diff --git a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/hub/usbh_hub.c b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/hub/usbh_hub.c
index e3674d327..fef242ee0 100644
--- a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/hub/usbh_hub.c
+++ b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/hub/usbh_hub.c
@@ -13,10 +13,15 @@ History:
 1. Date: 2024-06-24
 Author: AIIT XUOS Lab
 Modification: Modify the hub to decouple from xhci.
+
+2. Date: 2024-07-16
+Author: AIIT XUOS Lab
+Modification: rndis uses naive_mmap to assign virtual and physical addresses and match the relevant codes.
 *************************************************/
 
 #include "usbh_hub.h"
 #include "usb_def.h"
+#include "usyscall.h"
 
 
 #define DEV_FORMAT "/usb%d/hub%d"
@@ -103,7 +108,7 @@ static int _usbh_hub_get_hub_descriptor(struct usbh_hub *hub, uint8_t *buffer)
     setup->wIndex = 0;
     setup->wLength = USB_SIZEOF_HUB_DESC;
 
-    ret = usbh_control_transfer_xiuos(hub->parent, hub->parent->ep0, setup, hub->g_hub_buf);
+    ret = usbh_control_transfer_xiuos(hub->parent, hub->parent->ep0, setup, hub->g_hub_buf_phy);
     if (ret < 0) {
         return ret;
     }
@@ -124,7 +129,7 @@ static int _usbh_hub_get_status(struct usbh_hub *hub, uint8_t *buffer)
     setup->wIndex = 0;
     setup->wLength = 2;
 
-    ret = usbh_control_transfer_xiuos(hub->parent, hub->parent->ep0, setup, hub->g_hub_buf);
+    ret = usbh_control_transfer_xiuos(hub->parent, hub->parent->ep0, setup, hub->g_hub_buf_phy);
     if (ret < 0) {
         return ret;
     }
@@ -146,7 +151,7 @@ static int _usbh_hub_get_portstatus(struct usbh_hub *hub, uint8_t port, struct h
     setup->wIndex = port;
     setup->wLength = 4;
 
-    ret = usbh_control_transfer_xiuos(hub->parent, hub->parent->ep0, setup, hub->g_hub_buf);
+    ret = usbh_control_transfer_xiuos(hub->parent, hub->parent->ep0, setup, hub->g_hub_buf_phy);
     if (ret < 0) {
         return ret;
     }
@@ -289,7 +294,7 @@ static int usbh_hub_set_depth(struct usbh_hub *hub, uint16_t depth)
         setup->wValue = depth;
         setup->wIndex = 0;
         setup->wLength = 0;
-		return usbh_roothub_control(hub->usb, setup, NULL);
+        return usbh_roothub_control(hub->usb, setup, NULL);
     } else {
         return _usbh_hub_set_depth(hub, depth);
     }    
@@ -312,6 +317,8 @@ static int usbh_hub_connect(struct usbh_hubport *hport, uint8_t intf)
     struct usbh_bus *usb = usbh_get_bus_of_port(hport);
     int ret;
     int index;
+    uintptr_t vaddr, paddr;
+    int rc;
 
     index = usbh_hub_devno_alloc();
     if (index > (CONFIG_USBHOST_MAX_EXTHUBS + EXTHUB_FIRST_INDEX - 1)) {
@@ -327,6 +334,15 @@ static int usbh_hub_connect(struct usbh_hubport *hport, uint8_t intf)
     hub->parent = hport;
     hub->index = index;
 
+    /* g_hub_buf allocate virtual address and physical address*/
+    rc = naive_mmap(&vaddr, &paddr, 32, false);
+    if(rc != 0){
+        USB_LOG_ERR("g_hub_buf allocate error, ret: %d\n", rc);
+        return -ENOMEM;
+    }
+    hub->g_hub_buf = (uint8_t *)vaddr;
+    hub->g_hub_buf_phy = (uint8_t *)paddr;
+
     hport->config.intf[intf].priv = hub;
 
     ret = _usbh_hub_get_hub_descriptor(hub, (uint8_t *)&hub->hub_desc);
@@ -642,8 +658,8 @@ static void usbh_hub_events(struct usbh_hub *hub)
                     child = &hub->child[port];
                     /** release child sources */
                     usbh_hubport_release(child);
-					
-					/** some USB 3.0 ip may failed to enable USB 2.0 port for USB 3.0 device */
+
+                    /** some USB 3.0 ip may failed to enable USB 2.0 port for USB 3.0 device */
                     USB_LOG_WRN("Failed to enable port %u\r\n", port + 1);
 
                     continue;
diff --git a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/usbh_rndis.c b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/usbh_rndis.c
index 1e7f50102..46f4b73a0 100644
--- a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/usbh_rndis.c
+++ b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/usbh_rndis.c
@@ -14,11 +14,16 @@ History:
 1. Date: 2024-07-10
 Author: AIIT XUOS Lab
 Modification: rndis ADAPTS to usb core to decouple xhci.
+
+2. Date: 2024-07-16
+Author: AIIT XUOS Lab
+Modification: rndis uses naive_mmap to assign virtual and physical addresses and match the relevant codes.
 *************************************************/
 
 #include "usbh_core.h"
 #include "usbh_rndis.h"
 #include "rndis_protocol.h"
+#include "usyscall.h"
 
 #define DEV_FORMAT "/dev/rndis"
 
@@ -32,8 +37,19 @@ static int usbh_rndis_init_msg_transfer(struct usbh_rndis *rndis_class)
     int ret = 0;
     rndis_initialize_msg_t *cmd;
     rndis_initialize_cmplt_t *resp;
+    rndis_initialize_msg_t *cmd_phy;
+    rndis_initialize_cmplt_t *resp_phy;
+    uintptr_t vaddr;
+    uintptr_t paddr;
 
-    cmd = (rndis_initialize_msg_t *)g_rndis_buf;
+    //cmd = (rndis_initialize_msg_t *)g_rndis_buf;
+    ret = naive_mmap(&vaddr, &paddr, sizeof(rndis_initialize_msg_t), false);
+    if(ret != 0){
+        USB_LOG_ERR("rndis_initialize_msg_t allocate error, ret: %d\r\n", ret);
+        return -ENOMEM;
+    }
+    cmd = (rndis_initialize_msg_t *)vaddr;
+    cmd_phy = (rndis_initialize_msg_t *)paddr;
 
     cmd->MessageType = REMOTE_NDIS_INITIALIZE_MSG;
     cmd->MessageLength = sizeof(rndis_initialize_msg_t);
@@ -48,7 +64,7 @@ static int usbh_rndis_init_msg_transfer(struct usbh_rndis *rndis_class)
     setup->wIndex = 0;
     setup->wLength = sizeof(rndis_initialize_msg_t);
 
-    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)cmd);
+    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)cmd_phy);
     if (ret < 0) {
         USB_LOG_ERR("rndis_initialize_msg_t send error, ret: %d\r\n", ret);
         return ret;
@@ -56,7 +72,14 @@ static int usbh_rndis_init_msg_transfer(struct usbh_rndis *rndis_class)
 
     //ret = usbh_ep_intr_transfer()
 
-    resp = (rndis_initialize_cmplt_t *)g_rndis_buf;
+    //resp = (rndis_initialize_cmplt_t *)g_rndis_buf;
+    ret = naive_mmap(&vaddr, &paddr, 4096, false);    // Parameter len is consistent with setup->wLength.
+    if(ret != 0){
+        USB_LOG_ERR("rndis_initialize_cmplt_t allocate error, ret: %d\r\n", ret);
+        return -ENOMEM;
+    }
+    resp = (rndis_initialize_cmplt_t *)vaddr;
+    resp_phy = (rndis_initialize_cmplt_t *)paddr;
 
     setup->bmRequestType = USB_REQUEST_DIR_IN | USB_REQUEST_CLASS | USB_REQUEST_RECIPIENT_INTERFACE;
     setup->bRequest = CDC_REQUEST_GET_ENCAPSULATED_RESPONSE;
@@ -64,7 +87,7 @@ static int usbh_rndis_init_msg_transfer(struct usbh_rndis *rndis_class)
     setup->wIndex = 0;
     setup->wLength = 4096;
 
-    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)resp);
+    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)resp_phy);
     if (ret < 0) {
         USB_LOG_ERR("rndis_initialize_cmplt_t recv error, ret: %d\r\n", ret);
         return ret;
@@ -79,8 +102,19 @@ int usbh_rndis_query_msg_transfer(struct usbh_rndis *rndis_class, uint32_t oid,
     int ret = 0;
     rndis_query_msg_t *cmd;
     rndis_query_cmplt_t *resp;
+    rndis_query_msg_t *cmd_phy;
+    rndis_query_cmplt_t *resp_phy;
+    uintptr_t vaddr;
+    uintptr_t paddr;
 
-    cmd = (rndis_query_msg_t *)g_rndis_buf;
+    //cmd = (rndis_query_msg_t *)g_rndis_buf;
+    ret = naive_mmap(&vaddr, &paddr, query_len + sizeof(rndis_query_msg_t), false);
+    if(ret != 0){
+        USB_LOG_ERR("rndis_query_msg_t allocate error, ret: %d\r\n", ret);
+        return -ENOMEM;
+    }
+    cmd = (rndis_query_msg_t *)vaddr;
+    cmd_phy = (rndis_query_msg_t *)paddr;
 
     cmd->MessageType = REMOTE_NDIS_QUERY_MSG;
     cmd->MessageLength = query_len + sizeof(rndis_query_msg_t);
@@ -96,7 +130,7 @@ int usbh_rndis_query_msg_transfer(struct usbh_rndis *rndis_class, uint32_t oid,
     setup->wIndex = 0;
     setup->wLength = query_len + sizeof(rndis_query_msg_t);
 
-    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)cmd);
+    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)cmd_phy);
     if (ret < 0) {
         USB_LOG_ERR("oid:%08x send error, ret: %d\r\n", (unsigned int)oid, ret);
         return ret;
@@ -104,7 +138,14 @@ int usbh_rndis_query_msg_transfer(struct usbh_rndis *rndis_class, uint32_t oid,
 
     //ret = usbh_ep_intr_transfer()
 
-    resp = (rndis_query_cmplt_t *)g_rndis_buf;
+    //resp = (rndis_query_cmplt_t *)g_rndis_buf;
+    ret = naive_mmap(&vaddr, &paddr, 4096, false);
+    if(ret != 0){
+        USB_LOG_ERR("rndis_query_cmplt_t allocate error, ret: %d\r\n", ret);
+        return -ENOMEM;
+    }
+    resp = (rndis_query_cmplt_t *)vaddr;
+    resp_phy = (rndis_query_cmplt_t *)paddr;
 
     setup->bmRequestType = USB_REQUEST_DIR_IN | USB_REQUEST_CLASS | USB_REQUEST_RECIPIENT_INTERFACE;
     setup->bRequest = CDC_REQUEST_GET_ENCAPSULATED_RESPONSE;
@@ -112,7 +153,7 @@ int usbh_rndis_query_msg_transfer(struct usbh_rndis *rndis_class, uint32_t oid,
     setup->wIndex = 0;
     setup->wLength = 4096;
 
-    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)resp);
+    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)resp_phy);
     if (ret < 0) {
         USB_LOG_ERR("oid:%08x recv error, ret: %d\r\n", (unsigned int)oid, ret);
         return ret;
@@ -130,8 +171,19 @@ static int usbh_rndis_set_msg_transfer(struct usbh_rndis *rndis_class, uint32_t
     int ret = 0;
     rndis_set_msg_t *cmd;
     rndis_set_cmplt_t *resp;
+    rndis_set_msg_t *cmd_phy;
+    rndis_set_cmplt_t *resp_phy;
+    uintptr_t vaddr;
+    uintptr_t paddr;
 
-    cmd = (rndis_set_msg_t *)g_rndis_buf;
+    //cmd = (rndis_set_msg_t *)g_rndis_buf;
+    ret = naive_mmap(&vaddr, &paddr, info_len + sizeof(rndis_set_msg_t), false);
+    if(ret != 0){
+        USB_LOG_ERR("rndis_set_msg_t allocate error, ret: %d\r\n", ret);
+        return -ENOMEM;
+    }
+    cmd = (rndis_set_msg_t *)vaddr;
+    cmd_phy = (rndis_set_msg_t *)paddr;
 
     cmd->MessageType = REMOTE_NDIS_SET_MSG;
     cmd->MessageLength = info_len + sizeof(rndis_set_msg_t);
@@ -148,7 +200,7 @@ static int usbh_rndis_set_msg_transfer(struct usbh_rndis *rndis_class, uint32_t
     setup->wIndex = 0;
     setup->wLength = info_len + sizeof(rndis_set_msg_t);
 
-    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)cmd);
+    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)cmd_phy);
     if (ret < 0) {
         USB_LOG_ERR("oid:%08x send error, ret: %d\r\n", (unsigned int)oid, ret);
         return ret;
@@ -156,7 +208,14 @@ static int usbh_rndis_set_msg_transfer(struct usbh_rndis *rndis_class, uint32_t
 
     //ret = usbh_ep_intr_transfer(rndis_class->hport->intin,buf,len,500);
 
-    resp = (rndis_set_cmplt_t *)g_rndis_buf;
+    //resp = (rndis_set_cmplt_t *)g_rndis_buf;
+    ret = naive_mmap(&vaddr, &paddr, 4096, false);
+    if(ret != 0){
+        USB_LOG_ERR("rndis_set_cmplt_t allocate error, ret: %d\r\n", ret);
+        return -ENOMEM;
+    }
+    resp = (rndis_set_cmplt_t *)vaddr;
+    resp_phy = (rndis_set_cmplt_t *)paddr;
 
     setup->bmRequestType = USB_REQUEST_DIR_IN | USB_REQUEST_CLASS | USB_REQUEST_RECIPIENT_INTERFACE;
     setup->bRequest = CDC_REQUEST_GET_ENCAPSULATED_RESPONSE;
@@ -164,7 +223,7 @@ static int usbh_rndis_set_msg_transfer(struct usbh_rndis *rndis_class, uint32_t
     setup->wIndex = 0;
     setup->wLength = 4096;
 
-    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)resp);
+    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)resp_phy);
     if (ret < 0) {
         USB_LOG_ERR("oid:%08x recv error, ret: %d\r\n", (unsigned int)oid, ret);
         return ret;
@@ -207,8 +266,19 @@ int usbh_rndis_keepalive(struct usbh_rndis *rndis_class)
     int ret = 0;
     rndis_keepalive_msg_t *cmd;
     rndis_keepalive_cmplt_t *resp;
+    rndis_keepalive_msg_t *cmd_phy;
+    rndis_keepalive_cmplt_t *resp_phy;
+    uintptr_t vaddr;
+    uintptr_t paddr;
 
-    cmd = (rndis_keepalive_msg_t *)g_rndis_buf;
+    //cmd = (rndis_keepalive_msg_t *)g_rndis_buf;
+    ret = naive_mmap(&vaddr, &paddr, sizeof(rndis_keepalive_msg_t), false);
+    if(ret != 0){
+        USB_LOG_ERR("rndis_keepalive_msg_t allocate error, ret: %d\r\n", ret);
+        return -ENOMEM;
+    }
+    cmd = (rndis_keepalive_msg_t *)vaddr;
+    cmd_phy = (rndis_keepalive_msg_t *)paddr;
 
     cmd->MessageType = REMOTE_NDIS_KEEPALIVE_MSG;
     cmd->MessageLength = sizeof(rndis_keepalive_msg_t);
@@ -220,7 +290,7 @@ int usbh_rndis_keepalive(struct usbh_rndis *rndis_class)
     setup->wIndex = 0;
     setup->wLength = sizeof(rndis_keepalive_msg_t);
 
-    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)cmd);
+    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)cmd_phy);
     if (ret < 0) {
         USB_LOG_ERR("keepalive send error, ret: %d\r\n", ret);
         return ret;
@@ -228,7 +298,14 @@ int usbh_rndis_keepalive(struct usbh_rndis *rndis_class)
 
     //ret = usbh_ep_intr_transfer(rndis_class->hport->intin,buf,len,500);
 
-    resp = (rndis_keepalive_cmplt_t *)g_rndis_buf;
+    //resp = (rndis_keepalive_cmplt_t *)g_rndis_buf;
+    ret = naive_mmap(&vaddr, &paddr, 4096, false);
+    if(ret != 0){
+        USB_LOG_ERR("rndis_keepalive_cmplt_t allocate error, ret: %d\r\n", ret);
+        return -ENOMEM;
+    }
+    resp = (rndis_keepalive_cmplt_t *)vaddr;
+    resp_phy = (rndis_keepalive_cmplt_t *)paddr;
 
     setup->bmRequestType = USB_REQUEST_DIR_IN | USB_REQUEST_CLASS | USB_REQUEST_RECIPIENT_INTERFACE;
     setup->bRequest = CDC_REQUEST_GET_ENCAPSULATED_RESPONSE;
@@ -236,7 +313,7 @@ int usbh_rndis_keepalive(struct usbh_rndis *rndis_class)
     setup->wIndex = 0;
     setup->wLength = 4096;
 
-    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)resp);
+    ret = usbh_control_transfer_xiuos(rndis_class->hport, rndis_class->hport->ep0, setup, (uint8_t *)resp_phy);
     if (ret < 0) {
         USB_LOG_ERR("keepalive recv error, ret: %d\r\n", ret);
         return ret;
diff --git a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/core/usbh_core.c b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/core/usbh_core.c
index 1bff9fc37..7e5535504 100644
--- a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/core/usbh_core.c
+++ b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/core/usbh_core.c
@@ -24,11 +24,16 @@ Modification: Extract the functions of the host controller to core.
 Author: AIIT XUOS Lab
 Modification: Modifying functions in usb core is related to xhci.
 
+4. Date: 2024-07-16
+Author: AIIT XUOS Lab
+Modification: usb core uses naive_mmap to assign virtual and physical addresses and match the relevant codes.
+
 *************************************************/
 
 #include "usbh_core.h"
 #include "usbh_hub.h"
 #include "usb_hc_xhci.h"
+#include "usyscall.h"
 
 struct usbh_class_info *usbh_class_info_table_begin = NULL;
 struct usbh_class_info *usbh_class_info_table_end = NULL;
@@ -553,7 +558,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wLength = 8;
 
     dev_desc = (struct usb_device_descriptor *)usb->ep0_request_buffer;
-    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, (uint8_t *)dev_desc);
+    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, (uint8_t *)usb->ep0_request_buffer_phy);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get device descriptor,errorcode:%d\r\n", ret);
         goto errout;
@@ -611,7 +616,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wIndex = 0;
     setup->wLength = USB_SIZEOF_DEVICE_DESC;
 
-    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer);
+    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer_phy);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get full device descriptor,errorcode:%d\r\n", ret);
         goto errout;
@@ -630,7 +635,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wIndex = 0;
     setup->wLength = USB_SIZEOF_CONFIG_DESC;
 
-    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer);
+    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer_phy);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get config descriptor,errorcode:%d\r\n", ret);
         goto errout;
@@ -647,7 +652,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wIndex = 0;
     setup->wLength = wTotalLength;
 
-    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer);
+    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer_phy);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get full config descriptor,errorcode:%d\r\n", ret);
         goto errout;
@@ -674,7 +679,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wIndex = 0x0409;
     setup->wLength = 255;
 
-    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer);
+    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer_phy);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get Manufacturer string,errorcode:%d\r\n", ret);
         goto errout;
@@ -689,7 +694,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wIndex = 0x0409;
     setup->wLength = 255;
 
-    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer);
+    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer_phy);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get get Product string,errorcode:%d\r\n", ret);
         goto errout;
@@ -704,7 +709,7 @@ int usbh_enumerate(struct usbh_hubport *hport)
     setup->wIndex = 0x0409;
     setup->wLength = 255;
 
-    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer);
+    ret = usbh_control_transfer_xiuos(hport, hport->ep0, setup, usb->ep0_request_buffer_phy);
     if (ret < 0) {
         USB_LOG_ERR("Failed to get get SerialNumber string,errorcode:%d\r\n", ret);
         goto errout;
@@ -810,6 +815,9 @@ void *usbh_find_class_instance(const char *devname)
 
 int usbh_initialize(uint32_t id, struct usbh_bus *usb)
 {
+    uintptr_t vaddr, paddr;
+    int rc;
+
     memset(usb, 0, sizeof(struct usbh_bus));
 
 #ifdef __ARMCC_VERSION /* ARM C Compiler */
@@ -837,6 +845,15 @@ int usbh_initialize(uint32_t id, struct usbh_bus *usb)
     usb->hub_class_head.next = NULL;
     usb->id = id;
 
+    /* ep0_request_buffer allocate virtual address and physical address*/
+    rc = naive_mmap(&vaddr, &paddr, CONFIG_USBHOST_REQUEST_BUFFER_LEN, false);
+    if(rc != 0){
+        USB_LOG_ERR("ep0_request_buffer allocate error, ret: %d\n", rc);
+        return -ENOMEM;
+    }
+    usb->ep0_request_buffer = (uint8_t *)vaddr;
+    usb->ep0_request_buffer_phy = (uint8_t *)paddr;
+
     usb_slist_add_tail(&usb_buses, &(usb->list));
     usbh_hub_initialize(usb);
     return 0;
diff --git a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/core/usbh_core.h b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/core/usbh_core.h
index 3cba17813..919c6f737 100644
--- a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/core/usbh_core.h
+++ b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/core/usbh_core.h
@@ -18,6 +18,10 @@ Modification: New parameter usb_hc_type for host controller type.
 2. Date: 2024-06-24
 Author: AIIT XUOS Lab
 Modification: Refactor the function that fills urb with usb_hc_type.
+
+2. Date: 2024-07-16
+Author: AIIT XUOS Lab
+Modification: Add physical addresses to data structures usbh_bus and usbh_bus.
 *************************************************/
 
 
@@ -167,8 +171,8 @@ struct usbh_configuration {
 
 struct usbh_hub;
 struct usbh_hubport {
-	/** Name */
-	char name[32];
+    /** Name */
+    char name[32];
     bool connected;   /* True: device connected; false: disconnected */
     uint8_t port;     /* Hub port index */
     uint8_t dev_addr; /* device address */
@@ -204,7 +208,9 @@ struct usbh_hub {
     usb_slist_t hub_event_list;
     struct usbh_bus *usb;
     uint32_t ports; /* num of ports */
-    USB_MEM_ALIGNX uint8_t g_hub_buf[32];
+    //USB_MEM_ALIGNX uint8_t g_hub_buf[32];
+    uint8_t* g_hub_buf;    //virtual address
+    uint8_t* g_hub_buf_phy;    //physical address
     USB_MEM_ALIGNX uint8_t g_hub_intbuf[CONFIG_USBHOST_MAX_EXTHUBS + 1][1];
 };
 
@@ -240,8 +246,8 @@ struct usbh_bus {
     usb_slist_t list;
     uint8_t id;
     uint8_t usb_hc_type;
-	/** Largest transfer allowed on the bus */
-	size_t mtu;
+    /** Largest transfer allowed on the bus */
+    size_t mtu;
     struct usbh_devaddr_map devgen;   
     struct usbh_hub roothub;
 #if CONFIG_USBHOST_MAX_EXTHUBS > 0
@@ -257,7 +263,9 @@ struct usbh_bus {
     int (*hub_open)(struct usbh_hub *hub);
     void (*hub_close)(struct usbh_hub *hub);
     int (*root_open)(struct usbh_hub *hub);
-    USB_MEM_ALIGNX uint8_t ep0_request_buffer[CONFIG_USBHOST_REQUEST_BUFFER_LEN];
+    //USB_MEM_ALIGNX uint8_t ep0_request_buffer[CONFIG_USBHOST_REQUEST_BUFFER_LEN];
+    uint8_t* ep0_request_buffer;    //virtual address
+    uint8_t* ep0_request_buffer_phy;    //physical address
     USB_MEM_ALIGNX struct usb_setup_packet g_setup[CONFIG_USBHOST_MAX_EXTHUBS + 1][CONFIG_USBHOST_MAX_EHPORTS];
 };