Index: kernel/arch/ia64/src/mm/vhpt.c
===================================================================
--- kernel/arch/ia64/src/mm/vhpt.c	(revision 43dd8028069d3f1680a1f7a3f3ad25488e4fe07f)
+++ kernel/arch/ia64/src/mm/vhpt.c	(revision 26bc0fd10fa2579b9b192f6dd165b50194fcedc4)
@@ -42,9 +42,10 @@
 uintptr_t vhpt_set_up(void)
 {
-	vhpt_base = (vhpt_entry_t *)
-	    PA2KA(frame_alloc(SIZE2FRAMES(VHPT_SIZE), FRAME_ATOMIC, 0));
-	if (!vhpt_base)
+	uintptr_t vhpt_frame =
+	    frame_alloc(SIZE2FRAMES(VHPT_SIZE), FRAME_ATOMIC, 0);
+	if (!vhpt_frame)
 		panic("Kernel configured with VHPT but no memory for table.");
 	
+	vhpt_base = (vhpt_entry_t *) PA2KA(vhpt_frame);
 	vhpt_invalidate_all();
 	return (uintptr_t) vhpt_base;
Index: kernel/arch/sparc64/src/mm/sun4u/as.c
===================================================================
--- kernel/arch/sparc64/src/mm/sun4u/as.c	(revision 43dd8028069d3f1680a1f7a3f3ad25488e4fe07f)
+++ kernel/arch/sparc64/src/mm/sun4u/as.c	(revision 26bc0fd10fa2579b9b192f6dd165b50194fcedc4)
@@ -63,34 +63,30 @@
 {
 #ifdef CONFIG_TSB
+	uintptr_t tsb_phys =
+	    frame_alloc(SIZE2FRAMES((ITSB_ENTRY_COUNT + DTSB_ENTRY_COUNT) *
+	    sizeof(tsb_entry_t)), flags, 0);
+	if (!tsb_phys)
+		return -1;
+	
+	tsb_entry_t *tsb = (tsb_entry_t *) PA2KA(tsb_phys);
+	
+	as->arch.itsb = tsb;
+	as->arch.dtsb = tsb + ITSB_ENTRY_COUNT;
+	
+	memsetb(as->arch.itsb, (ITSB_ENTRY_COUNT + DTSB_ENTRY_COUNT) *
+	    sizeof(tsb_entry_t), 0);
+#endif
+	
+	return 0;
+}
+
+int as_destructor_arch(as_t *as)
+{
+#ifdef CONFIG_TSB
 	size_t frames = SIZE2FRAMES((ITSB_ENTRY_COUNT + DTSB_ENTRY_COUNT) *
 	    sizeof(tsb_entry_t));
-	
-	uintptr_t tsb = PA2KA(frame_alloc(frames, flags, 0));
-	if (!tsb)
-		return -1;
-	
-	as->arch.itsb = (tsb_entry_t *) tsb;
-	as->arch.dtsb = (tsb_entry_t *) (tsb +
-	    ITSB_ENTRY_COUNT * sizeof(tsb_entry_t));
-	
-	memsetb(as->arch.itsb,
-	    (ITSB_ENTRY_COUNT + DTSB_ENTRY_COUNT) * sizeof(tsb_entry_t), 0);
-#endif
-	
-	return 0;
-}
-
-int as_destructor_arch(as_t *as)
-{
-#ifdef CONFIG_TSB
-	/*
-	 * The count must be calculated with respect to the emualted 16K page
-	 * size.
-	 */
-	size_t cnt = ((ITSB_ENTRY_COUNT + DTSB_ENTRY_COUNT) *
-	    sizeof(tsb_entry_t)) >> FRAME_WIDTH;
-	frame_free(KA2PA((uintptr_t) as->arch.itsb));
-	
-	return cnt;
+	frame_free(KA2PA((uintptr_t) as->arch.itsb), frames);
+	
+	return frames;
 #else
 	return 0;
Index: kernel/arch/sparc64/src/mm/sun4v/as.c
===================================================================
--- kernel/arch/sparc64/src/mm/sun4v/as.c	(revision 43dd8028069d3f1680a1f7a3f3ad25488e4fe07f)
+++ kernel/arch/sparc64/src/mm/sun4v/as.c	(revision 26bc0fd10fa2579b9b192f6dd165b50194fcedc4)
@@ -66,8 +66,7 @@
 {
 #ifdef CONFIG_TSB
-	size_t frames =
-	    SIZE2FRAMES(TSB_ENTRY_COUNT * sizeof(tsb_entry_t));
-	
-	uintptr_t tsb = frame_alloc(frames, flags, 0);
+	uintptr_t tsb =
+	    frame_alloc(SIZE2FRAMES(TSB_ENTRY_COUNT * sizeof(tsb_entry_t)),
+	    flags, 0);
 	if (!tsb)
 		return -1;
@@ -91,8 +90,8 @@
 {
 #ifdef CONFIG_TSB
-	size_t cnt = (TSB_ENTRY_COUNT * sizeof(tsb_entry_t)) >> FRAME_WIDTH;
-	frame_free((uintptr_t) as->arch.tsb_description.tsb_base);
+	size_t frames = SIZE2FRAMES(TSB_ENTRY_COUNT * sizeof(tsb_entry_t));
+	frame_free(as->arch.tsb_description.tsb_base, frames);
 	
-	return cnt;
+	return frames;
 #else
 	return 0;
Index: kernel/generic/src/cpu/cpu.c
===================================================================
--- kernel/generic/src/cpu/cpu.c	(revision 43dd8028069d3f1680a1f7a3f3ad25488e4fe07f)
+++ kernel/generic/src/cpu/cpu.c	(revision 26bc0fd10fa2579b9b192f6dd165b50194fcedc4)
@@ -73,12 +73,15 @@
 		size_t i;
 		for (i = 0; i < config.cpu_count; i++) {
-			cpus[i].stack = (uint8_t *) PA2KA(frame_alloc(STACK_FRAMES,
-			    FRAME_LOWMEM | FRAME_ATOMIC, STACK_SIZE - 1));
+			uintptr_t stack_phys = frame_alloc(STACK_FRAMES,
+			    FRAME_LOWMEM | FRAME_ATOMIC, STACK_SIZE - 1);
+			if (!stack_phys)
+				panic("Cannot allocate CPU stack.");
+			
+			cpus[i].stack = (uint8_t *) PA2KA(stack_phys);
 			cpus[i].id = i;
 			
 			irq_spinlock_initialize(&cpus[i].lock, "cpus[].lock");
 			
-			unsigned int j;
-			for (j = 0; j < RQ_COUNT; j++) {
+			for (unsigned int j = 0; j < RQ_COUNT; j++) {
 				irq_spinlock_initialize(&cpus[i].rq[j].lock, "cpus[].rq[].lock");
 				list_initialize(&cpus[i].rq[j].rq);
Index: kernel/generic/src/mm/frame.c
===================================================================
--- kernel/generic/src/mm/frame.c	(revision 43dd8028069d3f1680a1f7a3f3ad25488e4fe07f)
+++ kernel/generic/src/mm/frame.c	(revision 26bc0fd10fa2579b9b192f6dd165b50194fcedc4)
@@ -374,4 +374,5 @@
 		return;
 	
+	frame->refcount = 1;
 	bitmap_set_range(&zone->bitmap, index, 1);
 	
Index: kernel/generic/src/mm/slab.c
===================================================================
--- kernel/generic/src/mm/slab.c	(revision 43dd8028069d3f1680a1f7a3f3ad25488e4fe07f)
+++ kernel/generic/src/mm/slab.c	(revision 26bc0fd10fa2579b9b192f6dd165b50194fcedc4)
@@ -182,8 +182,10 @@
 	size_t zone = 0;
 	
-	void *data = (void *)
-	    PA2KA(frame_alloc_generic(cache->frames, flags, 0, &zone));
-	if (!data)
+	uintptr_t data_phys =
+	    frame_alloc_generic(cache->frames, flags, 0, &zone);
+	if (!data_phys)
 		return NULL;
+	
+	void *data = (void *) PA2KA(data_phys);
 	
 	slab_t *slab;
Index: kernel/generic/src/proc/thread.c
===================================================================
--- kernel/generic/src/proc/thread.c	(revision 43dd8028069d3f1680a1f7a3f3ad25488e4fe07f)
+++ kernel/generic/src/proc/thread.c	(revision 26bc0fd10fa2579b9b192f6dd165b50194fcedc4)
@@ -192,7 +192,7 @@
 	kmflags &= ~FRAME_HIGHMEM;
 	
-	thread->kstack = (uint8_t *)
-	    PA2KA(frame_alloc(STACK_FRAMES, kmflags, STACK_SIZE - 1));
-	if (!thread->kstack) {
+	uintptr_t stack_phys =
+	    frame_alloc(STACK_FRAMES, kmflags, STACK_SIZE - 1);
+	if (!stack_phys) {
 #ifdef CONFIG_FPU
 		if (thread->saved_fpu_context)
@@ -201,4 +201,6 @@
 		return -1;
 	}
+	
+	thread->kstack = (uint8_t *) PA2KA(stack_phys);
 	
 #ifdef CONFIG_UDEBUG
Index: kernel/test/mm/falloc1.c
===================================================================
--- kernel/test/mm/falloc1.c	(revision 43dd8028069d3f1680a1f7a3f3ad25488e4fe07f)
+++ kernel/test/mm/falloc1.c	(revision 26bc0fd10fa2579b9b192f6dd165b50194fcedc4)
@@ -62,10 +62,8 @@
 			unsigned int allocated = 0;
 			for (unsigned int i = 0; i < (MAX_FRAMES / count); i++) {
-				frames[allocated] =
-				    PA2KA(frame_alloc(count, FRAME_ATOMIC, 0));
-				
-				if (frames[allocated])
+				frames[allocated] = frame_alloc(count, FRAME_ATOMIC, 0);
+				if (frames[allocated]) {
 					allocated++;
-				else {
+				} else {
 					TPRINTF("done. ");
 					break;
@@ -84,5 +82,5 @@
 			
 			for (unsigned int i = 0; i < allocated; i++)
-				frame_free(KA2PA(frames[i]), count);
+				frame_free(frames[i], count);
 			
 			TPRINTF("done.\n");
Index: kernel/test/mm/falloc2.c
===================================================================
--- kernel/test/mm/falloc2.c	(revision 43dd8028069d3f1680a1f7a3f3ad25488e4fe07f)
+++ kernel/test/mm/falloc2.c	(revision 26bc0fd10fa2579b9b192f6dd165b50194fcedc4)
@@ -74,8 +74,7 @@
 			unsigned int allocated = 0;
 			for (unsigned int i = 0; i < (MAX_FRAMES / count); i++) {
-				frames[allocated] =
-				    PA2KA(frame_alloc(count, FRAME_ATOMIC, 0));
+				frames[allocated] = frame_alloc(count, FRAME_ATOMIC, 0);
 				if (frames[allocated]) {
-					memsetb((void *) frames[allocated], bytes, val);
+					memsetb((void *) PA2KA(frames[allocated]), bytes, val);
 					allocated++;
 				} else
@@ -91,8 +90,8 @@
 			for (unsigned int i = 0; i < allocated; i++) {
 				for (size_t k = 0; k < bytes; k++) {
-					if (((uint8_t *) frames[i])[k] != val) {
+					if (((uint8_t *) PA2KA(frames[i]))[k] != val) {
 						TPRINTF("Thread #%" PRIu64 " (cpu%u): "
 						    "Unexpected data (%c) in block %zu offset %zu\n",
-						    THREAD->tid, CPU->id, ((char *) frames[i])[k],
+						    THREAD->tid, CPU->id, ((char *) PA2KA(frames[i]))[k],
 						    frames[i], k);
 						atomic_inc(&thread_fail);
@@ -100,5 +99,5 @@
 					}
 				}
-				frame_free(KA2PA(frames[i]), count);
+				frame_free(frames[i], count);
 			}