Index: trunk/src/VBox/VMM/PGM.cpp
===================================================================
--- trunk/src/VBox/VMM/PGM.cpp	(revision 16904)
+++ trunk/src/VBox/VMM/PGM.cpp	(revision 16907)
@@ -1157,7 +1157,5 @@
     pVM->pgm.s.enmHostMode      = SUPPAGINGMODE_INVALID;
     pVM->pgm.s.GCPhysCR3        = NIL_RTGCPHYS;
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.GCPhysGstCR3Monitored = NIL_RTGCPHYS;
-#endif
     pVM->pgm.s.fA20Enabled      = true;
     pVM->pgm.s.GCPhys4MBPSEMask = RT_BIT_64(32) - 1; /* default; checked later */
@@ -3067,8 +3065,6 @@
     pVM->pgm.s.pfnR3GstModifyPage           = pModeData->pfnR3GstModifyPage;
     pVM->pgm.s.pfnR3GstGetPDE               = pModeData->pfnR3GstGetPDE;
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnR3GstMonitorCR3           = pModeData->pfnR3GstMonitorCR3;
     pVM->pgm.s.pfnR3GstUnmonitorCR3         = pModeData->pfnR3GstUnmonitorCR3;
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnR3GstWriteHandlerCR3      = pModeData->pfnR3GstWriteHandlerCR3;
@@ -3080,8 +3076,6 @@
     pVM->pgm.s.pfnRCGstModifyPage           = pModeData->pfnRCGstModifyPage;
     pVM->pgm.s.pfnRCGstGetPDE               = pModeData->pfnRCGstGetPDE;
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnRCGstMonitorCR3           = pModeData->pfnRCGstMonitorCR3;
     pVM->pgm.s.pfnRCGstUnmonitorCR3         = pModeData->pfnRCGstUnmonitorCR3;
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnRCGstWriteHandlerCR3      = pModeData->pfnRCGstWriteHandlerCR3;
@@ -3091,8 +3085,6 @@
     pVM->pgm.s.pfnR0GstModifyPage           = pModeData->pfnR0GstModifyPage;
     pVM->pgm.s.pfnR0GstGetPDE               = pModeData->pfnR0GstGetPDE;
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnR0GstMonitorCR3           = pModeData->pfnR0GstMonitorCR3;
     pVM->pgm.s.pfnR0GstUnmonitorCR3         = pModeData->pfnR0GstUnmonitorCR3;
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pVM->pgm.s.pfnR0GstWriteHandlerCR3      = pModeData->pfnR0GstWriteHandlerCR3;
Index: trunk/src/VBox/VMM/PGMGst.h
===================================================================
--- trunk/src/VBox/VMM/PGMGst.h	(revision 16904)
+++ trunk/src/VBox/VMM/PGMGst.h	(revision 16907)
@@ -119,8 +119,6 @@
 PGM_GST_DECL(int, ModifyPage)(PVM pVM, RTGCPTR GCPtr, size_t cb, uint64_t fFlags, uint64_t fMask);
 PGM_GST_DECL(int, GetPDE)(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPDE);
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
 PGM_GST_DECL(int, MonitorCR3)(PVM pVM, RTGCPHYS GCPhysCR3);
 PGM_GST_DECL(int, UnmonitorCR3)(PVM pVM);
-#endif
 __END_DECLS
 
@@ -145,8 +143,6 @@
     pModeData->pfnR3GstGetPage            = PGM_GST_NAME(GetPage);
     pModeData->pfnR3GstModifyPage         = PGM_GST_NAME(ModifyPage);
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     pModeData->pfnR3GstMonitorCR3         = PGM_GST_NAME(MonitorCR3);
     pModeData->pfnR3GstUnmonitorCR3       = PGM_GST_NAME(UnmonitorCR3);
-#endif
 
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
@@ -176,10 +172,8 @@
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(GetPDE),           &pModeData->pfnRCGstGetPDE);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(GetPDE), rc), rc);
-# ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(MonitorCR3),       &pModeData->pfnRCGstMonitorCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(MonitorCR3), rc), rc);
         rc = PDMR3LdrGetSymbolRC(pVM, NULL,       PGM_GST_NAME_RC_STR(UnmonitorCR3),     &pModeData->pfnRCGstUnmonitorCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_RC_STR(UnmonitorCR3), rc), rc);
-# endif
 # ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
 #  if PGM_GST_TYPE == PGM_TYPE_32BIT || PGM_GST_TYPE == PGM_TYPE_PAE
@@ -199,10 +193,8 @@
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(GetPDE),           &pModeData->pfnR0GstGetPDE);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(GetPDE), rc), rc);
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(MonitorCR3),       &pModeData->pfnR0GstMonitorCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(MonitorCR3), rc), rc);
         rc = PDMR3LdrGetSymbolR0(pVM, NULL,       PGM_GST_NAME_R0_STR(UnmonitorCR3),     &pModeData->pfnR0GstUnmonitorCR3);
         AssertMsgRCReturn(rc, ("%s -> rc=%Rrc\n", PGM_GST_NAME_R0_STR(UnmonitorCR3), rc), rc);
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
 # if PGM_GST_TYPE == PGM_TYPE_32BIT || PGM_GST_TYPE == PGM_TYPE_PAE
@@ -235,7 +227,7 @@
 #else
     int rc = PGM_BTH_NAME(MapCR3)(pVM, GCPhysCR3);
+#endif
     if (RT_SUCCESS(rc) && !pVM->pgm.s.fMappingsFixed)
         rc = PGM_GST_NAME(MonitorCR3)(pVM, GCPhysCR3);
-#endif
     return rc;
 }
@@ -266,9 +258,9 @@
     int rc;
 
-#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
-    rc = PGM_BTH_PFN(UnmapCR3, pVM)(pVM);
-#else
     rc = PGM_GST_NAME(UnmonitorCR3)(pVM);
     if (RT_SUCCESS(rc))
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+        rc = PGM_BTH_PFN(UnmapCR3, pVM)(pVM);
+#else
         rc = PGM_BTH_NAME(UnmapCR3)(pVM);
 #endif
Index: trunk/src/VBox/VMM/PGMInternal.h
===================================================================
--- trunk/src/VBox/VMM/PGMInternal.h	(revision 16904)
+++ trunk/src/VBox/VMM/PGMInternal.h	(revision 16907)
@@ -1635,5 +1635,4 @@
      * It's a hack required because of REMR3NotifyHandlerPhysicalDeregister. */
     bool volatile       fReusedFlushPending;
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     /** Used to indicate that the guest is mapping the page is also used as a CR3.
      * In these cases the access handler acts differently and will check
@@ -1643,5 +1642,4 @@
      */
     bool                fCR3Mix;
-#endif
 } PGMPOOLPAGE, *PPGMPOOLPAGE, **PPPGMPOOLPAGE;
 
@@ -2050,8 +2048,6 @@
     DECLR3CALLBACKMEMBER(int,       pfnR3GstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLR3CALLBACKMEMBER(int,       pfnR3GstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstUnmonitorCR3,(PVM pVM));
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     R3PTRTYPE(PFNPGMR3PHYSHANDLER)  pfnR3GstWriteHandlerCR3;
@@ -2063,8 +2059,6 @@
     DECLRCCALLBACKMEMBER(int,       pfnRCGstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLRCCALLBACKMEMBER(int,       pfnRCGstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstUnmonitorCR3,(PVM pVM));
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     RCPTRTYPE(PFNPGMRCPHYSHANDLER)  pfnRCGstWriteHandlerCR3;
@@ -2074,8 +2068,6 @@
     DECLR0CALLBACKMEMBER(int,       pfnR0GstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLR0CALLBACKMEMBER(int,       pfnR0GstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstUnmonitorCR3,(PVM pVM));
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     R0PTRTYPE(PFNPGMRCPHYSHANDLER)  pfnR0GstWriteHandlerCR3;
@@ -2177,9 +2169,7 @@
     uint32_t                        u32Alignment;
 #endif
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     /** The physical address of the currently monitored guest CR3 page.
      * When this value is NIL_RTGCPHYS no page is being monitored. */
     RTGCPHYS                        GCPhysGstCR3Monitored;
-#endif
     /** @name 32-bit Guest Paging.
      * @{ */
@@ -2345,8 +2335,6 @@
     DECLR3CALLBACKMEMBER(int,       pfnR3GstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLR3CALLBACKMEMBER(int,       pfnR3GstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR3CALLBACKMEMBER(int,       pfnR3GstUnmonitorCR3,(PVM pVM));
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     R3PTRTYPE(PFNPGMR3PHYSHANDLER)  pfnR3GstWriteHandlerCR3;
@@ -2358,8 +2346,6 @@
     DECLRCCALLBACKMEMBER(int,       pfnRCGstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLRCCALLBACKMEMBER(int,       pfnRCGstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLRCCALLBACKMEMBER(int,       pfnRCGstUnmonitorCR3,(PVM pVM));
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     RCPTRTYPE(PFNPGMRCPHYSHANDLER)  pfnRCGstWriteHandlerCR3;
@@ -2373,8 +2359,6 @@
     DECLR0CALLBACKMEMBER(int,       pfnR0GstModifyPage,(PVM pVM, RTGCPTR GCPtr, size_t cbPages, uint64_t fFlags, uint64_t fMask));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstGetPDE,(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPde));
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     DECLR0CALLBACKMEMBER(int,       pfnR0GstMonitorCR3,(PVM pVM, RTGCPHYS GCPhysCR3));
     DECLR0CALLBACKMEMBER(int,       pfnR0GstUnmonitorCR3,(PVM pVM));
-#endif
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
     R0PTRTYPE(PFNPGMRCPHYSHANDLER)  pfnR0GstWriteHandlerCR3;
@@ -2977,6 +2961,11 @@
 void            pgmPoolMonitorModifiedInsert(PPGMPOOL pPool, PPGMPOOLPAGE pPage);
 void            pgmPoolMonitorModifiedClearAll(PVM pVM);
+# ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+int             pgmPoolMonitorMonitorCR3(PPGMPOOL pPool, RTGCPHYS GCPhysCR3);
+int             pgmPoolMonitorUnmonitorCR3(PPGMPOOL pPool, RTGCPHYS GCPhysCR3);
+# else
 int             pgmPoolMonitorMonitorCR3(PPGMPOOL pPool, uint16_t idxRoot, RTGCPHYS GCPhysCR3);
 int             pgmPoolMonitorUnmonitorCR3(PPGMPOOL pPool, uint16_t idxRoot);
+# endif
 #endif
 
Index: trunk/src/VBox/VMM/PGMPool.cpp
===================================================================
--- trunk/src/VBox/VMM/PGMPool.cpp	(revision 16904)
+++ trunk/src/VBox/VMM/PGMPool.cpp	(revision 16907)
@@ -586,7 +586,5 @@
     }
     else if (    (   pPage->cModifications < 96 /* it's cheaper here. */
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
                   || pPage->fCR3Mix
-#endif
                   )
              &&  cbBuf <= 4)
Index: trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 16904)
+++ trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 16907)
@@ -719,8 +719,6 @@
         pVM->pgm.s.fSyncFlags &= ~PGM_SYNC_MONITOR_CR3;
         Assert(!pVM->pgm.s.fMappingsFixed);
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
         Assert(pVM->pgm.s.GCPhysCR3 == pVM->pgm.s.GCPhysGstCR3Monitored);
         rc = PGM_GST_PFN(MonitorCR3, pVM)(pVM, pVM->pgm.s.GCPhysCR3);
-#endif
     }
 
@@ -1641,7 +1639,5 @@
             {
                 pVM->pgm.s.fSyncFlags &= ~PGM_SYNC_MONITOR_CR3;
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
                 rc = PGM_GST_PFN(MonitorCR3, pVM)(pVM, GCPhysCR3);
-#endif
             }
         }
@@ -1670,7 +1666,5 @@
             pVM->pgm.s.fSyncFlags &= ~PGM_SYNC_MONITOR_CR3;
             Assert(!pVM->pgm.s.fMappingsFixed);
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
             rc = PGM_GST_PFN(MonitorCR3, pVM)(pVM, GCPhysCR3);
-#endif
         }
         if (fGlobal)
@@ -1848,8 +1842,6 @@
             pVM->pgm.s.fSyncFlags &= ~PGM_SYNC_MONITOR_CR3;
             Assert(!pVM->pgm.s.fMappingsFixed);
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
             Assert(pVM->pgm.s.GCPhysCR3 == pVM->pgm.s.GCPhysGstCR3Monitored);
             rc = PGM_GST_PFN(MonitorCR3, pVM)(pVM, pVM->pgm.s.GCPhysCR3);
-#endif
         }
     }
Index: trunk/src/VBox/VMM/VMMAll/PGMAllGst.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllGst.h	(revision 16904)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllGst.h	(revision 16907)
@@ -129,8 +129,6 @@
 PGM_GST_DECL(int, ModifyPage)(PVM pVM, RTGCPTR GCPtr, size_t cb, uint64_t fFlags, uint64_t fMask);
 PGM_GST_DECL(int, GetPDE)(PVM pVM, RTGCPTR GCPtr, PX86PDEPAE pPDE);
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
 PGM_GST_DECL(int, MonitorCR3)(PVM pVM, RTGCPHYS GCPhysCR3);
 PGM_GST_DECL(int, UnmonitorCR3)(PVM pVM);
-#endif
 PGM_GST_DECL(bool, HandlerVirtualUpdate)(PVM pVM, uint32_t cr4);
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
@@ -414,6 +412,4 @@
 
 
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
-
 #undef LOG_GROUP
 #define LOG_GROUP LOG_GROUP_PGM_POOL
@@ -438,4 +434,57 @@
      * Register/Modify write phys handler for guest's CR3 if it changed.
      */
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+
+    if (pVM->pgm.s.GCPhysGstCR3Monitored != GCPhysCR3)
+    {
+        rc = pgmPoolMonitorMonitorCR3(pVM->pgm.s.CTX_SUFF(pPool), GCPhysCR3);
+        if (RT_FAILURE(rc))
+        {
+            AssertMsgFailed(("PGMHandlerPhysicalModify/PGMR3HandlerPhysicalRegister failed, rc=%Rrc GCPhysGstCR3Monitored=%RGp GCPhysCR3=%RGp\n",
+                             rc, pVM->pgm.s.GCPhysGstCR3Monitored, GCPhysCR3));
+            return rc;
+        }
+        pVM->pgm.s.GCPhysGstCR3Monitored = GCPhysCR3;
+    }
+
+#if PGM_GST_TYPE == PGM_TYPE_PAE
+    /*
+     * Do the 4 PDs.
+     */
+    PX86PDPT pGuestPDPT = pgmGstGetPaePDPTPtr(&pVM->pgm.s);
+    for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++)
+    {
+        if (pGuestPDPT->a[i].n.u1Present)
+        {
+            RTGCPHYS GCPhys = pGuestPDPT->a[i].u & X86_PDPE_PG_MASK;
+            if (pVM->pgm.s.aGCPhysGstPaePDsMonitored[i] != GCPhys)
+            {
+                Assert(pVM->pgm.s.enmShadowMode == PGMMODE_PAE || pVM->pgm.s.enmShadowMode == PGMMODE_PAE_NX);
+
+                rc = pgmPoolMonitorMonitorCR3(pVM->pgm.s.CTX_SUFF(pPool), GCPhys);
+            }
+
+            if (RT_FAILURE(rc))
+            {
+                AssertMsgFailed(("PGMHandlerPhysicalModify/PGMR3HandlerPhysicalRegister failed, rc=%Rrc GCPhysGstCR3Monitored=%RGp GCPhysCR3=%RGp\n",
+                                 rc, pVM->pgm.s.aGCPhysGstPaePDsMonitored[i], GCPhys));
+                return rc;
+            }
+            pVM->pgm.s.aGCPhysGstPaePDsMonitored[i] = GCPhys;
+        }
+        else if (pVM->pgm.s.aGCPhysGstPaePDsMonitored[i] != NIL_RTGCPHYS)
+        {
+            rc = pgmPoolMonitorUnmonitorCR3(pVM->pgm.s.CTX_SUFF(pPool), pVM->pgm.s.aGCPhysGstPaePDsMonitored[i]);
+            AssertRC(rc);
+            pVM->pgm.s.aGCPhysGstPaePDsMonitored[i] = NIL_RTGCPHYS;
+        }
+    }
+
+#else
+    /* prot/real/amd64 mode stub */
+
+#endif
+
+#else
 #if PGM_GST_TYPE == PGM_TYPE_32BIT
 
@@ -525,4 +574,5 @@
 
 #endif
+#endif /* VBOX_WITH_PGMPOOL_PAGING_ONLY */
     return rc;
 }
@@ -544,4 +594,34 @@
      * before we enter GC again.
      */
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+
+    /* Unmonitor the root. (pd or pdpt) */
+    if (pVM->pgm.s.GCPhysGstCR3Monitored != NIL_RTGCPHYS)
+    {
+        rc = pgmPoolMonitorUnmonitorCR3(pVM->pgm.s.CTX_SUFF(pPool), pVM->pgm.s.GCPhysGstCR3Monitored);
+        AssertRCReturn(rc, rc);
+        pVM->pgm.s.GCPhysGstCR3Monitored = NIL_RTGCPHYS;
+    }
+
+#if PGM_GST_TYPE == PGM_TYPE_PAE
+    /* The 4 PDs. */
+    for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++)
+    {
+        if (pVM->pgm.s.aGCPhysGstPaePDsMonitored[i] != NIL_RTGCPHYS)
+        {
+            Assert(pVM->pgm.s.enmShadowMode == PGMMODE_PAE || pVM->pgm.s.enmShadowMode == PGMMODE_PAE_NX);
+            int rc2 = pgmPoolMonitorUnmonitorCR3(pVM->pgm.s.CTX_SUFF(pPool), pVM->pgm.s.aGCPhysGstPaePDsMonitored[i]);
+            AssertRC(rc2);
+            if (RT_FAILURE(rc2))
+                rc = rc2;
+            pVM->pgm.s.aGCPhysGstPaePDsMonitored[i] = NIL_RTGCPHYS;
+        }
+    }
+#else
+    /* prot/real/amd64 mode stub */
+#endif
+
+#else
+
 #if PGM_GST_TYPE == PGM_TYPE_32BIT
     if (pVM->pgm.s.GCPhysGstCR3Monitored != NIL_RTGCPHYS)
@@ -589,4 +669,5 @@
     /* prot/real/amd64 mode stub */
 #endif
+#endif /* VBOX_WITH_PGMPOOL_PAGING_ONLY */
     return rc;
 
@@ -595,6 +676,4 @@
 #undef LOG_GROUP
 #define LOG_GROUP LOG_GROUP_PGM
-
-#endif /* VBOX_WITH_PGMPOOL_PAGING_ONLY */
 
 
Index: trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 16904)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 16907)
@@ -1235,7 +1235,5 @@
     bool fReused = false;
     if (    (   pPage->cModifications < 48   /** @todo #define */ /** @todo need to check that it's not mapping EIP. */ /** @todo adjust this! */
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
              || pPage->fCR3Mix
-#endif
             )
         &&  !(fReused = pgmPoolMonitorIsReused(pVM, pPage, pRegFrame, &Cpu, pvFault))
@@ -1947,7 +1945,5 @@
             PPGMPOOLPAGE pNewHead = &pPool->aPages[pPage->iMonitoredNext];
             pNewHead->iMonitoredPrev = NIL_PGMPOOL_IDX;
-#ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
             pNewHead->fCR3Mix = pPage->fCR3Mix;
-#endif
             rc = PGMHandlerPhysicalChangeCallbacks(pVM, pPage->GCPhys & ~(RTGCPHYS)(PAGE_SIZE - 1),
                                                    pPool->pfnAccessHandlerR3, MMHyperCCToR3(pVM, pNewHead),
@@ -2031,4 +2027,10 @@
  * @param   GCPhysCR3   The (new) CR3 value.
  */
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+int pgmPoolMonitorMonitorCR3(PPGMPOOL pPool, RTGCPHYS GCPhysCR3)
+{
+    return VINF_SUCCESS;
+}
+#else
 int pgmPoolMonitorMonitorCR3(PPGMPOOL pPool, uint16_t idxRoot, RTGCPHYS GCPhysCR3)
 {
@@ -2077,4 +2079,5 @@
     return rc;
 }
+#endif /* VBOX_WITH_PGMPOOL_PAGING_ONLY */
 
 
@@ -2086,4 +2089,10 @@
  * @param   idxRoot     The CR3 (root) page index.
  */
+#ifdef VBOX_WITH_PGMPOOL_PAGING_ONLY
+int pgmPoolMonitorUnmonitorCR3(PPGMPOOL pPool, RTGCPHYS GCPhysCR3)
+{
+    return VINF_SUCCESS;
+}
+#else
 int pgmPoolMonitorUnmonitorCR3(PPGMPOOL pPool, uint16_t idxRoot)
 {
@@ -2107,4 +2116,5 @@
     return rc;
 }
+#endif /* VBOX_WITH_PGMPOOL_PAGING_ONLY */
 
 # endif /* PGMPOOL_WITH_MIXED_PT_CR3 */
@@ -4115,8 +4125,7 @@
         pPage->fCached   = false;
         pPage->fReusedFlushPending = false;
+        pPage->fCR3Mix = false;
 #ifdef PGMPOOL_WITH_USER_TRACKING
         pPage->iUserHead = NIL_PGMPOOL_USER_INDEX;
-#else
-        pPage->fCR3Mix = false;
 #endif
 #ifdef PGMPOOL_WITH_CACHE
@@ -4502,10 +4511,9 @@
     pPage->fCached = false;
     pPage->fReusedFlushPending = false;
+    pPage->fCR3Mix = false;
 #ifdef PGMPOOL_WITH_MONITORING
     pPage->cModifications = 0;
     pPage->iModifiedNext = NIL_PGMPOOL_IDX;
     pPage->iModifiedPrev = NIL_PGMPOOL_IDX;
-#else
-    pPage->fCR3Mix = false;
 #endif
 #ifdef PGMPOOL_WITH_USER_TRACKING
