diff --git a/firmware/target/arm/as3525/app.lds b/firmware/target/arm/as3525/app.lds
index c2fce0d..d6ea4c7 100644
--- a/firmware/target/arm/as3525/app.lds
+++ b/firmware/target/arm/as3525/app.lds
@@ -26,6 +26,7 @@ STARTUP(target/arm/crt0.o)
#define IRAMSIZE (0x20000)
#endif

+#define DRAM_RO_OFFSET (DRAM_SIZE + 0x100000)

/* Where the codec buffer ends, and the plugin buffer starts */
#if CODEC_BUFFER_FILLS_IRAM
@@ -46,14 +47,15 @@ MEMORY
SECTIONS
{
loadaddress = DRAM_ORIG;
+ . = DRAM_ORIG;

- .vectors :
+ .vectors . + DRAM_RO_OFFSET:
{
_vectors_start = .;
*(.init.text)
- } > DRAM
+ } AT> DRAM

- .text :
+ .text . :
{
_loadaddress = .;
_textstart = .;
@@ -61,13 +63,13 @@ SECTIONS
*(.glue_7)
*(.glue_7t)
. = ALIGN(0x4);
- } > DRAM
+ } AT> DRAM

- .rodata :
+ .rodata . :
{
*(.rodata*)
. = ALIGN(0x4);
- } > DRAM
+ } AT> DRAM

.data :
{
diff --git a/firmware/target/arm/as3525/memory-init.S b/firmware/target/arm/as3525/memory-init.S
index 49b0546..b96a219 100644
--- a/firmware/target/arm/as3525/memory-init.S
+++ b/firmware/target/arm/as3525/memory-init.S
@@ -126,30 +126,44 @@ memory_init:
mov r1, #0 @ virtual address
mov r2, #0x1000 @ size (all memory)
mov r3, #CACHE_NONE
+ orr r3, r3, #(1<<10) @ AP = 01 = RW
bl map_section

mov r0, #0 @ physical address
ldr r1, =IRAM_ORIG @ virtual address
mov r2, #1 @ size : 1MB
mov r3, #CACHE_ALL
+ orr r3, r3, #(1<<10) @ AP = 01 = RW
bl map_section

mov r0, #0 @ physical address
ldr r1, =UNCACHED_ADDR(IRAM_ORIG) @ virtual address
mov r2, #1 @ size : 1MB
mov r3, #CACHE_NONE
+ orr r3, r3, #(1<<10) @ AP = 01 = RW
bl map_section

mov r0, #0x30000000 @ physical address
mov r1, #DRAM_ORIG @ virtual address
mov r2, #MEMORYSIZE @ size
mov r3, #CACHE_ALL
+ orr r3, r3, #(1<<10) @ AP = 01 = RW
+ bl map_section
+
+ mov r0, #0x30000000 @ physical address
+ mov r1, #DRAM_ORIG @ virtual address
+ add r1, r1, #((MEMORYSIZE+1) * 0x100000)
+ mov r2, #MEMORYSIZE @ size
+ mov r3, #(1 << 3) @ cacheable
+ add r3, #(1 << 5) @ domain 1 (Client)
+@ orr r3, r3, #(1<<10) @ AP = 01 = RW
bl map_section

mov r0, #0x30000000 @ physical address
mov r1, #UNCACHED_ADDR(DRAM_ORIG) @ virtual address
mov r2, #MEMORYSIZE @ size
mov r3, #CACHE_NONE
+ orr r3, r3, #(1<<10) @ AP = 01 = RW
bl map_section

/* map 1st mbyte of RAM at 0x0 to have exception vectors available */
@@ -161,6 +175,7 @@ memory_init:
mov r1, #0 @ virtual address
mov r2, #1 @ size
mov r3, #CACHE_ALL
+ orr r3, r3, #(1<<10) @ AP = 01 = RW
bl map_section

bl enable_mmu
diff --git a/firmware/target/arm/as3525/sd-as3525v2.c b/firmware/target/arm/as3525/sd-as3525v2.c
index 9edc598..b8b1763 100644
--- a/firmware/target/arm/as3525/sd-as3525v2.c
+++ b/firmware/target/arm/as3525/sd-as3525v2.c
@@ -712,6 +712,8 @@ static void init_controller(void)

int sd_init(void)
{
+ //char *b = sd_thread_name;
+ //*b = 'l';
int ret;

bitset32(&CGU_PERI, CGU_MCI_CLOCK_ENABLE);
diff --git a/firmware/target/arm/mmu-arm.S b/firmware/target/arm/mmu-arm.S
index 522aa9f..66713bb 100644
--- a/firmware/target/arm/mmu-arm.S
+++ b/firmware/target/arm/mmu-arm.S
@@ -93,6 +93,7 @@ ttb_init:
ldr r0, =TTB_BASE_ADDR @
mvn r1, #0 @
mcr p15, 0, r0, c2, c0, 0 @ Set the TTB base address
+ bic r1, r1, #(1 << 3) @ D1 = Client (access are checked)
mcr p15, 0, r1, c3, c0, 0 @ Set all domains to manager status
bx lr @
.size ttb_init, .-ttb_init
@@ -117,8 +118,9 @@ map_section:
@ 3,2: Cache flags (flags (r3))
@ 1: Section signature
orr r0, r0, r3
- orr r0, r0, #0x410
- orr r0, r0, #0x2
+@ orr r0, r0, #(1<<10) @ AP bit = 01 = RW
+ orr r0, r0, #0x10 @ always 1
+ orr r0, r0, #0x2 @ section sig

@ unsigned int* ttbPtr = TTB_BASE + (va >> 20);
@ sections are 1MB size
@@ -160,6 +162,7 @@ enable_mmu:
orr r0, r0, #1 @ enable mmu bit, i and dcache
orr r0, r0, #1<<2 @ enable dcache
orr r0, r0, #1<<12 @ enable icache
+ orr r0, r0, #1<<9 @ ROM protection (read-only)
mcr p15, 0, r0, c1, c0, 0 @
nop @
nop @