diff --git a/Ubiquitous/XiZi_AIoT/kernel_actracer/actracer.h b/Ubiquitous/XiZi_AIoT/kernel_actracer/actracer.h
index 0f4808d44..06f819c6a 100644
--- a/Ubiquitous/XiZi_AIoT/kernel_actracer/actracer.h
+++ b/Ubiquitous/XiZi_AIoT/kernel_actracer/actracer.h
@@ -70,6 +70,6 @@ struct SysTracer {
 void sys_tracer_init();
 TraceTag* const RequireRootTag();
 bool AchieveResourceTag(struct TraceTag* target, struct TraceTag* owner, char* name);
-void* AchieveResource(struct TraceTag* target);
+void* AchieveResource(struct TraceTag* tag);
 bool CreateResourceTag(struct TraceTag* new_tag, struct TraceTag* owner, char* name, tracemeta_ac_type type, void* p_resource);
 bool DeleteResource(struct TraceTag* target, struct TraceTag* owner);
\ No newline at end of file
diff --git a/Ubiquitous/XiZi_AIoT/services/app/Makefile b/Ubiquitous/XiZi_AIoT/services/app/Makefile
index fdc097b9d..b3a6c8c02 100644
--- a/Ubiquitous/XiZi_AIoT/services/app/Makefile
+++ b/Ubiquitous/XiZi_AIoT/services/app/Makefile
@@ -27,9 +27,9 @@ INC_DIR = 	-I$(KERNEL_ROOT)/services/shell/letter-shell \
 			-I$(KERNEL_ROOT)/services/app 
 
 ifeq ($(BOARD), imx6q-sabrelite)
-all: init test_fs simple_client simple_server shell fs_server semaphore_server test_thread test_irq_hdlr test_irq_block test_irq_send eth_driver epit_server readme.txt | bin
+all: init test_fault simple_client simple_server shell fs_server semaphore_server test_thread test_irq_hdlr test_irq_block test_irq_send eth_driver epit_server readme.txt | bin
 else 
-all: init test_fs simple_client simple_server shell fs_server test_irq_hdlr readme.txt | bin
+all: init test_fault simple_client simple_server shell fs_server test_irq_hdlr readme.txt | bin
 endif
 	../tools/mkfs/mkfs ./fs.img $^
 	@mv $(filter-out readme.txt, $^) bin
@@ -77,7 +77,7 @@ init: init.o libfs.o libipc.o session.o libserial.o printf.o usyscall.o arch_usy
 	@${ld} ${user_ldflags} -e main -o $@ $^ ${board_specs}
 	@${objdump} -S $@ > $@.asm
 
-test_fs: test_fs.o libfs.o libipc.o session.o libserial.o printf.o usyscall.o arch_usyscall.o libmem.o
+test_fault: test_fault.o libserial.o printf.o usyscall.o arch_usyscall.o 
 	@${ld} ${user_ldflags} -e main -o $@ $^ ${board_specs}
 	@${objdump} -S $@ > $@.asm
 
diff --git a/Ubiquitous/XiZi_AIoT/services/app/simple_client.c b/Ubiquitous/XiZi_AIoT/services/app/simple_client.c
index 62689573b..2a23acb6a 100755
--- a/Ubiquitous/XiZi_AIoT/services/app/simple_client.c
+++ b/Ubiquitous/XiZi_AIoT/services/app/simple_client.c
@@ -85,7 +85,6 @@ int main(int argc, char** argv)
     if (argc >= 2) {
         id = string_to_integer(argv[1]);
     }
-    // printf("This is Simple Client %d, size is 0x%x\n", id, task_heap_base());
 
     struct Session session_wait;
     struct Session session_nowait;
@@ -94,37 +93,39 @@ int main(int argc, char** argv)
         exit(1);
     }
 
+    // test no wait ipc
     char *buf1 = NULL, *buf2 = NULL;
     struct IpcMsg* msg1 = hello_string_nowait(&session_nowait, &buf1, 32);
     struct IpcMsg* msg2 = hello_string_nowait(&session_nowait, &buf2, 128);
 
-    int ret = add(&session_wait, 17, 22);
+    // test ipc add(wait version)
+    int ret = 0;
+    ret = add(&session_wait, 17, 22);
     printf("ipc_add 17 + 22 = %d\n", ret);
-    char buf[32];
     ret = add(&session_wait, 9, 9);
     printf("ipc_add 9 + 9 = %d\n", ret);
 
-    struct Session session;
+    struct Session fs_session;
     static char id_buf[33] = { 0 };
     if (id > 1) {
-        if (connect_session(&session, "MemFS", 8092) < 0) {
-            printf("connect session failed\n");
+        if (connect_session(&fs_session, "MemFS", 8192) < 0) {
+            printf("connect fs_session failed\n");
         } else {
             int fd;
             itoa(id - 1, id_buf, 10);
             char* shell_task_param[3] = { "/simple_client", id_buf, 0 };
-            if ((fd = open(&session, shell_task_param[0])) >= 0) {
-                if (spawn(&session, fd, read, fsize, shell_task_param[0], shell_task_param) < 0) {
+            if ((fd = open(&fs_session, shell_task_param[0])) >= 0) {
+                if (spawn(&fs_session, fd, read, fsize, shell_task_param[0], shell_task_param) < 0) {
                     printf("Syscall Spawn simple_client failed\n");
                 }
-                if (spawn(&session, fd, read, fsize, shell_task_param[0], shell_task_param) < 0) {
+                if (spawn(&fs_session, fd, read, fsize, shell_task_param[0], shell_task_param) < 0) {
                     printf("Syscall Spawn simple_client failed\n");
                 }
-                close(&session, fd);
+                close(&fs_session, fd);
             } else {
                 printf("Open %s failed\n", shell_task_param[0]);
             }
-            free_session(&session);
+            free_session(&fs_session);
         }
     }
 
diff --git a/Ubiquitous/XiZi_AIoT/services/app/test_priority.c b/Ubiquitous/XiZi_AIoT/services/app/test_fault.c
similarity index 61%
rename from Ubiquitous/XiZi_AIoT/services/app/test_priority.c
rename to Ubiquitous/XiZi_AIoT/services/app/test_fault.c
index cefa2a48e..03d8e4b32 100644
--- a/Ubiquitous/XiZi_AIoT/services/app/test_priority.c
+++ b/Ubiquitous/XiZi_AIoT/services/app/test_fault.c
@@ -10,34 +10,19 @@
  * See the Mulan PSL v2 for more details.
  */
 
-// test_priority: Test the priority scheduler of task
+// test_fs: Test the file io control of fs
 #include <assert.h>
 #include <stdbool.h>
+#include <string.h>
 
 #include "libserial.h"
 #include "usyscall.h"
 
-static void count_down()
-{
-    int time = 500000000;
-    while (time >= 0) {
-        if (time % 10000000 == 0) {
-            printf("Priority-based preempting, time remained %d\n", time);
-        }
-        time--;
-    }
-    return;
-}
-
+#define BLOCK_SIZE 256
 int main(int argc, char* argv[])
 {
-    // set priority
-    sys_state_info info;
-    info.priority = 0;
-    set_priority(&info);
-
-    // test function
-    count_down();
+    printf("Test memry error %s.\n", 0x50000000);
+    printf("After error computing.\n");
 
     exit(0);
     return 0;
diff --git a/Ubiquitous/XiZi_AIoT/services/app/test_fs.c b/Ubiquitous/XiZi_AIoT/services/app/test_fs.c
deleted file mode 100644
index f1400fac7..000000000
--- a/Ubiquitous/XiZi_AIoT/services/app/test_fs.c
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * Copyright (c) 2020 AIIT XUOS Lab
- * XiUOS is licensed under Mulan PSL v2.
- * You can use this software according to the terms and conditions of the Mulan PSL v2.
- * You may obtain a copy of Mulan PSL v2 at:
- *        http://license.coscl.org.cn/MulanPSL2
- * THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
- * EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
- * MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
- * See the Mulan PSL v2 for more details.
- */
-
-// test_fs: Test the file io control of fs
-#include <assert.h>
-#include <stdbool.h>
-#include <string.h>
-
-#include "libfs.h"
-#include "libserial.h"
-#include "usyscall.h"
-
-#define BLOCK_SIZE 256
-int main(int argc, char* argv[])
-{
-    printf("file system test\n");
-
-    struct Session session;
-    connect_session(&session, "MemFS", 4096);
-
-    int fd;
-    char* fd_path = "/readme.txt";
-    fd = open(&session, fd_path);
-    /// @todo support malloc for user
-    char buffer[BLOCK_SIZE] = { 0 };
-    read(&session, fd, buffer, 0, BLOCK_SIZE);
-    printf("file content: %s\n", buffer);
-
-    char* write_data = "hello world\n";
-    write(&session, fd, write_data, 0, strlen(write_data) + 1);
-    memset(buffer, 0, BLOCK_SIZE);
-    read(&session, fd, buffer, 0, BLOCK_SIZE);
-    printf("file content: %s\n", buffer);
-
-    close(&session, fd);
-    free_session(&session);
-
-    printf("file test done.\n");
-    printf("Test memry error %s.\n", 0x50000000);
-    printf("After error computing.\n");
-
-    exit(0);
-    return 0;
-}
diff --git a/Ubiquitous/XiZi_AIoT/services/fs/fs_server/fs.c b/Ubiquitous/XiZi_AIoT/services/fs/fs_server/fs.c
index 964251cbb..d4c2243e2 100644
--- a/Ubiquitous/XiZi_AIoT/services/fs/fs_server/fs.c
+++ b/Ubiquitous/XiZi_AIoT/services/fs/fs_server/fs.c
@@ -119,9 +119,7 @@ struct Inode* InodeCreate(struct Inode* parent_inode, char* name, int type)
 /// @brief Delete a file Inode or a dir Inode
 int InodeDelete(struct Inode* parent_inode, char* name)
 {
-    uint32_t offset;
     struct Inode* inode;
-    struct DirectEntry de;
 
     if ((inode = DirInodeLookup(parent_inode, name)) == 0) {
         printf("Inode delete failed, file not exsit");
diff --git a/Ubiquitous/XiZi_AIoT/services/lib/ipc/libipc.c b/Ubiquitous/XiZi_AIoT/services/lib/ipc/libipc.c
index 1f6680a0c..4428db4f3 100644
--- a/Ubiquitous/XiZi_AIoT/services/lib/ipc/libipc.c
+++ b/Ubiquitous/XiZi_AIoT/services/lib/ipc/libipc.c
@@ -79,12 +79,12 @@ struct IpcMsg* new_ipc_msg(struct Session* session, const int argc, const int* a
 bool ipc_msg_set_nth_arg(struct IpcMsg* msg, const int arg_num, const void* const data, const int len)
 {
     if (arg_num >= msg->header.nr_args) {
-        printf("[%s] IPC: arg_num out of msg range, arg_num: %d, nr_args: %d\n", __func__, arg_num, msg->header.nr_args);
+        printf("[%s] IPC: arg_num out of msg range, arg_num: %d, nr_args: %lu\n", __func__, arg_num, msg->header.nr_args);
         return false;
     }
     struct IpcArgInfo* nth_arg_info = IPCMSG_ARG_INFO(msg, arg_num);
     if (len > nth_arg_info->len) {
-        printf("[%s] IPC: size of arg out of buffer range, given len: %d, len %d\n", __func__, len, nth_arg_info->len);
+        printf("[%s] IPC: size of arg out of buffer range, given len: %d, len %u\n", __func__, len, nth_arg_info->len);
         return false;
     }
     void* buf = ipc_msg_get_nth_arg_buf(msg, arg_num);
@@ -170,12 +170,6 @@ bool is_cur_handler_been_delayed()
     return ipc_server_loop_cur_msg->header.delayed == 1;
 }
 
-bool server_set_cycle_handler(struct IpcNode* ipc_node, void (*handler)())
-{
-    ipc_node->cycle_handler = handler;
-    return true;
-}
-
 void ipc_server_loop(struct IpcNode* ipc_node)
 {
     struct Session session_list[NR_MAX_SESSION];
@@ -204,7 +198,6 @@ void ipc_server_loop(struct IpcNode* ipc_node)
                     interfaces[opcode] should explicitly call delay_session() and return to delay this session
                 */
                 while (ipc_server_loop_cur_msg->header.magic == IPC_MSG_MAGIC && ipc_server_loop_cur_msg->header.valid == 1 && ipc_server_loop_cur_msg->header.done == 0) {
-                    // printf("session %d [%d, %d]\n", session_list[i].id, session_list[i].head, session_list[i].tail);
                     if (session_used_size(&session_list[i]) == 0 && session_forward_tail(&session_list[i], ipc_server_loop_cur_msg->header.len) < 0) {
                         break;
                     }
@@ -219,7 +212,7 @@ void ipc_server_loop(struct IpcNode* ipc_node)
                             break;
                         }
                     } else {
-                        printf("Unsupport opcode(%d) for server: %s\n", ipc_server_loop_cur_msg->header.opcode, ipc_node->name);
+                        printf("Unsupport opcode(%u) for server: %s\n", ipc_server_loop_cur_msg->header.opcode, ipc_node->name);
                     }
                     // current msg is a message that needs to ignore
                     // finish this message in server's perspective
@@ -233,8 +226,5 @@ void ipc_server_loop(struct IpcNode* ipc_node)
                 ipc_server_loop_cur_msg = NULL;
             }
         }
-        if (ipc_node->cycle_handler) {
-            ipc_node->cycle_handler();
-        }
     }
 }
\ No newline at end of file
diff --git a/Ubiquitous/XiZi_AIoT/services/lib/ipc/libipc.h b/Ubiquitous/XiZi_AIoT/services/lib/ipc/libipc.h
index 6a8f83e0e..eaa084aad 100644
--- a/Ubiquitous/XiZi_AIoT/services/lib/ipc/libipc.h
+++ b/Ubiquitous/XiZi_AIoT/services/lib/ipc/libipc.h
@@ -76,7 +76,6 @@ typedef int (*IpcInterface)(struct IpcMsg* msg);
 struct IpcNode {
     char* name;
     IpcInterface interfaces[UINT8_MAX];
-    void (*cycle_handler)();
 } __attribute__((packed));
 
 #define IPC_SERVER_LOOP(ipc_node_name) rpc_server_loop_##rpc_node_name
@@ -243,6 +242,8 @@ bool is_cur_session_delayed(void);
     }
 
 int cur_session_id(void);
-bool server_set_cycle_handler(struct IpcNode* ipc_node, void (*handler)());
+/// @brief delay the session(message, or a inter-process-call)
+///         the delayed call will be handled again later from begining, not from the position where delay_session() is called.
+/// @param
 void delay_session(void);
 bool is_cur_handler_been_delayed();
\ No newline at end of file
diff --git a/Ubiquitous/XiZi_AIoT/services/lib/ipc/session.c b/Ubiquitous/XiZi_AIoT/services/lib/ipc/session.c
index a399dec18..4cdbc143d 100644
--- a/Ubiquitous/XiZi_AIoT/services/lib/ipc/session.c
+++ b/Ubiquitous/XiZi_AIoT/services/lib/ipc/session.c
@@ -49,7 +49,7 @@ void* session_alloc_buf(struct Session* session, int len)
     if (len > session_remain_capacity(session)) {
         return NULL;
     }
-    void* buf = session->buf + session->tail;
+    void* buf = (void*)((uintptr_t)session->buf + session->tail);
     // we mapped double size of page, so it's ok to write buffer directly
     memset(buf, 0, len);
     session_forward_tail(session, len);
diff --git a/Ubiquitous/XiZi_AIoT/services/lib/usyscall/usyscall.c b/Ubiquitous/XiZi_AIoT/services/lib/usyscall/usyscall.c
index 8038de4d6..1e3d2da9b 100644
--- a/Ubiquitous/XiZi_AIoT/services/lib/usyscall/usyscall.c
+++ b/Ubiquitous/XiZi_AIoT/services/lib/usyscall/usyscall.c
@@ -14,14 +14,19 @@
 
 int spawn(struct Session* session, int fd, ipc_read_fn ipc_read, ipc_fsize_fn ipc_fsize, char* name, char** argv)
 {
+    /* read elf image */
     int file_size = ipc_fsize(session, fd);
     void* img = malloc(file_size);
-    int read_len = 0, cur_read_len = 0;
+    int read_len = 0;
     while (read_len < file_size) {
-        cur_read_len = file_size - read_len < 4096 ? file_size - read_len : 4096;
-        read_len += ipc_read(session, fd, img + read_len, read_len, cur_read_len);
+        int cur_read_len = file_size - read_len < 4096 ? file_size - read_len : 4096;
+        if (cur_read_len < 0) {
+            return -1;
+        }
+        read_len += ipc_read(session, fd, (char*)((uintptr_t)img + read_len), read_len, cur_read_len);
     }
-    int ret = syscall(SYSCALL_SPAWN, (intptr_t)img, (intptr_t)name, (intptr_t)argv, 0);
+    /* sys call */
+    int ret = syscall(SYSCALL_SPAWN, (uintptr_t)img, (uintptr_t)name, (uintptr_t)argv, 0);
     free(img);
     return ret;
 }
diff --git a/Ubiquitous/XiZi_AIoT/services/semaphore/semaphore_server.c b/Ubiquitous/XiZi_AIoT/services/semaphore/semaphore_server.c
index 47d6d858c..a540ee0a1 100644
--- a/Ubiquitous/XiZi_AIoT/services/semaphore/semaphore_server.c
+++ b/Ubiquitous/XiZi_AIoT/services/semaphore/semaphore_server.c
@@ -68,7 +68,8 @@ int IPC_DO_SERVE_FUNC(Ipc_sem_wait)(sem_t* sem, int* timeout)
         return SEMAPHORE_SUC;
     }
 
-    // block current session
+    // delay current session
+    // this handler will be invoke again later
     delay_session();
     return SEMAPHORE_ERR;
 }
diff --git a/Ubiquitous/XiZi_AIoT/softkernel/include/pagetable.h b/Ubiquitous/XiZi_AIoT/softkernel/include/pagetable.h
index 54d2a3c01..dec02088d 100644
--- a/Ubiquitous/XiZi_AIoT/softkernel/include/pagetable.h
+++ b/Ubiquitous/XiZi_AIoT/softkernel/include/pagetable.h
@@ -59,8 +59,8 @@ struct PagerRightGroup {
 struct XiziPageManager {
     bool (*new_pgdir)(struct TopLevelPageDirectory* pgdir);
     void (*free_user_pgdir)(struct TopLevelPageDirectory* pgdir);
-    bool (*map_pages)(uintptr_t* pd_addr, uintptr_t vaddr, uintptr_t paddr, uintptr_t len, bool is_dev);
-    bool (*unmap_pages)(uintptr_t* pd_addr, uintptr_t vaddr, uintptr_t len);
+    bool (*map_pages)(uintptr_t* pd_addr, uintptr_t vaddr, uintptr_t paddr, int len, bool is_dev);
+    bool (*unmap_pages)(uintptr_t* pd_addr, uintptr_t vaddr, int len);
 
     uintptr_t (*resize_user_pgdir)(struct TopLevelPageDirectory* pgdir, uintptr_t old_size, uintptr_t new_size);
     uintptr_t (*address_translate)(struct TopLevelPageDirectory* pgdir, uintptr_t vaddr);
diff --git a/Ubiquitous/XiZi_AIoT/softkernel/memory/buddy.c b/Ubiquitous/XiZi_AIoT/softkernel/memory/buddy.c
index 4757838d0..97817851a 100644
--- a/Ubiquitous/XiZi_AIoT/softkernel/memory/buddy.c
+++ b/Ubiquitous/XiZi_AIoT/softkernel/memory/buddy.c
@@ -110,12 +110,11 @@ static void KBuddyPagesFree(struct KBuddy* pbuddy, struct KPage* page)
 {
     struct KPage* buddy = NULL;
     uintptr_t order = (page->order >= MAX_BUDDY_ORDER) ? 0 : page->order;
-    uintptr_t buddy_idx = 0, new_buddy_idx = 0;
     uintptr_t page_idx = page - pbuddy->pages;
 
     for (; order < MAX_BUDDY_ORDER - 1; order++) {
         // find and delete buddy to combine
-        buddy_idx = BUDDY_PAGE_INDEX(page_idx, order);
+        uintptr_t buddy_idx = BUDDY_PAGE_INDEX(page_idx, order);
         if (buddy_idx > pbuddy->n_pages - 1) {
             break;
         }
@@ -128,7 +127,7 @@ static void KBuddyPagesFree(struct KBuddy* pbuddy, struct KPage* page)
         pbuddy->free_list[order].n_free_pages--;
         buddy->order = MAX_BUDDY_ORDER;
         // update page and page_idx after combined
-        new_buddy_idx = COMBINED_PAGE_INDEX(page_idx, order);
+        uintptr_t new_buddy_idx = COMBINED_PAGE_INDEX(page_idx, order);
         page = page + (new_buddy_idx - page_idx);
         page_idx = new_buddy_idx;
     }
diff --git a/Ubiquitous/XiZi_AIoT/softkernel/memory/kalloc.c b/Ubiquitous/XiZi_AIoT/softkernel/memory/kalloc.c
index 7a9e6764d..17d9aeba5 100644
--- a/Ubiquitous/XiZi_AIoT/softkernel/memory/kalloc.c
+++ b/Ubiquitous/XiZi_AIoT/softkernel/memory/kalloc.c
@@ -39,7 +39,7 @@ struct KBuddy user_phy_freemem_buddy;
 extern uintptr_t kernel_data_end[];
 bool module_phymem_init()
 {
-    uintptr_t kern_freemem_start = V2P(&kernel_data_end);
+    uintptr_t kern_freemem_start = V2P(kernel_data_end);
     uintptr_t kern_freemem_end = PHY_USER_FREEMEM_BASE;
     uintptr_t user_freemem_start = PHY_USER_FREEMEM_BASE;
     uintptr_t user_freemem_end = PHY_MEM_STOP;
diff --git a/Ubiquitous/XiZi_AIoT/softkernel/memory/object_allocator.c b/Ubiquitous/XiZi_AIoT/softkernel/memory/object_allocator.c
index 360803c77..b79e52ac6 100644
--- a/Ubiquitous/XiZi_AIoT/softkernel/memory/object_allocator.c
+++ b/Ubiquitous/XiZi_AIoT/softkernel/memory/object_allocator.c
@@ -52,7 +52,7 @@ void slab_init(struct slab_allocator* const allocator, const size_t element_size
     if (allocator == NULL) {
         panic("init a NULL slab_allocator\n");
     }
-    if (element_size <= 0 || element_size > ARENA_SIZE_PER_INCREASE) {
+    if (element_size > ARENA_SIZE_PER_INCREASE) {
         panic("Not supported slab element size\n");
     }
 
diff --git a/Ubiquitous/XiZi_AIoT/softkernel/memory/pagetable.c b/Ubiquitous/XiZi_AIoT/softkernel/memory/pagetable.c
index f5d08dfe5..dd2d4df4c 100644
--- a/Ubiquitous/XiZi_AIoT/softkernel/memory/pagetable.c
+++ b/Ubiquitous/XiZi_AIoT/softkernel/memory/pagetable.c
@@ -51,17 +51,15 @@ static bool _new_pgdir(struct TopLevelPageDirectory* pgdir)
     return true;
 }
 
-static bool _map_pages(uintptr_t* pgdir, uintptr_t vaddr, uintptr_t paddr, uintptr_t len, uintptr_t attr)
+static bool _map_pages(uintptr_t* pgdir, uintptr_t vaddr, uintptr_t paddr, int len, uintptr_t attr)
 {
-    if (len <= 0) {
-        return false;
-    }
+    assert(len >= 0);
     vaddr = ALIGNDOWN(vaddr, LEVEL4_PTE_SIZE);
     paddr = ALIGNDOWN(paddr, LEVEL4_PTE_SIZE);
     uintptr_t vaddr_last = ALIGNDOWN(vaddr + len - 1, LEVEL4_PTE_SIZE);
 
-    uintptr_t* pte;
     while (true) {
+        uintptr_t* pte = NULL;
         if ((pte = _page_walk(pgdir, vaddr, true)) == NULL) {
             ERROR("pte not found for vaddr %x.\n", vaddr);
             return false;
@@ -86,16 +84,14 @@ static bool _map_pages(uintptr_t* pgdir, uintptr_t vaddr, uintptr_t paddr, uintp
     return true;
 }
 
-static bool _unmap_pages(uintptr_t* pgdir, uintptr_t vaddr, uintptr_t len)
+static bool _unmap_pages(uintptr_t* pgdir, uintptr_t vaddr, int len)
 {
-    if (len <= 0) {
-        return false;
-    }
+    assert(len >= 0);
     vaddr = ALIGNDOWN(vaddr, LEVEL4_PTE_SIZE);
     uintptr_t vaddr_last = ALIGNDOWN(vaddr + len - 1, LEVEL4_PTE_SIZE);
 
-    uintptr_t* pte;
     while (true) {
+        uintptr_t* pte = NULL;
         if ((pte = _page_walk(pgdir, vaddr, false)) == NULL) {
             ERROR("pte not found for vaddr %x.\n", vaddr);
             return false;
@@ -126,8 +122,11 @@ static bool _unmap_pages(uintptr_t* pgdir, uintptr_t vaddr, uintptr_t len)
 /// @param len
 /// @param is_dev
 /// @return
-static bool _map_user_pages(uintptr_t* pgdir, uintptr_t vaddr, uintptr_t paddr, uintptr_t len, bool is_dev)
+static bool _map_user_pages(uintptr_t* pgdir, uintptr_t vaddr, uintptr_t paddr, int len, bool is_dev)
 {
+    if (len < 0) {
+        return false;
+    }
 
     if (UNLIKELY(vaddr >= USER_MEM_TOP)) {
         ERROR("mapping kernel space.\n");
diff --git a/Ubiquitous/XiZi_AIoT/softkernel/memory/share_page.c b/Ubiquitous/XiZi_AIoT/softkernel/memory/share_page.c
index db2170b9d..06d4aa622 100644
--- a/Ubiquitous/XiZi_AIoT/softkernel/memory/share_page.c
+++ b/Ubiquitous/XiZi_AIoT/softkernel/memory/share_page.c
@@ -56,8 +56,8 @@ static struct slab_allocator* SessionAllocator()
 /// @return true if mem range is free, false if at least one page inside [vaddr, vaddr + nr_pages * PAGE_SIZE) is mapped
 static inline bool check_pages_unmapped(struct Thread* task, uintptr_t vaddr, int nr_pages)
 {
-    static uintptr_t paddr = UINT32_MAX;
     for (uintptr_t i = 0; i < nr_pages; i++) {
+        uintptr_t paddr = UINT32_MAX;
         if ((paddr = xizi_pager.address_translate(&task->memspace->pgdir, vaddr)) != (uintptr_t)NULL) {
             return false;
         }
diff --git a/Ubiquitous/XiZi_AIoT/softkernel/syscall/sys_register_irq.c b/Ubiquitous/XiZi_AIoT/softkernel/syscall/sys_register_irq.c
index f386df591..38a19bcff 100644
--- a/Ubiquitous/XiZi_AIoT/softkernel/syscall/sys_register_irq.c
+++ b/Ubiquitous/XiZi_AIoT/softkernel/syscall/sys_register_irq.c
@@ -57,7 +57,7 @@ static void send_irq_to_user(int irq_num)
 
         /* get message space and add session tail */
         void* session_kern_vaddr = P2V(xizi_pager.address_translate(&kernel_irq_proxy->memspace->pgdir, (uintptr_t)session->buf));
-        struct IpcMsg* buf = session_kern_vaddr + session->tail;
+        struct IpcMsg* buf = (struct IpcMsg*)((uintptr_t)session_kern_vaddr + session->tail);
 
         /* check if server session is full */
         if (buf->header.magic == IPC_MSG_MAGIC && buf->header.done == 0) {
diff --git a/Ubiquitous/XiZi_AIoT/softkernel/task/memspace.c b/Ubiquitous/XiZi_AIoT/softkernel/task/memspace.c
index 7d27fcad9..2e25ef22e 100644
--- a/Ubiquitous/XiZi_AIoT/softkernel/task/memspace.c
+++ b/Ubiquitous/XiZi_AIoT/softkernel/task/memspace.c
@@ -221,7 +221,7 @@ struct ThreadStackPointer load_user_stack(struct MemSpace* pmemspace, char** arg
     memset(user_stack_init, 0, sizeof(user_stack_init));
     uintptr_t argc = 0;
     uintptr_t copy_len = 0;
-    for (argc = 0; argv != NULL && argc < MAX_SUPPORT_PARAMS && argv[argc] != NULL; argc++) {
+    for (argc = 0; argv != NULL && argc < (MAX_SUPPORT_PARAMS - 1) && argv[argc] != NULL; argc++) {
         /// @todo handle with large number of parameters (more than 32)
         // copy param to user stack
         copy_len = strlen(argv[argc]) + 1;
diff --git a/Ubiquitous/XiZi_AIoT/softkernel/task/task.c b/Ubiquitous/XiZi_AIoT/softkernel/task/task.c
index 6fe34d7c2..55cb2d2c6 100644
--- a/Ubiquitous/XiZi_AIoT/softkernel/task/task.c
+++ b/Ubiquitous/XiZi_AIoT/softkernel/task/task.c
@@ -99,7 +99,7 @@ static struct Thread* _alloc_task_cb()
     return task;
 }
 
-int _task_retrieve_sys_resources(struct Thread* ptask)
+int _task_return_sys_resources(struct Thread* ptask)
 {
     assert(ptask != NULL);
 
@@ -152,7 +152,7 @@ static void _dealloc_task_cb(struct Thread* task)
         return;
     }
 
-    _task_retrieve_sys_resources(task);
+    _task_return_sys_resources(task);
 
     /* free thread's user stack */
     if (task->thread_context.user_stack_idx != -1) {