diff --git a/src/soc/nvidia/tegra210/addressmap.c b/src/soc/nvidia/tegra210/addressmap.c
index ddf3f991ef..d177323caa 100644
--- a/src/soc/nvidia/tegra210/addressmap.c
+++ b/src/soc/nvidia/tegra210/addressmap.c
@@ -91,6 +91,10 @@ void carveout_range(int id, uintptr_t *base_mib, size_t *size_mib)
 					read32(&mc->mts_carveout_size_mb));
 		break;
 	case CARVEOUT_VPR:
+		/*
+		 * A 128MB VPR carveout is felt to be sufficient as per syseng.
+		 * Set it up in vpr_region_init, below.
+		 */
 		carveout_from_regs(base_mib, size_mib,
 					read32(&mc->video_protect_bom),
 					read32(&mc->video_protect_bom_adr_hi),
@@ -347,3 +351,22 @@ void tsec_region_init(void)
 	setbits_le32(&mc->security_carveout4_cfg0, MC_SECURITY_CARVEOUT_LOCKED);
 	setbits_le32(&mc->security_carveout5_cfg0, MC_SECURITY_CARVEOUT_LOCKED);
 }
+
+void vpr_region_init(void)
+{
+	struct tegra_mc_regs * const mc = (void *)(uintptr_t)TEGRA_MC_BASE;
+	uintptr_t vpr_base_mib = 0, end = 4096;
+	size_t vpr_size_mib = VPR_CARVEOUT_SIZE_MB;
+
+	/* Get memory layout below 4GiB */
+	memory_in_range(&vpr_base_mib, &end, CARVEOUT_VPR);
+	vpr_base_mib = end - vpr_size_mib;
+
+	/* Set the carveout base address and size */
+	write32(&mc->video_protect_bom, vpr_base_mib << 20);
+	write32(&mc->video_protect_bom_adr_hi, 0);
+	write32(&mc->video_protect_size_mb, vpr_size_mib);
+
+	/* Set the locked bit. This will lock out any other writes! */
+	write32(&mc->video_protect_reg_ctrl, MC_VPR_WR_ACCESS_DISABLE);
+}
diff --git a/src/soc/nvidia/tegra210/include/soc/addressmap.h b/src/soc/nvidia/tegra210/include/soc/addressmap.h
index b9bec18a12..322a971c3f 100644
--- a/src/soc/nvidia/tegra210/include/soc/addressmap.h
+++ b/src/soc/nvidia/tegra210/include/soc/addressmap.h
@@ -107,6 +107,7 @@ enum {
 #define GPU_CARVEOUT_SIZE_MB		1
 #define NVDEC_CARVEOUT_SIZE_MB		1
 #define TSEC_CARVEOUT_SIZE_MB		2
+#define VPR_CARVEOUT_SIZE_MB		128
 
 /* Return total size of DRAM memory configured on the platform. */
 int sdram_size_mb(void);
@@ -148,5 +149,6 @@ void trustzone_region_init(void);
 void gpu_region_init(void);
 void nvdec_region_init(void);
 void tsec_region_init(void);
+void vpr_region_init(void);
 
 #endif /* __SOC_NVIDIA_TEGRA210_INCLUDE_SOC_ADDRESS_MAP_H__ */
diff --git a/src/soc/nvidia/tegra210/romstage.c b/src/soc/nvidia/tegra210/romstage.c
index d8d191bbd1..16ba778fe9 100644
--- a/src/soc/nvidia/tegra210/romstage.c
+++ b/src/soc/nvidia/tegra210/romstage.c
@@ -71,6 +71,7 @@ void romstage(void)
 	gpu_region_init();
 	nvdec_region_init();
 	tsec_region_init();
+	vpr_region_init();
 
 	/*
 	 * When romstage is running it's always on the reboot path -- never a
diff --git a/src/soc/nvidia/tegra210/soc.c b/src/soc/nvidia/tegra210/soc.c
index 829acb2d73..9e67531b76 100644
--- a/src/soc/nvidia/tegra210/soc.c
+++ b/src/soc/nvidia/tegra210/soc.c
@@ -82,23 +82,6 @@ static struct cpu_control_ops cntrl_ops = {
 };
 
 
-static void lock_down_vpr(void)
-{
-	struct tegra_mc_regs *regs = (void *)(uintptr_t)TEGRA_MC_BASE;
-
-	write32(&regs->video_protect_bom, 0);
-	write32(&regs->video_protect_size_mb, 0);
-
-	write32(&regs->video_protect_gpu_override_0, 1);
-	/*
-	 * Set both _ACCESS bits so that kernel/secure code
-	 * can reconfig VPR careveout as needed from the TrustZone.
-	 */
-
-	write32(&regs->video_protect_reg_ctrl,
-		(MC_VPR_WR_ACCESS_DISABLE | MC_VPR_ALLOW_TZ_WR_ACCESS_ENABLE));
-}
-
 static void soc_init(device_t dev)
 {
 	struct soc_nvidia_tegra210_config *cfg;
@@ -109,9 +92,6 @@ static void soc_init(device_t dev)
 	spintable_init((void *)cfg->spintable_addr);
 	arch_initialize_cpus(dev, &cntrl_ops);
 
-	/* Lock down VPR */
-	lock_down_vpr();
-
 #if IS_ENABLED(CONFIG_MAINBOARD_DO_NATIVE_VGA_INIT)
 	if (vboot_skip_display_init())
 		printk(BIOS_INFO, "Skipping display init.\n");