Index: /trunk/include/VBox/types.h
===================================================================
--- /trunk/include/VBox/types.h	(revision 55965)
+++ /trunk/include/VBox/types.h	(revision 55966)
@@ -205,7 +205,4 @@
       || defined(DOXYGEN_RUNNING) )
 # define VBOXSTRICTRC_STRICT_ENABLED 1
-# ifdef _MSC_VER
-#  pragma warning(disable:4190)
-# endif
 #endif
 
@@ -283,4 +280,7 @@
     /** @} */
 };
+# ifdef _MSC_VER
+#  pragma warning(disable:4190)
+# endif
 #else
 typedef int32_t VBOXSTRICTRC;
Index: /trunk/include/VBox/vmm/pgm.h
===================================================================
--- /trunk/include/VBox/vmm/pgm.h	(revision 55965)
+++ /trunk/include/VBox/vmm/pgm.h	(revision 55966)
@@ -166,5 +166,5 @@
  * \#PF Handler callback for physical access handler ranges in RC and R0.
  *
- * @returns VBox status code (appropriate for RC return).
+ * @returns Strict VBox status code (appropriate for ring-0 and raw-mode).
  * @param   pVM         VM Handle.
  * @param   pVCpu           Pointer to the cross context CPU context for the
@@ -177,6 +177,6 @@
  * @param   pvUser      User argument.
  */
-typedef DECLCALLBACK(int) FNPGMRZPHYSPFHANDLER(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
-                                               RTGCPHYS GCPhysFault, void *pvUser);
+typedef DECLCALLBACK(VBOXSTRICTRC) FNPGMRZPHYSPFHANDLER(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
+                                                        RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser);
 /** Pointer to PGM access callback. */
 typedef FNPGMRZPHYSPFHANDLER *PFNPGMRZPHYSPFHANDLER;
@@ -189,6 +189,12 @@
  * to certain pages.
  *
- * @returns VINF_SUCCESS if the handler have carried out the operation.
- * @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
+ * @returns Strict VBox status code in ring-0 and raw-mode context, in ring-3
+ *          the only supported informational status code is
+ *          VINF_PGM_HANDLER_DO_DEFAULT.
+ * @retval  VINF_SUCCESS if the handler have carried out the operation.
+ * @retval  VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the
+ *          access operation.
+ * @retval  VINF_EM_XXX in ring-0 and raw-mode context.
+ *
  * @param   pVM             VM Handle.
  * @param   pVCpu           Pointer to the cross context CPU context for the
@@ -202,6 +208,6 @@
  * @param   pvUser          User argument.
  */
-typedef DECLCALLBACK(int) FNPGMPHYSHANDLER(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
-                                           PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser);
+typedef DECLCALLBACK(VBOXSTRICTRC) FNPGMPHYSHANDLER(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
+                                                    PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser);
 /** Pointer to PGM access callback. */
 typedef FNPGMPHYSHANDLER *PFNPGMPHYSHANDLER;
Index: /trunk/src/VBox/Devices/Graphics/DevVGA-SVGA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA-SVGA.cpp	(revision 55965)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA-SVGA.cpp	(revision 55966)
@@ -1884,6 +1884,7 @@
  * @param   pvUser          User argument.
  */
-static DECLCALLBACK(int) vmsvgaR3FIFOAccessHandler(PVM pVM, PVMCPU pVCpu RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
-                                                   PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
+static DECLCALLBACK(VBOXSTRICTRC)
+vmsvgaR3FIFOAccessHandler(PVM pVM, PVMCPU pVCpu RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
+                          PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
 {
     PVGASTATE   pThis = (PVGASTATE)pvUser;
@@ -1919,6 +1920,7 @@
  * @param   pvUser          User argument.
  */
-static DECLCALLBACK(int) vmsvgaR3GMRAccessHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
-                                                  PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
+static DECLCALLBACK(VBOXSTRICTRC)
+vmsvgaR3GMRAccessHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
+                         PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
 {
     PVGASTATE   pThis = (PVGASTATE)pvUser;
Index: /trunk/src/VBox/Devices/Graphics/DevVGA.cpp
===================================================================
--- /trunk/src/VBox/Devices/Graphics/DevVGA.cpp	(revision 55965)
+++ /trunk/src/VBox/Devices/Graphics/DevVGA.cpp	(revision 55966)
@@ -3538,6 +3538,6 @@
  * @callback_method_impl{FNPGMRCPHYSHANDLER, \#PF Handler for VBE LFB access.}
  */
-PDMBOTHCBDECL(int) vgaLbfAccessPfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
-                                         RTGCPHYS GCPhysFault, void *pvUser)
+PDMBOTHCBDECL(VBOXSTRICTRC) vgaLbfAccessPfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
+                                                  RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
 {
     PVGASTATE   pThis = (PVGASTATE)pvUser;
@@ -3555,6 +3555,6 @@
  * @callback_method_impl{FNPGMPHYSHANDLER, HC access handler for the LFB.}
  */
-PGM_ALL_CB_DECL(int) vgaLFBAccessHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
-                                         PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
+PGM_ALL_CB_DECL(VBOXSTRICTRC) vgaLFBAccessHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
+                                                  PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
 {
     PVGASTATE   pThis = (PVGASTATE)pvUser;
Index: /trunk/src/VBox/Devices/Network/DevPCNet.cpp
===================================================================
--- /trunk/src/VBox/Devices/Network/DevPCNet.cpp	(revision 55965)
+++ /trunk/src/VBox/Devices/Network/DevPCNet.cpp	(revision 55966)
@@ -1173,6 +1173,7 @@
  * @param   pvUser          User argument.
  */
-PGM_ALL_CB_DECL(int) pcnetHandleRingWrite(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
-                                          PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
+PGM_ALL_CB_DECL(VBOXSTRICTRC)
+pcnetHandleRingWrite(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
+                     PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
 {
     PPDMDEVINS  pDevIns = (PPDMDEVINS)pvUser;
Index: /trunk/src/VBox/VMM/Makefile.kmk
===================================================================
--- /trunk/src/VBox/VMM/Makefile.kmk	(revision 55965)
+++ /trunk/src/VBox/VMM/Makefile.kmk	(revision 55966)
@@ -68,4 +68,7 @@
 ifdef VBOX_WITH_64ON32_CMOS_DEBUG
  VMM_COMMON_DEFS += VBOX_WITH_64ON32_CMOS_DEBUG
+endif
+ifdef VBOXSTRICTRC_STRICT_ENABLED
+ VMM_COMMON_DEFS += VBOXSTRICTRC_STRICT_ENABLED
 endif
 ifeq ($(KBUILD_TARGET),amd64)
Index: /trunk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMAll/IOMAllMMIO.cpp	(revision 55966)
@@ -276,5 +276,6 @@
  * @warning RT_SUCCESS(rc=VINF_IOM_R3_MMIO_WRITE) is TRUE!
  */
-static int iomMMIODoWrite(PVM pVM, PVMCPU pVCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault, const void *pvData, unsigned cb)
+static VBOXSTRICTRC iomMMIODoWrite(PVM pVM, PVMCPU pVCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhysFault,
+                                   const void *pvData, unsigned cb)
 {
 #ifdef VBOX_WITH_STATISTICS
@@ -292,5 +293,5 @@
 #endif
 
-    VBOXSTRICTRC rc;
+    VBOXSTRICTRC rcStrict;
     if (RT_LIKELY(pRange->CTX_SUFF(pfnWriteCallback)))
     {
@@ -298,15 +299,15 @@
             || (pRange->fFlags & IOMMMIO_FLAGS_WRITE_MODE) == IOMMMIO_FLAGS_WRITE_PASSTHRU
             || (cb == 8 && !(GCPhysFault & 7) && IOMMMIO_DOES_WRITE_MODE_ALLOW_QWORD(pRange->fFlags)) )
-            rc = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
-                                                    GCPhysFault, (void *)pvData, cb); /** @todo fix const!! */
+            rcStrict = pRange->CTX_SUFF(pfnWriteCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser),
+                                                          GCPhysFault, (void *)pvData, cb); /** @todo fix const!! */
         else
-            rc = iomMMIODoComplicatedWrite(pVM, pRange, GCPhysFault, pvData, cb);
+            rcStrict = iomMMIODoComplicatedWrite(pVM, pRange, GCPhysFault, pvData, cb);
     }
     else
-        rc = VINF_SUCCESS;
+        rcStrict = VINF_SUCCESS;
 
     STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfWrite), a);
     STAM_COUNTER_INC(&pStats->Accesses);
-    return VBOXSTRICTRC_TODO(rc);
+    return rcStrict;
 }
 
@@ -492,5 +493,6 @@
  * Wrapper which does the read and updates range statistics when such are enabled.
  */
-DECLINLINE(int) iomMMIODoRead(PVM pVM, PVMCPU pVCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhys, void *pvValue, unsigned cbValue)
+DECLINLINE(VBOXSTRICTRC) iomMMIODoRead(PVM pVM, PVMCPU pVCpu, PIOMMMIORANGE pRange, RTGCPHYS GCPhys,
+                                       void *pvValue, unsigned cbValue)
 {
 #ifdef VBOX_WITH_STATISTICS
@@ -508,5 +510,5 @@
 #endif
 
-    VBOXSTRICTRC rc;
+    VBOXSTRICTRC rcStrict;
     if (RT_LIKELY(pRange->CTX_SUFF(pfnReadCallback)))
     {
@@ -517,16 +519,17 @@
                 && !(GCPhys & 7)
                 && (pRange->fFlags & IOMMMIO_FLAGS_READ_MODE) == IOMMMIO_FLAGS_READ_DWORD_QWORD ) )
-            rc = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys, pvValue, cbValue);
+            rcStrict = pRange->CTX_SUFF(pfnReadCallback)(pRange->CTX_SUFF(pDevIns), pRange->CTX_SUFF(pvUser), GCPhys,
+                                                         pvValue, cbValue);
         else
-            rc = iomMMIODoComplicatedRead(pVM, pRange, GCPhys, pvValue, cbValue);
+            rcStrict = iomMMIODoComplicatedRead(pVM, pRange, GCPhys, pvValue, cbValue);
     }
     else
-        rc = VINF_IOM_MMIO_UNUSED_FF;
-    if (rc != VINF_SUCCESS)
-    {
-        switch (VBOXSTRICTRC_VAL(rc))
+        rcStrict = VINF_IOM_MMIO_UNUSED_FF;
+    if (rcStrict != VINF_SUCCESS)
+    {
+        switch (VBOXSTRICTRC_VAL(rcStrict))
         {
-            case VINF_IOM_MMIO_UNUSED_FF: rc = iomMMIODoReadFFs(pvValue, cbValue); break;
-            case VINF_IOM_MMIO_UNUSED_00: rc = iomMMIODoRead00s(pvValue, cbValue); break;
+            case VINF_IOM_MMIO_UNUSED_FF: rcStrict = iomMMIODoReadFFs(pvValue, cbValue); break;
+            case VINF_IOM_MMIO_UNUSED_00: rcStrict = iomMMIODoRead00s(pvValue, cbValue); break;
         }
     }
@@ -534,5 +537,5 @@
     STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfRead), a);
     STAM_COUNTER_INC(&pStats->Accesses);
-    return VBOXSTRICTRC_VAL(rc);
+    return rcStrict;
 }
 
@@ -596,5 +599,5 @@
 
     uint64_t u64Data = 0;
-    int rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &u64Data, cb);
+    int rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &u64Data, cb));
     if (rc == VINF_SUCCESS)
     {
@@ -658,5 +661,5 @@
     AssertMsg(fRc, ("Failed to get reg/imm port number!\n")); NOREF(fRc);
 
-    int rc = iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, &u64Data, cb);
+    int rc = VBOXSTRICTRC_TODO(iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, &u64Data, cb));
     if (rc == VINF_SUCCESS)
         iomMMIOStatLength(pVM, cb);
@@ -809,5 +812,5 @@
                 if (rc != VINF_SUCCESS)
                     break;
-                rc = iomMMIODoWrite(pVM, pRange, Phys, &u32Data, cb);
+                rc = VBOXSTRICTRC_TODO(iomMMIODoWrite(pVM, pRange, Phys, &u32Data, cb));
                 if (rc != VINF_SUCCESS)
                     break;
@@ -874,8 +877,8 @@
             {
                 uint32_t u32Data;
-                rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
+                rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb));
                 if (rc != VINF_SUCCESS)
                     break;
-                rc = iomMMIODoWrite(pVM, pMMIODst, PhysDst, &u32Data, cb);
+                rc = VBOXSTRICTRC_TODO(iomMMIODoWrite(pVM, pMMIODst, PhysDst, &u32Data, cb));
                 if (rc != VINF_SUCCESS)
                     break;
@@ -909,5 +912,5 @@
             {
                 uint32_t u32Data;
-                rc = iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb);
+                rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pRange, Phys, &u32Data, cb));
                 if (rc != VINF_SUCCESS)
                     break;
@@ -1072,5 +1075,5 @@
         do
         {
-            rc = iomMMIODoWrite(pVM, pVCpu, pRange, Phys, &u64Data, cb);
+            rc = VBOXSTRICTRC_TODO(iomMMIODoWrite(pVM, pVCpu, pRange, Phys, &u64Data, cb));
             if (rc != VINF_SUCCESS)
                 break;
@@ -1135,5 +1138,5 @@
      * Perform read.
      */
-    int rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &pRegFrame->rax, cb);
+    int rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &pRegFrame->rax, cb));
     if (rc == VINF_SUCCESS)
     {
@@ -1181,8 +1184,8 @@
     if (iomGetRegImmData(pCpu, &pCpu->Param1, pRegFrame, &uData1, &cb))
         /* cmp reg, [MMIO]. */
-        rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb);
+        rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb));
     else if (iomGetRegImmData(pCpu, &pCpu->Param2, pRegFrame, &uData2, &cb))
         /* cmp [MMIO], reg|imm. */
-        rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb);
+        rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb));
     else
     {
@@ -1260,5 +1263,5 @@
         Assert(pRange->CTX_SUFF(pfnReadCallback) || !pRange->pfnReadCallbackR3);
         fAndWrite = false;
-        rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb);
+        rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb));
     }
     else if (iomGetRegImmData(pCpu, &pCpu->Param2, pRegFrame, &uData2, &cb))
@@ -1273,5 +1276,5 @@
         if (    (pRange->CTX_SUFF(pfnReadCallback) || !pRange->pfnReadCallbackR3)
             &&  (pRange->CTX_SUFF(pfnWriteCallback) || !pRange->pfnWriteCallbackR3))
-            rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb);
+            rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb));
         else
             rc = VINF_IOM_R3_MMIO_READ_WRITE;
@@ -1292,5 +1295,5 @@
         if (fAndWrite)
             /* Store result to MMIO. */
-            rc = iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb);
+            rc = VBOXSTRICTRC_TODO(iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb));
         else
         {
@@ -1341,10 +1344,10 @@
     {
         /* and test, [MMIO]. */
-        rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb);
+        rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb));
     }
     else if (iomGetRegImmData(pCpu, &pCpu->Param2, pRegFrame, &uData2, &cb))
     {
         /* test [MMIO], reg|imm. */
-        rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb);
+        rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb));
     }
     else
@@ -1406,5 +1409,5 @@
 
     /* bt [MMIO], reg|imm. */
-    int rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData, cbData);
+    int rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData, cbData));
     if (rc == VINF_SUCCESS)
     {
@@ -1448,9 +1451,9 @@
     {
         /* xchg reg, [MMIO]. */
-        rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb);
+        rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb));
         if (rc == VINF_SUCCESS)
         {
             /* Store result to MMIO. */
-            rc = iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb);
+            rc = VBOXSTRICTRC_TODO(iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb));
 
             if (rc == VINF_SUCCESS)
@@ -1469,9 +1472,9 @@
     {
         /* xchg [MMIO], reg. */
-        rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb);
+        rc = VBOXSTRICTRC_TODO(iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, &uData1, cb));
         if (rc == VINF_SUCCESS)
         {
             /* Store result to MMIO. */
-            rc = iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb);
+            rc = VBOXSTRICTRC_TODO(iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, &uData2, cb));
             if (rc == VINF_SUCCESS)
             {
@@ -1743,11 +1746,10 @@
  * @param   pvUser      Pointer to the MMIO ring-3 range entry.
  */
-DECLEXPORT(int) iomMmioPfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPTR pvFault,
-                                 RTGCPHYS GCPhysFault, void *pvUser)
+DECLEXPORT(VBOXSTRICTRC) iomMmioPfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pCtxCore, RTGCPTR pvFault,
+                                          RTGCPHYS GCPhysFault, void *pvUser)
 {
     LogFlow(("iomMmioPfHandler: GCPhys=%RGp uErr=%#x pvFault=%RGv rip=%RGv\n",
              GCPhysFault, (uint32_t)uErrorCode, pvFault, (RTGCPTR)pCtxCore->rip));
-    VBOXSTRICTRC rcStrict = iomMMIOHandler(pVM, pVCpu, (uint32_t)uErrorCode, pCtxCore, GCPhysFault, pvUser);
-    return VBOXSTRICTRC_VAL(rcStrict);
+    return iomMMIOHandler(pVM, pVCpu, (uint32_t)uErrorCode, pCtxCore, GCPhysFault, pvUser);
 }
 
@@ -1803,6 +1805,6 @@
  * @param   pvUser          Pointer to the MMIO range entry.
  */
-PGM_ALL_CB2_DECL(int) iomMmioHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhysFault, void *pvPhys, void *pvBuf, size_t cbBuf,
-                                     PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
+PGM_ALL_CB2_DECL(VBOXSTRICTRC) iomMmioHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhysFault, void *pvPhys, void *pvBuf,
+                                              size_t cbBuf, PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
 {
     PIOMMMIORANGE pRange = (PIOMMMIORANGE)pvUser;
@@ -1836,13 +1838,14 @@
      * Perform the access.
      */
+    VBOXSTRICTRC rcStrict;
     if (enmAccessType == PGMACCESSTYPE_READ)
-        rc = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
+        rcStrict = iomMMIODoRead(pVM, pVCpu, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
     else
-        rc = iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
-
-    AssertRC(rc);
+        rcStrict = iomMMIODoWrite(pVM, pVCpu, pRange, GCPhysFault, pvBuf, (unsigned)cbBuf);
+    AssertRC(rcStrict);
+
     iomMmioReleaseRange(pVM, pRange);
     PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
-    return rc;
+    return rcStrict;
 }
 
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 55966)
@@ -164,5 +164,5 @@
 #endif
     PVM             pVM         = pVCpu->CTX_SUFF(pVM);
-    int             rc;
+    VBOXSTRICTRC    rcStrict;
 
     if (PGM_PAGE_HAS_ANY_PHYSICAL_HANDLERS(pPage))
@@ -193,16 +193,16 @@
             {
 #   if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
-                rc = PGM_BTH_NAME(SyncPage)(pVCpu, pGstWalk->Pde, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                rcStrict = PGM_BTH_NAME(SyncPage)(pVCpu, pGstWalk->Pde, pvFault, PGM_SYNC_NR_PAGES, uErr);
 #   else
-                rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrcDummy, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                rcStrict = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrcDummy, pvFault, PGM_SYNC_NR_PAGES, uErr);
 #   endif
-                if (    RT_FAILURE(rc)
+                if (    RT_FAILURE(rcStrict)
                     || !(uErr & X86_TRAP_PF_RW)
-                    || rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE)
+                    || rcStrict == VINF_PGM_SYNCPAGE_MODIFIED_PDE)
                 {
-                    AssertRC(rc);
+                    AssertRC(rcStrict);
                     STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eHandlersOutOfSync);
                     STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eTime2OutOfSyncHndPhys; });
-                    return rc;
+                    return rcStrict;
                 }
             }
@@ -221,15 +221,15 @@
             {
 #   if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
-                rc = PGM_BTH_NAME(SyncPage)(pVCpu, pGstWalk->Pde, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                rcStrict = PGM_BTH_NAME(SyncPage)(pVCpu, pGstWalk->Pde, pvFault, PGM_SYNC_NR_PAGES, uErr);
 #   else
-                rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrcDummy, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                rcStrict = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrcDummy, pvFault, PGM_SYNC_NR_PAGES, uErr);
 #   endif
-                if (    RT_FAILURE(rc)
-                    || rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE)
+                if (    RT_FAILURE(rcStrict)
+                    || rcStrict == VINF_PGM_SYNCPAGE_MODIFIED_PDE)
                 {
-                    AssertRC(rc);
+                    AssertRC(rcStrict);
                     STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eHandlersOutOfSync);
                     STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eTime2OutOfSyncHndPhys; });
-                    return rc;
+                    return rcStrict;
                 }
             }
@@ -260,5 +260,5 @@
                 }
 
-                rc = pCurType->CTX_SUFF(pfnPfHandler)(pVM, pVCpu, uErr, pRegFrame, pvFault, GCPhysFault, pvUser);
+                rcStrict = pCurType->CTX_SUFF(pfnPfHandler)(pVM, pVCpu, uErr, pRegFrame, pvFault, GCPhysFault, pvUser);
 
 #  ifdef VBOX_WITH_STATISTICS
@@ -271,8 +271,8 @@
             }
             else
-                rc = VINF_EM_RAW_EMULATE_INSTR;
+                rcStrict = VINF_EM_RAW_EMULATE_INSTR;
 
             STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eTime2HndPhys; });
-            return rc;
+            return rcStrict;
         }
     }
@@ -289,13 +289,13 @@
             && !(uErr & X86_TRAP_PF_P))
         {
-            rc = PGM_BTH_NAME(SyncPage)(pVCpu, pGstWalk->Pde, pvFault, PGM_SYNC_NR_PAGES, uErr);
-            if (    RT_FAILURE(rc)
-                ||  rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
+            rcStrict = PGM_BTH_NAME(SyncPage)(pVCpu, pGstWalk->Pde, pvFault, PGM_SYNC_NR_PAGES, uErr);
+            if (    RT_FAILURE(rcStrict)
+                ||  rcStrict == VINF_PGM_SYNCPAGE_MODIFIED_PDE
                 ||  !(uErr & X86_TRAP_PF_RW))
             {
-                AssertRC(rc);
+                AssertRC(rcStrict);
                 STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eHandlersOutOfSync);
                 STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eTime2OutOfSyncHndVirt; });
-                return rc;
+                return rcStrict;
             }
         }
@@ -334,6 +334,6 @@
                 *pfLockTaken = false;
 
-                rc = pCurType->CTX_SUFF(pfnPfHandler)(pVM, pVCpu, uErr, pRegFrame, pvFault, GCPtrStart,
-                                                      pvFault - GCPtrStart, pvUser);
+                rcStrict = pCurType->CTX_SUFF(pfnPfHandler)(pVM, pVCpu, uErr, pRegFrame, pvFault, GCPtrStart,
+                                                            pvFault - GCPtrStart, pvUser);
 
 #    ifdef VBOX_WITH_STATISTICS
@@ -345,9 +345,9 @@
 #    endif
 #   else
-                rc = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
+                rcStrict = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
 #   endif
                 STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eHandlersVirtual);
                 STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eTime2HndVirt; });
-                return rc;
+                return rcStrict;
             }
             /* Unhandled part of a monitored page */
@@ -358,6 +358,5 @@
            /* Check by physical address. */
             unsigned iPage;
-            rc = pgmHandlerVirtualFindByPhysAddr(pVM, pGstWalk->Core.GCPhys, &pCur, &iPage);
-            Assert(RT_SUCCESS(rc) || !pCur);
+            pCur = pgmHandlerVirtualFindByPhysAddr(pVM, pGstWalk->Core.GCPhys, &iPage);
             if (pCur)
             {
@@ -379,5 +378,5 @@
                                 - (GCPtrStart & PAGE_OFFSET_MASK);
                     Assert(off < pCur->cb);
-                    rc = pCurType->CTX_SUFF(pfnPfHandler)(pVM, pVCpu, uErr, pRegFrame, pvFault, GCPtrStart, off, pvUser);
+                    rcStrict = pCurType->CTX_SUFF(pfnPfHandler)(pVM, pVCpu, uErr, pRegFrame, pvFault, GCPtrStart, off, pvUser);
 
 #    ifdef VBOX_WITH_STATISTICS
@@ -389,9 +388,9 @@
 #    endif
 #   else
-                    rc = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
+                    rcStrict = VINF_EM_RAW_EMULATE_INSTR; /** @todo for VMX */
 #   endif
                     STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eHandlersVirtualByPhys);
                     STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eTime2HndVirt; });
-                    return rc;
+                    return rcStrict;
                 }
             }
@@ -414,16 +413,16 @@
     {
 #  if PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE)
-        rc = PGM_BTH_NAME(SyncPage)(pVCpu, pGstWalk->Pde, pvFault, PGM_SYNC_NR_PAGES, uErr);
+        rcStrict = PGM_BTH_NAME(SyncPage)(pVCpu, pGstWalk->Pde, pvFault, PGM_SYNC_NR_PAGES, uErr);
 #  else
-        rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrcDummy, pvFault, PGM_SYNC_NR_PAGES, uErr);
-#  endif
-        if (    RT_FAILURE(rc)
-            ||  rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
+        rcStrict = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrcDummy, pvFault, PGM_SYNC_NR_PAGES, uErr);
+#  endif
+        if (    RT_FAILURE(rcStrict)
+            ||  rcStrict == VINF_PGM_SYNCPAGE_MODIFIED_PDE
             ||  !(uErr & X86_TRAP_PF_RW))
         {
-            AssertRC(rc);
+            AssertRC(rcStrict);
             STAM_COUNTER_INC(&pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eHandlersOutOfSync);
             STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eTime2OutOfSyncHndPhys; });
-            return rc;
+            return rcStrict;
         }
     }
@@ -432,8 +431,8 @@
      *        It's writing to an unhandled part of the LDT page several million times.
      */
-    rc = VBOXSTRICTRC_TODO(PGMInterpretInstruction(pVM, pVCpu, pRegFrame, pvFault));
-    LogFlow(("PGM: PGMInterpretInstruction -> rc=%d pPage=%R[pgmpage]\n", rc, pPage));
+    rcStrict = PGMInterpretInstruction(pVM, pVCpu, pRegFrame, pvFault);
+    LogFlow(("PGM: PGMInterpretInstruction -> rcStrict=%d pPage=%R[pgmpage]\n", VBOXSTRICTRC_VAL(rcStrict), pPage));
     STAM_STATS({ pVCpu->pgm.s.CTX_SUFF(pStatTrap0eAttribution) = &pVCpu->pgm.s.CTX_SUFF(pStats)->StatRZTrap0eTime2HndUnhandled; });
-    return rc;
+    return rcStrict;
 } /* if any kind of handler */
 
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 55966)
@@ -164,5 +164,5 @@
         case PGMPHYSHANDLERKIND_MMIO:
         case PGMPHYSHANDLERKIND_ALL:
-            /* Simplification for PGMPhysRead, PGMR0Trap0eHandlerNPMisconfig and others. */
+            /* Simplification for PGMPhysRead, PGMR0Trap0eHandlerNPMisconfig and others: Full pages. */
             AssertMsgReturn(!(GCPhys & PAGE_OFFSET_MASK), ("%RGp\n", GCPhys), VERR_INVALID_PARAMETER);
             AssertMsgReturn((GCPhysLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK, ("%RGp\n", GCPhysLast), VERR_INVALID_PARAMETER);
@@ -1455,14 +1455,12 @@
  * Search for virtual handler with matching physical address
  *
- * @returns VBox status code
+ * @returns Pointer to the virtual handler structure if found, otherwise NULL.
  * @param   pVM         Pointer to the VM.
  * @param   GCPhys      GC physical address to search for.
- * @param   ppVirt      Where to store the pointer to the virtual handler structure.
  * @param   piPage      Where to store the pointer to the index of the cached physical page.
  */
-int pgmHandlerVirtualFindByPhysAddr(PVM pVM, RTGCPHYS GCPhys, PPGMVIRTHANDLER *ppVirt, unsigned *piPage)
+PPGMVIRTHANDLER pgmHandlerVirtualFindByPhysAddr(PVM pVM, RTGCPHYS GCPhys, unsigned *piPage)
 {
     STAM_PROFILE_START(&pVM->pgm.s.CTX_MID_Z(Stat,VirtHandlerSearchByPhys), a);
-    Assert(ppVirt);
 
     pgmLock(pVM);
@@ -1472,6 +1470,6 @@
     {
         /* found a match! */
-        *ppVirt = (PPGMVIRTHANDLER)((uintptr_t)pCur + pCur->offVirtHandler);
-        *piPage = pCur - &(*ppVirt)->aPhysToVirt[0];
+        PPGMVIRTHANDLER pVirt = (PPGMVIRTHANDLER)((uintptr_t)pCur + pCur->offVirtHandler);
+        *piPage = pCur - &pVirt->aPhysToVirt[0];
         pgmUnlock(pVM);
 
@@ -1479,13 +1477,12 @@
         AssertRelease(pCur->offNextAlias & PGMPHYS2VIRTHANDLER_IS_HEAD);
 #endif
-        LogFlow(("PHYS2VIRT: found match for %RGp -> %RGv *piPage=%#x\n", GCPhys, (*ppVirt)->Core.Key, *piPage));
+        LogFlow(("PHYS2VIRT: found match for %RGp -> %RGv *piPage=%#x\n", GCPhys, pVirt->Core.Key, *piPage));
         STAM_PROFILE_STOP(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,VirtHandlerSearchByPhys), a);
-        return VINF_SUCCESS;
+        return pVirt;
     }
 
     pgmUnlock(pVM);
-    *ppVirt = NULL;
     STAM_PROFILE_STOP(&pVM->pgm.s.CTX_SUFF(pStats)->CTX_MID_Z(Stat,VirtHandlerSearchByPhys), a);
-    return VERR_PGM_HANDLER_NOT_FOUND;
+    return NULL;
 }
 
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 55966)
@@ -66,6 +66,6 @@
  * @param   pvUser      User argument.
  */
-VMMDECL(int) pgmPhysPfHandlerRedirectToHC(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
-                                          RTGCPHYS GCPhysFault, void *pvUser)
+VMMDECL(VBOXSTRICTRC) pgmPhysPfHandlerRedirectToHC(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
+                                                   RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
 {
     NOREF(pVM); NOREF(pVCpu); NOREF(uErrorCode); NOREF(pRegFrame); NOREF(pvFault); NOREF(GCPhysFault); NOREF(pvUser);
@@ -88,6 +88,6 @@
  * @param   pvUser      User argument. Pointer to the ROM range structure.
  */
-DECLEXPORT(int) pgmPhysRomWritePfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
-                                         RTGCPHYS GCPhysFault, void *pvUser)
+DECLEXPORT(VBOXSTRICTRC) pgmPhysRomWritePfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
+                                                  RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
 {
     int             rc;
@@ -167,6 +167,7 @@
  * @param   pvUser          User argument.
  */
-PGM_ALL_CB2_DECL(int) pgmPhysRomWriteHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
-                                             PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
+PGM_ALL_CB2_DECL(VBOXSTRICTRC)
+pgmPhysRomWriteHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
+                       PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
 {
     PPGMROMRANGE    pRom     = (PPGMROMRANGE)pvUser;
@@ -2180,7 +2181,8 @@
  * Deals with reading from a page with one or more ALL access handlers.
  *
- * @returns VBox status code. Can be ignored in ring-3.
+ * @returns Strict VBox status code in ring-0 and raw-mode, ignorable in ring-3.
  * @retval  VINF_SUCCESS.
- * @retval  VERR_PGM_PHYS_WR_HIT_HANDLER in R0 and GC, NEVER in R3.
+ * @retval  VERR_PGM_PHYS_WR_HIT_HANDLER in R0 and GC, NEVER in R3 or with
+ *          PGMACCESSORIGIN_IEM.
  *
  * @param   pVM         Pointer to the VM.
@@ -2191,5 +2193,6 @@
  * @param   enmOrigin       The origin of this call.
  */
-static int pgmPhysReadHandler(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void *pvBuf, size_t cb, PGMACCESSORIGIN enmOrigin)
+static VBOXSTRICTRC pgmPhysReadHandler(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void *pvBuf, size_t cb,
+                                       PGMACCESSORIGIN enmOrigin)
 {
     /*
@@ -2211,5 +2214,6 @@
         return VINF_SUCCESS;
     }
-    rc = VINF_PGM_HANDLER_DO_DEFAULT;
+
+    VBOXSTRICTRC rcStrict = VINF_PGM_HANDLER_DO_DEFAULT;
 
     /*
@@ -2238,5 +2242,5 @@
         /* Release the PGM lock as MMIO handlers take the IOM lock. (deadlock prevention) */
         pgmUnlock(pVM);
-        rc = pfnHandler(pVM, pVCpu, GCPhys, (void *)pvSrc, pvBuf, cb, PGMACCESSTYPE_READ, enmOrigin, pvUser);
+        rcStrict = pfnHandler(pVM, pVCpu, GCPhys, (void *)pvSrc, pvBuf, cb, PGMACCESSTYPE_READ, enmOrigin, pvUser);
         pgmLock(pVM);
 # ifdef VBOX_WITH_STATISTICS
@@ -2247,5 +2251,7 @@
         pPhys = NULL; /* might not be valid anymore. */
 # endif
-        AssertLogRelMsg(rc == VINF_SUCCESS || rc == VINF_PGM_HANDLER_DO_DEFAULT, ("rc=%Rrc GCPhys=%RGp\n", rc, GCPhys));
+        AssertLogRelMsg(rcStrict == VINF_SUCCESS || rcStrict == VINF_PGM_HANDLER_DO_DEFAULT,
+                        ("rcStrict=%Rrc GCPhys=%RGp\n", VBOXSTRICTRC_VAL(rcStrict), GCPhys));
+
 #else
         /* In R0 and RC the callbacks cannot handle this context, so we'll fail. */
@@ -2262,8 +2268,6 @@
     {
         unsigned        iPage;
-        PPGMVIRTHANDLER pVirt;
-
-        int rc2 = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &pVirt, &iPage);
-        AssertReleaseMsg(RT_SUCCESS(rc2), ("GCPhys=%RGp cb=%#x rc2=%Rrc\n", GCPhys, cb, rc2));
+        PPGMVIRTHANDLER pVirt = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &iPage);
+        AssertReleaseMsg(pVirt, ("GCPhys=%RGp cb=%#x\n", GCPhys, cb));
         Assert((pVirt->Core.Key     & PAGE_OFFSET_MASK) == 0);
         Assert((pVirt->Core.KeyLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK);
@@ -2283,10 +2287,16 @@
 
             STAM_PROFILE_START(&pVirt->Stat, h);
-            rc2 = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, (void *)pvSrc, pvBuf, cb, PGMACCESSTYPE_READ, enmOrigin,
-                                                  pVirt->CTX_SUFF(pvUser));
+            VBOXSTRICTRC rcStrict2 = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, (void *)pvSrc, pvBuf, cb,
+                                                                     PGMACCESSTYPE_READ, enmOrigin, pVirt->CTX_SUFF(pvUser));
             STAM_PROFILE_STOP(&pVirt->Stat, h);
-            if (rc2 == VINF_SUCCESS)
-                rc = VINF_SUCCESS;
-            AssertLogRelMsg(rc2 == VINF_SUCCESS || rc2 == VINF_PGM_HANDLER_DO_DEFAULT, ("rc=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n", rc2, GCPhys, pPage, pVirt->pszDesc));
+            if (rcStrict2 == VINF_SUCCESS)
+                rcStrict = rcStrict == VINF_PGM_HANDLER_DO_DEFAULT ? VINF_SUCCESS : rcStrict;
+            else if (rcStrict2 != VINF_PGM_HANDLER_DO_DEFAULT)
+            {
+                AssertLogRelMsgFailed(("rcStrict2=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n",
+                                       VBOXSTRICTRC_VAL(rcStrict2), GCPhys, pPage, pVirt->pszDesc));
+                if (rcStrict == VINF_SUCCESS || rcStrict == VINF_PGM_HANDLER_DO_DEFAULT || rcStrict2 < rcStrict)
+                    rcStrict = rcStrict2;
+            }
         }
         else
@@ -2303,8 +2313,11 @@
      * Take the default action.
      */
-    if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
+    if (rcStrict == VINF_PGM_HANDLER_DO_DEFAULT)
+    {
         memcpy(pvBuf, pvSrc, cb);
+        rcStrict = VINF_SUCCESS;
+    }
     pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
-    return rc;
+    return rcStrict;
 }
 
@@ -2358,17 +2371,8 @@
 
                 /*
-                 * Any ALL access handlers?
+                 * Normal page? Get the pointer to it.
                  */
-                if (RT_UNLIKELY(   PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage)
-                                || PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage)))
-                {
-                    int rc = pgmPhysReadHandler(pVM, pPage, pRam->GCPhys + off, pvBuf, cb, enmOrigin);
-                    if (RT_FAILURE(rc))
-                    {
-                        pgmUnlock(pVM);
-                        return rc;
-                    }
-                }
-                else
+                if (   !PGM_PAGE_HAS_ACTIVE_ALL_HANDLERS(pPage)
+                    && !PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage))
                 {
                     /*
@@ -2390,4 +2394,16 @@
                     }
                 }
+                /*
+                 * Have ALL/MMIO access handlers.
+                 */
+                else
+                {
+                    VBOXSTRICTRC rcStrict = pgmPhysReadHandler(pVM, pPage, pRam->GCPhys + off, pvBuf, cb, enmOrigin);
+                    if (rcStrict != VINF_SUCCESS)
+                    {
+                        pgmUnlock(pVM);
+                        return VBOXSTRICTRC_TODO(rcStrict);
+                    }
+                }
 
                 /* next page */
@@ -2437,7 +2453,8 @@
  * Deals with writing to a page with one or more WRITE or ALL access handlers.
  *
- * @returns VBox status code. Can be ignored in ring-3.
+ * @returns Strict VBox status code in ring-0 and raw-mode, ignorable in ring-3.
  * @retval  VINF_SUCCESS.
- * @retval  VERR_PGM_PHYS_WR_HIT_HANDLER in R0 and GC, NEVER in R3.
+ * @retval  VERR_PGM_PHYS_WR_HIT_HANDLER in R0 and GC, NEVER in R3 or with
+ *          PGMACCESSORIGIN_IEM.
  *
  * @param   pVM         Pointer to the VM.
@@ -2446,12 +2463,12 @@
  * @param   pvBuf       What to write.
  * @param   cbWrite     How much to write - less or equal to a page.
- * @param   enmOrigin       The origin of this call.
- */
-static int pgmPhysWriteHandler(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void const *pvBuf, size_t cbWrite,
-                               PGMACCESSORIGIN enmOrigin)
+ * @param   enmOrigin   The origin of this call.
+ */
+static VBOXSTRICTRC pgmPhysWriteHandler(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhys, void const *pvBuf, size_t cbWrite,
+                                        PGMACCESSORIGIN enmOrigin)
 {
     PGMPAGEMAPLOCK  PgMpLck;
     void           *pvDst = NULL;
-    int             rc;
+    VBOXSTRICTRC    rcStrict;
 
     /*
@@ -2486,8 +2503,8 @@
                   GCPhys, cbRange, pPage, R3STRING(pCur->pszDesc) ));
             if (!PGM_PAGE_IS_MMIO_OR_SPECIAL_ALIAS(pPage))
-                rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDst, &PgMpLck);
+                rcStrict = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDst, &PgMpLck);
             else
-                rc = VINF_SUCCESS;
-            if (RT_SUCCESS(rc))
+                rcStrict = VINF_SUCCESS;
+            if (RT_SUCCESS(rcStrict))
             {
                 PFNPGMPHYSHANDLER pfnHandler = PGMPHYSHANDLER_GET_TYPE(pVM, pCur)->CTX_SUFF(pfnHandler);
@@ -2498,5 +2515,5 @@
                 /* Release the PGM lock as MMIO handlers take the IOM lock. (deadlock prevention) */
                 pgmUnlock(pVM);
-                rc = pfnHandler(pVM, pVCpu, GCPhys, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
+                rcStrict = pfnHandler(pVM, pVCpu, GCPhys, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
                 pgmLock(pVM);
 # ifdef VBOX_WITH_STATISTICS
@@ -2507,21 +2524,23 @@
                 pCur = NULL; /* might not be valid anymore. */
 # endif
-                if (rc == VINF_PGM_HANDLER_DO_DEFAULT && pvDst)
+                if (rcStrict == VINF_PGM_HANDLER_DO_DEFAULT)
                 {
                     if (pvDst)
                         memcpy(pvDst, pvBuf, cbRange);
+                    rcStrict = VINF_SUCCESS;
                 }
                 else
-                    AssertLogRelMsg(rc == VINF_SUCCESS || rc == VINF_PGM_HANDLER_DO_DEFAULT,
-                                    ("rc=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n", rc, GCPhys, pPage, pCur ? pCur->pszDesc : ""));
+                    AssertLogRelMsg(rcStrict == VINF_SUCCESS,
+                                    ("rcStrict=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n",
+                                     VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, pCur ? pCur->pszDesc : ""));
             }
             else
                 AssertLogRelMsgFailedReturn(("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n",
-                                             GCPhys, pPage, rc), rc);
-            if (RT_LIKELY(cbRange == cbWrite))
+                                             GCPhys, pPage, VBOXSTRICTRC_VAL(rcStrict)), rcStrict);
+            if (RT_LIKELY(cbRange == cbWrite) || rcStrict != VINF_SUCCESS)
             {
                 if (pvDst)
                     pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
-                return VINF_SUCCESS;
+                return rcStrict;
             }
 
@@ -2543,11 +2562,10 @@
     {
         unsigned        iPage;
-        PPGMVIRTHANDLER pCur;
-        rc = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &pCur, &iPage);
-        if (RT_SUCCESS(rc))
-        {
-            PPGMVIRTHANDLERTYPEINT pCurType = PGMVIRTANDLER_GET_TYPE(pVM, pCur);
-
-            size_t cbRange = (PAGE_OFFSET_MASK & pCur->Core.KeyLast) - (PAGE_OFFSET_MASK & GCPhys) + 1;
+        PPGMVIRTHANDLER pVirt = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &iPage);
+        if (pVirt)
+        {
+            PPGMVIRTHANDLERTYPEINT pVirtType = PGMVIRTANDLER_GET_TYPE(pVM, pVirt);
+
+            size_t cbRange = (PAGE_OFFSET_MASK & pVirt->Core.KeyLast) - (PAGE_OFFSET_MASK & GCPhys) + 1;
             if (cbRange > cbWrite)
                 cbRange = cbWrite;
@@ -2561,32 +2579,39 @@
 #else  /* IN_RING3 */
 
-            Log5(("pgmPhysWriteHandler: GCPhys=%RGp cbRange=%#x pPage=%R[pgmpage] virt %s\n", GCPhys, cbRange, pPage, R3STRING(pCur->pszDesc) ));
-            rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDst, &PgMpLck);
-            if (RT_SUCCESS(rc))
+            Log5(("pgmPhysWriteHandler: GCPhys=%RGp cbRange=%#x pPage=%R[pgmpage] virt %s\n",
+                  GCPhys, cbRange, pPage, R3STRING(pVirt->pszDesc) ));
+            rcStrict = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDst, &PgMpLck);
+            if (RT_SUCCESS(rcStrict))
             {
-                rc = VINF_PGM_HANDLER_DO_DEFAULT;
-                if (pCurType->pfnHandlerR3)
+                if (pVirtType->pfnHandlerR3)
                 {
-                    RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pCur->Core.Key & PAGE_BASE_GC_MASK)
+                    RTGCUINTPTR GCPtr = ((RTGCUINTPTR)pVirt->Core.Key & PAGE_BASE_GC_MASK)
                                       + (iPage << PAGE_SHIFT)
                                       + (GCPhys & PAGE_OFFSET_MASK);
 
-                    STAM_PROFILE_START(&pCur->Stat, h);
-                    rc = pCurType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE,
-                                                        enmOrigin, pCur->CTX_SUFF(pvUser));
-                    STAM_PROFILE_STOP(&pCur->Stat, h);
+                    STAM_PROFILE_START(&pVirt->Stat, h);
+                    rcStrict = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, pvDst, (void *)pvBuf, cbRange,
+                                                               PGMACCESSTYPE_WRITE, enmOrigin, pVirt->CTX_SUFF(pvUser));
+                    STAM_PROFILE_STOP(&pVirt->Stat, h);
                 }
-                if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
+                else
+                    rcStrict = VINF_PGM_HANDLER_DO_DEFAULT;
+                if (rcStrict == VINF_PGM_HANDLER_DO_DEFAULT)
+                {
                     memcpy(pvDst, pvBuf, cbRange);
+                    rcStrict = VINF_SUCCESS;
+                }
                 else
-                    AssertLogRelMsg(rc == VINF_SUCCESS, ("rc=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n", rc, GCPhys, pPage, pCur->pszDesc));
+                    AssertLogRelMsg(rcStrict == VINF_SUCCESS,
+                                    ("rcStrict=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n",
+                                     VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, pVirt->pszDesc));
             }
             else
                 AssertLogRelMsgFailedReturn(("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n",
-                                             GCPhys, pPage, rc), rc);
-            if (RT_LIKELY(cbRange == cbWrite))
+                                             GCPhys, pPage, VBOXSTRICTRC_VAL(rcStrict)), rcStrict);
+            if (RT_LIKELY(cbRange == cbWrite) || rcStrict != VINF_SUCCESS)
             {
                 pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
-                return VINF_SUCCESS;
+                return rcStrict;
             }
 
@@ -2608,8 +2633,8 @@
     if (!pvDst)
     {
-        rc = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDst, &PgMpLck);
-        AssertLogRelMsgReturn(RT_SUCCESS(rc),
+        rcStrict = pgmPhysGCPhys2CCPtrInternal(pVM, pPage, GCPhys, &pvDst, &PgMpLck);
+        AssertLogRelMsgReturn(RT_SUCCESS(rcStrict),
                               ("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n",
-                               GCPhys, pPage, rc), rc);
+                               GCPhys, pPage, VBOXSTRICTRC_VAL(rcStrict)), rcStrict);
     }
 
@@ -2634,6 +2659,6 @@
         if (fMoreVirt && !pVirt)
         {
-            rc = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &pVirt, &iVirtPage);
-            if (RT_SUCCESS(rc))
+            pVirt = pgmHandlerVirtualFindByPhysAddr(pVM, GCPhys, &iVirtPage);
+            if (pVirt)
             {
                 offVirt = 0;
@@ -2696,5 +2721,5 @@
          * Handle access to space without handlers (that's easy).
          */
-        rc = VINF_PGM_HANDLER_DO_DEFAULT;
+        rcStrict = VINF_PGM_HANDLER_DO_DEFAULT;
         uint32_t cbRange = (uint32_t)cbWrite;
         if (offPhys && offVirt)
@@ -2724,5 +2749,5 @@
             /* Release the PGM lock as MMIO handlers take the IOM lock. (deadlock prevention) */
             pgmUnlock(pVM);
-            rc = pfnHandler(pVM, pVCpu, GCPhys, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
+            rcStrict = pfnHandler(pVM, pVCpu, GCPhys, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
             pgmLock(pVM);
 # ifdef VBOX_WITH_STATISTICS
@@ -2733,5 +2758,7 @@
             pPhys = NULL; /* might not be valid anymore. */
 # endif
-            AssertLogRelMsg(rc == VINF_SUCCESS || rc == VINF_PGM_HANDLER_DO_DEFAULT, ("rc=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n", rc, GCPhys, pPage, (pPhys) ? pPhys->pszDesc : ""));
+            AssertLogRelMsg(rcStrict == VINF_SUCCESS || rcStrict == VINF_PGM_HANDLER_DO_DEFAULT,
+                            ("rcStrict=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n",
+                             VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, (pPhys) ? pPhys->pszDesc : ""));
 #else
             /* In R0 and RC the callbacks cannot handle this context, so we'll fail. */
@@ -2761,8 +2788,10 @@
                                   + (GCPhys & PAGE_OFFSET_MASK);
                 STAM_PROFILE_START(&pVirt->Stat, h);
-                rc = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE,
-                                                     enmOrigin, pVirt->CTX_SUFF(pvUser));
+                rcStrict = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE,
+                                                           enmOrigin, pVirt->CTX_SUFF(pvUser));
                 STAM_PROFILE_STOP(&pVirt->Stat, h);
-                AssertLogRelMsg(rc == VINF_SUCCESS || rc == VINF_PGM_HANDLER_DO_DEFAULT, ("rc=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n", rc, GCPhys, pPage, pVirt->pszDesc));
+                AssertLogRelMsg(rcStrict == VINF_SUCCESS || rcStrict == VINF_PGM_HANDLER_DO_DEFAULT,
+                                ("rcStrict=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n",
+                                 VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, pVirt->pszDesc));
             }
             pVirt = NULL;
@@ -2799,5 +2828,5 @@
             /* Release the PGM lock as MMIO handlers take the IOM lock. (deadlock prevention) */
             pgmUnlock(pVM);
-            rc = pfnHandler(pVM, pVCpu, GCPhys, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
+            rcStrict = pfnHandler(pVM, pVCpu, GCPhys, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE, enmOrigin, pvUser);
             pgmLock(pVM);
 # ifdef VBOX_WITH_STATISTICS
@@ -2808,5 +2837,7 @@
             pPhys = NULL; /* might not be valid anymore. */
 # endif
-            AssertLogRelMsg(rc == VINF_SUCCESS || rc == VINF_PGM_HANDLER_DO_DEFAULT, ("rc=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n", rc, GCPhys, pPage, (pPhys) ? pPhys->pszDesc : ""));
+            AssertLogRelMsg(rcStrict == VINF_SUCCESS || rcStrict == VINF_PGM_HANDLER_DO_DEFAULT,
+                            ("rcStrict=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n",
+                             VBOXSTRICTRC_VAL(rcStrict), GCPhys, pPage, (pPhys) ? pPhys->pszDesc : ""));
             if (pVirtType->pfnHandlerR3)
             {
@@ -2816,11 +2847,16 @@
                                   + (GCPhys & PAGE_OFFSET_MASK);
                 STAM_PROFILE_START(&pVirt->Stat, h2);
-                int rc2 = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, pvDst, (void *)pvBuf, cbRange, PGMACCESSTYPE_WRITE,
-                                                          enmOrigin, pVirt->CTX_SUFF(pvUser));
+                VBOXSTRICTRC rcStrict2 = pVirtType->CTX_SUFF(pfnHandler)(pVM, pVCpu, GCPtr, pvDst, (void *)pvBuf, cbRange,
+                                                                         PGMACCESSTYPE_WRITE, enmOrigin, pVirt->CTX_SUFF(pvUser));
                 STAM_PROFILE_STOP(&pVirt->Stat, h2);
-                if (rc2 == VINF_SUCCESS && rc == VINF_PGM_HANDLER_DO_DEFAULT)
-                    rc = VINF_SUCCESS;
-                else
-                    AssertLogRelMsg(rc2 == VINF_SUCCESS || rc2 == VINF_PGM_HANDLER_DO_DEFAULT, ("rc=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n", rc, GCPhys, pPage, pVirt->pszDesc));
+                if (rcStrict2 == VINF_SUCCESS)
+                    rcStrict = rcStrict == VINF_PGM_HANDLER_DO_DEFAULT ? VINF_SUCCESS : rcStrict;
+                else if (rcStrict2 != VINF_PGM_HANDLER_DO_DEFAULT)
+                {
+                    AssertLogRelMsgFailed(("rcStrict2=%Rrc GCPhys=%RGp pPage=%R[pgmpage] %s\n",
+                                           VBOXSTRICTRC_VAL(rcStrict2), GCPhys, pPage, pVirt->pszDesc));
+                    if (rcStrict == VINF_SUCCESS || rcStrict == VINF_PGM_HANDLER_DO_DEFAULT || rcStrict2 < rcStrict)
+                        rcStrict = rcStrict2;
+                }
             }
             pPhys = NULL;
@@ -2834,14 +2870,17 @@
 #endif
         }
-        if (rc == VINF_PGM_HANDLER_DO_DEFAULT)
+        if (rcStrict == VINF_PGM_HANDLER_DO_DEFAULT)
+        {
             memcpy(pvDst, pvBuf, cbRange);
+            rcStrict = VINF_SUCCESS;
+        }
 
         /*
          * Advance if we've got more stuff to do.
          */
-        if (cbRange >= cbWrite)
+        if (cbRange >= cbWrite || rcStrict != VINF_SUCCESS)
         {
             pgmPhysReleaseInternalPageMappingLock(pVM, &PgMpLck);
-            return VINF_SUCCESS;
+            return rcStrict;
         }
 
@@ -2908,21 +2947,9 @@
 
                 /*
-                 * Any active WRITE or ALL access handlers?
+                 * Normal page? Get the pointer to it.
                  */
-                if (   PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage)
-                    || PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage))
+                if (   !PGM_PAGE_HAS_ACTIVE_HANDLERS(pPage)
+                    && !PGM_PAGE_IS_SPECIAL_ALIAS_MMIO(pPage))
                 {
-                    int rc = pgmPhysWriteHandler(pVM, pPage, pRam->GCPhys + off, pvBuf, cb, enmOrigin);
-                    if (RT_FAILURE(rc))
-                    {
-                        pgmUnlock(pVM);
-                        return rc;
-                    }
-                }
-                else
-                {
-                    /*
-                     * Get the pointer to the page.
-                     */
                     PGMPAGEMAPLOCK PgMpLck;
                     void          *pvDst;
@@ -2938,4 +2965,16 @@
                         AssertLogRelMsgFailed(("pgmPhysGCPhys2CCPtrInternal failed on %RGp / %R[pgmpage] -> %Rrc\n",
                                                 pRam->GCPhys + off, pPage, rc));
+                }
+                /*
+                 * Active WRITE or ALL access handlers.
+                 */
+                else
+                {
+                    VBOXSTRICTRC rcStrict = pgmPhysWriteHandler(pVM, pPage, pRam->GCPhys + off, pvBuf, cb, enmOrigin);
+                    if (rcStrict != VINF_SUCCESS)
+                    {
+                        pgmUnlock(pVM);
+                        return VBOXSTRICTRC_TODO(rcStrict);
+                    }
                 }
 
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 55966)
@@ -1055,6 +1055,6 @@
  * @param   pvUser      User argument.
  */
-DECLEXPORT(int) pgmPoolAccessPfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault,
-                                       RTGCPHYS GCPhysFault, void *pvUser)
+DECLEXPORT(VBOXSTRICTRC) pgmPoolAccessPfHandler(PVM pVM, PVMCPU pVCpu, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
+                                                RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
 {
     STAM_PROFILE_START(&pVM->pgm.s.CTX_SUFF(pPool)->CTX_SUFF_Z(StatMonitor), a);
@@ -1370,6 +1370,7 @@
  * @param   pvUser          User argument.
  */
-PGM_ALL_CB2_DECL(int) pgmPoolAccessHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
-                                           PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
+PGM_ALL_CB2_DECL(VBOXSTRICTRC)
+pgmPoolAccessHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
+                     PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
 {
     PPGMPOOL        pPool = pVM->pgm.s.CTX_SUFF(pPool);
Index: /trunk/src/VBox/VMM/VMMR3/GIM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/GIM.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMR3/GIM.cpp	(revision 55966)
@@ -497,6 +497,7 @@
  * @param   pvUser          User argument (NULL, not used).
  */
-static DECLCALLBACK(int) gimR3Mmio2WriteHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
-                                                PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
+static DECLCALLBACK(VBOXSTRICTRC)
+gimR3Mmio2WriteHandler(PVM pVM, PVMCPU pVCpu, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf,
+                       PGMACCESSTYPE enmAccessType, PGMACCESSORIGIN enmOrigin, void *pvUser)
 {
     /*
Index: /trunk/src/VBox/VMM/VMMR3/PGMHandler.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/PGMHandler.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMR3/PGMHandler.cpp	(revision 55966)
@@ -411,4 +411,5 @@
     {
         case PGMVIRTHANDLERKIND_ALL:
+            /* Simplification for PGMPhysRead and others: Full pages. */
             AssertReleaseMsgReturn(   (GCPtr     & PAGE_OFFSET_MASK) == 0
                                    && (GCPtrLast & PAGE_OFFSET_MASK) == PAGE_OFFSET_MASK,
Index: /trunk/src/VBox/VMM/VMMRC/CSAMRC.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMRC/CSAMRC.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMRC/CSAMRC.cpp	(revision 55966)
@@ -116,5 +116,5 @@
                                                              4 /** @todo */);
         if (rcStrict == VINF_SUCCESS)
-            return rcStrict;
+            return VBOXSTRICTRC_TODO(rcStrict);
         if (rcStrict == VINF_EM_RAW_EMULATE_INSTR)
         {
Index: /trunk/src/VBox/VMM/VMMRC/PATMRC.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMRC/PATMRC.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMRC/PATMRC.cpp	(revision 55966)
@@ -124,5 +124,5 @@
             }
             LogFlow(("PATMHandleWriteToPatchPage: Interpret %x accessing %RRv\n", pRegFrame->eip, GCPtr));
-            int rc = EMInterpretInstruction(VMMGetCpu0(pVM), pRegFrame, (RTGCPTR)(RTRCUINTPTR)GCPtr);
+            int rc = VBOXSTRICTRC_TODO(EMInterpretInstruction(VMMGetCpu0(pVM), pRegFrame, (RTGCPTR)(RTRCUINTPTR)GCPtr));
             if (rc == VINF_SUCCESS)
             {
@@ -553,6 +553,6 @@
             }
 
-            rc = EMInterpretInstructionDisasState(pVCpu, &cpu, pRegFrame, 0 /* not relevant here */,
-                                                  EMCODETYPE_SUPERVISOR);
+            rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, &cpu, pRegFrame, 0 /* not relevant here */,
+                                                                    EMCODETYPE_SUPERVISOR));
 #endif
             if (RT_FAILURE(rc))
Index: /trunk/src/VBox/VMM/VMMRC/SELMRC.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMRC/SELMRC.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMRC/SELMRC.cpp	(revision 55966)
@@ -255,6 +255,6 @@
      */
     uint32_t cb;
-    int rc = EMInterpretInstructionEx(pVCpu, pRegFrame, (RTGCPTR)(RTRCUINTPTR)pvFault, &cb);
-    if (RT_SUCCESS(rc) && cb)
+    VBOXSTRICTRC rcStrict = EMInterpretInstructionEx(pVCpu, pRegFrame, (RTGCPTR)(RTRCUINTPTR)pvFault, &cb);
+    if (RT_SUCCESS(rcStrict) && cb)
     {
         /* Check if the LDT was in any way affected.  Do not sync the
@@ -268,5 +268,5 @@
             Log(("LDTR selector change -> fall back to HC!!\n"));
             VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_GDT);
-            rc = VINF_SELM_SYNC_GDT;
+            rcStrict = VINF_SELM_SYNC_GDT;
             /** @todo Implement correct stale LDT handling.  */
         }
@@ -275,42 +275,42 @@
             /* Sync the shadow GDT and continue provided the update didn't
                cause any segment registers to go stale in any way. */
-            int rc2 = selmRCSyncGDTEntry(pVM, pVCpu, pRegFrame, iGDTE1);
-            if (rc2 == VINF_SUCCESS || rc2 == VINF_EM_RESCHEDULE_REM)
+            VBOXSTRICTRC rcStrict2 = selmRCSyncGDTEntry(pVM, pVCpu, pRegFrame, iGDTE1);
+            if (rcStrict2 == VINF_SUCCESS || rcStrict2 == VINF_EM_RESCHEDULE_REM)
             {
-                if (rc == VINF_SUCCESS)
-                    rc = rc2;
+                if (rcStrict == VINF_SUCCESS)
+                    rcStrict = rcStrict2;
 
                 if (iGDTE1 != iGDTE2)
                 {
-                    rc2 = selmRCSyncGDTEntry(pVM, pVCpu, pRegFrame, iGDTE2);
-                    if (rc == VINF_SUCCESS)
-                        rc = rc2;
+                    rcStrict2 = selmRCSyncGDTEntry(pVM, pVCpu, pRegFrame, iGDTE2);
+                    if (rcStrict == VINF_SUCCESS)
+                        rcStrict = rcStrict2;
                 }
 
-                if (rc2 == VINF_SUCCESS || rc2 == VINF_EM_RESCHEDULE_REM)
+                if (rcStrict2 == VINF_SUCCESS || rcStrict2 == VINF_EM_RESCHEDULE_REM)
                 {
                     /* VINF_EM_RESCHEDULE_REM - bad idea if we're in a patch. */
-                    if (rc2 == VINF_EM_RESCHEDULE_REM)
-                        rc = VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT;
+                    if (rcStrict2 == VINF_EM_RESCHEDULE_REM)
+                        rcStrict = VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT;
                     STAM_COUNTER_INC(&pVM->selm.s.StatRCWriteGuestGDTHandled);
-                    return rc;
+                    return VBOXSTRICTRC_TODO(rcStrict);
                 }
             }
 
             /* sync failed, return to ring-3 and resync the GDT. */
-            if (rc == VINF_SUCCESS || RT_FAILURE(rc2))
-                rc = rc2;
+            if (rcStrict == VINF_SUCCESS || RT_FAILURE(rcStrict2))
+                rcStrict = rcStrict2;
         }
     }
     else
     {
-        Assert(RT_FAILURE(rc));
-        if (rc == VERR_EM_INTERPRETER)
-            rc = VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT;
+        Assert(RT_FAILURE(rcStrict));
+        if (rcStrict == VERR_EM_INTERPRETER)
+            rcStrict = VINF_EM_RAW_EMULATE_INSTR_GDT_FAULT;
         VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_GDT);
     }
 
     STAM_COUNTER_INC(&pVM->selm.s.StatRCWriteGuestGDTUnhandled);
-    return rc;
+    return VBOXSTRICTRC_TODO(rcStrict);
 }
 #endif /* SELM_TRACK_GUEST_GDT_CHANGES */
@@ -400,9 +400,9 @@
      */
     uint32_t cb;
-    int rc = EMInterpretInstructionEx(pVCpu, pRegFrame, (RTGCPTR)(RTRCUINTPTR)pvFault, &cb);
-    if (    RT_SUCCESS(rc)
-        &&  cb)
-    {
-        rc = VINF_SUCCESS;
+    VBOXSTRICTRC rcStrict = EMInterpretInstructionEx(pVCpu, pRegFrame, (RTGCPTR)(RTRCUINTPTR)pvFault, &cb);
+    if (   RT_SUCCESS(rcStrict)
+        && cb)
+    {
+        rcStrict = VINF_SUCCESS;
 
         /*
@@ -449,6 +449,6 @@
             } s;
             AssertCompileSize(s, 8);
-            rc = selmRCReadTssBits(pVM, &s, &pGuestTss->esp0, sizeof(s));
-            if (    rc == VINF_SUCCESS
+            rcStrict = selmRCReadTssBits(pVM, &s, &pGuestTss->esp0, sizeof(s));
+            if (    rcStrict == VINF_SUCCESS
                 &&  (    s.esp0 !=  pVM->selm.s.Tss.esp1
                      ||  s.ss0  != (pVM->selm.s.Tss.ss1 & ~1)) /* undo raw-r0 */
@@ -496,7 +496,7 @@
                     for (uint32_t i = 0; i < sizeof(pVM->selm.s.Tss.IntRedirBitmap) / 8; i++)
                     {
-                        rc = selmRCReadTssBits(pVM, &pVM->selm.s.Tss.IntRedirBitmap[i * 8],
-                                               (uint8_t *)pGuestTss + offIntRedirBitmap + i * 8, 8);
-                        if (rc != VINF_SUCCESS)
+                        rcStrict = selmRCReadTssBits(pVM, &pVM->selm.s.Tss.IntRedirBitmap[i * 8],
+                                                     (uint8_t *)pGuestTss + offIntRedirBitmap + i * 8, 8);
+                        if (rcStrict != VINF_SUCCESS)
                             break;
                     }
@@ -507,10 +507,10 @@
 
         /* Return to ring-3 for a full resync if any of the above fails... (?) */
-        if (rc != VINF_SUCCESS)
+        if (rcStrict != VINF_SUCCESS)
         {
             VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
             VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
-            if (RT_SUCCESS(rc))
-                rc = VINF_SUCCESS;
+            if (RT_SUCCESS(rcStrict))
+                rcStrict = VINF_SUCCESS;
         }
 
@@ -519,11 +519,11 @@
     else
     {
-        AssertMsg(RT_FAILURE(rc), ("cb=%u rc=%#x\n", cb, rc));
+        AssertMsg(RT_FAILURE(rcStrict), ("cb=%u rcStrict=%#x\n", cb, VBOXSTRICTRC_VAL(rcStrict)));
         VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
         STAM_COUNTER_INC(&pVM->selm.s.StatRCWriteGuestTSSUnhandled);
-        if (rc == VERR_EM_INTERPRETER)
-            rc = VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT;
-    }
-    return rc;
+        if (rcStrict == VERR_EM_INTERPRETER)
+            rcStrict = VINF_EM_RAW_EMULATE_INSTR_TSS_FAULT;
+    }
+    return VBOXSTRICTRC_TODO(rcStrict);
 }
 #endif /* SELM_TRACK_GUEST_TSS_CHANGES */
Index: /trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp	(revision 55965)
+++ /trunk/src/VBox/VMM/VMMRC/TRPMRCHandlers.cpp	(revision 55966)
@@ -608,5 +608,5 @@
         {
             LogFlow(("TRPMGCTrap06Handler: -> EMInterpretInstructionCPU\n"));
-            rc = EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
+            rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, &Cpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
         }
         else if (GIMShouldTrapXcptUD(pVCpu))
@@ -872,5 +872,5 @@
         case OP_WRMSR:
         {
-            rc = EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
+            rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
             if (rc == VERR_EM_INTERPRETER)
                 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
@@ -959,5 +959,5 @@
         case OP_RDPMC:
         {
-            rc = EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR);
+            rc = VBOXSTRICTRC_TODO(EMInterpretInstructionDisasState(pVCpu, pCpu, pRegFrame, PC, EMCODETYPE_SUPERVISOR));
             if (rc == VERR_EM_INTERPRETER)
                 rc = VINF_EM_RAW_EXCEPTION_PRIVILEGED;
@@ -1124,5 +1124,5 @@
                     TRPMResetTrap(pVCpu);
                     TRPMAssertTrap(pVCpu, X86_XCPT_DE, TRPM_TRAP);
-                    if (rcStrict)
+                    if (rcStrict != VINF_SUCCESS)
                         LogRel(("trpmGCTrap0dHandler: Overriding %Rrc with #DB on I/O port access.\n", VBOXSTRICTRC_VAL(rcStrict)));
                     rcStrict = VINF_EM_RAW_GUEST_TRAP;
Index: /trunk/src/VBox/VMM/include/PATMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/PATMInternal.h	(revision 55965)
+++ /trunk/src/VBox/VMM/include/PATMInternal.h	(revision 55966)
@@ -687,5 +687,5 @@
 void patmR3DbgAddPatch(PVM pVM, PPATMPATCHREC pPatchRec);
 
-PGM_ALL_CB2_DECL(FNPGMPHYSHANDLER) patmVirtPageHandler;
-
-#endif
+PGM_ALL_CB2_DECL(FNPGMR3VIRTHANDLER) patmVirtPageHandler;
+
+#endif
Index: /trunk/src/VBox/VMM/include/PGMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/PGMInternal.h	(revision 55965)
+++ /trunk/src/VBox/VMM/include/PGMInternal.h	(revision 55966)
@@ -4119,5 +4119,5 @@
 bool            pgmHandlerPhysicalIsAll(PVM pVM, RTGCPHYS GCPhys);
 void            pgmHandlerPhysicalResetAliasedPage(PVM pVM, PPGMPAGE pPage, RTGCPHYS GCPhysPage, bool fDoAccounting);
-int             pgmHandlerVirtualFindByPhysAddr(PVM pVM, RTGCPHYS GCPhys, PPGMVIRTHANDLER *ppVirt, unsigned *piPage);
+PPGMVIRTHANDLER pgmHandlerVirtualFindByPhysAddr(PVM pVM, RTGCPHYS GCPhys, unsigned *piPage);
 DECLCALLBACK(int) pgmHandlerVirtualResetOne(PAVLROGCPTRNODECORE pNode, void *pvUser);
 #if defined(VBOX_STRICT) || defined(LOG_ENABLED)
