diff --git a/Ubiquitous/XiZi_AIoT/hardkernel/clock/arm/armv8-a/cortex-a72/ok1028a-c/clock.c b/Ubiquitous/XiZi_AIoT/hardkernel/clock/arm/armv8-a/cortex-a72/ok1028a-c/clock.c
index 7d925d2af..1c401bdcc 100644
--- a/Ubiquitous/XiZi_AIoT/hardkernel/clock/arm/armv8-a/cortex-a72/ok1028a-c/clock.c
+++ b/Ubiquitous/XiZi_AIoT/hardkernel/clock/arm/armv8-a/cortex-a72/ok1028a-c/clock.c
@@ -39,7 +39,8 @@ static void disable_timer()
 static void reload_timer()
 {
     // interval 100ms
-    uint32_t interval = 100000;
+    static uint32_t ms = 10;
+    uint32_t interval = ms * 1000;
     uint32_t interval_clk = interval * (r_cntfrq_el0() / 1000000);
     w_cntv_tval_el0(interval_clk);
 }
diff --git a/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/gicv3/gicv3.c b/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/gicv3/gicv3.c
index 1dc5a016c..17e68a39d 100644
--- a/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/gicv3/gicv3.c
+++ b/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/gicv3/gicv3.c
@@ -192,8 +192,7 @@ gic_set_prio0(uint32_t intid)
     gicd_write(D_IPRIORITYR(intid / 4), p);
 }
 
-static void
-gic_set_target(uint32_t intid, uint32_t cpuid)
+static void gic_set_target(uint32_t intid, uint32_t cpuid)
 {
     uint32_t itargetsr = gicd_read(D_ITARGETSR(intid / 4));
     itargetsr &= ~((uint32_t)0xff << (intid % 4 * 8));
diff --git a/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/gicv3/gicv3_common_opa.h b/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/gicv3/gicv3_common_opa.h
index 417869264..17e3632eb 100644
--- a/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/gicv3/gicv3_common_opa.h
+++ b/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/gicv3/gicv3_common_opa.h
@@ -83,6 +83,7 @@ void gic_set_cpu_target(uint32_t irqID, unsigned cpuNumber, bool enableIt);
 void gic_set_irq_priority(uint32_t irq_id, uint32_t priority);
 
 void gic_setup_spi(uint32_t cpuid, uint32_t intid);
+void gic_setup_ppi(uint32_t cpuid, uint32_t intid);
 
 void gicv3inithart(uint32_t cpu_id);
 //! @brief Send a software generated interrupt to a specific CPU.
diff --git a/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/ok1028a-c/trap_common.c b/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/ok1028a-c/trap_common.c
index 5fbb233da..328634f27 100644
--- a/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/ok1028a-c/trap_common.c
+++ b/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/ok1028a-c/trap_common.c
@@ -70,7 +70,7 @@ static void _cpu_irq_disable(void)
 
 static void _single_irq_enable(int irq, int cpu, int prio)
 {
-    gic_setup_spi((uint32_t)cpu, (uint32_t)irq);
+    gic_setup_ppi((uint32_t)cpu, (uint32_t)irq);
 }
 
 static void _single_irq_disable(int irq, int cpu)
diff --git a/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/trampoline.S b/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/trampoline.S
index e55e41046..c365de082 100644
--- a/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/trampoline.S
+++ b/Ubiquitous/XiZi_AIoT/hardkernel/intr/arm/armv8-a/cortex-a72/trampoline.S
@@ -197,7 +197,6 @@ el1irq:
         bl intr_irq_dispatch
 
         urestorereg
-        msr daifclr, #0xf
       
         eret
       
@@ -209,7 +208,6 @@ el0sync:
         bl syscall_arch_handler
       
         urestorereg
-        msr daifclr, #0xf
       
         eret
 
@@ -223,6 +221,5 @@ el0irq:
 .global trap_return
 trap_return:
         urestorereg
-        msr daifclr, #0xf
 
         eret
\ No newline at end of file
diff --git a/Ubiquitous/XiZi_AIoT/hardkernel/mmu/arm/armv8-a/cortex-a72/bootmmu.c b/Ubiquitous/XiZi_AIoT/hardkernel/mmu/arm/armv8-a/cortex-a72/bootmmu.c
index a7663fd18..b01be9923 100644
--- a/Ubiquitous/XiZi_AIoT/hardkernel/mmu/arm/armv8-a/cortex-a72/bootmmu.c
+++ b/Ubiquitous/XiZi_AIoT/hardkernel/mmu/arm/armv8-a/cortex-a72/bootmmu.c
@@ -48,8 +48,13 @@ extern uint64_t kernel_data_begin[];
 
 #define L4_TYPE_PAGE        (3 << 0)
 #define L4_PTE_DEV          ((0b00) << 2) // Device memory
+#define L4_PTE_NORMAL       ((0b01) << 2) // Device memory
 #define L4_PTE_AF           (1 << 10) // Data Access Permissions
 
+#define L4_PTE_PXN             (1UL << 53)   // Privileged eXecute Never
+#define L4_PTE_UXN             (1UL << 54)   // Unprivileged(user) eXecute Never
+#define L4_PTE_XN              (PTE_PXN|PTE_UXN)  // eXecute Never
+
 #define IDX_MASK            (0b111111111)
 #define L3_PDE_INDEX(idx)   ((idx << LEVEL3_PDE_SHIFT) & L3_IDX_MASK)
 // clang-format on
@@ -76,7 +81,7 @@ static void build_boot_pgdir()
         boot_dev_l3pgdir[i] = (uint64_t)boot_dev_l4pgdirs[i] | L3_TYPE_TAB | L3_PTE_VALID;
 
         for (size_t j = 0; j < NUM_LEVEL4_PTE; j++) {
-            boot_dev_l4pgdirs[i][j] = cur_mem_paddr | L4_TYPE_PAGE | L4_PTE_DEV | L4_PTE_AF;
+            boot_dev_l4pgdirs[i][j] = cur_mem_paddr | L4_TYPE_PAGE | L4_PTE_DEV | L4_PTE_AF | L4_PTE_XN;
 
             cur_mem_paddr += PAGE_SIZE;
         }
@@ -91,7 +96,7 @@ static void build_boot_pgdir()
         boot_kern_l3pgdir[i] = (uint64_t)boot_kern_l4pgdirs[i] | L3_TYPE_TAB | L3_PTE_VALID;
 
         for (size_t j = 0; j < NUM_LEVEL4_PTE; j++) {
-            boot_kern_l4pgdirs[i][j] = cur_mem_paddr | L4_TYPE_PAGE | L4_PTE_AF;
+            boot_kern_l4pgdirs[i][j] = cur_mem_paddr | L4_TYPE_PAGE | L4_PTE_NORMAL | L4_PTE_AF;
 
             cur_mem_paddr += PAGE_SIZE;
         }
@@ -111,7 +116,6 @@ static void load_boot_pgdir()
     // Enable paging using read/modify/write
     SCTLR_R(val);
     val |= (1 << 0); // EL1 and EL0 stage 1 address translation enabled.
-
     SCTLR_W(val);
 
     // flush all TLB