diff --git a/etc/init b/etc/init
new file mode 100755
index 0000000..539e434
Binary files /dev/null and b/etc/init differ
diff --git a/etc/init.S b/etc/init.S
new file mode 100644
index 0000000..db1fdcd
--- /dev/null
+++ b/etc/init.S
@@ -0,0 +1,10 @@
+.section .text
+.global _start
+_start:
+    movq $100, %rcx
+1:
+    dec %rcx
+    jnz 1b
+    // XXX: Syscall fucks up kstack?
+    //syscall
+    jmp _start
diff --git a/include/sys/amd64/hw/int_macros.inc b/include/sys/amd64/hw/int_macros.inc
index 94c3d92..1b9c86d 100644
--- a/include/sys/amd64/hw/int_macros.inc
+++ b/include/sys/amd64/hw/int_macros.inc
@@ -41,11 +41,11 @@
     popq %rax
     mov %rax, %ds
     popq %rax
-    mov %rax, %es
+    //mov %rax, %es
     popq %rax
-    mov %rax, %fs
+    //mov %rax, %fs
     popq %rax
-    mov %rax, %gs
+    //mov %rax, %gs
 
     // cr3
     popq %rax
diff --git a/include/sys/amd64/sys/thread.h b/include/sys/amd64/sys/thread.h
index a8a25e0..f5f4a4a 100644
--- a/include/sys/amd64/sys/thread.h
+++ b/include/sys/amd64/sys/thread.h
@@ -28,6 +28,9 @@ struct thread {
     uintptr_t kstack_base;
     size_t kstack_size;
 
+    uintptr_t ustack_base;
+    size_t ustack_size;
+
     thread_info_t info;
 
     thread_t *next;
diff --git a/include/sys/binfmt_elf.h b/include/sys/binfmt_elf.h
new file mode 100644
index 0000000..dcff88e
--- /dev/null
+++ b/include/sys/binfmt_elf.h
@@ -0,0 +1,4 @@
+#pragma once
+#include "sys/thread.h"
+
+int elf_load(thread_t *thr, const void *eptr);
diff --git a/include/sys/elf.h b/include/sys/elf.h
new file mode 100644
index 0000000..12c853f
--- /dev/null
+++ b/include/sys/elf.h
@@ -0,0 +1,447 @@
+// Copied this from linux/elf.h, changed typenames
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+#ifndef _UAPI_LINUX_ELF_H
+#define _UAPI_LINUX_ELF_H
+
+#include "sys/types.h"
+
+/* 32-bit ELF base types. */
+typedef uint32_t    Elf32_Addr;
+typedef uint16_t    Elf32_Half;
+typedef uint32_t    Elf32_Off;
+typedef int32_t     Elf32_Sword;
+typedef uint32_t    Elf32_Word;
+
+/* 64-bit ELF base types. */
+typedef uint64_t    Elf64_Addr;
+typedef uint16_t    Elf64_Half;
+typedef int16_t     Elf64_SHalf;
+typedef uint64_t    Elf64_Off;
+typedef uint32_t    Elf64_Sword;
+typedef uint32_t    Elf64_Word;
+typedef uint64_t    Elf64_Xword;
+typedef int64_t     Elf64_Sxword;
+
+/* These constants are for the segment types stored in the image headers */
+#define PT_NULL    0
+#define PT_LOAD    1
+#define PT_DYNAMIC 2
+#define PT_INTERP  3
+#define PT_NOTE    4
+#define PT_SHLIB   5
+#define PT_PHDR    6
+#define PT_TLS     7               /* Thread local storage segment */
+#define PT_LOOS    0x60000000      /* OS-specific */
+#define PT_HIOS    0x6fffffff      /* OS-specific */
+#define PT_LOPROC  0x70000000
+#define PT_HIPROC  0x7fffffff
+#define PT_GNU_EH_FRAME		0x6474e550
+
+#define PT_GNU_STACK	(PT_LOOS + 0x474e551)
+
+/*
+ * Extended Numbering
+ *
+ * If the real number of program header table entries is larger than
+ * or equal to PN_XNUM(0xffff), it is set to sh_info field of the
+ * section header at index 0, and PN_XNUM is set to e_phnum
+ * field. Otherwise, the section header at index 0 is zero
+ * initialized, if it exists.
+ *
+ * Specifications are available in:
+ *
+ * - Oracle: Linker and Libraries.
+ *   Part No: 817–1984–19, August 2011.
+ *   http://docs.oracle.com/cd/E18752_01/pdf/817-1984.pdf
+ *
+ * - System V ABI AMD64 Architecture Processor Supplement
+ *   Draft Version 0.99.4,
+ *   January 13, 2010.
+ *   http://www.cs.washington.edu/education/courses/cse351/12wi/supp-docs/abi.pdf
+ */
+#define PN_XNUM 0xffff
+
+/* These constants define the different elf file types */
+#define ET_NONE   0
+#define ET_REL    1
+#define ET_EXEC   2
+#define ET_DYN    3
+#define ET_CORE   4
+#define ET_LOPROC 0xff00
+#define ET_HIPROC 0xffff
+
+/* This is the info that is needed to parse the dynamic section of the file */
+#define DT_NULL		0
+#define DT_NEEDED	1
+#define DT_PLTRELSZ	2
+#define DT_PLTGOT	3
+#define DT_HASH		4
+#define DT_STRTAB	5
+#define DT_SYMTAB	6
+#define DT_RELA		7
+#define DT_RELASZ	8
+#define DT_RELAENT	9
+#define DT_STRSZ	10
+#define DT_SYMENT	11
+#define DT_INIT		12
+#define DT_FINI		13
+#define DT_SONAME	14
+#define DT_RPATH 	15
+#define DT_SYMBOLIC	16
+#define DT_REL	        17
+#define DT_RELSZ	18
+#define DT_RELENT	19
+#define DT_PLTREL	20
+#define DT_DEBUG	21
+#define DT_TEXTREL	22
+#define DT_JMPREL	23
+#define DT_ENCODING	32
+#define OLD_DT_LOOS	0x60000000
+#define DT_LOOS		0x6000000d
+#define DT_HIOS		0x6ffff000
+#define DT_VALRNGLO	0x6ffffd00
+#define DT_VALRNGHI	0x6ffffdff
+#define DT_ADDRRNGLO	0x6ffffe00
+#define DT_ADDRRNGHI	0x6ffffeff
+#define DT_VERSYM	0x6ffffff0
+#define DT_RELACOUNT	0x6ffffff9
+#define DT_RELCOUNT	0x6ffffffa
+#define DT_FLAGS_1	0x6ffffffb
+#define DT_VERDEF	0x6ffffffc
+#define	DT_VERDEFNUM	0x6ffffffd
+#define DT_VERNEED	0x6ffffffe
+#define	DT_VERNEEDNUM	0x6fffffff
+#define OLD_DT_HIOS     0x6fffffff
+#define DT_LOPROC	0x70000000
+#define DT_HIPROC	0x7fffffff
+
+/* This info is needed when parsing the symbol table */
+#define STB_LOCAL  0
+#define STB_GLOBAL 1
+#define STB_WEAK   2
+
+#define STT_NOTYPE  0
+#define STT_OBJECT  1
+#define STT_FUNC    2
+#define STT_SECTION 3
+#define STT_FILE    4
+#define STT_COMMON  5
+#define STT_TLS     6
+
+#define ELF_ST_BIND(x)		((x) >> 4)
+#define ELF_ST_TYPE(x)		(((unsigned int) x) & 0xf)
+#define ELF32_ST_BIND(x)	ELF_ST_BIND(x)
+#define ELF32_ST_TYPE(x)	ELF_ST_TYPE(x)
+#define ELF64_ST_BIND(x)	ELF_ST_BIND(x)
+#define ELF64_ST_TYPE(x)	ELF_ST_TYPE(x)
+
+typedef struct dynamic{
+  Elf32_Sword d_tag;
+  union{
+    Elf32_Sword	d_val;
+    Elf32_Addr	d_ptr;
+  } d_un;
+} Elf32_Dyn;
+
+typedef struct {
+  Elf64_Sxword d_tag;		/* entry tag value */
+  union {
+    Elf64_Xword d_val;
+    Elf64_Addr d_ptr;
+  } d_un;
+} Elf64_Dyn;
+
+/* The following are used with relocations */
+#define ELF32_R_SYM(x) ((x) >> 8)
+#define ELF32_R_TYPE(x) ((x) & 0xff)
+
+#define ELF64_R_SYM(i)			((i) >> 32)
+#define ELF64_R_TYPE(i)			((i) & 0xffffffff)
+
+typedef struct elf32_rel {
+  Elf32_Addr	r_offset;
+  Elf32_Word	r_info;
+} Elf32_Rel;
+
+typedef struct elf64_rel {
+  Elf64_Addr r_offset;	/* Location at which to apply the action */
+  Elf64_Xword r_info;	/* index and type of relocation */
+} Elf64_Rel;
+
+typedef struct elf32_rela{
+  Elf32_Addr	r_offset;
+  Elf32_Word	r_info;
+  Elf32_Sword	r_addend;
+} Elf32_Rela;
+
+typedef struct elf64_rela {
+  Elf64_Addr r_offset;	/* Location at which to apply the action */
+  Elf64_Xword r_info;	/* index and type of relocation */
+  Elf64_Sxword r_addend;	/* Constant addend used to compute value */
+} Elf64_Rela;
+
+typedef struct elf32_sym{
+  Elf32_Word	st_name;
+  Elf32_Addr	st_value;
+  Elf32_Word	st_size;
+  unsigned char	st_info;
+  unsigned char	st_other;
+  Elf32_Half	st_shndx;
+} Elf32_Sym;
+
+typedef struct elf64_sym {
+  Elf64_Word st_name;		/* Symbol name, index in string tbl */
+  unsigned char	st_info;	/* Type and binding attributes */
+  unsigned char	st_other;	/* No defined meaning, 0 */
+  Elf64_Half st_shndx;		/* Associated section index */
+  Elf64_Addr st_value;		/* Value of the symbol */
+  Elf64_Xword st_size;		/* Associated symbol size */
+} Elf64_Sym;
+
+
+#define EI_NIDENT	16
+
+typedef struct elf32_hdr{
+  unsigned char	e_ident[EI_NIDENT];
+  Elf32_Half	e_type;
+  Elf32_Half	e_machine;
+  Elf32_Word	e_version;
+  Elf32_Addr	e_entry;  /* Entry point */
+  Elf32_Off	e_phoff;
+  Elf32_Off	e_shoff;
+  Elf32_Word	e_flags;
+  Elf32_Half	e_ehsize;
+  Elf32_Half	e_phentsize;
+  Elf32_Half	e_phnum;
+  Elf32_Half	e_shentsize;
+  Elf32_Half	e_shnum;
+  Elf32_Half	e_shstrndx;
+} Elf32_Ehdr;
+
+typedef struct elf64_hdr {
+  unsigned char	e_ident[EI_NIDENT];	/* ELF "magic number" */
+  Elf64_Half e_type;
+  Elf64_Half e_machine;
+  Elf64_Word e_version;
+  Elf64_Addr e_entry;		/* Entry point virtual address */
+  Elf64_Off e_phoff;		/* Program header table file offset */
+  Elf64_Off e_shoff;		/* Section header table file offset */
+  Elf64_Word e_flags;
+  Elf64_Half e_ehsize;
+  Elf64_Half e_phentsize;
+  Elf64_Half e_phnum;
+  Elf64_Half e_shentsize;
+  Elf64_Half e_shnum;
+  Elf64_Half e_shstrndx;
+} Elf64_Ehdr;
+
+/* These constants define the permissions on sections in the program
+   header, p_flags. */
+#define PF_R		0x4
+#define PF_W		0x2
+#define PF_X		0x1
+
+typedef struct elf32_phdr{
+  Elf32_Word	p_type;
+  Elf32_Off	p_offset;
+  Elf32_Addr	p_vaddr;
+  Elf32_Addr	p_paddr;
+  Elf32_Word	p_filesz;
+  Elf32_Word	p_memsz;
+  Elf32_Word	p_flags;
+  Elf32_Word	p_align;
+} Elf32_Phdr;
+
+typedef struct elf64_phdr {
+  Elf64_Word p_type;
+  Elf64_Word p_flags;
+  Elf64_Off p_offset;		/* Segment file offset */
+  Elf64_Addr p_vaddr;		/* Segment virtual address */
+  Elf64_Addr p_paddr;		/* Segment physical address */
+  Elf64_Xword p_filesz;		/* Segment size in file */
+  Elf64_Xword p_memsz;		/* Segment size in memory */
+  Elf64_Xword p_align;		/* Segment alignment, file & memory */
+} Elf64_Phdr;
+
+/* sh_type */
+#define SHT_NULL	0
+#define SHT_PROGBITS	1
+#define SHT_SYMTAB	2
+#define SHT_STRTAB	3
+#define SHT_RELA	4
+#define SHT_HASH	5
+#define SHT_DYNAMIC	6
+#define SHT_NOTE	7
+#define SHT_NOBITS	8
+#define SHT_REL		9
+#define SHT_SHLIB	10
+#define SHT_DYNSYM	11
+#define SHT_NUM		12
+#define SHT_LOPROC	0x70000000
+#define SHT_HIPROC	0x7fffffff
+#define SHT_LOUSER	0x80000000
+#define SHT_HIUSER	0xffffffff
+
+/* sh_flags */
+#define SHF_WRITE		0x1
+#define SHF_ALLOC		0x2
+#define SHF_EXECINSTR		0x4
+#define SHF_RELA_LIVEPATCH	0x00100000
+#define SHF_RO_AFTER_INIT	0x00200000
+#define SHF_MASKPROC		0xf0000000
+
+/* special section indexes */
+#define SHN_UNDEF	0
+#define SHN_LORESERVE	0xff00
+#define SHN_LOPROC	0xff00
+#define SHN_HIPROC	0xff1f
+#define SHN_LIVEPATCH	0xff20
+#define SHN_ABS		0xfff1
+#define SHN_COMMON	0xfff2
+#define SHN_HIRESERVE	0xffff
+
+typedef struct elf32_shdr {
+  Elf32_Word	sh_name;
+  Elf32_Word	sh_type;
+  Elf32_Word	sh_flags;
+  Elf32_Addr	sh_addr;
+  Elf32_Off	sh_offset;
+  Elf32_Word	sh_size;
+  Elf32_Word	sh_link;
+  Elf32_Word	sh_info;
+  Elf32_Word	sh_addralign;
+  Elf32_Word	sh_entsize;
+} Elf32_Shdr;
+
+typedef struct elf64_shdr {
+  Elf64_Word sh_name;		/* Section name, index in string tbl */
+  Elf64_Word sh_type;		/* Type of section */
+  Elf64_Xword sh_flags;		/* Miscellaneous section attributes */
+  Elf64_Addr sh_addr;		/* Section virtual addr at execution */
+  Elf64_Off sh_offset;		/* Section file offset */
+  Elf64_Xword sh_size;		/* Size of section in bytes */
+  Elf64_Word sh_link;		/* Index of another section */
+  Elf64_Word sh_info;		/* Additional section information */
+  Elf64_Xword sh_addralign;	/* Section alignment */
+  Elf64_Xword sh_entsize;	/* Entry size if section holds table */
+} Elf64_Shdr;
+
+#define	EI_MAG0		0		/* e_ident[] indexes */
+#define	EI_MAG1		1
+#define	EI_MAG2		2
+#define	EI_MAG3		3
+#define	EI_CLASS	4
+#define	EI_DATA		5
+#define	EI_VERSION	6
+#define	EI_OSABI	7
+#define	EI_PAD		8
+
+#define	ELFMAG0		0x7f		/* EI_MAG */
+#define	ELFMAG1		'E'
+#define	ELFMAG2		'L'
+#define	ELFMAG3		'F'
+#define	ELFMAG		"\177ELF"
+#define	SELFMAG		4
+
+#define	ELFCLASSNONE	0		/* EI_CLASS */
+#define	ELFCLASS32	1
+#define	ELFCLASS64	2
+#define	ELFCLASSNUM	3
+
+#define ELFDATANONE	0		/* e_ident[EI_DATA] */
+#define ELFDATA2LSB	1
+#define ELFDATA2MSB	2
+
+#define EV_NONE		0		/* e_version, EI_VERSION */
+#define EV_CURRENT	1
+#define EV_NUM		2
+
+#define ELFOSABI_NONE	0
+#define ELFOSABI_LINUX	3
+
+#ifndef ELF_OSABI
+#define ELF_OSABI ELFOSABI_NONE
+#endif
+
+/*
+ * Notes used in ET_CORE. Architectures export some of the arch register sets
+ * using the corresponding note types via the PTRACE_GETREGSET and
+ * PTRACE_SETREGSET requests.
+ */
+#define NT_PRSTATUS	1
+#define NT_PRFPREG	2
+#define NT_PRPSINFO	3
+#define NT_TASKSTRUCT	4
+#define NT_AUXV		6
+/*
+ * Note to userspace developers: size of NT_SIGINFO note may increase
+ * in the future to accomodate more fields, don't assume it is fixed!
+ */
+#define NT_SIGINFO      0x53494749
+#define NT_FILE         0x46494c45
+#define NT_PRXFPREG     0x46e62b7f      /* copied from gdb5.1/include/elf/common.h */
+#define NT_PPC_VMX	0x100		/* PowerPC Altivec/VMX registers */
+#define NT_PPC_SPE	0x101		/* PowerPC SPE/EVR registers */
+#define NT_PPC_VSX	0x102		/* PowerPC VSX registers */
+#define NT_PPC_TAR	0x103		/* Target Address Register */
+#define NT_PPC_PPR	0x104		/* Program Priority Register */
+#define NT_PPC_DSCR	0x105		/* Data Stream Control Register */
+#define NT_PPC_EBB	0x106		/* Event Based Branch Registers */
+#define NT_PPC_PMU	0x107		/* Performance Monitor Registers */
+#define NT_PPC_TM_CGPR	0x108		/* TM checkpointed GPR Registers */
+#define NT_PPC_TM_CFPR	0x109		/* TM checkpointed FPR Registers */
+#define NT_PPC_TM_CVMX	0x10a		/* TM checkpointed VMX Registers */
+#define NT_PPC_TM_CVSX	0x10b		/* TM checkpointed VSX Registers */
+#define NT_PPC_TM_SPR	0x10c		/* TM Special Purpose Registers */
+#define NT_PPC_TM_CTAR	0x10d		/* TM checkpointed Target Address Register */
+#define NT_PPC_TM_CPPR	0x10e		/* TM checkpointed Program Priority Register */
+#define NT_PPC_TM_CDSCR	0x10f		/* TM checkpointed Data Stream Control Register */
+#define NT_PPC_PKEY	0x110		/* Memory Protection Keys registers */
+#define NT_386_TLS	0x200		/* i386 TLS slots (struct user_desc) */
+#define NT_386_IOPERM	0x201		/* x86 io permission bitmap (1=deny) */
+#define NT_X86_XSTATE	0x202		/* x86 extended state using xsave */
+#define NT_S390_HIGH_GPRS	0x300	/* s390 upper register halves */
+#define NT_S390_TIMER	0x301		/* s390 timer register */
+#define NT_S390_TODCMP	0x302		/* s390 TOD clock comparator register */
+#define NT_S390_TODPREG	0x303		/* s390 TOD programmable register */
+#define NT_S390_CTRS	0x304		/* s390 control registers */
+#define NT_S390_PREFIX	0x305		/* s390 prefix register */
+#define NT_S390_LAST_BREAK	0x306	/* s390 breaking event address */
+#define NT_S390_SYSTEM_CALL	0x307	/* s390 system call restart data */
+#define NT_S390_TDB	0x308		/* s390 transaction diagnostic block */
+#define NT_S390_VXRS_LOW	0x309	/* s390 vector registers 0-15 upper half */
+#define NT_S390_VXRS_HIGH	0x30a	/* s390 vector registers 16-31 */
+#define NT_S390_GS_CB	0x30b		/* s390 guarded storage registers */
+#define NT_S390_GS_BC	0x30c		/* s390 guarded storage broadcast control block */
+#define NT_S390_RI_CB	0x30d		/* s390 runtime instrumentation */
+#define NT_ARM_VFP	0x400		/* ARM VFP/NEON registers */
+#define NT_ARM_TLS	0x401		/* ARM TLS register */
+#define NT_ARM_HW_BREAK	0x402		/* ARM hardware breakpoint registers */
+#define NT_ARM_HW_WATCH	0x403		/* ARM hardware watchpoint registers */
+#define NT_ARM_SYSTEM_CALL	0x404	/* ARM system call number */
+#define NT_ARM_SVE	0x405		/* ARM Scalable Vector Extension registers */
+#define NT_ARM_PAC_MASK		0x406	/* ARM pointer authentication code masks */
+#define NT_ARM_PACA_KEYS	0x407	/* ARM pointer authentication address keys */
+#define NT_ARM_PACG_KEYS	0x408	/* ARM pointer authentication generic key */
+#define NT_ARC_V2	0x600		/* ARCv2 accumulator/extra registers */
+#define NT_VMCOREDD	0x700		/* Vmcore Device Dump Note */
+#define NT_MIPS_DSP	0x800		/* MIPS DSP ASE registers */
+#define NT_MIPS_FP_MODE	0x801		/* MIPS floating-point mode */
+#define NT_MIPS_MSA	0x802		/* MIPS SIMD registers */
+
+/* Note header in a PT_NOTE section */
+typedef struct elf32_note {
+  Elf32_Word	n_namesz;	/* Name size */
+  Elf32_Word	n_descsz;	/* Content size */
+  Elf32_Word	n_type;		/* Content type */
+} Elf32_Nhdr;
+
+/* Note header in a PT_NOTE section */
+typedef struct elf64_note {
+  Elf64_Word n_namesz;	/* Name size */
+  Elf64_Word n_descsz;	/* Content size */
+  Elf64_Word n_type;	/* Content type */
+} Elf64_Nhdr;
+
+#endif /* _UAPI_LINUX_ELF_H */
+
diff --git a/sys/amd64/conf.mk b/sys/amd64/conf.mk
index c5670a2..fad7dd0 100644
--- a/sys/amd64/conf.mk
+++ b/sys/amd64/conf.mk
@@ -37,6 +37,7 @@ kernel_LDFLAGS=-nostdlib \
 			   -static \
 			   -Wl,--build-id=none \
 			   -z max-page-size=0x1000 \
+			   -ggdb \
 			   -T$(kernel_LINKER)
 kernel_CFLAGS=-ffreestanding \
 			  -I. \
diff --git a/sys/amd64/gdbrc b/sys/amd64/gdbrc
index d801e4d..dc3a993 100644
--- a/sys/amd64/gdbrc
+++ b/sys/amd64/gdbrc
@@ -1,2 +1,2 @@
 target remote localhost:1234
-symbol-file build/kernel.elf
+symbol-file build/sys/amd64/kernel.elf
diff --git a/sys/amd64/hw/exc.c b/sys/amd64/hw/exc.c
index 11a1831..4c4bd23 100644
--- a/sys/amd64/hw/exc.c
+++ b/sys/amd64/hw/exc.c
@@ -1,14 +1,51 @@
 #include "sys/amd64/hw/ints.h"
+#include "sys/amd64/mm/map.h"
 #include "sys/amd64/regs.h"
 #include "sys/debug.h"
 
-int amd64_err_num;
+uint64_t amd64_err_num, amd64_err_code;
 
 void amd64_exc_handler(amd64_ctx_regs_t *regs) {
     kfatal("Unhandled exception #%d\n", amd64_err_num);
 
     amd64_ctx_dump(DEBUG_FATAL, regs);
 
+    if (amd64_err_num == 14) {
+        mm_space_t pml4 = (mm_space_t) MM_VIRTUALIZE(regs->cr3);
+
+        kfatal("This is a page fault\n");
+        uintptr_t cr2;
+        asm volatile ("movq %%cr2, %0":"=a"(cr2));
+        kfatal("cr2 = %p\n", cr2);
+
+        uint64_t flags;
+        uintptr_t paddr = amd64_map_get(pml4, cr2, &flags);
+
+        if (paddr == MM_NADDR) {
+            kfatal("Requested page is not present\n");
+        } else {
+            kfatal("Requested page physical address is %p\n", paddr);
+        }
+
+        kfatal("Error code: %p\n", amd64_err_code);
+        if (amd64_err_code & (1 << 0)) {
+            kfatal("[Present]\n");
+        }
+        if (amd64_err_code & (1 << 1)) {
+            kfatal("[Write]\n");
+        }
+        if (amd64_err_code & (1 << 2)) {
+            kfatal("[User]\n");
+            kfatal("Page \"user\" flag is %d\n", !!(flags & (1 << 2)));
+        }
+        if (amd64_err_code & (1 << 3)) {
+            kfatal("[Reserved Write]\n");
+        }
+        if (amd64_err_code & (1 << 4)) {
+            kfatal("[Instruction Fetch]\n");
+        }
+    }
+
     while (1) {
         asm volatile ("cli; hlt");
     }
diff --git a/sys/amd64/hw/ints.S b/sys/amd64/hw/ints.S
index d0f46e8..81e89b4 100644
--- a/sys/amd64/hw/ints.S
+++ b/sys/amd64/hw/ints.S
@@ -11,6 +11,8 @@ __isr_generic:
     pushq %rax
     mov 8(%rsp), %rax
     mov %rax, amd64_err_num(%rip)
+    mov 16(%rsp), %rax
+    mov %rax, amd64_err_code(%rip)
     popq %rax
     add $16, %rsp
 
diff --git a/sys/amd64/hw/regs.c b/sys/amd64/hw/regs.c
index 429f934..9d330ac 100644
--- a/sys/amd64/hw/regs.c
+++ b/sys/amd64/hw/regs.c
@@ -1,7 +1,12 @@
 #include "sys/amd64/regs.h"
+#include "sys/mm.h"
 #include "sys/debug.h"
 
 void amd64_ctx_dump(int level, const amd64_ctx_regs_t *regs) {
+    if (regs->cr3 == MM_PHYS(mm_kernel)) {
+        kprint(level, "(CR3 points to kernel PML4)\n");
+    }
+
     kprint(level, "rax = %p (%ld)\n", regs->gp.rax, regs->gp.rax);
     kprint(level, "rcx = %p (%ld)\n", regs->gp.rcx, regs->gp.rcx);
     kprint(level, "rdx = %p (%ld)\n", regs->gp.rdx, regs->gp.rdx);
diff --git a/sys/amd64/kernel.c b/sys/amd64/kernel.c
index 44f734f..d0c4a2d 100644
--- a/sys/amd64/kernel.c
+++ b/sys/amd64/kernel.c
@@ -9,10 +9,18 @@
 #include "sys/amd64/loader/multiboot.h"
 #include "sys/amd64/mm/phys.h"
 #include "sys/amd64/acpi/tables.h"
+#include "sys/amd64/mm/pool.h"
+#include "sys/sched.h"
+#include "sys/string.h"
+#include "sys/assert.h"
+#include "sys/heap.h"
 #include "sys/fs/tar.h"
 #include "sys/fs/vfs.h"
+#include "sys/errno.h"
 #include "sys/fs/fcntl.h"
 #include "sys/blk/ram.h"
+#include "sys/thread.h"
+#include "sys/binfmt_elf.h"
 #include "sys/kidle.h"
 
 // TODO: move to some util header
@@ -26,6 +34,7 @@
 
 static struct amd64_loader_data *loader_data = 0;
 static multiboot_info_t *multiboot_info;
+static struct vfs_ioctx kernel_ioctx = { NULL, 0, 0 };
 
 static uint8_t amd64_loader_data_checksum(const struct amd64_loader_data *ld) {
     uint8_t chk = 0;
@@ -41,6 +50,66 @@ static void amd64_loader_data_process(void) {
     multiboot_info = (multiboot_info_t *) MM_VIRTUALIZE(loader_data->multiboot_info_ptr);
 }
 
+static int init_start(void) {
+    struct stat st;
+    int res;
+
+    if ((res = vfs_stat(&kernel_ioctx, "/etc/init", &st)) < 0) {
+        return res;
+    }
+
+    if ((st.st_mode & S_IFMT) != S_IFREG) {
+        kerror("/etc/init: not a regular file\n");
+        return -EINVAL;
+    }
+
+    if (!(st.st_mode & 0111)) {
+        kerror("/etc/init: no one can execute this\n");
+        return -EINVAL;
+    }
+
+    kdebug("/etc/init is %S\n", st.st_size);
+
+    // That seems to be a weird way of loading binaries, whatever
+    void *exec_buf = kmalloc(st.st_size);
+    _assert(exec_buf);
+    struct ofile fd;
+    char buf[512];
+    size_t pos = 0;
+    ssize_t bread;
+
+    if ((res = vfs_open(&kernel_ioctx, &fd, "/etc/init", 0, O_RDONLY)) < 0) {
+        return res;
+    }
+
+    while ((bread = vfs_read(&kernel_ioctx, &fd, buf, 512)) > 0) {
+        memcpy((void *) ((uintptr_t) exec_buf + pos), buf, bread);
+        pos += bread;
+    }
+
+    vfs_close(&kernel_ioctx, &fd);
+
+    kdebug("Successfully read init file\n");
+
+    thread_t *init_thread = (thread_t *) kmalloc(sizeof(thread_t));
+    _assert(init_thread);
+    mm_space_t thread_space = amd64_mm_pool_alloc();
+    _assert(thread_space);
+    mm_space_clone(thread_space, mm_kernel, MM_CLONE_FLG_KERNEL);
+
+    if (thread_init(init_thread, thread_space, 0, 0, 0, 0, 0, 0) < 0) {
+        panic("Failed to set init up\n");
+    }
+
+    if ((res = elf_load(init_thread, exec_buf)) < 0) {
+        return res;
+    }
+
+    sched_add(init_thread);
+
+    return 0;
+}
+
 void kernel_main(uintptr_t loader_info_phys_ptr) {
     kdebug("Booting\n");
 
@@ -87,28 +156,17 @@ void kernel_main(uintptr_t loader_info_phys_ptr) {
 
     // Setup tarfs class
     tarfs_init();
-    struct vfs_ioctx ioctx = {
-        NULL, 0, 0
-    };
 
     // Mount tarfs@ram0 as root
-    if (vfs_mount(&ioctx, "/", ramblk0, "ustar", NULL) < 0) {
+    if (vfs_mount(&kernel_ioctx, "/", ramblk0, "ustar", NULL) < 0) {
         panic("Failed to mount root\n");
     }
 
-    // Try finding /etc/file.txt
-    struct ofile fd;
+    // Try to execute an ELF binary from initrd
     int res;
-    if ((res = vfs_open(&ioctx, &fd, "/etc/file.txt", 0, O_RDONLY)) < 0) {
-        panic("Could not open the file\n");
+    if ((res = init_start()) < 0) {
+        kerror("Failed to execute init: %s\n", kstrerror(res));
     }
-    char buf[128];
-
-    while ((res = vfs_read(&ioctx, &fd, buf, 128)) > 0) {
-        kdebug("Read bytes: %s\n", buf);
-    }
-
-    vfs_close(&ioctx, &fd);
 
     kidle_init();
 
diff --git a/sys/amd64/mm/map.c b/sys/amd64/mm/map.c
index 80780f6..84cb706 100644
--- a/sys/amd64/mm/map.c
+++ b/sys/amd64/mm/map.c
@@ -136,7 +136,7 @@ int amd64_map_single(mm_space_t pml4, uintptr_t virt_addr, uintptr_t phys, uint3
         assert(pdpt, "PDPT alloc failed\n");
         kdebug("Allocated PDPT = %p\n", pdpt);
 
-        pml4[pml4i] = MM_PHYS(pdpt) | 1;
+        pml4[pml4i] = MM_PHYS(pdpt) | (1 << 2) | (1 << 1) | 1;
     } else {
         pdpt = (mm_pdpt_t) MM_VIRTUALIZE(pml4[pml4i] & ~0xFFF);
     }
@@ -147,7 +147,7 @@ int amd64_map_single(mm_space_t pml4, uintptr_t virt_addr, uintptr_t phys, uint3
         assert(pd, "PD alloc failed\n");
         kdebug("Allocated PD = %p\n", pd);
 
-        pdpt[pdpti] = MM_PHYS(pd) | 1;
+        pdpt[pdpti] = MM_PHYS(pd) | (1 << 2) | (1 << 1) | 1;
     } else {
         pd = (mm_pagedir_t) MM_VIRTUALIZE(pdpt[pdpti] & ~0xFFF);
     }
@@ -158,7 +158,7 @@ int amd64_map_single(mm_space_t pml4, uintptr_t virt_addr, uintptr_t phys, uint3
         assert(pt, "PT alloc failed\n");
         kdebug("Allocated PT = %p\n", pt);
 
-        pd[pdi] = MM_PHYS(pt) | 1;
+        pd[pdi] = MM_PHYS(pt) | (1 << 2) | (1 << 1) | 1;
     } else {
         pt = (mm_pagetab_t) MM_VIRTUALIZE(pd[pdi] & ~0xFFF);
     }
diff --git a/sys/amd64/sys/thread.c b/sys/amd64/sys/thread.c
index 252ac94..fb2b3e7 100644
--- a/sys/amd64/sys/thread.c
+++ b/sys/amd64/sys/thread.c
@@ -3,6 +3,7 @@
 #include "sys/assert.h"
 #include "sys/debug.h"
 #include "sys/heap.h"
+#include "sys/amd64/mm/phys.h"
 
 #define AMD64_DEFAULT_KSTACK_SIZE   0x4000
 
@@ -36,9 +37,17 @@ int thread_init(thread_t *t,
 
     // If we're not kernel, additionally set the ustack
     if (!(flags & THREAD_KERNEL)) {
-        assert(ustack_base, "Tried to create an userspace task, but passed no ustack\n");
+        if (ustack_base == 0) {
+            // Allocate an ustack
+            ustack_base = amd64_phys_alloc_page();
+            if (ustack_base == MM_NADDR) {
+                panic("Failed to allocate thread ustack\n");
+            }
+            ustack_size = 0x1000;
+        }
 
-        panic("Not implemented\n");
+        t->ustack_size = ustack_size;
+        t->ustack_base = ustack_base;
     }
 
     // Set CS:RIP
@@ -49,7 +58,11 @@ int thread_init(thread_t *t,
         ctx0(t)->rflags = 0x248;
         ctx0(t)->rip = ip;
     } else {
-        panic("Not implemented\n");
+        ctx0(t)->cs = 0x23;
+        ctx0(t)->ss = 0x1B;
+        ctx0(t)->rsp = t->ustack_size + t->ustack_base;
+        ctx0(t)->rflags = 0x248;
+        ctx0(t)->rip = ip;
     }
 
     assert(((uintptr_t) space) > 0xFFFFFF0000000000,
@@ -72,7 +85,11 @@ void thread_set_ip(thread_t *t, uintptr_t ip) {
         ctx0(t)->rflags = 0x248;
         ctx0(t)->rip = ip;
     } else {
-        panic("Userspace threads are not supported yet\n");
+        ctx0(t)->cs = 0x23;
+        ctx0(t)->ss = 0x1B;
+        ctx0(t)->rsp = t->ustack_size + t->ustack_base;
+        ctx0(t)->rflags = 0x248;
+        ctx0(t)->rip = ip;
     }
 }
 
diff --git a/sys/binfmt_elf.c b/sys/binfmt_elf.c
new file mode 100644
index 0000000..70126d4
--- /dev/null
+++ b/sys/binfmt_elf.c
@@ -0,0 +1,95 @@
+#include "sys/binfmt_elf.h"
+#include "sys/debug.h"
+#include "sys/mem.h"
+#include "sys/string.h"
+#include "sys/panic.h"
+#include "sys/amd64/mm/phys.h"
+#include "sys/amd64/mm/map.h"
+#include "sys/errno.h"
+#include "sys/elf.h"
+
+#define ELF_ADDR_MIN 0x400000
+
+int elf_load(thread_t *thr, const void *from) {
+    struct thread_info *thri = thread_get(thr);
+
+    Elf64_Ehdr *ehdr = (Elf64_Ehdr *) from;
+    // Check magic
+    if (strncmp((const char *) ehdr->e_ident, "\x7F""ELF", 4) != 0) {
+        kerror("elf: magic mismatch\n");
+        return -EINVAL;
+    }
+
+    if (ehdr->e_ident[EI_CLASS] != ELFCLASS64) {
+        kerror("elf: object was not intended for 64-bit\n");
+        return -EINVAL;
+    }
+
+    Elf64_Shdr *shdrs = (Elf64_Shdr *) (ehdr->e_shoff + (uintptr_t) from);
+    const char *shstrtabd = (const char *) (shdrs[ehdr->e_shstrndx].sh_offset + (uintptr_t) from);
+
+    // Load the sections
+    for (size_t i = 0; i < ehdr->e_shnum; ++i) {
+        Elf64_Shdr *shdr = &shdrs[i];
+        const char *name = &shstrtabd[shdr->sh_name];
+
+        if (shdr->sh_flags & SHF_ALLOC) {
+            if (!strncmp(name, ".note", 5)) {
+                // Fuck you, gcc
+                continue;
+            }
+            if (!strncmp(name, ".gnu", 4)) {
+                // Fuck you, gcc
+                continue;
+            }
+
+            kdebug("Loading %s\n", name);
+
+            // If the section is below what is allowed
+            if (shdr->sh_addr < ELF_ADDR_MIN) {
+                kerror("elf: section address is below allowed\n");
+                return -EINVAL;
+            }
+
+            // Allocate memory for the section
+            size_t sec_pages = (shdr->sh_size + 0xFFF) / 0x1000;
+            kdebug("%s needs %u pages\n", name, sec_pages);
+            if (sec_pages > 1) {
+                panic("elf: I was too lazy to implement this yet\n");
+            }
+
+            uintptr_t page_virt = shdr->sh_addr & ~0xFFF;
+
+            kdebug("%s base page is VMA %p\n", name, page_virt);
+
+            uintptr_t page_phys = amd64_phys_alloc_page();
+            uintptr_t page_offset = shdr->sh_addr & 0xFFF;
+
+            if (page_phys == MM_NADDR) {
+                panic("elf: out of memory\n");
+            }
+
+            if (amd64_map_single(thri->space, page_virt, page_phys, (1 << 1) | (1 << 2)) != 0) {
+                panic("elf: map failed\n");
+            }
+
+            if (shdr->sh_type == SHT_PROGBITS) {
+                kdebug("elf: memcpy %p <- %p %S\n", MM_VIRTUALIZE(page_phys) + page_offset,
+                                               (uintptr_t) from + shdr->sh_offset,
+                                               shdr->sh_size);
+                memcpy((void *) (MM_VIRTUALIZE(page_phys) + page_offset),
+                       (const void *) ((uintptr_t) from + shdr->sh_offset),
+                       shdr->sh_size);
+            } else if (shdr->sh_type == SHT_NOBITS) {
+                kdebug("elf: memset 0 %p %S\n", MM_VIRTUALIZE(page_phys) + page_offset,
+                                           shdr->sh_size);
+                memset((void *) (MM_VIRTUALIZE(page_phys) + page_offset),
+                       0, shdr->sh_size);
+            }
+        }
+    }
+
+    thread_set_ip(thr, ehdr->e_entry);
+
+    return 0;
+}
diff --git a/sys/conf.mk b/sys/conf.mk
index 74c8747..3bdc9f4 100644
--- a/sys/conf.mk
+++ b/sys/conf.mk
@@ -8,7 +8,8 @@ CFLAGS+=-Wall \
 		-Iinclude \
 		-Wno-unused-variable \
 		-Wno-language-extension-token \
-		-Wno-gnu-zero-variadic-macro-arguments
+		-Wno-gnu-zero-variadic-macro-arguments \
+		-ggdb
 
 ifdef KERNEL_TEST_MODE
 CFLAGS+=-DKERNEL_TEST_MODE
@@ -35,4 +36,6 @@ OBJS+=$(O)/sys/mem.o \
 	  $(O)/sys/vfs/ext2/ext2vnop.o \
 	  $(O)/sys/vfs/ext2/ext2dir.o \
 	  $(O)/sys/blk/ram.o \
-	  $(O)/sys/vfs/tar.o
+	  $(O)/sys/vfs/tar.o \
+	  $(O)/sys/binfmt_elf.o \
+	  $(O)/sys/errno.o
diff --git a/sys/errno.c b/sys/errno.c
new file mode 100644
index 0000000..bbe2d43
--- /dev/null
+++ b/sys/errno.c
@@ -0,0 +1,12 @@
+#include "sys/errno.h"
+
+const char *kstrerror(int e) {
+    switch (e) {
+    case -ENOENT:
+        return "No such file or directory";
+    case -EINVAL:
+        return "Invalid argument";
+    default:
+        return "Unknown error";
+    }
+}
diff --git a/sys/errno.h b/sys/errno.h
index 40a837e..8c7bccf 100644
--- a/sys/errno.h
+++ b/sys/errno.h
@@ -35,3 +35,4 @@
 #define EDOM            33
 #define ERANGE          34
 
+const char *kstrerror(int e);
diff --git a/sys/vfs/tar.c b/sys/vfs/tar.c
index 3b4b15d..78e2566 100644
--- a/sys/vfs/tar.c
+++ b/sys/vfs/tar.c
@@ -225,8 +225,29 @@ static struct fs_class _tarfs = {
 
 // Vnode operations
 
-static int tarfs_vnode_stat(vnode_t *vnode, struct stat *st) {
-    return -ENOENT;
+static int tarfs_vnode_stat(vnode_t *vn, struct stat *st) {
+    _assert(vn && st);
+    _assert(vn->fs_data);
+    struct tarfs_vnode_attr *attr = (struct tarfs_vnode_attr *) vn->fs_data;
+
+    st->st_atime = 0;
+    st->st_mtime = 0;
+    st->st_ctime = 0;
+    st->st_dev = 0;
+    st->st_rdev = 0;
+
+    st->st_gid = attr->gid;
+    st->st_uid = attr->uid;
+    st->st_mode = (attr->type_perm & 0x1FF) | ((attr->type_perm & (1 << 16)) ? S_IFDIR : S_IFREG);
+
+    st->st_ino = (attr->block / 512) - 1;
+    st->st_nlink = 1;
+
+    st->st_blksize = 512;
+    st->st_blocks = (attr->size + 511) & ~511;
+    st->st_size = attr->size;
+
+    return 0;
 }
 
 static int tarfs_vnode_open(vnode_t *vnode, int opt) {
diff --git a/sys/vfs/vfs.c b/sys/vfs/vfs.c
index 69c317b..dd747b5 100644
--- a/sys/vfs/vfs.c
+++ b/sys/vfs/vfs.c
@@ -268,6 +268,7 @@ static int vfs_find_tree(struct vfs_node *root_node, const char *path, struct vf
         //      the vnode for the path element given
         vnode_t *child_vnode = NULL;
         struct vfs_node *child_node = NULL;
+        _assert(root_vnode->op && root_vnode->op->find);
 
         //printf("Calling op->find on %s\n", root_node->name);
         if ((res = root_vnode->op->find(root_vnode, path_element, &child_vnode)) != 0) {