Index: /trunk/src/VBox/VMM/VMMR3/NEMR3Native-linux.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/NEMR3Native-linux.cpp	(revision 92521)
+++ /trunk/src/VBox/VMM/VMMR3/NEMR3Native-linux.cpp	(revision 92522)
@@ -534,4 +534,5 @@
                         STAMR3RegisterF(pVM, &pNemCpu->StatImportPendingInterrupt, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of times an interrupt was pending when importing from KVM", "/NEM/CPU%u/ImportPendingInterrupt", idCpu);
                         STAMR3RegisterF(pVM, &pNemCpu->StatExportPendingInterrupt, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of times an interrupt was pending when exporting to KVM", "/NEM/CPU%u/ExportPendingInterrupt", idCpu);
+                        STAMR3RegisterF(pVM, &pNemCpu->StatFlushExitOnReturn,   STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of times a KVM_EXIT_IO or KVM_EXIT_MMIO was flushed before returning to EM", "/NEM/CPU%u/FlushExitOnReturn", idCpu);
                         STAMR3RegisterF(pVM, &pNemCpu->StatQueryCpuTick,        STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of TSC queries",                  "/NEM/CPU%u/QueryCpuTick", idCpu);
                         STAMR3RegisterF(pVM, &pNemCpu->StatExitTotal,           STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "All exits",                  "/NEM/CPU%u/Exit", idCpu);
@@ -2247,5 +2248,5 @@
 
 
-static VBOXSTRICTRC nemHCLnxHandleExit(PVMCC pVM, PVMCPUCC pVCpu, struct kvm_run *pRun)
+static VBOXSTRICTRC nemHCLnxHandleExit(PVMCC pVM, PVMCPUCC pVCpu, struct kvm_run *pRun, bool *pfStatefulExit)
 {
     STAM_REL_COUNTER_INC(&pVCpu->nem.s.StatExitTotal);
@@ -2258,8 +2259,10 @@
         case KVM_EXIT_IO:
             STAM_REL_COUNTER_INC(&pVCpu->nem.s.StatExitIo);
+            *pfStatefulExit = true;
             return nemHCLnxHandleExitIo(pVM, pVCpu, pRun);
 
         case KVM_EXIT_MMIO:
             STAM_REL_COUNTER_INC(&pVCpu->nem.s.StatExitMmio);
+            *pfStatefulExit = true;
             return nemHCLnxHandleExitMmio(pVM, pVCpu, pRun);
 
@@ -2411,4 +2414,5 @@
     const bool              fSingleStepping     = DBGFIsStepping(pVCpu);
     VBOXSTRICTRC            rcStrict            = VINF_SUCCESS;
+    bool                    fStatefulExit       = false;  /* For MMIO and IO exits. */
     for (unsigned iLoop = 0;; iLoop++)
     {
@@ -2491,10 +2495,11 @@
                 }
 #endif
+                fStatefulExit = false;
                 if (RT_LIKELY(rcLnx == 0 || errno == EINTR))
                 {
                     /*
-                     * Deal with the message.
+                     * Deal with the exit.
                      */
-                    rcStrict = nemHCLnxHandleExit(pVM, pVCpu, pRun);
+                    rcStrict = nemHCLnxHandleExit(pVM, pVCpu, pRun, &fStatefulExit);
                     if (rcStrict == VINF_SUCCESS)
                     { /* hopefully likely */ }
@@ -2539,4 +2544,19 @@
     } /* the run loop */
 
+
+    /*
+     * If the last exit was stateful, commit the state we provided before
+     * returning to the EM loop so we have a consistent state and can safely
+     * be rescheduled and whatnot.  (There is no 'ing way to reset the kernel
+     * side completion callback for these stateful i/o exits.)
+     */
+    if (fStatefulExit)
+    {
+        pRun->immediate_exit = 1;
+        int rcLnx = ioctl(pVCpu->nem.s.fdVCpu, KVM_RUN, 0UL);
+        pRun->immediate_exit = 0;
+        Log(("NEM/%u: Flushed stateful exit -> %d/%d exit_reason=%d\n", pVCpu->idCpu, rcLnx, errno, pRun->exit_reason));
+        STAM_REL_COUNTER_INC(&pVCpu->nem.s.StatFlushExitOnReturn);
+    }
 
     /*
Index: /trunk/src/VBox/VMM/include/NEMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/NEMInternal.h	(revision 92521)
+++ /trunk/src/VBox/VMM/include/NEMInternal.h	(revision 92522)
@@ -368,4 +368,5 @@
     STAMCOUNTER                 StatBreakOnFFPost;
     STAMCOUNTER                 StatBreakOnStatus;
+    STAMCOUNTER                 StatFlushExitOnReturn;
     STAMCOUNTER                 StatImportOnDemand;
     STAMCOUNTER                 StatImportOnReturn;