Index: arch/ia32/src/smp/ap.S
===================================================================
--- arch/ia32/src/smp/ap.S	(revision b0bf5012e7a657969b61b900eb1f1446c6e3acae)
+++ arch/ia32/src/smp/ap.S	(revision a7a10630dfc3a5ecc03560398ae5bced5116ebb2)
@@ -64,4 +64,5 @@
 	movl $(ctx-0x80000000),%eax	# KA2PA((__address) &ctx)
 	movl (%eax),%esp
+	subl $0x80000000,%esp		# KA2PA(ctx.sp)
 
 	lidt idtr
Index: arch/ia32/src/smp/mps.c
===================================================================
--- arch/ia32/src/smp/mps.c	(revision b0bf5012e7a657969b61b900eb1f1446c6e3acae)
+++ arch/ia32/src/smp/mps.c	(revision a7a10630dfc3a5ecc03560398ae5bced5116ebb2)
@@ -393,4 +393,5 @@
 }
 
+
 /*
  * Kernel thread for bringing up application processors. It becomes clear
@@ -415,9 +416,7 @@
 
 	/*
-	 * Grab a frame and map its address to page 0. This is a hack which
-	 * accesses data in frame 0. Note that page 0 is not present because
-	 * of nil reference bug catching.
-	 */
-	frame = frame_alloc(FRAME_KA);
+	 * We need to access data in frame 0.
+	 */
+	frame = frame_alloc(0);
 	map_page_to_frame(frame,0,PAGE_CACHEABLE,0);
 
@@ -474,5 +473,5 @@
 		memcopy(gdt, gdt_new, GDT_ITEMS*sizeof(struct descriptor));
 		gdtr.base = KA2PA((__address) gdt_new);
-		
+
 		if (l_apic_send_init_ipi(pr[i].l_apic_id)) {
 			/*