diff --git a/arch/arm/balloon.c b/arch/arm/balloon.c
index 958ecba..1df7d1c 100644
--- a/arch/arm/balloon.c
+++ b/arch/arm/balloon.c
@@ -25,8 +25,6 @@
 
 #ifdef CONFIG_BALLOON
 
-unsigned long virt_kernel_area_end;   /* TODO: find a virtual area */
-
 void arch_pfn_add(unsigned long pfn, unsigned long mfn)
 {
 }
diff --git a/arch/arm/mm.c b/arch/arm/mm.c
index 4f58fc7..dbde162 100644
--- a/arch/arm/mm.c
+++ b/arch/arm/mm.c
@@ -141,3 +141,8 @@ grant_entry_t *arch_init_gnttab(int nr_grant_frames)
 
     return to_virt(gnttab_table);
 }
+
+unsigned long map_frame_virt(unsigned long mfn)
+{
+    return mfn_to_virt(mfn);
+}
diff --git a/arch/x86/balloon.c b/arch/x86/balloon.c
index 16aaae4..10b440c 100644
--- a/arch/x86/balloon.c
+++ b/arch/x86/balloon.c
@@ -29,9 +29,6 @@
 #include <mini-os/paravirt.h>
 
 #ifdef CONFIG_BALLOON
-
-unsigned long virt_kernel_area_end = VIRT_KERNEL_AREA;
-
 #ifdef CONFIG_PARAVIRT
 static void p2m_invalidate(unsigned long *list, unsigned long start_idx)
 {
@@ -53,7 +50,7 @@ static inline unsigned long *p2m_to_virt(unsigned long p2m)
 
 void arch_remap_p2m(unsigned long max_pfn)
 {
-    unsigned long pfn;
+    unsigned long pfn, new_p2m;
     unsigned long *l3_list, *l2_list, *l1_list;
 
     l3_list = p2m_l3list();
@@ -67,17 +64,15 @@ void arch_remap_p2m(unsigned long max_pfn)
     if ( p2m_pages(nr_max_pages) <= p2m_pages(max_pfn) )
         return;
 
+    new_p2m = alloc_virt_kernel(p2m_pages(nr_max_pages));
     for ( pfn = 0; pfn < max_pfn; pfn += P2M_ENTRIES )
     {
-        map_frame_rw(virt_kernel_area_end + PAGE_SIZE * (pfn / P2M_ENTRIES),
+        map_frame_rw(new_p2m + PAGE_SIZE * (pfn / P2M_ENTRIES),
                      virt_to_mfn(phys_to_machine_mapping + pfn));
     }
 
-    phys_to_machine_mapping = (unsigned long *)virt_kernel_area_end;
+    phys_to_machine_mapping = (unsigned long *)new_p2m;
     printk("remapped p2m list to %p\n", phys_to_machine_mapping);
-
-    virt_kernel_area_end += PAGE_SIZE * p2m_pages(nr_max_pages);
-    ASSERT(virt_kernel_area_end <= VIRT_DEMAND_AREA);
 }
 
 int arch_expand_p2m(unsigned long max_pfn)
diff --git a/arch/x86/mm.c b/arch/x86/mm.c
index f5248a4..762599d 100644
--- a/arch/x86/mm.c
+++ b/arch/x86/mm.c
@@ -57,6 +57,7 @@ unsigned long mfn_zero;
 pgentry_t *pt_base;
 static unsigned long first_free_pfn;
 static unsigned long last_free_pfn;
+static unsigned long virt_kernel_area_end = VIRT_KERNEL_AREA;
 
 extern char stack[];
 extern void page_walk(unsigned long va);
@@ -829,3 +830,25 @@ grant_entry_t *arch_init_gnttab(int nr_grant_frames)
     HYPERVISOR_grant_table_op(GNTTABOP_setup_table, &setup, 1);
     return map_frames(frames, nr_grant_frames);
 }
+
+unsigned long alloc_virt_kernel(unsigned n_pages)
+{
+    unsigned long addr;
+
+    addr = virt_kernel_area_end;
+    virt_kernel_area_end += PAGE_SIZE * n_pages;
+    ASSERT(virt_kernel_area_end <= VIRT_DEMAND_AREA);
+
+    return addr;
+}
+
+unsigned long map_frame_virt(unsigned long mfn)
+{
+    unsigned long addr;
+
+    addr = alloc_virt_kernel(1);
+    if ( map_frame_rw(addr, mfn) )
+        return 0;
+
+    return addr;
+}
diff --git a/balloon.c b/balloon.c
index 8669edb..b0d0230 100644
--- a/balloon.c
+++ b/balloon.c
@@ -50,20 +50,19 @@ void get_max_pages(void)
 
 void mm_alloc_bitmap_remap(void)
 {
-    unsigned long i;
+    unsigned long i, new_bitmap;
 
     if ( mm_alloc_bitmap_size >= ((nr_max_pages + 1) >> 3) )
         return;
 
+    new_bitmap = alloc_virt_kernel(PFN_UP((nr_max_pages + 1) >> 3));
     for ( i = 0; i < mm_alloc_bitmap_size; i += PAGE_SIZE )
     {
-        map_frame_rw(virt_kernel_area_end + i,
+        map_frame_rw(new_bitmap + i,
                      virt_to_mfn((unsigned long)(mm_alloc_bitmap) + i));
     }
 
-    mm_alloc_bitmap = (unsigned long *)virt_kernel_area_end;
-    virt_kernel_area_end += round_pgup((nr_max_pages + 1) >> 3);
-    ASSERT(virt_kernel_area_end <= VIRT_DEMAND_AREA);
+    mm_alloc_bitmap = (unsigned long *)new_bitmap;
 }
 
 #define N_BALLOON_FRAMES 64
diff --git a/include/balloon.h b/include/balloon.h
index 8cd41af..6cfec4f 100644
--- a/include/balloon.h
+++ b/include/balloon.h
@@ -33,7 +33,6 @@
 #define BALLOON_EMERGENCY_PAGES   64
 
 extern unsigned long nr_max_pages;
-extern unsigned long virt_kernel_area_end;
 extern unsigned long nr_mem_pages;
 
 void get_max_pages(void);
diff --git a/include/mm.h b/include/mm.h
index 953570c..4fc364f 100644
--- a/include/mm.h
+++ b/include/mm.h
@@ -79,6 +79,7 @@ int do_map_frames(unsigned long addr,
 	unsigned long increment, domid_t id, int *err, unsigned long prot);
 int unmap_frames(unsigned long va, unsigned long num_frames);
 int map_frame_rw(unsigned long addr, unsigned long mfn);
+unsigned long map_frame_virt(unsigned long mfn);
 #ifdef HAVE_LIBC
 extern unsigned long heap, brk, heap_mapped, heap_end;
 #endif
diff --git a/include/x86/arch_mm.h b/include/x86/arch_mm.h
index e0ae552..9372f1e 100644
--- a/include/x86/arch_mm.h
+++ b/include/x86/arch_mm.h
@@ -277,6 +277,7 @@ static __inline__ paddr_t machine_to_phys(maddr_t machine)
 
 pgentry_t *need_pgt(unsigned long addr);
 void arch_mm_preinit(void *p);
+unsigned long alloc_virt_kernel(unsigned n_pages);
 
 #endif
 
