diff --git a/arch/arm/cpu/armv8/fsl-layerscape/soc.c b/arch/arm/cpu/armv8/fsl-layerscape/soc.c
index 2f306c5..3f15cb0 100644
--- a/arch/arm/cpu/armv8/fsl-layerscape/soc.c
+++ b/arch/arm/cpu/armv8/fsl-layerscape/soc.c
@@ -11,6 +11,7 @@
 #include <asm/io.h>
 #include <asm/global_data.h>
 #include <asm/arch-fsl-layerscape/config.h>
+#include <asm/arch-fsl-layerscape/ns_access.h>
 #include <asm/arch-fsl-layerscape/fsl_icid.h>
 #ifdef CONFIG_LAYERSCAPE_NS_ACCESS
 #include <fsl_csu.h>
@@ -615,6 +616,14 @@ void fsl_lsch2_early_init_f(void)
 			 CCI400_DVM_MESSAGE_REQ_EN | CCI400_SNOOP_REQ_EN);
 	}
 
+	/*
+	 * Program Central Security Unit (CSU) to grant access
+	 * permission for USB 2.0 controller
+	 */
+#if defined(CONFIG_ARCH_LS1012A) && defined(CONFIG_USB_EHCI_FSL)
+	if (current_el() == 3)
+		set_devices_ns_access(CSU_CSLX_USB_2, CSU_ALL_RW);
+#endif
 	/* Erratum */
 	erratum_a008850_early(); /* part 1 of 2 */
 	erratum_a009929();
diff --git a/arch/arm/include/asm/arch-fsl-layerscape/ns_access.h b/arch/arm/include/asm/arch-fsl-layerscape/ns_access.h
index 2bbfab7..a265106 100644
--- a/arch/arm/include/asm/arch-fsl-layerscape/ns_access.h
+++ b/arch/arm/include/asm/arch-fsl-layerscape/ns_access.h
@@ -39,6 +39,7 @@ enum csu_cslx_ind {
 	CSU_CSLX_ESDHC,
 	CSU_CSLX_IFC = 45,
 	CSU_CSLX_I2C1,
+	CSU_CSLX_USB_2,
 	CSU_CSLX_I2C3 = 48,
 	CSU_CSLX_I2C2,
 	CSU_CSLX_DUART2 = 50,