Index: /trunk/src/VBox/VMM/HWACCM.cpp
===================================================================
--- /trunk/src/VBox/VMM/HWACCM.cpp	(revision 20034)
+++ /trunk/src/VBox/VMM/HWACCM.cpp	(revision 20035)
@@ -307,5 +307,5 @@
      * Register the saved state data unit.
      */
-    int rc = SSMR3RegisterInternal(pVM, "HWACCM", 0, HWACCM_SSM_VERSION, sizeof(HWACCM),
+    int rc = SSMR3RegisterInternal(pVM, "HWACCM", 0, HWACCM_SSM_VERSION_3_0_X, sizeof(HWACCM),
                                    NULL, hwaccmR3Save, NULL,
                                    NULL, hwaccmR3Load, NULL);
@@ -1697,4 +1697,7 @@
     }
 
+    rc = SSMR3PutBool(pSSM, pVM->hwaccm.s.svm.fTPRPatching);
+    AssertRCReturn(rc, rc);
+
     return VINF_SUCCESS;
 }
@@ -1717,6 +1720,7 @@
      * Validate version.
      */
-    if (   u32Version != HWACCM_SSM_VERSION
-        && u32Version != HWACCM_SSM_VERSION_2_0_X)
+    if (   u32Version != HWACCM_SSM_VERSION_2_2_X
+        && u32Version != HWACCM_SSM_VERSION_2_0_X
+        && u32Version != HWACCM_SSM_VERSION_3_0_X)
     {
         AssertMsgFailed(("hwaccmR3Load: Invalid version u32Version=%d!\n", u32Version));
@@ -1732,5 +1736,5 @@
         AssertRCReturn(rc, rc);
 
-        if (u32Version >= HWACCM_SSM_VERSION)
+        if (u32Version >= HWACCM_SSM_VERSION_2_2_X)
         {
             uint32_t val;
@@ -1749,4 +1753,11 @@
         }
     }
+
+    if (u32Version >= HWACCM_SSM_VERSION_3_0_X)
+    {
+        rc = SSMR3GetBool(pSSM, &pVM->hwaccm.s.svm.fTPRPatching);
+        AssertRCReturn(rc, rc);
+    }
+
     return VINF_SUCCESS;
 }
Index: /trunk/src/VBox/VMM/HWACCMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/HWACCMInternal.h	(revision 20034)
+++ /trunk/src/VBox/VMM/HWACCMInternal.h	(revision 20035)
@@ -135,5 +135,6 @@
 /** HWACCM SSM version
  */
-#define HWACCM_SSM_VERSION                  4
+#define HWACCM_SSM_VERSION_3_0_X            5
+#define HWACCM_SSM_VERSION_2_2_X            4
 #define HWACCM_SSM_VERSION_2_0_X            3
 
@@ -340,7 +341,6 @@
         /** Set if erratum 170 affects the AMD cpu. */
         bool                        fAlwaysFlushTLB;
-        /** Explicit alignment padding to make 32-bit gcc align u64RegisterMask
-         *  naturally. */
-        bool                        padding[1];
+        /** Set if we're patching 32 bits guests to get rid of TPR access overhead. */
+        bool                        fTPRPatching;
 
         /** R0 memory object for the host VM control block (VMCB). */
Index: /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 20034)
+++ /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 20035)
@@ -1431,5 +1431,5 @@
                  * Forward the trap to the guest by injecting the exception and resuming execution.
                  */
-                Log(("Guest page fault at %RGv cr2=%RGv error code %x rsp=%RGv\n", (RTGCPTR)pCtx->rip, uFaultAddress, errCode, (RTGCPTR)pCtx->rsp));
+                Log(("Guest page fault at %04X:%RGv cr2=%RGv error code %x rsp=%RGv\n", pCtx->cs, (RTGCPTR)pCtx->rip, uFaultAddress, errCode, (RTGCPTR)pCtx->rsp));
                 STAM_COUNTER_INC(&pVCpu->hwaccm.s.StatExitGuestPF);
 
@@ -1475,18 +1475,19 @@
                     if (    rc == VINF_SUCCESS
                         &&  Cpu.pCurInstr->opcode == OP_MOV
-                        &&  cbOp == 6)
+                        &&  cbOp >= 5)
                     {
                         if (    (errCode & X86_TRAP_PF_RW)
-                            &&  Cpu.param1.parval == uFaultAddress)
+                            &&  Cpu.param1.disp32 == (uint32_t)uFaultAddress)
                         {
+                            pVM->hwaccm.s.svm.fTPRPatching = true;
                             Log(("Acceptable write candidate!\n"));
                         }
                         else
-                        if (Cpu.param2.parval == uFaultAddress)
+                        if (Cpu.param2.disp32 == (uint32_t)uFaultAddress)
                         {
+                            pVM->hwaccm.s.svm.fTPRPatching = true;
                             Log(("Acceptable read candidate!\n"));
                         }
                     }
-
                 }
             }
@@ -1589,4 +1590,5 @@
                 Event.n.u1ErrorCodeValid    = 1;
                 Event.n.u32ErrorCode        = pVMCB->ctrl.u64ExitInfo1; /* EXITINFO1 = error code */
+Assert(pCtx->cs != 0xffcf || pCtx->eip != 0x4315);
                 break;
             case X86_XCPT_DE:
@@ -1607,5 +1609,5 @@
                 break;
             }
-            Log(("Trap %x at %RGv esi=%x\n", vector, (RTGCPTR)pCtx->rip, pCtx->esi));
+            Log(("Trap %x at %04x:%RGv esi=%x\n", vector, pCtx->cs, (RTGCPTR)pCtx->rip, pCtx->esi));
             SVMR0InjectEvent(pVM, pVMCB, pCtx, &Event);