diff --git a/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c b/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c
index bd16b9916..3b662a699 100644
--- a/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c
+++ b/plat/nvidia/tegra/common/drivers/memctrl/memctrl_v2.c
@@ -622,6 +622,20 @@ void tegra_memctrl_tzdram_setup(uint64_t phys_base, uint32_t size_in_bytes)
 	tegra_mc_write_32(MC_SECURITY_CFG3_0, (uint32_t)(phys_base >> 32));
 	tegra_mc_write_32(MC_SECURITY_CFG1_0, size_in_bytes >> 20);
 
+	/*
+	 * When TZ encryption enabled,
+	 * We need setup TZDRAM before CPU to access TZ Carveout,
+	 * otherwise CPU will fetch non-decrypted data.
+	 * So save TZDRAM setting for retore by SC7 resume FW.
+	 */
+
+	mmio_write_32(TEGRA_SCRATCH_BASE + SECURE_SCRATCH_RSV55_LO,
+					tegra_mc_read_32(MC_SECURITY_CFG0_0));
+	mmio_write_32(TEGRA_SCRATCH_BASE + SECURE_SCRATCH_RSV55_HI,
+					tegra_mc_read_32(MC_SECURITY_CFG3_0));
+	mmio_write_32(TEGRA_SCRATCH_BASE + SECURE_SCRATCH_RSV54_HI,
+					tegra_mc_read_32(MC_SECURITY_CFG1_0));
+
 	/*
 	 * MCE propogates the security configuration values across the
 	 * CCPLEX.
diff --git a/plat/nvidia/tegra/include/t186/tegra_def.h b/plat/nvidia/tegra/include/t186/tegra_def.h
index e0eddfd34..a394a7239 100644
--- a/plat/nvidia/tegra/include/t186/tegra_def.h
+++ b/plat/nvidia/tegra/include/t186/tegra_def.h
@@ -148,6 +148,9 @@
 #define  SECURE_SCRATCH_RSV11_HI	0x6AC
 #define  SECURE_SCRATCH_RSV53_LO	0x7F8
 #define  SECURE_SCRATCH_RSV53_HI	0x7FC
+#define  SECURE_SCRATCH_RSV54_HI	0x804
+#define  SECURE_SCRATCH_RSV55_LO	0x808
+#define  SECURE_SCRATCH_RSV55_HI	0x80C
 
 /*******************************************************************************
  * Tegra Memory Mapped Control Register Access Bus constants