[rt-smart] testcase & improvements for memory management (#7099)

* [utest/mm] add testcase for create/init
format codes of create/init in components/mm

* [libcpu/aarch64] fix user stack check routine

* [kservice] export API for utest

* [utest/mm] testcase for aspace_map
format & modify the files under components/mm related with aspace_map

* [lwp/user_mm] add user_map_varea for mmap feature

* [mm] rename rt_mm_fault_try_fix to rt_aspace_fault_try_fix

* [utest/mm] testcase for synchronization

* [mm] modify unmap api to improve throughput

* [utest/mm] testcases for cache and varea map

* [format] remove extra space

* [utest/mm] fix testcase problem in header

* [lwp] extend map_user_varea with a flag

* [utest/mm] testcase for lwp_map_user_varea

* [libcpu/arm/cortex-a] fix kernel space layout

* [utest/mm] adjust for armv7 arch

14 files changed, 510 insertions, 216 deletions

diff --git a/components/lwp/lwp_shm.c b/components/lwp/lwp_shm.c
index 51964dd2b8..f2bacf1b13 100644
--- a/components/lwp/lwp_shm.c
+++ b/components/lwp/lwp_shm.c
@@ -56,13 +56,24 @@ static void on_shm_varea_close(struct rt_varea *varea)
     shm->ref -= 1;
 }
 
-static void on_shm_page_fault(struct rt_varea *varea, struct rt_mm_fault_msg *msg)
+static void on_shm_page_fault(struct rt_varea *varea, struct rt_aspace_fault_msg *msg)
 {
     struct lwp_shm_struct *shm;
+    int err;
     shm = rt_container_of(varea->mem_obj, struct lwp_shm_struct, mem_obj);
-    msg->response.status = MM_FAULT_STATUS_OK;
-    msg->response.vaddr = (void *)shm->addr;
-    msg->response.size = shm->size;
+
+    /* map all share page frames to user space in a time */
+    void *page = (void *)shm->addr;
+    void *pg_paddr = page + PV_OFFSET;
+    err = rt_varea_map_range(varea, varea->start, pg_paddr, shm->size);
+
+    if (err == RT_EOK)
+    {
+        msg->response.status = MM_FAULT_STATUS_OK_MAPPED;
+        msg->response.size = shm->size;
+        msg->response.vaddr = page;
+    }
+
     return ;
 }
 
@@ -383,7 +394,7 @@ int _lwp_shmdt(void *shm_vaddr)
         return -1;
     }
 
-    ret = rt_aspace_unmap(lwp->aspace, shm_vaddr, 1);
+    ret = rt_aspace_unmap(lwp->aspace, shm_vaddr);
     if (ret != RT_EOK)
     {
         ret = -1;
diff --git a/components/lwp/lwp_user_mm.c b/components/lwp/lwp_user_mm.c
index 57dfb5338b..09cc47dd2b 100644
--- a/components/lwp/lwp_user_mm.c
+++ b/components/lwp/lwp_user_mm.c
@@ -108,15 +108,18 @@ static const char *user_get_name(rt_varea_t varea)
     return name;
 }
 
+#define NO_AUTO_FETCH               0x1
+#define VAREA_CAN_AUTO_FETCH(varea) (!((rt_ubase_t)((varea)->data) & NO_AUTO_FETCH))
+
 static void _user_do_page_fault(struct rt_varea *varea,
-                                struct rt_mm_fault_msg *msg)
+                                struct rt_aspace_fault_msg *msg)
 {
     struct rt_lwp_objs *lwp_objs;
     lwp_objs = rt_container_of(varea->mem_obj, struct rt_lwp_objs, mem_obj);
 
     if (lwp_objs->source)
     {
-        void *paddr = rt_hw_mmu_v2p(lwp_objs->source, msg->vaddr);
+        void *paddr = rt_hw_mmu_v2p(lwp_objs->source, msg->fault_vaddr);
         if (paddr != ARCH_MAP_FAILED)
         {
             void *vaddr;
@@ -128,7 +131,7 @@ static void _user_do_page_fault(struct rt_varea *varea,
                 if (cp)
                 {
                     memcpy(cp, vaddr, ARCH_PAGE_SIZE);
-                    rt_varea_insert_page(varea, cp);
+                    rt_varea_pgmgr_insert(varea, cp);
                     msg->response.status = MM_FAULT_STATUS_OK;
                     msg->response.vaddr = cp;
                     msg->response.size = ARCH_PAGE_SIZE;
@@ -143,7 +146,7 @@ static void _user_do_page_fault(struct rt_varea *varea,
             {
                 rt_page_t page = rt_page_addr2page(vaddr);
                 page->ref_cnt += 1;
-                rt_varea_insert_page(varea, vaddr);
+                rt_varea_pgmgr_insert(varea, vaddr);
                 msg->response.status = MM_FAULT_STATUS_OK;
                 msg->response.vaddr = vaddr;
                 msg->response.size = ARCH_PAGE_SIZE;
@@ -155,14 +158,20 @@ static void _user_do_page_fault(struct rt_varea *varea,
             rt_mm_dummy_mapper.on_page_fault(varea, msg);
         }
     }
-    else /* if (!lwp_objs->source), no aspace as source data */
+    else if (VAREA_CAN_AUTO_FETCH(varea))
     {
+        /* if (!lwp_objs->source), no aspace as source data */
         rt_mm_dummy_mapper.on_page_fault(varea, msg);
     }
 }
 
 static void _init_lwp_objs(struct rt_lwp_objs *lwp_objs, rt_aspace_t aspace)
 {
+    /**
+     * @brief one lwp_obj represent an base layout of page based memory in user space
+     * This is useful on duplication. Where we only have a (lwp_objs and offset) to
+     * provide identical memory. This is implemented by lwp_objs->source.
+     */
     lwp_objs->source = NULL;
     lwp_objs->mem_obj.get_name = user_get_name;
     lwp_objs->mem_obj.hint_free = NULL;
@@ -198,7 +207,7 @@ static void *_lwp_map_user(struct rt_lwp *lwp, void *map_va, size_t map_size,
 int lwp_unmap_user(struct rt_lwp *lwp, void *va)
 {
     int err;
-    err = rt_aspace_unmap(lwp->aspace, va, 1);
+    err = rt_aspace_unmap(lwp->aspace, va);
     return err;
 }
 
@@ -324,6 +333,93 @@ void *lwp_map_user(struct rt_lwp *lwp, void *map_va, size_t map_size, int text)
     return ret;
 }
 
+static inline size_t _flags_to_attr(size_t flags)
+{
+    size_t attr;
+
+    if (flags & LWP_MAP_FLAG_NOCACHE)
+    {
+        attr = MMU_MAP_U_RW;
+    }
+    else
+    {
+        attr = MMU_MAP_U_RWCB;
+    }
+
+    return attr;
+}
+
+static inline mm_flag_t _flags_to_aspace_flag(size_t flags)
+{
+    mm_flag_t mm_flag = 0;
+
+    return mm_flag;
+}
+
+static rt_varea_t _lwp_map_user_varea(struct rt_lwp *lwp, void *map_va, size_t map_size, size_t flags)
+{
+    void *va = map_va;
+    int ret = 0;
+    rt_mem_obj_t mem_obj = &lwp->lwp_obj->mem_obj;
+    rt_varea_t varea;
+    mm_flag_t mm_flags;
+    size_t attr;
+
+    varea = rt_malloc(sizeof(*varea));
+    if (varea)
+    {
+        attr = _flags_to_attr(flags);
+        mm_flags = _flags_to_aspace_flag(flags);
+        ret = rt_aspace_map_static(lwp->aspace, varea, &va, map_size,
+                                   attr, mm_flags, mem_obj, 0);
+        /* let aspace handle the free of varea */
+        varea->flag &= ~MMF_STATIC_ALLOC;
+        /* don't apply auto fetch on this */
+        varea->data = (void *)NO_AUTO_FETCH;
+    }
+    else
+    {
+        ret = -RT_ENOMEM;
+    }
+
+    if (ret != RT_EOK)
+    {
+        LOG_I("lwp_map_user: failed to map %lx with size %lx with errno %d", map_va,
+              map_size, ret);
+    }
+
+    return varea;
+}
+
+static rt_varea_t _map_user_varea_ext(struct rt_lwp *lwp, void *map_va, size_t map_size, size_t flags)
+{
+    rt_varea_t varea = RT_NULL;
+    size_t offset = 0;
+
+    if (!map_size)
+    {
+        return 0;
+    }
+    offset = (size_t)map_va & ARCH_PAGE_MASK;
+    map_size += (offset + ARCH_PAGE_SIZE - 1);
+    map_size &= ~ARCH_PAGE_MASK;
+    map_va = (void *)((size_t)map_va & ~ARCH_PAGE_MASK);
+
+    varea = _lwp_map_user_varea(lwp, map_va, map_size, flags);
+
+    return varea;
+}
+
+rt_varea_t lwp_map_user_varea_ext(struct rt_lwp *lwp, void *map_va, size_t map_size, size_t flags)
+{
+    return _map_user_varea_ext(lwp, map_va, map_size, flags);
+}
+
+rt_varea_t lwp_map_user_varea(struct rt_lwp *lwp, void *map_va, size_t map_size)
+{
+    return _map_user_varea_ext(lwp, map_va, map_size, LWP_MAP_FLAG_NONE);
+}
+
 void *lwp_map_user_phy(struct rt_lwp *lwp, void *map_va, void *map_pa,
                        size_t map_size, int cached)
 {
diff --git a/components/lwp/lwp_user_mm.h b/components/lwp/lwp_user_mm.h
index c057f23b88..d2c6681e29 100644
--- a/components/lwp/lwp_user_mm.h
+++ b/components/lwp/lwp_user_mm.h
@@ -25,12 +25,19 @@
 extern "C" {
 #endif
 
+#define LWP_MAP_FLAG_NONE       0x0000
+#define LWP_MAP_FLAG_NOCACHE    0x0001
+
 int lwp_user_space_init(struct rt_lwp *lwp, rt_bool_t is_fork);
 void lwp_unmap_user_space(struct rt_lwp *lwp);
 
 int lwp_unmap_user(struct rt_lwp *lwp, void *va);
 void *lwp_map_user(struct rt_lwp *lwp, void *map_va, size_t map_size, rt_bool_t text);
 
+rt_varea_t lwp_map_user_varea(struct rt_lwp *lwp, void *map_va, size_t map_size);
+/* check LWP_MAP_FLAG_* */
+rt_varea_t lwp_map_user_varea_ext(struct rt_lwp *lwp, void *map_va, size_t map_size, size_t flags);
+
 void *lwp_map_user_phy(struct rt_lwp *lwp, void *map_va, void *map_pa, size_t map_size, rt_bool_t cached);
 int lwp_unmap_user_phy(struct rt_lwp *lwp, void *va);
 
diff --git a/components/mm/avl_adpt.c b/components/mm/avl_adpt.c
index f89f667685..22e4ff8330 100644
--- a/components/mm/avl_adpt.c
+++ b/components/mm/avl_adpt.c
@@ -117,6 +117,7 @@ rt_varea_t _aspace_bst_search_exceed(struct rt_aspace *aspace, void *start)
 
         if (cmp < 0)
         {
+            /* varae exceed start */
             ptrdiff_t off = va_s - start;
             if (off < min_off)
             {
@@ -127,6 +128,7 @@ rt_varea_t _aspace_bst_search_exceed(struct rt_aspace *aspace, void *start)
         }
         else if (cmp > 0)
         {
+            /* find the next huger varea */
             node = node->avl_right;
         }
         else
diff --git a/components/mm/ioremap.c b/components/mm/ioremap.c
index f72a8b9354..93dd695d1c 100644
--- a/components/mm/ioremap.c
+++ b/components/mm/ioremap.c
@@ -98,7 +98,7 @@ void *rt_ioremap_cached(void *paddr, size_t size)
 
 void rt_iounmap(volatile void *vaddr)
 {
-    rt_aspace_unmap(&rt_kernel_space, (void *)vaddr, 1);
+    rt_aspace_unmap(&rt_kernel_space, (void *)vaddr);
 }
 
 #else
diff --git a/components/mm/mm_aspace.c b/components/mm/mm_aspace.c
index e171af15d5..558fc2b065 100644
--- a/components/mm/mm_aspace.c
+++ b/components/mm/mm_aspace.c
@@ -31,122 +31,100 @@
 #include <mmu.h>
 #include <tlb.h>
 
-static void _aspace_unmap(rt_aspace_t aspace, void *addr, rt_size_t length);
 static void *_find_free(rt_aspace_t aspace, void *prefer, rt_size_t req_size,
                         void *limit_start, rt_size_t limit_size,
                         mm_flag_t flags);
+static void _varea_uninstall(rt_varea_t varea);
 
 struct rt_aspace rt_kernel_space;
 
-rt_varea_t _varea_create(void *start, rt_size_t size)
-{
-    rt_varea_t varea;
-    varea = (rt_varea_t)rt_malloc(sizeof(struct rt_varea));
-    if (varea)
-    {
-        varea->start = start;
-        varea->size = size;
-    }
-    return varea;
-}
-
-static inline void _varea_post_install(rt_varea_t varea, rt_aspace_t aspace,
-                                       rt_size_t attr, rt_size_t flags,
-                                       rt_mem_obj_t mem_obj, rt_size_t offset)
+int _init_lock(rt_aspace_t aspace)
 {
-    varea->aspace = aspace;
-    varea->attr = attr;
-    varea->mem_obj = mem_obj;
-    varea->flag = flags;
-    varea->offset = offset;
-    varea->frames = NULL;
+    int err;
+    MM_PGTBL_LOCK_INIT(aspace);
+    err = rt_mutex_init(&aspace->bst_lock, "aspace", RT_IPC_FLAG_FIFO);
 
-    if (varea->mem_obj && varea->mem_obj->on_varea_open)
-        varea->mem_obj->on_varea_open(varea);
+    return err;
 }
 
-/* restore context modified by varea install */
-static inline void _varea_uninstall(rt_varea_t varea)
+rt_err_t rt_aspace_init(rt_aspace_t aspace, void *start, rt_size_t length, void *pgtbl)
 {
-    rt_aspace_t aspace = varea->aspace;
-
-    if (varea->mem_obj && varea->mem_obj->on_varea_close)
-        varea->mem_obj->on_varea_close(varea);
-
-    rt_varea_free_pages(varea);
-
-    rt_hw_mmu_unmap(aspace, varea->start, varea->size);
-    rt_hw_tlb_invalidate_range(aspace, varea->start, varea->size, ARCH_PAGE_SIZE);
+    int err = RT_EOK;
 
-    WR_LOCK(aspace);
-    _aspace_bst_remove(aspace, varea);
-    WR_UNLOCK(aspace);
-}
+    if (pgtbl)
+    {
+        aspace->page_table = pgtbl;
+        aspace->start = start;
+        aspace->size = length;
 
-int _init_lock(rt_aspace_t aspace)
-{
-    MM_PGTBL_LOCK_INIT(aspace);
-    rt_mutex_init(&aspace->bst_lock, "", RT_IPC_FLAG_FIFO);
+        err = _aspace_bst_init(aspace);
+        if (err == RT_EOK)
+        {
+            /**
+             * It has the side effect that lock will be added to object
+             * system management. So it must be paired with a detach once
+             * the initialization return successfully.
+             */
+            err = _init_lock(aspace);
+        }
+    }
+    else
+    {
+        err = -RT_EINVAL;
+    }
 
-    return RT_EOK;
+    return err;
 }
 
 rt_aspace_t rt_aspace_create(void *start, rt_size_t length, void *pgtbl)
 {
     rt_aspace_t aspace = NULL;
-    void *page_table = pgtbl;
+    int err;
 
-    if (page_table)
+    RT_ASSERT(length <= 0 - (rt_size_t)start);
+    aspace = (rt_aspace_t)rt_malloc(sizeof(*aspace));
+    if (aspace)
     {
-        aspace = (rt_aspace_t)rt_malloc(sizeof(*aspace));
-        if (aspace)
+        rt_memset(aspace, 0, sizeof(*aspace));
+
+        err = rt_aspace_init(aspace, start, length, pgtbl);
+
+        if (err != RT_EOK)
         {
-            aspace->page_table = page_table;
-            aspace->start = start;
-            aspace->size = length;
-            if (_init_lock(aspace) != RT_EOK ||
-                _aspace_bst_init(aspace) != RT_EOK)
-            {
-                rt_free(aspace);
-                aspace = NULL;
-            }
+            LOG_W("%s(%p, %lx, %p): failed with code %d\n", __func__,
+                start, length, pgtbl, err);
+            rt_free(aspace);
+            aspace = RT_NULL;
         }
     }
     return aspace;
 }
 
-rt_aspace_t rt_aspace_init(rt_aspace_t aspace, void *start, rt_size_t length,
-                           void *pgtbl)
+void rt_aspace_detach(rt_aspace_t aspace)
 {
-    void *page_table = pgtbl;
-    LOG_D("%s", __func__);
-
-    if (page_table)
+    WR_LOCK(aspace);
+    rt_varea_t varea = ASPACE_VAREA_FIRST(aspace);
+    while (varea)
     {
-        aspace->page_table = page_table;
-        aspace->start = start;
-        aspace->size = length;
-        if (_init_lock(aspace) != RT_EOK || _aspace_bst_init(aspace) != RT_EOK)
+        rt_varea_t prev = varea;
+        _varea_uninstall(varea);
+
+        varea = ASPACE_VAREA_NEXT(varea);
+        if (!(prev->flag & MMF_STATIC_ALLOC))
         {
-            aspace = NULL;
+            rt_free(prev);
         }
     }
-    return aspace;
-}
+    WR_UNLOCK(aspace);
 
-void rt_aspace_detach(rt_aspace_t aspace)
-{
-    _aspace_unmap(aspace, aspace->start, aspace->size);
     rt_mutex_detach(&aspace->bst_lock);
 }
 
 void rt_aspace_delete(rt_aspace_t aspace)
 {
-    if (aspace)
-    {
-        rt_aspace_detach(aspace);
-        rt_free(aspace);
-    }
+    RT_ASSERT(aspace);
+    rt_aspace_detach(aspace);
+    rt_free(aspace);
 }
 
 static int _do_named_map(rt_aspace_t aspace, void *vaddr, rt_size_t length,
@@ -178,19 +156,75 @@ static int _do_named_map(rt_aspace_t aspace, void *vaddr, rt_size_t length,
     return err;
 }
 
-rt_inline void _do_page_fault(struct rt_mm_fault_msg *msg, rt_size_t off,
+rt_inline void _do_page_fault(struct rt_aspace_fault_msg *msg, rt_size_t off,
                               void *vaddr, rt_mem_obj_t mem_obj,
                               rt_varea_t varea)
 {
     msg->off = off;
-    msg->vaddr = vaddr;
+    msg->fault_vaddr = vaddr;
     msg->fault_op = MM_FAULT_OP_READ;
     msg->fault_type = MM_FAULT_TYPE_PAGE_FAULT;
     msg->response.status = -1;
+    msg->response.vaddr = 0;
+    msg->response.size = 0;
 
     mem_obj->on_page_fault(varea, msg);
 }
 
+int _varea_map_with_msg(rt_varea_t varea, struct rt_aspace_fault_msg *msg)
+{
+    int err = -RT_ERROR;
+    if (msg->response.status == MM_FAULT_STATUS_OK)
+    {
+        /**
+         * the page returned by handler is not checked
+         * cause no much assumption can make on it
+         */
+        void *store = msg->response.vaddr;
+        rt_size_t store_sz = msg->response.size;
+        if (msg->fault_vaddr + store_sz > varea->start + varea->size)
+        {
+            LOG_W("%s: too much (0x%lx) of buffer on vaddr %p is provided",
+                    __func__, store_sz, msg->fault_vaddr);
+        }
+        else
+        {
+            void *map;
+            void *v_addr = msg->fault_vaddr;
+            void *p_addr = store + PV_OFFSET;
+            map = rt_hw_mmu_map(varea->aspace, v_addr, p_addr, store_sz, varea->attr);
+
+            if (!map)
+            {
+                LOG_W("%s: MMU mapping failed for va %p to %p of %lx", __func__,
+                    msg->fault_vaddr, store + PV_OFFSET, store_sz);
+            }
+            else
+            {
+                rt_hw_tlb_invalidate_range(varea->aspace, v_addr, store_sz, ARCH_PAGE_SIZE);
+                err = RT_EOK;
+            }
+        }
+    }
+    else if (msg->response.status == MM_FAULT_STATUS_OK_MAPPED)
+    {
+        if (rt_hw_mmu_v2p(varea->aspace, msg->fault_vaddr) == ARCH_MAP_FAILED)
+        {
+            LOG_W("%s: no page is mapped on %p", __func__, msg->fault_vaddr);
+        }
+        else
+        {
+            err = RT_EOK;
+        }
+    }
+    else
+    {
+        LOG_W("%s: failed on va %p inside varea %p(%s)", __func__, msg->fault_vaddr, varea,
+            varea->mem_obj->get_name ? varea->mem_obj->get_name(varea) : "unknow");
+    }
+    return err;
+}
+
 /* allocate memory page for mapping range */
 static int _do_prefetch(rt_aspace_t aspace, rt_varea_t varea, void *start,
                         rt_size_t size)
@@ -205,48 +239,28 @@ static int _do_prefetch(rt_aspace_t aspace, rt_varea_t varea, void *start,
     while (vaddr != end)
     {
         /* TODO try to map with huge TLB, when flag & HUGEPAGE */
-        struct rt_mm_fault_msg msg;
+        struct rt_aspace_fault_msg msg;
         _do_page_fault(&msg, off, vaddr, varea->mem_obj, varea);
 
-        if (msg.response.status == MM_FAULT_STATUS_OK)
-        {
-            void *store = msg.response.vaddr;
-            rt_size_t store_sz = msg.response.size;
-
-            if (store_sz + vaddr > end)
-            {
-                LOG_W("%s: too much (0x%lx) of buffer at vaddr %p is provided",
-                      __func__, store_sz, vaddr);
-                break;
-            }
-
-            void *map = rt_hw_mmu_map(aspace, vaddr, store + PV_OFFSET,
-                                      store_sz, varea->attr);
+        if (_varea_map_with_msg(varea, &msg))
+            break;
 
-            if (!map)
-            {
-                LOG_W("%s: MMU mapping failed for va %p to %p of %lx", __func__,
-                      vaddr, store + PV_OFFSET, store_sz);
-            }
-            else
-            {
-                rt_hw_tlb_invalidate_range(aspace, vaddr, store_sz, ARCH_PAGE_SIZE);
-            }
-            vaddr += store_sz;
-            off += store_sz >> ARCH_PAGE_SHIFT;
-        }
-        else
-        {
-            err = -RT_ENOMEM;
-            LOG_W("%s failed because no memory is provided", __func__);
+        /**
+         * It's hard to identify the mapping pattern on a customized handler
+         * So we terminate the prefetch process on that case
+         */
+        if (msg.response.status == MM_FAULT_STATUS_OK_MAPPED)
             break;
-        }
+
+        vaddr += msg.response.size;
+        off += msg.response.size >> ARCH_PAGE_SHIFT;
     }
 
     return err;
 }
 
-int _varea_install(rt_aspace_t aspace, rt_varea_t varea, rt_mm_va_hint_t hint)
+/* caller must hold the aspace lock */
+static int _varea_install(rt_aspace_t aspace, rt_varea_t varea, rt_mm_va_hint_t hint)
 {
     void *alloc_va;
     int err = RT_EOK;
@@ -274,6 +288,42 @@ int _varea_install(rt_aspace_t aspace, rt_varea_t varea, rt_mm_va_hint_t hint)
     return err;
 }
 
+static inline void _varea_post_install(rt_varea_t varea, rt_aspace_t aspace,
+                                       rt_size_t attr, rt_size_t flags,
+                                       rt_mem_obj_t mem_obj, rt_size_t offset)
+{
+    varea->aspace = aspace;
+    varea->attr = attr;
+    varea->mem_obj = mem_obj;
+    varea->flag = flags;
+    varea->offset = offset;
+    varea->frames = NULL;
+
+    if (varea->mem_obj && varea->mem_obj->on_varea_open)
+        varea->mem_obj->on_varea_open(varea);
+}
+
+/**
+ * restore context modified by varea install
+ * caller must NOT hold the aspace lock
+ */
+static void _varea_uninstall(rt_varea_t varea)
+{
+    rt_aspace_t aspace = varea->aspace;
+
+    if (varea->mem_obj && varea->mem_obj->on_varea_close)
+        varea->mem_obj->on_varea_close(varea);
+
+    rt_hw_mmu_unmap(aspace, varea->start, varea->size);
+    rt_hw_tlb_invalidate_range(aspace, varea->start, varea->size, ARCH_PAGE_SIZE);
+
+    rt_varea_pgmgr_pop_all(varea);
+
+    WR_LOCK(aspace);
+    _aspace_bst_remove(aspace, varea);
+    WR_UNLOCK(aspace);
+}
+
 static int _mm_aspace_map(rt_aspace_t aspace, rt_varea_t varea, rt_size_t attr,
                           mm_flag_t flags, rt_mem_obj_t mem_obj,
                           rt_size_t offset)
@@ -281,6 +331,12 @@ static int _mm_aspace_map(rt_aspace_t aspace, rt_varea_t varea, rt_size_t attr,
     int err = RT_EOK;
 
     WR_LOCK(aspace);
+
+    /**
+     * @brief .prefer & .map_size are scratched from varea which setup by caller
+     * .limit_start & .limit_range_size have default to be in range of aspace
+     * .flags is from parameter, and will be fill in varea if install successfully
+     */
     struct rt_mm_va_hint hint = {.prefer = varea->start,
                                  .map_size = varea->size,
                                  .limit_start = aspace->start,
@@ -293,6 +349,7 @@ static int _mm_aspace_map(rt_aspace_t aspace, rt_varea_t varea, rt_size_t attr,
         mem_obj->hint_free(&hint);
     }
 
+    /* try to allocate a virtual address region for varea */
     err = _varea_install(aspace, varea, &hint);
     WR_UNLOCK(aspace);
 
@@ -316,6 +373,18 @@ static int _mm_aspace_map(rt_aspace_t aspace, rt_varea_t varea, rt_size_t attr,
     return err;
 }
 
+rt_varea_t _varea_create(void *start, rt_size_t size)
+{
+    rt_varea_t varea;
+    varea = (rt_varea_t)rt_malloc(sizeof(struct rt_varea));
+    if (varea)
+    {
+        varea->start = start;
+        varea->size = size;
+    }
+    return varea;
+}
+
 #define _IS_OVERFLOW(start, length) ((length) > (0ul - (uintptr_t)(start)))
 #define _IS_OVERSIZE(start, length, limit_s, limit_sz) (((length) + (rt_size_t)((start) - (limit_start))) > (limit_size))
 
@@ -339,7 +408,8 @@ static inline int _not_align(void *start, rt_size_t length, rt_size_t mask)
 
 static inline int _not_support(rt_size_t flags)
 {
-    rt_size_t support_ops = (MMF_PREFETCH | MMF_MAP_FIXED | MMF_TEXT);
+    rt_size_t support_ops = (MMF_PREFETCH | MMF_MAP_FIXED | MMF_TEXT |
+        MMF_STATIC_ALLOC | MMF_REQUEST_ALIGN);
     return flags & ~(support_ops | _MMF_ALIGN_MASK);
 }
 
@@ -351,19 +421,25 @@ int rt_aspace_map(rt_aspace_t aspace, void **addr, rt_size_t length,
     int err;
     rt_varea_t varea;
 
-    if (!aspace || !addr || !mem_obj || length == 0 ||
-        _not_in_range(*addr, length, aspace->start, aspace->size))
+    if (!aspace || !addr || !mem_obj || length == 0)
     {
         err = -RT_EINVAL;
-        LOG_I("%s: Invalid input", __func__);
+        LOG_I("%s(%p, %p, %lx, %lx, %lx, %p, %lx): Invalid input",
+            __func__, aspace, addr, length, attr, flags, mem_obj, offset);
+    }
+    else if (_not_in_range(*addr, length, aspace->start, aspace->size))
+    {
+        err = -RT_EINVAL;
+        LOG_I("%s(addr:%p, len:%lx): out of range", __func__, *addr, length);
     }
     else if (_not_support(flags))
     {
-        LOG_I("%s: no support flags 0x%p", __func__, flags);
+        LOG_I("%s: no support flags 0x%lx", __func__, flags);
         err = -RT_ENOSYS;
     }
     else
     {
+        /* allocate the varea and fill in start and size */
         varea = _varea_create(*addr, length);
 
         if (varea)
@@ -376,7 +452,7 @@ int rt_aspace_map(rt_aspace_t aspace, void **addr, rt_size_t length,
         }
         else
         {
-            LOG_W("%s: mm aspace map failed", __func__);
+            LOG_W("%s: memory allocation failed", __func__);
             err = -RT_ENOMEM;
         }
     }
@@ -461,7 +537,7 @@ int _mm_aspace_map_phy(rt_aspace_t aspace, rt_varea_t varea,
 
         if (err == RT_EOK)
         {
-            _varea_post_install(varea, aspace, attr, 0, NULL, pa_off);
+            _varea_post_install(varea, aspace, attr, hint->flags, NULL, pa_off);
 
             vaddr = varea->start;
 
@@ -537,28 +613,25 @@ int rt_aspace_map_phy_static(rt_aspace_t aspace, rt_varea_t varea,
     return err;
 }
 
-void _aspace_unmap(rt_aspace_t aspace, void *addr, rt_size_t length)
+void _aspace_unmap(rt_aspace_t aspace, void *addr)
 {
-    struct _mm_range range = {addr, addr + length - 1};
-    rt_varea_t varea = _aspace_bst_search_overlap(aspace, range);
+    WR_LOCK(aspace);
+    rt_varea_t varea = _aspace_bst_search(aspace, addr);
+    WR_UNLOCK(aspace);
 
     if (varea == RT_NULL)
     {
-        LOG_I("%s: No such entry found at %p with %lx bytes\n", __func__, addr, length);
+        LOG_I("%s: No such entry found at %p\n", __func__, addr);
     }
 
-    while (varea)
+    _varea_uninstall(varea);
+    if (!(varea->flag & MMF_STATIC_ALLOC))
     {
-        _varea_uninstall(varea);
-        if (!(varea->flag & MMF_STATIC_ALLOC))
-        {
-            rt_free(varea);
-        }
-        varea = _aspace_bst_search_overlap(aspace, range);
+        rt_free(varea);
     }
 }
 
-int rt_aspace_unmap(rt_aspace_t aspace, void *addr, rt_size_t length)
+int rt_aspace_unmap(rt_aspace_t aspace, void *addr)
 {
     if (!aspace)
     {
@@ -566,14 +639,14 @@ int rt_aspace_unmap(rt_aspace_t aspace, void *addr, rt_size_t length)
         return -RT_EINVAL;
     }
 
-    if (_not_in_range(addr, length, aspace->start, aspace->size))
+    if (_not_in_range(addr, 1, aspace->start, aspace->size))
     {
         LOG_I("%s: %lx not in range of aspace[%lx:%lx]", __func__, addr,
               aspace->start, aspace->start + aspace->size);
         return -RT_EINVAL;
     }
 
-    _aspace_unmap(aspace, addr, length);
+    _aspace_unmap(aspace, addr);
 
     return RT_EOK;
 }
@@ -659,9 +732,8 @@ static void *_find_head_and_asc_search(rt_aspace_t aspace, rt_size_t req_size,
     {
         void *candidate;
         rt_size_t gap_size;
-        rt_varea_t former = _aspace_bst_search(aspace, limit.start);
 
-        candidate = former ? former->start + former->size : limit.start;
+        candidate = limit.start;
         candidate = _align(candidate, align_mask);
         gap_size = limit.end - candidate + 1;
 
@@ -688,6 +760,7 @@ static void *_find_free(rt_aspace_t aspace, void *prefer, rt_size_t req_size,
 
     if (prefer != RT_NULL)
     {
+        /* if prefer and free, just return the prefer region */
         prefer = _align(prefer, align_mask);
         struct _mm_range range = {prefer, prefer + req_size - 1};
         varea = _aspace_bst_search_overlap(aspace, range);
@@ -702,9 +775,11 @@ static void *_find_free(rt_aspace_t aspace, void *prefer, rt_size_t req_size,
         }
         else
         {
+            /* search from `varea` in ascending order */
             va = _ascending_search(varea, req_size, align_mask, limit);
             if (va == RT_NULL)
             {
+                /* rewind to first range */
                 limit.end = varea->start - 1;
                 va = _find_head_and_asc_search(aspace, req_size, align_mask,
                                                limit);
@@ -722,9 +797,13 @@ static void *_find_free(rt_aspace_t aspace, void *prefer, rt_size_t req_size,
 int rt_aspace_load_page(rt_aspace_t aspace, void *addr, rt_size_t npage)
 {
     int err = RT_EOK;
-    rt_varea_t varea = _aspace_bst_search(aspace, addr);
+    rt_varea_t varea;
     void *end = addr + (npage << ARCH_PAGE_SHIFT);
 
+    WR_LOCK(aspace);
+    varea = _aspace_bst_search(aspace, addr);
+    WR_UNLOCK(aspace);
+
     if (!varea)
     {
         LOG_W("%s: varea not exist", __func__);
@@ -744,18 +823,92 @@ int rt_aspace_load_page(rt_aspace_t aspace, void *addr, rt_size_t npage)
     return err;
 }
 
+int rt_varea_map_page(rt_varea_t varea, void *vaddr, void *page)
+{
+    int err = RT_EOK;
+    void *page_pa = rt_kmem_v2p(page);
+
+    if (!varea || !vaddr || !page)
+    {
+        LOG_W("%s(%p,%p,%p): invalid input", __func__, varea, vaddr, page);
+        err = -RT_EINVAL;
+    }
+    else if (page_pa == ARCH_MAP_FAILED)
+    {
+        LOG_W("%s: page is not in kernel space", __func__);
+        err = -RT_ERROR;
+    }
+    else if (_not_in_range(vaddr, ARCH_PAGE_SIZE, varea->start, varea->size))
+    {
+        LOG_W("%s(%p,%lx): not in range of varea(%p,%lx)", __func__,
+            vaddr, ARCH_PAGE_SIZE, varea->start, varea->size);
+        err = -RT_EINVAL;
+    }
+    else
+    {
+        err = _do_named_map(
+            varea->aspace,
+            vaddr,
+            ARCH_PAGE_SIZE,
+            MM_PA_TO_OFF(page_pa),
+            varea->attr
+        );
+    }
+
+    return err;
+}
+
+#define ALIGNED(addr) (!((rt_size_t)(addr) & ARCH_PAGE_MASK))
+
+int rt_varea_map_range(rt_varea_t varea, void *vaddr, void *paddr, rt_size_t length)
+{
+    int err;
+    if (!varea || !vaddr || !paddr || !length ||
+        !ALIGNED(vaddr) || !ALIGNED(paddr) || !(ALIGNED(length)))
+    {
+        LOG_W("%s(%p,%p,%p,%lx): invalid input", __func__, varea, vaddr, paddr, length);
+        err = -RT_EINVAL;
+    }
+    else if (_not_in_range(vaddr, length, varea->start, varea->size))
+    {
+        LOG_W("%s(%p,%lx): not in range of varea(%p,%lx)", __func__,
+            vaddr, length, varea->start, varea->size);
+        err = -RT_EINVAL;
+    }
+    else
+    {
+        err = _do_named_map(
+            varea->aspace,
+            vaddr,
+            length,
+            MM_PA_TO_OFF(paddr),
+            varea->attr
+        );
+    }
+    return err;
+}
+
 int rt_aspace_offload_page(rt_aspace_t aspace, void *addr, rt_size_t npage)
 {
     return -RT_ENOSYS;
 }
 
-int mm_aspace_control(rt_aspace_t aspace, void *addr, enum rt_mmu_cntl cmd)
+int rt_aspace_control(rt_aspace_t aspace, void *addr, enum rt_mmu_cntl cmd)
 {
     int err;
-    rt_varea_t varea = _aspace_bst_search(aspace, addr);
+    rt_varea_t varea;
+
+    WR_LOCK(aspace);
+    varea = _aspace_bst_search(aspace, addr);
+    WR_UNLOCK(aspace);
+
     if (varea)
     {
         err = rt_hw_mmu_control(aspace, varea->start, varea->size, cmd);
+        if (err == RT_EOK)
+        {
+            rt_hw_tlb_invalidate_range(aspace, varea->start, varea->size, ARCH_PAGE_SIZE);
+        }
     }
     else
     {
@@ -768,12 +921,15 @@ int mm_aspace_control(rt_aspace_t aspace, void *addr, enum rt_mmu_cntl cmd)
 int rt_aspace_traversal(rt_aspace_t aspace,
                         int (*fn)(rt_varea_t varea, void *arg), void *arg)
 {
-    rt_varea_t varea = ASPACE_VAREA_FIRST(aspace);
+    rt_varea_t varea;
+    WR_LOCK(aspace);
+    varea = ASPACE_VAREA_FIRST(aspace);
     while (varea)
     {
         fn(varea, arg);
         varea = ASPACE_VAREA_NEXT(varea);
     }
+    WR_UNLOCK(aspace);
 
     return 0;
 }
diff --git a/components/mm/mm_aspace.h b/components/mm/mm_aspace.h
index 79986efe52..d7578abad9 100644
--- a/components/mm/mm_aspace.h
+++ b/components/mm/mm_aspace.h
@@ -90,7 +90,7 @@ typedef struct rt_mm_va_hint
 typedef struct rt_mem_obj
 {
     void (*hint_free)(rt_mm_va_hint_t hint);
-    void (*on_page_fault)(struct rt_varea *varea, struct rt_mm_fault_msg *msg);
+    void (*on_page_fault)(struct rt_varea *varea, struct rt_aspace_fault_msg *msg);
 
     /* do pre open bushiness like inc a ref */
     void (*on_varea_open)(struct rt_varea *varea);
@@ -127,8 +127,7 @@ enum rt_mmu_cntl
 
 rt_aspace_t rt_aspace_create(void *start, rt_size_t length, void *pgtbl);
 
-rt_aspace_t rt_aspace_init(rt_aspace_t aspace, void *start, rt_size_t length,
-                           void *pgtbl);
+rt_err_t rt_aspace_init(rt_aspace_t aspace, void *start, rt_size_t length, void *pgtbl);
 
 void rt_aspace_delete(rt_aspace_t aspace);
 
@@ -182,12 +181,11 @@ int rt_aspace_map_phy_static(rt_aspace_t aspace, rt_varea_t varea,
  *
  * @param aspace
  * @param addr
- * @param length
  * @return int
  */
-int rt_aspace_unmap(rt_aspace_t aspace, void *addr, rt_size_t length);
+int rt_aspace_unmap(rt_aspace_t aspace, void *addr);
 
-int mm_aspace_control(rt_aspace_t aspace, void *addr, enum rt_mmu_cntl cmd);
+int rt_aspace_control(rt_aspace_t aspace, void *addr, enum rt_mmu_cntl cmd);
 
 int rt_aspace_load_page(rt_aspace_t aspace, void *addr, rt_size_t npage);
 
@@ -198,11 +196,35 @@ int rt_aspace_traversal(rt_aspace_t aspace,
 
 void rt_aspace_print_all(rt_aspace_t aspace);
 
-void rt_varea_insert_page(rt_varea_t varea, void *page_addr);
+/**
+ * @brief Map one page to varea
+ *
+ * @param varea target varea
+ * @param addr user address
+ * @param page the page frame to be mapped
+ * @return int
+ */
+int rt_varea_map_page(rt_varea_t varea, void *vaddr, void *page);
 
-void rt_varea_free_pages(rt_varea_t varea);
+/**
+ * @brief Map a range of physical address to varea
+ *
+ * @param varea target varea
+ * @param vaddr user address
+ * @param paddr physical address
+ * @param length map range
+ * @return int
+ */
+int rt_varea_map_range(rt_varea_t varea, void *vaddr, void *paddr, rt_size_t length);
 
-void rt_varea_offload_page(rt_varea_t varea, void *vaddr, rt_size_t size);
+/**
+ * @brief Insert page to page manager of varea
+ * The page will be freed by varea on uninstall automatically
+ *
+ * @param varea target varea
+ * @param page_addr the page frame to be added
+ */
+void rt_varea_pgmgr_insert(rt_varea_t varea, void *page_addr);
 
 rt_ubase_t rt_kmem_pvoff(void);
 
@@ -212,4 +234,6 @@ int rt_kmem_map_phy(void *va, void *pa, rt_size_t length, rt_size_t attr);
 
 void *rt_kmem_v2p(void *vaddr);
 
+void rt_kmem_list(void);
+
 #endif /* __MM_ASPACE_H__ */
diff --git a/components/mm/mm_fault.c b/components/mm/mm_fault.c
index e36d39a93f..29b540f0f4 100644
--- a/components/mm/mm_fault.c
+++ b/components/mm/mm_fault.c
@@ -26,40 +26,28 @@
 #define UNRECOVERABLE 0
 #define RECOVERABLE   1
 
-static int _fetch_page(rt_varea_t varea, struct rt_mm_fault_msg *msg)
+static int _fetch_page(rt_varea_t varea, struct rt_aspace_fault_msg *msg)
 {
-    int err = UNRECOVERABLE;
+    int err;
+    msg->response.status = MM_FAULT_STATUS_UNRECOVERABLE;
+    msg->response.vaddr = 0;
+    msg->response.size = 0;
     if (varea->mem_obj && varea->mem_obj->on_page_fault)
     {
         varea->mem_obj->on_page_fault(varea, msg);
-        if (msg->response.status == MM_FAULT_STATUS_OK)
-        {
-            void *store = msg->response.vaddr;
-            rt_size_t store_sz = msg->response.size;
-
-            if (msg->vaddr + store_sz > varea->start + varea->size)
-            {
-                LOG_W("%s more size of buffer is provided than varea", __func__);
-            }
-            else
-            {
-                rt_hw_mmu_map(varea->aspace, msg->vaddr, store + PV_OFFSET,
-                            store_sz, varea->attr);
-                rt_hw_tlb_invalidate_range(varea->aspace, msg->vaddr, store_sz,
-                                        ARCH_PAGE_SIZE);
-                err = RECOVERABLE;
-            }
-        }
+        err = _varea_map_with_msg(varea, msg);
+        err = (err == RT_EOK ? RECOVERABLE : UNRECOVERABLE);
     }
     return err;
 }
 
-static int _read_fault(rt_varea_t varea, void *pa, struct rt_mm_fault_msg *msg)
+static int _read_fault(rt_varea_t varea, void *pa, struct rt_aspace_fault_msg *msg)
 {
     int err = UNRECOVERABLE;
     if (msg->fault_type == MM_FAULT_TYPE_PAGE_FAULT)
     {
         RT_ASSERT(pa == ARCH_MAP_FAILED);
+        RT_ASSERT(!(varea->flag & MMF_PREFETCH));
         err = _fetch_page(varea, msg);
     }
     else
@@ -69,12 +57,13 @@ static int _read_fault(rt_varea_t varea, void *pa, struct rt_mm_fault_msg *msg)
     return err;
 }
 
-static int _write_fault(rt_varea_t varea, void *pa, struct rt_mm_fault_msg *msg)
+static int _write_fault(rt_varea_t varea, void *pa, struct rt_aspace_fault_msg *msg)
 {
     int err = UNRECOVERABLE;
     if (msg->fault_type == MM_FAULT_TYPE_PAGE_FAULT)
     {
         RT_ASSERT(pa == ARCH_MAP_FAILED);
+        RT_ASSERT(!(varea->flag & MMF_PREFETCH));
         err = _fetch_page(varea, msg);
     }
     else if (msg->fault_type == MM_FAULT_TYPE_ACCESS_FAULT &&
@@ -88,33 +77,34 @@ static int _write_fault(rt_varea_t varea, void *pa, struct rt_mm_fault_msg *msg)
     return err;
 }
 
-static int _exec_fault(rt_varea_t varea, void *pa, struct rt_mm_fault_msg *msg)
+static int _exec_fault(rt_varea_t varea, void *pa, struct rt_aspace_fault_msg *msg)
 {
     int err = UNRECOVERABLE;
     if (msg->fault_type == MM_FAULT_TYPE_PAGE_FAULT)
     {
         RT_ASSERT(pa == ARCH_MAP_FAILED);
+        RT_ASSERT(!(varea->flag & MMF_PREFETCH));
         err = _fetch_page(varea, msg);
     }
     return err;
 }
 
-int rt_mm_fault_try_fix(struct rt_mm_fault_msg *msg)
+int rt_aspace_fault_try_fix(struct rt_aspace_fault_msg *msg)
 {
     struct rt_lwp *lwp = lwp_self();
     int err = UNRECOVERABLE;
-    uintptr_t va = (uintptr_t)msg->vaddr;
+    uintptr_t va = (uintptr_t)msg->fault_vaddr;
     va &= ~ARCH_PAGE_MASK;
-    msg->vaddr = (void *)va;
+    msg->fault_vaddr = (void *)va;
 
     if (lwp)
     {
         rt_aspace_t aspace = lwp->aspace;
-        rt_varea_t varea = _aspace_bst_search(aspace, msg->vaddr);
+        rt_varea_t varea = _aspace_bst_search(aspace, msg->fault_vaddr);
         if (varea)
         {
-            void *pa = rt_hw_mmu_v2p(aspace, msg->vaddr);
-            msg->off = (msg->vaddr - varea->start) >> ARCH_PAGE_SHIFT;
+            void *pa = rt_hw_mmu_v2p(aspace, msg->fault_vaddr);
+            msg->off = (msg->fault_vaddr - varea->start) >> ARCH_PAGE_SHIFT;
 
             /* permission checked by fault op */
             switch (msg->fault_op)
diff --git a/components/mm/mm_fault.h b/components/mm/mm_fault.h
index 17657f5200..fc34024431 100644
--- a/components/mm/mm_fault.h
+++ b/components/mm/mm_fault.h
@@ -14,8 +14,11 @@
 #include <stddef.h>
 #include <stdint.h>
 
-#define MM_FAULT_STATUS_OK            0
-#define MM_FAULT_STATUS_UNRECOVERABLE 1
+/* fast path fault handler, a page frame on kernel space is returned */
+#define MM_FAULT_STATUS_OK              0
+/* customized fault handler, done by using rt_varea_map_* */
+#define MM_FAULT_STATUS_OK_MAPPED       1
+#define MM_FAULT_STATUS_UNRECOVERABLE   4
 
 struct rt_mm_fault_res
 {
@@ -39,17 +42,17 @@ enum rt_mm_fault_type
     MM_FAULT_TYPE_GENERIC,
 };
 
-struct rt_mm_fault_msg
+struct rt_aspace_fault_msg
 {
     enum rt_mm_fault_op fault_op;
     enum rt_mm_fault_type fault_type;
     rt_size_t off;
-    void *vaddr;
+    void *fault_vaddr;
 
     struct rt_mm_fault_res response;
 };
 
 /* MMU base page fault handler, return 1 is */
-int rt_mm_fault_try_fix(struct rt_mm_fault_msg *msg);
+int rt_aspace_fault_try_fix(struct rt_aspace_fault_msg *msg);
 
 #endif /* __MM_FAULT_H__ */
diff --git a/components/mm/mm_flag.h b/components/mm/mm_flag.h
index 1d5130cc45..390332867f 100644
--- a/components/mm/mm_flag.h
+++ b/components/mm/mm_flag.h
@@ -82,9 +82,9 @@ enum mm_flag_cntl
  *
  * Direct use of flag is also acceptable: (MMF_MAP_FIXED | MMF_PREFETCH)
  */
-#define MMF_CREATE(cntl, align)                                                \
-    (align ? (MMF_SET_CNTL((mm_flag_t)0, (cntl) | MMF_REQUEST_ALIGN) |         \
-              MMF_SET_ALIGN((mm_flag_t)0, align))                              \
+#define MMF_CREATE(cntl, align)                                                 \
+    ((align) ? (MMF_SET_CNTL((mm_flag_t)0, (cntl) | MMF_REQUEST_ALIGN) |        \
+              MMF_SET_ALIGN((mm_flag_t)0, (align)))                             \
            : (MMF_SET_CNTL((mm_flag_t)0, (cntl) & ~MMF_REQUEST_ALIGN)))
 
 #undef _DEF_FLAG
diff --git a/components/mm/mm_kmem.c b/components/mm/mm_kmem.c
index 3559aa6ab4..f981b36a83 100644
--- a/components/mm/mm_kmem.c
+++ b/components/mm/mm_kmem.c
@@ -17,13 +17,13 @@
 #include "mm_private.h"
 #include <mmu.h>
 
-static void list_kernel_space(void)
+static void list_kmem(void)
 {
     rt_aspace_print_all(&rt_kernel_space);
 }
-MSH_CMD_EXPORT(list_kernel_space, List varea in kernel space);
+MSH_CMD_EXPORT(list_kmem, List varea in kernel virtual memory space);
 
-void rt_kmem_list_varea(void) __attribute__((alias("list_kernel_space")));
+void rt_kmem_list(void) __attribute__((alias("list_kmem")));
 
 static rt_ubase_t rt_pv_offset;
 
diff --git a/components/mm/mm_object.c b/components/mm/mm_object.c
index 739c8ecdda..5f6649ba7e 100644
--- a/components/mm/mm_object.c
+++ b/components/mm/mm_object.c
@@ -24,7 +24,7 @@ static const char *get_name(rt_varea_t varea)
     return "dummy-mapper";
 }
 
-void rt_varea_insert_page(rt_varea_t varea, void *page_addr)
+void rt_varea_pgmgr_insert(rt_varea_t varea, void *page_addr)
 {
     rt_page_t page = rt_page_addr2page(page_addr);
 
@@ -41,7 +41,7 @@ void rt_varea_insert_page(rt_varea_t varea, void *page_addr)
     }
 }
 
-void rt_varea_free_pages(rt_varea_t varea)
+void rt_varea_pgmgr_pop_all(rt_varea_t varea)
 {
     rt_page_t page = varea->frames;
 
@@ -54,7 +54,7 @@ void rt_varea_free_pages(rt_varea_t varea)
     }
 }
 
-void rt_varea_offload_page(rt_varea_t varea, void *vaddr, rt_size_t size)
+void rt_varea_pgmgr_pop(rt_varea_t varea, void *vaddr, rt_size_t size)
 {
     void *vend = vaddr + size;
     while (vaddr != vend)
@@ -67,7 +67,7 @@ void rt_varea_offload_page(rt_varea_t varea, void *vaddr, rt_size_t size)
     }
 }
 
-static void on_page_fault(struct rt_varea *varea, struct rt_mm_fault_msg *msg)
+static void on_page_fault(struct rt_varea *varea, struct rt_aspace_fault_msg *msg)
 {
     void *page;
     page = rt_pages_alloc(0);
@@ -82,7 +82,7 @@ static void on_page_fault(struct rt_varea *varea, struct rt_mm_fault_msg *msg)
     msg->response.size = ARCH_PAGE_SIZE;
     msg->response.vaddr = page;
 
-    rt_varea_insert_page(varea, page);
+    rt_varea_pgmgr_insert(varea, page);
 }
 
 static void on_varea_open(struct rt_varea *varea)
@@ -96,7 +96,7 @@ static void on_varea_close(struct rt_varea *varea)
 
 static void on_page_offload(rt_varea_t varea, void *vaddr, rt_size_t size)
 {
-    rt_varea_offload_page(varea, vaddr, size);
+    rt_varea_pgmgr_pop(varea, vaddr, size);
 }
 
 struct rt_mem_obj rt_mm_dummy_mapper = {
diff --git a/components/mm/mm_page.c b/components/mm/mm_page.c
index 03ab5327b6..1ec95598ae 100644
--- a/components/mm/mm_page.c
+++ b/components/mm/mm_page.c
@@ -59,13 +59,13 @@ static void hint_free(rt_mm_va_hint_t hint)
     hint->prefer = rt_mpr_start;
 }
 
-static void on_page_fault(struct rt_varea *varea, struct rt_mm_fault_msg *msg)
+static void on_page_fault(struct rt_varea *varea, struct rt_aspace_fault_msg *msg)
 {
     void *init_start = (void *)init_mpr_align_start;
     void *init_end = (void *)init_mpr_align_end;
-    if (msg->vaddr < init_end && msg->vaddr >= init_start)
+    if (msg->fault_vaddr < init_end && msg->fault_vaddr >= init_start)
     {
-        rt_size_t offset = msg->vaddr - init_start;
+        rt_size_t offset = msg->fault_vaddr - init_start;
         msg->response.status = MM_FAULT_STATUS_OK;
         msg->response.vaddr = init_mpr_cont_start + offset;
         msg->response.size = ARCH_PAGE_SIZE;
diff --git a/components/mm/mm_private.h b/components/mm/mm_private.h
index 0f31fc1fba..364ddab717 100644
--- a/components/mm/mm_private.h
+++ b/components/mm/mm_private.h
@@ -7,8 +7,8 @@
  * Date           Author       Notes
  * 2022-11-14     WangXiaoyao  the first version
  */
-#ifndef __MM_INTERN_H__
-#define __MM_INTERN_H__
+#ifndef __MM_PRIVATE_H__
+#define __MM_PRIVATE_H__
 
 #include "mm_aspace.h"
 #include <rtdef.h>
@@ -44,7 +44,7 @@ struct _mm_range
 rt_err_t _aspace_bst_init(struct rt_aspace *aspace);
 
 /**
- * @brief
+ * @brief Retrieve any varea if start in [varea->start, varea->end]
  *
  * @param aspace
  * @param start
@@ -53,8 +53,7 @@ rt_err_t _aspace_bst_init(struct rt_aspace *aspace);
 struct rt_varea *_aspace_bst_search(struct rt_aspace *aspace, void *start);
 
 /**
- * @brief Retrieve lowest varea satisfies
- * ((varea->start >= start) || (varea->end >= start))
+ * @brief Retrieve lowest varea satisfies (varea->start >= start)
  *
  * @param aspace
  * @param length
@@ -91,4 +90,10 @@ void _aspace_bst_insert(struct rt_aspace *aspace, struct rt_varea *varea);
  */
 void _aspace_bst_remove(struct rt_aspace *aspace, struct rt_varea *varea);
 
-#endif /* __MM_INTERN_H__ */
+void rt_varea_pgmgr_pop(rt_varea_t varea, void *vaddr, rt_size_t size);
+
+void rt_varea_pgmgr_pop_all(rt_varea_t varea);
+
+int _varea_map_with_msg(rt_varea_t varea, struct rt_aspace_fault_msg *msg);
+
+#endif /* __MM_PRIVATE_H__ */