Index: trunk/src/VBox/VMM/REMInternal.h
===================================================================
--- trunk/src/VBox/VMM/REMInternal.h	(revision 20410)
+++ trunk/src/VBox/VMM/REMInternal.h	(revision 20421)
@@ -107,4 +107,6 @@
         uint64_t                padding[5];
     } u;
+    uint32_t                    idxSelf;
+    uint32_t                    idxNext;
 } REMHANDLERNOTIFICATION, *PREMHANDLERNOTIFICATION;
 
@@ -166,10 +168,10 @@
      * These instructions are replayed when entering REM. */
     RTGCPTR                 aGCPtrInvalidatedPages[48];
-    /** The number of recorded handler notifications. */
-    RTUINT volatile         cHandlerNotifications;
-    RTUINT                  padding0; /**< Padding. */
+
     /** Array of recorded handler noticications.
      * These are replayed when entering REM. */
     REMHANDLERNOTIFICATION  aHandlerNotifications[32];
+    volatile uint32_t       idxPendingList;
+    volatile uint32_t       idxFreeList;
 
     /** MMIO memory type.
@@ -211,9 +213,5 @@
     uint32_t                abPadding[HC_ARCH_BITS == 32 ? 6 : 4];
 
-#if GC_ARCH_BITS == 32
-# define REM_ENV_SIZE        (HC_ARCH_BITS == 32 ? 0xff00 : 0xff00)
-#else
-# define REM_ENV_SIZE        (HC_ARCH_BITS == 32 ? 0xff00 : 0xff00)
-#endif
+# define REM_ENV_SIZE       0xff00
 
     /** Recompiler CPU state. */
Index: trunk/src/VBox/VMM/VMMAll/REMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/REMAll.cpp	(revision 20410)
+++ trunk/src/VBox/VMM/VMMAll/REMAll.cpp	(revision 20421)
@@ -82,7 +82,50 @@
     AssertReleaseMsgFailed(("Ring 3 call????.\n"));
 #endif
-    Assert(pVM->rem.s.cHandlerNotifications == 0);
-}
-
+}
+
+
+/**
+ * Insert pending notification
+ *
+ * @param   pVM             VM Handle.
+ * @param   pRec            Notification record to insert
+ */
+static void remNotifyHandlerInsert(PVM pVM, PREMHANDLERNOTIFICATION pRec)
+{
+    uint32_t idxFree;
+    uint32_t idxNext;
+    PREMHANDLERNOTIFICATION pFree;
+
+    /* Fetch a free record. */
+    do
+    {
+        idxFree = pVM->rem.s.idxFreeList;
+        if (idxFree == -1)
+        {
+            pFree = NULL;
+            break;
+        }
+        pFree = &pVM->rem.s.aHandlerNotifications[idxFree];  
+    } while (!ASMAtomicCmpXchgU32(&pVM->rem.s.idxFreeList, pFree->idxNext, idxFree));
+
+    if (!pFree)
+    {
+        remFlushHandlerNotifications(pVM);
+        return;
+    }
+
+    /* Copy the record. */
+    *pFree = *pRec;
+    pFree->idxSelf = idxFree; /* was trashed */
+
+    /* Insert it into the pending list. */
+    do
+    {
+        idxNext = pVM->rem.s.idxPendingList;
+        pFree->idxNext = idxNext;
+    } while (!ASMAtomicCmpXchgU32(&pVM->rem.s.idxPendingList, idxFree, idxNext));
+
+    VM_FF_SET(pVM, VM_FF_REM_HANDLER_NOTIFY);
+}
 
 /**
@@ -97,13 +140,11 @@
 VMMDECL(void) REMNotifyHandlerPhysicalRegister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS cb, bool fHasHCHandler)
 {
-    if (pVM->rem.s.cHandlerNotifications >= RT_ELEMENTS(pVM->rem.s.aHandlerNotifications))
-        remFlushHandlerNotifications(pVM);
-    PREMHANDLERNOTIFICATION pRec = &pVM->rem.s.aHandlerNotifications[pVM->rem.s.cHandlerNotifications++];
-    pRec->enmKind = REMHANDLERNOTIFICATIONKIND_PHYSICAL_REGISTER;
-    pRec->u.PhysicalRegister.enmType = enmType;
-    pRec->u.PhysicalRegister.GCPhys = GCPhys;
-    pRec->u.PhysicalRegister.cb = cb;
-    pRec->u.PhysicalRegister.fHasHCHandler = fHasHCHandler;
-    VM_FF_SET(pVM, VM_FF_REM_HANDLER_NOTIFY);
+    REMHANDLERNOTIFICATION Rec;
+    Rec.enmKind = REMHANDLERNOTIFICATIONKIND_PHYSICAL_REGISTER;
+    Rec.u.PhysicalRegister.enmType = enmType;
+    Rec.u.PhysicalRegister.GCPhys = GCPhys;
+    Rec.u.PhysicalRegister.cb = cb;
+    Rec.u.PhysicalRegister.fHasHCHandler = fHasHCHandler;
+    remNotifyHandlerInsert(pVM, &Rec);
 }
 
@@ -121,14 +162,12 @@
 VMMDECL(void) REMNotifyHandlerPhysicalDeregister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS cb, bool fHasHCHandler, bool fRestoreAsRAM)
 {
-    if (pVM->rem.s.cHandlerNotifications >= RT_ELEMENTS(pVM->rem.s.aHandlerNotifications))
-        remFlushHandlerNotifications(pVM);
-    PREMHANDLERNOTIFICATION pRec = &pVM->rem.s.aHandlerNotifications[pVM->rem.s.cHandlerNotifications++];
-    pRec->enmKind = REMHANDLERNOTIFICATIONKIND_PHYSICAL_DEREGISTER;
-    pRec->u.PhysicalDeregister.enmType = enmType;
-    pRec->u.PhysicalDeregister.GCPhys = GCPhys;
-    pRec->u.PhysicalDeregister.cb = cb;
-    pRec->u.PhysicalDeregister.fHasHCHandler = fHasHCHandler;
-    pRec->u.PhysicalDeregister.fRestoreAsRAM = fRestoreAsRAM;
-    VM_FF_SET(pVM, VM_FF_REM_HANDLER_NOTIFY);
+    REMHANDLERNOTIFICATION Rec;
+    Rec.enmKind = REMHANDLERNOTIFICATIONKIND_PHYSICAL_DEREGISTER;
+    Rec.u.PhysicalDeregister.enmType = enmType;
+    Rec.u.PhysicalDeregister.GCPhys = GCPhys;
+    Rec.u.PhysicalDeregister.cb = cb;
+    Rec.u.PhysicalDeregister.fHasHCHandler = fHasHCHandler;
+    Rec.u.PhysicalDeregister.fRestoreAsRAM = fRestoreAsRAM;
+    remNotifyHandlerInsert(pVM, &Rec);
 }
 
@@ -147,15 +186,13 @@
 VMMDECL(void) REMNotifyHandlerPhysicalModify(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhysOld, RTGCPHYS GCPhysNew, RTGCPHYS cb, bool fHasHCHandler, bool fRestoreAsRAM)
 {
-    if (pVM->rem.s.cHandlerNotifications >= RT_ELEMENTS(pVM->rem.s.aHandlerNotifications))
-        remFlushHandlerNotifications(pVM);
-    PREMHANDLERNOTIFICATION pRec = &pVM->rem.s.aHandlerNotifications[pVM->rem.s.cHandlerNotifications++];
-    pRec->enmKind = REMHANDLERNOTIFICATIONKIND_PHYSICAL_MODIFY;
-    pRec->u.PhysicalModify.enmType = enmType;
-    pRec->u.PhysicalModify.GCPhysOld = GCPhysOld;
-    pRec->u.PhysicalModify.GCPhysNew = GCPhysNew;
-    pRec->u.PhysicalModify.cb = cb;
-    pRec->u.PhysicalModify.fHasHCHandler = fHasHCHandler;
-    pRec->u.PhysicalModify.fRestoreAsRAM = fRestoreAsRAM;
-    VM_FF_SET(pVM, VM_FF_REM_HANDLER_NOTIFY);
+    REMHANDLERNOTIFICATION Rec;
+    Rec.enmKind = REMHANDLERNOTIFICATIONKIND_PHYSICAL_MODIFY;
+    Rec.u.PhysicalModify.enmType = enmType;
+    Rec.u.PhysicalModify.GCPhysOld = GCPhysOld;
+    Rec.u.PhysicalModify.GCPhysNew = GCPhysNew;
+    Rec.u.PhysicalModify.cb = cb;
+    Rec.u.PhysicalModify.fHasHCHandler = fHasHCHandler;
+    Rec.u.PhysicalModify.fRestoreAsRAM = fRestoreAsRAM;
+    remNotifyHandlerInsert(pVM, &Rec);
 }
 
Index: trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 20410)
+++ trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 20421)
@@ -725,6 +725,7 @@
     GEN_CHECK_OFF(REM, cCanExecuteRaw);
     GEN_CHECK_OFF(REM, aGCPtrInvalidatedPages);
-    GEN_CHECK_OFF(REM, cHandlerNotifications);
+    GEN_CHECK_OFF(REM, idxPendingList);
     GEN_CHECK_OFF(REM, aHandlerNotifications);
+    GEN_CHECK_OFF(REM, idxFreeList);
     GEN_CHECK_OFF(REM, rc);
     GEN_CHECK_OFF(REM, StatsInQEMU);
