Index: /trunk/include/VBox/pgm.h
===================================================================
--- /trunk/include/VBox/pgm.h	(revision 14300)
+++ /trunk/include/VBox/pgm.h	(revision 14301)
@@ -535,4 +535,7 @@
 VMMR3DECL(bool)     PGMR3MapHasConflicts(PVM pVM, uint64_t cr3, bool fRawR0);
 VMMR3DECL(int)      PGMR3MapRead(PVM pVM, void *pvDst, RTGCPTR GCPtrSrc, size_t cb);
+VMMR3DECL(int)      PGMR3MapActivate(PVM pVM);
+VMMR3DECL(int)      PGMR3MapDeactivate(PVM pVM);
+
 VMMR3DECL(int)      PGMR3HandlerPhysicalRegister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast,
                                                  PFNPGMR3PHYSHANDLER pfnHandlerR3, void *pvUserR3,
Index: /trunk/src/VBox/VMM/PGM.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGM.cpp	(revision 14300)
+++ /trunk/src/VBox/VMM/PGM.cpp	(revision 14301)
@@ -1413,8 +1413,9 @@
      * As with the intermediate context, AMD64 uses the PAE PDPT and PDs.
      */
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pShw32BitPdR3    = (PX86PD)MMR3PageAllocLow(pVM);
-#ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
+# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
     pVM->pgm.s.pShw32BitPdR0    = (uintptr_t)pVM->pgm.s.pShw32BitPdR3;
-#endif
+# endif
     pVM->pgm.s.apShwPaePDsR3[0] = (PX86PDPAE)MMR3PageAlloc(pVM);
     pVM->pgm.s.apShwPaePDsR3[1] = (PX86PDPAE)MMR3PageAlloc(pVM);
@@ -1424,14 +1425,15 @@
     pVM->pgm.s.apShwPaePDsR3[3] = (PX86PDPAE)MMR3PageAlloc(pVM);
     AssertRelease((uintptr_t)pVM->pgm.s.apShwPaePDsR3[2] + PAGE_SIZE == (uintptr_t)pVM->pgm.s.apShwPaePDsR3[3]);
-#ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
+# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
     pVM->pgm.s.apShwPaePDsR0[0] = (uintptr_t)pVM->pgm.s.apShwPaePDsR3[0];
     pVM->pgm.s.apShwPaePDsR0[1] = (uintptr_t)pVM->pgm.s.apShwPaePDsR3[1];
     pVM->pgm.s.apShwPaePDsR0[2] = (uintptr_t)pVM->pgm.s.apShwPaePDsR3[2];
     pVM->pgm.s.apShwPaePDsR0[3] = (uintptr_t)pVM->pgm.s.apShwPaePDsR3[3];
-#endif
+# endif
     pVM->pgm.s.pShwPaePdptR3 = (PX86PDPT)MMR3PageAllocLow(pVM);
-#ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
+# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
     pVM->pgm.s.pShwPaePdptR0 = (uintptr_t)pVM->pgm.s.pShwPaePdptR3;
-#endif
+# endif
+#endif /* VBOX_WITH_PGMPOOL_PAGING_ONLY */
     pVM->pgm.s.pShwNestedRootR3 = MMR3PageAllocLow(pVM);
 #ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
@@ -1439,4 +1441,7 @@
 #endif
 
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    if (!pVM->pgm.s.pShwNestedRootR3)
+#else
     if (    !pVM->pgm.s.pShw32BitPdR3
         ||  !pVM->pgm.s.apShwPaePDsR3[0]
@@ -1446,4 +1451,5 @@
         ||  !pVM->pgm.s.pShwPaePdptR3
         ||  !pVM->pgm.s.pShwNestedRootR3)
+#endif
     {
         AssertMsgFailed(("Failed to allocate pages for the intermediate context!\n"));
@@ -1452,4 +1458,5 @@
 
     /* get physical addresses. */
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.HCPhysShw32BitPD = MMPage2Phys(pVM, pVM->pgm.s.pShw32BitPdR3);
     Assert(MMPagePhys2Page(pVM, pVM->pgm.s.HCPhysShw32BitPD) == pVM->pgm.s.pShw32BitPdR3);
@@ -1459,4 +1466,5 @@
     pVM->pgm.s.aHCPhysPaePDs[3] = MMPage2Phys(pVM, pVM->pgm.s.apShwPaePDsR3[3]);
     pVM->pgm.s.HCPhysShwPaePdpt = MMPage2Phys(pVM, pVM->pgm.s.pShwPaePdptR3);
+#endif
     pVM->pgm.s.HCPhysShwNestedRoot = MMPage2Phys(pVM, pVM->pgm.s.pShwNestedRootR3);
 
@@ -1464,7 +1472,10 @@
      * Initialize the pages, setting up the PML4 and PDPT for action below 4GB.
      */
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     ASMMemZero32(pVM->pgm.s.pShw32BitPdR3, PAGE_SIZE);
     ASMMemZero32(pVM->pgm.s.pShwPaePdptR3, PAGE_SIZE);
+#endif
     ASMMemZero32(pVM->pgm.s.pShwNestedRootR3, PAGE_SIZE);
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.apShwPaePDsR3); i++)
     {
@@ -1475,4 +1486,5 @@
 
     CPUMSetHyperCR3(pVM, (uint32_t)pVM->pgm.s.HCPhysShw32BitPD);
+#endif
 
     /*
@@ -1515,4 +1527,5 @@
         LogFlow(("pgmR3InitPaging: returns successfully\n"));
 #if HC_ARCH_BITS == 64
+# ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         LogRel(("Debug: HCPhysShw32BitPD=%RHp aHCPhysPaePDs={%RHp,%RHp,%RHp,%RHp} HCPhysShwPaePdpt=%RHp HCPhysShwPaePml4=%RHp\n",
                 pVM->pgm.s.HCPhysShw32BitPD,
@@ -1520,4 +1533,5 @@
                 pVM->pgm.s.HCPhysShwPaePdpt,
                 pVM->pgm.s.HCPhysShwPaePml4));
+# endif 
         LogRel(("Debug: HCPhysInterPD=%RHp HCPhysInterPaePDPT=%RHp HCPhysInterPaePML4=%RHp\n",
                 pVM->pgm.s.HCPhysInterPD, pVM->pgm.s.HCPhysInterPaePDPT, pVM->pgm.s.HCPhysInterPaePML4));
@@ -1772,11 +1786,15 @@
 {
     RTGCPTR GCPtr;
+    int     rc;
+
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     /*
      * Reserve space for mapping the paging pages into guest context.
      */
-    int rc = MMR3HyperReserve(pVM, PAGE_SIZE * (2 + RT_ELEMENTS(pVM->pgm.s.apShwPaePDsR3) + 1 + 2 + 2), "Paging", &GCPtr);
+    rc = MMR3HyperReserve(pVM, PAGE_SIZE * (2 + RT_ELEMENTS(pVM->pgm.s.apShwPaePDsR3) + 1 + 2 + 2), "Paging", &GCPtr);
     AssertRCReturn(rc, rc);
     pVM->pgm.s.pShw32BitPdRC = GCPtr;
     MMR3HyperReserve(pVM, PAGE_SIZE, "fence", NULL);
+#endif
 
     /*
@@ -1811,4 +1829,7 @@
 VMMR3DECL(int) PGMR3InitFinalize(PVM pVM)
 {
+    int rc;
+
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     /*
      * Map the paging pages into the guest context.
@@ -1817,5 +1838,5 @@
     AssertReleaseReturn(GCPtr, VERR_INTERNAL_ERROR);
 
-    int rc = PGMMap(pVM, GCPtr, pVM->pgm.s.HCPhysShw32BitPD, PAGE_SIZE, 0);
+    rc = PGMMap(pVM, GCPtr, pVM->pgm.s.HCPhysShw32BitPD, PAGE_SIZE, 0);
     AssertRCReturn(rc, rc);
     pVM->pgm.s.pShw32BitPdRC = GCPtr;
@@ -1841,5 +1862,5 @@
     GCPtr += PAGE_SIZE;
     GCPtr += PAGE_SIZE; /* reserved page */
-
+#endif
 
     /*
@@ -1905,14 +1926,20 @@
     /** @todo move this into shadow and guest specific relocation functions. */
     AssertMsg(pVM->pgm.s.pShw32BitPdR3, ("Init order, no relocation before paging is initialized!\n"));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pShw32BitPdRC += offDelta;
+#endif
     pVM->pgm.s.pGst32BitPdRC += offDelta;
     AssertCompile(RT_ELEMENTS(pVM->pgm.s.apShwPaePDsRC) == RT_ELEMENTS(pVM->pgm.s.apGstPaePDsRC));
     for (unsigned i = 0; i < RT_ELEMENTS(pVM->pgm.s.apShwPaePDsRC); i++)
     {
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         pVM->pgm.s.apShwPaePDsRC[i] += offDelta;
+#endif
         pVM->pgm.s.apGstPaePDsRC[i] += offDelta;
     }
     pVM->pgm.s.pGstPaePdptRC += offDelta;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pShwPaePdptRC += offDelta;
+#endif
 
     pgmR3ModeDataInit(pVM, true /* resolve GC/R0 symbols */);
@@ -2965,33 +2992,42 @@
     pVM->pgm.s.pfnR3GstModifyPage           = pModeData->pfnR3GstModifyPage;
     pVM->pgm.s.pfnR3GstGetPDE               = pModeData->pfnR3GstGetPDE;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnR3GstMonitorCR3           = pModeData->pfnR3GstMonitorCR3;
     pVM->pgm.s.pfnR3GstUnmonitorCR3         = pModeData->pfnR3GstUnmonitorCR3;
+#endif
     pVM->pgm.s.pfnR3GstMapCR3               = pModeData->pfnR3GstMapCR3;
     pVM->pgm.s.pfnR3GstUnmapCR3             = pModeData->pfnR3GstUnmapCR3;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnR3GstWriteHandlerCR3      = pModeData->pfnR3GstWriteHandlerCR3;
     pVM->pgm.s.pszR3GstWriteHandlerCR3      = pModeData->pszR3GstWriteHandlerCR3;
     pVM->pgm.s.pfnR3GstPAEWriteHandlerCR3   = pModeData->pfnR3GstPAEWriteHandlerCR3;
     pVM->pgm.s.pszR3GstPAEWriteHandlerCR3   = pModeData->pszR3GstPAEWriteHandlerCR3;
-
+#endif
     pVM->pgm.s.pfnRCGstGetPage              = pModeData->pfnRCGstGetPage;
     pVM->pgm.s.pfnRCGstModifyPage           = pModeData->pfnRCGstModifyPage;
     pVM->pgm.s.pfnRCGstGetPDE               = pModeData->pfnRCGstGetPDE;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnRCGstMonitorCR3           = pModeData->pfnRCGstMonitorCR3;
     pVM->pgm.s.pfnRCGstUnmonitorCR3         = pModeData->pfnRCGstUnmonitorCR3;
+#endif
     pVM->pgm.s.pfnRCGstMapCR3               = pModeData->pfnRCGstMapCR3;
     pVM->pgm.s.pfnRCGstUnmapCR3             = pModeData->pfnRCGstUnmapCR3;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnRCGstWriteHandlerCR3      = pModeData->pfnRCGstWriteHandlerCR3;
     pVM->pgm.s.pfnRCGstPAEWriteHandlerCR3   = pModeData->pfnRCGstPAEWriteHandlerCR3;
-
+#endif
     pVM->pgm.s.pfnR0GstGetPage              = pModeData->pfnR0GstGetPage;
     pVM->pgm.s.pfnR0GstModifyPage           = pModeData->pfnR0GstModifyPage;
     pVM->pgm.s.pfnR0GstGetPDE               = pModeData->pfnR0GstGetPDE;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnR0GstMonitorCR3           = pModeData->pfnR0GstMonitorCR3;
     pVM->pgm.s.pfnR0GstUnmonitorCR3         = pModeData->pfnR0GstUnmonitorCR3;
+#endif
     pVM->pgm.s.pfnR0GstMapCR3               = pModeData->pfnR0GstMapCR3;
     pVM->pgm.s.pfnR0GstUnmapCR3             = pModeData->pfnR0GstUnmapCR3;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnR0GstWriteHandlerCR3      = pModeData->pfnR0GstWriteHandlerCR3;
     pVM->pgm.s.pfnR0GstPAEWriteHandlerCR3   = pModeData->pfnR0GstPAEWriteHandlerCR3;
-
+#endif
 
     /* both */
Index: /trunk/src/VBox/VMM/PGMGst.h
===================================================================
--- /trunk/src/VBox/VMM/PGMGst.h	(revision 14300)
+++ /trunk/src/VBox/VMM/PGMGst.h	(revision 14301)
@@ -110,7 +110,7 @@
 PGM_GST_DECL(int, Exit)(PVM pVM);
 
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
 static DECLCALLBACK(int) pgmR3Gst32BitWriteHandlerCR3(PVM pVM, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
 static DECLCALLBACK(int) pgmR3GstPAEWriteHandlerCR3(PVM pVM, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
-#if 0
 static DECLCALLBACK(int) pgmR3GstPAEWriteHandlerPD(PVM pVM, RTGCPHYS GCPhys, void *pvPhys, void *pvBuf, size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser);
 #endif
@@ -122,6 +122,8 @@
 PGM_GST_DECL(int, MapCR3)(PVM pVM, RTGCPHYS GCPhysCR3);
 PGM_GST_DECL(int, UnmapCR3)(PVM pVM);
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
 PGM_GST_DECL(int, MonitorCR3)(PVM pVM, RTGCPHYS GCPhysCR3);
 PGM_GST_DECL(int, UnmonitorCR3)(PVM pVM);
+#endif
 __END_DECLS
 
@@ -148,17 +150,21 @@
     pModeData->pfnR3GstMapCR3             = PGM_GST_NAME(MapCR3);
     pModeData->pfnR3GstUnmapCR3           = PGM_GST_NAME(UnmapCR3);
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pModeData->pfnR3GstMonitorCR3         = PGM_GST_NAME(MonitorCR3);
     pModeData->pfnR3GstUnmonitorCR3       = PGM_GST_NAME(UnmonitorCR3);
-
-#if PGM_GST_TYPE == PGM_TYPE_32BIT || PGM_GST_TYPE == PGM_TYPE_PAE
+#endif
+
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
+# if PGM_GST_TYPE == PGM_TYPE_32BIT || PGM_GST_TYPE == PGM_TYPE_PAE
     pModeData->pfnR3GstWriteHandlerCR3    = PGM_GST_NAME(WriteHandlerCR3);
     pModeData->pszR3GstWriteHandlerCR3    = "Guest CR3 Write access handler";
     pModeData->pfnR3GstPAEWriteHandlerCR3 = PGM_GST_NAME(WriteHandlerCR3);
     pModeData->pszR3GstPAEWriteHandlerCR3 = "Guest CR3 Write access handler (PAE)";
-#else
+# else
     pModeData->pfnR3GstWriteHandlerCR3    = NULL;
     pModeData->pszR3GstWriteHandlerCR3    = NULL;
     pModeData->pfnR3GstPAEWriteHandlerCR3 = NULL;
     pModeData->pszR3GstPAEWriteHandlerCR3 = NULL;
+# endif
 #endif
 
@@ -175,17 +181,21 @@
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(GetPDE),           &pModeData->pfnRCGstGetPDE);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(GetPDE), rc), rc);
+# ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(MonitorCR3),       &pModeData->pfnRCGstMonitorCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(MonitorCR3), rc), rc);
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(UnmonitorCR3),     &pModeData->pfnRCGstUnmonitorCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(UnmonitorCR3), rc), rc);
+# endif
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(MapCR3),           &pModeData->pfnRCGstMapCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(MapCR3), rc), rc);
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(UnmapCR3),         &pModeData->pfnRCGstUnmapCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(UnmapCR3), rc), rc);
-# if PGM_GST_TYPE == PGM_TYPE_32BIT || PGM_GST_TYPE == PGM_TYPE_PAE
+# ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
+#  if PGM_GST_TYPE == PGM_TYPE_32BIT || PGM_GST_TYPE == PGM_TYPE_PAE
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(WriteHandlerCR3),  &pModeData->pfnRCGstWriteHandlerCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(WriteHandlerCR3), rc), rc);
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(WriteHandlerCR3),  &pModeData->pfnRCGstPAEWriteHandlerCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(WriteHandlerCR3), rc), rc);
+#  endif
 # endif
 #endif /* Not AMD64 shadow paging. */
@@ -198,17 +208,21 @@
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(GetPDE),           &pModeData->pfnR0GstGetPDE);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(GetPDE), rc), rc);
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(MonitorCR3),       &pModeData->pfnR0GstMonitorCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(MonitorCR3), rc), rc);
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(UnmonitorCR3),     &pModeData->pfnR0GstUnmonitorCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(UnmonitorCR3), rc), rc);
+#endif
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(MapCR3),           &pModeData->pfnR0GstMapCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(MapCR3), rc), rc);
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(UnmapCR3),         &pModeData->pfnR0GstUnmapCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(UnmapCR3), rc), rc);
-#if PGM_GST_TYPE == PGM_TYPE_32BIT || PGM_GST_TYPE == PGM_TYPE_PAE
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
+# if PGM_GST_TYPE == PGM_TYPE_32BIT || PGM_GST_TYPE == PGM_TYPE_PAE
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(WriteHandlerCR3),  &pModeData->pfnR0GstWriteHandlerCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(WriteHandlerCR3), rc), rc);
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(WriteHandlerCR3),  &pModeData->pfnR0GstPAEWriteHandlerCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(WriteHandlerCR3), rc), rc);
+# endif
 #endif
     }
@@ -231,6 +245,8 @@
      */
     int rc = PGM_GST_NAME(MapCR3)(pVM, GCPhysCR3);
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     if (RT_SUCCESS(rc) && !pVM->pgm.s.fMappingsFixed)
         rc = PGM_GST_NAME(MonitorCR3)(pVM, GCPhysCR3);
+#endif
     return rc;
 }
@@ -259,6 +275,10 @@
 PGM_GST_DECL(int, Exit)(PVM pVM)
 {
-    int rc = PGM_GST_NAME(UnmonitorCR3)(pVM);
+    int rc;
+
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    rc = PGM_GST_NAME(UnmonitorCR3)(pVM);
     if (RT_SUCCESS(rc))
+#endif
         rc = PGM_GST_NAME(UnmapCR3)(pVM);
     return rc;
Index: /trunk/src/VBox/VMM/PGMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/PGMInternal.h	(revision 14300)
+++ /trunk/src/VBox/VMM/PGMInternal.h	(revision 14301)
@@ -1342,4 +1342,16 @@
 /** Page directory (32-bit root). */
 #define PGMPOOL_IDX_PD                  1
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+/** Page directory (32-bit root). */
+#define PGMPOOL_IDX_PD                  1
+/** Page Directory Pointer Table (PAE root). */
+#define PGMPOOL_IDX_PDPT                2
+/** AMD64 CR3 level index.*/
+#define PGMPOOL_IDX_AMD64_CR3           3
+/** Nested paging root.*/
+#define PGMPOOL_IDX_NESTED_ROOT         4
+/** The first normal index. */
+#define PGMPOOL_IDX_FIRST               5
+#else
 /** The extended PAE page directory (2048 entries, works as root currently). */
 #define PGMPOOL_IDX_PAE_PD              2
@@ -1360,4 +1372,5 @@
 /** The first normal index. */
 #define PGMPOOL_IDX_FIRST               10
+#endif
 /** The last valid index. (inclusive, 14 bits) */
 #define PGMPOOL_IDX_LAST                0x3fff
@@ -1429,8 +1442,23 @@
     PGMPOOLKIND_PAE_PT_FOR_PAE_2MB,
 
+    /** Shw: 32-bit page directory. Gst: 32-bit page directory. */
+    PGMPOOLKIND_32BIT_PD,
+    /** Shw: 32-bit page directory. Gst: real mode. */
+    PGMPOOLKIND_32BIT_PD_PHYS_REAL,
+    /** Shw: 32-bit page directory. Gst: protected mode without paging. */
+    PGMPOOLKIND_32BIT_PD_PHYS_PROT,
     /** Shw: PAE page directory;    Gst: 32-bit page directory. */
     PGMPOOLKIND_PAE_PD_FOR_32BIT_PD,
     /** Shw: PAE page directory;    Gst: PAE page directory. */
     PGMPOOLKIND_PAE_PD_FOR_PAE_PD,
+    /** Shw: PAE page directory;    Gst: real mode. */
+    PGMPOOLKIND_PAE_PD_PHYS_REAL,
+    /** Shw: PAE page directory;    Gst: protected mode without paging. */
+    PGMPOOLKIND_PAE_PD_PHYS_PROT,
+
+    /** Shw: PAE page directory pointer table (legacy, 4 entries);  Gst 32 bits paging. */
+    PGMPOOLKIND_PAE_PDPT_FOR_32BIT,
+    /** Shw: PAE page directory pointer table (legacy, 4 entries);  Gst PAE PDPT. */
+    PGMPOOLKIND_PAE_PDPT,
 
     /** Shw: 64-bit page directory pointer table;   Gst: 64-bit page directory pointer table. */
@@ -1453,4 +1481,5 @@
     PGMPOOLKIND_EPT_PT_FOR_PHYS,
 
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     /** Shw: Root 32-bit page directory. */
     PGMPOOLKIND_ROOT_32BIT_PD,
@@ -1459,4 +1488,5 @@
     /** Shw: Root PAE page directory pointer table (legacy, 4 entries). */
     PGMPOOLKIND_ROOT_PDPT,
+#endif
     /** Shw: Root Nested paging table. */
     PGMPOOLKIND_ROOT_NESTED,
@@ -1741,5 +1771,9 @@
 # define PGMPOOL_PAGE_2_PTR(pVM, pPage)    pgmPoolMapPage((pVM), (pPage))
 #else
-# define PGMPOOL_PAGE_2_PTR(pVM, pPage)    ((pPage)->pvPageR3)
+ inline R3R0PTRTYPE(void *) PGMPOOL_PAGE_2_PTR(PVM pVM, PPGMPOOLPAGE pPage)
+ {
+     Assert(pPage->pvPageR3);
+     return pPage->pvPageR3;
+ }
 #endif
 
@@ -1915,32 +1949,42 @@
     DECLR3CALLBACKMEMBER(int,       pfnR3GstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLR3CALLBACKMEMBER(int,       pfnR3GstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstUnmonitorCR3,(PVM pVM));
+#endif
     DECLR3CALLBACKMEMBER(int,       pfnR3GstMapCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstUnmapCR3,(PVM pVM));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     R3PTRTYPE(PFNPGMR3PHYSHANDLER)  pfnR3GstWriteHandlerCR3;
     R3PTRTYPE(const char *)         pszR3GstWriteHandlerCR3;
     R3PTRTYPE(PFNPGMR3PHYSHANDLER)  pfnR3GstPAEWriteHandlerCR3;
     R3PTRTYPE(const char *)         pszR3GstPAEWriteHandlerCR3;
-
+#endif
     DECLRCCALLBACKMEMBER(int,       pfnRCGstGetPage,(PVM pVM, RTGCPTR GCPtr, uint64_t *pfFlags, PRTGCPHYS pGCPhys));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLRCCALLBACKMEMBER(int,       pfnRCGstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstUnmonitorCR3,(PVM pVM));
+#endif
     DECLRCCALLBACKMEMBER(int,       pfnRCGstMapCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstUnmapCR3,(PVM pVM));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     RCPTRTYPE(PFNPGMRCPHYSHANDLER)  pfnRCGstWriteHandlerCR3;
     RCPTRTYPE(PFNPGMRCPHYSHANDLER)  pfnRCGstPAEWriteHandlerCR3;
-
+#endif
     DECLR0CALLBACKMEMBER(int,       pfnR0GstGetPage,(PVM pVM, RTGCPTR GCPtr, uint64_t *pfFlags, PRTGCPHYS pGCPhys));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLR0CALLBACKMEMBER(int,       pfnR0GstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstUnmonitorCR3,(PVM pVM));
+#endif
     DECLR0CALLBACKMEMBER(int,       pfnR0GstMapCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstUnmapCR3,(PVM pVM));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     R0PTRTYPE(PFNPGMRCPHYSHANDLER)  pfnR0GstWriteHandlerCR3;
     R0PTRTYPE(PFNPGMRCPHYSHANDLER)  pfnR0GstPAEWriteHandlerCR3;
+#endif
     /** @} */
 
@@ -2086,4 +2130,17 @@
     /** @name 32-bit Shadow Paging
      * @{ */
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    /** The Physical Address (HC) of the current active shadow CR3. */
+    RTHCPHYS                        HCPhysShwCR3;
+    /** Pointer to the page of the current active CR3 - R3 Ptr. */
+    R3PTRTYPE(PPGMPOOLPAGE)         pShwPageCR3R3;
+    /** Pointer to the page of the current active CR3 - R0 Ptr. */
+    R0PTRTYPE(PPGMPOOLPAGE)         pShwPageCR3R0;
+    /** Pointer to the page of the current active CR3 - RC Ptr. */
+    RCPTRTYPE(PPGMPOOLPAGE)         pShwPageCR3RC;
+# if HC_ARCH_BITS == 64
+    RTRCPTR                         alignment6; /**< structure size alignment. */
+# endif
+#else
     /** The 32-Bit PD - R3 Ptr. */
     R3PTRTYPE(PX86PD)               pShw32BitPdR3;
@@ -2092,7 +2149,7 @@
     /** The 32-Bit PD - RC Ptr. */
     RCPTRTYPE(PX86PD)               pShw32BitPdRC;
-#if HC_ARCH_BITS == 64
+# if HC_ARCH_BITS == 64
     uint32_t                        u32Padding1; /**< alignment padding. */
-#endif
+# endif
     /** The Physical Address (HC) of the 32-Bit PD. */
     RTHCPHYS                        HCPhysShw32BitPD;
@@ -2105,9 +2162,9 @@
      * Thus, it's possible to walk the 2048 entries starting where apHCPaePDs[0] points. */
     R3PTRTYPE(PX86PDPAE)            apShwPaePDsR3[4];
-#ifndef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
+# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
     /** The four PDs for the low 4GB - R0 Ptr.
      * Same kind of mapping as apHCPaePDs. */
     R0PTRTYPE(PX86PDPAE)            apShwPaePDsR0[4];
-#endif
+# endif
     /** The four PDs for the low 4GB - RC Ptr.
      * Same kind of mapping as apHCPaePDs. */
@@ -2125,7 +2182,7 @@
     RCPTRTYPE(PX86PDPT)             pShwPaePdptRC;
     /** @} */
-#if HC_ARCH_BITS == 64
+# if HC_ARCH_BITS == 64
     RTRCPTR                         alignment5; /**< structure size alignment. */
-#endif
+# endif
 
     /** @name AMD64 Shadow Paging
@@ -2134,8 +2191,8 @@
     /** The Page Map Level 4 table - R3 Ptr. */
     R3PTRTYPE(PX86PML4)             pShwPaePml4R3;
-#ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
+# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
     /** The Page Map Level 4 table - R0 Ptr. */
     R0PTRTYPE(PX86PML4)             pShwPaePml4R0;
-#endif
+# endif
     /** The Physical Address (HC) of the Page Map Level 4 table. */
     RTHCPHYS                        HCPhysShwPaePml4;
@@ -2150,10 +2207,11 @@
     /** Root table; format depends on the host paging mode (AMD-V) or EPT - R3 pointer. */
     RTR3PTR                         pShwNestedRootR3;
-#ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
+# ifndef VBOX_WITH_2X_4GB_ADDR_SPACE
     /** Root table; format depends on the host paging mode (AMD-V) or EPT - R0 pointer. */
     RTR0PTR                         pShwNestedRootR0;
-#endif
+# endif
     /** The Physical Address (HC) of the nested paging root. */
     RTHCPHYS                        HCPhysShwNestedRoot;
+#endif
     /** @}  */
 
@@ -2182,22 +2240,29 @@
     DECLR3CALLBACKMEMBER(int,       pfnR3GstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLR3CALLBACKMEMBER(int,       pfnR3GstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstUnmonitorCR3,(PVM pVM));
+#endif
     DECLR3CALLBACKMEMBER(int,       pfnR3GstMapCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstUnmapCR3,(PVM pVM));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     R3PTRTYPE(PFNPGMR3PHYSHANDLER)  pfnR3GstWriteHandlerCR3;
     R3PTRTYPE(const char *)         pszR3GstWriteHandlerCR3;
     R3PTRTYPE(PFNPGMR3PHYSHANDLER)  pfnR3GstPAEWriteHandlerCR3;
     R3PTRTYPE(const char *)         pszR3GstPAEWriteHandlerCR3;
-
+#endif
     DECLRCCALLBACKMEMBER(int,       pfnRCGstGetPage,(PVM pVM, RTGCPTR GCPtr, uint64_t *pfFlags, PRTGCPHYS pGCPhys));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLRCCALLBACKMEMBER(int,       pfnRCGstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstUnmonitorCR3,(PVM pVM));
+#endif
     DECLRCCALLBACKMEMBER(int,       pfnRCGstMapCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstUnmapCR3,(PVM pVM));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     RCPTRTYPE(PFNPGMRCPHYSHANDLER)  pfnRCGstWriteHandlerCR3;
     RCPTRTYPE(PFNPGMRCPHYSHANDLER)  pfnRCGstPAEWriteHandlerCR3;
+#endif
 #if HC_ARCH_BITS == 64
     RTRCPTR                         alignment3; /**< structure size alignment. */
@@ -2207,10 +2272,14 @@
     DECLR0CALLBACKMEMBER(int,       pfnR0GstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLR0CALLBACKMEMBER(int,       pfnR0GstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstUnmonitorCR3,(PVM pVM));
+#endif
     DECLR0CALLBACKMEMBER(int,       pfnR0GstMapCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstUnmapCR3,(PVM pVM));
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     R0PTRTYPE(PFNPGMRCPHYSHANDLER)  pfnR0GstWriteHandlerCR3;
     R0PTRTYPE(PFNPGMRCPHYSHANDLER)  pfnR0GstPAEWriteHandlerCR3;
+#endif
     /** @} */
 
@@ -3857,5 +3926,8 @@
 DECLINLINE(PX86PD) pgmShwGet32BitPDPtr(PPGM pPGM)
 {
-#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    return (PX86PD)PGMPOOL_PAGE_2_PTR(PGM2VM(pPGM), pPGM->CTX_SUFF(pShwPageCR3));
+#else
+# ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
     PX86PD          pShwPd;
     Assert(pPGM->HCPhysShw32BitPD != 0 && pPGM->HCPhysShw32BitPD != NIL_RTHCPHYS);
@@ -3863,6 +3935,7 @@
     AssertRCReturn(rc, NULL);
     return pShwPd;
-#else
+# else
     return pPGM->CTX_SUFF(pShw32BitPd);
+# endif
 #endif
 }
@@ -3878,18 +3951,13 @@
 DECLINLINE(X86PDE) pgmShwGet32BitPDE(PPGM pPGM, RTGCPTR GCPtr)
 {
-    const unsigned  iPd = (GCPtr >> X86_PD_SHIFT) & X86_PD_MASK;
-#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
-    PCX86PD         pShwPd;
-    Assert(pPGM->HCPhysShw32BitPD != 0 && pPGM->HCPhysShw32BitPD != NIL_RTHCPHYS);
-    int rc = PGM_HCPHYS_2_PTR(PGM2VM(pPGM), pPGM->HCPhysShw32BitPD, &pShwPd);
-    if (RT_FAILURE(rc))
+    const unsigned iPd = (GCPtr >> X86_PD_SHIFT) & X86_PD_MASK;
+
+    PX86PD pShwPde = pgmShwGet32BitPDPtr(pPGM);
+    if (!pShwPde)
     {
         X86PDE ZeroPde = {0};
-        AssertMsgFailedReturn(("%Rrc\n", rc), ZeroPde);
+        return ZeroPde;
     }
-    return pShwPd->a[iPd];
-#else
-    return pPGM->CTX_SUFF(pShw32BitPd)->a[iPd];
-#endif
+    return pShwPde->a[iPd];
 }
 
@@ -3905,14 +3973,9 @@
 DECLINLINE(PX86PDE) pgmShwGet32BitPDEPtr(PPGM pPGM, RTGCPTR GCPtr)
 {
-    const unsigned  iPd = (GCPtr >> X86_PD_SHIFT) & X86_PD_MASK;
-#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
-    PX86PD          pShwPd;
-    Assert(pPGM->HCPhysShw32BitPD != 0 && pPGM->HCPhysShw32BitPD != NIL_RTHCPHYS);
-    int rc = PGM_HCPHYS_2_PTR(PGM2VM(pPGM), pPGM->HCPhysShw32BitPD, &pShwPd);
-    AssertRCReturn(rc, NULL);
-    return &pShwPd->a[iPd];
-#else
-    return &pPGM->CTX_SUFF(pShw32BitPd)->a[iPd];
-#endif
+    const unsigned iPd = (GCPtr >> X86_PD_SHIFT) & X86_PD_MASK;
+
+    PX86PD pPde = pgmShwGet32BitPDPtr(pPGM);
+    AssertReturn(pPde, NULL);
+    return &pPde->a[iPd];
 }
 
@@ -3926,5 +3989,8 @@
 DECLINLINE(PX86PDPT) pgmShwGetPaePDPTPtr(PPGM pPGM)
 {
-#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    return (PX86PDPT)PGMPOOL_PAGE_2_PTR(PGM2VM(pPGM), pPGM->CTX_SUFF(pShwPageCR3));
+#else
+# ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
     PX86PDPT pShwPdpt;
     Assert(pPGM->HCPhysShwPaePdpt != 0 && pPGM->HCPhysShwPaePdpt != NIL_RTHCPHYS);
@@ -3932,6 +3998,7 @@
     AssertRCReturn(rc, 0);
     return pShwPdpt;
-#else
+# else
     return pPGM->CTX_SUFF(pShwPaePdpt);
+# endif
 #endif
 }
@@ -3943,18 +4010,29 @@
  * @returns Pointer to the shadow PD.
  * @param   pPGM        Pointer to the PGM instance data.
- * @param   GCPtr       Address.
+ * @param   GCPtr       The address.
  */
 DECLINLINE(PX86PDPAE) pgmShwGetPaePDPtr(PPGM pPGM, RTGCPTR GCPtr)
 {
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
     const unsigned  iPdpt = (GCPtr >> X86_PDPT_SHIFT) & X86_PDPT_MASK_PAE;
-#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
+    PX86PDPT        pPdpt = pgmShwGetPaePDPTPtr(pPGM);
+
+    /* Fetch the pgm pool shadow descriptor. */
+    PPGMPOOLPAGE    pShwPde = pgmPoolGetPageByHCPhys(PGM2VM(pPGM), pPdpt->a[iPdpt].u & X86_PDPE_PG_MASK);
+    AssertReturn(pShwPde, NULL);
+
+    return (PX86PDPAE)PGMPOOL_PAGE_2_PTR(PGM2VM(pPGM), pShwPde);
+#else
+    const unsigned  iPdpt = (GCPtr >> X86_PDPT_SHIFT) & X86_PDPT_MASK_PAE;
+# ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
     PX86PDPAE       pPD;
     int rc = PGM_HCPHYS_2_PTR(PGM2VM(pPGM), pPGM->aHCPhysPaePDs[iPdpt], &pPD);
     AssertRCReturn(rc, 0);
     return pPD;
-#else
+# else
     PX86PDPAE       pPD = pPGM->CTX_SUFF(apShwPaePDs)[iPdpt];
     Assert(pPD);
     return pPD;
+# endif
 #endif
 }
@@ -3966,22 +4044,17 @@
  * @returns PDE.
  * @param   pPGM        Pointer to the PGM instance data.
- * @param   GCPtr       Address.
+ * @param   GCPtr       The address.
  */
 DECLINLINE(X86PDEPAE) pgmShwGetPaePDE(PPGM pPGM, RTGCPTR GCPtr)
 {
-    const unsigned  iPdpt = (GCPtr >> X86_PDPT_SHIFT)   & X86_PDPT_MASK_PAE;
     const unsigned  iPd   = (GCPtr >> X86_PD_PAE_SHIFT) & X86_PD_PAE_MASK;
-#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
-    PCX86PDPAE      pPD;
-    int rc = PGM_HCPHYS_2_PTR(PGM2VM(pPGM), pPGM->aHCPhysPaePDs[iPdpt], &pPD);
-    if (RT_FAILURE(rc))
+
+    PX86PDPAE pShwPde = pgmShwGetPaePDPtr(pPGM, GCPtr);
+    if (!pShwPde)
     {
         X86PDEPAE ZeroPde = {0};
-        AssertMsgFailedReturn(("%Rrc\n", rc), ZeroPde);
+        return ZeroPde;
     }
-    return pPD->a[iPd];
-#else
-    return pPGM->CTX_SUFF(apShwPaePDs)[iPdpt]->a[iPd];
-#endif
+    return pShwPde->a[iPd];
 }
 
@@ -3992,19 +4065,13 @@
  * @returns Pointer to the PDE.
  * @param   pPGM        Pointer to the PGM instance data.
- * @param   GCPtr       Address.
+ * @param   GCPtr       The address.
  */
 DECLINLINE(PX86PDEPAE) pgmShwGetPaePDEPtr(PPGM pPGM, RTGCPTR GCPtr)
 {
-    const unsigned  iPdpt = (GCPtr >> X86_PDPT_SHIFT)   & X86_PDPT_MASK_PAE;
     const unsigned  iPd   = (GCPtr >> X86_PD_PAE_SHIFT) & X86_PD_PAE_MASK;
-#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
-    PX86PDPAE       pPD;
-    int rc = PGM_HCPHYS_2_PTR(PGM2VM(pPGM), pPGM->aHCPhysPaePDs[iPdpt], &pPD);
-    AssertRCReturn(rc, 0);
-    return &pPD->a[iPd];
-#else
-    Assert(pPGM->CTX_SUFF(apShwPaePDs)[iPdpt]);
-    return &pPGM->CTX_SUFF(apShwPaePDs)[iPdpt]->a[iPd];
-#endif
+
+    PX86PDPAE pPde = pgmShwGetPaePDPtr(pPGM, GCPtr);
+    AssertReturn(pPde, NULL);
+    return &pPde->a[iPd];
 }
 
@@ -4019,5 +4086,8 @@
 DECLINLINE(PX86PML4) pgmShwGetLongModePML4Ptr(PPGM pPGM)
 {
-#ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    return (PX86PML4)PGMPOOL_PAGE_2_PTR(PGM2VM(pPGM), pPGM->CTX_SUFF(pShwPageCR3));
+#else
+# ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
     PX86PML4 pShwPml4;
     Assert(pPGM->HCPhysShwPaePml4 != 0 && pPGM->HCPhysShwPaePml4 != NIL_RTHCPHYS);
@@ -4025,7 +4095,8 @@
     AssertRCReturn(rc, 0);
     return pShwPml4;
-#else
+# else
     Assert(pPGM->CTX_SUFF(pShwPaePml4));
     return pPGM->CTX_SUFF(pShwPaePml4);
+# endif
 #endif
 }
@@ -4042,18 +4113,12 @@
 {
     const unsigned  iPml4 = ((RTGCUINTPTR64)GCPtr >> X86_PML4_SHIFT) & X86_PML4_MASK;
-# ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
-    PCX86PML4       pShwPml4;
-    Assert(pPGM->HCPhysShwPaePml4 != 0 && pPGM->HCPhysShwPaePml4 != NIL_RTHCPHYS);
-    int rc = PGM_HCPHYS_2_PTR(PGM2VM(pPGM), pPGM->HCPhysShwPaePml4, &pShwPml4);
-    if (RT_FAILURE(rc))
+    PX86PML4        pShwPml4 = pgmShwGetLongModePML4Ptr(pPGM);
+
+    if (!pShwPml4)
     {
         X86PML4E ZeroPml4e = {0};
-        AssertMsgFailedReturn(("%Rrc\n", rc), ZeroPml4e);
+        return ZeroPml4e;
     }
     return pShwPml4->a[iPml4];
-# else
-    Assert(pPGM->CTX_SUFF(pShwPaePml4));
-    return pPGM->CTX_SUFF(pShwPaePml4)->a[iPml4];
-# endif
 }
 
@@ -4068,14 +4133,10 @@
 DECLINLINE(PX86PML4E) pgmShwGetLongModePML4EPtr(PPGM pPGM, unsigned int iPml4)
 {
-# ifdef VBOX_WITH_2X_4GB_ADDR_SPACE_IN_R0
-    PX86PML4        pShwPml4;
-    Assert(pPGM->HCPhysShwPaePml4 != 0 && pPGM->HCPhysShwPaePml4 != NIL_RTHCPHYS);
-    int rc = PGM_HCPHYS_2_PTR(PGM2VM(pPGM), pPGM->HCPhysShwPaePml4, &pShwPml4);
-    AssertRCReturn(rc, 0);
+    PX86PML4 pShwPml4 = pgmShwGetLongModePML4Ptr(pPGM);
+
+    if (!pShwPml4)
+        return NULL;
+
     return &pShwPml4->a[iPml4];
-# else
-    Assert(pPGM->CTX_SUFF(pShwPaePml4));
-    return &pPGM->CTX_SUFF(pShwPaePml4)->a[iPml4];
-# endif
 }
 
Index: /trunk/src/VBox/VMM/PGMMap.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGMMap.cpp	(revision 14300)
+++ /trunk/src/VBox/VMM/PGMMap.cpp	(revision 14301)
@@ -430,4 +430,5 @@
     }
 
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     /*
      * Turn off CR3 updating monitoring.
@@ -435,4 +436,5 @@
     int rc2 = PGM_GST_PFN(UnmonitorCR3, pVM)(pVM);
     AssertRC(rc2);
+#endif
 
     /*
@@ -482,7 +484,8 @@
     AssertRC(rc);
 
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     rc = PGM_GST_PFN(MonitorCR3, pVM)(pVM, pVM->pgm.s.GCPhysCR3);
     AssertRC(rc);
-
+#endif
     return VINF_SUCCESS;
 }
@@ -723,6 +726,7 @@
          */
         pPGM->pInterPD->a[iOldPDE].u        = 0;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         pPGM->pShw32BitPdR3->a[iOldPDE].u   = 0;
-
+#endif
         /*
          * PAE.
@@ -731,11 +735,15 @@
         unsigned iPDE = iOldPDE * 2 % 512;
         pPGM->apInterPaePDs[iPD]->a[iPDE].u = 0;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         pPGM->apShwPaePDsR3[iPD]->a[iPDE].u = 0;
+#endif
         iPDE++;
         pPGM->apInterPaePDs[iPD]->a[iPDE].u = 0;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         pPGM->apShwPaePDsR3[iPD]->a[iPDE].u = 0;
 
         /* Clear the PGM_PDFLAGS_MAPPING flag for the page directory pointer entry. (legacy PAE guest mode) */
         pPGM->pShwPaePdptR3->a[iPD].u &= ~PGM_PLXFLAGS_MAPPING;
+#endif
     }
 }
@@ -771,12 +779,15 @@
          * 32-bit.
          */
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         if (pPGM->pShw32BitPdR3->a[iNewPDE].n.u1Present)
             pgmPoolFree(pVM, pPGM->pShw32BitPdR3->a[iNewPDE].u & X86_PDE_PG_MASK, PGMPOOL_IDX_PD, iNewPDE);
+#endif
         X86PDE Pde;
         /* Default mapping page directory flags are read/write and supervisor; individual page attributes determine the final flags */
         Pde.u = PGM_PDFLAGS_MAPPING | X86_PDE_P | X86_PDE_A | X86_PDE_RW | X86_PDE_US | (uint32_t)pMap->aPTs[i].HCPhysPT;
         pPGM->pInterPD->a[iNewPDE]        = Pde;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         pPGM->pShw32BitPdR3->a[iNewPDE]   = Pde;
-
+#endif
         /*
          * PAE.
@@ -784,21 +795,28 @@
         const unsigned iPD = iNewPDE / 256;
         unsigned iPDE = iNewPDE * 2 % 512;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         if (pPGM->apShwPaePDsR3[iPD]->a[iPDE].n.u1Present)
             pgmPoolFree(pVM, pPGM->apShwPaePDsR3[iPD]->a[iPDE].u & X86_PDE_PAE_PG_MASK, PGMPOOL_IDX_PAE_PD, iNewPDE * 2);
+#endif
         X86PDEPAE PdePae0;
         PdePae0.u = PGM_PDFLAGS_MAPPING | X86_PDE_P | X86_PDE_A | X86_PDE_RW | X86_PDE_US | pMap->aPTs[i].HCPhysPaePT0;
         pPGM->apInterPaePDs[iPD]->a[iPDE] = PdePae0;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         pPGM->apShwPaePDsR3[iPD]->a[iPDE] = PdePae0;
-
+#endif
         iPDE++;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         if (pPGM->apShwPaePDsR3[iPD]->a[iPDE].n.u1Present)
             pgmPoolFree(pVM, pPGM->apShwPaePDsR3[iPD]->a[iPDE].u & X86_PDE_PAE_PG_MASK, PGMPOOL_IDX_PAE_PD, iNewPDE * 2 + 1);
+#endif
         X86PDEPAE PdePae1;
         PdePae1.u = PGM_PDFLAGS_MAPPING | X86_PDE_P | X86_PDE_A | X86_PDE_RW | X86_PDE_US | pMap->aPTs[i].HCPhysPaePT1;
         pPGM->apInterPaePDs[iPD]->a[iPDE] = PdePae1;
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         pPGM->apShwPaePDsR3[iPD]->a[iPDE] = PdePae1;
 
         /* Set the PGM_PDFLAGS_MAPPING flag in the page directory pointer entry. (legacy PAE guest mode) */
         pPGM->pShwPaePdptR3->a[iPD].u |= PGM_PLXFLAGS_MAPPING;
+#endif
     }
 }
@@ -1129,4 +1147,129 @@
 }
 
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+/**
+ * Apply the hypervisor mappings to the active CR3.
+ *
+ * @returns VBox status.
+ * @param   pVM         The virtual machine.
+ */
+VMMR3DECL(int) PGMR3MapActivate(PVM pVM)
+{
+    /*
+     * Can skip this if mappings are safely fixed.
+     */
+    if (pVM->pgm.s.fMappingsFixed)
+        return VINF_SUCCESS;
+
+    PGMMODE const enmGuestMode = PGMGetGuestMode(pVM);
+    Assert(enmGuestMode <= PGMMODE_PAE_NX);
+
+    /*
+     * Iterate mappings.
+     */
+    if (enmGuestMode == PGMMODE_32_BIT)
+    {
+        /*
+         * Resolve the page directory.
+         */
+        PX86PD pPD = (PX86PD)pVM->pgm.s.pShwPageCR3R3;
+        Assert(pPD);
+
+        for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3; pCur; pCur = pCur->pNextR3)
+        {
+            unsigned iPDE = pCur->GCPtr >> X86_PD_SHIFT;
+            unsigned iPT = pCur->cPTs;
+            while (iPT-- > 0)
+                pPD->a[iPDE + iPT].u = 0;
+        }
+    }
+    else if (   enmGuestMode == PGMMODE_PAE
+             || enmGuestMode == PGMMODE_PAE_NX)
+    {
+        for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3; pCur; pCur = pCur->pNextR3)
+        {
+            RTGCPTR   GCPtr = pCur->GCPtr;
+            unsigned  iPdpt = (GCPtr >> X86_PDPT_SHIFT) & X86_PDPT_MASK_PAE;
+
+            unsigned  iPT = pCur->cb >> X86_PD_PAE_SHIFT;
+            while (iPT-- > 0)
+            {
+                PX86PDEPAE pPDE = pgmShwGetPaePDEPtr(&pVM->pgm.s, GCPtr);
+                pPDE->u = 0;
+
+                GCPtr += (1 << X86_PD_PAE_SHIFT);
+            }
+        }
+    }
+    else
+        AssertFailed();
+
+    return VINF_SUCCESS;
+}
+
+/**
+ * Remove the hypervisor mappings from the active CR3
+ *
+ * @returns VBox status.
+ * @param   pVM         The virtual machine.
+ */
+VMMR3DECL(int) PGMR3MapDeactivate(PVM pVM)
+{
+    /*
+     * Can skip this if mappings are safely fixed.
+     */
+    if (pVM->pgm.s.fMappingsFixed)
+        return VINF_SUCCESS;
+
+    PGMMODE const enmGuestMode = PGMGetGuestMode(pVM);
+    Assert(enmGuestMode <= PGMMODE_PAE_NX);
+
+    /*
+     * Iterate mappings.
+     */
+    if (enmGuestMode == PGMMODE_32_BIT)
+    {
+        /*
+         * Resolve the page directory.
+         */
+        PX86PD pPD = (PX86PD)pVM->pgm.s.pShwPageCR3R3;
+        Assert(pPD);
+
+        for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3; pCur; pCur = pCur->pNextR3)
+        {
+            unsigned iPDE = pCur->GCPtr >> X86_PD_SHIFT;
+            unsigned iPT = pCur->cPTs;
+            while (iPT-- > 0)
+                pPD->a[iPDE + iPT].u = 0;
+        }
+    }
+    else if (   enmGuestMode == PGMMODE_PAE
+             || enmGuestMode == PGMMODE_PAE_NX)
+    {
+        for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3; pCur; pCur = pCur->pNextR3)
+        {
+            RTGCPTR   GCPtr = pCur->GCPtr;
+
+            unsigned  iPT = pCur->cb >> X86_PD_PAE_SHIFT;
+            while (iPT-- > 0)
+            {
+                PX86PDEPAE pPDE = pgmShwGetPaePDEPtr(&pVM->pgm.s, GCPtr);
+                pPDE->u = 0;
+
+                GCPtr += (1 << X86_PD_PAE_SHIFT);
+            }
+        }
+
+        /* Clear the PGM_PDFLAGS_MAPPING flag for the page directory pointer entries. (legacy PAE guest mode) */
+        PX86PDPT pPdpt = (PX86PDPT)pVM->pgm.s.pShwPageCR3R3;
+        for (unsigned i=0;i<X86_PG_PAE_PDPE_ENTRIES;i++)
+            pPdpt->a[i].u &= ~PGM_PLXFLAGS_MAPPING;
+    }
+    else
+        AssertFailed();
+
+    return VINF_SUCCESS;
+}
+#endif /* VBOX_WITH_PGMPOOL_PAGING_ONLY */
 
 /**
Index: /trunk/src/VBox/VMM/PGMPool.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGMPool.cpp	(revision 14300)
+++ /trunk/src/VBox/VMM/PGMPool.cpp	(revision 14301)
@@ -255,8 +255,14 @@
     pPool->aPages[PGMPOOL_IDX_PD].Core.Key  = NIL_RTHCPHYS;
     pPool->aPages[PGMPOOL_IDX_PD].GCPhys    = NIL_RTGCPHYS;
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    pPool->aPages[PGMPOOL_IDX_PD].pvPageR3  = 0;
+    pPool->aPages[PGMPOOL_IDX_PD].enmKind   = PGMPOOLKIND_32BIT_PD;
+#else
     pPool->aPages[PGMPOOL_IDX_PD].pvPageR3  = pVM->pgm.s.pShw32BitPdR3;
     pPool->aPages[PGMPOOL_IDX_PD].enmKind   = PGMPOOLKIND_ROOT_32BIT_PD;
+#endif
     pPool->aPages[PGMPOOL_IDX_PD].idx       = PGMPOOL_IDX_PD;
 
+#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     /* The Shadow PAE PDs. This is actually 4 pages! (32 bits guest paging)  */
     pPool->aPages[PGMPOOL_IDX_PAE_PD].Core.Key  = NIL_RTHCPHYS;
@@ -275,10 +281,16 @@
         pPool->aPages[PGMPOOL_IDX_PAE_PD_0 + i].idx       = PGMPOOL_IDX_PAE_PD_0 + i;
     }
+#endif
 
     /* The Shadow PDPT. */
     pPool->aPages[PGMPOOL_IDX_PDPT].Core.Key  = NIL_RTHCPHYS;
     pPool->aPages[PGMPOOL_IDX_PDPT].GCPhys    = NIL_RTGCPHYS;
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    pPool->aPages[PGMPOOL_IDX_PDPT].pvPageR3  = 0;
+    pPool->aPages[PGMPOOL_IDX_PDPT].enmKind   = PGMPOOLKIND_PAE_PDPT;
+#else
     pPool->aPages[PGMPOOL_IDX_PDPT].pvPageR3  = pVM->pgm.s.pShwPaePdptR3;
     pPool->aPages[PGMPOOL_IDX_PDPT].enmKind   = PGMPOOLKIND_ROOT_PDPT;
+#endif
     pPool->aPages[PGMPOOL_IDX_PDPT].idx       = PGMPOOL_IDX_PDPT;
 
@@ -286,5 +298,9 @@
     pPool->aPages[PGMPOOL_IDX_AMD64_CR3].Core.Key  = NIL_RTHCPHYS;
     pPool->aPages[PGMPOOL_IDX_AMD64_CR3].GCPhys    = NIL_RTGCPHYS;
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+    pPool->aPages[PGMPOOL_IDX_AMD64_CR3].pvPageR3  = 0;
+#else
     pPool->aPages[PGMPOOL_IDX_AMD64_CR3].pvPageR3  = pVM->pgm.s.pShwPaePdptR3;  /* not used - isn't it wrong as well? */
+#endif
     pPool->aPages[PGMPOOL_IDX_AMD64_CR3].enmKind   = PGMPOOLKIND_64BIT_PML4_FOR_64BIT_PML4;
     pPool->aPages[PGMPOOL_IDX_AMD64_CR3].idx       = PGMPOOL_IDX_AMD64_CR3;
Index: /trunk/src/VBox/VMM/VMMSwitcher/32BitToAMD64.asm
===================================================================
--- /trunk/src/VBox/VMM/VMMSwitcher/32BitToAMD64.asm	(revision 14300)
+++ /trunk/src/VBox/VMM/VMMSwitcher/32BitToAMD64.asm	(revision 14301)
@@ -439,5 +439,6 @@
     lss     esp, [edx + CPUMCPU.Host.esp]
 
-        FIXUP FIX_NO_SYSENTER_JMP, 0, gth_sysenter_no - NAME(Start) ; this will insert a jmp gth_sysenter_no if host doesn't use sysenter.
+    FIXUP FIX_NO_SYSENTER_JMP, 0, gth_sysenter_no - NAME(Start) ; this will insert a jmp gth_sysenter_no if host doesn't use sysenter.
+    
     ; restore MSR_IA32_SYSENTER_CS register.
     mov     ecx, MSR_IA32_SYSENTER_CS
