Index: /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 62289)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 62290)
@@ -735,4 +735,5 @@
 IEM_STATIC VBOXSTRICTRC     iemRaiseAlignmentCheckException(PVMCPU pVCpu);
 #ifdef IEM_WITH_SETJMP
+DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaisePageFaultJmp(PVMCPU pVCpu, RTGCPTR GCPtrWhere, uint32_t fAccess, int rc);
 DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseGeneralProtectionFault0Jmp(PVMCPU pVCpu);
 DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseSelectorBoundsJmp(PVMCPU pVCpu, uint32_t iSegReg, uint32_t fAccess);
@@ -1361,5 +1362,5 @@
     pVCpu->iem.s.DataTlb.uTlbPhysRev = uTlbPhysRev;
 
-    if (!fFlushFlush)
+    if (!fFullFlush)
     { /* very likely */ }
     else
@@ -1371,5 +1372,5 @@
         {
             pVCpu->iem.s.CodeTlb.aEntries[i].pMappingR3        = NULL;
-            pVCpu->iem.s.CodeTlb.aEntries[i].fFlagsAndPhysRev &= ~(IEMTLBE_F_PG_NO_WRITE | IEMTLBE_F_PG_NO_READ | IEMTLBE_F_PHYS_REV)
+            pVCpu->iem.s.CodeTlb.aEntries[i].fFlagsAndPhysRev &= ~(IEMTLBE_F_PG_NO_WRITE | IEMTLBE_F_PG_NO_READ | IEMTLBE_F_PHYS_REV);
         }
 # endif
@@ -1379,5 +1380,5 @@
         {
             pVCpu->iem.s.DataTlb.aEntries[i].pMappingR3        = NULL;
-            pVCpu->iem.s.DataTlb.aEntries[i].fFlagsAndPhysRev &= ~(IEMTLBE_F_PG_NO_WRITE | IEMTLBE_F_PG_NO_READ | IEMTLBE_F_PHYS_REV)
+            pVCpu->iem.s.DataTlb.aEntries[i].fFlagsAndPhysRev &= ~(IEMTLBE_F_PG_NO_WRITE | IEMTLBE_F_PG_NO_READ | IEMTLBE_F_PHYS_REV);
         }
 # endif
@@ -1501,9 +1502,9 @@
             RTGCPHYS    GCPhys;
             uint64_t    fFlags;
-            int rc = PGMGstGetPage(pVCpu, GCPtrNext, &fFlags, &GCPhys);
+            int rc = PGMGstGetPage(pVCpu, GCPtrFirst, &fFlags, &GCPhys);
             if (RT_FAILURE(rc))
             {
-                Log(("iemOpcodeFetchMoreBytes: %RGv - rc=%Rrc\n", GCPtrNext, rc));
-                return iemRaisePageFault(pVCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, rc);
+                Log(("iemOpcodeFetchMoreBytes: %RGv - rc=%Rrc\n", GCPtrFirst, rc));
+                iemRaisePageFaultJmp(pVCpu, GCPtrFirst, IEM_ACCESS_INSTRUCTION, rc);
             }
 
@@ -1517,5 +1518,5 @@
 
     /*
-     * Check TLB access flags.
+     * Check TLB page table level access flags.
      */
     if (pTlbe->fFlagsAndPhysRev & (IEMTLBE_F_PT_NO_USER | IEMTLBE_F_PT_NO_EXEC))
@@ -1542,48 +1543,35 @@
     else
     {
-
-    }
-
+        /** @todo Could be optimized this a little in ring-3 if we liked. */
+        size_t cbRead = 0;
+        int rc = PATMReadPatchCode(pVCpu->CTX_SUFF(pVM), GCPtrFirst, pvDst, cbDst, &cbRead);
+        AssertRCStmt(rc, longjmp(*CTX_SUFF(pVCpu->iem.s.pJmpBuf), rc));
+        AssertStmt(cbRead == cbDst, longjmp(*CTX_SUFF(pVCpu->iem.s.pJmpBuf), VERR_IEM_IPE_1));
+        return;
+    }
 # endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
 
+    /*
+     * Look up the physical page info if necessary.
+     */
+    if ((pTlbe->fFlagsAndPhysRev & IEMTLBE_F_PHYS_REV) == pVCpu->iem.s.CodeTlb.uTlbPhysRev)
+    { /* not necessary */ }
+    else
+    {
+    }
+
+
+# if defined(IN_RING3) || (defined(IN_RING0) && !defined(VBOX_WITH_2X_4GB_ADDR_SPACE))
+    /*
+     * Try do a direct read using the pMappingR3 pointer.
+     */
+    if (!(pTlbe->fFlagsAndPhysRev & (IEMTLBE_F_NO_MAPPINGR3 | IEMTLBE_F_PG_NO_READ))
+    {
+
+    }
+# endif
+
+
 # if 0
-
-# ifdef VBOX_WITH_RAW_MODE_NOT_R0
-    /* Allow interpretation of patch manager code blocks since they can for
-       instance throw #PFs for perfectly good reasons. */
-    if (pVCpu->iem.s.fInPatchCode)
-    {
-        size_t cbRead = 0;
-        int rc = PATMReadPatchCode(pVCpu->CTX_SUFF(pVM), GCPtrNext, pVCpu->iem.s.abOpcode, cbToTryRead, &cbRead);
-        AssertRCReturn(rc, rc);
-        pVCpu->iem.s.cbOpcode = (uint8_t)cbRead; Assert(pVCpu->iem.s.cbOpcode == cbRead); Assert(cbRead > 0);
-        return VINF_SUCCESS;
-    }
-# endif /* VBOX_WITH_RAW_MODE_NOT_R0 */
-
-    RTGCPHYS    GCPhys;
-    uint64_t    fFlags;
-    int rc = PGMGstGetPage(pVCpu, GCPtrNext, &fFlags, &GCPhys);
-    if (RT_FAILURE(rc))
-    {
-        Log(("iemOpcodeFetchMoreBytes: %RGv - rc=%Rrc\n", GCPtrNext, rc));
-        return iemRaisePageFault(pVCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, rc);
-    }
-    if (!(fFlags & X86_PTE_US) && pVCpu->iem.s.uCpl == 3)
-    {
-        Log(("iemOpcodeFetchMoreBytes: %RGv - supervisor page\n", GCPtrNext));
-        return iemRaisePageFault(pVCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
-    }
-    if ((fFlags & X86_PTE_PAE_NX) && (pCtx->msrEFER & MSR_K6_EFER_NXE))
-    {
-        Log(("iemOpcodeFetchMoreBytes: %RGv - NX\n", GCPtrNext));
-        return iemRaisePageFault(pVCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
-    }
-    GCPhys |= GCPtrNext & PAGE_OFFSET_MASK;
-    Log5(("GCPtrNext=%RGv GCPhys=%RGp cbOpcodes=%#x\n",  GCPtrNext,  GCPhys,  pVCpu->iem.s.cbOpcode));
-    /** @todo Check reserved bits and such stuff. PGM is better at doing
-     *        that, so do it when implementing the guest virtual address
-     *        TLB... */
-
     /*
      * Read the bytes at this address.
@@ -5284,4 +5272,12 @@
                              uErr, GCPtrWhere);
 }
+
+#ifdef IEM_WITH_SETJMP
+/** \#PF(n) - 0e, longjmp.  */
+IEM_STATIC DECL_NO_RETURN(void) iemRaisePageFaultJmp(PVMCPU pVCpu, RTGCPTR GCPtrWhere, uint32_t fAccess, int rc)
+{
+    longjmp(*CTX_SUFF(pVCpu->iem.s.pJmpBuf), VBOXSTRICTRC_VAL(iemRaisePageFault(pVCpu, GCPtrWhere, fAccess, rc)));
+}
+#endif