Index: /trunk/src/VBox/VMM/VMMR0/GMMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/GMMR0.cpp	(revision 29221)
+++ /trunk/src/VBox/VMM/VMMR0/GMMR0.cpp	(revision 29222)
@@ -214,10 +214,10 @@
     struct GMMPAGESHARED
     {
-        /** The guest page frame number. (Max addressable: 2 ^ 44 - 16) */
+        /** The host page frame number. (Max addressable: 2 ^ 44 - 16) */
         uint32_t    pfn;
         /** The reference count (64K VMs). */
         uint32_t    cRefs : 16;
         /** Reserved. Checksum or something? Two hGVMs for forking? */
-        uint32_t    u30Reserved : 14;
+        uint32_t    u14Reserved : 14;
         /** The page state. */
         uint32_t    u2State : 2;
@@ -2625,8 +2625,9 @@
  * @param   pGMM        Pointer to the GMM instance.
  * @param   pGVM        Pointer to the GVM instance.
+ * @param   HCPhys      Host physical address
  * @param   idPage      The Page ID
  * @param   pPage       The page structure.
  */
-DECLINLINE(void) gmmR0ConvertToSharedPage(PGMM pGMM, PGVM pGVM, uint32_t idPage, PGMMPAGE pPage)
+DECLINLINE(void) gmmR0ConvertToSharedPage(PGMM pGMM, PGVM pGVM, RTHCPHYS HCPhys, uint32_t idPage, PGMMPAGE pPage)
 {
     PGMMCHUNK pChunk = gmmR0GetChunk(pGMM, idPage >> GMM_CHUNKID_SHIFT);
@@ -2644,5 +2645,5 @@
 
     /* Modify the page structure. */
-    pPage->Shared.pfn     = pPage->Private.pfn;     /* same location */
+    pPage->Shared.pfn     = (uint32_t)(HCPhys >> PAGE_SHIFT);
     pPage->Shared.cRefs   = 1;
     pPage->Common.u2State = GMM_PAGE_STATE_SHARED;
@@ -3700,6 +3701,6 @@
  *
  * Performs the following tasks:
- * - if a shared page is new, then it changes the GMM page type to shared and returns it in the paHCPhysPageID array
- * - if a shared page already exists, then it checks if the VM page is identical and if so frees the VM page and returns the shared page in the paHCPhysPageID array
+ * - if a shared page is new, then it changes the GMM page type to shared and returns it in the paPageDesc array
+ * - if a shared page already exists, then it checks if the VM page is identical and if so frees the VM page and returns the shared page in the paPageDesc array
  *
  * @returns VBox status code.
@@ -3708,5 +3709,5 @@
  * @param   pReq                Module description
  * @param   idxRegion           Region index
- * @param   cPages              Number of entries in the paHCPhysAndPageID array
+ * @param   cPages              Number of entries in the paPageDesc array
  * @param   paPageDesc          Page descriptor array (in/out)
  */
@@ -3769,5 +3770,5 @@
             {
                 /* We've seen this shared page for the first time? */
-                if (pGlobalRegion->paHCPhysPageID[i] == NIL_GMM_PAGEID)
+                if (pGlobalRegion->paHCPhysPageID == NIL_GMM_PAGEID)
                 {
                     /* Easy case: just change the internal page type. */
@@ -3779,9 +3780,9 @@
                         goto end;
                     }
-                    Log(("New shared page guest %RGp host %RHp\n", paPageDesc[i].GCPhys, (pPage->Private.pfn << 12)));
+                    Log(("New shared page guest %RGp host %RHp\n", paPageDesc[i].GCPhys, paPageDesc[i].HCPhys));
 
                     Assert(paPageDesc[i].HCPhys == (pPage->Private.pfn << 12));
 
-                    gmmR0ConvertToSharedPage(pGMM, pGVM, paPageDesc[i].uHCPhysPageId, pPage);
+                    gmmR0ConvertToSharedPage(pGMM, pGVM, paPageDesc[i].HCPhys, paPageDesc[i].uHCPhysPageId, pPage);
 
                     /* Keep track of these references. */
@@ -3806,5 +3807,5 @@
                     Assert(pPage->Common.u2State == GMM_PAGE_STATE_SHARED);
 
-                    Log(("Replace existing page guest %RGp host %RHp -> %RHp\n", paPageDesc[i].GCPhys, paPageDesc[i].HCPhys, (pPage->Private.pfn << 12)));
+                    Log(("Replace existing page guest %RGp host %RHp -> %RHp\n", paPageDesc[i].GCPhys, paPageDesc[i].HCPhys, pPage->Shared.pfn << PAGE_SHIFT));
 
                     /* Calculate the virtual address of the local page. */
@@ -3860,5 +3861,5 @@
 
                     /* Pass along the new physical address & page id. */
-                    paPageDesc[i].HCPhys        = (pPage->Private.pfn << 12);
+                    paPageDesc[i].HCPhys        = pPage->Shared.pfn << PAGE_SHIFT;
                     paPageDesc[i].uHCPhysPageId = pGlobalRegion->paHCPhysPageID[i];
                 }
