Index: trunk/src/VBox/VMM/MM.cpp
===================================================================
--- trunk/src/VBox/VMM/MM.cpp	(revision 18716)
+++ trunk/src/VBox/VMM/MM.cpp	(revision 18718)
@@ -456,33 +456,7 @@
 
     /*
-     * Release locked memory.
-     * (Associated record are released by the heap.)
-     */
-    PMMLOCKEDMEM pLockedMem = pVM->mm.s.pLockedMem;
-    while (pLockedMem)
-    {
-        int rc = SUPPageUnlock(pLockedMem->pv);
-        AssertMsgRC(rc, ("SUPPageUnlock(%p) -> rc=%d\n", pLockedMem->pv, rc));
-        switch (pLockedMem->eType)
-        {
-            case MM_LOCKED_TYPE_HYPER:
-                rc = SUPPageFree(pLockedMem->pv, pLockedMem->cb >> PAGE_SHIFT);
-                AssertMsgRC(rc, ("SUPPageFree(%p) -> rc=%d\n", pLockedMem->pv, rc));
-                break;
-            case MM_LOCKED_TYPE_HYPER_NOFREE:
-            case MM_LOCKED_TYPE_HYPER_PAGES:
-            case MM_LOCKED_TYPE_PHYS:
-                /* nothing to do. */
-                break;
-        }
-        /* next */
-        pLockedMem = pLockedMem->pNext;
-    }
-
-    /*
      * Zero stuff to detect after termination use of the MM interface
      */
     pVM->mm.s.offLookupHyper = NIL_OFFSET;
-    pVM->mm.s.pLockedMem     = NULL;
     pVM->mm.s.pHyperHeapR3   = NULL;        /* freed above. */
     pVM->mm.s.pHyperHeapR0   = NIL_RTR0PTR; /* freed above. */
@@ -724,126 +698,4 @@
 
 /**
- * Locks physical memory which backs a virtual memory range (HC) adding
- * the required records to the pLockedMem list.
- *
- * @returns VBox status code.
- * @param   pVM             The VM handle.
- * @param   pv              Pointer to memory range which shall be locked down.
- *                          This pointer is page aligned.
- * @param   cb              Size of memory range (in bytes). This size is page aligned.
- * @param   eType           Memory type.
- * @param   ppLockedMem     Where to store the pointer to the created locked memory record.
- *                          This is optional, pass NULL if not used.
- * @param   fSilentFailure  Don't raise an error when unsuccessful. Upper layer with deal with it.
- */
-int mmR3LockMem(PVM pVM, void *pv, size_t cb, MMLOCKEDTYPE eType, PMMLOCKEDMEM *ppLockedMem, bool fSilentFailure)
-{
-    Assert(RT_ALIGN_P(pv, PAGE_SIZE) == pv);
-    Assert(RT_ALIGN_Z(cb, PAGE_SIZE) == cb);
-
-    if (ppLockedMem)
-        *ppLockedMem = NULL;
-
-    /*
-     * Allocate locked mem structure.
-     */
-    unsigned        cPages = (unsigned)(cb >> PAGE_SHIFT);
-    AssertReturn(cPages == (cb >> PAGE_SHIFT), VERR_OUT_OF_RANGE);
-    PMMLOCKEDMEM    pLockedMem = (PMMLOCKEDMEM)MMR3HeapAlloc(pVM, MM_TAG_MM, RT_OFFSETOF(MMLOCKEDMEM, aPhysPages[cPages]));
-    if (!pLockedMem)
-        return VERR_NO_MEMORY;
-    pLockedMem->pv      = pv;
-    pLockedMem->cb      = cb;
-    pLockedMem->eType   = eType;
-    memset(&pLockedMem->u, 0, sizeof(pLockedMem->u));
-
-    /*
-     * Lock the memory.
-     */
-    int rc = SUPPageLock(pv, cPages, &pLockedMem->aPhysPages[0]);
-    if (RT_SUCCESS(rc))
-    {
-        /*
-         * Setup the reserved field.
-         */
-        PSUPPAGE    pPhysPage = &pLockedMem->aPhysPages[0];
-        for (unsigned c = cPages; c > 0; c--, pPhysPage++)
-            pPhysPage->uReserved = (RTHCUINTPTR)pLockedMem;
-
-        /*
-         * Insert into the list.
-         *
-         * ASSUME no protected needed here as only one thread in the system can possibly
-         * be doing this. No other threads will walk this list either we assume.
-         */
-        pLockedMem->pNext = pVM->mm.s.pLockedMem;
-        pVM->mm.s.pLockedMem = pLockedMem;
-        /* Set return value. */
-        if (ppLockedMem)
-            *ppLockedMem = pLockedMem;
-    }
-    else
-    {
-        AssertMsgFailed(("SUPPageLock failed with rc=%d\n", rc));
-        MMR3HeapFree(pLockedMem);
-        if (!fSilentFailure)
-            rc = VMSetError(pVM, rc, RT_SRC_POS, N_("Failed to lock %d bytes of host memory (out of memory)"), cb);
-    }
-
-    return rc;
-}
-
-
-/**
- * Maps a part of or an entire locked memory region into the guest context.
- *
- * @returns VBox status.
- *          God knows what happens if we fail...
- * @param   pVM         VM handle.
- * @param   pLockedMem  Locked memory structure.
- * @param   Addr        GC Address where to start the mapping.
- * @param   iPage       Page number in the locked memory region.
- * @param   cPages      Number of pages to map.
- * @param   fFlags      See the fFlags argument of PGR3Map().
- */
-int mmR3MapLocked(PVM pVM, PMMLOCKEDMEM pLockedMem, RTGCPTR Addr, unsigned iPage, size_t cPages, unsigned fFlags)
-{
-    /*
-     * Adjust ~0 argument
-     */
-    if (cPages == ~(size_t)0)
-        cPages = (pLockedMem->cb >> PAGE_SHIFT) - iPage;
-    Assert(cPages != ~0U);
-    /* no incorrect arguments are accepted */
-    Assert(RT_ALIGN_GCPT(Addr, PAGE_SIZE, RTGCPTR) == Addr);
-    AssertMsg(iPage < (pLockedMem->cb >> PAGE_SHIFT), ("never even think about giving me a bad iPage(=%d)\n", iPage));
-    AssertMsg(iPage + cPages <= (pLockedMem->cb >> PAGE_SHIFT), ("never even think about giving me a bad cPages(=%d)\n", cPages));
-
-    /*
-     * Map the pages.
-     */
-    PSUPPAGE    pPhysPage = &pLockedMem->aPhysPages[iPage];
-    while (cPages)
-    {
-        RTHCPHYS HCPhys = pPhysPage->Phys;
-        int rc = PGMMap(pVM, Addr, HCPhys, PAGE_SIZE, fFlags);
-        if (RT_FAILURE(rc))
-        {
-            /** @todo how the hell can we do a proper bailout here. */
-            return rc;
-        }
-
-        /* next */
-        cPages--;
-        iPage++;
-        pPhysPage++;
-        Addr += PAGE_SIZE;
-    }
-
-    return VINF_SUCCESS;
-}
-
-
-/**
  * Convert HC Physical address to HC Virtual address.
  *
@@ -868,17 +720,48 @@
 
     /*
-     * Iterate the locked memory - very slow.
+     * Iterate thru the lookup records for HMA.
      */
     uint32_t off = HCPhys & PAGE_OFFSET_MASK;
     HCPhys &= X86_PTE_PAE_PG_MASK;
-    for (PMMLOCKEDMEM pCur = pVM->mm.s.pLockedMem; pCur; pCur = pCur->pNext)
-    {
-        size_t iPage = pCur->cb >> PAGE_SHIFT;
-        while (iPage-- > 0)
-            if ((pCur->aPhysPages[iPage].Phys & X86_PTE_PAE_PG_MASK) == HCPhys)
+    PMMLOOKUPHYPER pCur = (PMMLOOKUPHYPER)((uint8_t *)pVM->mm.s.CTX_SUFF(pHyperHeap) + pVM->mm.s.offLookupHyper);
+    for (;;)
+    {
+        switch (pCur->enmType)
+        {
+            case MMLOOKUPHYPERTYPE_LOCKED:
             {
-                *ppv = (char *)pCur->pv + (iPage << PAGE_SHIFT) + off;
-                return VINF_SUCCESS;
+                PCRTHCPHYS  paHCPhysPages = pCur->u.Locked.paHCPhysPages;
+                size_t      iPage         = pCur->cb >> PAGE_SHIFT;
+                while (iPage-- > 0)
+                    if (paHCPhysPages[iPage] == HCPhys)
+                    {
+                        *ppv = (char *)pCur->u.Locked.pvR3 + (iPage << PAGE_SHIFT) + off;
+                        return VINF_SUCCESS;
+                    }
+                break;
             }
+
+            case MMLOOKUPHYPERTYPE_HCPHYS:
+                if (pCur->u.HCPhys.HCPhys - HCPhys < pCur->cb)
+                {
+                    *ppv = (uint8_t *)pCur->u.HCPhys.pvR3 + pCur->u.HCPhys.HCPhys - HCPhys + off;
+                    return VINF_SUCCESS;
+                }
+                break;
+
+            case MMLOOKUPHYPERTYPE_GCPHYS:  /* (for now we'll not allow these kind of conversions) */
+            case MMLOOKUPHYPERTYPE_MMIO2:
+            case MMLOOKUPHYPERTYPE_DYNAMIC:
+                break;
+
+            default:
+                AssertMsgFailed(("enmType=%d\n", pCur->enmType));
+                break;
+        }
+
+        /* next */
+        if (pCur->offNext ==  (int32_t)NIL_OFFSET)
+            break;
+        pCur = (PMMLOOKUPHYPER)((uint8_t *)pCur + pCur->offNext);
     }
     /* give up */
Index: trunk/src/VBox/VMM/MMHyper.cpp
===================================================================
--- trunk/src/VBox/VMM/MMHyper.cpp	(revision 18716)
+++ trunk/src/VBox/VMM/MMHyper.cpp	(revision 18718)
@@ -184,10 +184,17 @@
     {
         RTGCPTR     GCPtr = pVM->mm.s.pvHyperAreaGC + pLookup->off;
-        unsigned    cPages = pLookup->cb >> PAGE_SHIFT;
+        uint32_t    cPages = pLookup->cb >> PAGE_SHIFT;
         switch (pLookup->enmType)
         {
             case MMLOOKUPHYPERTYPE_LOCKED:
-                rc = mmR3MapLocked(pVM, pLookup->u.Locked.pLockedMem, GCPtr, 0, cPages, 0);
-                break;
+            {
+                PCRTHCPHYS paHCPhysPages = pLookup->u.Locked.paHCPhysPages;
+                for (uint32_t i = 0; i < cPages; i++)
+                {
+                    rc = PGMMap(pVM, GCPtr + (i << PAGE_SHIFT), paHCPhysPages[i], PAGE_SIZE, 0);
+                    AssertRCReturn(rc, rc);
+                }
+                break;
+            }
 
             case MMLOOKUPHYPERTYPE_HCPHYS:
@@ -198,6 +205,6 @@
             {
                 const RTGCPHYS  GCPhys = pLookup->u.GCPhys.GCPhys;
-                const size_t    cb = pLookup->cb;
-                for (unsigned off = 0; off < cb; off += PAGE_SIZE)
+                const uint32_t  cb = pLookup->cb;
+                for (uint32_t off = 0; off < cb; off += PAGE_SIZE)
                 {
                     RTHCPHYS HCPhys;
@@ -565,29 +572,29 @@
     {
         /*
-         * Create a locked memory record and tell PGM about this.
+         * Copy the physical page addresses and tell PGM about them.
          */
-        PMMLOCKEDMEM pLockedMem = (PMMLOCKEDMEM)MMR3HeapAlloc(pVM, MM_TAG_MM, RT_OFFSETOF(MMLOCKEDMEM, aPhysPages[cPages]));
-        if (pLockedMem)
-        {
-            pLockedMem->pv      = pvR3;
-            pLockedMem->cb      = cPages << PAGE_SHIFT;
-            pLockedMem->eType   = MM_LOCKED_TYPE_HYPER_PAGES;
-            memset(&pLockedMem->u, 0, sizeof(pLockedMem->u));
+        PRTHCPHYS paHCPhysPages = (PRTHCPHYS)MMR3HeapAlloc(pVM, MM_TAG_MM, sizeof(RTHCPHYS) * cPages);
+        if (paHCPhysPages)
+        {
             for (size_t i = 0; i < cPages; i++)
             {
                 AssertReleaseReturn(paPages[i].Phys != 0 && paPages[i].Phys != NIL_RTHCPHYS && !(paPages[i].Phys & PAGE_OFFSET_MASK), VERR_INTERNAL_ERROR);
-                pLockedMem->aPhysPages[i].Phys = paPages[i].Phys;
-                pLockedMem->aPhysPages[i].uReserved = (RTHCUINTPTR)pLockedMem;
+                paHCPhysPages[i] = paPages[i].Phys;
             }
 
-            /* map the stuff into guest address space. */
             if (pVM->mm.s.fPGMInitialized)
-                rc = mmR3MapLocked(pVM, pLockedMem, GCPtr, 0, ~(size_t)0, 0);
+            {
+                for (size_t i = 0; i < cPages; i++)
+                {
+                    rc = PGMMap(pVM, GCPtr + (i << PAGE_SHIFT), paHCPhysPages[i], PAGE_SIZE, 0);
+                    AssertRCReturn(rc, rc);
+                }
+            }
             if (RT_SUCCESS(rc))
             {
                 pLookup->enmType = MMLOOKUPHYPERTYPE_LOCKED;
-                pLookup->u.Locked.pvR3       = pvR3;
-                pLookup->u.Locked.pvR0       = pvR0;
-                pLookup->u.Locked.pLockedMem = pLockedMem;
+                pLookup->u.Locked.pvR3          = pvR3;
+                pLookup->u.Locked.pvR0          = pvR0;
+                pLookup->u.Locked.paHCPhysPages = paHCPhysPages;
 
                 /* done. */
@@ -981,5 +988,5 @@
                 unsigned off = (uint8_t *)pvR3 - (uint8_t *)pLookup->u.Locked.pvR3;
                 if (off < pLookup->cb)
-                    return (pLookup->u.Locked.pLockedMem->aPhysPages[off >> PAGE_SHIFT].Phys & X86_PTE_PAE_PG_MASK) | (off & PAGE_OFFSET_MASK);
+                    return pLookup->u.Locked.paHCPhysPages[off >> PAGE_SHIFT] | (off & PAGE_OFFSET_MASK);
                 break;
             }
@@ -1095,10 +1102,5 @@
                                 pLookup->u.Locked.pvR3,
                                 pLookup->u.Locked.pvR0,
-                                sizeof(RTHCPTR) * 2,
-                                pLookup->u.Locked.pLockedMem->eType == MM_LOCKED_TYPE_HYPER_NOFREE  ? "nofree"
-                                : pLookup->u.Locked.pLockedMem->eType == MM_LOCKED_TYPE_HYPER       ? "autofree"
-                                : pLookup->u.Locked.pLockedMem->eType == MM_LOCKED_TYPE_HYPER_PAGES ? "pages"
-                                : pLookup->u.Locked.pLockedMem->eType == MM_LOCKED_TYPE_PHYS        ? "gstphys"
-                                : "??",
+                                sizeof(RTHCPTR) * 2, "",
                                 pLookup->pszDesc);
                 break;
Index: trunk/src/VBox/VMM/MMInternal.h
===================================================================
--- trunk/src/VBox/VMM/MMInternal.h	(revision 18716)
+++ trunk/src/VBox/VMM/MMInternal.h	(revision 18718)
@@ -493,76 +493,4 @@
 
 
-
-/**
- * Type of memory that's locked.
- */
-typedef enum MMLOCKEDTYPE
-{
-    /** Hypervisor: Ring-3 memory locked by MM. */
-    MM_LOCKED_TYPE_HYPER,
-    /** Hypervisor: Ring-3 memory locked by MM that shouldn't be freed up. */
-    MM_LOCKED_TYPE_HYPER_NOFREE,
-    /** Hypervisor: Pre-locked ring-3 pages. */
-    MM_LOCKED_TYPE_HYPER_PAGES,
-    /** Guest: Physical VM memory (RAM & MMIO2). */
-    MM_LOCKED_TYPE_PHYS
-} MMLOCKEDTYPE;
-/** Pointer to memory type. */
-typedef MMLOCKEDTYPE *PMMLOCKEDTYPE;
-
-
-/**
- * Converts a SUPPAGE pointer to a MMLOCKEDMEM pointer.
- * @returns Pointer to the MMLOCKEDMEM record the range is associated with.
- * @param   pSupPage    Pointer to SUPPAGE structure managed by MM.
- */
-#define MM_SUPRANGE_TO_MMLOCKEDMEM(pSupPage) ((PMMLOCKEDMEM)pSupPage->uReserved)
-
-
-/**
- * Locked memory record.
- */
-typedef struct MMLOCKEDMEM
-{
-    /** Address (host mapping). */
-    void                   *pv;
-    /** Size. */
-    size_t                  cb;
-    /** Next record. */
-    struct MMLOCKEDMEM     *pNext;
-    /** Record type. */
-    MMLOCKEDTYPE            eType;
-    /** Type specific data. */
-    union
-    {
-        /** Data for MM_LOCKED_TYPE_HYPER, MM_LOCKED_TYPE_HYPER_NOFREE and MM_LOCKED_TYPE_HYPER_PAGES. */
-        struct
-        {
-            unsigned        uNothing;
-        } hyper;
-
-        /** Data for MM_LOCKED_TYPE_PHYS. */
-        struct
-        {
-            /** The GC physical address.
-             * (Assuming that this is a linear range of GC physical pages.)
-             */
-            RTGCPHYS        GCPhys;
-        } phys;
-    } u;
-
-    /** Physical Page Array. (Variable length.)
-     * The uReserved field contains pointer to the MMLOCKMEM record.
-     * Use the macro MM_SUPPAGE_TO_MMLOCKEDMEM() to convert.
-     *
-     * For MM_LOCKED_TYPE_PHYS the low 12 bits of the pvPhys member
-     * are bits (MM_RAM_FLAGS_*) and not part of the physical address.
-     */
-    SUPPAGE                 aPhysPages[1];
-} MMLOCKEDMEM;
-/** Pointer to locked memory. */
-typedef MMLOCKEDMEM *PMMLOCKEDMEM;
-
-
 /**
  * Hypervisor memory mapping type.
@@ -609,6 +537,6 @@
             /** Host context ring-0 pointer. Optional. */
             RTR0PTR                 pvR0;
-            /** Pointer to the locked mem record. */
-            R3PTRTYPE(PMMLOCKEDMEM) pLockedMem;
+            /** Pointer to an array containing the physical address of each page. */
+            R3PTRTYPE(PRTHCPHYS)    paHCPhysPages;
         } Locked;
 
@@ -712,6 +640,4 @@
     /** Page pool pages in low memory R3 Ptr. */
     R3PTRTYPE(PMMPAGEPOOL)      pPagePoolLowR3;
-    /** List of memory locks. (HC only) */
-    R3PTRTYPE(PMMLOCKEDMEM)     pLockedMem;
 
     /** Pointer to the dummy page.
@@ -769,7 +695,4 @@
 int  mmR3HyperInitPaging(PVM pVM);
 
-int  mmR3LockMem(PVM pVM, void *pv, size_t cb, MMLOCKEDTYPE eType, PMMLOCKEDMEM *ppLockedMem, bool fSilentFailure);
-int  mmR3MapLocked(PVM pVM, PMMLOCKEDMEM pLockedMem, RTGCPTR Addr, unsigned iPage, size_t cPages, unsigned fFlags);
-
 const char *mmR3GetTagName(MMTAG enmTag);
 
Index: trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 18716)
+++ trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 18718)
@@ -214,5 +214,4 @@
     GEN_CHECK_OFF(MM, pHyperHeapR3);
     GEN_CHECK_OFF(MM, pHyperHeapR0);
-    GEN_CHECK_OFF(MM, pLockedMem);
     GEN_CHECK_OFF(MM, pPagePoolR3);
     GEN_CHECK_OFF(MM, pPagePoolLowR3);
@@ -252,5 +251,5 @@
     GEN_CHECK_OFF(MMLOOKUPHYPER, u.Locked.pvR3);
     GEN_CHECK_OFF(MMLOOKUPHYPER, u.Locked.pvR0);
-    GEN_CHECK_OFF(MMLOOKUPHYPER, u.Locked.pLockedMem);
+    GEN_CHECK_OFF(MMLOOKUPHYPER, u.Locked.paHCPhysPages);
     GEN_CHECK_OFF(MMLOOKUPHYPER, u.HCPhys.pvR3);
     GEN_CHECK_OFF(MMLOOKUPHYPER, u.HCPhys.HCPhys);
