diff --git a/src/app/terminal.c b/src/app/terminal.c
index f5f7c6e..8968c5c 100644
--- a/src/app/terminal.c
+++ b/src/app/terminal.c
@@ -270,9 +270,7 @@ void terminal(process_t *p, __attribute__((unused)) uint8_t argc, __attribute__(
 
   proc = p;
 
-  char *greeting = string_format("Welcome to FreywarOS v%s!\n\n", VERSION);
-  WRITE_D(greeting);
-  memory_free(greeting);
+  WRITE_D("Welcome to FreywarOS v" VERSION "!\n\n");
 
   print_prompt();
 
diff --git a/src/bootloader.asm b/src/bootloader.asm
index 6be8331..cdeb040 100644
--- a/src/bootloader.asm
+++ b/src/bootloader.asm
@@ -276,23 +276,30 @@ protected_mode:
     mov ss, ax
     mov esp, 0x00090000
 
-    ; zero page table memory at 0x00010000 (3 pages = 768 dwords)
+    ; zero page table memory
     mov edi, 0x00010000
-    mov ecx, 768
+    mov ecx, 256 * 5
     xor eax, eax
     rep stosd
 
     ; PML4[0] -> PDPT at 0x00011000
     mov dword [0x00010000], 0x00011003
-    ; PDPT[0] -> PD at 0x00012000
-    mov dword [0x00011000], 0x00012003
+    ; PML4[511] -> PDPT at 0x00012000
+    mov dword [0x00010FF8], 0x00012003
+    ; PML4[0].PDPT[0] -> PD at 0x00013000
+    mov dword [0x00011000], 0x00013003
+    ; PML4[511].PDPT[510] -> PD at 0x00014000
+    mov dword [0x00012FF0], 0x00014003
     ; PD: fill 64 entries, each mapping 2MB
-    mov edi, 0x00012000
+    mov edi, 0x00013000
     mov eax, 0x00000083   ; present, writable, huge page, base 0
     mov ecx, 64
 
 .fill_pd:
+    mov ebx, edi
+    add ebx, 0x1000
     mov dword [edi], eax
+    mov dword [ebx], eax
     add edi, 8
     add eax, 0x00200000   ; next 2MB
     loop .fill_pd
@@ -327,11 +334,11 @@ long_mode:
     mov ds, ax
     mov es, ax
     mov ss, ax
-    mov rsp, 0x0000000000090000
+    mov rsp, 0xFFFFFFFF80090000
 
     xor rax, rax
     xor rbx, rbx
     xor rcx, rcx
     xor rdx, rdx
 
-    jmp 0x00020000
+    jmp 0xFFFFFFFF80020000
diff --git a/src/fs.h b/src/fs.h
index cd1334a..571d5b5 100644
--- a/src/fs.h
+++ b/src/fs.h
@@ -11,7 +11,6 @@ typedef struct fs_node {
   uint8_t type;
 } fs_node_t;
 
-
 fs_node_t *fs_mount();
 
 fs_node_t *fs_open_by(const fs_node_t *directory, const char *name);
diff --git a/src/kernel.c b/src/kernel.c
index f5ff1f0..ecea6f9 100644
--- a/src/kernel.c
+++ b/src/kernel.c
@@ -45,13 +45,15 @@ void kernel_main() {
   memory_init();
 
   process_t *proc = memory_allocate(sizeof(process_t));
-  proc->cwd = memory_allocate(sizeof(path_t));
   proc->root = fs_mount();
+  proc->cwd = memory_allocate(sizeof(path_t));
   proc->stdin = keyboard_init();
   proc->stdout = vga_init();
 
   terminal(proc, 0, NUL);
 
+  fs_unmount(proc->root);
+
   outw(0x604, 0x2000); // TODO: parse ACPI tables for real hardware
   __asm__ volatile("cli; hlt");
 }
diff --git a/src/linker.ld b/src/linker.ld
index 07fcbff..af8bc01 100644
--- a/src/linker.ld
+++ b/src/linker.ld
@@ -1,7 +1,7 @@
 ENTRY(kernel_main)
 
 SECTIONS {
-    . = 0x0000000000020000;
+    . = 0xFFFFFFFF80020000;
 
     .text : {
         *(.text)
diff --git a/src/memory.c b/src/memory.c
index f3070b6..9f52257 100644
--- a/src/memory.c
+++ b/src/memory.c
@@ -1,9 +1,8 @@
 #include "src/memory.h"
 #include "src/panic.h"
 #include "src/util.h"
-#include <stdint.h>
 
-#define MEMORY_SIZE 134217728
+#define MEMORY_SIZE 0x08000000
 #define PAGE_SIZE 4096
 #define PAGE_COUNT (MEMORY_SIZE / PAGE_SIZE)
 #define MAP_UNIT 64
@@ -49,6 +48,9 @@ __attribute__((unused)) static void memory_page_free(void *address) {
   }
 }
 
+#define KERNEL_VIRTUAL_BASE 0xFFFFFFFF80000000ULL
+#define PHYS_TO_VIRT(phys) ((void *)((uint64_t)(phys) + KERNEL_VIRTUAL_BASE))
+#define VIRT_TO_PHYS(virt) ((uint64_t)(virt) - KERNEL_VIRTUAL_BASE)
 #define HEAP_PAGE_COUNT 256
 
 typedef struct free_chunk {
@@ -59,9 +61,9 @@ typedef struct free_chunk {
 static free_chunk_t *free_list;
 
 void memory_init() {
-  free_list = memory_page_allocate();
+  free_list = PHYS_TO_VIRT(memory_page_allocate());
   for (uint64_t i = 1; i < HEAP_PAGE_COUNT; i++) {
-    memory_page_allocate(); // TODO Map the pages.
+    memory_page_allocate();
   }
   free_list->size = HEAP_PAGE_COUNT * PAGE_SIZE;
   free_list->next = NUL;
diff --git a/src/path.c b/src/path.c
index fb488ce..cca28fe 100644
--- a/src/path.c
+++ b/src/path.c
@@ -3,7 +3,6 @@
 #include "src/memory.h"
 #include "src/string.h"
 #include "src/util.h"
-#include <stdint.h>
 
 path_t *path_open(const fs_node_t *root, const path_t *source, char *path) {
   path_t *result = memory_allocate(sizeof(path_t));
diff --git a/src/process.h b/src/process.h
index fc2a4e1..25f69b7 100644
--- a/src/process.h
+++ b/src/process.h
@@ -6,8 +6,8 @@
 #include "src/string.h"
 
 typedef struct {
-  path_t *cwd;
   fs_node_t *root;
+  path_t *cwd;
   stream_t *stdin;
   stream_t *stdout;
 } process_t;
diff --git a/src/string.c b/src/string.c
index add1fda..27f3e3e 100644
--- a/src/string.c
+++ b/src/string.c
@@ -1,7 +1,5 @@
 #include "src/string.h"
-#include "src/memory.h"
 #include <stdarg.h>
-#include <stdint.h>
 
 uint8_t bytes_equal(const char *l, const char *r, uint64_t count) {
   while (count--) {
@@ -164,41 +162,39 @@ uint64_t string_uint_to_hex(uint64_t value, uint64_t max, char *result) {
   return i;
 }
 
-char *string_format(const char *format, ...) {
+uint64_t string_format(const char *format, uint64_t max, char *output, ...) {
   va_list args;
-  va_start(args, format);
+  va_start(args, output);
 
-  uint64_t limit = 1023;
-
-  char *result = memory_allocate(limit + 1);
+  uint64_t limit = max - 1;
 
   uint64_t fi = 0, ri = 0;
   while (format[fi] && ri < limit) {
     if (format[fi] != '%') {
-      result[ri++] = format[fi++];
+      output[ri++] = format[fi++];
     } else {
       switch (format[fi + 1]) {
       case 'c':
-        result[ri++] = (char)va_arg(args, int);
+        output[ri++] = (char)va_arg(args, int);
         fi += 2;
         break;
       case 'd':
-        string_int_to_decimal(va_arg(args, int64_t), limit - ri, result + ri);
-        while (result[ri]) {
+        string_int_to_decimal(va_arg(args, int64_t), limit - ri, output + ri);
+        while (output[ri]) {
           ri++;
         }
         fi += 2;
         break;
       case 'u':
-        string_uint_to_decimal(va_arg(args, uint64_t), limit - ri, result + ri);
-        while (result[ri]) {
+        string_uint_to_decimal(va_arg(args, uint64_t), limit - ri, output + ri);
+        while (output[ri]) {
           ri++;
         }
         fi += 2;
         break;
       case 'x':
-        string_uint_to_hex(va_arg(args, uint64_t), limit - ri, result + ri);
-        while (result[ri]) {
+        string_uint_to_hex(va_arg(args, uint64_t), limit - ri, output + ri);
+        while (output[ri]) {
           ri++;
         }
         fi += 2;
@@ -206,25 +202,26 @@ char *string_format(const char *format, ...) {
       case 's': {
         char *s = va_arg(args, char *);
         while (*s && ri < limit) {
-          result[ri++] = *s;
+          output[ri++] = *s;
           s++;
         }
         fi += 2;
         break;
       }
       case '%': {
-        result[ri++] = '%';
+        output[ri++] = '%';
         fi += 2;
         break;
       }
       default:
-        result[ri++] = format[fi++];
-        result[ri++] = format[fi++];
+        output[ri++] = format[fi++];
+        output[ri++] = format[fi++];
         break;
       }
     }
   }
-  result[ri] = '\0';
+  output[ri] = '\0';
   va_end(args);
-  return result;
+
+  return ri;
 }
diff --git a/src/string.h b/src/string.h
index 37de9f6..5c28377 100644
--- a/src/string.h
+++ b/src/string.h
@@ -20,4 +20,4 @@ uint64_t string_int_to_decimal(int64_t value, uint64_t max, char *result);
 
 uint64_t string_uint_to_hex(uint64_t value, uint64_t max, char *result);
 
-char *string_format(const char *format, ...);
+uint64_t string_format(const char *format, uint64_t max, char *output, ...);
diff --git a/src/vga.c b/src/vga.c
index 49e9e69..6203d0e 100644
--- a/src/vga.c
+++ b/src/vga.c
@@ -1,9 +1,8 @@
 #include "src/vga.h"
 #include "src/memory.h"
 #include "src/util.h"
-#include <stdint.h>
 
-static uint16_t *vga = (uint16_t *)0x000B8000;
+static uint16_t *vga = (uint16_t *)0xFFFFFFFF800B8000;
 static uint16_t color = (uint16_t)0x0F << 8;
 static uint16_t offset = 0;