Index: trunk/src/VBox/Additions/linux/drm/vbox_drv.h
===================================================================
--- trunk/src/VBox/Additions/linux/drm/vbox_drv.h	(revision 66510)
+++ trunk/src/VBox/Additions/linux/drm/vbox_drv.h	(revision 66523)
@@ -90,4 +90,10 @@
 #define VBOX_MAX_SCREENS  32
 
+#define GUEST_HEAP_OFFSET(vbox) (vbox->full_vram_size - VBVA_ADAPTER_INFORMATION_SIZE)
+#define GUEST_HEAP_SIZE   VBVA_ADAPTER_INFORMATION_SIZE
+#define GUEST_HEAP_USABLE_SIZE (VBVA_ADAPTER_INFORMATION_SIZE - \
+                                sizeof(HGSMIHOSTFLAGS))
+#define HOST_FLAGS_OFFSET GUEST_HEAP_USABLE_SIZE
+
 struct vbox_fbdev;
 
@@ -95,5 +101,6 @@
     struct drm_device *dev;
 
-    uint8_t __iomem *mapped_vram;
+    u8 __iomem *guest_heap;
+    u8 __iomem *vbva_buffers;
     HGSMIGUESTCOMMANDCONTEXT submit_info;
     struct VBVABUFFERCONTEXT *vbva_info;
@@ -104,8 +111,4 @@
     /** Amount of available VRAM, not including space used for buffers. */
     uint32_t available_vram_size;
-    /** Offset of mapped VRAM area in full VRAM. */
-    uint32_t vram_map_start;
-    /** Offset to the host flags in the VRAM. */
-    uint32_t host_flags_offset;
     /** Array of structures for receiving mode hints. */
     VBVAMODEHINT *last_mode_hints;
Index: trunk/src/VBox/Additions/linux/drm/vbox_irq.c
===================================================================
--- trunk/src/VBox/Additions/linux/drm/vbox_irq.c	(revision 66510)
+++ trunk/src/VBox/Additions/linux/drm/vbox_irq.c	(revision 66523)
@@ -57,5 +57,5 @@
 static uint32_t vbox_get_flags(struct vbox_private *vbox)
 {
-    return (uint32_t)readl(vbox->mapped_vram + vbox->host_flags_offset);
+	return readl(vbox->guest_heap + HOST_FLAGS_OFFSET);
 }
 
Index: trunk/src/VBox/Additions/linux/drm/vbox_main.c
===================================================================
--- trunk/src/VBox/Additions/linux/drm/vbox_main.c	(revision 66510)
+++ trunk/src/VBox/Additions/linux/drm/vbox_main.c	(revision 66523)
@@ -68,7 +68,6 @@
     unsigned i;
     struct VBVABUFFER *vbva;
-    uint32_t vram_map_offset = vbox->available_vram_size - vbox->vram_map_start;
-
-    if (vbox->vbva_info == NULL) {  /* Should never happen... */
+
+    if (!vbox->vbva_info || !vbox->vbva_buffers) { /* Should never happen... */
         printk(KERN_ERR "vboxvideo: failed to set up VBVA.\n");
         return;
@@ -76,6 +75,5 @@
     for (i = 0; i < vbox->num_crtcs; ++i) {
         if (vbox->vbva_info[i].pVBVA == NULL) {
-            vbva = (struct VBVABUFFER *) (  ((uint8_t *)vbox->mapped_vram)
-                                           + vram_map_offset
+            vbva = (struct VBVABUFFER *) ((u8 *)vbox->vbva_buffers
                                            + i * VBVA_MIN_BUFFER_SIZE);
             if (!VBoxVBVAEnable(&vbox->vbva_info[i], &vbox->submit_info, vbva, i)) {
@@ -238,4 +236,8 @@
         vbox->vbva_info = NULL;
     }
+    if (vbox->vbva_buffers) {
+        pci_iounmap(vbox->dev->pdev, vbox->vbva_buffers);
+        vbox->vbva_buffers = NULL;
+    }
 }
 
@@ -251,4 +253,11 @@
     /* Take a command buffer for each screen from the end of usable VRAM. */
     vbox->available_vram_size -= vbox->num_crtcs * VBVA_MIN_BUFFER_SIZE;
+
+    vbox->vbva_buffers = pci_iomap_range(vbox->dev->pdev, 0,
+                                     vbox->available_vram_size,
+                                     vbox->num_crtcs * VBVA_MIN_BUFFER_SIZE);
+    if (!vbox->vbva_buffers)
+        return -ENOMEM;
+
     for (i = 0; i < vbox->num_crtcs; ++i)
         VBoxVBVASetupBufferContext(&vbox->vbva_info[i],
@@ -303,29 +312,20 @@
 static int vbox_hw_init(struct vbox_private *vbox)
 {
-    uint32_t base_offset, map_start, guest_heap_offset, guest_heap_size, host_flags_offset;
-    void *guest_heap;
-
     vbox->full_vram_size = VBoxVideoGetVRAMSize();
     vbox->any_pitch = VBoxVideoAnyWidthAllowed();
     DRM_INFO("VRAM %08x\n", vbox->full_vram_size);
-    VBoxHGSMIGetBaseMappingInfo(vbox->full_vram_size, &base_offset, NULL,
-                                &guest_heap_offset, &guest_heap_size, &host_flags_offset);
-    map_start = (uint32_t)max((int)base_offset
-                              - VBOX_MAX_SCREENS * VBVA_MIN_BUFFER_SIZE, 0);
-    vbox->mapped_vram = pci_iomap_range(vbox->dev->pdev, 0, map_start,
-                                        vbox->full_vram_size - map_start);
-    if (!vbox->mapped_vram)
+
+    /* Map guest-heap at end of vram */
+    vbox->guest_heap = pci_iomap_range(vbox->dev->pdev, 0, GUEST_HEAP_OFFSET(vbox),
+                                       GUEST_HEAP_SIZE);
+    if (!vbox->guest_heap)
         return -ENOMEM;
-    vbox->vram_map_start = map_start;
-    guest_heap = ((uint8_t *)vbox->mapped_vram) + base_offset - map_start
-                   + guest_heap_offset;
-    vbox->host_flags_offset = base_offset - map_start + host_flags_offset;
-    if (RT_FAILURE(VBoxHGSMISetupGuestContext(&vbox->submit_info, guest_heap,
-                                              guest_heap_size,
-                                              base_offset + guest_heap_offset,
+
+    if (RT_FAILURE(VBoxHGSMISetupGuestContext(&vbox->submit_info, vbox->guest_heap,
+                                              GUEST_HEAP_USABLE_SIZE, GUEST_HEAP_OFFSET(vbox),
                                               &hgsmi_environ)))
         return -ENOMEM;
     /* Reduce available VRAM size to reflect the guest heap. */
-    vbox->available_vram_size = base_offset;
+    vbox->available_vram_size = GUEST_HEAP_OFFSET(vbox);
     /* Linux drm represents monitors as a 32-bit array. */
     vbox->num_crtcs = min(VBoxHGSMIGetMonitorCount(&vbox->submit_info),
@@ -413,6 +413,6 @@
     vbox_hw_fini(vbox);
     vbox_mm_fini(vbox);
-    if (vbox->mapped_vram)
-        pci_iounmap(dev->pdev, vbox->mapped_vram);
+    if (vbox->guest_heap)
+        pci_iounmap(dev->pdev, vbox->guest_heap);
     kfree(vbox);
     dev->dev_private = NULL;
Index: trunk/src/VBox/Additions/linux/drm/vbox_mode.c
===================================================================
--- trunk/src/VBox/Additions/linux/drm/vbox_mode.c	(revision 66510)
+++ trunk/src/VBox/Additions/linux/drm/vbox_mode.c	(revision 66523)
@@ -547,6 +547,6 @@
      * We need to report the flags location before reporting the IRQ
      * capability. */
-    VBoxHGSMIReportFlagsLocation(&vbox->submit_info,   vbox->vram_map_start
-                                                     + vbox->host_flags_offset);
+    VBoxHGSMIReportFlagsLocation(&vbox->submit_info, GUEST_HEAP_OFFSET(vbox) +
+                                                     HOST_FLAGS_OFFSET);
     if (vbox_connector->vbox_crtc->crtc_id == 0)
         vbox_report_caps(vbox);
