Index: kernel/arch/ia64/src/mm/tlb.c
===================================================================
--- kernel/arch/ia64/src/mm/tlb.c	(revision 0ff03f3a9f7a35d56bf50ddb10304d4fe756524d)
+++ kernel/arch/ia64/src/mm/tlb.c	(revision 22f05611fe61be707c3bee218be98f8f16f46f17)
@@ -52,6 +52,5 @@
 #include <arch.h>
 #include <interrupt.h>
-
-#define IO_FRAME_BASE 0xFFFFC000000
+#include <arch/legacyio.h>
 
 /** Invalidate all TLB entries. */
@@ -467,4 +466,13 @@
 }
 
+static bool is_kernel_fault(uintptr_t va)
+{
+	region_register_t rr;
+
+	rr.word = rr_read(VA2VRN(va));
+	rid_t rid = rr.map.rid;
+	return (RID2ASID(rid) == ASID_KERNEL) && (VA2VRN(va) == VRN_KERNEL);
+}
+
 /** Instruction TLB fault handler for faults with VHPT turned off.
  *
@@ -480,5 +488,6 @@
 	va = istate->cr_ifa; /* faulting address */
 	
-	page_table_lock(AS, true);
+	ASSERT(!is_kernel_fault(va));
+
 	t = page_mapping_find(AS, va, true);
 	if (t) {
@@ -488,10 +497,8 @@
 		 */
 		itc_pte_copy(t);
-		page_table_unlock(AS, true);
 	} else {
 		/*
 		 * Forward the page fault to address space page fault handler.
 		 */
-		page_table_unlock(AS, true);
 		if (as_page_fault(va, PF_ACCESS_EXEC, istate) == AS_PF_FAULT) {
 			fault_if_from_uspace(istate, "Page fault at %p.",
@@ -522,16 +529,16 @@
 static int try_memmap_io_insertion(uintptr_t va, istate_t *istate)
 {
-	if ((va >= IO_OFFSET ) && (va < IO_OFFSET + (1 << IO_PAGE_WIDTH))) {
+	if ((va >= LEGACYIO_USER_BASE) && (va < LEGACYIO_USER_BASE + (1 << LEGACYIO_PAGE_WIDTH))) {
 		if (TASK) {
-			uint64_t io_page = (va & ((1 << IO_PAGE_WIDTH) - 1)) >>
-			    USPACE_IO_PAGE_WIDTH;
+			uint64_t io_page = (va & ((1 << LEGACYIO_PAGE_WIDTH) - 1)) >>
+			    LEGACYIO_SINGLE_PAGE_WIDTH;
 			
 			if (is_io_page_accessible(io_page)) {
 				uint64_t page, frame;
 				
-				page = IO_OFFSET +
-				    (1 << USPACE_IO_PAGE_WIDTH) * io_page;
-				frame = IO_FRAME_BASE +
-				    (1 << USPACE_IO_PAGE_WIDTH) * io_page;
+				page = LEGACYIO_USER_BASE +
+				    (1 << LEGACYIO_SINGLE_PAGE_WIDTH) * io_page;
+				frame = LEGACYIO_PHYS_BASE +
+				    (1 << LEGACYIO_SINGLE_PAGE_WIDTH) * io_page;
 				
 				tlb_entry_t entry;
@@ -547,5 +554,5 @@
 				entry.ar = AR_READ | AR_WRITE;
 				entry.ppn = frame >> PPN_SHIFT;
-				entry.ps = USPACE_IO_PAGE_WIDTH;
+				entry.ps = LEGACYIO_SINGLE_PAGE_WIDTH;
 				
 				dtc_mapping_insert(page, TASK->as->asid, entry);
@@ -570,11 +577,11 @@
 {
 	if (istate->cr_isr.sp) {
-		/* Speculative load. Deffer the exception
-		   until a more clever approach can be used.
-		   
-		   Currently if we try to find the mapping
-		   for the speculative load while in the kernel,
-		   we might introduce a livelock because of
-		   the possibly invalid values of the address. */
+		/*
+		 * Speculative load. Deffer the exception until a more clever
+		 * approach can be used. Currently if we try to find the
+		 * mapping for the speculative load while in the kernel, we
+		 * might introduce a livelock because of the possibly invalid
+		 * values of the address.
+		 */
 		istate->cr_ipsr.ed = true;
 		return;
@@ -582,22 +589,20 @@
 	
 	uintptr_t va = istate->cr_ifa;  /* faulting address */
-	
-	region_register_t rr;
-	rr.word = rr_read(VA2VRN(va));
-	rid_t rid = rr.map.rid;
-	if (RID2ASID(rid) == ASID_KERNEL) {
-		if (VA2VRN(va) == VRN_KERNEL) {
+	as_t *as = AS;
+	
+	if (is_kernel_fault(va)) {
+		if (va < end_of_identity) {
 			/*
-			 * Provide KA2PA(identity) mapping for faulting piece of
-			 * kernel address space.
+			 * Create kernel identity mapping for low memory. 
 			 */
 			dtlb_kernel_mapping_insert(va, KA2PA(va), false, 0);
 			return;
+		} else {
+			as = AS_KERNEL;
 		}
 	}
 	
 	
-	page_table_lock(AS, true);
-	pte_t *entry = page_mapping_find(AS, va, true);
+	pte_t *entry = page_mapping_find(as, va, true);
 	if (entry) {
 		/*
@@ -606,7 +611,5 @@
 		 */
 		dtc_pte_copy(entry);
-		page_table_unlock(AS, true);
 	} else {
-		page_table_unlock(AS, true);
 		if (try_memmap_io_insertion(va, istate))
 			return;
@@ -647,9 +650,12 @@
 	uintptr_t va;
 	pte_t *t;
+	as_t *as = AS;
 	
 	va = istate->cr_ifa;  /* faulting address */
 	
-	page_table_lock(AS, true);
-	t = page_mapping_find(AS, va, true);
+	if (is_kernel_fault(va))
+		as = AS_KERNEL;
+
+	t = page_mapping_find(as, va, true);
 	ASSERT((t) && (t->p));
 	if ((t) && (t->p) && (t->w)) {
@@ -667,5 +673,4 @@
 		}
 	}
-	page_table_unlock(AS, true);
 }
 
@@ -682,6 +687,7 @@
 	
 	va = istate->cr_ifa;  /* faulting address */
-	
-	page_table_lock(AS, true);
+
+	ASSERT(!is_kernel_fault(va));
+	
 	t = page_mapping_find(AS, va, true);
 	ASSERT((t) && (t->p));
@@ -700,5 +706,4 @@
 		}
 	}
-	page_table_unlock(AS, true);
 }
 
@@ -713,9 +718,12 @@
 	uintptr_t va;
 	pte_t *t;
+	as_t *as = AS;
 	
 	va = istate->cr_ifa;  /* faulting address */
 	
-	page_table_lock(AS, true);
-	t = page_mapping_find(AS, va, true);
+	if (is_kernel_fault(va))
+		as = AS_KERNEL;
+
+	t = page_mapping_find(as, va, true);
 	ASSERT((t) && (t->p));
 	if ((t) && (t->p)) {
@@ -733,5 +741,4 @@
 		}
 	}
-	page_table_unlock(AS, true);
 }
 
@@ -748,9 +755,10 @@
 	
 	va = istate->cr_ifa;  /* faulting address */
+
+	ASSERT(!is_kernel_fault(va));
 	
 	/*
 	 * Assume a write to a read-only page.
 	 */
-	page_table_lock(AS, true);
 	t = page_mapping_find(AS, va, true);
 	ASSERT((t) && (t->p));
@@ -761,5 +769,4 @@
 		panic_memtrap(istate, PF_ACCESS_WRITE, va, NULL);
 	}
-	page_table_unlock(AS, true);
 }
 
@@ -777,5 +784,6 @@
 	va = istate->cr_ifa;  /* faulting address */
 	
-	page_table_lock(AS, true);
+	ASSERT(!is_kernel_fault(va));
+
 	t = page_mapping_find(AS, va, true);
 	ASSERT(t);
@@ -790,7 +798,5 @@
 		else
 			dtc_pte_copy(t);
-		page_table_unlock(AS, true);
 	} else {
-		page_table_unlock(AS, true);
 		if (as_page_fault(va, PF_ACCESS_READ, istate) == AS_PF_FAULT) {
 			fault_if_from_uspace(istate, "Page fault at %p.",
