diff --git a/lab3/kernel/build/kernel8.elf b/lab3/kernel/build/kernel8.elf
index 03d4b2547..5e498fa1c 100755
Binary files a/lab3/kernel/build/kernel8.elf and b/lab3/kernel/build/kernel8.elf differ
diff --git a/lab3/kernel/src/exception.c b/lab3/kernel/src/exception.c
index c91cf021d..33f3b7c0e 100644
--- a/lab3/kernel/src/exception.c
+++ b/lab3/kernel/src/exception.c
@@ -24,13 +24,13 @@ void el1h_irq_router(){
         if (*AUX_MU_IIR_REG & (1 << 1)) // FIFO clear bits
         {
             *AUX_MU_IER_REG &= ~(2);  // disable write interrupt
-            irqtask_add(uart_w_irq_handler, UART_IRQ_PRIORITY);
+            irqtask_add(uart_w_irq_handler, UART_IRQ_PRIORITY); //rpi write mean we read
             irqtask_run_preemptive(); // run the queued task before returning to the program.
         }
         else if (*AUX_MU_IIR_REG & (2 << 1)) // Interrupt ID bits
         {
             *AUX_MU_IER_REG &= ~(1);  // disable read interrupt
-            irqtask_add(uart_r_irq_handler, timer_priority);
+            irqtask_add(uart_r_irq_handler, UART_IRQ_PRIORITY); //rpi read mean we write
             irqtask_run_preemptive();
         }
     }
@@ -154,8 +154,7 @@ void irqtask_run_preemptive()
         // Run new task (early return) if its priority is lower than the scheduled task.
         if (curr_task_priority <= the_task->priority)
         {
-            exit = 1;
-
+            //exit = 1;
             el1_interrupt_enable();
             break;
         }
diff --git a/lab3/kernel/src/shell.c b/lab3/kernel/src/shell.c
index cc8a69974..e6d7c6193 100644
--- a/lab3/kernel/src/shell.c
+++ b/lab3/kernel/src/shell.c
@@ -33,12 +33,12 @@ void cli_cmd_read(char* buffer)
     while (1)
     {
         if (idx >= CMD_MAX_LEN) break;
-        c = uart_async_getc(); //test preemtive
+        c = uart_async_getc(); 
         if (c == '\n') break;
 
         if (c == 127 && idx > 0)
         {
-            uart_puts("\b \b"); //test preemptive
+            uart_puts("\b \b"); 
             idx--;
             continue;
         }        
@@ -301,7 +301,7 @@ void do_cmd_reboot()
 void do_test_preemptive()
 {
     add_timer(test_loop, 1, "test loop");
-    add_timer(set_exit, 10, "exit");
+    add_timer(set_exit, 5, "exit");
 }
 
 volatile int exit = 0;
@@ -314,6 +314,6 @@ void test_loop()
 
 void set_exit()
 {
-    //exit = 1;
-    uart_sendline("We set exit as 1 to exit infinite loop at t = 10s.\n");
+    exit = 1;
+    uart_sendline("We set exit as 1 to exit infinite loop at t = 5s.\n");
 }
\ No newline at end of file
diff --git a/lab3/kernel/src/timer.c b/lab3/kernel/src/timer.c
index 3f24138af..58bdfc594 100644
--- a/lab3/kernel/src/timer.c
+++ b/lab3/kernel/src/timer.c
@@ -7,6 +7,7 @@
 #define STR(x) #x
 #define XSTR(s) STR(s)
 
+
 struct list_head* timer_event_list;  // first head has nothing, store timer_event_t after it 
 
 void timer_list_init(){
@@ -60,12 +61,13 @@ void timer_event_callback(timer_event_t * timer_event){
     }
     core_timer_enable();
     ((void (*)(char*))timer_event->callback)(timer_event->args);  // call the event
+    
 }
 
 void timer_set2sAlert(char* str)
 {
     static int count = 0;
-    if(count > 10){
+    if(count > 3){
         return;
     }
     count++;
diff --git a/lab3/kernel/src/uart1.c b/lab3/kernel/src/uart1.c
index 557043054..d56dddabd 100644
--- a/lab3/kernel/src/uart1.c
+++ b/lab3/kernel/src/uart1.c
@@ -90,32 +90,53 @@ int  uart_sendline(char* fmt, ...) {
 }
 
 
-// uart_async_getc read from buffer
-// uart_r_irq_handler write to buffer then output
+// Read a character asynchronously from UART receive buffer.
 char uart_async_getc() {
-    *AUX_MU_IER_REG |=1; // enable read interrupt
-    // do while if buffer empty
-    while (uart_rx_buffer_ridx == uart_rx_buffer_widx) *AUX_MU_IER_REG |=1; // enable read interrupt
+    // Enable read interrupt
+    *AUX_MU_IER_REG |= 1;
+    
+    // Loop until the buffer has data
+    while (uart_rx_buffer_ridx == uart_rx_buffer_widx) {
+        *AUX_MU_IER_REG |= 1; // Keep enabling read interrupt
+    }
+    
+    // Disable interrupts to ensure atomic operations
     el1_interrupt_disable();
+    
+    // Read character from the buffer and increment read index
     char r = uart_rx_buffer[uart_rx_buffer_ridx++];
+    // Wrap around the index if it exceeds the buffer size
     if (uart_rx_buffer_ridx >= VSPRINT_MAX_BUF_SIZE) uart_rx_buffer_ridx = 0;
+    
+    // Re-enable interrupts
     el1_interrupt_enable();
-    return r;
+    
+    return r; // Return the read character
 }
 
-
-// uart_async_putc writes to buffer
-// uart_w_irq_handler read from buffer then output
+// Write a character asynchronously to UART transmit buffer.
 void uart_async_putc(char c) {
-    // if buffer full, wait for uart_w_irq_handler
-    while( (uart_tx_buffer_widx + 1) % VSPRINT_MAX_BUF_SIZE == uart_tx_buffer_ridx )  *AUX_MU_IER_REG |=2;  // enable write interrupt
+    // Wait if the buffer is full
+    while((uart_tx_buffer_widx + 1) % VSPRINT_MAX_BUF_SIZE == uart_tx_buffer_ridx) {
+        *AUX_MU_IER_REG |= 2;  // Enable write interrupt
+    }
+    
+    // Disable interrupts to ensure atomic operations
     el1_interrupt_disable();
+    
+    // Write character to the buffer and increment write index
     uart_tx_buffer[uart_tx_buffer_widx++] = c;
-    if(uart_tx_buffer_widx >= VSPRINT_MAX_BUF_SIZE) uart_tx_buffer_widx=0;  // cycle pointer
+    // Wrap around the index if it exceeds the buffer size
+    if(uart_tx_buffer_widx >= VSPRINT_MAX_BUF_SIZE) uart_tx_buffer_widx = 0;
+    
+    // Re-enable interrupts
     el1_interrupt_enable();
-    *AUX_MU_IER_REG |=2;  // enable write interrupt
+    
+    // Enable write interrupt
+    *AUX_MU_IER_REG |= 2;
 }
 
+
 int  uart_puts(char* fmt, ...) {
     __builtin_va_list args;
     __builtin_va_start(args, fmt);
@@ -147,25 +168,36 @@ void uart_interrupt_disable(){
 }
 
 
-void uart_r_irq_handler(){
-    if((uart_rx_buffer_widx + 1) % VSPRINT_MAX_BUF_SIZE == uart_rx_buffer_ridx)
-    {
-        *AUX_MU_IER_REG &= ~(1);  // disable read interrupt
+// UART receive interrupt handler
+void uart_r_irq_handler() {
+    // Check if the buffer is full
+    if((uart_rx_buffer_widx + 1) % VSPRINT_MAX_BUF_SIZE == uart_rx_buffer_ridx) {
+        // Disable read interrupt to prevent overflow
+        *AUX_MU_IER_REG &= ~(1);
         return;
     }
+    // Read data from UART and store it in the buffer
     uart_rx_buffer[uart_rx_buffer_widx++] = uart_recv();
-    if(uart_rx_buffer_widx>=VSPRINT_MAX_BUF_SIZE) uart_rx_buffer_widx=0;
-    *AUX_MU_IER_REG |=1;
+    // Wrap the write index if it reaches the buffer size
+    if(uart_rx_buffer_widx >= VSPRINT_MAX_BUF_SIZE) uart_rx_buffer_widx = 0;
+    // Re-enable read interrupt
+    *AUX_MU_IER_REG |= 1;
 }
 
-void uart_w_irq_handler(){
-    if(uart_tx_buffer_ridx == uart_tx_buffer_widx)
-    {
-        *AUX_MU_IER_REG &= ~(2);  // disable write interrupt
-        return;  // buffer empty
+// UART write interrupt handler
+void uart_w_irq_handler() {
+    // Check if the buffer is empty
+    if(uart_tx_buffer_ridx == uart_tx_buffer_widx) {
+        // Disable write interrupt to avoid unnecessary interrupts
+        *AUX_MU_IER_REG &= ~(2);
+        return;  // Exit if nothing to send
     }
+    // Send data from the buffer via UART
     uart_send(uart_tx_buffer[uart_tx_buffer_ridx++]);
-    if(uart_tx_buffer_ridx>=VSPRINT_MAX_BUF_SIZE) uart_tx_buffer_ridx=0;
-    *AUX_MU_IER_REG |=2;  // enable write interrupt
+    // Wrap the read index if it reaches the buffer size
+    if(uart_tx_buffer_ridx >= VSPRINT_MAX_BUF_SIZE) uart_tx_buffer_ridx = 0;
+    // Re-enable write interrupt
+    *AUX_MU_IER_REG |= 2;
 }
 
+
diff --git a/lab4/bootloader/bcm2710-rpi-3-b-plus.dtb b/lab4/bootloader/bcm2710-rpi-3-b-plus.dtb
new file mode 100644
index 000000000..38395a23f
Binary files /dev/null and b/lab4/bootloader/bcm2710-rpi-3-b-plus.dtb differ
diff --git a/lab4/bootloader/config.txt b/lab4/bootloader/config.txt
new file mode 100644
index 000000000..15654a481
--- /dev/null
+++ b/lab4/bootloader/config.txt
@@ -0,0 +1,3 @@
+kernel=bootloader.img
+arm_64bit=1
+initramfs initramfs.cpio 0x8000000
diff --git a/lab4/bootloader/include/bcm2837/rpi_base.h b/lab4/bootloader/include/bcm2837/rpi_base.h
new file mode 100644
index 000000000..e3259e8de
--- /dev/null
+++ b/lab4/bootloader/include/bcm2837/rpi_base.h
@@ -0,0 +1,6 @@
+#ifndef	_RPI_BASE_H_
+#define	_RPI_BASE_H_
+
+#define PERIPHERAL_BASE 0x3F000000
+
+#endif  /*_RPI_BASE_H_ */
diff --git a/lab4/bootloader/include/bcm2837/rpi_gpio.h b/lab4/bootloader/include/bcm2837/rpi_gpio.h
new file mode 100644
index 000000000..e5133708a
--- /dev/null
+++ b/lab4/bootloader/include/bcm2837/rpi_gpio.h
@@ -0,0 +1,25 @@
+#ifndef _RPI_GPIO_H_
+#define _RPI_GPIO_H_
+
+#include "bcm2837/rpi_base.h"
+
+#define GPFSEL0         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200000))
+#define GPFSEL1         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200004))
+#define GPFSEL2         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200008))
+#define GPFSEL3         ((volatile unsigned int*)(PERIPHERAL_BASE+0x0020000C))
+#define GPFSEL4         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200010))
+#define GPFSEL5         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200014))
+#define GPSET0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x0020001C))
+#define GPSET1          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200020))
+#define GPCLR0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200028))
+#define GPLEV0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200034))
+#define GPLEV1          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200038))
+#define GPEDS0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200040))
+#define GPEDS1          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200044))
+#define GPHEN0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200064))
+#define GPHEN1          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200068))
+#define GPPUD           ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200094))
+#define GPPUDCLK0       ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200098))
+#define GPPUDCLK1       ((volatile unsigned int*)(PERIPHERAL_BASE+0x0020009C))
+
+#endif /*_RPI_GPIO_H_*/
diff --git a/lab4/bootloader/include/bcm2837/rpi_uart1.h b/lab4/bootloader/include/bcm2837/rpi_uart1.h
new file mode 100644
index 000000000..959130656
--- /dev/null
+++ b/lab4/bootloader/include/bcm2837/rpi_uart1.h
@@ -0,0 +1,19 @@
+#ifndef	_RPI_UART1_H_
+#define	_RPI_UART1_H_
+
+#include "bcm2837/rpi_base.h"
+
+#define AUX_ENABLES     ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215004))
+#define AUX_MU_IO_REG   ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215040))
+#define AUX_MU_IER_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215044))
+#define AUX_MU_IIR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215048))
+#define AUX_MU_LCR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x0021504C))
+#define AUX_MU_MCR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215050))
+#define AUX_MU_LSR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215054))
+#define AUX_MU_MSR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215058))
+#define AUX_MU_SCRATCH  ((volatile unsigned int*)(PERIPHERAL_BASE+0x0021505C))
+#define AUX_MU_CNTL_REG ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215060))
+#define AUX_MU_STAT_REG ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215064))
+#define AUX_MU_BAUD_REG ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215068))
+
+#endif  /*_RPI_UART1_H_ */
diff --git a/lab4/bootloader/include/power.h b/lab4/bootloader/include/power.h
new file mode 100644
index 000000000..baf990974
--- /dev/null
+++ b/lab4/bootloader/include/power.h
@@ -0,0 +1,8 @@
+#ifndef	_POWER_H_
+#define	_POWER_H_
+
+#define PM_PASSWORD 0x5a000000
+#define PM_RSTC     0x3F10001c
+#define PM_WDOG     0x3F100024
+
+#endif /*_POWER_H_*/
diff --git a/lab4/bootloader/include/shell.h b/lab4/bootloader/include/shell.h
new file mode 100644
index 000000000..702f5eb14
--- /dev/null
+++ b/lab4/bootloader/include/shell.h
@@ -0,0 +1,23 @@
+#ifndef _SHELL_H_
+#define _SHELL_H_
+
+#define CLI_MAX_CMD 3
+#define CMD_MAX_LEN 32
+#define MSG_MAX_LEN 128
+
+typedef struct CLI_CMDS
+{
+    char command[CMD_MAX_LEN];
+    char help[MSG_MAX_LEN];
+} CLI_CMDS;
+
+void cli_cmd_clear(char*, int);
+void cli_cmd_read(char*);
+void cli_cmd_exec(char*);
+void cli_print_banner();
+
+void do_cmd_help();
+void do_cmd_loadimg();
+void do_cmd_reboot();
+
+#endif /* _SHELL_H_ */
diff --git a/lab4/bootloader/include/uart1.h b/lab4/bootloader/include/uart1.h
new file mode 100644
index 000000000..329d25c81
--- /dev/null
+++ b/lab4/bootloader/include/uart1.h
@@ -0,0 +1,11 @@
+#ifndef	_UART1_H_
+#define	_UART1_H_
+
+void uart_init();
+char uart_getc();
+char uart_recv();
+void uart_send(unsigned int c);
+int  uart_puts(char* fmt, ...);
+void uart_2hex(unsigned int d);
+
+#endif /*_UART1_H_*/
diff --git a/lab4/bootloader/include/utils.h b/lab4/bootloader/include/utils.h
new file mode 100644
index 000000000..e65ece675
--- /dev/null
+++ b/lab4/bootloader/include/utils.h
@@ -0,0 +1,11 @@
+#ifndef _UTILS_H_
+#define _UTILS_H_
+
+#define VSPRINT_MAX_BUF_SIZE 128
+
+unsigned int sprintf(char *dst, char* fmt, ...);
+unsigned int vsprintf(char *dst,char* fmt, __builtin_va_list args);
+
+int  strcmp(const char*, const char*);
+
+#endif /* _UTILS_H_ */
diff --git a/lab4/bootloader/makefile b/lab4/bootloader/makefile
new file mode 100644
index 000000000..b81bad692
--- /dev/null
+++ b/lab4/bootloader/makefile
@@ -0,0 +1,42 @@
+ARMGNU ?= aarch64-linux-gnu
+
+CFLAGS = -Wall -nostdlib -nostartfiles -ffreestanding -Iinclude -mgeneral-regs-only
+ASMFLAGS = -Iinclude
+
+BUILD_DIR = build
+SRC_DIR = src
+#---------------------------------------------------------------------------------------
+
+C_FILES = $(wildcard $(SRC_DIR)/*.c)
+ASM_FILES = $(wildcard $(SRC_DIR)/*.S)
+OBJ_FILES = $(C_FILES:$(SRC_DIR)/%.c=$(BUILD_DIR)/%_c.o)
+OBJ_FILES += $(ASM_FILES:$(SRC_DIR)/%.S=$(BUILD_DIR)/%_s.o)
+
+DEP_FILES = $(OBJ_FILES:%.o=%.d)
+-include $(DEP_FILES)
+
+$(BUILD_DIR)/%_c.o: $(SRC_DIR)/%.c
+	@mkdir -p $(@D)
+	$(ARMGNU)-gcc $(CFLAGS) -MMD -c $< -o $@
+
+$(BUILD_DIR)/%_s.o: $(SRC_DIR)/%.S
+	$(ARMGNU)-gcc $(ASMFLAGS) -MMD -c $< -o $@
+
+bootloader.img: $(SRC_DIR)/link.ld $(OBJ_FILES)
+	$(ARMGNU)-ld -T $(SRC_DIR)/link.ld -o $(BUILD_DIR)/bootloader.elf  $(OBJ_FILES)
+	$(ARMGNU)-objcopy $(BUILD_DIR)/bootloader.elf -O binary bootloader.img
+
+all: bootloader.img
+
+clean:
+	rm -rf $(BUILD_DIR) *.img
+
+run_std:
+	qemu-system-aarch64 -M raspi3b -kernel bootloader.img -serial null -serial stdio -initrd initramfs.cpio -dtb bcm2710-rpi-3-b-plus.dtb
+
+run_pty:
+	qemu-system-aarch64 -M raspi3b -kernel bootloader.img -serial null -serial pty -initrd initramfs.cpio -dtb bcm2710-rpi-3-b-plus.dtb
+
+debug:
+	qemu-system-aarch64 -M raspi3b -kernel bootloader.img -display none -S -s
+
diff --git a/lab4/bootloader/src/boot.S b/lab4/bootloader/src/boot.S
new file mode 100644
index 000000000..c872f56a7
--- /dev/null
+++ b/lab4/bootloader/src/boot.S
@@ -0,0 +1,52 @@
+/* ARMv8 Assembly Instruction */
+/**
+
+mov x0, x1
+    sets: x0 = x1
+ldr x0, <addr>
+    load 32bits from <addr> to x0
+ldr w0, <addr>
+    load 64bits from <addr> to w0
+cbz x0, <label>
+    if x0 == 0, jump to <label>
+cbnz x0, <label>
+    if x0 != 0, jump to <label>
+str x0 [x1] #8
+    store x0 in addr<x1> then x1=x1+8
+b   <label>
+    jump to <label>
+bl  <label>
+    jump to <label> and copies bl's next instruction into link register
+wfe
+    Wait for event, core in low-power state (power on, clk off)
+
+**/
+
+// x0 is used for dtb physical address
+.section ".text.boot"
+
+.global _start
+
+_start:
+setup_stack:
+    ldr     x1, =_stack_top
+    mov     sp, x1
+
+setup_bss:
+    ldr     x1, =_bss_top
+    ldr     w2, =_bss_size
+
+init_bss:
+    cbz     w2, run_main
+    str     xzr, [x1], #8
+    sub     w2, w2, #1
+    cbnz    w2, init_bss
+
+run_main:
+    ldr     x1, =_dtb
+    str     x0, [x1], #8
+    bl      main
+
+proc_hang:
+    wfe
+    b       proc_hang
diff --git a/lab4/bootloader/src/link.ld b/lab4/bootloader/src/link.ld
new file mode 100644
index 000000000..2784f52e2
--- /dev/null
+++ b/lab4/bootloader/src/link.ld
@@ -0,0 +1,32 @@
+_heap_stack_size = 1M;
+_bootloader_size = 64K;
+
+SECTIONS
+{
+    . = 0x80000;
+    _start = .;
+    .text : { *(.text.boot) *(.text) }
+    .rodata : { *(.rodata) }
+    .data : { *(.data) }
+    .bss : {
+        _bss_top = .;
+        *(.bss) 
+    }
+    _bss_size = SIZEOF(.bss) >> 3;
+    .heap : {
+        . = ALIGN(8);
+        _heap_top = .;
+    } 
+    . = . + _heap_stack_size;
+    .stack : {
+        . = ALIGN(8);
+        _stack_top = .;
+    }
+    _end = .;
+
+    . = 0x3000000;
+    _bootloader_relocated_addr = 0x3000000;
+    . = . + _bootloader_size;
+}
+
+__code_size = (_end - _start);
diff --git a/lab4/bootloader/src/main.c b/lab4/bootloader/src/main.c
new file mode 100644
index 000000000..232682ef4
--- /dev/null
+++ b/lab4/bootloader/src/main.c
@@ -0,0 +1,48 @@
+#include "uart1.h"
+#include "shell.h"
+
+extern char* _bootloader_relocated_addr;
+extern unsigned long long __code_size;
+extern unsigned long long _start;
+char* _dtb;
+
+int relocated_flag = 1;
+
+/* Copies codeblock from _start to addr */
+void code_relocate(char* addr)
+{
+    unsigned long long size = (unsigned long long)&__code_size;
+    char* start = (char *)&_start;
+    for(unsigned long long i=0;i<size;i++)
+    {
+        addr[i] = start[i];
+    }
+
+    ((void (*)(char*))addr)(_dtb);
+}
+
+/* x0-x7 are argument registers.
+   x0 is now used for dtb */
+void main(char* arg){
+    _dtb = arg;
+    char* relocated_ptr = (char*)&_bootloader_relocated_addr;
+
+    /* Relocate once only */
+    if (relocated_flag)
+    {
+        relocated_flag = 0;
+        code_relocate(relocated_ptr);
+    }
+
+    char input_buffer[CMD_MAX_LEN];
+
+    uart_init();
+    cli_print_banner();
+
+    while(1){
+        cli_cmd_clear(input_buffer, CMD_MAX_LEN);
+        uart_puts("# ");
+        cli_cmd_read(input_buffer);
+        cli_cmd_exec(input_buffer);
+    }
+}
diff --git a/lab4/bootloader/src/shell.c b/lab4/bootloader/src/shell.c
new file mode 100644
index 000000000..4b0b5c0bb
--- /dev/null
+++ b/lab4/bootloader/src/shell.c
@@ -0,0 +1,113 @@
+#include "shell.h"
+#include "uart1.h"
+#include "power.h"
+#include "utils.h"
+
+#define SHIFT_ADDR 0x100000
+
+extern char* _dtb;
+extern char _start[];
+
+struct CLI_CMDS cmd_list[CLI_MAX_CMD]=
+{
+    {.command="loadimg", .help="load image via uart1"},
+    {.command="help", .help="print all available commands"},
+    {.command="reboot", .help="reboot the device"}
+};
+
+void cli_cmd_clear(char* buffer, int length)
+{
+    for(int i=0; i<length; i++)
+    {
+        buffer[i] = '\0';
+    }
+};
+
+void cli_cmd_read(char* buffer)
+{
+    char c='\0';
+    int idx = 0;
+    while(1)
+    {
+        if ( idx >= CMD_MAX_LEN ) break;
+
+        c = uart_recv();
+        if ( c == '\n')
+        {
+            uart_puts("\r\n");
+            break;
+        }
+        if ( c > 16 && c < 32 ) continue;
+        if ( c > 127 ) continue;
+        buffer[idx++] = c;
+        uart_send(c);
+    }
+}
+
+void cli_cmd_exec(char* buffer)
+{
+    if (strcmp(buffer, "loadimg") == 0) {
+        do_cmd_loadimg();
+    } else if (strcmp(buffer, "help") == 0) {
+        do_cmd_help();
+    } else if (strcmp(buffer, "reboot") == 0) {
+        do_cmd_reboot();
+    } else if (*buffer){
+        uart_puts(buffer);
+        uart_puts(": command not found\r\n");
+    }
+}
+
+void cli_print_banner()
+{
+    uart_puts("\r\n");
+    uart_puts("=======================================\r\n");
+    uart_puts("    NYCU-OSC 2024 Lab2 - Bootloader    \r\n");
+    uart_puts("=======================================\r\n");
+}
+
+void do_cmd_help()
+{
+    for(int i = 0; i < CLI_MAX_CMD; i++)
+    {
+        uart_puts(cmd_list[i].command);
+        uart_puts("\t\t: ");
+        uart_puts(cmd_list[i].help);
+        uart_puts("\r\n");
+    }
+}
+
+/* Overwrite image file into _start,
+   Please make sure this current code has been relocated. */
+void do_cmd_loadimg()
+{
+    char* bak_dtb = _dtb;
+    char c;
+    unsigned long long kernel_size = 0;
+    char* kernel_start = (char*) (&_start);
+    uart_puts("Please upload the image file.\r\n");
+    for (int i=0; i<8; i++)
+    {
+        c = uart_getc();
+        kernel_size += c<<(i*8);
+    }
+    for (int i=0; i<kernel_size; i++)
+    {
+        c = uart_getc();
+        kernel_start[i] = c;
+    }
+    uart_puts("Image file downloaded successfully.\r\n");
+    uart_puts("Point to new kernel ...\r\n");
+
+    ((void (*)(char*))kernel_start)(bak_dtb);
+}
+
+void do_cmd_reboot()
+{
+    uart_puts("Reboot in 5 seconds ...\r\n\r\n");
+    volatile unsigned int* rst_addr = (unsigned int*)PM_RSTC;
+    *rst_addr = PM_PASSWORD | 0x20;
+    volatile unsigned int* wdg_addr = (unsigned int*)PM_WDOG;
+    *wdg_addr = PM_PASSWORD | 5;
+}
+
diff --git a/lab4/bootloader/src/uart1.c b/lab4/bootloader/src/uart1.c
new file mode 100644
index 000000000..cf6dd9e85
--- /dev/null
+++ b/lab4/bootloader/src/uart1.c
@@ -0,0 +1,83 @@
+#include "bcm2837/rpi_gpio.h"
+#include "bcm2837/rpi_uart1.h"
+#include "uart1.h"
+#include "utils.h"
+
+void uart_init()
+{
+    register unsigned int r;
+
+    /* initialize UART */
+    *AUX_ENABLES     |= 1;       // enable UART1
+    *AUX_MU_CNTL_REG  = 0;       // disable TX/RX
+
+    /* configure UART */
+    *AUX_MU_IER_REG   = 0;       // disable interrupt
+    *AUX_MU_LCR_REG   = 3;       // 8 bit data size
+    *AUX_MU_MCR_REG   = 0;       // disable flow control
+    *AUX_MU_BAUD_REG  = 270;     // 115200 baud rate
+    *AUX_MU_IIR_REG   = 6;       // disable FIFO
+
+    /* map UART1 to GPIO pins */
+    r = *GPFSEL1;
+    r &= ~(7<<12);               // clean gpio14
+    r |= 2<<12;                  // set gpio14 to alt5
+    r &= ~(7<<15);               // clean gpio15
+    r |= 2<<15;                  // set gpio15 to alt5
+    *GPFSEL1 = r;
+
+    /* enable pin 14, 15 - ref: Page 101 */
+    *GPPUD = 0;
+    r=150; while(r--) { asm volatile("nop"); }
+    *GPPUDCLK0 = (1<<14)|(1<<15);
+    r=150; while(r--) { asm volatile("nop"); }
+    *GPPUDCLK0 = 0;
+
+    *AUX_MU_CNTL_REG = 3;      // enable TX/RX
+}
+
+char uart_getc() {
+    char r;
+    while(!(*AUX_MU_LSR_REG & 0x01)){};
+    r = (char)(*AUX_MU_IO_REG);
+    return r;
+}
+
+char uart_recv() {
+    char r;
+    while(!(*AUX_MU_LSR_REG & 0x01)){};
+    r = (char)(*AUX_MU_IO_REG);
+    return r=='\r'?'\n':r;
+}
+
+void uart_send(unsigned int c) {
+    while(!(*AUX_MU_LSR_REG & 0x20)){};
+    *AUX_MU_IO_REG = c;
+}
+
+int uart_puts(char *fmt, ...) {
+    __builtin_va_list args;
+    __builtin_va_start(args, fmt);
+    char buf[VSPRINT_MAX_BUF_SIZE];
+
+    char *str = (char*)buf;
+    int count = vsprintf(str,fmt,args);
+
+    while(*str) {
+        if(*str=='\n')
+            uart_send('\r');
+        uart_send(*str++);
+    }
+    __builtin_va_end(args);
+    return count;
+}
+
+void uart_2hex(unsigned int d) {
+    unsigned int n;
+    int c;
+    for(c=28;c>=0;c-=4) {
+        n=(d>>c)&0xF;
+        n+=n>9?0x37:0x30;
+        uart_send(n);
+    }
+}
diff --git a/lab4/bootloader/src/utils.c b/lab4/bootloader/src/utils.c
new file mode 100644
index 000000000..03c51dd96
--- /dev/null
+++ b/lab4/bootloader/src/utils.c
@@ -0,0 +1,133 @@
+#include "utils.h"
+
+unsigned int vsprintf(char *dst, char* fmt, __builtin_va_list args)
+{
+    long int arg;
+    int len, sign, i;
+    char *p, *orig=dst, tmpstr[19];
+
+    // failsafes
+    if(dst==(void*)0 || fmt==(void*)0) {
+        return 0;
+    }
+
+    // main loop
+    arg = 0;
+    while(*fmt) {
+        if(dst-orig > VSPRINT_MAX_BUF_SIZE-0x10)
+        {
+            return -1;
+        }
+        // argument access
+        if(*fmt=='%') {
+            fmt++;
+            // literal %
+            if(*fmt=='%') {
+                goto put;
+            }
+            len=0;
+            // size modifier
+            while(*fmt>='0' && *fmt<='9') {
+                len *= 10;
+                len += *fmt-'0';
+                fmt++;
+            }
+            // skip long modifier
+            if(*fmt=='l') {
+                fmt++;
+            }
+            // character
+            if(*fmt=='c') {
+                arg = __builtin_va_arg(args, int);
+                *dst++ = (char)arg;
+                fmt++;
+                continue;
+            } else
+            // decimal number
+            if(*fmt=='d') {
+                arg = __builtin_va_arg(args, int);
+                // check input
+                sign=0;
+                if((int)arg<0) {
+                    arg*=-1;
+                    sign++;
+                }
+                if(arg>99999999999999999L) {
+                    arg=99999999999999999L;
+                }
+                // convert to string
+                i=18;
+                tmpstr[i]=0;
+                do {
+                    tmpstr[--i]='0'+(arg%10);
+                    arg/=10;
+                } while(arg!=0 && i>0);
+                if(sign) {
+                    tmpstr[--i]='-';
+                }
+                if(len>0 && len<18) {
+                    while(i>18-len) {
+                        tmpstr[--i]=' ';
+                    }
+                }
+                p=&tmpstr[i];
+                goto copystring;
+            } else
+            if(*fmt=='x') {
+                arg = __builtin_va_arg(args, long int);
+                i=16;
+                tmpstr[i]=0;
+                do {
+                    char n=arg & 0xf;
+                    tmpstr[--i]=n+(n>9?0x37:0x30);
+                    arg>>=4;
+                } while(arg!=0 && i>0);
+                if(len>0 && len<=16) {
+                    while(i>16-len) {
+                        tmpstr[--i]='0';
+                    }
+                }
+                p=&tmpstr[i];
+                goto copystring;
+            } else
+            if(*fmt=='s') {
+                p = __builtin_va_arg(args, char*);
+copystring:     if(p==(void*)0) {
+                    p="(null)";
+                }
+                while(*p) {
+                    *dst++ = *p++;
+                }
+            }
+        } else {
+put:        *dst++ = *fmt;
+        }
+        fmt++;
+    }
+    *dst=0;
+    return dst-orig;
+}
+
+unsigned int sprintf(char *dst, char* fmt, ...)
+{
+    __builtin_va_list args;
+    __builtin_va_start(args, fmt);
+    unsigned int r = vsprintf(dst,fmt,args);
+    __builtin_va_end(args);
+    return r;
+}
+
+
+int strcmp(const char* p1, const char* p2)
+{
+    const unsigned char *s1 = (const unsigned char*) p1;
+    const unsigned char *s2 = (const unsigned char*) p2;
+    unsigned char c1, c2;
+
+    do {
+        c1 = (unsigned char) *s1++;
+        c2 = (unsigned char) *s2++;
+        if ( c1 == '\0' ) return c1 - c2;
+    } while ( c1 == c2 );
+    return c1 - c2;
+}
diff --git a/lab4/create_fs/create_cpio.sh b/lab4/create_fs/create_cpio.sh
new file mode 100755
index 000000000..f1270ba2c
--- /dev/null
+++ b/lab4/create_fs/create_cpio.sh
@@ -0,0 +1,11 @@
+#!/bin/sh
+
+# Go to rootfs folder
+# Select all files and put into archives
+# '-o, --create' Run in copy-out mode
+# '-H FORMAT' archive format, 
+#    newc: SVR4 portable format
+
+cd rootfs
+find . | cpio -o -H newc > ../initramfs.cpio
+cd ..
diff --git a/lab4/create_fs/lab3_user_proc/linker.ld b/lab4/create_fs/lab3_user_proc/linker.ld
new file mode 100644
index 000000000..faee5d7b1
--- /dev/null
+++ b/lab4/create_fs/lab3_user_proc/linker.ld
@@ -0,0 +1,5 @@
+SECTIONS
+{
+  . = 0x80000;
+  .text : { *(.text) }
+}
diff --git a/lab4/create_fs/lab3_user_proc/makefile b/lab4/create_fs/lab3_user_proc/makefile
new file mode 100644
index 000000000..590bdf420
--- /dev/null
+++ b/lab4/create_fs/lab3_user_proc/makefile
@@ -0,0 +1,23 @@
+ARMGNU ?= aarch64-linux-gnu
+
+BUILD_DIR = build
+#---------------------------------------------------------------------------------------
+
+ASM_FILES = $(wildcard *.S)
+OBJ_FILES += $(ASM_FILES:%.S=$(BUILD_DIR)/%_s.o)
+
+DEP_FILES = $(OBJ_FILES:%.o=%.d)
+-include $(DEP_FILES)
+
+$(BUILD_DIR)/%_s.o: %.S
+	@mkdir -p $(@D)
+	$(ARMGNU)-gcc -c $< -o $@
+
+user_proc.img: linker.ld $(OBJ_FILES)
+	$(ARMGNU)-ld -T linker.ld -o $(BUILD_DIR)/user_proc.elf  $(OBJ_FILES)
+	$(ARMGNU)-objcopy $(BUILD_DIR)/user_proc.elf -O binary user_proc.img
+
+all: user_proc.img
+
+clean:
+	rm -rf $(BUILD_DIR) *.img
diff --git a/lab4/create_fs/lab3_user_proc/user_proc.S b/lab4/create_fs/lab3_user_proc/user_proc.S
new file mode 100644
index 000000000..2d9837651
--- /dev/null
+++ b/lab4/create_fs/lab3_user_proc/user_proc.S
@@ -0,0 +1,12 @@
+// Run `svc 0` 5 times; svc (el0 -> el1) system calls
+.section ".text"
+.global _start
+_start:
+    mov x0, 0
+1:
+    add x0, x0, 1
+    svc 0
+    cmp x0, 5
+    blt 1b
+1:
+    b 1b
diff --git a/lab4/create_fs/rootfs/file0.txt b/lab4/create_fs/rootfs/file0.txt
new file mode 100644
index 000000000..ad5866833
--- /dev/null
+++ b/lab4/create_fs/rootfs/file0.txt
@@ -0,0 +1,2 @@
+This is file 0
+
diff --git a/lab4/create_fs/rootfs/file1.txt b/lab4/create_fs/rootfs/file1.txt
new file mode 100644
index 000000000..0566bad46
--- /dev/null
+++ b/lab4/create_fs/rootfs/file1.txt
@@ -0,0 +1,2 @@
+This is file 1
+
diff --git a/lab4/debug.gdb b/lab4/debug.gdb
new file mode 100644
index 000000000..429cfa938
--- /dev/null
+++ b/lab4/debug.gdb
@@ -0,0 +1,2 @@
+file kernel/build/kernel8.elf
+target remote :1234
diff --git a/lab4/kernel/bcm2710-rpi-3-b-plus.dtb b/lab4/kernel/bcm2710-rpi-3-b-plus.dtb
new file mode 100644
index 000000000..38395a23f
Binary files /dev/null and b/lab4/kernel/bcm2710-rpi-3-b-plus.dtb differ
diff --git a/lab4/kernel/build/boot_s.d b/lab4/kernel/build/boot_s.d
new file mode 100644
index 000000000..718ca3b14
--- /dev/null
+++ b/lab4/kernel/build/boot_s.d
@@ -0,0 +1 @@
+build/boot_s.o: src/boot.S
diff --git a/lab4/kernel/build/cpio_c.d b/lab4/kernel/build/cpio_c.d
new file mode 100644
index 000000000..1e9d57c4f
--- /dev/null
+++ b/lab4/kernel/build/cpio_c.d
@@ -0,0 +1 @@
+build/cpio_c.o: src/cpio.c include/cpio.h include/u_string.h
diff --git a/lab4/kernel/build/dtb_c.d b/lab4/kernel/build/dtb_c.d
new file mode 100644
index 000000000..d48368d21
--- /dev/null
+++ b/lab4/kernel/build/dtb_c.d
@@ -0,0 +1,2 @@
+build/dtb_c.o: src/dtb.c include/dtb.h include/uart1.h include/u_string.h \
+ include/cpio.h include/memory.h include/u_list.h
diff --git a/lab4/kernel/build/entry_s.d b/lab4/kernel/build/entry_s.d
new file mode 100644
index 000000000..3420854b9
--- /dev/null
+++ b/lab4/kernel/build/entry_s.d
@@ -0,0 +1 @@
+build/entry_s.o: src/entry.S
diff --git a/lab4/kernel/build/exception_c.d b/lab4/kernel/build/exception_c.d
new file mode 100644
index 000000000..47bd025d5
--- /dev/null
+++ b/lab4/kernel/build/exception_c.d
@@ -0,0 +1,3 @@
+build/exception_c.o: src/exception.c include/bcm2837/rpi_irq.h \
+ include/bcm2837/rpi_base.h include/bcm2837/rpi_uart1.h include/uart1.h \
+ include/exception.h include/u_list.h include/timer.h include/memory.h
diff --git a/lab4/kernel/build/kernel8.elf b/lab4/kernel/build/kernel8.elf
new file mode 100755
index 000000000..1d6baef98
Binary files /dev/null and b/lab4/kernel/build/kernel8.elf differ
diff --git a/lab4/kernel/build/main_c.d b/lab4/kernel/build/main_c.d
new file mode 100644
index 000000000..7f9cbad99
--- /dev/null
+++ b/lab4/kernel/build/main_c.d
@@ -0,0 +1,3 @@
+build/main_c.o: src/main.c include/uart1.h include/shell.h \
+ include/memory.h include/u_list.h include/u_string.h include/dtb.h \
+ include/exception.h include/timer.h
diff --git a/lab4/kernel/build/mbox_c.d b/lab4/kernel/build/mbox_c.d
new file mode 100644
index 000000000..3a4b65349
--- /dev/null
+++ b/lab4/kernel/build/mbox_c.d
@@ -0,0 +1,2 @@
+build/mbox_c.o: src/mbox.c include/bcm2837/rpi_mbox.h \
+ include/bcm2837/rpi_base.h include/mbox.h
diff --git a/lab4/kernel/build/memory_c.d b/lab4/kernel/build/memory_c.d
new file mode 100644
index 000000000..333150390
--- /dev/null
+++ b/lab4/kernel/build/memory_c.d
@@ -0,0 +1,3 @@
+build/memory_c.o: src/memory.c include/memory.h include/u_list.h \
+ include/u_list.h include/uart1.h include/exception.h include/dtb.h \
+ include/shell.h
diff --git a/lab4/kernel/build/shell_c.d b/lab4/kernel/build/shell_c.d
new file mode 100644
index 000000000..5483e6f78
--- /dev/null
+++ b/lab4/kernel/build/shell_c.d
@@ -0,0 +1,3 @@
+build/shell_c.o: src/shell.c include/shell.h include/uart1.h \
+ include/mbox.h include/power.h include/cpio.h include/u_string.h \
+ include/dtb.h include/memory.h include/u_list.h include/timer.h
diff --git a/lab4/kernel/build/timer_c.d b/lab4/kernel/build/timer_c.d
new file mode 100644
index 000000000..66fbfb8bd
--- /dev/null
+++ b/lab4/kernel/build/timer_c.d
@@ -0,0 +1,2 @@
+build/timer_c.o: src/timer.c include/timer.h include/u_list.h \
+ include/uart1.h include/memory.h include/u_string.h
diff --git a/lab4/kernel/build/u_string_c.d b/lab4/kernel/build/u_string_c.d
new file mode 100644
index 000000000..a8f464ec9
--- /dev/null
+++ b/lab4/kernel/build/u_string_c.d
@@ -0,0 +1 @@
+build/u_string_c.o: src/u_string.c include/u_string.h
diff --git a/lab4/kernel/build/uart1_c.d b/lab4/kernel/build/uart1_c.d
new file mode 100644
index 000000000..65c71b97f
--- /dev/null
+++ b/lab4/kernel/build/uart1_c.d
@@ -0,0 +1,4 @@
+build/uart1_c.o: src/uart1.c include/bcm2837/rpi_gpio.h \
+ include/bcm2837/rpi_base.h include/bcm2837/rpi_uart1.h \
+ include/bcm2837/rpi_irq.h include/uart1.h include/exception.h \
+ include/u_list.h include/u_string.h
diff --git a/lab4/kernel/include/bcm2837/rpi_base.h b/lab4/kernel/include/bcm2837/rpi_base.h
new file mode 100644
index 000000000..e3259e8de
--- /dev/null
+++ b/lab4/kernel/include/bcm2837/rpi_base.h
@@ -0,0 +1,6 @@
+#ifndef	_RPI_BASE_H_
+#define	_RPI_BASE_H_
+
+#define PERIPHERAL_BASE 0x3F000000
+
+#endif  /*_RPI_BASE_H_ */
diff --git a/lab4/kernel/include/bcm2837/rpi_gpio.h b/lab4/kernel/include/bcm2837/rpi_gpio.h
new file mode 100644
index 000000000..e5133708a
--- /dev/null
+++ b/lab4/kernel/include/bcm2837/rpi_gpio.h
@@ -0,0 +1,25 @@
+#ifndef _RPI_GPIO_H_
+#define _RPI_GPIO_H_
+
+#include "bcm2837/rpi_base.h"
+
+#define GPFSEL0         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200000))
+#define GPFSEL1         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200004))
+#define GPFSEL2         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200008))
+#define GPFSEL3         ((volatile unsigned int*)(PERIPHERAL_BASE+0x0020000C))
+#define GPFSEL4         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200010))
+#define GPFSEL5         ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200014))
+#define GPSET0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x0020001C))
+#define GPSET1          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200020))
+#define GPCLR0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200028))
+#define GPLEV0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200034))
+#define GPLEV1          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200038))
+#define GPEDS0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200040))
+#define GPEDS1          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200044))
+#define GPHEN0          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200064))
+#define GPHEN1          ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200068))
+#define GPPUD           ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200094))
+#define GPPUDCLK0       ((volatile unsigned int*)(PERIPHERAL_BASE+0x00200098))
+#define GPPUDCLK1       ((volatile unsigned int*)(PERIPHERAL_BASE+0x0020009C))
+
+#endif /*_RPI_GPIO_H_*/
diff --git a/lab4/kernel/include/bcm2837/rpi_irq.h b/lab4/kernel/include/bcm2837/rpi_irq.h
new file mode 100644
index 000000000..8423dfea0
--- /dev/null
+++ b/lab4/kernel/include/bcm2837/rpi_irq.h
@@ -0,0 +1,24 @@
+#ifndef _RPI_IRQ_H_
+#define _RPI_IRQ_H_
+
+#include "bcm2837/rpi_base.h"
+
+/*
+The basic pending register shows which interrupt are pending. To speed up interrupts processing, a
+number of 'normal' interrupt status bits have been added to this register. This makes the 'IRQ
+pending base' register different from the other 'base' interrupt registers
+p112-115 https://cs140e.sergio.bz/docs/BCM2837-ARM-Peripherals.pdf
+*/
+
+#define IRQ_BASIC_PENDING	((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B200))
+#define IRQ_PENDING_1		((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B204))
+#define IRQ_PENDING_2		((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B208))
+#define FIQ_CONTROL		((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B20C))
+#define ENABLE_IRQS_1		((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B210))
+#define ENABLE_IRQS_2		((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B214))
+#define ENABLE_BASIC_IRQS	((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B218))
+#define DISABLE_IRQS_1		((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B21C))
+#define DISABLE_IRQS_2		((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B220))
+#define DISABLE_BASIC_IRQS	((volatile unsigned int*)(PERIPHERAL_BASE+0x0000B224))
+
+#endif /*_RPI_IRQ_H_*/
diff --git a/lab4/kernel/include/bcm2837/rpi_mbox.h b/lab4/kernel/include/bcm2837/rpi_mbox.h
new file mode 100644
index 000000000..ba1001472
--- /dev/null
+++ b/lab4/kernel/include/bcm2837/rpi_mbox.h
@@ -0,0 +1,17 @@
+#ifndef _RPI_MBOX_H_
+#define _RPI_MBOX_H_
+
+#include "bcm2837/rpi_base.h"
+
+#define MBOX_BASE     (PERIPHERAL_BASE+0x0000B880)
+
+// The register access to a mailbox
+// https://jsandler18.github.io/extra/mailbox.html
+#define MBOX_READ     ((volatile unsigned int*)(MBOX_BASE+0x00))
+#define MBOX_POLL     ((volatile unsigned int*)(MBOX_BASE+0x10))
+#define MBOX_SENDER   ((volatile unsigned int*)(MBOX_BASE+0x14))
+#define MBOX_STATUS   ((volatile unsigned int*)(MBOX_BASE+0x18))
+#define MBOX_CONFIG   ((volatile unsigned int*)(MBOX_BASE+0x1C))
+#define MBOX_WRITE    ((volatile unsigned int*)(MBOX_BASE+0x20))
+
+#endif  /*_RPI_MBOX_H_ */
diff --git a/lab4/kernel/include/bcm2837/rpi_uart1.h b/lab4/kernel/include/bcm2837/rpi_uart1.h
new file mode 100644
index 000000000..959130656
--- /dev/null
+++ b/lab4/kernel/include/bcm2837/rpi_uart1.h
@@ -0,0 +1,19 @@
+#ifndef	_RPI_UART1_H_
+#define	_RPI_UART1_H_
+
+#include "bcm2837/rpi_base.h"
+
+#define AUX_ENABLES     ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215004))
+#define AUX_MU_IO_REG   ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215040))
+#define AUX_MU_IER_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215044))
+#define AUX_MU_IIR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215048))
+#define AUX_MU_LCR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x0021504C))
+#define AUX_MU_MCR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215050))
+#define AUX_MU_LSR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215054))
+#define AUX_MU_MSR_REG  ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215058))
+#define AUX_MU_SCRATCH  ((volatile unsigned int*)(PERIPHERAL_BASE+0x0021505C))
+#define AUX_MU_CNTL_REG ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215060))
+#define AUX_MU_STAT_REG ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215064))
+#define AUX_MU_BAUD_REG ((volatile unsigned int*)(PERIPHERAL_BASE+0x00215068))
+
+#endif  /*_RPI_UART1_H_ */
diff --git a/lab4/kernel/include/cpio.h b/lab4/kernel/include/cpio.h
new file mode 100644
index 000000000..7dd29c1cd
--- /dev/null
+++ b/lab4/kernel/include/cpio.h
@@ -0,0 +1,38 @@
+#ifndef _CPIO_H_
+#define _CPIO_H_
+
+/*
+    cpio format : https://manpages.ubuntu.com/manpages/bionic/en/man5/cpio.5.html
+    We are using "newc" format
+    header, file path, file data, header  ......
+    header + file path (padding 4 bytes)
+    file data (padding 4 bytes)  (max size 4gb)
+*/
+
+#define CPIO_NEWC_HEADER_MAGIC "070701"    // big endian constant, to check whether it is big endian or little endian
+
+// Using newc archive format
+struct cpio_newc_header
+{
+    char c_magic[6];            // fixed, "070701".
+    char c_ino[8];
+    char c_mode[8];
+    char c_uid[8];
+    char c_gid[8];
+    char c_nlink[8];
+    char c_mtime[8];
+    char c_filesize[8];
+    char c_devmajor[8];
+    char c_devminor[8];
+    char c_rdevmajor[8];
+    char c_rdevminor[8];
+    char c_namesize[8];
+    char c_check[8];
+};
+
+/* write pathname, data, next header into corresponding parameter*/
+int cpio_newc_parse_header(struct cpio_newc_header *this_header_pointer,
+        char **pathname, unsigned int *filesize, char **data,
+        struct cpio_newc_header **next_header_pointer);
+
+#endif /* _CPIO_H_ */
diff --git a/lab4/kernel/include/dtb.h b/lab4/kernel/include/dtb.h
new file mode 100644
index 000000000..1a3f56ad8
--- /dev/null
+++ b/lab4/kernel/include/dtb.h
@@ -0,0 +1,26 @@
+#ifndef _DTB_H_
+#define _DTB_H_
+#include <stdint.h>
+// #define uint32_t unsigned int
+// #define uint64_t unsigned long long
+
+// manipulate device tree with dtb file format
+// linux kernel fdt.h
+#define FDT_BEGIN_NODE 0x00000001
+#define FDT_END_NODE 0x00000002
+#define FDT_PROP 0x00000003
+#define FDT_NOP 0x00000004
+#define FDT_END 0x00000009
+
+typedef void (*dtb_callback)(uint32_t node_type, char *name, void *value, uint32_t name_size);
+
+uint32_t uint32_endian_big2lttle(uint32_t data);
+uint64_t uint64_endian_big2lttle(uint64_t data);
+
+void traverse_device_tree(void *base, dtb_callback callback);  //traverse dtb tree
+void dtb_callback_show_tree(uint32_t node_type, char *name, void *value, uint32_t name_size);
+void dtb_callback_initramfs(uint32_t node_type, char *name, void *value, uint32_t name_size);
+
+void dtb_find_and_store_reserved_memory();
+
+#endif
diff --git a/lab4/kernel/include/exception.h b/lab4/kernel/include/exception.h
new file mode 100644
index 000000000..60bf2384f
--- /dev/null
+++ b/lab4/kernel/include/exception.h
@@ -0,0 +1,38 @@
+#ifndef	_EXCEPTION_H_
+#define	_EXCEPTION_H_
+
+#include "u_list.h"
+
+#define UART_IRQ_PRIORITY  1
+#define TIMER_IRQ_PRIORITY 0
+
+typedef struct irqtask
+{
+    struct list_head listhead;
+    unsigned long long priority; // store priority (smaller number is more preemptive)
+    void *task_function;         // task function pointer
+} irqtask_t;
+
+void irqtask_add(void *task_function, unsigned long long priority);
+void irqtask_run(irqtask_t *the_task);
+void irqtask_run_preemptive();
+void irqtask_list_init();
+
+// https://github.com/Tekki/raspberrypi-documentation/blob/master/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf p16
+#define CORE0_INTERRUPT_SOURCE ((volatile unsigned int*)(0x40000060))
+
+#define INTERRUPT_SOURCE_CNTPNSIRQ (1<<1)
+#define INTERRUPT_SOURCE_GPU (1<<8)
+
+#define IRQ_PENDING_1_AUX_INT (1<<29)
+
+void el1_interrupt_enable();
+void el1_interrupt_disable();
+
+void el1h_irq_router();
+void el0_sync_router();
+void el0_irq_64_router();
+
+void invalid_exception_router(); // exception_handler.S
+
+#endif /*_EXCEPTION_H_*/
diff --git a/lab4/kernel/include/mbox.h b/lab4/kernel/include/mbox.h
new file mode 100644
index 000000000..78d2cb7f3
--- /dev/null
+++ b/lab4/kernel/include/mbox.h
@@ -0,0 +1,63 @@
+#ifndef _MBOX_H_
+#define _MBOX_H_
+
+extern volatile unsigned int pt[64];
+
+// Mailbox Register MMIO
+// https://jsandler18.github.io/extra/mailbox.html
+// include/bcm2837/rpi_mbox.h
+
+// Mailbox Channels
+// https://github.com/raspberrypi/firmware/wiki/Mailboxes
+typedef enum {
+    MBOX_POWER_MANAGEMENT = 0,
+    MBOX_FRAMEBUFFER,
+    MBOX_VIRTUAL_UART,
+    MBOX_VCHIQ,
+    MBOX_LEDS,
+    MBOX_BUTTONS,
+    MBOX_TOUCHSCREEN,
+    MBOX_UNUSED,
+    MBOX_TAGS_ARM_TO_VC,
+    MBOX_TAGS_VC_TO_ARM,
+} mbox_channel_type;
+
+// Status Code from Broadcom Videocode Driver
+// brcm_usrlib/dag/vmcsx/vcinclude/bcm2708_chip/arm_control.h
+enum mbox_status_reg_bits {
+    BCM_ARM_VC_MS_FULL  = 0x80000000,
+    BCM_ARM_VC_MS_EMPTY = 0x40000000,
+    BCM_ARM_VC_MS_LEVEL = 0x400000FF,
+};
+
+enum mbox_buffer_status_code {
+    MBOX_REQUEST_PROCESS = 0x00000000,
+    MBOX_REQUEST_SUCCEED = 0x80000000,
+    MBOX_REQUEST_FAILED  = 0x80000001,
+};
+
+// Tag
+// https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface
+// Included partition only
+typedef enum {
+    /* Videocore */
+    MBOX_TAG_GET_FIRMWARE_VERSION = 0x1,
+
+    /* Hardware */
+    MBOX_TAG_GET_BOARD_MODEL = 0x10001,
+    MBOX_TAG_GET_BOARD_REVISION,
+    MBOX_TAG_GET_BOARD_MAC_ADDRESS,
+    MBOX_TAG_GET_BOARD_SERIAL,
+    MBOX_TAG_GET_ARM_MEMORY,
+    MBOX_TAG_GET_VC_MEMORY,
+    MBOX_TAG_GET_CLOCKS,
+
+} mbox_tag_type;
+
+
+#define MBOX_TAG_REQUEST_CODE 0x00000000
+#define MBOX_TAG_LAST_BYTE    0x00000000
+
+int mbox_call(mbox_channel_type, unsigned int);
+
+#endif /*_MBOX_H_*/
diff --git a/lab4/kernel/include/memory.h b/lab4/kernel/include/memory.h
new file mode 100644
index 000000000..46a9b98e2
--- /dev/null
+++ b/lab4/kernel/include/memory.h
@@ -0,0 +1,71 @@
+#ifndef _MEMORY_H_
+#define _MEMORY_H_
+
+#include "u_list.h"
+
+/* Lab2 */
+void* s_allocator(unsigned int size);
+void  s_free(void* ptr);
+
+/* Lab4 */
+#define BUDDY_MEMORY_BASE       0x0     // 0x10000000 - 0x20000000 (SPEC) -> Advanced #3 for all memory region
+#define BUDDY_MEMORY_PAGE_COUNT 0x3C000 // let BUDDY_MEMORY use 0x0 ~ 0x3C000000 (SPEC)
+#define PAGESIZE    0x1000     // 4KB
+#define MAX_PAGES   0x10000    // 65536 (Entries), PAGESIZE * MAX_PAGES = 0x10000000 (SPEC)
+
+typedef enum {
+    FRAME_FREE = -2,
+    FRAME_ALLOCATED,
+    FRAME_IDX_0 = 0,      //  0x1000
+    FRAME_IDX_1,          //  0x2000
+    FRAME_IDX_2,          //  0x4000
+    FRAME_IDX_3,          //  0x8000
+    FRAME_IDX_4,          // 0x10000
+    FRAME_IDX_5,          // 0x20000
+    FRAME_IDX_FINAL = 6,  // 0x40000
+    FRAME_MAX_IDX = 7
+} frame_value_type;
+
+typedef enum {
+    CHUNK_NONE = -1,     // Chunk not used
+    CHUNK_IDX_0 = 0,     //  0x20
+    CHUNK_IDX_1,         //  0x40
+    CHUNK_IDX_2,         //  0x80
+    CHUNK_IDX_3,         // 0x100
+    CHUNK_IDX_4,         // 0x200
+    CHUNK_IDX_5,         // 0x400
+    CHUNK_IDX_FINAL = 6, // 0x800
+    CHUNK_MAX_IDX = 7
+} chunk_value_type;
+
+typedef struct frame
+{
+    struct list_head listhead; // store freelist
+    int val;                   // store order
+    int used;
+    int chunk_order;
+    unsigned int idx;
+} frame_t;
+
+void     init_allocator();
+frame_t *release_redundant(frame_t *frame);
+frame_t *get_buddy(frame_t *frame);
+int      coalesce(frame_t *frame_ptr);
+
+void page_info();
+void chunk_info();
+
+//buddy system
+void* page_malloc(unsigned int size);
+void  page_free(void *ptr);
+void  page2chunks(int order);
+void* chunk_malloc(unsigned int size);
+void  chunk_free(void* ptr);
+
+void* kmalloc(unsigned int size);
+void  kfree(void *ptr);
+void  memory_reserve(unsigned long long start, unsigned long long end);
+int all_chunks_free_in_page(frame_t* page_frame);
+void print_allocated_pages_addr();
+void print_allocated_chunks_addr();
+#endif /* _MEMORY_H_ */
diff --git a/lab4/kernel/include/power.h b/lab4/kernel/include/power.h
new file mode 100644
index 000000000..baf990974
--- /dev/null
+++ b/lab4/kernel/include/power.h
@@ -0,0 +1,8 @@
+#ifndef	_POWER_H_
+#define	_POWER_H_
+
+#define PM_PASSWORD 0x5a000000
+#define PM_RSTC     0x3F10001c
+#define PM_WDOG     0x3F100024
+
+#endif /*_POWER_H_*/
diff --git a/lab4/kernel/include/shell.h b/lab4/kernel/include/shell.h
new file mode 100644
index 000000000..e446ce483
--- /dev/null
+++ b/lab4/kernel/include/shell.h
@@ -0,0 +1,37 @@
+#ifndef _SHELL_H_
+#define _SHELL_H_
+
+#define CMD_MAX_LEN 0x100
+#define MSG_MAX_LEN 0x100
+
+typedef struct CLI_CMDS
+{
+    char command[CMD_MAX_LEN];
+    char help[MSG_MAX_LEN];
+} CLI_CMDS;
+
+int  cli_cmd_strcmp(const char*, const char*);
+void cli_cmd_clear(char*, int);
+void cli_cmd_read(char*);
+void cli_cmd_exec(char*);
+void cli_print_banner();
+
+void do_cmd_cat(char*);
+void do_cmd_dtb();
+void do_cmd_exec(char*);
+void do_cmd_help();
+void do_cmd_hello();
+void do_cmd_info();
+void do_cmd_s_allocator();
+void do_cmd_ls(char*);
+void do_cmd_memory_tester();
+void do_cmd_setTimeout(char* msg, char* sec);
+void do_cmd_set2sAlert();
+void do_cmd_kmalloc(char* size);
+void do_cmd_kfree(char* addr);
+void do_cmd_page_addr();
+void do_cmd_chunk_addr();
+void do_cmd_page_idx();
+void do_cmd_reboot();
+
+#endif /* _SHELL_H_ */
diff --git a/lab4/kernel/include/timer.h b/lab4/kernel/include/timer.h
new file mode 100644
index 000000000..228aa6bc8
--- /dev/null
+++ b/lab4/kernel/include/timer.h
@@ -0,0 +1,30 @@
+#ifndef _TIMER_H_
+#define _TIMER_H_
+
+#include "u_list.h"
+
+#define CORE0_TIMER_IRQ_CTRL 0x40000040
+
+void core_timer_enable();
+void core_timer_disable();
+void core_timer_handler();
+
+typedef struct timer_event {
+    struct list_head listhead;
+    unsigned long long interrupt_time;  //store as tick time after cpu start
+    void *callback; // interrupt -> timer_callback -> callback(args)
+    char* args; // need to free the string by event callback function
+} timer_event_t;
+
+//now the callback only support "funcion(char *)", char* in args
+void timer_event_callback(timer_event_t * timer_event);
+void add_timer(void *callback, unsigned long long timeout, char* args);
+unsigned long long get_tick_plus_s(unsigned long long second);
+void set_core_timer_interrupt(unsigned long long expired_time);
+void set_core_timer_interrupt_by_tick(unsigned long long tick);
+void timer_set2sAlert(char* str);
+void timer_list_init();
+int  timer_list_get_size();
+
+
+#endif /* _TIMER_H_ */
diff --git a/lab4/kernel/include/u_list.h b/lab4/kernel/include/u_list.h
new file mode 100644
index 000000000..f1ef8f356
--- /dev/null
+++ b/lab4/kernel/include/u_list.h
@@ -0,0 +1,137 @@
+#ifndef _U_LIST_H_
+#define _U_LIST_H_
+
+/*
+ * Circular doubly linked list implementation.
+ *
+ * Some of the internal functions ("__xxx") are useful when
+ * manipulating whole lists rather than single entries, as
+ * sometimes we already know the next/prev entries and we can
+ * generate better code by using them directly rather than
+ * using the generic single-entry routines.
+ *
+ * https://github.com/torvalds/linux/blob/master/include/linux/list.
+ * https://elixir.bootlin.com/linux/latest/source/scripts/kconfig/list.h#L24
+ */
+
+typedef struct list_head {
+	struct list_head *next, *prev;
+}list_head_t;
+
+#define LIST_HEAD_INIT(name) { &(name), &(name) }
+
+#define LIST_HEAD(name) \
+	struct list_head name = LIST_HEAD_INIT(name)
+
+/**
+ * INIT_LIST_HEAD - Initialize a list_head structure
+ * @list: list_head structure to be initialized.
+ *
+ * Initializes the list_head to point to itself.  If it is a list header,
+ * the result is an empty list.
+ */
+static inline void INIT_LIST_HEAD(struct list_head *list)
+{
+	list->next = list;
+	list->prev = list;
+}
+
+static inline void __list_add(struct list_head *new,
+			      struct list_head *prev,
+			      struct list_head *next)
+{
+	next->prev = new;
+	new->next = next;
+	new->prev = prev;
+	prev->next = new;
+}
+
+/**
+ * list_add - add a new entry
+ * @new: new entry to be added
+ * @head: list head to add it after
+ *
+ * Insert a new entry after the specified head.
+ * This is good for implementing stacks.
+ */
+static inline void list_add(struct list_head *new, struct list_head *head)
+{
+	__list_add(new, head, head->next);
+}
+
+/**
+ * list_add_tail - add a new entry
+ * @new: new entry to be added
+ * @head: list head to add it before
+ *
+ * Insert a new entry before the specified head.
+ * This is useful for implementing queues.
+ */
+static inline void list_add_tail(struct list_head *new, struct list_head *head)
+{
+	__list_add(new, head->prev, head);
+}
+
+/*
+ * Delete a list entry by making the prev/next entries
+ * point to each other.
+ *
+ * This is only for internal list manipulation where we know
+ * the prev/next entries already!
+ */
+static inline void __list_del(struct list_head * prev, struct list_head * next)
+{
+	next->prev = prev;
+	prev->next = next;
+}
+
+static inline void list_del_entry(struct list_head *entry)
+{
+	__list_del(entry->prev, entry->next);
+}
+
+
+/**
+ * list_is_head - tests whether @list is the list @head
+ * @list: the entry to test
+ * @head: the head of the list
+ */
+static inline int list_is_head(const struct list_head *list, const struct list_head *head)
+{
+	return list == head;
+}
+
+
+/**
+ * list_empty - tests whether a list is empty
+ * @head: the list to test.
+ */
+static inline int list_empty(const struct list_head *head)
+{
+	return head->next == head;
+}
+
+/**
+ * list_for_each	-	iterate over a list
+ * @pos:	the &struct list_head to use as a loop cursor.
+ * @head:	the head for your list.
+ */
+#define list_for_each(pos, head) \
+	for (pos = (head)->next; !list_is_head(pos, (head)); pos = pos->next)
+
+/**
+ * list_empty - tests whether a list is empty
+ * @head: the list to test.
+ */
+static inline int list_size(const struct list_head *head)
+{
+	list_head_t *pos;
+	int i= 0;
+	list_for_each(pos, head)
+	{
+		i++;
+	}
+	return i;
+}
+
+#endif /* _U_LIST_H_ */
diff --git a/lab4/kernel/include/u_string.h b/lab4/kernel/include/u_string.h
new file mode 100644
index 000000000..c717e02dd
--- /dev/null
+++ b/lab4/kernel/include/u_string.h
@@ -0,0 +1,19 @@
+#ifndef _U_STRING_H_
+#define _U_STRING_H_
+
+#define VSPRINT_MAX_BUF_SIZE 0x100
+
+unsigned int sprintf(char *dst, char* fmt, ...);
+unsigned int vsprintf(char *dst,char* fmt, __builtin_va_list args);
+
+unsigned long long strlen(const char *str);
+int                strcmp(const char*, const char*);
+int                strncmp(const char*, const char*, unsigned long long);
+char*              memcpy(void *dest, const void *src, unsigned long long len);
+char*              strcpy(char *dest, const char *src);
+
+char* str_SepbySpace(char* head);
+int   atoi(char* str);
+unsigned long str_to_hex(const char* str);
+
+#endif /* _U_STRING_H_ */
diff --git a/lab4/kernel/include/uart1.h b/lab4/kernel/include/uart1.h
new file mode 100644
index 000000000..933b9c816
--- /dev/null
+++ b/lab4/kernel/include/uart1.h
@@ -0,0 +1,18 @@
+#ifndef	_UART1_H_
+#define	_UART1_H_
+
+void uart_init();
+char uart_recv();
+void uart_send(char c);
+int  uart_sendline(char* fmt, ...);
+char uart_async_getc();
+void uart_async_putc(char c);
+int  uart_puts(char* fmt, ...);
+void uart_2hex(unsigned int d);
+
+void uart_interrupt_enable();
+void uart_interrupt_disable();
+void uart_r_irq_handler();
+void uart_w_irq_handler();
+
+#endif /*_UART1_H_*/
diff --git a/lab4/kernel/initramfs.cpio b/lab4/kernel/initramfs.cpio
new file mode 100644
index 000000000..176c9d56f
Binary files /dev/null and b/lab4/kernel/initramfs.cpio differ
diff --git a/lab4/kernel/makefile b/lab4/kernel/makefile
new file mode 100644
index 000000000..df733ea9f
--- /dev/null
+++ b/lab4/kernel/makefile
@@ -0,0 +1,39 @@
+ARMGNU ?= aarch64-linux-gnu
+
+CFLAGS = -Wall -nostdlib -nostartfiles -ffreestanding -Iinclude -mgeneral-regs-only -g
+ASMFLAGS = -Iinclude
+
+BUILD_DIR = build
+SRC_DIR = src
+#---------------------------------------------------------------------------------------
+
+C_FILES = $(wildcard $(SRC_DIR)/*.c)
+ASM_FILES = $(wildcard $(SRC_DIR)/*.S)
+OBJ_FILES = $(C_FILES:$(SRC_DIR)/%.c=$(BUILD_DIR)/%_c.o)
+OBJ_FILES += $(ASM_FILES:$(SRC_DIR)/%.S=$(BUILD_DIR)/%_s.o)
+
+DEP_FILES = $(OBJ_FILES:%.o=%.d)
+-include $(DEP_FILES)
+
+$(BUILD_DIR)/%_c.o: $(SRC_DIR)/%.c
+	@mkdir -p $(@D)
+	$(ARMGNU)-gcc $(CFLAGS) -MMD -c $< -o $@
+
+$(BUILD_DIR)/%_s.o: $(SRC_DIR)/%.S
+	$(ARMGNU)-gcc $(ASMFLAGS) -MMD -c $< -o $@
+
+kernel8.img: $(SRC_DIR)/link.ld $(OBJ_FILES)
+	$(ARMGNU)-ld -T $(SRC_DIR)/link.ld -o $(BUILD_DIR)/kernel8.elf  $(OBJ_FILES)
+	$(ARMGNU)-objcopy $(BUILD_DIR)/kernel8.elf -O binary kernel8.img
+
+all: kernel8.img
+
+clean:
+	rm -rf $(BUILD_DIR) *.img
+
+run:
+	qemu-system-aarch64 -M raspi3b -display none -kernel kernel8.img -serial null -serial stdio -initrd initramfs.cpio -dtb bcm2710-rpi-3-b-plus.dtb
+
+debug:
+	qemu-system-aarch64 -M raspi3b -display none -kernel kernel8.img -serial null -serial stdio -initrd initramfs.cpio -dtb bcm2710-rpi-3-b-plus.dtb -S -s
+
diff --git a/lab4/kernel/src/boot.S b/lab4/kernel/src/boot.S
new file mode 100644
index 000000000..5f8a96392
--- /dev/null
+++ b/lab4/kernel/src/boot.S
@@ -0,0 +1,43 @@
+/* ARMv8 Assembly */
+
+.section ".text.boot"
+
+.global _start
+
+_start:
+    bl from_el2_to_el1
+
+set_exception_vector_table:
+    adr x1, exception_vector_table // vbar_el1: Vector Base Address Register (EL1)
+    msr vbar_el1, x1               //           Holds the exception base address for any exception that is taken to EL1.
+
+setup_stack:
+    ldr     x1, =_stack_top
+    mov     sp, x1                 // sp = x1
+
+setup_bss:
+    ldr     x1, =_bss_top          // load 32bits to x1 from _bss_top
+    ldr     w2, =_bss_size         // load 64bits to w2 from _bss_size
+
+init_bss:
+    cbz     w2, run_main
+    str     xzr, [x1], #8          // store xzr to addr[x1], then x1=x1+8
+    sub     w2, w2, #1
+    cbnz    w2, init_bss           // branch if w2 != 0
+
+run_main:
+    ldr     x1, =dtb_ptr
+    str     x0, [x1], #8
+    bl      main                   // branch and update lr with "main"
+
+proc_hang:
+    wfe                            // waiting in low-power state
+    b       proc_hang
+
+from_el2_to_el1:
+    mov x1, (1 << 31)              // hcr_el2: Execution state control for EL2
+    msr hcr_el2, x1                //          RW[31]: 0b1 The processor execution environment for EL1 is AArch64
+    mov x1, 0x3c5                  // spsr_el2: Holds the saved process state when an exception is taken to EL2.
+    msr spsr_el2, x1               //           (1)[1111] 00 (2)[0101] -> (1) EL2-PSTATE.DAIF Disabled (2) Exception level = EL1h
+    msr elr_el2, lr                // elr_el2: When taking an exception to EL2, holds the address to return to.
+    eret                           // eret: Perform an exception return. EL2 -> EL1
diff --git a/lab4/kernel/src/cpio.c b/lab4/kernel/src/cpio.c
new file mode 100644
index 000000000..a11233b7c
--- /dev/null
+++ b/lab4/kernel/src/cpio.c
@@ -0,0 +1,63 @@
+#include "cpio.h"
+#include "u_string.h"
+
+/* Parse an ASCII hex string into an integer. (big endian)*/
+static unsigned int parse_hex_str(char *s, unsigned int max_len)
+{
+    unsigned int r = 0;
+
+    for (unsigned int i = 0; i < max_len; i++) {
+        r *= 16;
+        if (s[i] >= '0' && s[i] <= '9') {
+            r += s[i] - '0';
+        }  else if (s[i] >= 'a' && s[i] <= 'f') {
+            r += s[i] - 'a' + 10;
+        }  else if (s[i] >= 'A' && s[i] <= 'F') {
+            r += s[i] - 'A' + 10;
+        } else {
+            return r;
+        }
+    }
+    return r;
+}
+
+
+/* write pathname, data, next header into corresponding parameter */
+/* if no next header, next_header_pointer = 0 */
+/* return -1 if parse error*/
+int cpio_newc_parse_header(struct cpio_newc_header *this_header_pointer, char **pathname, unsigned int *filesize, char **data, struct cpio_newc_header **next_header_pointer)
+{
+    /* Ensure magic header exists. */
+    if (strncmp(this_header_pointer->c_magic, CPIO_NEWC_HEADER_MAGIC, sizeof(this_header_pointer->c_magic)) != 0) return -1;
+
+    // transfer big endian 8 byte hex string to unsigned int and store into *filesize
+    *filesize = parse_hex_str(this_header_pointer->c_filesize,8);
+
+    // end of header is the pathname
+    *pathname = ((char *)this_header_pointer) + sizeof(struct cpio_newc_header); 
+
+    // get file data, file data is just after pathname
+    unsigned int pathname_length = parse_hex_str(this_header_pointer->c_namesize,8);
+    unsigned int offset = pathname_length + sizeof(struct cpio_newc_header);
+    // The file data is padded to a multiple of four bytes
+    offset = offset % 4 == 0 ? offset:(offset+4-offset%4);
+    *data = (char *)this_header_pointer+offset;
+
+    //get next header pointer
+    if(*filesize==0)
+    {
+        *next_header_pointer = (struct cpio_newc_header*)*data;
+    }else
+    {
+        offset = *filesize;
+        *next_header_pointer = (struct cpio_newc_header*)(*data + (offset%4==0?offset:(offset+4-offset%4)));
+    }
+
+    // if filepath is TRAILER!!! means there is no more files.
+    if(strncmp(*pathname,"TRAILER!!!", sizeof("TRAILER!!!"))==0)
+    {
+        *next_header_pointer = 0;
+    }
+
+    return 0;
+}
diff --git a/lab4/kernel/src/dtb.c b/lab4/kernel/src/dtb.c
new file mode 100644
index 000000000..c84cb7ce5
--- /dev/null
+++ b/lab4/kernel/src/dtb.c
@@ -0,0 +1,155 @@
+#include "dtb.h"
+#include "uart1.h"
+#include "u_string.h"
+#include "cpio.h"
+#include "memory.h"
+
+void* CPIO_DEFAULT_START;
+void* CPIO_DEFAULT_END;
+extern char* dtb_ptr;
+
+//stored as big endian
+struct fdt_header {
+    uint32_t magic;
+    uint32_t totalsize;
+    uint32_t off_dt_struct;
+    uint32_t off_dt_strings;
+    // reserve map for reserve memory, dtp pdf pg.52
+    uint32_t off_mem_rsvmap;
+    uint32_t version;
+    uint32_t last_comp_version;
+    uint32_t boot_cpuid_phys;
+    uint32_t size_dt_strings;
+    uint32_t size_dt_struct;
+};
+
+// memory reservation block - https://zhuanlan.zhihu.com/p/144863497
+struct fdt_reserve_entry {
+    uint64_t address;
+    uint64_t size;
+};
+
+uint32_t uint32_endian_big2lttle(uint32_t data)
+{
+    char* r = (char*)&data;
+    return (r[3]<<0) | (r[2]<<8) | (r[1]<<16) | (r[0]<<24);
+}
+
+uint64_t uint64_endian_big2lttle(uint64_t data)
+{
+    char *r = (char *)&data;
+    return ((unsigned long long)r[7] << 0) | ((unsigned long long)r[6] << 8) | ((unsigned long long)r[5] << 16) | ((unsigned long long)r[4] << 24) | ((unsigned long long)r[3] << 32) | ((unsigned long long)r[2] << 40) | ((unsigned long long)r[1] << 48) | ((unsigned long long)r[0] << 56);
+}
+
+void traverse_device_tree(void *dtb_ptr, dtb_callback callback)
+{
+    struct fdt_header* header = dtb_ptr;
+    if(uint32_endian_big2lttle(header->magic) != 0xD00DFEED)
+    {
+        uart_puts("traverse_device_tree : wrong magic in traverse_device_tree");
+        return;
+    }
+    // https://abcamus.github.io/2016/12/28/uboot%E8%AE%BE%E5%A4%87%E6%A0%91-%E8%A7%A3%E6%9E%90%E8%BF%87%E7%A8%8B/
+    // https://blog.csdn.net/wangdapao12138/article/details/82934127
+    uint32_t struct_size = uint32_endian_big2lttle(header->size_dt_struct);
+    char* dt_struct_ptr = (char*)((char*)header + uint32_endian_big2lttle(header->off_dt_struct));
+    char* dt_strings_ptr = (char*)((char*)header + uint32_endian_big2lttle(header->off_dt_strings));
+
+    char* end = (char*)dt_struct_ptr + struct_size;
+    char* pointer = dt_struct_ptr;
+
+    while(pointer < end)
+    {
+        uint32_t token_type = uint32_endian_big2lttle(*(uint32_t*)pointer);
+
+        pointer += 4;
+        if(token_type == FDT_BEGIN_NODE)
+        {
+            callback(token_type, pointer, 0, 0);
+            pointer += strlen(pointer);
+            pointer += 4 - (unsigned long long) pointer % 4;           //alignment 4 byte
+        }else if(token_type == FDT_END_NODE)
+        {
+            callback(token_type, 0, 0, 0);
+        }else if(token_type == FDT_PROP)
+        {
+            uint32_t len = uint32_endian_big2lttle(*(uint32_t*)pointer);
+            pointer += 4;
+            char* name = (char*)dt_strings_ptr + uint32_endian_big2lttle(*(uint32_t*)pointer);
+            pointer += 4;
+            callback(token_type, name, pointer, len);
+            pointer += len;
+            if((unsigned long long)pointer % 4 != 0) pointer += 4 - (unsigned long long)pointer%4;   //alignment 4 byte
+        }else if(token_type == FDT_NOP)
+        {
+            callback(token_type, 0, 0, 0);
+        }else if(token_type == FDT_END)
+        {
+            callback(token_type, 0, 0, 0);
+        }else
+        {
+            uart_puts("error type:%x\n",token_type);
+            return;
+        }
+    }
+}
+
+void dtb_callback_show_tree(uint32_t node_type, char *name, void *data, uint32_t name_size)
+{
+    static int level = 0;
+    if(node_type==FDT_BEGIN_NODE)
+    {
+        for(int i=0;i<level;i++)uart_puts("   ");
+        uart_puts("%s{\n",name);
+        level++;
+    }else if(node_type==FDT_END_NODE)
+    {
+        level--;
+        for(int i=0;i<level;i++)uart_puts("   ");
+        uart_puts("}\n");
+    }else if(node_type==FDT_PROP)
+    {
+        for(int i=0;i<level;i++)uart_puts("   ");
+        uart_puts("%s\n",name);
+    }
+}
+
+void dtb_callback_initramfs(uint32_t node_type, char *name, void *value, uint32_t name_size) {
+    // https://github.com/stweil/raspberrypi-documentation/blob/master/configuration/device-tree.md
+    // linux,initrd-start will be assigned by start.elf based on config.txt
+    if (node_type == FDT_PROP && strcmp(name,"linux,initrd-start") == 0)
+    {
+        CPIO_DEFAULT_START = (void *)(unsigned long long)uint32_endian_big2lttle(*(uint32_t*)value);
+    }
+    if (node_type == FDT_PROP && strcmp(name, "linux,initrd-end") == 0)
+    {
+        CPIO_DEFAULT_END = (void *)(unsigned long long)uint32_endian_big2lttle(*(uint32_t *)value);
+    }
+}
+
+void dtb_find_and_store_reserved_memory()
+{
+    struct fdt_header *header = (struct fdt_header *) dtb_ptr;
+    if (uint32_endian_big2lttle(header->magic) != 0xD00DFEED)
+    {
+        uart_puts("traverse_device_tree : wrong magic in traverse_device_tree");
+        return;
+    }
+
+    // off_mem_rsvmap stores all of reserve memory map with address and size
+    char *dt_mem_rsvmap_ptr = (char *)((char *)header + uint32_endian_big2lttle(header->off_mem_rsvmap));
+    struct fdt_reserve_entry *reverse_entry = (struct fdt_reserve_entry *)dt_mem_rsvmap_ptr;
+
+    // reserve memory which is defined by dtb
+    while (reverse_entry->address != 0 || reverse_entry->size != 0)
+    {
+        unsigned long long start = uint64_endian_big2lttle(reverse_entry->address);
+        unsigned long long end = uint64_endian_big2lttle(reverse_entry->size) + start;
+        memory_reserve(start, end);
+        // increasing according to type
+        reverse_entry++;
+    }
+
+    // reserve device tree itself
+    memory_reserve((unsigned long long)dtb_ptr, (unsigned long long)dtb_ptr + uint32_endian_big2lttle(header->totalsize));
+}
diff --git a/lab4/kernel/src/entry.S b/lab4/kernel/src/entry.S
new file mode 100644
index 000000000..7d4ee414c
--- /dev/null
+++ b/lab4/kernel/src/entry.S
@@ -0,0 +1,191 @@
+// save general registers to stack
+.macro save_all
+    sub sp, sp, 32 * 9
+    stp x0, x1, [sp ,16 * 0]  // store pair of registers
+    stp x2, x3, [sp ,16 * 1]
+    stp x4, x5, [sp ,16 * 2]
+    stp x6, x7, [sp ,16 * 3]
+    stp x8, x9, [sp ,16 * 4]
+    stp x10, x11, [sp ,16 * 5]
+    stp x12, x13, [sp ,16 * 6]
+    stp x14, x15, [sp ,16 * 7]
+    stp x16, x17, [sp ,16 * 8]
+    stp x18, x19, [sp ,16 * 9]
+    stp x20, x21, [sp ,16 * 10]
+    stp x22, x23, [sp ,16 * 11]
+    stp x24, x25, [sp ,16 * 12]
+    stp x26, x27, [sp ,16 * 13]
+    stp x28, x29, [sp ,16 * 14]
+    str x30, [sp, 16 * 15]
+    // information for nested interrupt
+    mrs x0, spsr_el1
+    str x0, [sp, 16 * 16]
+    mrs x0, elr_el1
+    str x0, [sp, 16 * 17]
+    ldp x0, x1, [sp ,16 * 0]  // restore x0 instead of elr_el1
+.endm
+
+// load general registers from stack
+.macro load_all
+    ldp x0, x1, [sp ,16 * 0]
+    ldp x2, x3, [sp ,16 * 1]
+    ldp x4, x5, [sp ,16 * 2]
+    ldp x6, x7, [sp ,16 * 3]
+    ldp x8, x9, [sp ,16 * 4]
+    ldp x10, x11, [sp ,16 * 5]
+    ldp x12, x13, [sp ,16 * 6]
+    ldp x14, x15, [sp ,16 * 7]
+    ldp x16, x17, [sp ,16 * 8]
+    ldp x18, x19, [sp ,16 * 9]
+    ldp x20, x21, [sp ,16 * 10]
+    ldp x22, x23, [sp ,16 * 11]
+    ldp x24, x25, [sp ,16 * 12]
+    ldp x26, x27, [sp ,16 * 13]
+    ldp x28, x29, [sp ,16 * 14]
+    ldr x30, [sp, 16 * 15]
+    // information for nested interrupt
+    ldr x0, [sp, 16 * 16]
+    msr spsr_el1,x0
+    ldr x0, [sp, 16 * 17]
+    msr elr_el1, x0
+    ldp x0, x1, [sp ,16 * 0]  // restore x0 instead of elr_el1
+    add sp, sp, 32 * 9
+.endm
+
+.macro    ventry    label
+    .align    7   // entry should be aligned to 0x80 (2^7)
+    b    \label
+.endm
+
+.align 11         // vector table should be aligned to 0x800 (2^11)
+.global exception_vector_table
+
+// exception_vector_table definition
+// https://github.com/torvalds/linux/blob/v4.14/arch/arm64/kernel/entry.S#L367
+exception_vector_table:
+    //Exception from the current EL while using SP_EL0
+    ventry    el1t_sync_invalid        // Synchronous EL1t
+    ventry    el1t_irq_invalid         // IRQ EL1t
+    ventry    el1t_fiq_invalid         // FIQ EL1t
+    ventry    el1t_error_invalid       // Error EL1t
+
+    //Exception from the current EL while using SP_ELx
+    ventry    el1h_sync                // Synchronous EL1h
+    ventry    el1h_irq                 // IRQ EL1h
+    ventry    el1h_fiq_invalid         // FIQ EL1h
+    ventry    el1h_error_invalid       // Error EL1h
+
+    //Exception from a lower EL and at least one lower EL is AArch64
+    ventry    el0_sync_64             // Synchronous 64-bit EL0
+    ventry    el0_irq_64              // IRQ 64-bit EL0
+    ventry    el0_fiq_invalid_64      // FIQ 64-bit EL0
+    ventry    el0_error_invalid_64    // Error 64-bit EL0
+
+    //Exception from a lower EL and at least all lower EL are AArch32
+    ventry    el0_sync_invalid_32     // Synchronous 32-bit EL0
+    ventry    el0_irq_invalid_32      // IRQ 32-bit EL0
+    ventry    el0_fiq_invalid_32      // FIQ 32-bit EL0
+    ventry    el0_error_invalid_32    // Error 32-bit EL0
+
+
+el1t_sync_invalid:
+    save_all
+    mov x0,0
+    bl invalid_exception_router
+    load_all
+    eret
+el1t_irq_invalid:
+    save_all
+    mov x0,1
+    bl invalid_exception_router
+    load_all
+    eret
+el1t_fiq_invalid:
+    save_all
+    mov x0,2
+    bl invalid_exception_router
+    load_all
+    eret
+el1t_error_invalid:
+    save_all
+    mov x0,3
+    bl invalid_exception_router
+    load_all
+    eret
+
+
+el1h_sync:
+    save_all
+    mov x0,4
+    bl invalid_exception_router
+    load_all
+    eret
+el1h_irq:
+    save_all
+    mov x0,5
+    bl el1h_irq_router
+    load_all
+    eret
+el1h_fiq_invalid:
+    save_all
+    mov x0,6
+    bl invalid_exception_router
+    load_all
+    eret
+el1h_error_invalid:
+    save_all
+    mov x0,7
+    bl invalid_exception_router
+    load_all
+    eret
+
+el0_sync_64:
+    save_all
+    mov x0,8
+    bl el0_sync_router
+    load_all
+    eret
+el0_irq_64:
+    save_all
+    mov x0,9
+    bl el0_irq_64_router
+    load_all
+    eret
+el0_fiq_invalid_64:
+    save_all
+    mov x0,10
+    bl invalid_exception_router
+    load_all
+    eret
+el0_error_invalid_64:
+    save_all
+    mov x0,11
+    bl invalid_exception_router
+    load_all
+    eret
+
+
+el0_sync_invalid_32:
+    save_all
+    mov x0,12
+    bl invalid_exception_router
+    load_all
+    eret
+el0_irq_invalid_32:
+    save_all
+    mov x0,13
+    bl invalid_exception_router
+    load_all
+    eret
+el0_fiq_invalid_32:
+    save_all
+    mov x0,14
+    bl invalid_exception_router
+    load_all
+    eret
+el0_error_invalid_32:
+    save_all
+    mov x0,15
+    bl invalid_exception_router
+    load_all
+    eret
diff --git a/lab4/kernel/src/exception.c b/lab4/kernel/src/exception.c
new file mode 100644
index 000000000..3de99ffc7
--- /dev/null
+++ b/lab4/kernel/src/exception.c
@@ -0,0 +1,173 @@
+#include "bcm2837/rpi_irq.h"
+#include "bcm2837/rpi_uart1.h"
+#include "uart1.h"
+#include "exception.h"
+#include "timer.h"
+#include "memory.h"
+
+// DAIF, Interrupt Mask Bits
+void el1_interrupt_enable(){
+    __asm__ __volatile__("msr daifclr, 0xf"); // umask all DAIF
+}
+
+void el1_interrupt_disable(){
+    __asm__ __volatile__("msr daifset, 0xf"); // mask all DAIF
+}
+
+void el1h_irq_router(){
+    // decouple the handler into irqtask queue
+    // (1) https://datasheets.raspberrypi.com/bcm2835/bcm2835-peripherals.pdf - Pg.113
+    // (2) https://datasheets.raspberrypi.com/bcm2836/bcm2836-peripherals.pdf - Pg.16
+    if(*IRQ_PENDING_1 & IRQ_PENDING_1_AUX_INT && *CORE0_INTERRUPT_SOURCE & INTERRUPT_SOURCE_GPU) // from aux && from GPU0 -> uart exception
+    {
+        if (*AUX_MU_IIR_REG & (1 << 1))
+        {
+            *AUX_MU_IER_REG &= ~(2);  // disable write interrupt
+            irqtask_add(uart_w_irq_handler, UART_IRQ_PRIORITY);
+            irqtask_run_preemptive(); // run the queued task before returning to the program.
+        }
+        else if (*AUX_MU_IIR_REG & (2 << 1))
+        {
+            *AUX_MU_IER_REG &= ~(1);  // disable read interrupt
+            irqtask_add(uart_r_irq_handler, UART_IRQ_PRIORITY);
+            irqtask_run_preemptive();
+        }
+    }
+    else if(*CORE0_INTERRUPT_SOURCE & INTERRUPT_SOURCE_CNTPNSIRQ)  //from CNTPNS (core_timer) // A1 - setTimeout run in el1
+    {
+        core_timer_disable();
+        irqtask_add(core_timer_handler, TIMER_IRQ_PRIORITY);
+        irqtask_run_preemptive();
+        core_timer_enable();
+    }
+}
+
+void el0_sync_router(){
+    unsigned long long spsr_el1;
+    __asm__ __volatile__("mrs %0, SPSR_EL1\n\t" : "=r" (spsr_el1)); // EL1 configuration, spsr_el1[9:6]=4b0 to enable interrupt
+    unsigned long long elr_el1;
+    __asm__ __volatile__("mrs %0, ELR_EL1\n\t" : "=r" (elr_el1));   // ELR_EL1 holds the address if return to EL1
+    unsigned long long esr_el1;
+    __asm__ __volatile__("mrs %0, ESR_EL1\n\t" : "=r" (esr_el1));   // ESR_EL1 holds symdrome information of exception, to know why the exception happens.
+    uart_sendline("[Exception][el0_sync] spsr_el1 : 0x%x, elr_el1 : 0x%x, esr_el1 : 0x%x\n", spsr_el1, elr_el1, esr_el1);
+}
+
+void el0_irq_64_router(){
+    // decouple the handler into irqtask queue
+    // (1) https://datasheets.raspberrypi.com/bcm2835/bcm2835-peripherals.pdf - Pg.113
+    // (2) https://datasheets.raspberrypi.com/bcm2836/bcm2836-peripherals.pdf - Pg.16
+    if(*IRQ_PENDING_1 & IRQ_PENDING_1_AUX_INT && *CORE0_INTERRUPT_SOURCE & INTERRUPT_SOURCE_GPU) // from aux && from GPU0 -> uart exception
+    {
+        if (*AUX_MU_IIR_REG & (0b01 << 1))
+        {
+            *AUX_MU_IER_REG &= ~(2);  // disable write interrupt
+            irqtask_add(uart_w_irq_handler, UART_IRQ_PRIORITY);
+            irqtask_run_preemptive();
+        }
+        else if (*AUX_MU_IIR_REG & (0b10 << 1))
+        {
+            *AUX_MU_IER_REG &= ~(1);  // disable read interrupt
+            irqtask_add(uart_r_irq_handler, UART_IRQ_PRIORITY);
+            irqtask_run_preemptive();
+        }
+    }
+    else if(*CORE0_INTERRUPT_SOURCE & INTERRUPT_SOURCE_CNTPNSIRQ)  //from CNTPNS (core_timer) // A1 - setTimeout run in el1
+    {
+        core_timer_disable();
+        irqtask_add(core_timer_handler, TIMER_IRQ_PRIORITY);
+        irqtask_run_preemptive();
+        core_timer_enable();
+    }
+}
+
+
+void invalid_exception_router(unsigned long long x0){
+    //uart_sendline("invalid exception : 0x%x\r\n",x0);
+    //while(1);
+}
+
+// ------------------------------------------------------------------------------------------
+
+/*
+Preemption
+Now, any interrupt handler can preempt the task’s execution, but the newly enqueued task still needs to wait for the currently running task’s completion.
+It’d be better if the newly enqueued task with a higher priority can preempt the currently running task.
+To achieve the preemption, the kernel can check the last executing task’s priority before returning to the previous interrupt handler.
+If there are higher priority tasks, execute the highest priority task.
+*/
+
+int curr_task_priority = 9999;   // Small number has higher priority
+
+struct list_head *task_list;
+void irqtask_list_init()
+{
+    INIT_LIST_HEAD(task_list);
+}
+
+
+void irqtask_add(void *task_function,unsigned long long priority){
+    irqtask_t *the_task = s_allocator(sizeof(irqtask_t)); // free by irq_tasl_run_preemptive()
+
+    // store all the related information into irqtask node
+    // manually copy the device's buffer
+    the_task->priority = priority;
+    the_task->task_function = task_function;
+    INIT_LIST_HEAD(&the_task->listhead);
+
+    // add the timer_event into timer_event_list (sorted)
+    // if the priorities are the same -> FIFO
+    struct list_head *curr;
+
+    // mask the device's interrupt line
+    el1_interrupt_disable();
+    // enqueue the processing task to the event queue with sorting.
+    list_for_each(curr, task_list)
+    {
+        if (((irqtask_t *)curr)->priority > the_task->priority)
+        {
+            list_add(&the_task->listhead, curr->prev);
+            break;
+        }
+    }
+    // if the priority is lowest
+    if (list_is_head(curr, task_list))
+    {
+        list_add_tail(&the_task->listhead, task_list);
+    }
+    // unmask the interrupt line
+    el1_interrupt_enable();
+}
+
+void irqtask_run_preemptive(){
+    el1_interrupt_enable();
+    while (!list_empty(task_list))
+    {
+        // critical section protects new coming node
+        el1_interrupt_disable();
+        irqtask_t *the_task = (irqtask_t *)task_list->next;
+        // Run new task (early return) if its priority is lower than the scheduled task.
+        if (curr_task_priority <= the_task->priority)
+        {
+            el1_interrupt_enable();
+            break;
+        }
+        // get the scheduled task and run it.
+        list_del_entry((struct list_head *)the_task);
+        int prev_task_priority = curr_task_priority;
+        curr_task_priority = the_task->priority;
+
+        el1_interrupt_enable();
+        irqtask_run(the_task);
+        el1_interrupt_disable();
+
+        curr_task_priority = prev_task_priority;
+        el1_interrupt_enable();
+        s_free(the_task);
+    }
+}
+
+void irqtask_run(irqtask_t* the_task)
+{
+    ((void (*)())the_task->task_function)();
+}
+
diff --git a/lab4/kernel/src/link.ld b/lab4/kernel/src/link.ld
new file mode 100644
index 000000000..6c85f41d7
--- /dev/null
+++ b/lab4/kernel/src/link.ld
@@ -0,0 +1,36 @@
+_heap_stack_size = 8M;
+#heap size 0x800000
+
+# 0x080000   _start
+#            text, rodata, bss
+#            heap+stack // simple allocator
+# 0x880000   _end 0x8892E0
+# 0x3000000  bootloader
+# 0x3100000  _end
+# 0x8000000  initramfs
+# 0x10000000 buddy_system
+# 0x20000000 _end
+
+SECTIONS
+{
+    . = 0x80000;
+    _start = .;
+    .text : { *(.text.boot) *(.text) }
+    .rodata : { *(.rodata) }
+    .data : { *(.data) }
+    .bss : {
+        _bss_top = .;
+        *(.bss) 
+    }
+    _bss_size = SIZEOF(.bss) >> 3;
+    .heap : {
+        . = ALIGN(8);
+        _heap_top = .;
+    } 
+    . = . + _heap_stack_size;
+    .stack : {
+        . = ALIGN(8);
+        _stack_top = .;
+    }
+    _end = .;
+}
diff --git a/lab4/kernel/src/main.c b/lab4/kernel/src/main.c
new file mode 100644
index 000000000..6c429b908
--- /dev/null
+++ b/lab4/kernel/src/main.c
@@ -0,0 +1,38 @@
+#include "uart1.h"
+#include "shell.h"
+#include "memory.h"
+#include "u_string.h"
+#include "dtb.h"
+#include "exception.h"
+#include "timer.h"
+
+char* dtb_ptr;
+extern char* _end;
+
+void main(char* arg){
+    char input_buffer[CMD_MAX_LEN];
+
+    dtb_ptr = arg;
+    traverse_device_tree(dtb_ptr, dtb_callback_initramfs); // get initramfs location from dtb
+
+    uart_init();
+    //uart_2hex((unsigned int)&_end);
+    irqtask_list_init();
+    timer_list_init();
+
+    uart_interrupt_enable();
+    el1_interrupt_enable();  // enable interrupt in EL1 -> EL1
+    core_timer_enable();
+
+    cli_cmd_read(input_buffer); // Wait for input, Windows cannot attach to SERIAL from two processes.
+
+    init_allocator();
+
+    cli_print_banner();
+    while(1){
+        cli_cmd_clear(input_buffer, CMD_MAX_LEN);
+        uart_puts("# ");
+        cli_cmd_read(input_buffer);
+        cli_cmd_exec(input_buffer);
+    }
+}
diff --git a/lab4/kernel/src/mbox.c b/lab4/kernel/src/mbox.c
new file mode 100644
index 000000000..e59dee6ee
--- /dev/null
+++ b/lab4/kernel/src/mbox.c
@@ -0,0 +1,23 @@
+#include "bcm2837/rpi_mbox.h"
+#include "mbox.h"
+
+/* Aligned to 16-byte boundary while we have 28-bits for VC */
+volatile unsigned int  __attribute__((aligned(16))) pt[64];
+
+int mbox_call( mbox_channel_type channel, unsigned int value )
+{
+    // Add channel to lower 4 bit
+    value &= ~(0xF);
+    value |= channel;
+    while ( (*MBOX_STATUS & BCM_ARM_VC_MS_FULL) != 0 ) {}
+    // Write to Register
+    *MBOX_WRITE = value;
+    while(1) {
+        while ( *MBOX_STATUS & BCM_ARM_VC_MS_EMPTY ) {}
+        // Read from Register
+        if (value == *MBOX_READ)
+            return pt[1] == MBOX_REQUEST_SUCCEED;
+    }
+    return 0;
+}
+
diff --git a/lab4/kernel/src/memory.c b/lab4/kernel/src/memory.c
new file mode 100644
index 000000000..4a7069e77
--- /dev/null
+++ b/lab4/kernel/src/memory.c
@@ -0,0 +1,510 @@
+#include "memory.h"
+#include "u_list.h"
+#include "uart1.h"
+#include "exception.h"
+#include "dtb.h"
+#include "shell.h"
+
+extern char  _heap_top;
+static char* htop_ptr = &_heap_top;
+
+extern char  _start;
+extern char  _end;
+extern char  _stack_top;
+extern char* CPIO_DEFAULT_START;
+extern char* CPIO_DEFAULT_END;
+extern char* dtb_ptr;
+
+// ------ Lab2 ------
+void* s_allocator(unsigned int size)
+{
+    // -> htop_ptr
+    // htop_ptr + 0x02:  heap_block size
+    // htop_ptr + 0x10 ~ htop_ptr + 0x10 * k:
+    //            { heap_block }
+    // -> htop_ptr
+
+    // 0x10 for heap_block header
+    char* r = htop_ptr + 0x10;
+    // size paddling to multiple of 0x10
+    size = 0x10 + size - size % 0x10;
+    *(unsigned int*)(r - 0x8) = size;
+    htop_ptr += size;
+    return r;
+}
+
+void s_free(void* ptr)
+{
+    // TBD
+}
+
+// ------ Lab4 ------
+static frame_t* frame_array;                    // store memory's statement and page's corresponding index
+static list_head_t        frame_freelist[FRAME_MAX_IDX];  // store available block for page
+static list_head_t        chunk_list[CHUNK_MAX_IDX];      // store available block for chunk
+
+void init_allocator()
+{   //allocator in heap, simple allocator
+    frame_array = s_allocator(BUDDY_MEMORY_PAGE_COUNT * sizeof(frame_t));
+
+    // init frame_array
+    for (int i = 0; i < BUDDY_MEMORY_PAGE_COUNT; i++)
+    {
+        if (i % (1 << FRAME_IDX_FINAL) == 0)
+        {   //val : order
+            frame_array[i].val = FRAME_IDX_FINAL;
+            frame_array[i].used = FRAME_FREE;
+        }
+    }
+
+    //init frame freelist
+    for (int i = FRAME_IDX_0; i <= FRAME_IDX_FINAL; i++)
+    {
+        INIT_LIST_HEAD(&frame_freelist[i]);
+    }
+
+    //init chunk list
+    for (int i = CHUNK_IDX_0; i <= CHUNK_IDX_FINAL; i++)
+    {
+        INIT_LIST_HEAD(&chunk_list[i]);
+    }
+
+    for (int i = 0; i < BUDDY_MEMORY_PAGE_COUNT; i++)
+    {
+        // init listhead for each frame
+        INIT_LIST_HEAD(&frame_array[i].listhead);
+        frame_array[i].idx = i;
+        frame_array[i].chunk_order = CHUNK_NONE;
+
+        // add init frame (FRAME_IDX_FINAL) into freelist
+        if (i % (1 << FRAME_IDX_FINAL) == 0)
+        {
+            list_add(&frame_array[i].listhead, &frame_freelist[FRAME_IDX_FINAL]);
+        }
+    }
+
+    /* Startup reserving the following region:
+    Spin tables for multicore boot (0x0000 - 0x1000)
+    Devicetree (Optional, if you have implement it)
+    Kernel image in the physical memory
+    Your simple allocator (startup allocator) (Stack + Heap in my case)
+    Initramfs
+    */
+    uart_sendline("\r\n* Startup Allocation *\r\n");
+    uart_sendline("buddy system: usable memory region: 0x%x ~ 0x%x\n", BUDDY_MEMORY_BASE, BUDDY_MEMORY_BASE + BUDDY_MEMORY_PAGE_COUNT * PAGESIZE);
+    dtb_find_and_store_reserved_memory(); // find spin tables in dtb
+    memory_reserve((unsigned long long) & _start, (unsigned long long) & _end); // kernel
+    memory_reserve((unsigned long long)CPIO_DEFAULT_START, (unsigned long long)CPIO_DEFAULT_END);
+}
+
+void* page_malloc(unsigned int size)
+{
+    uart_sendline("    [+] Allocate page - size : %d(0x%x)\r\n", size, size);
+    uart_sendline("        Before\r\n");
+    page_info();
+
+    int target_order;
+    // turn size into minimum 4KB * 2**target_order
+    for (int i = FRAME_IDX_0; i <= FRAME_IDX_FINAL; i++)
+    {
+        // search from small to big
+        if (size <= (PAGESIZE << i))
+        {
+            target_order = i;
+            uart_sendline("        block size = 0x%x\n", PAGESIZE << i);
+            break;
+        }
+        if (i == FRAME_IDX_FINAL)
+        {
+            uart_puts("[!] request size exceeded for page_malloc!!!!\r\n");
+            return (void*)0;
+        }
+
+    }
+
+    // find the available larger free page in freelist
+    int order;
+    for (order = target_order; order <= FRAME_IDX_FINAL; order++)
+    {
+        // 如果有的話跳出執行
+        // freelist does not have 2**i order frame, going for next order
+        if (!list_empty(&frame_freelist[order]))
+            break;
+    }
+    if (order > FRAME_IDX_FINAL)
+    {
+        uart_puts("[!] No available frame in freelist, page_malloc ERROR!!!!\r\n");
+        return (void*)0;
+    }
+
+    // get the available frame from freelist
+    // 找當前order的freelist的第一個frame
+    // current order is the closest freelist node
+    frame_t* target_frame_ptr = (frame_t*)frame_freelist[order].next;
+    list_del_entry((struct list_head*)target_frame_ptr);
+
+    // // 計算目標 frame 的基地址
+    unsigned long frame_base = BUDDY_MEMORY_BASE + (target_frame_ptr->idx * PAGESIZE);
+
+    // 目前不夠用會去比較大的地方切割
+    // Release redundant memory block to separate into pieces
+    for (int j = order; j > target_order; j--) // ex: 10000 -> 01111
+    {
+        // ex 8kb-> 4kb, 4kb
+        unsigned long left_block_start = frame_base;
+        unsigned long left_block_end = left_block_start + (PAGESIZE << (j - 1)) - 1;
+        unsigned long right_block_start = left_block_end + 1;
+        unsigned long right_block_end = right_block_start + (PAGESIZE << (j - 1)) - 1;
+
+        //uart_sendline("page_info big to small:\n");
+        // page_info();
+        // // 輸出分割訊息
+        uart_sendline("Split 0x%x to 0x%x ~ 0x%x and 0x%x ~ 0x%x\n",
+            (unsigned int)frame_base,
+            (unsigned int)left_block_start, (unsigned int)left_block_end,
+            (unsigned int)right_block_start, (unsigned int)right_block_end);
+        release_redundant(target_frame_ptr);//split
+        
+    }
+
+    
+    // Allocate it
+    // return allocated buddy memory address
+    target_frame_ptr->used = FRAME_ALLOCATED;
+    uart_sendline("        physical address : 0x%x\n", BUDDY_MEMORY_BASE + (PAGESIZE * (target_frame_ptr->idx)));
+    uart_sendline("        After\r\n");
+    page_info();
+
+    return (void*)BUDDY_MEMORY_BASE + (PAGESIZE * (target_frame_ptr->idx));
+}
+
+void page_free(void* ptr)
+{   
+    //idx : ((unsigned long long)ptr - BUDDY_MEMORY_BASE) >> 12 
+    frame_t* target_frame_ptr = &frame_array[((unsigned long long)ptr - BUDDY_MEMORY_BASE) >> 12]; // PAGESIZE * Available Region -> 0x1000 * 0x10000000 // SPEC #1, #2
+    uart_sendline("    [+] Free page: 0x%x, val = %d\r\n", ptr, target_frame_ptr->val);
+    uart_sendline("        Before\r\n");
+    page_info();
+    target_frame_ptr->used = FRAME_FREE;
+    while (coalesce(target_frame_ptr) == 0); // merge buddy iteratively
+    list_add(&target_frame_ptr->listhead, &frame_freelist[target_frame_ptr->val]);
+    uart_sendline("        After\r\n");
+    page_info();
+}
+
+frame_t* release_redundant(frame_t* frame)//split
+{
+    // order -1 -> add its buddy to free list (frame itself will be used in master function)
+    // 切割出來的兩塊, 有一塊被aloocated掉沒有加進去
+
+    frame->val -= 1;
+    frame_t* buddyptr = get_buddy(frame);
+    buddyptr->val = frame->val;
+    list_add(&buddyptr->listhead, &frame_freelist[buddyptr->val]);
+    //page_info();
+    return frame;
+}
+
+frame_t* get_buddy(frame_t* frame)
+{
+    // XOR(idx, order)
+    return &frame_array[frame->idx ^ (1 << frame->val)];
+}
+
+int coalesce(frame_t* frame_ptr)
+{
+    frame_t* buddy = get_buddy(frame_ptr);
+    // frame is the boundary
+    if (frame_ptr->val == FRAME_IDX_FINAL)
+        return -1;
+
+    // Order must be the same: 2**i + 2**i = 2**(i+1)
+    if (frame_ptr->val != buddy->val)
+        return -1;
+
+    // buddy is in used
+    if (buddy->used == FRAME_ALLOCATED)
+        return -1;
+
+    list_del_entry((struct list_head*)buddy);
+    // merge成更大塊，所以更新他的order值
+    frame_ptr->val += 1;
+    uart_sendline("    coalesce detected, merging 0x%x, 0x%x, -> val = %d\r\n", frame_ptr->idx, buddy->idx, frame_ptr->val);
+    return 0;
+}
+
+void page_info()
+{
+    unsigned int exp2 = 1;
+    uart_sendline("        ----------------- [  Number of Available Page Blocks  ] -----------------\r\n        | ");
+    for (int i = FRAME_IDX_0; i <= FRAME_IDX_FINAL; i++)
+    {
+        uart_sendline("%4dKB(%1d) ", 4 * exp2, i);
+        exp2 *= 2;
+    }
+    uart_sendline("|\r\n        | ");
+    for (int i = FRAME_IDX_0; i <= FRAME_IDX_FINAL; i++)
+        uart_sendline("     %4d ", list_size(&frame_freelist[i]));
+    uart_sendline("|\r\n");
+}
+
+void chunk_info()
+{
+    unsigned int exp2 = 1;
+    uart_sendline("    -- [  Number of Available Chunk Blocks ] --\r\n    | ");
+    for (int i = CHUNK_IDX_0; i <= CHUNK_IDX_FINAL; i++)
+    {
+        uart_sendline("%4dB(%1d) ", 32 * exp2, i);
+        exp2 *= 2;
+    }
+    uart_sendline("|\r\n    | ");
+    for (int i = CHUNK_IDX_0; i <= CHUNK_IDX_FINAL; i++)
+        uart_sendline("   %5d ", list_size(&chunk_list[i]));
+    uart_sendline("|\r\n");
+}
+
+void page2chunks(int target_order)
+{
+    // make chunks from a smallest-size page
+    char* page = page_malloc(PAGESIZE);
+    frame_t* pageframe_ptr = &frame_array[((unsigned long long)page - BUDDY_MEMORY_BASE) >> 12];
+    pageframe_ptr->chunk_order = target_order;
+
+    // split page into a lot of chunks and push them into chunk_list
+    int chunksize = (32 << target_order);
+    for (int i = 0; i < PAGESIZE; i += chunksize)
+    {
+        list_head_t* c = (list_head_t*)(page + i); //page = chunk base address, i is i-th chunk
+        list_add(c, &chunk_list[target_order]); // c : chunk addr
+    }
+}
+
+void* chunk_malloc(unsigned int size)
+{
+    uart_sendline("[+] Allocate chunk - size : %d(0x%x)\r\n", size, size);
+    uart_sendline("    Before\r\n");
+    chunk_info();
+
+    // turn size into chunk order: 32B * 2**target_order
+    int target_order;
+    for (int i = CHUNK_IDX_0; i <= CHUNK_IDX_FINAL; i++)
+    {
+        if (size <= (32 << i)) { target_order = i; break; }
+    }
+
+    // if no available chunk in list, assign one page for it
+    if (list_empty(&chunk_list[target_order]))
+    {
+        page2chunks(target_order);
+    }
+
+    list_head_t* r = chunk_list[target_order].next;
+    list_del_entry(r);
+    uart_sendline("    physical address : 0x%x\n", r);
+    uart_sendline("    After\r\n");
+    chunk_info();
+    return r;
+}
+
+int all_chunks_free_in_page(frame_t* page_frame)
+{
+    // 獲取該頁面的 chunk 級別
+    int chunk_order = page_frame->chunk_order;
+    int chunksize = (32 << chunk_order);
+    int num_chunks_in_page = PAGESIZE / chunksize;
+
+    // 計算該頁面起始地址
+    unsigned long long page_start = BUDDY_MEMORY_BASE + (page_frame->idx * PAGESIZE);
+    unsigned long long page_end = page_start + PAGESIZE;
+
+    // 檢查該頁面內的所有 chunk
+    int free_chunks_count = 0;
+    list_head_t *current;
+    list_for_each(current, &chunk_list[chunk_order]) {
+        if ((unsigned long long)current >= page_start && (unsigned long long)current < page_end) {
+            free_chunks_count++;
+        }
+    }
+    if (free_chunks_count == num_chunks_in_page)
+    {
+        list_for_each(current, &chunk_list[chunk_order])
+        {
+            if ((unsigned long long)current >= page_start && (unsigned long long)current < page_end) {
+                list_del_entry(current);
+            }
+        }
+
+    }
+
+    // 如果該頁面內所有 chunk 都已釋放，則返回 true
+    return (free_chunks_count == num_chunks_in_page);
+}
+
+
+void chunk_free(void* ptr)
+{
+    list_head_t* c = (list_head_t*)ptr;
+    frame_t* pageframe_ptr = &frame_array[((unsigned long long)ptr - BUDDY_MEMORY_BASE) >> 12];
+    uart_sendline("[+] Free chunk: 0x%x, val = %d\r\n", ptr, pageframe_ptr->chunk_order);
+    uart_sendline("    Before\r\n");
+    chunk_info();
+    list_add(c, &chunk_list[pageframe_ptr->chunk_order]);
+    uart_sendline("    After\r\n");
+    chunk_info();
+    // uart_sendline("%d", 32 * pageframe_ptr->chunk_order << 1 * list_size(&chunk_list[pageframe_ptr->chunk_order]));
+    // if (32 * 1<<pageframe_ptr->chunk_order * list_size(&chunk_list[pageframe_ptr->chunk_order]) == PAGESIZE)
+    // {
+    //     page_free(ptr);
+    // }
+    if (all_chunks_free_in_page(pageframe_ptr)) {
+        uart_sendline("[+] All chunks in page are free. Releasing page back to Buddy System\n");
+        unsigned long long address = BUDDY_MEMORY_BASE + (pageframe_ptr->idx * PAGESIZE);
+        page_free((void*)address);
+    }
+
+}
+
+void* kmalloc(unsigned int size)
+{
+    uart_sendline("\n\n");
+    uart_sendline("================================\r\n");
+    uart_sendline("[+] Request kmalloc size: %d\r\n", size);
+    uart_sendline("================================\r\n");
+    // if size is larger than chunk size, go for page
+    if (size > (32 << CHUNK_IDX_FINAL)) // if > 2048 bytes
+    {
+        void* r = page_malloc(size);
+        return r;
+    }
+    // go for chunk
+    void* r = chunk_malloc(size);
+    return r;
+}
+
+void kfree(void* ptr)
+{
+    uart_sendline("\n\n");
+    uart_sendline("==========================\r\n");
+    uart_sendline("[+] Request kfree 0x%x\r\n", ptr);
+    uart_sendline("==========================\r\n");
+    // If no chunk assigned, go for page
+    if ((unsigned long long)ptr % PAGESIZE == 0 && frame_array[((unsigned long long)ptr - BUDDY_MEMORY_BASE) >> 12].chunk_order == CHUNK_NONE)
+    {
+        page_free(ptr);
+        return;
+    }
+    // go for chunk
+    chunk_free(ptr);
+}
+
+void memory_reserve(unsigned long long start, unsigned long long end)
+{
+    char input_buffer[1];
+    start -= start % PAGESIZE; // floor (align 0x1000)
+    end = end % PAGESIZE ? end + PAGESIZE - (end % PAGESIZE) : end; // ceiling (align 0x1000)
+
+    uart_sendline("Reserved Memory: ");
+    uart_sendline("start 0x%x ~ ", start);
+    uart_sendline("end 0x%x\r\n", end);
+    
+    // delete page from free list
+    for (int order = FRAME_IDX_FINAL; order >= 0; order--)
+    {
+        list_head_t* pos;
+        list_for_each(pos, &frame_freelist[order])
+        {
+            unsigned long long pagestart = ((frame_t*)pos)->idx * PAGESIZE + BUDDY_MEMORY_BASE;
+            unsigned long long pageend = pagestart + (PAGESIZE << order);
+
+            if (start <= pagestart && end >= pageend) // if page all in reserved memory -> delete it from freelist
+            {
+                ((frame_t*)pos)->used = FRAME_ALLOCATED;
+                uart_sendline("    [!] Reserved page in 0x%x - 0x%x\n", pagestart, pageend);
+                uart_sendline("        Before\n");
+                page_info();
+                list_del_entry(pos);
+                uart_sendline("        Remove usable block for reserved memory: order %d\r\n", order);
+                uart_sendline("        After\n");
+                page_info();
+            } else if (start >= pageend || end <= pagestart) // no intersection
+            {
+                continue;
+            } else // partial intersection, separate the page into smaller size.
+            {
+                list_del_entry(pos);
+                list_head_t* temppos = pos->prev;
+                // split current frame ptr and add it to free list
+                list_add(&release_redundant((frame_t*)pos)->listhead, &frame_freelist[order - 1]);// recursion reduant memory
+                pos = temppos;
+            }
+        }
+    }
+    cli_cmd_read(input_buffer);
+    page_info();
+}
+
+void print_allocated_pages_addr()
+{
+    struct list_head *tmp;
+    uart_sendline("\n------- BS free list -------\n");
+    for (int i = 0; i < FRAME_MAX_IDX; i++) {
+        uart_sendline("Order ");
+        if (i < 10) uart_sendline(" ");
+        uart_sendline("%d free list address: ",i);
+        list_for_each(tmp, &frame_freelist[i])
+        {
+            // uart_2hex(list_entry(tmp, struct frame_t, list)->idx);
+            struct frame* frame = tmp;//get_frame_from_list(tmp);
+            uart_2hex(frame->idx<<12);
+            //uart_sendline("%x", frame->idx);
+            uart_sendline(" ");
+        }
+        uart_sendline("\n");
+    }
+    uart_sendline("\n----------------------------\n");
+
+    //print_allocated_pages_index();
+    return;
+}
+
+void print_allocated_pages_index() {
+    uart_sendline("Currently allocated address:");
+    int allocated_count = 0;
+
+    for (int i = 0; i < MAX_PAGES; i++) {
+        if (frame_array[i].used == FRAME_ALLOCATED) {
+            uart_sendline(" %x ",i<<12);
+            //uart_2hex(i);
+            //uart_sendline(" ");
+            allocated_count++;
+        }
+    }
+
+    if (allocated_count == 0) {
+        uart_sendline(" No allocations currently.\n");
+    } else {
+        uart_sendline("\nTotal allocated blocks: %d blocks.\n",allocated_count);
+    }
+    
+    uart_sendline("----------------------------\n");
+}
+
+void print_allocated_chunks_addr() {
+    uart_sendline("\n------- Chunk List -------\n");
+    for (int i = CHUNK_IDX_0; i <= CHUNK_IDX_FINAL; i++) {
+        uart_sendline("Order %d (size: %d bytes) address: ", i, 32 << i);
+        struct list_head *tmp;
+        
+        // 遍歷指定 order 的 chunk 列表
+        list_for_each(tmp, &chunk_list[i]) {
+            struct list_head *chunk = tmp;
+            // 計算 chunk 的起始地址
+            unsigned long long chunk_address = (unsigned long long)chunk;
+            
+            uart_2hex(chunk_address);
+            uart_sendline(" ");
+        }
+        uart_sendline("\n");
+    }
+    uart_sendline("\n-------------------------\n");
+}
diff --git a/lab4/kernel/src/shell.c b/lab4/kernel/src/shell.c
new file mode 100644
index 000000000..432958c9d
--- /dev/null
+++ b/lab4/kernel/src/shell.c
@@ -0,0 +1,438 @@
+#include <stddef.h>
+#include "shell.h"
+#include "uart1.h"
+#include "mbox.h"
+#include "power.h"
+#include "cpio.h"
+#include "u_string.h"
+#include "dtb.h"
+#include "memory.h"
+#include "timer.h"
+#include "stdint.h"
+
+#define CLI_MAX_CMD 15
+#define USTACK_SIZE 0x10000
+
+extern char* dtb_ptr;
+extern void* CPIO_DEFAULT_START;
+
+struct CLI_CMDS cmd_list[CLI_MAX_CMD]=
+{
+    {.command = "cat", .help="concatenate files and print on the standard output"},
+    {.command = "dtb", .help="show device tree"},
+    {.command = "exec", .help="execute a command, replacing current image with a new image"},
+    {.command = "hello", .help="print Hello World!"},
+    {.command = "help", .help="print all available commands"},
+    {.command = "s_allocator", .help="simple allocator in heap session"},
+    {.command = "info", .help="get device information via mailbox"},
+    {.command = "ls", .help="list directory contents"},
+    {.command = "memory_tester", .help="memory testcase generator, allocate and free"},
+    {.command = "setTimeout", .help="setTimeout [MESSAGE] [SECONDS]"},
+    {.command = "set2sAlert", .help = "set core timer interrupt every 2 second"},
+    {.command = "kmalloc", .help = "allocate memory using buddy system and dynamic allocator"},
+    {.command = "kfree", .help = "free memory using buddy system and dynamic allocator"},
+    {.command = "set2sAlert", .help = "set core timer interrupt every 2 second"},
+    {.command = "reboot", .help = "reboot the device"}
+};
+
+void cli_cmd_clear(char* buffer, int length)
+{
+    for(int i=0; i<length; i++)
+    {
+        buffer[i] = '\0';
+    }
+};
+
+void cli_cmd_read(char* buffer)
+{
+    char c = '\0';
+    int idx = 0;
+    while (1)
+    {
+        if (idx >= CMD_MAX_LEN) break;
+        c = uart_async_getc();
+        if (c == '\n') break;
+
+        if (c == 127 && idx > 0)
+        {
+            uart_puts("\b \b");
+            idx--;
+            continue;
+        }
+        if (c == 127 && idx == 0) continue;
+        
+        buffer[idx++] = c;
+    }
+}
+
+void cli_cmd_exec(char* buffer)
+{
+    if (!buffer) return;
+
+    char* cmd = buffer;
+    char* argvs = str_SepbySpace(buffer);
+
+    if (strcmp(cmd, "cat") == 0) {
+        do_cmd_cat(argvs);
+    } else if (strcmp(cmd, "dtb") == 0){
+        do_cmd_dtb();
+    } else if (strcmp(cmd, "exec") == 0){
+        do_cmd_exec(argvs);
+    } else if (strcmp(cmd, "hello") == 0) {
+        do_cmd_hello();
+    } else if (strcmp(cmd, "help") == 0) {
+        do_cmd_help();
+    } else if (strcmp(cmd, "info") == 0) {
+        do_cmd_info();
+    } else if (strcmp(cmd, "s_allocator") == 0) {
+        do_cmd_s_allocator();
+    } else if (strcmp(cmd, "ls") == 0) {
+        do_cmd_ls(argvs);
+    } else if (strcmp(cmd, "memory_tester") == 0) {
+        do_cmd_memory_tester();
+    } else if (strcmp(cmd, "setTimeout") == 0) {
+        char* sec = str_SepbySpace(argvs);
+        do_cmd_setTimeout(argvs, sec);
+    } else if (strcmp(cmd, "set2sAlert") == 0)
+    {
+        do_cmd_set2sAlert();
+    } else if (strcmp(cmd, "kmalloc") == 0){
+        do_cmd_kmalloc(argvs);
+    } else if (strcmp(cmd, "kfree") == 0)
+    {
+        do_cmd_kfree(argvs);
+    
+    } else if (strcmp(cmd, "page_addr") == 0)
+    {
+        do_cmd_page_addr();
+    } else if (strcmp(cmd, "chunk_addr") == 0)
+    {
+        do_cmd_chunk_addr();
+    } else if (strcmp(cmd, "page_idx") == 0)
+    {
+        do_cmd_page_idx();
+    }else if (strcmp(cmd, "reboot") == 0)
+    {
+        do_cmd_reboot();
+    }
+    else{
+        uart_puts("Command not found! Type <help> for commands.\n\n");
+    }
+}
+
+void cli_print_banner() {
+    uart_puts("\r\n");
+    uart_puts("=======================================\r\n");
+    uart_puts("      Welcome to RPI Terminal!         \r\n");
+    uart_puts("=======================================\r\n");
+    uart_puts(" Type 'help' to see available commands \r\n");
+    uart_puts("=======================================\r\n");
+}
+
+
+void do_cmd_cat(char* filepath)
+{
+    char* c_filepath;
+    char* c_filedata;
+    unsigned int c_filesize;
+    struct cpio_newc_header *header_ptr = CPIO_DEFAULT_START;
+
+    while(header_ptr!=0)
+    {
+        int error = cpio_newc_parse_header(header_ptr, &c_filepath, &c_filesize, &c_filedata, &header_ptr);
+        //if parse header error
+        if(error)
+        {
+            uart_puts("cpio parse error");
+            break;
+        }
+
+        if(strcmp(c_filepath, filepath)==0)
+        {
+            uart_puts("%s", c_filedata);
+            break;
+        }
+
+        //if this is TRAILER!!! (last of file)
+        if(header_ptr==0) uart_puts("cat: %s: No such file or directory\n", filepath);
+    }
+}
+
+void do_cmd_dtb()
+{
+    traverse_device_tree(dtb_ptr, dtb_callback_show_tree);
+}
+
+void do_cmd_help() {
+    uart_puts("\r\nAvailable Commands:\r\n");
+    uart_puts("====================\r\n");
+
+    int max_cmd_length = 0;
+    for (int i = 0; i < CLI_MAX_CMD; i++) {
+        int cmd_length = strlen(cmd_list[i].command);
+        if (cmd_length > max_cmd_length) {
+            max_cmd_length = cmd_length;
+        }
+    }
+
+    for (int i = 0; i < CLI_MAX_CMD; i++) {
+        uart_puts(cmd_list[i].command);
+        
+        int current_length = strlen(cmd_list[i].command);
+        int spaces_to_add = max_cmd_length - current_length + 4;
+        for (int j = 0; j < spaces_to_add; j++) {
+            uart_puts(" ");
+        }
+        
+        uart_puts(": ");
+        uart_puts(cmd_list[i].help);
+        uart_puts("\r\n");
+    }
+}
+
+
+void do_cmd_exec(char* filepath)
+{
+    char* c_filepath;
+    char* c_filedata;
+    unsigned int c_filesize;
+    struct cpio_newc_header *header_ptr = CPIO_DEFAULT_START;
+
+    while(header_ptr!=0)
+    {
+        int error = cpio_newc_parse_header(header_ptr, &c_filepath, &c_filesize, &c_filedata, &header_ptr);
+        //if parse header error
+        if(error)
+        {
+            uart_puts("cpio parse error");
+            break;
+        }
+
+        if(strcmp(c_filepath, filepath)==0)
+        {
+            //exec c_filedata
+            char* ustack = s_allocator(USTACK_SIZE);
+            asm("msr elr_el1, %0\n\t"   // elr_el1: Set the address to return to: c_filedata
+                "msr spsr_el1, xzr\n\t" // enable interrupt (PSTATE.DAIF) -> spsr_el1[9:6]=4b0. In Basic#1 sample, EL1 interrupt is disabled.
+                "msr sp_el0, %1\n\t"    // user program stack pointer set to new stack.
+                "eret\n\t"              // Perform exception return. EL1 -> EL0
+                :: "r" (c_filedata),
+                   "r" (ustack+USTACK_SIZE));
+            s_free(ustack);
+            break;
+        }
+
+        //if this is TRAILER!!! (last of file)
+        if(header_ptr==0) uart_puts("cat: %s: No such file or directory\n", filepath);
+    }
+
+}
+
+void do_cmd_hello()
+{
+    uart_puts("Hello World!\r\n");
+}
+
+void do_cmd_info()
+{
+    // print hw revision
+    pt[0] = 8 * 4;
+    pt[1] = MBOX_REQUEST_PROCESS;
+    pt[2] = MBOX_TAG_GET_BOARD_REVISION;
+    pt[3] = 4;
+    pt[4] = MBOX_TAG_REQUEST_CODE;
+    pt[5] = 0;
+    pt[6] = 0;
+    pt[7] = MBOX_TAG_LAST_BYTE;
+
+    if (mbox_call(MBOX_TAGS_ARM_TO_VC, (unsigned int)((unsigned long)&pt)) ) {
+        uart_puts("Hardware Revision\t: ");
+        uart_2hex(pt[6]);
+        uart_2hex(pt[5]);
+        uart_puts("\r\n");
+    }
+    // print arm memory
+    pt[0] = 8 * 4;
+    pt[1] = MBOX_REQUEST_PROCESS;
+    pt[2] = MBOX_TAG_GET_ARM_MEMORY;
+    pt[3] = 8;
+    pt[4] = MBOX_TAG_REQUEST_CODE;
+    pt[5] = 0;
+    pt[6] = 0;
+    pt[7] = MBOX_TAG_LAST_BYTE;
+
+    if (mbox_call(MBOX_TAGS_ARM_TO_VC, (unsigned int)((unsigned long)&pt)) ) {
+        uart_puts("ARM Memory Base Address\t: ");
+        uart_2hex(pt[5]);
+        uart_puts("\r\n");
+        uart_puts("ARM Memory Size\t\t: ");
+        uart_2hex(pt[6]);
+        uart_puts("\r\n");
+    }
+}
+
+void do_cmd_s_allocator()
+{
+    //test malloc
+    char* test1 = s_allocator(0x18);
+    memcpy(test1,"test malloc1",sizeof("test malloc1"));
+    uart_puts("%s\n",test1);
+
+    char* test2 = s_allocator(0x20);
+    memcpy(test2,"test malloc2",sizeof("test malloc2"));
+    uart_puts("%s\n",test2);
+
+    char* test3 = s_allocator(0x28);
+    memcpy(test3,"test malloc3",sizeof("test malloc3"));
+    uart_puts("%s\n",test3);
+}
+
+void do_cmd_ls(char* workdir)
+{
+    char* c_filepath;
+    char* c_filedata;
+    unsigned int c_filesize;
+    struct cpio_newc_header *header_ptr = CPIO_DEFAULT_START;
+
+    while(header_ptr!=0)
+    {
+        int error = cpio_newc_parse_header(header_ptr, &c_filepath, &c_filesize, &c_filedata, &header_ptr);
+        //if parse header error
+        if(error)
+        {
+            uart_puts("cpio parse error");
+            break;
+        }
+
+        //if this is not TRAILER!!! (last of file)
+        if(header_ptr!=0) uart_puts("%s\n", c_filepath);
+    }
+}
+
+void do_cmd_memory_tester()
+{
+/*
+    char *p1 = kmalloc(0x820);
+    char *p2 = kmalloc(0x900);
+    char *p3 = kmalloc(0x2000);
+    char *p4 = kmalloc(0x3900);
+    kfree(p3);
+    kfree(p4);
+    kfree(p1);
+    kfree(p2);
+*/
+    char *a = kmalloc(0x10);
+    char *b = kmalloc(0x100);
+    char *c = kmalloc(0x1000);
+
+    kfree(a);
+    kfree(b);
+    kfree(c);
+
+    a = kmalloc(32);
+    char *aa = kmalloc(50);
+    b = kmalloc(64);
+    char *bb = kmalloc(64);
+    c = kmalloc(128);
+    char *cc = kmalloc(129);
+    char *d = kmalloc(256);
+    char *dd = kmalloc(256);
+    char *e = kmalloc(512);
+    char *ee = kmalloc(999);
+
+    char *f = kmalloc(0x2000);
+    char *ff = kmalloc(0x2000);
+    char *g = kmalloc(0x2000);
+    char *gg = kmalloc(0x2000);
+    char *h = kmalloc(0x2000);
+    char *hh = kmalloc(0x2000);
+
+    kfree(a);
+    kfree(aa);
+    kfree(b);
+    kfree(bb);
+    kfree(c);
+    kfree(cc);
+    kfree(dd);
+    kfree(d);
+    kfree(e);
+    kfree(ee);
+
+    kfree(f);
+    kfree(ff);
+    kfree(g);
+    kfree(gg);
+    kfree(h);
+    kfree(hh);
+}
+
+void do_cmd_setTimeout(char* msg, char* sec)
+{
+    add_timer(uart_sendline,atoi(sec),msg);
+}
+
+void do_cmd_set2sAlert()
+{
+    add_timer(timer_set2sAlert,2,"2sAlert");
+}
+
+void do_cmd_kmalloc(char* size) {
+    page_info();
+    uart_sendline("size (Bytes): ");
+    cli_cmd_read(size);
+    void* address = kmalloc((unsigned int)atoi(size));
+    uintptr_t address_int = (uintptr_t)address;
+    uart_sendline("address: 0x");
+    uart_2hex((unsigned int)address_int);
+    uart_sendline("\n");
+}
+
+void do_cmd_kfree(char* addr) {
+    uart_sendline("address: ");
+    cli_cmd_read(addr);
+    kfree((void*)str_to_hex(addr));
+    uart_sendline("\n");
+}
+// void do_cmd_buddy_system_alloc(char *size)
+// {
+//     uart_puts("size(KB): ");
+//     cli_cmd_read(size);
+//     unsigned long int address = buddy_system_alloc(atoi(size));
+//     uart_puts("address: 0x");
+//     uart_2hex(address);
+//     uart_puts("\n");
+// }
+
+// void do_cmd_buddy_system_free(char *index)
+// {
+//     uart_puts("index: ");
+//     cli_cmd_read(index);
+//     //uart_sendline("atoi :%d\n", hex2dec(index));
+//     buddy_system_free(atoi(index));
+//     uart_puts("\n");
+// }
+
+void do_cmd_page_addr()
+{
+    print_allocated_pages_addr();
+}
+
+void do_cmd_chunk_addr()
+{
+    print_allocated_chunks_addr();
+}
+
+void do_cmd_page_idx()
+{
+    print_allocated_pages_index();
+}
+
+void do_cmd_reboot()
+{
+    uart_puts("Reboot in 5 seconds ...\r\n\r\n");
+    volatile unsigned int* rst_addr = (unsigned int*)PM_RSTC;
+    *rst_addr = PM_PASSWORD | 0x20;
+    volatile unsigned int* wdg_addr = (unsigned int*)PM_WDOG;
+    *wdg_addr = PM_PASSWORD | 5;
+}
+
diff --git a/lab4/kernel/src/timer.c b/lab4/kernel/src/timer.c
new file mode 100644
index 000000000..930118af1
--- /dev/null
+++ b/lab4/kernel/src/timer.c
@@ -0,0 +1,134 @@
+#include "timer.h"
+#include "uart1.h"
+#include "memory.h"
+#include "u_string.h"
+
+#define STR(x) #x
+#define XSTR(s) STR(s)
+
+struct list_head* timer_event_list;  // first head has nothing, store timer_event_t after it 
+
+void timer_list_init(){
+    INIT_LIST_HEAD(timer_event_list);
+}
+
+void core_timer_enable(){
+    __asm__ __volatile__(
+        "mov x1, 1\n\t"
+        "msr cntp_ctl_el0, x1\n\t" // cntp_ctl_el0[0]: enable, Control register for the EL1 physical timer.
+                                   // cntp_tval_el0: Holds the timer value for the EL1 physical timer
+        "mov x2, 2\n\t"
+        "ldr x1, =" XSTR(CORE0_TIMER_IRQ_CTRL) "\n\t"
+        "str w2, [x1]\n\t"         // QA7_rev3.4.pdf: Core0 Timer IRQ allows Non-secure physical timer(nCNTPNSIRQ)
+    );
+}
+
+void core_timer_disable()
+{
+    __asm__ __volatile__(
+        "mov x2, 0\n\t"
+        "ldr x1, =" XSTR(CORE0_TIMER_IRQ_CTRL) "\n\t"
+        "str w2, [x1]\n\t"         // QA7_rev3.4.pdf: Mask all timer interrupt
+    );
+}
+
+void core_timer_handler(){
+    if (list_empty(timer_event_list))
+    {
+        set_core_timer_interrupt(10000); // disable timer interrupt (set a very big value)
+        return;
+    }
+    timer_event_callback((timer_event_t *)timer_event_list->next); // do callback and set new interrupt
+}
+
+void timer_event_callback(timer_event_t * timer_event){
+    list_del_entry((struct list_head*)timer_event); // delete the event in queue
+    s_free(timer_event->args);                        // free the event's space
+    s_free(timer_event);
+    ((void (*)(char*))timer_event-> callback)(timer_event->args);  // call the event
+
+    // set queue linked list to next time event if it exists
+    if(!list_empty(timer_event_list))
+    {
+        set_core_timer_interrupt_by_tick(((timer_event_t*)timer_event_list->next)->interrupt_time);
+    }
+    else
+    {
+        set_core_timer_interrupt(10000);  // disable timer interrupt (set a very big value)
+    }
+}
+
+void timer_set2sAlert(char* str)
+{
+    unsigned long long cntpct_el0;
+    __asm__ __volatile__("mrs %0, cntpct_el0\n\t": "=r"(cntpct_el0)); // tick auchor
+    unsigned long long cntfrq_el0;
+    __asm__ __volatile__("mrs %0, cntfrq_el0\n\t": "=r"(cntfrq_el0)); // tick frequency
+    uart_sendline("[Interrupt][el1_irq][%s] %d seconds after booting\n", str, cntpct_el0/cntfrq_el0);
+    add_timer(timer_set2sAlert,2,"2sAlert");
+}
+
+
+void add_timer(void *callback, unsigned long long timeout, char* args){
+    timer_event_t* the_timer_event = s_allocator(sizeof(timer_event_t)); // free by timer_event_callback
+    // store all the related information in timer_event
+    the_timer_event->args = s_allocator(strlen(args)+1);
+    strcpy(the_timer_event -> args,args);
+    the_timer_event->interrupt_time = get_tick_plus_s(timeout);
+    the_timer_event->callback = callback;
+    INIT_LIST_HEAD(&the_timer_event->listhead);
+
+    // add the timer_event into timer_event_list (sorted)
+    struct list_head* curr;
+    list_for_each(curr,timer_event_list)
+    {
+        if(((timer_event_t*)curr)->interrupt_time > the_timer_event->interrupt_time)
+        {
+            list_add(&the_timer_event->listhead,curr->prev);  // add this timer at the place just before the bigger one (sorted)
+            break;
+        }
+    }
+    // if the timer_event is the biggest, run this code block
+    if(list_is_head(curr,timer_event_list))
+    {
+        list_add_tail(&the_timer_event->listhead,timer_event_list);
+    }
+    // set interrupt to first event
+    set_core_timer_interrupt_by_tick(((timer_event_t*)timer_event_list->next)->interrupt_time);
+}
+
+// get cpu tick add some second
+unsigned long long get_tick_plus_s(unsigned long long second){
+    unsigned long long cntpct_el0=0;
+    __asm__ __volatile__("mrs %0, cntpct_el0\n\t": "=r"(cntpct_el0)); // tick auchor
+    unsigned long long cntfrq_el0=0;
+    __asm__ __volatile__("mrs %0, cntfrq_el0\n\t": "=r"(cntfrq_el0)); // tick frequency
+    return (cntpct_el0 + cntfrq_el0*second);
+}
+
+// set timer interrupt time to [expired_time] seconds after now (relatively)
+void set_core_timer_interrupt(unsigned long long expired_time){
+    __asm__ __volatile__(
+        "mrs x1, cntfrq_el0\n\t"    // cntfrq_el0 -> frequency of the timer
+        "mul x1, x1, %0\n\t"        // cntpct_el0 = cntfrq_el0 * seconds: relative timer to cntfrq_el0
+        "msr cntp_tval_el0, x1\n\t" // Set expired time to cntp_tval_el0, which stores time value of EL1 physical timer.
+    :"=r" (expired_time));
+}
+
+// directly set timer interrupt time to a cpu tick  (directly)
+void set_core_timer_interrupt_by_tick(unsigned long long tick){
+    __asm__ __volatile__(
+        "msr cntp_cval_el0, %0\n\t"  //cntp_cval_el0 -> absolute timer
+    :"=r" (tick));
+}
+
+// get timer pending queue size
+int timer_list_get_size(){
+    int r = 0;
+    struct list_head* curr;
+    list_for_each(curr,timer_event_list)
+    {
+        r++;
+    }
+    return r;
+}
diff --git a/lab4/kernel/src/u_string.c b/lab4/kernel/src/u_string.c
new file mode 100644
index 000000000..55b6a73b5
--- /dev/null
+++ b/lab4/kernel/src/u_string.c
@@ -0,0 +1,254 @@
+#include "u_string.h"
+#include <stddef.h>
+
+unsigned int vsprintf(char *dst, char* fmt, __builtin_va_list args)
+{
+    long int arg;
+    int len, sign, i;
+    char *p, *orig=dst, tmpstr[19];
+
+    // failsafes
+    if(dst==(void*)0 || fmt==(void*)0) {
+        return 0;
+    }
+
+    // main loop
+    arg = 0;
+    while(*fmt) {
+        if(dst-orig > VSPRINT_MAX_BUF_SIZE-0x10)
+        {
+            return -1;
+        }
+        // argument access
+        if(*fmt=='%') {
+            fmt++;
+            // literal %
+            if(*fmt=='%') {
+                goto put;
+            }
+            len=0;
+            // size modifier
+            while(*fmt>='0' && *fmt<='9') {
+                len *= 10;
+                len += *fmt-'0';
+                fmt++;
+            }
+            // skip long modifier
+            if(*fmt=='l') {
+                fmt++;
+            }
+            // character
+            if(*fmt=='c') {
+                arg = __builtin_va_arg(args, int);
+                *dst++ = (char)arg;
+                fmt++;
+                continue;
+            } else
+            // decimal number
+            if(*fmt=='d') {
+                arg = __builtin_va_arg(args, int);
+                // check input
+                sign=0;
+                if((int)arg<0) {
+                    arg*=-1;
+                    sign++;
+                }
+                if(arg>99999999999999999L) {
+                    arg=99999999999999999L;
+                }
+                // convert to string
+                i=18;
+                tmpstr[i]=0;
+                do {
+                    tmpstr[--i]='0'+(arg%10);
+                    arg/=10;
+                } while(arg!=0 && i>0);
+                if(sign) {
+                    tmpstr[--i]='-';
+                }
+                if(len>0 && len<18) {
+                    while(i>18-len) {
+                        tmpstr[--i]=' ';
+                    }
+                }
+                p=&tmpstr[i];
+                goto copystring;
+            } else
+            if(*fmt=='x') {
+                arg = __builtin_va_arg(args, long int);
+                i=16;
+                tmpstr[i]=0;
+                do {
+                    char n=arg & 0xf;
+                    tmpstr[--i]=n+(n>9?0x37:0x30);
+                    arg>>=4;
+                } while(arg!=0 && i>0);
+                if(len>0 && len<=16) {
+                    while(i>16-len) {
+                        tmpstr[--i]='0';
+                    }
+                }
+                p=&tmpstr[i];
+                goto copystring;
+            } else
+            if(*fmt=='s') {
+                p = __builtin_va_arg(args, char*);
+copystring:     if(p==(void*)0) {
+                    p="(null)";
+                }
+                while(*p) {
+                    *dst++ = *p++;
+                }
+            }
+        } else {
+put:        *dst++ = *fmt;
+        }
+        fmt++;
+    }
+    *dst=0;
+    return dst-orig;
+}
+
+unsigned int sprintf(char *dst, char* fmt, ...)
+{
+    __builtin_va_list args;
+    __builtin_va_start(args, fmt);
+    unsigned int r = vsprintf(dst,fmt,args);
+    __builtin_va_end(args);
+    return r;
+}
+
+unsigned long long strlen(const char *str)
+{
+    size_t count = 0;
+    while((unsigned char)*str++)count++;
+    return count;
+}
+
+int strcmp(const char* p1, const char* p2)
+{
+    const unsigned char *s1 = (const unsigned char*) p1;
+    const unsigned char *s2 = (const unsigned char*) p2;
+    unsigned char c1, c2;
+
+    do {
+        c1 = (unsigned char) *s1++;
+        c2 = (unsigned char) *s2++;
+        if ( c1 == '\0' ) return c1 - c2;
+    } while ( c1 == c2 );
+    return c1 - c2;
+}
+
+int strncmp (const char *s1, const char *s2, unsigned long long n)
+{
+    unsigned char c1 = '\0';
+    unsigned char c2 = '\0';
+    if (n >= 4)
+    {
+        size_t n4 = n >> 2;
+        do
+        {
+            c1 = (unsigned char) *s1++;
+            c2 = (unsigned char) *s2++;
+            if (c1 == '\0' || c1 != c2)
+                return c1 - c2;
+            c1 = (unsigned char) *s1++;
+            c2 = (unsigned char) *s2++;
+            if (c1 == '\0' || c1 != c2)
+                return c1 - c2;
+            c1 = (unsigned char) *s1++;
+            c2 = (unsigned char) *s2++;
+            if (c1 == '\0' || c1 != c2)
+                return c1 - c2;
+            c1 = (unsigned char) *s1++;
+            c2 = (unsigned char) *s2++;
+            if (c1 == '\0' || c1 != c2)
+                return c1 - c2;
+        } while (--n4 > 0);
+        n &= 3;
+    }
+    while (n > 0)
+    {
+        c1 = (unsigned char) *s1++;
+        c2 = (unsigned char) *s2++;
+        if (c1 == '\0' || c1 != c2)
+            return c1 - c2;
+        n--;
+    }
+    return c1 - c2;
+}
+
+char* memcpy(void *dest, const void *src, unsigned long long len)
+{
+    char *d = dest;
+    const char *s = src;
+    while (len--)
+        *d++ = *s++;
+    return dest;
+}
+
+char* strcpy (char *dest, const char *src)
+{
+    return memcpy (dest, src, strlen (src) + 1);
+}
+
+char* str_SepbySpace(char* head)
+{
+    char* end;
+    while(1){
+        if(*head == '\0')
+        {
+            end = head;
+            break;
+        }
+        if(*head == ' ')
+        {
+            *head = '\0';
+            end = head + 1;
+            break;
+        }
+        head++;
+    }
+    return end;
+}
+
+// A simple atoi() function
+int atoi(char* str)
+{
+    // Initialize result
+    int res = 0;
+
+    // Iterate through all characters
+    // of input string and update result
+    // take ASCII character of corresponding digit and
+    // subtract the code from '0' to get numerical
+    // value and multiply res by 10 to shuffle
+    // digits left to update running total
+    for (int i = 0; str[i] != '\0'; ++i)
+    {
+        if(str[i] > '9' || str[i] < '0')return res;
+        res = res * 10 + str[i] - '0';
+    }
+
+    // return result.
+    return res;
+}
+
+unsigned long str_to_hex(const char *str) {
+  unsigned long result = 0;
+  while (*str) {
+    char c = *str++;
+    int value = 0;
+    if (c >= '0' && c <= '9') {
+      value = c - '0';
+    } else if (c >= 'a' && c <= 'f') {
+      value = 10 + (c - 'a');
+    } else if (c >= 'A' && c <= 'F') {
+      value = 10 + (c - 'A');
+    } else {
+      return 0;
+    }
+    result = result * 16 + value;
+  }
+  return result;
+}
\ No newline at end of file
diff --git a/lab4/kernel/src/uart1.c b/lab4/kernel/src/uart1.c
new file mode 100644
index 000000000..3aa594883
--- /dev/null
+++ b/lab4/kernel/src/uart1.c
@@ -0,0 +1,169 @@
+#include "bcm2837/rpi_gpio.h"
+#include "bcm2837/rpi_uart1.h"
+#include "bcm2837/rpi_irq.h"
+#include "uart1.h"
+#include "exception.h"
+#include "u_string.h"
+
+//implement first in first out buffer with a read index and a write index
+char uart_tx_buffer[VSPRINT_MAX_BUF_SIZE]={};
+unsigned int uart_tx_buffer_widx = 0;  //write index
+unsigned int uart_tx_buffer_ridx = 0;  //read index
+char uart_rx_buffer[VSPRINT_MAX_BUF_SIZE]={};
+unsigned int uart_rx_buffer_widx = 0;
+unsigned int uart_rx_buffer_ridx = 0;
+
+void uart_init()
+{
+    register unsigned int r;
+
+    /* initialize UART */
+    *AUX_ENABLES     |= 1;       // enable UART1
+    *AUX_MU_CNTL_REG  = 0;       // disable TX/RX
+
+    /* configure UART */
+    *AUX_MU_IER_REG   = 0;       // disable interrupt
+    *AUX_MU_LCR_REG   = 3;       // 8 bit data size
+    *AUX_MU_MCR_REG   = 0;       // disable flow control
+    *AUX_MU_BAUD_REG  = 270;     // 115200 baud rate
+    *AUX_MU_IIR_REG   = 0xC6;    // disable FIFO
+
+    /* map UART1 to GPIO pins */
+    r = *GPFSEL1;
+    r &= ~(7<<12);               // clean gpio14
+    r |= 2<<12;                  // set gpio14 to alt5
+    r &= ~(7<<15);               // clean gpio15
+    r |= 2<<15;                  // set gpio15 to alt5
+    *GPFSEL1 = r;
+
+    /* enable pin 14, 15 - ref: Page 101 */
+    *GPPUD = 0;
+    r=150; while(r--) { asm volatile("nop"); }
+    *GPPUDCLK0 = (1<<14)|(1<<15);
+    r=150; while(r--) { asm volatile("nop"); }
+    *GPPUDCLK0 = 0;
+
+    *AUX_MU_CNTL_REG = 3;      // enable TX/RX
+}
+
+char uart_recv() {
+    char r;
+    while(!(*AUX_MU_LSR_REG & 0x01)){};
+    r = (char)(*AUX_MU_IO_REG);
+    uart_send(r);
+    if(r =='\r') {uart_send('\r');uart_send('\n');}
+    return r=='\r'?'\n':r;
+}
+
+void uart_send(char c) {
+    while(!(*AUX_MU_LSR_REG & 0x20)){};
+    *AUX_MU_IO_REG = c;
+}
+
+void uart_2hex(unsigned int d) {
+    unsigned int n;
+    int c;
+    for(c=28;c>=0;c-=4) {
+        n=(d>>c)&0xF;
+        n+=n>9?0x37:0x30;
+        uart_send(n);
+    }
+}
+
+int  uart_sendline(char* fmt, ...) {
+    __builtin_va_list args;
+    __builtin_va_start(args, fmt);
+    char buf[VSPRINT_MAX_BUF_SIZE];
+
+    char *str = (char*)buf;
+    int count = vsprintf(str,fmt,args);
+
+    while(*str) {
+        if(*str=='\n')
+            uart_send('\r');
+        uart_send(*str++);
+    }
+    __builtin_va_end(args);
+    return count;
+}
+
+
+// uart_async_getc read from buffer
+// uart_r_irq_handler write to buffer then output
+char uart_async_getc() {
+    *AUX_MU_IER_REG |=1; // enable read interrupt
+    // do while if buffer empty
+    while (uart_rx_buffer_ridx == uart_rx_buffer_widx) *AUX_MU_IER_REG |=1; // enable read interrupt
+    el1_interrupt_disable();
+    char r = uart_rx_buffer[uart_rx_buffer_ridx++];
+    if (uart_rx_buffer_ridx >= VSPRINT_MAX_BUF_SIZE) uart_rx_buffer_ridx = 0;
+    el1_interrupt_enable();
+    return r;
+}
+
+
+// uart_async_putc writes to buffer
+// uart_w_irq_handler read from buffer then output
+void uart_async_putc(char c) {
+    // if buffer full, wait for uart_w_irq_handler
+    while( (uart_tx_buffer_widx + 1) % VSPRINT_MAX_BUF_SIZE == uart_tx_buffer_ridx )  *AUX_MU_IER_REG |=2;  // enable write interrupt
+    el1_interrupt_disable();
+    uart_tx_buffer[uart_tx_buffer_widx++] = c;
+    if(uart_tx_buffer_widx >= VSPRINT_MAX_BUF_SIZE) uart_tx_buffer_widx=0;  // cycle pointer
+    el1_interrupt_enable();
+    *AUX_MU_IER_REG |=2;  // enable write interrupt
+}
+
+int  uart_puts(char* fmt, ...) {
+    __builtin_va_list args;
+    __builtin_va_start(args, fmt);
+    char buf[VSPRINT_MAX_BUF_SIZE];
+
+    char *str = (char*)buf;
+    int count = vsprintf(str,fmt,args);
+
+    while(*str) {
+        if(*str=='\n')
+            uart_async_putc('\r');
+        uart_async_putc(*str++);
+    }
+    __builtin_va_end(args);
+    return count;
+}
+
+
+// AUX_MU_IER_REG -> BCM2837-ARM-Peripherals.pdf - Pg.12
+void uart_interrupt_enable(){
+    *AUX_MU_IER_REG |=1;  // enable read interrupt
+    *AUX_MU_IER_REG |=2;  // enable write interrupt
+    *ENABLE_IRQS_1  |= 1 << 29;    // Pg.112
+}
+
+void uart_interrupt_disable(){
+    *AUX_MU_IER_REG &= ~(1);  // disable read interrupt
+    *AUX_MU_IER_REG &= ~(2);  // disable write interrupt
+}
+
+
+void uart_r_irq_handler(){
+    if((uart_rx_buffer_widx + 1) % VSPRINT_MAX_BUF_SIZE == uart_rx_buffer_ridx)
+    {
+        *AUX_MU_IER_REG &= ~(1);  // disable read interrupt
+        return;
+    }
+    uart_rx_buffer[uart_rx_buffer_widx++] = uart_recv();
+    if(uart_rx_buffer_widx>=VSPRINT_MAX_BUF_SIZE) uart_rx_buffer_widx=0;
+    *AUX_MU_IER_REG |=1;
+}
+
+void uart_w_irq_handler(){
+    if(uart_tx_buffer_ridx == uart_tx_buffer_widx)
+    {
+        *AUX_MU_IER_REG &= ~(2);  // disable write interrupt
+        return;  // buffer empty
+    }
+    uart_send(uart_tx_buffer[uart_tx_buffer_ridx++]);
+    if(uart_tx_buffer_ridx>=VSPRINT_MAX_BUF_SIZE) uart_tx_buffer_ridx=0;
+    *AUX_MU_IER_REG |=2;  // enable write interrupt
+}
+
diff --git a/lab4/toolbox/run_commands.sh b/lab4/toolbox/run_commands.sh
new file mode 100755
index 000000000..0e70df7a0
--- /dev/null
+++ b/lab4/toolbox/run_commands.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+echo "Sending image to bootloader..."
+sudo ./send_image_to_bootloader.py
+
+if [ $? -eq 0 ]; then
+    echo "Image sent successfully. Starting screen session..."
+    sudo screen /dev/ttyUSB0 115200
+else
+    echo "Failed to send image to bootloader."
+fi
diff --git a/lab4/toolbox/send_image_to_bootloader.py b/lab4/toolbox/send_image_to_bootloader.py
new file mode 100755
index 000000000..4438d1005
--- /dev/null
+++ b/lab4/toolbox/send_image_to_bootloader.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+
+from serial import Serial
+from pwn import *
+import argparse
+from sys import platform
+
+if platform == "linux" or platform == "linux2":
+    parser = argparse.ArgumentParser(description='NYCU OSDI kernel sender')
+    parser.add_argument('--filename', metavar='PATH', default='../kernel/kernel8.img', type=str, help='path to kernel8.img')
+    parser.add_argument('--device', metavar='TTY', default='/dev/ttyUSB0', type=str, help='path to UART device')
+    parser.add_argument('--baud', metavar='Hz', default=115200, type=int, help='baud rate')
+    args = parser.parse_args()
+
+    with open(args.filename, 'rb') as fd:
+        with Serial(args.device, args.baud) as ser:
+            kernel_raw = fd.read()
+            length = len(kernel_raw)
+
+            print("Kernel image size : ", hex(length))
+            # 将长度信息发送到接收端
+            for i in range(8):
+                ser.write(struct.pack('<Q', length)[i:i+1])
+                ser.flush()
+            time.sleep(0.5)
+
+            print("Start sending kernel image by uart1...")
+            # 读取文件并发送数据
+            fd.seek(0)  # 重新定位到文件的开头
+            sent_bytes = 0
+            while True:
+                chunk = fd.read(1024)  # 每次读取512字节
+                if not chunk:
+                    break
+                ser.write(chunk)
+                ser.flush()  # 确保每个块都被发送
+                sent_bytes += len(chunk)
+                print("{:>6}/{:>6} bytes sent".format(sent_bytes, length))
+                time.sleep(0.1)  # 给接收端处理时间
+
+            print("{:>6}/{:>6} bytes".format(length, length))
+            print("Transfer finished!")
+
+else:
+    parser = argparse.ArgumentParser(description='NYCU OSDI kernel sender')
+    parser.add_argument('--filename', metavar='PATH', default='kernel8.img', type=str, help='path to kernel8.img')
+    parser.add_argument('--device', metavar='COM',default='COM3', type=str,  help='COM# to UART device')
+    parser.add_argument('--baud', metavar='Hz',default=115200, type=int,  help='baud rate')
+    args = parser.parse_args()
+
+    with open(args.filename,'rb') as fd:
+        with Serial(args.device, args.baud) as ser:
+
+            kernel_raw = fd.read()
+            length = len(kernel_raw)
+
+            print("Kernel image size : ", hex(length))
+            for i in range(8):
+                ser.write(p64(length)[i:i+1])
+                ser.flush()
+
+            print("Start sending kernel image by uart1...")
+            for i in range(length):
+                # Use kernel_raw[i: i+1] is byte type. Instead of using kernel_raw[i] it will retrieve int type then cause error
+                ser.write(kernel_raw[i: i+1])
+                ser.flush()
+                if i % 100 == 0:
+                    print("{:>6}/{:>6} bytes".format(i, length))
+            print("{:>6}/{:>6} bytes".format(length, length))
+            print("Transfer finished!")
\ No newline at end of file
diff --git a/lab5/toolbox/run_commands.sh b/lab5/toolbox/run_commands.sh
new file mode 100755
index 000000000..0e70df7a0
--- /dev/null
+++ b/lab5/toolbox/run_commands.sh
@@ -0,0 +1,11 @@
+#!/bin/bash
+
+echo "Sending image to bootloader..."
+sudo ./send_image_to_bootloader.py
+
+if [ $? -eq 0 ]; then
+    echo "Image sent successfully. Starting screen session..."
+    sudo screen /dev/ttyUSB0 115200
+else
+    echo "Failed to send image to bootloader."
+fi
diff --git a/lab5/toolbox/send_image_to_bootloader.py b/lab5/toolbox/send_image_to_bootloader.py
new file mode 100755
index 000000000..4438d1005
--- /dev/null
+++ b/lab5/toolbox/send_image_to_bootloader.py
@@ -0,0 +1,70 @@
+#!/usr/bin/env python3
+
+from serial import Serial
+from pwn import *
+import argparse
+from sys import platform
+
+if platform == "linux" or platform == "linux2":
+    parser = argparse.ArgumentParser(description='NYCU OSDI kernel sender')
+    parser.add_argument('--filename', metavar='PATH', default='../kernel/kernel8.img', type=str, help='path to kernel8.img')
+    parser.add_argument('--device', metavar='TTY', default='/dev/ttyUSB0', type=str, help='path to UART device')
+    parser.add_argument('--baud', metavar='Hz', default=115200, type=int, help='baud rate')
+    args = parser.parse_args()
+
+    with open(args.filename, 'rb') as fd:
+        with Serial(args.device, args.baud) as ser:
+            kernel_raw = fd.read()
+            length = len(kernel_raw)
+
+            print("Kernel image size : ", hex(length))
+            # 将长度信息发送到接收端
+            for i in range(8):
+                ser.write(struct.pack('<Q', length)[i:i+1])
+                ser.flush()
+            time.sleep(0.5)
+
+            print("Start sending kernel image by uart1...")
+            # 读取文件并发送数据
+            fd.seek(0)  # 重新定位到文件的开头
+            sent_bytes = 0
+            while True:
+                chunk = fd.read(1024)  # 每次读取512字节
+                if not chunk:
+                    break
+                ser.write(chunk)
+                ser.flush()  # 确保每个块都被发送
+                sent_bytes += len(chunk)
+                print("{:>6}/{:>6} bytes sent".format(sent_bytes, length))
+                time.sleep(0.1)  # 给接收端处理时间
+
+            print("{:>6}/{:>6} bytes".format(length, length))
+            print("Transfer finished!")
+
+else:
+    parser = argparse.ArgumentParser(description='NYCU OSDI kernel sender')
+    parser.add_argument('--filename', metavar='PATH', default='kernel8.img', type=str, help='path to kernel8.img')
+    parser.add_argument('--device', metavar='COM',default='COM3', type=str,  help='COM# to UART device')
+    parser.add_argument('--baud', metavar='Hz',default=115200, type=int,  help='baud rate')
+    args = parser.parse_args()
+
+    with open(args.filename,'rb') as fd:
+        with Serial(args.device, args.baud) as ser:
+
+            kernel_raw = fd.read()
+            length = len(kernel_raw)
+
+            print("Kernel image size : ", hex(length))
+            for i in range(8):
+                ser.write(p64(length)[i:i+1])
+                ser.flush()
+
+            print("Start sending kernel image by uart1...")
+            for i in range(length):
+                # Use kernel_raw[i: i+1] is byte type. Instead of using kernel_raw[i] it will retrieve int type then cause error
+                ser.write(kernel_raw[i: i+1])
+                ser.flush()
+                if i % 100 == 0:
+                    print("{:>6}/{:>6} bytes".format(i, length))
+            print("{:>6}/{:>6} bytes".format(length, length))
+            print("Transfer finished!")
\ No newline at end of file