diff --git a/src/soc/nvidia/tegra210/Kconfig b/src/soc/nvidia/tegra210/Kconfig
index 7aa932aa08..7aff588f41 100644
--- a/src/soc/nvidia/tegra210/Kconfig
+++ b/src/soc/nvidia/tegra210/Kconfig
@@ -102,6 +102,19 @@ config TRUSTZONE_CARVEOUT_SIZE_MB
 	help
 	  Size of Trust Zone area in MiB to reserve in memory map.
 
+config TTB_SIZE_MB
+	hex "Size of TTB"
+	default 0x4
+	help
+	  Maximum size of Translation Table Buffer in MiB.
+
+config SEC_COMPONENT_SIZE_MB
+	hex "Size of resident EL3 components"
+	default 0x10
+	help
+	  Maximum size of resident EL3 components in MiB including BL31 and
+	  Secure OS.
+
 # Default to 700MHz. This value is based on nv bootloader setting.
 config PLLX_KHZ
 	int
diff --git a/src/soc/nvidia/tegra210/Makefile.inc b/src/soc/nvidia/tegra210/Makefile.inc
index 98e752c1a3..3b2dc7c5b1 100644
--- a/src/soc/nvidia/tegra210/Makefile.inc
+++ b/src/soc/nvidia/tegra210/Makefile.inc
@@ -146,6 +146,28 @@ $(objcbfs)/bootblock.bin: $(objcbfs)/bootblock.raw.bin $(BCT_BIN)
 	@printf "    CBOOTIMAGE $(subst $(obj)/,,$(@))\n"
 	$(CBOOTIMAGE) $(CBOOTIMAGE_OPTS) $(BCT_WRAPPER) $@
 
+# We need to ensure that TZ memory has enough space to hold TTB and resident EL3
+# components (including BL31 and Secure OS)
+ttb_size=$(shell printf "%d" $(CONFIG_TTB_SIZE_MB))
+sec_size=$(shell printf "%d" $(CONFIG_SEC_COMPONENT_SIZE_MB))
+req_tz_size=$(shell expr $(ttb_size) + $(sec_size))
+
+tz_size=$(shell printf "%d" $(CONFIG_TRUSTZONE_CARVEOUT_SIZE_MB))
+
+ifeq ($(shell test $(tz_size) -lt $(req_tz_size) && echo 1), 1)
+     $(error "TRUSTZONE_CARVEOUT_SIZE_MB should be atleast as big as TTB_SIZE_MB + SEC_COMPONENT_SIZE_MB")
+endif
+
+# BL31 component is placed towards the end of 32-bit address space. This assumes
+# that TrustZone memory is placed at the end of 32-bit address space. Within the
+# TZ memory, we place TTB at the beginning and then remaining space can be used
+# up by BL31 and secure OS. Calculate TZDRAM_BASE i.e. base of BL31 component
+# by:
+#   0x1000 = end of 32-bit address space in MiB
+#   0x1000 - $(CONFIG_TRUSTZONE_CARVEOUT_SIZE_MB) = start of TZ memory in MiB
+#   0x1000 - $(CONFIG_TRUSTZONE_CARVEOUT_SIZE_MB) + $(CONFIG_TTB_SIZE_MB)
+#             = skip TTB buffer and get base address of BL31
+BL31_MAKEARGS += TZDRAM_BASE=$$(((0x1000 - $(CONFIG_TRUSTZONE_CARVEOUT_SIZE_MB) + $(CONFIG_TTB_SIZE_MB)) << 20))
 BL31_MAKEARGS += PLAT=tegra TARGET_SOC=t210
 
 # MTC fw
diff --git a/src/soc/nvidia/tegra210/include/soc/mmu_operations.h b/src/soc/nvidia/tegra210/include/soc/mmu_operations.h
index 6a81e7c321..a6e42aabe5 100644
--- a/src/soc/nvidia/tegra210/include/soc/mmu_operations.h
+++ b/src/soc/nvidia/tegra210/include/soc/mmu_operations.h
@@ -22,7 +22,4 @@
 
 void tegra210_mmu_init(void);
 
-/* Default ttb size of 4MiB */
-#define TTB_SIZE 0x4
-
 #endif //__SOC_NVIDIA_TEGRA210_MMU_OPERATIONS_H__
diff --git a/src/soc/nvidia/tegra210/mmu_operations.c b/src/soc/nvidia/tegra210/mmu_operations.c
index 2ee6b80ac4..66a93e1878 100644
--- a/src/soc/nvidia/tegra210/mmu_operations.c
+++ b/src/soc/nvidia/tegra210/mmu_operations.c
@@ -77,7 +77,7 @@ void tegra210_mmu_init(void)
 	/* Place page tables at the base of the trust zone region. */
 	carveout_range(CARVEOUT_TZ, &tz_base_mib, &tz_size_mib);
 	tz_base_mib *= MiB;
-	ttb_size_mib = TTB_SIZE * MiB;
+	ttb_size_mib = CONFIG_TTB_SIZE_MB * MiB;
 	mmu_init(map, (void *)tz_base_mib, ttb_size_mib);
 	mmu_enable();
 }
diff --git a/src/soc/nvidia/tegra210/secmon.c b/src/soc/nvidia/tegra210/secmon.c
index 66ebed2ea7..c0936074e9 100644
--- a/src/soc/nvidia/tegra210/secmon.c
+++ b/src/soc/nvidia/tegra210/secmon.c
@@ -43,7 +43,7 @@ void soc_get_secmon_base_size(uint64_t *base, size_t *size)
 
 	soc_get_secure_mem(&tz_base, &tz_size);
 
-	ttb_size = TTB_SIZE * MiB;
+	ttb_size = CONFIG_TTB_SIZE_MB * MiB;
 
 	*base = tz_base + ttb_size;
 	*size = tz_size - ttb_size;