diff --git a/ch4/user/src/bin/00power_3.rs b/ch4/user/src/bin/00power_3.rs
index f5f5adc..b3e4185 100644
--- a/ch4/user/src/bin/00power_3.rs
+++ b/ch4/user/src/bin/00power_3.rs
@@ -1,28 +1,28 @@
 #![no_std]
 #![no_main]
 
-#[macro_use]
-extern crate user_lib;
+use user_lib::*;
 
 const LEN: usize = 100;
 
+static mut S: [u64; LEN] = [0u64; LEN];
+
 #[no_mangle]
-fn main() -> i32 {
+unsafe fn main() -> i32 {
     let p = 3u64;
     let m = 998244353u64;
-    let iter: usize = 20000000;
-    let mut s = [0u64; LEN];
+    let iter: usize = 300000;
     let mut cur = 0usize;
-    s[cur] = 1;
+    S[cur] = 1;
     for i in 1..=iter {
         let next = if cur + 1 == LEN { 0 } else { cur + 1 };
-        s[next] = s[cur] * p % m;
+        S[next] = S[cur] * p % m;
         cur = next;
-        if i % 1000000 == 0 {
+        if i % 10000 == 0 {
             println!("power_3 [{}/{}]", i, iter);
         }
     }
-    println!("{}^{} = {}(MOD {})", p, iter, s[cur], m);
+    println!("{}^{} = {}(MOD {})", p, iter, S[cur], m);
     println!("Test power_3 OK!");
     0
-}
+}
\ No newline at end of file
diff --git a/ch4/user/src/bin/01power_5.rs b/ch4/user/src/bin/01power_5.rs
index 85edaf1..f6c94c5 100644
--- a/ch4/user/src/bin/01power_5.rs
+++ b/ch4/user/src/bin/01power_5.rs
@@ -1,28 +1,28 @@
 #![no_std]
 #![no_main]
 
-#[macro_use]
-extern crate user_lib;
+use user_lib::*;
 
 const LEN: usize = 100;
 
+static mut S: [u64; LEN] = [0u64; LEN];
+
 #[no_mangle]
-fn main() -> i32 {
+unsafe fn main() -> i32 {
     let p = 5u64;
     let m = 998244353u64;
-    let iter: usize = 14000000;
-    let mut s = [0u64; LEN];
+    let iter: usize = 210000;
     let mut cur = 0usize;
-    s[cur] = 1;
+    S[cur] = 1;
     for i in 1..=iter {
         let next = if cur + 1 == LEN { 0 } else { cur + 1 };
-        s[next] = s[cur] * p % m;
+        S[next] = S[cur] * p % m;
         cur = next;
-        if i % 1000000 == 0 {
+        if i % 10000 == 0 {
             println!("power_5 [{}/{}]", i, iter);
         }
     }
-    println!("{}^{} = {}(MOD {})", p, iter, s[cur], m);
+    println!("{}^{} = {}(MOD {})", p, iter, S[cur], m);
     println!("Test power_5 OK!");
     0
-}
+}
\ No newline at end of file
diff --git a/ch4/user/src/bin/02power_7.rs b/ch4/user/src/bin/02power_7.rs
deleted file mode 100644
index b4e20af..0000000
--- a/ch4/user/src/bin/02power_7.rs
+++ /dev/null
@@ -1,28 +0,0 @@
-#![no_std]
-#![no_main]
-
-#[macro_use]
-extern crate user_lib;
-
-const LEN: usize = 100;
-
-#[no_mangle]
-fn main() -> i32 {
-    let p = 7u64;
-    let m = 998244353u64;
-    let iter: usize = 16000000;
-    let mut s = [0u64; LEN];
-    let mut cur = 0usize;
-    s[cur] = 1;
-    for i in 1..=iter {
-        let next = if cur + 1 == LEN { 0 } else { cur + 1 };
-        s[next] = s[cur] * p % m;
-        cur = next;
-        if i % 1000000 == 0 {
-            println!("power_7 [{}/{}]", i, iter);
-        }
-    }
-    println!("{}^{} = {}(MOD {})", p, iter, s[cur], m);
-    println!("Test power_7 OK!");
-    0
-}
diff --git a/ch4/user/src/bin/04loop.rs b/ch4/user/src/bin/02sleep.rs
similarity index 63%
rename from ch4/user/src/bin/04loop.rs
rename to ch4/user/src/bin/02sleep.rs
index 094066a..15bafda 100644
--- a/ch4/user/src/bin/04loop.rs
+++ b/ch4/user/src/bin/02sleep.rs
@@ -1,18 +1,16 @@
 #![no_std]
 #![no_main]
 
-#[macro_use]
-extern crate user_lib;
-
-use user_lib::syscall::{sys_get_time, sys_yield};
+use user_lib::*;
+use user_lib::syscall::*;
 
 #[no_mangle]
 fn main() -> i32 {
     let current_timer = sys_get_time();
     let wait_for = current_timer + 3000;
-    loop {
-
+    while sys_get_time() < wait_for {
+        sys_yield();
     }
     println!("Test sleep OK!");
     0
-}
+}
\ No newline at end of file
diff --git a/ch4/user/src/bin/03load_fault.rs b/ch4/user/src/bin/03load_fault.rs
new file mode 100644
index 0000000..811058c
--- /dev/null
+++ b/ch4/user/src/bin/03load_fault.rs
@@ -0,0 +1,18 @@
+#![no_std]
+#![no_main]
+
+use user_lib::*;
+
+use core::ptr::{null_mut, read_volatile};
+
+#[no_mangle]
+fn main() -> i32 {
+    return 0;
+    // println!("\nload_fault APP running...\n");
+    // println!("Into Test load_fault, we will insert an invalid load operation...");
+    // println!("Kernel should kill this application!");
+    // unsafe {
+    //     let _i = read_volatile(null_mut::<u8>());
+    // }
+    // 0
+}
\ No newline at end of file
diff --git a/ch4/user/src/bin/03sleep.rs b/ch4/user/src/bin/03sleep.rs
deleted file mode 100644
index 5e002ba..0000000
--- a/ch4/user/src/bin/03sleep.rs
+++ /dev/null
@@ -1,18 +0,0 @@
-#![no_std]
-#![no_main]
-
-#[macro_use]
-extern crate user_lib;
-
-use user_lib::syscall::{sys_get_time, sys_yield};
-
-#[no_mangle]
-fn main() -> i32 {
-    let current_timer = sys_get_time();
-    let wait_for = current_timer + 3000;
-    while sys_get_time() < wait_for {
-        // sys_yield();  loop太快,防止每次切换时间小于1ms, 这里注释, 但是还是不对, 模拟器的时间不准,cpu频率不对, 这个用户应用统计的怎么都不够3000ms
-    }
-    println!("Test sleep OK!");
-    0
-}
diff --git a/ch4/user/src/bin/05store_fault.rs b/ch4/user/src/bin/05store_fault.rs
new file mode 100644
index 0000000..4d702d1
--- /dev/null
+++ b/ch4/user/src/bin/05store_fault.rs
@@ -0,0 +1,16 @@
+#![no_std]
+#![no_main]
+use core::ptr::{null_mut, read_volatile};
+use user_lib::*;
+
+#[no_mangle]
+fn main() -> i32 {
+    return 0;
+    // println!("\nload_fault APP running...\n");
+    // println!("Into Test load_fault, we will insert an invalid load operation...");
+    // println!("Kernel should kill this application!");
+    // unsafe {
+    //     let _i = read_volatile(null_mut::<u8>());
+    // }
+    // 0
+}
\ No newline at end of file
diff --git a/ch4/user/src/bin/06sbrk_test.rs b/ch4/user/src/bin/06sbrk_test.rs
new file mode 100644
index 0000000..dd75b40
--- /dev/null
+++ b/ch4/user/src/bin/06sbrk_test.rs
@@ -0,0 +1,46 @@
+#![no_std]
+#![no_main]
+
+use core::ptr::slice_from_raw_parts_mut;
+use user_lib::*;
+
+#[no_mangle]
+fn main() -> i32 {
+    return 0;
+    // println!("Test sbrk start.");
+    // const PAGE_SIZE: usize = 0x1000;
+    // let origin_brk = sbrk(0);
+    // println!("origin break point = {:x}", origin_brk);
+    // let brk = sbrk(PAGE_SIZE as i32);
+    // if brk != origin_brk {
+    //     return -1;
+    // }
+    // let brk = sbrk(0);
+    // println!("one page allocated,  break point = {:x}", brk);
+    // println!("try write to allocated page");
+    // let new_page = unsafe {
+    //     &mut *slice_from_raw_parts_mut(origin_brk as usize as *const u8 as *mut u8, PAGE_SIZE)
+    // };
+    // for pos in 0..PAGE_SIZE {
+    //     new_page[pos] = 1;
+    // }
+    // println!("write ok");
+    // sbrk(PAGE_SIZE as i32 * 10);
+    // let brk = sbrk(0);
+    // println!("10 page allocated,  break point = {:x}", brk);
+    // sbrk(PAGE_SIZE as i32 * -11);
+    // let brk = sbrk(0);
+    // println!("11 page DEALLOCATED,  break point = {:x}", brk);
+    // println!("try DEALLOCATED more one page, should be failed.");
+    // let ret = sbrk(PAGE_SIZE as i32 * -1);
+    // if ret != -1 {
+    //     println!("Test sbrk failed!");
+    //     return -1;
+    // }
+    // println!("Test sbrk almost OK!");
+    // println!("now write to deallocated page, should cause page fault.");
+    // for pos in 0..PAGE_SIZE {
+    //     new_page[pos] = 2;
+    // }
+    // 0
+}
\ No newline at end of file
diff --git a/ch4/user/src/lib.rs b/ch4/user/src/lib.rs
index 23b813a..8ec796b 100644
--- a/ch4/user/src/lib.rs
+++ b/ch4/user/src/lib.rs
@@ -7,19 +7,13 @@ pub mod user_lang_items;
 pub use user_lang_items::*;
 
 pub mod syscall;
-use syscall::{sys_exit};
-
-extern "C" {
-    fn start_bss();
-    fn end_bss();
-}
+use syscall::*;
 
 
 // 只要使用这个包, 那么这里就会作为bin程序的开始
 #[no_mangle]
 #[link_section = ".text.entry"]  // 链接到指定的段
 pub extern "C" fn _start() -> ! {
-    clear_bss();
     sys_exit(main());  // 这里执行的main程序是我们 bin文件夹里面的main, 而不是下面的, 下面的main程序只有在bin程序没有main函数的时候才会链接
     // 正常是不会走到这一步的, 因为上面已经退出了程序
     panic!("unreachable after sys_exit!");
@@ -30,9 +24,3 @@ pub extern "C" fn _start() -> ! {
 fn main() -> i32 {
     panic!("Cannot find main!");
 }
-
-fn clear_bss() {
-    unsafe {
-        (start_bss as usize..end_bss as usize).for_each(|p| (p as *mut u8).write_unaligned(0))
-    };
-}