Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 31207)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 31208)
@@ -230,5 +230,5 @@
         pVM->pgm.s.PhysTlbHC.aEntries[i].pv = 0;
     }
-    /* @todo clear the RC TLB whenever we add it. */
+    /** @todo clear the RC TLB whenever we add it. */
     pgmUnlock(pVM);
 }
@@ -390,5 +390,5 @@
             return rc;
 
-        /* fall back to 4kb pages. */
+        /* fall back to 4KB pages. */
     }
 # endif
@@ -471,12 +471,11 @@
     if (pvSharedPage)
     {
+        /* Get the virtual address of the new page. */
         void *pvNewPage;
-
-        /* Get the virtual address of the new page. */
         rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvNewPage);
         AssertRC(rc);
         if (rc == VINF_SUCCESS)
         {
-            /** todo write ASMMemCopy */
+            /** @todo todo write ASMMemCopyPage */
             memcpy(pvNewPage, pvSharedPage, PAGE_SIZE);
         }
@@ -1021,8 +1020,7 @@
 {
     Assert(PGMIsLocked(PGM2VM(pPGM)));
-    STAM_COUNTER_INC(&pPGM->CTX_SUFF(pStats)->CTX_MID_Z(Stat,PageMapTlbMisses));
-
-    /*
-     * Find the ram range.
+
+    /*
+     * Find the ram range and page and hand it over to the with-page function.
      * 99.8% of requests are expected to be in the first range.
      */
@@ -1035,14 +1033,37 @@
             pRam = pRam->CTX_SUFF(pNext);
             if (!pRam)
+            {
+                STAM_COUNTER_INC(&pPGM->CTX_SUFF(pStats)->CTX_MID_Z(Stat,PageMapTlbMisses));
                 return VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS;
+            }
             off = GCPhys - pRam->GCPhys;
         } while (off >= pRam->cb);
     }
 
+    return pgmPhysPageLoadIntoTlbWithPage(pPGM, &pRam->aPages[off >> PAGE_SHIFT], GCPhys);
+}
+
+
+/**
+ * Load a guest page into the ring-3 physical TLB.
+ *
+ * @returns VBox status code.
+ * @retval  VINF_SUCCESS on success
+ * @retval  VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
+ *
+ * @param   pPGM        The PGM instance pointer.
+ * @param   pPage       Pointer to the PGMPAGE structure corresponding to
+ *                      GCPhys.
+ * @param   GCPhys      The guest physical address in question.
+ */
+int pgmPhysPageLoadIntoTlbWithPage(PPGM pPGM, PPGMPAGE pPage, RTGCPHYS GCPhys)
+{
+    Assert(PGMIsLocked(PGM2VM(pPGM)));
+    STAM_COUNTER_INC(&pPGM->CTX_SUFF(pStats)->CTX_MID_Z(Stat,PageMapTlbMisses));
+
     /*
      * Map the page.
      * Make a special case for the zero page as it is kind of special.
      */
-    PPGMPAGE pPage = &pRam->aPages[off >> PAGE_SHIFT];
     PPGMPAGEMAPTLBE pTlbe = &pPGM->CTXSUFF(PhysTlb).aEntries[PGM_PAGEMAPTLB_IDX(GCPhys)];
     if (    !PGM_PAGE_IS_ZERO(pPage)
@@ -1065,55 +1086,9 @@
     }
 #ifdef PGM_WITH_PHYS_TLB
-    pTlbe->GCPhys = GCPhys & X86_PTE_PAE_PG_MASK;
-#else
-    pTlbe->GCPhys = NIL_RTGCPHYS;
-#endif
-    pTlbe->pPage  = pPage;
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Load a guest page into the ring-3 physical TLB.
- *
- * @returns VBox status code.
- * @retval  VINF_SUCCESS on success
- * @retval  VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS if it's not a valid physical address.
- *
- * @param   pPGM        The PGM instance pointer.
- * @param   pPage       Pointer to the PGMPAGE structure corresponding to
- *                      GCPhys.
- * @param   GCPhys      The guest physical address in question.
- */
-int pgmPhysPageLoadIntoTlbWithPage(PPGM pPGM, PPGMPAGE pPage, RTGCPHYS GCPhys)
-{
-    Assert(PGMIsLocked(PGM2VM(pPGM)));
-    STAM_COUNTER_INC(&pPGM->CTX_SUFF(pStats)->CTX_MID_Z(Stat,PageMapTlbMisses));
-
-    /*
-     * Map the page.
-     * Make a special case for the zero page as it is kind of special.
-     */
-    PPGMPAGEMAPTLBE pTlbe = &pPGM->CTXSUFF(PhysTlb).aEntries[PGM_PAGEMAPTLB_IDX(GCPhys)];
-    if (    !PGM_PAGE_IS_ZERO(pPage)
-        &&  !PGM_PAGE_IS_BALLOONED(pPage))
-    {
-        void *pv;
-        PPGMPAGEMAP pMap;
-        int rc = pgmPhysPageMapCommon(PGM2VM(pPGM), pPage, GCPhys, &pMap, &pv);
-        if (RT_FAILURE(rc))
-            return rc;
-        pTlbe->pMap = pMap;
-        pTlbe->pv = pv;
-        Assert(!((uintptr_t)pTlbe->pv & PAGE_OFFSET_MASK));
-    }
+    if (    PGM_PAGE_GET_TYPE(pPage) < PGMPAGETYPE_ROM_SHADOW
+        ||  PGM_PAGE_GET_TYPE(pPage) > PGMPAGETYPE_ROM)
+        pTlbe->GCPhys = GCPhys & X86_PTE_PAE_PG_MASK;
     else
-    {
-        Assert(PGM_PAGE_GET_HCPHYS(pPage) == pPGM->HCPhysZeroPg);
-        pTlbe->pMap = NULL;
-        pTlbe->pv = pPGM->CTXALLSUFF(pvZeroPg);
-    }
-#ifdef PGM_WITH_PHYS_TLB
-    pTlbe->GCPhys = GCPhys & X86_PTE_PAE_PG_MASK;
+        pTlbe->GCPhys = NIL_RTGCPHYS; /* ROM: Problematic because of the two pages. :-/ */
 #else
     pTlbe->GCPhys = NIL_RTGCPHYS;