Index: /trunk/src/VBox/Runtime/r0drv/linux/memobj-r0drv-linux.c
===================================================================
--- /trunk/src/VBox/Runtime/r0drv/linux/memobj-r0drv-linux.c	(revision 22678)
+++ /trunk/src/VBox/Runtime/r0drv/linux/memobj-r0drv-linux.c	(revision 22679)
@@ -1154,8 +1154,18 @@
 #ifdef VBOX_USE_PAE_HACK
 /**
- * Replace the PFN of a PTE entry of a reserved page. This hack is required for older Linux
- * kernels which don't provide remap_pfn_range().
+ * Replace the PFN of a PTE with the address of the actual page.
+ *
+ * The caller maps a reserved dummy page at the address with the desired access
+ * and flags.
+ *
+ * This hack is required for older Linux kernels which don't provide
+ * remap_pfn_range().
+ *
+ * @returns 0 on success, -ENOMEM on failure.
+ * @param   mm          The memory context.
+ * @param   ulAddr      The mapping address.
+ * @param   Phys        The physical address of the page to map.
  */
-static int fixPte(struct mm_struct *mm, unsigned long ulAddr, unsigned long long u64Phys)
+static int rtR0MemObjLinuxFixPte(struct mm_struct *mm, unsigned long ulAddr, RTHCPHYS Phys)
 {
     int rc = -ENOMEM;
@@ -1175,7 +1185,7 @@
                 pte_t pte = *ptep;
                 pte.pte_high &= 0xfff00000;
-                pte.pte_high |= ((u64Phys >> 32) & 0x000fffff);
+                pte.pte_high |= ((Phys >> 32) & 0x000fffff);
                 pte.pte_low  &= 0x00000fff;
-                pte.pte_low  |= (u64Phys & 0xfffff000);
+                pte.pte_low  |= (Phys & 0xfffff000);
                 set_pte(ptep, pte);
                 pte_unmap(ptep);
@@ -1229,13 +1239,13 @@
             size_t          iPage;
 #ifdef VBOX_USE_PAE_HACK
-            struct page     *pDummyPage = alloc_page(GFP_USER);
+            struct page    *pDummyPage = alloc_page(GFP_USER);
             RTHCPHYS        DummyPhys;
 
             if (!pDummyPage)
-                goto error;
-
+                goto l_error;
             SetPageReserved(pDummyPage);
             DummyPhys = page_to_phys(pDummyPage);
 #endif
+
             rc = 0;
             if (pMemLnxToMap->cPages)
@@ -1262,10 +1272,6 @@
 #elif defined(VBOX_USE_PAE_HACK)
                     rc = remap_page_range(vma, ulAddrCur, DummyPhys, PAGE_SIZE, fPg);
-                    if (rc)
-                    {
-                        rc = VERR_NO_MEMORY;
-                        break;
-                    }
-                    rc = fixPte(pTask->mm, ulAddrCur, Phys);
+                    if (!rc)
+                        rc = rtR0MemObjLinuxFixPte(pTask->mm, ulAddrCur, Phys);
 #elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0) || defined(HAVE_26_STYLE_REMAP_PAGE_RANGE)
                     rc = remap_page_range(vma, ulAddrCur, Phys, PAGE_SIZE, fPg);
@@ -1309,10 +1315,6 @@
 #elif defined(VBOX_USE_PAE_HACK)
                         rc = remap_page_range(vma, ulAddrCur, DummyPhys, PAGE_SIZE, fPg);
-                        if (rc)
-                        {
-                            rc = VERR_NO_MEMORY;
-                            break;
-                        }
-                        rc = fixPte(pTask->mm, ulAddrCur, Phys);
+                        if (!rc)
+                            rc = rtR0MemObjLinuxFixPte(pTask->mm, ulAddrCur, Phys);
 #elif LINUX_VERSION_CODE >= KERNEL_VERSION(2, 6, 0) || defined(HAVE_26_STYLE_REMAP_PAGE_RANGE)
                         rc = remap_page_range(vma, ulAddrCur, Phys, PAGE_SIZE, fPg);
@@ -1328,5 +1330,5 @@
                 }
             }
-#if LINUX_VERSION_CODE < KERNEL_VERSION(2, 6, 11) && defined(CONFIG_X86_PAE)
+#ifdef VBOX_USE_PAE_HACK
             __free_page(pDummyPage);
 #endif
@@ -1345,10 +1347,8 @@
              */
             MY_DO_MUNMAP(pTask->mm, (unsigned long)pv, pMemLnxToMap->Core.cb);
-            if (rc != VERR_INTERNAL_ERROR)
-                rc = VERR_NO_MEMORY;
         }
 
 #ifdef VBOX_USE_PAE_HACK
-error:
+l_error:
 #endif
         up_write(&pTask->mm->mmap_sem);