diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c
index f9ed7fe..53c3141 100644
--- a/arch/arm/lib/bootm.c
+++ b/arch/arm/lib/bootm.c
@@ -248,15 +248,20 @@ static void boot_prep_linux(bootm_headers_t *images)
 	}
 }
 
-#ifdef CONFIG_ARMV7_NONSEC
-bool armv7_boot_nonsec(void)
+__weak bool armv7_boot_nonsec_default(void)
 {
-	char *s = getenv("bootm_boot_mode");
 #ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT
-	bool nonsec = false;
+	return false;
 #else
-	bool nonsec = true;
+	return true;
 #endif
+}
+
+#ifdef CONFIG_ARMV7_NONSEC
+bool armv7_boot_nonsec(void)
+{
+	char *s = getenv("bootm_boot_mode");
+	bool nonsec = armv7_boot_nonsec_default();
 
 	if (s && !strcmp(s, "sec"))
 		nonsec = false;
diff --git a/board/armltd/vexpress/Makefile b/board/armltd/vexpress/Makefile
index 1dd6780..95f4ec0 100644
--- a/board/armltd/vexpress/Makefile
+++ b/board/armltd/vexpress/Makefile
@@ -6,3 +6,4 @@
 #
 
 obj-y	:= vexpress_common.o
+obj-$(CONFIG_TARGET_VEXPRESS_CA15_TC2)	+= vexpress_tc2.o
diff --git a/board/armltd/vexpress/vexpress_tc2.c b/board/armltd/vexpress/vexpress_tc2.c
new file mode 100644
index 0000000..ebb41a8
--- /dev/null
+++ b/board/armltd/vexpress/vexpress_tc2.c
@@ -0,0 +1,33 @@
+/*
+ * (C) Copyright 2016 Linaro
+ * Jon Medhurst <tixy@linaro.org>
+ *
+ * TC2 specific code for Versatile Express.
+ *
+ * SPDX-License-Identifier:	GPL-2.0+
+ */
+
+#include <asm/io.h>
+
+#define SCC_BASE	0x7fff0000
+
+bool armv7_boot_nonsec_default(void)
+{
+#ifdef CONFIG_ARMV7_BOOT_SEC_DEFAULT
+	return false
+#else
+	/*
+	 * The Serial Configuration Controller (SCC) register at address 0x700
+	 * contains flags for configuring the behaviour of the Boot Monitor
+	 * (which CPUs execute from reset). Two of these bits are of interest:
+	 *
+	 * bit 12 = Use per-cpu mailboxes for power management
+	 * bit 13 = Power down the non-boot cluster
+	 *
+	 * It is only when both of these are false that U-Boot's current
+	 * implementation of 'nonsec' mode can work as expected because we
+	 * rely on getting all CPUs to execute _nonsec_init, so let's check that.
+	 */
+	return (readl((u32 *)(SCC_BASE + 0x700)) & ((1 << 12) | (1 << 13))) == 0;
+#endif
+}