Index: /trunk/src/VBox/VMM/VMMAll/TMAllCpu.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/TMAllCpu.cpp	(revision 53324)
+++ /trunk/src/VBox/VMM/VMMAll/TMAllCpu.cpp	(revision 53325)
@@ -267,5 +267,5 @@
             /* The source is the real TSC. */
             if (pVM->tm.s.fTSCVirtualized)
-                *poffRealTSC = pVCpu->tm.s.offTSCRawSrc;
+                *poffRealTSC = 0 - pVCpu->tm.s.offTSCRawSrc;
             else
                 *poffRealTSC = 0;
@@ -365,5 +365,5 @@
             /* The source is the real TSC. */
             if (pVM->tm.s.fTSCVirtualized)
-                *poffRealTSC = pVCpu->tm.s.offTSCRawSrc;
+                *poffRealTSC = 0 - pVCpu->tm.s.offTSCRawSrc;
             else
                 *poffRealTSC = 0;
Index: /trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 53324)
+++ /trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 53325)
@@ -2263,5 +2263,5 @@
         uint64_t u64LastTick = TMCpuTickGetLastSeen(pVCpu);
 
-        if (u64CurTSC - pVmcb->ctrl.u64TSCOffset >= TMCpuTickGetLastSeen(pVCpu))
+        if (u64CurTSC + pVmcb->ctrl.u64TSCOffset >= TMCpuTickGetLastSeen(pVCpu))
         {
             pVmcb->ctrl.u32InterceptCtrl1 &= ~SVM_CTRL1_INTERCEPT_RDTSC;
@@ -3199,9 +3199,8 @@
     }
 
+    /** @todo Last-seen-tick shouldn't be necessary when TM supports invariant
+     *        mode. */
     if (!(pVmcb->ctrl.u32InterceptCtrl1 & SVM_CTRL1_INTERCEPT_RDTSC))
-    {
-        /** @todo Find a way to fix hardcoding a guestimate.  */
-        TMCpuTickSetLastSeen(pVCpu, ASMReadTSC() - pVmcb->ctrl.u64TSCOffset - 0x400);
-    }
+        TMCpuTickSetLastSeen(pVCpu, ASMReadTSC() + pVmcb->ctrl.u64TSCOffset);
 
     STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatInGC, &pVCpu->hm.s.StatExit1, x);
Index: /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 53324)
+++ /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 53325)
@@ -5630,8 +5630,8 @@
     {
         uint64_t u64CurTSC = ASMReadTSC();
-        if (u64CurTSC - pVCpu->hm.s.vmx.u64TSCOffset >= TMCpuTickGetLastSeen(pVCpu))
+        if (u64CurTSC + pVCpu->hm.s.vmx.u64TSCOffset >= TMCpuTickGetLastSeen(pVCpu))
         {
             /* Note: VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT takes precedence over TSC_OFFSET, applies to RDTSCP too. */
-            rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, 0 - pVCpu->hm.s.vmx.u64TSCOffset); AssertRC(rc);
+            rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, pVCpu->hm.s.vmx.u64TSCOffset);     AssertRC(rc);
 
             pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT;
@@ -8707,10 +8707,8 @@
     pVmxTransient->fVectoringDoublePF  = false;                 /* Vectoring double page-fault needs to be determined later. */
 
+    /** @todo Last-seen-tick shouldn't be necessary when TM supports invariant
+     *        mode. */
     if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_RDTSC_EXIT))
-    {
-        /** @todo Find a way to fix hardcoding a guestimate.  */
-        TMCpuTickSetLastSeen(pVCpu, ASMReadTSC() - pVCpu->hm.s.vmx.u64TSCOffset
-                             - 0x400  /* guestimate of world switch overhead in clock ticks */);
-    }
+        TMCpuTickSetLastSeen(pVCpu, ASMReadTSC() + pVCpu->hm.s.vmx.u64TSCOffset);
 
     STAM_PROFILE_ADV_STOP_START(&pVCpu->hm.s.StatInGC, &pVCpu->hm.s.StatExit1, x);