Index: kernel/generic/src/mm/backend_elf.c
===================================================================
--- kernel/generic/src/mm/backend_elf.c	(revision de0af3afebf0198d5752b631cae05c2546287398)
+++ kernel/generic/src/mm/backend_elf.c	(revision ca4c5596d25d61385c705f462b32f0bdef2c681b)
@@ -153,6 +153,6 @@
 {
 	elf_segment_header_t *entry = area->backend_data.segment;
-	link_t *cur;
-	btree_node_t *leaf, *node;
+	used_space_ival_t *start;
+	used_space_ival_t *cur;
 	uintptr_t start_anon = entry->p_vaddr + entry->p_filesz;
 
@@ -164,11 +164,8 @@
 	 */
 	if (area->flags & AS_AREA_WRITE) {
-		node = list_get_instance(list_first(&area->used_space.leaf_list),
-		    btree_node_t, leaf_link);
+		start = used_space_first(&area->used_space);
 	} else {
-		(void) btree_search(&area->used_space, start_anon, &leaf);
-		node = btree_leaf_node_left_neighbour(&area->used_space, leaf);
-		if (!node)
-			node = leaf;
+		/* Find first interval containing addresses >= start_anon */
+		start = used_space_find_gteq(&area->used_space, start_anon);
 	}
 
@@ -177,57 +174,53 @@
 	 */
 	mutex_lock(&area->sh_info->lock);
-	for (cur = &node->leaf_link; cur != &area->used_space.leaf_list.head;
-	    cur = cur->next) {
+	cur = start;
+	while (cur != NULL) {
+		uintptr_t base = cur->page;
+		size_t count = cur->count;
 		unsigned int i;
 
-		node = list_get_instance(cur, btree_node_t, leaf_link);
-
-		for (i = 0; i < node->keys; i++) {
-			uintptr_t base = node->key[i];
-			size_t count = (size_t) node->value[i];
-			unsigned int j;
+		/*
+		 * Skip read-only areas of used space that are backed
+		 * by the ELF image.
+		 */
+		if (!(area->flags & AS_AREA_WRITE))
+			if (base >= entry->p_vaddr &&
+			    base + P2SZ(count) <= start_anon)
+				continue;
+
+		for (i = 0; i < count; i++) {
+			pte_t pte;
+			bool found;
 
 			/*
-			 * Skip read-only areas of used space that are backed
-			 * by the ELF image.
+			 * Skip read-only pages that are backed by the
+			 * ELF image.
 			 */
 			if (!(area->flags & AS_AREA_WRITE))
 				if (base >= entry->p_vaddr &&
-				    base + P2SZ(count) <= start_anon)
+				    base + P2SZ(i + 1) <= start_anon)
 					continue;
 
-			for (j = 0; j < count; j++) {
-				pte_t pte;
-				bool found;
-
-				/*
-				 * Skip read-only pages that are backed by the
-				 * ELF image.
-				 */
-				if (!(area->flags & AS_AREA_WRITE))
-					if (base >= entry->p_vaddr &&
-					    base + P2SZ(j + 1) <= start_anon)
-						continue;
-
-				page_table_lock(area->as, false);
-				found = page_mapping_find(area->as,
-				    base + P2SZ(j), false, &pte);
-
-				(void) found;
-				assert(found);
-				assert(PTE_VALID(&pte));
-				assert(PTE_PRESENT(&pte));
-
-				as_pagemap_insert(&area->sh_info->pagemap,
-				    (base + P2SZ(j)) - area->base,
-				    PTE_GET_FRAME(&pte));
-				page_table_unlock(area->as, false);
-
-				pfn_t pfn = ADDR2PFN(PTE_GET_FRAME(&pte));
-				frame_reference_add(pfn);
-			}
-
+			page_table_lock(area->as, false);
+			found = page_mapping_find(area->as,
+			    base + P2SZ(i), false, &pte);
+
+			(void) found;
+			assert(found);
+			assert(PTE_VALID(&pte));
+			assert(PTE_PRESENT(&pte));
+
+			as_pagemap_insert(&area->sh_info->pagemap,
+			    (base + P2SZ(i)) - area->base,
+			    PTE_GET_FRAME(&pte));
+			page_table_unlock(area->as, false);
+
+			pfn_t pfn = ADDR2PFN(PTE_GET_FRAME(&pte));
+			frame_reference_add(pfn);
 		}
-	}
+
+		cur = used_space_next(cur);
+	}
+
 	mutex_unlock(&area->sh_info->lock);
 }
@@ -310,5 +303,5 @@
 			page_mapping_insert(AS, upage, frame,
 			    as_area_get_flags(area));
-			if (!used_space_insert(area, upage, 1))
+			if (!used_space_insert(&area->used_space, upage, 1))
 				panic("Cannot insert used space.");
 			mutex_unlock(&area->sh_info->lock);
@@ -405,5 +398,5 @@
 
 	page_mapping_insert(AS, upage, frame, as_area_get_flags(area));
-	if (!used_space_insert(area, upage, 1))
+	if (!used_space_insert(&area->used_space, upage, 1))
 		panic("Cannot insert used space.");
 
