diff --git a/.vscode/settings.json b/.vscode/settings.json
index 42077ea02..d117e934f 100755
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -221,7 +221,8 @@
         "endian.h": "c",
         "ipc.h": "c",
         "stdarg.h": "c",
-        "ipcstat.h": "c"
+        "ipcstat.h": "c",
+        "fs_cli.h": "c"
     },
     "cortex-debug.showRTOS": false,
     "cortex-debug.variableUseNaturalFormat": true,
diff --git a/TODO.md b/TODO.md
index 66bb1a5c5..fb5278840 100644
--- a/TODO.md
+++ b/TODO.md
@@ -27,6 +27,7 @@
 * [ ] posix sig支持
 * [ ] posix shm支持
 * [ ] posix sema支持
+* [ ] posix 信号支持
 * [ ] 几大组件稳定性测试
 * [ ] 内核代码review
 ### mid prio
diff --git a/armv7_8.cmake b/armv7_8.cmake
index 268ae3b6b..48f2fdf50 100644
--- a/armv7_8.cmake
+++ b/armv7_8.cmake
@@ -1,21 +1,22 @@
 message("========use armv7_8.cmake")
 
-set(CMAKE_C_FLAGS "-mcpu=${CONFIG_ARCH} -O0 -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb  -DMKRTOS \
--std=gnu11 -ffunction-sections -fdata-sections -fno-builtin -u=_printf_float \
+set(CMAKE_C_FLAGS "-mcpu=${CONFIG_ARCH} -Ofast -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb  -DMKRTOS \
+-std=gnu11 -ffunction-sections -fdata-sections -fno-builtin -u=_printf_float -Wall \
 -nostartfiles -nodefaultlibs -nostdlib -nostdinc \
--fno-stack-protector -Wl,--gc-section -D__ARM_ARCH_7M__ \
+-fno-stack-protector -Wno-unused-but-set-variable -Wno-unused-function -Wno-parentheses -Wno-volatile-register-var -Wno-unused-variable -Wno-maybe-uninitialized\
+-Wl,--gc-section -D__ARM_ARCH_7M__ -Werror \
 -include ${CMAKE_SOURCE_DIR}/build/autoconf.h \
 " CACHE STRING "" FORCE)
 
-set(CMAKE_CXX_FLAGS "-mcpu=${CONFIG_ARCH} -O0 -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb -DMKRTOS -std=c++11 \
--fmessage-length=0 -Xlinker --print-map -Wall -W -fno-stack-protector \ 
+set(CMAKE_CXX_FLAGS "-mcpu=${CONFIG_ARCH} -Ofast -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb -DMKRTOS -std=c++11 \
+-fmessage-length=0 -Xlinker --print-map -Wall -W -fno-stack-protector -Wall \ 
  -u=_printf_float  -D__ARM_ARCH_7M__  \
 -ffunction-sections -fdata-sections -fno-builtin -nostartfiles -nodefaultlibs -nostdlib -nostdinc -Xlinker \
 -include ${CMAKE_SOURCE_DIR}/build/autoconf.h \
 " CACHE STRING "" FORCE)
 
-set(CMAKE_ASM_FLAGS "-mcpu=${CONFIG_ARCH} -O0 -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb -DMKRTOS \
--u=_printf_float -std=gnu11 -ffunction-sections -fdata-sections -fno-builtin \
+set(CMAKE_ASM_FLAGS "-mcpu=${CONFIG_ARCH} -Ofast -g3 -mfloat-abi=${CONFIG_FLOAT_TYPE} -mthumb -DMKRTOS \
+-u=_printf_float -std=gnu11 -ffunction-sections -fdata-sections -fno-builtin -Wall \
 -nostartfiles -nodefaultlibs -nostdlib -nostdinc -Xlinker  -fno-stack-protector  -D__ARM_ARCH_7M__ \
 -include ${CMAKE_SOURCE_DIR}/build/autoconf.h \
 " CACHE STRING "" FORCE)
diff --git a/mkrtos_bootstrap/CMakeLists.txt b/mkrtos_bootstrap/CMakeLists.txt
index 9b36894f3..375029bf2 100755
--- a/mkrtos_bootstrap/CMakeLists.txt
+++ b/mkrtos_bootstrap/CMakeLists.txt
@@ -8,6 +8,7 @@ set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} \
 -Wno-unused-function \
 -Wno-unused-variable \
 -Wno-deprecated \
+-Wno-unused-but-set-variable \
 ")
 
 include_directories(${CMAKE_SOURCE_DIR}/)
diff --git a/mkrtos_bootstrap/bsp/STM32F2/system_stm32f2xx.c b/mkrtos_bootstrap/bsp/STM32F2/system_stm32f2xx.c
index cdc57fbd6..f6d00d4a5 100644
--- a/mkrtos_bootstrap/bsp/STM32F2/system_stm32f2xx.c
+++ b/mkrtos_bootstrap/bsp/STM32F2/system_stm32f2xx.c
@@ -392,8 +392,6 @@ static void SetSysClock(void)
 
     /* Wait till the main PLL is used as system clock source */
     while ((RCC->CFGR & (uint32_t)RCC_CFGR_SWS ) != RCC_CFGR_SWS_PLL);
-    {
-    }
   }
   else
   { /* If HSE fails to start-up, the application will have wrong clock
diff --git a/mkrtos_knl/arch/cortex-m/CmBacktrace/cm_backtrace/cm_backtrace.c b/mkrtos_knl/arch/cortex-m/CmBacktrace/cm_backtrace/cm_backtrace.c
index 5088e1115..3231ee27e 100644
--- a/mkrtos_knl/arch/cortex-m/CmBacktrace/cm_backtrace/cm_backtrace.c
+++ b/mkrtos_knl/arch/cortex-m/CmBacktrace/cm_backtrace/cm_backtrace.c
@@ -470,7 +470,7 @@ static void print_call_stack(uint32_t sp)
 
     if (cur_depth)
     {
-        cmb_println(print_info[PRINT_CALL_STACK_INFO], fw_name, CMB_ELF_FILE_EXTENSION_NAME, cur_depth * (8 + 1),
+        cmb_println(print_info[PRINT_CALL_STACK_INFO], kobject_get_name(&thread_get_current_task()->kobj), CMB_ELF_FILE_EXTENSION_NAME, cur_depth * (8 + 1),
                     call_stack_info);
     }
     else
diff --git a/mkrtos_knl/arch/cortex-m/stm32f2/arch.c b/mkrtos_knl/arch/cortex-m/stm32f2/arch.c
index c39afc8b5..686eeb0f6 100644
--- a/mkrtos_knl/arch/cortex-m/stm32f2/arch.c
+++ b/mkrtos_knl/arch/cortex-m/stm32f2/arch.c
@@ -117,7 +117,7 @@ void arch_init(void)
     SCB->SHCSR |= SCB_SHCSR_BUSFAULTENA_Msk;
     ((uint8_t *)(0xE000E008))[0] |= 0x6;
 
-    cm_backtrace_init("CmBacktrace", HARDWARE_VERSION, SOFTWARE_VERSION);
+    cm_backtrace_init("mkrtos", HARDWARE_VERSION, SOFTWARE_VERSION);
 
     // RCC_ClocksTypeDef RCC_ClocksStatus;
     // RCC_GetClocksFreq(&RCC_ClocksStatus);
diff --git a/mkrtos_knl/inc/knl/printk.h b/mkrtos_knl/inc/knl/printk.h
index 07e2bc0af..44839797e 100755
--- a/mkrtos_knl/inc/knl/printk.h
+++ b/mkrtos_knl/inc/knl/printk.h
@@ -25,6 +25,7 @@ void putc(int c);
  * @return int
  */
 int getc(void);
+void put_bytes(const uint8_t *data, size_t len);
 /**
  * @brief 打印内核信息
  *
diff --git a/mkrtos_knl/inc/knl/sleep.h b/mkrtos_knl/inc/knl/sleep.h
index 31d5c1317..e17aa89c9 100644
--- a/mkrtos_knl/inc/knl/sleep.h
+++ b/mkrtos_knl/inc/knl/sleep.h
@@ -1,4 +1,4 @@
-#pragma
+#pragma once
 
 #include "thread.h"
 typedef struct thread_wait_entry
diff --git a/mkrtos_knl/inc/lib/xprintf.h b/mkrtos_knl/inc/lib/xprintf.h
index 885ef8a6f..7d9f0ce15 100755
--- a/mkrtos_knl/inc/lib/xprintf.h
+++ b/mkrtos_knl/inc/lib/xprintf.h
@@ -11,7 +11,7 @@ extern "C"
 #endif
 #include "stdarg.h"
 #define XF_USE_OUTPUT 1 /* 1: Enable output functions */
-#define XF_CRLF 1       /* 1: Convert \n ==> \r\n in the output char */
+#define XF_CRLF 0       /* 1: Convert \n ==> \r\n in the output char */
 #define XF_USE_DUMP 0   /* 1: Enable put_dump function */
 #define XF_USE_LLI 0    /* 1: Enable long long integer in size prefix ll */
 #define XF_USE_FP 0     /* 1: Enable support for floating point in type e and f */
diff --git a/mkrtos_knl/knl/access.c b/mkrtos_knl/knl/access.c
index 4c206cd47..429af87c8 100644
--- a/mkrtos_knl/knl/access.c
+++ b/mkrtos_knl/knl/access.c
@@ -15,7 +15,7 @@
 #include <util.h>
 /**
  * @brief 检测内存是否可访问
- *
+ * TODO: 需要检查动态申请的内存
  * @param tg_task 目标进程
  * @param addr 开始地址
  * @param size 大小
diff --git a/mkrtos_knl/knl/futex.c b/mkrtos_knl/knl/futex.c
index 78efedff9..fc47d025c 100644
--- a/mkrtos_knl/knl/futex.c
+++ b/mkrtos_knl/knl/futex.c
@@ -518,7 +518,7 @@ static int futex_lock_pi(thread_t *cur_th, futex_t *fst, uint32_t *uaddr, uint32
         spinlock_set(&fst->kobj.lock, status);
         return -EACCES;
     }
-    if (*paddr = 0)
+    if ((*paddr) == 0)
     {
         *paddr = tid;
     }
diff --git a/mkrtos_knl/knl/log.c b/mkrtos_knl/knl/log.c
index c53a5d011..65fc3de7f 100755
--- a/mkrtos_knl/knl/log.c
+++ b/mkrtos_knl/knl/log.c
@@ -56,19 +56,10 @@ static void log_reg(void)
 INIT_KOBJ(log_reg);
 static msg_tag_t log_write_data(log_t *log, const char *data, int len)
 {
-    for (int i = 0; i < len && data[i]; i++)
-    {
-#if 1
-        if (data[i] == '\n')
-        {
-            putc('\r');
-        }
-#endif
-        putc(data[i]);
-    }
+    put_bytes((const uint8_t *)data, len);
     return msg_tag_init(0);
 }
-static int log_read_data(log_t *log, uint8_t *data, int len)
+static int log_read_data(log_t *log, uint8_t *data, int len, int flags)
 {
     for (int i = 0; i < len; i++)
     {
@@ -77,7 +68,7 @@ static int log_read_data(log_t *log, uint8_t *data, int len)
 
         if (c < 0 && i == 0)
         {
-            int ret = irq_sender_wait(&log->kobj, thread_get_current(), 0);
+            int ret = irq_sender_wait(&log->kobj, thread_get_current(), flags);
             if (ret < 0)
             {
                 return ret;
@@ -108,7 +99,7 @@ log_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame
             break;
         case READ_DATA:
         {
-            int ret = log_read_data((log_t *)kobj, (uint8_t *)(&f->regs[1]), MIN(f->regs[1], WORD_BYTES * 3));
+            int ret = log_read_data((log_t *)kobj, (uint8_t *)(&f->regs[1]), MIN(f->regs[1], WORD_BYTES * 3), f->regs[2]);
             tag = msg_tag_init4(0, 0, 0, ret);
         }
         break;
diff --git a/mkrtos_knl/knl/map.c b/mkrtos_knl/knl/map.c
index 9e91470a0..3ecb68762 100755
--- a/mkrtos_knl/knl/map.c
+++ b/mkrtos_knl/knl/map.c
@@ -66,6 +66,7 @@ int obj_map_src_dst(obj_space_t *dst_space, obj_space_t *src_space,
     if (obj_space_lookup_kobj(dst_space, dst_inx))
     { //!< 已经存在则解除注释
         obj_unmap(dst_space, vpage_create3(0, 0, dst_inx), del_list);
+        printk("unmap:%d \n", dst_inx);
     }
 
     return obj_map(dst_space, dst_inx, obj_map_entry_kobj_get(entry_obj),
diff --git a/mkrtos_knl/knl/mm.c b/mkrtos_knl/knl/mm.c
index 73f446370..90d604d12 100755
--- a/mkrtos_knl/knl/mm.c
+++ b/mkrtos_knl/knl/mm.c
@@ -191,7 +191,6 @@ void mem_free_align(mem_t *_this, void *f_mem)
 {
     struct mem_heap *mem;
     umword_t *real_mem;
-    int find = 0;
 
     umword_t status = spinlock_lock(&_this->lock);
     for (mem = _this->heap_start; mem != _this->heap_end; mem = mem->next)
@@ -199,7 +198,6 @@ void mem_free_align(mem_t *_this, void *f_mem)
         assert(mem->magic == MAGIC_NUM);
         if ((ptr_t)mem == (ptr_t)f_mem - MEM_HEAP_STRUCT_SIZE)
         {
-            find = 1;
             break;
         }
     }
diff --git a/mkrtos_knl/knl/mm/mpu/vma.c b/mkrtos_knl/knl/mm/mpu/vma.c
index e950c6422..69f7e0105 100644
--- a/mkrtos_knl/knl/mm/mpu/vma.c
+++ b/mkrtos_knl/knl/mm/mpu/vma.c
@@ -294,6 +294,7 @@ int task_vma_alloc(task_vma_t *task_vma, vma_addr_t vaddr, size_t size,
     int ret = 0;
     size_t mem_align_size;
     bool_t is_alloc_mem = FALSE;
+    mword_t status = -1;
 
     pt_task = container_of(
         container_of(task_vma, mm_space_t, mem_vma),
@@ -321,7 +322,7 @@ int task_vma_alloc(task_vma_t *task_vma, vma_addr_t vaddr, size_t size,
         ret = -EINVAL;
         goto err_end;
     }
-    mword_t status = task_vma_lock(task_vma);
+    status = task_vma_lock(task_vma);
 
     if (paddr == 0)
     {
@@ -410,7 +411,10 @@ err_end:
         mm_limit_free_align(pt_task->lim, (void *)vma_addr, mem_align_size);
     }
 end:
-    task_vma_unlock(task_vma, status);
+    if (status >= 0)
+    {
+        task_vma_unlock(task_vma, status);
+    }
     return ret;
 }
 /**
@@ -456,9 +460,6 @@ static int vma_idl_tree_eq_cmp_handler(const void *key, const void *data)
         return 1;
     }
 }
-static inline int task_vma_addr_check(vaddr_t addr, size_t size)
-{
-}
 static int task_vma_free_inner(task_vma_t *task_vma, vaddr_t vaddr, size_t size, bool_t is_free_mem)
 {
     addr_t vma_addr;
@@ -535,7 +536,7 @@ end:
         mpu_switch_to_task(pt_task);
     }
     task_vma_unlock(task_vma, status);
-    return 0;
+    return ret;
 }
 /**
  * @brief 释放申请的虚拟内存，并释放已经申请的物理内存
@@ -700,7 +701,7 @@ int task_vma_clean(task_vma_t *task_vma)
         .tree = &task_vma->alloc_tree,
     }; // 删除所有的节点
     ret = mln_rbtree_iterate(&task_vma->alloc_tree, rbtree_iterate_handler_delete, &params);
-    return 0;
+    return ret;
 }
 
 #if IS_ENABLED(CONFIG_MPU)
diff --git a/mkrtos_knl/knl/printk.c b/mkrtos_knl/knl/printk.c
index 7d93da7c5..2488bd144 100755
--- a/mkrtos_knl/knl/printk.c
+++ b/mkrtos_knl/knl/printk.c
@@ -39,6 +39,18 @@ void putc(int c)
 {
     uart_putc(uart_get_global(), c);
 }
+void put_bytes(const uint8_t *data, size_t len)
+{
+    umword_t state = 0;
+    state = spinlock_lock(&lock);
+
+    for (int i = 0; i < len; i++)
+    {
+        uart_putc(uart_get_global(), data[i]);
+    }
+
+    spinlock_set(&lock, state);
+}
 int getc(void)
 {
     return uart_getc(uart_get_global());
diff --git a/mkrtos_knl/knl/sema.c b/mkrtos_knl/knl/sema.c
index e867468a1..215fe1877 100644
--- a/mkrtos_knl/knl/sema.c
+++ b/mkrtos_knl/knl/sema.c
@@ -48,7 +48,6 @@ void sema_up(sema_t *obj)
     thread_t *th = thread_get_current();
 
     ref_counter_inc(&obj->ref);
-again:
     status = spinlock_lock(&obj->lock);
     if (slist_is_empty(&obj->suspend_head))
     {
diff --git a/mkrtos_knl/knl/share_mem.c b/mkrtos_knl/knl/share_mem.c
index d5b3906cf..1a80578c7 100644
--- a/mkrtos_knl/knl/share_mem.c
+++ b/mkrtos_knl/knl/share_mem.c
@@ -453,7 +453,7 @@ static void share_mem_unmap_op(task_t *tk, share_mem_t *sm)
 }
 static void share_mem_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f)
 {
-    ssize_t ret;
+    ssize_t ret = 0;
     msg_tag_t tag = msg_tag_init4(0, 0, 0, -EINVAL);
     task_t *task = thread_get_current_task();
     share_mem_t *sm = container_of(kobj, share_mem_t, kobj);
diff --git a/mkrtos_knl/knl/task.c b/mkrtos_knl/knl/task.c
index 837656f8c..63caf89c7 100755
--- a/mkrtos_knl/knl/task.c
+++ b/mkrtos_knl/knl/task.c
@@ -35,6 +35,7 @@ enum task_op_code
     TASK_OBJ_MAP,        //!< 进行映射操作
     TASK_OBJ_UNMAP,      //!< 进行解除映射操作
     TASK_ALLOC_RAM_BASE, //!< 分配task的基础内存
+    TASK_GET_RAM_INFO,   //!< 获取task的ram信息
     TASK_OBJ_VALID,      //!< 判断一个对象是否有效
     TASK_SET_PID,        //!< 设置task的pid
     TASK_GET_PID,        //!< 获取task的pid
@@ -120,10 +121,12 @@ static void task_unlock_2(spinlock_t *sp0, spinlock_t *sp1, int status0, int sta
         spinlock_set(sp1, status1);
         spinlock_set(sp0, status0);
     }
-    else
+    else if (sp0 > sp1)
     {
         spinlock_set(sp0, status0);
         spinlock_set(sp1, status1);
+    } else {
+        spinlock_set(sp0, status0);
     }
 }
 /**
@@ -155,7 +158,7 @@ static int task_lock_2(spinlock_t *sp0, spinlock_t *sp1, int *st0, int *st1)
         *st0 = status0;
         *st1 = status1;
     }
-    else
+    else if (sp0 > sp1)
     {
         status0 = spinlock_lock(sp1);
         if (status0 < 0)
@@ -170,6 +173,14 @@ static int task_lock_2(spinlock_t *sp0, spinlock_t *sp1, int *st0, int *st1)
         }
         *st0 = status1;
         *st1 = status0;
+    } else {
+        status0 = spinlock_lock(sp0);
+        if (status0 < 0)
+        {
+            return FALSE;
+        }
+        *st0 = status0;
+        *st1 = status0;
     }
     return TRUE;
 }
@@ -315,6 +326,19 @@ static void task_syscall_func(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t i
         spinlock_set(&tag_task->kobj.lock, status);
     }
     break;
+    case TASK_GET_RAM_INFO:
+    {
+        mword_t status = spinlock_lock(&tag_task->kobj.lock);
+        if (status < 0)
+        {
+            tag = msg_tag_init4(0, 0, 0, -EINVAL);
+            break;
+        }
+        mm_space_get_ram_block(&tag_task->mm_space, (void**)(&f->regs[1]), (size_t *)(&f->regs[2]));
+        spinlock_set(&tag_task->kobj.lock, status);
+        tag = msg_tag_init4(0, 0, 0, 0);
+    }
+    break;
 #endif
     case TASK_COPY_DATA: //!< 拷贝数据到task的内存区域
     {
@@ -371,7 +395,7 @@ static void task_syscall_func(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t i
         if (!source_kobj)
         {
             ret = -EINVAL;
-            goto copy_data_to_end;
+            goto copy_data_to_end2;
         }
         task_t *dst_task_obj = container_of(source_kobj, task_t, kobj);
 
@@ -381,11 +405,13 @@ static void task_syscall_func(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t i
             tag = msg_tag_init4(0, 0, 0, -EINVAL);
             break;
         }
+        #if 0/*TODO: 需要检查动态申请的内存*/
         if (!is_rw_access(tag_task, (void *)src_addr, copy_len, FALSE))
         {
             ret = -EPERM;
             goto copy_data_to_end;
         }
+        #endif
         if (!is_rw_access(dst_task_obj, (void *)dst_addr, copy_len, FALSE))
         {
             ret = -EPERM;
@@ -399,6 +425,7 @@ static void task_syscall_func(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t i
 
     copy_data_to_end:
         task_unlock_2(&tag_task->kobj.lock, &dst_task_obj->kobj.lock, st0, st1);
+    copy_data_to_end2:
         tag = msg_tag_init4(0, 0, 0, ret);
     }
     break;
@@ -524,6 +551,8 @@ static void task_release_stage1(kobject_t *kobj)
             pf_t *cur_pf = ((pf_t *)((char *)restore_th + CONFIG_THREAD_BLOCK_SIZE + 8)) - 1;
             cur_pf->regs[5] = (umword_t)(thread_get_bind_task(restore_th)->mm_space.mm_block);
             ref_counter_dec_and_release(&tk->ref_cn, &tk->kobj);
+        } else {
+            break;
         }
     }
 
diff --git a/mkrtos_knl/knl/thread.c b/mkrtos_knl/knl/thread.c
index 5f7e96bf6..a3a05bc10 100755
--- a/mkrtos_knl/knl/thread.c
+++ b/mkrtos_knl/knl/thread.c
@@ -138,6 +138,7 @@ void thread_init(thread_t *th, ram_limit_t *lim, umword_t flags)
     ref_counter_inc(&th->ref);
     thread_arch_init(th, flags);
 
+    kobject_set_name(&th->kobj, kobject_get_name(&th->kobj));
     slist_init(&th->com->fast_ipc_node);
     stack_init(&th->com->fast_ipc_stack, &th->com->fast_ipc_stack_data,
                ARRARY_LEN(th->com->fast_ipc_stack_data),
@@ -470,176 +471,6 @@ thread_t *thread_create(ram_limit_t *ram, umword_t flags)
     printk("create thread 0x%x\n", th);
     return th;
 }
-#if 0
-/**
- * @brief 线程超时检查
- *
- * @param tick
- */
-void thread_timeout_check(ssize_t tick)
-{
-    thread_wait_entry_t *pos;
-    slist_head_t *head =
-        (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_send_queue);
-
-    slist_foreach_not_next(pos, head, node_timeout)
-    {
-        if (pos->th->status != THREAD_SUSPEND)
-        {
-            printk("%s:%d th_name:%s.\n", __func__, __LINE__, pos->th->kobj.dbg.name);
-        }
-        assert(pos->th->status == THREAD_SUSPEND);
-        thread_wait_entry_t *next = slist_next_entry(
-            pos, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_send_queue),
-            node_timeout);
-        if (pos->times > 0)
-        {
-            pos->times -= tick;
-            if (pos->times <= 0)
-            {
-                pos->th->ipc_status = THREAD_TIMEOUT;
-
-                slist_del(&pos->node_timeout);
-                if (slist_in_list(&pos->node))
-                {
-                    slist_del(&pos->node);
-                }
-                // printk("send timeout:0x%lx\n", pos->th);
-                thread_ready(pos->th, TRUE);
-            }
-        }
-        pos = next;
-    }
-
-    thread_wait_entry_t *pos2;
-    slist_foreach_not_next(
-        pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_recv_queue),
-        node)
-    {
-        assert(pos2->th->status == THREAD_SUSPEND);
-        thread_wait_entry_t *next = slist_next_entry(
-            pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_recv_queue),
-            node);
-
-        if (pos2->times > 0)
-        {
-            pos2->times -= tick;
-            if (pos2->times <= 0)
-            {
-                pos2->th->ipc_status = THREAD_TIMEOUT;
-                assert(slist_in_list(&pos2->node));
-                slist_del(&pos2->node);
-                // printk("recv timeout:0x%lx\n", pos2->th);
-                thread_ready(pos2->th, TRUE);
-            }
-        }
-        pos2 = next;
-    }
-}
-static void thread_timeout_del_form_send_queue(thread_t *th)
-{
-    thread_wait_entry_t *pos2;
-    assert(th->cpu == arch_get_current_cpu_id());
-
-    slist_foreach_not_next(
-        pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_send_queue),
-        node_timeout)
-    {
-        thread_wait_entry_t *next = slist_next_entry(
-            pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_send_queue),
-            node_timeout);
-
-        if (pos2->th == th)
-        {
-            slist_del(&pos2->node_timeout);
-            if (slist_in_list(&pos2->node))
-            {
-                slist_del(&pos2->node);
-            }
-            break;
-        }
-        pos2 = next;
-    }
-}
-#if IS_ENABLED(CONFIG_SMP)
-static int thread_timeout_del_form_send_queue_handler(ipi_msg_t *msg, bool_t *is_sched)
-{
-    thread_timeout_del_form_send_queue((void *)(msg->msg));
-    thread_ready((void *)(msg->msg), TRUE); //!< 直接唤醒接受者
-    return 0;
-}
-#endif
-void thread_timeout_del_from_send_queue_remote(thread_t *th)
-{
-#if IS_ENABLED(CONFIG_SMP)
-    if (th->cpu == arch_get_current_cpu_id())
-    {
-        thread_timeout_del_form_send_queue(th);
-        thread_ready(th, TRUE); //!< 直接唤醒接受者
-    }
-    else
-    {
-        thread_t *cur_th = thread_get_current();
-        cur_th->ipi_msg_node.msg = (umword_t)th;
-        cur_th->ipi_msg_node.cb = thread_timeout_del_form_send_queue_handler;
-        cpu_ipi_to_msg(1 << th->cpu, &cur_th->ipi_msg_node, IPI_CALL);
-    }
-#else
-    thread_timeout_del_form_send_queue(th);
-    thread_ready(th, TRUE); //!< 直接唤醒接受者
-#endif
-}
-static void thread_timeout_del_recv(thread_t *th)
-{
-    thread_wait_entry_t *pos2;
-    assert(th->cpu == arch_get_current_cpu_id());
-
-    slist_foreach_not_next(
-        pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_recv_queue),
-        node)
-    {
-        thread_wait_entry_t *next = slist_next_entry(
-            pos2, (slist_head_t *)pre_cpu_get_current_cpu_var(&wait_recv_queue),
-            node);
-
-        if (pos2->th == th)
-        {
-            slist_del(&pos2->node);
-            break;
-        }
-        pos2 = next;
-    }
-}
-#if IS_ENABLED(CONFIG_SMP)
-static int thread_timeout_del_recv_remote_handler(ipi_msg_t *msg, bool_t *is_sched)
-{
-    thread_t *th = (void *)(msg->msg);
-    thread_timeout_del_recv(th);
-    thread_ready(th, TRUE); //!< 直接唤醒接受者
-    return 0;
-}
-#endif
-void thread_timeout_del_recv_remote(thread_t *th, bool_t is_sche)
-{
-#if IS_ENABLED(CONFIG_SMP)
-    if (th->cpu == arch_get_current_cpu_id())
-    {
-        thread_timeout_del_recv(th);
-        thread_ready(th, is_sche); //!< 直接唤醒接受者
-    }
-    else
-    {
-        thread_t *cur_th = thread_get_current();
-        cur_th->ipi_msg_node.msg = (umword_t)th;
-        cur_th->ipi_msg_node.cb = thread_timeout_del_recv_remote_handler;
-        cpu_ipi_to_msg(1 << th->cpu, &cur_th->ipi_msg_node, IPI_CALL);
-    }
-#else
-    thread_timeout_del_recv(th);
-    thread_ready(th, is_sche); //!< 直接唤醒接受者
-#endif
-}
-#endif
 
 static int ipc_dat_copy_raw(obj_space_t *dst_obj, obj_space_t *src_obj, ram_limit_t *lim,
                             ipc_msg_t *dst_ipc, ipc_msg_t *src_ipc, msg_tag_t tag, int is_reply)
@@ -1362,58 +1193,6 @@ msg_tag_t thread_do_ipc(kobject_t *kobj, entry_frame_t *f, umword_t user_id)
         return thread_fast_ipc_call(to_tk, f, user_id);
     }
     break;
-#if 0
-    case IPC_CALL:
-    {
-        msg_tag_t in_tag = msg_tag_init(f->regs[0]);
-        msg_tag_t recv_tag;
-        th_hd = f->regs[2];
-        ipc_timeout_t ipc_tm_out = ipc_timeout_create(f->regs[3]);
-
-        to_th->user_id = user_id;
-        ret = thread_ipc_call(to_th, in_tag, &recv_tag, ipc_tm_out, &f->regs[1],
-                              TRUE);
-        if (ret < 0)
-        {
-            return msg_tag_init4(0, 0, 0, ret);
-        }
-        return recv_tag;
-    }
-    case IPC_REPLY:
-    {
-        msg_tag_t in_tag = msg_tag_init(f->regs[0]);
-
-        ret = thread_ipc_reply(in_tag);
-        return msg_tag_init4(0, 0, 0, ret);
-    }
-    case IPC_RECV:
-    case IPC_WAIT:
-    {
-        msg_tag_t ret_msg;
-        ipc_timeout_t ipc_tm_out = ipc_timeout_create(f->regs[3]);
-        kobject_t *ipc_kobj = obj_space_lookup_kobj_cmp_type(
-            &cur_task->obj_space, f->regs[4], IPC_TYPE);
-
-        int ret = thread_ipc_recv(&ret_msg, ipc_tm_out, &f->regs[1],
-                                  (ipc_t *)ipc_kobj, NULL);
-        if (ret < 0)
-        {
-            return msg_tag_init4(0, 0, 0, ret);
-        }
-        return ret_msg;
-    }
-    case IPC_SEND:
-    {
-        msg_tag_t in_tag = msg_tag_init(f->regs[0]);
-        msg_tag_t recv_tag;
-        // th_hd = f->regs[2];
-        ipc_timeout_t ipc_tm_out = ipc_timeout_create(f->regs[3]);
-
-        to_th->user_id = user_id;
-        ret = thread_ipc_call(to_th, in_tag, NULL, ipc_tm_out, NULL, FALSE);
-        return msg_tag_init4(0, 0, 0, ret);
-    }
-#endif
     default:
         ret = -ENOSYS;
         break;
@@ -1611,6 +1390,7 @@ static void thread_syscall(kobject_t *kobj, syscall_prot_t sys_p,
                 (tge_prio >= PRIO_MAX ? PRIO_MAX - 1 : tge_prio);
             thread_ready(tag_th, TRUE);
         }
+        goto run_thread_end;
 #endif
     run_thread_end:
         cpulock_set(status);
diff --git a/mkrtos_knl/knl/thread_knl.c b/mkrtos_knl/knl/thread_knl.c
index ad7f08cab..f0f96be4b 100755
--- a/mkrtos_knl/knl/thread_knl.c
+++ b/mkrtos_knl/knl/thread_knl.c
@@ -48,8 +48,8 @@ static task_t knl_task;
 static thread_t *init_thread;
 static task_t *init_task;
 static thread_t *knl_thread[CONFIG_CPU];
-static slist_head_t del_task_head; //!<链表中是需要被删除的进程
-static slist_head_t del_thread_head;//!<链表中是需要被释放内存的线程
+static slist_head_t del_task_head;   //!< 链表中是需要被删除的进程
+static slist_head_t del_thread_head; //!< 链表中是需要被释放内存的线程
 static umword_t cpu_usage[CONFIG_CPU];
 static spinlock_t del_lock;
 static umword_t cpu_usage_last_tick_val[CONFIG_CPU];
@@ -63,19 +63,15 @@ static void knl_release_thread(void)
     if (slist_is_empty(&del_thread_head))
     {
         spinlock_set(&del_lock, status2);
-        return ;
+        return;
     }
     slist_foreach_not_next(pos, &del_thread_head, release_node)
     {
         thread_t *next = slist_next_entry(pos, &del_thread_head, release_node);
-        int ret;
 
         // printk("+++++release th:0x%x\n", pos);
-        ret = ref_counter_dec_and_release(&pos->ref, &pos->kobj);
-        // if (ret == 1)
-        // {
-            // printk("------release th:0x%x\n", pos);
-        // }
+        ref_counter_dec_and_release(&pos->ref, &pos->kobj);
+        // printk("------release th:0x%x\n", pos);
         slist_del(&pos->release_node);
         pos = next;
     }
@@ -90,7 +86,7 @@ static void knl_del_task(void)
     if (slist_is_empty(&del_task_head))
     {
         spinlock_set(&del_lock, status2);
-        return ;
+        return;
     }
     // 在这里删除进程
     slist_foreach_not_next(pos, &del_task_head, del_node)
@@ -305,7 +301,8 @@ bool_t task_knl_kill(thread_t *kill_thread, bool_t is_knl)
     task_t *task = container_of(kill_thread->task, task_t, kobj);
     if (!is_knl)
     {
-        printk("kill %s th:0x%x task:0x%x, pid:%d\n", kobject_get_name(&task->kobj), kill_thread, task, task->pid);
+        printk("kill task:0x%x-->%s th:0x%x-->%s, pid:%d\n", task, kobject_get_name(&task->kobj), kill_thread,
+               kobject_get_name(&kill_thread->kobj), task->pid);
         umword_t status2;
 
         status2 = spinlock_lock(&del_lock);
diff --git a/mkrtos_script/build_f2.sh b/mkrtos_script/build_f2.sh
index 90e3fd657..bf4e2815c 100755
--- a/mkrtos_script/build_f2.sh
+++ b/mkrtos_script/build_f2.sh
@@ -1,7 +1,7 @@
 #!/bin/bash
 
-export TOOLCHAIN=/home/zhangzheng/toolchain/gcc-arm-10.3-2021.07-x86_64-arm-none-eabi/bin/
-export TOOLCHAIN_LIB=/home/zhangzheng/toolchain/gcc-arm-10.3-2021.07-x86_64-arm-none-eabi/lib/gcc/arm-none-eabi/10.3.1/thumb/v7-m/nofp
+export TOOLCHAIN=/home/zhangzheng/toolchain/arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi/bin/
+export TOOLCHAIN_LIB=/home/zhangzheng/toolchain/arm-gnu-toolchain-14.2.rel1-x86_64-arm-none-eabi/lib/gcc/arm-none-eabi/14.2.1/thumb/v7-m/nofp
 
 # export TOOLCHAIN=/Users/zhangzheng/gcc-arm-none-eabi-10.3-2021.10/bin/
 # export TOOLCHAIN_LIB=/Users/zhangzheng/gcc-arm-none-eabi-10.3-2021.10/lib/gcc/arm-none-eabi/10.3.1/thumb/v7-m/nofp
diff --git a/mkrtos_user/CMakeLists.txt b/mkrtos_user/CMakeLists.txt
index 5051e355d..38f41535d 100644
--- a/mkrtos_user/CMakeLists.txt
+++ b/mkrtos_user/CMakeLists.txt
@@ -6,6 +6,7 @@ if (${CONFIG_ARCH} STREQUAL "cortex-m3" OR
     ${CONFIG_ARCH} STREQUAL "cortex-m33"
     )
     # -n -pie -fpie -fpic -msingle-pic-base -mno-pic-data-is-text-relative
+    # -mlong-calls -mword-relocations
     set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} \
     -fPIC -fPIE -n -pie -fpie -fpic -msingle-pic-base -mno-pic-data-is-text-relative \
    \
diff --git a/mkrtos_user/lib/cpio/cpiofs.c b/mkrtos_user/lib/cpio/cpiofs.c
index eca51df6a..b5b87da68 100644
--- a/mkrtos_user/lib/cpio/cpiofs.c
+++ b/mkrtos_user/lib/cpio/cpiofs.c
@@ -98,8 +98,6 @@ int cpio_find_next(umword_t st, const char *pre_name,
 }
 int cpio_find_file(umword_t st, umword_t en, const char *name, umword_t *size, int *type, umword_t *addr)
 {
-    uint8_t rByte;
-    int32_t bk_inx;
     cpio_fs_t *file_info;
     uint32_t mode;
 
diff --git a/mkrtos_user/lib/fd/fd.c b/mkrtos_user/lib/fd/fd.c
index a0d514862..909115a97 100644
--- a/mkrtos_user/lib/fd/fd.c
+++ b/mkrtos_user/lib/fd/fd.c
@@ -99,7 +99,6 @@ void *file_desc_free(int fd)
 }
 void file_desc_recycle(pid_t pid)
 {
-    int free_cn = 0;
 
     u_mutex_lock(&fds_lock, 0, NULL);
     for (int i = 0; i < FILE_DESC_NR_OPEN; i++)
@@ -107,7 +106,7 @@ void file_desc_recycle(pid_t pid)
         if (file_desc[i].close != NULL && file_desc[i].pid == pid)
         {
             file_desc[i].close(i);
-            printf("free fd:%d.\n", i);
+            // printf("free fd:%d.\n", i);
         }
     }
     u_mutex_unlock(&fds_lock);
diff --git a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_cfg_user.h b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_cfg_user.h
index 00bd523a9..4aedc0095 100644
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_cfg_user.h
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_cfg_user.h
@@ -36,7 +36,7 @@
  *        使能后，可以在声明命令时，指定函数的签名，shell 会根据函数签名进行参数转换，
  *        而不是自动判断参数的类型，如果参数和函数签名不匹配，会停止执行命令
  */
-#define SHELL_USING_FUNC_SIGNATURE 1
+#define SHELL_USING_FUNC_SIGNATURE 0
 
 /**
  * @brief 支持数组参数
diff --git a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_fs_ext.c b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_fs_ext.c
index 8c0e75d08..6f4809efc 100644
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_fs_ext.c
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_fs_ext.c
@@ -15,6 +15,8 @@
 #include <sys/time.h>
 #include <unistd.h>
 #include <fcntl.h>
+#include <time.h>
+#include <u_sleep.h>
 int ls(int argc, char *agrv[])
 {
     DIR *dir;
@@ -38,8 +40,8 @@ int ls(int argc, char *agrv[])
     {
         return -ENOMEM;
     }
-    ret = getcwd(path, PAGE_SIZE);
-    if (ret < 0)
+    path = getcwd(path, PAGE_SIZE);
+    if (path == NULL)
     {
         u_free(path);
         return ret;
@@ -83,7 +85,7 @@ int cp(int argc, char *argv[])
     // 检查参数数量
     if (argc != 3)
     {
-        fprintf(stderr, "用法: %s 源文件 目标文件\n", argv[0]);
+        fprintf(stderr, "example: %s /bin/a.bin /mnt/a.bin\n", argv[0]);
         return -1;
     }
 
@@ -91,7 +93,7 @@ int cp(int argc, char *argv[])
     source_fd = open(argv[1], O_RDONLY);
     if (source_fd == -1)
     {
-        perror("无法打开源文件");
+        perror("can not open src file.\n");
         return -1;
     }
     struct stat st = {0};
@@ -102,13 +104,13 @@ int cp(int argc, char *argv[])
     target_fd = open(argv[2], O_WRONLY | O_CREAT, 0644);
     if (target_fd == -1)
     {
-        perror("无法打开目标文件");
+        perror("can not open dest file.");
         close(source_fd);
         return -1;
     }
     if (ftruncate(target_fd, st.st_size) < 0)
     {
-        printf("设置文件大小错误\n");
+        printf("to set fiel size is error.\n");
         return -1;
     }
 
@@ -118,7 +120,7 @@ int cp(int argc, char *argv[])
         bytes_written = write(target_fd, buffer, bytes_read);
         if (bytes_written != bytes_read)
         {
-            perror("写入目标文件失败");
+            perror("write file is error.\n");
             close(source_fd);
             close(target_fd);
             return -1;
@@ -127,14 +129,14 @@ int cp(int argc, char *argv[])
 
     if (bytes_read == -1)
     {
-        perror("读取源文件失败");
+        perror("read src file is error.\n");
     }
 
     // 关闭文件
     close(source_fd);
     close(target_fd);
 
-    printf("文件复制成功！\n");
+    printf("cp file is success.\n");
 
     return 0;
 }
@@ -320,4 +322,14 @@ int shell_exit(int argc, char *argv[])
     exit(0);
     return 0;
 }
-SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), exit, exit, exit command);
+SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), exit, shell_exit, exit command);
+int shell_sleep(int argc, char *argv[])
+{
+    if (argc < 1)
+    {
+        return -1;
+    }
+    u_sleep_ms(1000 * atol(argv[1]));
+    return 0;
+}
+SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), sleep, shell_sleep, sleep command);
\ No newline at end of file
diff --git a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.c b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.c
index 6376a1dad..813ab557a 100644
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.c
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.c
@@ -31,11 +31,15 @@
 #include "u_sleep.h"
 #include "u_sema.h"
 #include "u_task.h"
+#include <errno.h>
+#include <stdlib.h>
 static Shell shell;
 static ShellFs shellFs;
-static char shellBuffer[512];
+static char shellBuffer[1024];
 // static char shellPathBuffer[128] = "/";
-
+static struct termios old_settings;
+static struct termios new_settings;
+int script_sh_fd = STDIN_FILENO;
 /**
  * @brief 用户shell写
  *
@@ -45,7 +49,11 @@ static char shellBuffer[512];
  * @return unsigned short 写入实际长度
  */
 signed short userShellWrite(char *data, unsigned short len)
-{    return write(STDOUT_FILENO, data, len);
+{
+    // if (script_sh_fd == STDIN_FILENO)
+    {
+        return write(STDOUT_FILENO, data, len);
+    }
 }
 
 /**
@@ -60,7 +68,13 @@ signed short userShellRead(char *data, unsigned short len)
 {
     int rlen;
 
-    rlen = read(STDIN_FILENO, data, len);
+    rlen = read(script_sh_fd, data, len);
+    if (rlen <= 0)
+    {
+        if (errno != ENOTTY && errno != EAGAIN) {
+            exit(0);
+        }
+    }
     return rlen;
 }
 /**
@@ -95,31 +109,47 @@ size_t userShellListDir(char *path, char *buffer, size_t maxLen)
     closedir(dir);
     return 0;
 }
-static struct termios old_settings;
-static struct termios new_settings;
 
 void tty_set_raw_mode(void)
 {
-    new_settings = old_settings;
-    new_settings.c_lflag &= ~(ICANON | ECHO);   // 禁用规范模式和回显
-    new_settings.c_cc[VMIN] = 1;                // 读取的最小字符数
-    new_settings.c_cc[VTIME] = 0;               // 读取的超时时间（以10ms为单位）
-    tcsetattr(STDIN_FILENO, TCSANOW, &new_settings);
+    if (script_sh_fd == STDIN_FILENO)
+    {
+        new_settings = old_settings;
+        new_settings.c_lflag &= ~(ICANON | ECHO);   // 禁用规范模式和回显
+        new_settings.c_cc[VMIN] = 1;                // 读取的最小字符数
+        new_settings.c_cc[VTIME] = 0;               // 读取的超时时间（以10ms为单位）
+        tcsetattr(script_sh_fd, TCSANOW, &new_settings);
+    }
 }
 void tty_set_normal_mode(void)
 {
-    tcsetattr(STDIN_FILENO, TCSANOW, &old_settings);
+    if (script_sh_fd == STDIN_FILENO)
+    {
+        tcsetattr(script_sh_fd, TCSANOW, &old_settings);
+    }
 }
 /**
  * @brief 用户shell初始化
  *
  */
-void userShellInit(void)
+void userShellInit(int argc, char *args[])
 {
-    tcgetattr(STDIN_FILENO, &old_settings);
-    tty_set_raw_mode();
-    task_set_obj_name(TASK_THIS, TASK_THIS, "tk_shell");
-    task_set_obj_name(TASK_THIS, THREAD_MAIN, "th_shell");
+    if (argc > 1)
+    {
+        printf("run script:%s\n", args[1]);
+        script_sh_fd = open(args[1], O_RDWR, 0777);
+        if (script_sh_fd < 0)
+        {
+            script_sh_fd = STDIN_FILENO;
+        }
+    } else {
+        script_sh_fd = STDIN_FILENO;
+    }
+    if (script_sh_fd == STDIN_FILENO)
+    {
+        tcgetattr(script_sh_fd, &old_settings);
+        tty_set_raw_mode();
+    }
     // shellFs.getcwd = getcwd;
     // shellFs.chdir = chdir;
     // shellFs.listdir = userShellListDir;
diff --git a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.h b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.h
index 0fd47ce25..11fd29048 100644
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.h
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_port.h
@@ -16,5 +16,5 @@
 
 extern Shell shell;
 
-void userShellInit(void);
+void userShellInit(int argc, char *args[]);
 #endif
diff --git a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_test.c b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_test.c
index b5fc62c98..89afa0034 100644
--- a/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_test.c
+++ b/mkrtos_user/lib/letter-shell/demo/mkrtos/shell_test.c
@@ -1,7 +1,7 @@
 #include "shell.h"
 #include "cons_cli.h"
 #include "u_sig.h"
-#include "cons_cli.h"
+#include "pm_cli.h"
 #include <stdlib.h>
 #include <stdio.h>
 #include <dirent.h>
@@ -41,18 +41,32 @@ SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN),
 int shell_float_test(int argc, char *argv[])
 {
     float a = 1.1, b = 1.2;
-     
+
     printf("%f\n", a + b);
     return 0;
 }
 SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), ftest, shell_float_test, ftest command);
 int shell_div0(int argc, char *argv[])
 {
-    int a=1,b=0;
-     
+    int a = 1, b = 0;
+
     *((char *)(0)) = 0;
-    printf("%d\n", a/b);
+    printf("%d\n", a / b);
     return 0;
 }
 SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), div0, shell_div0, div0 command);
+
+int shell_fapp(int argc, char *argv[])
+{
+    int ret;
+    if (argc < 2)
+    {
+        printf("example: fapp 2048\n");
+        return -1;
+    }
+    ret = pm_run_app(NULL, 0, 0x1 /*FIXME:*/, -1,
+                     NULL, atol(argv[1]), NULL, 0); //!< 创建一个dummy task
+    return ret;
+}
+SHELL_EXPORT_CMD(SHELL_CMD_PERMISSION(0) | SHELL_CMD_TYPE(SHELL_TYPE_CMD_MAIN), fapp, shell_fapp, fapp command);
 #endif
diff --git a/mkrtos_user/lib/letter-shell/src/shell.c b/mkrtos_user/lib/letter-shell/src/shell.c
index 0f251fad6..d03a16591 100644
--- a/mkrtos_user/lib/letter-shell/src/shell.c
+++ b/mkrtos_user/lib/letter-shell/src/shell.c
@@ -18,6 +18,7 @@
 #include "u_sig.h"
 #include <termios.h>
 #include <unistd.h>
+#include <stdlib.h>
 #if SHELL_USING_CMD_EXPORT == 1
 /**
  * @brief 默认用户
@@ -1455,42 +1456,50 @@ void shellExec(Shell *shell)
         }
         else
         {
-            uint8_t params[96/*FIXME:数组溢出*/];
-            uint8_t envs[64/*FIXME:*/];
+            uint8_t params[96 /*FIXME:数组溢出*/];
+            uint8_t envs[64 /*FIXME:*/];
             int params_len = 0;
             int envs_len = 0;
-            int pid;
+            int pid = -1;
             bool_t bg_run = FALSE;
             int task_mem_blk = 0;
 
+
+            if (shell->parser.param[shell->parser.paramCount - 1][0] == '~')
+            {
+                // 指定启动的mem，参数少一个
+                task_mem_blk = atoi(&(shell->parser.param[shell->parser.paramCount - 1][1]));
+                shell->parser.paramCount--;
+            }
+            if (shell->parser.param[shell->parser.paramCount - 1][0] == '@')
+            {
+                // 指定启动的mem，参数少一个
+                pid = atoi(&(shell->parser.param[shell->parser.paramCount - 1][1]));
+                shell->parser.paramCount--;
+            }
+            if (strcmp(shell->parser.param[shell->parser.paramCount - 1], "&") == 0)
+            {
+                // 后台启动，参数少一个
+                shell->parser.param[shell->parser.paramCount - 1] = NULL;
+                shell->parser.paramCount--;
+                bg_run = TRUE;
+            }
             // 处理params
             for (int i = 1; i < shell->parser.paramCount; i++)
             {
                 memcpy(&params[params_len], shell->parser.param[i], strlen(shell->parser.param[i]) + 1); // copy the string
                 params_len += strlen(shell->parser.param[i]) + 1;
             }
-            if (shell->parser.param[shell->parser.paramCount - 1][0] == '~')
-            {
-                //指定启动的mem，参数少一个
-                task_mem_blk = atoi(&(shell->parser.param[shell->parser.paramCount - 1][1]));
-                shell->parser.paramCount--;
-            }
-            if (strcmp(shell->parser.param[shell->parser.paramCount - 1], "&") == 0)
-            {
-                //后台启动，参数少一个
-                shell->parser.param[shell->parser.paramCount - 1] = NULL;
-                shell->parser.paramCount--;
-                bg_run = TRUE;
-            }
             // 处理envs
             for (char **e = __environ; *e; e++)
             {
                 memcpy(&envs[envs_len], *e, strlen(*e) + 1);
-                envs_len+= strlen(*e)+1;
+                envs_len += strlen(*e) + 1;
             }
 
             //!< 内建命令中未找到，则执行应用
-            pid = pm_run_app(shell->parser.param[0], task_mem_blk, params, params_len, envs, envs_len);
+            pid = pm_run_app(shell->parser.param[0], task_mem_blk, pid != -1 ? PM_USE_LOAD_TO_RAM : 0, /*pid*/ pid,
+                             params, params_len, envs, envs_len);
             if (pid < 0)
             {
                 shellWriteString(shell, shellText[SHELL_TEXT_CMD_NOT_FOUND]);
@@ -1503,15 +1512,22 @@ void shellExec(Shell *shell)
                 {
                     shell->parser.param[shell->parser.paramCount - 1] = NULL;
                     shell->parser.paramCount--;
-                    task_get_pid(TASK_THIS, &cur_pid);
+                    task_get_pid(TASK_THIS, (umword_t *)&cur_pid);
                     pm_sig_watch(pid, 0);
                     extern void tty_set_raw_mode(void);
                     extern void tty_set_normal_mode(void);
+                    extern int script_sh_fd;
 
                     tty_set_normal_mode();
-                    tcsetpgrp(STDIN_FILENO, pid);
+                    if (script_sh_fd == STDIN_FILENO)
+                    {
+                        tcsetpgrp(script_sh_fd, pid);
+                    }
                     pm_waitpid(pid, NULL);
-                    tcsetpgrp(STDIN_FILENO, cur_pid);
+                    if (script_sh_fd == STDIN_FILENO)
+                    {
+                        tcsetpgrp(script_sh_fd, cur_pid);
+                    }
                     tty_set_raw_mode();
                 }
             }
diff --git a/mkrtos_user/lib/letter-shell/src/shell_cfg.h b/mkrtos_user/lib/letter-shell/src/shell_cfg.h
index 1da1ad8c4..c863b54a5 100644
--- a/mkrtos_user/lib/letter-shell/src/shell_cfg.h
+++ b/mkrtos_user/lib/letter-shell/src/shell_cfg.h
@@ -147,14 +147,14 @@
  *        开启后会默认定义一个`RETVAL`变量，会保存上一次命令执行的返回值，可以在随后的命令中进行调用
  *        如果命令的`SHELL_CMD_DISABLE_RETURN`标志被设置，则该命令不会更新`RETVAL`
  */
-#define     SHELL_KEEP_RETURN_VALUE     0
+#define     SHELL_KEEP_RETURN_VALUE     1
 #endif /** SHELL_KEEP_RETURN_VALUE */
 
 #ifndef SHELL_MAX_NUMBER
 /**
  * @brief 管理的最大shell数量
  */
-#define     SHELL_MAX_NUMBER            5
+#define     SHELL_MAX_NUMBER            2
 #endif /** SHELL_MAX_NUMBER */
 
 #ifndef SHELL_PRINT_BUFFER
diff --git a/mkrtos_user/lib/libc_backend/inc/syscall_backend.h b/mkrtos_user/lib/libc_backend/inc/syscall_backend.h
index 5774fbbfd..e0f10fb67 100644
--- a/mkrtos_user/lib/libc_backend/inc/syscall_backend.h
+++ b/mkrtos_user/lib/libc_backend/inc/syscall_backend.h
@@ -8,6 +8,7 @@
 #include <sys/socket.h>
 #include <sys/ipc.h>
 #include "sys/shm.h"
+#include <poll.h>
 // typedef int key_t;
 
 #define ARG_1_BE(ap, arg0, type0)       \
@@ -110,6 +111,10 @@ umword_t be_mmap(void *start,
 int be_fcntl(int fd, int cmd, void *arg);
 long be_chdir(const char *path);
 long be_ftruncate(int fd, off_t off);
+long be_poll(struct pollfd *fds, uint32_t n, int timeout);
+long be_fstat(int fd, void *_buf);
+long be_getcwd(char *path, size_t size);
+int be_access(const char *filename, int amode);
 // net api
 int be_accept(int s, struct sockaddr *addr, socklen_t *addrlen);
 int be_bind(int s, const struct sockaddr *name, socklen_t namelen);
diff --git a/mkrtos_user/lib/libc_backend/src/armv7_8m/mm_backend.c b/mkrtos_user/lib/libc_backend/src/armv7_8m/mm_backend.c
index 94d01f445..6ecd24100 100644
--- a/mkrtos_user/lib/libc_backend/src/armv7_8m/mm_backend.c
+++ b/mkrtos_user/lib/libc_backend/src/armv7_8m/mm_backend.c
@@ -99,7 +99,7 @@ static int mm_page_free(int st, int nr)
 {
     app_info_t *info = app_info_get(app_start_addr);
     assert(info);
-    void *heap_addr = (void *)((umword_t)TASK_RAM_BASE() + info->i.heap_offset - info->i.data_offset);
+    // void *heap_addr = (void *)((umword_t)TASK_RAM_BASE() + info->i.heap_offset - info->i.data_offset);
     size_t max_page_nr = (info->i.heap_size) / PAGE_SIZE;
 
     if (st + nr >= max_page_nr)
diff --git a/mkrtos_user/lib/libc_backend/src/be_exit.c b/mkrtos_user/lib/libc_backend/src/be_exit.c
index 29b89b97b..b36f7a10a 100644
--- a/mkrtos_user/lib/libc_backend/src/be_exit.c
+++ b/mkrtos_user/lib/libc_backend/src/be_exit.c
@@ -39,7 +39,7 @@ void be_exit(long exit_code)
     {
         if (old_ctid)
         {
-            be_futex(old_ctid, FUTEX_WAKE_CLEAR, 1, 0, 0, 0);
+            be_futex((uint32_t *)old_ctid, FUTEX_WAKE_CLEAR, 1, 0, 0, 0);
         }
         if (pthread_cnt_dec() == 1)
         {
diff --git a/mkrtos_user/lib/libc_backend/src/fd_map.c b/mkrtos_user/lib/libc_backend/src/fd_map.c
index 4f46e60d2..0fcbe510f 100644
--- a/mkrtos_user/lib/libc_backend/src/fd_map.c
+++ b/mkrtos_user/lib/libc_backend/src/fd_map.c
@@ -43,7 +43,6 @@ int fd_map_alloc(uint32_t svr_fd, uint32_t priv_fd, enum fd_type type)
 {
     int alloc_fd = 0;
 
-again_alloc:
     pthread_spin_lock(&fd_map.lock);
     if (fd_map.free_fd >= FD_MAP_TOTAL)
     {
@@ -142,6 +141,7 @@ int fd_map_update(int fd, fd_map_entry_t *new_entry)
     fd_map.row[row_inx]->entry[inx] = *new_entry;
     fd_map.row[row_inx]->entry[inx].flags = flags;
     pthread_spin_unlock(&fd_map.lock);
+    return 0;
 }
 /**
  * @brief 释放fd
diff --git a/mkrtos_user/lib/libc_backend/src/fs_backend.c b/mkrtos_user/lib/libc_backend/src/fs_backend.c
index 440e0acdd..00f839880 100644
--- a/mkrtos_user/lib/libc_backend/src/fs_backend.c
+++ b/mkrtos_user/lib/libc_backend/src/fs_backend.c
@@ -64,6 +64,18 @@ const char *fs_backend_cur_path(void)
 {
     return cur_path;
 }
+void fs_cons_lock(void)
+{
+    u_mutex_lock(&lock_cons, 0, NULL);
+}
+void fs_cons_unlock(void)
+{
+    u_mutex_unlock(&lock_cons);
+}
+void fs_cons_write_unlock(void *buf, size_t size)
+{
+    ulog_write_bytes(u_get_global_env()->log_hd, buf, size);
+}
 void fs_cons_write(void *buf, size_t size)
 {
     u_mutex_lock(&lock_cons, 0, NULL);
@@ -269,15 +281,16 @@ long be_readv(long fd, const struct iovec *iov, long iovcnt)
 long be_writev(long fd, const struct iovec *iov, long iovcnt)
 {
     long wlen = 0;
+    fd_map_entry_t u_fd;
+    int ret;
+
+    ret = fd_map_get(fd, &u_fd);
+    if (ret < 0)
+    {
+        return -EBADF;
+    }
     for (int i = 0; i < iovcnt; i++)
     {
-        fd_map_entry_t u_fd;
-        int ret = fd_map_get(fd, &u_fd);
-
-        if (ret < 0)
-        {
-            return -EBADF;
-        }
         switch (u_fd.type)
         {
         case FD_TTY:
@@ -500,7 +513,7 @@ long be_unlink(const char *path)
         *parent_last_path = '\0';
     }
     obj_handler_t hd;
-    int ret = ns_query(new_src_path, &hd, 0);
+    int ret = ns_query(new_src_path, &hd);
 
     if (ret < 0)
     {
@@ -509,7 +522,7 @@ long be_unlink(const char *path)
     *parent_last_path = '/';
     return fs_unlink(hd, ret == 0 ? new_src_path : parent_last_path);
 }
-long be_poll(struct pollfd *fds, nfds_t n, int timeout)
+long be_poll(struct pollfd *fds, uint32_t n, int timeout)
 {
     for (int i = 0; i < n; i++)
     {
@@ -521,7 +534,7 @@ long be_poll(struct pollfd *fds, nfds_t n, int timeout)
         /*FIXME:性能优化*/
         if (fds[0].events & POLLIN)
         {
-            char buf;
+            // char buf;
             int len;
             int ret;
             int time = 0;
diff --git a/mkrtos_user/lib/libc_backend/src/shm_backend.c b/mkrtos_user/lib/libc_backend/src/shm_backend.c
index 5fa3b54d2..cd69268f9 100644
--- a/mkrtos_user/lib/libc_backend/src/shm_backend.c
+++ b/mkrtos_user/lib/libc_backend/src/shm_backend.c
@@ -22,7 +22,7 @@ static int _be_shm_open_svr(const char *shm_name)
     // const char *cur_path = fs_backend_cur_path();
 
     // u_rel_path_to_abs(cur_path, shm_name, new_src_path);
-    if (ns_query_svr(shm_name, &shm_hd, 1) < 0)
+    if (ns_query_svr(shm_name, &shm_hd) < 0)
     {
         return -ENOENT;
     }
@@ -146,8 +146,6 @@ int be_shmdt(const void *addr)
 int be_shmctl(int id, int cmd, struct shmid_ds *buf)
 {
     fd_map_entry_t u_fd;
-    msg_tag_t tag;
-    umword_t shm_addr;
     int ret;
     
     ret = fd_map_free(id, &u_fd);
diff --git a/mkrtos_user/lib/libc_backend/src/sys_backend.c b/mkrtos_user/lib/libc_backend/src/sys_backend.c
index 4e6e735f0..8a2afb390 100644
--- a/mkrtos_user/lib/libc_backend/src/sys_backend.c
+++ b/mkrtos_user/lib/libc_backend/src/sys_backend.c
@@ -74,7 +74,7 @@ int be_clone(int (*func)(void *), void *stack, int flags, void *args, pid_t *pti
     msg_tag_t tag;
     obj_handler_t th1_hd;
     struct pthread *ph;
-    struct start_args *st_args = args;
+    // struct start_args *st_args = args;
 
     ph = (struct pthread *)((char *)tls - sizeof(struct pthread));
 
@@ -144,7 +144,6 @@ end_free_mm:
 #if IS_ENABLED(CONFIG_MMU)
     u_vmam_free(VMA_PROT, msg_buf_addr, PAGE_SIZE);
 #endif
-end:
     handler_free_umap(th1_hd);
 end_ok:
     return ret;
diff --git a/mkrtos_user/lib/lwip/contrib/ports/mkrtos/sys_arch.c b/mkrtos_user/lib/lwip/contrib/ports/mkrtos/sys_arch.c
index 3f9937b82..98c7bcfa8 100644
--- a/mkrtos_user/lib/lwip/contrib/ports/mkrtos/sys_arch.c
+++ b/mkrtos_user/lib/lwip/contrib/ports/mkrtos/sys_arch.c
@@ -110,8 +110,8 @@ get_monotonic_time(struct timespec *ts)
 
 #if SYS_LIGHTWEIGHT_PROT
 static u_mutex_t lwprot_mutex;
-static umword_t lwprot_thread = (umword_t)0xDEAD;
-static int lwprot_count = 0;
+// static umword_t lwprot_thread = (umword_t)0xDEAD;
+// static int lwprot_count = 0;
 #endif /* SYS_LIGHTWEIGHT_PROT */
 
 #if !NO_SYS
diff --git a/mkrtos_user/lib/mlibc/crt/reloc.c b/mkrtos_user/lib/mlibc/crt/reloc.c
index 4c2a21e1c..863d4decb 100644
--- a/mkrtos_user/lib/mlibc/crt/reloc.c
+++ b/mkrtos_user/lib/mlibc/crt/reloc.c
@@ -96,13 +96,13 @@ static mk_ldso_t ldso;
 static void so_parse(app_info_t *app)
 {
     // 遍历动态段
-    Elf32_Dyn *dyn = (char *)app + app->i.dyn_start;
+    Elf32_Dyn *dyn = (Elf32_Dyn *)((char *)app + app->i.dyn_start);
 
     for (int i = 0; i < dyn[i].d_tag != DT_NULL; i++)
     {
         if (dyn[i].d_tag == DT_SYMTAB)
         {
-            Elf32_Sym *symtab = (char *)app + dyn[i].d_un.d_val;
+            Elf32_Sym *symtab = (Elf32_Sym *)((char *)app + dyn[i].d_un.d_val);
             ldso.syms = symtab;
         }
         else if (dyn[i].d_tag == DT_STRTAB)
diff --git a/mkrtos_user/lib/mlibc/include/endian.h b/mkrtos_user/lib/mlibc/include/endian.h
index e92d6f61b..fd64004d5 100644
--- a/mkrtos_user/lib/mlibc/include/endian.h
+++ b/mkrtos_user/lib/mlibc/include/endian.h
@@ -31,12 +31,12 @@ static __inline uint16_t __bswap16(uint16_t __x)
 
 static __inline uint32_t __bswap32(uint32_t __x)
 {
-	return __x>>24 | __x>>8&0xff00 | __x<<8&0xff0000 | __x<<24;
+	return (__x>>24) | (__x>>8&0xff00) | (__x<<8&0xff0000) | __x<<24;
 }
 
 static __inline uint64_t __bswap64(uint64_t __x)
 {
-	return __bswap32(__x)+0ULL<<32 | __bswap32(__x>>32);
+	return ((__bswap32(__x)+0ULL)<<32) | __bswap32(__x>>32);
 }
 
 #if __BYTE_ORDER == __LITTLE_ENDIAN
diff --git a/mkrtos_user/lib/mlibc/include/stdio.h b/mkrtos_user/lib/mlibc/include/stdio.h
index 3f4124475..856255724 100644
--- a/mkrtos_user/lib/mlibc/include/stdio.h
+++ b/mkrtos_user/lib/mlibc/include/stdio.h
@@ -49,10 +49,10 @@ extern "C" {
 #define _IOLBF 1
 #define _IONBF 2
 
-#define BUFSIZ 64 //TODO: 1024
+#define BUFSIZ 128 //TODO: 1024
 #define FILENAME_MAX 128 //TODO:4096
-#define FOPEN_MAX 1000
-#define TMP_MAX 10000
+#define FOPEN_MAX 64 //1000
+#define TMP_MAX 64 //10000
 #define L_tmpnam 20
 
 typedef union _G_fpos64_t {
diff --git a/mkrtos_user/lib/mlibc/src/fcntl/fcntl.c b/mkrtos_user/lib/mlibc/src/fcntl/fcntl.c
index 190395855..55b44d6c1 100644
--- a/mkrtos_user/lib/mlibc/src/fcntl/fcntl.c
+++ b/mkrtos_user/lib/mlibc/src/fcntl/fcntl.c
@@ -38,14 +38,14 @@ int fcntl(int fd, int cmd, ...)
 	#ifdef NO_LITTLE_MODE
 		int ret = __syscall(SYS_fcntl, fd, F_DUPFD_CLOEXEC, arg);
 	#else
-		int ret = be_fcntl( fd, F_DUPFD_CLOEXEC, arg);
+		int ret = be_fcntl( fd, F_DUPFD_CLOEXEC, (void *)arg);
 	#endif
 		if (ret != -EINVAL) {
 			if (ret >= 0)
 	#ifdef NO_LITTLE_MODE
 				__syscall(SYS_fcntl, ret, F_SETFD, FD_CLOEXEC);
 	#else
-				be_fcntl(ret, F_SETFD, FD_CLOEXEC);
+				be_fcntl(ret, F_SETFD, (void *)FD_CLOEXEC);
 	#endif
 			return __syscall_ret(ret);
 		}
@@ -66,8 +66,8 @@ int fcntl(int fd, int cmd, ...)
 		ret = __syscall(SYS_fcntl, fd, F_DUPFD, arg);
 		if (ret >= 0) __syscall(SYS_fcntl, ret, F_SETFD, FD_CLOEXEC);
 	#else
-		ret = be_fcntl(fd, F_DUPFD, arg);
-		if (ret >= 0) be_fcntl(ret, F_SETFD, FD_CLOEXEC);
+		ret = be_fcntl(fd, F_DUPFD, (void *)arg);
+		if (ret >= 0) be_fcntl(ret, F_SETFD, (void *)FD_CLOEXEC);
 	#endif
 		return __syscall_ret(ret);
 	}
diff --git a/mkrtos_user/lib/mlibc/src/ipc/shmat.c b/mkrtos_user/lib/mlibc/src/ipc/shmat.c
index 5abdbd7a5..e8b553294 100644
--- a/mkrtos_user/lib/mlibc/src/ipc/shmat.c
+++ b/mkrtos_user/lib/mlibc/src/ipc/shmat.c
@@ -21,6 +21,6 @@ void *shmat(int id, const void *addr, int flag)
 #else
 void *shmat(int id, const void *addr, int flag)
 {
-	return (void *)__syscall_ret(be_shmat(id, addr, flag));
+	return (void *)__syscall_ret((long)be_shmat(id, addr, flag));
 }
 #endif
diff --git a/mkrtos_user/lib/mlibc/src/network/socket.c b/mkrtos_user/lib/mlibc/src/network/socket.c
index 53f5476ee..d6babbdc9 100644
--- a/mkrtos_user/lib/mlibc/src/network/socket.c
+++ b/mkrtos_user/lib/mlibc/src/network/socket.c
@@ -31,9 +31,9 @@ int socket(int domain, int type, int protocol)
 			__syscall(SYS_fcntl, s, F_SETFL, O_NONBLOCK);
 	#else
 	if (type & SOCK_CLOEXEC)
-			be_fcntl(s, F_SETFD, FD_CLOEXEC);
+			be_fcntl(s, F_SETFD, (void *)FD_CLOEXEC);
 		if (type & SOCK_NONBLOCK)
-			be_fcntl(s, F_SETFL, O_NONBLOCK);
+			be_fcntl(s, F_SETFL, (void *)O_NONBLOCK);
 	#endif
 	}
 	return __syscall_ret(s);
diff --git a/mkrtos_user/lib/sys/inc/u_factory.h b/mkrtos_user/lib/sys/inc/u_factory.h
index 2ee0ae7e2..38ef21b70 100644
--- a/mkrtos_user/lib/sys/inc/u_factory.h
+++ b/mkrtos_user/lib/sys/inc/u_factory.h
@@ -1,4 +1,4 @@
-#pragma
+#pragma once
 
 #include "u_types.h"
 #include "u_prot.h"
diff --git a/mkrtos_user/lib/sys/inc/u_log.h b/mkrtos_user/lib/sys/inc/u_log.h
index a8fc9b366..baa9d1982 100644
--- a/mkrtos_user/lib/sys/inc/u_log.h
+++ b/mkrtos_user/lib/sys/inc/u_log.h
@@ -7,4 +7,4 @@
 
 void ulog_write_bytes(obj_handler_t obj_inx, const uint8_t *data, umword_t len);
 void ulog_write_str(obj_handler_t obj_inx, const char *str);
-int ulog_read_bytes(obj_handler_t obj_inx, uint8_t *data, umword_t len);
+int ulog_read_bytes(obj_handler_t obj_inx, uint8_t *data, umword_t len, int flags);
diff --git a/mkrtos_user/lib/sys/inc/u_task.h b/mkrtos_user/lib/sys/inc/u_task.h
index 92c60c6f6..ee15a91bd 100644
--- a/mkrtos_user/lib/sys/inc/u_task.h
+++ b/mkrtos_user/lib/sys/inc/u_task.h
@@ -15,6 +15,7 @@ msg_tag_t task_map(obj_handler_t dst_task, obj_handler_t src_obj, obj_handler_t
 msg_tag_t task_unmap(obj_handler_t task_han, vpage_t vpage);
 msg_tag_t task_alloc_ram_base(obj_handler_t task_han, umword_t size, addr_t *alloc_addr,
                               int mem_block, addr_t text_addr, size_t text_size);
+msg_tag_t task_alloc_get_ram_info(obj_handler_t task_han, addr_t *ram_addr, size_t *size);
 msg_tag_t task_copy_data(obj_handler_t task_obj, void *st_addr, umword_t size);
 msg_tag_t task_copy_data_to(obj_handler_t task_obj, obj_handler_t dst_task_obj, void *st_addr, void *dst_addr, umword_t size);
 msg_tag_t task_set_com_point(obj_handler_t task_obj, void *com_point_func,
diff --git a/mkrtos_user/lib/sys/inc/u_types.h b/mkrtos_user/lib/sys/inc/u_types.h
index 9a0478a5a..066faa375 100755
--- a/mkrtos_user/lib/sys/inc/u_types.h
+++ b/mkrtos_user/lib/sys/inc/u_types.h
@@ -9,6 +9,7 @@
 typedef unsigned long umword_t;
 typedef long mword_t;
 typedef unsigned short uhmword_t;
+typedef short hmword_t;
 typedef umword_t ptr_t;
 typedef char bool_t;
 typedef unsigned long obj_addr_t;
diff --git a/mkrtos_user/lib/sys/src/u_log.c b/mkrtos_user/lib/sys/src/u_log.c
index 195218c00..21fb54a8f 100644
--- a/mkrtos_user/lib/sys/src/u_log.c
+++ b/mkrtos_user/lib/sys/src/u_log.c
@@ -13,7 +13,7 @@ enum log_op
     SET_FLAGS
 };
 MK_SYSCALL
-static msg_tag_t ulog_read_bytes_raw(obj_handler_t obj_inx, umword_t data[5], int len)
+static msg_tag_t ulog_read_bytes_raw(obj_handler_t obj_inx, umword_t data[5], int len, int flags)
 {
     register volatile umword_t r0 asm(ARCH_REG_0);
     register volatile umword_t r1 asm(ARCH_REG_1);
@@ -24,7 +24,7 @@ static msg_tag_t ulog_read_bytes_raw(obj_handler_t obj_inx, umword_t data[5], in
     mk_syscall(syscall_prot_create(READ_DATA, LOG_PROT, obj_inx).raw,
                msg_tag_init4(0, 0, 0, 0).raw,
                len,
-               0,
+               flags,
                0,
                0,
                0);
@@ -44,11 +44,11 @@ static msg_tag_t ulog_read_bytes_raw(obj_handler_t obj_inx, umword_t data[5], in
     return tag;
 }
 MK_SYSCALL
-int ulog_read_bytes(obj_handler_t obj_inx, uint8_t *data, umword_t len)
+int ulog_read_bytes(obj_handler_t obj_inx, uint8_t *data, umword_t len, int flags)
 {
     umword_t buffer[5];
 
-    msg_tag_t tag = ulog_read_bytes_raw(obj_inx, buffer, len);
+    msg_tag_t tag = ulog_read_bytes_raw(obj_inx, buffer, len, flags);
 
     if (msg_tag_get_val(tag) > 0)
     {
diff --git a/mkrtos_user/lib/sys/src/u_task.c b/mkrtos_user/lib/sys/src/u_task.c
index a499a04dd..8f0406eb7 100644
--- a/mkrtos_user/lib/sys/src/u_task.c
+++ b/mkrtos_user/lib/sys/src/u_task.c
@@ -8,6 +8,7 @@ enum task_op_code
     TASK_OBJ_MAP,
     TASK_OBJ_UNMAP,
     TASK_ALLOC_RAM_BASE,
+    TASK_GET_RAM_INFO,   //!< 获取task的ram信息
     TASK_OBJ_VALID,
     TASK_SET_PID,
     TASK_GET_PID,
@@ -168,6 +169,35 @@ msg_tag_t task_alloc_ram_base(obj_handler_t task_han, umword_t size, addr_t *all
     return msg_tag_init(r0);
 }
 MK_SYSCALL
+msg_tag_t task_alloc_get_ram_info(obj_handler_t task_han, addr_t *ram_addr, size_t *size)
+{
+    register volatile umword_t r0 asm(ARCH_REG_0);
+    register volatile umword_t r1 asm(ARCH_REG_1);
+    register volatile umword_t r2 asm(ARCH_REG_2);
+
+    mk_syscall(syscall_prot_create(TASK_GET_RAM_INFO, TASK_PROT, task_han).raw,
+               0,
+               0,
+               0,
+               0,
+               0,
+               0);
+    asm __volatile__(""
+                     :
+                     :
+                     : ARCH_REG_0, ARCH_REG_1);
+    if (ram_addr)
+    {
+        *ram_addr = r1;
+    }
+    if (size)
+    {
+        *size = r2;
+    }
+
+    return msg_tag_init(r0);
+}
+MK_SYSCALL
 msg_tag_t task_copy_data(obj_handler_t task_obj, void *st_addr, umword_t size)
 {
     register volatile umword_t r0 asm(ARCH_REG_0);
diff --git a/mkrtos_user/lib/sys/src/u_thread.c b/mkrtos_user/lib/sys/src/u_thread.c
index b3a62e5c5..131131c91 100644
--- a/mkrtos_user/lib/sys/src/u_thread.c
+++ b/mkrtos_user/lib/sys/src/u_thread.c
@@ -24,78 +24,6 @@ enum IPC_TYPE
     IPC_FAST_CALL, //!< 快速CALL通信，不切换上下文
     IPC_FAST_REPLAY,
 };
-#if 0
-
-msg_tag_t thread_ipc_wait(ipc_timeout_t timeout, umword_t *obj, obj_handler_t ipc_obj)
-{
-    register volatile umword_t r0 asm(ARCH_REG_0);
-    register volatile umword_t r1 asm(ARCH_REG_1);
-    mk_syscall(syscall_prot_create4(DO_IPC, THREAD_PROT, -1, TRUE).raw,
-               0,
-               IPC_WAIT,
-               0,
-               timeout.raw,
-               ipc_obj,
-               0);
-    asm __volatile__(""
-                     :
-                     :
-                     : ARCH_REG_0, ARCH_REG_1);
-    if (obj)
-    {
-        *obj = r1;
-    }
-    return msg_tag_init(r0);
-}
-msg_tag_t thread_ipc_reply(msg_tag_t in_tag, ipc_timeout_t timeout)
-{
-    register volatile umword_t r0 asm(ARCH_REG_0);
-    mk_syscall(syscall_prot_create4(DO_IPC, THREAD_PROT, -1, TRUE).raw,
-               in_tag.raw,
-               IPC_REPLY,
-               0,
-               timeout.raw,
-               0,
-               0);
-    asm __volatile__(""
-                     :
-                     :
-                     : ARCH_REG_0);
-    return msg_tag_init(r0);
-}
-msg_tag_t thread_ipc_send(msg_tag_t in_tag, obj_handler_t target_th_obj, ipc_timeout_t timeout)
-{
-    register volatile umword_t r0 asm(ARCH_REG_0);
-    mk_syscall(syscall_prot_create4(DO_IPC, THREAD_PROT, target_th_obj, TRUE).raw,
-               in_tag.raw,
-               IPC_SEND,
-               0,
-               timeout.raw,
-               0,
-               0);
-    asm __volatile__(""
-                     :
-                     :
-                     : ARCH_REG_0);
-    return msg_tag_init(r0);
-}
-msg_tag_t thread_ipc_call(msg_tag_t in_tag, obj_handler_t target_th_obj, ipc_timeout_t timeout)
-{
-    register volatile umword_t r0 asm(ARCH_REG_0);
-    mk_syscall(syscall_prot_create4(DO_IPC, THREAD_PROT, target_th_obj, TRUE).raw,
-               in_tag.raw,
-               IPC_CALL,
-               0,
-               timeout.raw,
-               0,
-               0);
-    asm __volatile__(""
-                     :
-                     :
-                     : ARCH_REG_0);
-    return msg_tag_init(r0);
-}
-#endif
 MK_SYSCALL
 msg_tag_t thread_sleep(umword_t ticks)
 {
@@ -111,6 +39,7 @@ msg_tag_t thread_sleep(umword_t ticks)
                      :
                      :
                      : ARCH_REG_0);
+    return msg_tag_init(r0);
 }
 MK_SYSCALL
 msg_tag_t thread_ipc_fast_call(msg_tag_t in_tag, obj_handler_t target_obj, umword_t arg0, umword_t arg1, umword_t arg2)
diff --git a/mkrtos_user/lib/sys_svr/inc/fs_cli.h b/mkrtos_user/lib/sys_svr/inc/fs_cli.h
index d696a5ca0..4260776e5 100644
--- a/mkrtos_user/lib/sys_svr/inc/fs_cli.h
+++ b/mkrtos_user/lib/sys_svr/inc/fs_cli.h
@@ -5,14 +5,18 @@
 #include <poll.h>
 #include <u_types.h>
 #include <u_rpc.h>
+int fs_open_raw(obj_handler_t fs_hd, const char *path, int flags, int mode);
 sd_t fs_open(const char *path, int flags, int mode);
+int fs_close_raw(obj_handler_t hd, int fd);
 int fs_close(sd_t _fd);
+int fs_read_raw(obj_handler_t hd, int fd, void *buf, size_t len);
 int fs_read(sd_t _fd, void *buf, size_t len);
 int fs_write(sd_t _fd, void *buf, size_t len);
 int fs_readdir(sd_t _fd, dirent_t *dirent);
 int fs_lseek(sd_t _fd, int offs, int whence);
 int fs_ftruncate(sd_t _fd, off_t off);
-int fs_fstat(sd_t _fd, stat_t *stat);
+int fs_fstat_raw(obj_handler_t hd, int fd, kstat_t *stat);
+int fs_fstat(sd_t _fd, kstat_t *stat);
 int fs_ioctl(sd_t _fd, int req, void *arg);
 int fs_fcntl(sd_t _fd, int cmd, void *arg);
 int fs_fsync(sd_t _fd);
diff --git a/mkrtos_user/lib/sys_svr/inc/ns_cli.h b/mkrtos_user/lib/sys_svr/inc/ns_cli.h
index 5f2c643e6..783539027 100644
--- a/mkrtos_user/lib/sys_svr/inc/ns_cli.h
+++ b/mkrtos_user/lib/sys_svr/inc/ns_cli.h
@@ -4,5 +4,5 @@
 #include "ns_types.h"
 
 int ns_register(const char *path, obj_handler_t svr_hd, int flags);
-int ns_query(const char *path, obj_handler_t *svr_hd, int flags);
-int ns_query_svr(const char *path, obj_handler_t *svr_hd, int flags);
+int ns_query(const char *path, obj_handler_t *svr_hd);
+int ns_query_svr(const char *path, obj_handler_t *svr_hd);
diff --git a/mkrtos_user/lib/sys_svr/inc/pm_cli.h b/mkrtos_user/lib/sys_svr/inc/pm_cli.h
index 2a65d859b..e40f40f54 100644
--- a/mkrtos_user/lib/sys_svr/inc/pm_cli.h
+++ b/mkrtos_user/lib/sys_svr/inc/pm_cli.h
@@ -4,7 +4,8 @@
 #include <sys/types.h>
 #define PM_KILL_TASK_ALL 0x1
 
-int pm_run_app(const char *path, int mem_block, uint8_t *params, int params_len, uint8_t *envs, int envs_len);
+int pm_run_app(const char *path, int16_t mem_block, int16_t flags, 
+    int pid, uint8_t *params, int params_len, uint8_t *envs, int envs_len);
 int pm_kill_task(int pid, int flags, int exit_code);
 int pm_watch_pid(obj_handler_t sig_hd, pid_t pid, int flags);
 int pm_copy_data(pid_t src_pid, pid_t dst_pid, addr_t src_addr, addr_t dst_addr, size_t len);
diff --git a/mkrtos_user/lib/sys_svr/inc/pm_svr.h b/mkrtos_user/lib/sys_svr/inc/pm_svr.h
index 145875bdb..59d3e409c 100644
--- a/mkrtos_user/lib/sys_svr/inc/pm_svr.h
+++ b/mkrtos_user/lib/sys_svr/inc/pm_svr.h
@@ -32,10 +32,35 @@ typedef struct pm
     slist_head_t watch_head;
 } pm_t;
 
-#define PM_APP_BG_RUN 0x1
+#define PM_CREATE_DUMMY_TASK 0x1
+// #define PM_USE_EXIST_DUMMY_TASK 0x2
+#define PM_USE_LOAD_TO_RAM 0x2
+typedef union pm_flags
+{
+    umword_t raw;
+    struct {
+        uint8_t mem_block;
+        uint8_t flags;//@see PM_CREATE_DUMMY_TASK
+        hmword_t pid;
+    };
+} pm_flags_t;
+static inline pm_flags_t pm_flags_init_raw(umword_t raw)
+{
+    return (pm_flags_t) {
+        .raw = raw,
+    };
+}
+static inline pm_flags_t pm_flags_init(uint8_t mem_block, uint8_t flags, pid_t pid)
+{
+    return (pm_flags_t) {
+        .mem_block = mem_block,
+        .flags = flags,
+        .pid = pid,
+    };
+}
 
 void pm_svr_obj_init(pm_t *pm);
-int pm_rpc_run_app(const char *path, int mem_block, char *params, int params_len, char *env, int envs_len);
+int pm_rpc_run_app(const char *path, pm_flags_t pm_flags, char *params, int params_len_or_app_size, char *env, int envs_len);
 int pm_rpc_kill_task(int src_pid, int pid, int flags, int exit_code);
 
 int pm_rpc_watch_pid(pm_t *pm, obj_handler_t sig_rcv_hd, pid_t pid, int flags);
diff --git a/mkrtos_user/lib/sys_svr/src/cons_cli.c b/mkrtos_user/lib/sys_svr/src/cons_cli.c
index 13cfbe4c5..5d1435ae4 100644
--- a/mkrtos_user/lib/sys_svr/src/cons_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/cons_cli.c
@@ -31,9 +31,6 @@ int cons_write(const uint8_t *data, int len)
             .data = (uint8_t *)data + rlen,
             .len = r_once_len,
         };
-        rpc_int_t rpc_len = {
-            .data = r_once_len,
-        };
         msg_tag_t tag = cons_t_write_call(env->log_hd, &rpc_buf);
 
         if (msg_tag_get_val(tag) < 0)
diff --git a/mkrtos_user/lib/sys_svr/src/drv_cli.c b/mkrtos_user/lib/sys_svr/src/drv_cli.c
index 05d62c335..824944a77 100644
--- a/mkrtos_user/lib/sys_svr/src/drv_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/drv_cli.c
@@ -31,7 +31,7 @@ RPC_GENERATION_CALL3(drv_t, FS_PROT, DRV_IOCTL, ioctl,
 int dev_fs_open(const char *path, uint32_t oflags)
 {
     obj_handler_t hd;
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);
 
     if (ret < 0)
     {
diff --git a/mkrtos_user/lib/sys_svr/src/drv_svr.c b/mkrtos_user/lib/sys_svr/src/drv_svr.c
index 53fec3560..2d1106bd4 100644
--- a/mkrtos_user/lib/sys_svr/src/drv_svr.c
+++ b/mkrtos_user/lib/sys_svr/src/drv_svr.c
@@ -12,7 +12,7 @@ RPC_GENERATION_OP2(drv_t, FS_PROT, DRV_OPEN, open,
                    rpc_uint32_t_t, rpc_uint32_t_t, RPC_DIR_IN, RPC_TYPE_DATA, oflags)
 {
     name->data[name->len - 1] = 0;
-    return dev_open(name->data, oflags->data);
+    return dev_open((char *)name->data, oflags->data);
 }
 
 RPC_GENERATION_DISPATCH2(drv_t, FS_PROT, DRV_OPEN, open,
diff --git a/mkrtos_user/lib/sys_svr/src/fs_cli.c b/mkrtos_user/lib/sys_svr/src/fs_cli.c
index 1a4803c20..799c89ef6 100644
--- a/mkrtos_user/lib/sys_svr/src/fs_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/fs_cli.c
@@ -21,20 +21,11 @@ RPC_GENERATION_CALL3(fs_t, FS_PROT, FS_OPEN, open,
                      rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, flags,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, mode)
-sd_t fs_open(const char *path, int flags, int mode)
+int fs_open_raw(obj_handler_t fs_hd, const char *path, int flags, int mode)
 {
-    assert(path);
-    obj_handler_t hd;
-    int ret = ns_query(path, &hd, 0x1);
-
-    if (ret < 0)
-    {
-        return ret;
-    }
-
     rpc_ref_file_array_t rpc_path = {
-        .data = (uint8_t *)(&path[ret]),
-        .len = strlen(&path[ret]) + 1,
+        .data = (uint8_t *)(path),
+        .len = strlen(path) + 1,
     };
     rpc_int_t rpc_flags = {
         .data = flags,
@@ -42,46 +33,53 @@ sd_t fs_open(const char *path, int flags, int mode)
     rpc_int_t rpc_mode = {
         .data = mode,
     };
-    msg_tag_t tag = fs_t_open_call(hd, &rpc_path, &rpc_flags, &rpc_mode);
+    msg_tag_t tag = fs_t_open_call(fs_hd, &rpc_path, &rpc_flags, &rpc_mode);
 
-    if (msg_tag_get_val(tag) < 0)
+    return msg_tag_get_val(tag);
+}
+sd_t fs_open(const char *path, int flags, int mode)
+{
+    assert(path);
+    obj_handler_t hd;
+    int ret = ns_query(path, &hd);
+
+    if (ret < 0)
     {
-        return msg_tag_get_val(tag);
+        return ret;
     }
-
-    return mk_sd_init2(hd, msg_tag_get_val(tag)).raw;
+    ret = fs_open_raw(hd, &path[ret], flags, mode);
+    if (ret < 0)
+    {
+        return ret;
+    }
+    return mk_sd_init2(hd, ret).raw;
 }
 /*close*/
 RPC_GENERATION_CALL1(fs_t, FS_PROT, FS_CLOSE, close,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd)
-int fs_close(sd_t _fd)
+int fs_close_raw(obj_handler_t hd, int fd)
 {
-    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
-    int fd = mk_sd_init_raw(_fd).fd;
-
     rpc_int_t rpc_fd = {
         .data = fd,
     };
     msg_tag_t tag = fs_t_close_call(hd, &rpc_fd);
 
-    if (msg_tag_get_val(tag) < 0)
-    {
-        return msg_tag_get_val(tag);
-    }
-
     return msg_tag_get_val(tag);
 }
+int fs_close(sd_t _fd)
+{
+    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
+    int fd = mk_sd_init_raw(_fd).fd;
+
+    return fs_close_raw(hd, fd);
+}
 /*read*/
 RPC_GENERATION_CALL3(fs_t, FS_PROT, FS_READ, read,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd,
                      rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_OUT, RPC_TYPE_DATA, buf,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, len)
-
-int fs_read(sd_t _fd, void *buf, size_t len)
+int fs_read_raw(obj_handler_t hd, int fd, void *buf, size_t len)
 {
-    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
-    int fd = mk_sd_init_raw(_fd).fd;
-
     rpc_int_t rpc_fd = {
         .data = fd,
     };
@@ -114,6 +112,13 @@ int fs_read(sd_t _fd, void *buf, size_t len)
 
     return rlen;
 }
+int fs_read(sd_t _fd, void *buf, size_t len)
+{
+    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
+    int fd = mk_sd_init_raw(_fd).fd;
+
+    return fs_read_raw(hd, fd, buf, len);
+}
 /*write*/
 RPC_GENERATION_CALL3(fs_t, FS_PROT, FS_WRITE, write,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd,
@@ -246,11 +251,8 @@ int fs_ftruncate(sd_t _fd, off_t off)
 RPC_GENERATION_CALL2(fs_t, FS_PROT, FS_FSTAT, fstat,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd,
                      rpc_kstat_t_t, rpc_kstat_t_t, RPC_DIR_OUT, RPC_TYPE_DATA, statbuf)
-int fs_fstat(sd_t _fd, kstat_t *stat)
+int fs_fstat_raw(obj_handler_t hd, int fd, kstat_t *stat)
 {
-    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
-    int fd = mk_sd_init_raw(_fd).fd;
-
     rpc_int_t rpc_fd = {
         .data = fd,
     };
@@ -271,6 +273,13 @@ int fs_fstat(sd_t _fd, kstat_t *stat)
 
     return msg_tag_get_val(tag);
 }
+int fs_fstat(sd_t _fd, kstat_t *stat)
+{
+    obj_handler_t hd = mk_sd_init_raw(_fd).hd;
+    int fd = mk_sd_init_raw(_fd).fd;
+
+    return fs_fstat_raw(hd, fd, stat);
+}
 // int ioctl(int fd, int req, void *arg)
 RPC_GENERATION_CALL3(fs_t, FS_PROT, FS_IOCTL, ioctl,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, fd,
@@ -292,10 +301,6 @@ int fs_ioctl(sd_t _fd, int req, void *arg)
     };
     msg_tag_t tag;
 
-    if (!stat)
-    {
-        return -EINVAL;
-    }
     tag = fs_t_ioctl_call(hd, &rpc_fd, &rpc_req, &rpc_arg);
 
     return msg_tag_get_val(tag);
@@ -321,10 +326,6 @@ int fs_fcntl(sd_t _fd, int cmd, void *arg)
     };
     msg_tag_t tag;
 
-    if (!stat)
-    {
-        return -EINVAL;
-    }
     tag = fs_t_fcntl_call(hd, &rpc_fd, &rpc_cmd, &rpc_arg);
 
     return msg_tag_get_val(tag);
@@ -370,13 +371,13 @@ int fs_symlink(const char *src, const char *dst)
     obj_handler_t src_hd;
     obj_handler_t dst_hd;
 
-    int src_ret = ns_query(src, &src_hd, 0x1);
+    int src_ret = ns_query(src, &src_hd);
 
     if (src_ret < 0)
     {
         return src_ret;
     }
-    int dst_ret = ns_query(dst, &dst_hd, 0x1);
+    int dst_ret = ns_query(dst, &dst_hd);
 
     if (dst_ret < 0)
     {
@@ -408,7 +409,7 @@ RPC_GENERATION_CALL1(fs_t, FS_PROT, FS_MKDIR, mkdir,
 int fs_mkdir(char *path)
 {
     obj_handler_t hd;
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);
 
     if (ret < 0)
     {
@@ -432,7 +433,7 @@ RPC_GENERATION_CALL1(fs_t, FS_PROT, FS_RMDIR, rmdir,
 int fs_rmdir(char *path)
 {
     obj_handler_t hd;
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);
 
     if (ret < 0)
     {
@@ -458,13 +459,13 @@ int fs_rename(char *old, char *new)
     obj_handler_t src_hd;
     obj_handler_t dst_hd;
 
-    int src_ret = ns_query(old, &src_hd, 0x1);
+    int src_ret = ns_query(old, &src_hd);
 
     if (src_ret < 0)
     {
         return src_ret;
     }
-    int dst_ret = ns_query(new, &dst_hd, 0x1);
+    int dst_ret = ns_query(new, &dst_hd);
 
     if (dst_ret < 0)
     {
@@ -501,7 +502,7 @@ int fs_stat(char *path, void *_buf)
     {
         return -EINVAL;
     }
-    int ret = ns_query(path, &hd, 0x0);
+    int ret = ns_query(path, &hd);
 
     if (ret < 0)
     {
@@ -535,7 +536,7 @@ int fs_readlink(const char *path, char *buf, int bufsize)
     {
         return -EINVAL;
     }
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);
 
     if (ret < 0)
     {
@@ -546,7 +547,7 @@ int fs_readlink(const char *path, char *buf, int bufsize)
         .len = strlen(&path[ret]) + 1,
     };
     rpc_ref_file_array_t rpc_buf = {
-        .data = buf,
+        .data = (uint8_t *)buf,
         .len = bufsize,
     };
     rpc_int_t rpc_bufsize = {
@@ -570,7 +571,7 @@ int fs_statfs(const char *path, statfs_t *buf)
     {
         return -EINVAL;
     }
-    int ret = ns_query(path, &hd, 0x1);
+    int ret = ns_query(path, &hd);
 
     if (ret < 0)
     {
diff --git a/mkrtos_user/lib/sys_svr/src/fs_svr.c b/mkrtos_user/lib/sys_svr/src/fs_svr.c
index 2e4c10f21..05fd00aad 100644
--- a/mkrtos_user/lib/sys_svr/src/fs_svr.c
+++ b/mkrtos_user/lib/sys_svr/src/fs_svr.c
@@ -218,7 +218,7 @@ RPC_GENERATION_OP1(fs_t, FS_PROT, FS_UNLINK, unlink,
         return -ENOSYS;
     }
     path->data[path->len - 1] = 0;
-    return obj->op->fs_svr_unlink(path->data);
+    return obj->op->fs_svr_unlink((char *)path->data);
 }
 RPC_GENERATION_DISPATCH1(fs_t, FS_PROT, FS_UNLINK, unlink,
                          rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path)
@@ -234,7 +234,7 @@ RPC_GENERATION_OP2(fs_t, FS_PROT, FS_SYMLINK, symlink,
     src->data[src->len - 1] = 0;
     dst->data[dst->len - 1] = 0;
 
-    return obj->op->fs_svr_symlink(src->data, src->data);
+    return obj->op->fs_svr_symlink((char *)src->data, (char *)src->data);
 }
 RPC_GENERATION_DISPATCH2(fs_t, FS_PROT, FS_SYMLINK, symlink,
                          rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, src,
@@ -249,7 +249,7 @@ RPC_GENERATION_OP1(fs_t, FS_PROT, FS_MKDIR, mkdir,
         return -ENOSYS;
     }
     dir->data[dir->len - 1] = 0;
-    return obj->op->fs_svr_mkdir(dir->data);
+    return obj->op->fs_svr_mkdir((char *)dir->data);
 }
 RPC_GENERATION_DISPATCH1(fs_t, FS_PROT, FS_MKDIR, mkdir,
                          rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, dir)
@@ -262,7 +262,7 @@ RPC_GENERATION_OP1(fs_t, FS_PROT, FS_RMDIR, rmdir,
         return -ENOSYS;
     }
     dir->data[dir->len - 1] = 0;
-    return obj->op->fs_svr_rmdir(dir->data);
+    return obj->op->fs_svr_rmdir((char *)dir->data);
 }
 RPC_GENERATION_DISPATCH1(fs_t, FS_PROT, FS_RMDIR, rmdir,
                          rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, dir)
@@ -279,7 +279,7 @@ RPC_GENERATION_OP2(fs_t, FS_PROT, FS_RENAME, rename,
     old->data[old->len - 1] = 0;
     new->data[new->len - 1] = 0;
 
-    return obj->op->fs_svr_rename(old->data, new->data);
+    return obj->op->fs_svr_rename((char *)old->data, (char *)new->data);
 }
 RPC_GENERATION_DISPATCH2(fs_t, FS_PROT, FS_RENAME, rename,
                          rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, old,
@@ -295,7 +295,7 @@ RPC_GENERATION_OP2(fs_t, FS_PROT, FS_STAT, stat,
         return -ENOSYS;
     }
     path->data[path->len - 1] = 0;
-    return obj->op->fs_svr_stat(path->data, &buf->data);
+    return obj->op->fs_svr_stat((char *)path->data, &buf->data);
 }
 RPC_GENERATION_DISPATCH2(fs_t, FS_PROT, FS_STAT, stat,
                          rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
@@ -314,7 +314,7 @@ RPC_GENERATION_OP3(fs_t, FS_PROT, FS_READLINK, readlink,
     path->data[path->len - 1] = 0;
     // buf->data[buf->len - 1] = 0;
 
-    return obj->op->fs_svr_readlink(path->data, buf->data, MIN(bufsize->data, buf->len));
+    return obj->op->fs_svr_readlink((char *)path->data, (char *)buf->data, MIN(bufsize->data, buf->len));
 }
 RPC_GENERATION_DISPATCH3(fs_t, FS_PROT, FS_READLINK, readlink,
                          rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
@@ -331,7 +331,7 @@ RPC_GENERATION_OP2(fs_t, FS_PROT, FS_STATFS, statfs,
         return -ENOSYS;
     }
     path->data[path->len - 1] = 0;
-    return obj->op->fs_svr_statfs(path->data, &buf->data);
+    return obj->op->fs_svr_statfs((char *)(path->data), &buf->data);
 }
 RPC_GENERATION_DISPATCH2(fs_t, FS_PROT, FS_STATFS, statfs,
                          rpc_ref_file_array_t, rpc_file_array_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
diff --git a/mkrtos_user/lib/sys_svr/src/net_cli.c b/mkrtos_user/lib/sys_svr/src/net_cli.c
index 592f1024c..c1c340054 100644
--- a/mkrtos_user/lib/sys_svr/src/net_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/net_cli.c
@@ -334,7 +334,6 @@ int net_recv(int s, void *mem, size_t len, int flags)
     rpc_int_t rpc_flags = {
         .data = flags,
     };
-    msg_tag_t tag;
 
     int rlen = 0;
     int r_once_len = 0;
@@ -404,7 +403,6 @@ int net_recvfrom(int s, void *mem, size_t len, int flags,
     {
         rpc_fromlen.data = *fromlen;
     }
-    msg_tag_t tag;
 
     int rlen = 0;
     int r_once_len = 0;
@@ -457,7 +455,6 @@ int net_send(int s, const void *dataptr, size_t size, int flags)
         .data = flags,
     };
 
-    msg_tag_t tag;
 
     int rlen = 0;
     int w_once_len = 0;
@@ -524,7 +521,6 @@ int net_sendto(int s, const void *dataptr, size_t size, int flags,
     rpc_socklen_t_t rpc_tolen = {
         .data = tolen,
     };
-    msg_tag_t tag;
 
     int rlen = 0;
     int w_once_len = 0;
@@ -566,7 +562,7 @@ int net_socket(int domain, int type, int protocol)
     {
     case AF_INET:
     case AF_INET6:
-        ret = ns_query_svr("/sys/net" /*FIXME:更改为宏*/, &hd, 1);
+        ret = ns_query_svr("/sys/net" /*FIXME:更改为宏*/, &hd);
         break;
     default:
         return -ENOSYS;
diff --git a/mkrtos_user/lib/sys_svr/src/ns_cli.c b/mkrtos_user/lib/sys_svr/src/ns_cli.c
index 9aac32bf1..9ed241f60 100644
--- a/mkrtos_user/lib/sys_svr/src/ns_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/ns_cli.c
@@ -35,7 +35,6 @@ static pthread_spinlock_t ns_cli_cache_lock;
 static obj_handler_t find_hd(const char *path, int *split_pos)
 {
     int i = 0;
-    int empty = -1;
 
     pthread_spin_lock(&ns_cli_cache_lock);
     for (i = 0; i < NS_CLI_CACHE_NR; i++)
@@ -72,7 +71,6 @@ static obj_handler_t find_hd(const char *path, int *split_pos)
 static bool_t reg_hd(const char *path, obj_handler_t hd, int split_inx)
 {
     int i = 0;
-    int empty = -1;
 
     pthread_spin_lock(&ns_cli_cache_lock);
     for (i = 0; i < NS_CLI_CACHE_NR; i++)
@@ -92,7 +90,6 @@ static bool_t reg_hd(const char *path, obj_handler_t hd, int split_inx)
 static void del_hd(obj_handler_t hd)
 {
     int i = 0;
-    int empty = -1;
 
     pthread_spin_lock(&ns_cli_cache_lock);
     for (i = 0; i < NS_CLI_CACHE_NR; i++)
@@ -135,7 +132,7 @@ int ns_register(const char *path, obj_handler_t svr_hd, int flags)
     return msg_tag_get_val(tag);
 }
 
-int ns_query(const char *path, obj_handler_t *svr_hd, int flags)
+int ns_query(const char *path, obj_handler_t *svr_hd)
 {
     int inx = 0;
     assert(path);
@@ -215,11 +212,11 @@ next:
     *svr_hd = newfd;
     return msg_tag_get_val(tag);
 }
-int ns_query_svr(const char *path, obj_handler_t *svr_hd, int flags)
+int ns_query_svr(const char *path, obj_handler_t *svr_hd)
 {
     int ret;
 
-    ret = ns_query(path, svr_hd, flags);
+    ret = ns_query(path, svr_hd);
     if (ret < 0)
     {
         return ret;
diff --git a/mkrtos_user/lib/sys_svr/src/pm_cli.c b/mkrtos_user/lib/sys_svr/src/pm_cli.c
index eb76f2fe7..3156bf025 100644
--- a/mkrtos_user/lib/sys_svr/src/pm_cli.c
+++ b/mkrtos_user/lib/sys_svr/src/pm_cli.c
@@ -13,19 +13,20 @@
 
 RPC_GENERATION_CALL6(pm_t, PM_PROT, PM_RUN_APP, run_app,
                      rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
-                     rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, mem_block,
+                     rpc_umword_t_t, rpc_umword_t_t, RPC_DIR_IN, RPC_TYPE_DATA, pm_flags,
                      rpc_ref_array_uint32_t_uint8_t_96_t, rpc_array_uint32_t_uint8_t_96_t, RPC_DIR_IN, RPC_TYPE_DATA, params,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, params_len,
                      rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, envs,
                      rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, envs_len)
-int pm_run_app(const char *path, int mem_block, uint8_t *params, int params_len, uint8_t *envs, int envs_len)
+int pm_run_app(const char *path, int16_t mem_block, int16_t flags, 
+    int pid, uint8_t *params, int params_len, uint8_t *envs, int envs_len)
 {
     rpc_ref_array_uint32_t_uint8_t_64_t rpc_path = {
-        .data = (uint8_t *)path,
-        .len = MIN(strlen(path) + 1, 64),
+        .data = (uint8_t *)path ? (uint8_t *)path : (uint8_t *)"",
+        .len = path ? MIN(strlen(path) + 1, 64) : 1,
     };
-    rpc_int_t rpc_mem_block = {
-        .data = mem_block,
+    rpc_umword_t_t rpc_mem_block = {
+        .data = pm_flags_init(mem_block, flags, pid).raw,
     };
     rpc_ref_array_uint32_t_uint8_t_96_t rpc_params = {
         .data = (uint8_t *)params ? params : (uint8_t *)"",
diff --git a/mkrtos_user/lib/sys_svr/src/pm_svr.c b/mkrtos_user/lib/sys_svr/src/pm_svr.c
index 2e4794fb2..84506b03d 100644
--- a/mkrtos_user/lib/sys_svr/src/pm_svr.c
+++ b/mkrtos_user/lib/sys_svr/src/pm_svr.c
@@ -24,7 +24,7 @@
  */
 RPC_GENERATION_OP6(pm_t, PM_PROT, PM_RUN_APP, run_app,
                    rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
-                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, mem_block,
+                   rpc_umword_t_t, rpc_umword_t_t, RPC_DIR_IN, RPC_TYPE_DATA, pm_flags,
                    rpc_ref_array_uint32_t_uint8_t_96_t, rpc_array_uint32_t_uint8_t_96_t, RPC_DIR_IN, RPC_TYPE_DATA, params,
                    rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, params_len,
                    rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, envs,
@@ -33,14 +33,18 @@ RPC_GENERATION_OP6(pm_t, PM_PROT, PM_RUN_APP, run_app,
 {
     int16_t ret = -1;
 
-    path->data[path->len - 1] = 0;
-    ret = pm_rpc_run_app(path->data, mem_block->data, params->data, params_len->data, envs->data, envs_len->data);
+    if (path->len)
+    {
+        path->data[path->len - 1] = 0;
+    }
+    ret = pm_rpc_run_app((char *)path->data, pm_flags_init_raw(pm_flags->data),
+    (char *)params->data, params_len->data, (char *)envs->data, envs_len->data);
     return ret;
 }
 
 RPC_GENERATION_DISPATCH6(pm_t, PM_PROT, PM_RUN_APP, run_app,
                    rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, path,
-                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, mem_block,
+                   rpc_umword_t_t, rpc_umword_t_t, RPC_DIR_IN, RPC_TYPE_DATA, pm_flags,
                    rpc_ref_array_uint32_t_uint8_t_96_t, rpc_array_uint32_t_uint8_t_96_t, RPC_DIR_IN, RPC_TYPE_DATA, params,
                    rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, params_len,
                    rpc_ref_array_uint32_t_uint8_t_64_t, rpc_array_uint32_t_uint8_t_64_t, RPC_DIR_IN, RPC_TYPE_DATA, envs,
diff --git a/mkrtos_user/lib/sys_svr/src/sig_svr.c b/mkrtos_user/lib/sys_svr/src/sig_svr.c
index 95cbe131e..2f42255de 100644
--- a/mkrtos_user/lib/sys_svr/src/sig_svr.c
+++ b/mkrtos_user/lib/sys_svr/src/sig_svr.c
@@ -18,18 +18,18 @@
 
 RPC_GENERATION_OP2(sig_t, SIG_PORT, SIG_KILL, kill,
                    rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, flags,
-                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, resv)
+                   rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, pid)
 {
     if (!obj->op->kill)
     {
         return -ENOSYS;
     }
-    return obj->op->kill(flags->data, resv->data);
+    return obj->op->kill(flags->data, pid->data);
 }
 
 RPC_GENERATION_DISPATCH2(sig_t, SIG_PORT, SIG_KILL, kill,
                          rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, flags,
-                         rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, resv)
+                         rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, pid)
 
 RPC_GENERATION_OP2(sig_t, SIG_PORT, SIG_TOKILL, to_kill,
                    rpc_int_t, rpc_int_t, RPC_DIR_IN, RPC_TYPE_DATA, flags,
diff --git a/mkrtos_user/lib/sys_util/inc/u_app_loader.h b/mkrtos_user/lib/sys_util/inc/u_app_loader.h
index f58c533bc..7d6846ea2 100644
--- a/mkrtos_user/lib/sys_util/inc/u_app_loader.h
+++ b/mkrtos_user/lib/sys_util/inc/u_app_loader.h
@@ -3,7 +3,8 @@
 #include "u_env.h"
 #include "u_hd_man.h"
 
-int app_load(const char *name, uenv_t *cur_env, pid_t *pid,
+int app_load(const char *name,
+             uenv_t *cur_env, pid_t *pid,
              char *argv[], int arg_cn,
              char *envp[], int envp_cn,
-             int mem_block);
\ No newline at end of file
+             int mem_blockpm, bool_t load_to_ram);
\ No newline at end of file
diff --git a/mkrtos_user/lib/sys_util/inc/u_rpc.h b/mkrtos_user/lib/sys_util/inc/u_rpc.h
index bf23aed3e..5fa8b92cd 100644
--- a/mkrtos_user/lib/sys_util/inc/u_rpc.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc.h
@@ -24,7 +24,7 @@
 #include <sys/statfs.h>
 
 typedef struct stat stat_t;
-// typedef struct kstat kstat_t;
+typedef struct kstat kstat_t;
 typedef struct statfs statfs_t;
 typedef struct dirent dirent_t;
 
diff --git a/mkrtos_user/lib/sys_util/inc/u_rpc_1.h b/mkrtos_user/lib/sys_util/inc/u_rpc_1.h
index 8549c4740..73e2f5e1e 100644
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_1.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_1.h
@@ -11,7 +11,7 @@
  * @brief 该宏用于生成一个客户端的调用函数（传递一个参数）
  *
  */
-#define RPC_GENERATION_CALL1(struct_type, prot, op, func_name, cli_type0, svr_type0, dir0, rpc_type0, name0)              \
+#define RPC_GENERATION_CALL1(struct_type, prot, op, func_name, cli_type0, svr_type0, dir0, rpc_type0, name0)                       \
     msg_tag_t struct_type##_##func_name##_call(obj_handler_t hd, cli_type0 *var0)                                                  \
     {                                                                                                                              \
         void *buf;                                                                                                                 \
@@ -22,7 +22,6 @@
                                                                                                                                    \
         int off = 0;                                                                                                               \
         int off_buf = 0;                                                                                                           \
-        int ret = -1;                                                                                                              \
         umword_t op_val = op;                                                                                                      \
         /*拷贝op*/                                                                                                                 \
         rpc_memcpy(msg_ipc->msg_buf, &op_val, sizeof(op_val));                                                                     \
@@ -32,8 +31,8 @@
         PRC_CLI_FILL_MAP_BUF(rpc_type0, cli_type0, var0, dir0, (uint8_t *)msg_ipc->map_buf, off_buf);                              \
         /*msg_tag_t tag = dispatch_test(msg_tag_init4(0, ROUND_UP(off, WORD_BYTES), ROUND_UP(off_buf, WORD_BYTES), 0), msg_ipc);*/ \
         msg_tag_t tag;                                                                                                             \
-        tag = thread_ipc_fast_call(msg_tag_init4(0, ROUND_UP(off, WORD_BYTES), ROUND_UP(off_buf, WORD_BYTES), prot),           \
-                                    hd, 1111, 2222, 3333);                                                                      \
+        tag = thread_ipc_fast_call(msg_tag_init4(0, ROUND_UP(off, WORD_BYTES), ROUND_UP(off_buf, WORD_BYTES), prot),               \
+                                   hd, 1111, 2222, 3333);                                                                          \
         if (msg_tag_get_val(tag) < 0)                                                                                              \
         {                                                                                                                          \
             return tag;                                                                                                            \
diff --git a/mkrtos_user/lib/sys_util/inc/u_rpc_2.h b/mkrtos_user/lib/sys_util/inc/u_rpc_2.h
index 522cafbba..0995b1673 100644
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_2.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_2.h
@@ -21,7 +21,6 @@
                                                                                                                                     \
         int off = 0;                                                                                                                \
         int off_buf = 0;                                                                                                            \
-        int ret = -1;                                                                                                               \
         umword_t op_val = op;                                                                                                       \
         /*拷贝op*/                                                                                                                  \
         rpc_memcpy(msg_ipc->msg_buf, &op_val, sizeof(op_val));                                                                      \
diff --git a/mkrtos_user/lib/sys_util/inc/u_rpc_3.h b/mkrtos_user/lib/sys_util/inc/u_rpc_3.h
index b92ca55b6..c553036b1 100644
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_3.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_3.h
@@ -22,7 +22,6 @@
                                                                                                                                     \
         int off = 0;                                                                                                                \
         int off_buf = 0;                                                                                                            \
-        int ret = -1;                                                                                                               \
         umword_t op_val = op;                                                                                                       \
         /*拷贝op*/                                                                                                                  \
         rpc_memcpy(msg_ipc->msg_buf, &op_val, __alignof(op_val));                                                                   \
@@ -55,9 +54,9 @@
                                  cli_type2, svr_type2, dir2, rpc_type2, name2)                                     \
     msg_tag_t struct_type##_##func_name##_dispatch(struct_type *obj, msg_tag_t tag, ipc_msg_t *ipc_msg)            \
     {                                                                                                              \
-        svr_type0 var0;                                                                                            \
-        svr_type1 var1;                                                                                            \
-        svr_type2 var2;                                                                                            \
+        svr_type0 var0 = {};                                                                                            \
+        svr_type1 var1 = {};                                                                                            \
+        svr_type2 var2 = {};                                                                                            \
         size_t op_val;                                                                                             \
         uint8_t *value = (uint8_t *)(ipc_msg->msg_buf);                                                            \
         uint8_t *map_value = (uint8_t *)(ipc_msg->map_buf);                                                        \
diff --git a/mkrtos_user/lib/sys_util/inc/u_rpc_4.h b/mkrtos_user/lib/sys_util/inc/u_rpc_4.h
index ae23db866..7a2bef67d 100644
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_4.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_4.h
@@ -23,7 +23,6 @@
                                                                                                                                      \
         int off = 0;                                                                                                                 \
         int off_buf = 0;                                                                                                             \
-        int ret = -1;                                                                                                                \
         umword_t op_val = op;                                                                                                        \
         /*拷贝op*/                                                                                                                   \
         rpc_memcpy(msg_ipc->msg_buf, &op_val, __alignof(op_val));                                                                    \
diff --git a/mkrtos_user/lib/sys_util/inc/u_rpc_5.h b/mkrtos_user/lib/sys_util/inc/u_rpc_5.h
index fd7ad126b..881aef78c 100644
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_5.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_5.h
@@ -24,7 +24,6 @@
                                                                                                                                                       \
         int off = 0;                                                                                                                                  \
         int off_buf = 0;                                                                                                                              \
-        int ret = -1;                                                                                                                                 \
         umword_t op_val = op;                                                                                                                         \
         /*拷贝op*/                                                                                                                                    \
         rpc_memcpy(msg_ipc->msg_buf, &op_val, __alignof(op_val));                                                                                     \
diff --git a/mkrtos_user/lib/sys_util/inc/u_rpc_6.h b/mkrtos_user/lib/sys_util/inc/u_rpc_6.h
index 026963b44..d7db4dc60 100644
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_6.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_6.h
@@ -25,7 +25,6 @@
                                                                                                                                                                        \
         int off = 0;                                                                                                                                                   \
         int off_buf = 0;                                                                                                                                               \
-        int ret = -1;                                                                                                                                                  \
         umword_t op_val = op;                                                                                                                                          \
         /*拷贝op*/                                                                                                                                                     \
         rpc_memcpy(msg_ipc->msg_buf, &op_val, __alignof(op_val));                                                                                                      \
diff --git a/mkrtos_user/lib/sys_util/inc/u_rpc_svr.h b/mkrtos_user/lib/sys_util/inc/u_rpc_svr.h
index 57ef679bf..5a6c57bc0 100644
--- a/mkrtos_user/lib/sys_util/inc/u_rpc_svr.h
+++ b/mkrtos_user/lib/sys_util/inc/u_rpc_svr.h
@@ -18,6 +18,7 @@ static inline int rpc_svr_obj_init(rpc_svr_obj_t *obj, rpc_dispatch_func dis, mw
 {
     obj->dispatch = dis;
     obj->prot = prot;
+    return 0;
 }
 
 #define META_PROT_NR 4
diff --git a/mkrtos_user/lib/sys_util/src/u_app_loader.c b/mkrtos_user/lib/sys_util/src/u_app_loader.c
index d52d7b1f2..5cbd6614d 100644
--- a/mkrtos_user/lib/sys_util/src/u_app_loader.c
+++ b/mkrtos_user/lib/sys_util/src/u_app_loader.c
@@ -110,111 +110,251 @@ static void *app_stack_push_array(obj_handler_t task_obj, umword_t **stack, uint
 
     return *stack;
 }
+#if 1
+struct kstat
+{
+    long st_dev;
+    int __st_dev_padding;
+    long __st_ino_truncated;
+    mode_t st_mode;
+    nlink_t st_nlink;
+    uid_t st_uid;
+    gid_t st_gid;
+    long st_rdev;
+    int __st_rdev_padding;
+    long st_size;
+    blksize_t st_blksize;
+    long st_blocks;
+    long st_atime_sec;
+    long st_atime_nsec;
+    long st_mtime_sec;
+    long st_mtime_nsec;
+    long st_ctime_sec;
+    long st_ctime_nsec;
+    long st_ino;
+};
+typedef struct kstat kstat_t;
 
+#include "u_malloc.h"
+#include "fs_cli.h"
+// #include "ns.h"
+#include <fcntl.h>
+
+static int app_file_ram_copy_to_task(obj_handler_t task_hd, void *file_ram, size_t size)
+{
+    msg_tag_t tag;
+    addr_t ram_addr;
+    size_t ram_size;
+    tag = task_alloc_get_ram_info(task_hd, &ram_addr, &ram_size);
+    if (msg_tag_get_val(tag) < 0)
+    {
+        u_free(file_ram);
+        return msg_tag_get_val(tag);
+    }
+    tag = task_copy_data_to(TASK_THIS, task_hd, (void *)file_ram, (void *)ram_addr, size);
+    if (msg_tag_get_val(tag) < 0)
+    {
+        u_free(file_ram);
+        return msg_tag_get_val(tag);
+    }
+    u_free(file_ram);
+    return 0;
+}
 /**
- * @brief 加载并执行一个app
- *
- * @param name app的名字
- * @return int
+ * load app and get addr.
  */
-int app_load(const char *name, uenv_t *cur_env, pid_t *pid,
-             char *argv[], int arg_cn,
-             char *envp[], int envp_cn,
-             int mem_block)
+static int app_file_load(const char *name, obj_handler_t task_hd, addr_t *start_addr, size_t *total_size, bool_t load_to_ram)
 {
     msg_tag_t tag;
     sys_info_t sys_info;
+    umword_t addr;
+    int ret = 0;
+    unsigned long size;
 
     tag = sys_read_info(SYS_PROT, &sys_info, 0);
     if (msg_tag_get_val(tag) < 0)
     {
         return -ENOENT;
     }
-    int type;
-    umword_t addr;
-    int ret = 0;
-    unsigned long size;
-
-#if IS_ENABLED(CONFIG_CPIO_SUPPORT)
-    ret = cpio_find_file((umword_t)sys_info.bootfs_start_addr, (umword_t)(-1), name, NULL, &type, &addr);
-#else
-    type = 0;
-    addr = (umword_t)appfs_tiny_find_file_addr_by_name(appfs_tiny_get_form_addr((void *)sys_info.bootfs_start_addr), name, &size);
-    if (addr == 0)
+    if (load_to_ram)
     {
-        ret = -ENOENT;
-    }
-#endif
-    if (ret < 0 || (ret >= 0 && type == 1))
-    {
-        return -ENOENT;
-    }
-    addr_t entry_addr;
-    app_info_t *app = app_info_get((void *)addr);
-    addr_t at_base = addr;
-    if (app == NULL)
-    {
-        addr_t text_addr;
-        ret = elf32_load((umword_t)addr, 0 /*TODO:*/,
-                         &entry_addr, 0, &text_addr);
+        // read form file.
+        void *file_ram = NULL;
+        kstat_t stat;
+        obj_handler_t hd;
+        int fd;
+        extern int namespace_query(const char *path, obj_handler_t *hd);
+        ret = namespace_query(name, &hd);
         if (ret < 0)
         {
-            printf("app format is error.\n");
-            return -1;
+            return ret;
         }
-
-        addr = entry_addr + text_addr;
-        app = app_info_get((void *)addr);
-        if (app == NULL)
+        fd = fs_open_raw(hd, name + ret, O_RDWR, 0777);
+        if (fd < 0)
         {
-            printf("app format is error.\n");
-            return -1;
+            return fd;
         }
-        printf("%s text addr is [0x%x]\n", name, text_addr);
-        printf("entry addr is [0x%x]\n", addr);
+        ret = fs_fstat_raw(hd, fd, &stat);
+        if (ret < 0)
+        {
+            fs_close_raw(hd, fd);
+            return ret;
+        }
+        file_ram = u_malloc(stat.st_size);
+        if (!file_ram)
+        {
+            fs_close_raw(hd, fd);
+            return -ENOMEM;
+        }
+        ret = fs_read_raw(hd, fd, file_ram, stat.st_size);
+        if (ret != stat.st_size)
+        {
+            fs_close_raw(hd, fd);
+            u_free(file_ram);
+            return -EIO;
+        }
+        fs_close_raw(hd, fd);
+        // addr_t ram_addr;
+        // size_t ram_size;
+        // tag = task_alloc_get_ram_info(task_hd, &ram_addr, &ram_size);
+        // if (msg_tag_get_val(tag) < 0)
+        // {
+        //     u_free(file_ram);
+        //     return msg_tag_get_val(tag);
+        // }
+        *start_addr = (addr_t)file_ram;
+        *total_size = stat.st_size;
+        return 0;
+    }
+    else
+    {
+#if IS_ENABLED(CONFIG_CPIO_SUPPORT)
+        ret = cpio_find_file((umword_t)sys_info.bootfs_start_addr, (umword_t)(-1), name, NULL, &type, &addr);
+        if (ret < 0 || type == 1)
+        {
+            return -ENOENT;
+        }
+#else
+        addr = (umword_t)appfs_tiny_find_file_addr_by_name(appfs_tiny_get_form_addr((void *)sys_info.bootfs_start_addr), name, &size);
+        if (addr == 0)
+        {
+            ret = -ENOENT;
+        }
+        *start_addr = addr;
+        *total_size = size;
+#endif
+    }
+    return ret;
+}
+#endif
+/**
+ * @brief 加载并执行一个app
+ *
+ * @param name app的名字
+ * @return int
+ */
+int app_load(const char *name,
+             uenv_t *cur_env, pid_t *pid,
+             char *argv[], int arg_cn,
+             char *envp[], int envp_cn,
+             int mem_block, bool_t load_to_ram)
+{
+    assert(name);
+    assert(cur_env);
+    assert(pid);
+    umword_t ram_base;
+
+    msg_tag_t tag;
+    bool_t is_ext_hd_task = FALSE;
+
+    is_ext_hd_task = *pid != HANDLER_INVALID ? TRUE : FALSE;
+    umword_t addr;
+    int ret = 0;
+    size_t size;
+
+    ret = app_file_load(name, *pid, &addr, &size, load_to_ram);
+    if (ret < 0)
+    {
+        return ret;
+    }
+    if (addr == 0)
+    {
+        return -1;
+    }
+    app_info_t *app = app_info_get((void *)addr);
+
+    if (app == NULL)
+    {
+        printf("app format is error.\n");
+        return -ENOENT;
     }
     else
     {
         printf("%s addr is [0x%x]\n", name, app);
     }
-    umword_t ram_base;
-    obj_handler_t hd_task = handler_alloc();
-    obj_handler_t hd_thread = handler_alloc();
+    obj_handler_t hd_task;
+    obj_handler_t hd_thread = HANDLER_INVALID;
 
-    if (hd_task == HANDLER_INVALID)
+    if (is_ext_hd_task)
     {
-        goto end;
+        hd_task = *pid; /*FIXME:*/
     }
+    else
+    {
+        hd_task = handler_alloc();
+        if (hd_task == HANDLER_INVALID)
+        {
+            goto end;
+        }
+    }
+    hd_thread = handler_alloc();
+
     if (hd_thread == HANDLER_INVALID)
     {
         goto end;
     }
-    tag = factory_create_task(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, hd_task));
-    if (msg_tag_get_prot(tag) < 0)
+    if (!is_ext_hd_task)
     {
-        goto end_del_obj;
+        tag = factory_create_task(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, hd_task));
+        if (msg_tag_get_prot(tag) < 0)
+        {
+            goto end_del_obj;
+        }
     }
     tag = factory_create_thread(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, hd_thread));
     if (msg_tag_get_prot(tag) < 0)
     {
         goto end_del_obj;
     }
-    tag = task_alloc_ram_base(hd_task, app ? app->i.ram_size : 100 * 1024 /*TODO:*/,
-                              &ram_base, mem_block, (addr_t)addr, size);
-    if (msg_tag_get_prot(tag) < 0)
+    if (!is_ext_hd_task)
     {
-        goto end_del_obj;
+        tag = task_alloc_ram_base(hd_task, app->i.ram_size,
+                                  &ram_base, mem_block, (addr_t)addr, size);
+        if (msg_tag_get_prot(tag) < 0)
+        {
+            goto end_del_obj;
+        }
+    }
+    else
+    {
+        tag = task_alloc_get_ram_info(hd_task, &ram_base, &size);
+        if (msg_tag_get_prot(tag) < 0)
+        {
+            goto end_del_obj;
+        }
     }
     tag = task_map(hd_task, hd_task, TASK_PROT, 0);
     if (msg_tag_get_prot(tag) < 0)
     {
         goto end_del_obj;
     }
-    tag = task_map(hd_task, cur_env->ns_hd, LOG_PROT, KOBJ_DELETE_RIGHT);
+#if 1
+    tag = task_map(hd_task, LOG_PROT, LOG_PROT, KOBJ_DELETE_RIGHT);
     if (msg_tag_get_prot(tag) < 0)
     {
         goto end_del_obj;
     }
+#endif
     tag = task_map(hd_task, SYS_PROT, SYS_PROT, KOBJ_DELETE_RIGHT);
     if (msg_tag_get_prot(tag) < 0)
     {
@@ -250,41 +390,40 @@ int app_load(const char *name, uenv_t *cur_env, pid_t *pid,
     {
         goto end_del_obj;
     }
-    if (app)
-    {
-        tag = thread_msg_buf_set(hd_thread, (void *)(ram_base + app->i.ram_size));
-    }
-    else
-    {
-        /*TODO:*/
-        tag = thread_msg_buf_set(hd_thread, (void *)(ram_base + 100 * 1024 - 2048 - MSG_BUG_LEN));
-    }
+    tag = thread_msg_buf_set(hd_thread, (void *)(ram_base + app->i.ram_size));
     if (msg_tag_get_prot(tag) < 0)
     {
         goto end_del_obj;
     }
-    tag = task_set_pid(hd_task, hd_task); //!< 设置进程的pid就是进程hd号码
-    if (msg_tag_get_prot(tag) < 0)
+    if (!is_ext_hd_task)
     {
-        goto end_del_obj;
-    }
-    if (pid)
-    {
-        *pid = hd_task;
+        tag = task_set_pid(hd_task, hd_task); //!< 设置进程的pid就是进程hd号码
+        if (msg_tag_get_prot(tag) < 0)
+        {
+            goto end_del_obj;
+        }
     }
+    *pid = hd_task;
     void *sp_addr;
     void *sp_addr_top;
-    if (app)
+
+    if (load_to_ram)
+    {
+        if (app_file_ram_copy_to_task(hd_task, (void *)addr, size) < 0)
+        {
+            goto end_del_obj;
+        }
+        sp_addr = (char *)ram_base + app->i.stack_offset;
+        sp_addr_top = (char *)sp_addr + app->i.stack_size;
+        addr = ram_base;
+    }
+    else
     {
         sp_addr = (char *)ram_base + app->i.stack_offset - app->i.data_offset;
         sp_addr_top = (char *)sp_addr + app->i.stack_size;
-        printf("stack:0x%x size:%d.\n", sp_addr, app->i.stack_size);
-    }
-    else
-    {
-        sp_addr = (char *)ram_base;
-        sp_addr_top = (char *)sp_addr + 100 * 1024 - 2048; /*TODO:*/
     }
+    printf("stack:0x%x size:%d.\n", sp_addr, app->i.stack_size);
+
     umword_t *usp_top = (umword_t *)((umword_t)((umword_t)sp_addr_top - 8) & ~0x7UL);
     uenv_t uenv = {
         .log_hd = cur_env->ns_hd,
@@ -322,8 +461,8 @@ int app_load(const char *name, uenv_t *cur_env, pid_t *pid,
     app_stack_push_umword(hd_task, &usp_top, (umword_t)app_env);
     app_stack_push_umword(hd_task, &usp_top, 0xfe);
 
-    app_stack_push_umword(hd_task, &usp_top, at_base);
-    app_stack_push_umword(hd_task, &usp_top, (umword_t)AT_BASE);
+    // app_stack_push_umword(hd_task, &usp_top, at_base);
+    // app_stack_push_umword(hd_task, &usp_top, (umword_t)AT_BASE);
 
     app_stack_push_umword(hd_task, &usp_top, MK_PAGE_SIZE);
     app_stack_push_umword(hd_task, &usp_top, (umword_t)AT_PAGESZ);
@@ -357,14 +496,20 @@ end_del_obj:
     {
         task_unmap(TASK_THIS, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, hd_thread));
     }
-    if (hd_task != HANDLER_INVALID)
+    if (!is_ext_hd_task)
     {
-        task_unmap(TASK_THIS, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, hd_task));
+        if (hd_task != HANDLER_INVALID)
+        {
+            task_unmap(TASK_THIS, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, hd_task));
+        }
     }
 end:
-    if (hd_task != HANDLER_INVALID)
+    if (!is_ext_hd_task)
     {
-        handler_free(hd_task);
+        if (hd_task != HANDLER_INVALID)
+        {
+            handler_free(hd_task);
+        }
     }
     if (hd_thread != HANDLER_INVALID)
     {
diff --git a/mkrtos_user/lib/sys_util/src/u_fast_ipc.c b/mkrtos_user/lib/sys_util/src/u_fast_ipc.c
index 43919bfac..5788df66f 100644
--- a/mkrtos_user/lib/sys_util/src/u_fast_ipc.c
+++ b/mkrtos_user/lib/sys_util/src/u_fast_ipc.c
@@ -56,7 +56,6 @@ static msg_tag_t process_ipc(int j, umword_t obj, long tag)
     rpc_svr_obj_t *svr_obj;
     ipc_msg_t *msg;
     msg_tag_t ret_tag;
-    int ret = 0;
 
     msg = (ipc_msg_t *)(&cons_msg_buf[j * MSG_BUG_LEN]);
     ret_tag = msg_tag_init4(0, 0, 0, -EIO);
diff --git a/mkrtos_user/lib/sys_util/src/u_intr.c b/mkrtos_user/lib/sys_util/src/u_intr.c
index 74cae90c7..423a89aa2 100644
--- a/mkrtos_user/lib/sys_util/src/u_intr.c
+++ b/mkrtos_user/lib/sys_util/src/u_intr.c
@@ -14,7 +14,7 @@ int u_intr_bind(int irq_no, u_irq_prio_t prio, int th_prio,
     obj_handler_t irq_obj = handler_alloc();
     obj_handler_t th_hd;
     msg_tag_t tag;
-    int ret;
+    int ret = 0;
 
     if (irq_obj == HANDLER_INVALID)
     {
diff --git a/mkrtos_user/lib/sys_util/src/u_rpc_svr.c b/mkrtos_user/lib/sys_util/src/u_rpc_svr.c
index 5ec25f838..db3c05656 100644
--- a/mkrtos_user/lib/sys_util/src/u_rpc_svr.c
+++ b/mkrtos_user/lib/sys_util/src/u_rpc_svr.c
@@ -110,7 +110,7 @@ static msg_tag_t rpc_meta_t_dispatch(struct rpc_svr_obj *obj, msg_tag_t in_tag,
 
     if (msg_tag_get_prot(in_tag) == META_PROT)
     {
-#if 0
+#if 1
         cons_write_str("unknow prot.\n"); //FIXME:
 #endif
         return msg_tag_init4(0, 0, 0, -EPROTO);
@@ -122,8 +122,8 @@ static msg_tag_t rpc_meta_t_dispatch(struct rpc_svr_obj *obj, msg_tag_t in_tag,
 
         if (svr_obj == NULL)
         {
-#if 0
-        cons_write_str("unknow prot.\n"); //FIXME:
+#if 1
+            cons_write_str("unknow prot.\n"); // FIXME:
 #endif
             return msg_tag_init4(0, 0, 0, -EPROTO);
         }
diff --git a/mkrtos_user/lib/sys_util/src/u_sig.c b/mkrtos_user/lib/sys_util/src/u_sig.c
index 729c7c638..e699a87dc 100644
--- a/mkrtos_user/lib/sys_util/src/u_sig.c
+++ b/mkrtos_user/lib/sys_util/src/u_sig.c
@@ -50,7 +50,6 @@ int pm_sig_del_watch(pid_t pid, int flags)
  */
 int pm_waitpid(pid_t pid, umword_t *status)
 {
-    msg_tag_t tag;
 
     wait_pid = pid;
     pm_sig_watch(pid, 0);
@@ -72,7 +71,7 @@ static int kill(int flags, int pid)
 {
     int ret = -EINVAL;
 
-        printf("kill pid:%d, flags:0x%x\n", pid ,flags);
+    printf("kill pid:%d, flags:0x%x\n", pid ,flags);
     if (wait_pid == pid || wait_pid == -1)
     {
         u_sema_up(sema_wait_hd);
diff --git a/mkrtos_user/lib/util/src/u_malloc.c b/mkrtos_user/lib/util/src/u_malloc.c
index 1dfdb07b6..e1e649d72 100644
--- a/mkrtos_user/lib/util/src/u_malloc.c
+++ b/mkrtos_user/lib/util/src/u_malloc.c
@@ -480,7 +480,7 @@ void u__bin_chunk(struct chunk *self)
 
 	/* Replace middle of large chunks with fresh zero pages */
 	if (size > RECLAIM && (size^(size-osize)) > size-osize) {
-		uintptr_t a = (uintptr_t)self + SIZE_ALIGN+PAGE_SIZE-1 & -PAGE_SIZE;
+		uintptr_t a = (((uintptr_t)self + SIZE_ALIGN+PAGE_SIZE-1) & (-PAGE_SIZE));
 		uintptr_t b = (uintptr_t)next - SIZE_ALIGN & -PAGE_SIZE;
 		int e = errno;
 #if 1
diff --git a/mkrtos_user/server/fs/appfs/fs_rpc.c b/mkrtos_user/server/fs/appfs/fs_rpc.c
index b9a11f353..d7be5fc22 100644
--- a/mkrtos_user/server/fs/appfs/fs_rpc.c
+++ b/mkrtos_user/server/fs/appfs/fs_rpc.c
@@ -41,7 +41,7 @@ int fs_svr_open(const char *path, int flags, int mode)
         int w_ret = pm_sig_watch(pid, 0 /*TODO:现在只有kill */);
         if (w_ret < 0)
         {
-            printf("pm wath pid %d err.\n", w_ret);
+            printf("appfs wath pid %d err.\n", w_ret);
         }
 #endif
     }
diff --git a/mkrtos_user/server/fs/appfs/hw_block.c b/mkrtos_user/server/fs/appfs/hw_block.c
index 7345eff70..1f40ad9ea 100644
--- a/mkrtos_user/server/fs/appfs/hw_block.c
+++ b/mkrtos_user/server/fs/appfs/hw_block.c
@@ -24,8 +24,6 @@
 
 static obj_handler_t shm_hd;
 
-static int block_mem_addr = -1;
-static int block_nr = -1;
 static uint8_t *block_buf; //!< 块缓冲区
 static obj_handler_t blk_drv_hd;
 static blk_drv_info_t blk_info;
@@ -105,7 +103,7 @@ int hw_init_block(fs_info_t *fs, const char *dev_path)
     fs->cb.hw_write_and_erase_block = hw_write_and_erase_block;
 
 again:
-    ret = ns_query_svr(dev_path, &blk_drv_hd, 0x1);
+    ret = ns_query_svr(dev_path, &blk_drv_hd);
     if (ret < 0)
     {
         u_sleep_ms(50);
@@ -114,7 +112,7 @@ again:
     ret = blk_drv_cli_info(blk_drv_hd, &blk_info);
     if (ret < 0)
     {
-        printf("blk info get fail.\n");
+        printf("blk info get fail. err:%d.\n", ret);
         return ret;
     }
     ret = hw_create_shm_obj(blk_info.blk_size, &shm_hd);
@@ -131,7 +129,7 @@ again:
         return -ENOMEM;
     }
     block_buf = (void *)shm_addr;
-    printf("block_buf addr:0x%x\n", block_buf);
+    printf("block_buf addr:0x%x fs_base_addr: 0x%x\n", block_buf, blk_info.blk_start_addr);
     // printf("img size is %d, block nr is %d.\n", block_mem_size, block_nr);
     return 0;
 }
diff --git a/mkrtos_user/server/fs/appfs/main.c b/mkrtos_user/server/fs/appfs/main.c
index a93f7ec02..39bffc18d 100644
--- a/mkrtos_user/server/fs/appfs/main.c
+++ b/mkrtos_user/server/fs/appfs/main.c
@@ -38,12 +38,6 @@ int main(int argc, char *argv[])
     char *mount_path = NULL;
     char *dev_path = NULL;
 
-    task_set_obj_name(TASK_THIS, TASK_THIS, "tk_appfs");
-    task_set_obj_name(TASK_THIS, THREAD_MAIN, "th_appfs");
-    for (int i = 0; i < argc; i++)
-    {
-        printf("args[%d]:%s\n", i, argv[i]);
-    }
     fast_ipc_init();
     int o;
     const char *optstring = "d:m:"; // 有三个选项-abc，其中c选项后有冒号，所以后面必须有参数
@@ -53,6 +47,7 @@ int main(int argc, char *argv[])
         {
         case 'd':
             dev_path = optarg;
+            printf("dev path:%s\n", optarg);
             break;
         case 'm':
             printf("mount path:%s\n", optarg);
@@ -71,20 +66,17 @@ int main(int argc, char *argv[])
         return -1;
     }
     ret = hw_init_block(&fs_obj, dev_path);
-    assert(ret >= 0);
+    assert(ret >= 0 && "hw_init_block error.");
     ret = appfs_init(&fs_obj);
-    assert(ret >= 0);
+    assert(ret >= 0 && "appfs_init error.");
     ret = appfs_open_init(&fs_obj);
-    assert(ret >= 0);
+    assert(ret >= 0 && "appfs_open_init error.");
 
     ret = rpc_meta_init_def(TASK_THIS, &hd);
-    assert(ret >= 0);
+    assert(ret >= 0 && "rpc_meta_init_def error.");
     fs_svr_init();
     ns_register(mount_path, hd, 0);
     cons_write_str("appfs mount success\n");
-#if 0
-    fs_svr_loop();
-#endif
     while (1)
     {
         u_sleep_ms(U_SLEEP_ALWAYS);
diff --git a/mkrtos_user/server/fs/appfs/src/appfs.c b/mkrtos_user/server/fs/appfs/src/appfs.c
index 58d750256..0a5891894 100644
--- a/mkrtos_user/server/fs/appfs/src/appfs.c
+++ b/mkrtos_user/server/fs/appfs/src/appfs.c
@@ -12,11 +12,12 @@
 
 int appfs_init(fs_info_t *fs)
 {
-    int ret;
+    int ret = 0;
     assert(fs);
     fs->cb.hw_init_fs_for_block(fs);
     fs_info_t *fs_info = (fs_info_t *)fs->mem_addr;
 
+    printf("fs->mem_addr:0x%x\n", fs->mem_addr);
     // ret = fs->cb.hw_read_block(fs, 0, fs->buf, fs->save.block_size);
     // if (ret >= 0)
     // {
@@ -576,7 +577,6 @@ const dir_info_t *appfs_dir_info_get_next(fs_info_t *info, const dir_info_t *cur
 {
     assert(info);
     assert(cur);
-    int ret = 0;
 
     for (const dir_info_t *cur_dir = (const dir_info_t *)cur + 1;
          (unsigned long)cur_dir < info->mem_addr + (info->save.dirinfo_inx + info->save.dirinfo_nr) * info->save.block_size;
@@ -922,7 +922,6 @@ int appfs_file_resize(fs_info_t *info, const char *name, int size)
 {
     assert(info);
 
-    int ret = 0;
     const dir_info_t *dir_info = NULL;
 
     // 通过文件名查找文件
@@ -946,7 +945,6 @@ int appfs_file_resize(fs_info_t *info, const char *name, int size)
 int appfs_arrange_files(fs_info_t *info)
 {
     int last_idle_block_inx = -1;
-    int status = 0;
     assert(info);
     for (int i = 0; i < info->save.blockinfo_nr; i++)
     {
diff --git a/mkrtos_user/server/fs/appfs/src/appfs_open.c b/mkrtos_user/server/fs/appfs/src/appfs_open.c
index ff8475fe5..6d8271a67 100644
--- a/mkrtos_user/server/fs/appfs/src/appfs_open.c
+++ b/mkrtos_user/server/fs/appfs/src/appfs_open.c
@@ -92,10 +92,10 @@ void appfs_task_free(int pid)
 {
     for (int i = 0; i < DIR_INFO_NR; i++)
     {
-        if (appfs_files[i].dir_info_fd != -1)
+        if (appfs_files[i].dir_info_fd != -1 && appfs_files[i].pid == pid)
         {
             appfs_close(i);
-            printf("free fd:%d\n", i);
+            printf("appfs free fd:%d\n", i);
         }
     }
 }
@@ -151,7 +151,7 @@ int appfs_open(const char *name, int flags, int mode)
 #else
     int pid = 0;
 #endif
-    int ret;
+    int ret = 0;
     const dir_info_t *file;
     int fd;
     enum appfs_type type;
diff --git a/mkrtos_user/server/fs/fatfs/CMakeLists.txt b/mkrtos_user/server/fs/fatfs/CMakeLists.txt
index f1e90afb6..b39659552 100644
--- a/mkrtos_user/server/fs/fatfs/CMakeLists.txt
+++ b/mkrtos_user/server/fs/fatfs/CMakeLists.txt
@@ -1,6 +1,6 @@
 cmake_minimum_required(VERSION 3.13)
 
-set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DUSE_STDPERIPH_DRIVER=1 -DSTM32F10X_XL ")
+# set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -DUSE_STDPERIPH_DRIVER=1 -DSTM32F10X_XL ")
 
 file(
     GLOB deps  
diff --git a/mkrtos_user/server/fs/fatfs/ext_disk_drv/diskio.c b/mkrtos_user/server/fs/fatfs/ext_disk_drv/diskio.c
index 05dee6bd9..4ca7e6262 100644
--- a/mkrtos_user/server/fs/fatfs/ext_disk_drv/diskio.c
+++ b/mkrtos_user/server/fs/fatfs/ext_disk_drv/diskio.c
@@ -150,7 +150,7 @@ DRESULT disk_ioctl(
 			*(DWORD *)buff = FLASH_SECTOR_COUNT;
 			return RES_OK;
 		case GET_SECTOR_SIZE: // sector size, 传入block size(SD),单位bytes
-			*(DWORD *)buff = FLASH_SECTOR_SIZE;
+			*(WORD *)buff = FLASH_SECTOR_SIZE;
 			return RES_OK;
 		case GET_BLOCK_SIZE:				   // block size, 由上文可得，对于SD2.0卡最大8192，最小 1
 			*(DWORD *)buff = FLASH_BLOCK_SIZE; // 单位为 sector(FatFs)
diff --git a/mkrtos_user/server/fs/fatfs/fs_rpc.c b/mkrtos_user/server/fs/fatfs/fs_rpc.c
index d324bb947..94f390730 100644
--- a/mkrtos_user/server/fs/fatfs/fs_rpc.c
+++ b/mkrtos_user/server/fs/fatfs/fs_rpc.c
@@ -253,7 +253,6 @@ int fs_svr_readdir(int fd, dirent_t *dir)
 }
 int fs_svr_lseek(int fd, int offs, int whence)
 {
-    UINT bw;
     file_desc_t *file = file_desc_get(fd);
     file_desc_priv_t *file_priv = NULL;
 
diff --git a/mkrtos_user/server/fs/fatfs/ram_disk_drv/diskio.c b/mkrtos_user/server/fs/fatfs/ram_disk_drv/diskio.c
index 4ae4de884..d861c41e5 100644
--- a/mkrtos_user/server/fs/fatfs/ram_disk_drv/diskio.c
+++ b/mkrtos_user/server/fs/fatfs/ram_disk_drv/diskio.c
@@ -26,6 +26,7 @@ static obj_handler_t shm_hd;
 static addr_t dev_shm_mem;
 static addr_t dev_shm_size;
 static blk_drv_info_t blk_info;
+static int ram_block_inited;
 int disk_set_dev_path(int pdrv, const char *dev)
 {
 	int ret;
@@ -35,7 +36,7 @@ int disk_set_dev_path(int pdrv, const char *dev)
 	{
 		int try_cn = 0;
 	again:
-		ret = ns_query_svr(dev, &dev_hd, 1);
+		ret = ns_query_svr(dev, &dev_hd);
 		if (ret < 0)
 		{
 			try_cn++;
@@ -90,12 +91,15 @@ DSTATUS disk_initialize(
 )
 {
 	DSTATUS stat;
-	int result;
 
 	switch (pdrv)
 	{
 	case DEV_MK_BLOCK:
 	{
+		if (ram_block_inited)
+		{
+			return RES_OK;
+		}
 		msg_tag_t tag;
 
 		shm_hd = handler_alloc();
@@ -120,6 +124,7 @@ DSTATUS disk_initialize(
 			return RES_ERROR;
 		}
 		stat = RES_OK;
+		ram_block_inited = 1;
 		// translate the reslut code here
 		return stat;
 	}
@@ -138,7 +143,6 @@ DRESULT disk_read(
 	UINT count	  /* Number of sectors to read */
 )
 {
-	DRESULT res;
 
 	switch (pdrv)
 	{
@@ -171,7 +175,6 @@ DRESULT disk_write(
 	UINT count		  /* Number of sectors to write */
 )
 {
-	int result;
 
 	switch (pdrv)
 	{
@@ -203,8 +206,6 @@ DRESULT disk_ioctl(
 	void *buff /* Buffer to send/receive control data */
 )
 {
-	DRESULT res;
-	int result;
 
 	switch (pdrv)
 	{
@@ -216,7 +217,7 @@ DRESULT disk_ioctl(
 			*(DWORD *)buff = blk_info.blk_nr;
 			return RES_OK;
 		case GET_SECTOR_SIZE: // sector size, 传入block size(SD),单位bytes
-			*(DWORD *)buff = blk_info.blk_size;
+			*(WORD *)buff = blk_info.blk_size;
 			return RES_OK;
 		case GET_BLOCK_SIZE:	// block size, 由上文可得，对于SD2.0卡最大8192，最小 1
 			*(DWORD *)buff = 1; // 单位为 sector(FatFs)
diff --git a/mkrtos_user/server/fs/fatfs/static_ram_disk_drv/diskio.c b/mkrtos_user/server/fs/fatfs/static_ram_disk_drv/diskio.c
index ab314f4ae..d861362af 100644
--- a/mkrtos_user/server/fs/fatfs/static_ram_disk_drv/diskio.c
+++ b/mkrtos_user/server/fs/fatfs/static_ram_disk_drv/diskio.c
@@ -140,7 +140,7 @@ DRESULT disk_ioctl(
 			*(DWORD *)buff = ram_disk_sector_nr();
 			return RES_OK;
 		case GET_SECTOR_SIZE: // sector size, 传入block size(SD),单位bytes
-			*(DWORD *)buff = 512;
+			*(WORD *)buff = 512;
 			return RES_OK;
 		case GET_BLOCK_SIZE:	// block size, 由上文可得，对于SD2.0卡最大8192，最小 1
 			*(DWORD *)buff = 1; // 单位为 sector(FatFs)
diff --git a/mkrtos_user/server/init/src/ns.c b/mkrtos_user/server/init/src/ns.c
index 64e1b32ce..4c0b07257 100644
--- a/mkrtos_user/server/init/src/ns.c
+++ b/mkrtos_user/server/init/src/ns.c
@@ -28,39 +28,63 @@
 #include "u_rpc_svr.h"
 #include "u_slist.h"
 #include "nsfs.h"
-
+#include "u_mutex.h"
 static ns_t ns;
 static fs_t ns_fs;
 
 static obj_handler_t ns_hd;
-
+static u_mutex_t ns_lock;
 static int fs_svr_open(const char *path, int flags, int mode)
 {
-    return fs_ns_open(path, flags, mode);
+    int ret;
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
+    ret = fs_ns_open(path, flags, mode);
+    u_mutex_unlock(&ns_lock);
+    return ret;
 }
 
 static int fs_svr_readdir(int fd, dirent_t *dir)
 {
-    return fs_ns_readdir(fd, dir);
+    int ret;
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
+    ret = fs_ns_readdir(fd, dir);
+    u_mutex_unlock(&ns_lock);
+    return ret;
 }
 static void fs_svr_close(int fd)
 {
+    u_mutex_lock(&ns_lock, 0, NULL);
     fs_ns_close(fd);
+    u_mutex_unlock(&ns_lock);
 }
 static int fs_svr_unlink(const char *path)
 {
-    return fs_ns_remove(path);
+    int ret;
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
+    ret = fs_ns_remove(path);
+    u_mutex_unlock(&ns_lock);
+    return ret;
 }
 static int fs_svr_mkdir(char *path)
 {
-    return fs_ns_mkdir(path);
+    int ret;
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
+    ret = fs_ns_mkdir(path);
+    u_mutex_unlock(&ns_lock);
+    return ret;
 }
 static int fs_svr_stat(const char *path, void *_buf)
 {
     struct kstat *buf = (struct kstat *)_buf;
     int ret;
-
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
     ret = fs_ns_stat(path, buf);
+    u_mutex_unlock(&ns_lock);
     return ret;
 }
 /**
@@ -91,7 +115,8 @@ int namespace_register(const char *path, obj_handler_t hd, int type)
     {
         return -EISDIR;
     }
-again:
+    
+    u_mutex_lock(&ns_lock, 0, NULL);
     ret = ns_mknode(path, hd, NODE_TYPE_SVR);
     if (ret < 0)
     {
@@ -112,6 +137,7 @@ again:
         }
     }
 #endif
+    u_mutex_unlock(&ns_lock);
     return ret;
 }
 /**
@@ -125,7 +151,9 @@ int namespace_query(const char *path, obj_handler_t *hd)
 {
     int ret;
 
+    u_mutex_lock(&ns_lock, 0, NULL);
     ret = ns_find_svr_obj(path, hd);
+    u_mutex_unlock(&ns_lock);
     return ret;
 }
 /**
@@ -153,5 +181,6 @@ void namespace_init(obj_handler_t ipc_hd)
     thread_set_src_pid(0);
     ns_hd = ipc_hd;
     ns_root_node_init(ipc_hd);
+    assert(u_mutex_init(&ns_lock, handler_alloc()) >= 0);
     // printf("ns svr init...\n");
 }
diff --git a/mkrtos_user/server/init/src/nsfs/ns.c b/mkrtos_user/server/init/src/nsfs/ns.c
index 64c4ccbcc..6fcf2fe8f 100644
--- a/mkrtos_user/server/init/src/nsfs/ns.c
+++ b/mkrtos_user/server/init/src/nsfs/ns.c
@@ -414,7 +414,9 @@ int ns_mknode(const char *path, obj_handler_t svr_hd, node_type_t type)
         return -ENOENT;
     }
     // 获得节点的名字
-    int name_len = ns_node_strcpy(name, path + p_inx + 1, NS_NODE_NAME_LEN);
+    // int name_len = 0;
+    
+    ns_node_strcpy(name, path + p_inx + 1, NS_NODE_NAME_LEN);
 
     new_node = node_create(name, NODE_TYPE_DUMMY);
     if (new_node == NULL)
diff --git a/mkrtos_user/server/init/src/parse_cfg.c b/mkrtos_user/server/init/src/parse_cfg.c
index 4af01591c..f387cd121 100644
--- a/mkrtos_user/server/init/src/parse_cfg.c
+++ b/mkrtos_user/server/init/src/parse_cfg.c
@@ -26,7 +26,7 @@
 #include <parse_cfg.h>
 #include <appfs_tiny.h>
 static char cmd_line[CMD_LEN];                              //!< 命令行
-static char cmd_params[CMD_PARAMS_CN][CMD_PARAMS_ITEM_LEN]; //!< 参数数组
+// static char cmd_params[CMD_PARAMS_CN][CMD_PARAMS_ITEM_LEN]; //!< 参数数组
 static int cmd_params_off[CMD_PARAMS_CN];                   //!< 参数偏移量
 static int cmd_params_num = 0;                              //!< 参数个数
 static u_mutex_t cmd_lock;                                  //!< 命令行锁
@@ -163,8 +163,8 @@ int parse_cfg(const char *parse_cfg_file_name, uenv_t *env)
                 {
                     cmd_line[MIN(line_inx, sizeof(cmd_line)) - 1] = 0;
                 }
-                pid_t pid;
-                int params_cn = 0;
+                pid_t pid = HANDLER_INVALID;
+                // int params_cn = 0;
                 char *args[CMD_PARAMS_CN] = {
                     NULL,
                 };
@@ -182,7 +182,7 @@ int parse_cfg(const char *parse_cfg_file_name, uenv_t *env)
                 printf("parse_cfg cmd_params_num:%d\n", cmd_params_num);
                 #endif
                 int ret = app_load(cmd_line, env, &pid, args, cmd_params_num,
-                                   NULL, 0, mem_block);
+                                   NULL, 0, mem_block, FALSE);
                 if (ret < 0)
                 {
                     printf("%s load fail, 0x%x\n", cmd_line, ret);
diff --git a/mkrtos_user/server/init/src/parse_cfg.h b/mkrtos_user/server/init/src/parse_cfg.h
index b546205c6..c943b1fd2 100644
--- a/mkrtos_user/server/init/src/parse_cfg.h
+++ b/mkrtos_user/server/init/src/parse_cfg.h
@@ -13,6 +13,7 @@
 #include <u_env.h>
 #define CMD_LEN 64                         //!< 命令行最大长度
 #define CMD_PARAMS_CN CONFIG_APP_PARAMS_NR //!< 参数个数
+#define CMD_ENVS_CN CONFIG_APP_ENV_NR
 #define CMD_PARAMS_ITEM_LEN 16             //!< 每个参数的最大长度
 void parse_cfg_init(void);
 int parse_cfg(const char *parse_cfg_file_name, uenv_t *env);
diff --git a/mkrtos_user/server/init/src/pm.c b/mkrtos_user/server/init/src/pm.c
index 2dfaf95ca..66459c582 100644
--- a/mkrtos_user/server/init/src/pm.c
+++ b/mkrtos_user/server/init/src/pm.c
@@ -136,7 +136,7 @@ int pm_rpc_watch_pid(pm_t *pm, obj_handler_t sig_rcv_hd, pid_t pid, int flags)
 #endif
     entry->sig_hd = sig_rcv_hd;
     entry->src_pid = src_pid; // 监控的pid
-    entry->watch_pid = pid; //被监控的pid
+    entry->watch_pid = pid;   // 被监控的pid
     entry->flags = flags;
     slist_init(&entry->node);
     slist_add_append(&pm->watch_head, &entry->node);
@@ -151,7 +151,7 @@ int pm_rpc_watch_pid(pm_t *pm, obj_handler_t sig_rcv_hd, pid_t pid, int flags)
  * @param pid
  * @return bool_t
  */
-static bool_t pm_send_sig_to_task(pm_t *pm, pid_t pid, umword_t sig_val)
+static void pm_send_sig_to_task(pm_t *pm, pid_t pid, umword_t sig_val)
 {
     ipc_msg_t *ipc;
     watch_entry_t *pos;
@@ -173,12 +173,13 @@ static bool_t pm_send_sig_to_task(pm_t *pm, pid_t pid, umword_t sig_val)
                 ret = sig_kill(pos->sig_hd, sig_val, pid);
             }
             slist_del(&pos->node);
-            handler_free_umap(pos->sig_hd);   //!< 删除信号通知的ipc
+            handler_free_umap(pos->sig_hd); //!< 删除信号通知的ipc
             // handler_free_umap(pos->watch_pid); //!< 删除被watch的进程
             u_free(pos);
         }
         pos = next;
     }
+    return ;
 }
 #endif
 /**
@@ -200,19 +201,60 @@ int pm_rpc_kill_task(int src_pid, int pid, int flags, int exit_code)
         printf("pid is error.\n");
         return -EINVAL;
     }
-    // ns_node_del_by_pid(pid, flags); TODO:         //!< 从ns中删除
-    #if IS_ENABLED(CONFIG_USING_SIG)
+// ns_node_del_by_pid(pid, flags); TODO:         //!< 从ns中删除
+#if IS_ENABLED(CONFIG_USING_SIG)
     if (src_pid != pid)
     {
         // 发起者自己删除
         handler_del_umap(pid);
     }
     pm_send_sig_to_task(&pm, pid, KILL_SIG); //!< 给watch者发送sig
-    #endif
+#endif
     pm_del_watch_by_pid(&pm, pid); //!< 从watch中删除
     printf("[pm] kill pid:%d code:%d.\n", pid, exit_code);
     return 0;
 }
+#include "u_task.h"
+#include "u_factory.h"
+/**
+ * @return >0 pid <0 错误码
+ */
+static int pm_rpc_create_dummy_task(int mem_block, size_t app_size)
+{
+    obj_handler_t hd_task = handler_alloc();
+    msg_tag_t tag;
+    addr_t ram_base;
+
+    if (hd_task == HANDLER_INVALID)
+    {
+        goto end;
+    }
+    tag = factory_create_task(FACTORY_PROT, vpage_create_raw3(KOBJ_ALL_RIGHTS, 0, hd_task));
+    if (msg_tag_get_prot(tag) < 0)
+    {
+        goto end_del_obj;
+    }
+    tag = task_alloc_ram_base(hd_task, app_size,
+                              &ram_base, mem_block, (addr_t)NULL, 0);
+    if (msg_tag_get_prot(tag) < 0)
+    {
+        goto end_del_obj;
+    }
+    tag = task_set_pid(hd_task, hd_task); //!< 设置进程的pid就是进程hd号码
+    if (msg_tag_get_prot(tag) < 0)
+    {
+        goto end_del_obj;
+    }
+    printf("dummy task pid:%d addr:0x%x\n\n", hd_task, ram_base);
+    return hd_task;
+end_del_obj:
+    if (hd_task != HANDLER_INVALID)
+    {
+        task_unmap(TASK_THIS, vpage_create_raw3(KOBJ_DELETE_RIGHT, 0, hd_task));
+    }
+end:
+    return -ENOMEM;
+}
 /**
  * @brief 运行一个新的app
  *
@@ -220,25 +262,42 @@ int pm_rpc_kill_task(int src_pid, int pid, int flags, int exit_code)
  * @param flags
  * @return int
  */
-int pm_rpc_run_app(const char *path, int mem_block, char *params, int params_len, char *envs_in, int envs_in_len)
+int pm_rpc_run_app(const char *path, pm_flags_t pm_flags, char *params, int params_len_or_app_size,
+                   char *envs_in, int envs_in_len)
 {
-    pid_t pid;
+    pid_t pid = HANDLER_INVALID;
     int ret;
     int i;
     int j = 0;
     int args_len = 0;
     int evns_len = 0;
+
+    if (pm_flags.flags & PM_CREATE_DUMMY_TASK)
+    {
+        return pm_rpc_create_dummy_task(pm_flags.mem_block, params_len_or_app_size);
+    }
+    int obj_type;
+    if (msg_tag_get_val(task_obj_valid(TASK_THIS, pm_flags.pid, &obj_type)) != 1)
+    {
+        pid = HANDLER_INVALID;
+    }
+    else if (obj_type != TASK_TYPE)
+    {
+        pid = HANDLER_INVALID;
+    }
+    else
+    {
+        pid = pm_flags.pid;
+    }
     printf("pm run %s.\n", path);
     char *args[CMD_PARAMS_CN] = {
         (char *)path,
     };
-    char *envs[8/*FIXME:*/] = {
-    };
-
+    char *envs[CMD_ENVS_CN] = {};
 
     for (i = 1, j = 0; *params && i < CMD_PARAMS_CN; i++)
     {
-        if (j >= params_len)
+        if (j >= params_len_or_app_size)
         {
             break;
         }
@@ -249,7 +308,7 @@ int pm_rpc_run_app(const char *path, int mem_block, char *params, int params_len
     }
     args_len = i;
 
-    for (i = 0, j = 0; *envs_in && i < CMD_PARAMS_CN; i++)
+    for (i = 0, j = 0; *envs_in && i < CMD_ENVS_CN; i++)
     {
         if (j >= envs_in_len)
         {
@@ -263,7 +322,8 @@ int pm_rpc_run_app(const char *path, int mem_block, char *params, int params_len
     evns_len = i;
 
     ret = app_load(path, u_get_global_env(), &pid, args, args_len,
-                   envs, evns_len,  mem_block);
+                   envs, evns_len, pm_flags.mem_block,
+                   !!(pm_flags.flags & PM_USE_LOAD_TO_RAM));
     if (ret >= 0)
     {
         return pid;
diff --git a/mkrtos_user/server/init/src/test/log_test.c b/mkrtos_user/server/init/src/test/log_test.c
index 41c8d932f..7c26ebc6a 100644
--- a/mkrtos_user/server/init/src/test/log_test.c
+++ b/mkrtos_user/server/init/src/test/log_test.c
@@ -6,10 +6,10 @@
 
 static void ulog_test(CuTest *tc)
 {
-    uint8_t data[10];
-
+    
     ulog_write_str(LOG_PROT, "Please key..\n");
-#if 0
+    #if 0
+    uint8_t data[10];
     int len = ulog_read_bytes(LOG_PROT, data, sizeof(data) - 1);
     if (len > 0)
     {
diff --git a/mkrtos_user/server/init/src/test/pthread_cond_lock_test.c b/mkrtos_user/server/init/src/test/pthread_cond_lock_test.c
index 148479aa8..a16181399 100644
--- a/mkrtos_user/server/init/src/test/pthread_cond_lock_test.c
+++ b/mkrtos_user/server/init/src/test/pthread_cond_lock_test.c
@@ -23,6 +23,7 @@ static void *thread_signal(void *arg)
         pthread_mutex_unlock(&mutex);
         sleep(1);
     }
+    return NULL;
 }
 
 static void *thread_wait(void *arg)
@@ -41,6 +42,7 @@ static void *thread_wait(void *arg)
         pthread_mutex_unlock(&mutex);
         sleep(1);
     }
+    return NULL;
 }
 
 static pthread_t tid1;
diff --git a/mkrtos_user/server/init/src/tty.c b/mkrtos_user/server/init/src/tty.c
index 422560095..4923ce066 100644
--- a/mkrtos_user/server/init/src/tty.c
+++ b/mkrtos_user/server/init/src/tty.c
@@ -62,12 +62,32 @@ static inline void cons_read_unlock(void)
 
 static void console_read_func(void)
 {
-    uint8_t data[12];
+    uint8_t data[64];
 
     while (1)
     {
-        int r_len = ulog_read_bytes(LOG_PROT, data, sizeof(data));
+        int r_len = 0;
+        int buf_size = sizeof(data); 
+        
+        do
+        {
+            int ret;
 
+            r_len += ulog_read_bytes(LOG_PROT, data + r_len, buf_size, 0);
+            buf_size = sizeof(data) - r_len;
+            if (buf_size == 0)
+            {
+                break;
+            }
+            ret = ulog_read_bytes(LOG_PROT, data + r_len, buf_size, O_NONBLOCK);
+            if (ret > 0)
+            {
+                r_len += ret;
+            } else {
+                break;
+            }
+            buf_size = sizeof(data) - r_len;
+        } while (buf_size != 0);
         if (r_len > 0)
         {
             cons_read_lock();
@@ -191,7 +211,7 @@ static int erase_c(tty_struct_t *tty)
     char r_tmp;
 
     // 如果最后一个字符是换行符号，则不能在进行擦除了。
-    if (q_get_tail(&tty->pre_queue, &r_tmp) < 0)
+    if (q_get_tail(&tty->pre_queue, (uint8_t *)&r_tmp) < 0)
     {
         return -1;
     }
@@ -199,7 +219,7 @@ static int erase_c(tty_struct_t *tty)
     {
         return 0;
     }
-    if (q_dequeue_tail(&tty->pre_queue, &r_tmp) >= 0)
+    if (q_dequeue_tail(&tty->pre_queue, (uint8_t *)&r_tmp) >= 0)
     {
         // 刪除上次写的两个字符
         // 如果在标准模式下设定了ECHOE标志，则当收到一个ERASE控制符时将删除前一个显示字符。
@@ -444,9 +464,12 @@ static int tty_def_line_handler(tty_struct_t *tty, uint8_t r)
             q_enqueue(&tty->pre_queue, r);
         }
     }
-end:
     return ret;
 }
+// fs_backend.c
+extern void fs_cons_write(void *buf, size_t size);
+extern void fs_cons_lock(void);
+extern void fs_cons_unlock(void);
 static int tty_write_hw(tty_struct_t *tty)
 {
     uint8_t r;
@@ -457,11 +480,13 @@ static int tty_write_hw(tty_struct_t *tty)
     {
         return w_len;
     }
+    fs_cons_lock();
     while ((res = q_dequeue(&tty->w_queue, &r)) >= 0)
     {
-        tty_write_data(&r, 1);
+        fs_cons_write(&r, 1);
         w_len++;
     }
+    fs_cons_unlock();
     return w_len;
 }
 static int tty_read(int fd, void *buf, size_t len)
@@ -482,7 +507,6 @@ static int tty_read(int fd, void *buf, size_t len)
         }
         u_sema_down(sem_th, 0, NULL);
     }
-again:
     cons_read_lock();
     if (q_queue_len(&sys_tty.pre_queue) == 0)
     {
@@ -504,16 +528,16 @@ again:
     tty_write_hw(&sys_tty);
     return i;
 }
+
 void tty_write_data(void *buf, size_t len)
 {
-    extern void fs_cons_write(void *buf, size_t size);
     fs_cons_write(buf, len);
 }
 static int tty_write(int fd, void *buf, size_t len)
 {
+#if 0
     int i;
     uint8_t r;
-#if 0
     int ret;
     uint8_t *tmp_buf = buf;
     for (i = 0; i < len; i++)
diff --git a/mkrtos_user/server/net/src/fs_rpc.c b/mkrtos_user/server/net/src/fs_rpc.c
index 959816083..d4c6cd33f 100644
--- a/mkrtos_user/server/net/src/fs_rpc.c
+++ b/mkrtos_user/server/net/src/fs_rpc.c
@@ -116,7 +116,6 @@ static const fs_operations_t ops =
 
 void fs_svr_init(void)
 {
-    msg_tag_t tag;
 
     fs_init(&fs, &ops);
     meta_reg_svr_obj(&fs.svr, FS_PROT);
diff --git a/mkrtos_user/server/net/src/main.c b/mkrtos_user/server/net/src/main.c
index 99def5186..92860fa06 100644
--- a/mkrtos_user/server/net/src/main.c
+++ b/mkrtos_user/server/net/src/main.c
@@ -44,8 +44,8 @@ int main(int args, char *argv[])
     int ret;
     msg_tag_t tag;
     obj_handler_t hd;
-    obj_handler_t sem_hd;
-    obj_handler_t shm_hd;
+    obj_handler_t sem_hd = HANDLER_INVALID;
+    obj_handler_t shm_hd = HANDLER_INVALID;
     int count_net_link = 0;
     task_set_obj_name(TASK_THIS, TASK_THIS, "tk_net");
     task_set_obj_name(TASK_THIS, THREAD_MAIN, "th_net");
@@ -58,7 +58,7 @@ int main(int args, char *argv[])
         return -1;
     }
 again:
-    ret = ns_query_svr("/dev/eth", &net_drv_hd, 0x1);
+    ret = ns_query_svr("/dev/eth", &net_drv_hd);
     if (ret < 0)
     {
         // 0代表根节点
diff --git a/mkrtos_user/server/net/src/net_rpc.c b/mkrtos_user/server/net/src/net_rpc.c
index d4787abf8..5ec8d226d 100644
--- a/mkrtos_user/server/net/src/net_rpc.c
+++ b/mkrtos_user/server/net/src/net_rpc.c
@@ -191,7 +191,6 @@ static net_operations_t net_op = {
 static net_t net;
 void net_svr_init(void)
 {
-    msg_tag_t tag;
 
     net_init(&net, &net_op);
     meta_reg_svr_obj(&net.svr, NET_PROT);
diff --git a/mkrtos_user/server/net/src/test/net_test.c b/mkrtos_user/server/net/src/test/net_test.c
index 693c473c8..3b19e2ab4 100644
--- a/mkrtos_user/server/net/src/test/net_test.c
+++ b/mkrtos_user/server/net/src/test/net_test.c
@@ -152,7 +152,7 @@ int net_test(void)
         return -1;
     }
     sleep(1);
-    if (pthread_create(&net_server_pt, NULL, net_client_func, NULL))
+    if (pthread_create(&net_client_pt, NULL, net_client_func, NULL))
     {
         printf("net server pthread create failed.\n");
         return -1;
diff --git a/mkrtos_user/server/shell/src/main.c b/mkrtos_user/server/shell/src/main.c
index dda403e40..a5d558c7b 100644
--- a/mkrtos_user/server/shell/src/main.c
+++ b/mkrtos_user/server/shell/src/main.c
@@ -60,16 +60,7 @@ void fast_ipc_test(void)
 
 int main(int argc, char *args[])
 {
-    task_set_obj_name(TASK_THIS, TASK_THIS, "tk_sh");
-    task_set_obj_name(TASK_THIS, THREAD_MAIN, "th_sh");
-#if 0
-    thread_run(-1, 3);
-#endif
     // fast_ipc_test();
-    for (int i = 0; i < argc; i++)
-    {
-        printf("args[%d]:%s\n", i, args[i]);
-    }
-    userShellInit();
+    userShellInit(argc, args);
     return 0;
 }
diff --git a/mkrtos_user/user/app/ATSURFF437/nes_simulator/vnes/nes_main.c b/mkrtos_user/user/app/ATSURFF437/nes_simulator/vnes/nes_main.c
index 36e5aaa38..8abe0d76b 100644
--- a/mkrtos_user/user/app/ATSURFF437/nes_simulator/vnes/nes_main.c
+++ b/mkrtos_user/user/app/ATSURFF437/nes_simulator/vnes/nes_main.c
@@ -557,7 +557,7 @@ int nes_sound_open(int samples_per_sync, int sample_rate)
 	int ret;
 	msg_tag_t tag;
 again:
-	ret = ns_query_svr("/snd", &snd_drv_hd, 0x1);
+	ret = ns_query_svr("/snd", &snd_drv_hd);
 	if (ret < 0)
 	{
 		u_sleep_ms(50);
diff --git a/mkrtos_user/user/app/CMakeLists.txt b/mkrtos_user/user/app/CMakeLists.txt
index 707d9aff1..547c794d1 100644
--- a/mkrtos_user/user/app/CMakeLists.txt
+++ b/mkrtos_user/user/app/CMakeLists.txt
@@ -9,7 +9,7 @@ add_subdirectory(Ymodem)
 add_subdirectory(binutils-2.33.1)
 # add_subdirectory(share_lib_test)
 # add_subdirectory(share_lib_test2)
-# add_subdirectory(shared_test)
+add_subdirectory(tcc_test)
 if(EXISTS ${CMAKE_CURRENT_SOURCE_DIR}/${CONFIG_BOARD_NAME})
     add_subdirectory(${CONFIG_BOARD_NAME})
 endif()
diff --git a/mkrtos_user/user/app/Ymodem/receive.c b/mkrtos_user/user/app/Ymodem/receive.c
index e0f820a50..10d28a604 100644
--- a/mkrtos_user/user/app/Ymodem/receive.c
+++ b/mkrtos_user/user/app/Ymodem/receive.c
@@ -22,7 +22,8 @@ enum STATE
     END,
     STOP
 };
-#define PRINTF
+#define YM_DEBUG 0
+#define PRINTF 
 static char buf[150] = {0};
 
 /**
@@ -78,7 +79,7 @@ static inline uint16_t cal_CRC16(const uint8_t *data, uint32_t size)
 
 int ymodem_receive(int fd)
 {
-    int fd_file;
+    int fd_file = -1;
     char start_char, tmp_char;
     int state, len, i;
     int trans_end = 0;
@@ -156,10 +157,13 @@ int ymodem_receive(int fd)
                     state = RECEIVE_DATA;
                 }
                 // to get name and file size
+                #if YM_DEBUG
                 PRINTF("receive file name: %s, length :%d\n", buf, strlen(buf));
+                #endif
                 file_size = atoi((buf + strlen(buf) + 1));
+                #if YM_DEBUG
                 PRINTF("file size: %d\n", file_size);
-
+                #endif
                 fd_file = open(buf, O_RDWR | O_CREAT | O_TRUNC, 0777);
                 if (fd_file < 0)
                 {
@@ -227,7 +231,7 @@ int ymodem_receive(int fd)
                 }
                 r_b += ret;
             }
-            crc = cal_CRC16(buf, PACKET_SIZE);
+            crc = cal_CRC16((uint8_t *)buf, PACKET_SIZE);
             // crc
             recv_crc = get_char(fd) << 8;
             recv_crc |= get_char(fd);
@@ -327,7 +331,9 @@ int main(int argc, char **argv)
 
     if (set_serial(fd) < 0)
     {
+        #if YM_DEBUG
         PRINTF("set_serial() failed!\n");
+        #endif
         close(fd);
         return -1;
     }
@@ -335,7 +341,9 @@ int main(int argc, char **argv)
     ret = ymodem_receive(fd);
     if (ret < 0)
     {
+        #if YM_DEBUG
         PRINTF("ymodem_receive() error\n");
+        #endif
         return -1;
     }
 
diff --git a/mkrtos_user/user/app/binutils-2.33.1/binutils/bfdtest1 b/mkrtos_user/user/app/binutils-2.33.1/binutils/bfdtest1
index 5fba02ad1..06e2e00c3 100755
Binary files a/mkrtos_user/user/app/binutils-2.33.1/binutils/bfdtest1 and b/mkrtos_user/user/app/binutils-2.33.1/binutils/bfdtest1 differ
diff --git a/mkrtos_user/user/app/binutils-2.33.1/binutils/bfdtest2 b/mkrtos_user/user/app/binutils-2.33.1/binutils/bfdtest2
index 24bde4278..12da785d4 100755
Binary files a/mkrtos_user/user/app/binutils-2.33.1/binutils/bfdtest2 and b/mkrtos_user/user/app/binutils-2.33.1/binutils/bfdtest2 differ
diff --git a/mkrtos_user/user/app/binutils-2.33.1/binutils/nm-new.bin b/mkrtos_user/user/app/binutils-2.33.1/binutils/nm-new.bin
index b2d290bd5..400eac6ed 100644
Binary files a/mkrtos_user/user/app/binutils-2.33.1/binutils/nm-new.bin and b/mkrtos_user/user/app/binutils-2.33.1/binutils/nm-new.bin differ
diff --git a/mkrtos_user/user/app/binutils-2.33.1/binutils/objcopy.bin b/mkrtos_user/user/app/binutils-2.33.1/binutils/objcopy.bin
index 7aba200d8..57b2329a2 100644
Binary files a/mkrtos_user/user/app/binutils-2.33.1/binutils/objcopy.bin and b/mkrtos_user/user/app/binutils-2.33.1/binutils/objcopy.bin differ
diff --git a/mkrtos_user/user/app/binutils-2.33.1/binutils/objdump.bin b/mkrtos_user/user/app/binutils-2.33.1/binutils/objdump.bin
index 73cb20882..aecdf363a 100644
Binary files a/mkrtos_user/user/app/binutils-2.33.1/binutils/objdump.bin and b/mkrtos_user/user/app/binutils-2.33.1/binutils/objdump.bin differ
diff --git a/mkrtos_user/user/app/binutils-2.33.1/binutils/readelf.bin b/mkrtos_user/user/app/binutils-2.33.1/binutils/readelf.bin
index b15621338..86a4cd75f 100644
Binary files a/mkrtos_user/user/app/binutils-2.33.1/binutils/readelf.bin and b/mkrtos_user/user/app/binutils-2.33.1/binutils/readelf.bin differ
diff --git a/mkrtos_user/user/app/binutils-2.33.1/binutils/size.bin b/mkrtos_user/user/app/binutils-2.33.1/binutils/size.bin
index 3d04ac26a..569722570 100644
Binary files a/mkrtos_user/user/app/binutils-2.33.1/binutils/size.bin and b/mkrtos_user/user/app/binutils-2.33.1/binutils/size.bin differ
diff --git a/mkrtos_user/user/app/binutils-2.33.1/binutils/testsuite/gentestdlls b/mkrtos_user/user/app/binutils-2.33.1/binutils/testsuite/gentestdlls
index 4dbb72ff8..bed287555 100755
Binary files a/mkrtos_user/user/app/binutils-2.33.1/binutils/testsuite/gentestdlls and b/mkrtos_user/user/app/binutils-2.33.1/binutils/testsuite/gentestdlls differ
diff --git a/mkrtos_user/user/app/binutils-2.33.1/gas/as-new.bin b/mkrtos_user/user/app/binutils-2.33.1/gas/as-new.bin
index 9951b98ed..2c13372f0 100644
Binary files a/mkrtos_user/user/app/binutils-2.33.1/gas/as-new.bin and b/mkrtos_user/user/app/binutils-2.33.1/gas/as-new.bin differ
diff --git a/mkrtos_user/user/app/binutils-2.33.1/ld/ld-new.bin b/mkrtos_user/user/app/binutils-2.33.1/ld/ld-new.bin
index b35477d43..e1ba22107 100644
Binary files a/mkrtos_user/user/app/binutils-2.33.1/ld/ld-new.bin and b/mkrtos_user/user/app/binutils-2.33.1/ld/ld-new.bin differ
diff --git a/mkrtos_user/user/app/coremark/coremark_src/core_list_join.c b/mkrtos_user/user/app/coremark/coremark_src/core_list_join.c
index a5154284a..c97440ce8 100644
--- a/mkrtos_user/user/app/coremark/coremark_src/core_list_join.c
+++ b/mkrtos_user/user/app/coremark/coremark_src/core_list_join.c
@@ -135,7 +135,7 @@ ee_u16 core_bench_list(core_results *res, ee_s16 finder_idx) {
 	ee_s16 find_num=res->seed3;
 	list_head *this_find;
 	list_head *finder, *remover;
-	list_data info;
+	list_data info = {};
 	ee_s16 i;
 
 	info.idx=finder_idx;
diff --git a/mkrtos_user/user/app/misc/dm9000_drv/src/main.c b/mkrtos_user/user/app/misc/dm9000_drv/src/main.c
index 299568646..e1504f487 100644
--- a/mkrtos_user/user/app/misc/dm9000_drv/src/main.c
+++ b/mkrtos_user/user/app/misc/dm9000_drv/src/main.c
@@ -70,10 +70,10 @@ int main(int argc, char *args[])
     assert(ret >= 0);
     meta_reg_svr_obj(&net_drv.svr, BLK_DRV_PROT);
 
+    
+    assert(DM9000_Init(1) == 0);
     assert(ns_register("/dm9000", hd, 0) >= 0);
     mk_printf("dm9000 reg success\n");
-
-    assert(DM9000_Init(1) == 0);
     rpc_loop(); //!< loop
     return 0;
 }
diff --git a/mkrtos_user/user/app/tcc_test/CMakeLists.txt b/mkrtos_user/user/app/tcc_test/CMakeLists.txt
new file mode 100644
index 000000000..9c8aea6cc
--- /dev/null
+++ b/mkrtos_user/user/app/tcc_test/CMakeLists.txt
@@ -0,0 +1,7 @@
+cmake_minimum_required(VERSION 3.13)
+
+add_custom_target(
+    tcc_test_dump ALL
+    COMMAND
+    cp ${CMAKE_CURRENT_SOURCE_DIR}/* ${CMAKE_SOURCE_DIR}/build/output/cpio/
+)
diff --git a/mkrtos_user/user/app/tcc_test/build.lsh b/mkrtos_user/user/app/tcc_test/build.lsh
new file mode 100644
index 000000000..9f464be57
--- /dev/null
+++ b/mkrtos_user/user/app/tcc_test/build.lsh
@@ -0,0 +1,7 @@
+cd /mnt
+tcc -nostdinc -nostdlib -c /bin/main.c -o main.o  -pie
+tcc -nostdinc -nostdlib -c /bin/cons.c -o cons.o  -pie
+as -mthumb -mcpu=cortex-m3 /bin/start.S -o start.o  -pie
+as -mthumb -mcpu=cortex-m3 /bin/syscall.S -o syscall.o  -pie
+ld start.o main.o cons.o syscall.o -T/bin/link_pie.lds -o a.out --section-start .text=0x20144000 -pie
+objcopy -O binary -S a.out a.bin
diff --git a/mkrtos_user/user/app/tcc_test/cons.c b/mkrtos_user/user/app/tcc_test/cons.c
new file mode 100644
index 000000000..f58d43120
--- /dev/null
+++ b/mkrtos_user/user/app/tcc_test/cons.c
@@ -0,0 +1,88 @@
+#include "cons.h"
+#define ULOG_RW_MAX_BYTES (WORD_BYTES * 5)
+#define WRITE_DATA 0
+typedef union syscall_prot
+{
+    umword_t raw;
+    struct
+    {
+        umword_t op : 6;                     //!< 操作的op
+        umword_t prot : 5;                   //!< 通信的类型
+        umword_t self : 1;                   //!< 如果obj_inx指定为无效，则采用当前thread
+        umword_t obj_inx : (WORD_BITS - 12); //!<
+    };
+} syscall_prot_t;
+#define LOG_PROT 4
+
+static inline syscall_prot_t syscall_prot_create(uint8_t op, uint8_t prot, obj_handler_t obj_inx)
+{
+    return (syscall_prot_t){
+        .op = op,
+        .prot = prot,
+        .obj_inx = obj_inx,
+        .self = 0,
+    };
+}
+typedef union msg_tag
+{
+    umword_t raw;
+    struct
+    {
+        umword_t flags : 4; // 3bit:代表错误由内核报告
+        umword_t msg_buf_len : 7;
+        umword_t map_buf_len : 5;
+        umword_t prot : WORD_BITS - 16;
+    };
+} msg_tag_t;
+
+#define msg_tag_init(r) \
+    ((msg_tag_t){.raw = (r)})
+
+#define msg_tag_is_knl_err(tag) (!!((tag).flags & MSG_TAG_KNL_ERR)) //!< 内核错误
+
+#define msg_tag_init4(fg, msg_words, buf_words, p) ((msg_tag_t){ \
+    .flags = (fg),                                               \
+    .msg_buf_len = (msg_words),                                  \
+    .map_buf_len = (buf_words),                                  \
+    .prot = (p)})
+void *__aeabi_memset(void *dest, int c, int n)
+{
+	unsigned char *s = dest;
+
+    for (; n; n--, s++) *s = c;
+
+    return dest;
+}
+void ulog_write_bytes(obj_handler_t obj_inx, const uint8_t *data, int len)
+{
+    uint8_t write_buf[ULOG_RW_MAX_BYTES] = {0};
+    int j = 0;
+    int i = 0;
+
+    while (1)
+    {
+        for (i = 0; i < ULOG_RW_MAX_BYTES && j < len; i++, j++)
+        {
+            write_buf[i] = data[j];
+        }
+        if (i > 0)
+        {
+            int *write_word_buf = (int *)write_buf;
+            mk_syscall(syscall_prot_create(WRITE_DATA, LOG_PROT, obj_inx).raw,
+                       msg_tag_init4(0, ROUND_UP(i, WORD_BYTES), 0, 0).raw,
+                       write_word_buf[0],
+                       write_word_buf[1],
+                       write_word_buf[2],
+                       write_word_buf[3],
+                       write_word_buf[4]);
+        }
+        if (j >= len)
+        {
+            return;
+        }
+        for (int i = 0; i < ULOG_RW_MAX_BYTES; i++)
+        {
+            write_buf[i] = 0;
+        }
+    }
+}
diff --git a/mkrtos_user/user/app/tcc_test/cons.h b/mkrtos_user/user/app/tcc_test/cons.h
new file mode 100644
index 000000000..aa7ce3421
--- /dev/null
+++ b/mkrtos_user/user/app/tcc_test/cons.h
@@ -0,0 +1,14 @@
+#ifndef __CONS_H__
+#define __CONS_H__
+typedef unsigned long obj_handler_t;
+typedef unsigned char uint8_t;
+typedef unsigned long umword_t;
+#define WORD_BYTES (sizeof(void *))
+#define WORD_BITS (sizeof(void *) * 8)
+#define ROUND(a, b) (((a) / (b)) + (((a) % (b)) ? 1 : 0))          //!< a/b后的值向上取整
+#define ROUND_UP(a, b) ROUND(a, b)                                 //!< a除b向上取整数
+extern int mk_syscall(int nr, ...);
+void ulog_write_bytes(obj_handler_t obj_inx, const uint8_t *data, int len);
+
+
+#endif
diff --git a/mkrtos_user/user/app/tcc_test/link.lds b/mkrtos_user/user/app/tcc_test/link.lds
index d20dc6e64..51a3bda4e 100644
--- a/mkrtos_user/user/app/tcc_test/link.lds
+++ b/mkrtos_user/user/app/tcc_test/link.lds
@@ -1,124 +1,109 @@
 ENTRY(_start_)
-STACKSIZE = 1024;
+_estack = 0x20000000 + 0x4000;
+_Min_Heap_Size = 0;
+_Min_Stack_Size = 0x300;
+MEMORY
+{
+RAM (xrw) : ORIGIN = 0x20000000 , LENGTH = 0x4000 - 0x300
+FLASH (rx) : ORIGIN = 0x8000000, LENGTH = 0x2000
+}
 SECTIONS
 {
-    .text : {
-        . = ALIGN(4);
-        __text_start__ = .;
-        KEEP(*(.first))
-        *(.text)
-        *(.text.*)
-
-        KEEP(*(.init))
-        KEEP(*(.fini))
-
-        /* .ctors */
-        *crtbegin.o(.ctors)
-        *crtbegin?.o(.ctors)
-        *(EXCLUDE_FILE(*crtend?.o *crtend.o) .ctors)
-        *(SORT(.ctors.*))
-        *(.ctors)
-
-        /* .dtors */
-        *crtbegin.o(.dtors)
-        *crtbegin?.o(.dtors)
-        *(EXCLUDE_FILE(*crtend?.o *crtend.o) .dtors)
-        *(SORT(.dtors.*))
-        *(.dtors)
-
-        *(SORT(.rodata.*))
-        *(.rodata)
-
-        KEEP(*(.eh_frame*))
-
-        . = ALIGN(4);
-        __rel_start__ = .;
-        *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*)
-        __rel_end__ = .;
-    }
-    .ARM.exidx : {
-        . = ALIGN(4);
-        __exdix_start = .;
-        *(.ARM.exidx* .gnu.linkonce.armexidx.*)
-        /* This is used by the startup in order to initialize the .data secion */
-        __exdix_end = .;
-    }
-
-    .permissions_table : {
-        . = ALIGN(4);
-        __permissions_table_start__ = .;
-        KEEP(*(.permissions_table))
-        __permissions_table_end__ = .;
-    }
-
-
-    PROVIDE(__ram_size__ = __bss_end__ - __data_start__);
-    .data : {
-        . = ALIGN(4);
-        __data_start__ = .;
-        __got_start__ = .;
-        *(.got)
-        __got_end__ = .;
-        . = ALIGN(4);
-        *(.data)
-        *(.data.*)
-    
-        *(vtable)
-        *(.data*)
-    
-        . = ALIGN(4);
-        /* preinit data */
-        PROVIDE_HIDDEN (__preinit_array_start = .);
-        KEEP(*(.preinit_array))
-        PROVIDE_HIDDEN (__preinit_array_end = .);
-    
-        . = ALIGN(4);
-        /* init data */
-        PROVIDE_HIDDEN (__init_array_start = .);
-        KEEP(*(SORT(.init_array.*)))
-        KEEP(*(.init_array))
-        PROVIDE_HIDDEN (__init_array_end = .);
-    
-        . = ALIGN(4);
-        /* finit data */
-        PROVIDE_HIDDEN (__fini_array_start = .);
-        KEEP(*(SORT(.fini_array.*)))
-        KEEP(*(.fini_array))
-        PROVIDE_HIDDEN (__fini_array_end = .);
-
-        . = ALIGN(4);
-        _shell_command_start = .;
-        KEEP(*(shellCommand))
-        _shell_command_end = .;
-    
-        . = ALIGN(4);
-        /* All data end */
-        __data_end__ = .;
-    }
-
-    PROVIDE(__heap_size__ = __heap_end__ - __heap_start__);
-    PROVIDE(__stack_size__ = __stack_end__ - __stack_start__);
-    .bss : {
-        . = ALIGN(4);
-        /* This is used by the startup in order to initialize the .bss secion */
-        __bss_start__ = .;
-        *(.bss)
-        *(COMMON)
-    
-        . = ALIGN(4);
-        __heap_start__ = .;
-        KEEP(*(.bss.heap))
-        __heap_end__ = .;
-    
-        . = ALIGN(4);
-        __stack_start__ = .;
-        . = . + STACKSIZE;
-        __stack_end__ = .;
-    
-        *(.bss.*)
-        /* This is used by the startup in order to initialize the .bss secion */
-        . = ALIGN(4);
-        __bss_end__ = .;
-    }
-    _end = .;
+  .isr_vector :
+  {
+    . = ALIGN(4);
+    KEEP(*(.isr_vector))
+    . = ALIGN(4);
+  } >FLASH
+  .text :
+  {
+    . = ALIGN(4);
+    *(.text)
+    *(.text*)
+    *(.glue_7)
+    *(.glue_7t)
+    *(.eh_frame)
+    KEEP (*(.init))
+    KEEP (*(.fini))
+   . = ALIGN(4);
+    _dev_reg_item_start = .;
+    KEEP (*(DevRegList))
+    _dev_reg_item_end = .;
+    . = ALIGN(4);
+    _mkrtos_init_start = .;
+    KEEP (*(SORT(.mkrtos.init.*)))
+    _mkrtos_init_end = .;
+    . = ALIGN(4);
+    cpio_start = .;
+    *(.cpio*)
+    . = ALIGN(4);
+    cpio_end = .;
+    . = ALIGN(4);
+    _etext = .;
+  } >FLASH
+  .rodata :
+  {
+    . = ALIGN(4);
+    *(.rodata)
+    *(.rodata*)
+    . = ALIGN(4);
+  } >FLASH
+  .ARM.extab : { *(.ARM.extab* .gnu.linkonce.armextab.*) } >FLASH
+  .ARM : {
+    __exidx_start = .;
+    *(.ARM.exidx*)
+    __exidx_end = .;
+  } >FLASH
+  .preinit_array :
+  {
+    PROVIDE_HIDDEN (__preinit_array_start = .);
+    KEEP (*(.preinit_array*))
+    PROVIDE_HIDDEN (__preinit_array_end = .);
+  } >FLASH
+  .init_array :
+  {
+    PROVIDE_HIDDEN (__init_array_start = .);
+    KEEP (*(SORT(.init_array.*)))
+    KEEP (*(.init_array*))
+    PROVIDE_HIDDEN (__init_array_end = .);
+  } >FLASH
+  .fini_array :
+  {
+    PROVIDE_HIDDEN (__fini_array_start = .);
+    KEEP (*(SORT(.fini_array.*)))
+    KEEP (*(.fini_array*))
+    PROVIDE_HIDDEN (__fini_array_end = .);
+  } >FLASH
+  _sidata = LOADADDR(.data);
+  .data :
+  {
+    . = ALIGN(4);
+    _sdata = .;
+    *(.data)
+    *(.data*)
+    . = ALIGN(4);
+    _edata = .;
+  } >RAM AT> FLASH
+  . = ALIGN(4);
+  .bss :
+  {
+    _sbss = .;
+    __bss_start__ = _sbss;
+    *(.bss)
+    *(.bss*)
+    *(COMMON)
+    . = ALIGN(4);
+    _ebss = .;
+    __bss_end__ = _ebss;
+  } >RAM
+  ._user_heap_stack :
+  {
+    . = ALIGN(8);
+    PROVIDE ( end = . );
+    PROVIDE ( _end = . );
+    . = . + _Min_Heap_Size;
+    . = . + _Min_Stack_Size;
+    . = ALIGN(8);
+  } >RAM
+  .ARM.attributes 0 : { *(.ARM.attributes) }
 }
diff --git a/mkrtos_user/user/app/tcc_test/link_pie.lds b/mkrtos_user/user/app/tcc_test/link_pie.lds
new file mode 100644
index 000000000..d20dc6e64
--- /dev/null
+++ b/mkrtos_user/user/app/tcc_test/link_pie.lds
@@ -0,0 +1,124 @@
+ENTRY(_start_)
+STACKSIZE = 1024;
+SECTIONS
+{
+    .text : {
+        . = ALIGN(4);
+        __text_start__ = .;
+        KEEP(*(.first))
+        *(.text)
+        *(.text.*)
+
+        KEEP(*(.init))
+        KEEP(*(.fini))
+
+        /* .ctors */
+        *crtbegin.o(.ctors)
+        *crtbegin?.o(.ctors)
+        *(EXCLUDE_FILE(*crtend?.o *crtend.o) .ctors)
+        *(SORT(.ctors.*))
+        *(.ctors)
+
+        /* .dtors */
+        *crtbegin.o(.dtors)
+        *crtbegin?.o(.dtors)
+        *(EXCLUDE_FILE(*crtend?.o *crtend.o) .dtors)
+        *(SORT(.dtors.*))
+        *(.dtors)
+
+        *(SORT(.rodata.*))
+        *(.rodata)
+
+        KEEP(*(.eh_frame*))
+
+        . = ALIGN(4);
+        __rel_start__ = .;
+        *(.rel.data .rel.data.* .rel.gnu.linkonce.d.*)
+        __rel_end__ = .;
+    }
+    .ARM.exidx : {
+        . = ALIGN(4);
+        __exdix_start = .;
+        *(.ARM.exidx* .gnu.linkonce.armexidx.*)
+        /* This is used by the startup in order to initialize the .data secion */
+        __exdix_end = .;
+    }
+
+    .permissions_table : {
+        . = ALIGN(4);
+        __permissions_table_start__ = .;
+        KEEP(*(.permissions_table))
+        __permissions_table_end__ = .;
+    }
+
+
+    PROVIDE(__ram_size__ = __bss_end__ - __data_start__);
+    .data : {
+        . = ALIGN(4);
+        __data_start__ = .;
+        __got_start__ = .;
+        *(.got)
+        __got_end__ = .;
+        . = ALIGN(4);
+        *(.data)
+        *(.data.*)
+    
+        *(vtable)
+        *(.data*)
+    
+        . = ALIGN(4);
+        /* preinit data */
+        PROVIDE_HIDDEN (__preinit_array_start = .);
+        KEEP(*(.preinit_array))
+        PROVIDE_HIDDEN (__preinit_array_end = .);
+    
+        . = ALIGN(4);
+        /* init data */
+        PROVIDE_HIDDEN (__init_array_start = .);
+        KEEP(*(SORT(.init_array.*)))
+        KEEP(*(.init_array))
+        PROVIDE_HIDDEN (__init_array_end = .);
+    
+        . = ALIGN(4);
+        /* finit data */
+        PROVIDE_HIDDEN (__fini_array_start = .);
+        KEEP(*(SORT(.fini_array.*)))
+        KEEP(*(.fini_array))
+        PROVIDE_HIDDEN (__fini_array_end = .);
+
+        . = ALIGN(4);
+        _shell_command_start = .;
+        KEEP(*(shellCommand))
+        _shell_command_end = .;
+    
+        . = ALIGN(4);
+        /* All data end */
+        __data_end__ = .;
+    }
+
+    PROVIDE(__heap_size__ = __heap_end__ - __heap_start__);
+    PROVIDE(__stack_size__ = __stack_end__ - __stack_start__);
+    .bss : {
+        . = ALIGN(4);
+        /* This is used by the startup in order to initialize the .bss secion */
+        __bss_start__ = .;
+        *(.bss)
+        *(COMMON)
+    
+        . = ALIGN(4);
+        __heap_start__ = .;
+        KEEP(*(.bss.heap))
+        __heap_end__ = .;
+    
+        . = ALIGN(4);
+        __stack_start__ = .;
+        . = . + STACKSIZE;
+        __stack_end__ = .;
+    
+        *(.bss.*)
+        /* This is used by the startup in order to initialize the .bss secion */
+        . = ALIGN(4);
+        __bss_end__ = .;
+    }
+    _end = .;
+}
diff --git a/mkrtos_user/user/app/tcc_test/main.c b/mkrtos_user/user/app/tcc_test/main.c
index f619dd317..5da75e456 100644
--- a/mkrtos_user/user/app/tcc_test/main.c
+++ b/mkrtos_user/user/app/tcc_test/main.c
@@ -1,8 +1,15 @@
 
 
-
+int a;
+int b;
 int _start_c(void)
 {
-    *((char *)(0)) = 0;
-    return 0;
+    a = 1;
+    b = 2;
+    while(a++ < 100)
+    {
+        ulog_write_bytes(4, "tcc test\n", 9);
+    }
+   
+    return a+b;
 }
\ No newline at end of file
diff --git a/mkrtos_user/user/app/tcc_test/readme.txt b/mkrtos_user/user/app/tcc_test/readme.txt
index 2e46d39a2..1e000074e 100644
--- a/mkrtos_user/user/app/tcc_test/readme.txt
+++ b/mkrtos_user/user/app/tcc_test/readme.txt
@@ -1,65 +1,22 @@
 
-cd /mnt
-tcc -nostdinc -nostdlib -c /bin/reloc.c -o reloc.o
-tcc -nostdinc -nostdlib -c /bin/main.c -o main.o
-as -mthumb -mcpu=cortex-m3 /bin/start.S -o start.o 
-ld reloc.o start.o main.o -T/bin/link.lds -o a.out -pie
-objcopy -O binary -S a.out a.bin
+ cd /mnt
+ tcc -nostdinc -nostdlib -c /bin/reloc.c -o reloc.o
+ tcc -nostdinc -nostdlib -c /bin/main.c -o main.o
+ tcc -nostdinc -nostdlib -c /bin/cons.c -o cons.o
+ as -mthumb -mcpu=cortex-m3 /bin/start.S -o start.o 
+ as -mthumb -mcpu=cortex-m3 /bin/syscall.S -o syscall.o 
+ ld start.o main.o -T/bin/link.lds -o a.out --section-start .text=0x8000000
+ ld start.o main.o cons.o syscall.o -T/bin/link_pie.lds -o a.out --section-start .text=0x20143800
+ ld start.o main.o -T/bin/link_pie.lds -o a.out --section-start .text=0x20143400 -L/bin -static -lsys
+ ld reloc.o start.o main.o -T/bin/link.lds -o b.out -r --gc-sections
+ objcopy -O binary -S a.out a.bin
+    59: 201438ec     0 NOTYPE  GLOBAL DEFAULT    5 __stack_end__
+ objdump -b binary -D -m armv7e-m -M force-thumb --adjust-vma=0x8000000 a.bin
 
-echo "84 46 3d e0 00 00 00 00 00 00 00 00 00 00 00 00 
-00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
-4d 4b 52 54 4f 53 2e 20 78 04 00 00 88 03 00 00 
-88 03 00 00 00 00 00 00 00 04 00 00 10 03 00 00 
-88 03 00 00 10 03 00 00 10 03 00 00 d8 02 00 00 
-d8 02 00 00 00 00 00 00 10 03 00 00 00 00 00 00 
-00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
-00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
-00 21 af f2 83 02 22 f0 01 02 0c 48 10 44 0c 4b 
-13 44 03 e0 42 58 49 f8 01 20 04 31 42 18 9a 42 
-f8 d3 48 46 af f2 a7 01 21 f0 01 01 00 f0 0a f8 
-68 46 af f2 b3 01 00 f0 05 f9 fe e7 10 03 00 00 
-14 03 00 00 03 b4 2d e9 00 58 eb 46 ad f2 2c 0d 
-db f8 10 00 4b f8 2c 0c 5b f8 2c 0c 28 30 30 30 
-01 68 4b f8 28 1c 5b f8 2c 0c 28 30 1c 30 01 68 
-4b f8 10 1c 5b f8 2c 0c 28 30 20 30 01 68 4b f8 
-14 1c 5b f8 2c 0c 28 30 2c 30 01 68 4b f8 18 1c 
-00 20 4b f8 04 0c 5b f8 10 0c 4b f8 08 0c 5b f8 
-08 0c 5b f8 14 1c 88 42 80 f0 4b 80 0b e0 5b f8 
-08 0c 04 30 4b f8 08 0c 5b f8 04 0c 01 46 01 30 
-4b f8 04 0c eb e7 5b f8 04 0c 80 00 db f8 0c 10 
-08 18 01 68 5b f8 28 0c 81 42 c0 f0 19 80 5b f8 
-04 0c 80 00 db f8 0c 10 08 18 01 68 5b f8 28 0c 
-08 1a 4b f8 0c 0c 5b f8 04 0c 80 00 db f8 0c 10 
-08 18 5b f8 0c 1c db f8 0c 20 89 18 01 60 17 e0 
-5b f8 04 0c 80 00 db f8 0c 10 08 18 01 68 5b f8 
-18 0c 08 1a 4b f8 0c 0c 5b f8 04 0c 80 00 db f8 
-0c 10 08 18 5b f8 0c 1c db f8 10 20 89 18 01 60 
-b5 e7 5b f8 2c 0c 28 30 24 30 01 68 db f8 10 00 
-08 18 4b f8 1c 0c 5b f8 2c 0c 28 30 28 30 01 68 
-db f8 10 00 08 18 4b f8 20 0c 00 20 4b f8 04 0c 
-5b f8 1c 0c 4b f8 08 0c 5b f8 08 0c 5b f8 20 1c 
-88 42 80 f0 59 80 0a e0 5b f8 08 0c 08 30 4b f8 
-08 0c 5b f8 04 0c 02 30 4b f8 04 0c ec e7 5b f8 
-04 0c 80 00 5b f8 1c 1c 08 18 01 68 5b f8 28 0c 
-08 1a 4b f8 0c 0c db f8 0c 00 5b f8 0c 1c 40 18 
-4b f8 24 0c 5b f8 04 0c 01 30 80 00 5b f8 1c 1c 
-08 18 01 68 01 f0 ff 01 29 e0 5b f8 24 0c 01 68 
-5b f8 28 0c 81 42 c0 f0 11 80 5b f8 24 0c 01 68 
-5b f8 28 0c 08 1a 4b f8 0c 0c 5b f8 24 0c 5b f8 
-0c 1c db f8 0c 20 89 18 01 60 0f e0 5b f8 24 0c 
-01 68 5b f8 18 0c 08 1a 4b f8 0c 0c 5b f8 24 0c 
-5b f8 0c 1c db f8 10 20 89 18 01 60 03 e0 17 29 
-3f f4 d3 af 00 bf a7 e7 0b b0 bd e8 00 58 02 b0 
-70 47 00 bf 2d e9 00 58 eb 46 00 bf 00 bf fe e7 
-bd e8 00 58 70 47 00 bf 2f 75 73 72 2f 6c 69 62 
-2f 6c 64 2e 73 6f 2e 31 00 00 00 00 00 00 00 00 
-00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
-01 00 00 00 01 00 00 00 00 00 00 00 00 00 00 00 
-11 11 01 00 04 00 00 00 00 03 00 00 05 00 00 00 
-fc 02 00 00 06 00 00 00 ec 02 00 00 0a 00 00 00 
-01 00 00 00 0b 00 00 00 10 00 00 00 15 00 00 00 
-00 00 00 00 fb ff ff 6f 00 00 00 08 00 00 00 00 
-00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
-00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 
-00 00 00 00 00 00 00 00 00 00 00 00 14 03 00 00 
-00 00 00 00 00 00 00 00" | xxd -r -p > a.bin
+127
+
+ tcc -nostdinc -nostdlib -c main.c -o main.o
+ as -mthumb -mcpu=cortex-m3 start.S -o start.o 
+ ld start.o main.o -T/bin/link.lds -o a.out --section-start .text=0x8000000
+
+ echo "" | xxd -r -p > a.bin
diff --git a/mkrtos_user/user/app/tcc_test/reloc.c b/mkrtos_user/user/app/tcc_test/reloc.c
deleted file mode 100644
index 068f2bcef..000000000
--- a/mkrtos_user/user/app/tcc_test/reloc.c
+++ /dev/null
@@ -1,95 +0,0 @@
-/**
- * @brief
- *
- */
-typedef struct app_info
-{
-    const char d[32];
-    const char magic[8];
-    union
-    {
-        struct exec_head_info
-        {
-            unsigned long ram_size;
-            unsigned long heap_offset;
-            unsigned long stack_offset;
-            unsigned long heap_size;
-            unsigned long stack_size;
-            unsigned long data_offset;
-            unsigned long bss_offset;
-            unsigned long got_start;
-            unsigned long got_end;
-            unsigned long rel_start;
-            unsigned long rel_end;
-            unsigned long text_start;
-            unsigned long data_start;
-            unsigned long dyn_start;
-        } i;
-        // const char d1[256];
-    };
-    const char dot_text[];
-} app_info_t;
-#define R_TYPE(x) ((x) & 255)
-#define R_SYM(x) ((x) >> 8)
-#define R_INFO ELF32_R_INFO
-#define R_ARM_RELATIVE		23
-/**
- * gbase: 内存基地址
- * tbase: text的首地址
- */
-void _reloc(unsigned int *gbase, unsigned int tbase)
-{
-    int i;
-    unsigned int s;
-    unsigned int offset;
-    unsigned int gs, ge, ts;
-    unsigned int *rs, *re;
-    unsigned int *pointer;
-    unsigned int ds;
-
-    app_info_t *app = (void *)tbase;
-    ds = (unsigned int)app->i.data_start;
-    gs = (unsigned int)app->i.got_start;
-    ge = (unsigned int)app->i.got_end;
-    ts = (unsigned int)app->i.text_start;
-
-    for (i = 0, s = gs; s < ge; s += 4, i++)
-    {
-        if (gbase[i] >= ds)
-        {
-            offset = gbase[i] - ds;
-            gbase[i] = offset + (unsigned int)gbase;
-        }
-        else
-        {
-            offset = gbase[i] - ts;
-            gbase[i] = offset + tbase;
-        }
-    }
-    rs = (unsigned int *)(app->i.rel_start + tbase);
-    re = (unsigned int *)(app->i.rel_end + tbase);
-    // rel
-    for (i = 0, s = (unsigned int)rs; s < (unsigned int)re; s += 8, i += 2)
-    {
-        offset = rs[i] - ds;
-        pointer = (unsigned int *)((unsigned int)gbase + offset);
-        switch (R_TYPE(rs[i + 1]))
-        {
-        case R_ARM_RELATIVE:
-        {
-            if (*pointer >= ds)
-            {
-                offset = *pointer - ds;
-                *pointer = offset + (unsigned int)gbase;
-            }
-            else
-            {
-                offset = *pointer - ts;
-                *pointer = offset + (unsigned int)tbase;
-            }
-        }
-        break;
-        }
-    }
-    return;
-}
\ No newline at end of file
diff --git a/mkrtos_user/user/app/tcc_test/start.S b/mkrtos_user/user/app/tcc_test/start.S
index f23d57a11..c0735464a 100644
--- a/mkrtos_user/user/app/tcc_test/start.S
+++ b/mkrtos_user/user/app/tcc_test/start.S
@@ -18,7 +18,7 @@ _head_start:
 heap_offset:     .word     __heap_start__ - _start_
 stack_offset:    .word     __stack_start__ - _start_
 heap_size:       .word     __heap_size__
-stack_size:      .word     1024
+stack_size:      .word     __stack_size__
 data_offset:     .word     __data_start__ - _start_
 
     .word   __bss_start__ - _start_
@@ -34,27 +34,27 @@ data_start: .word __data_start__
     .align
 __start:
 
-    movs    r1, #0
-    adr     r2, _start_
-    bic     r2, r2, #1
-    ldr     r0, = __data_start__
-    add     r0, r0, r2
-    ldr     r3, = __data_end__
-    add     r3, r3, r2
-    b       LoopCopyDataInit
-CopyDataInit:
-    ldr     r2, [r0, r1]
-    str     r2, [r9, r1]
-    adds    r1, r1, #4
-LoopCopyDataInit:
-    adds    r2, r0, r1
-    cmp     r2, r3
-    bcc     CopyDataInit
+@     movs    r1, #0
+@     adr     r2, _start_
+@     bic     r2, r2, #1
+@     ldr     r0, = __data_start__
+@     add     r0, r0, r2
+@     ldr     r3, = __data_end__
+@     add     r3, r3, r2
+@     b       LoopCopyDataInit
+@ CopyDataInit:
+@     ldr     r2, [r0, r1]
+@     str     r2, [r9, r1]
+@     adds    r1, r1, #4
+@ LoopCopyDataInit:
+@     adds    r2, r0, r1
+@     cmp     r2, r3
+@     bcc     CopyDataInit
 
-    mov     r0, r9
-    adr     r1, _start_
-    bic     r1, r1, #1
-    bl      _reloc
+    @ mov     r0, r9
+    @ adr     r1, _start_
+    @ bic     r1, r1, #1
+    @ bl      _reloc
 
 	@ pop     {r0, r12}
     mov     r0, sp
diff --git a/mkrtos_user/user/app/tcc_test/syscall.S b/mkrtos_user/user/app/tcc_test/syscall.S
new file mode 100644
index 000000000..fc8be995f
--- /dev/null
+++ b/mkrtos_user/user/app/tcc_test/syscall.S
@@ -0,0 +1,19 @@
+.syntax unified
+.text
+
+/*
+int mk_syscall(int nr, ...)
+*/
+.global mk_syscall
+.type mk_syscall, %function
+mk_syscall:
+    push {r4-r7}
+    mov r7, r0
+    mov r0, r1
+    mov r1, r2
+    mov r2, r3
+    add r6, sp,#16
+    ldmia r6,{r3-r5}
+    svc 128
+    pop {r4-r7}
+    bx lr
diff --git a/mkrtos_user/user/app/test/fs_test.c b/mkrtos_user/user/app/test/fs_test.c
index 2a4a177c5..2b115c19d 100644
--- a/mkrtos_user/user/app/test/fs_test.c
+++ b/mkrtos_user/user/app/test/fs_test.c
@@ -10,7 +10,7 @@
 int fs_test(void)
 {
     int fd;
-    int ret;
+    int ret = 0;
     printf("%s start\n", __func__);
 
     fd = open("/mnt/1.txt", O_RDWR | O_CREAT, 0777);
@@ -63,7 +63,7 @@ static uint8_t buf[512];
 int fs_test2(void)
 {
     int fd;
-    int ret;
+    int ret = -1;
 
     printf("%s start\n", __func__);
     for (int i = 0; i < 512; i++)
diff --git a/mkrtos_user/user/drv/ATSURFF437/block/main.c b/mkrtos_user/user/drv/ATSURFF437/block/main.c
index 8598b6ee2..d95926d4d 100644
--- a/mkrtos_user/user/drv/ATSURFF437/block/main.c
+++ b/mkrtos_user/user/drv/ATSURFF437/block/main.c
@@ -95,11 +95,13 @@ int blk_drv_info(blk_drv_info_t *info)
     ret = flash_get_sector_size(&mem_addr, &blk_size, &blk_nr);
     if (ret < 0)
     {
+        printf("blk drv info error : %d\n", ret);
         return ret;
     }
     info->blk_nr = blk_nr;
     info->blk_size = blk_size;
     info->blk_start_addr = mem_addr;
+    printf("[block] 0x%x %d\n", info->blk_start_addr, info->blk_size);
     return 0;
 }
 int main(int argc, char *argv[])
@@ -113,8 +115,6 @@ int main(int argc, char *argv[])
         printf("example:block /block");
         return -1;
     }
-    task_set_obj_name(TASK_THIS, TASK_THIS, "tk_blk");
-    task_set_obj_name(TASK_THIS, THREAD_MAIN, "th_blk");
     printf("%s init..\n", argv[0]);
     fast_ipc_init();
 
@@ -122,11 +122,11 @@ int main(int argc, char *argv[])
     blk_drv_init(&blk_drv);
     ret = rpc_meta_init_def(TASK_THIS, &hd);
     assert(ret >= 0);
-    ns_register(argv[1], hd, 0);
     meta_reg_svr_obj(&blk_drv.svr, BLK_DRV_PROT);
+    ns_register(argv[1], hd, 0);
 
     while (1)
     {
-        u_sleep_ms(0);
+        u_sleep_ms(U_SLEEP_ALWAYS);
     }
 }
diff --git a/mkrtos_user/user/drv/STM32F205/block/main.c b/mkrtos_user/user/drv/STM32F205/block/main.c
index 70eb3d73c..b5b452aaa 100644
--- a/mkrtos_user/user/drv/STM32F205/block/main.c
+++ b/mkrtos_user/user/drv/STM32F205/block/main.c
@@ -64,7 +64,6 @@ int blk_drv_read(obj_handler_t obj, int len, int inx)
     int ret = -1;
     addr_t addr = 0;
     umword_t size = 0;
-    uint32_t _err;
     msg_tag_t tag = share_mem_map(obj, vma_addr_create(VPAGE_PROT_RWX, 0, 0), &addr, &size);
 
     if (msg_tag_get_val(tag) < 0)
@@ -113,8 +112,6 @@ int main(int argc, char *argv[])
         printf("example:block /block");
         return -1;
     }
-    task_set_obj_name(TASK_THIS, TASK_THIS, "tk_blk");
-    task_set_obj_name(TASK_THIS, THREAD_MAIN, "th_blk");
     printf("%s init..\n", argv[0]);
     fast_ipc_init();
 
@@ -122,8 +119,8 @@ int main(int argc, char *argv[])
     blk_drv_init(&blk_drv);
     ret = rpc_meta_init_def(TASK_THIS, &hd);
     assert(ret >= 0);
-    ns_register(argv[1], hd, 0);
     meta_reg_svr_obj(&blk_drv.svr, BLK_DRV_PROT);
+    ns_register(argv[1], hd, 0);
 
     while (1)
     {
diff --git a/mkrtos_user/user/drv/STM32F407VET6/block/main.c b/mkrtos_user/user/drv/STM32F407VET6/block/main.c
index 70eb3d73c..f2d778215 100644
--- a/mkrtos_user/user/drv/STM32F407VET6/block/main.c
+++ b/mkrtos_user/user/drv/STM32F407VET6/block/main.c
@@ -122,8 +122,8 @@ int main(int argc, char *argv[])
     blk_drv_init(&blk_drv);
     ret = rpc_meta_init_def(TASK_THIS, &hd);
     assert(ret >= 0);
-    ns_register(argv[1], hd, 0);
     meta_reg_svr_obj(&blk_drv.svr, BLK_DRV_PROT);
+    ns_register(argv[1], hd, 0);
 
     while (1)
     {
diff --git a/mkrtos_user/user/drv/common/ram_block/main.c b/mkrtos_user/user/drv/common/ram_block/main.c
index b86066a0f..c1f3682ce 100644
--- a/mkrtos_user/user/drv/common/ram_block/main.c
+++ b/mkrtos_user/user/drv/common/ram_block/main.c
@@ -19,7 +19,7 @@
 #include <string.h>
 #include "u_hd_man.h"
 #include "u_vmam.h"
-#define STACK_COM_ITME_SIZE (1024 + 512)
+#define STACK_COM_ITME_SIZE (2048)
 ATTR_ALIGN(8)
 static uint8_t stack_coms[STACK_COM_ITME_SIZE];
 static uint8_t msg_buf_coms[MSG_BUG_LEN];
@@ -39,11 +39,14 @@ static size_t blk_size;
 
 int blk_drv_write(obj_handler_t obj, int len, int inx)
 {
-    int ret = -1;
     addr_t addr = 0;
     umword_t size = 0;
     msg_tag_t tag;
 
+    if (inx >= blk_nr)
+    {
+        return -EINVAL;
+    }
     if (len == 0)
     {
         memset(blk_data + inx * blk_size, 0xff, len);
@@ -64,11 +67,13 @@ int blk_drv_write(obj_handler_t obj, int len, int inx)
 }
 int blk_drv_read(obj_handler_t obj, int len, int inx)
 {
-    int ret = -1;
     addr_t addr = 0;
     umword_t size = 0;
-    uint32_t _err;
 
+    if (inx >= blk_nr)
+    {
+        return -EINVAL;
+    }
     if (len % blk_size)
     {
         return -EINVAL;
@@ -124,6 +129,7 @@ int main(int argc, char *argv[])
             break;
         case 'p':
             dev_path = optarg;
+            printf("dev path %s\n", dev_path);
         default:
             break;
         }
@@ -146,6 +152,7 @@ int main(int argc, char *argv[])
         return -1;
     }
     printf("%s init..\n", argv[0]);
+    printf("ram block base addr:[0x%x 0x%x] \n", blk_data, blk_data + blk_nr* blk_size);
     fast_ipc_init();
 
     blk_drv_init(&blk_drv);
diff --git a/mkrtos_user/user/drv/lib/mk_display/mk_display_drv.c b/mkrtos_user/user/drv/lib/mk_display/mk_display_drv.c
index 3f5aad693..dead3fcd2 100644
--- a/mkrtos_user/user/drv/lib/mk_display/mk_display_drv.c
+++ b/mkrtos_user/user/drv/lib/mk_display/mk_display_drv.c
@@ -53,7 +53,7 @@ static int mk_display_drv_ioctl(mk_dev_t *_dev, int cmd, umword_t args)
     mk_display_dev_t *dis_dev = _dev->priv_data;
     mk_display_ops_t *ops = dis_dev->ops;
     assert(ops);
-    int ret;
+    int ret = 0;
     pid_t cur_pid;
 
     switch (cmd)
diff --git a/mkrtos_user/user/drv/lib/mk_drv/mk_dtb_parse.c b/mkrtos_user/user/drv/lib/mk_drv/mk_dtb_parse.c
index ede18d480..4c8bbb79e 100644
--- a/mkrtos_user/user/drv/lib/mk_drv/mk_dtb_parse.c
+++ b/mkrtos_user/user/drv/lib/mk_drv/mk_dtb_parse.c
@@ -87,8 +87,6 @@ int dtb_parse_init(void)
 {
     printf("init dts parsing.\n");
 
-    addr_t entry;
-    size_t size;
     void *fdt;
 
     fdt = (void *)sys_read_dtbo();