Index: arch/ia32/src/smp/smp.c
===================================================================
--- arch/ia32/src/smp/smp.c	(revision b1fd4f0d27464f1c0d19fe9eba51e64568127c4f)
+++ arch/ia32/src/smp/smp.c	(revision 6a22fcb1d8d4c7fa9ad4454c62a6df536ba463f1)
@@ -56,4 +56,7 @@
 void smp_init(void)
 {
+	int status;
+	__address l_apic_address, io_apic_address;
+
 	if (acpi_madt) {
 		acpi_madt_parse();
@@ -65,9 +68,20 @@
 	}
 
+	l_apic_address = PA2KA(PFN2ADDR(frame_alloc_rc(ONE_FRAME, FRAME_ATOMIC | FRAME_KA, &status)));
+	if (status != FRAME_OK)
+		panic("cannot allocate address for l_apic\n");
+
+	io_apic_address = PA2KA(PFN2ADDR(frame_alloc_rc(ONE_FRAME, FRAME_ATOMIC | FRAME_KA, &status)));
+	if (status != FRAME_OK)
+		panic("cannot allocate address for io_apic\n");
+
 	if (config.cpu_count > 1) {		
-		page_mapping_insert(AS_KERNEL, (__address) l_apic, (__address) l_apic, 
+		page_mapping_insert(AS_KERNEL, l_apic_address, (__address) l_apic, 
 				  PAGE_NOT_CACHEABLE);
-		page_mapping_insert(AS_KERNEL, (__address) io_apic, (__address) io_apic,
+		page_mapping_insert(AS_KERNEL, io_apic_address, (__address) io_apic,
 				  PAGE_NOT_CACHEABLE);
+				  
+		l_apic = (__u32 *) l_apic_address;
+		io_apic = (__u32 *) io_apic_address;
         }
 
Index: arch/ia64/Makefile.inc
===================================================================
--- arch/ia64/Makefile.inc	(revision b1fd4f0d27464f1c0d19fe9eba51e64568127c4f)
+++ arch/ia64/Makefile.inc	(revision 6a22fcb1d8d4c7fa9ad4454c62a6df536ba463f1)
@@ -39,6 +39,9 @@
 #
 
-INIT_ADDRESS = 0xe000000000400000
-INIT_SIZE = 0x100000
+INIT0_ADDRESS = 0xe000000000400000
+INIT0_SIZE = 0x100000
+
+INIT1_ADDRESS = 0xe000000000800000
+INIT1_SIZE = 0x100000
 
 CFLAGS += -mconstant-gp -fno-unwind-tables -mfixed-range=f32-f127
@@ -46,5 +49,6 @@
 AFLAGS += -mconstant-gp
 
-DEFS += -D__64_BITS__ -DINIT_ADDRESS=$(INIT_ADDRESS) -DINIT_SIZE=$(INIT_SIZE)
+DEFS += -D__64_BITS__ -DINIT0_ADDRESS=$(INIT0_ADDRESS) -DINIT0_SIZE=$(INIT0_SIZE) \
+	-DINIT1_ADDRESS=$(INIT1_ADDRESS) -DINIT1_SIZE=$(INIT1_SIZE)
 
 ## Compile with page hash table support.
Index: arch/ia64/src/ia64.c
===================================================================
--- arch/ia64/src/ia64.c	(revision b1fd4f0d27464f1c0d19fe9eba51e64568127c4f)
+++ arch/ia64/src/ia64.c	(revision 6a22fcb1d8d4c7fa9ad4454c62a6df536ba463f1)
@@ -53,7 +53,9 @@
 	
 	/* Setup usermode */
-	init.cnt = 1;
-	init.tasks[0].addr = INIT_ADDRESS;
-	init.tasks[0].size = INIT_SIZE;
+	init.cnt = 2;
+	init.tasks[0].addr = INIT0_ADDRESS;
+	init.tasks[0].size = INIT0_SIZE;
+	init.tasks[1].addr = INIT1_ADDRESS;
+	init.tasks[1].size = INIT1_SIZE;
 }
 
Index: contrib/conf/ski.conf
===================================================================
--- contrib/conf/ski.conf	(revision b1fd4f0d27464f1c0d19fe9eba51e64568127c4f)
+++ contrib/conf/ski.conf	(revision 6a22fcb1d8d4c7fa9ad4454c62a6df536ba463f1)
@@ -1,2 +1,4 @@
 load HelenOS/boot/kernel.bin
-romload HelenOS/uspace/init/init 0x400000
+romload HelenOS/uspace/ns/ns 0x400000
+romload HelenOS/uspace/init/init 0x800000
+
Index: genarch/src/mm/as_pt.c
===================================================================
--- genarch/src/mm/as_pt.c	(revision b1fd4f0d27464f1c0d19fe9eba51e64568127c4f)
+++ genarch/src/mm/as_pt.c	(revision 6a22fcb1d8d4c7fa9ad4454c62a6df536ba463f1)
@@ -67,13 +67,19 @@
 		memsetb((__address) dst_ptl0, PAGE_SIZE, 0);
 	} else {
+		__address src, dst;
+	
 		/*
 		 * Copy the kernel address space portion to new PTL0.
-		 * TODO: copy only kernel address space.
 		 */
 		 
 		ipl = interrupts_disable();
-		spinlock_lock(&AS_KERNEL->lock);
+		spinlock_lock(&AS_KERNEL->lock);		
 		src_ptl0 = (pte_t *) PA2KA((__address) AS_KERNEL->page_table);
-		memcpy((void *) dst_ptl0,(void *) src_ptl0, PAGE_SIZE);
+
+		src = (__address) &src_ptl0[PTL0_INDEX(KERNEL_ADDRESS_SPACE_START)];
+		dst = (__address) &dst_ptl0[PTL0_INDEX(KERNEL_ADDRESS_SPACE_START)];
+
+		memsetb((__address) dst_ptl0, PAGE_SIZE, 0);
+		memcpy((void *) dst, (void *) src, PAGE_SIZE - (src - (__address) src_ptl0));
 		spinlock_unlock(&AS_KERNEL->lock);
 		interrupts_restore(ipl);