diff --git a/kernel/Cargo.lock b/kernel/Cargo.lock
index f741316..5bd1261 100644
--- a/kernel/Cargo.lock
+++ b/kernel/Cargo.lock
@@ -389,7 +389,7 @@ dependencies = [
 [[package]]
 name = "riscv"
 version = "0.3.0"
-source = "git+https://github.com/rcore-os/riscv#ac09fc675387998df9874349fd9794aced81185c"
+source = "git+https://github.com/rcore-os/riscv#26f9a05dc82c747f0ca5e01174abfae3aa6e82c1"
 dependencies = [
  "bare-metal 0.2.4 (registry+https://github.com/rust-lang/crates.io-index)",
  "bit_field 0.9.0 (registry+https://github.com/rust-lang/crates.io-index)",
diff --git a/kernel/Cargo.toml b/kernel/Cargo.toml
index c7fb172..651df03 100644
--- a/kernel/Cargo.toml
+++ b/kernel/Cargo.toml
@@ -23,7 +23,7 @@ no_mmu = []
 m_mode = ["no_mmu"]
 # Page table sv39 or sv48 (for riscv64)
 sv39 = []
-board_u540 = ["sv39"]
+board_u540 = ["sv39", "link_user"]
 # (for aarch64 RaspberryPi3)
 nographic = []
 board_raspi3 = ["bcm2837", "link_user"]
diff --git a/kernel/Makefile b/kernel/Makefile
index 219f91d..b8adb2d 100644
--- a/kernel/Makefile
+++ b/kernel/Makefile
@@ -22,7 +22,7 @@
 #         | raspi3              Only available on aarch64, run on Raspberry Pi 3 Model B/B+
 #   m_mode                      Only available on riscv32, build for M-Mode, without MMU
 
-arch ?= riscv32
+arch ?= riscv64
 board ?= none
 mode ?= debug
 LOG  ?= debug
@@ -31,9 +31,10 @@ smp  ?= 4
 m_mode ?=
 
 target := $(arch)
-kernel := target/$(target)/$(mode)/rcore
-kernel_img := target/$(target)/$(mode)/kernel.img
-bootimage := target/$(target)/bootimage.bin
+build_path := target/$(target)/$(mode)
+kernel := $(build_path)/rcore
+kernel_img := $(build_path)/kernel.img
+bootimage := $(build_path)/bootimage.bin
 bootloader_dir = ../bootloader
 bootloader := $(bootloader_dir)/target/$(target)/$(mode)/rcore-bootloader
 bbl_path := $(PWD)/../riscv-pk
@@ -260,6 +261,7 @@ kernel:
 	@echo Building $(arch) kernel
 ifeq ($(arch), x86_64)
 	@bootimage build $(build_args)
+	@mv target/x86_64/bootimage.bin $(bootimage)
 else ifeq ($(arch), riscv32)
 	@-patch -p0 -N -b \
 		$(shell rustc --print sysroot)/lib/rustlib/src/rust/src/libcore/sync/atomic.rs \
@@ -312,6 +314,13 @@ install: $(kernel_img)
 	@python3 ../tools/k210/kflash.py $(kernel_img) -b 600000
 endif
 
+ifeq ($(board), u540)
+.PHONY:
+install: $(kernel_img)
+	@$(objcopy) -S -O binary --change-addresses -0x80000000 $< $(build_path)/bin
+	@sudo sh ../tools/u540/mkimg.sh $(build_path)/bin $(build_path)/sd.img
+endif
+
 .PHONY:
 addr2line:
 	@python3 ../tools/addr2line.py $(prefix)addr2line $(arch)
diff --git a/kernel/src/arch/riscv32/memory.rs b/kernel/src/arch/riscv32/memory.rs
index 5266987..48e91d4 100644
--- a/kernel/src/arch/riscv32/memory.rs
+++ b/kernel/src/arch/riscv32/memory.rs
@@ -25,12 +25,9 @@ pub fn init(dtb: usize) {
     unsafe { sstatus::set_sum(); }  // Allow user memory access
     // initialize heap and Frame allocator
     init_frame_allocator();
-    info!("init_frame_allocator end");
     init_heap();
-    info!("init_heap end");
     // remap the kernel use 4K page
     remap_the_kernel(dtb);
-    info!("remap_the_kernel end");
 }
 
 pub fn init_other() {
@@ -52,6 +49,8 @@ fn init_frame_allocator() {
     let range = to_range((end as usize) - KERNEL_OFFSET + MEMORY_OFFSET + PAGE_SIZE, MEMORY_END);
     ba.insert(range);
 
+    info!("frame allocator: init end");
+
     /*
     * @param:
     *   start: start address
@@ -83,6 +82,7 @@ fn remap_the_kernel(dtb: usize) {
     unsafe { ms.activate(); }
     unsafe { SATP = ms.token(); }
     mem::forget(ms);
+    info!("remap kernel end");
 }
 
 // First core stores its SATP here.
diff --git a/kernel/src/arch/riscv32/mod.rs b/kernel/src/arch/riscv32/mod.rs
index c2d17a7..fba7361 100644
--- a/kernel/src/arch/riscv32/mod.rs
+++ b/kernel/src/arch/riscv32/mod.rs
@@ -15,7 +15,7 @@ pub extern fn rust_main(hartid: usize, dtb: usize, hart_mask: usize, functions:
 
     unsafe { cpu::set_cpu_id(hartid); }
 
-    if hartid != 0 {
+    if hartid != BOOT_HART_ID {
         while unsafe { !cpu::has_started(hartid) }  { }
         println!("Hello RISCV! in hart {}, dtb @ {:#x}, functions @ {:#x}", hartid, dtb, functions);
         others_main();
@@ -31,6 +31,8 @@ pub extern fn rust_main(hartid: usize, dtb: usize, hart_mask: usize, functions:
     interrupt::init();
     memory::init(dtb);
     timer::init();
+    // FIXME: init driver on u540
+    #[cfg(not(feature = "board_u540"))]
     crate::drivers::init(dtb);
     crate::process::init();
 
@@ -45,6 +47,10 @@ fn others_main() -> ! {
     crate::kmain();
 }
 
+#[cfg(not(feature = "board_u540"))]
+const BOOT_HART_ID: usize = 0;
+#[cfg(feature = "board_u540")]
+const BOOT_HART_ID: usize = 1;
 
 /// Constant & Macro for `trap.asm`
 #[cfg(feature = "m_mode")]
diff --git a/kernel/src/process/mod.rs b/kernel/src/process/mod.rs
index 72e94fa..08b8872 100644
--- a/kernel/src/process/mod.rs
+++ b/kernel/src/process/mod.rs
@@ -22,7 +22,7 @@ pub fn init() {
 
     crate::shell::run_user_shell();
 
-    info!("process init end");
+    info!("process: init end");
 }
 
 static PROCESSORS: [Processor; MAX_CPU_NUM] = [Processor::new(), Processor::new(), Processor::new(), Processor::new(), Processor::new(), Processor::new(), Processor::new(), Processor::new()];
diff --git a/kernel/src/trap.rs b/kernel/src/trap.rs
index 8b42121..6079eb5 100644
--- a/kernel/src/trap.rs
+++ b/kernel/src/trap.rs
@@ -18,10 +18,10 @@ pub fn timer() {
 
 pub fn error(tf: &TrapFrame) -> ! {
     error!("{:#x?}", tf);
-    let pid = processor().tid();
-    error!("On CPU{} Process {}", cpu::id(), pid);
+    let tid = processor().tid();
+    error!("On CPU{} Thread {}", cpu::id(), tid);
 
-    processor().manager().exit(pid, 0x100);
+    processor().manager().exit(tid, 0x100);
     processor().yield_now();
     unreachable!();
 }
diff --git a/riscv-pk b/riscv-pk
index e216edb..2829915 160000
--- a/riscv-pk
+++ b/riscv-pk
@@ -1 +1 @@
-Subproject commit e216edbf9898b5bdb5c3b2c1fe6c0df00c8a7ba9
+Subproject commit 2829915ea12fba2e5fd4db2879e23311043a55b4
diff --git a/tools/u540/mkimg.sh b/tools/u540/mkimg.sh
new file mode 100644
index 0000000..d06ce5a
--- /dev/null
+++ b/tools/u540/mkimg.sh
@@ -0,0 +1,56 @@
+#!/bin/bash
+# tested on Ubuntu 18.04 & macOS 10.14
+
+# To run on macOS, first:
+#   brew install gptfdisk
+
+set -e
+
+if [ "x$2" == "x" ]; then
+  echo Usage: $0 in out
+  exit 1
+fi
+
+# Parameters
+RAW=$1
+IMG=$2
+BS=512
+RAW_START=2048
+
+# Relevant partition type codes
+BBL=2E54B353-1271-4842-806F-E436D6AF6985
+FSBL=5B193300-FC78-40CD-8002-E86C45580B47
+
+if [[ `uname` == "Darwin" ]]; then
+  M=m
+  RAW_SIZE=`stat -f%z ${RAW}`
+  type sgdisk || { echo "Try: brew install gptfdisk"; exit 1; }
+else
+  M=M
+  RAW_SIZE=`du -b ${RAW} | cut -d "	" -f1`
+fi
+
+echo Input file is ${RAW_SIZE} bytes.
+
+RAW_BLOCKS=$(((${RAW_SIZE} + ${BS} - 1) / ${BS}))
+RAW_END=$((${RAW_START} + ${RAW_BLOCKS} - 1))
+
+echo Start=${RAW_START}
+echo Blocks=${RAW_BLOCKS}
+echo End=${RAW_END}
+
+echo Creating an image file...
+dd if=/dev/zero of=${IMG} bs=${BS} count=$((${RAW_END} + 128))
+
+echo Partitioning the image...
+sgdisk --clear \
+  --new=1:${RAW_START}:${RAW_END} \
+  --change-name=1:bootloader \
+  --typecode=1:${BBL} \
+  -p ${IMG}
+
+echo Writing bootloader into the image...
+dd if=${RAW} of=${IMG} conv=notrunc bs=${BS} seek=${RAW_START} count=${RAW_BLOCKS}
+
+echo Done.
+echo Use \"dd if=${IMG} of=/dev/XXX\" to write the image to a real SD card.