Index: /trunk/include/VBox/vmm/gvm.h
===================================================================
--- /trunk/include/VBox/vmm/gvm.h	(revision 104858)
+++ /trunk/include/VBox/vmm/gvm.h	(revision 104859)
@@ -265,5 +265,5 @@
         struct PGMR0PERVM   s;
 #endif
-        uint8_t             padding[89600];
+        uint8_t             padding[89728];
     } pgmr0;
 
@@ -310,7 +310,7 @@
     /** Padding so aCpus starts on a page boundrary.  */
 #ifdef VBOX_WITH_NEM_R0
-    uint8_t         abPadding2[16384*7 - 64 - 4352 - 1024 - 256 - 256 - 64 - 3008 - 89600 - 512 - 64 - 1024 - 192 - 704 - sizeof(PGVMCPU) * VMM_MAX_CPU_COUNT];
+    uint8_t         abPadding2[16384*7 - 64 - 4352 - 1024 - 256 - 256 - 64 - 3008 - 89728 - 512 - 64 - 1024 - 192 - 704 - sizeof(PGVMCPU) * VMM_MAX_CPU_COUNT];
 #else
-    uint8_t         abPadding2[16384*7 - 64 - 4352 - 1024 - 256 -       64 - 3008 - 89600 - 512 - 64 - 1024 - 192 - 704 - sizeof(PGVMCPU) * VMM_MAX_CPU_COUNT];
+    uint8_t         abPadding2[16384*7 - 64 - 4352 - 1024 - 256 -       64 - 3008 - 89728 - 512 - 64 - 1024 - 192 - 704 - sizeof(PGVMCPU) * VMM_MAX_CPU_COUNT];
 #endif
 
Index: /trunk/include/VBox/vmm/gvm.mac
===================================================================
--- /trunk/include/VBox/vmm/gvm.mac	(revision 104858)
+++ /trunk/include/VBox/vmm/gvm.mac	(revision 104859)
@@ -95,5 +95,5 @@
         .pdmr0              resb 3008
         alignb 64
-        .pgmr0              resb 89600
+        .pgmr0              resb 89728
         alignb 64
         .iomr0              resb 512
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 104858)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 104859)
@@ -589,6 +589,8 @@
 {
     PGM_LOCK_VOID(pVM);
-    RT_ZERO(pVM->pgm.s.apRamRangesTlbR3);
-    RT_ZERO(pVM->pgm.s.apRamRangesTlbR0);
+    /* This is technically only required when freeing the PCNet MMIO2 range
+       during ancient saved state loading.  The code freeing the RAM range
+       will make sure this function is called in both rings. */
+    RT_ZERO(pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb);
     PGM_UNLOCK(pVM);
 }
@@ -630,5 +632,5 @@
             PPGMRAMRANGE const pRamRange  = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRanges[idRamRange];
             Assert(pRamRange);
-            pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
+            pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
             return pRamRange;
         }
@@ -677,5 +679,5 @@
             PPGMRAMRANGE const pRamRange  = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRanges[idRamRange];
             Assert(pRamRange);
-            pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
+            pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
             return pRamRange;
         }
@@ -731,5 +733,5 @@
             PPGMRAMRANGE const pRamRange  = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRanges[idRamRange];
             AssertReturn(pRamRange, NULL);
-            pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
+            pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
 
             /* Get the page. */
@@ -784,5 +786,5 @@
             PPGMRAMRANGE const pRamRange  = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRanges[idRamRange];
             AssertReturn(pRamRange, VERR_PGM_PHYS_RAM_LOOKUP_IPE);
-            pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
+            pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
 
             /* Get the page. */
@@ -840,5 +842,5 @@
             PPGMRAMRANGE const pRamRange  = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRanges[idRamRange];
             AssertReturn(pRamRange, VERR_PGM_PHYS_RAM_LOOKUP_IPE);
-            pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
+            pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)] = pRamRange;
 
             /* Get the page. */
@@ -1103,4 +1105,8 @@
     }
 
+    /*
+     * Make sure the RAM range TLB does not contain any stale pointers to this range.
+     */
+    pgmPhysInvalidRamRangeTlbs(pVM);
     return rc;
 }
Index: /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp	(revision 104858)
+++ /trunk/src/VBox/VMM/VMMR3/PGMPhys.cpp	(revision 104859)
@@ -2852,5 +2852,5 @@
 
     pgmPhysInvalidatePageMapTLB(pVM);
-    pgmPhysInvalidRamRangeTlbs(pVM);
+    /*pgmPhysInvalidRamRangeTlbs(pVM); - not necessary */
 
     return rc;
@@ -3403,4 +3403,5 @@
                                      rc2, idx, cChunks, pszDesc),
                                     rc = RT_SUCCESS(rc) ? rc2 : rc);
+                pgmPhysInvalidRamRangeTlbs(pVM); /* Ensure no stale pointers in the ring-3 RAM range TLB. */
             }
             if (RT_FAILURE(rc2))
@@ -3905,5 +3906,5 @@
 
     pgmPhysInvalidatePageMapTLB(pVM);
-    pgmPhysInvalidRamRangeTlbs(pVM);
+    /* pgmPhysInvalidRamRangeTlbs(pVM); - not necessary */
 
     return rcRet;
Index: /trunk/src/VBox/VMM/include/PGMInline.h
===================================================================
--- /trunk/src/VBox/VMM/include/PGMInline.h	(revision 104858)
+++ /trunk/src/VBox/VMM/include/PGMInline.h	(revision 104859)
@@ -71,5 +71,5 @@
 DECLINLINE(PPGMRAMRANGE) pgmPhysGetRange(PVMCC pVM, RTGCPHYS GCPhys)
 {
-    PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)];
+    PPGMRAMRANGE pRam = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)];
     if (!pRam || GCPhys - pRam->GCPhys >= pRam->cb)
         return pgmPhysGetRangeSlow(pVM, GCPhys);
@@ -91,5 +91,5 @@
 DECLINLINE(PPGMRAMRANGE) pgmPhysGetRangeAtOrAbove(PVMCC pVM, RTGCPHYS GCPhys)
 {
-    PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)];
+    PPGMRAMRANGE pRam = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)];
     if (   !pRam
         || (GCPhys - pRam->GCPhys) >= pRam->cb)
@@ -111,5 +111,5 @@
 DECLINLINE(PPGMPAGE) pgmPhysGetPage(PVMCC pVM, RTGCPHYS GCPhys)
 {
-    PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)];
+    PPGMRAMRANGE pRam = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)];
     RTGCPHYS off;
     if (   pRam
@@ -138,5 +138,5 @@
 DECLINLINE(int) pgmPhysGetPageEx(PVMCC pVM, RTGCPHYS GCPhys, PPPGMPAGE ppPage)
 {
-    PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)];
+    PPGMRAMRANGE pRam = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)];
     RTGCPHYS off;
     if (   !pRam
@@ -171,5 +171,5 @@
         ||  RT_UNLIKELY((off = GCPhys - pRam->GCPhys) >= pRam->cb))
     {
-        pRam = pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)];
+        pRam = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)];
         if (   !pRam
             || (off = GCPhys - pRam->GCPhys) >= pRam->cb)
@@ -197,5 +197,5 @@
 DECLINLINE(int) pgmPhysGetPageAndRangeEx(PVMCC pVM, RTGCPHYS GCPhys, PPPGMPAGE ppPage, PPGMRAMRANGE *ppRam)
 {
-    PPGMRAMRANGE pRam = pVM->pgm.s.CTX_SUFF(apRamRangesTlb)[PGM_RAMRANGE_TLB_IDX(GCPhys)];
+    PPGMRAMRANGE pRam = pVM->CTX_EXPR(pgm, pgmr0, pgm).s.apRamRangesTlb[PGM_RAMRANGE_TLB_IDX(GCPhys)];
     RTGCPHYS off;
     if (   !pRam
Index: /trunk/src/VBox/VMM/include/PGMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/PGMInternal.h	(revision 104858)
+++ /trunk/src/VBox/VMM/include/PGMInternal.h	(revision 104859)
@@ -1413,5 +1413,5 @@
 /** The number of entries in the RAM range TLBs (there is one for each
  *  context).  Must be a power of two. */
-#define PGM_RAMRANGE_TLB_ENTRIES            8
+#define PGM_RAMRANGE_TLB_ENTRIES            16
 
 /**
@@ -3112,17 +3112,10 @@
 
     /** RAM range TLB for R3. */
-    R3PTRTYPE(PPGMRAMRANGE)         apRamRangesTlbR3[PGM_RAMRANGE_TLB_ENTRIES];
+    R3PTRTYPE(PPGMRAMRANGE)         apRamRangesTlb[PGM_RAMRANGE_TLB_ENTRIES];
     /** Shadow Page Pool - R3 Ptr. */
     R3PTRTYPE(PPGMPOOL)             pPoolR3;
-    /** Pointer to the list of ROM ranges - for R3.
-     * This is sorted by physical address and contains no overlapping ranges. */
-    R3PTRTYPE(PPGMROMRANGE)         pRomRangesR3;
-
-    /** RAM range TLB for R0. */
-    R0PTRTYPE(PPGMRAMRANGE)         apRamRangesTlbR0[PGM_RAMRANGE_TLB_ENTRIES];
+
     /** Shadow Page Pool - R0 Ptr. */
     R0PTRTYPE(PPGMPOOL)             pPoolR0;
-    /** R0 pointer corresponding to PGM::pRomRangesR3. */
-    R0PTRTYPE(PPGMROMRANGE)         pRomRangesR0;
 
     /** Hack: Number of deprecated page mapping locks taken by the current lock
@@ -3146,5 +3139,5 @@
     uint32_t                        idxLastPhysHandler;
 
-    uint32_t                        au64Padding3[5];
+    uint32_t                        au64Padding3[9];
 
     /** PGM critical section.
@@ -3763,4 +3756,6 @@
     uint32_t                        idRamRangeMax;
     uint8_t                         abAlignment1[64 - sizeof(uint32_t)];
+    /** RAM range TLB for R0. */
+    R0PTRTYPE(PPGMRAMRANGE)         apRamRangesTlb[PGM_RAMRANGE_TLB_ENTRIES];
     /** @} */
 
