严格代码检查，修复大量错误，以及diskio.c ioctl参数大小导致的卡死问题

2025-03-23 17:35:56 +08:00
parent 749e24ddb7
commit 54b6bc9c24
139 changed files with 1317 additions and 1077 deletions
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -221,7 +221,8 @@
        "endian.h": "c",
        "ipc.h": "c",
        "stdarg.h": "c",
-        "ipcstat.h": "c"
+        "ipcstat.h": "c",
+        "fs_cli.h": "c"
    },
    "cortex-debug.showRTOS": false,
    "cortex-debug.variableUseNaturalFormat": true,
--- a/TODO.md
+++ b/TODO.md
@@ -27,6 +27,7 @@
 * [ ] posix sig支持
 * [ ] posix shm支持
 * [ ] posix sema支持
+* [ ] posix 信号支持
 * [ ] 几大组件稳定性测试
 * [ ] 内核代码review
 ### mid prio
--- a/armv7_8.cmake
+++ b/armv7_8.cmake
@@ -1,21 +1,22 @@
 message("========use armv7_8.cmake")

-set(CMAKE_C_FLAGS "-mcpu=${CONFIG_ARCH} -O0 -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb  -DMKRTOS \
-std=gnu11 -ffunction-sections -fdata-sections -fno-builtin -u=_printf_float \
+set(CMAKE_C_FLAGS "-mcpu=${CONFIG_ARCH} -Ofast -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb  -DMKRTOS \
+-std=gnu11 -ffunction-sections -fdata-sections -fno-builtin -u=_printf_float -Wall \
 -nostartfiles -nodefaultlibs -nostdlib -nostdinc \
-fno-stack-protector -Wl,--gc-section -D__ARM_ARCH_7M__ \
+-fno-stack-protector -Wno-unused-but-set-variable -Wno-unused-function -Wno-parentheses -Wno-volatile-register-var -Wno-unused-variable -Wno-maybe-uninitialized\
+-Wl,--gc-section -D__ARM_ARCH_7M__ -Werror \
 -include ${CMAKE_SOURCE_DIR}/build/autoconf.h \
 " CACHE STRING "" FORCE)

-set(CMAKE_CXX_FLAGS "-mcpu=${CONFIG_ARCH} -O0 -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb -DMKRTOS -std=c++11 \
-fmessage-length=0 -Xlinker --print-map -Wall -W -fno-stack-protector \ 
+set(CMAKE_CXX_FLAGS "-mcpu=${CONFIG_ARCH} -Ofast -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb -DMKRTOS -std=c++11 \
+-fmessage-length=0 -Xlinker --print-map -Wall -W -fno-stack-protector -Wall \ 
 -u=_printf_float  -D__ARM_ARCH_7M__  \
 -ffunction-sections -fdata-sections -fno-builtin -nostartfiles -nodefaultlibs -nostdlib -nostdinc -Xlinker \
 -include ${CMAKE_SOURCE_DIR}/build/autoconf.h \
 " CACHE STRING "" FORCE)

-set(CMAKE_ASM_FLAGS "-mcpu=${CONFIG_ARCH} -O0 -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb -DMKRTOS \
-u=_printf_float -std=gnu11 -ffunction-sections -fdata-sections -fno-builtin \
+set(CMAKE_ASM_FLAGS "-mcpu=${CONFIG_ARCH} -Ofast -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb -DMKRTOS \
+-u=_printf_float -std=gnu11 -ffunction-sections -fdata-sections -fno-builtin -Wall \
 -nostartfiles -nodefaultlibs -nostdlib -nostdinc -Xlinker  -fno-stack-protector  -D__ARM_ARCH_7M__ \
 -include ${CMAKE_SOURCE_DIR}/build/autoconf.h \
 " CACHE STRING "" FORCE)
--- a/mkrtos_bootstrap/CMakeLists.txt
+++ b/mkrtos_bootstrap/CMakeLists.txt
@@ -8,6 +8,7 @@ set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} \
 -Wno-unused-function \
 -Wno-unused-variable \
 -Wno-deprecated \
+-Wno-unused-but-set-variable \
 ")

 include_directories(${CMAKE_SOURCE_DIR}/)
--- a/mkrtos_bootstrap/bsp/STM32F2/system_stm32f2xx.c
+++ b/mkrtos_bootstrap/bsp/STM32F2/system_stm32f2xx.c
@@ -392,8 +392,6 @@ static void SetSysClock(void)

    /* Wait till the main PLL is used as system clock source */
    while ((RCC->CFGR & (uint32_t)RCC_CFGR_SWS ) != RCC_CFGR_SWS_PLL);
-    {
-    }
  }
  else
  { /* If HSE fails to start-up, the application will have wrong clock
--- a/mkrtos_knl/arch/cortex-m/CmBacktrace/cm_backtrace/cm_backtrace.c
+++ b/mkrtos_knl/arch/cortex-m/CmBacktrace/cm_backtrace/cm_backtrace.c
@@ -470,7 +470,7 @@ static void print_call_stack(uint32_t sp)

    if (cur_depth)
    {
-        cmb_println(print_info[PRINT_CALL_STACK_INFO], fw_name, CMB_ELF_FILE_EXTENSION_NAME, cur_depth * (8 + 1),
+        cmb_println(print_info[PRINT_CALL_STACK_INFO], kobject_get_name(&thread_get_current_task()->kobj), CMB_ELF_FILE_EXTENSION_NAME, cur_depth * (8 + 1),
                    call_stack_info);
    }
    else
--- a/mkrtos_knl/arch/cortex-m/stm32f2/arch.c
+++ b/mkrtos_knl/arch/cortex-m/stm32f2/arch.c
@@ -117,7 +117,7 @@ void arch_init(void)
    SCB->SHCSR |= SCB_SHCSR_BUSFAULTENA_Msk;
    ((uint8_t *)(0xE000E008))[0] |= 0x6;

-    cm_backtrace_init("CmBacktrace", HARDWARE_VERSION, SOFTWARE_VERSION);
+    cm_backtrace_init("mkrtos", HARDWARE_VERSION, SOFTWARE_VERSION);

    // RCC_ClocksTypeDef RCC_ClocksStatus;
    // RCC_GetClocksFreq(&RCC_ClocksStatus);
--- a/mkrtos_knl/inc/knl/printk.h
+++ b/mkrtos_knl/inc/knl/printk.h
@@ -25,6 +25,7 @@ void putc(int c);
 * @return int
 */
 int getc(void);
+void put_bytes(const uint8_t *data, size_t len);
 /**
 * @brief 打印内核信息
 *
--- a/mkrtos_knl/inc/knl/sleep.h
+++ b/mkrtos_knl/inc/knl/sleep.h
@@ -1,4 +1,4 @@
-#pragma
+#pragma once

 #include "thread.h"
 typedef struct thread_wait_entry
--- a/mkrtos_knl/inc/lib/xprintf.h
+++ b/mkrtos_knl/inc/lib/xprintf.h
@@ -11,7 +11,7 @@ extern "C"
 #endif
 #include "stdarg.h"
 #define XF_USE_OUTPUT 1 /* 1: Enable output functions */
-#define XF_CRLF 1       /* 1: Convert \n ==> \r\n in the output char */
+#define XF_CRLF 0       /* 1: Convert \n ==> \r\n in the output char */
 #define XF_USE_DUMP 0   /* 1: Enable put_dump function */
 #define XF_USE_LLI 0    /* 1: Enable long long integer in size prefix ll */
 #define XF_USE_FP 0     /* 1: Enable support for floating point in type e and f */
--- a/mkrtos_knl/knl/access.c
+++ b/mkrtos_knl/knl/access.c
@@ -15,7 +15,7 @@
 #include <util.h>
 /**
 * @brief 检测内存是否可访问
- *
+ * TODO: 需要检查动态申请的内存
 * @param tg_task 目标进程
 * @param addr 开始地址
 * @param size 大小
--- a/mkrtos_knl/knl/futex.c
+++ b/mkrtos_knl/knl/futex.c
@@ -518,7 +518,7 @@ static int futex_lock_pi(thread_t *cur_th, futex_t *fst, uint32_t *uaddr, uint32
        spinlock_set(&fst->kobj.lock, status);
        return -EACCES;
    }
-    if (*paddr = 0)
+    if ((*paddr) == 0)
    {
        *paddr = tid;
    }
--- a/mkrtos_knl/knl/log.c
+++ b/mkrtos_knl/knl/log.c
@@ -56,19 +56,10 @@ static void log_reg(void)
 INIT_KOBJ(log_reg);
 static msg_tag_t log_write_data(log_t *log, const char *data, int len)
 {
-    for (int i = 0; i < len && data[i]; i++)
-    {
-#if 1
-        if (data[i] == '\n')
-        {
-            putc('\r');
-        }
-#endif
-        putc(data[i]);
-    }
+    put_bytes((const uint8_t *)data, len);
    return msg_tag_init(0);
 }
-static int log_read_data(log_t *log, uint8_t *data, int len)
+static int log_read_data(log_t *log, uint8_t *data, int len, int flags)
 {
    for (int i = 0; i < len; i++)
    {
@@ -77,7 +68,7 @@ static int log_read_data(log_t *log, uint8_t *data, int len)

        if (c < 0 && i == 0)
        {
-            int ret = irq_sender_wait(&log->kobj, thread_get_current(), 0);
+            int ret = irq_sender_wait(&log->kobj, thread_get_current(), flags);
            if (ret < 0)
            {
                return ret;
@@ -108,7 +99,7 @@ log_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame
            break;
        case READ_DATA:
        {
-            int ret = log_read_data((log_t *)kobj, (uint8_t *)(&f->regs[1]), MIN(f->regs[1], WORD_BYTES * 3));
+            int ret = log_read_data((log_t *)kobj, (uint8_t *)(&f->regs[1]), MIN(f->regs[1], WORD_BYTES * 3), f->regs[2]);
            tag = msg_tag_init4(0, 0, 0, ret);
        }
        break;
--- a/mkrtos_knl/knl/map.c
+++ b/mkrtos_knl/knl/map.c
@@ -66,6 +66,7 @@ int obj_map_src_dst(obj_space_t *dst_space, obj_space_t *src_space,
    if (obj_space_lookup_kobj(dst_space, dst_inx))
    { //!< 已经存在则解除注释
        obj_unmap(dst_space, vpage_create3(0, 0, dst_inx), del_list);
+        printk("unmap:%d \n", dst_inx);
    }

    return obj_map(dst_space, dst_inx, obj_map_entry_kobj_get(entry_obj),
--- a/mkrtos_knl/knl/mm.c
+++ b/mkrtos_knl/knl/mm.c
@@ -191,7 +191,6 @@ void mem_free_align(mem_t *_this, void *f_mem)
 {
    struct mem_heap *mem;
    umword_t *real_mem;
-    int find = 0;

    umword_t status = spinlock_lock(&_this->lock);
    for (mem = _this->heap_start; mem != _this->heap_end; mem = mem->next)
@@ -199,7 +198,6 @@ void mem_free_align(mem_t *_this, void *f_mem)
        assert(mem->magic == MAGIC_NUM);
        if ((ptr_t)mem == (ptr_t)f_mem - MEM_HEAP_STRUCT_SIZE)
        {
-            find = 1;
            break;
        }
    }
--- a/mkrtos_knl/knl/mm/mpu/vma.c
+++ b/mkrtos_knl/knl/mm/mpu/vma.c
@@ -294,6 +294,7 @@ int task_vma_alloc(task_vma_t *task_vma, vma_addr_t vaddr, size_t size,
    int ret = 0;
    size_t mem_align_size;
    bool_t is_alloc_mem = FALSE;
+    mword_t status = -1;

    pt_task = container_of(
        container_of(task_vma, mm_space_t, mem_vma),
@@ -321,7 +322,7 @@ int task_vma_alloc(task_vma_t *task_vma, vma_addr_t vaddr, size_t size,
        ret = -EINVAL;
        goto err_end;
    }
-    mword_t status = task_vma_lock(task_vma);
+    status = task_vma_lock(task_vma);

    if (paddr == 0)
    {
@@ -410,7 +411,10 @@ err_end:
        mm_limit_free_align(pt_task->lim, (void *)vma_addr, mem_align_size);
    }
 end:
-    task_vma_unlock(task_vma, status);
+    if (status >= 0)
+    {
+        task_vma_unlock(task_vma, status);
+    }
    return ret;
 }
 /**
@@ -456,9 +460,6 @@ static int vma_idl_tree_eq_cmp_handler(const void *key, const void *data)
        return 1;
    }
 }
-static inline int task_vma_addr_check(vaddr_t addr, size_t size)
-{
-}
 static int task_vma_free_inner(task_vma_t *task_vma, vaddr_t vaddr, size_t size, bool_t is_free_mem)
 {
    addr_t vma_addr;
@@ -535,7 +536,7 @@ end:
        mpu_switch_to_task(pt_task);
    }
    task_vma_unlock(task_vma, status);
-    return 0;
+    return ret;
 }
 /**
 * @brief 释放申请的虚拟内存，并释放已经申请的物理内存
@@ -700,7 +701,7 @@ int task_vma_clean(task_vma_t *task_vma)
        .tree = &task_vma->alloc_tree,
    }; // 删除所有的节点
    ret = mln_rbtree_iterate(&task_vma->alloc_tree, rbtree_iterate_handler_delete, &params);
-    return 0;
+    return ret;
 }

 #if IS_ENABLED(CONFIG_MPU)
--- a/mkrtos_knl/knl/printk.c
+++ b/mkrtos_knl/knl/printk.c
@@ -39,6 +39,18 @@ void putc(int c)
 {
    uart_putc(uart_get_global(), c);
 }
+void put_bytes(const uint8_t *data, size_t len)
+{
+    umword_t state = 0;
+    state = spinlock_lock(&lock);
+
+    for (int i = 0; i < len; i++)
+    {
+        uart_putc(uart_get_global(), data[i]);
+    }
+
+    spinlock_set(&lock, state);
+}
 int getc(void)
 {
    return uart_getc(uart_get_global());
--- a/mkrtos_knl/knl/sema.c
+++ b/mkrtos_knl/knl/sema.c
@@ -48,7 +48,6 @@ void sema_up(sema_t *obj)
    thread_t *th = thread_get_current();

    ref_counter_inc(&obj->ref);
-again:
    status = spinlock_lock(&obj->lock);
    if (slist_is_empty(&obj->suspend_head))
    {
--- a/mkrtos_knl/knl/share_mem.c
+++ b/mkrtos_knl/knl/share_mem.c
@@ -453,7 +453,7 @@ static void share_mem_unmap_op(task_t *tk, share_mem_t *sm)
 }
 static void share_mem_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f)
 {
-    ssize_t ret;
+    ssize_t ret = 0;
    msg_tag_t tag = msg_tag_init4(0, 0, 0, -EINVAL);
    task_t *task = thread_get_current_task();
    share_mem_t *sm = container_of(kobj, share_mem_t, kobj);
--- a/mkrtos_knl/knl/task.c
+++ b/mkrtos_knl/knl/task.c
@@ -35,6 +35,7 @@ enum task_op_code
    TASK_OBJ_MAP,        //!< 进行映射操作
    TASK_OBJ_UNMAP,      //!< 进行解除映射操作
    TASK_ALLOC_RAM_BASE, //!< 分配task的基础内存
+    TASK_GET_RAM_INFO,   //!< 获取task的ram信息
    TASK_OBJ_VALID,      //!< 判断一个对象是否有效
    TASK_SET_PID,        //!< 设置task的pid
    TASK_GET_PID,        //!< 获取task的pid
@@ -120,10 +121,12 @@ static void task_unlock_2(spinlock_t *sp0, spinlock_t *sp1, int status0, int sta
        spinlock_set(sp1, status1);
        spinlock_set(sp0, status0);
    }
-    else
+    else if (sp0 > sp1)
    {
        spinlock_set(sp0, status0);
        spinlock_set(sp1, status1);
+    } else {
+        spinlock_set(sp0, status0);
    }
 }
 /**
@@ -155,7 +158,7 @@ static int task_lock_2(spinlock_t *sp0, spinlock_t *sp1, int *st0, int *st1)
        *st0 = status0;
        *st1 = status1;
    }
-    else
+    else if (sp0 > sp1)
    {
        status0 = spinlock_lock(sp1);
        if (status0 < 0)
@@ -170,6 +173,14 @@ static int task_lock_2(spinlock_t *sp0, spinlock_t *sp1, int *st0, int *st1)
        }
        *st0 = status1;
        *st1 = status0;
+    } else {
+        status0 = spinlock_lock(sp0);
+        if (status0 < 0)
+        {
+            return FALSE;
+        }
+        *st0 = status0;
+        *st1 = status0;
    }
    return TRUE;
 }
@@ -315,6 +326,19 @@ static void task_syscall_func(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t i
        spinlock_set(&tag_task->kobj.lock, status);
    }
    break;
+    case TASK_GET_RAM_INFO:
+    {
+        mword_t status = spinlock_lock(&tag_task->kobj.lock);
+        if (status < 0)
+        {
+            tag = msg_tag_init4(0, 0, 0, -EINVAL);
+            break;
+        }
+        mm_space_get_ram_block(&tag_task->mm_space, (void**)(&f->regs[1]), (size_t *)(&f->regs[2]));
+        spinlock_set(&tag_task->kobj.lock, status);
+        tag = msg_tag_init4(0, 0, 0, 0);
+    }
+    break;
 #endif
    case TASK_COPY_DATA: //!< 拷贝数据到task的内存区域
    {
@@ -371,7 +395,7 @@ static void task_syscall_func(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t i
        if (!source_kobj)
        {
            ret = -EINVAL;
-            goto copy_data_to_end;
+            goto copy_data_to_end2;
        }
        task_t *dst_task_obj = container_of(source_kobj, task_t, kobj);

@@ -381,11 +405,13 @@ static void task_syscall_func(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t i
            tag = msg_tag_init4(0, 0, 0, -EINVAL);
            break;
        }
+        #if 0/*TODO: 需要检查动态申请的内存*/
        if (!is_rw_access(tag_task, (void *)src_addr, copy_len, FALSE))
        {
            ret = -EPERM;
            goto copy_data_to_end;
        }
+        #endif
        if (!is_rw_access(dst_task_obj, (void *)dst_addr, copy_len, FALSE))
        {
            ret = -EPERM;
@@ -399,6 +425,7 @@ static void task_syscall_func(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t i

    copy_data_to_end:
        task_unlock_2(&tag_task->kobj.lock, &dst_task_obj->kobj.lock, st0, st1);
+    copy_data_to_end2:
        tag = msg_tag_init4(0, 0, 0, ret);
    }
    break;
@@ -524,6 +551,8 @@ static void task_release_stage1(kobject_t *kobj)
            pf_t *cur_pf = ((pf_t *)((char *)restore_th + CONFIG_THREAD_BLOCK_SIZE + 8)) - 1;
            cur_pf->regs[5] = (umword_t)(thread_get_bind_task(restore_th)->mm_space.mm_block);
            ref_counter_dec_and_release(&tk->ref_cn, &tk->kobj);
+        } else {
+            break;
        }
    }

--- a/mkrtos_knl/knl/thread.c
+++ b/mkrtos_knl/knl/thread.c
@@ -138,6 +138,7 @@ void thread_init(thread_t *th, ram_limit_t *lim, umword_t flags)
    ref_counter_inc(&th->ref);
    thread_arch_init(th, flags);

+    kobject_set_name(&th->kobj, kobject_get_name(&th->kobj));
    slist_init(&th->com->fast_ipc_node);
    stack_init(&th->com->fast_ipc_stack, &th->com->fast_ipc_stack_data,
               ARRARY_LEN(th->com->fast_ipc_stack_data),
@@ -470,176 +471,6 @@ thread_t *thread_create(ram_limit_t *ram, umword_t flags)
    printk("create thread 0x%x\n", th);
    return th;
 }
-#if 0
-/**
- * @brief 线程超时检查
- *
- * @param tick
- */
-void thread_timeout_check(ssize_t tick)
-{
-    thread_wait_entry_t *pos;
-    slist_head_t *head =
-        (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_send_queue);
-
-    slist_foreach_not_next(pos, head, node_timeout)
-    {
-        if (pos->th->status != THREAD_SUSPEND)
-        {
-            printk("%s:%d th_name:%s.\n", __func__, __LINE__, pos->th->kobj.dbg.name);
-        }
-        assert(pos->th->status == THREAD_SUSPEND);
-        thread_wait_entry_t *next = slist_next_entry(
-            pos, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_send_queue),
-            node_timeout);
-        if (pos->times > 0)
-        {
-            pos->times -= tick;
-            if (pos->times <= 0)
-            {
-                pos->th->ipc_status = THREAD_TIMEOUT;
-
-                slist_del(&pos->node_timeout);
-                if (slist_in_list(&pos->node))
-                {
-                    slist_del(&pos->node);
-                }
-                // printk("send timeout:0x%lx\n", pos->th);
-                thread_ready(pos->th, TRUE);
-            }
-        }
-        pos = next;
-    }
-
-    thread_wait_entry_t *pos2;
-    slist_foreach_not_next(
-        pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_recv_queue),
-        node)
-    {
-        assert(pos2->th->status == THREAD_SUSPEND);
-        thread_wait_entry_t *next = slist_next_entry(
-            pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_recv_queue),
-            node);
-
-        if (pos2->times > 0)
-        {
-            pos2->times -= tick;
-            if (pos2->times <= 0)
-            {
-                pos2->th->ipc_status = THREAD_TIMEOUT;
-                assert(slist_in_list(&pos2->node));
-                slist_del(&pos2->node);
-                // printk("recv timeout:0x%lx\n", pos2->th);
-                thread_ready(pos2->th, TRUE);
-            }
-        }
-        pos2 = next;
-    }
-}
-static void thread_timeout_del_form_send_queue(thread_t *th)
-{
-    thread_wait_entry_t *pos2;
-    assert(th->cpu == arch_get_current_cpu_id());
-
-    slist_foreach_not_next(
-        pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_send_queue),
-        node_timeout)
-    {
-        thread_wait_entry_t *next = slist_next_entry(
-            pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_send_queue),
-            node_timeout);
-
-        if (pos2->th == th)
-        {
-            slist_del(&pos2->node_timeout);
-            if (slist_in_list(&pos2->node))
-            {
-                slist_del(&pos2->node);
-            }
-            break;
-        }
-        pos2 = next;
-    }
-}
-#if IS_ENABLED(CONFIG_SMP)
-static int thread_timeout_del_form_send_queue_handler(ipi_msg_t *msg, bool_t *is_sched)
-{
-    thread_timeout_del_form_send_queue((void *)(msg->msg));
-    thread_ready((void *)(msg->msg), TRUE); //!< 直接唤醒接受者
-    return 0;
-}
-#endif
-void thread_timeout_del_from_send_queue_remote(thread_t *th)
-{
-#if IS_ENABLED(CONFIG_SMP)
-    if (th->cpu == arch_get_current_cpu_id())
-    {
-        thread_timeout_del_form_send_queue(th);
-        thread_ready(th, TRUE); //!< 直接唤醒接受者
-    }
-    else
-    {
-        thread_t *cur_th = thread_get_current();
-        cur_th->ipi_msg_node.msg = (umword_t)th;
-        cur_th->ipi_msg_node.cb = thread_timeout_del_form_send_queue_handler;
-        cpu_ipi_to_msg(1 << th->cpu, &cur_th->ipi_msg_node, IPI_CALL);
-    }
-#else
-    thread_timeout_del_form_send_queue(th);
-    thread_ready(th, TRUE); //!< 直接唤醒接受者
-#endif
-}
-static void thread_timeout_del_recv(thread_t *th)
-{
-    thread_wait_entry_t *pos2;
-    assert(th->cpu == arch_get_current_cpu_id());
-
-    slist_foreach_not_next(
-        pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_recv_queue),
-        node)
-    {
-        thread_wait_entry_t *next = slist_next_entry(
-            pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_recv_queue),
-            node);
-
-        if (pos2->th == th)
-        {
-            slist_del(&pos2->node);
-            break;
-        }
-        pos2 = next;
-    }
-}
-#if IS_ENABLED(CONFIG_SMP)
-static int thread_timeout_del_recv_remote_handler(ipi_msg_t *msg, bool_t *is_sched)
-{
-    thread_t *th = (void *)(msg->msg);
-    thread_timeout_del_recv(th);
-    thread_ready(th, TRUE); //!< 直接唤醒接受者
-    return 0;
-}
-#endif
-void thread_timeout_del_recv_remote(thread_t *th, bool_t is_sche)
-{
-#if IS_ENABLED(CONFIG_SMP)
-    if (th->cpu == arch_get_current_cpu_id())
-    {
-        thread_timeout_del_recv(th);
-        thread_ready(th, is_sche); //!< 直接唤醒接受者
-    }
-    else
-    {
-        thread_t *cur_th = thread_get_current();
-        cur_th->ipi_msg_node.msg = (umword_t)th;
-        cur_th->ipi_msg_node.cb = thread_timeout_del_recv_remote_handler;
-        cpu_ipi_to_msg(1 << th->cpu, &cur_th->ipi_msg_node, IPI_CALL);
-    }
-#else
-    thread_timeout_del_recv(th);
-    thread_ready(th, is_sche); //!< 直接唤醒接受者
-#endif
-}
-#endif

 static int ipc_dat_copy_raw(obj_space_t *dst_obj, obj_space_t *src_obj, ram_limit_t *lim,
                            ipc_msg_t *dst_ipc, ipc_msg_t *src_ipc, msg_tag_t tag, int is_reply)
@@ -1362,58 +1193,6 @@ msg_tag_t thread_do_ipc(kobject_t *kobj, entry_frame_t *f, umword_t user_id)
        return thread_fast_ipc_call(to_tk, f, user_id);
    }
    break;
-#if 0
-    case IPC_CALL:
-    {
-        msg_tag_t in_tag = msg_tag_init(f->regs[0]);
-        msg_tag_t recv_tag;
-        th_hd = f->regs[2];
-        ipc_timeout_t ipc_tm_out = ipc_timeout_create(f->regs[3]);
-
-        to_th->user_id = user_id;
-        ret = thread_ipc_call(to_th, in_tag, &recv_tag, ipc_tm_out, &f->regs[1],
-                              TRUE);
-        if (ret < 0)
-        {
-            return msg_tag_init4(0, 0, 0, ret);
-        }
-        return recv_tag;
-    }
-    case IPC_REPLY:
-    {
-        msg_tag_t in_tag = msg_tag_init(f->regs[0]);
-
-        ret = thread_ipc_reply(in_tag);
-        return msg_tag_init4(0, 0, 0, ret);
-    }
-    case IPC_RECV:
-    case IPC_WAIT:
-    {
-        msg_tag_t ret_msg;
-        ipc_timeout_t ipc_tm_out = ipc_timeout_create(f->regs[3]);
-        kobject_t *ipc_kobj = obj_space_lookup_kobj_cmp_type(
-            &cur_task->obj_space, f->regs[4], IPC_TYPE);
-
-        int ret = thread_ipc_recv(&ret_msg, ipc_tm_out, &f->regs[1],
-                                  (ipc_t *)ipc_kobj, NULL);
-        if (ret < 0)
-        {
-            return msg_tag_init4(0, 0, 0, ret);
-        }
-        return ret_msg;
-    }
-    case IPC_SEND:
-    {
-        msg_tag_t in_tag = msg_tag_init(f->regs[0]);
-        msg_tag_t recv_tag;
-        // th_hd = f->regs[2];
-        ipc_timeout_t ipc_tm_out = ipc_timeout_create(f->regs[3]);
-
-        to_th->user_id = user_id;
-        ret = thread_ipc_call(to_th, in_tag, NULL, ipc_tm_out, NULL, FALSE);
-        return msg_tag_init4(0, 0, 0, ret);
-    }
-#endif
    default:
        ret = -ENOSYS;
        break;
@@ -1611,6 +1390,7 @@ static void thread_syscall(kobject_t *kobj, syscall_prot_t sys_p,
                (tge_prio >= PRIO_MAX ? PRIO_MAX - 1 : tge_prio);
            thread_ready(tag_th, TRUE);
        }
+        goto run_thread_end;
 #endif
    run_thread_end:
        cpulock_set(status);
--- a/mkrtos_knl/knl/thread_knl.c
+++ b/mkrtos_knl/knl/thread_knl.c
@@ -48,8 +48,8 @@ static task_t knl_task;
 static thread_t *init_thread;
 static task_t *init_task;
 static thread_t *knl_thread[CONFIG_CPU];
-static slist_head_t del_task_head; //!<链表中是需要被删除的进程
-static slist_head_t del_thread_head;//!<链表中是需要被释放内存的线程
+static slist_head_t del_task_head;   //!< 链表中是需要被删除的进程
+static slist_head_t del_thread_head; //!< 链表中是需要被释放内存的线程
 static umword_t cpu_usage[CONFIG_CPU];
 static spinlock_t del_lock;
 static umword_t cpu_usage_last_tick_val[CONFIG_CPU];
@@ -63,19 +63,15 @@ static void knl_release_thread(void)
    if (slist_is_empty(&del_thread_head))
    {
        spinlock_set(&del_lock, status2);
-        return ;
+        return;
    }
    slist_foreach_not_next(pos, &del_thread_head, release_node)
    {
        thread_t *next = slist_next_entry(pos, &del_thread_head, release_node);
-        int ret;

        // printk("+++++release th:0x%x\n", pos);
-        ret = ref_counter_dec_and_release(&pos->ref, &pos->kobj);
-        // if (ret == 1)
-        // {
-            // printk("------release th:0x%x\n", pos);
-        // }
+        ref_counter_dec_and_release(&pos->ref, &pos->kobj);
+        // printk("------release th:0x%x\n", pos);
        slist_del(&pos->release_node);
        pos = next;
    }
@@ -90,7 +86,7 @@ static void knl_del_task(void)
    if (slist_is_empty(&del_task_head))
    {
        spinlock_set(&del_lock, status2);
-        return ;
+        return;
    }
    // 在这里删除进程
    slist_foreach_not_next(pos, &del_task_head, del_node)
@@ -305,7 +301,8 @@ bool_t task_knl_kill(thread_t *kill_thread, bool_t is_knl)
    task_t *task = container_of(kill_thread->task, task_t, kobj);
    if (!is_knl)
    {
-        printk("kill %s th:0x%x task:0x%x, pid:%d\n", kobject_get_name(&task->kobj), kill_thread, task, task->pid);
+        printk("kill task:0x%x-->%s th:0x%x-->%s, pid:%d\n", task, kobject_get_name(&task->kobj), kill_thread,
+               kobject_get_name(&kill_thread->kobj), task->pid);
        umword_t status2;

        status2 = spinlock_lock(&del_lock);
--- a/mkrtos_script/build_f2.sh
+++ b/mkrtos_script/build_f2.sh
@@ -1,7 +1,7 @@
 #!/bin/bash

-export TOOLCHAIN=/home/zhangzheng/toolchain/gcc-arm-10.3-2021.07-x86_64-arm-none-eabi/bin/
-export TOOLCHAIN_LIB=/home/zhangzheng/toolchain/gcc-arm-10.3-2021.07-x86_64-arm-none-eabi/lib/gcc/arm-none-eabi/10.3.1/thumb/v7-m/nofp
+export TOOLCHAIN=/home/zhangzheng/toolchain/arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi/bin/
+export TOOLCHAIN_LIB=/home/zhangzheng/toolchain/arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi/lib/gcc/arm-none-eabi/14.2.1/thumb/v7-m/nofp

 # export TOOLCHAIN=/Users/zhangzheng/gcc-arm-none-eabi-10.3-2021.10/bin/
 # export TOOLCHAIN_LIB=/Users/zhangzheng/gcc-arm-none-eabi-10.3-2021.10/lib/gcc/arm-none-eabi/10.3.1/thumb/v7-m/nofp
--- a/mkrtos_user/CMakeLists.txt
+++ b/mkrtos_user/CMakeLists.txt
@@ -6,6 +6,7 @@ if (${CONFIG_ARCH} STREQUAL "cortex-m3" OR
    ${CONFIG_ARCH} STREQUAL "cortex-m33"
    )
    # -n -pie -fpie -fpic -msingle-pic-base -mno-pic-data-is-text-relative
+    # -mlong-calls -mword-relocations
    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} \
    -fPIC -fPIE -n -pie -fpie -fpic -msingle-pic-base -mno-pic-data-is-text-relative \
   \
--- a/mkrtos_user/lib/cpio/cpiofs.c
+++ b/mkrtos_user/lib/cpio/cpiofs.c
@@ -98,8 +98,6 @@ int cpio_find_next(umword_t st, const char *pre_name,
 }
 int cpio_find_file(umword_t st, umword_t en, const char *name, umword_t *size, int *type, umword_t *addr)
 {
-    uint8_t rByte;
-    int32_t bk_inx;
    cpio_fs_t *file_info;
    uint32_t mode;

--- a/mkrtos_user/lib/fd/fd.c
+++ b/mkrtos_user/lib/fd/fd.c
@@ -99,7 +99,6 @@ void *file_desc_free(int fd)
 }
 void file_desc_recycle(pid_t pid)
 {
-    int free_cn = 0;

    u_mutex_lock(&fds_lock, 0, NULL);
    for (int i = 0; i < FILE_DESC_NR_OPEN; i++)
@@ -107,7 +106,7 @@ void file_desc_recycle(pid_t pid)
        if (file_desc[i].close != NULL && file_desc[i].pid == pid)
        {
            file_desc[i].close(i);
-            printf("free fd:%d.\n", i);
+            // printf("free fd:%d.\n", i);
        }
    }
    u_mutex_unlock(&fds_lock);
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_cfg_user.h
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_cfg_user.h
@@ -36,7 +36,7 @@
 *        使能后，可以在声明命令时，指定函数的签名，shell 会根据函数签名进行参数转换，
 *        而不是自动判断参数的类型，如果参数和函数签名不匹配，会停止执行命令
 */
-#define SHELL_USING_FUNC_SIGNATURE 1
+#define SHELL_USING_FUNC_SIGNATURE 0

 /**
 * @brief 支持数组参数
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_fs_ext.c
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_fs_ext.c
@@ -15,6 +15,8 @@
 #include <sys/time.h>
 #include <unistd.h>
 #include <fcntl.h>
+#include <time.h>
+#include <u_sleep.h>
 int ls(int argc, char *agrv[])
 {
    DIR *dir;
@@ -38,8 +40,8 @@ int ls(int argc, char *agrv[])
    {
        return -ENOMEM;
    }
-    ret = getcwd(path, PAGE_SIZE);
-    if (ret < 0)
+    path = getcwd(path, PAGE_SIZE);
+    if (path == NULL)
    {
        u_free(path);
        return ret;
@@ -83,7 +85,7 @@ int cp(int argc, char *argv[])
    // 检查参数数量
    if (argc != 3)
    {
-        fprintf(stderr, "用法: %s 源文件 目标文件\n", argv[0]);
+        fprintf(stderr, "example: %s /bin/a.bin /mnt/a.bin\n", argv[0]);
        return -1;
    }

@@ -91,7 +93,7 @@ int cp(int argc, char *argv[])
    source_fd = open(argv[1], O_RDONLY);
    if (source_fd == -1)
    {
-        perror("无法打开源文件");
+        perror("can not open src file.\n");
        return -1;
    }
    struct stat st = {0};
@@ -102,13 +104,13 @@ int cp(int argc, char *argv[])
    target_fd = open(argv[2], O_WRONLY | O_CREAT, 0644);
    if (target_fd == -1)
    {
-        perror("无法打开目标文件");
+        perror("can not open dest file.");
        close(source_fd);
        return -1;
    }
    if (ftruncate(target_fd, st.st_size) < 0)
    {
-        printf("设置文件大小错误\n");
+        printf("to set fiel size is error.\n");
        return -1;
    }

@@ -118,7 +120,7 @@ int cp(int argc, char *argv[])
        bytes_written = write(target_fd, buffer, bytes_read);
        if (bytes_written != bytes_read)
        {
-            perror("写入目标文件失败");
+            perror("write file is error.\n");
            close(source_fd);
            close(target_fd);
            return -1;
@@ -127,14 +129,14 @@ int cp(int argc, char *argv[])

    if (bytes_read == -1)
    {
-        perror("读取源文件失败");
+        perror("read src file is error.\n");
    }

    // 关闭文件
    close(source_fd);
    close(target_fd);

-    printf("文件复制成功！\n");
+    printf("cp file is success.\n");

    return 0;
 }
@@ -320,4 +322,14 @@ int shell_exit(int argc, char *argv[])
    exit(0);
    return 0;
 }
-SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), exit, exit, exit command);
+SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), exit, shell_exit, exit command);
+int shell_sleep(int argc, char *argv[])
+{
+    if (argc < 1)
+    {
+        return -1;
+    }
+    u_sleep_ms(1000 * atol(argv[1]));
+    return 0;
+}
+SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), sleep, shell_sleep, sleep command);
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.c
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.c
@@ -31,11 +31,15 @@
 #include "u_sleep.h"
 #include "u_sema.h"
 #include "u_task.h"
+#include <errno.h>
+#include <stdlib.h>
 static Shell shell;
 static ShellFs shellFs;
-static char shellBuffer[512];
+static char shellBuffer[1024];
 // static char shellPathBuffer[128] = "/";
-
+static struct termios old_settings;
+static struct termios new_settings;
+int script_sh_fd = STDIN_FILENO;
 /**
 * @brief 用户shell写
 *
@@ -45,7 +49,11 @@ static char shellBuffer[512];
 * @return unsigned short 写入实际长度
 */
 signed short userShellWrite(char *data, unsigned short len)
-{    return write(STDOUT_FILENO, data, len);
+{
+    // if (script_sh_fd == STDIN_FILENO)
+    {
+        return write(STDOUT_FILENO, data, len);
+    }
 }

 /**
@@ -60,7 +68,13 @@ signed short userShellRead(char *data, unsigned short len)
 {
    int rlen;

-    rlen = read(STDIN_FILENO, data, len);
+    rlen = read(script_sh_fd, data, len);
+    if (rlen <= 0)
+    {
+        if (errno != ENOTTY && errno != EAGAIN) {
+            exit(0);
+        }
+    }
    return rlen;
 }
 /**
@@ -95,31 +109,47 @@ size_t userShellListDir(char *path, char *buffer, size_t maxLen)
    closedir(dir);
    return 0;
 }
-static struct termios old_settings;
-static struct termios new_settings;

 void tty_set_raw_mode(void)
 {
-    new_settings = old_settings;
-    new_settings.c_lflag &= ~(ICANON | ECHO);   // 禁用规范模式和回显
-    new_settings.c_cc[VMIN] = 1;                // 读取的最小字符数
-    new_settings.c_cc[VTIME] = 0;               // 读取的超时时间（以10ms为单位）
-    tcsetattr(STDIN_FILENO, TCSANOW, &new_settings);
+    if (script_sh_fd == STDIN_FILENO)
+    {
+        new_settings = old_settings;
+        new_settings.c_lflag &= ~(ICANON | ECHO);   // 禁用规范模式和回显
+        new_settings.c_cc[VMIN] = 1;                // 读取的最小字符数
+        new_settings.c_cc[VTIME] = 0;               // 读取的超时时间（以10ms为单位）
+        tcsetattr(script_sh_fd, TCSANOW, &new_settings);
+    }
 }
 void tty_set_normal_mode(void)
 {
-    tcsetattr(STDIN_FILENO, TCSANOW, &old_settings);
+    if (script_sh_fd == STDIN_FILENO)
+    {
+        tcsetattr(script_sh_fd, TCSANOW, &old_settings);
+    }
 }
 /**
 * @brief 用户shell初始化
 *
 */
-void userShellInit(void)
+void userShellInit(int argc, char *args[])
 {
-    tcgetattr(STDIN_FILENO, &old_settings);
-    tty_set_raw_mode();
-    task_set_obj_name(TASK_THIS, TASK_THIS, "tk_shell");
-    task_set_obj_name(TASK_THIS, THREAD_MAIN, "th_shell");
+    if (argc > 1)
+    {
+        printf("run script:%s\n", args[1]);
+        script_sh_fd = open(args[1], O_RDWR, 0777);
+        if (script_sh_fd < 0)
+        {
+            script_sh_fd = STDIN_FILENO;
+        }
+    } else {
+        script_sh_fd = STDIN_FILENO;
+    }
+    if (script_sh_fd == STDIN_FILENO)
+    {
+        tcgetattr(script_sh_fd, &old_settings);
+        tty_set_raw_mode();
+    }
    // shellFs.getcwd = getcwd;
    // shellFs.chdir = chdir;
    // shellFs.listdir = userShellListDir;
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.h
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.h
@@ -16,5 +16,5 @@

 extern Shell shell;

-void userShellInit(void);
+void userShellInit(int argc, char *args[]);
 #endif
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_test.c
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_test.c
@@ -1,7 +1,7 @@
 #include "shell.h"
 #include "cons_cli.h"
 #include "u_sig.h"
-#include "cons_cli.h"
+#include "pm_cli.h"
 #include <stdlib.h>
 #include <stdio.h>
 #include <dirent.h>
@@ -41,18 +41,32 @@ SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN),
 int shell_float_test(int argc, char *argv[])
 {
    float a = 1.1, b = 1.2;
-     
+
    printf("%f\n", a + b);
    return 0;
 }
 SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), ftest, shell_float_test, ftest command);
 int shell_div0(int argc, char *argv[])
 {
-    int a=1,b=0;
-     
+    int a = 1, b = 0;
+
    *((char *)(0)) = 0;
-    printf("%d\n", a/b);
+    printf("%d\n", a / b);
    return 0;
 }
 SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), div0, shell_div0, div0 command);
+
+int shell_fapp(int argc, char *argv[])
+{
+    int ret;
+    if (argc < 2)
+    {
+        printf("example: fapp 2048\n");
+        return -1;
+    }
+    ret = pm_run_app(NULL, 0, 0x1 /*FIXME:*/, -1,
+                     NULL, atol(argv[1]), NULL, 0); //!< 创建一个dummy task
+    return ret;
+}
+SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), fapp, shell_fapp, fapp command);
 #endif
--- a/mkrtos_user/lib/letter-shell/src/shell.c
+++ b/mkrtos_user/lib/letter-shell/src/shell.c
@@ -18,6 +18,7 @@
 #include "u_sig.h"
 #include <termios.h>
 #include <unistd.h>
+#include <stdlib.h>
 #if SHELL_USING_CMD_EXPORT == 1
 /**
 * @brief 默认用户
@@ -1455,42 +1456,50 @@ void shellExec(Shell *shell)
        }
        else
        {
-            uint8_t params[96/*FIXME:数组溢出*/];
-            uint8_t envs[64/*FIXME:*/];
+            uint8_t params[96 /*FIXME:数组溢出*/];
+            uint8_t envs[64 /*FIXME:*/];
            int params_len = 0;
            int envs_len = 0;
-            int pid;
+            int pid = -1;
            bool_t bg_run = FALSE;
            int task_mem_blk = 0;

+
+            if (shell->parser.param[shell->parser.paramCount - 1][0] == '~')
+            {
+                // 指定启动的mem，参数少一个
+                task_mem_blk = atoi(&(shell->parser.param[shell->parser.paramCount - 1][1]));
+                shell->parser.paramCount--;
+            }
+            if (shell->parser.param[shell->parser.paramCount - 1][0] == '@')
+            {
+                // 指定启动的mem，参数少一个
+                pid = atoi(&(shell->parser.param[shell->parser.paramCount - 1][1]));
+                shell->parser.paramCount--;
+            }
+            if (strcmp(shell->parser.param[shell->parser.paramCount - 1], "&") == 0)
+            {
+                // 后台启动，参数少一个
+                shell->parser.param[shell->parser.paramCount - 1] = NULL;
+                shell->parser.paramCount--;
+                bg_run = TRUE;
+            }
            // 处理params
            for (int i = 1; i < shell->parser.paramCount; i++)
            {
                memcpy(&params[params_len], shell->parser.param[i], strlen(shell->parser.param[i]) + 1); // copy the string
                params_len += strlen(shell->parser.param[i]) + 1;
            }
-            if (shell->parser.param[shell->parser.paramCount - 1][0] == '~')
-            {
-                //指定启动的mem，参数少一个
-                task_mem_blk = atoi(&(shell->parser.param[shell->parser.paramCount - 1][1]));
-                shell->parser.paramCount--;
-            }
-            if (strcmp(shell->parser.param[shell->parser.paramCount - 1], "&") == 0)
-            {
-                //后台启动，参数少一个
-                shell->parser.param[shell->parser.paramCount - 1] = NULL;
-                shell->parser.paramCount--;
-                bg_run = TRUE;
-            }
            // 处理envs
            for (char **e = __environ; *e; e++)
            {
                memcpy(&envs[envs_len], *e, strlen(*e) + 1);
-                envs_len+= strlen(*e)+1;
+                envs_len += strlen(*e) + 1;
            }

            //!< 内建命令中未找到，则执行应用
-            pid = pm_run_app(shell->parser.param[0], task_mem_blk, params, params_len, envs, envs_len);
+            pid = pm_run_app(shell->parser.param[0], task_mem_blk, pid != -1 ? PM_USE_LOAD_TO_RAM : 0, /*pid*/ pid,
+                             params, params_len, envs, envs_len);
            if (pid < 0)
            {
                shellWriteString(shell, shellText[SHELL_TEXT_CMD_NOT_FOUND]);
@@ -1503,15 +1512,22 @@ void shellExec(Shell *shell)
                {
                    shell->parser.param[shell->parser.paramCount - 1] = NULL;
                    shell->parser.paramCount--;
-                    task_get_pid(TASK_THIS, &cur_pid);
+                    task_get_pid(TASK_THIS, (umword_t *)&cur_pid);
                    pm_sig_watch(pid, 0);
                    extern void tty_set_raw_mode(void);
                    extern void tty_set_normal_mode(void);
+                    extern int script_sh_fd;

                    tty_set_normal_mode();
-                    tcsetpgrp(STDIN_FILENO, pid);
+                    if (script_sh_fd == STDIN_FILENO)
+                    {
+                        tcsetpgrp(script_sh_fd, pid);
+                    }
                    pm_waitpid(pid, NULL);
-                    tcsetpgrp(STDIN_FILENO, cur_pid);
+                    if (script_sh_fd == STDIN_FILENO)
+                    {
+                        tcsetpgrp(script_sh_fd, cur_pid);
+                    }
                    tty_set_raw_mode();
                }
            }
--- a/mkrtos_user/lib/letter-shell/src/shell_cfg.h
+++ b/mkrtos_user/lib/letter-shell/src/shell_cfg.h
@@ -147,14 +147,14 @@
 *        开启后会默认定义一个`RETVAL`变量，会保存上一次命令执行的返回值，可以在随后的命令中进行调用
 *        如果命令的`SHELL_CMD_DISABLE_RETURN`标志被设置，则该命令不会更新`RETVAL`
 */
-#define     SHELL_KEEP_RETURN_VALUE     0
+#define     SHELL_KEEP_RETURN_VALUE     1
 #endif /** SHELL_KEEP_RETURN_VALUE */

 #ifndef SHELL_MAX_NUMBER
 /**
 * @brief 管理的最大shell数量
 */
-#define     SHELL_MAX_NUMBER            5
+#define     SHELL_MAX_NUMBER            2
 #endif /** SHELL_MAX_NUMBER */

 #ifndef SHELL_PRINT_BUFFER
--- a/mkrtos_user/lib/libc_backend/inc/syscall_backend.h
+++ b/mkrtos_user/lib/libc_backend/inc/syscall_backend.h
@@ -8,6 +8,7 @@
 #include <sys/socket.h>
 #include <sys/ipc.h>
 #include "sys/shm.h"
+#include <poll.h>
 // typedef int key_t;

 #define ARG_1_BE(ap, arg0, type0)       \
@@ -110,6 +111,10 @@ umword_t be_mmap(void *start,
 int be_fcntl(int fd, int cmd, void *arg);
 long be_chdir(const char *path);
 long be_ftruncate(int fd, off_t off);
+long be_poll(struct pollfd *fds, uint32_t n, int timeout);
+long be_fstat(int fd, void *_buf);
+long be_getcwd(char *path, size_t size);
+int be_access(const char *filename, int amode);
 // net api
 int be_accept(int s, struct sockaddr *addr, socklen_t *addrlen);
 int be_bind(int s, const struct sockaddr *name, socklen_t namelen);
--- a/mkrtos_user/lib/libc_backend/src/armv7_8m/mm_backend.c
+++ b/mkrtos_user/lib/libc_backend/src/armv7_8m/mm_backend.c
@@ -99,7 +99,7 @@ static int mm_page_free(int st, int nr)
 {
    app_info_t *info = app_info_get(app_start_addr);
    assert(info);
-    void *heap_addr = (void *)((umword_t)TASK_RAM_BASE() + info->i.heap_offset - info->i.data_offset);
+    // void *heap_addr = (void *)((umword_t)TASK_RAM_BASE() + info->i.heap_offset - info->i.data_offset);
    size_t max_page_nr = (info->i.heap_size) / PAGE_SIZE;

    if (st + nr >= max_page_nr)
--- a/mkrtos_user/lib/libc_backend/src/be_exit.c
+++ b/mkrtos_user/lib/libc_backend/src/be_exit.c
@@ -39,7 +39,7 @@ void be_exit(long exit_code)
    {
        if (old_ctid)
        {
-            be_futex(old_ctid, FUTEX_WAKE_CLEAR, 1, 0, 0, 0);
+            be_futex((uint32_t *)old_ctid, FUTEX_WAKE_CLEAR, 1, 0, 0, 0);
        }
        if (pthread_cnt_dec() == 1)
        {
--- a/mkrtos_user/lib/libc_backend/src/fd_map.c
+++ b/mkrtos_user/lib/libc_backend/src/fd_map.c
@@ -43,7 +43,6 @@ int fd_map_alloc(uint32_t svr_fd, uint32_t priv_fd, enum fd_type type)
 {
    int alloc_fd = 0;

-again_alloc:
    pthread_spin_lock(&fd_map.lock);
    if (fd_map.free_fd >= FD_MAP_TOTAL)
    {
@@ -142,6 +141,7 @@ int fd_map_update(int fd, fd_map_entry_t *new_entry)
    fd_map.row[row_inx]->entry[inx] = *new_entry;
    fd_map.row[row_inx]->entry[inx].flags = flags;
    pthread_spin_unlock(&fd_map.lock);
+    return 0;
 }
 /**
 * @brief 释放fd
--- a/mkrtos_user/lib/libc_backend/src/fs_backend.c
+++ b/mkrtos_user/lib/libc_backend/src/fs_backend.c
@@ -64,6 +64,18 @@ const char *fs_backend_cur_path(void)
 {
    return cur_path;
 }
+void fs_cons_lock(void)
+{
+    u_mutex_lock(&lock_cons, 0, NULL);
+}
+void fs_cons_unlock(void)
+{
+    u_mutex_unlock(&lock_cons);
+}
+void fs_cons_write_unlock(void *buf, size_t size)
+{
+    ulog_write_bytes(u_get_global_env()->log_hd, buf, size);
+}
 void fs_cons_write(void *buf, size_t size)
 {
    u_mutex_lock(&lock_cons, 0, NULL);
@@ -269,15 +281,16 @@ long be_readv(long fd, const struct iovec *iov, long iovcnt)
 long be_writev(long fd, const struct iovec *iov, long iovcnt)
 {
    long wlen = 0;
+    fd_map_entry_t u_fd;
+    int ret;
+
+    ret = fd_map_get(fd, &u_fd);
+    if (ret < 0)
+    {
+        return -EBADF;
+    }
    for (int i = 0; i < iovcnt; i++)
    {
-        fd_map_entry_t u_fd;
-        int ret = fd_map_get(fd, &u_fd);
-
-        if (ret < 0)
-        {
-            return -EBADF;
-        }
        switch (u_fd.type)
        {
        case FD_TTY:
@@ -500,7 +513,7 @@ long be_unlink(const char *path)
        *parent_last_path = '\0';
    }
    obj_handler_t hd;
-    int ret = ns_query(new_src_path, &hd, 0);
+    int ret = ns_query(new_src_path, &hd);

    if (ret < 0)
    {
@@ -509,7 +522,7 @@ long be_unlink(const char *path)
    *parent_last_path = '/';
    return fs_unlink(hd, ret == 0 ? new_src_path : parent_last_path);
 }
-long be_poll(struct pollfd *fds, nfds_t n, int timeout)
+long be_poll(struct pollfd *fds, uint32_t n, int timeout)
 {
    for (int i = 0; i < n; i++)
    {
@@ -521,7 +534,7 @@ long be_poll(struct pollfd *fds, nfds_t n, int timeout)
        /*FIXME:性能优化*/
        if (fds[0].events & POLLIN)
        {
-            char buf;
+            // char buf;
            int len;
            int ret;
            int time = 0;
--- a/mkrtos_user/lib/libc_backend/src/shm_backend.c
+++ b/mkrtos_user/lib/libc_backend/src/shm_backend.c
@@ -22,7 +22,7 @@ static int _be_shm_open_svr(const char *shm_name)
    // const char *cur_path = fs_backend_cur_path();

    // u_rel_path_to_abs(cur_path, shm_name, new_src_path);
-    if (ns_query_svr(shm_name, &shm_hd, 1) < 0)
+    if (ns_query_svr(shm_name, &shm_hd) < 0)
    {
        return -ENOENT;
    }
@@ -146,8 +146,6 @@ int be_shmdt(const void *addr)
 int be_shmctl(int id, int cmd, struct shmid_ds *buf)
 {
    fd_map_entry_t u_fd;
-    msg_tag_t tag;
-    umword_t shm_addr;
    int ret;
    
    ret = fd_map_free(id, &u_fd);
--- a/mkrtos_user/lib/libc_backend/src/sys_backend.c
+++ b/mkrtos_user/lib/libc_backend/src/sys_backend.c
@@ -74,7 +74,7 @@ int be_clone(int (*func)(void *), void *stack, int flags, void *args, pid_t *pti
    msg_tag_t tag;
    obj_handler_t th1_hd;
    struct pthread *ph;
-    struct start_args *st_args = args;
+    // struct start_args *st_args = args;

    ph = (struct pthread *)((char *)tls - sizeof(struct pthread));

@@ -144,7 +144,6 @@ end_free_mm:
 #if IS_ENABLED(CONFIG_MMU)
    u_vmam_free(VMA_PROT, msg_buf_addr, PAGE_SIZE);
 #endif
-end:
    handler_free_umap(th1_hd);
 end_ok:
    return ret;
--- a/mkrtos_user/lib/lwip/contrib/ports/mkrtos/sys_arch.c
+++ b/mkrtos_user/lib/lwip/contrib/ports/mkrtos/sys_arch.c
@@ -110,8 +110,8 @@ get_monotonic_time(struct timespec *ts)

 #if SYS_LIGHTWEIGHT_PROT
 static u_mutex_t lwprot_mutex;
-static umword_t lwprot_thread = (umword_t)0xDEAD;
-static int lwprot_count = 0;
+// static umword_t lwprot_thread = (umword_t)0xDEAD;
+// static int lwprot_count = 0;
 #endif /* SYS_LIGHTWEIGHT_PROT */

 #if !NO_SYS
--- a/mkrtos_user/lib/mlibc/crt/reloc.c
+++ b/mkrtos_user/lib/mlibc/crt/reloc.c
@@ -96,13 +96,13 @@ static mk_ldso_t ldso;
 static void so_parse(app_info_t *app)
 {
    // 遍历动态段
-    Elf32_Dyn *dyn = (char *)app + app->i.dyn_start;
+    Elf32_Dyn *dyn = (Elf32_Dyn *)((char *)app + app->i.dyn_start);

    for (int i = 0; i < dyn[i].d_tag != DT_NULL; i++)
    {
        if (dyn[i].d_tag == DT_SYMTAB)
        {
-            Elf32_Sym *symtab = (char *)app + dyn[i].d_un.d_val;
+            Elf32_Sym *symtab = (Elf32_Sym *)((char *)app + dyn[i].d_un.d_val);
            ldso.syms = symtab;
        }
        else if (dyn[i].d_tag == DT_STRTAB)
--- a/mkrtos_user/lib/mlibc/include/endian.h
+++ b/mkrtos_user/lib/mlibc/include/endian.h
@@ -31,12 +31,12 @@ static __inline uint16_t __bswap16(uint16_t __x)

 static __inline uint32_t __bswap32(uint32_t __x)
 {
-	return __x>>24 | __x>>8&0xff00 | __x<<8&0xff0000 | __x<<24;
+	return (__x>>24) | (__x>>8&0xff00) | (__x<<8&0xff0000) | __x<<24;
 }

 static __inline uint64_t __bswap64(uint64_t __x)
 {
-	return __bswap32(__x)+0ULL<<32 | __bswap32(__x>>32);
+	return ((__bswap32(__x)+0ULL)<<32) | __bswap32(__x>>32);
 }

 #if __BYTE_ORDER == __LITTLE_ENDIAN
--- a/mkrtos_user/lib/mlibc/include/stdio.h
+++ b/mkrtos_user/lib/mlibc/include/stdio.h
@@ -49,10 +49,10 @@ extern "C" {
 #define _IOLBF 1
 #define _IONBF 2

-#define BUFSIZ 64 //TODO: 1024
+#define BUFSIZ 128 //TODO: 1024
 #define FILENAME_MAX 128 //TODO:4096
-#define FOPEN_MAX 1000
-#define TMP_MAX 10000
+#define FOPEN_MAX 64 //1000
+#define TMP_MAX 64 //10000
 #define L_tmpnam 20

 typedef union _G_fpos64_t {
--- a/mkrtos_user/lib/mlibc/src/fcntl/fcntl.c
+++ b/mkrtos_user/lib/mlibc/src/fcntl/fcntl.c
@@ -38,14 +38,14 @@ int fcntl(int fd, int cmd, ...)
 	#ifdef NO_LITTLE_MODE
 		int ret = __syscall(SYS_fcntl, fd, F_DUPFD_CLOEXEC, arg);
 	#else
-		int ret = be_fcntl( fd, F_DUPFD_CLOEXEC, arg);
+		int ret = be_fcntl( fd, F_DUPFD_CLOEXEC, (void *)arg);
 	#endif
 		if (ret != -EINVAL) {
 			if (ret >= 0)
 	#ifdef NO_LITTLE_MODE
 				__syscall(SYS_fcntl, ret, F_SETFD, FD_CLOEXEC);
 	#else
-				be_fcntl(ret, F_SETFD, FD_CLOEXEC);
+				be_fcntl(ret, F_SETFD, (void *)FD_CLOEXEC);
 	#endif
 			return __syscall_ret(ret);
 		}
@@ -66,8 +66,8 @@ int fcntl(int fd, int cmd, ...)
 		ret = __syscall(SYS_fcntl, fd, F_DUPFD, arg);
 		if (ret >= 0) __syscall(SYS_fcntl, ret, F_SETFD, FD_CLOEXEC);
 	#else
-		ret = be_fcntl(fd, F_DUPFD, arg);
-		if (ret >= 0) be_fcntl(ret, F_SETFD, FD_CLOEXEC);
+		ret = be_fcntl(fd, F_DUPFD, (void *)arg);
+		if (ret >= 0) be_fcntl(ret, F_SETFD, (void *)FD_CLOEXEC);
 	#endif
 		return __syscall_ret(ret);
 	}
--- a/mkrtos_user/lib/mlibc/src/ipc/shmat.c
+++ b/mkrtos_user/lib/mlibc/src/ipc/shmat.c
@@ -21,6 +21,6 @@ void *shmat(int id, const void *addr, int flag)
 #else
 void *shmat(int id, const void *addr, int flag)
 {
-	return (void *)__syscall_ret(be_shmat(id, addr, flag));
+	return (void *)__syscall_ret((long)be_shmat(id, addr, flag));
 }
 #endif
--- a/mkrtos_user/lib/mlibc/src/network/socket.c
+++ b/mkrtos_user/lib/mlibc/src/network/socket.c
@@ -31,9 +31,9 @@ int socket(int domain, int type, int protocol)
 			__syscall(SYS_fcntl, s, F_SETFL, O_NONBLOCK);
 	#else
 	if (type & SOCK_CLOEXEC)
-			be_fcntl(s, F_SETFD, FD_CLOEXEC);
+			be_fcntl(s, F_SETFD, (void *)FD_CLOEXEC);
 		if (type & SOCK_NONBLOCK)
-			be_fcntl(s, F_SETFL, O_NONBLOCK);
+			be_fcntl(s, F_SETFL, (void *)O_NONBLOCK);
 	#endif
 	}
 	return __syscall_ret(s);
--- a/mkrtos_user/lib/sys/inc/u_factory.h
+++ b/mkrtos_user/lib/sys/inc/u_factory.h
@@ -1,4 +1,4 @@
-#pragma
+#pragma once

 #include "u_types.h"
 #include "u_prot.h"
--- a/mkrtos_user/lib/sys/inc/u_log.h
+++ b/mkrtos_user/lib/sys/inc/u_log.h
@@ -7,4 +7,4 @@

 void ulog_write_bytes(obj_handler_t obj_inx, const uint8_t *data, umword_t len);
 void ulog_write_str(obj_handler_t obj_inx, const char *str);
-int ulog_read_bytes(obj_handler_t obj_inx, uint8_t *data, umword_t len);
+int ulog_read_bytes(obj_handler_t obj_inx, uint8_t *data, umword_t len, int flags);
--- a/mkrtos_user/lib/sys/inc/u_task.h
+++ b/mkrtos_user/lib/sys/inc/u_task.h
@@ -15,6 +15,7 @@ msg_tag_t task_map(obj_handler_t dst_task, obj_handler_t src_obj, obj_handler_t
 msg_tag_t task_unmap(obj_handler_t task_han, vpage_t vpage);
 msg_tag_t task_alloc_ram_base(obj_handler_t task_han, umword_t size, addr_t *alloc_addr,
                              int mem_block, addr_t text_addr, size_t text_size);
+msg_tag_t task_alloc_get_ram_info(obj_handler_t task_han, addr_t *ram_addr, size_t *size);
 msg_tag_t task_copy_data(obj_handler_t task_obj, void *st_addr, umword_t size);
 msg_tag_t task_copy_data_to(obj_handler_t task_obj, obj_handler_t dst_task_obj, void *st_addr, void *dst_addr, umword_t size);
 msg_tag_t task_set_com_point(obj_handler_t task_obj, void *com_point_func,
--- a/mkrtos_user/lib/sys/inc/u_types.h
+++ b/mkrtos_user/lib/sys/inc/u_types.h
@@ -9,6 +9,7 @@
 typedef unsigned long umword_t;
 typedef long mword_t;
 typedef unsigned short uhmword_t;
+typedef short hmword_t;
 typedef umword_t ptr_t;
 typedef char bool_t;
 typedef unsigned long obj_addr_t;
--- a/mkrtos_user/lib/sys/src/u_log.c
+++ b/mkrtos_user/lib/sys/src/u_log.c
@@ -13,7 +13,7 @@ enum log_op
    SET_FLAGS
 };
 MK_SYSCALL
-static msg_tag_t ulog_read_bytes_raw(obj_handler_t obj_inx, umword_t data[5], int len)
+static msg_tag_t ulog_read_bytes_raw(obj_handler_t obj_inx, umword_t data[5], int len, int flags)
 {
    register volatile umword_t r0 asm(ARCH_REG_0);
    register volatile umword_t r1 asm(ARCH_REG_1);
@@ -24,7 +24,7 @@ static msg_tag_t ulog_read_bytes_raw(obj_handler_t obj_inx, umword_t data[5], in
    mk_syscall(syscall_prot_create(READ_DATA, LOG_PROT, obj_inx).raw,
               msg_tag_init4(0, 0, 0, 0).raw,
               len,
-               0,
+               flags,
               0,
               0,
               0);
@@ -44,11 +44,11 @@ static msg_tag_t ulog_read_bytes_raw(obj_handler_t obj_inx, umword_t data[5], in
    return tag;
 }
 MK_SYSCALL
-int ulog_read_bytes(obj_handler_t obj_inx, uint8_t *data, umword_t len)
+int ulog_read_bytes(obj_handler_t obj_inx, uint8_t *data, umword_t len, int flags)
 {
    umword_t buffer[5];

-    msg_tag_t tag = ulog_read_bytes_raw(obj_inx, buffer, len);
+    msg_tag_t tag = ulog_read_bytes_raw(obj_inx, buffer, len, flags);

    if (msg_tag_get_val(tag) > 0)
    {
--- a/mkrtos_user/lib/sys/src/u_task.c
+++ b/mkrtos_user/lib/sys/src/u_task.c
@@ -8,6 +8,7 @@ enum task_op_code
    TASK_OBJ_MAP,
    TASK_OBJ_UNMAP,
    TASK_ALLOC_RAM_BASE,
+    TASK_GET_RAM_INFO,   //!< 获取task的ram信息
    TASK_OBJ_VALID,
    TASK_SET_PID,
    TASK_GET_PID,
@@ -168,6 +169,35 @@ msg_tag_t task_alloc_ram_base(obj_handler_t task_han, umword_t size, addr_t *all
    return msg_tag_init(r0);
 }
 MK_SYSCALL
+msg_tag_t task_alloc_get_ram_info(obj_handler_t task_han, addr_t *ram_addr, size_t *size)
+{
+    register volatile umword_t r0 asm(ARCH_REG_0);
+    register volatile umword_t r1 asm(ARCH_REG_1);
+    register volatile umword_t r2 asm(ARCH_REG_2);
+
+    mk_syscall(syscall_prot_create(TASK_GET_RAM_INFO, TASK_PROT, task_han).raw,
+               0,
+               0,
+               0,
+               0,
+               0,
+               0);
+    asm __volatile__(""
+                     :
+                     :
+                     : ARCH_REG_0, ARCH_REG_1);
+    if (ram_addr)
+    {
+        *ram_addr = r1;
+    }
+    if (size)
+    {
+        *size = r2;
+    }
+
+    return msg_tag_init(r0);
+}
+MK_SYSCALL
 msg_tag_t task_copy_data(obj_handler_t task_obj, void *st_addr, umword_t size)
 {
    register volatile umword_t r0 asm(ARCH_REG_0);
--- a/mkrtos_user/lib/sys/src/u_thread.c
+++ b/mkrtos_user/lib/sys/src/u_thread.c
@@ -24,78 +24,6 @@ enum IPC_TYPE
    IPC_FAST_CALL, //!< 快速CALL通信，不切换上下文
    IPC_FAST_REPLAY,
 };
-#if 0
-
-msg_tag_t thread_ipc_wait(ipc_timeout_t timeout, umword_t *obj, obj_handler_t ipc_obj)
-{
-    register volatile umword_t r0 asm(ARCH_REG_0);
-    register volatile umword_t r1 asm(ARCH_REG_1);
-    mk_syscall(syscall_prot_create4(DO_IPC, THREAD_PROT, -1, TRUE).raw,
-               0,
-               IPC_WAIT,
-               0,
-               timeout.raw,
-               ipc_obj,
-               0);
-    asm __volatile__(""
-                     :
-                     :
-                     : ARCH_REG_0, ARCH_REG_1);
-    if (obj)
-    {
-        *obj = r1;
-    }
-    return msg_tag_init(r0);
-}
-msg_tag_t thread_ipc_reply(msg_tag_t in_tag, ipc_timeout_t timeout)
-{
-    register volatile umword_t r0 asm(ARCH_REG_0);
-    mk_syscall(syscall_prot_create4(DO_IPC, THREAD_PROT, -1, TRUE).raw,
-               in_tag.raw,
-               IPC_REPLY,
-               0,
-               timeout.raw,
-               0,
-               0);
-    asm __volatile__(""
-                     :
-                     :
-                     : ARCH_REG_0);
-    return msg_tag_init(r0);
-}
-msg_tag_t thread_ipc_send(msg_tag_t in_tag, obj_handler_t target_th_obj, ipc_timeout_t timeout)
-{
-    register volatile umword_t r0 asm(ARCH_REG_0);
-    mk_syscall(syscall_prot_create4(DO_IPC, THREAD_PROT, target_th_obj, TRUE).raw,
-               in_tag.raw,
-               IPC_SEND,
-               0,
-               timeout.raw,
-               0,
-               0);
-    asm __volatile__(""
-                     :
-                     :
-                     : ARCH_REG_0);
-    return msg_tag_init(r0);
-}
-msg_tag_t thread_ipc_call(msg_tag_t in_tag, obj_handler_t target_th_obj, ipc_timeout_t timeout)
-{
-    register volatile umword_t r0 asm(ARCH_REG_0);
-    mk_syscall(syscall_prot_create4(DO_IPC, THREAD_PROT, target_th_obj, TRUE).raw,
-               in_tag.raw,
-               IPC_CALL,
-               0,
-               timeout.raw,
-               0,
-               0);
-    asm __volatile__(""
-                     :
-                     :
-                     : ARCH_REG_0);
-    return msg_tag_init(r0);
-}
-#endif
 MK_SYSCALL
 msg_tag_t thread_sleep(umword_t ticks)
 {
@@ -111,6 +39,7 @@ msg_tag_t thread_sleep(umword_t ticks)
                     :
                     :
                     : ARCH_REG_0);
+    return msg_tag_init(r0);
 }
 MK_SYSCALL
 msg_tag_t thread_ipc_fast_call(msg_tag_t in_tag, obj_handler_t target_obj, umword_t arg0, umword_t arg1, umword_t arg2)
--- a/mkrtos_user/lib/sys_svr/inc/fs_cli.h
+++ b/mkrtos_user/lib/sys_svr/inc/fs_cli.h
@@ -5,14 +5,18 @@
 #include <poll.h>
 #include <u_types.h>
 #include <u_rpc.h>
+int fs_open_raw(obj_handler_t fs_hd, const char *path, int flags, int mode);
 sd_t fs_open(const char *path, int flags, int mode);
+int fs_close_raw(obj_handler_t hd, int fd);
 int fs_close(sd_t _fd);
+int fs_read_raw(obj_handler_t hd, int fd, void *buf, size_t len);
 int fs_read(sd_t _fd, void *buf, size_t len);
 int fs_write(sd_t _fd, void *buf, size_t len);
 int fs_readdir(sd_t _fd, dirent_t *dirent);
 int fs_lseek(sd_t _fd, int offs, int whence);
 int fs_ftruncate(sd_t _fd, off_t off);
-int fs_fstat(sd_t _fd, stat_t *stat);
+int fs_fstat_raw(obj_handler_t hd, int fd, kstat_t *stat);
+int fs_fstat(sd_t _fd, kstat_t *stat);
 int fs_ioctl(sd_t _fd, int req, void *arg);
 int fs_fcntl(sd_t _fd, int cmd, void *arg);
 int fs_fsync(sd_t _fd);
--- a/mkrtos_user/lib/sys_svr/inc/ns_cli.h
+++ b/mkrtos_user/lib/sys_svr/inc/ns_cli.h
@@ -4,5 +4,5 @@
 #include "ns_types.h"

 int ns_register(const char *path, obj_handler_t svr_hd, int flags);
-int ns_query(const char *path, obj_handler_t *svr_hd, int flags);
-int ns_query_svr(const char *path, obj_handler_t *svr_hd, int flags);
+int ns_query(const char *path, obj_handler_t *svr_hd);
+int ns_query_svr(const char *path, obj_handler_t *svr_hd);
--- a/mkrtos_user/lib/sys_svr/inc/pm_cli.h
+++ b/mkrtos_user/lib/sys_svr/inc/pm_cli.h
@@ -4,7 +4,8 @@
 #include <sys/types.h>
 #define PM_KILL_TASK_ALL 0x1

-int pm_run_app(const char *path, int mem_block, uint8_t *params, int params_len, uint8_t *envs, int envs_len);
+int pm_run_app(const char *path, int16_t mem_block, int16_t flags, 
+    int pid, uint8_t *params, int params_len, uint8_t *envs, int envs_len);
 int pm_kill_task(int pid, int flags, int exit_code);
 int pm_watch_pid(obj_handler_t sig_hd, pid_t pid, int flags);
 int pm_copy_data(pid_t src_pid, pid_t dst_pid, addr_t src_addr, addr_t dst_addr, size_t len);
--- a/mkrtos_user/lib/sys_svr/inc/pm_svr.h
+++ b/mkrtos_user/lib/sys_svr/inc/pm_svr.h
@@ -32,10 +32,35 @@ typedef struct pm
    slist_head_t watch_head;
 } pm_t;

-#define PM_APP_BG_RUN 0x1
+#define PM_CREATE_DUMMY_TASK 0x1
+// #define PM_USE_EXIST_DUMMY_TASK 0x2
+#define PM_USE_LOAD_TO_RAM 0x2
+typedef union pm_flags
+{
+    umword_t raw;
+    struct {
+        uint8_t mem_block;
+        uint8_t flags;//@see PM_CREATE_DUMMY_TASK
+        hmword_t pid;
+    };
+} pm_flags_t;
+static inline pm_flags_t pm_flags_init_raw(umword_t raw)
+{
+    return (pm_flags_t) {
+        .raw = raw,
+    };
+}
+static inline pm_flags_t pm_flags_init(uint8_t mem_block, uint8_t flags, pid_t pid)
+{
+    return (pm_flags_t) {
+        .mem_block = mem_block,
+        .flags = flags,
+        .pid = pid,
+    };
+}

 void pm_svr_obj_init(pm_t *pm);
-int pm_rpc_run_app(const char *path, int mem_block, char *params, int params_len, char *env, int envs_len);
+int pm_rpc_run_app(const char *path, pm_flags_t pm_flags, char *params, int params_len_or_app_size, char *env, int envs_len);
 int pm_rpc_kill_task(int src_pid, int pid, int flags, int exit_code);

 int pm_rpc_watch_pid(pm_t *pm, obj_handler_t sig_rcv_hd, pid_t pid, int flags);
--- a/mkrtos_user/lib/sys_svr/src/cons_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/cons_cli.c
@@ -31,9 +31,6 @@ int cons_write(const uint8_t *data, int len)
            .data = (uint8_t *)data + rlen,
            .len = r_once_len,
        };
-        rpc_int_t rpc_len = {
-            .data = r_once_len,
-        };
        msg_tag_t tag = cons_t_write_call(env->log_hd, &rpc_buf);

        if (msg_tag_get_val(tag) < 0)
--- a/mkrtos_user/lib/sys_svr/src/drv_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/drv_cli.c
@@ -31,7 +31,7 @@ RPC_GENERATION_CALL3(drv_t, FS_PROT, DRV_IOCTL, ioctl,
 int dev_fs_open(const char *path, uint32_t oflags)
 {
    obj_handler_t hd;
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);

    if (ret < 0)
    {
--- a/mkrtos_user/lib/sys_svr/src/drv_svr.c
+++ b/mkrtos_user/lib/sys_svr/src/drv_svr.c
@@ -12,7 +12,7 @@ RPC_GENERATION_OP2(drv_t, FS_PROT, DRV_OPEN, open,
                   rpc_uint32_t_t, rpc_uint32_t_t, RPC_DIR_IN, RPC_TYPE_DATA, oflags)
 {
    name->data[name->len - 1] = 0;
-    return dev_open(name->data, oflags->data);
+    return dev_open((char *)name->data, oflags->data);
 }

 RPC_GENERATION_DISPATCH2(drv_t, FS_PROT, DRV_OPEN, open,
--- a/mkrtos_user/lib/sys_svr/src/fs_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/fs_cli.c
@@ -21,20 +21,11 @@ RPC_GENERATION_CALL3(fs_t, FS_PROT, FS_OPEN, open,
                     rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, flags,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, mode)
-sd_t fs_open(const char *path, int flags, int mode)
+int fs_open_raw(obj_handler_t fs_hd, const char *path, int flags, int mode)
 {
-    assert(path);
-    obj_handler_t hd;
-    int ret = ns_query(path, &hd, 0x1);
-
-    if (ret < 0)
-    {
-        return ret;
-    }
-
    rpc_ref_file_array_t rpc_path = {
-        .data = (uint8_t *)(&path[ret]),
-        .len = strlen(&path[ret]) + 1,
+        .data = (uint8_t *)(path),
+        .len = strlen(path) + 1,
    };
    rpc_int_t rpc_flags = {
        .data = flags,
@@ -42,46 +33,53 @@ sd_t fs_open(const char *path, int flags, int mode)
    rpc_int_t rpc_mode = {
        .data = mode,
    };
-    msg_tag_t tag = fs_t_open_call(hd, &rpc_path, &rpc_flags, &rpc_mode);
+    msg_tag_t tag = fs_t_open_call(fs_hd, &rpc_path, &rpc_flags, &rpc_mode);

-    if (msg_tag_get_val(tag) < 0)
+    return msg_tag_get_val(tag);
+}
+sd_t fs_open(const char *path, int flags, int mode)
+{
+    assert(path);
+    obj_handler_t hd;
+    int ret = ns_query(path, &hd);
+
+    if (ret < 0)
    {
-        return msg_tag_get_val(tag);
+        return ret;
    }
-
-    return mk_sd_init2(hd, msg_tag_get_val(tag)).raw;
+    ret = fs_open_raw(hd, &path[ret], flags, mode);
+    if (ret < 0)
+    {
+        return ret;
+    }
+    return mk_sd_init2(hd, ret).raw;
 }
 /*close*/
 RPC_GENERATION_CALL1(fs_t, FS_PROT, FS_CLOSE, close,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd)
-int fs_close(sd_t _fd)
+int fs_close_raw(obj_handler_t hd, int fd)
 {
-    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
-    int fd = mk_sd_init_raw(_fd).fd;
-
    rpc_int_t rpc_fd = {
        .data = fd,
    };
    msg_tag_t tag = fs_t_close_call(hd, &rpc_fd);

-    if (msg_tag_get_val(tag) < 0)
-    {
-        return msg_tag_get_val(tag);
-    }
-
    return msg_tag_get_val(tag);
 }
+int fs_close(sd_t _fd)
+{
+    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
+    int fd = mk_sd_init_raw(_fd).fd;
+
+    return fs_close_raw(hd, fd);
+}
 /*read*/
 RPC_GENERATION_CALL3(fs_t, FS_PROT, FS_READ, read,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd,
                     rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_OUT, RPC_TYPE_DATA, buf,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, len)
-
-int fs_read(sd_t _fd, void *buf, size_t len)
+int fs_read_raw(obj_handler_t hd, int fd, void *buf, size_t len)
 {
-    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
-    int fd = mk_sd_init_raw(_fd).fd;
-
    rpc_int_t rpc_fd = {
        .data = fd,
    };
@@ -114,6 +112,13 @@ int fs_read(sd_t _fd, void *buf, size_t len)

    return rlen;
 }
+int fs_read(sd_t _fd, void *buf, size_t len)
+{
+    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
+    int fd = mk_sd_init_raw(_fd).fd;
+
+    return fs_read_raw(hd, fd, buf, len);
+}
 /*write*/
 RPC_GENERATION_CALL3(fs_t, FS_PROT, FS_WRITE, write,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd,
@@ -246,11 +251,8 @@ int fs_ftruncate(sd_t _fd, off_t off)
 RPC_GENERATION_CALL2(fs_t, FS_PROT, FS_FSTAT, fstat,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd,
                     rpc_kstat_t_t, rpc_kstat_t_t, RPC_DIR_OUT, RPC_TYPE_DATA, statbuf)
-int fs_fstat(sd_t _fd, kstat_t *stat)
+int fs_fstat_raw(obj_handler_t hd, int fd, kstat_t *stat)
 {
-    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
-    int fd = mk_sd_init_raw(_fd).fd;
-
    rpc_int_t rpc_fd = {
        .data = fd,
    };
@@ -271,6 +273,13 @@ int fs_fstat(sd_t _fd, kstat_t *stat)

    return msg_tag_get_val(tag);
 }
+int fs_fstat(sd_t _fd, kstat_t *stat)
+{
+    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
+    int fd = mk_sd_init_raw(_fd).fd;
+
+    return fs_fstat_raw(hd, fd, stat);
+}
 // int ioctl(int fd, int req, void *arg)
 RPC_GENERATION_CALL3(fs_t, FS_PROT, FS_IOCTL, ioctl,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd,
@@ -292,10 +301,6 @@ int fs_ioctl(sd_t _fd, int req, void *arg)
    };
    msg_tag_t tag;

-    if (!stat)
-    {
-        return -EINVAL;
-    }
    tag = fs_t_ioctl_call(hd, &rpc_fd, &rpc_req, &rpc_arg);

    return msg_tag_get_val(tag);
@@ -321,10 +326,6 @@ int fs_fcntl(sd_t _fd, int cmd, void *arg)
    };
    msg_tag_t tag;

-    if (!stat)
-    {
-        return -EINVAL;
-    }
    tag = fs_t_fcntl_call(hd, &rpc_fd, &rpc_cmd, &rpc_arg);

    return msg_tag_get_val(tag);
@@ -370,13 +371,13 @@ int fs_symlink(const char *src, const char *dst)
    obj_handler_t src_hd;
    obj_handler_t dst_hd;

-    int src_ret = ns_query(src, &src_hd, 0x1);
+    int src_ret = ns_query(src, &src_hd);

    if (src_ret < 0)
    {
        return src_ret;
    }
-    int dst_ret = ns_query(dst, &dst_hd, 0x1);
+    int dst_ret = ns_query(dst, &dst_hd);

    if (dst_ret < 0)
    {
@@ -408,7 +409,7 @@ RPC_GENERATION_CALL1(fs_t, FS_PROT, FS_MKDIR, mkdir,
 int fs_mkdir(char *path)
 {
    obj_handler_t hd;
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);

    if (ret < 0)
    {
@@ -432,7 +433,7 @@ RPC_GENERATION_CALL1(fs_t, FS_PROT, FS_RMDIR, rmdir,
 int fs_rmdir(char *path)
 {
    obj_handler_t hd;
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);

    if (ret < 0)
    {
@@ -458,13 +459,13 @@ int fs_rename(char *old, char *new)
    obj_handler_t src_hd;
    obj_handler_t dst_hd;

-    int src_ret = ns_query(old, &src_hd, 0x1);
+    int src_ret = ns_query(old, &src_hd);

    if (src_ret < 0)
    {
        return src_ret;
    }
-    int dst_ret = ns_query(new, &dst_hd, 0x1);
+    int dst_ret = ns_query(new, &dst_hd);

    if (dst_ret < 0)
    {
@@ -501,7 +502,7 @@ int fs_stat(char *path, void *_buf)
    {
        return -EINVAL;
    }
-    int ret = ns_query(path, &hd, 0x0);
+    int ret = ns_query(path, &hd);

    if (ret < 0)
    {
@@ -535,7 +536,7 @@ int fs_readlink(const char *path, char *buf, int bufsize)
    {
        return -EINVAL;
    }
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);

    if (ret < 0)
    {
@@ -546,7 +547,7 @@ int fs_readlink(const char *path, char *buf, int bufsize)
        .len = strlen(&path[ret]) + 1,
    };
    rpc_ref_file_array_t rpc_buf = {
-        .data = buf,
+        .data = (uint8_t *)buf,
        .len = bufsize,
    };
    rpc_int_t rpc_bufsize = {
@@ -570,7 +571,7 @@ int fs_statfs(const char *path, statfs_t *buf)
    {
        return -EINVAL;
    }
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);

    if (ret < 0)
    {
--- a/mkrtos_user/lib/sys_svr/src/fs_svr.c
+++ b/mkrtos_user/lib/sys_svr/src/fs_svr.c
@@ -218,7 +218,7 @@ RPC_GENERATION_OP1(fs_t, FS_PROT, FS_UNLINK, unlink,
        return -ENOSYS;
    }
    path->data[path->len - 1] = 0;
-    return obj->op->fs_svr_unlink(path->data);
+    return obj->op->fs_svr_unlink((char *)path->data);
 }
 RPC_GENERATION_DISPATCH1(fs_t, FS_PROT, FS_UNLINK, unlink,
                         rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path)
@@ -234,7 +234,7 @@ RPC_GENERATION_OP2(fs_t, FS_PROT, FS_SYMLINK, symlink,
    src->data[src->len - 1] = 0;
    dst->data[dst->len - 1] = 0;

-    return obj->op->fs_svr_symlink(src->data, src->data);
+    return obj->op->fs_svr_symlink((char *)src->data, (char *)src->data);
 }
 RPC_GENERATION_DISPATCH2(fs_t, FS_PROT, FS_SYMLINK, symlink,
                         rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, src,
@@ -249,7 +249,7 @@ RPC_GENERATION_OP1(fs_t, FS_PROT, FS_MKDIR, mkdir,
        return -ENOSYS;
    }
    dir->data[dir->len - 1] = 0;
-    return obj->op->fs_svr_mkdir(dir->data);
+    return obj->op->fs_svr_mkdir((char *)dir->data);
 }
 RPC_GENERATION_DISPATCH1(fs_t, FS_PROT, FS_MKDIR, mkdir,
                         rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, dir)
@@ -262,7 +262,7 @@ RPC_GENERATION_OP1(fs_t, FS_PROT, FS_RMDIR, rmdir,
        return -ENOSYS;
    }
    dir->data[dir->len - 1] = 0;
-    return obj->op->fs_svr_rmdir(dir->data);
+    return obj->op->fs_svr_rmdir((char *)dir->data);
 }
 RPC_GENERATION_DISPATCH1(fs_t, FS_PROT, FS_RMDIR, rmdir,
                         rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, dir)
@@ -279,7 +279,7 @@ RPC_GENERATION_OP2(fs_t, FS_PROT, FS_RENAME, rename,
    old->data[old->len - 1] = 0;
    new->data[new->len - 1] = 0;

-    return obj->op->fs_svr_rename(old->data, new->data);
+    return obj->op->fs_svr_rename((char *)old->data, (char *)new->data);
 }
 RPC_GENERATION_DISPATCH2(fs_t, FS_PROT, FS_RENAME, rename,
                         rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, old,
@@ -295,7 +295,7 @@ RPC_GENERATION_OP2(fs_t, FS_PROT, FS_STAT, stat,
        return -ENOSYS;
    }
    path->data[path->len - 1] = 0;
-    return obj->op->fs_svr_stat(path->data, &buf->data);
+    return obj->op->fs_svr_stat((char *)path->data, &buf->data);
 }
 RPC_GENERATION_DISPATCH2(fs_t, FS_PROT, FS_STAT, stat,
                         rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
@@ -314,7 +314,7 @@ RPC_GENERATION_OP3(fs_t, FS_PROT, FS_READLINK, readlink,
    path->data[path->len - 1] = 0;
    // buf->data[buf->len - 1] = 0;

-    return obj->op->fs_svr_readlink(path->data, buf->data, MIN(bufsize->data, buf->len));
+    return obj->op->fs_svr_readlink((char *)path->data, (char *)buf->data, MIN(bufsize->data, buf->len));
 }
 RPC_GENERATION_DISPATCH3(fs_t, FS_PROT, FS_READLINK, readlink,
                         rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
@@ -331,7 +331,7 @@ RPC_GENERATION_OP2(fs_t, FS_PROT, FS_STATFS, statfs,
        return -ENOSYS;
    }
    path->data[path->len - 1] = 0;
-    return obj->op->fs_svr_statfs(path->data, &buf->data);
+    return obj->op->fs_svr_statfs((char *)(path->data), &buf->data);
 }
 RPC_GENERATION_DISPATCH2(fs_t, FS_PROT, FS_STATFS, statfs,
                         rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
--- a/mkrtos_user/lib/sys_svr/src/net_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/net_cli.c
@@ -334,7 +334,6 @@ int net_recv(int s, void *mem, size_t len, int flags)
    rpc_int_t rpc_flags = {
        .data = flags,
    };
-    msg_tag_t tag;

    int rlen = 0;
    int r_once_len = 0;
@@ -404,7 +403,6 @@ int net_recvfrom(int s, void *mem, size_t len, int flags,
    {
        rpc_fromlen.data = *fromlen;
    }
-    msg_tag_t tag;

    int rlen = 0;
    int r_once_len = 0;
@@ -457,7 +455,6 @@ int net_send(int s, const void *dataptr, size_t size, int flags)
        .data = flags,
    };

-    msg_tag_t tag;

    int rlen = 0;
    int w_once_len = 0;
@@ -524,7 +521,6 @@ int net_sendto(int s, const void *dataptr, size_t size, int flags,
    rpc_socklen_t_t rpc_tolen = {
        .data = tolen,
    };
-    msg_tag_t tag;

    int rlen = 0;
    int w_once_len = 0;
@@ -566,7 +562,7 @@ int net_socket(int domain, int type, int protocol)
    {
    case AF_INET:
    case AF_INET6:
-        ret = ns_query_svr("/sys/net" /*FIXME:更改为宏*/, &hd, 1);
+        ret = ns_query_svr("/sys/net" /*FIXME:更改为宏*/, &hd);
        break;
    default:
        return -ENOSYS;
--- a/mkrtos_user/lib/sys_svr/src/ns_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/ns_cli.c
@@ -35,7 +35,6 @@ static pthread_spinlock_t ns_cli_cache_lock;
 static obj_handler_t find_hd(const char *path, int *split_pos)
 {
    int i = 0;
-    int empty = -1;

    pthread_spin_lock(&ns_cli_cache_lock);
    for (i = 0; i < NS_CLI_CACHE_NR; i++)
@@ -72,7 +71,6 @@ static obj_handler_t find_hd(const char *path, int *split_pos)
 static bool_t reg_hd(const char *path, obj_handler_t hd, int split_inx)
 {
    int i = 0;
-    int empty = -1;

    pthread_spin_lock(&ns_cli_cache_lock);
    for (i = 0; i < NS_CLI_CACHE_NR; i++)
@@ -92,7 +90,6 @@ static bool_t reg_hd(const char *path, obj_handler_t hd, int split_inx)
 static void del_hd(obj_handler_t hd)
 {
    int i = 0;
-    int empty = -1;

    pthread_spin_lock(&ns_cli_cache_lock);
    for (i = 0; i < NS_CLI_CACHE_NR; i++)
@@ -135,7 +132,7 @@ int ns_register(const char *path, obj_handler_t svr_hd, int flags)
    return msg_tag_get_val(tag);
 }

-int ns_query(const char *path, obj_handler_t *svr_hd, int flags)
+int ns_query(const char *path, obj_handler_t *svr_hd)
 {
    int inx = 0;
    assert(path);
@@ -215,11 +212,11 @@ next:
    *svr_hd = newfd;
    return msg_tag_get_val(tag);
 }
-int ns_query_svr(const char *path, obj_handler_t *svr_hd, int flags)
+int ns_query_svr(const char *path, obj_handler_t *svr_hd)
 {
    int ret;

-    ret = ns_query(path, svr_hd, flags);
+    ret = ns_query(path, svr_hd);
    if (ret < 0)
    {
        return ret;
--- a/mkrtos_user/lib/sys_svr/src/pm_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/pm_cli.c
@@ -13,19 +13,20 @@

 RPC_GENERATION_CALL6(pm_t, PM_PROT, PM_RUN_APP, run_app,
                     rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
-                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, mem_block,
+                     rpc_umword_t_t, rpc_umword_t_t, RPC_DIR_IN, RPC_TYPE_DATA, pm_flags,
                     rpc_ref_array_uint32_t_uint8_t_96_t, rpc_array_uint32_t_uint8_t_96_t, RPC_DIR_IN, RPC_TYPE_DATA, params,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, params_len,
                     rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, envs,
                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, envs_len)
-int pm_run_app(const char *path, int mem_block, uint8_t *params, int params_len, uint8_t *envs, int envs_len)
+int pm_run_app(const char *path, int16_t mem_block, int16_t flags, 
+    int pid, uint8_t *params, int params_len, uint8_t *envs, int envs_len)
 {
    rpc_ref_array_uint32_t_uint8_t_64_t rpc_path = {
-        .data = (uint8_t *)path,
-        .len = MIN(strlen(path) + 1, 64),
+        .data = (uint8_t *)path ? (uint8_t *)path : (uint8_t *)"",
+        .len = path ? MIN(strlen(path) + 1, 64) : 1,
    };
-    rpc_int_t rpc_mem_block = {
-        .data = mem_block,
+    rpc_umword_t_t rpc_mem_block = {
+        .data = pm_flags_init(mem_block, flags, pid).raw,
    };
    rpc_ref_array_uint32_t_uint8_t_96_t rpc_params = {
        .data = (uint8_t *)params ? params : (uint8_t *)"",
--- a/mkrtos_user/lib/sys_svr/src/pm_svr.c
+++ b/mkrtos_user/lib/sys_svr/src/pm_svr.c
@@ -24,7 +24,7 @@
 */
 RPC_GENERATION_OP6(pm_t, PM_PROT, PM_RUN_APP, run_app,
                   rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
-                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, mem_block,
+                   rpc_umword_t_t, rpc_umword_t_t, RPC_DIR_IN, RPC_TYPE_DATA, pm_flags,
                   rpc_ref_array_uint32_t_uint8_t_96_t, rpc_array_uint32_t_uint8_t_96_t, RPC_DIR_IN, RPC_TYPE_DATA, params,
                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, params_len,
                   rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, envs,
@@ -33,14 +33,18 @@ RPC_GENERATION_OP6(pm_t, PM_PROT, PM_RUN_APP, run_app,
 {
    int16_t ret = -1;

-    path->data[path->len - 1] = 0;
-    ret = pm_rpc_run_app(path->data, mem_block->data, params->data, params_len->data, envs->data, envs_len->data);
+    if (path->len)
+    {
+        path->data[path->len - 1] = 0;
+    }
+    ret = pm_rpc_run_app((char *)path->data, pm_flags_init_raw(pm_flags->data),
+    (char *)params->data, params_len->data, (char *)envs->data, envs_len->data);
    return ret;
 }

 RPC_GENERATION_DISPATCH6(pm_t, PM_PROT, PM_RUN_APP, run_app,
                   rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
-                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, mem_block,
+                   rpc_umword_t_t, rpc_umword_t_t, RPC_DIR_IN, RPC_TYPE_DATA, pm_flags,
                   rpc_ref_array_uint32_t_uint8_t_96_t, rpc_array_uint32_t_uint8_t_96_t, RPC_DIR_IN, RPC_TYPE_DATA, params,
                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, params_len,
                   rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, envs,
--- a/mkrtos_user/lib/sys_svr/src/sig_svr.c
+++ b/mkrtos_user/lib/sys_svr/src/sig_svr.c
@@ -18,18 +18,18 @@

 RPC_GENERATION_OP2(sig_t, SIG_PORT, SIG_KILL, kill,
                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, flags,
-                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, resv)
+                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, pid)
 {
    if (!obj->op->kill)
    {
        return -ENOSYS;
    }
-    return obj->op->kill(flags->data, resv->data);
+    return obj->op->kill(flags->data, pid->data);
 }

 RPC_GENERATION_DISPATCH2(sig_t, SIG_PORT, SIG_KILL, kill,
                         rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, flags,
-                         rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, resv)
+                         rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, pid)

 RPC_GENERATION_OP2(sig_t, SIG_PORT, SIG_TOKILL, to_kill,
                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, flags,
--- a/mkrtos_user/lib/sys_util/inc/u_app_loader.h
+++ b/mkrtos_user/lib/sys_util/inc/u_app_loader.h
@@ -3,7 +3,8 @@
 #include "u_env.h"
 #include "u_hd_man.h"

-int app_load(const char *name, uenv_t *cur_env, pid_t *pid,
+int app_load(const char *name,
+             uenv_t *cur_env, pid_t *pid,
             char *argv[], int arg_cn,
             char *envp[], int envp_cn,
-             int mem_block);
+             int mem_blockpm, bool_t load_to_ram);
--- a/mkrtos_user/lib/sys_util/inc/u_rpc.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc.h
@@ -24,7 +24,7 @@
 #include <sys/statfs.h>

 typedef struct stat stat_t;
-// typedef struct kstat kstat_t;
+typedef struct kstat kstat_t;
 typedef struct statfs statfs_t;
 typedef struct dirent dirent_t;

--- a/mkrtos_user/lib/sys_util/inc/u_rpc_1.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_1.h
@@ -11,7 +11,7 @@
 * @brief 该宏用于生成一个客户端的调用函数（传递一个参数）
 *
 */
-#define RPC_GENERATION_CALL1(struct_type, prot, op, func_name, cli_type0, svr_type0, dir0, rpc_type0, name0)              \
+#define RPC_GENERATION_CALL1(struct_type, prot, op, func_name, cli_type0, svr_type0, dir0, rpc_type0, name0)                       \
    msg_tag_t struct_type##_##func_name##_call(obj_handler_t hd, cli_type0 *var0)                                                  \
    {                                                                                                                              \
        void *buf;                                                                                                                 \
@@ -22,7 +22,6 @@
                                                                                                                                   \
        int off = 0;                                                                                                               \
        int off_buf = 0;                                                                                                           \
-        int ret = -1;                                                                                                              \
        umword_t op_val = op;                                                                                                      \
        /*拷贝op*/                                                                                                                 \
        rpc_memcpy(msg_ipc->msg_buf, &op_val, sizeof(op_val));                                                                     \
@@ -32,8 +31,8 @@
        PRC_CLI_FILL_MAP_BUF(rpc_type0, cli_type0, var0, dir0, (uint8_t *)msg_ipc->map_buf, off_buf);                              \
        /*msg_tag_t tag = dispatch_test(msg_tag_init4(0, ROUND_UP(off, WORD_BYTES), ROUND_UP(off_buf, WORD_BYTES), 0), msg_ipc);*/ \
        msg_tag_t tag;                                                                                                             \
-        tag = thread_ipc_fast_call(msg_tag_init4(0, ROUND_UP(off, WORD_BYTES), ROUND_UP(off_buf, WORD_BYTES), prot),           \
-                                    hd, 1111, 2222, 3333);                                                                      \
+        tag = thread_ipc_fast_call(msg_tag_init4(0, ROUND_UP(off, WORD_BYTES), ROUND_UP(off_buf, WORD_BYTES), prot),               \
+                                   hd, 1111, 2222, 3333);                                                                          \
        if (msg_tag_get_val(tag) < 0)                                                                                              \
        {                                                                                                                          \
            return tag;                                                                                                            \
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_2.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_2.h
@@ -21,7 +21,6 @@
                                                                                                                                    \
        int off = 0;                                                                                                                \
        int off_buf = 0;                                                                                                            \
-        int ret = -1;                                                                                                               \
        umword_t op_val = op;                                                                                                       \
        /*拷贝op*/                                                                                                                  \
        rpc_memcpy(msg_ipc->msg_buf, &op_val, sizeof(op_val));                                                                      \
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_3.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_3.h
@@ -22,7 +22,6 @@
                                                                                                                                    \
        int off = 0;                                                                                                                \
        int off_buf = 0;                                                                                                            \
-        int ret = -1;                                                                                                               \
        umword_t op_val = op;                                                                                                       \
        /*拷贝op*/                                                                                                                  \
        rpc_memcpy(msg_ipc->msg_buf, &op_val, __alignof(op_val));                                                                   \
@@ -55,9 +54,9 @@
                                 cli_type2, svr_type2, dir2, rpc_type2, name2)                                     \
    msg_tag_t struct_type##_##func_name##_dispatch(struct_type *obj, msg_tag_t tag, ipc_msg_t *ipc_msg)            \
    {                                                                                                              \
-        svr_type0 var0;                                                                                            \
-        svr_type1 var1;                                                                                            \
-        svr_type2 var2;                                                                                            \
+        svr_type0 var0 = {};                                                                                            \
+        svr_type1 var1 = {};                                                                                            \
+        svr_type2 var2 = {};                                                                                            \
        size_t op_val;                                                                                             \
        uint8_t *value = (uint8_t *)(ipc_msg->msg_buf);                                                            \
        uint8_t *map_value = (uint8_t *)(ipc_msg->map_buf);                                                        \
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_4.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_4.h
@@ -23,7 +23,6 @@
                                                                                                                                     \
        int off = 0;                                                                                                                 \
        int off_buf = 0;                                                                                                             \
-        int ret = -1;                                                                                                                \
        umword_t op_val = op;                                                                                                        \
        /*拷贝op*/                                                                                                                   \
        rpc_memcpy(msg_ipc->msg_buf, &op_val, __alignof(op_val));                                                                    \
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_5.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_5.h
@@ -24,7 +24,6 @@
                                                                                                                                                      \
        int off = 0;                                                                                                                                  \
        int off_buf = 0;                                                                                                                              \
-        int ret = -1;                                                                                                                                 \
        umword_t op_val = op;                                                                                                                         \
        /*拷贝op*/                                                                                                                                    \
        rpc_memcpy(msg_ipc->msg_buf, &op_val, __alignof(op_val));                                                                                     \
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_6.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_6.h
@@ -25,7 +25,6 @@
                                                                                                                                                                       \
        int off = 0;                                                                                                                                                   \
        int off_buf = 0;                                                                                                                                               \
-        int ret = -1;                                                                                                                                                  \
        umword_t op_val = op;                                                                                                                                          \
        /*拷贝op*/                                                                                                                                                     \
        rpc_memcpy(msg_ipc->msg_buf, &op_val, __alignof(op_val));                                                                                                      \
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_svr.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_svr.h
@@ -18,6 +18,7 @@ static inline int rpc_svr_obj_init(rpc_svr_obj_t *obj, rpc_dispatch_func dis, mw
 {
    obj->dispatch = dis;
    obj->prot = prot;
+    return 0;
 }

 #define META_PROT_NR 4
--- a/mkrtos_user/lib/sys_util/src/u_app_loader.c
+++ b/mkrtos_user/lib/sys_util/src/u_app_loader.c
@@ -110,111 +110,251 @@ static void *app_stack_push_array(obj_handler_t task_obj, umword_t **stack, uint

    return *stack;
 }
+#if 1
+struct kstat
+{
+    long st_dev;
+    int __st_dev_padding;
+    long __st_ino_truncated;
+    mode_t st_mode;
+    nlink_t st_nlink;
+    uid_t st_uid;
+    gid_t st_gid;
+    long st_rdev;
+    int __st_rdev_padding;
+    long st_size;
+    blksize_t st_blksize;
+    long st_blocks;
+    long st_atime_sec;
+    long st_atime_nsec;
+    long st_mtime_sec;
+    long st_mtime_nsec;
+    long st_ctime_sec;
+    long st_ctime_nsec;
+    long st_ino;
+};
+typedef struct kstat kstat_t;

+#include "u_malloc.h"
+#include "fs_cli.h"
+// #include "ns.h"
+#include <fcntl.h>
+
+static int app_file_ram_copy_to_task(obj_handler_t task_hd, void *file_ram, size_t size)
+{
+    msg_tag_t tag;
+    addr_t ram_addr;
+    size_t ram_size;
+    tag = task_alloc_get_ram_info(task_hd, &ram_addr, &ram_size);
+    if (msg_tag_get_val(tag) < 0)
+    {
+        u_free(file_ram);
+        return msg_tag_get_val(tag);
+    }
+    tag = task_copy_data_to(TASK_THIS, task_hd, (void *)file_ram, (void *)ram_addr, size);
+    if (msg_tag_get_val(tag) < 0)
+    {
+        u_free(file_ram);
+        return msg_tag_get_val(tag);
+    }
+    u_free(file_ram);
+    return 0;
+}
 /**
- * @brief 加载并执行一个app
- *
- * @param name app的名字
- * @return int
+ * load app and get addr.
 */
-int app_load(const char *name, uenv_t *cur_env, pid_t *pid,
-             char *argv[], int arg_cn,
-             char *envp[], int envp_cn,
-             int mem_block)
+static int app_file_load(const char *name, obj_handler_t task_hd, addr_t *start_addr, size_t *total_size, bool_t load_to_ram)
 {
    msg_tag_t tag;
    sys_info_t sys_info;
+    umword_t addr;
+    int ret = 0;
+    unsigned long size;

    tag = sys_read_info(SYS_PROT, &sys_info, 0);
    if (msg_tag_get_val(tag) < 0)
    {
        return -ENOENT;
    }
-    int type;
-    umword_t addr;
-    int ret = 0;
-    unsigned long size;
-
-#if IS_ENABLED(CONFIG_CPIO_SUPPORT)
-    ret = cpio_find_file((umword_t)sys_info.bootfs_start_addr, (umword_t)(-1), name, NULL, &type, &addr);
-#else
-    type = 0;
-    addr = (umword_t)appfs_tiny_find_file_addr_by_name(appfs_tiny_get_form_addr((void *)sys_info.bootfs_start_addr), name, &size);
-    if (addr == 0)
+    if (load_to_ram)
    {
-        ret = -ENOENT;
-    }
-#endif
-    if (ret < 0 || (ret >= 0 && type == 1))
-    {
-        return -ENOENT;
-    }
-    addr_t entry_addr;
-    app_info_t *app = app_info_get((void *)addr);
-    addr_t at_base = addr;
-    if (app == NULL)
-    {
-        addr_t text_addr;
-        ret = elf32_load((umword_t)addr, 0 /*TODO:*/,
-                         &entry_addr, 0, &text_addr);
+        // read form file.
+        void *file_ram = NULL;
+        kstat_t stat;
+        obj_handler_t hd;
+        int fd;
+        extern int namespace_query(const char *path, obj_handler_t *hd);
+        ret = namespace_query(name, &hd);
        if (ret < 0)
        {
-            printf("app format is error.\n");
-            return -1;
+            return ret;
        }
-
-        addr = entry_addr + text_addr;
-        app = app_info_get((void *)addr);
-        if (app == NULL)
+        fd = fs_open_raw(hd, name + ret, O_RDWR, 0777);
+        if (fd < 0)
        {
-            printf("app format is error.\n");
-            return -1;
+            return fd;
        }
-        printf("%s text addr is [0x%x]\n", name, text_addr);
-        printf("entry addr is [0x%x]\n", addr);
+        ret = fs_fstat_raw(hd, fd, &stat);
+        if (ret < 0)
+        {
+            fs_close_raw(hd, fd);
+            return ret;
+        }
+        file_ram = u_malloc(stat.st_size);
+        if (!file_ram)
+        {
+            fs_close_raw(hd, fd);
+            return -ENOMEM;
+        }
+        ret = fs_read_raw(hd, fd, file_ram, stat.st_size);
+        if (ret != stat.st_size)
+        {
+            fs_close_raw(hd, fd);
+            u_free(file_ram);
+            return -EIO;
+        }
+        fs_close_raw(hd, fd);
+        // addr_t ram_addr;
+        // size_t ram_size;
+        // tag = task_alloc_get_ram_info(task_hd, &ram_addr, &ram_size);
+        // if (msg_tag_get_val(tag) < 0)
+        // {
+        //     u_free(file_ram);
+        //     return msg_tag_get_val(tag);
+        // }
+        *start_addr = (addr_t)file_ram;
+        *total_size = stat.st_size;
+        return 0;
+    }
+    else
+    {
+#if IS_ENABLED(CONFIG_CPIO_SUPPORT)
+        ret = cpio_find_file((umword_t)sys_info.bootfs_start_addr, (umword_t)(-1), name, NULL, &type, &addr);
+        if (ret < 0 || type == 1)
+        {
+            return -ENOENT;
+        }
+#else
+        addr = (umword_t)appfs_tiny_find_file_addr_by_name(appfs_tiny_get_form_addr((void *)sys_info.bootfs_start_addr), name, &size);
+        if (addr == 0)
+        {
+            ret = -ENOENT;
+        }
+        *start_addr = addr;
+        *total_size = size;
+#endif
+    }
+    return ret;
+}
+#endif
+/**
+ * @brief 加载并执行一个app
+ *
+ * @param name app的名字
+ * @return int
+ */
+int app_load(const char *name,
+             uenv_t *cur_env, pid_t *pid,
+             char *argv[], int arg_cn,
+             char *envp[], int envp_cn,
+             int mem_block, bool_t load_to_ram)
+{
+    assert(name);
+    assert(cur_env);
+    assert(pid);
+    umword_t ram_base;
+
+    msg_tag_t tag;
+    bool_t is_ext_hd_task = FALSE;
+
+    is_ext_hd_task = *pid != HANDLER_INVALID ? TRUE : FALSE;
+    umword_t addr;
+    int ret = 0;
+    size_t size;
+
+    ret = app_file_load(name, *pid, &addr, &size, load_to_ram);
+    if (ret < 0)
+    {
+        return ret;
+    }
+    if (addr == 0)
+    {
+        return -1;
+    }
+    app_info_t *app = app_info_get((void *)addr);
+
+    if (app == NULL)
+    {
+        printf("app format is error.\n");
+        return -ENOENT;
    }
    else
    {
        printf("%s addr is [0x%x]\n", name, app);
    }
-    umword_t ram_base;
-    obj_handler_t hd_task = handler_alloc();
-    obj_handler_t hd_thread = handler_alloc();
+    obj_handler_t hd_task;
+    obj_handler_t hd_thread = HANDLER_INVALID;

-    if (hd_task == HANDLER_INVALID)
+    if (is_ext_hd_task)
    {
-        goto end;
+        hd_task = *pid; /*FIXME:*/
    }
+    else
+    {
+        hd_task = handler_alloc();
+        if (hd_task == HANDLER_INVALID)
+        {
+            goto end;
+        }
+    }
+    hd_thread = handler_alloc();
+
    if (hd_thread == HANDLER_INVALID)
    {
        goto end;
    }
-    tag = factory_create_task(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, hd_task));
-    if (msg_tag_get_prot(tag) < 0)
+    if (!is_ext_hd_task)
    {
-        goto end_del_obj;
+        tag = factory_create_task(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, hd_task));
+        if (msg_tag_get_prot(tag) < 0)
+        {
+            goto end_del_obj;
+        }
    }
    tag = factory_create_thread(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, hd_thread));
    if (msg_tag_get_prot(tag) < 0)
    {
        goto end_del_obj;
    }
-    tag = task_alloc_ram_base(hd_task, app ? app->i.ram_size : 100 * 1024 /*TODO:*/,
-                              &ram_base, mem_block, (addr_t)addr, size);
-    if (msg_tag_get_prot(tag) < 0)
+    if (!is_ext_hd_task)
    {
-        goto end_del_obj;
+        tag = task_alloc_ram_base(hd_task, app->i.ram_size,
+                                  &ram_base, mem_block, (addr_t)addr, size);
+        if (msg_tag_get_prot(tag) < 0)
+        {
+            goto end_del_obj;
+        }
+    }
+    else
+    {
+        tag = task_alloc_get_ram_info(hd_task, &ram_base, &size);
+        if (msg_tag_get_prot(tag) < 0)
+        {
+            goto end_del_obj;
+        }
    }
    tag = task_map(hd_task, hd_task, TASK_PROT, 0);
    if (msg_tag_get_prot(tag) < 0)
    {
        goto end_del_obj;
    }
-    tag = task_map(hd_task, cur_env->ns_hd, LOG_PROT, KOBJ_DELETE_RIGHT);
+#if 1
+    tag = task_map(hd_task, LOG_PROT, LOG_PROT, KOBJ_DELETE_RIGHT);
    if (msg_tag_get_prot(tag) < 0)
    {
        goto end_del_obj;
    }
+#endif
    tag = task_map(hd_task, SYS_PROT, SYS_PROT, KOBJ_DELETE_RIGHT);
    if (msg_tag_get_prot(tag) < 0)
    {
@@ -250,41 +390,40 @@ int app_load(const char *name, uenv_t *cur_env, pid_t *pid,
    {
        goto end_del_obj;
    }
-    if (app)
-    {
-        tag = thread_msg_buf_set(hd_thread, (void *)(ram_base + app->i.ram_size));
-    }
-    else
-    {
-        /*TODO:*/
-        tag = thread_msg_buf_set(hd_thread, (void *)(ram_base + 100 * 1024 - 2048 - MSG_BUG_LEN));
-    }
+    tag = thread_msg_buf_set(hd_thread, (void *)(ram_base + app->i.ram_size));
    if (msg_tag_get_prot(tag) < 0)
    {
        goto end_del_obj;
    }
-    tag = task_set_pid(hd_task, hd_task); //!< 设置进程的pid就是进程hd号码
-    if (msg_tag_get_prot(tag) < 0)
+    if (!is_ext_hd_task)
    {
-        goto end_del_obj;
-    }
-    if (pid)
-    {
-        *pid = hd_task;
+        tag = task_set_pid(hd_task, hd_task); //!< 设置进程的pid就是进程hd号码
+        if (msg_tag_get_prot(tag) < 0)
+        {
+            goto end_del_obj;
+        }
    }
+    *pid = hd_task;
    void *sp_addr;
    void *sp_addr_top;
-    if (app)
+
+    if (load_to_ram)
+    {
+        if (app_file_ram_copy_to_task(hd_task, (void *)addr, size) < 0)
+        {
+            goto end_del_obj;
+        }
+        sp_addr = (char *)ram_base + app->i.stack_offset;
+        sp_addr_top = (char *)sp_addr + app->i.stack_size;
+        addr = ram_base;
+    }
+    else
    {
        sp_addr = (char *)ram_base + app->i.stack_offset - app->i.data_offset;
        sp_addr_top = (char *)sp_addr + app->i.stack_size;
-        printf("stack:0x%x size:%d.\n", sp_addr, app->i.stack_size);
-    }
-    else
-    {
-        sp_addr = (char *)ram_base;
-        sp_addr_top = (char *)sp_addr + 100 * 1024 - 2048; /*TODO:*/
    }
+    printf("stack:0x%x size:%d.\n", sp_addr, app->i.stack_size);
+
    umword_t *usp_top = (umword_t *)((umword_t)((umword_t)sp_addr_top - 8) & ~0x7UL);
    uenv_t uenv = {
        .log_hd = cur_env->ns_hd,
@@ -322,8 +461,8 @@ int app_load(const char *name, uenv_t *cur_env, pid_t *pid,
    app_stack_push_umword(hd_task, &usp_top, (umword_t)app_env);
    app_stack_push_umword(hd_task, &usp_top, 0xfe);

-    app_stack_push_umword(hd_task, &usp_top, at_base);
-    app_stack_push_umword(hd_task, &usp_top, (umword_t)AT_BASE);
+    // app_stack_push_umword(hd_task, &usp_top, at_base);
+    // app_stack_push_umword(hd_task, &usp_top, (umword_t)AT_BASE);

    app_stack_push_umword(hd_task, &usp_top, MK_PAGE_SIZE);
    app_stack_push_umword(hd_task, &usp_top, (umword_t)AT_PAGESZ);
@@ -357,14 +496,20 @@ end_del_obj:
    {
        task_unmap(TASK_THIS, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, hd_thread));
    }
-    if (hd_task != HANDLER_INVALID)
+    if (!is_ext_hd_task)
    {
-        task_unmap(TASK_THIS, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, hd_task));
+        if (hd_task != HANDLER_INVALID)
+        {
+            task_unmap(TASK_THIS, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, hd_task));
+        }
    }
 end:
-    if (hd_task != HANDLER_INVALID)
+    if (!is_ext_hd_task)
    {
-        handler_free(hd_task);
+        if (hd_task != HANDLER_INVALID)
+        {
+            handler_free(hd_task);
+        }
    }
    if (hd_thread != HANDLER_INVALID)
    {
--- a/mkrtos_user/lib/sys_util/src/u_fast_ipc.c
+++ b/mkrtos_user/lib/sys_util/src/u_fast_ipc.c
@@ -56,7 +56,6 @@ static msg_tag_t process_ipc(int j, umword_t obj, long tag)
    rpc_svr_obj_t *svr_obj;
    ipc_msg_t *msg;
    msg_tag_t ret_tag;
-    int ret = 0;

    msg = (ipc_msg_t *)(&cons_msg_buf[j * MSG_BUG_LEN]);
    ret_tag = msg_tag_init4(0, 0, 0, -EIO);
--- a/mkrtos_user/lib/sys_util/src/u_intr.c
+++ b/mkrtos_user/lib/sys_util/src/u_intr.c
@@ -14,7 +14,7 @@ int u_intr_bind(int irq_no, u_irq_prio_t prio, int th_prio,
    obj_handler_t irq_obj = handler_alloc();
    obj_handler_t th_hd;
    msg_tag_t tag;
-    int ret;
+    int ret = 0;

    if (irq_obj == HANDLER_INVALID)
    {
--- a/mkrtos_user/lib/sys_util/src/u_rpc_svr.c
+++ b/mkrtos_user/lib/sys_util/src/u_rpc_svr.c
@@ -110,7 +110,7 @@ static msg_tag_t rpc_meta_t_dispatch(struct rpc_svr_obj *obj, msg_tag_t in_tag,

    if (msg_tag_get_prot(in_tag) == META_PROT)
    {
-#if 0
+#if 1
        cons_write_str("unknow prot.\n"); //FIXME:
 #endif
        return msg_tag_init4(0, 0, 0, -EPROTO);
@@ -122,8 +122,8 @@ static msg_tag_t rpc_meta_t_dispatch(struct rpc_svr_obj *obj, msg_tag_t in_tag,

        if (svr_obj == NULL)
        {
-#if 0
-        cons_write_str("unknow prot.\n"); //FIXME:
+#if 1
+            cons_write_str("unknow prot.\n"); // FIXME:
 #endif
            return msg_tag_init4(0, 0, 0, -EPROTO);
        }
--- a/mkrtos_user/lib/sys_util/src/u_sig.c
+++ b/mkrtos_user/lib/sys_util/src/u_sig.c
@@ -50,7 +50,6 @@ int pm_sig_del_watch(pid_t pid, int flags)
 */
 int pm_waitpid(pid_t pid, umword_t *status)
 {
-    msg_tag_t tag;

    wait_pid = pid;
    pm_sig_watch(pid, 0);
@@ -72,7 +71,7 @@ static int kill(int flags, int pid)
 {
    int ret = -EINVAL;

-        printf("kill pid:%d, flags:0x%x\n", pid ,flags);
+    printf("kill pid:%d, flags:0x%x\n", pid ,flags);
    if (wait_pid == pid || wait_pid == -1)
    {
        u_sema_up(sema_wait_hd);
--- a/mkrtos_user/lib/util/src/u_malloc.c
+++ b/mkrtos_user/lib/util/src/u_malloc.c
@@ -480,7 +480,7 @@ void u__bin_chunk(struct chunk *self)

 	/* Replace middle of large chunks with fresh zero pages */
 	if (size > RECLAIM && (size^(size-osize)) > size-osize) {
-		uintptr_t a = (uintptr_t)self + SIZE_ALIGN+PAGE_SIZE-1 & -PAGE_SIZE;
+		uintptr_t a = (((uintptr_t)self + SIZE_ALIGN+PAGE_SIZE-1) & (-PAGE_SIZE));
 		uintptr_t b = (uintptr_t)next - SIZE_ALIGN & -PAGE_SIZE;
 		int e = errno;
 #if 1
--- a/mkrtos_user/server/fs/appfs/fs_rpc.c
+++ b/mkrtos_user/server/fs/appfs/fs_rpc.c
@@ -41,7 +41,7 @@ int fs_svr_open(const char *path, int flags, int mode)
        int w_ret = pm_sig_watch(pid, 0 /*TODO:现在只有kill */);
        if (w_ret < 0)
        {
-            printf("pm wath pid %d err.\n", w_ret);
+            printf("appfs wath pid %d err.\n", w_ret);
        }
 #endif
    }
--- a/mkrtos_user/server/fs/appfs/hw_block.c
+++ b/mkrtos_user/server/fs/appfs/hw_block.c
@@ -24,8 +24,6 @@

 static obj_handler_t shm_hd;

-static int block_mem_addr = -1;
-static int block_nr = -1;
 static uint8_t *block_buf; //!< 块缓冲区
 static obj_handler_t blk_drv_hd;
 static blk_drv_info_t blk_info;
@@ -105,7 +103,7 @@ int hw_init_block(fs_info_t *fs, const char *dev_path)
    fs->cb.hw_write_and_erase_block = hw_write_and_erase_block;

 again:
-    ret = ns_query_svr(dev_path, &blk_drv_hd, 0x1);
+    ret = ns_query_svr(dev_path, &blk_drv_hd);
    if (ret < 0)
    {
        u_sleep_ms(50);
@@ -114,7 +112,7 @@ again:
    ret = blk_drv_cli_info(blk_drv_hd, &blk_info);
    if (ret < 0)
    {
-        printf("blk info get fail.\n");
+        printf("blk info get fail. err:%d.\n", ret);
        return ret;
    }
    ret = hw_create_shm_obj(blk_info.blk_size, &shm_hd);
@@ -131,7 +129,7 @@ again:
        return -ENOMEM;
    }
    block_buf = (void *)shm_addr;
-    printf("block_buf addr:0x%x\n", block_buf);
+    printf("block_buf addr:0x%x fs_base_addr: 0x%x\n", block_buf, blk_info.blk_start_addr);
    // printf("img size is %d, block nr is %d.\n", block_mem_size, block_nr);
    return 0;
 }
--- a/mkrtos_user/server/fs/appfs/main.c
+++ b/mkrtos_user/server/fs/appfs/main.c
@@ -38,12 +38,6 @@ int main(int argc, char *argv[])
    char *mount_path = NULL;
    char *dev_path = NULL;

-    task_set_obj_name(TASK_THIS, TASK_THIS, "tk_appfs");
-    task_set_obj_name(TASK_THIS, THREAD_MAIN, "th_appfs");
-    for (int i = 0; i < argc; i++)
-    {
-        printf("args[%d]:%s\n", i, argv[i]);
-    }
    fast_ipc_init();
    int o;
    const char *optstring = "d:m:"; // 有三个选项-abc，其中c选项后有冒号，所以后面必须有参数
@@ -53,6 +47,7 @@ int main(int argc, char *argv[])
        {
        case 'd':
            dev_path = optarg;
+            printf("dev path:%s\n", optarg);
            break;
        case 'm':
            printf("mount path:%s\n", optarg);
@@ -71,20 +66,17 @@ int main(int argc, char *argv[])
        return -1;
    }
    ret = hw_init_block(&fs_obj, dev_path);
-    assert(ret >= 0);
+    assert(ret >= 0 && "hw_init_block error.");
    ret = appfs_init(&fs_obj);
-    assert(ret >= 0);
+    assert(ret >= 0 && "appfs_init error.");
    ret = appfs_open_init(&fs_obj);
-    assert(ret >= 0);
+    assert(ret >= 0 && "appfs_open_init error.");

    ret = rpc_meta_init_def(TASK_THIS, &hd);
-    assert(ret >= 0);
+    assert(ret >= 0 && "rpc_meta_init_def error.");
    fs_svr_init();
    ns_register(mount_path, hd, 0);
    cons_write_str("appfs mount success\n");
-#if 0
-    fs_svr_loop();
-#endif
    while (1)
    {
        u_sleep_ms(U_SLEEP_ALWAYS);
--- a/mkrtos_user/server/fs/appfs/src/appfs.c
+++ b/mkrtos_user/server/fs/appfs/src/appfs.c
@@ -12,11 +12,12 @@

 int appfs_init(fs_info_t *fs)
 {
-    int ret;
+    int ret = 0;
    assert(fs);
    fs->cb.hw_init_fs_for_block(fs);
    fs_info_t *fs_info = (fs_info_t *)fs->mem_addr;

+    printf("fs->mem_addr:0x%x\n", fs->mem_addr);
    // ret = fs->cb.hw_read_block(fs, 0, fs->buf, fs->save.block_size);
    // if (ret >= 0)
    // {
@@ -576,7 +577,6 @@ const dir_info_t *appfs_dir_info_get_next(fs_info_t *info, const dir_info_t *cur
 {
    assert(info);
    assert(cur);
-    int ret = 0;

    for (const dir_info_t *cur_dir = (const dir_info_t *)cur + 1;
         (unsigned long)cur_dir < info->mem_addr + (info->save.dirinfo_inx + info->save.dirinfo_nr) * info->save.block_size;
@@ -922,7 +922,6 @@ int appfs_file_resize(fs_info_t *info, const char *name, int size)
 {
    assert(info);

-    int ret = 0;
    const dir_info_t *dir_info = NULL;

    // 通过文件名查找文件
@@ -946,7 +945,6 @@ int appfs_file_resize(fs_info_t *info, const char *name, int size)
 int appfs_arrange_files(fs_info_t *info)
 {
    int last_idle_block_inx = -1;
-    int status = 0;
    assert(info);
    for (int i = 0; i < info->save.blockinfo_nr; i++)
    {
--- a/mkrtos_user/server/fs/appfs/src/appfs_open.c
+++ b/mkrtos_user/server/fs/appfs/src/appfs_open.c
@@ -92,10 +92,10 @@ void appfs_task_free(int pid)
 {
    for (int i = 0; i < DIR_INFO_NR; i++)
    {
-        if (appfs_files[i].dir_info_fd != -1)
+        if (appfs_files[i].dir_info_fd != -1 && appfs_files[i].pid == pid)
        {
            appfs_close(i);
-            printf("free fd:%d\n", i);
+            printf("appfs free fd:%d\n", i);
        }
    }
 }
@@ -151,7 +151,7 @@ int appfs_open(const char *name, int flags, int mode)
 #else
    int pid = 0;
 #endif
-    int ret;
+    int ret = 0;
    const dir_info_t *file;
    int fd;
    enum appfs_type type;
--- a/mkrtos_user/server/fs/fatfs/CMakeLists.txt
+++ b/mkrtos_user/server/fs/fatfs/CMakeLists.txt
@@ -1,6 +1,6 @@
 cmake_minimum_required(VERSION 3.13)

-set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DUSE_STDPERIPH_DRIVER=1 -DSTM32F10X_XL ")
+# set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DUSE_STDPERIPH_DRIVER=1 -DSTM32F10X_XL ")

 file(
    GLOB deps  
--- a/mkrtos_user/server/fs/fatfs/ext_disk_drv/diskio.c
+++ b/mkrtos_user/server/fs/fatfs/ext_disk_drv/diskio.c
@@ -150,7 +150,7 @@ DRESULT disk_ioctl(
 			*(DWORD *)buff = FLASH_SECTOR_COUNT;
 			return RES_OK;
 		case GET_SECTOR_SIZE: // sector size, 传入block size(SD),单位bytes
-			*(DWORD *)buff = FLASH_SECTOR_SIZE;
+			*(WORD *)buff = FLASH_SECTOR_SIZE;
 			return RES_OK;
 		case GET_BLOCK_SIZE:				   // block size, 由上文可得，对于SD2.0卡最大8192，最小 1
 			*(DWORD *)buff = FLASH_BLOCK_SIZE; // 单位为 sector(FatFs)
--- a/mkrtos_user/server/fs/fatfs/fs_rpc.c
+++ b/mkrtos_user/server/fs/fatfs/fs_rpc.c
@@ -253,7 +253,6 @@ int fs_svr_readdir(int fd, dirent_t *dir)
 }
 int fs_svr_lseek(int fd, int offs, int whence)
 {
-    UINT bw;
    file_desc_t *file = file_desc_get(fd);
    file_desc_priv_t *file_priv = NULL;

--- a/mkrtos_user/server/fs/fatfs/ram_disk_drv/diskio.c
+++ b/mkrtos_user/server/fs/fatfs/ram_disk_drv/diskio.c
@@ -26,6 +26,7 @@ static obj_handler_t shm_hd;
 static addr_t dev_shm_mem;
 static addr_t dev_shm_size;
 static blk_drv_info_t blk_info;
+static int ram_block_inited;
 int disk_set_dev_path(int pdrv, const char *dev)
 {
 	int ret;
@@ -35,7 +36,7 @@ int disk_set_dev_path(int pdrv, const char *dev)
 	{
 		int try_cn = 0;
 	again:
-		ret = ns_query_svr(dev, &dev_hd, 1);
+		ret = ns_query_svr(dev, &dev_hd);
 		if (ret < 0)
 		{
 			try_cn++;
@@ -90,12 +91,15 @@ DSTATUS disk_initialize(
 )
 {
 	DSTATUS stat;
-	int result;

 	switch (pdrv)
 	{
 	case DEV_MK_BLOCK:
 	{
+		if (ram_block_inited)
+		{
+			return RES_OK;
+		}
 		msg_tag_t tag;

 		shm_hd = handler_alloc();
@@ -120,6 +124,7 @@ DSTATUS disk_initialize(
 			return RES_ERROR;
 		}
 		stat = RES_OK;
+		ram_block_inited = 1;
 		// translate the reslut code here
 		return stat;
 	}
@@ -138,7 +143,6 @@ DRESULT disk_read(
 	UINT count	  /* Number of sectors to read */
 )
 {
-	DRESULT res;

 	switch (pdrv)
 	{
@@ -171,7 +175,6 @@ DRESULT disk_write(
 	UINT count		  /* Number of sectors to write */
 )
 {
-	int result;

 	switch (pdrv)
 	{
@@ -203,8 +206,6 @@ DRESULT disk_ioctl(
 	void *buff /* Buffer to send/receive control data */
 )
 {
-	DRESULT res;
-	int result;

 	switch (pdrv)
 	{
@@ -216,7 +217,7 @@ DRESULT disk_ioctl(
 			*(DWORD *)buff = blk_info.blk_nr;
 			return RES_OK;
 		case GET_SECTOR_SIZE: // sector size, 传入block size(SD),单位bytes
-			*(DWORD *)buff = blk_info.blk_size;
+			*(WORD *)buff = blk_info.blk_size;
 			return RES_OK;
 		case GET_BLOCK_SIZE:	// block size, 由上文可得，对于SD2.0卡最大8192，最小 1
 			*(DWORD *)buff = 1; // 单位为 sector(FatFs)
--- a/mkrtos_user/server/fs/fatfs/static_ram_disk_drv/diskio.c
+++ b/mkrtos_user/server/fs/fatfs/static_ram_disk_drv/diskio.c
@@ -140,7 +140,7 @@ DRESULT disk_ioctl(
 			*(DWORD *)buff = ram_disk_sector_nr();
 			return RES_OK;
 		case GET_SECTOR_SIZE: // sector size, 传入block size(SD),单位bytes
-			*(DWORD *)buff = 512;
+			*(WORD *)buff = 512;
 			return RES_OK;
 		case GET_BLOCK_SIZE:	// block size, 由上文可得，对于SD2.0卡最大8192，最小 1
 			*(DWORD *)buff = 1; // 单位为 sector(FatFs)
--- a/mkrtos_user/server/init/src/ns.c
+++ b/mkrtos_user/server/init/src/ns.c
@@ -28,39 +28,63 @@
 #include "u_rpc_svr.h"
 #include "u_slist.h"
 #include "nsfs.h"
-
+#include "u_mutex.h"
 static ns_t ns;
 static fs_t ns_fs;

 static obj_handler_t ns_hd;
-
+static u_mutex_t ns_lock;
 static int fs_svr_open(const char *path, int flags, int mode)
 {
-    return fs_ns_open(path, flags, mode);
+    int ret;
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
+    ret = fs_ns_open(path, flags, mode);
+    u_mutex_unlock(&ns_lock);
+    return ret;
 }

 static int fs_svr_readdir(int fd, dirent_t *dir)
 {
-    return fs_ns_readdir(fd, dir);
+    int ret;
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
+    ret = fs_ns_readdir(fd, dir);
+    u_mutex_unlock(&ns_lock);
+    return ret;
 }
 static void fs_svr_close(int fd)
 {
+    u_mutex_lock(&ns_lock, 0, NULL);
    fs_ns_close(fd);
+    u_mutex_unlock(&ns_lock);
 }
 static int fs_svr_unlink(const char *path)
 {
-    return fs_ns_remove(path);
+    int ret;
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
+    ret = fs_ns_remove(path);
+    u_mutex_unlock(&ns_lock);
+    return ret;
 }
 static int fs_svr_mkdir(char *path)
 {
-    return fs_ns_mkdir(path);
+    int ret;
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
+    ret = fs_ns_mkdir(path);
+    u_mutex_unlock(&ns_lock);
+    return ret;
 }
 static int fs_svr_stat(const char *path, void *_buf)
 {
    struct kstat *buf = (struct kstat *)_buf;
    int ret;
-
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
    ret = fs_ns_stat(path, buf);
+    u_mutex_unlock(&ns_lock);
    return ret;
 }
 /**
@@ -91,7 +115,8 @@ int namespace_register(const char *path, obj_handler_t hd, int type)
    {
        return -EISDIR;
    }
-again:
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
    ret = ns_mknode(path, hd, NODE_TYPE_SVR);
    if (ret < 0)
    {
@@ -112,6 +137,7 @@ again:
        }
    }
 #endif
+    u_mutex_unlock(&ns_lock);
    return ret;
 }
 /**
@@ -125,7 +151,9 @@ int namespace_query(const char *path, obj_handler_t *hd)
 {
    int ret;

+    u_mutex_lock(&ns_lock, 0, NULL);
    ret = ns_find_svr_obj(path, hd);
+    u_mutex_unlock(&ns_lock);
    return ret;
 }
 /**
@@ -153,5 +181,6 @@ void namespace_init(obj_handler_t ipc_hd)
    thread_set_src_pid(0);
    ns_hd = ipc_hd;
    ns_root_node_init(ipc_hd);
+    assert(u_mutex_init(&ns_lock, handler_alloc()) >= 0);
    // printf("ns svr init...\n");
 }
--- a/mkrtos_user/server/init/src/nsfs/ns.c
+++ b/mkrtos_user/server/init/src/nsfs/ns.c
@@ -414,7 +414,9 @@ int ns_mknode(const char *path, obj_handler_t svr_hd, node_type_t type)
        return -ENOENT;
    }
    // 获得节点的名字
-    int name_len = ns_node_strcpy(name, path + p_inx + 1, NS_NODE_NAME_LEN);
+    // int name_len = 0;
+    
+    ns_node_strcpy(name, path + p_inx + 1, NS_NODE_NAME_LEN);

    new_node = node_create(name, NODE_TYPE_DUMMY);
    if (new_node == NULL)
--- a/mkrtos_user/server/init/src/parse_cfg.c
+++ b/mkrtos_user/server/init/src/parse_cfg.c
@@ -26,7 +26,7 @@
 #include <parse_cfg.h>
 #include <appfs_tiny.h>
 static char cmd_line[CMD_LEN];                              //!< 命令行
-static char cmd_params[CMD_PARAMS_CN][CMD_PARAMS_ITEM_LEN]; //!< 参数数组
+// static char cmd_params[CMD_PARAMS_CN][CMD_PARAMS_ITEM_LEN]; //!< 参数数组
 static int cmd_params_off[CMD_PARAMS_CN];                   //!< 参数偏移量
 static int cmd_params_num = 0;                              //!< 参数个数
 static u_mutex_t cmd_lock;                                  //!< 命令行锁
@@ -163,8 +163,8 @@ int parse_cfg(const char *parse_cfg_file_name, uenv_t *env)
                {
                    cmd_line[MIN(line_inx, sizeof(cmd_line)) - 1] = 0;
                }
-                pid_t pid;
-                int params_cn = 0;
+                pid_t pid = HANDLER_INVALID;
+                // int params_cn = 0;
                char *args[CMD_PARAMS_CN] = {
                    NULL,
                };
@@ -182,7 +182,7 @@ int parse_cfg(const char *parse_cfg_file_name, uenv_t *env)
                printf("parse_cfg cmd_params_num:%d\n", cmd_params_num);
                #endif
                int ret = app_load(cmd_line, env, &pid, args, cmd_params_num,
-                                   NULL, 0, mem_block);
+                                   NULL, 0, mem_block, FALSE);
                if (ret < 0)
                {
                    printf("%s load fail, 0x%x\n", cmd_line, ret);
--- a/mkrtos_user/server/init/src/parse_cfg.h
+++ b/mkrtos_user/server/init/src/parse_cfg.h
@@ -13,6 +13,7 @@
 #include <u_env.h>
 #define CMD_LEN 64                         //!< 命令行最大长度
 #define CMD_PARAMS_CN CONFIG_APP_PARAMS_NR //!< 参数个数
+#define CMD_ENVS_CN CONFIG_APP_ENV_NR
 #define CMD_PARAMS_ITEM_LEN 16             //!< 每个参数的最大长度
 void parse_cfg_init(void);
 int parse_cfg(const char *parse_cfg_file_name, uenv_t *env);
--- a/mkrtos_user/server/init/src/pm.c
+++ b/mkrtos_user/server/init/src/pm.c
@@ -136,7 +136,7 @@ int pm_rpc_watch_pid(pm_t *pm, obj_handler_t sig_rcv_hd, pid_t pid, int flags)
 #endif
    entry->sig_hd = sig_rcv_hd;
    entry->src_pid = src_pid; // 监控的pid
-    entry->watch_pid = pid; //被监控的pid
+    entry->watch_pid = pid;   // 被监控的pid
    entry->flags = flags;
    slist_init(&entry->node);
    slist_add_append(&pm->watch_head, &entry->node);
@@ -151,7 +151,7 @@ int pm_rpc_watch_pid(pm_t *pm, obj_handler_t sig_rcv_hd, pid_t pid, int flags)
 * @param pid
 * @return bool_t
 */
-static bool_t pm_send_sig_to_task(pm_t *pm, pid_t pid, umword_t sig_val)
+static void pm_send_sig_to_task(pm_t *pm, pid_t pid, umword_t sig_val)
 {
    ipc_msg_t *ipc;
    watch_entry_t *pos;
@@ -173,12 +173,13 @@ static bool_t pm_send_sig_to_task(pm_t *pm, pid_t pid, umword_t sig_val)
                ret = sig_kill(pos->sig_hd, sig_val, pid);
            }
            slist_del(&pos->node);
-            handler_free_umap(pos->sig_hd);   //!< 删除信号通知的ipc
+            handler_free_umap(pos->sig_hd); //!< 删除信号通知的ipc
            // handler_free_umap(pos->watch_pid); //!< 删除被watch的进程
            u_free(pos);
        }
        pos = next;
    }
+    return ;
 }
 #endif
 /**
@@ -200,19 +201,60 @@ int pm_rpc_kill_task(int src_pid, int pid, int flags, int exit_code)
        printf("pid is error.\n");
        return -EINVAL;
    }
-    // ns_node_del_by_pid(pid, flags); TODO:         //!< 从ns中删除
-    #if IS_ENABLED(CONFIG_USING_SIG)
+// ns_node_del_by_pid(pid, flags); TODO:         //!< 从ns中删除
+#if IS_ENABLED(CONFIG_USING_SIG)
    if (src_pid != pid)
    {
        // 发起者自己删除
        handler_del_umap(pid);
    }
    pm_send_sig_to_task(&pm, pid, KILL_SIG); //!< 给watch者发送sig
-    #endif
+#endif
    pm_del_watch_by_pid(&pm, pid); //!< 从watch中删除
    printf("[pm] kill pid:%d code:%d.\n", pid, exit_code);
    return 0;
 }
+#include "u_task.h"
+#include "u_factory.h"
+/**
+ * @return >0 pid <0 错误码
+ */
+static int pm_rpc_create_dummy_task(int mem_block, size_t app_size)
+{
+    obj_handler_t hd_task = handler_alloc();
+    msg_tag_t tag;
+    addr_t ram_base;
+
+    if (hd_task == HANDLER_INVALID)
+    {
+        goto end;
+    }
+    tag = factory_create_task(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, hd_task));
+    if (msg_tag_get_prot(tag) < 0)
+    {
+        goto end_del_obj;
+    }
+    tag = task_alloc_ram_base(hd_task, app_size,
+                              &ram_base, mem_block, (addr_t)NULL, 0);
+    if (msg_tag_get_prot(tag) < 0)
+    {
+        goto end_del_obj;
+    }
+    tag = task_set_pid(hd_task, hd_task); //!< 设置进程的pid就是进程hd号码
+    if (msg_tag_get_prot(tag) < 0)
+    {
+        goto end_del_obj;
+    }
+    printf("dummy task pid:%d addr:0x%x\n\n", hd_task, ram_base);
+    return hd_task;
+end_del_obj:
+    if (hd_task != HANDLER_INVALID)
+    {
+        task_unmap(TASK_THIS, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, hd_task));
+    }
+end:
+    return -ENOMEM;
+}
 /**
 * @brief 运行一个新的app
 *
@@ -220,25 +262,42 @@ int pm_rpc_kill_task(int src_pid, int pid, int flags, int exit_code)
 * @param flags
 * @return int
 */
-int pm_rpc_run_app(const char *path, int mem_block, char *params, int params_len, char *envs_in, int envs_in_len)
+int pm_rpc_run_app(const char *path, pm_flags_t pm_flags, char *params, int params_len_or_app_size,
+                   char *envs_in, int envs_in_len)
 {
-    pid_t pid;
+    pid_t pid = HANDLER_INVALID;
    int ret;
    int i;
    int j = 0;
    int args_len = 0;
    int evns_len = 0;
+
+    if (pm_flags.flags & PM_CREATE_DUMMY_TASK)
+    {
+        return pm_rpc_create_dummy_task(pm_flags.mem_block, params_len_or_app_size);
+    }
+    int obj_type;
+    if (msg_tag_get_val(task_obj_valid(TASK_THIS, pm_flags.pid, &obj_type)) != 1)
+    {
+        pid = HANDLER_INVALID;
+    }
+    else if (obj_type != TASK_TYPE)
+    {
+        pid = HANDLER_INVALID;
+    }
+    else
+    {
+        pid = pm_flags.pid;
+    }
    printf("pm run %s.\n", path);
    char *args[CMD_PARAMS_CN] = {
        (char *)path,
    };
-    char *envs[8/*FIXME:*/] = {
-    };
-
+    char *envs[CMD_ENVS_CN] = {};

    for (i = 1, j = 0; *params && i < CMD_PARAMS_CN; i++)
    {
-        if (j >= params_len)
+        if (j >= params_len_or_app_size)
        {
            break;
        }
@@ -249,7 +308,7 @@ int pm_rpc_run_app(const char *path, int mem_block, char *params, int params_len
    }
    args_len = i;

-    for (i = 0, j = 0; *envs_in && i < CMD_PARAMS_CN; i++)
+    for (i = 0, j = 0; *envs_in && i < CMD_ENVS_CN; i++)
    {
        if (j >= envs_in_len)
        {
@@ -263,7 +322,8 @@ int pm_rpc_run_app(const char *path, int mem_block, char *params, int params_len
    evns_len = i;

    ret = app_load(path, u_get_global_env(), &pid, args, args_len,
-                   envs, evns_len,  mem_block);
+                   envs, evns_len, pm_flags.mem_block,
+                   !!(pm_flags.flags & PM_USE_LOAD_TO_RAM));
    if (ret >= 0)
    {
        return pid;
--- a/mkrtos_user/server/init/src/test/log_test.c
+++ b/mkrtos_user/server/init/src/test/log_test.c
@@ -6,10 +6,10 @@

 static void ulog_test(CuTest *tc)
 {
-    uint8_t data[10];
-
+    
    ulog_write_str(LOG_PROT, "Please key..\n");
-#if 0
+    #if 0
+    uint8_t data[10];
    int len = ulog_read_bytes(LOG_PROT, data, sizeof(data) - 1);
    if (len > 0)
    {
--- a/mkrtos_user/server/init/src/test/pthread_cond_lock_test.c
+++ b/mkrtos_user/server/init/src/test/pthread_cond_lock_test.c
@@ -23,6 +23,7 @@ static void *thread_signal(void *arg)
        pthread_mutex_unlock(&mutex);
        sleep(1);
    }
+    return NULL;
 }

 static void *thread_wait(void *arg)
@@ -41,6 +42,7 @@ static void *thread_wait(void *arg)
        pthread_mutex_unlock(&mutex);
        sleep(1);
    }
+    return NULL;
 }

 static pthread_t tid1;
--- a/Show More
+++ b/Show More