diff --git a/include/proto.h b/include/proto.h
index 2eeaa4e..b83b3b1 100644
--- a/include/proto.h
+++ b/include/proto.h
@@ -92,7 +92,7 @@ int sys_get_ticks();             /* sys_call */
 int sys_get_pid();               // add by visual 2016.4.6
 void *sys_kmalloc(int size);     // edit by visual 2016.5.9
 void *sys_kmalloc_4k();          // edit by visual 2016.5.9
-void *sys_malloc(int size);      // edit by visual 2016.5.9
+void *sys_malloc(void* uesp);      // edit by visual 2016.5.9
 void *sys_malloc_4k();           // edit by visual 2016.5.9
 int sys_free(void *arg);         // edit by visual 2016.5.9
 int sys_free_4k(void *AdddrLin); // edit by visual 2016.5.9
diff --git a/kernel/fbcon.c b/kernel/fbcon.c
index b9796d1..81f21f5 100644
--- a/kernel/fbcon.c
+++ b/kernel/fbcon.c
@@ -34,8 +34,11 @@ static uint32_t* _fb = NULL;
 static uint32_t* cur_fb = NULL;
 static volatile int framecnt = 0;
 static char* textbuf;
+volatile u32 buflock;
+
 #define UNIT_CHAR_H (_fnt_char_height * _fbscale)
 #define UNIT_CHAR_W (_fnt_char_width * _fbscale)
+#define INDEX(row, col, mx) ((row) * (mx) + (col))
 
 #include "font8x8.h"
 static void fast_copy(void* dst, void* src, int len);
@@ -70,6 +73,11 @@ static void fbcon_scroll() {
     memset((void*)cur_fb + _fbbufsize - lineoffset, 0, lineoffset);
 }
 
+static void textbuf_scroll() {
+    memcpy((void*) textbuf, (void*)textbuf + _scr_max_cols, (_scr_max_rows-1)*_scr_max_cols);
+    memset((void*)textbuf + (_scr_max_rows-1)*_scr_max_cols, ' ', _scr_max_cols);
+}
+
 static void fbcon_putchar(char ch) {
     switch (ch)
 	{
@@ -77,7 +85,7 @@ static void fbcon_putchar(char ch) {
 		cur_row ++;
 		cur_col = 0;
 		if (cur_row >= _scr_max_rows) {
-			fbcon_scroll();
+			textbuf_scroll();
 			cur_row --;
 		}
 		break;
@@ -94,7 +102,7 @@ static void fbcon_putchar(char ch) {
 		}
 		break;
 	default:
-		fbcon_draw_raw(cur_row, cur_col, ch);
+		textbuf[INDEX(cur_row, cur_col, _scr_max_cols)] = ch;
 		cur_col ++;
 		if (cur_col >= _scr_max_cols) {
 			cur_col = 0;
@@ -102,17 +110,13 @@ static void fbcon_putchar(char ch) {
 		}
 
 		if (cur_row >= _scr_max_rows) {
-			fbcon_scroll();
+			textbuf_scroll();
 			cur_row --;
 		}
 		break;
 	}
 }
 
-volatile u32 buflock;
-static char _buf1[TTY_IN_BYTES];
-ringbuf_t writebuf;
-
 int screen_setup() {
     cur_col = 0;
     cur_row = 0;
@@ -124,46 +128,27 @@ int screen_setup() {
     _fbheight = bga_ioctl(BGA_GET_HEIGHT, 0);
     _fbpixels_per_row = _fbwidth;
     _fbbufsize = _fbwidth * _fbheight * 4;
-    kprintf("bufsz = %p\n", _fbbufsize);
     _fbscale = 2;
     cur_fb = _fb;
     _scr_max_cols = _fbwidth / _fnt_char_width / _fbscale;
     _scr_max_rows = _fbheight / _fnt_char_height / _fbscale;
+    kprintf("bufsz = %p, maxsize(%d, %d)\n", _fbbufsize, _scr_max_rows, _scr_max_cols);
 
     _basecolor = 0;
     cursor_blink = 1;
-    writebuf.buf = &_buf1;
-    writebuf.head = writebuf.tail = writebuf.size = 0;
-    writebuf.maxsize = TTY_IN_BYTES;
     framecnt = 0;
-    
+    textbuf = (char*)malloc(_scr_max_cols * _scr_max_rows);
+    memset(textbuf, ' ', _scr_max_cols * _scr_max_rows);
     return 0;
 }
 
-static inline void bufpush(ringbuf_t* buf, char data) {
-    ((char*)buf->buf)[buf->tail] = data;
-    buf->tail = NEXT(buf->tail, buf->maxsize);
-    if (buf->head == buf->tail)
-        buf->head = NEXT(buf->head, buf->maxsize);
-    else
-        buf->size++;
-}
-
-static inline char bufpop(ringbuf_t* buf) {
-    if (buf->size == 0) return -1;
-    char retval = ((char*)buf->buf)[buf->head];
-    buf->head = NEXT(buf->head, buf->maxsize);
-    buf->size--;
-    return retval;
-}
 
 static void do_fbcon_write(char* buf, int nr) {
-    while (xchg(&buflock, 1) == 1)
-        sys_yield();
+    disable_int();
     while (nr--) {
-        bufpush(&writebuf, *buf++);
+        fbcon_putchar(*buf++);
     }
-    xchg(&buflock, 0);
+    enable_int();
 }
 
 void fbcon_tty_write(NTTY* tty, char ch) {
@@ -199,6 +184,14 @@ static void fast_copy(void* dst, void* src, int len) {
     }
 }
 
+static void textbuf_render() {
+    for (int row = 0; row < _scr_max_rows; ++ row) {
+        for (int col = 0; col < _scr_max_cols; ++ col) {
+            fbcon_draw_raw(row, col, textbuf[INDEX(row, col, _scr_max_cols)]);
+        }
+    }
+}
+
 void task_tty() {
     // main rountine for drawing framebuffered console
     screen_setup();
@@ -207,14 +200,11 @@ void task_tty() {
     // fbcon_write(text1, strlen(text1));
     int cur_buf = 0, last_buf = 1;
     while (1) {
-        fast_copy((void*)_fb + cur_buf * _fbbufsize, (void*)_fb + last_buf * _fbbufsize, _fbbufsize);
+        // fast_copy((void*)_fb + cur_buf * _fbbufsize, (void*)_fb + last_buf * _fbbufsize, _fbbufsize);
         draw_cursor_clear();
         while (xchg(&buflock, 1) == 1)
             yield();
-        while (writebuf.size) {
-            char ch = bufpop(&writebuf);
-            fbcon_putchar(ch);
-        }
+        textbuf_render();
         xchg(&buflock, 0);
         blink_ctrl();
         if (cursor_blink)
diff --git a/kernel/syscall.asm b/kernel/syscall.asm
index 85e3d2c..826c2f5 100644
--- a/kernel/syscall.asm
+++ b/kernel/syscall.asm
@@ -113,13 +113,13 @@ get_pid:
 ; ; ====================================================================
 ; ;                              malloc		//add by visual 2016.4.7
 ; ; ====================================================================
-; malloc:
-; 	push	ebx
-; 	mov	ebx,[esp+4] ; 将C函数调用时传来的参数放到ebx里!!111
-; 	mov	eax, _NR_malloc
-; 	int	INT_VECTOR_SYS_CALL
-; 	pop	ebx
-; 	ret
+malloc:
+	push	ebx
+	mov	ebx, esp ; 将C函数调用时传来的参数放到ebx里!!111
+	mov	eax, _NR_malloc
+	int	INT_VECTOR_SYS_CALL
+	pop	ebx
+	ret
 	
 ; ; ====================================================================
 ; ;                              malloc_4k		//add by visual 2016.4.7
diff --git a/kernel/syscallc.c b/kernel/syscallc.c
index 9039235..bc994e7 100644
--- a/kernel/syscallc.c
+++ b/kernel/syscallc.c
@@ -51,19 +51,19 @@ void *sys_kmalloc_4k()
 /*======================================================================*
 						   sys_malloc		edit by visual 2016.5.4
  *======================================================================*/
-void *sys_malloc(int size)
+void *sys_malloc(void* uesp)
 {
-	int vir_addr, AddrLin;
-	vir_addr = vmalloc(size);
+	// int vir_addr, AddrLin;
+	void* vir_addr = K_PHY2LIN(sys_kmalloc(get_arg(uesp, 1)));
 
-	for (AddrLin = vir_addr; AddrLin < vir_addr + size; AddrLin += num_4B) // 一个字节一个字节处理
-	{
-		lin_mapping_phy(AddrLin,				  // 线性地址					//add by visual 2016.5.9
-						MAX_UNSIGNED_INT,		  // 物理地址						//edit by visual 2016.5.19
-						p_proc_current->task.pid, // 进程pid				//edit by visual 2016.5.19
-						PG_P | PG_USU | PG_RWW,	  // 页目录的属性位
-						PG_P | PG_USU | PG_RWW);  // 页表的属性位
-	}
+	// for (AddrLin = vir_addr; AddrLin < vir_addr + size; AddrLin += num_4B) // 一个字节一个字节处理
+	// {
+	// 	lin_mapping_phy(AddrLin,				  // 线性地址					//add by visual 2016.5.9
+	// 					MAX_UNSIGNED_INT,		  // 物理地址						//edit by visual 2016.5.19
+	// 					p_proc_current->task.pid, // 进程pid				//edit by visual 2016.5.19
+	// 					PG_P | PG_USU | PG_RWW,	  // 页目录的属性位
+	// 					PG_P | PG_USU | PG_RWW);  // 页表的属性位
+	// }
 	return (void *)vir_addr;
 }