Index: /trunk/src/VBox/VMM/HWACCM.cpp
===================================================================
--- /trunk/src/VBox/VMM/HWACCM.cpp	(revision 20025)
+++ /trunk/src/VBox/VMM/HWACCM.cpp	(revision 20026)
@@ -619,4 +619,6 @@
     Assert(!pVM->fHWACCMEnabled || VMMIsHwVirtExtForced(pVM));
 
+    pVM->hwaccm.s.fHasIoApic = PDMHasIoApic(pVM);
+
     if (pVM->hwaccm.s.vmx.fSupported)
     {
Index: /trunk/src/VBox/VMM/HWACCMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/HWACCMInternal.h	(revision 20025)
+++ /trunk/src/VBox/VMM/HWACCMInternal.h	(revision 20026)
@@ -205,7 +205,10 @@
     bool                        fAllow64BitGuests;
 
+    /** Set if an IO-APIC is configured for this VM. */
+    bool                        fHasIoApic;
+
     /** Explicit alignment padding to make 32-bit gcc align u64RegisterMask
      *  naturally. */
-    bool                        padding[2];
+    bool                        padding[1];
 
     /** And mask for copying register contents. */
Index: /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 20025)
+++ /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 20026)
@@ -1453,4 +1453,45 @@
             Assert(!pVM->hwaccm.s.fNestedPaging);
 
+#if 0
+            /* Shortcut for APIC TPR reads and writes; 32 bits guests only */
+            if (    (uFaultAddress & 0xfff) == 0x080
+                &&  pVM->hwaccm.s.fHasIoApic
+                &&  !(errCode & X86_TRAP_PF_P)  /* not present */
+                &&  !CPUMIsGuestInLongModeEx(pCtx))
+            {
+                RTGCPHYS GCPhysApicBase, GCPhys;
+                PDMApicGetBase(pVM, &GCPhysApicBase);   /* @todo cache this */
+                GCPhysApicBase &= PAGE_BASE_GC_MASK;
+
+                rc = PGMGstGetPage(pVCpu, (RTGCPTR)uFaultAddress, NULL, &GCPhys);
+                if (    rc == VINF_SUCCESS
+                    &&  GCPhys == GCPhysApicBase)
+                {
+                    Log(("Replace TPR access at %RGv\n", pCtx->rip));
+
+                    DISCPUSTATE Cpu;
+                    unsigned cbOp;
+                    rc = EMInterpretDisasOne(pVM, pVCpu, CPUMCTX2CORE(pCtx), &Cpu, &cbOp);
+                    AssertRC(rc);
+                    if (    rc == VINF_SUCCESS
+                        &&  Cpu.pCurInstr->opcode == OP_MOV
+                        &&  cbOp == 6)
+                    {
+                        if (    (errCode & X86_TRAP_PF_RW)
+                            &&  Cpu.param1.parval == uFaultAddress)
+                        {
+                            Log(("Acceptable write candidate!\n"));
+                        }
+                        else
+                        if (Cpu.param2.parval == uFaultAddress)
+                        {
+                            Log(("Acceptable read candidate!\n"));
+                        }
+                    }
+
+                }
+            }
+#endif
+
             Log2(("Page fault at %RGv cr2=%RGv error code %x\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode));
             /* Exit qualification contains the linear address of the page fault. */
Index: /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 20025)
+++ /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 20026)
@@ -431,5 +431,5 @@
 #endif /* HWACCM_VTX_WITH_VPID */
 
-            if (PDMHasIoApic(pVM))
+            if (pVM->hwaccm.s.fHasIoApic)
                 val |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC;
             
@@ -2017,5 +2017,5 @@
     if (    CPUMIsGuestInLongModeEx(pCtx)
         || (   (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC)
-            && PDMHasIoApic(pVM))
+            &&  pVM->hwaccm.s.fHasIoApic)
        )
     {