Index: /trunk/include/VBox/mm.h
===================================================================
--- /trunk/include/VBox/mm.h	(revision 17278)
+++ /trunk/include/VBox/mm.h	(revision 17279)
@@ -99,7 +99,4 @@
 /** The idx value when we're out of of extents or there are simply too many mappings of this page. */
 #define MM_RAM_FLAGS_IDX_OVERFLOWED     MM_RAM_FLAGS_IDX_MASK
-
-/** Mask for masking off any references to the page. */
-#define MM_RAM_FLAGS_NO_REFS_MASK       UINT64_C(0x0000ffffffffffff)
 /** @} */
 
Index: /trunk/src/VBox/VMM/PGMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/PGMInternal.h	(revision 17278)
+++ /trunk/src/VBox/VMM/PGMInternal.h	(revision 17279)
@@ -958,4 +958,33 @@
      || (pPage)->u2HandlerVirtStateX == PGM_PAGE_HNDL_VIRT_STATE_ALL )
 
+
+
+
+/** @def PGM_PAGE_GET_TRACKING
+ * Gets the packed shadow page pool tracking data associated with a guest page.
+ * @returns uint16_t containing the data.
+ * @param   pPage       Pointer to the physical guest page tracking structure.
+ */
+#define PGM_PAGE_GET_TRACKING(pPage) \
+    ( *((uint16_t *)&(pPage)->HCPhys + 3) )
+
+/** @def PGM_PAGE_SET_TRACKING
+ * Sets the packed shadow page pool tracking data associated with a guest page.
+ * @param   pPage               Pointer to the physical guest page tracking structure.
+ * @param   u16TrackingData     The tracking data to store.
+ */
+#define PGM_PAGE_SET_TRACKING(pPage, u16TrackingData) \
+    do { *((uint16_t *)&(pPage)->HCPhys + 3) = (u16TrackingData); } while (0)
+
+/** @def PGM_PAGE_GET_TD_CREFS
+ * Gets the @a cRefs tracking data member.
+ * @returns cRefs.
+ * @param   pPage               Pointer to the physical guest page tracking structure.
+ */
+#define PGM_PAGE_GET_TD_CREFS(pPage) \
+    ((PGM_PAGE_GET_TRACKING(pPage) >> PGMPOOL_TD_CREFS_SHIFT) & PGMPOOL_TD_CREFS_MASK)
+
+#define PGM_PAGE_GET_TD_IDX(pPage) \
+    ((PGM_PAGE_GET_TRACKING(pPage) >> PGMPOOL_TD_IDX_SHIFT)   & PGMPOOL_TD_IDX_MASK)
 
 /**
@@ -1476,4 +1505,5 @@
 /**
  * Node in the chain of physical cross reference extents.
+ * @todo Calling this an 'extent' is not quite right, find a better name.
  */
 #pragma pack(1)
@@ -1886,4 +1916,61 @@
 
 
+/** @name Per guest page tracking data.
+ * This is currently as a 16-bit word in the PGMPAGE structure, the idea though
+ * is to use more bits for it and split it up later on. But for now we'll play
+ * safe and change as little as possible.
+ *
+ * The 16-bit word has two parts:
+ *
+ * The first 14-bit forms the @a idx field. It is either the index of a page in
+ * the shadow page pool, or and index into the extent list.
+ *
+ * The 2 topmost bits makes up the @a cRefs field, which counts the number of
+ * shadow page pool references to the page. If cRefs equals
+ * PGMPOOL_CREFS_PHYSEXT, then the @a idx field is an indext into the extent
+ * (misnomer) table and not the shadow page pool.
+ *
+ * See PGM_PAGE_GET_TRACKING and PGM_PAGE_SET_TRACKING for how to get and set
+ * the 16-bit word.
+ *
+ * @{ */
+/** The shift count for getting to the cRefs part. */
+#define PGMPOOL_TD_CREFS_SHIFT          14
+/** The mask applied after shifting the tracking data down by
+ * PGMPOOL_TD_CREFS_SHIFT. */
+#define PGMPOOL_TD_CREFS_MASK           0x3
+/** The cRef value used to indiciate that the idx is the head of a
+ * physical cross reference list. */
+#define PGMPOOL_TD_CREFS_PHYSEXT        PGMPOOL_TD_CREFS_MASK
+/** The shift used to get idx. */
+#define PGMPOOL_TD_IDX_SHIFT            0
+/** The mask applied to the idx after shifting down by PGMPOOL_TD_IDX_SHIFT. */
+#define PGMPOOL_TD_IDX_MASK             0x3fff
+/** The idx value when we're out of of PGMPOOLPHYSEXT entries or/and there are
+ * simply too many mappings of this page. */
+#define PGMPOOL_TD_IDX_OVERFLOWED       PGMPOOL_TD_IDX_MASK
+/** @} */
+
+#ifdef MM_RAM_FLAGS_CREFS_SHIFT
+# if MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT != PGMPOOL_TD_CREFS_SHIFT
+#  error "MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT != PGMPOOL_TD_CREFS_SHIFT"
+# endif
+# if MM_RAM_FLAGS_CREFS_MASK != MM_RAM_FLAGS_CREFS_MASK
+#  error "MM_RAM_FLAGS_CREFS_MASK != MM_RAM_FLAGS_CREFS_MASK"
+# endif
+# if MM_RAM_FLAGS_CREFS_PHYSEXT != MM_RAM_FLAGS_CREFS_PHYSEXT
+#  error "MM_RAM_FLAGS_CREFS_PHYSEXT != MM_RAM_FLAGS_CREFS_PHYSEXT"
+# endif
+# if MM_RAM_FLAGS_IDX_SHIFT - 48 != PGMPOOL_TD_IDX_SHIFT
+#  error "MM_RAM_FLAGS_IDX_SHIFT - 48 != PGMPOOL_TD_IDX_SHIFT"
+# endif
+# if MM_RAM_FLAGS_IDX_MASK != PGMPOOL_TD_IDX_MASK
+#  error "MM_RAM_FLAGS_IDX_MASK != PGMPOOL_TD_IDX_MASK"
+# endif
+# if MM_RAM_FLAGS_IDX_OVERFLOWED != PGMPOOL_TD_IDX_OVERFLOWED
+#  error "MM_RAM_FLAGS_IDX_OVERFLOWED != PGMPOOL_TD_IDX_OVERFLOWED"
+# endif
+#endif
+
 
 /**
@@ -4677,15 +4764,15 @@
      */
 # ifdef LOG_ENABLED
-    const RTHCPHYS HCPhysOrg = pPhysPage->HCPhys; /** @todo PAGE FLAGS */
+    const unsigned uOrg = PGM_PAGE_GET_TRACKING(pPhysPage);
 # endif
-    const unsigned cRefs = pPhysPage->HCPhys >> MM_RAM_FLAGS_CREFS_SHIFT; /** @todo PAGE FLAGS */
+    const unsigned cRefs = PGM_PAGE_GET_TD_CREFS(pPhysPage);
     if (cRefs == 1)
     {
-        Assert(pPoolPage->idx == ((pPhysPage->HCPhys >> MM_RAM_FLAGS_IDX_SHIFT) & MM_RAM_FLAGS_IDX_MASK));
-        pPhysPage->HCPhys = pPhysPage->HCPhys & MM_RAM_FLAGS_NO_REFS_MASK;
+        Assert(pPoolPage->idx == PGM_PAGE_GET_TD_IDX(pPhysPage));
+        PGM_PAGE_SET_TRACKING(pPhysPage, 0);
     }
     else
         pgmPoolTrackPhysExtDerefGCPhys(pPool, pPoolPage, pPhysPage);
-    Log2(("pgmTrackDerefGCPhys: HCPhys=%RHp -> %RHp\n", HCPhysOrg, pPhysPage->HCPhys));
+    Log2(("pgmTrackDerefGCPhys: %x -> %x HCPhys=%RGp\n", uOrg, PGM_PAGE_GET_TRACKING(pPhysPage), PGM_PAGE_GET_HCPHYS(pPhysPage) ));
 }
 #endif /* PGMPOOL_WITH_GCPHYS_TRACKING */
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 17278)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 17279)
@@ -946,5 +946,5 @@
     PPGMPOOLPAGE    pShwPde;
     PX86PDPAE       pPDDst;
-    
+
     /* Fetch the pgm pool shadow descriptor. */
     rc = pgmShwGetPaePoolPagePD(&pVM->pgm.s, GCPtrPage, &pShwPde);
@@ -1425,13 +1425,13 @@
     {
         STAM_COUNTER_INC(&pVM->pgm.s.StatTrackVirgin);
-        u16 = (1 << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT)) | pShwPage->idx;
+        u16 = (1 << PGMPOOL_TD_CREFS_SHIFT) | pShwPage->idx;
     }
     else
         u16 = pgmPoolTrackPhysExtAddref(pVM, u16, pShwPage->idx);
 
-    /* write back, trying to be clever... */
-    Log2(("SyncPageWorkerTrackAddRef: u16=%#x pPage->HCPhys=%RHp->%RHp iPTDst=%#x\n",
-          u16, pPage->HCPhys, (pPage->HCPhys & MM_RAM_FLAGS_NO_REFS_MASK) | ((uint64_t)u16 << MM_RAM_FLAGS_CREFS_SHIFT), iPTDst));
-    *((uint16_t *)&pPage->HCPhys + 3) = u16; /** @todo PAGE FLAGS */
+    /* write back */
+    Log2(("SyncPageWorkerTrackAddRef: u16=%#x->%#x  iPTDst=%#x\n", u16, PGM_PAGE_GET_TRACKING(pPage), iPTDst));
+    PGM_PAGE_SET_TRACKING(pPage, u16);
+
 # endif /* PGMPOOL_WITH_GCPHYS_TRACKING */
 
@@ -1655,5 +1655,5 @@
     PPGMPOOLPAGE    pShwPde;
     PX86PDPAE       pPDDst;
-    
+
     /* Fetch the pgm pool shadow descriptor. */
     int rc = pgmShwGetPaePoolPagePD(&pVM->pgm.s, GCPtrPage, &pShwPde);
@@ -2390,5 +2390,5 @@
     PX86PDPAE       pPDDst;
     PSHWPDE         pPdeDst;
-    
+
     /* Fetch the pgm pool shadow descriptor. */
     rc = pgmShwGetPaePoolPagePD(&pVM->pgm.s, GCPtrPage, &pShwPde);
@@ -2570,5 +2570,5 @@
                          | (PdeSrc.u & ~(GST_PDE_PG_MASK | X86_PDE_AVL_MASK | X86_PDE_PCD | X86_PDE_PWT | X86_PDE_PS | X86_PDE4M_G | X86_PDE4M_D));
                 *pPdeDst = PdeDst;
-# if defined(IN_RC) && defined(VBOX_WITH_PGMPOOL_PAGING_ONLY)            
+# if defined(IN_RC) && defined(VBOX_WITH_PGMPOOL_PAGING_ONLY)
                 PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
 # endif
@@ -2676,5 +2676,5 @@
             }
             *pPdeDst = PdeDst;
-# if defined(IN_RC) && defined(VBOX_WITH_PGMPOOL_PAGING_ONLY)            
+# if defined(IN_RC) && defined(VBOX_WITH_PGMPOOL_PAGING_ONLY)
             PGMDynUnlockHCPage(pVM, (uint8_t *)pPdeDst);
 # endif
@@ -2815,5 +2815,5 @@
     PX86PDPAE       pPDDst;
     PSHWPDE         pPdeDst;
-    
+
     /* Fetch the pgm pool shadow descriptor. */
     rc = pgmShwGetPaePoolPagePD(&pVM->pgm.s, GCPtrPage, &pShwPde);
@@ -4688,5 +4688,5 @@
 
 #  ifndef PGM_WITHOUT_MAPPINGS
-    /* Apply all hypervisor mappings to the new CR3. 
+    /* Apply all hypervisor mappings to the new CR3.
      * Note that SyncCR3 will be executed in case CR3 is changed in a guest paging mode; this will
      * make sure we check for conflicts in the new CR3 root.
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 17278)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 17279)
@@ -245,10 +245,10 @@
 # endif
 
-                if ((u16 >> (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT)) != MM_RAM_FLAGS_CREFS_PHYSEXT)
+                if ((u16 >> PGMPOOL_TD_CREFS_SHIFT) != MM_RAM_FLAGS_CREFS_PHYSEXT)
                     pgmPoolTrackFlushGCPhysPT(pVM,
                                               pPage,
                                               u16 & MM_RAM_FLAGS_IDX_MASK,
-                                              u16 >> (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT));
-                else if (u16 != ((MM_RAM_FLAGS_CREFS_PHYSEXT << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT)) | MM_RAM_FLAGS_IDX_OVERFLOWED))
+                                              u16 >> PGMPOOL_TD_CREFS_SHIFT);
+                else if (u16 != ((MM_RAM_FLAGS_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT) | MM_RAM_FLAGS_IDX_OVERFLOWED))
                     pgmPoolTrackFlushGCPhysPTs(pVM, pPage, u16 & MM_RAM_FLAGS_IDX_MASK);
                 else
@@ -969,5 +969,10 @@
 
             /* Do the actual remapping here. This page now serves as an alias for the backing memory specified. */
-            pPage->HCPhys = pPageRemap->HCPhys & MM_RAM_FLAGS_NO_REFS_MASK;
+#ifdef VBOX_WITH_NEW_PHYS_CODE
+            AssertReleaseFailed(); /** @todo see todo above! */
+#else
+            pPage->HCPhys = pPageRemap->HCPhys;
+            PGM_PAGE_SET_TRACKING(pPage, 0);
+#endif
 
             LogFlow(("PGMHandlerPhysicalPageAlias %RGp -> %RGp - %RHp\n", GCPhysPage, GCPhysPageRemap, pPageRemap->HCPhys));
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 17278)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 17279)
@@ -320,5 +320,5 @@
 #  ifdef PGMPOOL_WITH_GCPHYS_TRACKING
                     X86PTE GstPte;
-                    
+
                     int rc = pgmPoolPhysSimpleReadGCPhys(pPool->CTX_SUFF(pVM), &GstPte, pvAddress, GCPhysFault, sizeof(GstPte));
                     AssertRC(rc);
@@ -371,7 +371,7 @@
 
                 LogFlow(("pgmPoolMonitorChainChanging PAE for 32 bits: iGst=%x idx = %d page idx=%d\n", iGst, iShwPdpt, pPage->enmKind - PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD));
-                if (iShwPdpt == pPage->enmKind - PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD)
+                if (iShwPdpt == pPage->enmKind - (unsigned)PGMPOOLKIND_PAE_PD0_FOR_32BIT_PD)
                 {
-                    for (unsigned i=0;i<2;i++)
+                    for (unsigned i = 0; i < 2; i++)
                     {
 #  ifndef IN_RING0
@@ -678,5 +678,5 @@
 #ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
 # ifndef IN_RING0
-                    else 
+                    else
 # endif /* !IN_RING0 */
                     if (uShw.pPDPae->a[iShw2].n.u1Present)
@@ -1580,5 +1580,5 @@
                 if ((PGMPOOLKIND)pPage->enmKind == enmKind)
                 {
-                    /* Put it at the start of the use list to make sure pgmPoolTrackAddUser 
+                    /* Put it at the start of the use list to make sure pgmPoolTrackAddUser
                      * doesn't flush it in case there are no more free use records.
                      */
@@ -2334,5 +2334,5 @@
         unsigned iPage = pRam->cb >> PAGE_SHIFT;
         while (iPage-- > 0)
-            pRam->aPages[iPage].HCPhys &= MM_RAM_FLAGS_NO_REFS_MASK; /** @todo PAGE FLAGS */
+            PGM_PAGE_SET_TRACKING(&pRam->aPages[iPage], 0);
     }
 
@@ -2917,5 +2917,5 @@
     STAM_PROFILE_START(&pPool->StatTrackFlushGCPhysPT, f);
     pgmPoolTrackFlushGCPhysPTInt(pVM, pPhysPage, iShw, cRefs);
-    pPhysPage->HCPhys &= MM_RAM_FLAGS_NO_REFS_MASK; /** @todo PAGE FLAGS */
+    PGM_PAGE_SET_TRACKING(pPhysPage, 0);
     STAM_PROFILE_STOP(&pPool->StatTrackFlushGCPhysPT, f);
 }
@@ -2955,5 +2955,5 @@
     pPhysExt->iNext = pPool->iPhysExtFreeHead;
     pPool->iPhysExtFreeHead = iPhysExtStart;
-    pPhysPage->HCPhys &= MM_RAM_FLAGS_NO_REFS_MASK; /** @todo PAGE FLAGS */
+    PGM_PAGE_SET_TRACKING(pPhysPage, 0);
 
     STAM_PROFILE_STOP(&pPool->StatTrackFlushGCPhysPTs, f);
@@ -3060,5 +3060,5 @@
     }
 
-    pPhysPage->HCPhys &= MM_RAM_FLAGS_NO_REFS_MASK; /** @todo PAGE FLAGS */
+    PGM_PAGE_SET_TRACKING(pPhysPage, 0);
     STAM_PROFILE_STOP(&pPool->StatTrackFlushGCPhysPTsSlow, s);
     return VINF_SUCCESS;
@@ -3359,5 +3359,5 @@
         STAM_COUNTER_INC(&pVM->pgm.s.StatTrackAliasedMany);
         LogFlow(("pgmPoolTrackPhysExtAddref: %d:{,,%d}\n", iPhysExt, iShwPT));
-        return iPhysExt | (MM_RAM_FLAGS_CREFS_PHYSEXT << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT));
+        return iPhysExt | (MM_RAM_FLAGS_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT);
     }
 
@@ -3374,5 +3374,5 @@
                 STAM_COUNTER_INC(&pVM->pgm.s.StatTrackAliasedMany);
                 LogFlow(("pgmPoolTrackPhysExtAddref: %d:{%d} i=%d cMax=%d\n", iPhysExt, iShwPT, i, cMax));
-                return iPhysExtStart | (MM_RAM_FLAGS_CREFS_PHYSEXT << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT));
+                return iPhysExtStart | (MM_RAM_FLAGS_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT);
             }
         if (!--cMax)
@@ -3381,5 +3381,5 @@
             pgmPoolTrackPhysExtFreeList(pVM, iPhysExtStart);
             LogFlow(("pgmPoolTrackPhysExtAddref: overflow (1) iShwPT=%d\n", iShwPT));
-            return MM_RAM_FLAGS_IDX_OVERFLOWED | (MM_RAM_FLAGS_CREFS_PHYSEXT << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT));
+            return MM_RAM_FLAGS_IDX_OVERFLOWED | (MM_RAM_FLAGS_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT);
         }
     }
@@ -3391,10 +3391,10 @@
         STAM_COUNTER_INC(&pVM->pgm.s.StatTrackOverflows);
         pgmPoolTrackPhysExtFreeList(pVM, iPhysExtStart);
-        return MM_RAM_FLAGS_IDX_OVERFLOWED | (MM_RAM_FLAGS_CREFS_PHYSEXT << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT));
+        return MM_RAM_FLAGS_IDX_OVERFLOWED | (MM_RAM_FLAGS_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT);
     }
     pNew->iNext = iPhysExtStart;
     pNew->aidx[0] = iShwPT;
     LogFlow(("pgmPoolTrackPhysExtAddref: added new extent %d:{%d}->%d\n", iPhysExt, iShwPT, iPhysExtStart));
-    return iPhysExt | (MM_RAM_FLAGS_CREFS_PHYSEXT << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT));
+    return iPhysExt | (MM_RAM_FLAGS_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT);
 }
 
@@ -3411,10 +3411,10 @@
 uint16_t pgmPoolTrackPhysExtAddref(PVM pVM, uint16_t u16, uint16_t iShwPT)
 {
-    if ((u16 >> (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT)) != MM_RAM_FLAGS_CREFS_PHYSEXT)
+    if ((u16 >> PGMPOOL_TD_CREFS_SHIFT) != MM_RAM_FLAGS_CREFS_PHYSEXT)
     {
         /*
          * Convert to extent list.
          */
-        Assert((u16 >> (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT)) == 1);
+        Assert((u16 >> PGMPOOL_TD_CREFS_SHIFT) == 1);
         uint16_t iPhysExt;
         PPGMPOOLPHYSEXT pPhysExt = pgmPoolTrackPhysExtAlloc(pVM, &iPhysExt);
@@ -3425,10 +3425,10 @@
             pPhysExt->aidx[0] = u16 & MM_RAM_FLAGS_IDX_MASK;
             pPhysExt->aidx[1] = iShwPT;
-            u16 = iPhysExt | (MM_RAM_FLAGS_CREFS_PHYSEXT << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT));
+            u16 = iPhysExt | (MM_RAM_FLAGS_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT);
         }
         else
-            u16 = MM_RAM_FLAGS_IDX_OVERFLOWED | (MM_RAM_FLAGS_CREFS_PHYSEXT << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT));
-    }
-    else if (u16 != (MM_RAM_FLAGS_IDX_OVERFLOWED | (MM_RAM_FLAGS_CREFS_PHYSEXT << (MM_RAM_FLAGS_CREFS_SHIFT - MM_RAM_FLAGS_IDX_SHIFT))))
+            u16 = MM_RAM_FLAGS_IDX_OVERFLOWED | (MM_RAM_FLAGS_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT);
+    }
+    else if (u16 != (MM_RAM_FLAGS_IDX_OVERFLOWED | (MM_RAM_FLAGS_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT)))
     {
         /*
@@ -3489,5 +3489,5 @@
                         pgmPoolTrackPhysExtFree(pVM, iPhysExt);
                         Log2(("pgmPoolTrackPhysExtDerefGCPhys: HCPhys=%RX64 idx=%d lonely\n", pPhysPage->HCPhys, pPage->idx));
-                        pPhysPage->HCPhys &= MM_RAM_FLAGS_NO_REFS_MASK; /** @todo PAGE FLAGS */
+                        PGM_PAGE_SET_TRACKING(pPhysPage, 0);
                     }
                     else if (iPhysExtPrev == NIL_PGMPOOL_PHYSEXT_INDEX)
@@ -3495,7 +3495,6 @@
                         /* head */
                         Log2(("pgmPoolTrackPhysExtDerefGCPhys: HCPhys=%RX64 idx=%d head\n", pPhysPage->HCPhys, pPage->idx));
-                        pPhysPage->HCPhys = (pPhysPage->HCPhys & MM_RAM_FLAGS_NO_REFS_MASK)    /** @todo PAGE FLAGS */
-                                          | ((uint64_t)MM_RAM_FLAGS_CREFS_PHYSEXT << MM_RAM_FLAGS_CREFS_SHIFT)
-                                          | ((uint64_t)iPhysExtNext << MM_RAM_FLAGS_IDX_SHIFT);
+                        PGM_PAGE_SET_TRACKING(pPhysPage, (PGMPOOL_TD_CREFS_PHYSEXT << PGMPOOL_TD_CREFS_SHIFT)
+                                                       | (iPhysExtNext << PGMPOOL_TD_IDX_SHIFT));
                         pgmPoolTrackPhysExtFree(pVM, iPhysExt);
                     }
@@ -4207,5 +4206,5 @@
         unsigned iPage = pRam->cb >> PAGE_SHIFT;
         while (iPage-- > 0)
-            pRam->aPages[iPage].HCPhys &= MM_RAM_FLAGS_NO_REFS_MASK; /** @todo PAGE FLAGS */
+            PGM_PAGE_SET_TRACKING(&pRam->aPages[iPage], 0);
     }