filter < controller->num_filters; filter++) {
 		state = tzc_get_gate_keeper(controller->base, filter);
 		if (state) {
+			/* The TZC filter is already configured. Changing the
+			 * programmer's view in an active system can cause
+			 * unpredictable behavior therefore panic for now rather
+			 * than try to determine whether this is safe in this
+			 * instance. See:
+			 * http://infocenter.arm.com/help/index.jsp?\
+			 * topic=/com.arm.doc.ddi0504c/CJHHECBF.html */
 			ERROR("TZC : Filter %d Gatekeeper already enabled.\n",
 				filter);
 			panic();