Index: generic/include/ipc/ipc.h
===================================================================
--- generic/include/ipc/ipc.h	(revision 00b595b1f3d16136f64efb0f31c35648430b4447)
+++ generic/include/ipc/ipc.h	(revision 46fc2f9324ff6ec5e31b68cb451363c2e7a3c050)
@@ -43,5 +43,5 @@
 					* userspace, will be discarded */
 #define IPC_CALL_FORWARDED      (1<<3) /* Call was forwarded */
-#define IPC_CALL_CONN_ME_TO     (1<<4) /* Identify connect_me_to */
+#define IPC_CALL_CONN_ME_TO     (1<<4) /* Identify connect_me_to answer */
 #define IPC_CALL_NOTIF          (1<<5) /* Interrupt notification */
 
@@ -120,10 +120,23 @@
 /** Interrupt notification */
 #define IPC_M_INTERRUPT         4
+
 /** Send as_area over IPC 
- * - ARG2 - src base address
- * - ARG3 - size of src as(filled automatically by kernel)
+ * - ARG1 - src base address
+ * - ARG2 - size of src as(filled automatically by kernel)
+ * - ARG3 - flags of the area being sent
  * - on answer ARG1 - dst base adress
  */
 #define IPC_M_AS_AREA_SEND      5
+
+/** Get as_area over IPC
+ * - ARG1 - Where the area will be mapped
+ * - ARG2 - Expected size of area
+ * - ARG3 - Requested rights for the area
+ * on answer - the server sets ARG1 as src as address of the as_area
+ * to be shared
+ *
+ *
+ */
+#define IPC_M_AS_AREA_RECV      6
 
 
Index: generic/include/mm/as.h
===================================================================
--- generic/include/mm/as.h	(revision 00b595b1f3d16136f64efb0f31c35648430b4447)
+++ generic/include/mm/as.h	(revision 46fc2f9324ff6ec5e31b68cb451363c2e7a3c050)
@@ -169,6 +169,6 @@
 extern void as_switch(as_t *old, as_t *new);
 extern void as_free(as_t *as);
-extern int as_area_share(as_t *src_as, __address src_base, size_t acc_size,
-	__address dst_base, int dst_flags_mask);
+int as_area_share(as_t *src_as, __address src_base, size_t acc_size,
+		  as_t *dst_as, __address dst_base, int dst_flags_mask);
 extern size_t as_get_size(__address base);
 extern int used_space_insert(as_area_t *a, __address page, count_t count);
Index: generic/include/mm/slab.h
===================================================================
--- generic/include/mm/slab.h	(revision 00b595b1f3d16136f64efb0f31c35648430b4447)
+++ generic/include/mm/slab.h	(revision 46fc2f9324ff6ec5e31b68cb451363c2e7a3c050)
@@ -39,5 +39,5 @@
 
 /** Maximum size to be allocated by malloc */
-#define SLAB_MAX_MALLOC_W 17
+#define SLAB_MAX_MALLOC_W 18
 
 /** Initial Magazine size (TODO: dynamically growing magazines) */
Index: generic/src/ipc/sysipc.c
===================================================================
--- generic/src/ipc/sysipc.c	(revision 00b595b1f3d16136f64efb0f31c35648430b4447)
+++ generic/src/ipc/sysipc.c	(revision 46fc2f9324ff6ec5e31b68cb451363c2e7a3c050)
@@ -65,5 +65,6 @@
 static inline int is_forwardable(__native method)
 {
-	if (method == IPC_M_PHONE_HUNGUP || method == IPC_M_AS_AREA_SEND)
+	if (method == IPC_M_PHONE_HUNGUP || method == IPC_M_AS_AREA_SEND \
+	    || method == IPC_M_AS_AREA_RECV)
 		return 0; /* This message is meant only for the receiver */
 	return 1;
@@ -86,8 +87,13 @@
 	if (IPC_GET_METHOD(call->data) == IPC_M_AS_AREA_SEND)
 		return 1;
-	return 0;
-}
-
-/** Interpret process answer as control information */
+	if (IPC_GET_METHOD(call->data) == IPC_M_AS_AREA_RECV)
+		return 1;
+	return 0;
+}
+
+/** Interpret process answer as control information
+ *
+ * This function is called directly after sys_ipc_answer 
+ */
 static inline int answer_preprocess(call_t *answer, ipc_data_t *olddata)
 {
@@ -140,5 +146,19 @@
 			
 			return as_area_share(as, IPC_GET_ARG1(*olddata), IPC_GET_ARG2(*olddata),
-				IPC_GET_ARG1(answer->data), IPC_GET_ARG3(*olddata));
+					     AS, IPC_GET_ARG1(answer->data), IPC_GET_ARG3(*olddata));
+		}
+	} else if (IPC_GET_METHOD(*olddata) == IPC_M_AS_AREA_RECV) {
+		if (!IPC_GET_RETVAL(answer->data)) { 
+			ipl_t ipl;
+			as_t *as;
+			
+			ipl = interrupts_disable();
+			spinlock_lock(&answer->sender->lock);
+			as = answer->sender->as;
+			spinlock_unlock(&answer->sender->lock);
+			interrupts_restore(ipl);
+			
+			return as_area_share(AS, IPC_GET_ARG1(answer->data), IPC_GET_ARG2(*olddata),
+					     as, IPC_GET_ARG1(*olddata), IPC_GET_ARG3(*olddata));
 		}
 	}
Index: generic/src/mm/as.c
===================================================================
--- generic/src/mm/as.c	(revision 00b595b1f3d16136f64efb0f31c35648430b4447)
+++ generic/src/mm/as.c	(revision 46fc2f9324ff6ec5e31b68cb451363c2e7a3c050)
@@ -457,4 +457,5 @@
  * @param src_base Base address of the source address space area.
  * @param acc_size Expected size of the source area.
+ * @param dst_as Pointer to destination address space.
  * @param dst_base Target base address.
  * @param dst_flags_mask Destination address space area flags mask.
@@ -468,5 +469,5 @@
  */
 int as_area_share(as_t *src_as, __address src_base, size_t acc_size,
-		  __address dst_base, int dst_flags_mask)
+		  as_t *dst_as, __address dst_base, int dst_flags_mask)
 {
 	ipl_t ipl;
@@ -544,5 +545,5 @@
 	 * to support sharing in less privileged mode.
 	 */
-	dst_area = as_area_create(AS, src_flags & dst_flags_mask, src_size, dst_base,
+	dst_area = as_area_create(dst_as, src_flags & dst_flags_mask, src_size, dst_base,
 				  AS_AREA_ATTR_PARTIAL, src_backend, &src_backend_data);
 	if (!dst_area) {
Index: generic/src/mm/slab.c
===================================================================
--- generic/src/mm/slab.c	(revision 00b595b1f3d16136f64efb0f31c35648430b4447)
+++ generic/src/mm/slab.c	(revision 46fc2f9324ff6ec5e31b68cb451363c2e7a3c050)
@@ -128,5 +128,5 @@
 	"malloc-256","malloc-512","malloc-1K","malloc-2K",
 	"malloc-4K","malloc-8K","malloc-16K","malloc-32K",
-	"malloc-64K","malloc-128K"
+	"malloc-64K","malloc-128K","malloc-256K"
 };