diff --git a/kern/arch/x86/atomic.h b/kern/arch/x86/atomic.h
index 54dca37..dfe3583 100644
--- a/kern/arch/x86/atomic.h
+++ b/kern/arch/x86/atomic.h
@@ -107,6 +107,7 @@
 static inline bool atomic_sub_and_test(atomic_t *number, long val)
 {
 	bool b;
+	// XXX this this OK?
 	asm volatile("lock sub %2,%1; setz %0" : "=q"(b), "=m"(*number)
 	                                       : "r"(val), "m"(*number)
 	                                       : "cc" );
diff --git a/kern/drivers/dev/cbdma.c b/kern/drivers/dev/cbdma.c
index 8e3bbf8..e5cca42 100644
--- a/kern/drivers/dev/cbdma.c
+++ b/kern/drivers/dev/cbdma.c
@@ -145,6 +145,8 @@
 	/* You can poke this.  dma_sync_wait() also calls this. */
 	dma_async_issue_pending(dc);
 
+	// XXX cat cbd/ktest doesn't work when assigned to another process
+	// HERE NEXT 
 	if (async) {
 		/* Giant warning: the polling methods, like
 		 * dmaengine_tx_status(), might actually trigger the
diff --git a/kern/drivers/dev/iommu.c b/kern/drivers/dev/iommu.c
index 4b9019f..71f4c9c 100644
--- a/kern/drivers/dev/iommu.c
+++ b/kern/drivers/dev/iommu.c
@@ -550,6 +550,10 @@
 		pci_iter->iommu = iommu;
 		TAILQ_INSERT_TAIL(&iommu->pci_devs, pci_iter, iommu_link);
 	}
+
+	// XXX this means that we have some devices on the default IOMMU that
+	// shouldn't be...
+	// TODO: parse devscope and assign scoped iommus
 }
 
 /* This is called from acpi.c to initialize an iommu. */
@@ -642,6 +646,7 @@
 	struct pci_device *pdev;
 	struct sized_alloc *sza = sized_kzmalloc(BUFFERSZ, MEM_WAIT);
 
+	// XXX consider listing all PCI devices
 	TAILQ_FOREACH(iommu, &iommu_list, iommu_link) {
 		sza_printf(sza, "Mappings for iommu@%p\n", iommu);
 		spin_lock_irqsave(&iommu->iommu_lock);
diff --git a/kern/drivers/dma/ioat/init.c b/kern/drivers/dma/ioat/init.c
index cb9ae76..804e0b7 100644
--- a/kern/drivers/dma/ioat/init.c
+++ b/kern/drivers/dma/ioat/init.c
@@ -16,6 +16,8 @@
  *
  */
 
+#define DEV_DBG 1
+
 #include <linux_compat.h>
 #include <linux/sizes.h>
 
diff --git a/kern/include/env.h b/kern/include/env.h
index 4ddd46b..fea43fb 100644
--- a/kern/include/env.h
+++ b/kern/include/env.h
@@ -22,6 +22,7 @@
 #include <ns.h>
 #include <arch/vmm/vmm.h>
 #include <arch/pci.h>
+// XXX pci.h couldn't include.  pulled in too much via arena->rb->rcu->cv
 #include <dma.h>
 
 TAILQ_HEAD(vcore_tailq, vcore);
@@ -129,6 +130,7 @@
 
 	struct strace		*strace;
 
+	// XXX
 	qlock_t			dev_qlock;
 	struct list_head	iommus;
 	struct pcidev_tq	pci_devs;
diff --git a/kern/src/alarm.c b/kern/src/alarm.c
index 3ff6534..a000951 100644
--- a/kern/src/alarm.c
+++ b/kern/src/alarm.c
@@ -291,6 +291,24 @@
 	return ret;
 }
 
+// XXX these aren't threadsafe...  two people try to reset at the same time,
+// both unset, then both set.
+//
+// since they were racy before, might as well make them nosync too, since anyone
+// using them must have thought they were the only one using them.
+//
+// this (regardless of the race fix) does mean we'll have the alarm set again
+// while it is still running. 
+//
+// which means it might be able to go off again, concurrently. 
+//
+// which is a problem, since alarm handlers assume they are not
+// running concurrently with themselves.
+//
+// which means tchain->running could == an alarm on another core!
+//
+// if you knew you were submitting to the same tchain, then it'd be OK
+// 	and it is the same tchain.
 bool reset_alarm_abs(struct timer_chain *tchain, struct alarm_waiter *waiter,
                      uint64_t abs_time)
 {
diff --git a/kern/src/dma.c b/kern/src/dma.c
index 155a6d6..3c93053 100644
--- a/kern/src/dma.c
+++ b/kern/src/dma.c
@@ -228,6 +228,9 @@
 	struct proc *p = da->data;
 	void *uaddr;
 
+	/* XXX need a 'can't be munmapped by userspace' flag?  what was the deal
+	 * with that?  can make the kernel driver PF if they trash the mapping
+	 */
 	uaddr = mmap(p, 0, amt, PROT_READ | PROT_WRITE,
 		     MAP_ANONYMOUS | MAP_POPULATE | MAP_PRIVATE, -1, 0);
 
diff --git a/kern/src/mm.c b/kern/src/mm.c
index 648745a..fae424d 100644
--- a/kern/src/mm.c
+++ b/kern/src/mm.c
@@ -629,6 +629,7 @@
 	return 0;
 }
 
+// XXX pip hook / debug level for this (for when /proc/PID/maps is busted)
 void print_vmrs(struct proc *p)
 {
 	int count = 0;
diff --git a/user/vmm/vthread.c b/user/vmm/vthread.c
index 5262e60..49af5dc 100644
--- a/user/vmm/vthread.c
+++ b/user/vmm/vthread.c
@@ -174,15 +174,40 @@
 	int ret;
 	uintptr_t *stack, *tos;
 
+#if 0
 	ret = posix_memalign((void **)&stack, PGSIZE, DEFAULT_STACK_SIZE);
 	if (ret)
 		return 0;
+#else
+
+	// this works fine...  does/did it not work on some machines?
+	stack = mmap(0, DEFAULT_STACK_SIZE, PROT_READ | PROT_WRITE,
+		     MAP_ANONYMOUS | MAP_PRIVATE, -1, 0);
+	if (stack == MAP_FAILED)
+		return 0;
+#endif
+
+
 	add_pte_entries(vm, (uintptr_t)stack,
 	                (uintptr_t)stack + DEFAULT_STACK_SIZE);
+	// XXX why did i get here?  checking if IPT was mapped, since i thought
+	// that might be a UCBDMA bug?
+// XXX this is fucked up - we can PF later on, but don't have a handler.
+// so we're just as fucked.  we just avoid it since we touch the top.
+// so might as well make the stacks as big as you want.
+//
+// wait, why are we PFing?  if we touch it here, we bring it in to the EPT.
+// might be that old bug that zach ran into?
+//
+// 	yeah, that is unnecessary.  the only reason to do it is for faster perf,
+// 	not for correctness
+//
+// also, we never free these.  though we also never free vthrs.  reuse,
+// etc.
 	/* touch the top word on the stack so we don't page fault
 	 * on that in the VM. */
 	tos = &stack[DEFAULT_STACK_SIZE / sizeof(uint64_t) - 1];
-	*tos = 0;
+	//*tos = 0;
 	return (uintptr_t)tos;
 }