diff -r d2bf1a7cc131 xen/arch/x86/shadow.c
--- a/xen/arch/x86/shadow.c	Sat Jul 29 14:05:59 2006 +0100
+++ b/xen/arch/x86/shadow.c	Mon Aug 07 09:39:52 2006 +0800
@@ -1315,55 +1315,6 @@ static int is_out_of_sync(struct vcpu *v
     return 0;
 }
 
-#define GPFN_TO_GPTEPAGE(_gpfn) ((_gpfn) / (PAGE_SIZE / sizeof(guest_l1_pgentry_t)))
-static inline unsigned long
-predict_writable_pte_page(struct domain *d, unsigned long gpfn)
-{
-    return __shadow_status(d, GPFN_TO_GPTEPAGE(gpfn), PGT_writable_pred);
-}
-
-static inline void
-increase_writable_pte_prediction(struct domain *d, unsigned long gpfn, unsigned long prediction)
-{
-    unsigned long score = prediction & PGT_score_mask;
-    int create = (score == 0);
-
-    // saturating addition
-    score = (score + (1u << PGT_score_shift)) & PGT_score_mask;
-    score = score ? score : PGT_score_mask;
-
-    prediction = (prediction & PGT_mfn_mask) | score;
-
-    //printk("increase gpfn=%lx pred=%lx create=%d\n", gpfn, prediction, create);
-    set_shadow_status(d, GPFN_TO_GPTEPAGE(gpfn), 0, prediction, PGT_writable_pred, 0);
-
-    if ( create )
-        perfc_incr(writable_pte_predictions);
-}
-
-static inline void
-decrease_writable_pte_prediction(struct domain *d, unsigned long gpfn, unsigned long prediction)
-{
-    unsigned long score = prediction & PGT_score_mask;
-    ASSERT(score);
-
-    // divide score by 2...  We don't like bad predictions.
-    //
-    score = (score >> 1) & PGT_score_mask;
-
-    prediction = (prediction & PGT_mfn_mask) | score;
-
-    //printk("decrease gpfn=%lx pred=%lx score=%lx\n", gpfn, prediction, score);
-
-    if ( score )
-        set_shadow_status(d, GPFN_TO_GPTEPAGE(gpfn), 0, prediction, PGT_writable_pred, 0);
-    else
-    {
-        delete_shadow_status(d, GPFN_TO_GPTEPAGE(gpfn), 0, PGT_writable_pred, 0);
-        perfc_decr(writable_pte_predictions);
-    }
-}
-
 static int fix_entry(
     struct domain *d,
     l1_pgentry_t *pt, u32 *found, int is_l1_shadow, u32 max_refs_to_find)
diff -r d2bf1a7cc131 xen/arch/x86/shadow_public.c
--- a/xen/arch/x86/shadow_public.c	Sat Jul 29 14:05:59 2006 +0100
+++ b/xen/arch/x86/shadow_public.c	Mon Aug 07 09:39:52 2006 +0800
@@ -749,7 +749,7 @@ void free_shadow_page(unsigned long smfn
         unsigned long mfn;
         mfn = __shadow_status(d, gpfn, PGT_fl1_shadow);
         if ( !mfn )
-            gpfn |= (1UL << 63);
+            gpfn |= PGT_high_mfn_nx;
     }
 #endif
 #if CONFIG_PAGING_LEVELS >= 3
diff -r d2bf1a7cc131 xen/include/asm-x86/mm.h
--- a/xen/include/asm-x86/mm.h	Sat Jul 29 14:05:59 2006 +0100
+++ b/xen/include/asm-x86/mm.h	Mon Aug 07 09:39:52 2006 +0800
@@ -101,17 +101,17 @@ struct page_info
 #ifdef __x86_64__
 #define PGT_high_mfn_shift  52
 #define PGT_high_mfn_mask   (0xfffUL << PGT_high_mfn_shift)
-#define PGT_mfn_mask        (((1U<<23)-1) | PGT_high_mfn_mask)
+#define PGT_mfn_mask        (((1U<<27)-1) | PGT_high_mfn_mask)
 #define PGT_high_mfn_nx     (0x800UL << PGT_high_mfn_shift)
 #else
  /* 23-bit mfn mask for shadow types: good for up to 32GB RAM. */
 #define PGT_mfn_mask        ((1U<<23)-1)
  /* NX for PAE xen is not supported yet */
 #define PGT_high_mfn_nx     (1ULL << 63)
-#endif
 
 #define PGT_score_shift     23
 #define PGT_score_mask      (((1U<<4)-1)<<PGT_score_shift)
+#endif
 
  /* Cleared when the owning guest 'frees' this page. */
 #define _PGC_allocated      31