diff --git a/arch/arm/mach-rockchip/rv1126/rv1126.c b/arch/arm/mach-rockchip/rv1126/rv1126.c
index 91554c9..b9b8987 100644
--- a/arch/arm/mach-rockchip/rv1126/rv1126.c
+++ b/arch/arm/mach-rockchip/rv1126/rv1126.c
@@ -10,6 +10,8 @@
 #include <asm/arch-rockchip/hardware.h>
 #include <asm/arch-rockchip/grf_rv1126.h>
 
+#define FIREWALL_APB_BASE	0xffa60000
+#define FW_DDR_CON_REG		0x80
 #define GRF_BASE		0xFE000000
 
 const char * const boot_devices[BROM_LAST_BOOTSOURCE + 1] = {
@@ -58,6 +60,16 @@
 #ifndef CONFIG_TPL_BUILD
 int arch_cpu_init(void)
 {
+	/**
+	 * Set dram area unsecure in spl
+	 *
+	 * usb & mmc & sfc controllers can read data to dram
+	 * since they are unsecure.
+	 * (Note: only secure-world can access this register)
+	 */
+	if (IS_ENABLED(CONFIG_SPL_BUILD))
+		writel(0, FIREWALL_APB_BASE + FW_DDR_CON_REG);
+
 	return 0;
 }
 #endif