Index: trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 46167)
+++ trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 46168)
@@ -771,5 +771,12 @@
     pIemCpu->rcPassUp           = VINF_SUCCESS;
     pIemCpu->fBypassHandlers    = fBypassHandlers;
-
+#ifdef IN_RC
+    pIemCpu->fInPatchCode       = pIemCpu->uCpl == 0
+                               && pCtx->cs.u64Base == 0
+                               && pCtx->cs.u32Limit == UINT32_MAX
+                               && PATMIsPatchGCAddr(IEMCPU_TO_VM(pIemCpu), pCtx->eip);
+    if (!pIemCpu->fInPatchCode)
+        CPUMRawLeave(pVCpu, CPUMCTX2CORE(pCtx), VINF_SUCCESS);
+#endif
 }
 
@@ -818,6 +825,5 @@
     /* Allow interpretation of patch manager code blocks since they can for
        instance throw #PFs for perfectly good reasons. */
-    if (   (pCtx->cs.Sel & X86_SEL_RPL) == 1
-        && PATMIsPatchGCAddr(IEMCPU_TO_VM(pIemCpu), GCPtrPC))
+    if (pIemCpu->fInPatchCode)
     {
         uint32_t cbLeftOnPage = PAGE_SIZE - (GCPtrPC & PAGE_OFFSET_MASK);
@@ -8372,4 +8378,23 @@
 
 
+#ifdef IN_RC
+/**
+ * Re-enters raw-mode or ensure we return to ring-3.
+ *
+ * @returns rcStrict, maybe modified.
+ * @param   pIemCpu     The IEM CPU structure.
+ * @param   pVCpu       The cross context virtual CPU structure of the caller.
+ * @param   pCtx        The current CPU context.
+ * @param   rcStrict    The status code returne by the interpreter.
+ */
+DECLINLINE(VBOXSTRICTRC) iemRCRawMaybeReenter(PIEMCPU pIemCpu, PVMCPU pVCpu, PCPUMCTX pCtx, VBOXSTRICTRC rcStrict)
+{
+    if (!pIemCpu->fInPatchCode)
+        CPUMRawEnter(pVCpu, CPUMCTX2CORE(pCtx));
+    return rcStrict;
+}
+#endif
+
+
 /**
  * Execute one instruction.
@@ -8432,4 +8457,7 @@
     iemExecVerificationModeCheck(pIemCpu);
 #endif
+#ifdef IN_RC
+    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
+#endif
     if (rcStrict != VINF_SUCCESS)
         LogFlow(("IEMExecOne: cs:rip=%04x:%08RX64 ss:rsp=%04x:%08RX64 EFL=%06x - rcStrict=%Rrc\n",
@@ -8445,7 +8473,5 @@
     AssertReturn(CPUMCTX2CORE(pCtx) == pCtxCore, VERR_IEM_IPE_3);
 
-    iemInitDecoder(pIemCpu, false);
     uint32_t const cbOldWritten = pIemCpu->cbWritten;
-
     VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, false);
     if (rcStrict == VINF_SUCCESS)
@@ -8455,4 +8481,8 @@
             *pcbWritten = pIemCpu->cbWritten - cbOldWritten;
     }
+
+#ifdef IN_RC
+    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
+#endif
     return rcStrict;
 }
@@ -8481,4 +8511,8 @@
         rcStrict = iemExecOneInner(pVCpu, pIemCpu, true);
     }
+
+#ifdef IN_RC
+    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
+#endif
     return rcStrict;
 }
@@ -8491,11 +8525,5 @@
     AssertReturn(CPUMCTX2CORE(pCtx) == pCtxCore, VERR_IEM_IPE_3);
 
-#ifdef IN_RC
-    CPUMRawLeave(pVCpu, pCtxCore, VINF_SUCCESS);
-#endif
-
-    iemInitDecoder(pIemCpu, true);
     uint32_t const cbOldWritten = pIemCpu->cbWritten;
-
     VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, true);
     if (rcStrict == VINF_SUCCESS)
@@ -8507,5 +8535,5 @@
 
 #ifdef IN_RC
-    CPUMRawEnter(pVCpu, pCtxCore);
+    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
 #endif
     return rcStrict;
@@ -8519,8 +8547,4 @@
     PCPUMCTX pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     AssertReturn(CPUMCTX2CORE(pCtx) == pCtxCore, VERR_IEM_IPE_3);
-
-#ifdef IN_RC
-    CPUMRawLeave(pVCpu, pCtxCore, VINF_SUCCESS);
-#endif
 
     VBOXSTRICTRC rcStrict;
@@ -8539,5 +8563,5 @@
 
 #ifdef IN_RC
-    CPUMRawEnter(pVCpu, pCtxCore);
+    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
 #endif
     return rcStrict;
Index: trunk/src/VBox/VMM/include/IEMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMInternal.h	(revision 46167)
+++ trunk/src/VBox/VMM/include/IEMInternal.h	(revision 46168)
@@ -214,6 +214,8 @@
     /** Whether to bypass access handlers or not. */
     bool                    fBypassHandlers;
+    /** Indicates that we're interpreting patch code - RC only! */
+    bool                    fInPatchCode;
     /** Explicit alignment padding. */
-    bool                    afAlignment0[3];
+    bool                    afAlignment0[2];
 
     /** The flags of the current exception / interrupt. */
Index: trunk/src/VBox/VMM/include/SELMInline.h
===================================================================
--- trunk/src/VBox/VMM/include/SELMInline.h	(revision 46167)
+++ trunk/src/VBox/VMM/include/SELMInline.h	(revision 46168)
@@ -282,4 +282,5 @@
     pSReg->u64Base        = X86DESC_BASE(pShwDesc);
     pSReg->ValidSel       = pSReg->Sel;
+/** @todo VBOX_WITH_RAW_RING1 */
     if (pSReg->Attr.n.u1Available)
         pSReg->ValidSel  &= ~(RTSEL)1;
@@ -303,4 +304,5 @@
     pSReg->u64Base        = X86DESC_BASE(pGstDesc);
     pSReg->ValidSel       = pSReg->Sel;
+/** @todo VBOX_WITH_RAW_RING1 */
     if ((pSReg->ValidSel & 1) && CPUMIsGuestInRawMode(pVCpu))
         pSReg->ValidSel  &= ~(RTSEL)1;
