Index: trunk/src/VBox/VMM/include/IEMInternal-armv8.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMInternal-armv8.h	(revision 100965)
+++ trunk/src/VBox/VMM/include/IEMInternal-armv8.h	(revision 100966)
@@ -295,5 +295,6 @@
 #define IEMTLBE_F_NO_MAPPINGR3      RT_BIT_64(7) /**< TLB entry:   The IEMTLBENTRY::pMappingR3 member is invalid. */
 #define IEMTLBE_F_PG_UNASSIGNED     RT_BIT_64(8) /**< Phys page:   Unassigned memory (not RAM, ROM, MMIO2 or MMIO). */
-#define IEMTLBE_F_PHYS_REV          UINT64_C(0xfffffffffffffe00) /**< Physical revision mask. @sa IEMTLB_PHYS_REV_INCR */
+#define IEMTLBE_F_PG_CODE_PAGE      RT_BIT_64(9) /**< Phys page:   Code page. */
+#define IEMTLBE_F_PHYS_REV          UINT64_C(0xfffffffffffffc00) /**< Physical revision mask. @sa IEMTLB_PHYS_REV_INCR */
 /** @} */
 
@@ -360,5 +361,5 @@
 /** IEMTLB::uTlbPhysRev increment.
  * @sa IEMTLBE_F_PHYS_REV */
-#define IEMTLB_PHYS_REV_INCR    RT_BIT_64(9)
+#define IEMTLB_PHYS_REV_INCR    RT_BIT_64(10)
 /**
  * Calculates the TLB tag for a virtual address.
Index: trunk/src/VBox/VMM/include/IEMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMInternal.h	(revision 100965)
+++ trunk/src/VBox/VMM/include/IEMInternal.h	(revision 100966)
@@ -443,5 +443,6 @@
 #define IEMTLBE_F_NO_MAPPINGR3      RT_BIT_64(7) /**< TLB entry:   The IEMTLBENTRY::pMappingR3 member is invalid. */
 #define IEMTLBE_F_PG_UNASSIGNED     RT_BIT_64(8) /**< Phys page:   Unassigned memory (not RAM, ROM, MMIO2 or MMIO). */
-#define IEMTLBE_F_PHYS_REV          UINT64_C(0xfffffffffffffe00) /**< Physical revision mask. @sa IEMTLB_PHYS_REV_INCR */
+#define IEMTLBE_F_PG_CODE_PAGE      RT_BIT_64(9) /**< Phys page:   Code page. */
+#define IEMTLBE_F_PHYS_REV          UINT64_C(0xfffffffffffffc00) /**< Physical revision mask. @sa IEMTLB_PHYS_REV_INCR */
 /** @} */
 
@@ -512,5 +513,5 @@
 /** IEMTLB::uTlbPhysRev increment.
  * @sa IEMTLBE_F_PHYS_REV */
-#define IEMTLB_PHYS_REV_INCR    RT_BIT_64(9)
+#define IEMTLB_PHYS_REV_INCR    RT_BIT_64(10)
 /**
  * Calculates the TLB tag for a virtual address.
Index: trunk/src/VBox/VMM/include/PGMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/PGMInternal.h	(revision 100965)
+++ trunk/src/VBox/VMM/include/PGMInternal.h	(revision 100966)
@@ -659,9 +659,17 @@
         /** 2     - Don't apply the physical handler in HM mode (nested APIC hack). */
         uint64_t    fHandlerPhysNotInHm : 1;
-        /** 3     - Flag indicating that a write monitored page was written to
-         *  when set. */
+        /** 3     - Flag indicating that a write monitored page was written to when set. */
         uint64_t    fWrittenToY         : 1;
-        /** 7:4   - Unused. */
-        uint64_t    u2Unused0           : 4;
+        /** 4     - Set when the page is write monitored because it's an IEM TB code
+         * page.  Save recompiled code the need to verify opcode bytes.
+         *
+         * IEM fetches this flag as part of the TLB queries.  The flag is cleared when
+         * the page is made writable and IEM is informed and will invalidate its
+         * physical TLB layer.
+         *
+         * @note Can possibly be set on ROM pages that are not in the monitored state. */
+        uint64_t    fCodePageY          : 1;
+        /** 7:5   - Unused. */
+        uint64_t    u2Unused0           : 3;
         /** 9:8   - Paging structure needed to map the page
          * (PGM_PAGE_PDE_TYPE_*). */
@@ -977,4 +985,5 @@
 #define PGM_PAGE_IS_ALLOCATED(a_pPage)          ( (a_pPage)->s.uStateY == PGM_PAGE_STATE_ALLOCATED )
 
+
 /**
  * Marks the page as written to (for GMM change monitoring).
@@ -999,4 +1008,28 @@
  */
 #define PGM_PAGE_IS_WRITTEN_TO(a_pPage)         ( (a_pPage)->s.fWrittenToY )
+
+
+/**
+ * Marks the page as an IEM code page (being write monitored or a ROM page).
+ * @param   a_pVM       The VM handle, only used for lock ownership assertions.
+ * @param   a_pPage     Pointer to the physical guest page tracking structure.
+ */
+#define PGM_PAGE_SET_CODE_PAGE(a_pVM, a_pPage) \
+    do { (a_pPage)->s.fCodePageY = 1; PGM_PAGE_ASSERT_LOCK(a_pVM); } while (0)
+
+/**
+ * Clears the code page indicator.
+ * @param   a_pVM       The VM handle, only used for lock ownership assertions.
+ * @param   a_pPage     Pointer to the physical guest page tracking structure.
+ */
+#define PGM_PAGE_CLEAR_CODE_PAGE(a_pVM, a_pPage) \
+    do { (a_pPage)->s.fCodePageY = 0; PGM_PAGE_ASSERT_LOCK(a_pVM); } while (0)
+
+/**
+ * Checks if the page is an IEM code page (implies write monitored or ROM page).
+ * @returns true/false.
+ * @param   a_pPage     Pointer to the physical guest page tracking structure.
+ */
+#define PGM_PAGE_IS_CODE_PAGE(a_pPage)         ( (a_pPage)->s.fCodePageY )
 
 
