diff --git a/src/arch/armv7/include/arch/cache.h b/src/arch/armv7/include/arch/cache.h
index 028cf1808d..d5c3a5b241 100644
--- a/src/arch/armv7/include/arch/cache.h
+++ b/src/arch/armv7/include/arch/cache.h
@@ -303,6 +303,8 @@ enum dcache_policy {
 	DCACHE_WRITETHROUGH,
 };
 
+/* disable the mmu for a range. Primarily useful to lock out address 0. */
+void mmu_disable_range(unsigned long start_mb, unsigned long size_mb);
 /* mmu range configuration (set dcache policy) */
 void mmu_config_range(unsigned long start_mb, unsigned long size_mb,
 						enum dcache_policy policy);
diff --git a/src/arch/armv7/lib/mmu.c b/src/arch/armv7/lib/mmu.c
index 224b566a50..82c735818e 100644
--- a/src/arch/armv7/lib/mmu.c
+++ b/src/arch/armv7/lib/mmu.c
@@ -39,6 +39,19 @@
 
 static uintptr_t ttb_addr;
 
+void mmu_disable_range(unsigned long start_mb, unsigned long size_mb)
+{
+	unsigned int i;
+	uint32_t *ttb_entry = (uint32_t *)ttb_addr;
+	printk(BIOS_DEBUG, "Disabling: 0x%08lx:0x%08lx\n",
+			start_mb << 20, ((start_mb + size_mb) << 20) - 1);
+
+	for (i = start_mb; i < start_mb + size_mb; i++) {
+		ttb_entry[i] = 0;
+		tlbimvaa(i);
+	}
+}
+
 void mmu_config_range(unsigned long start_mb, unsigned long size_mb,
 		enum dcache_policy policy)
 {