Index: /trunk/include/VBox/vmm/iem.h
===================================================================
--- /trunk/include/VBox/vmm/iem.h	(revision 61967)
+++ /trunk/include/VBox/vmm/iem.h	(revision 61968)
@@ -109,5 +109,5 @@
                                                                       const void *pvOpcodeBytes, size_t cbOpcodeBytes,
                                                                       uint32_t *pcbWritten);
-VMMDECL(VBOXSTRICTRC)       IEMExecLots(PVMCPU pVCpu);
+VMMDECL(VBOXSTRICTRC)       IEMExecLots(PVMCPU pVCpu, uint32_t *pcInstructions);
 VMMDECL(VBOXSTRICTRC)       IEMInjectTrpmEvent(PVMCPU pVCpu);
 VMM_INT_DECL(VBOXSTRICTRC)  IEMInjectTrap(PVMCPU pVCpu, uint8_t u8TrapNo, TRPMEVENT enmType, uint16_t uErrCode, RTGCPTR uCr2,
Index: /trunk/src/VBox/VMM/Makefile.kmk
===================================================================
--- /trunk/src/VBox/VMM/Makefile.kmk	(revision 61967)
+++ /trunk/src/VBox/VMM/Makefile.kmk	(revision 61968)
@@ -784,5 +784,5 @@
 # Always optimize the interpreter.
 #
-if $(USERNAME) != "bird" || "$(KBUILD_TYPE)" != "release" || "$(KBUILD_TARGET).$(KBUILD_TARGET_ARCH)" == "win.amd64"
+if $(USERNAME) != "bird" || "$(KBUILD_TYPE)" == "release" #|| "$(KBUILD_TARGET).$(KBUILD_TARGET_ARCH)" == "win.amd64"
  if1of ($(KBUILD_TARGET), win)
   # -noover is recognized despite the statement saying otherwise. It silences these warnings:
Index: /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 61967)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 61968)
@@ -896,4 +896,6 @@
  * Initializes the decoder state.
  *
+ * iemReInitDecoder is mostly a copy of this function.
+ *
  * @param   pIemCpu             The per CPU IEM state.
  * @param   fBypassHandlers     Whether to bypass access handlers.
@@ -974,4 +976,97 @@
 #endif
 }
+
+
+/**
+ * Reinitializes the decoder state 2nd+ loop of IEMExecLots.
+ *
+ * This is mostly a copy of iemInitDecoder.
+ *
+ * @param   pVCpu               The cross context virtual CPU structure of the calling EMT.
+ * @param   pIemCpu             The per CPU IEM state.
+ */
+DECLINLINE(void) iemReInitDecoder(PVMCPU pVCpu, PIEMCPU pIemCpu)
+{
+    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+
+    Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_IEM));
+
+#if defined(VBOX_STRICT) && (defined(IEM_VERIFICATION_MODE_FULL) || !defined(VBOX_WITH_RAW_MODE_NOT_R0))
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->cs));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->es));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ds));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->fs));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->gs));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ldtr));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->tr));
+#endif
+
+    pIemCpu->uCpl               = CPUMGetGuestCPL(pVCpu);   /** @todo this should be updated during execution! */
+#ifdef IEM_VERIFICATION_MODE_FULL
+    if (pIemCpu->uInjectCpl != UINT8_MAX)
+        pIemCpu->uCpl           = pIemCpu->uInjectCpl;
+#endif
+    IEMMODE enmMode = iemCalcCpuMode(pCtx);
+    pIemCpu->enmCpuMode         = enmMode;                  /** @todo this should be updated during execution! */
+    pIemCpu->enmDefAddrMode     = enmMode;  /** @todo check if this is correct... */
+    pIemCpu->enmEffAddrMode     = enmMode;
+    if (enmMode != IEMMODE_64BIT)
+    {
+        pIemCpu->enmDefOpSize   = enmMode;  /** @todo check if this is correct... */
+        pIemCpu->enmEffOpSize   = enmMode;
+    }
+    else
+    {
+        pIemCpu->enmDefOpSize   = IEMMODE_32BIT;
+        pIemCpu->enmEffOpSize   = IEMMODE_32BIT;
+    }
+    pIemCpu->fPrefixes          = 0;
+    pIemCpu->uRexReg            = 0;
+    pIemCpu->uRexB              = 0;
+    pIemCpu->uRexIndex          = 0;
+    pIemCpu->iEffSeg            = X86_SREG_DS;
+    if (pIemCpu->cbOpcode > pIemCpu->offOpcode) /* No need to check RIP here because branch instructions will update cbOpcode.  */
+    {
+        pIemCpu->cbOpcode      -= pIemCpu->offOpcode;
+        memmove(&pIemCpu->abOpcode[0], &pIemCpu->abOpcode[pIemCpu->offOpcode], pIemCpu->cbOpcode);
+    }
+    else
+        pIemCpu->cbOpcode       = 0;
+    pIemCpu->offOpcode          = 0;
+    Assert(pIemCpu->cActiveMappings == 0);
+    pIemCpu->iNextMapping       = 0;
+    Assert(pIemCpu->rcPassUp   == VINF_SUCCESS);
+    Assert(pIemCpu->fBypassHandlers == false);
+#ifdef VBOX_WITH_RAW_MODE_NOT_R0
+    if (!pIemCpu->fInPatchCode)
+    { /* likely */ }
+    else
+    {
+        pIemCpu->fInPatchCode   = pIemCpu->uCpl == 0
+                               && pCtx->cs.u64Base == 0
+                               && pCtx->cs.u32Limit == UINT32_MAX
+                               && PATMIsPatchGCAddr(IEMCPU_TO_VM(pIemCpu), pCtx->eip);
+        if (!pIemCpu->fInPatchCode)
+            CPUMRawLeave(pVCpu, VINF_SUCCESS);
+    }
+#endif
+
+#ifdef DBGFTRACE_ENABLED
+    switch (enmMode)
+    {
+        case IEMMODE_64BIT:
+            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I64/%u %08llx", pIemCpu->uCpl, pCtx->rip);
+            break;
+        case IEMMODE_32BIT:
+            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I32/%u %04x:%08x", pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip);
+            break;
+        case IEMMODE_16BIT:
+            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I16/%u %04x:%04x", pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip);
+            break;
+    }
+#endif
+}
+
 
 
@@ -1753,5 +1848,5 @@
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U16_ZX_U32(a_pu32) (*(a_pu32) = (int16_t)iemOpcodeGetNextU16Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_U16_ZX_U32(a_pu32) (*(a_pu32) = iemOpcodeGetNextU16Jmp(pIemCpu))
 #endif
 
@@ -1816,5 +1911,5 @@
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U16_ZX_U64(a_pu64)  (*(a_pu64) = (int16_t)iemOpcodeGetNextU16Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_U16_ZX_U64(a_pu64)  (*(a_pu64) = iemOpcodeGetNextU16Jmp(pIemCpu))
 #endif
 
@@ -2035,5 +2130,5 @@
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U32_ZX_U64(a_pu64) (*(a_pu64) = (int32_t)iemOpcodeGetNextU32Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_U32_ZX_U64(a_pu64) (*(a_pu64) = iemOpcodeGetNextU32Jmp(pIemCpu))
 #endif
 
@@ -4270,4 +4365,9 @@
 
     /*
+     * Flush prefetch buffer
+     */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
+    /*
      * Perform the V8086 IOPL check and upgrade the fault without nesting.
      */
@@ -4374,4 +4474,7 @@
     else
         rcStrict = iemRaiseXcptOrIntInProtMode( pIemCpu, pCtx, cbInstr, u8Vector, fFlags, uErr, uCr2);
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
 
     /*
@@ -5091,4 +5194,8 @@
 
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -5118,4 +5225,7 @@
     pCtx->eflags.Bits.u1RF = 0;
 
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -5156,4 +5266,8 @@
     }
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -5211,4 +5325,8 @@
 
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -9421,5 +9539,4 @@
 #define IEM_MC_SET_RIP_U32(a_u32NewIP)                  IEM_MC_RETURN_ON_FAILURE(iemRegRipJump((pIemCpu), (a_u32NewIP)))
 #define IEM_MC_SET_RIP_U64(a_u64NewIP)                  IEM_MC_RETURN_ON_FAILURE(iemRegRipJump((pIemCpu), (a_u64NewIP)))
-
 #define IEM_MC_RAISE_DIVIDE_ERROR()                     return iemRaiseDivideError(pIemCpu)
 #define IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE()       \
@@ -12367,4 +12484,6 @@
  * IEMExecOneWithPrefetchedByPC.
  *
+ * Similar code is found in IEMExecLots.
+ *
  * @return  Strict VBox status code.
  * @param   pVCpu       The cross context virtual CPU structure of the calling EMT.
@@ -12385,4 +12504,6 @@
         rcStrict = FNIEMOP_CALL(g_apfnOneByteMap[b]);
     }
+    else
+        pIemCpu->cLongJumps++;
     pIemCpu->CTX_SUFF(pJmpBuf) = pSavedJmpBuf;
 #else
@@ -12393,5 +12514,8 @@
         pIemCpu->cInstructions++;
     if (pIemCpu->cActiveMappings > 0)
+    {
+        Assert(rcStrict != VINF_SUCCESS);
         iemMemRollback(pIemCpu);
+    }
 //#ifdef DEBUG
 //    AssertMsg(pIemCpu->offOpcode == cbInstr || rcStrict != VINF_SUCCESS, ("%u %u\n", pIemCpu->offOpcode, cbInstr));
@@ -12418,4 +12542,6 @@
                 rcStrict = FNIEMOP_CALL(g_apfnOneByteMap[b]);
             }
+            else
+                pIemCpu->cLongJumps++;
             pIemCpu->CTX_SUFF(pJmpBuf) = pSavedJmpBuf;
 #else
@@ -12426,5 +12552,8 @@
                 pIemCpu->cInstructions++;
             if (pIemCpu->cActiveMappings > 0)
+            {
+                Assert(rcStrict != VINF_SUCCESS);
                 iemMemRollback(pIemCpu);
+            }
         }
         EMSetInhibitInterruptsPC(pVCpu, UINT64_C(0x7777555533331111));
@@ -12671,12 +12800,13 @@
 
 
-VMMDECL(VBOXSTRICTRC) IEMExecLots(PVMCPU pVCpu)
-{
-    PIEMCPU  pIemCpu = &pVCpu->iem.s;
-
+VMMDECL(VBOXSTRICTRC) IEMExecLots(PVMCPU pVCpu, uint32_t *pcInstructions)
+{
+    PIEMCPU         pIemCpu              = &pVCpu->iem.s;
+    uint32_t const  cInstructionsAtStart = pIemCpu->cInstructions;
+
+#if defined(IEM_VERIFICATION_MODE_FULL) && defined(IN_RING3)
     /*
-     * See if there is an interrupt pending in TRPM and inject it if we can.
+     * See if there is an interrupt pending in TRPM, inject it if we can.
      */
-#if !defined(IEM_VERIFICATION_MODE_FULL) || !defined(IN_RING3)
     PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
 # ifdef IEM_VERIFICATION_MODE_FULL
@@ -12696,15 +12826,11 @@
             TRPMResetTrap(pVCpu);
     }
-#else
-    iemExecVerificationModeSetup(pIemCpu);
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-#endif
 
     /*
      * Log the state.
      */
-#ifdef LOG_ENABLED
+# ifdef LOG_ENABLED
     iemLogCurInstr(pVCpu, pCtx, true);
-#endif
+# endif
 
     /*
@@ -12715,21 +12841,131 @@
         rcStrict = iemExecOneInner(pVCpu, pIemCpu, true);
 
-#if defined(IEM_VERIFICATION_MODE_FULL) && defined(IN_RING3)
     /*
      * Assert some sanity.
      */
     rcStrict = iemExecVerificationModeCheck(pIemCpu, rcStrict);
-#endif
+
+    /*
+     * Log and return.
+     */
+    if (rcStrict != VINF_SUCCESS)
+        LogFlow(("IEMExecLots: cs:rip=%04x:%08RX64 ss:rsp=%04x:%08RX64 EFL=%06x - rcStrict=%Rrc\n",
+                 pCtx->cs.Sel, pCtx->rip, pCtx->ss.Sel, pCtx->rsp, pCtx->eflags.u, VBOXSTRICTRC_VAL(rcStrict)));
+    if (pcInstructions)
+        *pcInstructions = pIemCpu->cInstructions - cInstructionsAtStart;
+    return rcStrict;
+
+#else  /* Not verification mode */
+
+    /*
+     * See if there is an interrupt pending in TRPM, inject it if we can.
+     */
+    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+# ifdef IEM_VERIFICATION_MODE_FULL
+    pIemCpu->uInjectCpl = UINT8_MAX;
+# endif
+    if (   pCtx->eflags.Bits.u1IF
+        && TRPMHasTrap(pVCpu)
+        && EMGetInhibitInterruptsPC(pVCpu) != pCtx->rip)
+    {
+        uint8_t     u8TrapNo;
+        TRPMEVENT   enmType;
+        RTGCUINT    uErrCode;
+        RTGCPTR     uCr2;
+        int rc2 = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrCode, &uCr2, NULL /* pu8InstLen */); AssertRC(rc2);
+        IEMInjectTrap(pVCpu, u8TrapNo, enmType, (uint16_t)uErrCode, uCr2, 0 /* cbInstr */);
+        if (!IEM_VERIFICATION_ENABLED(pIemCpu))
+            TRPMResetTrap(pVCpu);
+    }
+
+    /*
+     * Initial decoder init w/ prefetch, then setup setjmp.
+     */
+    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, false);
+    if (rcStrict == VINF_SUCCESS)
+    {
+# ifdef IEM_WITH_SETJMP
+        jmp_buf         JmpBuf;
+        jmp_buf        *pSavedJmpBuf = pIemCpu->CTX_SUFF(pJmpBuf);
+        pIemCpu->CTX_SUFF(pJmpBuf)   = &JmpBuf;
+        pIemCpu->cActiveMappings     = 0;
+        if ((rcStrict = setjmp(JmpBuf)) == 0)
+# endif
+        {
+            /*
+             * The run loop.  We limit ourselves to 2048 instructions right now.
+             */
+            PVM         pVM    = pVCpu->CTX_SUFF(pVM);
+            uint32_t    cInstr = 2048;
+            for (;;)
+            {
+                /*
+                 * Log the state.
+                 */
+# ifdef LOG_ENABLED
+                iemLogCurInstr(pVCpu, pCtx, true);
+# endif
+
+                /*
+                 * Do the decoding and emulation.
+                 */
+                uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
+                rcStrict = FNIEMOP_CALL(g_apfnOneByteMap[b]);
+                if (RT_LIKELY(rcStrict == VINF_SUCCESS))
+                {
+                    Assert(pIemCpu->cActiveMappings == 0);
+                    pIemCpu->cInstructions++;
+                    if (RT_LIKELY(pIemCpu->rcPassUp == VINF_SUCCESS))
+                    {
+                        if (RT_LIKELY(   !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_ALL_MASK & ~VMCPU_FF_INHIBIT_INTERRUPTS)
+                                      && !VM_FF_IS_PENDING(pVM, VM_FF_ALL_MASK)
+                                      && cInstr-- > 0 ))
+                        {
+                            iemReInitDecoder(pVCpu, pIemCpu);
+                            continue;
+                        }
+                    }
+                }
+                else if (pIemCpu->cActiveMappings > 0) /** @todo This should only happen when rcStrict != VINF_SUCCESS! */
+                    iemMemRollback(pIemCpu);
+                rcStrict = iemExecStatusCodeFiddling(pIemCpu, rcStrict);
+                break;
+            }
+        }
+# ifdef IEM_WITH_SETJMP
+        else
+        {
+            if (pIemCpu->cActiveMappings > 0)
+                iemMemRollback(pIemCpu);
+            pIemCpu->cLongJumps++;
+        }
+# endif
+
+        /*
+         * Assert hidden register sanity (also done in iemInitDecoder and iemReInitDecoder).
+         */
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->cs));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->ss));
+# if defined(IEM_VERIFICATION_MODE_FULL)
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->es));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->ds));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->fs));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->gs));
+# endif
+    }
 
     /*
      * Maybe re-enter raw-mode and log.
      */
-#ifdef IN_RC
+# ifdef IN_RC
     rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pIemCpu->CTX_SUFF(pCtx), rcStrict);
-#endif
+# endif
     if (rcStrict != VINF_SUCCESS)
         LogFlow(("IEMExecLots: cs:rip=%04x:%08RX64 ss:rsp=%04x:%08RX64 EFL=%06x - rcStrict=%Rrc\n",
                  pCtx->cs.Sel, pCtx->rip, pCtx->ss.Sel, pCtx->rsp, pCtx->eflags.u, VBOXSTRICTRC_VAL(rcStrict)));
+    if (pcInstructions)
+        *pcInstructions = pIemCpu->cInstructions - cInstructionsAtStart;
     return rcStrict;
+#endif /* Not verification mode */
 }
 
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 61967)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 61968)
@@ -759,4 +759,7 @@
     pCtx->rip = uNewPC;
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
     return VINF_SUCCESS;
 }
@@ -782,4 +785,7 @@
     pCtx->rip = uNewPC;
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
     return VINF_SUCCESS;
 }
@@ -823,4 +829,7 @@
     pCtx->rip = uNewPC;
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
     return VINF_SUCCESS;
 }
@@ -846,4 +855,7 @@
     pCtx->rip = uNewPC;
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
     return VINF_SUCCESS;
 }
@@ -870,4 +882,7 @@
     pCtx->rip = uNewPC;
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
     return VINF_SUCCESS;
 }
@@ -893,4 +908,8 @@
     pCtx->rip = uNewPC;
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -1625,4 +1644,7 @@
     }
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
     return VINF_SUCCESS;
 #endif
@@ -1847,4 +1869,8 @@
     /** @todo check if the hidden bits are loaded correctly for 64-bit
      *        mode.  */
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -2066,4 +2092,8 @@
     /** @todo check if the hidden bits are loaded correctly for 64-bit
      *        mode.  */
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -2466,4 +2496,7 @@
         pCtx->eflags.Bits.u1RF = 0;
     }
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
     return VINF_SUCCESS;
 }
@@ -2536,4 +2569,7 @@
     pCtx->rsp = NewRsp.u;
     pCtx->eflags.Bits.u1RF = 0;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
 
     return VINF_SUCCESS;
@@ -2857,4 +2893,7 @@
     IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
 
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -2932,4 +2971,7 @@
     pCtx->rsp      = uNewEsp; /** @todo check this out! */
     pIemCpu->uCpl  = 3;
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
 
     return VINF_SUCCESS;
@@ -3364,4 +3406,8 @@
         /* Done! */
     }
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -3661,4 +3707,7 @@
     }
 
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -3785,4 +3834,7 @@
     pCtx->ss.fFlags     = CPUMSELREG_FLAGS_VALID;
 
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+
     return VINF_SUCCESS;
 }
@@ -3885,4 +3937,7 @@
     /** @todo Testcase: verify that SS.u1Long and SS.u1DefBig are left unchanged
      *        on sysret. */
+
+    /* Flush the prefetch buffer. */
+    pIemCpu->cbOpcode = pIemCpu->offOpcode;
 
     return VINF_SUCCESS;
Index: /trunk/src/VBox/VMM/VMMR3/EM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/EM.cpp	(revision 61967)
+++ /trunk/src/VBox/VMM/VMMR3/EM.cpp	(revision 61968)
@@ -1145,5 +1145,5 @@
             rc = REMR3Run(pVM, pVCpu);
 #else
-            rc = VBOXSTRICTRC_TODO(IEMExecLots(pVCpu));
+            rc = VBOXSTRICTRC_TODO(IEMExecLots(pVCpu, NULL /*pcInstructions*/));
 #endif
             STAM_PROFILE_STOP(&pVCpu->em.s.StatREMExec, c);
@@ -1298,5 +1298,7 @@
     while (pVCpu->em.s.cIemThenRemInstructions < 1024)
     {
-        VBOXSTRICTRC rcStrict = IEMExecLots(pVCpu);
+        uint32_t     cInstructions;
+        VBOXSTRICTRC rcStrict = IEMExecLots(pVCpu, &cInstructions);
+        pVCpu->em.s.cIemThenRemInstructions += cInstructions;
         if (rcStrict != VINF_SUCCESS)
         {
@@ -1305,10 +1307,8 @@
                 break;
 
-            pVCpu->em.s.cIemThenRemInstructions++;
             Log(("emR3ExecuteIemThenRem: returns %Rrc after %u instructions\n",
                  VBOXSTRICTRC_VAL(rcStrict), pVCpu->em.s.cIemThenRemInstructions));
             return rcStrict;
         }
-        pVCpu->em.s.cIemThenRemInstructions++;
 
         EMSTATE enmNewState = emR3Reschedule(pVM, pVCpu, pVCpu->em.s.pCtx);
@@ -2544,5 +2544,5 @@
                     else if (rc == VERR_EM_CANNOT_EXEC_GUEST)
 #endif
-                        rc = VBOXSTRICTRC_TODO(IEMExecLots(pVCpu));
+                        rc = VBOXSTRICTRC_TODO(IEMExecLots(pVCpu, NULL /*pcInstructions*/));
                     if (pVM->em.s.fIemExecutesAll)
                     {
Index: /trunk/src/VBox/VMM/VMMR3/IEMR3.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/IEMR3.cpp	(revision 61967)
+++ /trunk/src/VBox/VMM/VMMR3/IEMR3.cpp	(revision 61968)
@@ -71,4 +71,6 @@
         STAMR3RegisterF(pVM, &pVCpu->iem.s.cInstructions,             STAMTYPE_U32,       STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
                         "Instructions interpreted",          "/IEM/CPU%u/cInstructions", idCpu);
+        STAMR3RegisterF(pVM, &pVCpu->iem.s.cLongJumps,                STAMTYPE_U32,       STAMVISIBILITY_ALWAYS, STAMUNIT_BYTES,
+                        "Number of longjmp calls",           "/IEM/CPU%u/cLongJumps", idCpu);
         STAMR3RegisterF(pVM, &pVCpu->iem.s.cPotentialExits,           STAMTYPE_U32,       STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
                         "Potential exits",                   "/IEM/CPU%u/cPotentialExits", idCpu);
Index: /trunk/src/VBox/VMM/include/IEMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/IEMInternal.h	(revision 61967)
+++ /trunk/src/VBox/VMM/include/IEMInternal.h	(revision 61968)
@@ -297,4 +297,7 @@
     /** Number of times RZ left with instruction commit pending for ring-3. */
     uint32_t                cPendingCommit;
+    /** Number of long jumps. */
+    uint32_t                cLongJumps;
+    uint32_t                uPadding; /**< Alignment padding. */
 #ifdef IEM_VERIFICATION_MODE_FULL
     /** The Number of I/O port reads that has been performed. */
Index: /trunk/src/VBox/VMM/include/PGMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/PGMInternal.h	(revision 61967)
+++ /trunk/src/VBox/VMM/include/PGMInternal.h	(revision 61968)
@@ -1780,5 +1780,5 @@
 
 /**
- * Ring-3 tracking structore for an allocation chunk ring-3 mapping.
+ * Ring-3 tracking structure for an allocation chunk ring-3 mapping.
  *
  * The primary tree (Core) uses the chunk id as key.
