Index: /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 42483)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 42484)
@@ -4536,10 +4536,12 @@
      *        living in PGM, but with publicly accessible inlined access methods
      *        could perhaps be an even better solution. */
-    return PGMPhysIemGCPhys2Ptr(IEMCPU_TO_VM(pIemCpu),
-                                GCPhysMem,
-                                RT_BOOL(fAccess & IEM_ACCESS_TYPE_WRITE),
-                                pIemCpu->fByPassHandlers,
-                                ppvMem,
-                                pLock);
+    int rc = PGMPhysIemGCPhys2Ptr(IEMCPU_TO_VM(pIemCpu),
+                                  GCPhysMem,
+                                  RT_BOOL(fAccess & IEM_ACCESS_TYPE_WRITE),
+                                  pIemCpu->fByPassHandlers,
+                                  ppvMem,
+                                  pLock);
+    /*Log(("PGMPhysIemGCPhys2Ptr %Rrc pLock=%.*Rhxs\n", rc, sizeof(*pLock), pLock));*/
+    return rc;
 }
 
@@ -4547,6 +4549,4 @@
 /**
  * Unmap a page previously mapped by iemMemPageMap.
- *
- * This is currently a dummy function.
  *
  * @param   pIemCpu             The IEM per CPU data.
@@ -4562,7 +4562,5 @@
     NOREF(fAccess);
     NOREF(pvMem);
-#ifndef IN_RING3
     PGMPhysReleasePageMappingLock(IEMCPU_TO_VM(pIemCpu), pLock);
-#endif
 }
 
@@ -5026,15 +5024,13 @@
     AssertReturn(iMemMap >= 0, iMemMap);
 
-    /*
-     * If it's bounce buffered, we need to write back the buffer.
-     */
-    if (   (pIemCpu->aMemMappings[iMemMap].fAccess & (IEM_ACCESS_BOUNCE_BUFFERED | IEM_ACCESS_TYPE_WRITE))
-        == (IEM_ACCESS_BOUNCE_BUFFERED | IEM_ACCESS_TYPE_WRITE))
-        return iemMemBounceBufferCommitAndUnmap(pIemCpu, iMemMap);
-
-#ifndef IN_RING3
-    /* Unlock it. */
-    PGMPhysReleasePageMappingLock(IEMCPU_TO_VM(pIemCpu), &pIemCpu->aMemMappingLocks[iMemMap].Lock);
-#endif
+    /* If it's bounce buffered, we may need to write back the buffer. */
+    if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED)
+    {
+        if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE)
+            return iemMemBounceBufferCommitAndUnmap(pIemCpu, iMemMap);
+    }
+    /* Otherwise unlock it. */
+    else
+        PGMPhysReleasePageMappingLock(IEMCPU_TO_VM(pIemCpu), &pIemCpu->aMemMappingLocks[iMemMap].Lock);
 
     /* Free the entry. */
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 42483)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 42484)
@@ -4107,5 +4107,4 @@
 #endif
 
-
             Log6(("PGMPhysIemGCPhys2Ptr: GCPhys=%RGp rc=%Rrc pPage=%R[pgmpage] *ppv=%p\n", GCPhys, rc, pPage, *ppv));
         }