diff --git a/lab5/user/lab5/apps/init.c b/lab5/user/lab5/apps/init.c
index 43ec581..947afd2 100644
--- a/lab5/user/lab5/apps/init.c
+++ b/lab5/user/lab5/apps/init.c
@@ -189,12 +189,22 @@ int fs_read(char *path, off_t offset, ssize_t count) {
  */
 int fs_read_all(char *path, void **ret_buf)
 {
+    int ret;
+
     // 获得文件长度
     int size = fs_get_size(path);
     if (size < 0) {
         return size;
     }
 
+    // 映射读文件区
+    ret = usys_map_pmo(SELF_CAP,
+                       tmpfs_read_pmo_cap,
+                       TMPFS_READ_BUF_VADDR, VM_READ | VM_WRITE);
+    if (ret < 0) {
+        return ret;
+    }
+
     // 申请缓冲
     unsigned char *buf = malloc(size);
     if (!buf) {
@@ -206,7 +216,7 @@ int fs_read_all(char *path, void **ret_buf)
     // FIXME: 读取 1 页以上会遇到 warning: vmr overlap
     int pos = 0;
     while (size - pos > 0) {
-        int cur = fs_read(path, pos, PAGE_SIZE - 1);
+        int cur = fs_read(path, pos, PAGE_SIZE);
         if (cur < 0) {
             return cur;
         }
@@ -215,6 +225,9 @@ int fs_read_all(char *path, void **ret_buf)
         buf += cur;
     }
 
+    // 释放
+    usys_unmap_pmo(SELF_CAP, tmpfs_read_pmo_cap, TMPFS_READ_BUF_VADDR);
+
     return size;
 }
 
@@ -446,10 +459,5 @@ void boot_fs(void)
     fail_cond(tmpfs_read_pmo_cap < 0, "usys create_ret ret %d\n",
               tmpfs_read_pmo_cap);
 
-    ret = usys_map_pmo(SELF_CAP,
-                       tmpfs_read_pmo_cap,
-                       TMPFS_READ_BUF_VADDR, VM_READ | VM_WRITE);
-    fail_cond(ret < 0, "usys_map_pmo ret %d\n", ret);
-
 	printf("fs is UP.\n");
 }