Index: trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 86471)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 86472)
@@ -21,4 +21,5 @@
 *********************************************************************************************************************************/
 #define LOG_GROUP LOG_GROUP_PGM_POOL
+#define VBOX_WITHOUT_PAGING_BIT_FIELDS /* 64-bit bitfields are just asking for trouble. See @bugref{9841} and others. */
 #include <VBox/vmm/pgm.h>
 #include <VBox/vmm/mm.h>
@@ -444,11 +445,9 @@
                 if (iShw < X86_PG_PAE_PDPE_ENTRIES)          /* don't use RT_ELEMENTS(uShw.pPDPT->a), because that's for long mode only */
                 {
-                    if (uShw.pPDPT->a[iShw].n.u1Present)
+                    X86PGPAEUINT const uPdpe = uShw.pPDPT->a[iShw].u;
+                    if (uPdpe & X86_PDPE_P)
                     {
                         LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
-                        pgmPoolFree(pVM,
-                                    uShw.pPDPT->a[iShw].u & X86_PDPE_PG_MASK,
-                                    pPage->idx,
-                                    iShw);
+                        pgmPoolFree(pVM, uPdpe & X86_PDPE_PG_MASK, pPage->idx, iShw);
                         ASMAtomicWriteU64(&uShw.pPDPT->a[iShw].u, 0);
                     }
@@ -462,11 +461,9 @@
                             &&  iShw2 < X86_PG_PAE_PDPE_ENTRIES)
                         {
-                            if (uShw.pPDPT->a[iShw2].n.u1Present)
+                            X86PGPAEUINT const uPdpe2 = uShw.pPDPT->a[iShw2].u;
+                            if (uPdpe2 & X86_PDPE_P)
                             {
                                 LogFlow(("pgmPoolMonitorChainChanging: pae pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
-                                pgmPoolFree(pVM,
-                                            uShw.pPDPT->a[iShw2].u & X86_PDPE_PG_MASK,
-                                            pPage->idx,
-                                            iShw2);
+                                pgmPoolFree(pVM, uPdpe2 & X86_PDPE_PG_MASK, pPage->idx, iShw2);
                                 ASMAtomicWriteU64(&uShw.pPDPT->a[iShw2].u, 0);
                             }
@@ -526,8 +523,9 @@
                 uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
                 const unsigned iShw = off / sizeof(X86PDPE);
-                if (uShw.pPDPT->a[iShw].n.u1Present)
+                X86PGPAEUINT const uPdpe = uShw.pPDPT->a[iShw].u;
+                if (uPdpe & X86_PDPE_P)
                 {
-                    LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPDPT->a[iShw].u));
-                    pgmPoolFree(pVM, uShw.pPDPT->a[iShw].u & X86_PDPE_PG_MASK, pPage->idx, iShw);
+                    LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw=%#x: %RX64 -> freeing it!\n", iShw, uPdpe));
+                    pgmPoolFree(pVM, uPdpe & X86_PDPE_PG_MASK, pPage->idx, iShw);
                     ASMAtomicWriteU64(&uShw.pPDPT->a[iShw].u, 0);
                 }
@@ -537,8 +535,9 @@
                 {
                     const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PDPE);
-                    if (uShw.pPDPT->a[iShw2].n.u1Present)
+                    X86PGPAEUINT const uPdpe2 = uShw.pPDPT->a[iShw2].u;
+                    if (uPdpe2 & X86_PDPE_P)
                     {
-                        LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPDPT->a[iShw2].u));
-                        pgmPoolFree(pVM, uShw.pPDPT->a[iShw2].u & X86_PDPE_PG_MASK, pPage->idx, iShw2);
+                        LogFlow(("pgmPoolMonitorChainChanging: pdpt iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uPdpe2));
+                        pgmPoolFree(pVM, uPdpe2 & X86_PDPE_PG_MASK, pPage->idx, iShw2);
                         ASMAtomicWriteU64(&uShw.pPDPT->a[iShw2].u, 0);
                     }
@@ -556,8 +555,9 @@
                 uShw.pv = PGMPOOL_PAGE_2_PTR(pVM, pPage);
                 const unsigned iShw = off / sizeof(X86PDPE);
-                if (uShw.pPML4->a[iShw].n.u1Present)
+                X86PGPAEUINT const uPml4e = uShw.pPML4->a[iShw].u;
+                if (uPml4e & X86_PML4E_P)
                 {
-                    LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw=%#x: %RX64 -> freeing it!\n", iShw, uShw.pPML4->a[iShw].u));
-                    pgmPoolFree(pVM, uShw.pPML4->a[iShw].u & X86_PML4E_PG_MASK, pPage->idx, iShw);
+                    LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw=%#x: %RX64 -> freeing it!\n", iShw, uPml4e));
+                    pgmPoolFree(pVM, uPml4e & X86_PML4E_PG_MASK, pPage->idx, iShw);
                     ASMAtomicWriteU64(&uShw.pPML4->a[iShw].u, 0);
                 }
@@ -567,8 +567,9 @@
                 {
                     const unsigned iShw2 = (off + cbWrite - 1) / sizeof(X86PML4E);
-                    if (uShw.pPML4->a[iShw2].n.u1Present)
+                    X86PGPAEUINT const uPml4e2 = uShw.pPML4->a[iShw2].u;
+                    if (uPml4e2 & X86_PML4E_P)
                     {
-                        LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uShw.pPML4->a[iShw2].u));
-                        pgmPoolFree(pVM, uShw.pPML4->a[iShw2].u & X86_PML4E_PG_MASK, pPage->idx, iShw2);
+                        LogFlow(("pgmPoolMonitorChainChanging: pml4 iShw2=%#x: %RX64 -> freeing it!\n", iShw2, uPml4e2));
+                        pgmPoolFree(pVM, uPml4e2 & X86_PML4E_PG_MASK, pPage->idx, iShw2);
                         ASMAtomicWriteU64(&uShw.pPML4->a[iShw2].u, 0);
                     }
@@ -3631,6 +3632,5 @@
      * This is simple but not quite optimal solution.
      */
-    const uint64_t  u64   = PGM_PAGE_GET_HCPHYS(pPhysPage) | X86_PTE_P;   /** @todo drop X86_PTE_P here as we always test if present separately, anyway. */
-    const uint32_t  u32   = u64;                                          /** @todo move into the 32BIT_PT_xx case */
+    const uint64_t  u64   = PGM_PAGE_GET_HCPHYS(pPhysPage);
     unsigned        cLeft = pPool->cUsedPages;
     unsigned        iPage = pPool->cCurPages;
@@ -3650,10 +3650,11 @@
                 case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
                 {
-                    unsigned    cPresent = pPage->cPresent;
-                    PX86PT      pPT = (PX86PT)PGMPOOL_PAGE_2_PTR(pVM, pPage);
+                    const uint32_t  u32      = (uint32_t)u64;
+                    unsigned        cPresent = pPage->cPresent;
+                    PX86PT          pPT      = (PX86PT)PGMPOOL_PAGE_2_PTR(pVM, pPage);
                     for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pPT->a); i++)
                         if (pPT->a[i].n.u1Present)
                         {
-                            if ((pPT->a[i].u & (X86_PTE_PG_MASK | X86_PTE_P)) == u32)
+                            if ((pPT->a[i].u & X86_PTE_PG_MASK) == u32)
                             {
                                 //Log4(("pgmPoolTrackFlushGCPhysPTsSlow: idx=%d i=%d pte=%RX32\n", iPage, i, pPT->a[i]));
@@ -3684,5 +3685,5 @@
                         if (PGMSHWPTEPAE_IS_P(pPT->a[i]))
                         {
-                            if ((PGMSHWPTEPAE_GET_U(pPT->a[i]) & (X86_PTE_PAE_PG_MASK | X86_PTE_P)) == u64)
+                            if ((PGMSHWPTEPAE_GET_U(pPT->a[i]) & X86_PTE_PAE_PG_MASK) == u64)
                             {
                                 //Log4(("pgmPoolTrackFlushGCPhysPTsSlow: idx=%d i=%d pte=%RX64\n", iPage, i, pPT->a[i]));
@@ -3707,7 +3708,9 @@
                     PEPTPT    pPT = (PEPTPT)PGMPOOL_PAGE_2_PTR(pVM, pPage);
                     for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pPT->a); i++)
-                        if (pPT->a[i].n.u1Present)
+                    {
+                        X86PGPAEUINT const uPte = pPT->a[i].u;
+                        if (uPte & EPT_E_READ)
                         {
-                            if ((pPT->a[i].u & (EPT_PTE_PG_MASK | X86_PTE_P)) == u64)
+                            if ((uPte & EPT_PTE_PG_MASK) == u64)
                             {
                                 //Log4(("pgmPoolTrackFlushGCPhysPTsSlow: idx=%d i=%d pte=%RX64\n", iPage, i, pPT->a[i]));
@@ -3723,4 +3726,5 @@
                                 break;
                         }
+                    }
                     PGM_DYNMAP_UNUSED_HINT_VM(pVM, pPT);
                     break;
@@ -4466,10 +4470,11 @@
     for (unsigned i = pPage->iFirstPresent; i < RT_ELEMENTS(pShwPT->a); i++, GCPhys += PAGE_SIZE)
     {
-        Assert((pShwPT->a[i].u & UINT64_C(0xfff0000000000f80)) == 0);
-        if (pShwPT->a[i].n.u1Present)
+        X86PGPAEUINT const uPte = pShwPT->a[i].u;
+        Assert((uPte & UINT64_C(0xfff0000000000f80)) == 0);
+        if (uPte & EPT_E_READ)
         {
             Log4(("pgmPoolTrackDerefPTEPT: i=%d pte=%RX64 GCPhys=%RX64\n",
-                  i, pShwPT->a[i].u & EPT_PTE_PG_MASK, pPage->GCPhys));
-            pgmPoolTracDerefGCPhys(pPool, pPage, pShwPT->a[i].u & EPT_PTE_PG_MASK, GCPhys & GCPhysA20Mask, i);
+                  i, uPte & EPT_PTE_PG_MASK, pPage->GCPhys));
+            pgmPoolTracDerefGCPhys(pPool, pPage, uPte & EPT_PTE_PG_MASK, GCPhys & GCPhysA20Mask, i);
             if (!pPage->cPresent)
                 break;
@@ -4559,16 +4564,17 @@
     for (unsigned i = 0; i < X86_PG_PAE_PDPE_ENTRIES; i++)
     {
-        Assert((pShwPDPT->a[i].u & (X86_PDPE_PAE_MBZ_MASK | UINT64_C(0x7ff0000000000200))) == 0);
-        if (    pShwPDPT->a[i].n.u1Present
+        X86PGPAEUINT const uPdpe = pShwPDPT->a[i].u;
+        Assert((uPdpe & (X86_PDPE_PAE_MBZ_MASK | UINT64_C(0x7ff0000000000200))) == 0);
+        if (    uPdpe & X86_PDPE_P
 #ifndef PGM_WITHOUT_MAPPINGS
-            &&  !(pShwPDPT->a[i].u & PGM_PLXFLAGS_MAPPING)
+            &&  !(uPdpe & PGM_PLXFLAGS_MAPPING)
 #endif
            )
         {
-            PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
+            PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, uPdpe & X86_PDPE_PG_MASK);
             if (pSubPage)
                 pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
             else
-                AssertFatalMsgFailed(("%RX64\n", pShwPDPT->a[i].u & X86_PDPE_PG_MASK));
+                AssertFatalMsgFailed(("%RX64\n", uPdpe & X86_PDPE_PG_MASK));
         }
     }
@@ -4587,12 +4593,13 @@
     for (unsigned i = 0; i < RT_ELEMENTS(pShwPDPT->a); i++)
     {
-        Assert((pShwPDPT->a[i].u & (X86_PDPE_LM_MBZ_MASK_NX | UINT64_C(0x7ff0000000000200))) == 0);
-        if (pShwPDPT->a[i].n.u1Present)
-        {
-            PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & X86_PDPE_PG_MASK);
+        X86PGPAEUINT const uPdpe = pShwPDPT->a[i].u;
+        Assert((uPdpe & (X86_PDPE_LM_MBZ_MASK_NX | UINT64_C(0x7ff0000000000200))) == 0);
+        if (uPdpe & X86_PDPE_P)
+        {
+            PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, uPdpe & X86_PDPE_PG_MASK);
             if (pSubPage)
                 pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
             else
-                AssertFatalMsgFailed(("%RX64\n", pShwPDPT->a[i].u & X86_PDPE_PG_MASK));
+                AssertFatalMsgFailed(("%RX64\n", uPdpe & X86_PDPE_PG_MASK));
             /** @todo 64-bit guests: have to ensure that we're not exhausting the dynamic mappings! */
         }
@@ -4612,12 +4619,13 @@
     for (unsigned i = 0; i < RT_ELEMENTS(pShwPML4->a); i++)
     {
-        Assert((pShwPML4->a[i].u & (X86_PML4E_MBZ_MASK_NX | UINT64_C(0x7ff0000000000200))) == 0);
-        if (pShwPML4->a[i].n.u1Present)
-        {
-            PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPML4->a[i].u & X86_PDPE_PG_MASK);
+        X86PGPAEUINT const uPml4e = pShwPML4->a[i].u;
+        Assert((uPml4e & (X86_PML4E_MBZ_MASK_NX | UINT64_C(0x7ff0000000000200))) == 0);
+        if (uPml4e & X86_PML4E_P)
+        {
+            PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, uPml4e & X86_PDPE_PG_MASK);
             if (pSubPage)
                 pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
             else
-                AssertFatalMsgFailed(("%RX64\n", pShwPML4->a[i].u & X86_PML4E_PG_MASK));
+                AssertFatalMsgFailed(("%RX64\n", uPml4e & X86_PML4E_PG_MASK));
             /** @todo 64-bit guests: have to ensure that we're not exhausting the dynamic mappings! */
         }
@@ -4637,13 +4645,14 @@
     for (unsigned i = 0; i < RT_ELEMENTS(pShwPD->a); i++)
     {
-        Assert((pShwPD->a[i].u & UINT64_C(0xfff0000000000f80)) == 0);
-        if (pShwPD->a[i].n.u1Present)
+        X86PGPAEUINT const uPde = pShwPD->a[i].u;
+        Assert((uPde & UINT64_C(0xfff0000000000f80)) == 0);
+        if (uPde & EPT_E_READ)
         {
 #ifdef PGM_WITH_LARGE_PAGES
-            if (pShwPD->a[i].b.u1Size)
+            if (uPde & EPT_E_LEAF)
             {
                 Log4(("pgmPoolTrackDerefPDEPT: i=%d pde=%RX64 GCPhys=%RX64\n",
-                      i, pShwPD->a[i].u & X86_PDE2M_PAE_PG_MASK, pPage->GCPhys));
-                pgmPoolTracDerefGCPhys(pPool, pPage, pShwPD->a[i].u & X86_PDE2M_PAE_PG_MASK,
+                      i, uPde & EPT_PDE2M_PG_MASK, pPage->GCPhys));
+                pgmPoolTracDerefGCPhys(pPool, pPage, uPde & EPT_PDE2M_PG_MASK,
                                        pPage->GCPhys + i * 2 * _1M /* pPage->GCPhys = base address of the memory described by the PD */,
                                        i);
@@ -4652,5 +4661,5 @@
 #endif
             {
-                PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPD->a[i].u & EPT_PDE_PG_MASK);
+                PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, uPde & EPT_PDE_PG_MASK);
                 if (pSubPage)
                     pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
@@ -4675,12 +4684,13 @@
     for (unsigned i = 0; i < RT_ELEMENTS(pShwPDPT->a); i++)
     {
-        Assert((pShwPDPT->a[i].u & UINT64_C(0xfff0000000000f80)) == 0);
-        if (pShwPDPT->a[i].n.u1Present)
-        {
-            PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, pShwPDPT->a[i].u & EPT_PDPTE_PG_MASK);
+        X86PGPAEUINT const uPdpe = pShwPDPT->a[i].u;
+        Assert((uPdpe & UINT64_C(0xfff0000000000f80)) == 0);
+        if (uPdpe & EPT_E_READ)
+        {
+            PPGMPOOLPAGE pSubPage = (PPGMPOOLPAGE)RTAvloHCPhysGet(&pPool->HCPhysTree, uPdpe & EPT_PDPTE_PG_MASK);
             if (pSubPage)
                 pgmPoolTrackFreeUser(pPool, pSubPage, pPage->idx, i);
             else
-                AssertFatalMsgFailed(("%RX64\n", pShwPDPT->a[i].u & EPT_PDPTE_PG_MASK));
+                AssertFatalMsgFailed(("%RX64\n", uPdpe & EPT_PDPTE_PG_MASK));
             /** @todo 64-bit guests: have to ensure that we're not exhausting the dynamic mappings! */
         }
Index: trunk/src/VBox/VMM/VMMR3/PGMPool.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/PGMPool.cpp	(revision 86471)
+++ trunk/src/VBox/VMM/VMMR3/PGMPool.cpp	(revision 86472)
@@ -97,4 +97,5 @@
 *********************************************************************************************************************************/
 #define LOG_GROUP LOG_GROUP_PGM_POOL
+#define VBOX_WITHOUT_PAGING_BIT_FIELDS /* 64-bit bitfields are just asking for trouble. See @bugref{9841} and others. */
 #include <VBox/vmm/pgm.h>
 #include <VBox/vmm/mm.h>
@@ -563,6 +564,5 @@
                         {
                             Assert((pShwPD->a[i].u & UINT64_C(0xfff0000000000f80)) == 0);
-                            if (    pShwPD->a[i].n.u1Present
-                                &&  pShwPD->a[i].b.u1Size)
+                            if ((pShwPD->a[i].u & (EPT_E_READ | EPT_E_LEAF)) == (EPT_E_READ | EPT_E_LEAF))
                             {
 # ifndef PGM_WITHOUT_MAPPINGS
@@ -815,6 +815,6 @@
                     for (unsigned iShw = 0; iShw < RT_ELEMENTS(uShw.pPTEpt->a); iShw++)
                     {
-                        if (uShw.pPTEpt->a[iShw].n.u1Present)
-                            uShw.pPTEpt->a[iShw].n.u1Write = 0;
+                        if (uShw.pPTEpt->a[iShw].u & EPT_E_READ)
+                            uShw.pPTEpt->a[iShw].u &= ~(X86PGPAEUINT)EPT_E_WRITE;
                     }
                     break;
