Index: /trunk/src/VBox/VMM/PATM/PATM.cpp
===================================================================
--- /trunk/src/VBox/VMM/PATM/PATM.cpp	(revision 92)
+++ /trunk/src/VBox/VMM/PATM/PATM.cpp	(revision 93)
@@ -1125,10 +1125,10 @@
     PRECPATCHTOGUEST pPatchToGuestRec;
     PRECGUESTTOPATCH pGuestToPatchRec;
-    RTGCUINTPTR PatchOffset = pPatchInstrHC - pVM->patm.s.pPatchMemHC;  /* Offset in memory reserved for PATM. */
+    uint32_t PatchOffset = pPatchInstrHC - pVM->patm.s.pPatchMemHC;  /* Offset in memory reserved for PATM. */
 
     if (enmType == PATM_LOOKUP_PATCH2GUEST)
     {
-        pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGet(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)PatchOffset);
-        if (pPatchToGuestRec && pPatchToGuestRec->Core.Key == (AVLPVKEY)PatchOffset)
+        pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32Get(&pPatch->Patch2GuestAddrTree, PatchOffset);
+        if (pPatchToGuestRec && pPatchToGuestRec->Core.Key == PatchOffset)
             return; /* already there */
 
@@ -1138,5 +1138,5 @@
     else
     {
-        pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGet(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)PatchOffset);
+        pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32Get(&pPatch->Patch2GuestAddrTree, PatchOffset);
         Assert(!pPatchToGuestRec);
     }
@@ -1145,10 +1145,10 @@
     pPatchToGuestRec = (PRECPATCHTOGUEST)MMR3HeapAllocZ(pVM, MM_TAG_PATM_PATCH, sizeof(RECPATCHTOGUEST) + sizeof(RECGUESTTOPATCH));
     Assert(pPatchToGuestRec);
-    pPatchToGuestRec->Core.Key    = (AVLPVKEY)PatchOffset;
+    pPatchToGuestRec->Core.Key    = PatchOffset;
     pPatchToGuestRec->pOrgInstrGC = pInstrGC;
     pPatchToGuestRec->enmType     = enmType;
     pPatchToGuestRec->fDirty      = fDirty;
 
-    ret = RTAvlPVInsert(&pPatch->Patch2GuestAddrTree, &pPatchToGuestRec->Core);
+    ret = RTAvlU32Insert(&pPatch->Patch2GuestAddrTree, &pPatchToGuestRec->Core);
     Assert(ret);
 
@@ -1156,5 +1156,5 @@
     if (enmType == PATM_LOOKUP_BOTHDIR)
     {
-        pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlPVGet(&pPatch->Guest2PatchAddrTree, (AVLPVKEY)PatchOffset);
+        pGuestToPatchRec = (PRECGUESTTOPATCH)RTAvlPVGet(&pPatch->Guest2PatchAddrTree, (AVLPVKEY)PatchOffset); /** @todo bird: this doesn't look right. check it out later. */
         if (!pGuestToPatchRec)
         {
@@ -1181,9 +1181,10 @@
 void patmr3RemoveP2GLookupRecord(PVM pVM, PPATCHINFO pPatch, RTGCPTR pPatchInstrGC)
 {
-    PAVLPVNODECORE   pNode;
+    PAVLU32NODECORE  pNode;
+    PAVLPVNODECORE   pNode2;
     PRECPATCHTOGUEST pPatchToGuestRec;
-    RTGCUINTPTR      PatchOffset = pPatchInstrGC - pVM->patm.s.pPatchMemGC;  /* Offset in memory reserved for PATM. */
-
-    pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGet(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)PatchOffset);
+    uint32_t         PatchOffset = pPatchInstrGC - pVM->patm.s.pPatchMemGC;  /* Offset in memory reserved for PATM. */
+
+    pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32Get(&pPatch->Patch2GuestAddrTree, PatchOffset);
     Assert(pPatchToGuestRec);
     if (pPatchToGuestRec)
@@ -1194,8 +1195,8 @@
 
             Assert(pGuestToPatchRec->Core.Key);
-            pNode = RTAvlPVRemove(&pPatch->Guest2PatchAddrTree, pGuestToPatchRec->Core.Key);
-            Assert(pNode);
-        }
-        pNode = RTAvlPVRemove(&pPatch->Patch2GuestAddrTree, pPatchToGuestRec->Core.Key);
+            pNode2 = RTAvlPVRemove(&pPatch->Guest2PatchAddrTree, pGuestToPatchRec->Core.Key);
+            Assert(pNode2);
+        }
+        pNode = RTAvlU32Remove(&pPatch->Patch2GuestAddrTree, pPatchToGuestRec->Core.Key);
         Assert(pNode);
 
@@ -1206,5 +1207,15 @@
 
 
-/* Empty the specified tree (PV tree, MMR3 heap)
+/**
+ * RTAvlPVDestroy callback.
+ */
+static DECLCALLBACK(int) patmEmptyTreePVCallback(PAVLPVNODECORE pNode, void *)
+{
+    MMR3HeapFree(pNode);
+    return 0;
+}
+
+/**
+ * Empty the specified tree (PV tree, MMR3 heap)
  *
  * @param   pVM             The VM to operate on.
@@ -1213,20 +1224,26 @@
 void patmEmptyTree(PVM pVM, PAVLPVNODECORE *ppTree)
 {
-    PAVLPVNODECORE pRec;
-
-    if (*ppTree == 0)
-        return;
-
-    while (true)
-    {
-        pRec = RTAvlPVRemoveBestFit(ppTree, 0, true);
-        if (pRec)
-        {
-            MMR3HeapFree(pRec);
-        }
-        else
-            break;
-    }
-    Assert(*ppTree == 0);
+    RTAvlPVDestroy(ppTree, patmEmptyTreePVCallback, NULL);
+}
+
+
+/**
+ * RTAvlU32Destroy callback.
+ */
+static DECLCALLBACK(int) patmEmptyTreeU32Callback(PAVLU32NODECORE pNode, void *)
+{
+    MMR3HeapFree(pNode);
+    return 0;
+}
+
+/**
+ * Empty the specified tree (U32 tree, MMR3 heap)
+ *
+ * @param   pVM             The VM to operate on.
+ * @param   ppTree          Tree to empty
+ */
+void patmEmptyTreeU32(PVM pVM, PPAVLU32NODECORE ppTree)
+{
+    RTAvlU32Destroy(ppTree, patmEmptyTreeU32Callback, NULL);
 }
 
@@ -4243,5 +4260,5 @@
         if (pPatchRec && pPatchRec->patch.nrPatch2GuestRecs)
         {
-            patmEmptyTree(pVM, &pPatchRec->patch.Patch2GuestAddrTree);
+            patmEmptyTreeU32(pVM, &pPatchRec->patch.Patch2GuestAddrTree);
             pPatchRec->patch.nrPatch2GuestRecs = 0;
         }
@@ -4644,9 +4661,9 @@
                         if (pPatchInstrGC)
                         {
-                            RTGCUINTPTR PatchOffset = pPatchInstrGC - pVM->patm.s.pPatchMemGC;  /* Offset in memory reserved for PATM. */
+                            uint32_t PatchOffset = pPatchInstrGC - pVM->patm.s.pPatchMemGC;  /* Offset in memory reserved for PATM. */
 
                             fValidPatchWrite = true;
 
-                            PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGet(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)PatchOffset);
+                            PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32Get(&pPatch->Patch2GuestAddrTree, PatchOffset);
                             Assert(pPatchToGuestRec);
                             if (pPatchToGuestRec && !pPatchToGuestRec->fDirty)
@@ -5234,5 +5251,5 @@
 
     /** @note no need to free Guest2PatchAddrTree as those records share memory with Patch2GuestAddrTree records. */
-    patmEmptyTree(pVM, &pPatch->Patch2GuestAddrTree);
+    patmEmptyTreeU32(pVM, &pPatch->Patch2GuestAddrTree);
     pPatch->nrPatch2GuestRecs = 0;
     Assert(pPatch->Patch2GuestAddrTree == 0);
@@ -5399,5 +5416,5 @@
     Assert(pPatch->Patch2GuestAddrTree);
     /* Get the closest record from below. */
-    PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGetBestFit(&pPatch->Patch2GuestAddrTree, (AVLPVKEY)(pPatchGC - pVM->patm.s.pPatchMemGC), false);
+    PRECPATCHTOGUEST pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32GetBestFit(&pPatch->Patch2GuestAddrTree, pPatchGC - pVM->patm.s.pPatchMemGC, false);
     if (pPatchToGuestRec)
         return pPatchToGuestRec->pOrgInstrGC;
@@ -5601,5 +5618,5 @@
 
         /* Let's see if there's another dirty instruction right after. */
-        pRec = (PRECPATCHTOGUEST)RTAvlPVGetBestFit(&pPatch->patch.Patch2GuestAddrTree, (AVLPVKEY)(pCurPatchInstrGC - pVM->patm.s.pPatchMemGC), true);
+        pRec = (PRECPATCHTOGUEST)RTAvlU32GetBestFit(&pPatch->patch.Patch2GuestAddrTree, pCurPatchInstrGC - pVM->patm.s.pPatchMemGC, true);
         if (!pRec || !pRec->fDirty)
             break;  /* no more dirty instructions */
@@ -5753,5 +5770,5 @@
         }
 
-        pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlPVGetBestFit(&pPatch->patch.Patch2GuestAddrTree, (AVLPVKEY)offset, false);
+        pPatchToGuestRec = (PRECPATCHTOGUEST)RTAvlU32GetBestFit(&pPatch->patch.Patch2GuestAddrTree, offset, false);
         AssertReleaseMsg(pPatchToGuestRec, ("PATMR3HandleTrap: Unable to find corresponding guest address for %VGv (offset %x)\n", pEip, offset));
 
@@ -5821,5 +5838,5 @@
     if (pPatchToGuestRec->fDirty)
     {
-        Assert(pPatchToGuestRec->Core.Key == (AVLPVKEY)offset);
+        Assert(pPatchToGuestRec->Core.Key == offset);
         Assert(pVM->patm.s.pGCStateHC->fPIF == 1);
 
Index: /trunk/src/VBox/VMM/PATM/PATMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/PATM/PATMInternal.h	(revision 92)
+++ /trunk/src/VBox/VMM/PATM/PATMInternal.h	(revision 93)
@@ -149,5 +149,5 @@
 typedef struct
 {
-    /** The key is a GC virtual address. */
+    /** The key is a pointer to a JUMPREC structure. */
     AVLPVNODECORE   Core;
 
@@ -173,5 +173,5 @@
 {
     /** The key is an offset inside the patch memory block. */
-    AVLPVNODECORE    Core;
+    AVLU32NODECORE   Core;
 
     RTGCPTR          pOrgInstrGC;
@@ -189,5 +189,6 @@
     AVLPVNODECORE   Core;
 
-    RTGCUINTPTR     PatchOffset;
+    /** Patch offset (relative to PATM::pPatchMemGC / PATM::pPatchMemHC). */
+    uint32_t        PatchOffset;
 } RECGUESTTOPATCH, *PRECGUESTTOPATCH;
 
@@ -257,5 +258,5 @@
      * instruction in the patch block.
      */
-    HCPTRTYPE(PAVLPVNODECORE) Patch2GuestAddrTree;
+    HCPTRTYPE(PAVLU32NODECORE) Patch2GuestAddrTree;
     HCPTRTYPE(PAVLPVNODECORE) Guest2PatchAddrTree;
     uint32_t                  nrPatch2GuestRecs;
@@ -609,10 +610,20 @@
 
 
-/* Empty the specified tree (PV tree, MMR3 heap)
+/**
+ * Empty the specified tree (PV tree, MMR3 heap)
  *
  * @param   pVM             The VM to operate on.
  * @param   ppTree          Tree to empty
  */
-void patmEmptyTree(PVM pVM, PAVLPVNODECORE *ppTree);
+void patmEmptyTree(PVM pVM, PPAVLPVNODECORE ppTree);
+
+
+/**
+ * Empty the specified tree (U32 tree, MMR3 heap)
+ *
+ * @param   pVM             The VM to operate on.
+ * @param   ppTree          Tree to empty
+ */
+void patmEmptyTreeU32(PVM pVM, PPAVLU32NODECORE ppTree);
 
 
Index: /trunk/src/VBox/VMM/PATM/PATMSSM.cpp
===================================================================
--- /trunk/src/VBox/VMM/PATM/PATMSSM.cpp	(revision 92)
+++ /trunk/src/VBox/VMM/PATM/PATMSSM.cpp	(revision 93)
@@ -180,9 +180,9 @@
 #ifdef VBOX_STRICT
     int nrLookupRecords = 0;
-    RTAvlPVDoWithAll(&pPatch->patch.Patch2GuestAddrTree, true, patmCountLeaf, &nrLookupRecords);
+    RTAvlU32DoWithAll(&pPatch->patch.Patch2GuestAddrTree, true, patmCountLeaf, &nrLookupRecords);
     Assert(nrLookupRecords == pPatch->patch.nrPatch2GuestRecs);
 #endif
 
-    RTAvlPVDoWithAll(&pPatch->patch.Patch2GuestAddrTree, true, patmSaveP2GLookupRecords, pVM);
+    RTAvlU32DoWithAll(&pPatch->patch.Patch2GuestAddrTree, true, patmSaveP2GLookupRecords, pVM);
     return VINF_SUCCESS;
 }
