diff --git a/arch/arm/mach-tegra/Kconfig b/arch/arm/mach-tegra/Kconfig
index db91983..28914a3 100644
--- a/arch/arm/mach-tegra/Kconfig
+++ b/arch/arm/mach-tegra/Kconfig
@@ -35,6 +35,10 @@
 config TEGRA_PMC
 	bool
 
+config TEGRA_PMC_SECURE
+	bool
+	depends on TEGRA_PMC
+
 config TEGRA_COMMON
 	bool "Tegra common options"
 	select BINMAN
@@ -127,6 +131,7 @@
 	select TEGRA_NO_BPMP
 	select TEGRA_PINCTRL
 	select TEGRA_PMC
+	select TEGRA_PMC_SECURE
 
 config TEGRA186
 	bool "Tegra186 family"
diff --git a/arch/arm/mach-tegra/Makefile b/arch/arm/mach-tegra/Makefile
index 517be21..f8bc65a 100644
--- a/arch/arm/mach-tegra/Makefile
+++ b/arch/arm/mach-tegra/Makefile
@@ -1,6 +1,6 @@
 # SPDX-License-Identifier: GPL-2.0+
 #
-# (C) Copyright 2010-2015 Nvidia Corporation.
+# (C) Copyright 2010-2019 Nvidia Corporation.
 #
 # (C) Copyright 2000-2008
 # Wolfgang Denk, DENX Software Engineering, wd@denx.de.
@@ -27,11 +27,11 @@
 obj-$(CONFIG_TEGRA_CLOCK_SCALING) += emc.o
 obj-$(CONFIG_TEGRA_GPU) += gpu.o
 obj-$(CONFIG_TEGRA_IVC) += ivc.o
-obj-y += lowlevel_init.o
 ifndef CONFIG_SPL_BUILD
 obj-$(CONFIG_ARMV7_PSCI) += psci.o
 endif
 obj-$(CONFIG_DISPLAY_CPUINFO) += sys_info.o
+obj-y += pmc.o
 
 obj-$(CONFIG_TEGRA20) += tegra20/
 obj-$(CONFIG_TEGRA30) += tegra30/
diff --git a/arch/arm/mach-tegra/clock.c b/arch/arm/mach-tegra/clock.c
index dc5f16b..e539ad8 100644
--- a/arch/arm/mach-tegra/clock.c
+++ b/arch/arm/mach-tegra/clock.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Copyright (c) 2010-2015, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2010-2019, NVIDIA CORPORATION.  All rights reserved.
  */
 
 /* Tegra SoC common clock control functions */
@@ -815,11 +815,16 @@
 
 int clock_external_output(int clk_id)
 {
-	struct pmc_ctlr *pmc = (struct pmc_ctlr *)NV_PA_PMC_BASE;
+	u32 val;
 
 	if (clk_id >= 1 && clk_id <= 3) {
-		setbits_le32(&pmc->pmc_clk_out_cntrl,
-			     1 << (2 + (clk_id - 1) * 8));
+		val = tegra_pmc_readl(offsetof(struct pmc_ctlr,
+				      pmc_clk_out_cntrl));
+		val |= 1 << (2 + (clk_id - 1) * 8);
+		tegra_pmc_writel(val,
+				 offsetof(struct pmc_ctlr,
+				 pmc_clk_out_cntrl));
+
 	} else {
 		printf("%s: Unknown output clock id %d\n", __func__, clk_id);
 		return -EINVAL;
diff --git a/arch/arm/mach-tegra/cmd_enterrcm.c b/arch/arm/mach-tegra/cmd_enterrcm.c
index 4e6beb3..4a889f0 100644
--- a/arch/arm/mach-tegra/cmd_enterrcm.c
+++ b/arch/arm/mach-tegra/cmd_enterrcm.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0+
 /*
- * Copyright (c) 2012, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2012-2019, NVIDIA CORPORATION. All rights reserved.
  *
  * Derived from code (arch/arm/lib/reset.c) that is:
  *
@@ -31,12 +31,10 @@
 static int do_enterrcm(cmd_tbl_t *cmdtp, int flag, int argc,
 		       char * const argv[])
 {
-	struct pmc_ctlr *pmc = (struct pmc_ctlr *)NV_PA_PMC_BASE;
-
 	puts("Entering RCM...\n");
 	udelay(50000);
 
-	pmc->pmc_scratch0 = 2;
+	tegra_pmc_writel(2, PMC_SCRATCH0);
 	disable_interrupts();
 	reset_cpu(0);
 
diff --git a/arch/arm/mach-tegra/cpu.c b/arch/arm/mach-tegra/cpu.c
index 1b6ad07..3d14076 100644
--- a/arch/arm/mach-tegra/cpu.c
+++ b/arch/arm/mach-tegra/cpu.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Copyright (c) 2010-2015, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2010-2019, NVIDIA CORPORATION.  All rights reserved.
  */
 
 #include <common.h>
@@ -299,21 +299,19 @@
 
 static int is_cpu_powered(void)
 {
-	struct pmc_ctlr *pmc = (struct pmc_ctlr *)NV_PA_PMC_BASE;
-
-	return (readl(&pmc->pmc_pwrgate_status) & CPU_PWRED) ? 1 : 0;
+	return (tegra_pmc_readl(offsetof(struct pmc_ctlr,
+				pmc_pwrgate_status)) & CPU_PWRED) ? 1 : 0;
 }
 
 static void remove_cpu_io_clamps(void)
 {
-	struct pmc_ctlr *pmc = (struct pmc_ctlr *)NV_PA_PMC_BASE;
 	u32 reg;
 	debug("%s entry\n", __func__);
 
 	/* Remove the clamps on the CPU I/O signals */
-	reg = readl(&pmc->pmc_remove_clamping);
+	reg = tegra_pmc_readl(offsetof(struct pmc_ctlr, pmc_remove_clamping));
 	reg |= CPU_CLMP;
-	writel(reg, &pmc->pmc_remove_clamping);
+	tegra_pmc_writel(reg, offsetof(struct pmc_ctlr, pmc_remove_clamping));
 
 	/* Give I/O signals time to stabilize */
 	udelay(IO_STABILIZATION_DELAY);
@@ -321,17 +319,19 @@
 
 void powerup_cpu(void)
 {
-	struct pmc_ctlr *pmc = (struct pmc_ctlr *)NV_PA_PMC_BASE;
 	u32 reg;
 	int timeout = IO_STABILIZATION_DELAY;
 	debug("%s entry\n", __func__);
 
 	if (!is_cpu_powered()) {
 		/* Toggle the CPU power state (OFF -> ON) */
-		reg = readl(&pmc->pmc_pwrgate_toggle);
+		reg = tegra_pmc_readl(offsetof(struct pmc_ctlr,
+				      pmc_pwrgate_toggle));
 		reg &= PARTID_CP;
 		reg |= START_CP;
-		writel(reg, &pmc->pmc_pwrgate_toggle);
+		tegra_pmc_writel(reg,
+				 offsetof(struct pmc_ctlr,
+				 pmc_pwrgate_toggle));
 
 		/* Wait for the power to come up */
 		while (!is_cpu_powered()) {
diff --git a/arch/arm/mach-tegra/lowlevel_init.S b/arch/arm/mach-tegra/lowlevel_init.S
deleted file mode 100644
index 626f1b6..0000000
--- a/arch/arm/mach-tegra/lowlevel_init.S
+++ /dev/null
@@ -1,39 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0+ */
-/*
- * SoC-specific setup info
- *
- * (C) Copyright 2010,2011
- * NVIDIA Corporation <www.nvidia.com>
- */
-
-#include <config.h>
-#include <linux/linkage.h>
-
-#ifdef CONFIG_ARM64
-	.align	5
-ENTRY(reset_cpu)
-	/* get address for global reset register */
-	ldr	x1, =PRM_RSTCTRL
-	ldr	w3, [x1]
-	/* force reset */
-	orr	w3, w3, #0x10
-	str	w3, [x1]
-	mov	w0, w0
-1:
-	b	1b
-ENDPROC(reset_cpu)
-#else
-	.align	5
-ENTRY(reset_cpu)
-	ldr	r1, rstctl			@ get addr for global reset
-						@ reg
-	ldr	r3, [r1]
-	orr	r3, r3, #0x10
-	str	r3, [r1]			@ force reset
-	mov	r0, r0
-_loop_forever:
-	b	_loop_forever
-rstctl:
-	.word	PRM_RSTCTRL
-ENDPROC(reset_cpu)
-#endif
diff --git a/arch/arm/mach-tegra/pmc.c b/arch/arm/mach-tegra/pmc.c
new file mode 100644
index 0000000..afd3c54
--- /dev/null
+++ b/arch/arm/mach-tegra/pmc.c
@@ -0,0 +1,92 @@
+/* SPDX-License-Identifier: GPL-2.0 */
+/*
+ * Copyright (c) 2018-2019, NVIDIA CORPORATION. All rights reserved.
+ */
+
+#include <common.h>
+
+#include <linux/arm-smccc.h>
+
+#include <asm/io.h>
+#include <asm/arch-tegra/pmc.h>
+
+DECLARE_GLOBAL_DATA_PTR;
+
+#if IS_ENABLED(CONFIG_TEGRA_PMC_SECURE)
+static bool tegra_pmc_detect_tz_only(void)
+{
+	static bool initialized = false;
+	static bool is_tz_only = false;
+	u32 value, saved;
+
+	if (!initialized) {
+		saved = readl(NV_PA_PMC_BASE + PMC_SCRATCH0);
+		value = saved ^ 0xffffffff;
+
+		if (value == 0xffffffff)
+			value = 0xdeadbeef;
+
+		/* write pattern and read it back */
+		writel(value, NV_PA_PMC_BASE + PMC_SCRATCH0);
+		value = readl(NV_PA_PMC_BASE + PMC_SCRATCH0);
+
+		/* if we read all-zeroes, access is restricted to TZ only */
+		if (value == 0) {
+			debug("access to PMC is restricted to TZ\n");
+			is_tz_only = true;
+		} else {
+			/* restore original value */
+			writel(saved, NV_PA_PMC_BASE + PMC_SCRATCH0);
+		}
+
+		initialized = true;
+	}
+
+	return is_tz_only;
+}
+#endif
+
+uint32_t tegra_pmc_readl(unsigned long offset)
+{
+#if IS_ENABLED(CONFIG_TEGRA_PMC_SECURE)
+	if (tegra_pmc_detect_tz_only()) {
+		struct arm_smccc_res res;
+
+		arm_smccc_smc(TEGRA_SMC_PMC, TEGRA_SMC_PMC_READ, offset, 0, 0,
+			      0, 0, 0, &res);
+		if (res.a0)
+			printf("%s(): SMC failed: %lu\n", __func__, res.a0);
+
+		return res.a1;
+	}
+#endif
+
+	return readl(NV_PA_PMC_BASE + offset);
+}
+
+void tegra_pmc_writel(u32 value, unsigned long offset)
+{
+#if IS_ENABLED(CONFIG_TEGRA_PMC_SECURE)
+	if (tegra_pmc_detect_tz_only()) {
+		struct arm_smccc_res res;
+
+		arm_smccc_smc(TEGRA_SMC_PMC, TEGRA_SMC_PMC_WRITE, offset,
+			      value, 0, 0, 0, 0, &res);
+		if (res.a0)
+			printf("%s(): SMC failed: %lu\n", __func__, res.a0);
+
+		return;
+	}
+#endif
+
+	writel(value, NV_PA_PMC_BASE + offset);
+}
+
+void reset_cpu(ulong addr)
+{
+	u32 value;
+
+	value = tegra_pmc_readl(PMC_CNTRL);
+	value |= PMC_CNTRL_MAIN_RST;
+	tegra_pmc_writel(value, PMC_CNTRL);
+}
diff --git a/arch/arm/mach-tegra/powergate.c b/arch/arm/mach-tegra/powergate.c
index e45f096..761c9ef 100644
--- a/arch/arm/mach-tegra/powergate.c
+++ b/arch/arm/mach-tegra/powergate.c
@@ -1,6 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0
 /*
- * Copyright (c) 2014, NVIDIA CORPORATION.  All rights reserved.
+ * Copyright (c) 2014-2019, NVIDIA CORPORATION.  All rights reserved.
  */
 
 #include <common.h>
@@ -11,6 +11,7 @@
 
 #include <asm/arch/powergate.h>
 #include <asm/arch/tegra.h>
+#include <asm/arch-tegra/pmc.h>
 
 #define PWRGATE_TOGGLE 0x30
 #define  PWRGATE_TOGGLE_START (1 << 8)
@@ -24,18 +25,18 @@
 	u32 value, mask = state ? (1 << id) : 0, old_mask;
 	unsigned long start, timeout = 25;
 
-	value = readl(NV_PA_PMC_BASE + PWRGATE_STATUS);
+	value = tegra_pmc_readl(PWRGATE_STATUS);
 	old_mask = value & (1 << id);
 
 	if (mask == old_mask)
 		return 0;
 
-	writel(PWRGATE_TOGGLE_START | id, NV_PA_PMC_BASE + PWRGATE_TOGGLE);
+	tegra_pmc_writel(PWRGATE_TOGGLE_START | id, PWRGATE_TOGGLE);
 
 	start = get_timer(0);
 
 	while (get_timer(start) < timeout) {
-		value = readl(NV_PA_PMC_BASE + PWRGATE_STATUS);
+		value = tegra_pmc_readl(PWRGATE_STATUS);
 		if ((value & (1 << id)) == mask)
 			return 0;
 	}
@@ -69,7 +70,7 @@
 	else
 		value = 1 << id;
 
-	writel(value, NV_PA_PMC_BASE + REMOVE_CLAMPING);
+	tegra_pmc_writel(value, REMOVE_CLAMPING);
 
 	return 0;
 }