diff --git a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/rndis_host.c b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/rndis_host.c
index a38e6ab23..7b9889d66 100644
--- a/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/rndis_host.c
+++ b/Ubiquitous/XiZi_AIoT/services/drivers/usb/components/class/wireless/rndis_host.c
@@ -13,11 +13,16 @@ Modification: Modify rndis_host.c according to
         https://github.com/cherry-embedded/CherryUSB/blob/v0.10.2/third_party/FreeRTOS-10.4/rndis_host/rndis_host.c
         https://github.com/cherry-embedded/CherryUSB/blob/v0.10.2/third_party/rt-thread-4.1.1/rndis_host/rndis_host_lwip2.1.2.c
         and https://github.com/longtengmcu/USB-HOST-driver-4G-rndis-device/components/drivers/usb/usbhost/class/rndis_dev.c (Zhaoshimin).
+
+2. Date: 2024-07-23
+Author: AIIT XUOS Lab
+Modification: rndis bulk transfer buffer uses physical addresses.
 *************************************************/
 #include <usb_osal.h>
 #include "usbh_core.h"
 #include "usbh_rndis.h"
 #include "rndis_protocol.h"
+#include "usyscall.h"
 
 /* define the rdnis device state*/
 #define RNDIS_BUS_UNINITIALIZED 0
@@ -34,7 +39,8 @@ Modification: Modify rndis_host.c according to
 #define RNDIS_DEV_KEEPALIVE_TIMEOUT 5000
 /*should be the usb Integer multiple of maximum packet length  N*64*/
 #define RNDIS_ETH_BUFFER_LEN      (sizeof(rndis_data_packet_t) + USB_ETH_MTU + 42)
-#define RNDIS_RXETH_BUFFER_LEN    (RNDIS_ETH_BUFFER_LEN * 5)
+/* The maximum number of concatenated REMOTE_NDIS_PACKET_MSG messages in a single bus transfer to it, see MaxPacketsPerTransfer in REMOTE_NDIS_INITIALIZE_CMPLT. */
+#define RNDIS_RXETH_BUFFER_LEN    (RNDIS_ETH_BUFFER_LEN * 1)
 
 #define RT_TRUE                         1               /**< boolean true  */
 #define RT_FALSE                        0               /**< boolean fails */
@@ -42,9 +48,14 @@ Modification: Modify rndis_host.c according to
 /* Static Variable Definition*/
 static struct usbh_rndis *s_rndis_class_ptr;
 
-USB_NOCACHE_RAM_SECTION uint8_t tx_buffer[RNDIS_ETH_BUFFER_LEN];
-USB_NOCACHE_RAM_SECTION uint8_t rx_buffer[RNDIS_RXETH_BUFFER_LEN];
-static uint8_t *rx_buf_ptr;
+//USB_NOCACHE_RAM_SECTION uint8_t tx_buffer[RNDIS_ETH_BUFFER_LEN];
+//USB_NOCACHE_RAM_SECTION uint8_t rx_buffer[RNDIS_RXETH_BUFFER_LEN];
+//static uint8_t *rx_buf_ptr;
+static uint8_t *tx_buffer;
+static uint8_t *tx_buffer_phy;
+static uint8_t *rx_buffer;
+static uint8_t *rx_buffer_phy;
+
 usb_osal_sem_t mutex_sem_handle;
 usb_osal_thread_t timer_handle;
 usb_osal_thread_t data_recv_task_handle;
@@ -78,7 +89,6 @@ static void usbh_rndis_data_recv_entry(void *pdata)
     uint32_t info_len = 0;
 
     struct usbh_rndis *rndis_class = (struct usbh_rndis *)pdata;
-    rx_buf_ptr = rx_buffer;
 
     if (!rndis_class->link_status) {
         printf("linkdown, drop pkg\r\n");
@@ -102,13 +112,13 @@ static void usbh_rndis_data_recv_entry(void *pdata)
 
     while (1) {
         pmg_offset = 0;
-        ret = usbh_rndis_bulk_in_transfer(rndis_class, rx_buf_ptr, RNDIS_RXETH_BUFFER_LEN, USB_OSAL_WAITING_FOREVER);
+        ret = usbh_rndis_bulk_in_transfer(rndis_class, rx_buffer_phy, RNDIS_RXETH_BUFFER_LEN, USB_OSAL_WAITING_FOREVER);
         if (ret <= 0) {
             usb_osal_msleep(1);
             continue;
         }
         while (ret > 0) {
-            pmsg = (rndis_data_packet_t *)(rx_buf_ptr + pmg_offset);
+            pmsg = (rndis_data_packet_t *)(rx_buffer + pmg_offset);
             if (pmsg->MessageType == REMOTE_NDIS_PACKET_MSG) {
                 eth_device_ready((uint8_t *)(&pmsg->DataOffset) + pmsg->DataOffset, pmsg->MessageLength);
                 pmg_offset += pmsg->MessageLength;
@@ -120,8 +130,26 @@ static void usbh_rndis_data_recv_entry(void *pdata)
 
 void usbh_rndis_run(struct usbh_rndis *rndis_class)
 {
+    uintptr_t vaddr, paddr;
+    int ret;
+
     s_rndis_class_ptr = rndis_class;
-    rx_buf_ptr        = rx_buffer;
+
+    ret = naive_mmap(&vaddr, &paddr, RNDIS_ETH_BUFFER_LEN, false);
+    if(ret != 0){
+        USB_LOG_ERR("tx_buf_ptr allocate error, ret: %d\n", ret);
+        return;
+    }
+    tx_buffer = (uint8_t *)vaddr;
+    tx_buffer_phy = (uint8_t *)paddr;
+
+    ret = naive_mmap(&vaddr, &paddr, RNDIS_RXETH_BUFFER_LEN, false);
+    if(ret != 0){
+        USB_LOG_ERR("rx_buf_ptr allocate error, ret: %d\n", ret);
+        return;
+    }
+    rx_buffer = (uint8_t *)vaddr;
+    rx_buffer_phy = (uint8_t *)paddr;
 
     mutex_sem_handle = usb_osal_sem_create(0);
     if (NULL == mutex_sem_handle) {
@@ -195,10 +223,10 @@ int usbh_rndis_eth_tx(void *dataptr, size_t tot_len)
         return 0;
     }
 
-    USB_ASSERT((tot_len + sizeof(rndis_data_packet_t)) < sizeof(tx_buffer));
-    if (tot_len > sizeof(tx_buffer)) {
-        printf("RNDIS MTU is:%d, but the send packet size is %d\r\n", sizeof(tx_buffer), tot_len);
-        tot_len = sizeof(tx_buffer);
+    USB_ASSERT((tot_len + sizeof(rndis_data_packet_t)) < RNDIS_ETH_BUFFER_LEN);
+    if (tot_len > RNDIS_ETH_BUFFER_LEN) {
+        printf("RNDIS MTU is:%d, but the send packet size is %d\r\n", RNDIS_ETH_BUFFER_LEN, tot_len);
+        tot_len = RNDIS_ETH_BUFFER_LEN;
     }
 
     hdr = (rndis_data_packet_t *)tx_buffer;
@@ -216,7 +244,7 @@ int usbh_rndis_eth_tx(void *dataptr, size_t tot_len)
         /* pad a dummy. */
         hdr->MessageLength += 1;
     }
-    return rndis_msg_data_send(s_rndis_class_ptr, (uint8_t *)tx_buffer, hdr->MessageLength);
+    return rndis_msg_data_send(s_rndis_class_ptr, (uint8_t *)tx_buffer_phy, hdr->MessageLength);
 }
 
 int usbh_rndis_eth_control(int cmd, void *args)