diff --git a/firmware/target/arm/as3525/app.lds b/firmware/target/arm/as3525/app.lds
index c2fce0d..d6ea4c7 100644
--- a/firmware/target/arm/as3525/app.lds
+++ b/firmware/target/arm/as3525/app.lds
@@ -26,6 +26,7 @@ STARTUP(target/arm/crt0.o)
 #define IRAMSIZE (0x20000)
 #endif
 
+#define DRAM_RO_OFFSET (DRAM_SIZE + 0x100000)
 
 /* Where the codec buffer ends, and the plugin buffer starts */
 #if CODEC_BUFFER_FILLS_IRAM
@@ -46,14 +47,15 @@ MEMORY
 SECTIONS
 {
     loadaddress = DRAM_ORIG;
+    . = DRAM_ORIG;
 
-    .vectors :
+    .vectors . + DRAM_RO_OFFSET:
     {
         _vectors_start = .;
         *(.init.text)
-    } > DRAM
+    } AT> DRAM
 
-    .text :
+    .text . :
     {
         _loadaddress = .;
         _textstart = .;
@@ -61,13 +63,13 @@ SECTIONS
         *(.glue_7)
         *(.glue_7t)
         . = ALIGN(0x4);
-    } > DRAM
+    } AT> DRAM
 
-    .rodata :
+    .rodata . :
     {
         *(.rodata*)
         . = ALIGN(0x4);
-    } > DRAM
+    } AT> DRAM
 
     .data :
     {
diff --git a/firmware/target/arm/as3525/memory-init.S b/firmware/target/arm/as3525/memory-init.S
index 49b0546..b96a219 100644
--- a/firmware/target/arm/as3525/memory-init.S
+++ b/firmware/target/arm/as3525/memory-init.S
@@ -126,30 +126,44 @@ memory_init:
     mov     r1, #0                          @ virtual address
     mov     r2, #0x1000                     @ size (all memory)
     mov     r3, #CACHE_NONE
+    orr     r3, r3, #(1<<10)                @ AP = 01 = RW
     bl      map_section
 
     mov     r0, #0                          @ physical address
     ldr     r1, =IRAM_ORIG                  @ virtual address
     mov     r2, #1                          @ size : 1MB
     mov     r3, #CACHE_ALL
+    orr     r3, r3, #(1<<10)                @ AP = 01 = RW
     bl      map_section
 
     mov     r0, #0                          @ physical address
     ldr     r1, =UNCACHED_ADDR(IRAM_ORIG)   @ virtual address
     mov     r2, #1                          @ size : 1MB
     mov     r3, #CACHE_NONE
+    orr     r3, r3, #(1<<10)                @ AP = 01 = RW
     bl      map_section
 
     mov     r0, #0x30000000                 @ physical address
     mov     r1, #DRAM_ORIG                  @ virtual address
     mov     r2, #MEMORYSIZE                 @ size
     mov     r3, #CACHE_ALL
+    orr     r3, r3, #(1<<10)                @ AP = 01 = RW
+    bl      map_section
+
+    mov     r0, #0x30000000                 @ physical address
+    mov     r1, #DRAM_ORIG                  @ virtual address
+    add     r1, r1, #((MEMORYSIZE+1) * 0x100000)
+    mov     r2, #MEMORYSIZE                 @ size
+    mov     r3, #(1 << 3)           @ cacheable
+    add     r3, #(1 << 5)           @ domain 1 (Client)
+@    orr     r3, r3, #(1<<10)                @ AP = 01 = RW
     bl      map_section
 
     mov     r0, #0x30000000                 @ physical address
     mov     r1, #UNCACHED_ADDR(DRAM_ORIG)   @ virtual address
     mov     r2, #MEMORYSIZE                 @ size
     mov     r3, #CACHE_NONE
+    orr     r3, r3, #(1<<10)                @ AP = 01 = RW
     bl      map_section
 
     /* map 1st mbyte of RAM at 0x0 to have exception vectors available */
@@ -161,6 +175,7 @@ memory_init:
     mov     r1, #0                          @ virtual address
     mov     r2, #1                          @ size
     mov     r3, #CACHE_ALL
+    orr     r3, r3, #(1<<10)                @ AP = 01 = RW
     bl      map_section
 
     bl      enable_mmu
diff --git a/firmware/target/arm/as3525/sd-as3525v2.c b/firmware/target/arm/as3525/sd-as3525v2.c
index 9edc598..b8b1763 100644
--- a/firmware/target/arm/as3525/sd-as3525v2.c
+++ b/firmware/target/arm/as3525/sd-as3525v2.c
@@ -712,6 +712,8 @@ static void init_controller(void)
 
 int sd_init(void)
 {
+    //char *b = sd_thread_name;
+    //*b = 'l';
     int ret;
 
     bitset32(&CGU_PERI, CGU_MCI_CLOCK_ENABLE);
diff --git a/firmware/target/arm/mmu-arm.S b/firmware/target/arm/mmu-arm.S
index 522aa9f..66713bb 100644
--- a/firmware/target/arm/mmu-arm.S
+++ b/firmware/target/arm/mmu-arm.S
@@ -93,6 +93,7 @@ ttb_init:
     ldr     r0, =TTB_BASE_ADDR      @
     mvn     r1, #0                  @
     mcr     p15, 0, r0, c2, c0, 0   @ Set the TTB base address
+    bic     r1, r1, #(1 << 3)       @ D1 = Client (access are checked)
     mcr     p15, 0, r1, c3, c0, 0   @ Set all domains to manager status
     bx      lr                      @
     .size   ttb_init, .-ttb_init
@@ -117,8 +118,9 @@ map_section:
     @  3,2: Cache flags (flags (r3))
     @  1:   Section signature
     orr     r0, r0, r3
-    orr     r0, r0, #0x410
-    orr     r0, r0, #0x2
+@    orr     r0, r0, #(1<<10) @ AP bit = 01 = RW
+    orr     r0, r0, #0x10 @ always 1
+    orr     r0, r0, #0x2  @ section sig
 
     @ unsigned int* ttbPtr = TTB_BASE + (va >> 20);
     @ sections are 1MB size
@@ -160,6 +162,7 @@ enable_mmu:
     orr     r0, r0, #1              @ enable mmu bit, i and dcache
     orr     r0, r0, #1<<2           @ enable dcache
     orr     r0, r0, #1<<12          @ enable icache
+    orr     r0, r0, #1<<9           @ ROM protection (read-only)
     mcr     p15, 0, r0, c1, c0, 0   @
     nop                             @
     nop                             @