diff --git a/kernel/dlmalloc/dlmalloc_port.inc b/kernel/dlmalloc/dlmalloc_port.inc
index 5e5bc98..2e4613a 100644
--- a/kernel/dlmalloc/dlmalloc_port.inc
+++ b/kernel/dlmalloc/dlmalloc_port.inc
@@ -34,6 +34,7 @@
 #define malloc_getpagesize 0x1000
 #define EINVAL 0xdeadbeef
 #define ENOMEM 0xb16b00b5
+#define MORECORE_CONTIGUOUS 0
 
 #define MLOCK_T SpinLock
 
diff --git a/kernel/hal/x86_64/intr.c b/kernel/hal/x86_64/intr.c
index 174f3ad..b5ad3bf 100644
--- a/kernel/hal/x86_64/intr.c
+++ b/kernel/hal/x86_64/intr.c
@@ -17,6 +17,19 @@
 #include "proc/ps2kbproc/ps2kbproc.h"
 #include "rbuf/rbuf.h"
 
+typedef struct BackTraceFrame {
+  struct BackTraceFrame *rbp;
+  uint64_t rip;
+} BackTraceFrame;
+
+void backtrace(BackTraceFrame *bt) {
+  kprintf("Backtrace:\n");
+  for (size_t frame = 0; bt; frame++) {
+    kprintf("  0x%llx\n", bt->rip);
+    bt = bt->rbp;
+  }
+}
+
 void hal_intr_disable(void) {
   asm volatile("cli");
 }
@@ -178,9 +191,7 @@ void hal_syscalldispatch(IntrStackFrame *frame) {
 }
 
 void intr_eoi(uint8_t irq) {
-  if (irq >= 8) {
-    io_out8(PIC2_CMD, PIC_EOI);
-  }
+  io_out8(PIC2_CMD, PIC_EOI);
   io_out8(PIC1_CMD, PIC_EOI);
 }
 
@@ -188,7 +199,8 @@ void intr_handleintr(IntrStackFrame *frame) {
   if (frame->trapnum <= 31) {
     kprintf("ERROR %s, 0x%lX\n", exceptions[frame->trapnum], frame->errnum);
     intr_dumpframe(frame);
-    if ((frame->trapnum == 14 && frame->errnum & 0x4) || frame->trapnum == 0x6) {
+    backtrace((BackTraceFrame *)frame->regs.rbp);
+    if (frame->errnum & 0x4) {
       kprintf("killed pid %ld %s\n", PROCS.current->pid, PROCS.current->name);
       proc_killself();
       proc_sched((void *)frame);
diff --git a/kernel/hal/x86_64/vmm.c b/kernel/hal/x86_64/vmm.c
index 05656b8..2ba999c 100644
--- a/kernel/hal/x86_64/vmm.c
+++ b/kernel/hal/x86_64/vmm.c
@@ -101,7 +101,7 @@ void hal_vmm_unmap_range(uint64_t cr3phys, void *virtstart, void *physstart, siz
 void hal_vmm_map_kern(uint64_t targetcr3) {
   uint64_t *kcr3 = (uint64_t *)VIRT(KERNEL_CR3);
   uint64_t *cr3 = (uint64_t *)VIRT(targetcr3);
-  for (size_t i = 256; i < 512; i++) {
+  for (size_t i = 0; i < 512; i++) {
     cr3[i] = kcr3[i];
   }
 }
diff --git a/kernel/proc/proc.c b/kernel/proc/proc.c
index e6b3fe8..1385da8 100644
--- a/kernel/proc/proc.c
+++ b/kernel/proc/proc.c
@@ -58,7 +58,10 @@ ElfAuxval proc_load_elf_segs(Proc *proc, uint8_t *data) {
         hal_memset(VIRT(physaddr), 0, blocks * HAL_PAGE_SIZE);
         hal_memcpy(VIRT(physaddr) + off, (data + phdr->p_offset), phdr->p_filesz);
 
-        uint32_t pgflags = HAL_PG_USER | HAL_PG_RW | HAL_PG_PRESENT;
+        uint32_t pgflags = HAL_PG_USER | HAL_PG_PRESENT;
+        if (phdr->p_flags & PF_W) {
+          pgflags |= HAL_PG_RW;
+        }
         hal_vmm_map_range(proc->platformdata.cr3, virtaddr, physaddr, blocks * HAL_PAGE_SIZE, pgflags);
 
         VasRange *range = dlmalloc(sizeof(*range));
@@ -165,25 +168,8 @@ Proc *proc_spawnuser(char *mountpoint, char *path) {
   range->pgflags = flags;
   LL_APPEND(proc->vas, range);
 
-  /* uint8_t *sp = (uint8_t *)pmm_alloc(PROC_STACKBLOCKS) + PROC_STACKSIZE; */
-  /* uint8_t *spbase = sp - PROC_STACKSIZE; */
-  /* uint8_t *kstackp = (uint8_t *)pmm_alloc(PROC_STACKBLOCKS) + PROC_STACKSIZE; */
-  /* proc->platformdata.kstack = kstackp; */
-  /* proc->platformdata.pstack = sp; */
-
-    
-
-  /* uint32_t flags = HAL_PG_RW | HAL_PG_USER | HAL_PG_PRESENT; */
-
-  /* hal_vmm_map_range(proc->platformdata.cr3, spbase, spbase, PROC_STACKSIZE, flags); */
-  /* VasRange *range = dlmalloc(sizeof(*range)); */
-  /* range->virtstart = spbase; */
-  /* range->physstart = spbase; */
-  /* range->size = PROC_STACKSIZE; */
-  /* range->pgflags = flags; */
-  /* LL_APPEND(proc->vas, range); */
-
   ElfAuxval aux = proc_load_elf_segs(proc, data);
+  dlfree(data);
 
   proc->platformdata.trapframe.ss = 0x20 | 0x3;
   proc->platformdata.trapframe.rsp = (uint64_t)virttop;
diff --git a/kernel/proc/proc.h b/kernel/proc/proc.h
index b88237b..208f3b8 100644
--- a/kernel/proc/proc.h
+++ b/kernel/proc/proc.h
@@ -11,7 +11,7 @@
 
 #define PROC_NAME_MAX 0x100
 
-#define PROC_STACKBLOCKS 256
+#define PROC_STACKBLOCKS (1024*4)
 #define PROC_STACKSIZE (PROC_STACKBLOCKS * BITMAP_BLOCK_SIZE)
 
 #define PROC_MAX 0x100 // max amount of processes
@@ -19,8 +19,8 @@
 #define PROC_VFSHANDLES_MAX   0x80
 #define PROC_PIPEHANDLES_MAX  0x20
 
-#define PROC_MMAN_MAP_BASE 0x0000004000000000ULL
-#define PROC_USER_STACK_TOP 0x00007ffffffff000ULL
+#define PROC_MMAN_MAP_BASE  0x700000000000
+#define PROC_USER_STACK_TOP 0x800000000000
 
 typedef struct {
   IntrStackFrame trapframe;
diff --git a/mk/user/x86_64.mk b/mk/user/x86_64.mk
index 9b7bf51..79d58fb 100644
--- a/mk/user/x86_64.mk
+++ b/mk/user/x86_64.mk
@@ -9,4 +9,4 @@ CFLAGS += -m64 \
 					-fno-stack-protector \
 					-fno-stack-check \
 					-fno-builtin \
-					-Os \
+					-O0 \
diff --git a/ulib/_premain.c b/ulib/_premain.c
index 6e41e27..f11d08a 100644
--- a/ulib/_premain.c
+++ b/ulib/_premain.c
@@ -8,15 +8,13 @@
 #include <log.h>
 
 extern void main(void);
-extern uint8_t _bss_start;
-extern uint8_t _bss_end;
+extern uint8_t _bss_start[];
+extern uint8_t _bss_end[];
 
 void clearbss(void) {
-  uint8_t *ps = &_bss_start;
-  uint8_t *pe = &_bss_end;
-  size_t sz = pe - ps;
-  for (size_t i = 0; i < sz; i++) {
-    ps[i] = 0;
+  uint8_t *p = _bss_start;
+  while (p < _bss_end) {
+    *p++ = 0;
   }
 }
 
diff --git a/ulib/dlmalloc/dlmalloc_port.inc b/ulib/dlmalloc/dlmalloc_port.inc
index 9f222b4..b5c7fa2 100644
--- a/ulib/dlmalloc/dlmalloc_port.inc
+++ b/ulib/dlmalloc/dlmalloc_port.inc
@@ -22,6 +22,7 @@
 #define LACKS_STRINGS_H 1
 #define LACKS_SCHED_H 1
 #define HAVE_MMAP 0
+#define MORECORE_CONTIGUOUS 0
 #define ABORT \
   do { \
     uprintf("dlmalloc: Aborting...\n"); \
@@ -54,50 +55,28 @@ static MLOCK_T malloc_global_mutex = { 0 };
 
 #define PAGE_SIZE 0x1000
 
-static uint8_t *heap_start = NULL;
-static uint8_t *heap_end = NULL;
-static uint8_t *heap_commit = NULL;
-
 static size_t _roundpage(size_t sz) {
   return (sz + PAGE_SIZE - 1) & ~(PAGE_SIZE - 1);
 }
 
+void *_last = 0;
+
 void *sbrk(ptrdiff_t inc) {
-  if (!heap_end) {
-    size_t allocsz = PAGE_SIZE;
-    uint8_t *maddr = NULL;
-    int32_t ret = mman_map(NULL, allocsz, MMAN_MAP_PF_RW, 0, &maddr);
-    if (ret != E_OK || maddr == NULL) {
-      return (void *)-1;
-    }
-    heap_start = maddr;
-    heap_end = maddr;
-    heap_commit = maddr + allocsz;
+  if (inc < 0) {
+    return 0;
+  }
+  if (!inc) {
+    return _last;
   }
 
-  if (inc == 0) {
-    return heap_end;
+  uint64_t pages = _roundpage(inc);
+  uint8_t *maddr = NULL;
+  int32_t ret = mman_map(NULL, pages, MMAN_MAP_PF_RW, 0, &maddr);
+  if (ret != E_OK) {
+    return 0;
   }
-
-  uint8_t *oldbrk = heap_end;
-  uint8_t *newbrk = heap_end + inc;
-
-  if (newbrk < heap_start) {
-    return (void *)-1;
-  }
-
-  if (inc > 0) {
-    if (newbrk > heap_commit) {
-      size_t need = (size_t)(newbrk - heap_commit);
-      size_t extra = _roundpage(need);
-      uint8_t *maddr = NULL;
-      int32_t ret = mman_map(NULL, extra, MMAN_MAP_PF_RW, 0, &maddr);
-      if (ret != E_OK || maddr == NULL) {
-        return (void *)-1;
-      }
-      heap_commit += extra;
-    }
-  }
-  heap_end = newbrk;
-  return (void *)oldbrk;
+  string_memset(maddr, 0, pages);
+  _last = (void *)(maddr + inc);
+  return maddr;
 }
+
diff --git a/user/init/main.c b/user/init/main.c
index 606516a..d9bf988 100644
--- a/user/init/main.c
+++ b/user/init/main.c
@@ -24,20 +24,19 @@ void main(void) {
 
   ipcpipe(IPCPIPE_SELFPID, 10, IPCPIPE_MAKE, NULL, 0);
   ipcpipe(IPCPIPE_SELFPID, 10, IPCPIPE_ADD_BCAST, NULL, 1);
-  
-  processctl(tb, PCTL_RUN, 0, 0, 0);
 
   #define OUTBUF_MAX 1024
-  char *outbuf = dlmalloc(1024);
+  char *outbuf = dlmalloc(OUTBUF_MAX);
 
-  while(processctl(tb, PCTL_POLLSTATE, 0, 0, 0) != 4) {
+  processctl(tb, PCTL_RUN, 0, 0, 0);
+
+  for(;;) {
     string_memset(outbuf, 0, OUTBUF_MAX);
     int32_t nrd = ipcpipe(PID, SUBPROC_PIPE_OUT, IPCPIPE_READ, (uint8_t *)outbuf, sizeof(outbuf));
     if (nrd > 0) {
       uprintf("%s", outbuf);
     }
 
-#if 0
     int32_t kbchr;
     int32_t read = ipcpipe(IPCPIPE_SELFPID, 10, IPCPIPE_READ, (uint8_t *)&kbchr, sizeof(kbchr));
     if (read > 0) {
@@ -51,7 +50,6 @@ void main(void) {
         }
       }
     }
-#endif
   }
 
   for(;;);
diff --git a/user/pctl/main.o b/user/pctl/main.o
index 2bdef2c..8b315e8 100644
Binary files a/user/pctl/main.o and b/user/pctl/main.o differ
diff --git a/user/pctl/pctl b/user/pctl/pctl
index 56c0d4a..a461af0 100755
Binary files a/user/pctl/pctl and b/user/pctl/pctl differ
diff --git a/user/tb/interp.c b/user/tb/interp.c
index 2afab06..70e2999 100644
--- a/user/tb/interp.c
+++ b/user/tb/interp.c
@@ -45,14 +45,20 @@ int tz_next(Tokenizer *tz, Token *out) {
   size_t start = tz->pos;
   if (tz->str[start] == '"') {
     start++;
-    do {
-      tz->pos++;
-    } while (tz->pos < tz->len && tz->str[tz->pos] != '"');
     tz->pos++;
-    
-    out->ptr = tz->str + start;
-    out->len = tz->pos - start - 1;
-
+    while (tz->pos < tz->len && tz->str[tz->pos] != '"') {
+      tz->pos++;
+    }
+  
+    if (tz->pos >= tz->len) {
+      out->ptr = tz->str + start;
+      out->len = tz->len - start;
+      tz->pos = tz->len;
+    } else {
+      out->ptr = tz->str + start;
+      out->len = tz->pos - start;
+      tz->pos++;
+    }
   } else {
     while (tz->pos < tz->len && !string_chr_isspace(tz->str[tz->pos])) {
       tz->pos++;
@@ -65,6 +71,8 @@ int tz_next(Tokenizer *tz, Token *out) {
 }
 
 void tz_classify(Tokenizer *tz) {
+  const int tmpbufsz = 256;
+  char *tmpbuf = dlmalloc(tmpbufsz);
   Token *tk = tz->tokens;
   while (tk) {
     if (tk->ptr[0] == '"' && tk->ptr[tk->len - 1] == '"') {
@@ -72,8 +80,8 @@ void tz_classify(Tokenizer *tz) {
     } else if (tk->ptr[0] == '@') {
       RtCmd *cmd = RTCMDS;
       while (cmd) {
-        char tmpbuf[0xff] = {0};
-        usnprintf(tmpbuf, sizeof(tmpbuf), "%.*s", (int)tk->len, tk->ptr);
+        string_memset(tmpbuf, 0, tmpbufsz);
+        usnprintf(tmpbuf, tmpbufsz, "%.*s", (int)tk->len, tk->ptr);
         if (string_strcmp(tmpbuf, cmd->cmdname) == 0) {
           tk->type = TOK_CMD;
           tk->cmd = cmd;
@@ -86,6 +94,7 @@ void tz_classify(Tokenizer *tz) {
     }
     tk = tk->next;
   }
+  dlfree(tmpbuf);
 }
 
 bool interp_readline(char *data, const char **bgptr, const char **endptr) {
@@ -147,15 +156,14 @@ bool interp_runstring(const char *string, InterpResult **res) {
   
   rt_init();
   bool ok = true;
-
   const char *bg, *end;
   interp_readline((char *)string, NULL, NULL);
   while (interp_readline(NULL, &bg, &end)) {
     size_t linelen = end - bg;
-    Tokenizer tz = ZERO(&tz);
+    Tokenizer tz = {0};
     tz_init(&tz, bg, linelen);
   
-    Token toktmp = ZERO(&toktmp);
+    Token toktmp = {0};
     while (tz_next(&tz, &toktmp)) {
       Token *tok = dlmalloc(sizeof(*tok));
       tok->ptr = toktmp.ptr;
@@ -226,7 +234,6 @@ bool interp_runstring(const char *string, InterpResult **res) {
 
     tz_free(&tz);
   }
-
 done:
   return ok;
 }
diff --git a/user/tb/main.c b/user/tb/main.c
index 169eaba..eb5034d 100644
--- a/user/tb/main.c
+++ b/user/tb/main.c
@@ -63,7 +63,7 @@ void do_file(char *filepath) {
     return;
   }
 
-  IoctlStat statbuf = ZERO(&statbuf);
+  IoctlStat statbuf = {0};
 
   ioctl(ioh, IOCTL_STAT, (uint64_t)&statbuf, 0, 0);
   if (statbuf.type != IOCTLSTAT_FILE) {