Index: /trunk/src/recompiler_new/VBoxRecompiler.c
===================================================================
--- /trunk/src/recompiler_new/VBoxRecompiler.c	(revision 17273)
+++ /trunk/src/recompiler_new/VBoxRecompiler.c	(revision 17274)
@@ -5072,3 +5072,2 @@
 {
 }
-
Index: /trunk/src/recompiler_new/cpu-defs.h
===================================================================
--- /trunk/src/recompiler_new/cpu-defs.h	(revision 17273)
+++ /trunk/src/recompiler_new/cpu-defs.h	(revision 17274)
@@ -1,5 +1,5 @@
 /*
  * common defines for all CPUs
- * 
+ *
  * Copyright (c) 2003 Fabrice Bellard
  *
@@ -41,5 +41,5 @@
 #endif
 
-#ifndef TARGET_PHYS_ADDR_BITS 
+#ifndef TARGET_PHYS_ADDR_BITS
 #if TARGET_LONG_BITS >= HOST_LONG_BITS
 #define TARGET_PHYS_ADDR_BITS TARGET_LONG_BITS
@@ -86,5 +86,5 @@
 #define HOST_LONG_SIZE (HOST_LONG_BITS / 8)
 
-#define EXCP_INTERRUPT 	0x10000 /* async interruption */
+#define EXCP_INTERRUPT  0x10000 /* async interruption */
 #define EXCP_HLT        0x10001 /* hlt instruction reached */
 #define EXCP_DEBUG      0x10002 /* cpu stopped after a breakpoint or singlestep */
@@ -126,7 +126,7 @@
        bit 2..0                   : zero
     */
-    target_ulong addr_read; 
-    target_ulong addr_write; 
-    target_ulong addr_code; 
+    target_ulong addr_read;
+    target_ulong addr_write;
+    target_ulong addr_code;
       /* Addend to virtual address to get physical address.  IO accesses
        use the correcponding iotlb value.  */
@@ -138,7 +138,7 @@
 #endif
     /* padding to get a power of two size */
-    uint8_t dummy[(1 << CPU_TLB_ENTRY_BITS) - 
-                  (sizeof(target_ulong) * 3 + 
-                   ((-sizeof(target_ulong) * 3) & (sizeof(target_phys_addr_t) - 1)) + 
+    uint8_t dummy[(1 << CPU_TLB_ENTRY_BITS) -
+                  (sizeof(target_ulong) * 3 +
+                   ((-sizeof(target_ulong) * 3) & (sizeof(target_phys_addr_t) - 1)) +
                    sizeof(target_phys_addr_t))];
 } CPUTLBEntry;
@@ -174,4 +174,6 @@
     CPUTLBEntry tlb_table[NB_MMU_MODES][CPU_TLB_SIZE];                  \
     target_phys_addr_t iotlb[NB_MMU_MODES][CPU_TLB_SIZE];               \
+    /** addends for HVA -> GPA translations */                          \
+    VBOX_ONLY(target_phys_addr_t   phys_addends[NB_MMU_MODES][CPU_TLB_SIZE]); \
     struct TranslationBlock *tb_jmp_cache[TB_JMP_CACHE_SIZE];           \
     /* buffer for temporaries in the code generator */                  \
@@ -213,5 +215,5 @@
     void *opaque;                                                       \
                                                                         \
-    const char *cpu_model_str;                                          
-
-#endif
+    const char *cpu_model_str;
+
+#endif
Index: /trunk/src/recompiler_new/exec-all.h
===================================================================
--- /trunk/src/recompiler_new/exec-all.h	(revision 17273)
+++ /trunk/src/recompiler_new/exec-all.h	(revision 17274)
@@ -418,5 +418,8 @@
     return addr + env1->tlb_table[mmu_idx][page_index].addend;
 # elif defined(VBOX)
-    return remR3HCVirt2GCPhys(env1, (void *)(uintptr_t)(addr + env1->tlb_table[mmu_idx][page_index].addend));
+    Assert(env1->phys_addends[mmu_idx][page_index] != -1);
+    /** @todo: nike: will remove this assert along with remR3HCVirt2GCPhys() soon */
+    Assert(remR3HCVirt2GCPhys(env1, (void *)(uintptr_t)(addr + env1->tlb_table[mmu_idx][page_index].addend)) == addr + env1->phys_addends[mmu_idx][page_index]);
+    return addr + env1->phys_addends[mmu_idx][page_index];
 # else
     return addr + env1->tlb_table[mmu_idx][page_index].addend - (unsigned long)phys_ram_base;
Index: /trunk/src/recompiler_new/exec.c
===================================================================
--- /trunk/src/recompiler_new/exec.c	(revision 17273)
+++ /trunk/src/recompiler_new/exec.c	(revision 17274)
@@ -1849,5 +1849,4 @@
 {
     int i;
-
 #if defined(DEBUG_TLB)
     printf("tlb_flush:\n");
@@ -1864,12 +1863,22 @@
         env->tlb_table[1][i].addr_write = -1;
         env->tlb_table[1][i].addr_code = -1;
+#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
+        env->phys_addends[0][i] = -1;
+        env->phys_addends[1][i] = -1;
+#endif
 #if (NB_MMU_MODES >= 3)
         env->tlb_table[2][i].addr_read = -1;
         env->tlb_table[2][i].addr_write = -1;
         env->tlb_table[2][i].addr_code = -1;
+#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
+        env->phys_addends[2][i] = -1;
+#endif
 #if (NB_MMU_MODES == 4)
         env->tlb_table[3][i].addr_read = -1;
         env->tlb_table[3][i].addr_write = -1;
         env->tlb_table[3][i].addr_code = -1;
+#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
+        env->phys_addends[3][i] = -1;
+#endif
 #endif
 #endif
@@ -2058,8 +2067,8 @@
 #endif
 
-#ifndef VBOX
+#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
+DECLINLINE(void) tlb_update_dirty(CPUTLBEntry *tlb_entry, target_phys_addr_t phys_addend)
+#else
 static inline void tlb_update_dirty(CPUTLBEntry *tlb_entry)
-#else
-DECLINLINE(void) tlb_update_dirty(CPUTLBEntry *tlb_entry)
 #endif
 {
@@ -2074,5 +2083,9 @@
             tlb_entry->addend - (unsigned long)phys_ram_base;
 #else
-        ram_addr = remR3HCVirt2GCPhys(first_cpu, (void*)((tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend));
+        Assert(phys_addend != -1);
+        ram_addr = (tlb_entry->addr_write & TARGET_PAGE_MASK) + phys_addend;
+        
+        /** @todo: nike: will remove this assert along with remR3HCVirt2GCPhys() soon */
+        Assert(ram_addr == remR3HCVirt2GCPhys(first_cpu, (void*)((tlb_entry->addr_write & TARGET_PAGE_MASK) + tlb_entry->addend)));
 #endif
         if (!cpu_physical_memory_is_dirty(ram_addr)) {
@@ -2086,4 +2099,18 @@
 {
     int i;
+#if defined(VBOX) && !defined(REM_PHYS_ADDR_IN_TLB)
+    for(i = 0; i < CPU_TLB_SIZE; i++)
+        tlb_update_dirty(&env->tlb_table[0][i], env->phys_addends[0][i]);
+    for(i = 0; i < CPU_TLB_SIZE; i++)
+        tlb_update_dirty(&env->tlb_table[1][i], env->phys_addends[1][i]);
+#if (NB_MMU_MODES >= 3)
+    for(i = 0; i < CPU_TLB_SIZE; i++)
+        tlb_update_dirty(&env->tlb_table[2][i], env->phys_addends[2][i]);
+#if (NB_MMU_MODES == 4)
+    for(i = 0; i < CPU_TLB_SIZE; i++)
+        tlb_update_dirty(&env->tlb_table[3][i], env->phys_addends[3][i]);
+#endif
+#endif
+#else /* VBOX */
     for(i = 0; i < CPU_TLB_SIZE; i++)
         tlb_update_dirty(&env->tlb_table[0][i]);
@@ -2098,4 +2125,5 @@
 #endif
 #endif
+#endif /* VBOX */
 }
 
@@ -2278,4 +2306,6 @@
     if (prot & PAGE_WRITE)
         te->addr_write |= write_mods;
+
+    env->phys_addends[mmu_idx][index] = (pd & TARGET_PAGE_MASK)- vaddr;
 #endif
 
Index: /trunk/src/recompiler_new/osdep.h
===================================================================
--- /trunk/src/recompiler_new/osdep.h	(revision 17273)
+++ /trunk/src/recompiler_new/osdep.h	(revision 17274)
@@ -12,4 +12,6 @@
 
 #include "config.h"
+
+#define VBOX_ONLY(x) x
 
 #ifndef _MSC_VER
@@ -49,4 +51,6 @@
 
 #include <stdarg.h>
+
+#define VBOX_ONLY(x)
 
 #define qemu_snprintf snprintf   /* bird */
Index: /trunk/src/recompiler_new/target-i386/cpu.h
===================================================================
--- /trunk/src/recompiler_new/target-i386/cpu.h	(revision 17273)
+++ /trunk/src/recompiler_new/target-i386/cpu.h	(revision 17274)
@@ -1,5 +1,5 @@
 /*
  * i386 virtual CPU header
- * 
+ *
  *  Copyright (c) 2003 Fabrice Bellard
  *
@@ -112,6 +112,6 @@
 
 /* eflags masks */
-#define CC_C   	0x0001
-#define CC_P 	0x0004
+#define CC_C	0x0001
+#define CC_P	0x0004
 #define CC_A	0x0010
 #define CC_Z	0x0040
@@ -123,12 +123,12 @@
 #define VM_SHIFT   17
 
-#define TF_MASK 		0x00000100
-#define IF_MASK 		0x00000200
-#define DF_MASK 		0x00000400
+#define TF_MASK                 0x00000100
+#define IF_MASK                 0x00000200
+#define DF_MASK                 0x00000400
 #define IOPL_MASK		0x00003000
-#define NT_MASK	         	0x00004000
+#define NT_MASK	                0x00004000
 #define RF_MASK			0x00010000
 #define VM_MASK			0x00020000
-#define AC_MASK			0x00040000 
+#define AC_MASK			0x00040000
 #define VIF_MASK                0x00080000
 #define VIP_MASK                0x00100000
@@ -193,5 +193,5 @@
 
 #define HF2_GIF_MASK          (1 << HF2_GIF_SHIFT)
-#define HF2_HIF_MASK          (1 << HF2_HIF_SHIFT) 
+#define HF2_HIF_MASK          (1 << HF2_HIF_SHIFT)
 #define HF2_NMI_MASK          (1 << HF2_NMI_SHIFT)
 #define HF2_VINTR_MASK        (1 << HF2_VINTR_SHIFT)
@@ -257,5 +257,5 @@
 #define MSR_IA32_SYSENTER_ESP           0x175
 #define MSR_IA32_SYSENTER_EIP           0x176
-#endif 
+#endif
 
 #define MSR_IA32_SYSENTER_CS            0x174
@@ -377,5 +377,5 @@
 
 #define CPUID_VENDOR_AMD_1   0x68747541 /* "Auth" */
-#define CPUID_VENDOR_AMD_2   0x69746e65 /* "enti" */ 
+#define CPUID_VENDOR_AMD_2   0x69746e65 /* "enti" */
 #define CPUID_VENDOR_AMD_3   0x444d4163 /* "cAMD" */
 
@@ -572,5 +572,5 @@
         CPU86_LDouble d __attribute__((aligned(16)));
 #else
-	ALIGNED_MEMBER(CPU86_LDouble, d, 16); 
+	ALIGNED_MEMBER(CPU86_LDouble, d, 16);
 #endif
 #else
@@ -584,10 +584,10 @@
 #ifdef VBOX
     uint32_t alignment3[3]; /* force the long double to start a 16 byte line. */
-#endif 
+#endif
     CPU86_LDouble ft0;
 #if defined(VBOX) && defined(RT_ARCH_X86) && !defined(RT_OS_DARWIN)
     uint32_t alignment4; /* long double is 12 byte, pad it to 16. */
-#endif 
-   
+#endif
+
     float_status mmx_status; /* for 3DNow! float ops */
     float_status sse_status;
@@ -604,8 +604,8 @@
 #ifdef VBOX
     uint32_t alignment0;
-#endif 
+#endif
     uint64_t efer;
     uint64_t star;
-    
+
     uint64_t vm_hsave;
     uint64_t vm_vmcb;
@@ -677,5 +677,5 @@
 #else
     uint32_t alignment2[3];
-#endif 
+#endif
 } CPUX86State;
 
@@ -747,9 +747,9 @@
 #ifdef VBOX
     uint32_t alignment3[3]; /* force the long double to start a 16 byte line. */
-#endif 
+#endif
     CPU86_LDouble ft0;
 #if defined(VBOX) && defined(RT_ARCH_X86) && !defined(RT_OS_DARWIN)
     uint32_t alignment4; /* long double is 12 byte, pad it to 16. */
-#endif 
+#endif
     union {
 	float f;
@@ -758,5 +758,5 @@
         int64_t i64;
     } fp_convert;
-    
+
     float_status sse_status;
     uint32_t mxcsr;
@@ -771,5 +771,5 @@
 #ifdef VBOX
     uint32_t alignment0;
-#endif 
+#endif
     uint64_t efer;
     uint64_t star;
@@ -783,10 +783,10 @@
     int native_fp_regs; /* if true, the FPU state is in the native CPU regs */
 #endif
-    
+
     /* exception/interrupt handling */
     jmp_buf jmp_env;
 } CPUX86State_Ver16;
 
-/** CPUX86State state flags 
+/** CPUX86State state flags
  * @{ */
 #define CPU_RAW_RING0            0x0002 /* Set after first time RawR0 is executed, never cleared. */
@@ -813,14 +813,14 @@
    cache: it synchronizes the hflags with the segment cache values */
 #ifndef VBOX
-static inline void cpu_x86_load_seg_cache(CPUX86State *env, 
+static inline void cpu_x86_load_seg_cache(CPUX86State *env,
                                           int seg_reg, unsigned int selector,
                                           target_ulong base,
-                                          unsigned int limit, 
+                                          unsigned int limit,
                                           unsigned int flags)
 #else
-DECLINLINE(void)  cpu_x86_load_seg_cache(CPUX86State *env, 
+DECLINLINE(void)  cpu_x86_load_seg_cache(CPUX86State *env,
                                           int seg_reg, unsigned int selector,
                                           target_ulong base,
-                                          unsigned int limit, 
+                                          unsigned int limit,
                                           unsigned int flags)
 
@@ -829,5 +829,5 @@
     SegmentCache *sc;
     unsigned int new_hflags;
-    
+
     sc = &env->segs[seg_reg];
     sc->selector = selector;
@@ -847,5 +847,5 @@
                 env->hflags |= HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK;
                 env->hflags &= ~(HF_ADDSEG_MASK);
-            } else 
+            } else
 #endif
             {
@@ -861,5 +861,5 @@
         if (env->hflags & HF_CS64_MASK) {
             /* zero base assumed for DS, ES and SS in long mode */
-        } else if (!(env->cr[0] & CR0_PE_MASK) || 
+        } else if (!(env->cr[0] & CR0_PE_MASK) ||
                    (env->eflags & VM_MASK) ||
                    !(env->hflags & HF_CS32_MASK)) {
@@ -871,10 +871,10 @@
             new_hflags |= HF_ADDSEG_MASK;
         } else {
-            new_hflags |= ((env->segs[R_DS].base | 
+            new_hflags |= ((env->segs[R_DS].base |
                             env->segs[R_ES].base |
-                            env->segs[R_SS].base) != 0) << 
+                            env->segs[R_SS].base) != 0) <<
                 HF_ADDSEG_SHIFT;
         }
-        env->hflags = (env->hflags & 
+        env->hflags = (env->hflags &
                        ~(HF_SS32_MASK | HF_ADDSEG_MASK)) | new_hflags;
     }
@@ -908,5 +908,5 @@
    signal handlers to inform the virtual CPU of exceptions. non zero
    is returned if the signal was handled by the virtual CPU.  */
-int cpu_x86_signal_handler(int host_signum, void *pinfo, 
+int cpu_x86_signal_handler(int host_signum, void *pinfo,
                            void *puc);
 void cpu_x86_set_a20(CPUX86State *env, int a20_state);
@@ -923,6 +923,6 @@
 uint64_t cpu_apic_rdmsr(CPUX86State *env, uint32_t reg);
 void     cpu_apic_wrmsr(CPUX86State *env, uint32_t reg, uint64_t value);
-uint64_t cpu_rdmsr(CPUX86State *env, uint32_t msr); 
-void     cpu_wrmsr(CPUX86State *env, uint32_t msr, uint64_t val); 
+uint64_t cpu_rdmsr(CPUX86State *env, uint32_t msr);
+void     cpu_wrmsr(CPUX86State *env, uint32_t msr, uint64_t val);
 #endif
 void cpu_smm_update(CPUX86State *env);
