diff --git a/Cargo.lock b/Cargo.lock
index c82c7ac7f9..a882b41b79 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -567,7 +567,7 @@ dependencies = [
  "nb",
  "num-align",
  "smccc",
- "spin",
+ "spin 0.12.0",
  "thiserror 2.0.18",
  "tock-registers 0.10.1",
 ]
@@ -585,7 +585,7 @@ dependencies = [
  "axvisor_api",
  "log",
  "numeric-enum-macro",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -602,7 +602,7 @@ dependencies = [
  "axvisor_api",
  "bitmaps",
  "log",
- "spin",
+ "spin 0.12.0",
  "tock-registers 0.10.1",
 ]
 
@@ -664,9 +664,9 @@ checksum = "1505bd5d3d116872e7271a6d4e16d81d0c8570876c8de68093a09ac269d8aac0"
 
 [[package]]
 name = "autocfg"
-version = "1.5.0"
+version = "1.5.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c08606f8c3cbf4ce6ec8e28fb0014a2c086708fe954eaa885384a6165172e7e8"
+checksum = "f2032f911046de80f0a198e0901378627c33f59ea0ac00e363d481118bd70a53"
 
 [[package]]
 name = "aws-lc-rs"
@@ -901,15 +901,17 @@ dependencies = [
  "rdrive",
  "rdrive-macros",
  "realtek-rtl8125",
+ "riscv_goldfish",
  "rk3588-pci",
  "rockchip-npu",
  "rockchip-pm",
  "rockchip-soc",
  "sdhci-host",
  "sdmmc-protocol",
+ "sg200x-bsp",
  "simple-ahci",
  "some-serial",
- "spin",
+ "spin 0.12.0",
  "virtio-drivers",
 ]
 
@@ -960,7 +962,7 @@ dependencies = [
  "axfatfs",
  "log",
  "rsext4",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -969,7 +971,7 @@ version = "0.3.11"
 dependencies = [
  "ax-fs-vfs",
  "log",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -995,7 +997,7 @@ dependencies = [
  "rsext4",
  "scope-local",
  "slab",
- "spin",
+ "spin 0.12.0",
  "starry-fatfs",
 ]
 
@@ -1005,7 +1007,7 @@ version = "0.3.12"
 dependencies = [
  "ax-fs-vfs",
  "log",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1036,16 +1038,16 @@ dependencies = [
  "ax-plat-loongarch64-qemu-virt",
  "ax-plat-riscv64-qemu-virt",
  "ax-plat-riscv64-sg2002",
+ "ax-plat-riscv64-visionfive2",
  "ax-plat-x86-pc",
+ "ax-plat-x86-qemu-q35",
  "axplat-dyn",
- "axplat-riscv64-visionfive2",
- "axplat-x86-qemu-q35",
  "cfg-if",
  "fdt-parser",
  "heapless 0.9.3",
  "log",
  "rdrive",
- "spin",
+ "spin 0.12.0",
  "toml 1.1.2+spec-1.1.0",
 ]
 
@@ -1231,7 +1233,7 @@ dependencies = [
  "cfg-if",
  "log",
  "smoltcp 0.13.1",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1260,7 +1262,7 @@ dependencies = [
  "rdif-vsock",
  "ringbuf",
  "smoltcp 0.13.1",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1295,7 +1297,7 @@ dependencies = [
  "ax-kernel-guard",
  "ax-percpu-macros",
  "cfg-if",
- "spin",
+ "spin 0.12.0",
  "x86",
 ]
 
@@ -1352,7 +1354,7 @@ dependencies = [
  "ax-plat",
  "log",
  "some-serial",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1462,7 +1464,25 @@ dependencies = [
  "sbi-rt 0.0.3",
  "sg200x-bsp",
  "some-serial",
- "spin",
+ "spin 0.12.0",
+]
+
+[[package]]
+name = "ax-plat-riscv64-visionfive2"
+version = "0.1.4"
+dependencies = [
+ "ax-config-macros",
+ "ax-cpu",
+ "ax-kspin",
+ "ax-lazyinit",
+ "ax-plat",
+ "ax-riscv-plic",
+ "log",
+ "rdrive",
+ "riscv 0.14.0",
+ "riscv_goldfish",
+ "sbi-rt 0.0.3",
+ "uart_16550 0.4.0",
 ]
 
 [[package]]
@@ -1490,6 +1510,31 @@ dependencies = [
  "x86_rtc",
 ]
 
+[[package]]
+name = "ax-plat-x86-qemu-q35"
+version = "0.4.8"
+dependencies = [
+ "ax-config-macros",
+ "ax-cpu",
+ "ax-driver",
+ "ax-int-ratio",
+ "ax-kspin",
+ "ax-lazyinit",
+ "ax-percpu",
+ "ax-plat",
+ "axklib",
+ "bitflags 2.11.1",
+ "heapless 0.9.3",
+ "log",
+ "multiboot",
+ "raw-cpuid 11.6.0",
+ "uart_16550 0.4.0",
+ "x2apic",
+ "x86",
+ "x86_64",
+ "x86_rtc",
+]
+
 [[package]]
 name = "ax-posix-api"
 version = "0.5.16"
@@ -1509,7 +1554,7 @@ dependencies = [
  "bindgen 0.72.1",
  "flatten_objects",
  "scope-local",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1553,7 +1598,7 @@ dependencies = [
  "rd-block",
  "rd-net",
  "rdrive",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1583,7 +1628,7 @@ dependencies = [
  "ax-kspin",
  "ax-lazyinit",
  "lock_api",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1622,7 +1667,7 @@ dependencies = [
  "extern-trait",
  "futures-util",
  "log",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1670,7 +1715,7 @@ dependencies = [
  "gimli 0.33.0",
  "log",
  "paste",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1829,50 +1874,7 @@ dependencies = [
  "log",
  "rdrive",
  "somehal",
- "spin",
-]
-
-[[package]]
-name = "axplat-riscv64-visionfive2"
-version = "0.1.4"
-dependencies = [
- "ax-config-macros",
- "ax-cpu",
- "ax-kspin",
- "ax-lazyinit",
- "ax-plat",
- "ax-riscv-plic",
- "log",
- "rdrive",
- "riscv 0.14.0",
- "riscv_goldfish",
- "sbi-rt 0.0.3",
- "uart_16550 0.4.0",
-]
-
-[[package]]
-name = "axplat-x86-qemu-q35"
-version = "0.4.8"
-dependencies = [
- "ax-config-macros",
- "ax-cpu",
- "ax-driver",
- "ax-int-ratio",
- "ax-kspin",
- "ax-lazyinit",
- "ax-percpu",
- "ax-plat",
- "axklib",
- "bitflags 2.11.1",
- "heapless 0.9.3",
- "log",
- "multiboot",
- "raw-cpuid 11.6.0",
- "uart_16550 0.4.0",
- "x2apic",
- "x86",
- "x86_64",
- "x86_rtc",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -1883,7 +1885,7 @@ dependencies = [
  "bitflags 2.11.1",
  "futures",
  "linux-raw-sys 0.12.1",
- "spin",
+ "spin 0.12.0",
  "tokio",
 ]
 
@@ -1971,7 +1973,7 @@ dependencies = [
  "ax-page-table-multiarch",
  "ax-percpu",
  "ax-plat-loongarch64-qemu-virt",
- "ax-plat-riscv64-qemu-virt",
+ "ax-plat-x86-qemu-q35",
  "ax-std",
  "ax-timer-list",
  "axaddrspace",
@@ -1981,7 +1983,6 @@ dependencies = [
  "axhvc",
  "axklib",
  "axplat-dyn",
- "axplat-x86-qemu-q35",
  "axvcpu",
  "axvisor_api",
  "axvm",
@@ -2000,7 +2001,7 @@ dependencies = [
  "rdrive",
  "riscv_vcpu",
  "riscv_vplic",
- "spin",
+ "spin 0.12.0",
  "syn 2.0.117",
  "tokio",
  "toml 0.9.12+spec-1.1.0",
@@ -2050,7 +2051,7 @@ dependencies = [
  "log",
  "loongarch_vcpu",
  "riscv_vcpu",
- "spin",
+ "spin 0.12.0",
  "x86_vcpu",
 ]
 
@@ -2308,7 +2309,7 @@ dependencies = [
  "divan",
  "log",
  "rand 0.10.1",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -2323,14 +2324,14 @@ version = "0.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "b672b945a3e4f4f40bfd4cd5ee07df9e796a42254ce7cd6d2599ad969244c44a"
 dependencies = [
- "spin",
+ "spin 0.10.0",
 ]
 
 [[package]]
 name = "bumpalo"
-version = "3.20.2"
+version = "3.20.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5d20789868f4b01b2f2caec9f5c4e0213b41e3e5702a50157d699ae31ced2fcb"
+checksum = "72f5acc6cb2ba439de613abc23857ec3d78374d8ed5ac84e9d11336e87da8649"
 
 [[package]]
 name = "bwbench-client"
@@ -2643,9 +2644,9 @@ dependencies = [
 
 [[package]]
 name = "compact_str"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3b79c4069c6cad78e2e0cdfcbd26275770669fb39fd308a752dc110e83b9af32"
+checksum = "7fd622ebbb56a5b2ccb651b32b911cdeb2a9b4b11776b2473bf26a26a286244e"
 dependencies = [
  "castaway",
  "cfg-if",
@@ -2657,9 +2658,9 @@ dependencies = [
 
 [[package]]
 name = "compact_str"
-version = "0.9.0"
+version = "0.9.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3fdb1325a1cece981e8a296ab8f0f9b63ae357bd0784a9faaf548cc7b480707a"
+checksum = "9dfdd1c2274d9aa354115b09dc9a901d6c5576818cdf70d14cae2bdb47df00ab"
 dependencies = [
  "castaway",
  "cfg-if",
@@ -2823,7 +2824,7 @@ dependencies = [
  "mbarrier",
  "nb",
  "num_enum",
- "spin",
+ "spin 0.12.0",
  "thiserror 2.0.18",
  "tock-registers 0.10.1",
  "trait-ffi",
@@ -3037,9 +3038,9 @@ dependencies = [
 
 [[package]]
 name = "crypto-common"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "77727bb15fa921304124b128af125e7e3b968275d1b108b379190264f4423710"
+checksum = "ce6e4c961d6cd6c9a86db418387425e8bdeaf05b3c8bc1411e6dca4c252f1453"
 dependencies = [
  "hybrid-array",
 ]
@@ -3121,7 +3122,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "321ec774d27fafc66e812034d0025f8858bd7d9095304ff8fc200e0b9f9cc257"
 dependencies = [
  "ahash 0.8.12",
- "compact_str 0.8.1",
+ "compact_str 0.8.2",
  "crossbeam-channel",
  "cursive-macros",
  "enum-map",
@@ -3381,14 +3382,14 @@ checksum = "f1dd6dbb5841937940781866fa1281a1ff7bd3bf827091440879f9994983d5c2"
 dependencies = [
  "block-buffer 0.12.0",
  "const-oid",
- "crypto-common 0.2.1",
+ "crypto-common 0.2.2",
 ]
 
 [[package]]
 name = "displaydoc"
-version = "0.2.5"
+version = "0.2.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "97369cbbc041bc366949bc74d34658d6cda5621039731c6310521892a3a20ae0"
+checksum = "1ac70aa55017e108007fbaf5aa0f54b021c98f92ff8af59d42eda9da96e3dd4f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3505,9 +3506,9 @@ checksum = "d0881ea181b1df73ff77ffaaf9c7544ecc11e82fba9b5f27b262a3c73a332555"
 
 [[package]]
 name = "either"
-version = "1.15.0"
+version = "1.16.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "48c757948c5ede0e46177b7add2e67155f70e33c07fea8284df6576da70b3719"
+checksum = "91622ff5e7162018101f2fea40d6ebf4a78bbe5a49736a2020649edf9693679e"
 
 [[package]]
 name = "embedded-graphics"
@@ -3629,9 +3630,9 @@ dependencies = [
 
 [[package]]
 name = "enumset"
-version = "1.1.12"
+version = "1.1.13"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f96a4a12fe60ac746ae295a1a4ecb5bb02debc20856506c8635288065f142de"
+checksum = "839c4174b41e75c8f7306110b2c51996a293b8d1d850edd529011841d9fede7d"
 dependencies = [
  "enumset_derive",
 ]
@@ -3884,9 +3885,9 @@ checksum = "9844ddc3a6e533d62bba727eb6c28b5d360921d5175e9ff0f1e621a5c590a4d5"
 
 [[package]]
 name = "fitimage"
-version = "0.1.3"
+version = "0.1.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8cb4d07a1e7a76a7ac4b6b754d45670b1a82c8a0484d80cceeb30c99ad65ce1d"
+checksum = "92edd7c1c55efd27b5a17dd6d505affafcfe48dfaed7423d4c4ae7361e56a7d8"
 dependencies = [
  "anyhow",
  "byteorder",
@@ -4063,9 +4064,9 @@ checksum = "037711b3d59c33004d3856fbdc83b99d4ff37a24768fa1be9ce3538a1cde4393"
 
 [[package]]
 name = "futures-timer"
-version = "3.0.3"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f288b0a4f20f9a56b5d1da57e2227c661b7b16168e2f72365f57b63326e29b24"
+checksum = "af43fadb8a98512d547e37b4e92e0ced13e205c061b87b4623eff01d918d6968"
 
 [[package]]
 name = "futures-util"
@@ -4181,9 +4182,9 @@ checksum = "0cc23270f6e1808e30a928bdc84dea0b9b4136a8bc82338574f23baf47bbd280"
 
 [[package]]
 name = "goblin"
-version = "0.10.5"
+version = "0.10.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "983a6aafb3b12d4c41ea78d39e189af4298ce747353945ff5105b54a056e5cd9"
+checksum = "0d494b2004fbc8cf419a6d2115488df4e11140f6f4abd877519de1bbd90c5370"
 dependencies = [
  "log",
  "plain",
@@ -4311,18 +4312,6 @@ version = "0.5.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
 
-[[package]]
-name = "hello-kernel"
-version = "0.3.1"
-dependencies = [
- "ax-plat",
- "ax-plat-aarch64-qemu-virt",
- "ax-plat-loongarch64-qemu-virt",
- "ax-plat-riscv64-qemu-virt",
- "ax-plat-x86-pc",
- "cfg-if",
-]
-
 [[package]]
 name = "hermit-abi"
 version = "0.5.2"
@@ -4337,9 +4326,9 @@ checksum = "7f24254aa9a54b5c858eaee2f5bccdb46aaf0e486a595ed5fd8f86ba55232a70"
 
 [[package]]
 name = "http"
-version = "1.4.0"
+version = "1.4.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e3ba2a386d7f85a81f119ad7498ebe444d2e22c2af0b86b069416ace48b3311a"
+checksum = "8be7462df143984c4598a256ef469b251d7d7f9e271135073e78fc535414f3d0"
 dependencies = [
  "bytes",
  "itoa",
@@ -4734,20 +4723,6 @@ version = "2.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d98f6fed1fde3f8c21bc40a1abb88dd75e67924f9cffc3ef95607bad8017f8e2"
 
-[[package]]
-name = "irq-kernel"
-version = "0.3.1"
-dependencies = [
- "ax-config-macros",
- "ax-cpu",
- "ax-plat",
- "ax-plat-aarch64-qemu-virt",
- "ax-plat-loongarch64-qemu-virt",
- "ax-plat-riscv64-qemu-virt",
- "ax-plat-x86-pc",
- "cfg-if",
-]
-
 [[package]]
 name = "is-terminal"
 version = "0.4.17"
@@ -4813,9 +4788,9 @@ dependencies = [
 
 [[package]]
 name = "jiff"
-version = "0.2.24"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f00b5dbd620d61dfdcb6007c9c1f6054ebd75319f163d886a9055cec1155073d"
+checksum = "392c70591e8749fe235ddaf513e6f58b26bce3dcc16524cecc8936f75afa161e"
 dependencies = [
  "jiff-static",
  "log",
@@ -4826,9 +4801,9 @@ dependencies = [
 
 [[package]]
 name = "jiff-static"
-version = "0.2.24"
+version = "0.2.27"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e000de030ff8022ea1da3f466fbb0f3a809f5e51ed31f6dd931c35181ad8e6d7"
+checksum = "47b605b0c050d845fc355bb11eb3f9a8deddc218ea60c76e61aa1f2adfb2c96a"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -4860,9 +4835,9 @@ dependencies = [
 
 [[package]]
 name = "jkconfig"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d8746ebf553e6e9d0620a918072432b44aa9563f6f19d17432b613828df708a1"
+checksum = "d4cbaedffb63dabcbab61e23e0adc1fc7bc0d7420f2f56124e2bc0002d9274ab"
 dependencies = [
  "anyhow",
  "cargo_metadata",
@@ -4948,9 +4923,9 @@ dependencies = [
 
 [[package]]
 name = "js-sys"
-version = "0.3.98"
+version = "0.3.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "67df7112613f8bfd9150013a0314e196f4800d3201ae742489d999db2f979f08"
+checksum = "142bc4740e452c1e57ade0cbc129f139c9093e354346f0872ef985f4f5cf5f11"
 dependencies = [
  "cfg-if",
  "futures-util",
@@ -5077,6 +5052,12 @@ dependencies = [
  "yaxpeax-x86",
 ]
 
+[[package]]
+name = "ksym"
+version = "0.6.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b543b77d8cfa33302b6b51b6a255f9e85b06997b7c4a0a7354fcc8304036eb09"
+
 [[package]]
 name = "ktest-helper"
 version = "0.1.1"
@@ -5254,9 +5235,9 @@ dependencies = [
 
 [[package]]
 name = "log"
-version = "0.4.29"
+version = "0.4.30"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5e5032e24019045c762d3c0f28f5b6b8bbf38563a65908389bf7978758920897"
+checksum = "616ec5685824bcc94416c6d4a7a446eea774a31efd7062c8480ba6fd06d7a6e5"
 
 [[package]]
 name = "loongArch64"
@@ -5393,9 +5374,9 @@ checksum = "ae960838283323069879657ca3de837e9f7bbb4c7bf6ea7f1b290d5e9476d2e0"
 
 [[package]]
 name = "memchr"
-version = "2.8.0"
+version = "2.8.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f8ca58f447f06ed17d5fc4043ce1b10dd205e060fb3ce5b979b8ed8e59ff3f79"
+checksum = "6b947ae49db0d222b1dbc6b113ce7248a3fc3a6ca21b696717bfc000ba4484d8"
 
 [[package]]
 name = "memmap2"
@@ -5606,9 +5587,9 @@ dependencies = [
 
 [[package]]
 name = "num-conv"
-version = "0.2.1"
+version = "0.2.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c6673768db2d862beb9b39a78fdcb1a69439615d5794a1be50caa9bc92c81967"
+checksum = "521739c6d2bac4aa25192232afe6841231376b2b26d4d9fae5ecf8ca5772e441"
 
 [[package]]
 name = "num-derive"
@@ -5728,7 +5709,7 @@ dependencies = [
  "mmio-api",
  "pcie",
  "rd-block",
- "spin",
+ "spin 0.12.0",
  "tock-registers 0.10.1",
 ]
 
@@ -5800,9 +5781,9 @@ dependencies = [
 
 [[package]]
 name = "ostool"
-version = "0.19.0"
+version = "0.21.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f785cb91e2622849c3f0e55d5363989934d365967c06f0a8ce8fd944f3b834ba"
+checksum = "c4d0470fd8561e21f458d865490c928ebff45c0e1037a45f634a527acb8f15ff"
 dependencies = [
  "anyhow",
  "async-trait",
@@ -5816,7 +5797,7 @@ dependencies = [
  "fitimage",
  "futures",
  "indicatif",
- "jkconfig 0.2.3",
+ "jkconfig 0.2.4",
  "log",
  "lzma-rs",
  "network-interface",
@@ -6395,7 +6376,7 @@ dependencies = [
  "dma-api",
  "rd-block",
  "rdif-block",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -6503,7 +6484,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "5ef8dea09a92caaf73bff7adb70b76162e5937524058a7e5bff37869cbbec293"
 dependencies = [
  "bitflags 2.11.1",
- "compact_str 0.9.0",
+ "compact_str 0.9.1",
  "hashbrown 0.16.1",
  "indoc",
  "itertools 0.14.0",
@@ -6721,7 +6702,7 @@ dependencies = [
  "futures",
  "heapless 0.9.3",
  "rdif-base",
- "spin",
+ "spin 0.12.0",
  "thiserror 2.0.18",
 ]
 
@@ -6762,7 +6743,7 @@ dependencies = [
  "rdif-intc",
  "rdif-pcie",
  "rdrive-macros",
- "spin",
+ "spin 0.12.0",
  "thiserror 2.0.18",
 ]
 
@@ -6783,7 +6764,7 @@ dependencies = [
  "log",
  "mmio-api",
  "rdif-eth",
- "spin",
+ "spin 0.12.0",
  "thiserror 2.0.18",
  "tock-registers 0.10.1",
 ]
@@ -6863,9 +6844,9 @@ dependencies = [
 
 [[package]]
 name = "reqwest"
-version = "0.13.3"
+version = "0.13.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "62e0021ea2c22aed41653bc7e1419abb2c97e038ff2c33d0e1309e49a97deec0"
+checksum = "219c5811de6525e5416c7d5d53bb656d3afdbc6c5af816e0802bcfa42dbdc1c3"
 dependencies = [
  "base64 0.22.1",
  "bytes",
@@ -6950,6 +6931,19 @@ dependencies = [
  "riscv-pac",
 ]
 
+[[package]]
+name = "riscv"
+version = "0.15.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "b05cfa3f7b30c84536a9025150d44d26b8e1cc20ddf436448d74cd9591eefb25"
+dependencies = [
+ "critical-section",
+ "embedded-hal",
+ "paste",
+ "riscv-macros 0.3.0",
+ "riscv-pac",
+]
+
 [[package]]
 name = "riscv"
 version = "0.16.0"
@@ -6991,6 +6985,17 @@ dependencies = [
  "syn 2.0.117",
 ]
 
+[[package]]
+name = "riscv-macros"
+version = "0.3.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7d323d13972c1b104aa036bc692cd08b822c8bbf23d79a27c526095856499799"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.117",
+]
+
 [[package]]
 name = "riscv-macros"
 version = "0.4.0"
@@ -7122,7 +7127,7 @@ dependencies = [
  "mbarrier",
  "num-align",
  "rdif-base",
- "spin",
+ "spin 0.12.0",
  "thiserror 2.0.18",
  "tock-registers 0.10.1",
 ]
@@ -7149,7 +7154,7 @@ dependencies = [
  "log",
  "mbarrier",
  "num-align",
- "spin",
+ "spin 0.12.0",
  "thiserror 2.0.18",
  "tock-registers 0.10.1",
 ]
@@ -7160,7 +7165,7 @@ version = "0.4.1"
 dependencies = [
  "bitflags 2.11.1",
  "log",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -7448,7 +7453,7 @@ version = "0.3.7"
 dependencies = [
  "ax-percpu",
  "ctor 0.6.3",
- "spin",
+ "spin 0.12.0",
 ]
 
 [[package]]
@@ -7579,9 +7584,9 @@ dependencies = [
 
 [[package]]
 name = "serde_json"
-version = "1.0.149"
+version = "1.0.150"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "83fc039473c5595ace860d8c4fafa220ff474b3fc6bfdb4293327f1a37e94d86"
+checksum = "e8014e44b4736ed0538adeecded0fce2a272f22dc9578a7eb6b2d9993c74cfb9"
 dependencies = [
  "itoa",
  "memchr",
@@ -7855,23 +7860,6 @@ dependencies = [
  "managed",
 ]
 
-[[package]]
-name = "smp-kernel"
-version = "0.3.1"
-dependencies = [
- "ax-config-macros",
- "ax-cpu",
- "ax-memory-addr",
- "ax-percpu",
- "ax-plat",
- "ax-plat-aarch64-qemu-virt",
- "ax-plat-loongarch64-qemu-virt",
- "ax-plat-riscv64-qemu-virt",
- "ax-plat-x86-pc",
- "cfg-if",
- "const-str",
-]
-
 [[package]]
 name = "socket2"
 version = "0.6.3"
@@ -7935,7 +7923,7 @@ dependencies = [
  "smccc",
  "some-serial",
  "somehal-macros",
- "spin",
+ "spin 0.12.0",
  "syn 2.0.117",
  "thiserror 2.0.18",
  "tock-registers 0.10.1",
@@ -7951,15 +7939,18 @@ dependencies = [
  "aarch64-cpu 11.2.0",
  "anyhow",
  "arm-gic-driver",
+ "ax-riscv-plic",
  "kernutil",
  "log",
  "mmio-api",
  "page-table-generic",
  "rdif-intc",
  "rdrive",
+ "riscv 0.15.0",
+ "sbi-rt 0.0.3",
  "someboot",
  "somehal-macros",
- "spin",
+ "spin 0.12.0",
  "thiserror 2.0.18",
  "tock-registers 0.10.1",
 ]
@@ -7979,6 +7970,12 @@ name = "spin"
 version = "0.10.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d5fe4ccb98d9c292d56fec89a5e07da7fc4cf0dc11e156b41793132775d3e591"
+
+[[package]]
+name = "spin"
+version = "0.12.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1527984ca054dfca79333baec451042863f485fbee01b7bf6d911de915cac865"
 dependencies = [
  "lock_api",
 ]
@@ -8077,6 +8074,7 @@ dependencies = [
  "kernel-elf-parser",
  "kmod-loader",
  "kprobe",
+ "ksym",
  "ktracepoint",
  "linux-raw-sys 0.12.1",
  "lock_api",
@@ -8091,7 +8089,7 @@ dependencies = [
  "sg200x-bsp",
  "slab",
  "some-serial",
- "spin",
+ "spin 0.12.0",
  "starry-process",
  "starry-signal",
  "starry-vm",
@@ -8326,9 +8324,9 @@ checksum = "55937e1799185b12863d447f42597ed69d9928686b8d88a1df17376a097d8369"
 
 [[package]]
 name = "tar"
-version = "0.4.45"
+version = "0.4.46"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "22692a6476a21fa75fdfc11d452fda482af402c008cdbaf3476414e122040973"
+checksum = "3f6221d9a6003c78398e3b239969f352578258df48c8eb051caadae0015bc840"
 dependencies = [
  "filetime",
  "libc",
@@ -9086,9 +9084,9 @@ dependencies = [
 
 [[package]]
 name = "uboot-shell"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c3b3d5d2959cc2e9a28cb2c4ad30f99a33f6831f4f159b08c696604b9494b672"
+checksum = "2237321472e37a34980340e0a6f8ba406167fb010209ead2f0e594bdfb718e02"
 dependencies = [
  "colored",
  "futures",
@@ -9286,7 +9284,7 @@ dependencies = [
  "futures",
  "log",
  "num_enum",
- "spin",
+ "spin 0.12.0",
  "thiserror 2.0.18",
 ]
 
@@ -9499,9 +9497,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen"
-version = "0.2.121"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "49ace1d07c165b0864824eee619580c4689389afa9dc9ed3a4c75040d82e6790"
+checksum = "3ed04576f974d2b2fba0f38c51dbc5518011e38c36bf1143164be765528fd409"
 dependencies = [
  "cfg-if",
  "once_cell",
@@ -9512,9 +9510,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-futures"
-version = "0.4.71"
+version = "0.4.72"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "96492d0d3ffba25305a7dc88720d250b1401d7edca02cc3bcd50633b424673b8"
+checksum = "9473dbd2991ae90b6291c3c32c30c6187ac49aa32f9905d1cce280ec1e110b0f"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -9522,9 +9520,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro"
-version = "0.2.121"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "8e68e6f4afd367a562002c05637acb8578ff2dea1943df76afb9e83d177c8578"
+checksum = "916151b09da36bd82f6615cbf3a419e2f0ba23a03c6160e8e92eb6bd4aa1dec6"
 dependencies = [
  "quote",
  "wasm-bindgen-macro-support",
@@ -9532,9 +9530,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-macro-support"
-version = "0.2.121"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d95a9ec35c64b2a7cb35d3fead40c4238d0940c86d107136999567a4703259f2"
+checksum = "299047362ccbfce148b67ab7e73349f77748e00c8296f9542adfad2ad82c5c5e"
 dependencies = [
  "bumpalo",
  "proc-macro2",
@@ -9545,9 +9543,9 @@ dependencies = [
 
 [[package]]
 name = "wasm-bindgen-shared"
-version = "0.2.121"
+version = "0.2.122"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c4e0100b01e9f0d03189a92b96772a1fb998639d981193d7dbab487302513441"
+checksum = "9a929b2c61f11ba3e9bc35b50c1f25cb38e0e892c0c231ae2b8cf78d5dad4437"
 dependencies = [
  "unicode-ident",
 ]
@@ -9607,9 +9605,9 @@ checksum = "dba9c05687e501b2710833fbe2cc7ff8cc24411fb0d81967498ca44598942f88"
 
 [[package]]
 name = "web-sys"
-version = "0.3.98"
+version = "0.3.99"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4b572dff8bcf38bad0fa19729c89bb5748b2b9b1d8be70cf90df697e3a8f32aa"
+checksum = "6d621441cfc37b84979402712047321980c178f299193a3589d05b99e8763436"
 dependencies = [
  "js-sys",
  "wasm-bindgen",
@@ -10318,9 +10316,9 @@ dependencies = [
 
 [[package]]
 name = "yaxpeax-x86"
-version = "2.0.0"
+version = "2.1.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9a9a30b7dd533c7b1a73eaf7c4ea162a7a632a2bb29b9fff47d8f2cc8513a883"
+checksum = "a159e15f66ce40b5dfc28213366f8ff42ff8f0508e2e72e431c62573f025ac5e"
 dependencies = [
  "cfg-if",
  "num-traits",
diff --git a/apps/starry/orangepi-5-plus-uvc-rknn/build-aarch64-unknown-none-softfloat.toml b/apps/starry/orangepi-5-plus-uvc-rknn/build-aarch64-unknown-none-softfloat.toml
index f9a746df72..97f221b4a9 100644
--- a/apps/starry/orangepi-5-plus-uvc-rknn/build-aarch64-unknown-none-softfloat.toml
+++ b/apps/starry/orangepi-5-plus-uvc-rknn/build-aarch64-unknown-none-softfloat.toml
@@ -2,10 +2,8 @@
 target = "aarch64-unknown-none-softfloat"
 env = {}
 features = [
-  "ax-hal/plat-dyn",
-  "starry-kernel/plat-dyn",
   "ax-driver/irq",
-  "ax-driver/pci-list-devices",
+  "ax-driver/list-pci-devices",
   "ax-driver/rk3588-pcie",
   "ax-driver/realtek-rtl8125",
   "ax-driver/rockchip-soc",
diff --git a/apps/starry/orangepi-5-plus-uvc/build-aarch64-unknown-none-softfloat.toml b/apps/starry/orangepi-5-plus-uvc/build-aarch64-unknown-none-softfloat.toml
index a931ef284e..ef3f84f4a4 100644
--- a/apps/starry/orangepi-5-plus-uvc/build-aarch64-unknown-none-softfloat.toml
+++ b/apps/starry/orangepi-5-plus-uvc/build-aarch64-unknown-none-softfloat.toml
@@ -2,8 +2,6 @@
 target = "aarch64-unknown-none-softfloat"
 env = {}
 features = [
-  "ax-hal/plat-dyn",
-  "starry-kernel/plat-dyn",
   "ax-driver/rockchip-soc",
   "ax-driver/rockchip-dwc-xhci",
   "ax-driver/rockchip-sdhci",
diff --git a/components/axcpu/src/exception_table.rs b/components/axcpu/src/exception_table.rs
index cfa5bbe81f..aa475cc2d7 100644
--- a/components/axcpu/src/exception_table.rs
+++ b/components/axcpu/src/exception_table.rs
@@ -3,13 +3,13 @@ use crate::TrapFrame;
 #[repr(C)]
 #[derive(Debug, PartialEq, Eq)]
 struct ExceptionTableEntry {
-    #[cfg(target_arch = "aarch64")]
+    #[cfg(any(target_arch = "aarch64", target_arch = "riscv64"))]
     from: i32,
-    #[cfg(target_arch = "aarch64")]
+    #[cfg(any(target_arch = "aarch64", target_arch = "riscv64"))]
     to: i32,
-    #[cfg(not(target_arch = "aarch64"))]
+    #[cfg(not(any(target_arch = "aarch64", target_arch = "riscv64")))]
     from: usize,
-    #[cfg(not(target_arch = "aarch64"))]
+    #[cfg(not(any(target_arch = "aarch64", target_arch = "riscv64")))]
     to: usize,
 }
 
@@ -22,7 +22,13 @@ impl ExceptionTableEntry {
             (base + self.from as isize) as usize
         }
 
-        #[cfg(not(target_arch = "aarch64"))]
+        #[cfg(target_arch = "riscv64")]
+        {
+            let base = unsafe { _ex_table_start.as_ptr() } as isize;
+            (base + self.from as isize) as usize
+        }
+
+        #[cfg(not(any(target_arch = "aarch64", target_arch = "riscv64")))]
         {
             self.from
         }
@@ -36,7 +42,13 @@ impl ExceptionTableEntry {
             (base + self.to as isize) as usize
         }
 
-        #[cfg(not(target_arch = "aarch64"))]
+        #[cfg(target_arch = "riscv64")]
+        {
+            let base = unsafe { _ex_table_start.as_ptr() } as isize;
+            (base + self.to as isize) as usize
+        }
+
+        #[cfg(not(any(target_arch = "aarch64", target_arch = "riscv64")))]
         {
             self.to
         }
diff --git a/components/axcpu/src/riscv/macros.rs b/components/axcpu/src/riscv/macros.rs
index cd1cb822f9..35d75bedda 100644
--- a/components/axcpu/src/riscv/macros.rs
+++ b/components/axcpu/src/riscv/macros.rs
@@ -15,8 +15,8 @@ macro_rules! __asm_macros {
         .macro _asm_extable, from, to
             .pushsection __ex_table, "a"
             .balign 4
-            .word   \from
-            .word   \to
+            .word   \from - _ex_table_start
+            .word   \to - _ex_table_start
             .popsection
         .endm
 
@@ -40,9 +40,9 @@ macro_rules! __asm_macros {
 
         .macro _asm_extable, from, to
             .pushsection __ex_table, "a"
-            .balign 8
-            .quad   \from
-            .quad   \to
+            .balign 4
+            .word   \from - _ex_table_start
+            .word   \to - _ex_table_start
             .popsection
         .endm
 
diff --git a/components/someboot/Cargo.toml b/components/someboot/Cargo.toml
index e69b8a700e..79dfb26c82 100644
--- a/components/someboot/Cargo.toml
+++ b/components/someboot/Cargo.toml
@@ -14,6 +14,7 @@ efi = []
 hv = []
 mmu = []
 percpu-prealloc = []
+thead-mae = []
 uspace = ["mmu"]
 
 [dependencies]
diff --git a/components/someboot/build.rs b/components/someboot/build.rs
index 754c099381..923cae1a8a 100644
--- a/components/someboot/build.rs
+++ b/components/someboot/build.rs
@@ -40,7 +40,6 @@ fn main() {
     } else if build.uspace {
         println!("cargo:rustc-cfg=uspace");
     }
-
     if build.page_size == 4096 {
         println!("cargo:rustc-cfg=page_size_4k");
     } else if build.page_size == 16384 {
@@ -158,7 +157,7 @@ impl Build {
     fn prepare_riscv64(&mut self) {
         let ld_src = "src/arch/riscv64/link.ld";
 
-        if self.uspace {
+        if self.uspace || self.hv {
             self.kernel_vaddr = 0xffff_ffff_8000_0000;
         } else {
             self.kernel_vaddr = 0x8020_0000;
diff --git a/components/someboot/src/acpi/mod.rs b/components/someboot/src/acpi/mod.rs
index 4eb8a6ecb8..dfd5deab6a 100644
--- a/components/someboot/src/acpi/mod.rs
+++ b/components/someboot/src/acpi/mod.rs
@@ -35,6 +35,11 @@ fn rsdp() -> Option<NonNull<u8>> {
     NonNull::new(ptr)
 }
 
+pub fn rsdp_addr_phys() -> Option<usize> {
+    let rsdp = unsafe { RSDP };
+    (rsdp != 0).then_some(rsdp)
+}
+
 pub fn tables() -> Result<AcpiTables<AcpiHandle>, acpi::AcpiError> {
     unsafe {
         let rsdp = if RSDP == 0 {
diff --git a/components/someboot/src/arch/aarch64/paging/mod.rs b/components/someboot/src/arch/aarch64/paging/mod.rs
index bb10fe2e97..ae1bda059c 100644
--- a/components/someboot/src/arch/aarch64/paging/mod.rs
+++ b/components/someboot/src/arch/aarch64/paging/mod.rs
@@ -26,7 +26,7 @@ pub fn enable_mmu() -> ! {
     let mmu_entry_phys = super::entry::mmu_entry as *const () as usize;
     println!("MMU Entry point at physical address: {:#x}", mmu_entry_phys);
 
-    let meta = crate::smp::cpu_meta(crate::smp::cpu_idx()).unwrap();
+    let meta = crate::smp::cpu_meta(crate::smp::early_current_cpu_idx()).unwrap();
     let v_sp = meta.stack_top_virt;
     let v_entry = __kimage_va(mmu_entry_phys) as usize;
 
diff --git a/components/someboot/src/arch/riscv64/addrspace.rs b/components/someboot/src/arch/riscv64/addrspace.rs
index 7f44c598a8..0614261afe 100644
--- a/components/someboot/src/arch/riscv64/addrspace.rs
+++ b/components/someboot/src/arch/riscv64/addrspace.rs
@@ -1,11 +1,11 @@
 include!(concat!(env!("OUT_DIR"), "/defines.rs"));
 
-#[cfg(uspace)]
+#[cfg(any(uspace, hv))]
 pub const PAGE_OFFSET: usize = 0xffff_ffc0_0000_0000;
-#[cfg(not(uspace))]
+#[cfg(not(any(uspace, hv)))]
 pub const PAGE_OFFSET: usize = 0;
 
-#[cfg(uspace)]
+#[cfg(any(uspace, hv))]
 pub const PERCPU_BASE: usize = 0xffff_ffe0_0000_0000;
-#[cfg(not(uspace))]
+#[cfg(not(any(uspace, hv)))]
 pub const PERCPU_BASE: usize = PAGE_OFFSET;
diff --git a/components/someboot/src/arch/riscv64/entry.rs b/components/someboot/src/arch/riscv64/entry.rs
index 2fc518788d..da988f33c7 100644
--- a/components/someboot/src/arch/riscv64/entry.rs
+++ b/components/someboot/src/arch/riscv64/entry.rs
@@ -50,7 +50,8 @@ pub unsafe extern "C" fn kernel_entry(_hart_id: usize, _fdt_addr: usize) -> ! {
         "mv t0, a1",
         "lla sp, __cpu0_stack_top",
         "mv a0, t0",
-        "j {primary_head_entry}",
+        "lla t1, {primary_head_entry}",
+        "jr t1",
         primary_head_entry = sym primary_head_entry,
     )
 }
@@ -98,7 +99,8 @@ pub(crate) unsafe extern "C" fn _secondary_entry(_hartid: usize, _cpu_meta_paddr
         "mv t0, a1",
         "ld sp, {stack_top_offset}(t0)",
         "mv a0, t0",
-        "j {secondary_start}",
+        "lla t1, {secondary_start}",
+        "jr t1",
         secondary_start = sym secondary_start,
         stack_top_offset = const offset_of!(PerCpuMeta, stack_top),
     )
diff --git a/components/someboot/src/arch/riscv64/link.ld b/components/someboot/src/arch/riscv64/link.ld
index 27148429ae..e0eb04c756 100644
--- a/components/someboot/src/arch/riscv64/link.ld
+++ b/components/someboot/src/arch/riscv64/link.ld
@@ -1,5 +1,5 @@
 PROVIDE(PAGE_SIZE = 0x1000);
-PROVIDE(STACK_SIZE = 0x4000);
+PROVIDE(STACK_SIZE = 0x40000);
 VM_LOAD_ADDRESS = ${kernel_load_vaddr};
 
 OUTPUT_ARCH(riscv)
@@ -54,6 +54,21 @@ SECTIONS
     _edata = .;
     __kernel_load_end = .;
     __bss_start = .;
+
+    .tdata : {
+        _stdata = .;
+        *(.tdata .tdata.*)
+        _etdata = .;
+    }
+
+    .tbss : {
+        _stbss = .;
+        *(.tbss .tbss.*)
+        *(.init.bss)
+        *(.tcommon)
+        _etbss = .;
+    }
+
     .sbss : {
         *(.dynsbss)
         *(.sbss .sbss.*)
diff --git a/components/someboot/src/arch/riscv64/mod.rs b/components/someboot/src/arch/riscv64/mod.rs
index d96cbf685a..74f4858680 100644
--- a/components/someboot/src/arch/riscv64/mod.rs
+++ b/components/someboot/src/arch/riscv64/mod.rs
@@ -13,7 +13,7 @@ mod trap;
 use core::sync::atomic::{AtomicUsize, Ordering};
 
 pub(crate) use entry::_secondary_entry;
-use page_table_generic::{PageTableEntry, PhysAddr, PteConfig, TableMeta, VirtAddr};
+use page_table_generic::{MemAttributes, PageTableEntry, PhysAddr, PteConfig, TableMeta, VirtAddr};
 pub use relocate::apply as relocate;
 
 use crate::{
@@ -21,7 +21,7 @@ use crate::{
     mem::{PageTableInfo, mmu},
     power::CpuOnError,
 };
-#[cfg(uspace)]
+#[cfg(any(uspace, hv))]
 use crate::{mem::__kimage_va_to_pa, smp::percpu_va_range};
 
 const KERNEL_LOAD_ADDRESS: usize = 0x8020_0000;
@@ -37,10 +37,59 @@ const PTE_U: usize = 1 << 4;
 const PTE_G: usize = 1 << 5;
 const PTE_A: usize = 1 << 6;
 const PTE_D: usize = 1 << 7;
+const PTE_PPN_MASK: usize = (1 << 44) - 1;
+
+#[cfg(feature = "thead-mae")]
+const PTE_THEAD_SEC: usize = 1 << 59;
+#[cfg(feature = "thead-mae")]
+const PTE_THEAD_SH: usize = 1 << 60;
+#[cfg(feature = "thead-mae")]
+const PTE_THEAD_B: usize = 1 << 61;
+#[cfg(feature = "thead-mae")]
+const PTE_THEAD_C: usize = 1 << 62;
+#[cfg(feature = "thead-mae")]
+const PTE_THEAD_SO: usize = 1 << 63;
+#[cfg(feature = "thead-mae")]
+const PTE_THEAD_PMA: usize = PTE_THEAD_C | PTE_THEAD_B | PTE_THEAD_SH;
+#[cfg(feature = "thead-mae")]
+const PTE_THEAD_NOCACHE: usize = PTE_THEAD_B | PTE_THEAD_SH;
+#[cfg(feature = "thead-mae")]
+const PTE_THEAD_IO: usize = PTE_THEAD_SO | PTE_THEAD_SH;
+#[cfg(feature = "thead-mae")]
+const PTE_THEAD_MT_MASK: usize =
+    PTE_THEAD_SEC | PTE_THEAD_SH | PTE_THEAD_B | PTE_THEAD_C | PTE_THEAD_SO;
 
 static KERNEL_PAGE_TABLE_ADDR: AtomicUsize = AtomicUsize::new(0);
 static TIMEBASE_FREQ: AtomicUsize = AtomicUsize::new(0);
 
+#[cfg(feature = "thead-mae")]
+fn thead_mae_pte_bits(mem_attr: MemAttributes) -> usize {
+    match mem_attr {
+        MemAttributes::Device => PTE_THEAD_IO,
+        MemAttributes::Uncached => PTE_THEAD_NOCACHE,
+        MemAttributes::Normal | MemAttributes::PerCpu => PTE_THEAD_PMA,
+    }
+}
+
+#[cfg(not(feature = "thead-mae"))]
+fn thead_mae_pte_bits(_mem_attr: MemAttributes) -> usize {
+    0
+}
+
+#[cfg(feature = "thead-mae")]
+fn thead_mae_mem_attr(bits: usize) -> MemAttributes {
+    match bits & PTE_THEAD_MT_MASK {
+        PTE_THEAD_IO => MemAttributes::Device,
+        PTE_THEAD_NOCACHE => MemAttributes::Uncached,
+        _ => MemAttributes::Normal,
+    }
+}
+
+#[cfg(not(feature = "thead-mae"))]
+fn thead_mae_mem_attr(_bits: usize) -> MemAttributes {
+    MemAttributes::Normal
+}
+
 #[derive(Clone, Copy, Debug, Default)]
 #[repr(transparent)]
 pub struct Entry(usize);
@@ -75,9 +124,10 @@ impl PageTableEntry for Entry {
             if config.writable || config.dirty {
                 bits |= PTE_D;
             }
+            bits |= thead_mae_pte_bits(config.mem_attr);
         }
 
-        bits |= (config.paddr.raw() >> 12) << SV39_PPN_SHIFT;
+        bits |= ((config.paddr.raw() >> 12) & PTE_PPN_MASK) << SV39_PPN_SHIFT;
         Self(bits)
     }
 
@@ -91,7 +141,7 @@ impl PageTableEntry for Entry {
         let global = (bits & PTE_G) != 0;
         let dirty = (bits & PTE_D) != 0;
         let huge = is_dir && (read || writable || executable);
-        let paddr = PhysAddr::new((bits >> SV39_PPN_SHIFT) << 12);
+        let paddr = PhysAddr::new(((bits >> SV39_PPN_SHIFT) & PTE_PPN_MASK) << 12);
 
         PteConfig {
             paddr,
@@ -104,7 +154,7 @@ impl PageTableEntry for Entry {
             global,
             is_dir,
             huge,
-            mem_attr: Default::default(),
+            mem_attr: thead_mae_mem_attr(bits),
         }
     }
 
@@ -176,7 +226,7 @@ impl ArchTrait for Arch {
 
     fn virt_to_phys(vaddr: *const u8) -> usize {
         let vaddr = vaddr as usize;
-        #[cfg(uspace)]
+        #[cfg(any(uspace, hv))]
         {
             if mmu::is_mmu_enabled() {
                 if percpu_va_range().contains(&vaddr) {
@@ -237,10 +287,6 @@ impl ArchTrait for Arch {
     }
 
     fn cpu_on(hartid: usize, entry: usize, arg: usize) -> Result<(), CpuOnError> {
-        if hartid == Self::cpu_current_hartid() {
-            return Err(CpuOnError::AlreadyOn);
-        }
-
         match sbi::hart_start(hartid, entry, arg) {
             Ok(()) => Ok(()),
             Err(sbi::HartStartError::AlreadyAvailable | sbi::HartStartError::AlreadyStarted) => {
diff --git a/components/someboot/src/arch/riscv64/paging.rs b/components/someboot/src/arch/riscv64/paging.rs
index 75fc4aa912..dff0fa8741 100644
--- a/components/someboot/src/arch/riscv64/paging.rs
+++ b/components/someboot/src/arch/riscv64/paging.rs
@@ -15,7 +15,7 @@ pub fn enable_mmu() -> ! {
     }
 
     let mmu_entry_phys = super::entry::mmu_entry as *const () as usize;
-    let meta = crate::smp::cpu_meta(crate::smp::cpu_idx()).unwrap();
+    let meta = crate::smp::cpu_meta(crate::smp::early_current_cpu_idx()).unwrap();
     let v_sp = meta.stack_top_virt;
     let v_entry = __kimage_va(mmu_entry_phys) as usize;
 
diff --git a/components/someboot/src/arch/riscv64/trap.rs b/components/someboot/src/arch/riscv64/trap.rs
index e1fdae1d8d..4149eea46b 100644
--- a/components/someboot/src/arch/riscv64/trap.rs
+++ b/components/someboot/src/arch/riscv64/trap.rs
@@ -3,7 +3,6 @@ use core::{arch::global_asm, mem::offset_of};
 use crate::irq;
 
 const SCAUSE_INTERRUPT_BIT: usize = 1usize << (usize::BITS as usize - 1);
-const SCAUSE_SUPERVISOR_TIMER: usize = 5;
 
 #[repr(C)]
 struct TrapFrame {
@@ -66,11 +65,8 @@ pub fn trap_addr() -> usize {
 extern "C" fn __riscv64_handle_trap(tf: &mut TrapFrame) {
     let scause = tf.scause;
     if (scause & SCAUSE_INTERRUPT_BIT) != 0 {
-        let cause = scause & !SCAUSE_INTERRUPT_BIT;
-        if cause == SCAUSE_SUPERVISOR_TIMER {
-            irq::handle_irq(irq::systimer_irq());
-            return;
-        }
+        irq::handle_irq(irq::IrqId::new(scause));
+        return;
     }
 
     panic!(
diff --git a/components/someboot/src/arch/x86_64/paging.rs b/components/someboot/src/arch/x86_64/paging.rs
index bcac10ab2a..181fa943b5 100644
--- a/components/someboot/src/arch/x86_64/paging.rs
+++ b/components/someboot/src/arch/x86_64/paging.rs
@@ -124,7 +124,7 @@ pub fn enable_mmu() -> ! {
         panic!("failed to setup x86_64 page table: {err:?}");
     }
 
-    let meta = crate::smp::cpu_meta(crate::smp::cpu_idx()).unwrap();
+    let meta = crate::smp::cpu_meta(crate::smp::early_current_cpu_idx()).unwrap();
     let v_sp = meta.stack_top_virt;
     let v_entry = __kimage_va(super::entry::mmu_entry as *const () as usize) as usize;
 
diff --git a/components/someboot/src/arch/x86_64/power.rs b/components/someboot/src/arch/x86_64/power.rs
index 92948b482f..504e1b3846 100644
--- a/components/someboot/src/arch/x86_64/power.rs
+++ b/components/someboot/src/arch/x86_64/power.rs
@@ -132,8 +132,15 @@ pub(crate) fn notify_ap_started(apic_id: usize) {
     AP_BOOTED_ID.store(apic_id, Ordering::Release);
 }
 
+fn current_apic_id() -> usize {
+    x86::cpuid::CpuId::new()
+        .get_feature_info()
+        .map(|info| info.initial_local_apic_id() as usize)
+        .unwrap_or(0)
+}
+
 pub(crate) fn cpu_on(apic_id: usize, entry: usize, arg: usize) -> Result<(), CpuOnError> {
-    if apic_id == crate::smp::cpu_hart_id() {
+    if apic_id == current_apic_id() {
         return Err(CpuOnError::AlreadyOn);
     }
     let apic_id = u8::try_from(apic_id).map_err(|_| CpuOnError::InvalidParameters)?;
diff --git a/components/someboot/src/fdt/earlycon.rs b/components/someboot/src/fdt/earlycon.rs
index a3fab04bfe..539b04a669 100644
--- a/components/someboot/src/fdt/earlycon.rs
+++ b/components/someboot/src/fdt/earlycon.rs
@@ -59,7 +59,7 @@ fn set_by_stdout() -> Option<()> {
                 installed = true;
                 break;
             }
-            "snps,dw-apb-uart" => {
+            "snps,dw-apb-uart" | "ns16550a" | "ns16550" => {
                 let mut serial = ns16550::Ns16550::new_mmio(addr, clock, reg_width);
                 serial.open();
                 let tx = serial.take_tx()?;
diff --git a/components/someboot/src/lib.rs b/components/someboot/src/lib.rs
index 14f1c1b6e6..c956b65b82 100644
--- a/components/someboot/src/lib.rs
+++ b/components/someboot/src/lib.rs
@@ -47,6 +47,7 @@ pub mod power;
 pub mod smp;
 pub mod timer;
 
+pub use acpi::rsdp_addr_phys;
 pub use fdt::{fdt_addr, fdt_addr_phys};
 pub use page_table_generic::*;
 pub use somehal_macros::{entry, irq_handler, someboot_secondary_entry as secondary_entry};
@@ -176,7 +177,7 @@ fn prime_entry() -> ! {
     }
 
     let entry = __someboot_main as *const () as usize;
-    let sp = crate::smp::cpu_meta(crate::smp::cpu_idx())
+    let sp = crate::smp::cpu_meta(crate::smp::early_current_cpu_idx())
         .unwrap()
         .stack_top;
     let sp = __percpu(sp);
diff --git a/components/someboot/src/smp/mod.rs b/components/someboot/src/smp/mod.rs
index c7d4e803a0..75e7d14929 100644
--- a/components/someboot/src/smp/mod.rs
+++ b/components/someboot/src/smp/mod.rs
@@ -104,18 +104,23 @@ pub fn percpu_data_ptr(idx: usize) -> Option<*mut u8> {
     layout::percpu_data_ptr(idx)
 }
 
-pub fn cpu_hart_id() -> usize {
+/// Returns the current hardware CPU ID from the early boot register convention.
+///
+/// On RISC-V this reads `tp`, which is only a boot-time hart ID scratch
+/// register before handing control to the runtime. Runtime code must use its
+/// own per-CPU current-CPU reader instead.
+pub fn early_current_hart_id() -> usize {
     Arch::cpu_current_hartid()
 }
 
-pub fn cpu_idx() -> usize {
-    let hart_id = cpu_hart_id();
-    for (idx, id) in __cpu_id_list().enumerate() {
-        if id == hart_id {
-            return idx;
-        }
-    }
-    panic!("Current CPU hart id {hart_id:#x} not found in CPU list");
+pub fn early_current_cpu_idx() -> usize {
+    let hart_id = early_current_hart_id();
+    cpu_id_to_idx(hart_id)
+        .unwrap_or_else(|| panic!("Current CPU hart id {hart_id:#x} not found in CPU list"))
+}
+
+pub fn try_early_cpu_idx() -> Option<usize> {
+    cpu_id_to_idx(early_current_hart_id())
 }
 
 pub fn cpu_id_to_idx(hart_id: usize) -> Option<usize> {
diff --git a/docs/docs/build/configuration.md b/docs/docs/build/configuration.md
index 69d5c27e51..590b1d51e0 100644
--- a/docs/docs/build/configuration.md
+++ b/docs/docs/build/configuration.md
@@ -64,7 +64,7 @@ flowchart TD
 
 除默认值差异外，各架构还有一些需要注意的特殊行为：
 
-- **plat_dyn**：仅 `aarch64` 支持 `plat_dyn = true`（动态平台加载），其他架构使用静态平台绑定
+- **plat_dyn**：`aarch64` 和 `riscv64` 支持 `plat_dyn = true`（动态平台加载），其他架构使用静态平台绑定
 - **to_bin**：`x86_64` 不使用 `--bin`（直接生成 ELF 即可），其余架构默认将 ELF 转为 raw binary
 - **LoongArch QEMU**：运行 Axvisor loongarch64 时自动搜索 LVZ 版 QEMU（详见 [运行](./run#loongarch-特殊处理)）
 
@@ -286,7 +286,7 @@ axconfig 仅在**静态平台模式**（`plat_dyn = false`）下生成。动态
 |--------|-------------|-----------------|
 | ArceOS | `true`（aarch64）/ `false`（其他） | 仅 `plat_dyn = false` 时 |
 | StarryOS | `false` | 始终生成 |
-| Axvisor | `true`（aarch64）/ `false`（其他） | 仅 `plat_dyn = false` 时 |
+| Axvisor | `true`（aarch64/riscv64）/ `false`（其他） | 仅 `plat_dyn = false` 时 |
 
 ### 生成流程
 
diff --git a/drivers/ax-driver/Cargo.toml b/drivers/ax-driver/Cargo.toml
index a37c270951..1f05376de1 100644
--- a/drivers/ax-driver/Cargo.toml
+++ b/drivers/ax-driver/Cargo.toml
@@ -13,14 +13,12 @@ name = "ax_driver"
 [features]
 default = []
 
-fdt = ["dep:fdt-edit"]
-acpi = []
-pci = ["dep:pcie", "dep:heapless", "dep:rdif-pcie", "dep:spin"]
-pci-fdt = ["pci", "fdt", "dep:rdif-intc"]
+plat-static = []
+plat-dyn = ["dep:fdt-edit"]
 irq = []
 
-block = ["dep:ax-errno", "dep:ax-kspin", "dep:rd-block", "dep:spin"]
-net = ["dep:rd-net", "dep:spin"]
+block = ["dep:ax-errno", "dep:ax-kspin", "dep:rd-block"]
+net = ["dep:rd-net"]
 display = ["dep:ax-errno", "dep:rdif-display"]
 input = ["dep:ax-errno", "dep:rdif-input"]
 vsock = ["dep:ax-errno", "dep:rdif-vsock"]
@@ -35,22 +33,24 @@ virtio-socket = ["vsock", "virtio"]
 
 ramdisk = ["block", "dep:ramdisk"]
 bcm2835-sdhci = ["block", "dep:bcm2835-sdhci"]
-ahci = ["block", "pci", "dep:simple-ahci"]
-ixgbe = ["net", "pci", "dep:ax-alloc", "dep:ixgbe-driver"]
+cvsd = ["block", "plat-dyn", "dep:sg200x-bsp"]
+ahci = ["block", "dep:simple-ahci"]
+ixgbe = ["net", "dep:ax-alloc", "dep:ixgbe-driver"]
 fxmac = ["net", "dep:ax-alloc", "dep:ax-crate-interface", "dep:fxmac_rs"]
-intel-net = ["net", "pci", "dep:eth-intel"]
-realtek-rtl8125 = ["net", "pci", "dep:realtek-rtl8125"]
+intel-net = ["net", "dep:eth-intel"]
+realtek-rtl8125 = ["net", "dep:realtek-rtl8125"]
 
 usb = ["dep:crab-usb"]
-rockchip-dwc-xhci = ["usb", "fdt", "rockchip-soc", "rockchip-pm"]
-xhci-mmio = ["usb", "fdt"]
-xhci-pci = ["usb", "pci"]
-serial = ["fdt", "dep:some-serial"]
-rtc = ["fdt", "dep:ax-arm-pl031"]
-rknpu = ["fdt", "rockchip-pm", "rockchip-soc", "dep:rockchip-npu"]
+rockchip-dwc-xhci = ["usb", "plat-dyn", "rockchip-soc", "rockchip-pm"]
+xhci-mmio = ["usb", "plat-dyn"]
+xhci-pci = ["usb"]
+serial = ["plat-dyn", "dep:some-serial"]
+sg2002-placeholder = ["plat-dyn"]
+rtc = ["plat-dyn", "dep:ax-arm-pl031", "dep:riscv_goldfish"]
+rknpu = ["plat-dyn", "rockchip-pm", "rockchip-soc", "dep:rockchip-npu"]
 rockchip-sdhci = [
     "block",
-    "fdt",
+    "plat-dyn",
     "rockchip-soc",
     "dep:ax-kspin",
     "dep:rdif-clk",
@@ -60,7 +60,7 @@ rockchip-sdhci = [
 ]
 phytium-mci = [
     "block",
-    "fdt",
+    "plat-dyn",
     "dep:ax-kspin",
     "dep:phytium-mci-host",
     "dep:sdmmc-protocol",
@@ -68,7 +68,7 @@ phytium-mci = [
 ]
 rockchip-dwmmc = [
     "block",
-    "fdt",
+    "plat-dyn",
     "rockchip-soc",
     "dep:arm-scmi-rs",
     "dep:ax-kspin",
@@ -78,15 +78,14 @@ rockchip-dwmmc = [
     "sdmmc-protocol/sdio",
 ]
 rk3588-pcie = [
-    "pci-fdt",
+    "plat-dyn",
     "rockchip-soc",
     "rockchip-pm",
-    "dep:rdif-pcie",
     "dep:rk3588-pci",
 ]
-rockchip-soc = ["fdt", "dep:rdif-clk", "dep:rockchip-soc"]
+rockchip-soc = ["plat-dyn", "dep:rdif-clk", "dep:rockchip-soc"]
 rockchip-pm = ["rockchip-soc", "dep:rockchip-pm"]
-pci-list-devices = ["pci"]
+list-pci-devices = []
 
 [dependencies]
 anyhow = { workspace = true }
@@ -105,19 +104,19 @@ dwmmc-host = { workspace = true, optional = true }
 eth-intel = { workspace = true, optional = true }
 fdt-edit = { workspace = true, optional = true }
 fxmac_rs = { workspace = true, optional = true }
-heapless = { workspace = true, optional = true }
+heapless.workspace = true
 ixgbe-driver = { workspace = true, optional = true }
 log.workspace = true
 mmio-api.workspace = true
-pcie = { workspace = true, optional = true }
+pcie.workspace = true
 ramdisk = { workspace = true, optional = true }
 rd-block = { workspace = true, optional = true }
 rd-net = { workspace = true, optional = true }
 rdif-clk = { workspace = true, optional = true }
 rdif-display = { workspace = true, optional = true }
 rdif-input = { workspace = true, optional = true }
-rdif-intc = { workspace = true, optional = true }
-rdif-pcie = { workspace = true, optional = true }
+rdif-intc.workspace = true
+rdif-pcie.workspace = true
 rdif-vsock = { workspace = true, optional = true }
 realtek-rtl8125 = { workspace = true, optional = true }
 rdrive.workspace = true
@@ -129,7 +128,11 @@ rockchip-soc = { workspace = true, optional = true }
 phytium-mci-host = { workspace = true, optional = true }
 sdhci-host = { workspace = true, optional = true }
 sdmmc-protocol = { workspace = true, default-features = false, optional = true }
+sg200x-bsp = { workspace = true, optional = true }
 simple-ahci = { workspace = true, optional = true }
 some-serial = { workspace = true, optional = true }
-spin = { workspace = true, optional = true }
+spin.workspace = true
 virtio-drivers = { workspace = true, optional = true }
+
+[target.'cfg(target_arch = "riscv64")'.dependencies]
+riscv_goldfish = { version = "0.1", optional = true }
diff --git a/drivers/ax-driver/build.rs b/drivers/ax-driver/build.rs
index 50d1994b23..897e8664f8 100644
--- a/drivers/ax-driver/build.rs
+++ b/drivers/ax-driver/build.rs
@@ -6,14 +6,6 @@ const VIRTIO_DEV_FEATURES: &[&str] = &[
     "virtio-socket",
 ];
 
-fn make_cfg_values(str_list: &[&str]) -> String {
-    str_list
-        .iter()
-        .map(|s| format!("{s:?}"))
-        .collect::<Vec<_>>()
-        .join(", ")
-}
-
 fn has_feature(feature: &str) -> bool {
     std::env::var(format!(
         "CARGO_FEATURE_{}",
@@ -26,10 +18,6 @@ fn has_any_feature(features: &[&str]) -> bool {
     features.iter().any(|feature| has_feature(feature))
 }
 
-fn enable_cfg(key: &str, value: &str) {
-    println!("cargo:rustc-cfg={key}=\"{value}\"");
-}
-
 fn enable_cfg_flag(key: &str) {
     println!("cargo:rustc-cfg={key}");
 }
@@ -37,26 +25,25 @@ fn enable_cfg_flag(key: &str) {
 fn main() {
     let has_virtio_core = has_feature("virtio-core");
     let has_virtio_dev = has_any_feature(VIRTIO_DEV_FEATURES);
-    let has_pci = has_feature("pci");
-    let has_fdt = has_feature("fdt");
-
-    if has_pci {
-        enable_cfg("probe", "pci");
-    }
-    if has_fdt {
-        enable_cfg("probe", "fdt");
+    let has_plat_static = has_feature("plat-static");
+    let has_plat_dyn = has_feature("plat-dyn");
+    let target_arch = std::env::var("CARGO_CFG_TARGET_ARCH").unwrap_or_default();
+    let target_has_cvsd = matches!(target_arch.as_str(), "riscv32" | "riscv64");
+
+    if has_plat_dyn {
+        enable_cfg_flag("plat_dyn");
+    } else if has_plat_static {
+        enable_cfg_flag("plat_static");
     }
     if has_virtio_core || has_virtio_dev {
         enable_cfg_flag("virtio_dev");
     }
-    if has_any_feature(&["ahci", "bcm2835-sdhci"]) {
+    if has_any_feature(&["ahci", "bcm2835-sdhci"]) || (has_feature("cvsd") && target_has_cvsd) {
         enable_cfg_flag("sync_block_dev");
     }
 
-    println!(
-        "cargo::rustc-check-cfg=cfg(probe, values({}))",
-        make_cfg_values(&["pci", "fdt"])
-    );
+    println!("cargo::rustc-check-cfg=cfg(plat_static)");
+    println!("cargo::rustc-check-cfg=cfg(plat_dyn)");
     println!("cargo::rustc-check-cfg=cfg(virtio_dev)");
     println!("cargo::rustc-check-cfg=cfg(sync_block_dev)");
 }
diff --git a/drivers/ax-driver/src/block/cvsd.rs b/drivers/ax-driver/src/block/cvsd.rs
new file mode 100644
index 0000000000..a9c87f1149
--- /dev/null
+++ b/drivers/ax-driver/src/block/cvsd.rs
@@ -0,0 +1,160 @@
+#[cfg(plat_dyn)]
+use rdrive::register::FdtInfo;
+use rdrive::{PlatformDevice, probe::OnProbeError};
+#[cfg(any(target_arch = "riscv32", target_arch = "riscv64"))]
+use {alloc::format, sg200x_bsp::sdmmc::Sdmmc};
+
+#[cfg(any(target_arch = "riscv32", target_arch = "riscv64"))]
+use super::{SyncBlockOps, register_sync_block};
+
+#[cfg(any(target_arch = "riscv32", target_arch = "riscv64"))]
+const BLOCK_SIZE: usize = 512;
+pub const DEVICE_NAME: &str = "cvsd";
+
+#[cfg(plat_dyn)]
+crate::model_register!(
+    name: "FDT CVSD",
+    level: ProbeLevel::PostKernel,
+    priority: ProbePriority::DEFAULT,
+    probe_kinds: &[ProbeKind::Fdt {
+        compatibles: &["cvitek,cv181x-sd"],
+        on_probe: probe_fdt,
+    }],
+);
+
+#[cfg(plat_dyn)]
+fn probe_fdt(info: FdtInfo<'_>, plat_dev: PlatformDevice) -> Result<(), OnProbeError> {
+    let sdmmc =
+        info.node.regs().into_iter().next().ok_or_else(|| {
+            OnProbeError::other(alloc::format!("[{}] has no reg", info.node.name()))
+        })?;
+    let syscon = info
+        .find_compatible(&["syscon"])
+        .into_iter()
+        .find_map(|node| node.regs().into_iter().next())
+        .ok_or_else(|| OnProbeError::other("CVSD syscon node not found in FDT"))?;
+
+    register_mmio(
+        plat_dev,
+        sdmmc.address as usize,
+        sdmmc.size.unwrap_or(0x1000) as usize,
+        syscon.address as usize,
+        syscon.size.unwrap_or(0x1000) as usize,
+    )
+}
+
+fn register_mmio(
+    plat_dev: PlatformDevice,
+    sdmmc_paddr: usize,
+    sdmmc_size: usize,
+    syscon_paddr: usize,
+    syscon_size: usize,
+) -> Result<(), OnProbeError> {
+    if sdmmc_paddr == 0 || sdmmc_size == 0 || syscon_paddr == 0 || syscon_size == 0 {
+        return Err(OnProbeError::NotMatch);
+    }
+    register_mmio_target(plat_dev, sdmmc_paddr, sdmmc_size, syscon_paddr, syscon_size)
+}
+
+#[cfg(any(target_arch = "riscv32", target_arch = "riscv64"))]
+fn register_mmio_target(
+    plat_dev: PlatformDevice,
+    sdmmc_paddr: usize,
+    sdmmc_size: usize,
+    syscon_paddr: usize,
+    syscon_size: usize,
+) -> Result<(), OnProbeError> {
+    let sdmmc = map_region(sdmmc_paddr, sdmmc_size, "CVSD")?;
+    let syscon = map_region(syscon_paddr, syscon_size, "SYSCON")?;
+    let driver =
+        CvsdDriver::new(sdmmc, syscon).map_err(|_| OnProbeError::other("CVSD init failed"))?;
+    register_sync_block(plat_dev, driver);
+    Ok(())
+}
+
+#[cfg(not(any(target_arch = "riscv32", target_arch = "riscv64")))]
+fn register_mmio_target(
+    _plat_dev: PlatformDevice,
+    _sdmmc_paddr: usize,
+    _sdmmc_size: usize,
+    _syscon_paddr: usize,
+    _syscon_size: usize,
+) -> Result<(), OnProbeError> {
+    Err(OnProbeError::NotMatch)
+}
+
+#[cfg(any(target_arch = "riscv32", target_arch = "riscv64"))]
+fn map_region(address: usize, size: usize, name: &str) -> Result<usize, OnProbeError> {
+    let mmio = axklib::mmio::ioremap_raw(address.into(), size)
+        .map_err(|err| OnProbeError::other(format!("failed to map {name}: {err:?}")))?;
+    Ok(mmio.as_ptr() as usize)
+}
+
+#[cfg(any(target_arch = "riscv32", target_arch = "riscv64"))]
+struct CvsdDriver(Sdmmc);
+
+// The SG2002 SD/MMC core stores MMIO registers as `UnsafeCell`-backed
+// references, so the raw register block is intentionally not `Sync`.
+// `CvsdDriver` is owned by `SyncBlockDevice`, which serializes all access
+// through a mutex and never clones the driver, so moving that owner between
+// execution contexts is sound.
+#[cfg(any(target_arch = "riscv32", target_arch = "riscv64"))]
+unsafe impl Send for CvsdDriver {}
+
+#[cfg(any(target_arch = "riscv32", target_arch = "riscv64"))]
+impl CvsdDriver {
+    fn new(sdmmc: usize, syscon: usize) -> Result<Self, ()> {
+        let sdmmc = unsafe { Sdmmc::new(sdmmc, syscon) };
+        sdmmc.init().map_err(|_| ())?;
+        sdmmc.clk_en(true);
+        Ok(Self(sdmmc))
+    }
+
+    fn checked_lba(block_id: u64, offset: usize) -> Result<u32, rd_block::BlkError> {
+        let lba = block_id
+            .checked_add(offset as u64)
+            .ok_or(rd_block::BlkError::InvalidBlockIndex(block_id as usize))?;
+        u32::try_from(lba).map_err(|_| rd_block::BlkError::InvalidBlockIndex(block_id as usize))
+    }
+}
+
+#[cfg(any(target_arch = "riscv32", target_arch = "riscv64"))]
+impl SyncBlockOps for CvsdDriver {
+    fn name(&self) -> &'static str {
+        DEVICE_NAME
+    }
+
+    fn num_blocks(&self) -> u64 {
+        self.0.card_capacity_blocks()
+    }
+
+    fn block_size(&self) -> usize {
+        BLOCK_SIZE
+    }
+
+    fn read_blocks(&mut self, block_id: u64, buf: &mut [u8]) -> Result<(), rd_block::BlkError> {
+        if !buf.len().is_multiple_of(BLOCK_SIZE) {
+            return Err(rd_block::BlkError::NotSupported);
+        }
+
+        for (i, block) in buf.chunks_exact_mut(BLOCK_SIZE).enumerate() {
+            self.0
+                .read_block(Self::checked_lba(block_id, i)?, block)
+                .map_err(|_| rd_block::BlkError::Other("CVSD read failed".into()))?;
+        }
+        Ok(())
+    }
+
+    fn write_blocks(&mut self, block_id: u64, buf: &[u8]) -> Result<(), rd_block::BlkError> {
+        if !buf.len().is_multiple_of(BLOCK_SIZE) {
+            return Err(rd_block::BlkError::NotSupported);
+        }
+
+        for (i, block) in buf.chunks_exact(BLOCK_SIZE).enumerate() {
+            self.0
+                .write_block(Self::checked_lba(block_id, i)?, block)
+                .map_err(|_| rd_block::BlkError::Other("CVSD write failed".into()))?;
+        }
+        Ok(())
+    }
+}
diff --git a/drivers/ax-driver/src/block/mod.rs b/drivers/ax-driver/src/block/mod.rs
index 7b21a02895..15a6ef7685 100644
--- a/drivers/ax-driver/src/block/mod.rs
+++ b/drivers/ax-driver/src/block/mod.rs
@@ -4,6 +4,8 @@ mod binding;
 pub mod ahci;
 #[cfg(feature = "bcm2835-sdhci")]
 pub mod bcm2835;
+#[cfg(feature = "cvsd")]
+pub mod cvsd;
 #[cfg(feature = "phytium-mci")]
 pub mod phytium_mci;
 #[cfg(feature = "ramdisk")]
diff --git a/drivers/ax-driver/src/lib.rs b/drivers/ax-driver/src/lib.rs
index 7289ede1fa..dcb0f0a7c9 100644
--- a/drivers/ax-driver/src/lib.rs
+++ b/drivers/ax-driver/src/lib.rs
@@ -45,18 +45,19 @@ crate::model_register!(
 
 pub mod error;
 #[cfg(any(
-    feature = "serial",
-    all(feature = "rtc", feature = "fdt"),
-    all(feature = "rockchip-soc", feature = "fdt"),
-    all(feature = "rockchip-pm", feature = "fdt"),
-    all(feature = "rockchip-dwmmc", feature = "fdt"),
-    all(feature = "rockchip-sdhci", feature = "fdt"),
-    all(feature = "phytium-mci", feature = "fdt"),
-    all(feature = "rk3588-pcie", feature = "fdt"),
-    all(feature = "rknpu", feature = "fdt"),
-    all(feature = "xhci-mmio", target_os = "none"),
+    all(feature = "serial", plat_dyn),
+    all(feature = "rtc", plat_dyn),
+    all(feature = "rockchip-soc", plat_dyn),
+    all(feature = "rockchip-pm", plat_dyn),
+    all(feature = "sg2002-placeholder", plat_dyn),
+    all(feature = "rockchip-dwmmc", plat_dyn),
+    all(feature = "rockchip-sdhci", plat_dyn),
+    all(feature = "phytium-mci", plat_dyn),
+    all(feature = "rk3588-pcie", plat_dyn),
+    all(feature = "rknpu", plat_dyn),
+    all(feature = "xhci-mmio", target_os = "none", plat_dyn),
     all(feature = "xhci-pci", target_os = "none"),
-    all(virtio_dev, probe = "fdt")
+    all(virtio_dev, plat_dyn)
 ))]
 pub mod mmio;
 
@@ -71,7 +72,6 @@ pub mod net;
 #[cfg(feature = "vsock")]
 pub mod vsock;
 
-#[cfg(feature = "pci")]
 pub mod pci;
 #[cfg(feature = "rknpu")]
 pub mod rknpu;
@@ -80,6 +80,7 @@ pub mod serial;
 #[cfg(any(
     feature = "rockchip-soc",
     feature = "rockchip-pm",
+    feature = "sg2002-placeholder",
     feature = "rockchip-dwmmc"
 ))]
 pub mod soc;
diff --git a/drivers/ax-driver/src/net/binding.rs b/drivers/ax-driver/src/net/binding.rs
index 32d4b0eda0..400bcf7f6e 100644
--- a/drivers/ax-driver/src/net/binding.rs
+++ b/drivers/ax-driver/src/net/binding.rs
@@ -42,7 +42,17 @@ impl DriverGeneric for PlatformNetDevice {
 }
 
 pub fn pci_legacy_irq(endpoint: &EndpointRc) -> Option<usize> {
-    #[cfg(all(feature = "pci-fdt", target_os = "none"))]
+    #[cfg(all(
+        plat_dyn,
+        target_os = "none",
+        any(
+            feature = "intel-net",
+            feature = "ixgbe",
+            feature = "realtek-rtl8125",
+            feature = "virtio-net",
+            feature = "xhci-pci",
+        )
+    ))]
     {
         let interrupt_pin = endpoint.interrupt_pin();
         if interrupt_pin != 0 {
@@ -57,7 +67,6 @@ pub fn pci_legacy_irq(endpoint: &EndpointRc) -> Option<usize> {
         }
     }
 
-    #[cfg(feature = "pci")]
     if let Some(irq) =
         crate::pci::legacy_irq_for_endpoint(endpoint.address(), endpoint.interrupt_pin())
     {
diff --git a/drivers/ax-driver/src/pci/fdt.rs b/drivers/ax-driver/src/pci/fdt.rs
index b3788fe574..eebeef5e56 100644
--- a/drivers/ax-driver/src/pci/fdt.rs
+++ b/drivers/ax-driver/src/pci/fdt.rs
@@ -1,14 +1,41 @@
 extern crate alloc;
 
 use alloc::format;
-#[cfg(target_os = "none")]
+#[cfg(all(
+    target_os = "none",
+    any(
+        feature = "intel-net",
+        feature = "ixgbe",
+        feature = "realtek-rtl8125",
+        feature = "virtio-net",
+        feature = "xhci-pci",
+    )
+))]
 use alloc::vec::Vec;
 
-#[cfg(target_os = "none")]
+#[cfg(all(
+    target_os = "none",
+    any(
+        feature = "intel-net",
+        feature = "ixgbe",
+        feature = "realtek-rtl8125",
+        feature = "virtio-net",
+        feature = "xhci-pci",
+    )
+))]
 use fdt_edit::Fdt;
 use fdt_edit::{NodeType, PciRange, PciSpace};
 use log::{debug, trace, warn};
-#[cfg(target_os = "none")]
+#[cfg(all(
+    target_os = "none",
+    any(
+        feature = "intel-net",
+        feature = "ixgbe",
+        feature = "realtek-rtl8125",
+        feature = "virtio-net",
+        feature = "xhci-pci",
+    )
+))]
 use rdrive::probe::pci::PciAddress;
 use rdrive::{
     PlatformDevice,
@@ -131,7 +158,16 @@ pub(super) fn register_fdt_legacy_irq(info: &FdtInfo<'_>, logical_bus_end: u8) {
     super::register_legacy_irq_route(0, logical_bus_end, irq);
 }
 
-#[cfg(target_os = "none")]
+#[cfg(all(
+    target_os = "none",
+    any(
+        feature = "intel-net",
+        feature = "ixgbe",
+        feature = "realtek-rtl8125",
+        feature = "virtio-net",
+        feature = "xhci-pci",
+    )
+))]
 pub fn fdt_irq_for_endpoint(
     address: PciAddress,
     interrupt_pin: u8,
@@ -144,7 +180,16 @@ pub fn fdt_irq_for_endpoint(
     result.map(Some)
 }
 
-#[cfg(target_os = "none")]
+#[cfg(all(
+    target_os = "none",
+    any(
+        feature = "intel-net",
+        feature = "ixgbe",
+        feature = "realtek-rtl8125",
+        feature = "virtio-net",
+        feature = "xhci-pci",
+    )
+))]
 fn resolve_pci_irq_from_fdt(
     fdt: &Fdt,
     address: PciAddress,
@@ -214,7 +259,16 @@ fn resolve_pci_irq_from_fdt(
     })
 }
 
-#[cfg(target_os = "none")]
+#[cfg(all(
+    target_os = "none",
+    any(
+        feature = "intel-net",
+        feature = "ixgbe",
+        feature = "realtek-rtl8125",
+        feature = "virtio-net",
+        feature = "xhci-pci",
+    )
+))]
 fn decode_irq_cells(specifier: &[u32]) -> Option<usize> {
     match specifier {
         [irq] => Some(*irq as usize),
@@ -227,7 +281,7 @@ fn decode_irq_cells(specifier: &[u32]) -> Option<usize> {
     }
 }
 
-#[cfg(feature = "pci-list-devices")]
+#[cfg(feature = "list-pci-devices")]
 mod pci_list_devices {
     use log::info;
     use rdrive::probe::pci::{EndpointRc, FnOnProbe};
diff --git a/drivers/ax-driver/src/pci/mod.rs b/drivers/ax-driver/src/pci/mod.rs
index c6d063badb..440ba7e553 100644
--- a/drivers/ax-driver/src/pci/mod.rs
+++ b/drivers/ax-driver/src/pci/mod.rs
@@ -29,9 +29,19 @@ use virtio_drivers::transport::{
 #[cfg(virtio_dev)]
 use crate::virtio::VirtIoHalImpl;
 
-#[cfg(feature = "pci-fdt")]
+#[cfg(plat_dyn)]
 mod fdt;
-#[cfg(all(feature = "pci-fdt", target_os = "none"))]
+#[cfg(all(
+    plat_dyn,
+    target_os = "none",
+    any(
+        feature = "intel-net",
+        feature = "ixgbe",
+        feature = "realtek-rtl8125",
+        feature = "virtio-net",
+        feature = "xhci-pci",
+    )
+))]
 pub(crate) use fdt::fdt_irq_for_endpoint;
 
 const MAX_PCIE_LEGACY_IRQS: usize = 8;
@@ -105,7 +115,7 @@ pub const fn has_static_endpoint_drivers() -> bool {
         feature = "virtio-gpu",
         feature = "virtio-input",
         feature = "virtio-socket",
-        feature = "pci-list-devices",
+        feature = "list-pci-devices",
     ))
 }
 
diff --git a/drivers/ax-driver/src/serial/mod.rs b/drivers/ax-driver/src/serial/mod.rs
index 29fd470335..c6947174c0 100644
--- a/drivers/ax-driver/src/serial/mod.rs
+++ b/drivers/ax-driver/src/serial/mod.rs
@@ -14,7 +14,7 @@ crate::model_register!(
     level: ProbeLevel::PreKernel,
     priority: ProbePriority::DEFAULT,
     probe_kinds: &[ProbeKind::Fdt {
-        compatibles: &["arm,pl011", "snps,dw-apb-uart"],
+        compatibles: &["arm,pl011", "snps,dw-apb-uart", "ns16550a", "ns16550"],
         on_probe: probe
     }],
 );
@@ -49,7 +49,7 @@ fn probe(info: FdtInfo<'_>, plat_dev: PlatformDevice) -> Result<(), OnProbeError
             break;
         }
 
-        if compatible == "snps,dw-apb-uart" {
+        if matches!(compatible, "snps,dw-apb-uart" | "ns16550a" | "ns16550") {
             serial = Some(ns16550::Ns16550::new_mmio_boxed(
                 mmio_base, clock_freq, reg_width,
             ));
diff --git a/drivers/ax-driver/src/soc/mod.rs b/drivers/ax-driver/src/soc/mod.rs
index 050818eaf9..9724f5ccab 100644
--- a/drivers/ax-driver/src/soc/mod.rs
+++ b/drivers/ax-driver/src/soc/mod.rs
@@ -16,6 +16,8 @@
 mod rockchip;
 #[cfg(feature = "rockchip-dwmmc")]
 pub mod scmi;
+#[cfg(feature = "sg2002-placeholder")]
+mod sg2002;
 
 #[cfg(feature = "rockchip-soc")]
 pub use rockchip::{
diff --git a/drivers/ax-driver/src/soc/sg2002.rs b/drivers/ax-driver/src/soc/sg2002.rs
new file mode 100644
index 0000000000..30da06c141
--- /dev/null
+++ b/drivers/ax-driver/src/soc/sg2002.rs
@@ -0,0 +1,62 @@
+use log::info;
+use rdrive::{PlatformDevice, probe::OnProbeError, register::FdtInfo};
+
+const PLACEHOLDER_COMPATIBLES: &[&str] = &[
+    "cvitek,tpu",
+    "cvitek,cvitek-ion",
+    "cvitek,cvi-pwm",
+    "snps,dw-apb-gpio",
+    "cvitek,cv182x-usb",
+    "cvitek,cif",
+    "cvitek,mipi_tx",
+    "cvitek,sys",
+    "cvitek,base",
+    "cvitek,vi",
+    "cvitek,vpss",
+    "cvitek,ive",
+    "cvitek,vo",
+    "cvitek,fb",
+    "cvitek,dwa",
+    "cvitek,asic-vcodec",
+    "cvitek,asic-jpeg",
+    "cvitek,cvi_vc_drv",
+    "cvitek,rtos_cmdqu",
+    "cvitek,audio",
+    "cvitek,cv181x-thermal",
+];
+
+crate::model_register!(
+    name: "SG2002 placeholder",
+    level: ProbeLevel::PostKernel,
+    priority: ProbePriority::DEFAULT,
+    probe_kinds: &[ProbeKind::Fdt {
+        compatibles: &["cvitek,cv181x"],
+        on_probe: probe,
+    }],
+);
+
+fn probe(info: FdtInfo<'_>, _plat_dev: PlatformDevice) -> Result<(), OnProbeError> {
+    let mut mapped = 0usize;
+    for node in info.find_compatible(PLACEHOLDER_COMPATIBLES) {
+        for reg in node.regs() {
+            let Some(size) = reg.size else {
+                continue;
+            };
+            if size == 0 {
+                continue;
+            }
+            let mmio = crate::mmio::iomap(reg.address as usize, size as usize)?;
+            mapped += 1;
+            info!(
+                "SG2002 placeholder mapped {}: {:#x}+{:#x} -> {:#x}",
+                node.name(),
+                reg.address,
+                size,
+                mmio.as_ptr() as usize
+            );
+        }
+    }
+
+    info!("SG2002 placeholder mapped {mapped} region(s)");
+    Ok(())
+}
diff --git a/drivers/ax-driver/src/time.rs b/drivers/ax-driver/src/time.rs
index 590e194d51..eddffb2a87 100644
--- a/drivers/ax-driver/src/time.rs
+++ b/drivers/ax-driver/src/time.rs
@@ -1,6 +1,8 @@
-use ax_arm_pl031::Rtc;
+use ax_arm_pl031::Rtc as Pl031Rtc;
 use log::{debug, info};
 use rdrive::{PlatformDevice, probe::OnProbeError, register::FdtInfo};
+#[cfg(target_arch = "riscv64")]
+use riscv_goldfish::Rtc as GoldfishRtc;
 
 use crate::mmio::iomap;
 
@@ -10,11 +12,35 @@ crate::model_register!(
     priority: ProbePriority::DEFAULT,
     probe_kinds: &[ProbeKind::Fdt {
         compatibles: &["arm,pl031"],
-        on_probe: probe
+        on_probe: probe_pl031
     }],
 );
 
-fn probe(info: FdtInfo<'_>, _plat_dev: PlatformDevice) -> Result<(), OnProbeError> {
+#[cfg(target_arch = "riscv64")]
+crate::model_register!(
+    name: "goldfish rtc",
+    level: ProbeLevel::PostKernel,
+    priority: ProbePriority::DEFAULT,
+    probe_kinds: &[ProbeKind::Fdt {
+        compatibles: &["google,goldfish-rtc"],
+        on_probe: probe_goldfish
+    }],
+);
+
+fn probe_pl031(info: FdtInfo<'_>, _plat_dev: PlatformDevice) -> Result<(), OnProbeError> {
+    let mmio_base = map_first_reg(&info)?;
+    let rtc = unsafe { Pl031Rtc::new(mmio_base.as_ptr().cast()) };
+    init_epoch_offset(info.node.name(), u64::from(rtc.get_unix_timestamp()))
+}
+
+#[cfg(target_arch = "riscv64")]
+fn probe_goldfish(info: FdtInfo<'_>, _plat_dev: PlatformDevice) -> Result<(), OnProbeError> {
+    let mmio_base = map_first_reg(&info)?;
+    let rtc = GoldfishRtc::new(mmio_base.as_ptr() as usize);
+    init_epoch_offset(info.node.name(), rtc.get_unix_timestamp())
+}
+
+fn map_first_reg(info: &FdtInfo<'_>) -> Result<core::ptr::NonNull<u8>, OnProbeError> {
     let regs = info.node.regs();
     let Some(base_reg) = regs.first() else {
         return Err(OnProbeError::other(alloc::format!(
@@ -24,24 +50,21 @@ fn probe(info: FdtInfo<'_>, _plat_dev: PlatformDevice) -> Result<(), OnProbeErro
     };
 
     let mmio_size = base_reg.size.unwrap_or(0x1000);
-    let mmio_base = iomap(base_reg.address as usize, mmio_size as usize)?;
-    let rtc = unsafe { Rtc::new(mmio_base.as_ptr().cast()) };
-    let unix_timestamp = rtc.get_unix_timestamp();
+    iomap(base_reg.address as usize, mmio_size as usize)
+}
+
+fn init_epoch_offset(node_name: &str, unix_timestamp: u64) -> Result<(), OnProbeError> {
     if unix_timestamp == 0 {
         return Err(OnProbeError::other(alloc::format!(
-            "[{}] returned zero unix timestamp",
-            info.node.name()
+            "[{node_name}] returned zero unix timestamp"
         )));
     }
 
-    let epoch_time_nanos = u64::from(unix_timestamp) * 1_000_000_000;
+    let epoch_time_nanos = unix_timestamp * 1_000_000_000;
     if axklib::time::try_init_epoch_offset(epoch_time_nanos) {
-        info!("Initialized wall clock from {}", info.node.name());
+        info!("Initialized wall clock from {node_name}");
     } else {
-        debug!(
-            "Skipping RTC {} because epoch offset is already initialized",
-            info.node.name()
-        );
+        debug!("Skipping RTC {node_name} because epoch offset is already initialized",);
     }
 
     Ok(())
diff --git a/drivers/ax-driver/src/usb/mod.rs b/drivers/ax-driver/src/usb/mod.rs
index 1d76c99e08..9977cb1e49 100644
--- a/drivers/ax-driver/src/usb/mod.rs
+++ b/drivers/ax-driver/src/usb/mod.rs
@@ -240,7 +240,7 @@ fn pci_static_irq(endpoint: &rdrive::probe::pci::EndpointRc) -> Option<usize> {
 pub(crate) fn pci_irq_or_error(
     endpoint: &rdrive::probe::pci::EndpointRc,
 ) -> Result<usize, rdrive::probe::OnProbeError> {
-    #[cfg(feature = "pci-fdt")]
+    #[cfg(plat_dyn)]
     if let Some(irq) =
         crate::pci::fdt_irq_for_endpoint(endpoint.address(), endpoint.interrupt_pin())?
     {
diff --git a/drivers/ax-driver/src/virtio/block.rs b/drivers/ax-driver/src/virtio/block.rs
index 0eb6a863cf..8081ce07a7 100644
--- a/drivers/ax-driver/src/virtio/block.rs
+++ b/drivers/ax-driver/src/virtio/block.rs
@@ -3,7 +3,7 @@ extern crate alloc;
 use alloc::format;
 
 use rdrive::{DriverGeneric, PlatformDevice, probe::OnProbeError};
-#[cfg(any(probe = "fdt", probe = "pci"))]
+#[cfg(any(plat_dyn, plat_static))]
 use virtio_drivers::transport::DeviceType;
 use virtio_drivers::{
     Error as VirtIoError,
@@ -15,7 +15,7 @@ use crate::{block::PlatformDeviceBlock, virtio::VirtIoHalImpl};
 
 const VIRTIO_BLK_DMA_BUFFER_SIZE: usize = 32 * SECTOR_SIZE;
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 crate::model_register!(
     name: "VirtIO Block",
     level: ProbeLevel::PostKernel,
@@ -25,7 +25,7 @@ crate::model_register!(
     }],
 );
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 fn probe_pci(
     endpoint: &mut rdrive::probe::pci::EndpointRc,
     plat_dev: PlatformDevice,
@@ -34,7 +34,7 @@ fn probe_pci(
     register_transport(plat_dev, transport)
 }
 
-#[cfg(probe = "fdt")]
+#[cfg(plat_dyn)]
 crate::model_register!(
     name: "VirtIO MMIO Block",
     level: ProbeLevel::PostKernel,
@@ -45,7 +45,7 @@ crate::model_register!(
     }],
 );
 
-#[cfg(probe = "fdt")]
+#[cfg(plat_dyn)]
 fn probe_fdt(
     info: rdrive::register::FdtInfo<'_>,
     plat_dev: PlatformDevice,
diff --git a/drivers/ax-driver/src/virtio/display.rs b/drivers/ax-driver/src/virtio/display.rs
index 76e512c5a5..cf09df0f0e 100644
--- a/drivers/ax-driver/src/virtio/display.rs
+++ b/drivers/ax-driver/src/virtio/display.rs
@@ -4,13 +4,13 @@ use alloc::format;
 
 use rdif_display::{DisplayError, DisplayInfo, FrameBuffer, PixelFormat};
 use rdrive::{DriverGeneric, PlatformDevice, probe::OnProbeError};
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 use virtio_drivers::transport::DeviceType;
 use virtio_drivers::{Error as VirtIoError, device::gpu::VirtIOGpu, transport::Transport};
 
 use crate::{display::PlatformDeviceDisplay, virtio::VirtIoHalImpl};
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 crate::model_register!(
     name: "VirtIO GPU",
     level: ProbeLevel::PostKernel,
@@ -20,7 +20,7 @@ crate::model_register!(
     }],
 );
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 fn probe_pci(
     endpoint: &mut rdrive::probe::pci::EndpointRc,
     plat_dev: PlatformDevice,
diff --git a/drivers/ax-driver/src/virtio/input.rs b/drivers/ax-driver/src/virtio/input.rs
index a60e12d890..db93d0795e 100644
--- a/drivers/ax-driver/src/virtio/input.rs
+++ b/drivers/ax-driver/src/virtio/input.rs
@@ -4,7 +4,7 @@ use alloc::{borrow::ToOwned, format, string::String};
 
 use rdif_input::{AbsInfo, EventType, InputDeviceId, InputError, InputEvent};
 use rdrive::{DriverGeneric, PlatformDevice, probe::OnProbeError};
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 use virtio_drivers::transport::DeviceType;
 use virtio_drivers::{
     Error as VirtIoError,
@@ -14,7 +14,7 @@ use virtio_drivers::{
 
 use crate::{input::PlatformDeviceInput, virtio::VirtIoHalImpl};
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 crate::model_register!(
     name: "VirtIO Input",
     level: ProbeLevel::PostKernel,
@@ -24,7 +24,7 @@ crate::model_register!(
     }],
 );
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 fn probe_pci(
     endpoint: &mut rdrive::probe::pci::EndpointRc,
     plat_dev: PlatformDevice,
diff --git a/drivers/ax-driver/src/virtio/mod.rs b/drivers/ax-driver/src/virtio/mod.rs
index 8ace7d4174..9ac7d1d300 100644
--- a/drivers/ax-driver/src/virtio/mod.rs
+++ b/drivers/ax-driver/src/virtio/mod.rs
@@ -138,7 +138,7 @@ pub fn register_static_transport<T: Transport + 'static>(
     Err(rdrive::probe::OnProbeError::NotMatch)
 }
 
-#[cfg(probe = "fdt")]
+#[cfg(plat_dyn)]
 pub fn probe_fdt_mmio_device(
     info: &rdrive::register::FdtInfo<'_>,
 ) -> Result<(DeviceType, MmioTransport<'static>), rdrive::probe::OnProbeError> {
diff --git a/drivers/ax-driver/src/virtio/net.rs b/drivers/ax-driver/src/virtio/net.rs
index c89c3460cb..4e07c37579 100644
--- a/drivers/ax-driver/src/virtio/net.rs
+++ b/drivers/ax-driver/src/virtio/net.rs
@@ -9,7 +9,7 @@ use core::{
 use ax_kernel_guard::NoPreemptIrqSave;
 use rd_net::{DmaBuffer, Event, IRxQueue, ITxQueue, Interface, NetError, QueueConfig};
 use rdrive::{DriverGeneric, PlatformDevice, probe::OnProbeError};
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 use virtio_drivers::transport::DeviceType;
 use virtio_drivers::{Error as VirtIoError, device::net::VirtIONetRaw, transport::Transport};
 
@@ -21,7 +21,7 @@ use crate::{
 const QUEUE_SIZE: usize = 64;
 const BUFFER_SIZE: usize = 2048;
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 crate::model_register!(
     name: "VirtIO Net",
     level: ProbeLevel::PostKernel,
@@ -305,7 +305,7 @@ struct RxInflight {
     len: usize,
 }
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 fn probe_pci(
     endpoint: &mut rdrive::probe::pci::EndpointRc,
     plat_dev: PlatformDevice,
diff --git a/drivers/ax-driver/src/virtio/vsock.rs b/drivers/ax-driver/src/virtio/vsock.rs
index 5fd1eeb279..7571ac1e8e 100644
--- a/drivers/ax-driver/src/virtio/vsock.rs
+++ b/drivers/ax-driver/src/virtio/vsock.rs
@@ -4,7 +4,7 @@ use alloc::format;
 
 use rdif_vsock::{VsockAddr as RdifVsockAddr, VsockConnId, VsockError, VsockEvent};
 use rdrive::{DriverGeneric, PlatformDevice, probe::OnProbeError};
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 use virtio_drivers::transport::DeviceType;
 use virtio_drivers::{
     Error as VirtIoError,
@@ -19,7 +19,7 @@ use crate::{virtio::VirtIoHalImpl, vsock::PlatformDeviceVsock};
 
 const DEFAULT_RX_BUFFER_CAPACITY: u32 = 32 * 1024;
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 crate::model_register!(
     name: "VirtIO Socket",
     level: ProbeLevel::PostKernel,
@@ -29,7 +29,7 @@ crate::model_register!(
     }],
 );
 
-#[cfg(probe = "pci")]
+#[cfg(any(plat_static, plat_dyn))]
 fn probe_pci(
     endpoint: &mut rdrive::probe::pci::EndpointRc,
     plat_dev: PlatformDevice,
diff --git a/drivers/intc/riscv_plic/src/lib.rs b/drivers/intc/riscv_plic/src/lib.rs
index e3aadafcba..5de76cf2ab 100644
--- a/drivers/intc/riscv_plic/src/lib.rs
+++ b/drivers/intc/riscv_plic/src/lib.rs
@@ -65,6 +65,15 @@ pub struct Plic {
 unsafe impl Send for Plic {}
 unsafe impl Sync for Plic {}
 
+/// Lock-free PLIC operations used by interrupt entry code.
+#[derive(Clone, Copy)]
+pub struct PlicIrqHandler {
+    base: NonNull<PLICRegs>,
+}
+
+unsafe impl Send for PlicIrqHandler {}
+unsafe impl Sync for PlicIrqHandler {}
+
 impl Plic {
     /// Create a new instance of the PLIC from the base address.
     ///
@@ -76,9 +85,14 @@ impl Plic {
         Self { base }
     }
 
+    /// Returns a lock-free handler for per-context interrupt entry operations.
+    pub const fn irq_handler(&self) -> PlicIrqHandler {
+        PlicIrqHandler { base: self.base }
+    }
+
     /// Initialize the PLIC by context, setting the priority threshold to 0.
     pub fn init_by_context(&mut self, ctx: usize) {
-        self.regs().contexts[ctx].priority_threshold.set(0);
+        self.irq_handler().init_by_context(ctx);
     }
 
     const fn regs(&self) -> &PLICRegs {
@@ -190,7 +204,7 @@ impl Plic {
     /// See §8.
     #[inline]
     pub fn claim(&mut self, ctx: usize) -> Option<NonZeroU32> {
-        NonZeroU32::new(self.regs().contexts[ctx].interrupt_claim_complete.get())
+        self.irq_handler().claim(ctx)
     }
 
     /// Mark that interrupt identified by `source` is completed in `context`.
@@ -198,6 +212,27 @@ impl Plic {
     /// See §9.
     #[inline]
     pub fn complete(&mut self, ctx: usize, source: NonZeroU32) {
+        self.irq_handler().complete(ctx, source);
+    }
+}
+
+impl PlicIrqHandler {
+    const fn regs(&self) -> &PLICRegs {
+        unsafe { self.base.as_ref() }
+    }
+
+    /// Initialize the PLIC by context, setting the priority threshold to 0.
+    pub fn init_by_context(&self, ctx: usize) {
+        self.regs().contexts[ctx].priority_threshold.set(0);
+    }
+
+    /// Claim an interrupt in `context`, returning its source.
+    pub fn claim(&self, ctx: usize) -> Option<NonZeroU32> {
+        NonZeroU32::new(self.regs().contexts[ctx].interrupt_claim_complete.get())
+    }
+
+    /// Mark that interrupt identified by `source` is completed in `context`.
+    pub fn complete(&self, ctx: usize, source: NonZeroU32) {
         self.regs().contexts[ctx]
             .interrupt_claim_complete
             .set(source.get());
diff --git a/drivers/rdrive/src/probe/fdt/mod.rs b/drivers/rdrive/src/probe/fdt/mod.rs
index 923d4b8150..8531d0f1d5 100644
--- a/drivers/rdrive/src/probe/fdt/mod.rs
+++ b/drivers/rdrive/src/probe/fdt/mod.rs
@@ -56,6 +56,14 @@ pub struct FdtInfo<'a> {
 }
 
 impl<'a> FdtInfo<'a> {
+    pub fn get_by_phandle(&self, phandle: Phandle) -> Option<NodeType<'a>> {
+        system().get_by_phandle(phandle)
+    }
+
+    pub fn find_compatible(&self, compatible: &[&str]) -> Vec<NodeType<'a>> {
+        system().find_compatible(compatible)
+    }
+
     pub fn phandle_to_device_id(&self, phandle: Phandle) -> Option<DeviceId> {
         self.phandle_2_device_id.get(&phandle).copied()
     }
@@ -91,6 +99,14 @@ impl System {
         self.phandle_2_device_id.get(&phandle).copied()
     }
 
+    pub fn get_by_phandle(&self, phandle: Phandle) -> Option<NodeType<'_>> {
+        self.fdt.get_by_phandle(phandle)
+    }
+
+    pub fn find_compatible(&self, compatible: &[&str]) -> Vec<NodeType<'_>> {
+        self.fdt.find_compatible(compatible)
+    }
+
     pub fn new(fdt_addr: NonNull<u8>) -> Result<Self, DriverError> {
         let fdt = unsafe { Fdt::from_ptr(fdt_addr.as_ptr()) }
             .map_err(|error| DriverError::Fdt(format!("{error:?}")))?;
diff --git a/memory/page_table_entry/src/arch/riscv.rs b/memory/page_table_entry/src/arch/riscv.rs
index 7e43a0fe63..6eed06635c 100644
--- a/memory/page_table_entry/src/arch/riscv.rs
+++ b/memory/page_table_entry/src/arch/riscv.rs
@@ -118,16 +118,13 @@ impl Rv64PTE {
         #[cfg(feature = "xuantie-c9xx")]
         {
             // CPU T-Head XUANTIE-C9xx extended flags:
-            // Memory: Shareable, Bufferable, Cacheable, Non-strong-order
-            // Device: Shareable, Non-bufferable, Non-cacheable, Strong-order
             if mflags.contains(MappingFlags::DEVICE) {
                 self.0 |= (PTEFlags::SH | PTEFlags::SO).bits() as u64;
+            } else if mflags.contains(MappingFlags::UNCACHED) {
+                self.0 |= (PTEFlags::SH | PTEFlags::B).bits() as u64;
             } else {
                 self.0 |= (PTEFlags::SH | PTEFlags::B | PTEFlags::C).bits() as u64;
             }
-            if mflags.contains(MappingFlags::UNCACHED) {
-                self.0 &= !((PTEFlags::B | PTEFlags::C).bits() as u64);
-            }
         }
         self.0 |= (extended_flags & !Self::PHYS_ADDR_MASK);
         PTEFlags::from_bits_truncate(self.0 as usize)
diff --git a/os/StarryOS/configs/board/licheerv-nano-sg2002.toml b/os/StarryOS/configs/board/licheerv-nano-sg2002.toml
index 273b184467..03a58c86a0 100644
--- a/os/StarryOS/configs/board/licheerv-nano-sg2002.toml
+++ b/os/StarryOS/configs/board/licheerv-nano-sg2002.toml
@@ -1,7 +1,11 @@
 env = { UIMAGE = "y" }
 features = [
-  "sg2002",
+  "starry-kernel/sg2002",
+  "axplat-dyn/thead-mae",
+  "ax-driver/sg2002-placeholder",
+  "ax-driver/cvsd",
+  "ax-driver/serial",
 ]
 log = "Info"
-plat_dyn = false
+plat_dyn = true
 target = "riscv64gc-unknown-none-elf"
diff --git a/os/StarryOS/configs/board/orangepi-5-plus.toml b/os/StarryOS/configs/board/orangepi-5-plus.toml
index d3d5a0aa93..e88f614967 100644
--- a/os/StarryOS/configs/board/orangepi-5-plus.toml
+++ b/os/StarryOS/configs/board/orangepi-5-plus.toml
@@ -3,9 +3,7 @@ target = "aarch64-unknown-none-softfloat"
 # Runtime U-Boot settings live in `orangepi-5-plus-uboot.toml`.
 env = {}
 features = [
-  "ax-hal/plat-dyn",
-  "starry-kernel/plat-dyn",
-  "ax-driver/pci-list-devices",
+  "ax-driver/list-pci-devices",
   "ax-driver/rk3588-pcie",
   "ax-driver/realtek-rtl8125",
   "ax-driver/rockchip-soc",
diff --git a/os/StarryOS/configs/board/qemu-aarch64-dyn.toml b/os/StarryOS/configs/board/qemu-aarch64-dyn.toml
index d94a5bb8e3..72d8d8bd27 100644
--- a/os/StarryOS/configs/board/qemu-aarch64-dyn.toml
+++ b/os/StarryOS/configs/board/qemu-aarch64-dyn.toml
@@ -1,10 +1,8 @@
 env = {}
 features = [
-  "ax-hal/plat-dyn",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "starry-kernel/input",
-  "starry-kernel/plat-dyn",
   "starry-kernel/vsock",
   "ax-driver/intel-net",
 ]
diff --git a/os/StarryOS/configs/board/qemu-aarch64.toml b/os/StarryOS/configs/board/qemu-aarch64.toml
index 100371542c..be8795b4d2 100644
--- a/os/StarryOS/configs/board/qemu-aarch64.toml
+++ b/os/StarryOS/configs/board/qemu-aarch64.toml
@@ -2,7 +2,7 @@ env = {}
 features = [
   "ax-hal/aarch64-qemu-virt",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/os/StarryOS/configs/board/qemu-loongarch64.toml b/os/StarryOS/configs/board/qemu-loongarch64.toml
index 4c35f73930..664004de9a 100644
--- a/os/StarryOS/configs/board/qemu-loongarch64.toml
+++ b/os/StarryOS/configs/board/qemu-loongarch64.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/loongarch64-qemu-virt",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/os/StarryOS/configs/board/qemu-riscv64.toml b/os/StarryOS/configs/board/qemu-riscv64.toml
index 4902ae62f3..898a6e773d 100644
--- a/os/StarryOS/configs/board/qemu-riscv64.toml
+++ b/os/StarryOS/configs/board/qemu-riscv64.toml
@@ -1,8 +1,6 @@
 env = {}
 features = [
-  "ax-hal/riscv64-qemu-virt",
-  "qemu",
-  "ax-driver/pci",
+  "ax-driver/serial",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
@@ -10,5 +8,5 @@ features = [
   "ax-driver/virtio-socket",
 ]
 log = "Warn"
-plat_dyn = false
+plat_dyn = true
 target = "riscv64gc-unknown-none-elf"
diff --git a/os/StarryOS/configs/board/qemu-x86_64.toml b/os/StarryOS/configs/board/qemu-x86_64.toml
index 7efd9aa1bd..1128aa2eb9 100644
--- a/os/StarryOS/configs/board/qemu-x86_64.toml
+++ b/os/StarryOS/configs/board/qemu-x86_64.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/x86-pc",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/os/StarryOS/kernel/Cargo.toml b/os/StarryOS/kernel/Cargo.toml
index 8946edcbf6..ed0a4c35a5 100644
--- a/os/StarryOS/kernel/Cargo.toml
+++ b/os/StarryOS/kernel/Cargo.toml
@@ -22,6 +22,7 @@ ebpf = []
 memtrack = ["ax-feat/dwarf", "ax-alloc/tracking", "dep:gimli"]
 rknpu = ["dep:ax-driver", "ax-driver/rknpu"]
 plat-dyn = [
+    "ax-feat/plat-dyn",
     "dep:ax-driver",
     "ax-driver/usb",
     "dep:crab-usb",
diff --git a/os/StarryOS/kernel/src/file/mod.rs b/os/StarryOS/kernel/src/file/mod.rs
index 610aa1fbc4..49a438a4d9 100644
--- a/os/StarryOS/kernel/src/file/mod.rs
+++ b/os/StarryOS/kernel/src/file/mod.rs
@@ -2,7 +2,7 @@ pub mod epoll;
 pub mod event;
 mod fs;
 pub mod inotify;
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 pub mod ion;
 pub mod memfd;
 mod net;
diff --git a/os/StarryOS/kernel/src/pseudofs/dev/mod.rs b/os/StarryOS/kernel/src/pseudofs/dev/mod.rs
index fa482e1c1c..d2579d3bb2 100644
--- a/os/StarryOS/kernel/src/pseudofs/dev/mod.rs
+++ b/os/StarryOS/kernel/src/pseudofs/dev/mod.rs
@@ -16,7 +16,7 @@ mod r#loop;
 mod loop_block;
 #[cfg(feature = "ext4")]
 pub use r#loop::LoopDevice;
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 pub mod ion;
 #[cfg(feature = "memtrack")]
 mod memtrack;
@@ -24,19 +24,19 @@ mod memtrack;
 mod rknpu_card;
 #[cfg(all(feature = "rknpu", not(any(windows, unix))))]
 mod rknpu_drm;
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 pub mod tpu;
 pub mod tty;
 
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 mod cvi_camera;
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 mod cvi_usb_camera;
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 mod pinmux;
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 pub(super) mod pwm;
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 mod tty_serial;
 
 use alloc::{format, sync::Arc};
@@ -45,10 +45,10 @@ use core::any::Any;
 use ax_errno::AxError;
 use ax_sync::Mutex;
 use axfs_ng_vfs::{DeviceId, Filesystem, NodeFlags, NodeType, VfsResult};
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 use spin::Once;
 
-#[cfg(feature = "sg2002")]
+#[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
 pub static ION_DEVICE: Once<Arc<ion::IonDevice>> = Once::new();
 #[cfg(feature = "dev-log")]
 pub use log::bind_dev_log;
@@ -383,7 +383,7 @@ fn builder(fs: Arc<SimpleFs>) -> DirMaker {
         SimpleDir::new_maker(fs.clone(), Arc::new(event::input_devices(fs.clone()))),
     );
 
-    #[cfg(feature = "sg2002")]
+    #[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
     {
         root.add(
             "cvi-tpu0",
diff --git a/os/StarryOS/kernel/src/pseudofs/sysfs.rs b/os/StarryOS/kernel/src/pseudofs/sysfs.rs
index 44fa030137..7f3b5750de 100644
--- a/os/StarryOS/kernel/src/pseudofs/sysfs.rs
+++ b/os/StarryOS/kernel/src/pseudofs/sysfs.rs
@@ -186,9 +186,9 @@ struct ClassDir {
 
 impl SimpleDirOps for ClassDir {
     fn child_names<'a>(&'a self) -> Box<dyn Iterator<Item = Cow<'a, str>> + 'a> {
-        #[cfg(feature = "sg2002")]
+        #[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
         let names: &'static [&'static str] = &["drm", "graphics", "input", "pwm"];
-        #[cfg(not(feature = "sg2002"))]
+        #[cfg(any(not(feature = "sg2002"), feature = "plat-dyn"))]
         let names: &'static [&'static str] = &["drm", "graphics", "input"];
         Box::new(names.iter().copied().map(Cow::Borrowed))
     }
@@ -205,7 +205,7 @@ impl SimpleDirOps for ClassDir {
                 Arc::new(ClassSubsystemDir::new(fs, "graphics", &["fb0"])),
             ),
             "input" => SimpleDir::new_maker(fs.clone(), Arc::new(InputClassDir { fs })),
-            #[cfg(feature = "sg2002")]
+            #[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
             "pwm" => crate::pseudofs::dev::pwm::pwm_class_dir_maker(fs),
             _ => return Err(VfsError::NotFound),
         }))
diff --git a/os/StarryOS/kernel/src/syscall/mm/mmap.rs b/os/StarryOS/kernel/src/syscall/mm/mmap.rs
index 9f1d03e712..070855fd38 100644
--- a/os/StarryOS/kernel/src/syscall/mm/mmap.rs
+++ b/os/StarryOS/kernel/src/syscall/mm/mmap.rs
@@ -239,7 +239,7 @@ pub fn sys_mmap(
 
     // IonBufferFile 特殊处理：直接线性映射物理地址，跳过通用 file_mmap/device_mmap 路径。
     // 这样可以避免通用路径中 `range.start += offset` 对 Ion buffer 的错误偏移。
-    #[cfg(feature = "sg2002")]
+    #[cfg(all(feature = "sg2002", not(feature = "plat-dyn")))]
     if let Some(ref file) = file {
         use crate::file::ion::IonBufferFile;
         if let Some(ion_file) = file.downcast_ref::<IonBufferFile>() {
diff --git a/os/StarryOS/starryos/Cargo.toml b/os/StarryOS/starryos/Cargo.toml
index c9fb4538aa..36f14f6c0c 100644
--- a/os/StarryOS/starryos/Cargo.toml
+++ b/os/StarryOS/starryos/Cargo.toml
@@ -30,6 +30,13 @@ sg2002 = [
   "ax-hal/riscv64-sg2002",
   "starry-kernel/sg2002",
 ]
+sg2002-dyn = [
+  "plat-dyn",
+  "axplat-dyn/thead-mae",
+  "starry-kernel/sg2002",
+  "ax-driver/sg2002-placeholder",
+]
+plat-dyn = ["dep:axplat-dyn", "starry-kernel/plat-dyn"]
 
 # Enable the GICv3 distributor + redistributor + system-register
 # CPU interface on aarch64. Only meaningful when the target is the
diff --git a/os/arceos/README.md b/os/arceos/README.md
index 60aab66a23..4807d32caf 100644
--- a/os/arceos/README.md
+++ b/os/arceos/README.md
@@ -209,7 +209,7 @@ You may also need to select the corrsponding device drivers by setting the `FEAT
 # Build the shell app for raspi4, and use the SD card driver
 make MYPLAT=axplat-aarch64-raspi SMP=4 A=examples/shell FEATURES=page-alloc-4g,ax-driver/bcm2835-sdhci
 # Build httpserver for the bare-metal x86_64 platform, and use the ixgbe and ramdisk driver
-make PLAT_CONFIG=$(pwd)/configs/custom/x86_64-pc-oslab.toml A=examples/httpserver FEATURES=page-alloc-4g,ax-driver/pci,ax-driver/ixgbe,ax-driver/ramdisk SMP=4
+make PLAT_CONFIG=$(pwd)/configs/custom/x86_64-pc-oslab.toml A=examples/httpserver FEATURES=page-alloc-4g,ax-driver/plat-static,ax-driver/ixgbe,ax-driver/ramdisk SMP=4
 ```
 
 ## How to reuse ArceOS modules in your own project
diff --git a/os/arceos/api/axfeat/Cargo.toml b/os/arceos/api/axfeat/Cargo.toml
index 7712402f30..05657df2ec 100644
--- a/os/arceos/api/axfeat/Cargo.toml
+++ b/os/arceos/api/axfeat/Cargo.toml
@@ -28,7 +28,6 @@ ipi = ["irq", "dep:ax-ipi", "ax-hal/ipi", "ax-runtime/ipi", "ax-task?/ipi"]
 myplat = ["ax-hal/myplat"]
 defplat = ["ax-hal/defplat"]
 plat-dyn = [
-    "ax-hal/plat-dyn",
     "paging",
     "ax-runtime/plat-dyn",
     "ax-config/plat-dyn",
diff --git a/os/arceos/doc/ixgbe.md b/os/arceos/doc/ixgbe.md
index 23f1a8597f..4b6e7e340e 100644
--- a/os/arceos/doc/ixgbe.md
+++ b/os/arceos/doc/ixgbe.md
@@ -6,7 +6,7 @@ You can use the following command to compile an 'httpserver' app application:
 
 ```shell
 make PLAT_CONFIG=$(pwd)/configs/custom/x86_64-pc-oslab.toml defconfig
-make A=examples/httpserver PLAT_CONFIG=$(pwd)/configs/custom/x86_64-pc-oslab.toml FEATURES=ax-driver/pci,ax-driver/ixgbe
+make A=examples/httpserver PLAT_CONFIG=$(pwd)/configs/custom/x86_64-pc-oslab.toml FEATURES=ax-driver/plat-static,ax-driver/ixgbe
 ```
 
 You can also use the following command to start the iperf application:
@@ -14,7 +14,7 @@ You can also use the following command to start the iperf application:
 ```shell
 git clone https://github.com/arceos-org/arceos-apps.git
 make PLAT_CONFIG=$(pwd)/configs/custom/x86_64-pc-oslab.toml defconfig
-make A=arceos-apps/c/iperf PLAT_CONFIG=$(pwd)/configs/custom/x86_64-pc-oslab.toml FEATURES=ax-driver/pci,ax-driver/ixgbe,ax-driver/ramdisk
+make A=arceos-apps/c/iperf PLAT_CONFIG=$(pwd)/configs/custom/x86_64-pc-oslab.toml FEATURES=ax-driver/plat-static,ax-driver/ixgbe,ax-driver/ramdisk
 ```
 
 ## Use ixgbe NIC in QEMU with PCI passthrough
@@ -38,7 +38,7 @@ make A=arceos-apps/c/iperf PLAT_CONFIG=$(pwd)/configs/custom/x86_64-pc-oslab.tom
 3. Build and run ArceOS:
 
     ```shell
-    make A=examples/httpserver FEATURES=ax-driver/pci,ax-driver/ixgbe VFIO_PCI=02:00.0 IP=x.x.x.x GW=x.x.x.x run
+    make A=examples/httpserver FEATURES=ax-driver/plat-static,ax-driver/ixgbe VFIO_PCI=02:00.0 IP=x.x.x.x GW=x.x.x.x run
     ```
 
 4. If no longer in use, bind the NIC back to the `ixgbe` driver:
diff --git a/os/arceos/modules/axconfig/src/driver_dyn_config.rs b/os/arceos/modules/axconfig/src/driver_dyn_config.rs
index 3cc8bab13a..c97818c528 100644
--- a/os/arceos/modules/axconfig/src/driver_dyn_config.rs
+++ b/os/arceos/modules/axconfig/src/driver_dyn_config.rs
@@ -1,9 +1,49 @@
+#[cfg(target_arch = "aarch64")]
+mod arch {
+    pub const ARCH: &str = "aarch64";
+    pub const PACKAGE: &str = "axplat-aarch64-generic";
+    pub const PLATFORM: &str = "aarch64-generic";
+    pub const TIMER_IRQ: usize = 0xf0;
+    pub const IPI_IRQ: usize = 0;
+    pub const KERNEL_ASPACE_BASE: usize = 0xffff_8000_0000_0000;
+    pub const KERNEL_ASPACE_SIZE: usize = 0x0000_7fff_ffff_f000;
+    pub const KERNEL_BASE_PADDR: usize = 0x20_0000;
+    pub const KERNEL_BASE_VADDR: usize = 0xffff_8000_0020_0000;
+}
+
+#[cfg(target_arch = "riscv64")]
+mod arch {
+    pub const ARCH: &str = "riscv64";
+    pub const PACKAGE: &str = "axplat-dyn";
+    pub const PLATFORM: &str = "riscv64-plat-dyn";
+    const INTERRUPT_FLAG: usize = 1usize << (usize::BITS as usize - 1);
+    pub const TIMER_IRQ: usize = INTERRUPT_FLAG | 5;
+    pub const IPI_IRQ: usize = INTERRUPT_FLAG | 1;
+    pub const KERNEL_ASPACE_BASE: usize = 0xffff_ffc0_0000_0000;
+    pub const KERNEL_ASPACE_SIZE: usize = 0x0000_003f_ffff_f000;
+    pub const KERNEL_BASE_PADDR: usize = 0x8020_0000;
+    pub const KERNEL_BASE_VADDR: usize = 0xffff_ffff_8000_0000;
+}
+
+#[cfg(not(any(target_arch = "aarch64", target_arch = "riscv64")))]
+mod arch {
+    pub const ARCH: &str = "aarch64";
+    pub const PACKAGE: &str = "axplat-aarch64-generic";
+    pub const PLATFORM: &str = "aarch64-generic";
+    pub const TIMER_IRQ: usize = 0xf0;
+    pub const IPI_IRQ: usize = 0;
+    pub const KERNEL_ASPACE_BASE: usize = 0xffff_8000_0000_0000;
+    pub const KERNEL_ASPACE_SIZE: usize = 0x0000_7fff_ffff_f000;
+    pub const KERNEL_BASE_PADDR: usize = 0x20_0000;
+    pub const KERNEL_BASE_VADDR: usize = 0xffff_8000_0020_0000;
+}
+
 #[doc = " Architecture identifier."]
-pub const ARCH: &str = "aarch64";
+pub const ARCH: &str = arch::ARCH;
 #[doc = " Platform package."]
-pub const PACKAGE: &str = "axplat-aarch64-generic";
+pub const PACKAGE: &str = arch::PACKAGE;
 #[doc = " Platform identifier."]
-pub const PLATFORM: &str = "aarch64-generic";
+pub const PLATFORM: &str = arch::PLATFORM;
 #[doc = " Stack size of each task."]
 pub const TASK_STACK_SIZE: usize = 0x40000;
 #[doc = " Number of timer ticks per second (Hz). A timer tick may contain several timer"]
@@ -28,9 +68,9 @@ pub mod devices {
     #[doc = " PCI device memory ranges."]
     pub const PCI_RANGES: &[(usize, usize)] = &[];
     #[doc = " Timer interrupt num (PPI, physical timer)."]
-    pub const TIMER_IRQ: usize = 0xf0;
+    pub const TIMER_IRQ: usize = super::arch::TIMER_IRQ;
     #[doc = " IPI interrupt num."]
-    pub const IPI_IRQ: usize = 0;
+    pub const IPI_IRQ: usize = super::arch::IPI_IRQ;
     #[doc = " VirtIO MMIO regions with format (`base_paddr`, `size`)."]
     pub const VIRTIO_MMIO_REGIONS: &[(usize, usize)] = &[];
     #[doc = " SDMMC controller physical address."]
@@ -54,13 +94,13 @@ pub mod plat {
     #[doc = " Platform family (deprecated)."]
     pub const FAMILY: &str = "";
     #[doc = " Kernel address space base."]
-    pub const KERNEL_ASPACE_BASE: usize = 0xffff_8000_0000_0000;
+    pub const KERNEL_ASPACE_BASE: usize = super::arch::KERNEL_ASPACE_BASE;
     #[doc = " Kernel address space size."]
-    pub const KERNEL_ASPACE_SIZE: usize = 0x0000_7fff_ffff_f000;
+    pub const KERNEL_ASPACE_SIZE: usize = super::arch::KERNEL_ASPACE_SIZE;
     #[doc = " No need."]
-    pub const KERNEL_BASE_PADDR: usize = 0x20_0000;
+    pub const KERNEL_BASE_PADDR: usize = super::arch::KERNEL_BASE_PADDR;
     #[doc = " Base virtual address of the kernel image."]
-    pub const KERNEL_BASE_VADDR: usize = 0xffff_8000_0020_0000;
+    pub const KERNEL_BASE_VADDR: usize = super::arch::KERNEL_BASE_VADDR;
     #[doc = " Offset of bus address and phys address. some boards, the bus address is"]
     #[doc = " different from the physical address."]
     pub const PHYS_BUS_OFFSET: usize = 0;
diff --git a/os/arceos/modules/axhal/Cargo.toml b/os/arceos/modules/axhal/Cargo.toml
index 9e4fb56fd9..ec775a64c8 100644
--- a/os/arceos/modules/axhal/Cargo.toml
+++ b/os/arceos/modules/axhal/Cargo.toml
@@ -102,10 +102,6 @@ aarch64-phytium-pi = ["dep:ax-plat-aarch64-phytium-pi"]
 riscv64-qemu-virt = ["dep:ax-plat-riscv64-qemu-virt"]
 riscv64-sg2002 = ["dep:ax-plat-riscv64-sg2002"]
 riscv64-visionfive2 = ["dep:ax-plat-riscv64-visionfive2"]
-riscv64-qemu-virt-hv = [
-    "dep:ax-plat-riscv64-qemu-virt",
-    "ax-plat-riscv64-qemu-virt/hypervisor",
-]
 loongarch64-qemu-virt = ["dep:ax-plat-loongarch64-qemu-virt"]
 x86-qemu-q35 = ["dep:ax-plat-x86-qemu-q35", "ax-plat-x86-qemu-q35/reboot-on-system-off"]
 defplat = [
diff --git a/os/arceos/modules/axhal/build.rs b/os/arceos/modules/axhal/build.rs
index 116ca0125c..0354c4b780 100644
--- a/os/arceos/modules/axhal/build.rs
+++ b/os/arceos/modules/axhal/build.rs
@@ -65,11 +65,6 @@ const PLATFORM_FEATURES: &[PlatformFeature] = &[
         target_arch: Some("riscv64"),
         crate_name: "ax_plat_riscv64_visionfive2",
     },
-    PlatformFeature {
-        feature: "riscv64-qemu-virt-hv",
-        target_arch: Some("riscv64"),
-        crate_name: "ax_plat_riscv64_qemu_virt",
-    },
     PlatformFeature {
         feature: "loongarch64-qemu-virt",
         target_arch: Some("loongarch64"),
diff --git a/os/arceos/modules/axruntime/Cargo.toml b/os/arceos/modules/axruntime/Cargo.toml
index 9babc5ff1d..65230c060e 100644
--- a/os/arceos/modules/axruntime/Cargo.toml
+++ b/os/arceos/modules/axruntime/Cargo.toml
@@ -22,6 +22,7 @@ stack-guard-page = ["multitask", "paging", "ax-task/stack-guard-page"]
 tls = ["ax-hal/tls", "ax-task?/tls"]
 
 plat-dyn = [
+  "ax-driver/plat-dyn",
   "ax-hal/plat-dyn",
   "paging",
   "buddy-slab",
diff --git a/os/arceos/modules/axruntime/src/devices.rs b/os/arceos/modules/axruntime/src/devices.rs
index f7bfe6643f..f218302dfe 100644
--- a/os/arceos/modules/axruntime/src/devices.rs
+++ b/os/arceos/modules/axruntime/src/devices.rs
@@ -1,5 +1,9 @@
 pub(crate) fn probe_all_devices() {
     info!("Probe platform devices...");
+    if !rdrive::is_initialized() {
+        warn!("rdrive is not initialized; skip platform device probe");
+        return;
+    }
     rdrive::probe_all(false)
         .unwrap_or_else(|err| panic!("failed to probe platform devices: {err:?}"));
 }
@@ -9,6 +13,9 @@ pub(crate) fn take_dyn_fs_block_devices()
 -> alloc::vec::Vec<alloc::boxed::Box<dyn ax_fs::FsBlockDevice>> {
     #[cfg(target_os = "none")]
     {
+        if !rdrive::is_initialized() {
+            return alloc::vec::Vec::new();
+        }
         ax_driver::block::take_block_devices()
             .into_iter()
             .map(|dev| {
@@ -39,6 +46,9 @@ pub(crate) fn take_dyn_fs_ng_block_devices()
 -> alloc::vec::Vec<alloc::boxed::Box<dyn ax_fs_ng::FsBlockDevice>> {
     #[cfg(target_os = "none")]
     {
+        if !rdrive::is_initialized() {
+            return alloc::vec::Vec::new();
+        }
         ax_driver::block::take_block_devices()
             .into_iter()
             .map(|dev| {
@@ -68,6 +78,10 @@ pub(crate) fn take_static_fs_ng_block_devices()
 pub(crate) fn init_dyn_display() {
     #[cfg(target_os = "none")]
     {
+        if !rdrive::is_initialized() {
+            ax_display::init_display(core::iter::empty::<ax_display::ErasedDisplayDevice>());
+            return;
+        }
         let devices = ax_driver::display::take_display_devices()
             .unwrap_or_else(|err| panic!("failed to open display devices: {err:?}"))
             .into_iter()
@@ -100,6 +114,10 @@ pub(crate) fn init_static_display() {
 pub(crate) fn init_dyn_input() {
     #[cfg(target_os = "none")]
     {
+        if !rdrive::is_initialized() {
+            ax_input::init_input(core::iter::empty::<ax_input::ErasedInputDevice>());
+            return;
+        }
         let devices = ax_driver::input::take_input_devices()
             .unwrap_or_else(|err| panic!("failed to open input devices: {err:?}"))
             .into_iter()
@@ -170,6 +188,10 @@ pub(crate) fn take_static_net_ng_drivers()
 pub(crate) fn init_dyn_vsock() {
     #[cfg(target_os = "none")]
     {
+        if !rdrive::is_initialized() {
+            ax_net_ng::init_vsock(alloc::vec::Vec::new());
+            return;
+        }
         let devices = ax_driver::vsock::take_vsock_devices()
             .unwrap_or_else(|err| panic!("failed to open vsock devices: {err:?}"));
         ax_net_ng::init_vsock(devices);
@@ -190,6 +212,9 @@ pub(crate) fn init_static_vsock() {
 fn take_dyn_net_drivers() -> alloc::vec::Vec<alloc::boxed::Box<dyn ax_net::EthernetDriver>> {
     #[cfg(target_os = "none")]
     {
+        if !rdrive::is_initialized() {
+            return alloc::vec::Vec::new();
+        }
         let mut devices = alloc::vec::Vec::new();
         for dev in rdrive::get_list::<ax_driver::net::PlatformNetDevice>() {
             let (net, name, irq_num) = ax_driver::net::take_rd_net_device(dev)
@@ -211,6 +236,9 @@ fn take_dyn_net_drivers() -> alloc::vec::Vec<alloc::boxed::Box<dyn ax_net::Ether
 fn take_dyn_net_ng_drivers() -> alloc::vec::Vec<alloc::boxed::Box<dyn ax_net_ng::EthernetDriver>> {
     #[cfg(target_os = "none")]
     {
+        if !rdrive::is_initialized() {
+            return alloc::vec::Vec::new();
+        }
         let mut devices = alloc::vec::Vec::new();
         for dev in rdrive::get_list::<ax_driver::net::PlatformNetDevice>() {
             let (net, name, irq_num) = ax_driver::net::take_rd_net_device(dev)
diff --git a/os/arceos/modules/axruntime/src/lib.rs b/os/arceos/modules/axruntime/src/lib.rs
index 1e0b544099..61cba02dee 100644
--- a/os/arceos/modules/axruntime/src/lib.rs
+++ b/os/arceos/modules/axruntime/src/lib.rs
@@ -243,13 +243,17 @@ pub fn rust_main(cpu_id: usize, arg: usize) -> ! {
 
     info!("Initialize platform devices...");
     ax_hal::init_later(cpu_id, arg);
-    if !rdrive::is_initialized() {
+    if cfg!(not(feature = "plat-dyn")) && !rdrive::is_initialized() {
         rdrive::init(rdrive::Platform::Static)
             .unwrap_or_else(|err| panic!("failed to initialize static rdrive source: {err:?}"));
     }
-    registers::append_linker_registers();
-    rdrive::probe_pre_kernel()
-        .unwrap_or_else(|err| panic!("failed to run pre-kernel driver probes: {err:?}"));
+    if rdrive::is_initialized() {
+        registers::append_linker_registers();
+        rdrive::probe_pre_kernel()
+            .unwrap_or_else(|err| panic!("failed to run pre-kernel driver probes: {err:?}"));
+    } else {
+        warn!("rdrive is not initialized; skip pre-kernel driver probe");
+    }
 
     #[cfg(feature = "multitask")]
     ax_task::init_scheduler();
diff --git a/os/arceos/ulib/arceos-rust/lib/Cargo.toml b/os/arceos/ulib/arceos-rust/lib/Cargo.toml
index be7f862865..a9a5e45157 100644
--- a/os/arceos/ulib/arceos-rust/lib/Cargo.toml
+++ b/os/arceos/ulib/arceos-rust/lib/Cargo.toml
@@ -61,11 +61,11 @@ stack-guard-page = ["multitask", "paging", "ax-feat/stack-guard-page"]
 
 # File system
 fd = ["ax-posix-api/fd"]
-fs = ["ax-api/fs", "ax-posix-api/fs", "ax-feat/fs", "ax-driver/pci", "ax-driver/virtio-blk"]
+fs = ["ax-api/fs", "ax-posix-api/fs", "ax-feat/fs", "ax-driver/virtio-blk"]
 
 # Networking
 dns = []
-net = ["ax-api/net", "ax-posix-api/net", "ax-posix-api/poll", "ax-feat/net", "ax-driver/pci", "ax-driver/virtio-net"]
+net = ["ax-api/net", "ax-posix-api/net", "ax-posix-api/poll", "ax-feat/net", "ax-driver/virtio-net"]
 
 # Display
 display = ["ax-api/display", "ax-feat/display"]
diff --git a/os/axvisor/Cargo.toml b/os/axvisor/Cargo.toml
index 296e6fa451..ca265eb539 100644
--- a/os/axvisor/Cargo.toml
+++ b/os/axvisor/Cargo.toml
@@ -105,7 +105,6 @@ arm-gic-driver = { workspace = true, features = ["rdif"] }
 [target.'cfg(target_arch = "loongarch64")'.dependencies]
 ax-plat-loongarch64-qemu-virt = { workspace = true, default-features = false, features = ["irq", "smp"] }
 [target.'cfg(target_arch = "riscv64")'.dependencies]
-ax-plat-riscv64-qemu-virt = { workspace = true, features = ["hypervisor"] }
 riscv_vcpu = { workspace = true }
 riscv_vplic = { workspace = true }
 # xtask dependencies (only used on host platforms)
diff --git a/os/axvisor/configs/board/qemu-aarch64.toml b/os/axvisor/configs/board/qemu-aarch64.toml
index 317e9aae7c..ed80bad75a 100644
--- a/os/axvisor/configs/board/qemu-aarch64.toml
+++ b/os/axvisor/configs/board/qemu-aarch64.toml
@@ -1,6 +1,5 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
-  "ax-hal/plat-dyn",
     "ept-level-4",
     "ax-driver/virtio-blk",
     "fs",
diff --git a/os/axvisor/configs/board/qemu-loongarch64.toml b/os/axvisor/configs/board/qemu-loongarch64.toml
index b7945d66d0..06e413dfe1 100644
--- a/os/axvisor/configs/board/qemu-loongarch64.toml
+++ b/os/axvisor/configs/board/qemu-loongarch64.toml
@@ -2,7 +2,7 @@ env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
   "ax-hal/loongarch64-qemu-virt",
   "ax-driver/virtio-blk",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ept-level-4",
   "fs",
 ]
diff --git a/os/axvisor/configs/board/qemu-riscv64.toml b/os/axvisor/configs/board/qemu-riscv64.toml
index da0062ef6c..ab922ad886 100644
--- a/os/axvisor/configs/board/qemu-riscv64.toml
+++ b/os/axvisor/configs/board/qemu-riscv64.toml
@@ -1,13 +1,12 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
-    "ax-hal/riscv64-qemu-virt-hv",
-    "ax-driver/fdt",
     "ax-driver/virtio-blk",
     "ept-level-4",
     "fs",
     "sstc"
 ]
 log = "Info"
+plat_dyn = true
 target = "riscv64gc-unknown-none-elf"
 vm_configs = []
 max_cpu_num = 4
diff --git a/os/axvisor/configs/board/qemu-x86_64.toml b/os/axvisor/configs/board/qemu-x86_64.toml
index 64e99f9093..ffae3f21b0 100644
--- a/os/axvisor/configs/board/qemu-x86_64.toml
+++ b/os/axvisor/configs/board/qemu-x86_64.toml
@@ -2,7 +2,7 @@ env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
     "ax-hal/x86-qemu-q35",
     "ax-driver/virtio-blk",
-    "ax-driver/pci",
+    "ax-driver/plat-static",
     "ept-level-4",
     "fs",
 ]
diff --git a/os/axvisor/configs/board/rdk-s100.toml b/os/axvisor/configs/board/rdk-s100.toml
index 252da5797d..c8a96cc301 100644
--- a/os/axvisor/configs/board/rdk-s100.toml
+++ b/os/axvisor/configs/board/rdk-s100.toml
@@ -1,6 +1,5 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
-  "ax-hal/plat-dyn",
     "ept-level-4",
 ]
 log = "Info"
diff --git a/os/axvisor/configs/board/tac-e400.toml b/os/axvisor/configs/board/tac-e400.toml
index 252da5797d..c8a96cc301 100644
--- a/os/axvisor/configs/board/tac-e400.toml
+++ b/os/axvisor/configs/board/tac-e400.toml
@@ -1,6 +1,5 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
-  "ax-hal/plat-dyn",
     "ept-level-4",
 ]
 log = "Info"
diff --git a/os/axvisor/src/hal/arch/riscv64/api.rs b/os/axvisor/src/hal/arch/riscv64/api.rs
index 93241c1d35..7a845e27f1 100644
--- a/os/axvisor/src/hal/arch/riscv64/api.rs
+++ b/os/axvisor/src/hal/arch/riscv64/api.rs
@@ -1,5 +1,6 @@
+#[cfg(not(feature = "dyn-plat"))]
+compile_error!("riscv64 Axvisor requires the dyn-plat feature");
+
 pub(super) fn init_platform_irq_injector() {
-    ax_plat_riscv64_qemu_virt::irq::register_virtual_irq_injector(
-        crate::hal::arch::inject_interrupt,
-    );
+    axplat_dyn::register_virtual_irq_injector(crate::hal::arch::inject_interrupt);
 }
diff --git a/os/axvisor/src/hal/arch/riscv64/mod.rs b/os/axvisor/src/hal/arch/riscv64/mod.rs
index 75b0987487..71dd44c6a0 100644
--- a/os/axvisor/src/hal/arch/riscv64/mod.rs
+++ b/os/axvisor/src/hal/arch/riscv64/mod.rs
@@ -2,10 +2,11 @@ mod api;
 pub mod cache;
 
 use crate::vmm::vm_list::get_vm_by_id;
-use ax_plat_riscv64_qemu_virt::config::devices::PLIC_PADDR;
 use axaddrspace::{GuestPhysAddr, device::AccessWidth};
 use axvisor_api::vmm::current_vm_id;
 
+const GUEST_PLIC_PADDR: usize = 0x0c00_0000;
+
 pub fn hardware_check() {
     api::init_platform_irq_injector();
     // TODO: implement hardware checks for RISC-V64
@@ -19,12 +20,12 @@ pub fn inject_interrupt(irq_id: usize) {
     let vplic = get_vm_by_id(current_vm_id())
         .unwrap()
         .get_devices()
-        .find_mmio_dev(GuestPhysAddr::from_usize(PLIC_PADDR))
+        .find_mmio_dev(GuestPhysAddr::from_usize(GUEST_PLIC_PADDR))
         .unwrap();
 
     // Calulate the pending register offset and value.
     let reg_offset = riscv_vplic::PLIC_PENDING_OFFSET + (irq_id / 32) * 4;
-    let addr = GuestPhysAddr::from_usize(PLIC_PADDR + reg_offset);
+    let addr = GuestPhysAddr::from_usize(GUEST_PLIC_PADDR + reg_offset);
     let width = AccessWidth::Dword;
     let val: u32 = 1 << (irq_id % 32);
 
diff --git a/platforms/ax-plat-aarch64-qemu-virt/Cargo.toml b/platforms/ax-plat-aarch64-qemu-virt/Cargo.toml
index 677f394324..1eb9dbd453 100644
--- a/platforms/ax-plat-aarch64-qemu-virt/Cargo.toml
+++ b/platforms/ax-plat-aarch64-qemu-virt/Cargo.toml
@@ -30,7 +30,7 @@ ax-page-table-entry = { workspace = true }
 ax-config-macros = { workspace = true }
 ax-plat-aarch64-peripherals = { workspace = true }
 ax-cpu = { workspace = true }
-ax-driver = { workspace = true, features = ["pci", "virtio"] }
+ax-driver = { workspace = true, features = ["plat-static", "virtio"] }
 ax-plat = { workspace = true }
 axklib = { workspace = true, optional = true }
 mmio-api.workspace = true
diff --git a/platforms/ax-plat-loongarch64-qemu-virt/Cargo.toml b/platforms/ax-plat-loongarch64-qemu-virt/Cargo.toml
index b0132ff62b..bbef34aa55 100644
--- a/platforms/ax-plat-loongarch64-qemu-virt/Cargo.toml
+++ b/platforms/ax-plat-loongarch64-qemu-virt/Cargo.toml
@@ -27,7 +27,7 @@ uart_16550 = "0.5"
 
 ax-config-macros = { workspace = true }
 ax-cpu = { workspace = true }
-ax-driver = { workspace = true, features = ["pci"] }
+ax-driver = { workspace = true, features = ["plat-static"] }
 ax-plat = { workspace = true }
 axklib = { workspace = true, optional = true }
 mmio-api.workspace = true
diff --git a/platforms/ax-plat-riscv64-qemu-virt/Cargo.toml b/platforms/ax-plat-riscv64-qemu-virt/Cargo.toml
index 12bdbd40fa..a66a880d29 100644
--- a/platforms/ax-plat-riscv64-qemu-virt/Cargo.toml
+++ b/platforms/ax-plat-riscv64-qemu-virt/Cargo.toml
@@ -29,7 +29,7 @@ some-serial.workspace = true
 
 ax-config-macros = { workspace = true }
 ax-cpu = { workspace = true }
-ax-driver = { workspace = true, features = ["pci", "virtio"] }
+ax-driver = { workspace = true, features = ["plat-static", "virtio"] }
 ax-plat = { workspace = true }
 axklib = { workspace = true, optional = true }
 mmio-api.workspace = true
diff --git a/platforms/ax-plat-riscv64-sg2002/Cargo.toml b/platforms/ax-plat-riscv64-sg2002/Cargo.toml
index c09cd6fae9..b76056eb81 100644
--- a/platforms/ax-plat-riscv64-sg2002/Cargo.toml
+++ b/platforms/ax-plat-riscv64-sg2002/Cargo.toml
@@ -24,7 +24,7 @@ smp = ["ax-plat/smp", "ax-kspin/smp"]
 log = { workspace = true }
 ax-config-macros = { workspace = true }
 ax-cpu = { workspace = true, features = ["xuantie-c9xx"] }
-ax-driver = { workspace = true, features = ["block"] }
+ax-driver = { workspace = true, features = ["plat-static", "block"] }
 ax-kspin = { workspace = true }
 ax-lazyinit = { workspace = true }
 ax-plat = { workspace = true }
diff --git a/platforms/ax-plat-x86-pc/Cargo.toml b/platforms/ax-plat-x86-pc/Cargo.toml
index 7c035e9652..b544c201c8 100644
--- a/platforms/ax-plat-x86-pc/Cargo.toml
+++ b/platforms/ax-plat-x86-pc/Cargo.toml
@@ -26,7 +26,7 @@ ax-percpu.workspace = true
 heapless = "0.9"
 ax-config-macros = { workspace = true }
 ax-cpu = { workspace = true }
-ax-driver = { workspace = true, features = ["pci"] }
+ax-driver = { workspace = true, features = ["plat-static"] }
 ax-plat = { workspace = true }
 axklib.workspace = true
 
diff --git a/platforms/ax-plat-x86-qemu-q35/Cargo.toml b/platforms/ax-plat-x86-qemu-q35/Cargo.toml
index f4cd07df20..484bbdb6db 100644
--- a/platforms/ax-plat-x86-qemu-q35/Cargo.toml
+++ b/platforms/ax-plat-x86-qemu-q35/Cargo.toml
@@ -26,7 +26,7 @@ smp = ["ax-plat/smp", "ax-kspin/smp"]
 [target.'cfg(target_arch = "x86_64")'.dependencies]
 ax-config-macros = { workspace = true }
 ax-cpu = { workspace = true, features = ["arm-el2"] }
-ax-driver = { workspace = true, features = ["pci"] }
+ax-driver = { workspace = true, features = ["plat-static"] }
 ax-plat.workspace = true
 axklib.workspace = true
 bitflags = "2.6"
diff --git a/platforms/axplat-dyn/Cargo.toml b/platforms/axplat-dyn/Cargo.toml
index aef1d5d1e6..d7e9fdcea1 100644
--- a/platforms/axplat-dyn/Cargo.toml
+++ b/platforms/axplat-dyn/Cargo.toml
@@ -17,12 +17,13 @@ rtc = []
 fp-simd = ["ax-cpu/fp-simd"]
 uspace = ["somehal/uspace"]
 hv = ["somehal/hv", "ax-cpu/arm-el2"]
+thead-mae = ["somehal/thead-mae", "ax-cpu/xuantie-c9xx"]
 
 [dependencies]
 anyhow = { version = "1", default-features = false }
 ax-config-macros = { workspace = true }
 ax-cpu.workspace = true
-ax-driver = { workspace = true, features = ["fdt", "pci-fdt"] }
+ax-driver = { workspace = true, features = ["plat-dyn"] }
 ax-errno.workspace = true
 axklib.workspace = true
 ax-plat.workspace = true
diff --git a/platforms/axplat-dyn/src/boot.rs b/platforms/axplat-dyn/src/boot.rs
index d1b16cc13a..667a2860d3 100644
--- a/platforms/axplat-dyn/src/boot.rs
+++ b/platforms/axplat-dyn/src/boot.rs
@@ -11,7 +11,7 @@ fn main() -> ! {
         args = fdt;
     }
 
-    ax_plat::call_main(somehal::smp::cpu_idx(), args)
+    ax_plat::call_main(somehal::smp::early_current_cpu_idx(), args)
 }
 
 #[somehal::secondary_entry]
diff --git a/platforms/axplat-dyn/src/drivers/mod.rs b/platforms/axplat-dyn/src/drivers/mod.rs
index c2d12a2374..9edd46844a 100644
--- a/platforms/axplat-dyn/src/drivers/mod.rs
+++ b/platforms/axplat-dyn/src/drivers/mod.rs
@@ -1,5 +1,9 @@
 use ax_errno::AxError;
 
 pub fn probe_all_devices() -> Result<(), AxError> {
+    if !rdrive::is_initialized() {
+        warn!("rdrive is not initialized; skip platform device probe");
+        return Ok(());
+    }
     rdrive::probe_all(false).map_err(|_| AxError::BadState)
 }
diff --git a/platforms/axplat-dyn/src/init.rs b/platforms/axplat-dyn/src/init.rs
index d68349a3e8..190995198f 100644
--- a/platforms/axplat-dyn/src/init.rs
+++ b/platforms/axplat-dyn/src/init.rs
@@ -9,7 +9,9 @@ impl InitIf for InitIfImpl {
     /// This function should be called immediately after the kernel has booted,
     /// and performed earliest platform configuration and initialization (e.g.,
     /// early console, clocking).
-    fn init_early(_cpu_id: usize, _dtb: usize) {
+    fn init_early(cpu_id: usize, _dtb: usize) {
+        #[cfg(target_arch = "riscv64")]
+        somehal::arch::register_current_cpu_id(cpu_id, ax_plat::percpu::this_cpu_id);
         ax_cpu::init::init_trap();
         #[cfg(all(target_arch = "aarch64", feature = "fp-simd"))]
         {
@@ -21,7 +23,9 @@ impl InitIf for InitIfImpl {
 
     /// Initializes the platform at the early stage for secondary cores.
     #[cfg(feature = "smp")]
-    fn init_early_secondary(_cpu_id: usize) {
+    fn init_early_secondary(cpu_id: usize) {
+        #[cfg(target_arch = "riscv64")]
+        somehal::arch::register_current_cpu_id(cpu_id, ax_plat::percpu::this_cpu_id);
         ax_cpu::init::init_trap();
         #[cfg(all(target_arch = "aarch64", feature = "fp-simd"))]
         {
diff --git a/platforms/axplat-dyn/src/irq.rs b/platforms/axplat-dyn/src/irq.rs
index 254eaa3253..54c9c9c60a 100644
--- a/platforms/axplat-dyn/src/irq.rs
+++ b/platforms/axplat-dyn/src/irq.rs
@@ -1,12 +1,37 @@
+use core::sync::atomic::{AtomicPtr, Ordering};
+
 use ax_plat::irq::{HandlerTable, IrqHandler, IrqIf};
 use somehal::irq_handler;
 
 /// The maximum number of IRQs.
 const MAX_IRQ_COUNT: usize = 1024;
+#[cfg(target_arch = "aarch64")]
 const GIC_SPECIAL_IRQ_START: usize = 1020;
 
+#[cfg(target_arch = "riscv64")]
+const INTC_IRQ_BASE: usize = 1usize << (usize::BITS as usize - 1);
+#[cfg(target_arch = "riscv64")]
+const S_SOFT: usize = INTC_IRQ_BASE | 1;
+#[cfg(target_arch = "riscv64")]
+const S_TIMER: usize = INTC_IRQ_BASE | 5;
+#[cfg(target_arch = "riscv64")]
+const S_EXT: usize = INTC_IRQ_BASE | 9;
+
 static IRQ_HANDLER_TABLE: HandlerTable<MAX_IRQ_COUNT> = HandlerTable::new();
 
+#[cfg(target_arch = "riscv64")]
+static TIMER_HANDLER: AtomicPtr<()> = AtomicPtr::new(core::ptr::null_mut());
+#[cfg(target_arch = "riscv64")]
+static IPI_HANDLER: AtomicPtr<()> = AtomicPtr::new(core::ptr::null_mut());
+
+#[cfg(all(target_arch = "riscv64", feature = "hv"))]
+static VIRTUAL_IRQ_INJECTOR: AtomicPtr<()> = AtomicPtr::new(core::ptr::null_mut());
+
+#[cfg(all(target_arch = "riscv64", feature = "hv"))]
+pub fn register_virtual_irq_injector(injector: fn(usize)) {
+    VIRTUAL_IRQ_INJECTOR.store(injector as *mut (), Ordering::Release);
+}
+
 struct IrqIfImpl;
 
 #[impl_plat_interface]
@@ -23,6 +48,18 @@ impl IrqIf for IrqIfImpl {
     fn register(irq_num: usize, handler: IrqHandler) -> bool {
         debug!("register handler IRQ {}", irq_num);
 
+        #[cfg(target_arch = "riscv64")]
+        {
+            if register_local_irq(irq_num, handler) {
+                Self::set_enable(irq_num, true);
+                return true;
+            }
+            if is_riscv_local_irq(irq_num) {
+                warn!("register handler for local IRQ {} failed", irq_num);
+                return false;
+            }
+        }
+
         if IRQ_HANDLER_TABLE.register_handler(irq_num, handler) {
             Self::set_enable(irq_num, true);
             return true;
@@ -38,6 +75,15 @@ impl IrqIf for IrqIfImpl {
     fn unregister(irq_num: usize) -> Option<IrqHandler> {
         trace!("unregister handler IRQ {}", irq_num);
         Self::set_enable(irq_num, false);
+        #[cfg(target_arch = "riscv64")]
+        {
+            if let Some(handler) = unregister_local_irq(irq_num) {
+                return Some(handler);
+            }
+            if is_riscv_local_irq(irq_num) {
+                return None;
+            }
+        }
         IRQ_HANDLER_TABLE.unregister_handler(irq_num)
     }
 
@@ -46,8 +92,8 @@ impl IrqIf for IrqIfImpl {
     /// It is called by the common interrupt handler. It should look up in the
     /// IRQ handler table and calls the corresponding handler. If necessary, it
     /// also acknowledges the interrupt controller after handling.
-    fn handle(_irq_num: usize) -> Option<usize> {
-        let irq = somehal::irq::irq_handler_raw();
+    fn handle(irq_num: usize) -> Option<usize> {
+        let irq = somehal::irq::irq_handler_with_raw(irq_num)?;
         Some(irq.raw())
     }
 
@@ -67,11 +113,102 @@ impl IrqIf for IrqIfImpl {
 
 #[irq_handler]
 fn somehal_handle_irq(irq: somehal::irq::IrqId) {
+    #[cfg(target_arch = "aarch64")]
     if irq.raw() >= GIC_SPECIAL_IRQ_START {
         trace!("Ignoring special IRQ {irq:?}");
         return;
     }
-    if !IRQ_HANDLER_TABLE.handle(irq.raw()) {
+
+    #[cfg(target_arch = "riscv64")]
+    if handle_riscv_local_irq(irq.raw()) {
+        return;
+    }
+
+    #[cfg(all(target_arch = "riscv64", feature = "hv"))]
+    if inject_virtual_irq(irq.raw()) {
+        return;
+    }
+
+    if irq.raw() < MAX_IRQ_COUNT && IRQ_HANDLER_TABLE.handle(irq.raw()) {
+        return;
+    }
+
+    if irq.raw() >= MAX_IRQ_COUNT {
+        warn!("IRQ {irq:?} is outside handler table");
+    } else {
         warn!("Unhandled IRQ {irq:?}");
     }
 }
+
+#[cfg(target_arch = "riscv64")]
+fn is_riscv_local_irq(irq: usize) -> bool {
+    matches!(irq, S_TIMER | S_SOFT | S_EXT) || irq & INTC_IRQ_BASE != 0
+}
+
+#[cfg(target_arch = "riscv64")]
+fn register_local_irq(irq: usize, handler: IrqHandler) -> bool {
+    let slot = match irq {
+        S_TIMER => &TIMER_HANDLER,
+        S_SOFT => &IPI_HANDLER,
+        S_EXT => return false,
+        _ => return false,
+    };
+    slot.compare_exchange(
+        core::ptr::null_mut(),
+        handler as *mut (),
+        Ordering::AcqRel,
+        Ordering::Acquire,
+    )
+    .is_ok()
+}
+
+#[cfg(target_arch = "riscv64")]
+fn unregister_local_irq(irq: usize) -> Option<IrqHandler> {
+    let slot = match irq {
+        S_TIMER => &TIMER_HANDLER,
+        S_SOFT => &IPI_HANDLER,
+        _ => return None,
+    };
+    let handler = slot.swap(core::ptr::null_mut(), Ordering::AcqRel);
+    if handler.is_null() {
+        None
+    } else {
+        Some(unsafe { core::mem::transmute::<*mut (), IrqHandler>(handler) })
+    }
+}
+
+#[cfg(target_arch = "riscv64")]
+fn handle_riscv_local_irq(irq: usize) -> bool {
+    let slot = match irq {
+        S_TIMER => &TIMER_HANDLER,
+        S_SOFT => &IPI_HANDLER,
+        S_EXT => return false,
+        _ if irq & INTC_IRQ_BASE != 0 => {
+            warn!("Unhandled RISC-V local IRQ {irq:#x}");
+            return true;
+        }
+        _ => return false,
+    };
+    let handler = slot.load(Ordering::Acquire);
+    if handler.is_null() {
+        warn!("Unhandled RISC-V local IRQ {irq:#x}");
+        return true;
+    }
+    unsafe {
+        core::mem::transmute::<*mut (), IrqHandler>(handler)(irq);
+    }
+    true
+}
+
+#[cfg(all(target_arch = "riscv64", feature = "hv"))]
+fn inject_virtual_irq(irq: usize) -> bool {
+    let injector = VIRTUAL_IRQ_INJECTOR.load(Ordering::Acquire);
+    if injector.is_null() {
+        warn!("virtual IRQ injector is not registered");
+        return false;
+    }
+    unsafe {
+        core::mem::transmute::<*mut (), fn(usize)>(injector)(irq);
+    }
+    true
+}
diff --git a/platforms/axplat-dyn/src/lib.rs b/platforms/axplat-dyn/src/lib.rs
index ffb0a89ee8..cabac9f71a 100644
--- a/platforms/axplat-dyn/src/lib.rs
+++ b/platforms/axplat-dyn/src/lib.rs
@@ -27,6 +27,8 @@ fn somehal_handle_irq(_irq: somehal::irq::IrqId) {}
 
 pub use boot::boot_stack_bounds;
 pub use generic_timer::try_init_epoch_offset;
+#[cfg(all(feature = "irq", target_arch = "riscv64", feature = "hv"))]
+pub use irq::register_virtual_irq_injector;
 
 // pub mod config {
 //     //! Platform configuration module.
diff --git a/platforms/somehal/Cargo.toml b/platforms/somehal/Cargo.toml
index 97b6cd2394..274ddf5562 100644
--- a/platforms/somehal/Cargo.toml
+++ b/platforms/somehal/Cargo.toml
@@ -14,6 +14,7 @@ efi = ["someboot/efi"]
 hv = ["mmu", "someboot/hv"]
 mmu = ["someboot/mmu"]
 percpu-prealloc = ["someboot/percpu-prealloc"]
+thead-mae = ["someboot/thead-mae"]
 uspace = ["mmu", "someboot/uspace"]
 
 [dependencies]
@@ -34,3 +35,8 @@ spin = { workspace = true }
 [target.'cfg(target_arch = "aarch64")'.dependencies]
 aarch64-cpu = "11"
 arm-gic-driver = {workspace = true, features = ["rdif"]}
+
+[target.'cfg(target_arch = "riscv64")'.dependencies]
+ax-riscv-plic = { workspace = true }
+riscv = "0.15"
+sbi-rt = { version = "0.0.3", features = ["legacy"] }
diff --git a/platforms/somehal/src/arch/aarch64/mod.rs b/platforms/somehal/src/arch/aarch64/mod.rs
index 063fb5ae98..2200602ced 100644
--- a/platforms/somehal/src/arch/aarch64/mod.rs
+++ b/platforms/somehal/src/arch/aarch64/mod.rs
@@ -24,7 +24,7 @@ impl PlatOp for Plat {
 
     fn secondary_init() {}
 
-    fn secondary_init_intc() {
+    fn secondary_init_intc(_cpu_idx: usize) {
         gic::init_current_cpu();
     }
 
diff --git a/platforms/somehal/src/arch/loongarch64/mod.rs b/platforms/somehal/src/arch/loongarch64/mod.rs
index 589a8c1266..078425f223 100644
--- a/platforms/somehal/src/arch/loongarch64/mod.rs
+++ b/platforms/somehal/src/arch/loongarch64/mod.rs
@@ -15,7 +15,7 @@ impl PlatOp for Plat {
 
     fn secondary_init() {}
 
-    fn secondary_init_intc() {}
+    fn secondary_init_intc(_cpu_idx: usize) {}
 
     fn secondary_init_systick() {}
 }
diff --git a/platforms/somehal/src/arch/riscv64/mod.rs b/platforms/somehal/src/arch/riscv64/mod.rs
index b3ff36e065..55552474e4 100644
--- a/platforms/somehal/src/arch/riscv64/mod.rs
+++ b/platforms/somehal/src/arch/riscv64/mod.rs
@@ -1,27 +1,54 @@
 use crate::common::PlatOp;
 
+mod plic;
+
 pub struct Plat;
 
+pub fn register_current_cpu_id(cpu_idx: usize, reader: fn() -> usize) {
+    plic::register_current_cpu_id(cpu_idx, reader);
+}
+
 impl PlatOp for Plat {
     fn irq_set_enable(irq: rdrive::IrqId, enable: bool) {
-        let raw: usize = irq.into();
-        let irq = someboot::irq::IrqId::new(raw);
-        if irq == someboot::irq::systimer_irq() {
-            someboot::irq::irq_set_enable(irq, enable);
-        }
+        plic::irq_set_enable(irq, enable);
     }
 
     fn irq_handler() -> someboot::irq::IrqId {
-        someboot::irq::systimer_irq()
+        someboot::irq::IrqId::new(plic::systick_irq().raw())
+    }
+
+    fn irq_handler_with_raw(raw: usize) -> Option<someboot::irq::IrqId> {
+        plic::irq_handler_with_raw(raw)
     }
 
     fn systick_irq() -> rdrive::IrqId {
-        someboot::irq::systimer_irq().raw().into()
+        plic::systick_irq()
     }
 
     fn secondary_init() {}
 
-    fn secondary_init_intc() {}
+    fn secondary_init_intc(cpu_idx: usize) {
+        plic::secondary_init_intc(cpu_idx);
+    }
 
     fn secondary_init_systick() {}
+
+    fn send_ipi(_irq: rdrive::IrqId, target: crate::irq::IpiTarget) {
+        match target {
+            crate::irq::IpiTarget::Current { cpu_id } | crate::irq::IpiTarget::Other { cpu_id } => {
+                plic::send_ipi_to_cpu(cpu_id);
+            }
+            crate::irq::IpiTarget::AllExceptCurrent { cpu_id, cpu_num } => {
+                for target_cpu in 0..cpu_num {
+                    if target_cpu != cpu_id {
+                        plic::send_ipi_to_cpu(target_cpu);
+                    }
+                }
+            }
+        }
+    }
+
+    fn send_ipi_to_cpu(cpu_id: usize) {
+        plic::send_ipi_to_cpu(cpu_id);
+    }
 }
diff --git a/platforms/somehal/src/arch/riscv64/plic.rs b/platforms/somehal/src/arch/riscv64/plic.rs
new file mode 100644
index 0000000000..a4ac2a72e6
--- /dev/null
+++ b/platforms/somehal/src/arch/riscv64/plic.rs
@@ -0,0 +1,393 @@
+use alloc::{format, vec::Vec};
+use core::{
+    num::NonZeroU32,
+    ptr::NonNull,
+    sync::atomic::{AtomicPtr, Ordering},
+};
+
+use ax_riscv_plic::{PLICRegs, Plic, PlicIrqHandler};
+use kernutil::StaticCell;
+use rdif_intc::Interface;
+use rdrive::{
+    Device, DriverGeneric, Phandle, PlatformDevice, module_driver,
+    probe::{OnProbeError, fdt::NodeType},
+    register::FdtInfo,
+};
+use riscv::register::{sie, sip};
+use sbi_rt::HartMask;
+
+use crate::{common::ioremap, irq::_handle_irq};
+
+const INTC_IRQ_BASE: usize = 1usize << (usize::BITS as usize - 1);
+const S_SOFT: usize = INTC_IRQ_BASE | 1;
+const S_TIMER: usize = INTC_IRQ_BASE | 5;
+const S_EXT: usize = INTC_IRQ_BASE | 9;
+const SUPERVISOR_EXTERNAL_INTERRUPT: u32 = 9;
+const DEFAULT_PRIORITY: u32 = 1;
+const DEFAULT_PLIC_SIZE: usize = 0x400_0000;
+
+static IRQ_HANDLER: StaticCell<RiscvPlicIrqHandler> = StaticCell::uninit();
+static CURRENT_CPU_ID: AtomicPtr<()> = AtomicPtr::new(core::ptr::null_mut());
+
+module_driver!(
+    name: "RISC-V PLIC",
+    level: ProbeLevel::PreKernel,
+    priority: ProbePriority::INTC,
+    probe_kinds: &[ProbeKind::Fdt {
+        compatibles: &[
+            "riscv,plic0",
+            "sifive,plic-1.0.0",
+            "starfive,jh7110-plic",
+        ],
+        on_probe: probe_plic
+    }],
+);
+
+pub fn systick_irq() -> rdrive::IrqId {
+    S_TIMER.into()
+}
+
+pub fn register_current_cpu_id(_cpu_idx: usize, reader: fn() -> usize) {
+    CURRENT_CPU_ID.store(reader as *mut (), Ordering::Release);
+}
+
+pub fn irq_set_enable(irq: rdrive::IrqId, enable: bool) {
+    let raw: usize = irq.into();
+    match raw {
+        S_TIMER => unsafe {
+            if enable {
+                sie::set_stimer();
+            } else {
+                sie::clear_stimer();
+            }
+        },
+        S_SOFT => unsafe {
+            if enable {
+                sie::set_ssoft();
+            } else {
+                sie::clear_ssoft();
+            }
+        },
+        S_EXT => unsafe {
+            if enable {
+                sie::set_sext();
+            } else {
+                sie::clear_sext();
+            }
+        },
+        external if external & INTC_IRQ_BASE == 0 => set_external_irq_enable(external, enable),
+        other => warn!("unsupported RISC-V local IRQ {other:#x}"),
+    }
+}
+
+pub fn irq_handler_with_raw(raw: usize) -> Option<someboot::irq::IrqId> {
+    match raw {
+        S_TIMER => {
+            _handle_irq(S_TIMER.into());
+            Some(S_TIMER.into())
+        }
+        S_SOFT => {
+            unsafe {
+                sip::clear_ssoft();
+            }
+            _handle_irq(S_SOFT.into());
+            Some(S_SOFT.into())
+        }
+        S_EXT => handle_external_irq(),
+        external if external & INTC_IRQ_BASE == 0 => {
+            _handle_irq(external.into());
+            Some(external.into())
+        }
+        other => {
+            warn!("unsupported RISC-V interrupt cause {other:#x}");
+            None
+        }
+    }
+}
+
+pub fn secondary_init_intc(cpu_idx: usize) {
+    enable_local_interrupts();
+    if let Some(handler) = get_irq_handler() {
+        handler.init_context(cpu_idx);
+    }
+}
+
+pub fn send_ipi_to_cpu(cpu_id: usize) {
+    let Some(hart_id) = someboot::smp::cpu_idx_to_id(cpu_id) else {
+        warn!("failed to resolve hart id for logical CPU {cpu_id}");
+        return;
+    };
+    let res = sbi_rt::send_ipi(HartMask::from_mask_base(1, hart_id));
+    if !res.is_ok() {
+        warn!("send_ipi to hart {hart_id} failed: {res:?}");
+    }
+}
+
+fn probe_plic(info: FdtInfo<'_>, dev: PlatformDevice) -> Result<(), OnProbeError> {
+    let reg = info
+        .node
+        .regs()
+        .into_iter()
+        .next()
+        .ok_or_else(|| OnProbeError::other(format!("[{}] has no reg", info.node.name())))?;
+    let mmio = ioremap(
+        reg.address,
+        reg.size.unwrap_or(DEFAULT_PLIC_SIZE as u64) as usize,
+    )
+    .map_err(|err| OnProbeError::other(format!("failed to map PLIC: {err:?}")))?;
+    let plic = unsafe {
+        Plic::new(
+            NonNull::new(mmio.as_ptr() as *mut PLICRegs)
+                .ok_or_else(|| OnProbeError::other("PLIC MMIO mapping is null"))?,
+        )
+    };
+    let ndev = info
+        .node
+        .as_node()
+        .get_property("riscv,ndev")
+        .and_then(|prop| prop.get_u32())
+        .unwrap_or(1024) as usize;
+    let contexts = parse_supervisor_contexts(&info);
+
+    let irq_handler = RiscvPlicIrqHandler {
+        inner: plic.irq_handler(),
+        context_by_cpu: contexts.clone(),
+    };
+    IRQ_HANDLER.init(irq_handler);
+    IRQ_HANDLER.init_current_context();
+    let plic = RiscvPlic {
+        inner: plic,
+        context_by_cpu: contexts,
+        sources: ndev,
+    };
+    enable_local_interrupts();
+
+    dev.register(rdif_intc::Intc::new(plic));
+    Ok(())
+}
+
+fn parse_supervisor_contexts(info: &FdtInfo<'_>) -> Vec<Option<usize>> {
+    let mut contexts = Vec::new();
+    let Some(prop) = info.node.as_node().get_property("interrupts-extended") else {
+        return contexts;
+    };
+
+    let mut reader = prop.as_reader();
+    let mut context = 0;
+    while let (Some(phandle), Some(interrupt)) = (reader.read_u32(), reader.read_u32()) {
+        if interrupt == SUPERVISOR_EXTERNAL_INTERRUPT
+            && let Some(cpu_idx) = cpu_idx_from_intc_phandle(info, Phandle::from(phandle))
+        {
+            if contexts.len() <= cpu_idx {
+                contexts.resize(cpu_idx + 1, None);
+            }
+            contexts[cpu_idx] = Some(context);
+        }
+        context += 1;
+    }
+    contexts
+}
+
+fn cpu_idx_from_intc_phandle(info: &FdtInfo<'_>, phandle: Phandle) -> Option<usize> {
+    let intc = info.get_by_phandle(phandle)?;
+    if let Some(cpu_idx) = intc.parent().and_then(|cpu| cpu_idx_from_cpu_node(&cpu)) {
+        return Some(cpu_idx);
+    }
+    let cpu = info.get_by_phandle(intc.as_node().interrupt_parent()?)?;
+    cpu_idx_from_cpu_node(&cpu)
+}
+
+fn cpu_idx_from_cpu_node(cpu: &NodeType<'_>) -> Option<usize> {
+    let hart_id = cpu.regs().first()?.address as usize;
+    someboot::smp::cpu_id_to_idx(hart_id)
+}
+
+fn enable_local_interrupts() {
+    unsafe {
+        sie::set_ssoft();
+        sie::set_stimer();
+        sie::set_sext();
+    }
+}
+
+fn set_external_irq_enable(irq: usize, enable: bool) {
+    let Some(source) = NonZeroU32::new(irq as u32) else {
+        return;
+    };
+    with_plic("setting PLIC IRQ enable", |plic| {
+        if enable {
+            plic.enable_source(source);
+        } else {
+            plic.disable_source(source);
+        }
+    });
+}
+
+fn handle_external_irq() -> Option<someboot::irq::IrqId> {
+    let Some(handler) = get_irq_handler() else {
+        warn!("RISC-V PLIC IRQ handler is not registered for external IRQ");
+        return None;
+    };
+    let source = handler.claim_current()?;
+    let irq = someboot::irq::IrqId::new(source.get() as usize);
+    _handle_irq(irq.raw().into());
+    handler.complete_current(source);
+    Some(irq)
+}
+
+fn with_plic<R>(op: &str, f: impl FnOnce(&mut RiscvPlic) -> R) -> Option<R> {
+    let Some(intc) = get_plic() else {
+        warn!("RISC-V PLIC is not registered when {op}");
+        return None;
+    };
+    let Ok(mut intc) = intc.lock() else {
+        warn!("failed to lock RISC-V PLIC when {op}");
+        return None;
+    };
+    let Some(plic) = intc.typed_mut::<RiscvPlic>() else {
+        warn!("registered interrupt controller is not RISC-V PLIC when {op}");
+        return None;
+    };
+    Some(f(plic))
+}
+
+fn get_plic() -> Option<Device<rdif_intc::Intc>> {
+    if !rdrive::is_initialized() {
+        return None;
+    }
+    rdrive::get_one()
+}
+
+fn get_irq_handler() -> Option<&'static RiscvPlicIrqHandler> {
+    if IRQ_HANDLER.is_init() {
+        Some(&IRQ_HANDLER)
+    } else {
+        None
+    }
+}
+
+struct RiscvPlic {
+    inner: Plic,
+    context_by_cpu: Vec<Option<usize>>,
+    sources: usize,
+}
+
+struct RiscvPlicIrqHandler {
+    inner: PlicIrqHandler,
+    context_by_cpu: Vec<Option<usize>>,
+}
+
+impl RiscvPlicIrqHandler {
+    fn current_context(&self) -> Option<usize> {
+        current_context(&self.context_by_cpu)
+    }
+
+    fn init_current_context(&self) {
+        if let Some(context) = self.current_context() {
+            self.init_context_by_context_id(context);
+        } else {
+            warn_missing_current_context();
+        }
+    }
+
+    fn init_context(&self, cpu_idx: usize) {
+        if let Some(context) = self.context_by_cpu.get(cpu_idx).and_then(|ctx| *ctx) {
+            self.init_context_by_context_id(context);
+        } else {
+            warn!("PLIC supervisor context for logical CPU {cpu_idx} is not found");
+        }
+    }
+
+    fn init_context_by_context_id(&self, context: usize) {
+        self.inner.init_by_context(context);
+        trace!("PLIC context {context} initialized");
+    }
+
+    fn claim_current(&self) -> Option<NonZeroU32> {
+        let Some(context) = self.current_context() else {
+            warn_missing_current_context();
+            return None;
+        };
+        let Some(source) = self.inner.claim(context) else {
+            debug!("Spurious external IRQ");
+            return None;
+        };
+        Some(source)
+    }
+
+    fn complete_current(&self, source: NonZeroU32) {
+        let Some(context) = self.current_context() else {
+            warn_missing_current_context();
+            return;
+        };
+        self.inner.complete(context, source);
+    }
+}
+
+impl RiscvPlic {
+    fn enable_source(&mut self, source: NonZeroU32) {
+        if source.get() as usize > self.sources {
+            warn!("skip enabling out-of-range PLIC source {}", source.get());
+            return;
+        }
+        self.inner.set_priority(source, DEFAULT_PRIORITY);
+        let current = current_context(&self.context_by_cpu);
+        for context in self.context_by_cpu.iter().filter_map(|context| *context) {
+            self.inner.enable(source, context);
+        }
+        if current.is_none() {
+            warn_missing_current_context();
+        }
+    }
+
+    fn disable_source(&mut self, source: NonZeroU32) {
+        for context in self.context_by_cpu.iter().filter_map(|context| *context) {
+            self.inner.disable(source, context);
+        }
+    }
+}
+
+fn current_context(context_by_cpu: &[Option<usize>]) -> Option<usize> {
+    let cpu_idx = current_cpu_idx()?;
+    context_by_cpu.get(cpu_idx).and_then(|ctx| *ctx)
+}
+
+fn current_cpu_idx() -> Option<usize> {
+    let reader = CURRENT_CPU_ID.load(Ordering::Acquire);
+    if !reader.is_null() {
+        let reader = unsafe { core::mem::transmute::<*mut (), fn() -> usize>(reader) };
+        return Some(reader());
+    }
+
+    someboot::smp::try_early_cpu_idx()
+}
+
+fn warn_missing_current_context() {
+    if let Some(cpu_idx) = current_cpu_idx() {
+        warn!("PLIC supervisor context for logical CPU {cpu_idx} is not found");
+    } else {
+        warn!("PLIC supervisor context for current logical CPU is not found");
+    }
+}
+
+impl DriverGeneric for RiscvPlic {
+    fn name(&self) -> &str {
+        "RISC-V PLIC"
+    }
+}
+
+impl Interface for RiscvPlic {
+    fn setup_irq_by_fdt(&mut self, irq_prop: &[u32]) -> rdrive::IrqId {
+        let Some(source) = irq_prop.first().copied().map(|source| source as usize) else {
+            warn!("empty PLIC interrupt specifier");
+            return 0usize.into();
+        };
+        if source > self.sources {
+            warn!(
+                "PLIC interrupt source {} exceeds riscv,ndev {}",
+                source, self.sources
+            );
+        }
+        source.into()
+    }
+}
diff --git a/platforms/somehal/src/arch/x86_64/mod.rs b/platforms/somehal/src/arch/x86_64/mod.rs
index b4da28abf0..be2d02e560 100644
--- a/platforms/somehal/src/arch/x86_64/mod.rs
+++ b/platforms/somehal/src/arch/x86_64/mod.rs
@@ -22,7 +22,7 @@ impl PlatOp for Plat {
 
     fn secondary_init() {}
 
-    fn secondary_init_intc() {}
+    fn secondary_init_intc(_cpu_idx: usize) {}
 
     fn secondary_init_systick() {}
 }
diff --git a/platforms/somehal/src/common.rs b/platforms/somehal/src/common.rs
index f58cc8e5a8..d36fe418d7 100644
--- a/platforms/somehal/src/common.rs
+++ b/platforms/somehal/src/common.rs
@@ -12,13 +12,22 @@ pub trait PlatOp {
 
     fn irq_handler() -> someboot::irq::IrqId;
 
+    fn irq_handler_with_raw(raw: usize) -> Option<someboot::irq::IrqId> {
+        let _ = raw;
+        Some(Self::irq_handler())
+    }
+
     fn systick_irq() -> IrqId;
 
     fn secondary_init();
 
-    fn secondary_init_intc();
+    fn secondary_init_intc(cpu_idx: usize);
 
     fn secondary_init_systick();
+
+    fn send_ipi_to_cpu(cpu_id: usize) {
+        let _ = cpu_id;
+    }
 }
 
 #[allow(dead_code)]
diff --git a/platforms/somehal/src/driver.rs b/platforms/somehal/src/driver.rs
index 7cc021f467..0336f165c9 100644
--- a/platforms/somehal/src/driver.rs
+++ b/platforms/somehal/src/driver.rs
@@ -7,5 +7,17 @@ pub fn rdrive_setup() {
             addr: NonNull::new(addr).unwrap(),
         })
         .unwrap();
+    } else if let Some(rsdp) = someboot::rsdp_addr_phys() {
+        info!("Initializing rdrive with ACPI RSDP at {:#x}", rsdp);
+        if let Err(err) = rdrive::init(rdrive::Platform::Acpi(rdrive::probe::acpi::AcpiRoot {
+            rsdp,
+        })) {
+            warn!(
+                "failed to initialize rdrive with ACPI RSDP {:#x}: {:?}",
+                rsdp, err
+            );
+        }
+    } else {
+        warn!("No FDT or ACPI RSDP found; skip rdrive initialization");
     }
 }
diff --git a/platforms/somehal/src/irq.rs b/platforms/somehal/src/irq.rs
index 8d976368e6..7ae604567e 100644
--- a/platforms/somehal/src/irq.rs
+++ b/platforms/somehal/src/irq.rs
@@ -59,3 +59,11 @@ pub(crate) fn _handle_irq(hwirq: IrqId) {
 pub fn irq_handler_raw() -> IrqId {
     Plat::irq_handler().raw().into()
 }
+
+pub fn irq_handler_with_raw(raw: usize) -> Option<IrqId> {
+    Plat::irq_handler_with_raw(raw).map(|irq| irq.raw().into())
+}
+
+pub fn send_ipi_to_cpu(cpu_id: usize) {
+    Plat::send_ipi_to_cpu(cpu_id);
+}
diff --git a/platforms/somehal/src/lib.rs b/platforms/somehal/src/lib.rs
index b3f7f66212..bec4b660b3 100644
--- a/platforms/somehal/src/lib.rs
+++ b/platforms/somehal/src/lib.rs
@@ -59,7 +59,7 @@ pub fn __somehal_secondary_default() -> ! {
 fn secondary_entry() -> ! {
     someboot::set_kernel_page_table_paddr(meta.primary_table_paddr);
     arch::Plat::secondary_init();
-    arch::Plat::secondary_init_intc();
+    arch::Plat::secondary_init_intc(meta.cpu_idx);
     arch::Plat::secondary_init_systick();
 
     unsafe extern "Rust" {
diff --git a/scripts/axbuild/src/arceos/build.rs b/scripts/axbuild/src/arceos/build.rs
index 46857f4653..b86fb0182c 100644
--- a/scripts/axbuild/src/arceos/build.rs
+++ b/scripts/axbuild/src/arceos/build.rs
@@ -182,7 +182,7 @@ mod tests {
         build_info.resolve_features("ax-helloworld", "aarch64-unknown-none-softfloat", true);
 
         assert!(build_info.features.contains(&"ax-std/plat-dyn".to_string()));
-        assert!(build_info.features.contains(&"ax-hal/plat-dyn".to_string()));
+        assert!(!build_info.features.contains(&"ax-hal/plat-dyn".to_string()));
         assert!(!build_info.features.contains(&"ax-std/defplat".to_string()));
 
         let args = ArceosBuildInfo::build_cargo_args(
@@ -411,6 +411,11 @@ AX_IP = "10.0.2.15"
             true,
             Some(false)
         ));
+        assert!(build::resolve_effective_plat_dyn(
+            "riscv64gc-unknown-none-elf",
+            true,
+            None
+        ));
         assert!(!build::resolve_effective_plat_dyn(
             "x86_64-unknown-none",
             true,
diff --git a/scripts/axbuild/src/arceos/cbuild.rs b/scripts/axbuild/src/arceos/cbuild.rs
index a432758f7f..cb38846663 100644
--- a/scripts/axbuild/src/arceos/cbuild.rs
+++ b/scripts/axbuild/src/arceos/cbuild.rs
@@ -418,7 +418,7 @@ mod tests {
         let features = c_config_features(&strings(&[
             "ax-libc/net",
             "ax-feat/paging",
-            "ax-driver/pci",
+            "ax-driver/plat-static",
             "ax-driver/virtio-net",
             "ax-hal/riscv64-qemu-virt",
             "some-crate/feature",
@@ -433,13 +433,13 @@ mod tests {
     #[test]
     fn map_c_app_features_preserves_driver_features() {
         let features = map_c_app_features(
-            &strings(&["net", "ax-driver/pci", "ax-driver/virtio-net"]),
+            &strings(&["net", "ax-driver/plat-static", "ax-driver/virtio-net"]),
             &strings(&["ax-hal/riscv64-qemu-virt"]),
         );
 
         assert!(features.contains(&"ax-libc/net".to_string()));
         assert!(features.contains(&"ax-libc/fd".to_string()));
-        assert!(features.contains(&"ax-driver/pci".to_string()));
+        assert!(features.contains(&"ax-driver/plat-static".to_string()));
         assert!(features.contains(&"ax-driver/virtio-net".to_string()));
         assert!(features.contains(&"ax-hal/riscv64-qemu-virt".to_string()));
     }
diff --git a/scripts/axbuild/src/axvisor/board.rs b/scripts/axbuild/src/axvisor/board.rs
index 7f03fdb8c9..f6a8c87094 100644
--- a/scripts/axbuild/src/axvisor/board.rs
+++ b/scripts/axbuild/src/axvisor/board.rs
@@ -152,6 +152,7 @@ env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 target = "riscv64gc-unknown-none-elf"
 features = ["ept-level-4"]
 log = "Info"
+plat_dyn = true
 "#,
         );
 
diff --git a/scripts/axbuild/src/axvisor/build.rs b/scripts/axbuild/src/axvisor/build.rs
index f09c126e01..1d8e6a5637 100644
--- a/scripts/axbuild/src/axvisor/build.rs
+++ b/scripts/axbuild/src/axvisor/build.rs
@@ -125,6 +125,9 @@ fn to_cargo_config(
     metadata: &cargo_metadata::Metadata,
 ) -> anyhow::Result<Cargo> {
     config.target = request.target.clone();
+    let plat_dyn = config
+        .build_info
+        .effective_plat_dyn(&config.target, request.plat_dyn);
     let mut cargo = config
         .build_info
         .into_prepared_base_cargo_config_with_metadata(
@@ -133,6 +136,15 @@ fn to_cargo_config(
             request.plat_dyn,
             metadata,
         )?;
+    if plat_dyn {
+        cargo.features.retain(|feature| {
+            !matches!(
+                feature.as_str(),
+                "ax-std/plat-dyn" | "ax-feat/plat-dyn" | "dyn-plat"
+            )
+        });
+        cargo.features.push("dyn-plat".to_string());
+    }
     patch_axvisor_cargo_config(&mut cargo, request, &config.vm_configs)?;
     Ok(cargo)
 }
@@ -398,7 +410,7 @@ mod tests {
             r#"
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 target = "aarch64-unknown-none-softfloat"
-features = ["ept-level-4", "ax-driver/fdt"]
+features = ["ept-level-4"]
 log = "Info"
 plat_dyn = true
 vm_configs = []
@@ -413,7 +425,17 @@ vm_configs = []
         .unwrap();
 
         assert!(cargo.features.contains(&"ept-level-4".to_string()));
-        assert!(cargo.features.contains(&"ax-driver/fdt".to_string()));
+        assert!(cargo.features.contains(&"dyn-plat".to_string()));
+        assert!(
+            !cargo
+                .features
+                .contains(&concat!("ax-driver/", "plat-dyn").to_string())
+        );
+        assert!(
+            !cargo
+                .features
+                .contains(&concat!("ax-hal/", "plat-dyn").to_string())
+        );
         assert!(path.exists());
     }
 
@@ -600,8 +622,9 @@ plat_dyn = false
             &config_path,
             r#"
 env = {}
-features = ["ept-level-4", "ax-driver/fdt"]
+features = ["ept-level-4"]
 log = "Info"
+plat_dyn = false
 "#,
         )
         .unwrap();
diff --git a/scripts/axbuild/src/build.rs b/scripts/axbuild/src/build.rs
index 6b80f68708..d2dce88ebc 100644
--- a/scripts/axbuild/src/build.rs
+++ b/scripts/axbuild/src/build.rs
@@ -345,16 +345,12 @@ impl BuildInfo {
         has_myplat: bool,
         metadata: Option<&Metadata>,
     ) {
-        if has_myplat || has_ax_hal_platform_feature(&self.features, metadata) {
+        if plat_dyn || has_myplat || has_ax_hal_platform_feature(&self.features, metadata) {
             return;
         }
 
-        let feature = if plat_dyn {
-            "ax-hal/plat-dyn".to_string()
-        } else {
-            default_ax_hal_platform_feature(target, metadata)
-                .unwrap_or_else(|_| "ax-hal/defplat".to_string())
-        };
+        let feature = default_ax_hal_platform_feature(target, metadata)
+            .unwrap_or_else(|_| "ax-hal/defplat".to_string());
         self.features.push(feature);
     }
 
@@ -474,7 +470,10 @@ pub(crate) fn cargo_target_json_path(target: &str, plat_dyn: bool) -> anyhow::Re
     };
 
     if plat_dyn {
-        if target != "aarch64-unknown-none-softfloat" {
+        if !matches!(
+            target,
+            "aarch64-unknown-none-softfloat" | "riscv64gc-unknown-none-elf"
+        ) {
             bail!("unsupported PIE target `{target}`");
         }
         Ok(Path::new(TARGET_JSON_ROOT)
@@ -664,7 +663,7 @@ pub(crate) fn resolve_effective_plat_dyn(
 }
 
 fn supports_platform_dynamic(target: &str) -> bool {
-    target.starts_with("aarch64-")
+    target.starts_with("aarch64-") || target.starts_with("riscv64")
 }
 
 fn default_to_bin_for_target(target: &str) -> bool {
@@ -929,7 +928,6 @@ fn ax_hal_platform_feature_name<'a>(
     let platform = feature.strip_prefix("ax-hal/")?;
     match platform {
         "plat-dyn" => Some(platform),
-        "riscv64-qemu-virt-hv" => Some(platform),
         _ if metadata
             .map(|metadata| platform_package_by_name(metadata, platform).is_some())
             .unwrap_or_else(|| is_known_ax_hal_platform_feature(platform)) =>
@@ -1035,10 +1033,6 @@ fn platform_packages(metadata: &Metadata) -> Vec<PlatformPackage> {
 }
 
 fn platform_package_by_name(metadata: &Metadata, platform_name: &str) -> Option<String> {
-    if platform_name == "riscv64-qemu-virt-hv" {
-        return platform_package_by_name(metadata, "riscv64-qemu-virt");
-    }
-
     platform_packages(metadata)
         .into_iter()
         .find(|platform| platform.metadata.platform == platform_name)
@@ -1501,7 +1495,7 @@ mod tests {
         let mut envs = HashMap::new();
         let mut features = vec![
             "ax-hal/riscv64-qemu-virt".to_string(),
-            "ax-driver/pci".to_string(),
+            "ax-driver/plat-dyn".to_string(),
             "ax-driver/virtio-blk".to_string(),
             "ax-driver/virtio-net".to_string(),
             "dns".to_string(),
@@ -1513,7 +1507,8 @@ mod tests {
         assert_eq!(
             envs.get("ARCEOS_RUST_FEATURES"),
             Some(
-                &"ax-hal/riscv64-qemu-virt,ax-driver/pci,ax-driver/virtio-blk,ax-driver/virtio-net"
+                &"ax-hal/riscv64-qemu-virt,ax-driver/plat-dyn,ax-driver/virtio-blk,ax-driver/\
+                  virtio-net"
                     .to_string()
             )
         );
@@ -1564,10 +1559,10 @@ mod tests {
     }
 
     #[test]
-    fn cargo_target_json_path_rejects_unsupported_pie_target() {
-        let err = cargo_target_json_path("riscv64gc-unknown-none-elf", true).unwrap_err();
+    fn cargo_target_json_path_maps_riscv64_pie_target() {
+        let path = cargo_target_json_path("riscv64gc-unknown-none-elf", true).unwrap();
 
-        assert!(err.to_string().contains("unsupported PIE target"));
+        assert!(path.ends_with("scripts/targets/pie/riscv64gc-unknown-none-elf.json"));
     }
 
     #[test]
diff --git a/scripts/axbuild/src/context/tests.rs b/scripts/axbuild/src/context/tests.rs
index 1288a3ccd6..c81a09985e 100644
--- a/scripts/axbuild/src/context/tests.rs
+++ b/scripts/axbuild/src/context/tests.rs
@@ -489,7 +489,7 @@ fn prepare_axvisor_request_prefers_cli_over_snapshot() {
 config = "os/axvisor/.build.toml"
 arch = "riscv64"
 target = "riscv64gc-unknown-none-elf"
-plat_dyn = false
+plat_dyn = true
 vmconfigs = ["tmp/snapshot-vm.toml"]
 
 [qemu]
diff --git a/scripts/axbuild/src/starry/build.rs b/scripts/axbuild/src/starry/build.rs
index e304ffbd3e..f0a2c55990 100644
--- a/scripts/axbuild/src/starry/build.rs
+++ b/scripts/axbuild/src/starry/build.rs
@@ -90,12 +90,22 @@ pub(crate) fn load_cargo_config(request: &ResolvedStarryRequest) -> anyhow::Resu
     if let Some(smp) = request.smp {
         build_info.max_cpu_num = Some(smp);
     }
+    let plat_dyn = build_info.effective_plat_dyn(&request.target, request.plat_dyn);
     let mut cargo = build_info.into_prepared_base_cargo_config_with_metadata(
         &request.package,
         &request.target,
         request.plat_dyn,
         metadata,
     )?;
+    if plat_dyn {
+        cargo.features.retain(|feature| {
+            !matches!(
+                feature.as_str(),
+                "ax-feat/plat-dyn" | "ax-std/plat-dyn" | "starry-kernel/plat-dyn"
+            )
+        });
+        cargo.features.push("plat-dyn".to_string());
+    }
     patch_starry_cargo_config(&mut cargo, request, metadata)?;
     Ok(cargo)
 }
@@ -180,31 +190,55 @@ fn uimg_arch_for(arch: &str) -> String {
 
 fn inject_uimage_post_build_cmd(cargo: &mut Cargo, arch: &str) -> anyhow::Result<()> {
     let uimg_arch = uimg_arch_for(arch);
-    let config_path = cargo
-        .env
-        .get("AX_CONFIG_PATH")
-        .cloned()
-        .ok_or_else(|| anyhow::anyhow!("AX_CONFIG_PATH is required for UIMAGE generation"))?;
+    let paddr = uimage_load_paddr_expr(cargo, arch)?;
 
     let cmd = format!(
-        "paddr=$(ax-config-gen {config_path} -r plat.kernel-base-paddr | tr -d _) && \
-         bin=${{KERNEL_ELF%.elf}}.bin && mkimage -A {uimg_arch} -O linux -T kernel -C none -a \
-         \"$paddr\" -d \"$bin\" \"${{bin%.bin}}.uimg\""
+        "paddr={paddr} && bin=${{KERNEL_ELF%.elf}}.bin && mkimage -A {uimg_arch} -O linux -T \
+         kernel -C none -a \"$paddr\" -d \"$bin\" \"${{bin%.bin}}.uimg\""
     );
     cargo.post_build_cmds.push(cmd);
     Ok(())
 }
 
+fn uimage_load_paddr_expr(cargo: &Cargo, arch: &str) -> anyhow::Result<String> {
+    if let Some(config_path) = cargo.env.get("AX_CONFIG_PATH") {
+        return Ok(format!(
+            "$(ax-config-gen {config_path} -r plat.kernel-base-paddr | tr -d _)"
+        ));
+    }
+
+    if !uses_dynamic_platform(&cargo.features) {
+        return Err(anyhow::anyhow!(
+            "AX_CONFIG_PATH is required for UIMAGE generation"
+        ));
+    }
+
+    match arch {
+        "aarch64" => Ok("0x200000".to_string()),
+        "riscv64" => Ok("0x80200000".to_string()),
+        other => Err(anyhow::anyhow!(
+            "AX_CONFIG_PATH is required for UIMAGE generation on {other}"
+        )),
+    }
+}
+
 fn remove_qemu_feature_for_dynamic_platform(cargo: &mut Cargo) {
-    let uses_dynamic_platform = cargo.features.iter().any(|feature| {
+    if uses_dynamic_platform(&cargo.features) {
+        cargo.features.retain(|feature| feature != "qemu");
+    }
+}
+
+fn uses_dynamic_platform(features: &[String]) -> bool {
+    features.iter().any(|feature| {
         matches!(
             feature.as_str(),
-            "plat-dyn" | "ax-feat/plat-dyn" | "ax-std/plat-dyn" | "ax-hal/plat-dyn"
+            "plat-dyn"
+                | "ax-feat/plat-dyn"
+                | "ax-std/plat-dyn"
+                | "starry-kernel/plat-dyn"
+                | "ax-hal/plat-dyn"
         )
-    });
-    if uses_dynamic_platform {
-        cargo.features.retain(|feature| feature != "qemu");
-    }
+    })
 }
 
 fn uses_default_qemu_platform(features: &[String]) -> bool {
@@ -214,12 +248,7 @@ fn uses_default_qemu_platform(features: &[String]) -> bool {
             "defplat" | "ax-feat/defplat" | "ax-std/defplat"
         ) || default_starry_qemu_platform_feature(feature).is_some()
     });
-    let has_dynamic = features.iter().any(|feature| {
-        matches!(
-            feature.as_str(),
-            "plat-dyn" | "ax-feat/plat-dyn" | "ax-std/plat-dyn" | "ax-hal/plat-dyn"
-        )
-    });
+    let has_dynamic = uses_dynamic_platform(features);
     let has_custom = features.iter().any(|feature| {
         matches!(
             feature.as_str(),
@@ -525,7 +554,7 @@ HELLO = "world"
             env: HashMap::new(),
             features: vec![
                 "common".to_string(),
-                "ax-feat/plat-dyn".to_string(),
+                "plat-dyn".to_string(),
                 "ax-driver/rockchip-soc".to_string(),
                 "ax-driver/rockchip-sdhci".to_string(),
             ],
@@ -574,11 +603,7 @@ HELLO = "world"
         );
         let build_info = StarryBuildInfo {
             env: HashMap::new(),
-            features: vec![
-                "qemu".to_string(),
-                "ax-feat/plat-dyn".to_string(),
-                "starry-kernel/plat-dyn".to_string(),
-            ],
+            features: vec!["qemu".to_string(), "plat-dyn".to_string()],
             log: LogLevel::Info,
             max_cpu_num: None,
             axconfig_overrides: Vec::new(),
@@ -601,6 +626,62 @@ HELLO = "world"
         assert!(!cargo.env.contains_key("AX_PLATFORM"));
     }
 
+    #[test]
+    fn uimage_load_paddr_uses_dynamic_riscv64_fallback_without_axconfig() {
+        let cargo = Cargo {
+            env: HashMap::new(),
+            target: "scripts/targets/pie/riscv64gc-unknown-none-elf.json".to_string(),
+            package: STARRY_PACKAGE.to_string(),
+            bin: None,
+            features: vec!["plat-dyn".to_string()],
+            log: None,
+            extra_config: None,
+            profile: None,
+            disable_someboot_build_config: true,
+            args: Vec::new(),
+            pre_build_cmds: Vec::new(),
+            post_build_cmds: Vec::new(),
+            to_bin: true,
+        };
+
+        assert_eq!(
+            uimage_load_paddr_expr(&cargo, "riscv64").unwrap(),
+            "0x80200000"
+        );
+    }
+
+    #[test]
+    fn uimage_load_paddr_prefers_axconfig_when_available() {
+        let mut cargo = Cargo {
+            env: HashMap::from([(
+                "AX_CONFIG_PATH".to_string(),
+                "/tmp/generated.axconfig.toml".to_string(),
+            )]),
+            target: "riscv64gc-unknown-none-elf".to_string(),
+            package: STARRY_PACKAGE.to_string(),
+            bin: None,
+            features: vec!["plat-dyn".to_string()],
+            log: None,
+            extra_config: None,
+            profile: None,
+            disable_someboot_build_config: true,
+            args: Vec::new(),
+            pre_build_cmds: Vec::new(),
+            post_build_cmds: Vec::new(),
+            to_bin: true,
+        };
+
+        assert_eq!(
+            uimage_load_paddr_expr(&cargo, "riscv64").unwrap(),
+            "$(ax-config-gen /tmp/generated.axconfig.toml -r plat.kernel-base-paddr | tr -d _)"
+        );
+
+        inject_uimage_post_build_cmd(&mut cargo, "riscv64").unwrap();
+        assert!(
+            cargo.post_build_cmds[0].contains("paddr=$(ax-config-gen /tmp/generated.axconfig.toml")
+        );
+    }
+
     #[test]
     fn load_cargo_config_treats_sg2002_as_explicit_platform_feature() {
         let mut request = request(
@@ -728,7 +809,7 @@ HELLO = "world"
         let mut cargo = build_info.into_base_cargo_config_with_log(
             request.package.clone(),
             request.target.clone(),
-            StarryBuildInfo::build_cargo_args(&request.target, false, &[]),
+            StarryBuildInfo::build_cargo_args(&request.target, &[]),
         );
 
         let metadata = crate::build::workspace_metadata().unwrap();
diff --git a/scripts/axbuild/src/starry/rootfs.rs b/scripts/axbuild/src/starry/rootfs.rs
index abfe3e0602..59aeecf7c3 100644
--- a/scripts/axbuild/src/starry/rootfs.rs
+++ b/scripts/axbuild/src/starry/rootfs.rs
@@ -107,10 +107,11 @@ pub(super) async fn load_patched_qemu_config(
         }
     };
 
+    let mode = rootfs_patch_mode(request, cargo);
     if let Some(rootfs) = explicit_rootfs {
-        patch_qemu_rootfs_path(&mut qemu, rootfs);
+        patch_qemu_rootfs_path_with_mode(&mut qemu, rootfs, mode);
     } else if apply_default_args {
-        patch_qemu_rootfs(&mut qemu, request, starry.app.workspace_root(), None)?;
+        patch_qemu_rootfs(&mut qemu, request, starry.app.workspace_root(), None, mode)?;
     }
     qemu_test::apply_smp_qemu_arg(&mut qemu, request.smp);
 
@@ -241,6 +242,7 @@ pub(crate) fn patch_qemu_rootfs(
     request: &ResolvedStarryRequest,
     workspace_root: &Path,
     explicit_rootfs: Option<&Path>,
+    mode: RootfsPatchMode,
 ) -> anyhow::Result<()> {
     let expected_target = starry_target_for_arch_checked(&request.arch)?;
     if request.target != expected_target {
@@ -251,7 +253,7 @@ pub(crate) fn patch_qemu_rootfs(
         );
     }
     let rootfs_path = qemu_rootfs_path(request, workspace_root, explicit_rootfs)?;
-    patch_qemu_rootfs_path(qemu, &rootfs_path);
+    patch_qemu_rootfs_path_with_mode(qemu, &rootfs_path, mode);
     Ok(())
 }
 
@@ -269,8 +271,27 @@ pub(crate) fn qemu_rootfs_path(
 }
 
 /// Patches a QEMU config with a concrete Starry rootfs path.
-pub(crate) fn patch_qemu_rootfs_path(qemu: &mut QemuConfig, rootfs_path: &Path) {
-    patch_rootfs(qemu, rootfs_path, RootfsPatchMode::EnsureDiskBootNet);
+pub(crate) fn patch_qemu_rootfs_path_with_mode(
+    qemu: &mut QemuConfig,
+    rootfs_path: &Path,
+    mode: RootfsPatchMode,
+) {
+    patch_rootfs(qemu, rootfs_path, mode);
+}
+
+fn rootfs_patch_mode(request: &ResolvedStarryRequest, cargo: &Cargo) -> RootfsPatchMode {
+    if request.plat_dyn == Some(true)
+        || cargo.features.iter().any(|feature| {
+            matches!(
+                feature.as_str(),
+                "plat-dyn" | "ax-feat/plat-dyn" | "ax-std/plat-dyn" | "starry-kernel/plat-dyn"
+            )
+        })
+    {
+        RootfsPatchMode::ReplaceDriveOnly
+    } else {
+        RootfsPatchMode::EnsureDiskBootNet
+    }
 }
 
 #[cfg(test)]
@@ -306,7 +327,14 @@ mod tests {
         };
         let mut qemu = QemuConfig::default();
 
-        patch_qemu_rootfs(&mut qemu, &request, root.path(), None).unwrap();
+        patch_qemu_rootfs(
+            &mut qemu,
+            &request,
+            root.path(),
+            None,
+            RootfsPatchMode::EnsureDiskBootNet,
+        )
+        .unwrap();
 
         assert_eq!(
             qemu.args,
@@ -367,7 +395,14 @@ mod tests {
             ..Default::default()
         };
 
-        patch_qemu_rootfs(&mut qemu, &request, root.path(), None).unwrap();
+        patch_qemu_rootfs(
+            &mut qemu,
+            &request,
+            root.path(),
+            None,
+            RootfsPatchMode::EnsureDiskBootNet,
+        )
+        .unwrap();
 
         assert_eq!(
             qemu.args,
@@ -393,4 +428,66 @@ mod tests {
             ]
         );
     }
+
+    #[tokio::test]
+    async fn patch_qemu_rootfs_for_dynamic_platform_replaces_drive_only() {
+        let root = tempdir().unwrap();
+        let rootfs_dir = root.path().join("tmp/axbuild/rootfs");
+        fs::create_dir_all(&rootfs_dir).unwrap();
+        fs::write(
+            rootfs_dir.join("rootfs-riscv64-alpine.img"),
+            vec![0; 1024 * 1024],
+        )
+        .unwrap();
+
+        let request = ResolvedStarryRequest {
+            package: "starryos".to_string(),
+            arch: "riscv64".to_string(),
+            target: "riscv64gc-unknown-none-elf".to_string(),
+            plat_dyn: Some(true),
+            smp: None,
+            debug: false,
+            build_info_path: PathBuf::from("/tmp/.build.toml"),
+            build_info_override: None,
+            qemu_config: None,
+            uboot_config: None,
+        };
+        let mut qemu = QemuConfig {
+            args: vec![
+                "-machine".to_string(),
+                "virt".to_string(),
+                "-device".to_string(),
+                "virtio-blk-device,drive=disk0".to_string(),
+                "-drive".to_string(),
+                "id=disk0,if=none,format=raw,file=/old/rootfs.img".to_string(),
+            ],
+            ..Default::default()
+        };
+
+        patch_qemu_rootfs(
+            &mut qemu,
+            &request,
+            root.path(),
+            None,
+            RootfsPatchMode::ReplaceDriveOnly,
+        )
+        .unwrap();
+
+        assert_eq!(
+            qemu.args,
+            vec![
+                "-machine".to_string(),
+                "virt".to_string(),
+                "-device".to_string(),
+                "virtio-blk-device,drive=disk0".to_string(),
+                "-drive".to_string(),
+                format!(
+                    "id=disk0,if=none,format=raw,file={}",
+                    root.path()
+                        .join("tmp/axbuild/rootfs/rootfs-riscv64-alpine.img")
+                        .display()
+                ),
+            ]
+        );
+    }
 }
diff --git a/scripts/axbuild/src/starry/test.rs b/scripts/axbuild/src/starry/test.rs
index 4dd8eaf7a1..76795e87b4 100644
--- a/scripts/axbuild/src/starry/test.rs
+++ b/scripts/axbuild/src/starry/test.rs
@@ -1340,12 +1340,24 @@ mod tests {
     #[test]
     fn bug_ext4_dir_ops_qemu_configs_fail_on_lockdep_fatal() {
         let workspace_root = Path::new(env!("CARGO_MANIFEST_DIR")).join("../..");
-        let case_dir = workspace_root.join("test-suit/starryos/normal/qemu-smp1/bug-ext4-dir-ops");
+        let case_dir = workspace_root.join("test-suit/starryos/normal/qemu-smp1/bugfix");
 
         for arch in ["aarch64", "loongarch64", "riscv64", "x86_64"] {
             let path = case_dir.join(format!("qemu-{arch}.toml"));
             let content = fs::read_to_string(&path).unwrap();
             let config: toml::Value = toml::from_str(&content).unwrap();
+            let test_commands = config
+                .get("test_commands")
+                .and_then(toml::Value::as_array)
+                .unwrap();
+            assert!(
+                test_commands
+                    .iter()
+                    .filter_map(toml::Value::as_str)
+                    .any(|command| command == "/usr/bin/bug-ext4-dir-ops"),
+                "{} must include the bug-ext4-dir-ops grouped command",
+                path.display()
+            );
             let fail_regex = config
                 .get("fail_regex")
                 .and_then(toml::Value::as_array)
@@ -1778,8 +1790,8 @@ mod tests {
         fs::create_dir_all(build_config.parent().unwrap()).unwrap();
         fs::write(
             &build_config,
-            "target = \"aarch64-unknown-none-softfloat\"\nenv = {}\nfeatures = [\"qemu\", \
-             \"starry-kernel/plat-dyn\"]\nlog = \"Warn\"\nplat_dyn = true\n",
+            "target = \"aarch64-unknown-none-softfloat\"\nenv = {}\nfeatures = [\"qemu\"]\nlog = \
+             \"Warn\"\nplat_dyn = true\n",
         )
         .unwrap();
         let mut request = starry_request(
@@ -1799,9 +1811,10 @@ mod tests {
         let (_group_request, cargo) =
             Starry::qemu_group_build_context(&request, &build_config).unwrap();
 
-        assert!(cargo.features.contains(&"ax-feat/plat-dyn".to_string()));
+        assert!(cargo.features.contains(&"plat-dyn".to_string()));
+        assert!(!cargo.features.contains(&"ax-feat/plat-dyn".to_string()));
         assert!(
-            cargo
+            !cargo
                 .features
                 .contains(&"starry-kernel/plat-dyn".to_string())
         );
diff --git a/scripts/repo/repos.csv b/scripts/repo/repos.csv
index 52ef820ba9..a1ea8b50e0 100644
--- a/scripts/repo/repos.csv
+++ b/scripts/repo/repos.csv
@@ -1,57 +1,57 @@
-url,branch,target_dir,category,description
-https://github.com/arceos-org/arceos,dev,os/arceos,OS,ArceOS
-https://github.com/arceos-hypervisor/axvisor,,os/axvisor,OS,axvisor - ArceOS Hypervisor
-https://github.com/Starry-OS/StarryOS,,os/StarryOS,OS,StarryOS - 教学操作系统
-https://github.com/arceos-hypervisor/aarch64_sysreg,,virtualization/aarch64_sysreg,Hypervisor,
-https://github.com/arceos-hypervisor/axaddrspace,,memory/axaddrspace,Hypervisor,
-https://github.com/arceos-hypervisor/axdevice,,virtualization/axdevice,Hypervisor,
-https://github.com/arceos-hypervisor/axdevice_base,,virtualization/axdevice_base,Hypervisor,
-https://github.com/arceos-hypervisor/axhvc,,virtualization/axhvc,Hypervisor,
-https://github.com/arceos-hypervisor/axklib,,components/axklib,Hypervisor,
-https://github.com/arceos-hypervisor/axvcpu,,virtualization/axvcpu,Hypervisor,
-https://github.com/arceos-hypervisor/axvisor_api,,virtualization/axvisor_api,Hypervisor,
-https://github.com/arceos-hypervisor/axvm,,virtualization/axvm,Hypervisor,
-https://github.com/arceos-hypervisor/axvmconfig,,virtualization/axvmconfig,Hypervisor,
-https://github.com/arceos-hypervisor/x86_vcpu,,virtualization/x86_vcpu,Hypervisor,
-https://github.com/arceos-hypervisor/x86_vlapic.git,,virtualization/x86_vlapic,Hypervisor,
-https://github.com/arceos-hypervisor/arm_vcpu,,virtualization/arm_vcpu,Hypervisor,
-https://github.com/arceos-hypervisor/arm_vgic,,virtualization/arm_vgic,Hypervisor,
-https://github.com/arceos-hypervisor/riscv_vcpu,,virtualization/riscv_vcpu,Hypervisor,
-https://github.com/arceos-hypervisor/riscv-h,,virtualization/riscv-h,Hypervisor,
-https://github.com/arceos-hypervisor/riscv_vplic,,virtualization/riscv_vplic,Hypervisor,
-https://github.com/arceos-org/allocator,,memory/axallocator,ArceOS,
-https://github.com/arceos-org/axconfig-gen,,components/axconfig-gen,ArceOS,
-https://github.com/arceos-org/ax-cpu,dev,components/axcpu,ArceOS,
-https://github.com/arceos-org/axerrno,,components/axerrno,ArceOS,
-https://github.com/arceos-org/axio,dev2,components/axio,ArceOS,
-https://github.com/arceos-org/axsched,,components/axsched,ArceOS,
-https://github.com/arceos-org/cpumask,,components/cpumask,ArceOS,
-https://github.com/arceos-org/crate_interface,,components/crate_interface,ArceOS,
-https://github.com/arceos-org/ctor_bare,,components/ctor_bare,ArceOS,
-https://github.com/arceos-org/ax-handler-table,,components/handler_table,ArceOS,
-https://github.com/arceos-org/kernel_guard,,components/kernel_guard,ArceOS,
-https://github.com/arceos-org/kspin,,components/kspin,ArceOS,
-https://github.com/arceos-org/lazyinit,,components/ax-lazyinit,ArceOS,
-https://github.com/arceos-org/linked_list_r4l,,components/linked_list_r4l,ArceOS,
-https://github.com/arceos-org/percpu,dev,components/percpu,ArceOS,
-https://github.com/arceos-org/timer_list,,components/timer_list,ArceOS,
-https://github.com/arceos-org/ax-int-ratio,,components/int_ratio,ArceOS,
-https://github.com/arceos-org/cap_access,,components/cap_access,ArceOS,
-https://github.com/arceos-org/arm_pl031,,drivers/rtc/arm_pl031,ArceOS,
-https://github.com/arceos-org/riscv_plic,,drivers/intc/riscv_plic,ArceOS,
-https://github.com/rcore-os/bitmap-allocator,,memory/bitmap-allocator,rCore,
-https://github.com/Starry-OS/axbacktrace,,components/axbacktrace,Starry,
-https://github.com/Starry-OS/axpoll,,components/axpoll,Starry,
-https://github.com/Starry-OS/axfs-ng-vfs,,components/axfs-ng-vfs,Starry,
-https://github.com/Starry-OS/rsext4,,components/rsext4,Starry,
-https://github.com/Starry-OS/scope-local,,components/scope-local,Starry,
-https://github.com/Starry-OS/starry-process,,components/starry-process,Starry,
-https://github.com/Starry-OS/starry-signal,,components/starry-signal,Starry,
-https://github.com/Starry-OS/starry-vm,,components/starry-vm,Starry,
-https://github.com/Starry-OS/smoltcp,,components/starry-smoltcp,Starry,
-https://github.com/arceos-org/axfs_crates,main,components/axfs_crates,ArceOS,
-https://github.com/DeathWish5/fxmac_rs,,drivers/net/fxmac_rs,ArceOS,
-https://github.com/drivercraft/rknpu,,drivers/npu/rockchip-npu,drivers,
-https://github.com/drivercraft/rockchip-pm,,drivers/soc/rockchip/rockchip-pm,drivers,
-https://github.com/drivercraft/rockchip-soc,,drivers/soc/rockchip/rockchip-soc,,
+url,branch,target_dir,category,description
+https://github.com/arceos-org/arceos,dev,os/arceos,OS,ArceOS
+https://github.com/arceos-hypervisor/axvisor,,os/axvisor,OS,axvisor - ArceOS Hypervisor
+https://github.com/Starry-OS/StarryOS,,os/StarryOS,OS,StarryOS - 教学操作系统
+https://github.com/arceos-hypervisor/aarch64_sysreg,,virtualization/aarch64_sysreg,Hypervisor,
+https://github.com/arceos-hypervisor/axaddrspace,,memory/axaddrspace,Hypervisor,
+https://github.com/arceos-hypervisor/axdevice,,virtualization/axdevice,Hypervisor,
+https://github.com/arceos-hypervisor/axdevice_base,,virtualization/axdevice_base,Hypervisor,
+https://github.com/arceos-hypervisor/axhvc,,virtualization/axhvc,Hypervisor,
+https://github.com/arceos-hypervisor/axklib,,components/axklib,Hypervisor,
+https://github.com/arceos-hypervisor/axvcpu,,virtualization/axvcpu,Hypervisor,
+https://github.com/arceos-hypervisor/axvisor_api,,virtualization/axvisor_api,Hypervisor,
+https://github.com/arceos-hypervisor/axvm,,virtualization/axvm,Hypervisor,
+https://github.com/arceos-hypervisor/axvmconfig,,virtualization/axvmconfig,Hypervisor,
+https://github.com/arceos-hypervisor/x86_vcpu,,virtualization/x86_vcpu,Hypervisor,
+https://github.com/arceos-hypervisor/x86_vlapic.git,,virtualization/x86_vlapic,Hypervisor,
+https://github.com/arceos-hypervisor/arm_vcpu,,virtualization/arm_vcpu,Hypervisor,
+https://github.com/arceos-hypervisor/arm_vgic,,virtualization/arm_vgic,Hypervisor,
+https://github.com/arceos-hypervisor/riscv_vcpu,,virtualization/riscv_vcpu,Hypervisor,
+https://github.com/arceos-hypervisor/riscv-h,,virtualization/riscv-h,Hypervisor,
+https://github.com/arceos-hypervisor/riscv_vplic,,virtualization/riscv_vplic,Hypervisor,
+https://github.com/arceos-org/allocator,,memory/axallocator,ArceOS,
+https://github.com/arceos-org/axconfig-gen,,components/axconfig-gen,ArceOS,
+https://github.com/arceos-org/ax-cpu,dev,components/axcpu,ArceOS,
+https://github.com/arceos-org/axerrno,,components/axerrno,ArceOS,
+https://github.com/arceos-org/axio,dev2,components/axio,ArceOS,
+https://github.com/arceos-org/axsched,,components/axsched,ArceOS,
+https://github.com/arceos-org/cpumask,,components/cpumask,ArceOS,
+https://github.com/arceos-org/crate_interface,,components/crate_interface,ArceOS,
+https://github.com/arceos-org/ctor_bare,,components/ctor_bare,ArceOS,
+https://github.com/arceos-org/ax-handler-table,,components/handler_table,ArceOS,
+https://github.com/arceos-org/kernel_guard,,components/kernel_guard,ArceOS,
+https://github.com/arceos-org/kspin,,components/kspin,ArceOS,
+https://github.com/arceos-org/lazyinit,,components/ax-lazyinit,ArceOS,
+https://github.com/arceos-org/linked_list_r4l,,components/linked_list_r4l,ArceOS,
+https://github.com/arceos-org/percpu,dev,components/percpu,ArceOS,
+https://github.com/arceos-org/timer_list,,components/timer_list,ArceOS,
+https://github.com/arceos-org/ax-int-ratio,,components/int_ratio,ArceOS,
+https://github.com/arceos-org/cap_access,,components/cap_access,ArceOS,
+https://github.com/arceos-org/arm_pl031,,drivers/rtc/arm_pl031,ArceOS,
+https://github.com/arceos-org/riscv_plic,,drivers/intc/riscv_plic,ArceOS,
+https://github.com/rcore-os/bitmap-allocator,,memory/bitmap-allocator,rCore,
+https://github.com/Starry-OS/axbacktrace,,components/axbacktrace,Starry,
+https://github.com/Starry-OS/axpoll,,components/axpoll,Starry,
+https://github.com/Starry-OS/axfs-ng-vfs,,components/axfs-ng-vfs,Starry,
+https://github.com/Starry-OS/rsext4,,components/rsext4,Starry,
+https://github.com/Starry-OS/scope-local,,components/scope-local,Starry,
+https://github.com/Starry-OS/starry-process,,components/starry-process,Starry,
+https://github.com/Starry-OS/starry-signal,,components/starry-signal,Starry,
+https://github.com/Starry-OS/starry-vm,,components/starry-vm,Starry,
+https://github.com/Starry-OS/smoltcp,,components/starry-smoltcp,Starry,
+https://github.com/arceos-org/axfs_crates,main,components/axfs_crates,ArceOS,
+https://github.com/DeathWish5/fxmac_rs,,drivers/net/fxmac_rs,ArceOS,
+https://github.com/drivercraft/rknpu,,drivers/npu/rockchip-npu,drivers,
+https://github.com/drivercraft/rockchip-pm,,drivers/soc/rockchip/rockchip-pm,drivers,
+https://github.com/drivercraft/rockchip-soc,,drivers/soc/rockchip/rockchip-soc,,
 https://github.com/drivercraft/arm-scmi.git,,drivers/firmware/arm-scmi-rs,Starry,
diff --git a/scripts/targets/pie/riscv64gc-unknown-none-elf.json b/scripts/targets/pie/riscv64gc-unknown-none-elf.json
new file mode 100644
index 0000000000..1e18d1b92a
--- /dev/null
+++ b/scripts/targets/pie/riscv64gc-unknown-none-elf.json
@@ -0,0 +1,36 @@
+{
+  "arch": "riscv64",
+  "cpu": "generic-rv64",
+  "crt-objects-fallback": "false",
+  "data-layout": "e-m:e-p:64:64-i64:64-i128:128-n32:64-S128",
+  "eh-frame-header": false,
+  "emit-debug-gdb-scripts": false,
+  "features": "+m,+a,+f,+d,+c,+zicsr,+zifencei",
+  "linker": "rust-lld",
+  "linker-flavor": "gnu-lld",
+  "llvm-abiname": "lp64d",
+  "llvm-target": "riscv64",
+  "max-atomic-width": 64,
+  "metadata": {
+    "description": "Bare RISC-V (RV64IMAFDC ISA)",
+    "host_tools": false,
+    "std": false,
+    "tier": 2
+  },
+  "panic-strategy": "abort",
+  "position-independent-executables": true,
+  "pre-link-args": {
+    "gnu-lld": [
+      "-pie",
+      "-znostart-stop-gc",
+      "-Taxplat.x"
+    ]
+  },
+  "relocation-model": "pic",
+  "static-position-independent-executables": true,
+  "supported-sanitizers": [
+    "shadow-call-stack",
+    "kernel-address"
+  ],
+  "target-pointer-width": 64
+}
diff --git a/test-suit/arceos/c/httpclient/build-aarch64-unknown-none-softfloat.toml b/test-suit/arceos/c/httpclient/build-aarch64-unknown-none-softfloat.toml
index df8bbaf350..09a79b30c2 100644
--- a/test-suit/arceos/c/httpclient/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/c/httpclient/build-aarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["alloc", "paging", "net", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["alloc", "paging", "net", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Info"
 
 [env]
diff --git a/test-suit/arceos/c/httpclient/build-loongarch64-unknown-none-softfloat.toml b/test-suit/arceos/c/httpclient/build-loongarch64-unknown-none-softfloat.toml
index df8bbaf350..09a79b30c2 100644
--- a/test-suit/arceos/c/httpclient/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/c/httpclient/build-loongarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["alloc", "paging", "net", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["alloc", "paging", "net", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Info"
 
 [env]
diff --git a/test-suit/arceos/c/httpclient/build-riscv64gc-unknown-none-elf.toml b/test-suit/arceos/c/httpclient/build-riscv64gc-unknown-none-elf.toml
index df8bbaf350..09a79b30c2 100644
--- a/test-suit/arceos/c/httpclient/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/arceos/c/httpclient/build-riscv64gc-unknown-none-elf.toml
@@ -1,4 +1,4 @@
-features = ["alloc", "paging", "net", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["alloc", "paging", "net", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Info"
 
 [env]
diff --git a/test-suit/arceos/c/httpclient/build-x86_64-unknown-none.toml b/test-suit/arceos/c/httpclient/build-x86_64-unknown-none.toml
index df8bbaf350..09a79b30c2 100644
--- a/test-suit/arceos/c/httpclient/build-x86_64-unknown-none.toml
+++ b/test-suit/arceos/c/httpclient/build-x86_64-unknown-none.toml
@@ -1,4 +1,4 @@
-features = ["alloc", "paging", "net", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["alloc", "paging", "net", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Info"
 
 [env]
diff --git a/test-suit/arceos/rust/display/build-aarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/display/build-aarch64-unknown-none-softfloat.toml
index eda3a4a847..d50567d1c3 100644
--- a/test-suit/arceos/rust/display/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/display/build-aarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-gpu"]
+features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-gpu"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/display/build-loongarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/display/build-loongarch64-unknown-none-softfloat.toml
index 92f3749d99..4404257456 100644
--- a/test-suit/arceos/rust/display/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/display/build-loongarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-gpu"]
+features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-gpu"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/display/build-riscv64gc-unknown-none-elf.toml b/test-suit/arceos/rust/display/build-riscv64gc-unknown-none-elf.toml
index d490390524..e71ba13870 100644
--- a/test-suit/arceos/rust/display/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/arceos/rust/display/build-riscv64gc-unknown-none-elf.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-gpu"]
+features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-gpu"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/display/build-x86_64-unknown-none.toml b/test-suit/arceos/rust/display/build-x86_64-unknown-none.toml
index 4a36bd895c..22ce22029f 100644
--- a/test-suit/arceos/rust/display/build-x86_64-unknown-none.toml
+++ b/test-suit/arceos/rust/display/build-x86_64-unknown-none.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/x86-pc", "ax-driver/pci", "ax-driver/virtio-gpu"]
+features = ["ax-std", "ax-hal/x86-pc", "ax-driver/plat-static", "ax-driver/virtio-gpu"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/fs/shell/build-aarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/fs/shell/build-aarch64-unknown-none-softfloat.toml
index 928217c53f..772b5e3785 100644
--- a/test-suit/arceos/rust/fs/shell/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/fs/shell/build-aarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/virtio-blk"]
+features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-blk"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/fs/shell/build-loongarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/fs/shell/build-loongarch64-unknown-none-softfloat.toml
index 3f3e37f2da..356b482ab5 100644
--- a/test-suit/arceos/rust/fs/shell/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/fs/shell/build-loongarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-blk"]
+features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-blk"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/fs/shell/build-riscv64gc-unknown-none-elf.toml b/test-suit/arceos/rust/fs/shell/build-riscv64gc-unknown-none-elf.toml
index 1f6cd09f11..9b91c050c3 100644
--- a/test-suit/arceos/rust/fs/shell/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/arceos/rust/fs/shell/build-riscv64gc-unknown-none-elf.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-blk"]
+features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-blk"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/fs/shell/build-x86_64-unknown-none.toml b/test-suit/arceos/rust/fs/shell/build-x86_64-unknown-none.toml
index 9b12da4c8d..4c89f16752 100644
--- a/test-suit/arceos/rust/fs/shell/build-x86_64-unknown-none.toml
+++ b/test-suit/arceos/rust/fs/shell/build-x86_64-unknown-none.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/x86-pc", "ax-driver/pci", "ax-driver/virtio-blk"]
+features = ["ax-std", "ax-hal/x86-pc", "ax-driver/plat-static", "ax-driver/virtio-blk"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/echoserver/build-aarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/net/echoserver/build-aarch64-unknown-none-softfloat.toml
index 702f89231d..d885073496 100644
--- a/test-suit/arceos/rust/net/echoserver/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/net/echoserver/build-aarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 plat_dyn = false
diff --git a/test-suit/arceos/rust/net/echoserver/build-loongarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/net/echoserver/build-loongarch64-unknown-none-softfloat.toml
index 90c976edd0..71b6acb4b4 100644
--- a/test-suit/arceos/rust/net/echoserver/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/net/echoserver/build-loongarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/echoserver/build-riscv64gc-unknown-none-elf.toml b/test-suit/arceos/rust/net/echoserver/build-riscv64gc-unknown-none-elf.toml
index 5187b10d7a..62722e59d6 100644
--- a/test-suit/arceos/rust/net/echoserver/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/arceos/rust/net/echoserver/build-riscv64gc-unknown-none-elf.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/echoserver/build-x86_64-unknown-none.toml b/test-suit/arceos/rust/net/echoserver/build-x86_64-unknown-none.toml
index 47ca5d96c6..eff1acc096 100644
--- a/test-suit/arceos/rust/net/echoserver/build-x86_64-unknown-none.toml
+++ b/test-suit/arceos/rust/net/echoserver/build-x86_64-unknown-none.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/x86-pc", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/x86-pc", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/httpclient/build-aarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/net/httpclient/build-aarch64-unknown-none-softfloat.toml
index fa1c413f97..0fcc053015 100644
--- a/test-suit/arceos/rust/net/httpclient/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/net/httpclient/build-aarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/plat-dyn", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 plat_dyn = true
diff --git a/test-suit/arceos/rust/net/httpclient/build-loongarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/net/httpclient/build-loongarch64-unknown-none-softfloat.toml
index 610dc403ec..0e39320b3d 100644
--- a/test-suit/arceos/rust/net/httpclient/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/net/httpclient/build-loongarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/httpclient/build-riscv64gc-unknown-none-elf.toml b/test-suit/arceos/rust/net/httpclient/build-riscv64gc-unknown-none-elf.toml
index ee9b43a5d6..d19a749068 100644
--- a/test-suit/arceos/rust/net/httpclient/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/arceos/rust/net/httpclient/build-riscv64gc-unknown-none-elf.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/httpclient/build-x86_64-unknown-none.toml b/test-suit/arceos/rust/net/httpclient/build-x86_64-unknown-none.toml
index 47ca5d96c6..eff1acc096 100644
--- a/test-suit/arceos/rust/net/httpclient/build-x86_64-unknown-none.toml
+++ b/test-suit/arceos/rust/net/httpclient/build-x86_64-unknown-none.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/x86-pc", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/x86-pc", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/httpserver/build-aarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/net/httpserver/build-aarch64-unknown-none-softfloat.toml
index 702f89231d..d885073496 100644
--- a/test-suit/arceos/rust/net/httpserver/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/net/httpserver/build-aarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 plat_dyn = false
diff --git a/test-suit/arceos/rust/net/httpserver/build-loongarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/net/httpserver/build-loongarch64-unknown-none-softfloat.toml
index 90c976edd0..71b6acb4b4 100644
--- a/test-suit/arceos/rust/net/httpserver/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/net/httpserver/build-loongarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/httpserver/build-riscv64gc-unknown-none-elf.toml b/test-suit/arceos/rust/net/httpserver/build-riscv64gc-unknown-none-elf.toml
index 5187b10d7a..62722e59d6 100644
--- a/test-suit/arceos/rust/net/httpserver/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/arceos/rust/net/httpserver/build-riscv64gc-unknown-none-elf.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/httpserver/build-x86_64-unknown-none.toml b/test-suit/arceos/rust/net/httpserver/build-x86_64-unknown-none.toml
index 47ca5d96c6..eff1acc096 100644
--- a/test-suit/arceos/rust/net/httpserver/build-x86_64-unknown-none.toml
+++ b/test-suit/arceos/rust/net/httpserver/build-x86_64-unknown-none.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/x86-pc", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/x86-pc", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/udpserver/build-aarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/net/udpserver/build-aarch64-unknown-none-softfloat.toml
index 702f89231d..d885073496 100644
--- a/test-suit/arceos/rust/net/udpserver/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/net/udpserver/build-aarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/aarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 plat_dyn = false
diff --git a/test-suit/arceos/rust/net/udpserver/build-loongarch64-unknown-none-softfloat.toml b/test-suit/arceos/rust/net/udpserver/build-loongarch64-unknown-none-softfloat.toml
index 90c976edd0..71b6acb4b4 100644
--- a/test-suit/arceos/rust/net/udpserver/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/arceos/rust/net/udpserver/build-loongarch64-unknown-none-softfloat.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/loongarch64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/udpserver/build-riscv64gc-unknown-none-elf.toml b/test-suit/arceos/rust/net/udpserver/build-riscv64gc-unknown-none-elf.toml
index 5187b10d7a..62722e59d6 100644
--- a/test-suit/arceos/rust/net/udpserver/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/arceos/rust/net/udpserver/build-riscv64gc-unknown-none-elf.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/riscv64-qemu-virt", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/arceos/rust/net/udpserver/build-x86_64-unknown-none.toml b/test-suit/arceos/rust/net/udpserver/build-x86_64-unknown-none.toml
index 47ca5d96c6..eff1acc096 100644
--- a/test-suit/arceos/rust/net/udpserver/build-x86_64-unknown-none.toml
+++ b/test-suit/arceos/rust/net/udpserver/build-x86_64-unknown-none.toml
@@ -1,4 +1,4 @@
-features = ["ax-std", "ax-hal/x86-pc", "ax-driver/pci", "ax-driver/virtio-net"]
+features = ["ax-std", "ax-hal/x86-pc", "ax-driver/plat-static", "ax-driver/virtio-net"]
 log = "Warn"
 max_cpu_num = 4
 
diff --git a/test-suit/axvisor/normal/board-rdk-s100/build-aarch64-unknown-none-softfloat.toml b/test-suit/axvisor/normal/board-rdk-s100/build-aarch64-unknown-none-softfloat.toml
index 3744939244..82d078a057 100644
--- a/test-suit/axvisor/normal/board-rdk-s100/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/axvisor/normal/board-rdk-s100/build-aarch64-unknown-none-softfloat.toml
@@ -1,6 +1,5 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
-  "ax-hal/plat-dyn",
     "ept-level-4",
 ]
 log = "Info"
diff --git a/test-suit/axvisor/normal/qemu/build-aarch64-unknown-none-softfloat.toml b/test-suit/axvisor/normal/qemu/build-aarch64-unknown-none-softfloat.toml
index 85565cb686..7079f96928 100644
--- a/test-suit/axvisor/normal/qemu/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/axvisor/normal/qemu/build-aarch64-unknown-none-softfloat.toml
@@ -1,6 +1,5 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
-  "ax-hal/plat-dyn",
     "ept-level-4",
     "ax-driver/virtio-blk",
     "fs",
diff --git a/test-suit/axvisor/normal/qemu/build-loongarch64-unknown-none-softfloat.toml b/test-suit/axvisor/normal/qemu/build-loongarch64-unknown-none-softfloat.toml
index d16951f9f4..1e7fa7e04b 100644
--- a/test-suit/axvisor/normal/qemu/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/axvisor/normal/qemu/build-loongarch64-unknown-none-softfloat.toml
@@ -1,7 +1,7 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
   "ax-driver/virtio-blk",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ept-level-4",
   "fs",
 ]
diff --git a/test-suit/axvisor/normal/qemu/build-riscv64gc-unknown-none-elf.toml b/test-suit/axvisor/normal/qemu/build-riscv64gc-unknown-none-elf.toml
index 4e9112e70c..7cbfe678fb 100644
--- a/test-suit/axvisor/normal/qemu/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/axvisor/normal/qemu/build-riscv64gc-unknown-none-elf.toml
@@ -1,13 +1,12 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
-    "ax-hal/riscv64-qemu-virt-hv",
-    "ax-driver/fdt",
     "ax-driver/virtio-blk",
     "ept-level-4",
     "fs",
     "sstc"
 ]
 log = "Info"
+plat_dyn = true
 target = "riscv64gc-unknown-none-elf"
 vm_configs = ["os/axvisor/configs/vms/linux-riscv64-qemu-smp1.toml"]
 max_cpu_num = 4
diff --git a/test-suit/axvisor/normal/qemu/build-x86_64-unknown-none.toml b/test-suit/axvisor/normal/qemu/build-x86_64-unknown-none.toml
index fccc9c223a..96a1fc057a 100644
--- a/test-suit/axvisor/normal/qemu/build-x86_64-unknown-none.toml
+++ b/test-suit/axvisor/normal/qemu/build-x86_64-unknown-none.toml
@@ -1,7 +1,7 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
     "ax-driver/virtio-blk",
-    "ax-driver/pci",
+    "ax-driver/plat-static",
     "ept-level-4",
     "fs",
     "vmx",
diff --git a/test-suit/axvisor/svm/qemu/build-x86_64-unknown-none.toml b/test-suit/axvisor/svm/qemu/build-x86_64-unknown-none.toml
index 832d68593f..c160743f7c 100644
--- a/test-suit/axvisor/svm/qemu/build-x86_64-unknown-none.toml
+++ b/test-suit/axvisor/svm/qemu/build-x86_64-unknown-none.toml
@@ -1,7 +1,7 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
     "ax-driver/virtio-blk",
-    "ax-driver/pci",
+    "ax-driver/plat-static",
     "ept-level-4",
     "fs",
     "svm",
diff --git a/test-suit/starryos/aarch64-hvf/test-aarch64-gicv3-smoke/build-aarch64-unknown-none-softfloat.toml b/test-suit/starryos/aarch64-hvf/test-aarch64-gicv3-smoke/build-aarch64-unknown-none-softfloat.toml
index 8255f9fe7d..ad16f45be8 100644
--- a/test-suit/starryos/aarch64-hvf/test-aarch64-gicv3-smoke/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/aarch64-hvf/test-aarch64-gicv3-smoke/build-aarch64-unknown-none-softfloat.toml
@@ -1,16 +1,13 @@
 env = { AX_IP = "10.0.2.15", AX_GW = "10.0.2.2" }
 features = [
-  "ax-hal/plat-dyn",
   "ax-feat/display",
   "ax-feat/rtc",
-  "ax-driver/pci",
   "ax-driver/rtc",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "gic-v3",
   "cntv-timer",
   "starry-kernel/input",
-  "starry-kernel/plat-dyn",
   "starry-kernel/vsock",
 ]
 # CNTV PPI 11 = IRQ 27. The kernel's `cntv-timer` path programs the
diff --git a/test-suit/starryos/normal/board-licheerv-nano-sg2002/build-riscv64gc-unknown-none-elf.toml b/test-suit/starryos/normal/board-licheerv-nano-sg2002/build-riscv64gc-unknown-none-elf.toml
index f4d0d68008..5d1445e2fb 100644
--- a/test-suit/starryos/normal/board-licheerv-nano-sg2002/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/starryos/normal/board-licheerv-nano-sg2002/build-riscv64gc-unknown-none-elf.toml
@@ -1,7 +1,13 @@
 # Build-time config template for StarryOS on SG2002.
 target = "riscv64gc-unknown-none-elf"
 env = {}
-features = ["sg2002"]
+features = [
+  "starry-kernel/sg2002",
+  "axplat-dyn/thead-mae",
+  "ax-driver/sg2002-placeholder",
+  "ax-driver/cvsd",
+  "ax-driver/serial",
+]
 log = "Info"
 max_cpu_num = 1
-plat_dyn = false
+plat_dyn = true
diff --git a/test-suit/starryos/normal/board-orangepi-5-plus/build-aarch64-unknown-none-softfloat.toml b/test-suit/starryos/normal/board-orangepi-5-plus/build-aarch64-unknown-none-softfloat.toml
index 5ca9f332f2..3a3a986c62 100644
--- a/test-suit/starryos/normal/board-orangepi-5-plus/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/normal/board-orangepi-5-plus/build-aarch64-unknown-none-softfloat.toml
@@ -3,9 +3,7 @@ target = "aarch64-unknown-none-softfloat"
 # Runtime U-Boot settings live in `orangepi-5-plus-uboot.toml`.
 env = {}
 features = [
-  "ax-hal/plat-dyn",
-  "starry-kernel/plat-dyn",
-  "ax-driver/pci-list-devices",
+  "ax-driver/list-pci-devices",
   "ax-driver/rk3588-pcie",
   "ax-driver/realtek-rtl8125",
   "ax-driver/rockchip-soc",
diff --git a/test-suit/starryos/normal/qemu-aarch64-plat-dyn/build-aarch64-unknown-none-softfloat.toml b/test-suit/starryos/normal/qemu-aarch64-plat-dyn/build-aarch64-unknown-none-softfloat.toml
index 3069e0b191..71d3294162 100644
--- a/test-suit/starryos/normal/qemu-aarch64-plat-dyn/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/normal/qemu-aarch64-plat-dyn/build-aarch64-unknown-none-softfloat.toml
@@ -1,12 +1,10 @@
 env = {}
 features = [
-  "ax-hal/plat-dyn",
   "ax-feat/rtc",
   "ax-driver/rtc",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "starry-kernel/input",
-  "starry-kernel/plat-dyn",
   "starry-kernel/vsock",
   "ax-driver/intel-net",
   "ax-driver/xhci-pci",
diff --git a/test-suit/starryos/normal/qemu-dhcp/build-x86_64-unknown-none.toml b/test-suit/starryos/normal/qemu-dhcp/build-x86_64-unknown-none.toml
index 7efd9aa1bd..1128aa2eb9 100644
--- a/test-suit/starryos/normal/qemu-dhcp/build-x86_64-unknown-none.toml
+++ b/test-suit/starryos/normal/qemu-dhcp/build-x86_64-unknown-none.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/x86-pc",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-aarch64.toml b/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-aarch64.toml
index d719a0adf8..4bfffbcf74 100644
--- a/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-aarch64.toml
+++ b/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-aarch64.toml
@@ -96,5 +96,5 @@ test_commands = [
     "/usr/bin/bug-waitid-basic",
 ]
 success_regex = ["(?m)^STARRY_GROUPED_TESTS_PASSED\\s*$"]
-fail_regex = ['(?i)\bpanic(?:ked)?\b', '(?m)^STARRY_GROUPED_TEST_FAILED:']
+fail_regex = ['(?i)\bpanic(?:ked)?\b', "(?m)^lockdep fatal violation\\s*$", '(?m)^STARRY_GROUPED_TEST_FAILED:']
 timeout = 360
diff --git a/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-loongarch64.toml b/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-loongarch64.toml
index 50a7e7d342..7b92c33e8f 100644
--- a/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-loongarch64.toml
+++ b/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-loongarch64.toml
@@ -97,5 +97,5 @@ test_commands = [
     "/usr/bin/bug-waitid-basic",
 ]
 success_regex = ["(?m)^STARRY_GROUPED_TESTS_PASSED\\s*$"]
-fail_regex = ['(?i)\bpanic(?:ked)?\b', '(?m)^STARRY_GROUPED_TEST_FAILED:']
+fail_regex = ['(?i)\bpanic(?:ked)?\b', "(?m)^lockdep fatal violation\\s*$", '(?m)^STARRY_GROUPED_TEST_FAILED:']
 timeout = 360
diff --git a/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-riscv64.toml b/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-riscv64.toml
index 343b4466cc..dd019dcaa5 100644
--- a/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-riscv64.toml
+++ b/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-riscv64.toml
@@ -105,5 +105,5 @@ test_commands = [
     "/usr/bin/bug-waitid-basic",
 ]
 success_regex = ["(?m)^STARRY_GROUPED_TESTS_PASSED\\s*$"]
-fail_regex = ['(?i)\bpanic(?:ked)?\b', '(?m)^STARRY_GROUPED_TEST_FAILED:']
+fail_regex = ['(?i)\bpanic(?:ked)?\b', "(?m)^lockdep fatal violation\\s*$", '(?m)^STARRY_GROUPED_TEST_FAILED:']
 timeout = 360
diff --git a/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-x86_64.toml b/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-x86_64.toml
index 21f1152c8e..e8b1a476ed 100644
--- a/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-x86_64.toml
+++ b/test-suit/starryos/normal/qemu-smp1/bugfix/qemu-x86_64.toml
@@ -102,5 +102,5 @@ test_commands = [
     "/usr/bin/bug-waitid-basic",
 ]
 success_regex = ["(?m)^STARRY_GROUPED_TESTS_PASSED\\s*$"]
-fail_regex = ['(?i)\bpanic(?:ked)?\b', '(?m)^STARRY_GROUPED_TEST_FAILED:']
+fail_regex = ['(?i)\bpanic(?:ked)?\b', "(?m)^lockdep fatal violation\\s*$", '(?m)^STARRY_GROUPED_TEST_FAILED:']
 timeout = 360
diff --git a/test-suit/starryos/normal/qemu-smp1/build-aarch64-unknown-none-softfloat.toml b/test-suit/starryos/normal/qemu-smp1/build-aarch64-unknown-none-softfloat.toml
index 857f3a3dbd..6642260288 100644
--- a/test-suit/starryos/normal/qemu-smp1/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/normal/qemu-smp1/build-aarch64-unknown-none-softfloat.toml
@@ -1,9 +1,7 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
-  "ax-hal/plat-dyn",
   "ax-feat/display",
   "ax-feat/rtc",
-  "ax-driver/pci",
   "ax-driver/rtc",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
@@ -11,7 +9,6 @@ features = [
   "ax-driver/virtio-input",
   "ax-driver/virtio-socket",
   "starry-kernel/input",
-  "starry-kernel/plat-dyn",
   "starry-kernel/vsock",
 ]
 log = "Warn"
diff --git a/test-suit/starryos/normal/qemu-smp1/build-loongarch64-unknown-none-softfloat.toml b/test-suit/starryos/normal/qemu-smp1/build-loongarch64-unknown-none-softfloat.toml
index 0dc0ec2bb6..b6e12457d5 100644
--- a/test-suit/starryos/normal/qemu-smp1/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/normal/qemu-smp1/build-loongarch64-unknown-none-softfloat.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/loongarch64-qemu-virt",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/test-suit/starryos/normal/qemu-smp1/build-riscv64gc-unknown-none-elf.toml b/test-suit/starryos/normal/qemu-smp1/build-riscv64gc-unknown-none-elf.toml
index 2df21769c5..66c877a2a2 100644
--- a/test-suit/starryos/normal/qemu-smp1/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/starryos/normal/qemu-smp1/build-riscv64gc-unknown-none-elf.toml
@@ -1,14 +1,15 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
-  "ax-hal/riscv64-qemu-virt",
-  "qemu",
-  "ax-driver/pci",
+  "ax-feat/rtc",
+  "ax-driver/rtc",
+  "ax-driver/serial",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
   "ax-driver/virtio-input",
   "ax-driver/virtio-socket",
+  "starry-kernel/input",
 ]
 log = "Warn"
-plat_dyn = false
+plat_dyn = true
 target = "riscv64gc-unknown-none-elf"
diff --git a/test-suit/starryos/normal/qemu-smp1/build-x86_64-unknown-none.toml b/test-suit/starryos/normal/qemu-smp1/build-x86_64-unknown-none.toml
index 94d8986bbb..48f79a5df5 100644
--- a/test-suit/starryos/normal/qemu-smp1/build-x86_64-unknown-none.toml
+++ b/test-suit/starryos/normal/qemu-smp1/build-x86_64-unknown-none.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/x86-pc",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/test-suit/starryos/normal/qemu-smp4-buddy-slab/build-aarch64-unknown-none-softfloat.toml b/test-suit/starryos/normal/qemu-smp4-buddy-slab/build-aarch64-unknown-none-softfloat.toml
index f24592654f..8b785b5ae5 100644
--- a/test-suit/starryos/normal/qemu-smp4-buddy-slab/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/normal/qemu-smp4-buddy-slab/build-aarch64-unknown-none-softfloat.toml
@@ -1,9 +1,7 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
-  "ax-hal/plat-dyn",
   "ax-feat/display",
   "ax-feat/rtc",
-  "ax-driver/pci",
   "ax-driver/rtc",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
@@ -11,7 +9,6 @@ features = [
   "ax-driver/virtio-input",
   "ax-driver/virtio-socket",
   "starry-kernel/input",
-  "starry-kernel/plat-dyn",
   "starry-kernel/vsock",
   "starryos/buddy-slab",
 ]
diff --git a/test-suit/starryos/normal/qemu-smp4/build-aarch64-unknown-none-softfloat.toml b/test-suit/starryos/normal/qemu-smp4/build-aarch64-unknown-none-softfloat.toml
index 0cc1c3db01..3f72491b2b 100644
--- a/test-suit/starryos/normal/qemu-smp4/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/normal/qemu-smp4/build-aarch64-unknown-none-softfloat.toml
@@ -1,9 +1,7 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
-  "ax-hal/plat-dyn",
   "ax-feat/display",
   "ax-feat/rtc",
-  "ax-driver/pci",
   "ax-driver/rtc",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
@@ -11,7 +9,6 @@ features = [
   "ax-driver/virtio-input",
   "ax-driver/virtio-socket",
   "starry-kernel/input",
-  "starry-kernel/plat-dyn",
   "starry-kernel/vsock",
 ]
 max_cpu_num = 4
diff --git a/test-suit/starryos/normal/qemu-smp4/build-loongarch64-unknown-none-softfloat.toml b/test-suit/starryos/normal/qemu-smp4/build-loongarch64-unknown-none-softfloat.toml
index aea79288ad..fb74bee24c 100644
--- a/test-suit/starryos/normal/qemu-smp4/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/normal/qemu-smp4/build-loongarch64-unknown-none-softfloat.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/loongarch64-qemu-virt",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/test-suit/starryos/normal/qemu-smp4/build-riscv64gc-unknown-none-elf.toml b/test-suit/starryos/normal/qemu-smp4/build-riscv64gc-unknown-none-elf.toml
index f9e4ff6cb8..a4668fafd3 100644
--- a/test-suit/starryos/normal/qemu-smp4/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/starryos/normal/qemu-smp4/build-riscv64gc-unknown-none-elf.toml
@@ -1,8 +1,8 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
-  "ax-hal/riscv64-qemu-virt",
-  "qemu",
-  "ax-driver/pci",
+  "ax-feat/rtc",
+  "ax-driver/rtc",
+  "ax-driver/serial",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
@@ -11,5 +11,5 @@ features = [
 ]
 max_cpu_num = 4
 log = "Warn"
-plat_dyn = false
+plat_dyn = true
 target = "riscv64gc-unknown-none-elf"
diff --git a/test-suit/starryos/normal/qemu-smp4/build-x86_64-unknown-none.toml b/test-suit/starryos/normal/qemu-smp4/build-x86_64-unknown-none.toml
index 3f616671f3..415120f3e0 100644
--- a/test-suit/starryos/normal/qemu-smp4/build-x86_64-unknown-none.toml
+++ b/test-suit/starryos/normal/qemu-smp4/build-x86_64-unknown-none.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/x86-pc",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/test-suit/starryos/stress/postgresql/build-aarch64-unknown-none-softfloat.toml b/test-suit/starryos/stress/postgresql/build-aarch64-unknown-none-softfloat.toml
index 857f3a3dbd..6642260288 100644
--- a/test-suit/starryos/stress/postgresql/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/stress/postgresql/build-aarch64-unknown-none-softfloat.toml
@@ -1,9 +1,7 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
-  "ax-hal/plat-dyn",
   "ax-feat/display",
   "ax-feat/rtc",
-  "ax-driver/pci",
   "ax-driver/rtc",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
@@ -11,7 +9,6 @@ features = [
   "ax-driver/virtio-input",
   "ax-driver/virtio-socket",
   "starry-kernel/input",
-  "starry-kernel/plat-dyn",
   "starry-kernel/vsock",
 ]
 log = "Warn"
diff --git a/test-suit/starryos/stress/postgresql/build-loongarch64-unknown-none-softfloat.toml b/test-suit/starryos/stress/postgresql/build-loongarch64-unknown-none-softfloat.toml
index 0dc0ec2bb6..b6e12457d5 100644
--- a/test-suit/starryos/stress/postgresql/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/stress/postgresql/build-loongarch64-unknown-none-softfloat.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/loongarch64-qemu-virt",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/test-suit/starryos/stress/postgresql/build-riscv64gc-unknown-none-elf.toml b/test-suit/starryos/stress/postgresql/build-riscv64gc-unknown-none-elf.toml
index 2df21769c5..d5a03b3263 100644
--- a/test-suit/starryos/stress/postgresql/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/starryos/stress/postgresql/build-riscv64gc-unknown-none-elf.toml
@@ -1,8 +1,8 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
-  "ax-hal/riscv64-qemu-virt",
-  "qemu",
-  "ax-driver/pci",
+  "ax-feat/rtc",
+  "ax-driver/rtc",
+  "ax-driver/serial",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
@@ -10,5 +10,5 @@ features = [
   "ax-driver/virtio-socket",
 ]
 log = "Warn"
-plat_dyn = false
+plat_dyn = true
 target = "riscv64gc-unknown-none-elf"
diff --git a/test-suit/starryos/stress/postgresql/build-x86_64-unknown-none.toml b/test-suit/starryos/stress/postgresql/build-x86_64-unknown-none.toml
index 94d8986bbb..48f79a5df5 100644
--- a/test-suit/starryos/stress/postgresql/build-x86_64-unknown-none.toml
+++ b/test-suit/starryos/stress/postgresql/build-x86_64-unknown-none.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/x86-pc",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/test-suit/starryos/stress/stress-ng-0/build-aarch64-unknown-none-softfloat.toml b/test-suit/starryos/stress/stress-ng-0/build-aarch64-unknown-none-softfloat.toml
index 857f3a3dbd..6642260288 100644
--- a/test-suit/starryos/stress/stress-ng-0/build-aarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/stress/stress-ng-0/build-aarch64-unknown-none-softfloat.toml
@@ -1,9 +1,7 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
-  "ax-hal/plat-dyn",
   "ax-feat/display",
   "ax-feat/rtc",
-  "ax-driver/pci",
   "ax-driver/rtc",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
@@ -11,7 +9,6 @@ features = [
   "ax-driver/virtio-input",
   "ax-driver/virtio-socket",
   "starry-kernel/input",
-  "starry-kernel/plat-dyn",
   "starry-kernel/vsock",
 ]
 log = "Warn"
diff --git a/test-suit/starryos/stress/stress-ng-0/build-loongarch64-unknown-none-softfloat.toml b/test-suit/starryos/stress/stress-ng-0/build-loongarch64-unknown-none-softfloat.toml
index 0dc0ec2bb6..b6e12457d5 100644
--- a/test-suit/starryos/stress/stress-ng-0/build-loongarch64-unknown-none-softfloat.toml
+++ b/test-suit/starryos/stress/stress-ng-0/build-loongarch64-unknown-none-softfloat.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/loongarch64-qemu-virt",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/test-suit/starryos/stress/stress-ng-0/build-riscv64gc-unknown-none-elf.toml b/test-suit/starryos/stress/stress-ng-0/build-riscv64gc-unknown-none-elf.toml
index 2df21769c5..d5a03b3263 100644
--- a/test-suit/starryos/stress/stress-ng-0/build-riscv64gc-unknown-none-elf.toml
+++ b/test-suit/starryos/stress/stress-ng-0/build-riscv64gc-unknown-none-elf.toml
@@ -1,8 +1,8 @@
 env = {AX_IP = "10.0.2.15", AX_GW = "10.0.2.2"}
 features = [
-  "ax-hal/riscv64-qemu-virt",
-  "qemu",
-  "ax-driver/pci",
+  "ax-feat/rtc",
+  "ax-driver/rtc",
+  "ax-driver/serial",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
@@ -10,5 +10,5 @@ features = [
   "ax-driver/virtio-socket",
 ]
 log = "Warn"
-plat_dyn = false
+plat_dyn = true
 target = "riscv64gc-unknown-none-elf"
diff --git a/test-suit/starryos/stress/stress-ng-0/build-x86_64-unknown-none.toml b/test-suit/starryos/stress/stress-ng-0/build-x86_64-unknown-none.toml
index 94d8986bbb..48f79a5df5 100644
--- a/test-suit/starryos/stress/stress-ng-0/build-x86_64-unknown-none.toml
+++ b/test-suit/starryos/stress/stress-ng-0/build-x86_64-unknown-none.toml
@@ -4,7 +4,7 @@ log = "Warn"
 features = [
   "ax-hal/x86-pc",
   "qemu",
-  "ax-driver/pci",
+  "ax-driver/plat-static",
   "ax-driver/virtio-blk",
   "ax-driver/virtio-net",
   "ax-driver/virtio-gpu",
diff --git a/virtualization/riscv_vcpu/src/mem_extable.S b/virtualization/riscv_vcpu/src/mem_extable.S
index 2033de9573..de5d4bbff1 100644
--- a/virtualization/riscv_vcpu/src/mem_extable.S
+++ b/virtualization/riscv_vcpu/src/mem_extable.S
@@ -7,9 +7,9 @@
 // Adds the faulting instruction and fixup target to the exception table.
 .macro add_extable from, to
 .pushsection __ex_table, "a"
-.balign      8
-.quad        \from
-.quad        \to
+.balign      4
+.word        \from - _ex_table_start
+.word        \to - _ex_table_start
 .popsection
 .endm
 .option push