Index: /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 6854)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 6855)
@@ -993,75 +993,2 @@
 }
 
-#ifndef IN_RING3
-
-/**
- * \#PF Handler callback for Guest ROM range write access.
- * We simply ignore the writes or fall back to the recompiler if we don't support the instruction.
- *
- * @returns VBox status code (appropritate for trap handling and GC return).
- * @param   pVM         VM Handle.
- * @param   uErrorCode  CPU Error code.
- * @param   pRegFrame   Trap register frame.
- * @param   pvFault     The fault address (cr2).
- * @param   GCPhysFault The GC physical address corresponding to pvFault.
- * @param   pvUser      User argument. Pointer to the ROM range structure.
- */
-PGMDECL(int) pgmGuestROMWriteHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, void *pvFault, RTGCPHYS GCPhysFault, void *pvUser)
-{
-    int rc;
-#ifdef VBOX_WITH_NEW_PHYS_CODE
-    PPGMROMRANGE pRom = (PPGMROMRANGE)pvUser;
-    uint32_t iPage = GCPhysFault - pRom->GCPhys;
-    Assert(iPage < (pRom->cb >> PAGE_SHIFT));
-    switch (pRom->aPages[iPage].enmProt)
-    {
-        case PGMROMPROT_READ_ROM_WRITE_IGNORE:
-        case PGMROMPROT_READ_RAM_WRITE_IGNORE:
-        {
-#endif
-            /*
-             * If it's a simple instruction which doesn't change the cpu state
-             * we will simply skip it. Otherwise we'll have to defer it to REM.
-             */
-            uint32_t cbOp;
-            DISCPUSTATE Cpu;
-            rc = EMInterpretDisasOne(pVM, pRegFrame, &Cpu, &cbOp);
-            if (     RT_SUCCESS(rc)
-                &&   Cpu.mode == CPUMODE_32BIT
-                &&  !(Cpu.prefix & (PREFIX_REPNE | PREFIX_REP | PREFIX_SEG)))
-            {
-                switch (Cpu.opcode)
-                {
-                    /** @todo Find other instructions we can safely skip, possibly
-                     * adding this kind of detection to DIS or EM. */
-                    case OP_MOV:
-                        pRegFrame->eip += cbOp;
-                        STAM_COUNTER_INC(&pVM->pgm.s.StatGCGuestROMWriteHandled);
-                        return VINF_SUCCESS;
-                }
-            }
-            else if (RT_UNLIKELY(rc == VERR_INTERNAL_ERROR))
-                return rc;
-#ifdef VBOX_WITH_NEW_PHYS_CODE
-            break;
-        }
-
-        case PGMROMPROT_READ_RAM_WRITE_RAM:
-            rc = PGMHandlerPhysicalPageTempOff(pVM, pRom->GCPhys, GCPhysFault & X86_PTE_PG_MASK);
-            AssertRC(rc);
-        case PGMROMPROT_READ_ROM_WRITE_RAM:
-            /* Handle it in ring-3 because it's *way* easier there. */
-            break;
-
-        default:
-            AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhysFault=%RGp\n",
-                                   pRom->aPages[iPage].enmProt, iPage, GCPhysFault),
-                                  VERR_INTERNAL_ERROR);
-    }
-#endif
-
-    STAM_COUNTER_INC(&pVM->pgm.s.StatGCGuestROMWriteUnhandled);
-    return VINF_EM_RAW_EMULATE_INSTR;
-}
-
-#endif /* IN_RING3 */
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 6854)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 6855)
@@ -35,4 +35,5 @@
 #include <VBox/vmm.h>
 #include <VBox/iom.h>
+#include <VBox/em.h>
 #include <VBox/rem.h>
 #include "PGMInternal.h"
@@ -49,4 +50,78 @@
 
 
+
+#ifndef IN_RING3
+
+/**
+ * \#PF Handler callback for Guest ROM range write access.
+ * We simply ignore the writes or fall back to the recompiler if we don't support the instruction.
+ *
+ * @returns VBox status code (appropritate for trap handling and GC return).
+ * @param   pVM         VM Handle.
+ * @param   uErrorCode  CPU Error code.
+ * @param   pRegFrame   Trap register frame.
+ * @param   pvFault     The fault address (cr2).
+ * @param   GCPhysFault The GC physical address corresponding to pvFault.
+ * @param   pvUser      User argument. Pointer to the ROM range structure.
+ */
+PGMDECL(int) pgmGuestROMWriteHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, void *pvFault, RTGCPHYS GCPhysFault, void *pvUser)
+{
+    int rc;
+#ifdef VBOX_WITH_NEW_PHYS_CODE
+    PPGMROMRANGE pRom = (PPGMROMRANGE)pvUser;
+    uint32_t iPage = GCPhysFault - pRom->GCPhys;
+    Assert(iPage < (pRom->cb >> PAGE_SHIFT));
+    switch (pRom->aPages[iPage].enmProt)
+    {
+        case PGMROMPROT_READ_ROM_WRITE_IGNORE:
+        case PGMROMPROT_READ_RAM_WRITE_IGNORE:
+        {
+#endif
+            /*
+             * If it's a simple instruction which doesn't change the cpu state
+             * we will simply skip it. Otherwise we'll have to defer it to REM.
+             */
+            uint32_t cbOp;
+            DISCPUSTATE Cpu;
+            rc = EMInterpretDisasOne(pVM, pRegFrame, &Cpu, &cbOp);
+            if (     RT_SUCCESS(rc)
+                &&   Cpu.mode == CPUMODE_32BIT
+                &&  !(Cpu.prefix & (PREFIX_REPNE | PREFIX_REP | PREFIX_SEG)))
+            {
+                switch (Cpu.opcode)
+                {
+                    /** @todo Find other instructions we can safely skip, possibly
+                     * adding this kind of detection to DIS or EM. */
+                    case OP_MOV:
+                        pRegFrame->eip += cbOp;
+                        STAM_COUNTER_INC(&pVM->pgm.s.StatGCGuestROMWriteHandled);
+                        return VINF_SUCCESS;
+                }
+            }
+            else if (RT_UNLIKELY(rc == VERR_INTERNAL_ERROR))
+                return rc;
+#ifdef VBOX_WITH_NEW_PHYS_CODE
+            break;
+        }
+
+        case PGMROMPROT_READ_RAM_WRITE_RAM:
+            rc = PGMHandlerPhysicalPageTempOff(pVM, pRom->GCPhys, GCPhysFault & X86_PTE_PG_MASK);
+            AssertRC(rc);
+        case PGMROMPROT_READ_ROM_WRITE_RAM:
+            /* Handle it in ring-3 because it's *way* easier there. */
+            break;
+
+        default:
+            AssertMsgFailedReturn(("enmProt=%d iPage=%d GCPhysFault=%RGp\n",
+                                   pRom->aPages[iPage].enmProt, iPage, GCPhysFault),
+                                  VERR_INTERNAL_ERROR);
+    }
+#endif
+
+    STAM_COUNTER_INC(&pVM->pgm.s.StatGCGuestROMWriteUnhandled);
+    return VINF_EM_RAW_EMULATE_INSTR;
+}
+
+#endif /* IN_RING3 */
 
 /**
@@ -2268,2 +2343,3 @@
 /// @todo PGMDECL(int) PGMPhysInterpretedWrite(PVM pVM, PCPUMCTXCORE pCtxCore, RTGCPTR GCPtrDst, const void *pvSrc, size_t cb)
 
+