Index: trunk/src/VBox/VMM/include/IEMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMInternal.h	(revision 101958)
+++ trunk/src/VBox/VMM/include/IEMInternal.h	(revision 101984)
@@ -619,7 +619,13 @@
 /** Force end of TB after the instruction. */
 #define IEM_CIMPL_F_END_TB              RT_BIT_32(15)
+/** Flag set if a branch may also modify the stack (push/pop return address). */
+#define IEM_CIMPL_F_BRANCH_STACK        RT_BIT_32(16)
+/** Flag set if a branch may also modify the stack (push/pop return address)
+ *  and switch it (load/restore SS:RSP). */
+#define IEM_CIMPL_F_BRANCH_STACK_FAR    RT_BIT_32(17)
 /** Convenience: Raise exception (technically unnecessary, since it shouldn't return VINF_SUCCESS). */
 #define IEM_CIMPL_F_XCPT \
-    (IEM_CIMPL_F_BRANCH_INDIRECT | IEM_CIMPL_F_BRANCH_FAR | IEM_CIMPL_F_MODE | IEM_CIMPL_F_RFLAGS | IEM_CIMPL_F_VMEXIT)
+    (IEM_CIMPL_F_BRANCH_INDIRECT | IEM_CIMPL_F_BRANCH_FAR | IEM_CIMPL_F_BRANCH_STACK_FAR \
+     | IEM_CIMPL_F_MODE | IEM_CIMPL_F_RFLAGS | IEM_CIMPL_F_VMEXIT)
 
 /** The block calls a C-implementation instruction function with two implicit arguments.
@@ -627,15 +633,15 @@
  * IEM_CIMPL_F_CALLS_AIMPL_WITH_FXSTATE.
  * @note The python scripts will add this is missing.  */
-#define IEM_CIMPL_F_CALLS_CIMPL                 RT_BIT_32(16)
+#define IEM_CIMPL_F_CALLS_CIMPL                 RT_BIT_32(18)
 /** The block calls an ASM-implementation instruction function.
  * Mutually exclusive with IEM_CIMPL_F_CALLS_CIMPL and
  * IEM_CIMPL_F_CALLS_AIMPL_WITH_FXSTATE.
  * @note The python scripts will add this is missing.  */
-#define IEM_CIMPL_F_CALLS_AIMPL                 RT_BIT_32(17)
+#define IEM_CIMPL_F_CALLS_AIMPL                 RT_BIT_32(19)
 /** The block calls an ASM-implementation instruction function with an implicit
  * X86FXSTATE pointer argument.
  * Mutually exclusive with IEM_CIMPL_F_CALLS_CIMPL and IEM_CIMPL_F_CALLS_AIMPL.
  * @note The python scripts will add this is missing.  */
-#define IEM_CIMPL_F_CALLS_AIMPL_WITH_FXSTATE    RT_BIT_32(18)
+#define IEM_CIMPL_F_CALLS_AIMPL_WITH_FXSTATE    RT_BIT_32(20)
 /** @} */
 
@@ -1305,5 +1311,5 @@
 /** @name IEMBRANCHED_F_XXX - Branched indicator (IEMCPU::fTbBranched).
  *
- * These flags parallels IEM_CIMPL_F_BRANCH_XXX.
+ * These flags parallels the main IEM_CIMPL_F_BRANCH_XXX flags.
  *
  * @{ */
@@ -1320,6 +1326,10 @@
 /** Flag set if it's a far branch. */
 #define IEMBRANCHED_F_FAR           UINT8_C(0x10)
+/** Flag set if the stack pointer is modified. */
+#define IEMBRANCHED_F_STACK         UINT8_C(0x20)
+/** Flag set if the stack pointer and (maybe) the stack segment are modified. */
+#define IEMBRANCHED_F_STACK_FAR     UINT8_C(0x40)
 /** Flag set (by IEM_MC_REL_JMP_XXX) if it's a zero bytes relative jump. */
-#define IEMBRANCHED_F_ZERO          UINT8_C(0x20)
+#define IEMBRANCHED_F_ZERO          UINT8_C(0x80)
 /** @} */
 
@@ -4920,5 +4930,5 @@
  * @return  Strict VBox status code.
  */
-#define IEMOP_RAISE_DIVIDE_ERROR_RET()      IEM_MC_DEFER_TO_CIMPL_0_RET(IEM_CIMPL_F_XCPT, iemCImplRaiseDivideError)
+#define IEMOP_RAISE_DIVIDE_ERROR_RET()          IEM_MC_DEFER_TO_CIMPL_0_RET(IEM_CIMPL_F_XCPT, 0, iemCImplRaiseDivideError)
 
 /**
@@ -4930,5 +4940,5 @@
  * @return  Strict VBox status code.
  */
-#define IEMOP_RAISE_INVALID_LOCK_PREFIX_RET() IEM_MC_DEFER_TO_CIMPL_0_RET(IEM_CIMPL_F_XCPT, iemCImplRaiseInvalidLockPrefix)
+#define IEMOP_RAISE_INVALID_LOCK_PREFIX_RET()   IEM_MC_DEFER_TO_CIMPL_0_RET(IEM_CIMPL_F_XCPT, 0, iemCImplRaiseInvalidLockPrefix)
 
 /**
@@ -4940,5 +4950,5 @@
  * @return  Strict VBox status code.
  */
-#define IEMOP_RAISE_INVALID_OPCODE_RET()    IEM_MC_DEFER_TO_CIMPL_0_RET(IEM_CIMPL_F_XCPT, iemCImplRaiseInvalidOpcode)
+#define IEMOP_RAISE_INVALID_OPCODE_RET()        IEM_MC_DEFER_TO_CIMPL_0_RET(IEM_CIMPL_F_XCPT, 0, iemCImplRaiseInvalidOpcode)
 
 /**
@@ -4951,5 +4961,5 @@
  * @see     IEMOP_RAISE_INVALID_OPCODE_RET
  */
-#define IEMOP_RAISE_INVALID_OPCODE_RUNTIME_RET()   IEM_MC_DEFER_TO_CIMPL_0_RET(IEM_CIMPL_F_XCPT, iemCImplRaiseInvalidOpcode)
+#define IEMOP_RAISE_INVALID_OPCODE_RUNTIME_RET() IEM_MC_DEFER_TO_CIMPL_0_RET(IEM_CIMPL_F_XCPT, 0, iemCImplRaiseInvalidOpcode)
 
 /** @} */
Index: trunk/src/VBox/VMM/include/IEMMc.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMMc.h	(revision 101958)
+++ trunk/src/VBox/VMM/include/IEMMc.h	(revision 101984)
@@ -2101,8 +2101,10 @@
  *
  * @param   a_fFlags        IEM_CIMPL_F_XXX.
+ * @param   a_fGstShwFlush  Guest shadow register copies needing to be flushed
+ *                          in the native recompiler.
  * @param   a_pfnCImpl      The pointer to the C routine.
  * @sa      IEM_DECL_IMPL_C_TYPE_0 and IEM_CIMPL_DEF_0.
  */
-#define IEM_MC_DEFER_TO_CIMPL_0_RET(a_fFlags, a_pfnCImpl) \
+#define IEM_MC_DEFER_TO_CIMPL_0_RET(a_fFlags, a_fGstShwFlush, a_pfnCImpl) \
     IEM_MC_CALL_CIMPL_HLP_RET(a_fFlags, (a_pfnCImpl)(pVCpu, IEM_GET_INSTR_LEN(pVCpu)))
 
@@ -2114,8 +2116,10 @@
  *
  * @param   a_fFlags        IEM_CIMPL_F_XXX.
+ * @param   a_fGstShwFlush  Guest shadow register copies needing to be flushed
+ *                          in the native recompiler.
  * @param   a_pfnCImpl      The pointer to the C routine.
  * @param   a0              The argument.
  */
-#define IEM_MC_DEFER_TO_CIMPL_1_RET(a_fFlags, a_pfnCImpl, a0) \
+#define IEM_MC_DEFER_TO_CIMPL_1_RET(a_fFlags, a_fGstShwFlush, a_pfnCImpl, a0) \
     IEM_MC_CALL_CIMPL_HLP_RET(a_fFlags, (a_pfnCImpl)(pVCpu, IEM_GET_INSTR_LEN(pVCpu), a0))
 
@@ -2127,9 +2131,11 @@
  *
  * @param   a_fFlags        IEM_CIMPL_F_XXX.
+ * @param   a_fGstShwFlush  Guest shadow register copies needing to be flushed
+ *                          in the native recompiler.
  * @param   a_pfnCImpl      The pointer to the C routine.
  * @param   a0              The first extra argument.
  * @param   a1              The second extra argument.
  */
-#define IEM_MC_DEFER_TO_CIMPL_2_RET(a_fFlags, a_pfnCImpl, a0, a1) \
+#define IEM_MC_DEFER_TO_CIMPL_2_RET(a_fFlags, a_fGstShwFlush, a_pfnCImpl, a0, a1) \
     IEM_MC_CALL_CIMPL_HLP_RET(a_fFlags, (a_pfnCImpl)(pVCpu, IEM_GET_INSTR_LEN(pVCpu), a0, a1))
 
@@ -2141,4 +2147,6 @@
  *
  * @param   a_fFlags        IEM_CIMPL_F_XXX.
+ * @param   a_fGstShwFlush  Guest shadow register copies needing to be flushed
+ *                          in the native recompiler.
  * @param   a_pfnCImpl      The pointer to the C routine.
  * @param   a0              The first extra argument.
@@ -2146,5 +2154,5 @@
  * @param   a2              The third extra argument.
  */
-#define IEM_MC_DEFER_TO_CIMPL_3_RET(a_fFlags, a_pfnCImpl, a0, a1, a2) \
+#define IEM_MC_DEFER_TO_CIMPL_3_RET(a_fFlags, a_fGstShwFlush, a_pfnCImpl, a0, a1, a2) \
     IEM_MC_CALL_CIMPL_HLP_RET(a_fFlags, (a_pfnCImpl)(pVCpu, IEM_GET_INSTR_LEN(pVCpu), a0, a1, a2))
 
Index: trunk/src/VBox/VMM/include/IEMN8veRecompiler.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMN8veRecompiler.h	(revision 101958)
+++ trunk/src/VBox/VMM/include/IEMN8veRecompiler.h	(revision 101984)
@@ -348,14 +348,13 @@
 {
     kIemNativeGstReg_GprFirst      = 0,
-    kIemNativeGstReg_GprLast       = 15,
+    kIemNativeGstReg_GprLast       = kIemNativeGstReg_GprFirst + 15,
     kIemNativeGstReg_Pc,
-    kIemNativeGstReg_EFlags,            /**< This one is problematic since the higher bits are used internally. */
-    /* gap: 18..23 */
-    kIemNativeGstReg_SegSelFirst   = 24,
-    kIemNativeGstReg_SegSelLast    = 29,
-    kIemNativeGstReg_SegBaseFirst  = 30,
-    kIemNativeGstReg_SegBaseLast   = 35,
-    kIemNativeGstReg_SegLimitFirst = 36,
-    kIemNativeGstReg_SegLimitLast  = 41,
+    kIemNativeGstReg_EFlags,            /**< 32-bit, includes internal flags.  */
+    kIemNativeGstReg_SegSelFirst,
+    kIemNativeGstReg_SegSelLast    = kIemNativeGstReg_SegSelFirst + 5,
+    kIemNativeGstReg_SegBaseFirst,
+    kIemNativeGstReg_SegBaseLast   = kIemNativeGstReg_SegBaseFirst + 5,
+    kIemNativeGstReg_SegLimitFirst,
+    kIemNativeGstReg_SegLimitLast  = kIemNativeGstReg_SegLimitFirst + 5,
     kIemNativeGstReg_End
 } IEMNATIVEGSTREG;
