diff --git a/kernel/src/arch/mipsel/boot/trap.S b/kernel/src/arch/mipsel/boot/trap.S
index 04cf983..d232d33 100644
--- a/kernel/src/arch/mipsel/boot/trap.S
+++ b/kernel/src/arch/mipsel/boot/trap.S
@@ -92,8 +92,9 @@ trap_from_kernel:
 	mtc0 t1, $12     # cp0.status
 
 	# prepare to call rust_trap
+	ori a0, sp, 0             /* set argument (trapframe) */
 	jal rust_trap
-	addiu a0, sp, 16             /* set argument (trapframe) */
+	nop
 
 	.globl trap_return
 trap_return:
diff --git a/kernel/src/arch/mipsel/consts.rs b/kernel/src/arch/mipsel/consts.rs
index a008f2e..cf428ee 100644
--- a/kernel/src/arch/mipsel/consts.rs
+++ b/kernel/src/arch/mipsel/consts.rs
@@ -9,6 +9,6 @@ pub const MEMORY_OFFSET: usize = 0x8000_0000;
 
 pub const USER_STACK_OFFSET: usize = 0x80000000 - USER_STACK_SIZE;
 pub const USER_STACK_SIZE: usize = 0x10000;
-pub const USER32_STACK_OFFSET: usize = 0xC0000000 - USER_STACK_SIZE;
+pub const USER32_STACK_OFFSET: usize = 0x80000000 - USER_STACK_SIZE;
 
 pub const MAX_DTB_SIZE: usize = 0x2000;
diff --git a/kernel/src/arch/mipsel/context.rs b/kernel/src/arch/mipsel/context.rs
index 035969f..9227bef 100644
--- a/kernel/src/arch/mipsel/context.rs
+++ b/kernel/src/arch/mipsel/context.rs
@@ -174,6 +174,8 @@ impl Context {
     /// The stack pointer will be set to `kstack_top`.
     /// The SATP register will be set to `satp`.
     pub unsafe fn new_kernel_thread(entry: extern fn(usize) -> !, arg: usize, kstack_top: usize, satp: usize) -> Self {
+        trace!("New kernel thread @ {:x}, stack = {:x}", entry as usize, kstack_top);
+
         InitStack {
             context: ContextData::new(satp),
             tf: TrapFrame::new_kernel_thread(entry, arg, kstack_top),
@@ -186,6 +188,8 @@ impl Context {
     /// The stack pointer of user and kernel mode will be set to `ustack_top`, `kstack_top`.
     /// The SATP register will be set to `satp`.
     pub unsafe fn new_user_thread(entry_addr: usize, ustack_top: usize, kstack_top: usize, _is32: bool, satp: usize) -> Self {
+        trace!("New user thread @ {:x}, stack = {:x}", entry_addr, kstack_top);
+
         InitStack {
             context: ContextData::new(satp),
             tf: TrapFrame::new_user_thread(entry_addr, ustack_top),
diff --git a/kernel/src/arch/mipsel/interrupt.rs b/kernel/src/arch/mipsel/interrupt.rs
index 249fd94..09b2c44 100644
--- a/kernel/src/arch/mipsel/interrupt.rs
+++ b/kernel/src/arch/mipsel/interrupt.rs
@@ -61,7 +61,7 @@ pub unsafe fn restore(flags: usize) {
 #[no_mangle]
 pub extern fn rust_trap(tf: &mut TrapFrame) {
     use cp0::cause::{Exception as E};
-    trace!("Interrupt @ CPU{}: {:?} ", 0, tf.cause.cause());
+    trace!("Exception @ CPU{}: {:?} ", 0, tf.cause.cause());
     match tf.cause.cause() {
         E::Interrupt => interrupt_dispatcher(tf),
         E::Syscall => syscall(tf),
@@ -75,6 +75,7 @@ pub extern fn rust_trap(tf: &mut TrapFrame) {
 
 fn interrupt_dispatcher(tf: &mut TrapFrame) {
     let pint = tf.cause.pending_interrupt();
+    trace!("  Interrupt {:?} ", tf.cause.pending_interrupt());
     if (pint & 0b10000_00) != 0 {
         timer();
     } else if (pint & 0xb01111_00) != 0 {
@@ -116,9 +117,9 @@ fn try_process_drivers() -> bool {
 }
 
 fn ipi() {
-    /* do nothing */
     debug!("IPI");
-//    super::sbi::clear_ipi();
+    cp0::cause::reset_soft_int0();
+    cp0::cause::reset_soft_int1();
 }
 
 fn timer() {
diff --git a/kernel/src/arch/mipsel/timer.rs b/kernel/src/arch/mipsel/timer.rs
index 466c2d2..9659358 100644
--- a/kernel/src/arch/mipsel/timer.rs
+++ b/kernel/src/arch/mipsel/timer.rs
@@ -10,6 +10,7 @@ pub fn read_epoch() -> u64 {
 pub fn init() {
     // Enable supervisor timer interrupt
     cp0::status::enable_hard_int5();  // IP(7), timer interrupt
+    cp0::count::write_u32(0);
     set_next();
     info!("timer: init end");
 }
@@ -18,6 +19,7 @@ pub fn init() {
 pub fn set_next() {
     // 100Hz @ QEMU
     let timebase = 250000;
-    cp0::count::write_u32(0);
-    cp0::compare::write_u32(timebase);
+    cp0::compare::write_u32(
+        cp0::count::read_u32() + timebase
+    );
 }
diff --git a/kernel/src/fs/mod.rs b/kernel/src/fs/mod.rs
index 51e3298..1b772a9 100644
--- a/kernel/src/fs/mod.rs
+++ b/kernel/src/fs/mod.rs
@@ -58,14 +58,6 @@ lazy_static! {
             Arc::new(unsafe { device::MemBuf::new(_user_img_start, _user_img_end) })
         };
 
-        let device2 = {
-            extern {
-                fn _user_img_start();
-                fn _user_img_end();
-            }
-            Arc::new(unsafe { device::MemBuf::new(_user_img_start, _user_img_end) })
-        };
-
         let sfs = SimpleFileSystem::open(device).expect("failed to open SFS");
         sfs.root_inode()
     };