diff --git a/reactos/ntoskrnl/mm/ARM3/i386/init.c b/reactos/ntoskrnl/mm/ARM3/i386/init.c
index 250324ca65f..0e6908fcbcd 100644
--- a/reactos/ntoskrnl/mm/ARM3/i386/init.c
+++ b/reactos/ntoskrnl/mm/ARM3/i386/init.c
@@ -151,6 +151,7 @@ MiInitMachineDependent(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
     MMPTE TempPde, TempPte;
     PVOID NonPagedPoolExpansionVa;
     ULONG OldCount;
+    KIRQL OldIrql;
 
     /* Check for kernel stack size that's too big */
     if (MmLargeStackSize > (KERNEL_LARGE_STACK_SIZE / _1KB))
@@ -541,21 +542,26 @@ MiInitMachineDependent(IN PLOADER_PARAMETER_BLOCK LoaderBlock)
     //
     MiInitializeSystemPtes(PointerPte, MmNumberOfSystemPtes, SystemPteSpace);
     
-    //
-    // Get the PDE For hyperspace
-    //
+    /* Get the PDE For hyperspace */
     StartPde = MiAddressToPde(HYPER_SPACE);
     
-    //
-    // Allocate a page for it and create it
-    //
-    PageFrameIndex = MmAllocPage(MC_SYSTEM);
+    /* Lock PFN database */
+    OldIrql = KeAcquireQueuedSpinLock(LockQueuePfnLock);
+    
+    /* Allocate a page for hyperspace and create it */
+    PageFrameIndex = MiRemoveAnyPage(0);
     TempPde.u.Hard.PageFrameNumber = PageFrameIndex;
     TempPde.u.Hard.Global = FALSE; // Hyperspace is local!
     ASSERT(StartPde->u.Hard.Valid == 0);
     ASSERT(TempPde.u.Hard.Valid == 1);
     *StartPde = TempPde;
     
+    /* Flush the TLB */
+    KeFlushCurrentTb();
+    
+    /* Release the lock */
+    KeReleaseQueuedSpinLock(LockQueuePfnLock, OldIrql);
+    
     //
     // Zero out the page table now
     //
diff --git a/reactos/ntoskrnl/mm/ARM3/miarm.h b/reactos/ntoskrnl/mm/ARM3/miarm.h
index 11d4189a958..a6e87fe7b8b 100644
--- a/reactos/ntoskrnl/mm/ARM3/miarm.h
+++ b/reactos/ntoskrnl/mm/ARM3/miarm.h
@@ -89,6 +89,24 @@
 #define MM_DECOMMIT            0x10 
 #define MM_NOACCESS            (MM_DECOMMIT | MM_NOCACHE)
 
+//
+// Corresponds to MMPTE_SOFTWARE.Protection
+//
+#ifdef _M_IX86
+#define MM_PTE_SOFTWARE_PROTECTION_BITS   5
+#elif _M_ARM
+#define MM_PTE_SOFTWARE_PROTECTION_BITS   5
+#elif _M_AMD64
+#define MM_PTE_SOFTWARE_PROTECTION_BITS   5
+#else
+#error Define these please!
+#endif
+
+//
+// Creates a software PTE with the given protection
+//
+#define MI_MAKE_SOFTWARE_PTE(x)          ((x) << MM_PTE_SOFTWARE_PROTECTION_BITS)
+
 //
 // Special values for LoadedImports
 //
@@ -409,6 +427,12 @@ MmArmAccessFault(
     IN PVOID TrapInformation
 );
 
+NTSTATUS
+FASTCALL
+MiCheckPdeForPagedPool(
+    IN PVOID Address
+);
+
 VOID
 NTAPI
 MiInitializeNonPagedPool(
@@ -532,6 +556,18 @@ MiRemoveHeadList(
     IN PMMPFNLIST ListHead
 );
 
+PFN_NUMBER
+NTAPI
+MiAllocatePfn(
+    IN PMMPTE PointerPte,
+    IN ULONG Protection
+);
+
+PFN_NUMBER
+NTAPI
+MiRemoveAnyPage(
+    IN ULONG Color
+);
 
 VOID
 NTAPI