Index: /trunk/include/VBox/pgm.h
===================================================================
--- /trunk/include/VBox/pgm.h	(revision 16897)
+++ /trunk/include/VBox/pgm.h	(revision 16898)
@@ -331,6 +331,8 @@
 VMMDECL(int)        PGMMapActivateAll(PVM pVM);
 VMMDECL(int)        PGMMapDeactivateAll(PVM pVM);
-VMMDECL(bool)       PGMMapHasConflicts(PVM pVM, bool fResolveConflicts);
-
+#ifndef IN_RING0
+VMMDECL(bool)       PGMMapHasConflicts(PVM pVM);
+VMMDECL(int)        PGMMapResolveConflicts(PVM pVM);
+#endif
 VMMDECL(int)        PGMShwGetPage(PVM pVM, RTGCPTR GCPtr, uint64_t *pfFlags, PRTHCPHYS pHCPhys);
 VMMDECL(int)        PGMShwSetPage(PVM pVM, RTGCPTR GCPtr, size_t cb, uint64_t fFlags);
Index: /trunk/src/VBox/VMM/EM.cpp
===================================================================
--- /trunk/src/VBox/VMM/EM.cpp	(revision 16897)
+++ /trunk/src/VBox/VMM/EM.cpp	(revision 16898)
@@ -2607,5 +2607,5 @@
                   ("Tried to execute code with IF at EIP=%08x!\n", pCtx->eip));
         if (    !VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL)
-            &&  PGMMapHasConflicts(pVM, false))
+            &&  PGMMapHasConflicts(pVM))
         {
             AssertMsgFailed(("We should not get conflicts any longer!!!\n"));
@@ -2720,5 +2720,5 @@
          */
         if (    !VM_FF_ISPENDING(pVM, VM_FF_PGM_SYNC_CR3 | VM_FF_PGM_SYNC_CR3_NON_GLOBAL)
-            &&  PGMMapHasConflicts(pVM, false))
+            &&  PGMMapHasConflicts(pVM))
         {
             AssertMsgFailed(("We should not get conflicts any longer!!!\n"));
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 16897)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 16898)
@@ -3299,9 +3299,22 @@
 
 # ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+#  ifdef PGM_WITHOUT_MAPPINGS
+    Assert(!pVM->pgm.s.fMappingsFixed);
+    return VINF_SUCCESS;
+#  else
     /* Nothing to do when mappings are fixed. */
     if (pVM->pgm.s.fMappingsFixed)
         return VINF_SUCCESS;
-# endif
-
+
+    int rc = PGMMapResolveConflicts(pVM);
+    Assert(rc == VINF_SUCCESS || rc == VINF_PGM_SYNC_CR3);
+    if (rc == VINF_PGM_SYNC_CR3)
+    {
+        LogFlow(("SyncCR3: detected conflict -> VINF_PGM_SYNC_CR3\n"));
+        return VINF_PGM_SYNC_CR3;
+    }
+#  endif
+    return VINF_SUCCESS;
+# else
     /*
      * PAE and 32-bit legacy mode (shadow).
@@ -3341,10 +3354,4 @@
     PPGMPOOL    pPool         = pVM->pgm.s.CTX_SUFF(pPool);
 
-#  ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
-    /* Mappings are always enabled when we get here. */
-    Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
-    pMapping      = pVM->pgm.s.CTX_SUFF(pMappings);
-    iPdNoMapping  = (pMapping) ? (pMapping->GCPtr >> GST_PD_SHIFT) : ~0U;
-#  else
     /* Only check mappings if they are supposed to be put into the shadow page table. */
     if (pgmMapAreMappingsEnabled(&pVM->pgm.s))
@@ -3358,5 +3365,4 @@
         iPdNoMapping  = ~0U;
     }
-#  endif
 
 #  if PGM_GST_TYPE == PGM_TYPE_PAE
@@ -3369,5 +3375,4 @@
         PX86PDPT        pPdptDst  = pgmShwGetPaePDPTPtr(&pVM->pgm.s);
 
-#   ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         if (pPDSrc == NULL)
         {
@@ -3391,5 +3396,4 @@
             continue;
         }
-#    endif /* !VBOX_WITH_PGMPOOL_PAGING_ONLY */
 #  else  /* PGM_GST_TYPE != PGM_TYPE_PAE */
     {
@@ -3469,12 +3473,4 @@
 #  endif /* (PGM_GST_TYPE != PGM_TYPE_32BIT && PGM_GST_TYPE != PGM_TYPE_PAE) || PGM_WITHOUT_MAPPINGS */
 
-#  ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
-                /* advance */
-#   if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
-                pPDEDst += 2;
-#   else
-                pPDEDst++;
-#   endif
-#  else
                 /*
                  * Sync page directory entry.
@@ -3565,5 +3561,4 @@
                     pPDEDst++;
                 } /* foreach 2MB PAE PDE in 4MB guest PDE */
-#  endif /* !VBOX_WITH_PGMPOOL_PAGING_ONLY */
             }
 #  if PGM_GST_TYPE == PGM_TYPE_PAE
@@ -3576,12 +3571,4 @@
                  * Check if there is any page directory to mark not present here.
                  */
-#  ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
-                /* advance */
-#   if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
-                pPDEDst += 2;
-#   else
-                pPDEDst++;
-#   endif
-#  else
 #   if PGM_SHW_TYPE == PGM_TYPE_PAE && PGM_GST_TYPE == PGM_TYPE_32BIT
                 for (unsigned i = 0, iPdShw = iPD * 2; i < 2; i++, iPdShw++) /* pray that the compiler unrolls this */
@@ -3600,5 +3587,4 @@
                     pPDEDst++;
                 }
-#  endif /* !VBOX_WITH_PGMPOOL_PAGING_ONLY */
             }
             else
@@ -3611,5 +3597,4 @@
 
                 Assert(pgmMapAreMappingsEnabled(&pVM->pgm.s));
-#   ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY 
                 if (pVM->pgm.s.fMappingsFixed)
                 {
@@ -3619,5 +3604,4 @@
                 }
                 else
-#   endif /* !VBOX_WITH_PGMPOOL_PAGING_ONLY */
                 {
                     /*
@@ -3686,4 +3670,5 @@
     return VINF_SUCCESS;
 # endif
+#endif /* VBOX_WITH_PGMPOOL_PAGING_ONLY */
 #endif /* PGM_SHW_TYPE != PGM_TYPE_NESTED && PGM_SHW_TYPE != PGM_TYPE_EPT && PGM_SHW_TYPE != PGM_TYPE_AMD64 */
 }
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllMap.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllMap.cpp	(revision 16897)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllMap.cpp	(revision 16898)
@@ -525,4 +525,5 @@
 }
 
+#ifndef IN_RING0
 /**
  * Checks guest PD for conflicts with VMM GC mappings.
@@ -531,7 +532,6 @@
  * @returns false if not.
  * @param   pVM                 The virtual machine.
- * @param   fResolveConflicts   Whether to resolve found conflicts or not (only valid in ring 3)
- */
-VMMDECL(bool) PGMMapHasConflicts(PVM pVM, bool fResolveConflicts)
+ */
+VMMDECL(bool) PGMMapHasConflicts(PVM pVM)
 {
     /*
@@ -564,4 +564,5 @@
                 {
                     STAM_COUNTER_INC(&pVM->pgm.s.StatR3DetectedConflicts);
+
                     Log(("PGMHasMappingConflicts: Conflict was detected at %08RX32 for mapping %s (32 bits)\n"
                          "                        iPDE=%#x iPT=%#x PDE=%RGp.\n",
@@ -602,2 +603,113 @@
     return false;
 }
+
+/**
+ * Checks and resolves (ring 3 only) guest conflicts with VMM GC mappings.
+ *
+ * @returns VBox status.
+ * @param   pVM                 The virtual machine.
+ */
+VMMDECL(int) PGMMapResolveConflicts(PVM pVM)
+{
+    /*
+     * Can skip this if mappings are safely fixed.
+     */
+    if (pVM->pgm.s.fMappingsFixed)
+        return VINF_SUCCESS;
+
+    PGMMODE const enmGuestMode = PGMGetGuestMode(pVM);
+    Assert(enmGuestMode <= PGMMODE_PAE_NX);
+
+    /*
+     * Iterate mappings.
+     */
+    if (enmGuestMode == PGMMODE_32_BIT)
+    {
+        /*
+         * Resolve the page directory.
+         */
+        PX86PD pPD = pgmGstGet32bitPDPtr(&pVM->pgm.s);
+        Assert(pPD);
+
+        for (PPGMMAPPING pCur = pVM->pgm.s.CTX_SUFF(pMappings); pCur; pCur = pCur->CTX_SUFF(pNext))
+        {
+            unsigned iPDE = pCur->GCPtr >> X86_PD_SHIFT;
+            unsigned iPT = pCur->cPTs;
+            while (iPT-- > 0)
+            {
+                if (    pPD->a[iPDE + iPT].n.u1Present /** @todo PGMGstGetPDE. */
+                    &&  (pVM->fRawR0Enabled || pPD->a[iPDE + iPT].n.u1User))
+                {
+                    STAM_COUNTER_INC(&pVM->pgm.s.StatR3DetectedConflicts);
+
+                    Log(("PGMHasMappingConflicts: Conflict was detected at %08RX32 for mapping %s (32 bits)\n"
+                         "                        iPDE=%#x iPT=%#x PDE=%RGp.\n",
+                        (iPT + iPDE) << X86_PD_SHIFT, pCur->pszDesc,
+                        iPDE, iPT, pPD->a[iPDE + iPT].au32[0]));
+#ifdef IN_RING3
+                    int rc = pgmR3SyncPTResolveConflict(pVM, pCur, pPD, iPDE << X86_PD_SHIFT);
+                    AssertRCReturn(rc, rc);
+
+                    /*
+                     * Update pCur.
+                     */
+                    pCur = pVM->pgm.s.CTX_SUFF(pMappings);
+                    while (pCur && pCur->GCPtr < (iPDE << X86_PD_SHIFT))
+                        pCur = pCur->CTX_SUFF(pNext);
+                    break;
+#else
+                    return VINF_PGM_SYNC_CR3;
+#endif
+                }
+            }
+            if (!pCur) 
+                break;
+        }
+    }
+    else if (   enmGuestMode == PGMMODE_PAE
+             || enmGuestMode == PGMMODE_PAE_NX)
+    {
+        for (PPGMMAPPING pCur = pVM->pgm.s.CTX_SUFF(pMappings); pCur; pCur = pCur->CTX_SUFF(pNext))
+        {
+            RTGCPTR   GCPtr = pCur->GCPtr;
+
+            unsigned  iPT = pCur->cb >> X86_PD_PAE_SHIFT;
+            while (iPT-- > 0)
+            {
+                X86PDEPAE Pde = pgmGstGetPaePDE(&pVM->pgm.s, GCPtr);
+
+                if (   Pde.n.u1Present
+                    && (pVM->fRawR0Enabled || Pde.n.u1User))
+                {
+                    STAM_COUNTER_INC(&pVM->pgm.s.StatR3DetectedConflicts);
+                    Log(("PGMHasMappingConflicts: Conflict was detected at %RGv for mapping %s (PAE)\n"
+                         "                        PDE=%016RX64.\n",
+                        GCPtr, pCur->pszDesc, Pde.u));
+#ifdef IN_RING3
+                    int rc = pgmR3SyncPTResolveConflictPAE(pVM, pCur, GCPtr);
+                    AssertRCReturn(rc, rc);
+
+                    /*
+                     * Update pCur.
+                     */
+                    pCur = pVM->pgm.s.CTX_SUFF(pMappings);
+                    while (pCur && pCur->GCPtr < GCPtr)
+                        pCur = pCur->CTX_SUFF(pNext);
+                    break;
+#else
+                    return VINF_PGM_SYNC_CR3;
+#endif
+                }
+                GCPtr += (1 << X86_PD_PAE_SHIFT);
+            }
+            if (!pCur) 
+                break;
+        }
+    }
+    else
+        AssertFailed();
+
+    return VINF_SUCCESS;
+}
+#endif /* IN_RING0 */
+
