Index: trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 36820)
+++ trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 36821)
@@ -45,6 +45,6 @@
 *   Header Files                                                               *
 *******************************************************************************/
-#define RT_STRICT
-#define LOG_ENABLED
+//#define RT_STRICT
+//#define LOG_ENABLED
 #define LOG_GROUP   LOG_GROUP_EM /** @todo add log group */
 #include <VBox/vmm/iem.h>
@@ -346,4 +346,13 @@
     iemAImpl_test_u32, NULL,
     iemAImpl_test_u64, NULL
+};
+
+/** Function table for the IMUL instruction. */
+static const IEMOPBINSIZES g_iemAImpl_imul_two =
+{
+    NULL,  NULL,
+    iemAImpl_imul_two_u16, NULL,
+    iemAImpl_imul_two_u32, NULL,
+    iemAImpl_imul_two_u64, NULL
 };
 
@@ -554,4 +563,7 @@
 static VBOXSTRICTRC iemInitDecoderAndPrefetchOpcodes(PIEMCPU pIemCpu)
 {
+#ifdef IEM_VERIFICATION_MODE
+    uint8_t const cbOldOpcodes = pIemCpu->cbOpcode;
+#endif
     iemInitDecode(pIemCpu);
 
@@ -596,4 +608,21 @@
      *        TLB... */
 
+#ifdef IEM_VERIFICATION_MODE
+    /*
+     * Optimistic optimization: Use unconsumed opcode bytes from the previous
+     *                          instruction.
+     */
+    /** @todo optimize this differently by not using PGMPhysRead. */
+    RTGCPHYS const offPrevOpcodes = GCPhys - pIemCpu->GCPhysOpcodes;
+    pIemCpu->GCPhysOpcodes = GCPhys;
+    if (offPrevOpcodes < cbOldOpcodes)
+    {
+        uint8_t cbNew = cbOldOpcodes - (uint8_t)offPrevOpcodes;
+        memmove(&pIemCpu->abOpcode[0], &pIemCpu->abOpcode[offPrevOpcodes], cbNew);
+        pIemCpu->cbOpcode = cbNew;
+        return VINF_SUCCESS;
+    }
+#endif
+
     /*
      * Read the bytes at this address.
@@ -604,4 +633,5 @@
     if (cbToTryRead > sizeof(pIemCpu->abOpcode))
         cbToTryRead = sizeof(pIemCpu->abOpcode);
+    /** @todo patch manager */
     if (!pIemCpu->fByPassHandlers)
         rc = PGMPhysRead(IEMCPU_TO_VM(pIemCpu), GCPhys, pIemCpu->abOpcode, cbToTryRead);
@@ -6000,4 +6030,5 @@
                             case 6: u32EffAddr = pCtx->esi; break;
                             case 7: u32EffAddr = pCtx->edi; break;
+                            IEM_NOT_REACHED_DEFAULT_CASE_RET();
                         }
                         u32EffAddr <<= (bSib >> X86_SIB_SCALE_SHIFT) & X86_SIB_SCALE_SMASK;
@@ -6026,4 +6057,5 @@
                             case 6: u32EffAddr += pCtx->esi; break;
                             case 7: u32EffAddr += pCtx->edi; break;
+                            IEM_NOT_REACHED_DEFAULT_CASE_RET();
                         }
                         break;
@@ -6032,4 +6064,5 @@
                     case 6: u32EffAddr = pCtx->esi; break;
                     case 7: u32EffAddr = pCtx->edi; break;
+                    IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
 
@@ -6254,6 +6287,7 @@
     pIemCpu->cIOWrites   = 0;
     pIemCpu->fMulDivHack = false;
-    pIemCpu->fShlHack    = false;
-
+    pIemCpu->fShiftOfHack= false;
+
+# ifndef IEM_VERIFICATION_MODE_NO_REM
     /*
      * Free all verification records.
@@ -6275,4 +6309,5 @@
         pIemCpu->ppOtherEvtRecNext = &pIemCpu->pOtherEvtRecHead;
     } while (pEvtRec);
+# endif
 }
 
@@ -6637,5 +6672,5 @@
         if (pIemCpu->fMulDivHack)
             fFlagsMask &= ~(X86_EFL_SF | X86_EFL_ZF | X86_EFL_AF | X86_EFL_PF | X86_EFL_CF);
-        if (pIemCpu->fShlHack)
+        if (pIemCpu->fShiftOfHack)
             fFlagsMask &= ~(X86_EFL_OF);
         if ((pOrgCtx->rflags.u & fFlagsMask) != (pDebugCtx->rflags.u & fFlagsMask))
@@ -6844,21 +6879,24 @@
 #ifdef LOG_ENABLED
     PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-    char     szInstr[256];
-    uint32_t cbInstr = 0;
-    DBGFR3DisasInstrEx(pVCpu->pVMR3, pVCpu->idCpu, 0, 0,
-                       DBGF_DISAS_FLAGS_CURRENT_GUEST | DBGF_DISAS_FLAGS_DEFAULT_MODE,
-                       szInstr, sizeof(szInstr), &cbInstr);
-
-    Log2(("**** "
-          " eax=%08x ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x\n"
-          " eip=%08x esp=%08x ebp=%08x iopl=%d\n"
-          " cs=%04x ss=%04x ds=%04x es=%04x fs=%04x gs=%04x efl=%08x\n"
-          " %s\n"
-          ,
-          pCtx->eax, pCtx->ebx, pCtx->ecx, pCtx->edx, pCtx->esi, pCtx->edi,
-          pCtx->eip, pCtx->esp, pCtx->ebp, pCtx->eflags.Bits.u2IOPL,
-          (RTSEL)pCtx->cs, (RTSEL)pCtx->ss, (RTSEL)pCtx->ds, (RTSEL)pCtx->es,
-          (RTSEL)pCtx->fs, (RTSEL)pCtx->gs, pCtx->eflags.u,
-          szInstr));
+    if (0)//LogIs2Enabled())
+    {
+        char     szInstr[256];
+        uint32_t cbInstr = 0;
+        DBGFR3DisasInstrEx(pVCpu->pVMR3, pVCpu->idCpu, 0, 0,
+                           DBGF_DISAS_FLAGS_CURRENT_GUEST | DBGF_DISAS_FLAGS_DEFAULT_MODE,
+                           szInstr, sizeof(szInstr), &cbInstr);
+
+        Log2(("**** "
+              " eax=%08x ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x\n"
+              " eip=%08x esp=%08x ebp=%08x iopl=%d\n"
+              " cs=%04x ss=%04x ds=%04x es=%04x fs=%04x gs=%04x efl=%08x\n"
+              " %s\n"
+              ,
+              pCtx->eax, pCtx->ebx, pCtx->ecx, pCtx->edx, pCtx->esi, pCtx->edi,
+              pCtx->eip, pCtx->esp, pCtx->ebp, pCtx->eflags.Bits.u2IOPL,
+              (RTSEL)pCtx->cs, (RTSEL)pCtx->ss, (RTSEL)pCtx->ds, (RTSEL)pCtx->es,
+              (RTSEL)pCtx->fs, (RTSEL)pCtx->gs, pCtx->eflags.u,
+              szInstr));
+    }
 #endif
 
Index: trunk/src/VBox/VMM/VMMAll/IEMAllInstructions.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllInstructions.cpp.h	(revision 36820)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllInstructions.cpp.h	(revision 36821)
@@ -1678,8 +1678,66 @@
 /** Opcode 0x0f 0x9f. */
 FNIEMOP_STUB(iemOp_setnle_Jv);
+
+
+/**
+ * Common 'push segment-register' helper.
+ */
+FNIEMOP_DEF_1(iemOpCommonPushSReg, uint8_t, iReg)
+{
+    IEMOP_HLP_NO_LOCK_PREFIX();
+    if (iReg < X86_SREG_FS)
+        IEMOP_HLP_NO_64BIT();
+    IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
+
+    switch (pIemCpu->enmEffOpSize)
+    {
+        case IEMMODE_16BIT:
+            IEM_MC_BEGIN(0, 1);
+            IEM_MC_LOCAL(uint16_t, u16Value);
+            IEM_MC_FETCH_SREG_U16(u16Value, iReg);
+            IEM_MC_PUSH_U16(u16Value);
+            IEM_MC_ADVANCE_RIP();
+            IEM_MC_END();
+            break;
+
+        case IEMMODE_32BIT:
+            IEM_MC_BEGIN(0, 1);
+            IEM_MC_LOCAL(uint32_t, u32Value);
+            IEM_MC_FETCH_SREG_ZX_U32(u32Value, iReg);
+            IEM_MC_PUSH_U32(u32Value);
+            IEM_MC_ADVANCE_RIP();
+            IEM_MC_END();
+            break;
+
+        case IEMMODE_64BIT:
+            IEM_MC_BEGIN(0, 1);
+            IEM_MC_LOCAL(uint64_t, u64Value);
+            IEM_MC_FETCH_SREG_ZX_U64(u64Value, iReg);
+            IEM_MC_PUSH_U64(u64Value);
+            IEM_MC_ADVANCE_RIP();
+            IEM_MC_END();
+            break;
+    }
+
+    return VINF_SUCCESS;
+}
+
+
 /** Opcode 0x0f 0xa0. */
-FNIEMOP_STUB(iemOp_push_fs);
+FNIEMOP_DEF(iemOp_push_fs)
+{
+    IEMOP_HLP_NO_LOCK_PREFIX();
+    return FNIEMOP_CALL_1(iemOpCommonPushSReg, X86_SREG_FS);
+}
+
+
 /** Opcode 0x0f 0xa1. */
-FNIEMOP_STUB(iemOp_pop_fs);
+FNIEMOP_DEF(iemOp_pop_fs)
+{
+    IEMOP_HLP_NO_LOCK_PREFIX();
+    return IEM_MC_DEFER_TO_CIMPL_2(iemOpCImpl_pop_Sreg, X86_SREG_FS, pIemCpu->enmEffOpSize);
+}
+
+
 /** Opcode 0x0f 0xa2. */
 FNIEMOP_STUB(iemOp_cpuid);
@@ -1690,8 +1748,22 @@
 /** Opcode 0x0f 0xa7. */
 FNIEMOP_STUB(iemOp_shld_Ev_Gv_CL);
+
+
 /** Opcode 0x0f 0xa8. */
-FNIEMOP_STUB(iemOp_push_gs);
+FNIEMOP_DEF(iemOp_push_gs)
+{
+    IEMOP_HLP_NO_LOCK_PREFIX();
+    return FNIEMOP_CALL_1(iemOpCommonPushSReg, X86_SREG_GS);
+}
+
+
 /** Opcode 0x0f 0xa9. */
-FNIEMOP_STUB(iemOp_pop_gs);
+FNIEMOP_DEF(iemOp_pop_gs)
+{
+    IEMOP_HLP_NO_LOCK_PREFIX();
+    return IEM_MC_DEFER_TO_CIMPL_2(iemOpCImpl_pop_Sreg, X86_SREG_GS, pIemCpu->enmEffOpSize);
+}
+
+
 /** Opcode 0x0f 0xaa. */
 FNIEMOP_STUB(iemOp_rsm);
@@ -1704,6 +1776,17 @@
 /** Opcode 0x0f 0xae. */
 FNIEMOP_STUB(iemOp_Grp15);
+
+
 /** Opcode 0x0f 0xaf. */
-FNIEMOP_STUB(iemOp_imul_Gv_Ev);
+FNIEMOP_DEF(iemOp_imul_Gv_Ev)
+{
+    IEMOP_MNEMONIC("imul Gv,Ev");
+#ifdef IEM_VERIFICATION_MODE
+    pIemCpu->fMulDivHack = true;
+#endif
+    return FNIEMOP_CALL_1(iemOpHlpBinaryOperator_rv_rm, &g_iemAImpl_imul_two);
+}
+
+
 /** Opcode 0x0f 0xb0. */
 FNIEMOP_STUB(iemOp_cmpxchg_Eb_Gb);
@@ -2278,5 +2361,5 @@
 FNIEMOP_DEF(iemOp_add_Ev_Gv)
 {
-    IEMOP_MNEMONIC("add Gv,Ev");
+    IEMOP_MNEMONIC("add Ev,Gv");
     return FNIEMOP_CALL_1(iemOpHlpBinaryOperator_rm_rv, &g_iemAImpl_add);
 }
@@ -2312,48 +2395,4 @@
     IEMOP_MNEMONIC("add rAX,Iz");
     return FNIEMOP_CALL_1(iemOpHlpBinaryOperator_rAX_Iz, &g_iemAImpl_add);
-}
-
-
-/**
- * Common 'push segment-register' helper.
- */
-FNIEMOP_DEF_1(iemOpCommonPushSReg, uint8_t, iReg)
-{
-    IEMOP_HLP_NO_LOCK_PREFIX();
-    if (iReg < X86_SREG_FS)
-        IEMOP_HLP_NO_64BIT();
-    IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-
-    switch (pIemCpu->enmEffOpSize)
-    {
-        case IEMMODE_16BIT:
-            IEM_MC_BEGIN(0, 1);
-            IEM_MC_LOCAL(uint16_t, u16Value);
-            IEM_MC_FETCH_SREG_U16(u16Value, iReg);
-            IEM_MC_PUSH_U16(u16Value);
-            IEM_MC_ADVANCE_RIP();
-            IEM_MC_END();
-            break;
-
-        case IEMMODE_32BIT:
-            IEM_MC_BEGIN(0, 1);
-            IEM_MC_LOCAL(uint32_t, u32Value);
-            IEM_MC_FETCH_SREG_ZX_U32(u32Value, iReg);
-            IEM_MC_PUSH_U32(u32Value);
-            IEM_MC_ADVANCE_RIP();
-            IEM_MC_END();
-            break;
-
-        case IEMMODE_64BIT:
-            IEM_MC_BEGIN(0, 1);
-            IEM_MC_LOCAL(uint64_t, u64Value);
-            IEM_MC_FETCH_SREG_ZX_U64(u64Value, iReg);
-            IEM_MC_PUSH_U64(u64Value);
-            IEM_MC_ADVANCE_RIP();
-            IEM_MC_END();
-            break;
-    }
-
-    return VINF_SUCCESS;
 }
 
@@ -6412,4 +6451,7 @@
         IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
         IEM_MC_REF_EFLAGS(pEFlags);
+#ifdef IEM_VERIFICATION_MODE
+        if (cShift > 1) pIemCpu->fShiftOfHack = true;
+#endif
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags);
         IEM_MC_ADVANCE_RIP();
@@ -6431,4 +6473,7 @@
         IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
         IEM_MC_FETCH_EFLAGS(EFlags);
+#ifdef IEM_VERIFICATION_MODE
+        if (cShift > 1) pIemCpu->fShiftOfHack = true;
+#endif
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags);
 
@@ -6453,10 +6498,5 @@
         case 2: pImpl = &g_iemAImpl_rcl; IEMOP_MNEMONIC("rcl Ev,Ib"); break;
         case 3: pImpl = &g_iemAImpl_rcr; IEMOP_MNEMONIC("rcr Ev,Ib"); break;
-        case 4:
-            pImpl = &g_iemAImpl_shl; IEMOP_MNEMONIC("shl Ev,Ib");
-#ifdef IEM_VERIFICATION_MODE
-            pIemCpu->fShlHack = true;
-#endif
-            break;
+        case 4: pImpl = &g_iemAImpl_shl; IEMOP_MNEMONIC("shl Ev,Ib"); break;
         case 5: pImpl = &g_iemAImpl_shr; IEMOP_MNEMONIC("shr Ev,Ib"); break;
         case 7: pImpl = &g_iemAImpl_sar; IEMOP_MNEMONIC("sar Ev,Ib"); break;
@@ -6469,4 +6509,7 @@
         /* register */
         uint8_t cShift; IEM_OPCODE_GET_NEXT_BYTE(pIemCpu, &cShift);
+#ifdef IEM_VERIFICATION_MODE
+        if (cShift > 1) pIemCpu->fShiftOfHack = true;
+#endif
         IEMOP_HLP_NO_LOCK_PREFIX();
         switch (pIemCpu->enmEffOpSize)
@@ -6526,4 +6569,7 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm);
                 uint8_t cShift; IEM_OPCODE_GET_NEXT_BYTE(pIemCpu, &cShift);
+#ifdef IEM_VERIFICATION_MODE
+                if (cShift > 1) pIemCpu->fShiftOfHack = true;
+#endif
                 IEM_MC_ASSIGN(cShiftArg, cShift);
                 IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
@@ -6546,4 +6592,7 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm);
                 uint8_t cShift; IEM_OPCODE_GET_NEXT_BYTE(pIemCpu, &cShift);
+#ifdef IEM_VERIFICATION_MODE
+                if (cShift > 1) pIemCpu->fShiftOfHack = true;
+#endif
                 IEM_MC_ASSIGN(cShiftArg, cShift);
                 IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
@@ -6566,4 +6615,7 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm);
                 uint8_t cShift; IEM_OPCODE_GET_NEXT_BYTE(pIemCpu, &cShift);
+#ifdef IEM_VERIFICATION_MODE
+                if (cShift > 1) pIemCpu->fShiftOfHack = true;
+#endif
                 IEM_MC_ASSIGN(cShiftArg, cShift);
                 IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
@@ -6576,5 +6628,4 @@
                 IEM_MC_END();
                 return VINF_SUCCESS;
-
 
             IEM_NOT_REACHED_DEFAULT_CASE_RET();
@@ -6869,10 +6920,5 @@
         case 2: pImpl = &g_iemAImpl_rcl; IEMOP_MNEMONIC("rcl Ev,1"); break;
         case 3: pImpl = &g_iemAImpl_rcr; IEMOP_MNEMONIC("rcr Ev,1"); break;
-        case 4:
-            pImpl = &g_iemAImpl_shl; IEMOP_MNEMONIC("shl Ev,1");
-#ifdef IEM_VERIFICATION_MODE
-            pIemCpu->fShlHack = true;
-#endif
-            break;
+        case 4: pImpl = &g_iemAImpl_shl; IEMOP_MNEMONIC("shl Ev,1"); break;
         case 5: pImpl = &g_iemAImpl_shr; IEMOP_MNEMONIC("shr Ev,1"); break;
         case 7: pImpl = &g_iemAImpl_sar; IEMOP_MNEMONIC("sar Ev,1"); break;
@@ -7021,4 +7067,7 @@
         IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
         IEM_MC_REF_EFLAGS(pEFlags);
+#ifdef IEM_VERIFICATION_MODE
+        if (cShiftArg > 1) pIemCpu->fShiftOfHack = true;
+#endif
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags);
         IEM_MC_ADVANCE_RIP();
@@ -7039,4 +7088,7 @@
         IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
         IEM_MC_FETCH_EFLAGS(EFlags);
+#ifdef IEM_VERIFICATION_MODE
+        if (cShiftArg > 1) pIemCpu->fShiftOfHack = true;
+#endif
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags);
 
@@ -7061,10 +7113,5 @@
         case 2: pImpl = &g_iemAImpl_rcl; IEMOP_MNEMONIC("rcl Ev,CL"); break;
         case 3: pImpl = &g_iemAImpl_rcr; IEMOP_MNEMONIC("rcr Ev,CL"); break;
-        case 4:
-            pImpl = &g_iemAImpl_shl; IEMOP_MNEMONIC("shl Ev,CL");
-#ifdef IEM_VERIFICATION_MODE
-            pIemCpu->fShlHack = true;
-#endif
-            break;
+        case 4: pImpl = &g_iemAImpl_shl; IEMOP_MNEMONIC("shl Ev,CL"); break;
         case 5: pImpl = &g_iemAImpl_shr; IEMOP_MNEMONIC("shr Ev,CL"); break;
         case 7: pImpl = &g_iemAImpl_sar; IEMOP_MNEMONIC("sar Ev,CL"); break;
@@ -7087,4 +7134,7 @@
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_REF_EFLAGS(pEFlags);
+#ifdef IEM_VERIFICATION_MODE
+                if (cShiftArg > 1) pIemCpu->fShiftOfHack = true;
+#endif
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags);
                 IEM_MC_ADVANCE_RIP();
@@ -7100,4 +7150,7 @@
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_REF_EFLAGS(pEFlags);
+#ifdef IEM_VERIFICATION_MODE
+                if (cShiftArg > 1) pIemCpu->fShiftOfHack = true;
+#endif
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags);
                 IEM_MC_ADVANCE_RIP();
@@ -7113,4 +7166,7 @@
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_REF_EFLAGS(pEFlags);
+#ifdef IEM_VERIFICATION_MODE
+                if (cShiftArg > 1) pIemCpu->fShiftOfHack = true;
+#endif
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags);
                 IEM_MC_ADVANCE_RIP();
@@ -7138,4 +7194,7 @@
                 IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
+#ifdef IEM_VERIFICATION_MODE
+                if (cShiftArg > 1) pIemCpu->fShiftOfHack = true;
+#endif
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags);
 
@@ -7157,4 +7216,7 @@
                 IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
+#ifdef IEM_VERIFICATION_MODE
+                if (cShiftArg > 1) pIemCpu->fShiftOfHack = true;
+#endif
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags);
 
@@ -7176,4 +7238,7 @@
                 IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
+#ifdef IEM_VERIFICATION_MODE
+                if (cShiftArg > 1) pIemCpu->fShiftOfHack = true;
+#endif
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags);
 
Index: trunk/src/VBox/VMM/include/IEMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMInternal.h	(revision 36820)
+++ trunk/src/VBox/VMM/include/IEMInternal.h	(revision 36821)
@@ -167,9 +167,11 @@
     /** Hack for ignoring differences in undefined EFLAGS after MUL and DIV. */
     bool                    fMulDivHack;
-    /** Hack for ignoring differences in OF after SHL.  At least two intel CPUs
-     * this code is running on will not set it correctly (i.e. like AMD and QEMU
-     * does). */
-    bool                    fShlHack;
+    /** Hack for ignoring differences in OF after shifts greater than 1 bit.
+     * At least two intel CPUs this code is running on will set it different
+     * than what AMD and REM does. */
+    bool                    fShiftOfHack;
     bool                    afAlignment1[6];
+    /** The physical address corresponding to abOpcodes[0]. */
+    RTGCPHYS                GCPhysOpcodes;
 #endif
     /** @}  */
@@ -199,7 +201,7 @@
     uint8_t                 iEffSeg;
 
-    /** The current offset into abOpcode. */
+    /** The current offset into abOpcodes. */
     uint8_t                 offOpcode;
-    /** The size of what has currently been fetched into abOpcode. */
+    /** The size of what has currently been fetched into abOpcodes. */
     uint8_t                 cbOpcode;
     /** The opcode bytes. */
@@ -453,5 +455,4 @@
 /** @name Signed multiplication operations (thrown in with the binary ops).
  * @{ */
-FNIEMAIMPLBINU8  iemAImpl_imul_two_u8;
 FNIEMAIMPLBINU16 iemAImpl_imul_two_u16;
 FNIEMAIMPLBINU32 iemAImpl_imul_two_u32;
