diff --git a/20bsp.cdf b/20bsp.cdf
index d666c73..a47b5bc 100644
--- a/20bsp.cdf
+++ b/20bsp.cdf
@@ -15,6 +15,7 @@ Bsp ft20004_km02 {
     ENDIAN      little
     MP_OPTIONS  SMP
     REQUIRES    INCLUDE_KERNEL      \
+				INCLUDE_LOADER      \
                 DRV_ARM_GEN_SYS_TIMER   \
                 DRV_ARM_GICV3    \
 				INCLUDE_IPFTPS	\
diff --git a/config.h b/config.h
index 6b6e7cf..1439bd2 100644
--- a/config.h
+++ b/config.h
@@ -292,6 +292,7 @@ extern "C" {
 
 #define INCLUDE_ISR_OBJECTS
 
+#define USER_APPL_INIT (loadUserApp())
 
 #ifdef __cplusplus
 }
diff --git a/sysLib.c b/sysLib.c
index 7de1864..8dc2123 100644
--- a/sysLib.c
+++ b/sysLib.c
@@ -408,7 +408,18 @@ LOCAL void armGenGetFreq(void)
     _WRS_ASM("MRC p15, 0, %0, c14, c0, 0" : "=r"(genTimerFreq));
 }
 #else
-__asm volatile UINT32 __inline__GetCntFreq(void){ !"r0" mrc p15, 0, r0, c14, c0, 0 }
+/* clang-format off */
+__asm volatile UINT32 __macro__GetCntFreq (void)
+{
+! "r0"
+   mrc p15, 0, r0, c14, c0, 0
+}
+
+LOCAL UINT32 __inline__GetCntFreq (void)
+{
+    return __macro__GetCntFreq();
+}
+/* clang-format on */
 
 LOCAL UINT32 armGenGetFreq(void)
 {
diff --git a/usrStubs.c b/usrStubs.c
index 11c9af3..dc0cb66 100644
--- a/usrStubs.c
+++ b/usrStubs.c
@@ -1,6 +1,10 @@
 #include <vxWorks.h>
 #include <vsbConfig.h>
 #include <stdio.h>
+#include <moduleLib.h>
+#include <usrLib.h>
+#include <cacheLib.h>
+#include <sysSymTbl.h>
 #include "config.h"
 #if defined(INCLUDE_IPFTPS)
 #include <ipcom_sysvar.h>
@@ -15,10 +19,40 @@ int usr_ipftps_authenticate_nopasswd(Ipftps_session *session, char *password)
 
 #endif
 
+int loadUserApp()
+{
+	SEGMENT_ID seg;
+	SYMBOL_DESC symDesc;
+	MODULE_ID module = ld(1, 0, "/tffs0/UserApp.out");
+	void (*appEntry)(void) = NULL;
+	
+	if (module != NULL) {
+		/* flush text segment */
+		seg = moduleSegFirst(module);
+		while (seg) {
+			if (seg->type == SEGMENT_TEXT) {
+				/* printf("flush: %p, size: 0x%x\r\n", seg->address, seg->size); */
+				cacheFlush(DATA_CACHE, seg->address, seg->size);
+			}
+			seg = moduleSegNext(seg);
+		}
+		memset(&symDesc, 0, sizeof symDesc);
+		symDesc.mask = SYM_FIND_BY_NAME;
+		symDesc.name = "AppEntry";
+		
+		if (symFind(sysSymTbl, &symDesc) == OK) {
+			appEntry = (void (*)(void))(symDesc.value);
+			printf("AppEntry: %p\r\n", appEntry);
+			appEntry();
+		}
+	}
+	return 0;
+}
+
 #if defined(__DCC__)
 void usrAppInit(void)
 {
-    printf("appInited\r\n");
+    loadUserApp();
 }
 #endif
 
diff --git a/vxbLfsLib.c b/vxbLfsLib.c
index 3274f86..63360d7 100644
--- a/vxbLfsLib.c
+++ b/vxbLfsLib.c
@@ -245,6 +245,7 @@ LOCAL int lfsFuncIoctl(LFS_FILE_DESC *pfd, int cmd, _Vx_ioctl_arg_t arg)
     int ret = OK;
     const char *name;
     DIR *dirp;
+    size_t offset;
     struct lfs_info info;
     lfsDrvCtrl *pDrvCtrl = pfd->ctrl;
 
@@ -282,6 +283,15 @@ LOCAL int lfsFuncIoctl(LFS_FILE_DESC *pfd, int cmd, _Vx_ioctl_arg_t arg)
         strncpy(dirp->dd_dirent.d_name, info.name, _PARM_NAME_MAX + 1);
         dirp->dd_dirent.d_name[_PARM_NAME_MAX - 1] = EOS;
         break;
+    case FIOSEEK:
+    	if (pfd->isDir) {
+    		errnoSet(EINVAL);
+    		ret = ERROR;
+    		break;
+    	}
+    	offset = (size_t)arg;
+    	lfs_file_seek(&pDrvCtrl->fsh, &pfd->u.file, offset, LFS_SEEK_SET);
+    	break;
     case FIOUNLINK:
         name = (const char *)arg;
         ret = lfs_remove(&pDrvCtrl->fsh, name);
@@ -290,8 +300,8 @@ LOCAL int lfsFuncIoctl(LFS_FILE_DESC *pfd, int cmd, _Vx_ioctl_arg_t arg)
         ret = OK;
         break;
     default:
-        printf("unsupport ioctl: %d\n", cmd);
-        errnoSet(EINVAL);
+        printf("lfs unsupport ioctl: %d\n", cmd);
+        errnoSet(ENOTSUP);
         ret = ERROR;
         break;
     }
@@ -355,7 +365,7 @@ LOCAL int lfsFlashProg(const struct lfs_config *cfg, lfs_block_t block, lfs_off_
     lfsDrvCtrl *pDrvCtrl = cfg->context;
     UINT8 *buffers[2];
 
-    buffers[0] = buffer;
+    buffers[0] = (void *)buffer;
     buffers[1] = NULL;
     pos = pDrvCtrl->flashOffset + block * cfg->block_size + off;