Index: /trunk/src/VBox/VMM/PGM.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGM.cpp	(revision 31139)
+++ /trunk/src/VBox/VMM/PGM.cpp	(revision 31140)
@@ -2943,5 +2943,4 @@
     pVCpu->pgm.s.pfnR3BthSyncCR3              = pModeData->pfnR3BthSyncCR3;
     Assert(pVCpu->pgm.s.pfnR3BthSyncCR3);
-    pVCpu->pgm.s.pfnR3BthSyncPage             = pModeData->pfnR3BthSyncPage;
     pVCpu->pgm.s.pfnR3BthPrefetchPage         = pModeData->pfnR3BthPrefetchPage;
     pVCpu->pgm.s.pfnR3BthVerifyAccessSyncPage = pModeData->pfnR3BthVerifyAccessSyncPage;
@@ -2955,5 +2954,4 @@
     pVCpu->pgm.s.pfnRCBthInvalidatePage       = pModeData->pfnRCBthInvalidatePage;
     pVCpu->pgm.s.pfnRCBthSyncCR3              = pModeData->pfnRCBthSyncCR3;
-    pVCpu->pgm.s.pfnRCBthSyncPage             = pModeData->pfnRCBthSyncPage;
     pVCpu->pgm.s.pfnRCBthPrefetchPage         = pModeData->pfnRCBthPrefetchPage;
     pVCpu->pgm.s.pfnRCBthVerifyAccessSyncPage = pModeData->pfnRCBthVerifyAccessSyncPage;
@@ -2967,5 +2965,4 @@
     pVCpu->pgm.s.pfnR0BthInvalidatePage       = pModeData->pfnR0BthInvalidatePage;
     pVCpu->pgm.s.pfnR0BthSyncCR3              = pModeData->pfnR0BthSyncCR3;
-    pVCpu->pgm.s.pfnR0BthSyncPage             = pModeData->pfnR0BthSyncPage;
     pVCpu->pgm.s.pfnR0BthPrefetchPage         = pModeData->pfnR0BthPrefetchPage;
     pVCpu->pgm.s.pfnR0BthVerifyAccessSyncPage = pModeData->pfnR0BthVerifyAccessSyncPage;
Index: /trunk/src/VBox/VMM/PGMBth.h
===================================================================
--- /trunk/src/VBox/VMM/PGMBth.h	(revision 31139)
+++ /trunk/src/VBox/VMM/PGMBth.h	(revision 31140)
@@ -27,5 +27,4 @@
 PGM_BTH_DECL(int, Trap0eHandler)(PVMCPU pVCpu, RTGCUINT uErr, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, bool *pfLockTaken);
 PGM_BTH_DECL(int, SyncCR3)(PVMCPU pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal);
-PGM_BTH_DECL(int, SyncPage)(PVMCPU pVCpu, X86PDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uError);
 PGM_BTH_DECL(int, VerifyAccessSyncPage)(PVMCPU pVCpu, RTGCPTR Addr, unsigned fPage, unsigned uError);
 PGM_BTH_DECL(int, InvalidatePage)(PVMCPU pVCpu, RTGCPTR GCPtrPage);
@@ -54,5 +53,4 @@
     pModeData->pfnR3BthSyncCR3              = PGM_BTH_NAME(SyncCR3);
     pModeData->pfnR3BthInvalidatePage       = PGM_BTH_NAME(InvalidatePage);
-    pModeData->pfnR3BthSyncPage             = PGM_BTH_NAME(SyncPage);
     pModeData->pfnR3BthPrefetchPage         = PGM_BTH_NAME(PrefetchPage);
     pModeData->pfnR3BthVerifyAccessSyncPage = PGM_BTH_NAME(VerifyAccessSyncPage);
@@ -74,7 +72,5 @@
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_BTH_NAME_RC_STR(InvalidatePage), rc), rc);
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_BTH_NAME_RC_STR(SyncCR3),             &pModeData->pfnRCBthSyncCR3);
-        AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_BTH_NAME_RC_STR(SyncPage), rc), rc);
-        rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_BTH_NAME_RC_STR(SyncPage),            &pModeData->pfnRCBthSyncPage);
-        AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_BTH_NAME_RC_STR(SyncPage), rc), rc);
+        AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_BTH_NAME_RC_STR(SyncCR3), rc), rc);
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_BTH_NAME_RC_STR(PrefetchPage),        &pModeData->pfnRCBthPrefetchPage);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_BTH_NAME_RC_STR(PrefetchPage), rc), rc);
@@ -98,6 +94,4 @@
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_BTH_NAME_R0_STR(SyncCR3),             &pModeData->pfnR0BthSyncCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_BTH_NAME_R0_STR(SyncCR3), rc), rc);
-        rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_BTH_NAME_R0_STR(SyncPage),            &pModeData->pfnR0BthSyncPage);
-        AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_BTH_NAME_R0_STR(SyncPage), rc), rc);
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_BTH_NAME_R0_STR(PrefetchPage),        &pModeData->pfnR0BthPrefetchPage);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_BTH_NAME_R0_STR(PrefetchPage), rc), rc);
Index: /trunk/src/VBox/VMM/PGMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/PGMInternal.h	(revision 31139)
+++ /trunk/src/VBox/VMM/PGMInternal.h	(revision 31140)
@@ -2572,5 +2572,4 @@
     DECLR3CALLBACKMEMBER(int,       pfnR3BthInvalidatePage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLR3CALLBACKMEMBER(int,       pfnR3BthSyncCR3,(PVMCPU pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal));
-    DECLR3CALLBACKMEMBER(int,       pfnR3BthSyncPage,(PVMCPU pVCpu, X86PDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uError));
     DECLR3CALLBACKMEMBER(int,       pfnR3BthPrefetchPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLR3CALLBACKMEMBER(int,       pfnR3BthVerifyAccessSyncPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage, unsigned fFlags, unsigned uError));
@@ -2584,5 +2583,4 @@
     DECLRCCALLBACKMEMBER(int,       pfnRCBthInvalidatePage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLRCCALLBACKMEMBER(int,       pfnRCBthSyncCR3,(PVMCPU pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal));
-    DECLRCCALLBACKMEMBER(int,       pfnRCBthSyncPage,(PVMCPU pVCpu, X86PDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uError));
     DECLRCCALLBACKMEMBER(int,       pfnRCBthPrefetchPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLRCCALLBACKMEMBER(int,       pfnRCBthVerifyAccessSyncPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage, unsigned fFlags, unsigned uError));
@@ -2596,5 +2594,4 @@
     DECLR0CALLBACKMEMBER(int,       pfnR0BthInvalidatePage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLR0CALLBACKMEMBER(int,       pfnR0BthSyncCR3,(PVMCPU pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal));
-    DECLR0CALLBACKMEMBER(int,       pfnR0BthSyncPage,(PVMCPU pVCpu, X86PDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uError));
     DECLR0CALLBACKMEMBER(int,       pfnR0BthPrefetchPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLR0CALLBACKMEMBER(int,       pfnR0BthVerifyAccessSyncPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage, unsigned fFlags, unsigned uError));
@@ -3476,5 +3473,4 @@
     DECLR3CALLBACKMEMBER(int,       pfnR3BthInvalidatePage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLR3CALLBACKMEMBER(int,       pfnR3BthSyncCR3,(PVMCPU pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal));
-    DECLR3CALLBACKMEMBER(int,       pfnR3BthSyncPage,(PVMCPU pVCpu, X86PDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uError));
     DECLR3CALLBACKMEMBER(int,       pfnR3BthPrefetchPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLR3CALLBACKMEMBER(int,       pfnR3BthVerifyAccessSyncPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage, unsigned fFlags, unsigned uError));
@@ -3486,5 +3482,4 @@
     DECLR0CALLBACKMEMBER(int,       pfnR0BthInvalidatePage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLR0CALLBACKMEMBER(int,       pfnR0BthSyncCR3,(PVMCPU pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal));
-    DECLR0CALLBACKMEMBER(int,       pfnR0BthSyncPage,(PVMCPU pVCpu, X86PDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uError));
     DECLR0CALLBACKMEMBER(int,       pfnR0BthPrefetchPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLR0CALLBACKMEMBER(int,       pfnR0BthVerifyAccessSyncPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage, unsigned fFlags, unsigned uError));
@@ -3496,5 +3491,4 @@
     DECLRCCALLBACKMEMBER(int,       pfnRCBthInvalidatePage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLRCCALLBACKMEMBER(int,       pfnRCBthSyncCR3,(PVMCPU pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal));
-    DECLRCCALLBACKMEMBER(int,       pfnRCBthSyncPage,(PVMCPU pVCpu, X86PDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uError));
     DECLRCCALLBACKMEMBER(int,       pfnRCBthPrefetchPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage));
     DECLRCCALLBACKMEMBER(int,       pfnRCBthVerifyAccessSyncPage,(PVMCPU pVCpu, RTGCPTR GCPtrPage, unsigned fFlags, unsigned uError));
@@ -3502,5 +3496,7 @@
     DECLRCCALLBACKMEMBER(int,       pfnRCBthMapCR3,(PVMCPU pVCpu, RTGCPHYS GCPhysCR3));
     DECLRCCALLBACKMEMBER(int,       pfnRCBthUnmapCR3,(PVMCPU pVCpu));
+#if 0
     RTRCPTR                         alignment2; /**< structure size alignment. */
+#endif
     /** @} */
 
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 31139)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 31140)
@@ -34,8 +34,7 @@
 PGM_BTH_DECL(int, Trap0eHandler)(PVMCPU pVCpu, RTGCUINT uErr, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, bool *pfLockTaken);
 PGM_BTH_DECL(int, InvalidatePage)(PVMCPU pVCpu, RTGCPTR GCPtrPage);
-PGM_BTH_DECL(int, SyncPage)(PVMCPU pVCpu, GSTPDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uErr);
-PGM_BTH_DECL(int, CheckPageFault)(PVMCPU pVCpu, uint32_t uErr, PGSTPDE pPdeSrc, RTGCPTR GCPtrPage);
-PGM_BTH_DECL(int, CheckDirtyPageFault)(PVMCPU pVCpu, uint32_t uErr, PSHWPDE pPdeDst, GSTPDE const *pPdeSrc, RTGCPTR GCPtrPage);
-PGM_BTH_DECL(int, SyncPT)(PVMCPU pVCpu, unsigned iPD, PGSTPD pPDSrc, RTGCPTR GCPtrPage);
+static int PGM_BTH_NAME(SyncPage)(PVMCPU pVCpu, GSTPDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uErr);
+static int PGM_BTH_NAME(CheckDirtyPageFault)(PVMCPU pVCpu, uint32_t uErr, PSHWPDE pPdeDst, GSTPDE const *pPdeSrc, RTGCPTR GCPtrPage);
+static int PGM_BTH_NAME(SyncPT)(PVMCPU pVCpu, unsigned iPD, PGSTPD pPDSrc, RTGCPTR GCPtrPage);
 PGM_BTH_DECL(int, VerifyAccessSyncPage)(PVMCPU pVCpu, RTGCPTR Addr, unsigned fPage, unsigned uErr);
 PGM_BTH_DECL(int, PrefetchPage)(PVMCPU pVCpu, RTGCPTR GCPtrPage);
@@ -44,5 +43,4 @@
 PGM_BTH_DECL(unsigned, AssertCR3)(PVMCPU pVCpu, uint64_t cr3, uint64_t cr4, RTGCPTR GCPtr = 0, RTGCPTR cb = ~(RTGCPTR)0);
 #endif
-DECLINLINE(void) PGM_BTH_NAME(SyncPageWorkerTrackDeref)(PVMCPU pVCpu, PPGMPOOLPAGE pShwPage, RTHCPHYS HCPhys, uint16_t iPte);
 PGM_BTH_DECL(int, MapCR3)(PVMCPU pVCpu, RTGCPHYS GCPhysCR3);
 PGM_BTH_DECL(int, UnmapCR3)(PVMCPU pVCpu);
@@ -391,5 +389,5 @@
 # if  (   PGM_GST_TYPE == PGM_TYPE_32BIT || PGM_GST_TYPE == PGM_TYPE_REAL || PGM_GST_TYPE == PGM_TYPE_PROT \
        || PGM_GST_TYPE == PGM_TYPE_PAE   || PGM_GST_TYPE == PGM_TYPE_AMD64) \
-    && PGM_SHW_TYPE != PGM_TYPE_NESTED    \
+    && PGM_SHW_TYPE != PGM_TYPE_NESTED \
     && (PGM_SHW_TYPE != PGM_TYPE_EPT || PGM_GST_TYPE == PGM_TYPE_PROT)
     int rc;
@@ -1710,5 +1708,5 @@
  * @param   uErr        Fault error (X86_TRAP_PF_*).
  */
-PGM_BTH_DECL(int, SyncPage)(PVMCPU pVCpu, GSTPDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uErr)
+static int PGM_BTH_NAME(SyncPage)(PVMCPU pVCpu, GSTPDE PdeSrc, RTGCPTR GCPtrPage, unsigned cPages, unsigned uErr)
 {
     PVM      pVM = pVCpu->CTX_SUFF(pVM);
@@ -2274,200 +2272,4 @@
 
 /**
- * Investigate a page fault to identify ones targetted at the guest and to
- * handle write protection page faults caused by dirty bit tracking.
- *
- * This will do detect invalid entries and raise X86_TRAP_PF_RSVD.
- *
- * @returns VBox status code.
- * @param   pVCpu       The VMCPU handle.
- * @param   uErr        Page fault error code.  The X86_TRAP_PF_RSVD flag
- *                      cannot be trusted as it is used for MMIO optimizations.
- * @param   pPdeSrc     Guest page directory entry.
- * @param   GCPtrPage   Guest context page address.
- */
-PGM_BTH_DECL(int, CheckPageFault)(PVMCPU pVCpu, uint32_t uErr, PGSTPDE pPdeSrc, RTGCPTR GCPtrPage)
-{
-    bool        fUserLevelFault      = !!(uErr & X86_TRAP_PF_US);
-    bool        fWriteFault          = !!(uErr & X86_TRAP_PF_RW);
-# if PGM_WITH_NX(PGM_GST_TYPE, PGM_SHW_TYPE)
-    bool        fMaybeNXEFault       =   (uErr & X86_TRAP_PF_ID) && GST_IS_NX_ACTIVE(pVCpu);
-# endif
-    bool        fMaybeWriteProtFault = fWriteFault && (fUserLevelFault || CPUMIsGuestR0WriteProtEnabled(pVCpu));
-    PVM         pVM                  = pVCpu->CTX_SUFF(pVM);
-    int         rc;
-
-    LogFlow(("CheckPageFault: GCPtrPage=%RGv uErr=%#x PdeSrc=%08x\n", GCPtrPage, uErr, pPdeSrc->u));
-
-    /*
-     * Note! For PAE it is safe to assume that bad guest physical addresses
-     *       (which returns all FFs) in the translation tables will cause
-     *       #PF(RSVD).  The same will be the case for long mode provided the
-     *       physical address width is less than 52 bits - this we ASSUME.
-     *
-     * Note! No convenient shortcuts here, we have to validate everything!
-     */
-
-# if PGM_GST_TYPE == PGM_TYPE_AMD64
-    /*
-     * Real page fault? (PML4E level)
-     */
-    PX86PML4    pPml4Src  = pgmGstGetLongModePML4Ptr(pVCpu);
-    if (RT_UNLIKELY(!pPml4Src))
-        return PGM_BTH_NAME(CheckPageFaultReturnRSVD)(pVCpu, uErr, GCPtrPage, 0);
-
-    PX86PML4E   pPml4eSrc = &pPml4Src->a[(GCPtrPage >> X86_PML4_SHIFT) & X86_PML4_MASK];
-    if (!pPml4eSrc->n.u1Present)
-        return PGM_BTH_NAME(CheckPageFaultReturnNP)(pVCpu, uErr, GCPtrPage, 0);
-    if (RT_UNLIKELY(!GST_IS_PML4E_VALID(pVCpu, *pPml4eSrc)))
-        return PGM_BTH_NAME(CheckPageFaultReturnRSVD)(pVCpu, uErr, GCPtrPage, 0);
-    if (   (fMaybeWriteProtFault && !pPml4eSrc->n.u1Write)
-        || (fMaybeNXEFault       &&  pPml4eSrc->n.u1NoExecute)
-        || (fUserLevelFault      && !pPml4eSrc->n.u1User) )
-        return PGM_BTH_NAME(CheckPageFaultReturnProt)(pVCpu, uErr, GCPtrPage, 0);
-
-    /*
-     * Real page fault? (PDPE level)
-     */
-    PX86PDPT pPdptSrc;
-    rc = PGM_GCPHYS_2_PTR_BY_VMCPU(pVCpu, pPml4eSrc->u & X86_PML4E_PG_MASK, &pPdptSrc);
-    if (RT_FAILURE(rc))
-    {
-        AssertMsgReturn(rc == VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS, ("%Rrc\n", rc), rc);
-        return PGM_BTH_NAME(CheckPageFaultReturnRSVD)(pVCpu, uErr, GCPtrPage, 1);
-    }
-
-    PX86PDPE pPdpeSrc = &pPdptSrc->a[(GCPtrPage >> X86_PDPT_SHIFT) & X86_PDPT_MASK_AMD64];
-    if (!pPdpeSrc->n.u1Present)
-        return PGM_BTH_NAME(CheckPageFaultReturnNP)(pVCpu, uErr, GCPtrPage, 1);
-    if (!GST_IS_PDPE_VALID(pVCpu, *pPdpeSrc))
-        return PGM_BTH_NAME(CheckPageFaultReturnRSVD)(pVCpu, uErr, GCPtrPage, 1);
-    if (   (fMaybeWriteProtFault && !pPdpeSrc->lm.u1Write)
-        || (fMaybeNXEFault       &&  pPdpeSrc->lm.u1NoExecute)
-        || (fUserLevelFault      && !pPdpeSrc->lm.u1User) )
-        return PGM_BTH_NAME(CheckPageFaultReturnProt)(pVCpu, uErr, GCPtrPage, 1);
-
-# elif PGM_GST_TYPE == PGM_TYPE_PAE
-    /*
-     * Real page fault? (PDPE level)
-     */
-    PX86PDPT pPdptSrc = pgmGstGetPaePDPTPtr(pVCpu);
-    if (RT_UNLIKELY(!pPdptSrc))
-        return PGM_BTH_NAME(CheckPageFaultReturnRSVD)(pVCpu, uErr, GCPtrPage, 1);
-/** @todo Handle bad CR3 address. */
-    PX86PDPE pPdpeSrc = pgmGstGetPaePDPEPtr(pVCpu, GCPtrPage);
-    if (!pPdpeSrc->n.u1Present)
-        return PGM_BTH_NAME(CheckPageFaultReturnNP)(pVCpu, uErr, GCPtrPage, 1);
-    if (!GST_IS_PDPE_VALID(pVCpu, *pPdpeSrc))
-        return PGM_BTH_NAME(CheckPageFaultReturnRSVD)(pVCpu, uErr, GCPtrPage, 1);
-# endif /* PGM_GST_TYPE == PGM_TYPE_PAE */
-
-    /*
-     * Real page fault? (PDE level)
-     */
-    if (!pPdeSrc->n.u1Present)
-        return PGM_BTH_NAME(CheckPageFaultReturnNP)(pVCpu, uErr, GCPtrPage, 2);
-    bool const fBigPage = pPdeSrc->b.u1Size && GST_IS_PSE_ACTIVE(pVCpu);
-    if (!fBigPage ? !GST_IS_PDE_VALID(pVCpu, *pPdeSrc) : !GST_IS_BIG_PDE_VALID(pVCpu, *pPdeSrc))
-        return PGM_BTH_NAME(CheckPageFaultReturnRSVD)(pVCpu, uErr, GCPtrPage, 2);
-    if (   (fMaybeWriteProtFault && !pPdeSrc->n.u1Write)
-# if PGM_WITH_NX(PGM_GST_TYPE, PGM_SHW_TYPE)
-        || (fMaybeNXEFault       &&  pPdeSrc->n.u1NoExecute)
-# endif
-        || (fUserLevelFault      && !pPdeSrc->n.u1User) )
-        return PGM_BTH_NAME(CheckPageFaultReturnProt)(pVCpu, uErr, GCPtrPage, 2);
-
-    /*
-     * First check the easy case where the page directory has been marked
-     * read-only to track the dirty bit of an emulated BIG page.
-     */
-    if (fBigPage)
-    {
-        /* Mark guest page directory as accessed */
-# if PGM_GST_TYPE == PGM_TYPE_AMD64
-        pPml4eSrc->n.u1Accessed = 1;
-        pPdpeSrc->lm.u1Accessed = 1;
-# endif
-        pPdeSrc->b.u1Accessed   = 1;
-
-        /* Mark the entry guest PDE dirty it it's a write access. */
-        if (fWriteFault)
-            pPdeSrc->b.u1Dirty = 1;
-    }
-    else
-    {
-        /*
-         * Map the guest page table.
-         */
-        PGSTPT  pPTSrc;
-        PGSTPTE pPteSrc;
-        GSTPTE  PteSrc;
-        rc = PGM_GCPHYS_2_PTR(pVM, pPdeSrc->u & GST_PDE_PG_MASK, &pPTSrc);
-        if (RT_SUCCESS(rc))
-        {
-            pPteSrc = &pPTSrc->a[(GCPtrPage >> GST_PT_SHIFT) & GST_PT_MASK];
-            PteSrc.u = pPteSrc->u;
-        }
-        else if (rc == VERR_PGM_INVALID_GC_PHYSICAL_ADDRESS)
-        {
-            /* All bits in the PTE are set. */
-# if PGM_GST_TYPE == PGM_TYPE_32BIT
-            PteSrc.u = UINT32_MAX;
-# else
-            PteSrc.u = UINT64_MAX;
-# endif
-            pPteSrc = &PteSrc;
-        }
-        else
-        {
-            AssertRC(rc);
-            return rc;
-        }
-
-        /*
-         * Real page fault?
-         */
-        if (!PteSrc.n.u1Present)
-            return PGM_BTH_NAME(CheckPageFaultReturnNP)(pVCpu, uErr, GCPtrPage, 3);
-        if (!GST_IS_PTE_VALID(pVCpu, PteSrc))
-            return PGM_BTH_NAME(CheckPageFaultReturnRSVD)(pVCpu, uErr, GCPtrPage, 3);
-        if (   (fMaybeWriteProtFault && !PteSrc.n.u1Write)
-# if PGM_WITH_NX(PGM_GST_TYPE, PGM_SHW_TYPE)
-            || (fMaybeNXEFault       &&  PteSrc.n.u1NoExecute)
-# endif
-            || (fUserLevelFault      && !PteSrc.n.u1User) )
-            return PGM_BTH_NAME(CheckPageFaultReturnProt)(pVCpu, uErr, GCPtrPage, 0);
-
-        LogFlow(("CheckPageFault: page fault at %RGv PteSrc.u=%08x\n", GCPtrPage, PteSrc.u));
-
-        /*
-         * Set the accessed bits in the page directory and the page table.
-         */
-# if PGM_GST_TYPE == PGM_TYPE_AMD64
-        pPml4eSrc->n.u1Accessed = 1;
-        pPdpeSrc->lm.u1Accessed = 1;
-# endif
-        pPdeSrc->n.u1Accessed   = 1;
-        pPteSrc->n.u1Accessed   = 1;
-
-        /*
-         * Set the dirty flag in the PTE if it's a write access.
-         */
-        if (fWriteFault)
-        {
-# ifdef VBOX_WITH_STATISTICS
-            if (!pPteSrc->n.u1Dirty)
-                STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,DirtiedPage));
-            else
-                STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,PageAlreadyDirty));
-# endif
-
-            pPteSrc->n.u1Dirty = 1;
-        }
-    }
-    return VINF_SUCCESS;
-}
-
-
-/**
  * Handle dirty bit tracking faults.
  *
@@ -2479,5 +2281,5 @@
  * @param   GCPtrPage   Guest context page address.
  */
-PGM_BTH_DECL(int, CheckDirtyPageFault)(PVMCPU pVCpu, uint32_t uErr, PSHWPDE pPdeDst, GSTPDE const *pPdeSrc, RTGCPTR GCPtrPage)
+static int PGM_BTH_NAME(CheckDirtyPageFault)(PVMCPU pVCpu, uint32_t uErr, PSHWPDE pPdeDst, GSTPDE const *pPdeSrc, RTGCPTR GCPtrPage)
 {
     PVM         pVM   = pVCpu->CTX_SUFF(pVM);
@@ -2660,5 +2462,5 @@
  * @param   GCPtrPage   GC Pointer of the page that caused the fault
  */
-PGM_BTH_DECL(int, SyncPT)(PVMCPU pVCpu, unsigned iPDSrc, PGSTPD pPDSrc, RTGCPTR GCPtrPage)
+static int PGM_BTH_NAME(SyncPT)(PVMCPU pVCpu, unsigned iPDSrc, PGSTPD pPDSrc, RTGCPTR GCPtrPage)
 {
     PVM             pVM      = pVCpu->CTX_SUFF(pVM);
@@ -2673,9 +2475,9 @@
     Assert(PGMIsLocked(pVM));
 
-#if   (   PGM_GST_TYPE == PGM_TYPE_32BIT  \
-       || PGM_GST_TYPE == PGM_TYPE_PAE    \
-       || PGM_GST_TYPE == PGM_TYPE_AMD64) \
-    && PGM_SHW_TYPE != PGM_TYPE_NESTED    \
-    && PGM_SHW_TYPE != PGM_TYPE_EPT
+#if (   PGM_GST_TYPE == PGM_TYPE_32BIT \
+     || PGM_GST_TYPE == PGM_TYPE_PAE \
+     || PGM_GST_TYPE == PGM_TYPE_AMD64) \
+ && PGM_SHW_TYPE != PGM_TYPE_NESTED \
+ && PGM_SHW_TYPE != PGM_TYPE_EPT
 
     int             rc       = VINF_SUCCESS;
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllGst.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllGst.h	(revision 31139)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllGst.h	(revision 31140)
@@ -24,5 +24,5 @@
  || PGM_GST_TYPE == PGM_TYPE_PAE \
  || PGM_GST_TYPE == PGM_TYPE_AMD64
-PGM_GST_DECL(int,  Walk)(PVMCPU pVCpu, RTGCPTR GCPtr, PGSTPTWALK pWalk);
+static int PGM_GST_NAME(Walk)(PVMCPU pVCpu, RTGCPTR GCPtr, PGSTPTWALK pWalk);
 #endif
 PGM_GST_DECL(int,  GetPage)(PVMCPU pVCpu, RTGCPTR GCPtr, uint64_t *pfFlags, PRTGCPHYS pGCPhys);
@@ -73,5 +73,5 @@
  * @param   pWalk       Where to return the walk result. This is always set.
  */
-PGM_GST_DECL(int, Walk)(PVMCPU pVCpu, RTGCPTR GCPtr, PGSTPTWALK pWalk)
+static int PGM_GST_NAME(Walk)(PVMCPU pVCpu, RTGCPTR GCPtr, PGSTPTWALK pWalk)
 {
     int rc;
@@ -285,46 +285,22 @@
     if (pfFlags)
     {
-        /* The RW and US flags are determined via bitwise AND across all levels. */
-        uint64_t fUpperRwUs = (X86_PTE_RW | X86_PTE_US)
-#  if PGM_GST_TYPE == PGM_TYPE_AMD64
-                            & Walk.Pml4e.u
-                            & Walk.Pdpe.u
-#  endif
-                            & Walk.Pde.u;
-        fUpperRwUs |= ~(uint64_t)(X86_PTE_RW | X86_PTE_US);
-
-        /* The RW and US flags are determined via bitwise AND across all levels. */
+        if (!Walk.Core.fBigPage)
+            *pfFlags = (Walk.Pte.u & ~(GST_PTE_PG_MASK | X86_PTE_RW | X86_PTE_US))                      /* NX not needed */
+                     | (Walk.Core.fEffectiveRW ? X86_PTE_RW : 0)
+                     | (Walk.Core.fEffectiveUS ? X86_PTE_US : 0)
 # if PGM_WITH_NX(PGM_GST_TYPE, PGM_GST_TYPE)
-        uint32_t fUpperNx   = 0
-#  if PGM_GST_TYPE == PGM_TYPE_AMD64
-                            | Walk.Pml4e.n.u1NoExecute
-                            | Walk.Pdpe.lm.u1NoExecute
-#  endif
-                            | Walk.Pde.n.u1NoExecute;
-# endif
-
-        if (!Walk.Core.fBigPage)
-        {
-            *pfFlags = (Walk.Pte.u & ~GST_PTE_PG_MASK) & fUpperRwUs;
-# if PGM_WITH_NX(PGM_GST_TYPE, PGM_GST_TYPE)
-            if (Walk.Pte.n.u1NoExecute || fUpperNx)
-            {
-                Assert(GST_IS_NX_ACTIVE(pVCpu)); /* should trigger RSVD error otherwise. */
-                *pfFlags |= X86_PTE_PAE_NX;
-            }
-# endif
-        }
+                     | (Walk.Core.fEffectiveNX ? X86_PTE_PAE_NX : 0)
+# endif
+                     ;
         else
         {
-            *pfFlags = (  (Walk.Pde.u & ~(GST_PTE_PG_MASK | X86_PTE_PAT))
-                        | ((Walk.Pde.u & X86_PDE4M_PAT) >> X86_PDE4M_PAT_SHIFT))
-                     & fUpperRwUs;
+            *pfFlags = (Walk.Pde.u & ~(GST_PTE_PG_MASK | X86_PDE4M_RW | X86_PDE4M_US | X86_PDE4M_PS))   /* NX not needed */
+                     | ((Walk.Pde.u & X86_PDE4M_PAT) >> X86_PDE4M_PAT_SHIFT)
+                     | (Walk.Core.fEffectiveRW ? X86_PTE_RW : 0)
+                     | (Walk.Core.fEffectiveUS ? X86_PTE_US : 0)
 # if PGM_WITH_NX(PGM_GST_TYPE, PGM_GST_TYPE)
-            if (fUpperNx)
-            {
-                Assert(GST_IS_NX_ACTIVE(pVCpu)); /* should trigger RSVD error otherwise. */
-                *pfFlags |= X86_PTE_PAE_NX;
-            }
-# endif
+                     | (Walk.Core.fEffectiveNX ? X86_PTE_PAE_NX : 0)
+# endif
+                     ;
         }
     }
Index: /trunk/src/VBox/VMM/testcase/tstVMStructRC.cpp
===================================================================
--- /trunk/src/VBox/VMM/testcase/tstVMStructRC.cpp	(revision 31139)
+++ /trunk/src/VBox/VMM/testcase/tstVMStructRC.cpp	(revision 31140)
@@ -510,5 +510,4 @@
     GEN_CHECK_OFF(PGMCPU, pfnR3BthSyncCR3);
     GEN_CHECK_OFF(PGMCPU, pfnR3BthInvalidatePage);
-    GEN_CHECK_OFF(PGMCPU, pfnR3BthSyncPage);
     GEN_CHECK_OFF(PGMCPU, pfnR3BthPrefetchPage);
     GEN_CHECK_OFF(PGMCPU, pfnR3BthVerifyAccessSyncPage);
@@ -516,8 +515,12 @@
     GEN_CHECK_OFF(PGMCPU, pfnRCBthTrap0eHandler);
     GEN_CHECK_OFF(PGMCPU, pfnRCBthInvalidatePage);
-    GEN_CHECK_OFF(PGMCPU, pfnRCBthSyncPage);
     GEN_CHECK_OFF(PGMCPU, pfnRCBthPrefetchPage);
     GEN_CHECK_OFF(PGMCPU, pfnRCBthVerifyAccessSyncPage);
     GEN_CHECK_OFF(PGMCPU, pfnRCBthAssertCR3);
+    GEN_CHECK_OFF(PGMCPU, pfnR0BthTrap0eHandler);
+    GEN_CHECK_OFF(PGMCPU, pfnR0BthInvalidatePage);
+    GEN_CHECK_OFF(PGMCPU, pfnR0BthPrefetchPage);
+    GEN_CHECK_OFF(PGMCPU, pfnR0BthVerifyAccessSyncPage);
+    GEN_CHECK_OFF(PGMCPU, pfnR0BthAssertCR3);
     GEN_CHECK_OFF(PGMCPU, DisState);
     GEN_CHECK_OFF(PGMCPU, cGuestModeChanges);
