diff --git a/plat/imx/common/imx8m/imx_rdc.c b/plat/imx/common/imx8m/imx_rdc.c
index 337db73..35c5362 100644
--- a/plat/imx/common/imx8m/imx_rdc.c
+++ b/plat/imx/common/imx8m/imx_rdc.c
@@ -61,6 +61,10 @@
 		reg |= RDC_PDAP_SREQ_MASK;
 	/* Setup Lock from input */
 	reg |= p->lock << RDC_PDAP_LCK_SHIFT;
+
+	NOTICE("imx_rdc_set_pdap(): write addr=0x%p, reg=0x%x\n",
+			&imx_rdc->pdap[p->index], reg);
+
 	mmio_write_32((uintptr_t)&imx_rdc->pdap[p->index], reg);
 
 	return 0;
@@ -115,7 +119,7 @@
 	if (!r.lock) {
 	reg = (p->domain & RDC_MDA_DID_MASK)
 		| ((p->lock << RDC_MDA_LCK_SHIFT) & RDC_MDA_LCK_MASK);
-	NOTICE("imx_rdc_setup_mda(): write addr=0x%p, reg=0x%x\n",
+	NOTICE("imx_rdc_setup_mda(): write addr=%p, reg=0x%x\n",
 			&imx_rdc->mda[p->index], reg);
 	mmio_write_32((uintptr_t)&imx_rdc->mda[p->index], reg);
 	} else {
@@ -156,17 +160,17 @@
 #else
 /* Default peripherals settings as an example */
 static struct rdc_pdap_conf periph_config[] = {
-	{RDC_PDAP_GPIO1, 0x3, 0},
-	{RDC_PDAP_GPIO2, 0x3, 0},
-	{RDC_PDAP_GPIO3, 0x3, 0},
-	{RDC_PDAP_GPIO4, 0x3, 0},
-	{RDC_PDAP_GPIO5, 0x3, 0},
+	{RDC_PDAP_GPU_EXSC, 0x0C, 0},
+	{RDC_PDAP_VPU_SEC, 0x33, 0},
 };
 
 /* Default masters settings as an example */
 static struct rdc_mda_conf masters_config[] = {
-	{RDC_MDA_A53, 0, 0},
-	{RDC_MDA_CAAM, 0, 0},
+	{RDC_MDA_A53, 0, 1},
+	{RDC_MDA_CAAM, 0, 1},
+	{RDC_MDA_GPU, 1, 1},
+	{RDC_MDA_VPU_DEC, 2, 1},
+	{RDC_MDA_DCSS, 3, 1},
 };
 #endif
 void imx_rdc_set_peripherals_default(void)
diff --git a/plat/imx/imx8mm/imx8mm_bl31_setup.c b/plat/imx/imx8mm/imx8mm_bl31_setup.c
index 541939d..0d18530 100644
--- a/plat/imx/imx8mm/imx8mm_bl31_setup.c
+++ b/plat/imx/imx8mm/imx8mm_bl31_setup.c
@@ -56,6 +56,70 @@
 static entry_point_info_t bl32_image_ep_info;
 static entry_point_info_t bl33_image_ep_info;
 
+#define IMX_DDR_BASE 0x40000000
+
+#if defined(DECRYPTED_BUFFER_START) && defined(DECRYPTED_BUFFER_LEN)
+#define DECRYPTED_BUFFER_END   	DECRYPTED_BUFFER_START + DECRYPTED_BUFFER_LEN
+#endif
+
+#if defined(DECODED_BUFFER_START) && defined(DECODED_BUFFER_LEN)
+#define DECODED_BUFFER_END		DECODED_BUFFER_START + DECODED_BUFFER_LEN
+#endif
+
+#if !defined(DECRYPTED_BUFFER_END) && !defined(DECODED_BUFFER_END)
+#define RDC_DISABLED
+#endif
+
+/* set RDC settings */
+static void bl31_imx_rdc_setup(void)
+{
+#ifdef RDC_DISABLED
+	NOTICE("RDC off \n");
+#else
+	struct imx_rdc_regs *imx_rdc = (struct imx_rdc_regs *)IMX_RDC_BASE;
+
+	NOTICE("RDC imx_rdc_set_masters default \n");
+	imx_rdc_set_masters_default();
+
+	/*
+	 * Need to substact offset 0x40000000 from CPU address when
+	 * programming rdc region for i.mx8mq.
+	 */
+
+#ifdef DECRYPTED_BUFFER_START
+	/* Domain 2 no write access to memory region below decrypted video */
+	/* Prevent VPU to decode outside secure decoded buffer */
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[2].mrsa), 0);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[2].mrea), DECRYPTED_BUFFER_START - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[2].mrc), 0xC00000AF);
+#endif // DECRYPTED_BUFFER_START
+
+#ifdef DECRYPTED_BUFFER_END
+	NOTICE("RDC setup memory_region[0] decrypted buffer DID0 W DID2 R/W\n");
+	/* Domain 0 memory region W decrypted video */
+	/* Domain 2 memory region R decrypted video */
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[0].mrsa), DECRYPTED_BUFFER_START - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[0].mrea), DECRYPTED_BUFFER_END - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[0].mrc), 0xC0000061);
+#endif // DECRYPTED_BUFFER_END
+
+#ifdef DECODED_BUFFER_END
+	NOTICE("RDC setup memory_region[1] decoded buffer DID2 R/W DID3 R/W\n");
+	/* Domain 1+2 memory region R/W decoded video */
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[1].mrsa), DECODED_BUFFER_START - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[1].mrea), DECODED_BUFFER_END - IMX_DDR_BASE); 
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[1].mrc), 0xC000003D);
+
+	/* Domain 1+2+3 no access to memory region above decoded video */
+	/* Only CPU in secure mode can access TEE memory region (cf TZASC configuration) */
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[3].mrsa), DECODED_BUFFER_END - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[3].mrea), 0xC0000000 - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[3].mrc), 0xC0000003);
+#endif // DECODED_BUFFER_END
+
+#endif // RDC_DISABLED
+}
+
 /* get SPSR for BL33 entry */
 static uint32_t get_spsr_for_bl33_entry(void)
 {
@@ -93,7 +157,7 @@
 	if ((val & GPR_TZASC_EN) != GPR_TZASC_EN)
 		return;
 
-	NOTICE("Configureing TZASC380\n");
+	NOTICE("Configuring TZASC380\n");
 
 	tzc380_init(IMX_TZASC_BASE);
 
@@ -220,8 +284,14 @@
 	bl32_image_ep_info.spsr = 0;
 	/* Pass TEE base and size to uboot */
 	bl33_image_ep_info.args.arg1 = 0xBE000000;
+	/* TEE size + RDC reserved memory = 0x2000000 + 0x2000000 + 0x30000000 */
+#ifdef DECRYPTED_BUFFER_START
+	bl33_image_ep_info.args.arg2 = 0xC0000000 - DECRYPTED_BUFFER_START;
+#else
 	bl33_image_ep_info.args.arg2 = 0x2000000;
 #endif
+#endif
+
 	bl31_tzc380_setup();
 
 	/* Assign M4 to domain 1 */
@@ -233,6 +303,9 @@
 	csu_test();
 	rdc_test();
 #endif
+
+	bl31_imx_rdc_setup();
+
 }
 
 void bl31_plat_arch_setup(void)
diff --git a/plat/imx/imx8mm/platform.mk b/plat/imx/imx8mm/platform.mk
index 7707332..d2c65d9 100644
--- a/plat/imx/imx8mm/platform.mk
+++ b/plat/imx/imx8mm/platform.mk
@@ -54,3 +54,19 @@
 ERRATA_A53_835769	:=	1
 ERRATA_A53_843419	:=	1
 ERRATA_A53_855873	:=	1
+
+ifneq (${DECRYPTED_BUFFER_START},)
+$(eval $(call add_define,DECRYPTED_BUFFER_START))
+
+ifneq (${DECRYPTED_BUFFER_LEN},)
+$(eval $(call add_define,DECRYPTED_BUFFER_LEN))
+endif
+endif
+
+ifneq (${DECODED_BUFFER_START},)
+$(eval $(call add_define,DECODED_BUFFER_START))
+
+ifneq (${DECODED_BUFFER_LEN},)
+$(eval $(call add_define,DECODED_BUFFER_LEN))
+endif
+endif
diff --git a/plat/imx/imx8mq/imx8mq_bl31_setup.c b/plat/imx/imx8mq/imx8mq_bl31_setup.c
index 4a6423b..0414760 100644
--- a/plat/imx/imx8mq/imx8mq_bl31_setup.c
+++ b/plat/imx/imx8mq/imx8mq_bl31_setup.c
@@ -85,6 +85,69 @@
 static entry_point_info_t bl32_image_ep_info;
 static entry_point_info_t bl33_image_ep_info;
 
+#define IMX_DDR_BASE 0x40000000
+
+#if defined(DECRYPTED_BUFFER_START) && defined(DECRYPTED_BUFFER_LEN)
+#define DECRYPTED_BUFFER_END   	DECRYPTED_BUFFER_START + DECRYPTED_BUFFER_LEN
+#endif
+
+#if defined(DECODED_BUFFER_START) && defined(DECODED_BUFFER_LEN)
+#define DECODED_BUFFER_END		DECODED_BUFFER_START + DECODED_BUFFER_LEN
+#endif
+
+#if !defined(DECRYPTED_BUFFER_END) && !defined(DECODED_BUFFER_END)
+#define RDC_DISABLED
+#endif
+
+/* set RDC settings */
+static void bl31_imx_rdc_setup(void)
+{
+#ifdef RDC_DISABLED
+	NOTICE("RDC off \n");
+#else
+	struct imx_rdc_regs *imx_rdc = (struct imx_rdc_regs *)IMX_RDC_BASE;
+
+	NOTICE("RDC imx_rdc_set_masters default \n");
+	imx_rdc_set_masters_default();
+
+	/*
+	 * Need to substact offset 0x40000000 from CPU address when
+	 * programming rdc region for i.mx8mq.
+	 */
+
+#ifdef DECRYPTED_BUFFER_START
+	/* Domain 2 no write access to memory region below decrypted video */
+	/* Prevent VPU to decode outside secure decoded buffer */
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[2].mrsa), 0);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[2].mrea), DECRYPTED_BUFFER_START - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[2].mrc), 0xC00000EF);
+#endif // DECRYPTED_BUFFER_START
+
+#ifdef DECRYPTED_BUFFER_END
+	NOTICE("RDC setup memory_region[0] decrypted buffer DID0 W DID2 R/W\n");
+	/* Domain 0 memory region W decrypted video */
+	/* Domain 2 memory region R decrypted video */
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[0].mrsa), DECRYPTED_BUFFER_START - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[0].mrea), DECRYPTED_BUFFER_END - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[0].mrc), 0xC0000021);
+#endif // DECRYPTED_BUFFER_END
+
+#ifdef DECODED_BUFFER_END
+	NOTICE("RDC setup memory_region[1] decoded buffer DID2 R/W DID3 R/W\n");
+	/* Domain 2+3 memory region R/W decoded video */
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[1].mrsa), DECODED_BUFFER_START - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[1].mrea), DECODED_BUFFER_END - IMX_DDR_BASE); 
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[1].mrc), 0xC00000F0);
+
+	/* Domain 1+2+3 no access to memory region above decoded video */
+	/* Only CPU in secure mode can access TEE memory region (cf TZASC configuration) */
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[3].mrsa), DECODED_BUFFER_END - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[3].mrea), 0x100000000 - IMX_DDR_BASE);
+	mmio_write_32((uintptr_t)&(imx_rdc->mem_region[3].mrc), 0xC0000003);
+#endif // DECODED_BUFFER_END
+
+#endif // RDC_DISABLED
+}
 
 /* get SPSR for BL33 entry */
 static uint32_t get_spsr_for_bl33_entry(void)
@@ -137,7 +200,7 @@
 	if ((val & GPR_TZASC_EN) != GPR_TZASC_EN)
 		return;
 
-	NOTICE("Configureing TZASC380\n");
+	NOTICE("Configuring TZASC380\n");
 
 	tzc380_init(IMX_TZASC_BASE);
 
@@ -254,14 +317,23 @@
 	bl32_image_ep_info.spsr = 0;
 	/* Pass TEE base and size to uboot */
 	bl33_image_ep_info.args.arg1 = 0xFE000000;
+	/* TEE size + RDC reserved memory = 0x2000000 + 0x2000000 + 0x30000000 */
+#ifdef DECRYPTED_BUFFER_START
+	bl33_image_ep_info.args.arg2 = 0x100000000 - DECRYPTED_BUFFER_START;
+#else
 	bl33_image_ep_info.args.arg2 = 0x2000000;
 #endif
+#endif
+
 	bl31_tzc380_setup();
 
 #if defined (CSU_RDC_TEST)
 	csu_test();
 	rdc_test();
 #endif
+
+	bl31_imx_rdc_setup();
+
 }
 
 void bl31_plat_arch_setup(void)
diff --git a/plat/imx/imx8mq/platform.mk b/plat/imx/imx8mq/platform.mk
index f27f640..0f363eb 100644
--- a/plat/imx/imx8mq/platform.mk
+++ b/plat/imx/imx8mq/platform.mk
@@ -55,3 +55,19 @@
 ERRATA_A53_835769	:=	1
 ERRATA_A53_843419	:=	1
 ERRATA_A53_855873	:=	1
+
+ifneq (${DECRYPTED_BUFFER_START},)
+$(eval $(call add_define,DECRYPTED_BUFFER_START))
+
+ifneq (${DECRYPTED_BUFFER_LEN},)
+$(eval $(call add_define,DECRYPTED_BUFFER_LEN))
+endif
+endif
+
+ifneq (${DECODED_BUFFER_START},)
+$(eval $(call add_define,DECODED_BUFFER_START))
+
+ifneq (${DECODED_BUFFER_LEN},)
+$(eval $(call add_define,DECODED_BUFFER_LEN))
+endif
+endif