diff --git a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/usbh_rndis.c b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/usbh_rndis.c
index 46f4b73a0..61259a7be 100644
--- a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/usbh_rndis.c
+++ b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/usbh_rndis.c
@@ -27,7 +27,11 @@ Modification: rndis uses naive_mmap to assign virtual and physical addresses and
 
 #define DEV_FORMAT "/dev/rndis"
 
-USB_NOCACHE_RAM_SECTION USB_MEM_ALIGNX uint8_t g_rndis_buf[4096];
+//USB_NOCACHE_RAM_SECTION USB_MEM_ALIGNX uint8_t g_rndis_buf[4096];
+uint8_t *g_rndis_buf;
+uint8_t *g_rndis_buf_phy;
+uint8_t *g_rndis_keepalive_buf;
+uint8_t *g_rndis_keepalive_buf_phy;
 
 static struct usbh_rndis g_rndis_class;
 
@@ -39,17 +43,9 @@ static int usbh_rndis_init_msg_transfer(struct usbh_rndis *rndis_class)
     rndis_initialize_cmplt_t *resp;
     rndis_initialize_msg_t *cmd_phy;
     rndis_initialize_cmplt_t *resp_phy;
-    uintptr_t vaddr;
-    uintptr_t paddr;
 
-    //cmd = (rndis_initialize_msg_t *)g_rndis_buf;
-    ret = naive_mmap(&vaddr, &paddr, sizeof(rndis_initialize_msg_t), false);
-    if(ret != 0){
-        USB_LOG_ERR("rndis_initialize_msg_t allocate error, ret: %d\r\n", ret);
-        return -ENOMEM;
-    }
-    cmd = (rndis_initialize_msg_t *)vaddr;
-    cmd_phy = (rndis_initialize_msg_t *)paddr;
+    cmd = (rndis_initialize_msg_t *)g_rndis_buf;
+    cmd_phy = (rndis_initialize_msg_t *)g_rndis_buf_phy;
 
     cmd->MessageType = REMOTE_NDIS_INITIALIZE_MSG;
     cmd->MessageLength = sizeof(rndis_initialize_msg_t);
@@ -72,14 +68,8 @@ static int usbh_rndis_init_msg_transfer(struct usbh_rndis *rndis_class)
 
     //ret = usbh_ep_intr_transfer()
 
-    //resp = (rndis_initialize_cmplt_t *)g_rndis_buf;
-    ret = naive_mmap(&vaddr, &paddr, 4096, false);    // Parameter len is consistent with setup->wLength.
-    if(ret != 0){
-        USB_LOG_ERR("rndis_initialize_cmplt_t allocate error, ret: %d\r\n", ret);
-        return -ENOMEM;
-    }
-    resp = (rndis_initialize_cmplt_t *)vaddr;
-    resp_phy = (rndis_initialize_cmplt_t *)paddr;
+    resp = (rndis_initialize_cmplt_t *)g_rndis_buf;
+    resp_phy = (rndis_initialize_cmplt_t *)g_rndis_buf_phy;
 
     setup->bmRequestType = USB_REQUEST_DIR_IN | USB_REQUEST_CLASS | USB_REQUEST_RECIPIENT_INTERFACE;
     setup->bRequest = CDC_REQUEST_GET_ENCAPSULATED_RESPONSE;
@@ -104,17 +94,9 @@ int usbh_rndis_query_msg_transfer(struct usbh_rndis *rndis_class, uint32_t oid,
     rndis_query_cmplt_t *resp;
     rndis_query_msg_t *cmd_phy;
     rndis_query_cmplt_t *resp_phy;
-    uintptr_t vaddr;
-    uintptr_t paddr;
 
-    //cmd = (rndis_query_msg_t *)g_rndis_buf;
-    ret = naive_mmap(&vaddr, &paddr, query_len + sizeof(rndis_query_msg_t), false);
-    if(ret != 0){
-        USB_LOG_ERR("rndis_query_msg_t allocate error, ret: %d\r\n", ret);
-        return -ENOMEM;
-    }
-    cmd = (rndis_query_msg_t *)vaddr;
-    cmd_phy = (rndis_query_msg_t *)paddr;
+    cmd = (rndis_query_msg_t *)g_rndis_buf;
+    cmd_phy = (rndis_query_msg_t *)g_rndis_buf_phy;
 
     cmd->MessageType = REMOTE_NDIS_QUERY_MSG;
     cmd->MessageLength = query_len + sizeof(rndis_query_msg_t);
@@ -138,14 +120,8 @@ int usbh_rndis_query_msg_transfer(struct usbh_rndis *rndis_class, uint32_t oid,
 
     //ret = usbh_ep_intr_transfer()
 
-    //resp = (rndis_query_cmplt_t *)g_rndis_buf;
-    ret = naive_mmap(&vaddr, &paddr, 4096, false);
-    if(ret != 0){
-        USB_LOG_ERR("rndis_query_cmplt_t allocate error, ret: %d\r\n", ret);
-        return -ENOMEM;
-    }
-    resp = (rndis_query_cmplt_t *)vaddr;
-    resp_phy = (rndis_query_cmplt_t *)paddr;
+    resp = (rndis_query_cmplt_t *)g_rndis_buf;
+    resp_phy = (rndis_query_cmplt_t *)g_rndis_buf_phy;
 
     setup->bmRequestType = USB_REQUEST_DIR_IN | USB_REQUEST_CLASS | USB_REQUEST_RECIPIENT_INTERFACE;
     setup->bRequest = CDC_REQUEST_GET_ENCAPSULATED_RESPONSE;
@@ -173,17 +149,9 @@ static int usbh_rndis_set_msg_transfer(struct usbh_rndis *rndis_class, uint32_t
     rndis_set_cmplt_t *resp;
     rndis_set_msg_t *cmd_phy;
     rndis_set_cmplt_t *resp_phy;
-    uintptr_t vaddr;
-    uintptr_t paddr;
 
-    //cmd = (rndis_set_msg_t *)g_rndis_buf;
-    ret = naive_mmap(&vaddr, &paddr, info_len + sizeof(rndis_set_msg_t), false);
-    if(ret != 0){
-        USB_LOG_ERR("rndis_set_msg_t allocate error, ret: %d\r\n", ret);
-        return -ENOMEM;
-    }
-    cmd = (rndis_set_msg_t *)vaddr;
-    cmd_phy = (rndis_set_msg_t *)paddr;
+    cmd = (rndis_set_msg_t *)g_rndis_buf;
+    cmd_phy = (rndis_set_msg_t *)g_rndis_buf_phy;
 
     cmd->MessageType = REMOTE_NDIS_SET_MSG;
     cmd->MessageLength = info_len + sizeof(rndis_set_msg_t);
@@ -208,14 +176,8 @@ static int usbh_rndis_set_msg_transfer(struct usbh_rndis *rndis_class, uint32_t
 
     //ret = usbh_ep_intr_transfer(rndis_class->hport->intin,buf,len,500);
 
-    //resp = (rndis_set_cmplt_t *)g_rndis_buf;
-    ret = naive_mmap(&vaddr, &paddr, 4096, false);
-    if(ret != 0){
-        USB_LOG_ERR("rndis_set_cmplt_t allocate error, ret: %d\r\n", ret);
-        return -ENOMEM;
-    }
-    resp = (rndis_set_cmplt_t *)vaddr;
-    resp_phy = (rndis_set_cmplt_t *)paddr;
+    resp = (rndis_set_cmplt_t *)g_rndis_buf;
+    resp_phy = (rndis_set_cmplt_t *)g_rndis_buf_phy;
 
     setup->bmRequestType = USB_REQUEST_DIR_IN | USB_REQUEST_CLASS | USB_REQUEST_RECIPIENT_INTERFACE;
     setup->bRequest = CDC_REQUEST_GET_ENCAPSULATED_RESPONSE;
@@ -268,17 +230,9 @@ int usbh_rndis_keepalive(struct usbh_rndis *rndis_class)
     rndis_keepalive_cmplt_t *resp;
     rndis_keepalive_msg_t *cmd_phy;
     rndis_keepalive_cmplt_t *resp_phy;
-    uintptr_t vaddr;
-    uintptr_t paddr;
 
-    //cmd = (rndis_keepalive_msg_t *)g_rndis_buf;
-    ret = naive_mmap(&vaddr, &paddr, sizeof(rndis_keepalive_msg_t), false);
-    if(ret != 0){
-        USB_LOG_ERR("rndis_keepalive_msg_t allocate error, ret: %d\r\n", ret);
-        return -ENOMEM;
-    }
-    cmd = (rndis_keepalive_msg_t *)vaddr;
-    cmd_phy = (rndis_keepalive_msg_t *)paddr;
+    cmd = (rndis_keepalive_msg_t *)g_rndis_keepalive_buf;
+    cmd_phy = (rndis_keepalive_msg_t *)g_rndis_keepalive_buf_phy;
 
     cmd->MessageType = REMOTE_NDIS_KEEPALIVE_MSG;
     cmd->MessageLength = sizeof(rndis_keepalive_msg_t);
@@ -298,14 +252,8 @@ int usbh_rndis_keepalive(struct usbh_rndis *rndis_class)
 
     //ret = usbh_ep_intr_transfer(rndis_class->hport->intin,buf,len,500);
 
-    //resp = (rndis_keepalive_cmplt_t *)g_rndis_buf;
-    ret = naive_mmap(&vaddr, &paddr, 4096, false);
-    if(ret != 0){
-        USB_LOG_ERR("rndis_keepalive_cmplt_t allocate error, ret: %d\r\n", ret);
-        return -ENOMEM;
-    }
-    resp = (rndis_keepalive_cmplt_t *)vaddr;
-    resp_phy = (rndis_keepalive_cmplt_t *)paddr;
+    resp = (rndis_keepalive_cmplt_t *)g_rndis_keepalive_buf;
+    resp_phy = (rndis_keepalive_cmplt_t *)g_rndis_keepalive_buf_phy;
 
     setup->bmRequestType = USB_REQUEST_DIR_IN | USB_REQUEST_CLASS | USB_REQUEST_RECIPIENT_INTERFACE;
     setup->bRequest = CDC_REQUEST_GET_ENCAPSULATED_RESPONSE;
@@ -332,6 +280,7 @@ static int usbh_rndis_connect(struct usbh_hubport *hport, uint8_t intf)
     uint32_t data_len;
     uint8_t tmp_buffer[512];
     uint8_t data[32];
+    uintptr_t vaddr, paddr;
 
     struct usbh_rndis *rndis_class = &g_rndis_class;
 
@@ -341,6 +290,23 @@ static int usbh_rndis_connect(struct usbh_hubport *hport, uint8_t intf)
     rndis_class->ctrl_intf = intf;
     rndis_class->data_intf = intf + 1;
 
+    /* allocate virtual address and physical address*/
+    ret = naive_mmap(&vaddr, &paddr, 4096, false);
+    if(ret != 0){
+        USB_LOG_ERR("g_rndis_buf allocate error, ret: %d\n", ret);
+        return -ENOMEM;
+    }
+    g_rndis_buf = (uint8_t *)vaddr;
+    g_rndis_buf_phy = (uint8_t *)paddr;
+
+    ret = naive_mmap(&vaddr, &paddr, 4096, false);
+    if(ret != 0){
+        USB_LOG_ERR("g_rndis_keepalive_buf allocate error, ret: %d\n", ret);
+        return -ENOMEM;
+    }
+    g_rndis_keepalive_buf = (uint8_t *)vaddr;
+    g_rndis_keepalive_buf_phy = (uint8_t *)paddr;
+
     hport->config.intf[intf].priv = rndis_class;
     hport->config.intf[intf + 1].priv = NULL;