From ad72f5e0da85f9ef61193d00ef0c2d4655f2ec9e Mon Sep 17 00:00:00 2001
From: zhangzheng <1358745329@qq.comwq>
Date: Sun, 3 Sep 2023 15:55:06 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96=E7=B3=BB=E7=BB=9F=E8=B0=83?=
 =?UTF-8?q?=E7=94=A8?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .vscode/settings.json                       |  5 +-
 mkrtos_knl/arch/armv7m/mpu.c                |  1 +
 mkrtos_knl/inc/knl/ipc.h                    | 24 ++++++++
 mkrtos_knl/inc/knl/kobject.h                |  7 +--
 mkrtos_knl/inc/knl/map.h                    |  3 +
 mkrtos_knl/inc/knl/prot.h                   | 58 ++++++++++++++++--
 mkrtos_knl/inc/knl/task.h                   |  1 -
 mkrtos_knl/inc/knl/thread.h                 | 23 ++++---
 mkrtos_knl/inc/lib/types.h                  |  1 +
 mkrtos_knl/knl/factory.c                    | 28 ++++-----
 mkrtos_knl/knl/ipc.c                        | 67 +++++++++++++++-----
 mkrtos_knl/knl/log.c                        | 27 ++++----
 mkrtos_knl/knl/map.c                        | 12 ++++
 mkrtos_knl/knl/mm.c                         |  8 ---
 mkrtos_knl/knl/mm_man.c                     | 18 +++---
 mkrtos_knl/knl/syscall.c                    | 22 +++----
 mkrtos_knl/knl/task.c                       | 30 +++++----
 mkrtos_knl/knl/thread.c                     | 23 ++++---
 mkrtos_user/lib/sys/inc/u_prot.h            | 68 ++++++++++++++++++---
 mkrtos_user/lib/sys/inc/u_util.h            |  5 +-
 mkrtos_user/lib/sys/src/u_factory.c         | 15 ++++-
 mkrtos_user/lib/sys/src/u_ipc.c             |  6 +-
 mkrtos_user/lib/sys/src/u_log.c             | 15 +++--
 mkrtos_user/lib/sys/src/u_mm.c              |  6 +-
 mkrtos_user/lib/sys/src/u_task.c            |  9 ++-
 mkrtos_user/lib/sys/src/u_thread.c          | 15 +++--
 mkrtos_user/server/init/src/test/app_test.c |  2 +
 mkrtos_user/server/shell/src/main.c         |  2 -
 28 files changed, 355 insertions(+), 146 deletions(-)

diff --git a/.vscode/settings.json b/.vscode/settings.json
index fb0abe284..fec17478a 100755
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -119,7 +119,10 @@
         "u_util.h": "c",
         "u_mm.h": "c",
         "u_ipc.h": "c",
-        "ref.h": "c"
+        "ref.h": "c",
+        "map.h": "c",
+        "ipc.h": "c",
+        "err.h": "c"
     },
     "cortex-debug.showRTOS": false,
 }
\ No newline at end of file
diff --git a/mkrtos_knl/arch/armv7m/mpu.c b/mkrtos_knl/arch/armv7m/mpu.c
index e1d9be37f..f6e581e82 100755
--- a/mkrtos_knl/arch/armv7m/mpu.c
+++ b/mkrtos_knl/arch/armv7m/mpu.c
@@ -10,6 +10,7 @@
 #include "mpu.h"
 #include <stm32f2xx.h>
 #include <mpu_armv7.h>
+#include "thread.h"
 #include "task.h"
 static volatile umword_t *MPUCR = (umword_t *)0xE000ED94;
 
diff --git a/mkrtos_knl/inc/knl/ipc.h b/mkrtos_knl/inc/knl/ipc.h
index 307815ac8..aab93891a 100755
--- a/mkrtos_knl/inc/knl/ipc.h
+++ b/mkrtos_knl/inc/knl/ipc.h
@@ -1,3 +1,27 @@
 #pragma once
+#include "thread.h"
+#include "types.h"
+
+#define IPC_MSG_SIZE 96
+#define MAP_BUF_SIZE 16
+#define IPC_USER_SIZE 12
+
+#if (IPC_MSG_SIZE + MAP_BUF_SIZE + IPC_USER_SIZE) > THREAD_MSG_BUG_LEN
+#error "IPC MSG len error."
+#endif
+
+typedef struct ipc_msg
+{
+    union
+    {
+        struct
+        {
+            umword_t msg_buf[IPC_MSG_SIZE / WORD_BYTES];
+            umword_t map_buf[MAP_BUF_SIZE / WORD_BYTES];
+            umword_t user[IPC_USER_SIZE / WORD_BYTES];
+        };
+        uint8_t data[THREAD_MSG_BUG_LEN];
+    };
+} ipc_msg_t;
 
 void ipc_dump(void);
diff --git a/mkrtos_knl/inc/knl/kobject.h b/mkrtos_knl/inc/knl/kobject.h
index 46de9cdc7..456d6e513 100755
--- a/mkrtos_knl/inc/knl/kobject.h
+++ b/mkrtos_knl/inc/knl/kobject.h
@@ -12,7 +12,7 @@
 struct kobject;
 typedef struct kobject kobject_t;
 
-typedef msg_tag_t (*syscall_func)(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f);
+typedef void (*syscall_func)(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f);
 typedef void (*obj_release_stage_1_func)(kobject_t *kobj);
 typedef void (*obj_release_stage_2_func)(kobject_t *kobj);
 typedef bool_t (*obj_release_put)(kobject_t *kobj);
@@ -39,7 +39,6 @@ typedef struct kobject
     obj_release_put put_func;
 } kobject_t;
 
-
 typedef struct kobj_del_list
 {
     slist_head_t head;
@@ -76,10 +75,10 @@ static inline void kobject_invalidate(kobject_t *kobj)
     spinlock_invalidate(&kobj->lock);
 }
 
-static inline msg_tag_t kobject_invoke(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
+static inline void kobject_invoke(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f)
 {
     /*TODO:*/
-    return msg_tag_init3(0, 0, -ENOSYS);
+    f->r[0] = msg_tag_init3(0, 0, -ENOSYS).raw;
 }
 static inline bool_t kobject_put(kobject_t *kobj)
 {
diff --git a/mkrtos_knl/inc/knl/map.h b/mkrtos_knl/inc/knl/map.h
index 9a460b418..d212759ea 100755
--- a/mkrtos_knl/inc/knl/map.h
+++ b/mkrtos_knl/inc/knl/map.h
@@ -3,6 +3,9 @@
 #include "kobject.h"
 #include "obj_space.h"
 bool_t obj_map_root(kobject_t *kobj, obj_space_t *obj_space, ram_limit_t *ram, obj_addr_t addr);
+int obj_map_src_dst(obj_space_t *dst_space, obj_space_t *src_space,
+                    obj_handler_t dst_inx, obj_handler_t src_inx,
+                    ram_limit_t *ram);
 int obj_map(obj_space_t *obj_space, obj_handler_t inx, kobject_t *kobj, ram_limit_t *ram);
 void obj_unmap(obj_space_t *obj_space, obj_handler_t inx, kobj_del_list_t *del_list);
 void obj_unmap_all(obj_space_t *obj_space, kobj_del_list_t *del_list);
diff --git a/mkrtos_knl/inc/knl/prot.h b/mkrtos_knl/inc/knl/prot.h
index ddd5d48ea..5f828e123 100755
--- a/mkrtos_knl/inc/knl/prot.h
+++ b/mkrtos_knl/inc/knl/prot.h
@@ -22,6 +22,30 @@
 #define FACTORY_FUNC_MAX (MM_PROT + 1)
 #define FACTORY_PORT_END FACTORY_FUNC_MAX
 
+enum msg_type
+{
+    MSG_NONE_TYPE = 0,
+    MSG_DEF_TYPE = 1,
+};
+typedef union ipc_type
+{
+    union
+    {
+        uint8_t raw;
+        struct
+        {
+            uint8_t type : 1;
+            uint8_t msg_buf_len : 5;
+            uint8_t map_buf_len : 2;
+        };
+    };
+} ipc_type_t;
+
+static inline ipc_type_t ipc_type_create(uint8_t raw)
+{
+    return (ipc_type_t){.raw = raw};
+}
+
 typedef struct msg_tag
 {
     union
@@ -29,9 +53,9 @@ typedef struct msg_tag
         umword_t raw;
         struct
         {
-            umword_t type : 4;
-            umword_t type2 : 8;
-            umword_t prot : (sizeof(umword_t) * 8) - 12;
+            umword_t type : 4;                           //!< 系统调用时代表操作码
+            umword_t type2 : 8;                          //!< log操作，存放打印的长度; 也可以用于标志消息的类型
+            umword_t prot : (sizeof(umword_t) * 8) - 12; //!< 代码操作的系统调用类型，或者返回值时存放错误码
         };
     };
 } msg_tag_t;
@@ -39,5 +63,29 @@ typedef struct msg_tag
 #define msg_tag_init(r) \
     ((msg_tag_t){.raw = (r)})
 
-#define msg_tag_init3(t, t2, p) \
-    msg_tag_init(((umword_t)(t)&0xf) | (((umword_t)(t2)&0xff) << 4) | (((umword_t)(p)) << 12))
+#define msg_tag_init3(t, t2, p) ((msg_tag_t){ \
+    .type = t,                                \
+    .type2 = t2,                              \
+    .prot = p})
+
+typedef union syscall_prot
+{
+    umword_t raw;
+    struct
+    {
+        umword_t op : 6;                     //!< 操作的op
+        umword_t prot : 6;                   //!< 通信的类型
+        umword_t obj_inx : (WORD_BITS - 12); //!<
+    };
+} syscall_prot_t;
+
+#define syscall_prot_create_raw(r) ((syscall_prot_t){.raw = (r)})
+
+static inline syscall_prot_t syscall_prot_create(uint8_t op, uint8_t prot, obj_handler_t obj_inx)
+{
+    return (syscall_prot_t){
+        .op = op,
+        .prot = prot,
+        .obj_inx = obj_inx,
+    };
+}
diff --git a/mkrtos_knl/inc/knl/task.h b/mkrtos_knl/inc/knl/task.h
index d2c2c9315..f4b36f9ec 100755
--- a/mkrtos_knl/inc/knl/task.h
+++ b/mkrtos_knl/inc/knl/task.h
@@ -18,7 +18,6 @@ typedef struct task
     ref_counter_t ref_cn;
 } task_t;
 
-task_t *thread_get_current_task(void);
 void task_init(task_t *task, ram_limit_t *ram, int is_knl);
 task_t *task_create(ram_limit_t *lim, int is_knl);
 int task_alloc_base_ram(task_t *tk, ram_limit_t *lim, size_t size);
diff --git a/mkrtos_knl/inc/knl/thread.h b/mkrtos_knl/inc/knl/thread.h
index 434ef09c3..0b0191968 100755
--- a/mkrtos_knl/inc/knl/thread.h
+++ b/mkrtos_knl/inc/knl/thread.h
@@ -14,8 +14,11 @@
 #include "arch.h"
 #include "ref.h"
 #define THREAD_BLOCK_SIZE 0x400 //!< 线程块大小，栈在块的顶部
+struct task;
+typedef struct task task_t;
 struct thread;
 typedef struct thread thread_t;
+
 enum thread_state
 {
     THREAD_IDLE,
@@ -44,20 +47,22 @@ typedef struct sp_info
     mword_t sp_type; //!< 使用的栈类型
 } sp_info_t;
 
-#define THREAD_MSG_BUG_LEN 128       //!< 默认的消息寄存器大小
+#define THREAD_MSG_BUG_LEN 128UL     //!< 默认的消息寄存器大小
 #define MSG_BUF_HAS_DATA_FLAGS 0x01U //!< 已经有数据了
-#define MSG_BUF_RECV_R_FLAGS 0x02U     //!< 接收上次发送数据的接收者
-#define MSG_BUF_REPLY_FLAGS 0x04U //!<
+#define MSG_BUF_RECV_R_FLAGS 0x02U   //!< 接收来自recv_th的消息
+#define MSG_BUF_REPLY_FLAGS 0x04U    //!< 回复消息给send_th
+
 typedef struct msg_buf
 {
-    void *msg;         //!< buf，长度 @see THREAD_MSG_BUG_LEN
-    uhmword_t len;     //!< 这里不是buf的大小，而是存储接收或者发送的长度
+    void *msg;         //!< buf，长度是固定的 @see THREAD_MSG_BUG_LEN
+    thread_t *send_th; //!< 标志是谁发送的该数据
+    thread_t *recv_th; //!< 标志数据的接收方是谁
     uhmword_t flags;   //!< 传输标志
-    thread_t *send_th; //!< 当是call操作时，存放call的发起方
-    thread_t *recv_th; //!< 当是call操作时，存放call的发起方
+    uint8_t len;       //!< 这里不是buf的大小，而是存储接收或者发送的长度
+    uint8_t ipc_ide;  //!< ipc类型
 } msg_buf_t;
 
-#define THREAD_MAIGC 0xdeadead
+#define THREAD_MAIGC 0xdeadead //!< 用于栈溢出检测
 typedef struct thread
 {
     kobject_t kobj;           //!< 内核对象节点
@@ -97,6 +102,8 @@ static inline thread_t *thread_get_current(void)
 
     return th;
 }
+task_t *thread_get_current_task(void);
+task_t *thread_get_bind_task(thread_t *th);
 
 static inline pf_t *thread_get_current_pf(void)
 {
diff --git a/mkrtos_knl/inc/lib/types.h b/mkrtos_knl/inc/lib/types.h
index 6fdb8cbf9..1a6b67a50 100755
--- a/mkrtos_knl/inc/lib/types.h
+++ b/mkrtos_knl/inc/lib/types.h
@@ -38,4 +38,5 @@ typedef umword_t obj_handler_t;
 #define TRUE (!(FALSE))
 #endif
 
+#define WORD_BYTES (sizeof(void *))
 #define WORD_BITS (sizeof(void *) * 8)
diff --git a/mkrtos_knl/knl/factory.c b/mkrtos_knl/knl/factory.c
index 4a16a6738..7c5cafc95 100755
--- a/mkrtos_knl/knl/factory.c
+++ b/mkrtos_knl/knl/factory.c
@@ -8,7 +8,7 @@
 #include "map.h"
 #include "init.h"
 #include "globals.h"
-
+#include "thread.h"
 enum
 {
     FACTORY_CREATE_KOBJ
@@ -49,17 +49,17 @@ static kobject_t *factory_manu_kobj(kobject_t *kobj, ram_limit_t *lim, entry_fra
     }
     return new_kobj;
 }
-static msg_tag_t factory_create_map(kobject_t *kobj, task_t *tk, ram_limit_t *lim, entry_frame_t *f)
+static msg_tag_t factory_create_map(kobject_t *kobj, task_t *tk, entry_frame_t *f)
 {
-    kobject_t *new_kobj = factory_manu_kobj(kobj, lim, f);
+    kobject_t *new_kobj = factory_manu_kobj(kobj, tk->lim, f);
 
     if (!new_kobj)
     {
         return msg_tag_init3(0, 0, -ENOMEM);
     }
-    if (obj_map_root(new_kobj, &tk->obj_space, lim, f->r[2]) == FALSE)
+    if (obj_map_root(new_kobj, &tk->obj_space, tk->lim, f->r[2]) == FALSE)
     {
-        mm_limit_free(lim, new_kobj);
+        mm_limit_free(tk->lim, new_kobj);
         return msg_tag_init3(0, 0, -ENOMEM);
     }
     return msg_tag_init3(0, 0, 0);
@@ -72,27 +72,27 @@ static msg_tag_t factory_create_map(kobject_t *kobj, task_t *tk, ram_limit_t *li
  * @param f
  * @return msg_tag_t
  */
-static msg_tag_t
-factory_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
+static void
+factory_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f)
 {
-    msg_tag_t tag = msg_tag_init(f->r[0]);
+    msg_tag_t tag = msg_tag_init3(0, 0, -EINVAL);
     task_t *task = thread_get_current_task();
 
-    if (tag.prot != FACTORY_PROT)
+    if (sys_p.prot != FACTORY_PROT)
     {
-        return msg_tag_init3(0, 0, -EPROTO);
+        f->r[0] = msg_tag_init3(0, 0, -EPROTO).raw;
+        return;
     }
-    ram = task->lim;
-    switch (tag.type)
+    switch (sys_p.op)
     {
     case FACTORY_CREATE_KOBJ:
     {
-        return factory_create_map(kobj, task, ram, f);
+        tag = factory_create_map(kobj, task, f);
     }
     break;
     }
 
-    return msg_tag_init3(0, 0, 0);
+    f->r[0] = tag.raw;
 }
 static void factory_init(factory_t *fac, umword_t max)
 {
diff --git a/mkrtos_knl/knl/ipc.c b/mkrtos_knl/knl/ipc.c
index 424f6c4df..7ddc03cfb 100755
--- a/mkrtos_knl/knl/ipc.c
+++ b/mkrtos_knl/knl/ipc.c
@@ -4,13 +4,14 @@
 #include "prot.h"
 #include "kobject.h"
 #include "factory.h"
+#include "task.h"
 #include "thread.h"
 #include "assert.h"
 #include "slist.h"
 #include "spinlock.h"
 #include "string.h"
 #include "mm_wrap.h"
-
+#include "map.h"
 /**
  * @brief ipc 对象，用于接收与发送另一个thread发送的消息
  *
@@ -28,6 +29,7 @@ enum ipc_op
 {
     IPC_SEND, //!< 发送IPC消息
     IPC_REVC, //!< 接受IPC消息
+    IPC_MAP,  //!< 该消息是一个映射消息
 };
 
 static void add_wait(ipc_t *ipc, thread_t *th)
@@ -62,16 +64,48 @@ static void ipc_unbind_rcv(ipc_t *ipc)
         ipc->rcv = 0;
     }
 }
+static void ipc_data_copy(thread_t *dst_th, thread_t *src_th, int len, ipc_type_t ipc_type)
+{
+    void *src = dst_th->msg.msg;
+    void *dst = src_th->msg.msg;
+    if (ipc_type.type)
+    {
+        ipc_msg_t *src_ipc;
+        ipc_msg_t *dst_ipc;
 
-static int ipc_send(ipc_t *ipc, entry_frame_t *f)
+        src_ipc = src;
+        dst_ipc = dst;
+
+        if (ipc_type.map_buf_len > 0)
+        {
+            int map_len = ipc_type.map_buf_len;
+            task_t *src_tk = thread_get_bind_task(src_th);
+            task_t *dst_tk = thread_get_bind_task(dst_th);
+            for (int i = 0; i < map_len; i++)
+            {
+                obj_map_src_dst(&dst_tk->obj_space, &src_tk->obj_space,
+                                dst_ipc->map_buf[i], src_ipc->map_buf[i], dst_tk->lim);
+            }
+        }
+        memcpy(dst_ipc->msg_buf, src_ipc->msg_buf, MIN(ipc_type.msg_buf_len, IPC_MSG_SIZE));
+    }
+    else
+    {
+        memcpy(src, dst, len);
+    }
+}
+
+static int ipc_send(ipc_t *ipc, entry_frame_t *f, msg_tag_t tag)
 {
     umword_t status;
     size_t send_len_c = -1;
     umword_t send_flag = f->r[2];
+    ipc_type_t ipc_ide = ipc_type_create(tag.type2);
     thread_t *th = thread_get_current();
     void *send_addr = th->msg.msg;
-    th->msg.len = f->r[1];
 
+    th->msg.len = f->r[1];
+    th->msg.ipc_ide = ipc_ide.raw;
 again_send:
     if (!ipc->rcv)
     {
@@ -115,7 +149,8 @@ again_send:
                 send_len_c = MIN(THREAD_MSG_BUG_LEN, th->msg.len);
 
                 // 接收线程正在等待中，直接复制数据到目标缓存中，然后唤醒目标线程
-                memcpy(ipc->rcv->msg.msg, th->msg.msg, send_len_c); //!< 拷贝数据
+                // memcpy(ipc->rcv->msg.msg, th->msg.msg, send_len_c);
+                ipc_data_copy(ipc->rcv, th, send_len_c, ipc_type_create(tag.type2)); //!< 拷贝数据
                 ipc->rcv->msg.flags |= MSG_BUF_HAS_DATA_FLAGS;
                 ipc->rcv->msg.len = send_len_c;
                 thread_ready(ipc->rcv, TRUE); //!< 直接唤醒接受者
@@ -138,7 +173,7 @@ again_send:
         return send_len_c;
     }
 }
-static int ipc_recv(ipc_t *ipc, entry_frame_t *f)
+static int ipc_recv(ipc_t *ipc, entry_frame_t *f, msg_tag_t tag)
 {
     umword_t recv_flags = f->r[1];
     thread_t *th = thread_get_current();
@@ -191,7 +226,7 @@ again_recv:
         }
         if (find == 0)
         {
-            thread_sched(); // TODO:
+            thread_sched(); // TODO:应该挂起，并等待唤醒
             spinlock_set(&ipc->lock, status);
             goto again_recv;
         }
@@ -206,7 +241,8 @@ again_recv:
     }
 
     recv_len_c = MIN(THREAD_MSG_BUG_LEN, send_th->msg.len);
-    memcpy(recv_addr, send_th->msg.msg, recv_len_c); //!< 拷贝数据
+    // memcpy(recv_addr, send_th->msg.msg, recv_len_c);
+    ipc_data_copy(th, send_th, recv_len_c, ipc_type_create(send_th->msg.ipc_ide)); //!< 拷贝数据
     send_th->msg.flags |= MSG_BUF_HAS_DATA_FLAGS;
     send_th->msg.len = recv_len_c;
     send_th->msg.recv_th = th; //!< 设置消息发送给了谁
@@ -223,32 +259,33 @@ again_recv:
  * @param f
  * @return msg_tag_t
  */
-static msg_tag_t ipc_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
+static void ipc_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f)
 {
     assert(kobj);
     assert(f);
-    msg_tag_t tag = msg_tag_init(f->r[0]);
+    msg_tag_t tag = msg_tag_init3(0, 0, -EINVAL);
     thread_t *th = thread_get_current();
     ipc_t *ipc = container_of(kobj, ipc_t, kobj);
 
-    if (tag.prot != IPC_PROT)
+    if (sys_p.prot != IPC_PROT)
     {
-        return msg_tag_init3(0, 0, -EPROTO);
+        f->r[0] = msg_tag_init3(0, 0, -EPROTO).raw;
+        return;
     }
-    switch (tag.type)
+    switch (sys_p.op)
     {
     case IPC_SEND:
     {
-        return msg_tag_init3(0, 0, ipc_send(ipc, f));
+        tag = msg_tag_init3(0, 0, ipc_send(ipc, f, in_tag));
     }
     break;
     case IPC_REVC:
     {
-        return msg_tag_init3(0, 0, ipc_recv(ipc, f));
+        tag = msg_tag_init3(0, 0, ipc_recv(ipc, f, in_tag));
     }
     break;
     }
-    return msg_tag_init3(0, 0, -ENOSYS);
+    f->r[0] = tag.raw;
 }
 static void ipc_release_stage1(kobject_t *kobj)
 {
diff --git a/mkrtos_knl/knl/log.c b/mkrtos_knl/knl/log.c
index 618bb9af2..5cbeeb087 100755
--- a/mkrtos_knl/knl/log.c
+++ b/mkrtos_knl/knl/log.c
@@ -13,6 +13,8 @@
 #include "globals.h"
 #include "init.h"
 #include "printk.h"
+#include "types.h"
+#include "util.h"
 static log_t log;
 
 enum log_op
@@ -21,8 +23,7 @@ enum log_op
     READ_DATA,
     SET_FLAGS
 };
-static msg_tag_t
-log_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f);
+static void log_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f);
 
 static void log_reg(void)
 {
@@ -39,19 +40,21 @@ static msg_tag_t log_write_data(log_t *log, const char *data, int len)
     }
     return msg_tag_init(0);
 }
-static msg_tag_t
-log_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
+static void
+log_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f)
 {
-    msg_tag_t tag = msg_tag_init(f->r[0]);
-
-    if (tag.prot != LOG_PROT)
+    msg_tag_t tag = msg_tag_init3(0, 0, -EINVAL);
+    if (sys_p.prot != LOG_PROT)
     {
-        return msg_tag_init3(0, 0, -EPROTO);
+        f->r[0] = msg_tag_init3(0, 0, -EPROTO).raw;
+        return;
     }
-    switch (tag.type)
+    switch (sys_p.op)
     {
     case WRITE_DATA:
-        tag = log_write_data((log_t *)kobj, (const char *)(&f->r[1]), tag.type2);
+        tag = log_write_data(
+            (log_t *)kobj, (const char *)(&f->r[1]),
+            MIN(ipc_type_create(in_tag.type2).msg_buf_len, WORD_BYTES * 5));
         break;
     case READ_DATA:
         printk("don't support read data.\n");
@@ -63,8 +66,8 @@ log_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
         tag = msg_tag_init3(0, 0, -ENOSYS);
         break;
     }
-
-    return tag;
+    f->r[0] = tag.raw;
+    return;
 }
 
 void log_dump(void)
diff --git a/mkrtos_knl/knl/map.c b/mkrtos_knl/knl/map.c
index 1826e394b..fb12facdf 100755
--- a/mkrtos_knl/knl/map.c
+++ b/mkrtos_knl/knl/map.c
@@ -16,6 +16,18 @@ bool_t obj_map_root(kobject_t *kobj, obj_space_t *obj_space, ram_limit_t *ram, o
     slist_add(&kobj->mappable.node, &map->node);
     return TRUE;
 }
+int obj_map_src_dst(obj_space_t *dst_space, obj_space_t *src_space,
+                    obj_handler_t dst_inx, obj_handler_t src_inx,
+                    ram_limit_t *ram)
+{
+    kobject_t *source_kobj = obj_space_lookup_kobj(src_space, src_inx);
+
+    if (!source_kobj)
+    {
+        return -ENOENT;
+    }
+    return obj_map(dst_space, dst_inx, source_kobj, ram);
+}
 int obj_map(obj_space_t *obj_space, obj_handler_t inx, kobject_t *insert_kobj, ram_limit_t *ram)
 {
     obj_map_entry_t *entry = NULL;
diff --git a/mkrtos_knl/knl/mm.c b/mkrtos_knl/knl/mm.c
index 3a16e9109..fae60b139 100755
--- a/mkrtos_knl/knl/mm.c
+++ b/mkrtos_knl/knl/mm.c
@@ -59,7 +59,6 @@ void mem_free(mem_t *_this, void *mem)
     // #endif
     umword_t status = spinlock_lock(&_this->lock);
     m_mem = (struct mem_heap *)((ptr_t)mem - MEM_HEAP_STRUCT_SIZE);
-    // knl_check_user_ram_access_exit(m_mem, sizeof(struct mem_heap), 1, _this->blong_user);
     assert(m_mem->magic == MAGIC_NUM);
     if (!m_mem->used)
     {
@@ -86,7 +85,6 @@ void *mem_split(mem_t *_this, void *mem, uint32_t size)
     }
     umword_t status = spinlock_lock(&_this->lock);
     t_mem = (struct mem_heap *)((ptr_t)mem - MEM_HEAP_STRUCT_SIZE);
-    // knl_check_user_ram_access_exit(t_mem, sizeof(struct mem_heap), 1, _this->blong_user);
     if (t_mem->used == 0 || t_mem->size < MEM_HEAP_STRUCT_SIZE || t_mem->size < size || size < MEM_HEAP_STRUCT_SIZE)
     {
         spinlock_set(&_this->lock, status);
@@ -94,7 +92,6 @@ void *mem_split(mem_t *_this, void *mem, uint32_t size)
     }
 
     r_mem = (struct mem_heap *)((ptr_t)t_mem + size);
-    // knl_check_user_ram_access_exit(r_mem, sizeof(struct mem_heap), 1, _this->blong_user);
     r_mem->used = 1;
     r_mem->size = t_mem->size - size;
     r_mem->next = t_mem->next;
@@ -152,7 +149,6 @@ again_alloc:
             mem_free(_this, split_addr);
             goto again_alloc;
         }
-        // assert(((struct mem_heap *)(split_addr - MEM_HEAP_STRUCT_SIZE))->size >= size);
         return split_addr;
     }
 
@@ -169,7 +165,6 @@ void mem_free_align(mem_t *_this, void *f_mem)
     umword_t status = spinlock_lock(&_this->lock);
     for (mem = _this->heap_start; mem != _this->heap_end; mem = mem->next)
     {
-        // knl_check_user_ram_access_exit(mem, sizeof(struct mem_heap), 1, _this->blong_user);
         assert(mem->magic == MAGIC_NUM);
         if ((ptr_t)mem == (ptr_t)f_mem - MEM_HEAP_STRUCT_SIZE)
         {
@@ -204,7 +199,6 @@ void *mem_alloc(mem_t *_this, uint32_t size)
     umword_t status = spinlock_lock(&_this->lock);
     for (mem = _this->l_heap; mem != _this->heap_end; mem = mem->next)
     {
-        // knl_check_user_ram_access_exit(mem, sizeof(struct mem_heap), 1, _this->blong_user);
         assert(mem->magic == MAGIC_NUM);
         if (mem->used == 0 && mem->size > size)
         {
@@ -212,7 +206,6 @@ void *mem_alloc(mem_t *_this, uint32_t size)
             {
                 struct mem_heap *mem_temp = NULL;
                 mem_temp = (struct mem_heap *)((ptr_t)mem + MEM_HEAP_STRUCT_SIZE + size);
-                // knl_check_user_ram_access_exit(mem_temp, sizeof(struct mem_heap), 1, _this->blong_user);
                 mem_temp->next = mem->next;
                 mem_temp->prev = mem;
                 mem_temp->used = 0;
@@ -296,7 +289,6 @@ size_t mem_get_free_size(mem_t *_this)
     umword_t status = spinlock_lock(&_this->lock);
     for (mem = _this->heap_start; mem != _this->heap_end; mem = mem->next)
     {
-        // knl_check_user_ram_access_exit(mem, sizeof(struct mem_heap), 1, _this->blong_user);
         assert(mem->magic == MAGIC_NUM);
         if (!mem->used)
         {
diff --git a/mkrtos_knl/knl/mm_man.c b/mkrtos_knl/knl/mm_man.c
index a1af47a6b..728be152d 100644
--- a/mkrtos_knl/knl/mm_man.c
+++ b/mkrtos_knl/knl/mm_man.c
@@ -2,6 +2,7 @@
 #include "kobject.h"
 #include "init.h"
 #include "mm_page.h"
+#include "thread.h"
 #include "task.h"
 #include "globals.h"
 typedef struct mm_man
@@ -10,8 +11,7 @@ typedef struct mm_man
 } mm_man_t;
 static mm_man_t mm_man;
 
-static msg_tag_t
-mm_man_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f);
+static void mm_man_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f);
 
 static void mm_man_reg(void)
 {
@@ -28,17 +28,17 @@ enum mm_op
     MM_MOD_ATTRS,
 };
 
-static msg_tag_t
-mm_man_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
+static void mm_man_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f)
 {
     task_t *cur_task = thread_get_current_task();
-    msg_tag_t tag = msg_tag_init(f->r[0]);
+    msg_tag_t tag = msg_tag_init3(0, 0, -EINVAL);
 
-    if (tag.prot != MM_PROT)
+    if (sys_p.prot != MM_PROT)
     {
-        return msg_tag_init3(0, 0, -EPROTO);
+        f->r[0] = msg_tag_init3(0, 0, -EPROTO).raw;
+        return;
     }
-    switch (tag.type)
+    switch (sys_p.op)
     {
     case MM_ALLOC:
     {
@@ -70,7 +70,7 @@ mm_man_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
         tag = msg_tag_init3(0, 0, -ENOSYS);
         break;
     }
-    return tag;
+    f->r[0] = tag.raw;
 }
 void mm_man_dump(void)
 {
diff --git a/mkrtos_knl/knl/syscall.c b/mkrtos_knl/knl/syscall.c
index 9af7c0021..55a0c7394 100644
--- a/mkrtos_knl/knl/syscall.c
+++ b/mkrtos_knl/knl/syscall.c
@@ -11,32 +11,26 @@ void syscall_entry(entry_frame_t entry)
     msg_tag_t tag = msg_tag_init3(0, 0, -1);
     thread_t *th = thread_get_current();
     task_t *tk = thread_get_current_task();
+    syscall_prot_t sys_p = syscall_prot_create_raw(entry.r[7]);
 
-    obj_map_entry_t *entry_obj =
-        obj_space_lookup(&tk->obj_space, entry.r[7]);
+    kobject_t *kobj =
+        obj_space_lookup_kobj(&tk->obj_space, sys_p.obj_inx);
 
-    if (!entry_obj)
+    if (!kobj)
     {
-        tag = msg_tag_init3(0, 0, -ENOENT);
+        entry.r[0] = msg_tag_init3(0, 0, -ENOENT).raw;
         goto end;
     }
-    if (!entry_obj->obj)
-    {
-        tag = msg_tag_init3(0, 0, -ENOENT);
-        goto end;
-    }
-    kobject_t *kobj = obj_map_kobj_get(entry_obj->obj);
 
     if (kobj->invoke_func)
     {
-        tag = kobj->invoke_func(kobj, NULL, &entry);
+        kobj->invoke_func(kobj, sys_p, msg_tag_init(entry.r[0]), &entry);
     }
-end:
-    ;
+end:;
     addr_t u_sp = arch_get_user_sp();
     pf_s_t *pf_a = (pf_s_t *)u_sp;
 
-    pf_a->rg0[0] = tag.raw;
+    // pf_a->rg0[0] = tag.raw;
     pf_a->rg0[1] = entry.r[1];
     pf_a->rg0[2] = entry.r[2];
     pf_a->rg0[3] = entry.r[3];
diff --git a/mkrtos_knl/knl/task.c b/mkrtos_knl/knl/task.c
index 3e3927854..c3ec9f957 100755
--- a/mkrtos_knl/knl/task.c
+++ b/mkrtos_knl/knl/task.c
@@ -23,41 +23,45 @@ int task_alloc_base_ram(task_t *tk, ram_limit_t *lim, size_t size)
         return -EACCES;
     }
     // 申请init的ram内存
-    void *ram = mpu_ram_alloc(&tk->mm_space, lim, size);
+    void *ram = mpu_ram_alloc(&tk->mm_space, lim, size + THREAD_MSG_BUG_LEN);
     if (!ram)
     {
         printk("申请进程内存失败.\n");
         return -ENOMEM;
     }
-    mm_space_set_ram_block(&tk->mm_space, ram, size);
-    printk("task alloc size is %d, base is 0x%x\n", size, ram);
+    mm_space_set_ram_block(&tk->mm_space, ram, size + THREAD_MSG_BUG_LEN);
+    printk("task alloc size is %d, base is 0x%x\n", size + THREAD_MSG_BUG_LEN, ram);
     return 0;
 }
-
-static msg_tag_t task_syscall_func(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
+task_t *thread_get_bind_task(thread_t *th)
+{
+    return container_of(th->task, task_t, kobj);
+}
+static void task_syscall_func(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f)
 {
     task_t *cur_task = thread_get_current_task();
     task_t *tag_task = container_of(kobj, task_t, kobj);
-    msg_tag_t tag = msg_tag_init(f->r[0]);
+    msg_tag_t tag = msg_tag_init3(0, 0, -EINVAL);
 
-    if (tag.prot != TASK_PROT)
+    if (sys_p.prot != TASK_PROT)
     {
-        return msg_tag_init3(0, 0, -EINVAL);
+        f->r[0] = msg_tag_init3(0, 0, -EINVAL).raw;
+        return;
     }
 
-    switch (tag.type)
+    switch (sys_p.op)
     {
     case TASK_OBJ_MAP:
     {
         kobject_t *source_kobj = obj_space_lookup_kobj(&cur_task->obj_space, f->r[1]);
 
-        if (!kobj)
+        if (!source_kobj)
         {
             tag = msg_tag_init3(0, 0, -ENOENT);
             break;
         }
 
-        int ret = obj_map(&tag_task->obj_space, f->r[2], source_kobj, ram);
+        int ret = obj_map(&tag_task->obj_space, f->r[2], source_kobj, tag_task->lim);
 
         tag = msg_tag_init3(0, 0, ret);
     }
@@ -89,7 +93,7 @@ static msg_tag_t task_syscall_func(kobject_t *kobj, ram_limit_t *ram, entry_fram
         }
         int ret = task_alloc_base_ram(tag_task, tag_task->lim, f->r[1]);
         tag = msg_tag_init3(0, 0, ret);
-         f->r[1] = (umword_t)(tag_task->mm_space.mm_block);
+        f->r[1] = (umword_t)(tag_task->mm_space.mm_block);
         spinlock_set(&tag_task->kobj.lock, status);
     }
     break;
@@ -97,7 +101,7 @@ static msg_tag_t task_syscall_func(kobject_t *kobj, ram_limit_t *ram, entry_fram
         break;
     }
 
-    return tag;
+    f->r[0] = tag.raw;
 }
 
 void task_init(task_t *task, ram_limit_t *ram, int is_knl)
diff --git a/mkrtos_knl/knl/thread.c b/mkrtos_knl/knl/thread.c
index b3653d682..eb6e85433 100755
--- a/mkrtos_knl/knl/thread.c
+++ b/mkrtos_knl/knl/thread.c
@@ -20,9 +20,8 @@
 #include "slist.h"
 #include "thread_armv7m.h"
 #include "assert.h"
-
-static msg_tag_t
-thread_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f);
+#include "err.h"
+static void thread_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f);
 static bool_t thread_put(kobject_t *kobj);
 static void thread_release_stage1(kobject_t *kobj);
 static void thread_release_stage2(kobject_t *kobj);
@@ -180,20 +179,20 @@ enum thread_op
     MSG_BUG_GET,
     MSG_BUG_SET,
 };
-static msg_tag_t
-thread_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
+static void thread_syscall(kobject_t *kobj, syscall_prot_t sys_p, msg_tag_t in_tag, entry_frame_t *f)
 {
-    msg_tag_t tag = msg_tag_init(f->r[0]);
+    msg_tag_t tag = msg_tag_init3(0, 0, -EINVAL);
     task_t *task = thread_get_current_task();
     thread_t *tag_th = container_of(kobj, thread_t, kobj);
     thread_t *cur_th = thread_get_current();
 
-    if (tag.prot != THREAD_PROT)
+    if (sys_p.prot != THREAD_PROT)
     {
-        return msg_tag_init3(0, 0, -EPROTO);
+        f->r[0] = msg_tag_init3(0, 0, -EPROTO).raw;
+        return;
     }
 
-    switch (tag.type)
+    switch (sys_p.op)
     {
     case SET_EXEC_REGS:
     {
@@ -233,15 +232,15 @@ thread_syscall(kobject_t *kobj, ram_limit_t *ram, entry_frame_t *f)
         kobject_t *task_kobj = obj_space_lookup_kobj(&task->obj_space, f->r[1]);
         if (task_kobj == NULL /*TODO:检测kobj类型*/)
         {
-            tag = msg_tag_init3(0, 0, -ENOENT);
-            return tag;
+            f->r[0] = msg_tag_init3(0, 0, -ENOENT).raw;
+            return ;
         }
         thread_bind(tag_th, task_kobj);
         printk("thread bind to %d\n", f->r[7], f->r[1]);
     }
     break;
     }
-    return tag;
+    f->r[0] = tag.raw;
 }
 
 /**
diff --git a/mkrtos_user/lib/sys/inc/u_prot.h b/mkrtos_user/lib/sys/inc/u_prot.h
index 2dd3b2d65..b6a0a7e28 100644
--- a/mkrtos_user/lib/sys/inc/u_prot.h
+++ b/mkrtos_user/lib/sys/inc/u_prot.h
@@ -12,26 +12,78 @@
 #define THREAD_MAIN THREAD_PROT
 #define TASK_THIS TASK_PROT
 
-typedef struct msg_tag
+enum msg_type
+{
+    MSG_NONE_TYPE = 0,
+    MSG_DEF_TYPE = 1,
+};
+
+typedef union ipc_type
 {
     union
     {
-        umword_t raw;
+        uint8_t raw;
         struct
         {
-            umword_t type : 4;
-            umword_t type2 : 8;
-            umword_t prot : (sizeof(umword_t) * 8) - 12;
+            uint8_t type : 1;
+            uint8_t msg_buf_len : 5;
+            uint8_t map_buf_len : 2;
         };
     };
+} ipc_type_t;
+
+static inline ipc_type_t ipc_type_create(uint8_t raw)
+{
+    return (ipc_type_t){.raw = raw};
+}
+
+static inline ipc_type_t ipc_type_create_3(
+    enum msg_type type, uint8_t msg_buf_len, uint8_t map_buf_len)
+{
+    return (ipc_type_t){
+        .type = (uint8_t)type,
+        .msg_buf_len = msg_buf_len,
+        .map_buf_len = map_buf_len,
+    };
+}
+
+typedef union msg_tag
+{
+    umword_t raw;
+    struct
+    {
+        umword_t type : 4;
+        umword_t type2 : 8;
+        umword_t prot : WORD_BITS - 12;
+    };
 } msg_tag_t;
 
 #define msg_tag_init(r) \
     ((msg_tag_t){.raw = (r)})
 
-#define msg_tag_init3(t, t2, p) \
-    msg_tag_init(((umword_t)(t)&0xf) | (((umword_t)(t2)&0xff) << 4) | (((umword_t)(p)) << 12))
-
+#define msg_tag_init3(t, t2, p) ((msg_tag_t){ \
+    .type = t,                                \
+    .type2 = t2,                              \
+    .prot = p})
 #define msg_tag_get_prot(tag) \
     ((int16_t)((tag).prot))
 
+typedef union syscall_prot
+{
+    umword_t raw;
+    struct
+    {
+        umword_t op : 6;                     //!< 操作的op
+        umword_t prot : 6;                   //!< 通信的类型
+        umword_t obj_inx : (WORD_BITS - 12); //!<
+    };
+} syscall_prot_t;
+
+static inline syscall_prot_t syscall_prot_create(uint8_t op, uint8_t prot, obj_handler_t obj_inx)
+{
+    return (syscall_prot_t){
+        .op = op,
+        .prot = prot,
+        .obj_inx = obj_inx,
+    };
+}
diff --git a/mkrtos_user/lib/sys/inc/u_util.h b/mkrtos_user/lib/sys/inc/u_util.h
index 98cae5fe8..0c6592556 100644
--- a/mkrtos_user/lib/sys/inc/u_util.h
+++ b/mkrtos_user/lib/sys/inc/u_util.h
@@ -6,4 +6,7 @@
 #define ABS(a) ((a) < 0 ? -(a) : (a))                              //!< 取绝对值
 #define MIN(a, b) ((a) < (b) ? (a) : (b))                          //!< 最小值
 #define ALIGN(mem, align) (((mem) + ((align)-1)) & (~((align)-1))) //!< 向上对齐
-#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof(arr[0]))             //!< 获取数组大小
\ No newline at end of file
+#define ARRAY_SIZE(arr) (sizeof(arr) / sizeof(arr[0]))             //!< 获取数组大小
+#define ROUND(a, b) (((a) / (b)) + (((a) % (b)) ? 1 : 0))          //!< a/b后的值向上取整
+#define ROUND_UP(a, b) ROUND(a, b)                                 //!< a除b向上取整数
+#define ROUND_DOWN(a, b) ((a) / (b))                               //!< a/b向下取整
\ No newline at end of file
diff --git a/mkrtos_user/lib/sys/src/u_factory.c b/mkrtos_user/lib/sys/src/u_factory.c
index 28aee370f..ed0ed5e86 100644
--- a/mkrtos_user/lib/sys/src/u_factory.c
+++ b/mkrtos_user/lib/sys/src/u_factory.c
@@ -1,11 +1,18 @@
 #include "u_types.h"
 #include "u_prot.h"
 #include "u_factory.h"
+
+enum
+{
+    FACTORY_CREATE_KOBJ
+};
+
 msg_tag_t factory_create_thread(obj_handler_t obj, obj_handler_t tgt_obj_handler)
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(obj, msg_tag_init3(0, 2, FACTORY_PROT).raw,
+    syscall(syscall_prot_create(FACTORY_CREATE_KOBJ, FACTORY_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 2, 0).raw, FACTORY_PROT).raw,
             THREAD_PROT,
             tgt_obj_handler,
             0,
@@ -19,7 +26,8 @@ msg_tag_t factory_create_task(obj_handler_t obj, obj_handler_t tgt_obj_handler)
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(obj, msg_tag_init3(0, 2, FACTORY_PROT).raw,
+    syscall(syscall_prot_create(FACTORY_CREATE_KOBJ, FACTORY_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 2, 0).raw, FACTORY_PROT).raw,
             TASK_PROT,
             tgt_obj_handler,
             0,
@@ -33,7 +41,8 @@ msg_tag_t factory_create_ipc(obj_handler_t obj, obj_handler_t tgt_obj_handler)
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(obj, msg_tag_init3(0, 2, FACTORY_PROT).raw,
+    syscall(syscall_prot_create(FACTORY_CREATE_KOBJ, FACTORY_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 2, 0).raw, FACTORY_PROT).raw,
             IPC_PROT,
             tgt_obj_handler,
             0,
diff --git a/mkrtos_user/lib/sys/src/u_ipc.c b/mkrtos_user/lib/sys/src/u_ipc.c
index f3a6dc380..88c938315 100644
--- a/mkrtos_user/lib/sys/src/u_ipc.c
+++ b/mkrtos_user/lib/sys/src/u_ipc.c
@@ -10,7 +10,8 @@ msg_tag_t ipc_recv(obj_handler_t obj, umword_t flags)
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(obj, msg_tag_init3(IPC_REVC, 1, IPC_PROT).raw,
+    syscall(syscall_prot_create(IPC_REVC, IPC_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 1, 0).raw, IPC_PROT).raw,
             flags,
             0,
             0,
@@ -24,7 +25,8 @@ msg_tag_t ipc_send(obj_handler_t obj, umword_t len, umword_t flags)
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(obj, msg_tag_init3(IPC_SEND, 2, IPC_PROT).raw,
+    syscall(syscall_prot_create(IPC_SEND, IPC_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 2, 0).raw, IPC_PROT).raw,
             len,
             flags,
             0,
diff --git a/mkrtos_user/lib/sys/src/u_log.c b/mkrtos_user/lib/sys/src/u_log.c
index 73764afd4..7696b0679 100644
--- a/mkrtos_user/lib/sys/src/u_log.c
+++ b/mkrtos_user/lib/sys/src/u_log.c
@@ -3,11 +3,17 @@
 #include "u_log.h"
 #include "u_prot.h"
 #include "u_types.h"
+#include "u_util.h"
 #include <string.h>
-
+enum log_op
+{
+    WRITE_DATA,
+    READ_DATA,
+    SET_FLAGS
+};
 void ulog_write_bytes(obj_handler_t obj_inx, const uint8_t *data, umword_t len)
 {
-    uint8_t write_buf[ULOG_RW_MAX_BYTES];
+    uint8_t write_buf[ULOG_RW_MAX_BYTES] = {0};
     umword_t j = 0;
     int i = 0;
 
@@ -20,7 +26,8 @@ void ulog_write_bytes(obj_handler_t obj_inx, const uint8_t *data, umword_t len)
         if (i > 0)
         {
             umword_t *write_word_buf = (umword_t *)write_buf;
-            syscall(obj_inx, msg_tag_init3(0, i, LOG_PROT).raw,
+            syscall(syscall_prot_create(WRITE_DATA, LOG_PROT, obj_inx),
+                    msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, i, 0).raw, LOG_PROT).raw,
                     write_word_buf[0],
                     write_word_buf[1],
                     write_word_buf[2],
@@ -39,5 +46,5 @@ void ulog_write_str(obj_handler_t obj_inx, const char *str)
     size_t i;
     for (i = 0; str[i]; i++)
         ;
-    ulog_write_bytes(obj_inx, (uint8_t *)str, i);
+    ulog_write_bytes(obj_inx, (uint8_t *)str, i + 1);
 }
diff --git a/mkrtos_user/lib/sys/src/u_mm.c b/mkrtos_user/lib/sys/src/u_mm.c
index 6c6caac18..eaeb3025c 100644
--- a/mkrtos_user/lib/sys/src/u_mm.c
+++ b/mkrtos_user/lib/sys/src/u_mm.c
@@ -15,7 +15,8 @@ void *mm_alloc_page(obj_handler_t obj_inx, umword_t pnf_nr, uint8_t attrs)
     register volatile umword_t r1 asm("r1");
     register volatile umword_t r2 asm("r2");
     register volatile umword_t r3 asm("r3");
-    syscall(obj_inx, msg_tag_init3(MM_ALLOC, 1, MM_PROT).raw,
+    syscall(syscall_prot_create(MM_ALLOC, MM_PROT, obj_inx),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 2, 0).raw, MM_PROT).raw,
             pnf_nr,
             attrs,
             0,
@@ -34,7 +35,8 @@ void *mm_alloc_page(obj_handler_t obj_inx, umword_t pnf_nr, uint8_t attrs)
 }
 void mm_free_page(obj_handler_t obj_inx, void *addr, umword_t pfn_nr)
 {
-    syscall(obj_inx, msg_tag_init3(MM_FREE, 1, MM_PROT).raw,
+    syscall(syscall_prot_create(MM_FREE, MM_PROT, obj_inx),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 2, 0).raw, MM_PROT).raw,
             addr,
             pfn_nr,
             0,
diff --git a/mkrtos_user/lib/sys/src/u_task.c b/mkrtos_user/lib/sys/src/u_task.c
index 72eb6ba98..f0d064e29 100644
--- a/mkrtos_user/lib/sys/src/u_task.c
+++ b/mkrtos_user/lib/sys/src/u_task.c
@@ -12,7 +12,8 @@ msg_tag_t task_map(obj_handler_t dst_task, obj_handler_t src_obj, obj_handler_t
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(dst_task, msg_tag_init3(TASK_OBJ_MAP, 2, TASK_PROT).raw,
+    syscall(syscall_prot_create(TASK_OBJ_MAP, TASK_PROT, dst_task),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 2, 0).raw, TASK_PROT).raw,
             src_obj,
             dst_obj,
             0,
@@ -27,7 +28,8 @@ msg_tag_t task_unmap(obj_handler_t task_han, obj_handler_t obj)
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(task_han, msg_tag_init3(TASK_OBJ_UNMAP, 1, TASK_PROT).raw,
+    syscall(syscall_prot_create(TASK_OBJ_UNMAP, TASK_PROT, task_han),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 1, 0).raw, TASK_PROT).raw,
             obj,
             0,
             0,
@@ -42,7 +44,8 @@ msg_tag_t task_alloc_ram_base(obj_handler_t task_han, umword_t size, addr_t *all
     register volatile umword_t r0 asm("r0");
     register volatile umword_t r1 asm("r1");
 
-    syscall(task_han, msg_tag_init3(TASK_ALLOC_RAM_BASE, 1, TASK_PROT).raw,
+    syscall(syscall_prot_create(TASK_ALLOC_RAM_BASE, TASK_PROT, task_han),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 1, 0).raw, TASK_PROT).raw,
             size,
             0,
             0,
diff --git a/mkrtos_user/lib/sys/src/u_thread.c b/mkrtos_user/lib/sys/src/u_thread.c
index 9249a1f78..47d225501 100644
--- a/mkrtos_user/lib/sys/src/u_thread.c
+++ b/mkrtos_user/lib/sys/src/u_thread.c
@@ -15,7 +15,8 @@ msg_tag_t thread_msg_buf_set(obj_handler_t obj, void *msg)
     register volatile umword_t r1 asm("r1");
     register volatile umword_t r2 asm("r2");
 
-    syscall(obj, msg_tag_init3(MSG_BUG_SET, 0, THREAD_PROT).raw,
+    syscall(syscall_prot_create(MSG_BUG_SET, THREAD_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 1, 0).raw, THREAD_PROT).raw,
             msg,
             0,
             0,
@@ -29,7 +30,8 @@ msg_tag_t thread_msg_buf_get(obj_handler_t obj, umword_t *msg, umword_t *len)
     register volatile umword_t r1 asm("r1");
     register volatile umword_t r2 asm("r2");
 
-    syscall(obj, msg_tag_init3(MSG_BUG_GET, 0, THREAD_PROT).raw,
+    syscall(syscall_prot_create(MSG_BUG_GET, THREAD_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 0, 0).raw, THREAD_PROT).raw,
             0,
             0,
             0,
@@ -50,7 +52,8 @@ msg_tag_t thread_exec_regs(obj_handler_t obj, umword_t pc, umword_t sp, umword_t
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(obj, msg_tag_init3(SET_EXEC_REGS, 3, THREAD_PROT).raw,
+    syscall(syscall_prot_create(SET_EXEC_REGS, THREAD_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 3, 0).raw, THREAD_PROT).raw,
             pc,
             sp,
             ram,
@@ -63,7 +66,8 @@ msg_tag_t thread_run(obj_handler_t obj)
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(obj, msg_tag_init3(RUN_THREAD, 1, THREAD_PROT).raw,
+    syscall(syscall_prot_create(RUN_THREAD, THREAD_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 0, 0).raw, THREAD_PROT).raw,
             0,
             0,
             0,
@@ -77,7 +81,8 @@ msg_tag_t thread_bind_task(obj_handler_t obj, obj_handler_t tk_obj)
 {
     register volatile umword_t r0 asm("r0");
 
-    syscall(obj, msg_tag_init3(BIND_TASK, 1, THREAD_PROT).raw,
+    syscall(syscall_prot_create(BIND_TASK, THREAD_PROT, obj),
+            msg_tag_init3(0, ipc_type_create_3(MSG_NONE_TYPE, 1, 0).raw, THREAD_PROT).raw,
             tk_obj,
             0,
             0,
diff --git a/mkrtos_user/server/init/src/test/app_test.c b/mkrtos_user/server/init/src/test/app_test.c
index e44186d18..fec865a8b 100644
--- a/mkrtos_user/server/init/src/test/app_test.c
+++ b/mkrtos_user/server/init/src/test/app_test.c
@@ -52,6 +52,8 @@ void app_test(void)
     assert(msg_tag_get_prot(tag) >= 0);
     tag = thread_bind_task(hd_thread, hd_task);
     assert(msg_tag_get_prot(tag) >= 0);
+    tag = thread_msg_buf_set(hd_thread, ram_base + app->i.ram_size);
+    assert(msg_tag_get_prot(tag) >= 0);
     tag = thread_run(hd_thread);
     assert(msg_tag_get_prot(tag) >= 0);
 
diff --git a/mkrtos_user/server/shell/src/main.c b/mkrtos_user/server/shell/src/main.c
index 0d224b8c2..7ba042dd5 100644
--- a/mkrtos_user/server/shell/src/main.c
+++ b/mkrtos_user/server/shell/src/main.c
@@ -8,12 +8,10 @@
 #include "u_ipc.h"
 #include <assert.h>
 #include <stdio.h>
-static uint8_t msg_buf[MSG_BUG_LEN];
 int main(int argc, char *args[])
 {
     // printf("shell>\n");
     ulog_write_str(LOG_PROT, "MKRTOS:\n");
-    thread_msg_buf_set(THREAD_MAIN, msg_buf);
     ipc_recv(12, 0);
     char *buf;
     umword_t len;