Changeset 62015 in vbox for trunk/src/VBox/VMM

Timestamp:

Jul 4, 2016 7:58:28 PM (9 years ago)

Author:

vboxsync

Message:

IEM: Switched from using IEMCPU directly to using with via VMCPU. This saves 4-5 KB in 64-bit mode (~1.2%), but the 32-bit code is larger (suspecting because we lost a few some 8-bit displacements).

Location:

trunk/src/VBox/VMM

Files:

• VMMAll/IEMAll.cpp (modified) (733 diffs)
• VMMAll/IEMAllCImpl.cpp.h (modified) (479 diffs)
• VMMAll/IEMAllCImplStrInstr.cpp.h (modified) (119 diffs)
• VMMAll/IEMAllInstructions.cpp.h (modified) (704 diffs)
• include/IEMInternal.h (modified) (24 diffs)
• testcase/tstIEMCheckMc.cpp (modified) (3 diffs)

trunk/src/VBox/VMM/VMMAll/IEMAll.cpp

@@ -150 +150 @@
 
 #if defined(__GNUC__) && defined(RT_ARCH_X86)
-typedef VBOXSTRICTRC (__attribute__((__fastcall__)) * PFNIEMOP)(PIEMCPU pIemCpu);
-typedef VBOXSTRICTRC (__attribute__((__fastcall__)) * PFNIEMOPRM)(PIEMCPU pIemCpu, uint8_t bRm);
+typedef VBOXSTRICTRC (__attribute__((__fastcall__)) * PFNIEMOP)(PVMCPU pVCpu);
+typedef VBOXSTRICTRC (__attribute__((__fastcall__)) * PFNIEMOPRM)(PVMCPU pVCpu, uint8_t bRm);
 # define FNIEMOP_DEF(a_Name) \
-    IEM_STATIC VBOXSTRICTRC __attribute__((__fastcall__, __nothrow__)) a_Name(PIEMCPU pIemCpu)
+    IEM_STATIC VBOXSTRICTRC __attribute__((__fastcall__, __nothrow__)) a_Name(PVMCPU pVCpu)
 # define FNIEMOP_DEF_1(a_Name, a_Type0, a_Name0) \
-    IEM_STATIC VBOXSTRICTRC __attribute__((__fastcall__, __nothrow__)) a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0)
+    IEM_STATIC VBOXSTRICTRC __attribute__((__fastcall__, __nothrow__)) a_Name(PVMCPU pVCpu, a_Type0 a_Name0)
 # define FNIEMOP_DEF_2(a_Name, a_Type0, a_Name0, a_Type1, a_Name1) \
-    IEM_STATIC VBOXSTRICTRC __attribute__((__fastcall__, __nothrow__)) a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0, a_Type1 a_Name1)
+    IEM_STATIC VBOXSTRICTRC __attribute__((__fastcall__, __nothrow__)) a_Name(PVMCPU pVCpu, a_Type0 a_Name0, a_Type1 a_Name1)
 
 #elif defined(_MSC_VER) && defined(RT_ARCH_X86)
-typedef VBOXSTRICTRC (__fastcall * PFNIEMOP)(PIEMCPU pIemCpu);
-typedef VBOXSTRICTRC (__fastcall * PFNIEMOPRM)(PIEMCPU pIemCpu, uint8_t bRm);
+typedef VBOXSTRICTRC (__fastcall * PFNIEMOP)(PVMCPU pVCpu);
+typedef VBOXSTRICTRC (__fastcall * PFNIEMOPRM)(PVMCPU pVCpu, uint8_t bRm);
 # define FNIEMOP_DEF(a_Name) \
-    IEM_STATIC /*__declspec(naked)*/ VBOXSTRICTRC __fastcall a_Name(PIEMCPU pIemCpu) RT_NO_THROW_DEF
+    IEM_STATIC /*__declspec(naked)*/ VBOXSTRICTRC __fastcall a_Name(PVMCPU pVCpu) RT_NO_THROW_DEF
 # define FNIEMOP_DEF_1(a_Name, a_Type0, a_Name0) \
-    IEM_STATIC /*__declspec(naked)*/ VBOXSTRICTRC __fastcall a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0) RT_NO_THROW_DEF
+    IEM_STATIC /*__declspec(naked)*/ VBOXSTRICTRC __fastcall a_Name(PVMCPU pVCpu, a_Type0 a_Name0) RT_NO_THROW_DEF
 # define FNIEMOP_DEF_2(a_Name, a_Type0, a_Name0, a_Type1, a_Name1) \
-    IEM_STATIC /*__declspec(naked)*/ VBOXSTRICTRC __fastcall a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0, a_Type1 a_Name1) RT_NO_THROW_DEF
+    IEM_STATIC /*__declspec(naked)*/ VBOXSTRICTRC __fastcall a_Name(PVMCPU pVCpu, a_Type0 a_Name0, a_Type1 a_Name1) RT_NO_THROW_DEF
 
 #elif defined(__GNUC__)
-typedef VBOXSTRICTRC (* PFNIEMOP)(PIEMCPU pIemCpu);
-typedef VBOXSTRICTRC (* PFNIEMOPRM)(PIEMCPU pIemCpu, uint8_t bRm);
+typedef VBOXSTRICTRC (* PFNIEMOP)(PVMCPU pVCpu);
+typedef VBOXSTRICTRC (* PFNIEMOPRM)(PVMCPU pVCpu, uint8_t bRm);
 # define FNIEMOP_DEF(a_Name) \
-    IEM_STATIC VBOXSTRICTRC __attribute__((__nothrow__)) a_Name(PIEMCPU pIemCpu)
+    IEM_STATIC VBOXSTRICTRC __attribute__((__nothrow__)) a_Name(PVMCPU pVCpu)
 # define FNIEMOP_DEF_1(a_Name, a_Type0, a_Name0) \
-    IEM_STATIC VBOXSTRICTRC __attribute__((__nothrow__)) a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0)
+    IEM_STATIC VBOXSTRICTRC __attribute__((__nothrow__)) a_Name(PVMCPU pVCpu, a_Type0 a_Name0)
 # define FNIEMOP_DEF_2(a_Name, a_Type0, a_Name0, a_Type1, a_Name1) \
-    IEM_STATIC VBOXSTRICTRC __attribute__((__nothrow__)) a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0, a_Type1 a_Name1)
+    IEM_STATIC VBOXSTRICTRC __attribute__((__nothrow__)) a_Name(PVMCPU pVCpu, a_Type0 a_Name0, a_Type1 a_Name1)
 
 #else
-typedef VBOXSTRICTRC (* PFNIEMOP)(PIEMCPU pIemCpu);
-typedef VBOXSTRICTRC (* PFNIEMOPRM)(PIEMCPU pIemCpu, uint8_t bRm);
+typedef VBOXSTRICTRC (* PFNIEMOP)(PVMCPU pVCpu);
+typedef VBOXSTRICTRC (* PFNIEMOPRM)(PVMCPU pVCpu, uint8_t bRm);
 # define FNIEMOP_DEF(a_Name) \
-    IEM_STATIC VBOXSTRICTRC a_Name(PIEMCPU pIemCpu) RT_NO_THROW_DEF
+    IEM_STATIC VBOXSTRICTRC a_Name(PVMCPU pVCpu) RT_NO_THROW_DEF
 # define FNIEMOP_DEF_1(a_Name, a_Type0, a_Name0) \
-    IEM_STATIC VBOXSTRICTRC a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0) RT_NO_THROW_DEF
+    IEM_STATIC VBOXSTRICTRC a_Name(PVMCPU pVCpu, a_Type0 a_Name0) RT_NO_THROW_DEF
 # define FNIEMOP_DEF_2(a_Name, a_Type0, a_Name0, a_Type1, a_Name1) \
-    IEM_STATIC VBOXSTRICTRC a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0, a_Type1 a_Name1) RT_NO_THROW_DEF
+    IEM_STATIC VBOXSTRICTRC a_Name(PVMCPU pVCpu, a_Type0 a_Name0, a_Type1 a_Name1) RT_NO_THROW_DEF
 
 #endif
@@ -268 +268 @@
  * done as we please.  See FNIEMOP_DEF.
  */
-#define FNIEMOP_CALL(a_pfn) (a_pfn)(pIemCpu)
+#define FNIEMOP_CALL(a_pfn) (a_pfn)(pVCpu)
 
 /**
@@ -276 +276 @@
  * done as we please.  See FNIEMOP_DEF_1.
  */
-#define FNIEMOP_CALL_1(a_pfn, a0)           (a_pfn)(pIemCpu, a0)
+#define FNIEMOP_CALL_1(a_pfn, a0)           (a_pfn)(pVCpu, a0)
 
 /**
@@ -284 +284 @@
  * done as we please.  See FNIEMOP_DEF_1.
  */
-#define FNIEMOP_CALL_2(a_pfn, a0, a1)       (a_pfn)(pIemCpu, a0, a1)
+#define FNIEMOP_CALL_2(a_pfn, a0, a1)       (a_pfn)(pVCpu, a0, a1)
 
 /**
@@ -290 +290 @@
  *
  * @returns @c true if it is, @c false if not.
- * @param   a_pIemCpu       The IEM state of the current CPU.
- */
-#define IEM_IS_REAL_OR_V86_MODE(a_pIemCpu)  (CPUMIsGuestInRealOrV86ModeEx((a_pIemCpu)->CTX_SUFF(pCtx)))
+ * @param   a_pVCpu         The IEM state of the current CPU.
+ */
+#define IEM_IS_REAL_OR_V86_MODE(a_pVCpu)    (CPUMIsGuestInRealOrV86ModeEx((a_pVCpu)->iem.s.CTX_SUFF(pCtx)))
 
 /**
@@ -298 +298 @@
  *
  * @returns @c true if it is, @c false if not.
- * @param   a_pIemCpu       The IEM state of the current CPU.
- */
-#define IEM_IS_V86_MODE(a_pIemCpu)          (CPUMIsGuestInV86ModeEx((a_pIemCpu)->CTX_SUFF(pCtx)))
+ * @param   a_pVCpu         The IEM state of the current CPU.
+ */
+#define IEM_IS_V86_MODE(a_pVCpu)            (CPUMIsGuestInV86ModeEx((a_pVCpu)->iem.s.CTX_SUFF(pCtx)))
 
 /**
@@ -306 +306 @@
  *
  * @returns @c true if it is, @c false if not.
- * @param   a_pIemCpu       The IEM state of the current CPU.
- */
-#define IEM_IS_LONG_MODE(a_pIemCpu)         (CPUMIsGuestInLongModeEx((a_pIemCpu)->CTX_SUFF(pCtx)))
+ * @param   a_pVCpu         The IEM state of the current CPU.
+ */
+#define IEM_IS_LONG_MODE(a_pVCpu)           (CPUMIsGuestInLongModeEx((a_pVCpu)->iem.s.CTX_SUFF(pCtx)))
 
 /**
@@ -314 +314 @@
  *
  * @returns @c true if it is, @c false if not.
- * @param   a_pIemCpu       The IEM state of the current CPU.
- */
-#define IEM_IS_REAL_MODE(a_pIemCpu)         (CPUMIsGuestInRealModeEx((a_pIemCpu)->CTX_SUFF(pCtx)))
+ * @param   a_pVCpu         The IEM state of the current CPU.
+ */
+#define IEM_IS_REAL_MODE(a_pVCpu)           (CPUMIsGuestInRealModeEx((a_pVCpu)->iem.s.CTX_SUFF(pCtx)))
 
 /**
  * Returns a (const) pointer to the CPUMFEATURES for the guest CPU.
  * @returns PCCPUMFEATURES
- * @param   a_pIemCpu       The IEM state of the current CPU.
- */
-#define IEM_GET_GUEST_CPU_FEATURES(a_pIemCpu) (&(IEMCPU_TO_VM(a_pIemCpu)->cpum.ro.GuestFeatures))
+ * @param   a_pVCpu         The IEM state of the current CPU.
+ */
+#define IEM_GET_GUEST_CPU_FEATURES(a_pVCpu) (&((a_pVCpu)->CTX_SUFF(pVM)->cpum.ro.GuestFeatures))
 
 /**
  * Returns a (const) pointer to the CPUMFEATURES for the host CPU.
  * @returns PCCPUMFEATURES
- * @param   a_pIemCpu       The IEM state of the current CPU.
- */
-#define IEM_GET_HOST_CPU_FEATURES(a_pIemCpu)  (&(IEMCPU_TO_VM(a_pIemCpu)->cpum.ro.HostFeatures))
+ * @param   a_pVCpu         The IEM state of the current CPU.
+ */
+#define IEM_GET_HOST_CPU_FEATURES(a_pVCpu)  (&((a_pVCpu)->CTX_SUFF(pVM)->cpum.ro.HostFeatures))
 
 /**
  * Evaluates to true if we're presenting an Intel CPU to the guest.
  */
-#define IEM_IS_GUEST_CPU_INTEL(a_pIemCpu)   ( (a_pIemCpu)->enmCpuVendor == CPUMCPUVENDOR_INTEL )
+#define IEM_IS_GUEST_CPU_INTEL(a_pVCpu)     ( (a_pVCpu)->iem.s.enmCpuVendor == CPUMCPUVENDOR_INTEL )
 
 /**
  * Evaluates to true if we're presenting an AMD CPU to the guest.
  */
-#define IEM_IS_GUEST_CPU_AMD(a_pIemCpu)     ( (a_pIemCpu)->enmCpuVendor == CPUMCPUVENDOR_AMD )
+#define IEM_IS_GUEST_CPU_AMD(a_pVCpu)       ( (a_pVCpu)->iem.s.enmCpuVendor == CPUMCPUVENDOR_AMD )
 
 /**
@@ -708 +708 @@
 *   Internal Functions                                                                                                           *
 *********************************************************************************************************************************/
-IEM_STATIC VBOXSTRICTRC     iemRaiseTaskSwitchFaultWithErr(PIEMCPU pIemCpu, uint16_t uErr);
-IEM_STATIC VBOXSTRICTRC     iemRaiseTaskSwitchFaultCurrentTSS(PIEMCPU pIemCpu);
-IEM_STATIC VBOXSTRICTRC     iemRaiseTaskSwitchFault0(PIEMCPU pIemCpu);
-IEM_STATIC VBOXSTRICTRC     iemRaiseTaskSwitchFaultBySelector(PIEMCPU pIemCpu, uint16_t uSel);
-/*IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorNotPresent(PIEMCPU pIemCpu, uint32_t iSegReg, uint32_t fAccess);*/
-IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorNotPresentBySelector(PIEMCPU pIemCpu, uint16_t uSel);
-IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorNotPresentWithErr(PIEMCPU pIemCpu, uint16_t uErr);
-IEM_STATIC VBOXSTRICTRC     iemRaiseStackSelectorNotPresentBySelector(PIEMCPU pIemCpu, uint16_t uSel);
-IEM_STATIC VBOXSTRICTRC     iemRaiseStackSelectorNotPresentWithErr(PIEMCPU pIemCpu, uint16_t uErr);
-IEM_STATIC VBOXSTRICTRC     iemRaiseGeneralProtectionFault(PIEMCPU pIemCpu, uint16_t uErr);
-IEM_STATIC VBOXSTRICTRC     iemRaiseGeneralProtectionFault0(PIEMCPU pIemCpu);
-IEM_STATIC VBOXSTRICTRC     iemRaiseGeneralProtectionFaultBySelector(PIEMCPU pIemCpu, RTSEL uSel);
-IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorBounds(PIEMCPU pIemCpu, uint32_t iSegReg, uint32_t fAccess);
-IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorBoundsBySelector(PIEMCPU pIemCpu, RTSEL Sel);
-IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorInvalidAccess(PIEMCPU pIemCpu, uint32_t iSegReg, uint32_t fAccess);
-IEM_STATIC VBOXSTRICTRC     iemRaisePageFault(PIEMCPU pIemCpu, RTGCPTR GCPtrWhere, uint32_t fAccess, int rc);
-IEM_STATIC VBOXSTRICTRC     iemRaiseAlignmentCheckException(PIEMCPU pIemCpu);
-IEM_STATIC VBOXSTRICTRC     iemMemMap(PIEMCPU pIemCpu, void **ppvMem, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t fAccess);
-IEM_STATIC VBOXSTRICTRC     iemMemCommitAndUnmap(PIEMCPU pIemCpu, void *pvMem, uint32_t fAccess);
-IEM_STATIC VBOXSTRICTRC     iemMemFetchDataU32(PIEMCPU pIemCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
-IEM_STATIC VBOXSTRICTRC     iemMemFetchDataU64(PIEMCPU pIemCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
-IEM_STATIC VBOXSTRICTRC     iemMemFetchSysU8(PIEMCPU pIemCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
-IEM_STATIC VBOXSTRICTRC     iemMemFetchSysU16(PIEMCPU pIemCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
-IEM_STATIC VBOXSTRICTRC     iemMemFetchSysU32(PIEMCPU pIemCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
-IEM_STATIC VBOXSTRICTRC     iemMemFetchSysU64(PIEMCPU pIemCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
-IEM_STATIC VBOXSTRICTRC     iemMemFetchSelDescWithErr(PIEMCPU pIemCpu, PIEMSELDESC pDesc, uint16_t uSel, uint8_t uXcpt, uint16_t uErrorCode);
-IEM_STATIC VBOXSTRICTRC     iemMemFetchSelDesc(PIEMCPU pIemCpu, PIEMSELDESC pDesc, uint16_t uSel, uint8_t uXcpt);
-IEM_STATIC VBOXSTRICTRC     iemMemStackPushCommitSpecial(PIEMCPU pIemCpu, void *pvMem, uint64_t uNewRsp);
-IEM_STATIC VBOXSTRICTRC     iemMemStackPushBeginSpecial(PIEMCPU pIemCpu, size_t cbMem, void **ppvMem, uint64_t *puNewRsp);
-IEM_STATIC VBOXSTRICTRC     iemMemStackPushU32(PIEMCPU pIemCpu, uint32_t u32Value);
-IEM_STATIC VBOXSTRICTRC     iemMemStackPushU16(PIEMCPU pIemCpu, uint16_t u16Value);
-IEM_STATIC VBOXSTRICTRC     iemMemMarkSelDescAccessed(PIEMCPU pIemCpu, uint16_t uSel);
-IEM_STATIC uint16_t         iemSRegFetchU16(PIEMCPU pIemCpu, uint8_t iSegReg);
+IEM_STATIC VBOXSTRICTRC     iemRaiseTaskSwitchFaultWithErr(PVMCPU pVCpu, uint16_t uErr);
+IEM_STATIC VBOXSTRICTRC     iemRaiseTaskSwitchFaultCurrentTSS(PVMCPU pVCpu);
+IEM_STATIC VBOXSTRICTRC     iemRaiseTaskSwitchFault0(PVMCPU pVCpu);
+IEM_STATIC VBOXSTRICTRC     iemRaiseTaskSwitchFaultBySelector(PVMCPU pVCpu, uint16_t uSel);
+/*IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorNotPresent(PVMCPU pVCpu, uint32_t iSegReg, uint32_t fAccess);*/
+IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorNotPresentBySelector(PVMCPU pVCpu, uint16_t uSel);
+IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorNotPresentWithErr(PVMCPU pVCpu, uint16_t uErr);
+IEM_STATIC VBOXSTRICTRC     iemRaiseStackSelectorNotPresentBySelector(PVMCPU pVCpu, uint16_t uSel);
+IEM_STATIC VBOXSTRICTRC     iemRaiseStackSelectorNotPresentWithErr(PVMCPU pVCpu, uint16_t uErr);
+IEM_STATIC VBOXSTRICTRC     iemRaiseGeneralProtectionFault(PVMCPU pVCpu, uint16_t uErr);
+IEM_STATIC VBOXSTRICTRC     iemRaiseGeneralProtectionFault0(PVMCPU pVCpu);
+IEM_STATIC VBOXSTRICTRC     iemRaiseGeneralProtectionFaultBySelector(PVMCPU pVCpu, RTSEL uSel);
+IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorBounds(PVMCPU pVCpu, uint32_t iSegReg, uint32_t fAccess);
+IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorBoundsBySelector(PVMCPU pVCpu, RTSEL Sel);
+IEM_STATIC VBOXSTRICTRC     iemRaiseSelectorInvalidAccess(PVMCPU pVCpu, uint32_t iSegReg, uint32_t fAccess);
+IEM_STATIC VBOXSTRICTRC     iemRaisePageFault(PVMCPU pVCpu, RTGCPTR GCPtrWhere, uint32_t fAccess, int rc);
+IEM_STATIC VBOXSTRICTRC     iemRaiseAlignmentCheckException(PVMCPU pVCpu);
+IEM_STATIC VBOXSTRICTRC     iemMemMap(PVMCPU pVCpu, void **ppvMem, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t fAccess);
+IEM_STATIC VBOXSTRICTRC     iemMemCommitAndUnmap(PVMCPU pVCpu, void *pvMem, uint32_t fAccess);
+IEM_STATIC VBOXSTRICTRC     iemMemFetchDataU32(PVMCPU pVCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
+IEM_STATIC VBOXSTRICTRC     iemMemFetchDataU64(PVMCPU pVCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
+IEM_STATIC VBOXSTRICTRC     iemMemFetchSysU8(PVMCPU pVCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
+IEM_STATIC VBOXSTRICTRC     iemMemFetchSysU16(PVMCPU pVCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
+IEM_STATIC VBOXSTRICTRC     iemMemFetchSysU32(PVMCPU pVCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
+IEM_STATIC VBOXSTRICTRC     iemMemFetchSysU64(PVMCPU pVCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem);
+IEM_STATIC VBOXSTRICTRC     iemMemFetchSelDescWithErr(PVMCPU pVCpu, PIEMSELDESC pDesc, uint16_t uSel, uint8_t uXcpt, uint16_t uErrorCode);
+IEM_STATIC VBOXSTRICTRC     iemMemFetchSelDesc(PVMCPU pVCpu, PIEMSELDESC pDesc, uint16_t uSel, uint8_t uXcpt);
+IEM_STATIC VBOXSTRICTRC     iemMemStackPushCommitSpecial(PVMCPU pVCpu, void *pvMem, uint64_t uNewRsp);
+IEM_STATIC VBOXSTRICTRC     iemMemStackPushBeginSpecial(PVMCPU pVCpu, size_t cbMem, void **ppvMem, uint64_t *puNewRsp);
+IEM_STATIC VBOXSTRICTRC     iemMemStackPushU32(PVMCPU pVCpu, uint32_t u32Value);
+IEM_STATIC VBOXSTRICTRC     iemMemStackPushU16(PVMCPU pVCpu, uint16_t u16Value);
+IEM_STATIC VBOXSTRICTRC     iemMemMarkSelDescAccessed(PVMCPU pVCpu, uint16_t uSel);
+IEM_STATIC uint16_t         iemSRegFetchU16(PVMCPU pVCpu, uint8_t iSegReg);
 
 #if defined(IEM_VERIFICATION_MODE_FULL) && !defined(IEM_VERIFICATION_MODE_MINIMAL)
-IEM_STATIC PIEMVERIFYEVTREC iemVerifyAllocRecord(PIEMCPU pIemCpu);
-#endif
-IEM_STATIC VBOXSTRICTRC     iemVerifyFakeIOPortRead(PIEMCPU pIemCpu, RTIOPORT Port, uint32_t *pu32Value, size_t cbValue);
-IEM_STATIC VBOXSTRICTRC     iemVerifyFakeIOPortWrite(PIEMCPU pIemCpu, RTIOPORT Port, uint32_t u32Value, size_t cbValue);
+IEM_STATIC PIEMVERIFYEVTREC iemVerifyAllocRecord(PVMCPU pVCpu);
+#endif
+IEM_STATIC VBOXSTRICTRC     iemVerifyFakeIOPortRead(PVMCPU pVCpu, RTIOPORT Port, uint32_t *pu32Value, size_t cbValue);
+IEM_STATIC VBOXSTRICTRC     iemVerifyFakeIOPortWrite(PVMCPU pVCpu, RTIOPORT Port, uint32_t u32Value, size_t cbValue);
 
 
@@ -754 +754 @@
  *
  * @returns VINF_SUCCESS.
- * @param   pIemCpu             The per CPU IEM state of the calling thread.
+ * @param   pVCpu               The cross context virtual CPU structure of the
+ *                              calling thread.
  * @param   rcPassUp            The pass up status.  Must be informational.
  *                              VINF_SUCCESS is not allowed.
  */
-IEM_STATIC int iemSetPassUpStatus(PIEMCPU pIemCpu, VBOXSTRICTRC rcPassUp)
+IEM_STATIC int iemSetPassUpStatus(PVMCPU pVCpu, VBOXSTRICTRC rcPassUp)
 {
     AssertRC(VBOXSTRICTRC_VAL(rcPassUp)); Assert(rcPassUp != VINF_SUCCESS);
 
-    int32_t const rcOldPassUp = pIemCpu->rcPassUp;
+    int32_t const rcOldPassUp = pVCpu->iem.s.rcPassUp;
     if (rcOldPassUp == VINF_SUCCESS)
-        pIemCpu->rcPassUp = VBOXSTRICTRC_VAL(rcPassUp);
+        pVCpu->iem.s.rcPassUp = VBOXSTRICTRC_VAL(rcPassUp);
     /* If both are EM scheduling codes, use EM priority rules. */
     else if (   rcOldPassUp >= VINF_EM_FIRST && rcOldPassUp <= VINF_EM_LAST
@@ -772 +773 @@
         {
             Log(("IEM: rcPassUp=%Rrc! rcOldPassUp=%Rrc\n", VBOXSTRICTRC_VAL(rcPassUp), rcOldPassUp));
-            pIemCpu->rcPassUp = VBOXSTRICTRC_VAL(rcPassUp);
+            pVCpu->iem.s.rcPassUp = VBOXSTRICTRC_VAL(rcPassUp);
         }
         else
@@ -781 +782 @@
     {
         Log(("IEM: rcPassUp=%Rrc! rcOldPassUp=%Rrc\n", VBOXSTRICTRC_VAL(rcPassUp), rcOldPassUp));
-        pIemCpu->rcPassUp = VBOXSTRICTRC_VAL(rcPassUp);
+        pVCpu->iem.s.rcPassUp = VBOXSTRICTRC_VAL(rcPassUp);
     }
     /* Don't override specific status code, first come first served. */
@@ -811 +812 @@
  * Initializes the execution state.
  *
- * @param   pIemCpu             The per CPU IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the
+ *                              calling thread.
  * @param   fBypassHandlers     Whether to bypass access handlers.
  *
@@ -817 +819 @@
  *          side-effects in strict builds.
  */
-DECLINLINE(void) iemInitExec(PIEMCPU pIemCpu, bool fBypassHandlers)
-{
-    PCPUMCTX pCtx  = pIemCpu->CTX_SUFF(pCtx);
-    PVMCPU   pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
+DECLINLINE(void) iemInitExec(PVMCPU pVCpu, bool fBypassHandlers)
+{
+    PCPUMCTX pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_IEM));
@@ -838 +839 @@
     CPUMGuestLazyLoadHiddenCsAndSs(pVCpu);
 #endif
-    pIemCpu->uCpl               = CPUMGetGuestCPL(pVCpu);
-    pIemCpu->enmCpuMode         = iemCalcCpuMode(pCtx);
+    pVCpu->iem.s.uCpl               = CPUMGetGuestCPL(pVCpu);
+    pVCpu->iem.s.enmCpuMode         = iemCalcCpuMode(pCtx);
 #ifdef VBOX_STRICT
-    pIemCpu->enmDefAddrMode     = (IEMMODE)0xc0fe;
-    pIemCpu->enmEffAddrMode     = (IEMMODE)0xc0fe;
-    pIemCpu->enmDefOpSize       = (IEMMODE)0xc0fe;
-    pIemCpu->enmEffOpSize       = (IEMMODE)0xc0fe;
-    pIemCpu->fPrefixes          = (IEMMODE)0xfeedbeef;
-    pIemCpu->uRexReg            = 127;
-    pIemCpu->uRexB              = 127;
-    pIemCpu->uRexIndex          = 127;
-    pIemCpu->iEffSeg            = 127;
-    pIemCpu->offOpcode          = 127;
-    pIemCpu->cbOpcode           = 127;
-#endif
-
-    pIemCpu->cActiveMappings    = 0;
-    pIemCpu->iNextMapping       = 0;
-    pIemCpu->rcPassUp           = VINF_SUCCESS;
-    pIemCpu->fBypassHandlers    = fBypassHandlers;
+    pVCpu->iem.s.enmDefAddrMode     = (IEMMODE)0xc0fe;
+    pVCpu->iem.s.enmEffAddrMode     = (IEMMODE)0xc0fe;
+    pVCpu->iem.s.enmDefOpSize       = (IEMMODE)0xc0fe;
+    pVCpu->iem.s.enmEffOpSize       = (IEMMODE)0xc0fe;
+    pVCpu->iem.s.fPrefixes          = (IEMMODE)0xfeedbeef;
+    pVCpu->iem.s.uRexReg            = 127;
+    pVCpu->iem.s.uRexB              = 127;
+    pVCpu->iem.s.uRexIndex          = 127;
+    pVCpu->iem.s.iEffSeg            = 127;
+    pVCpu->iem.s.offOpcode          = 127;
+    pVCpu->iem.s.cbOpcode           = 127;
+#endif
+
+    pVCpu->iem.s.cActiveMappings    = 0;
+    pVCpu->iem.s.iNextMapping       = 0;
+    pVCpu->iem.s.rcPassUp           = VINF_SUCCESS;
+    pVCpu->iem.s.fBypassHandlers    = fBypassHandlers;
 #ifdef VBOX_WITH_RAW_MODE_NOT_R0
-    pIemCpu->fInPatchCode       = pIemCpu->uCpl == 0
+    pVCpu->iem.s.fInPatchCode       = pVCpu->iem.s.uCpl == 0
                                && pCtx->cs.u64Base == 0
                                && pCtx->cs.u32Limit == UINT32_MAX
-                               && PATMIsPatchGCAddr(IEMCPU_TO_VM(pIemCpu), pCtx->eip);
-    if (!pIemCpu->fInPatchCode)
+                               && PATMIsPatchGCAddr(pVCpu->CTX_SUFF(pVM), pCtx->eip);
+    if (!pVCpu->iem.s.fInPatchCode)
         CPUMRawLeave(pVCpu, VINF_SUCCESS);
 #endif
 
 #ifdef IEM_VERIFICATION_MODE_FULL
-    pIemCpu->fNoRemSavedByExec = pIemCpu->fNoRem;
-    pIemCpu->fNoRem = true;
+    pVCpu->iem.s.fNoRemSavedByExec = pVCpu->iem.s.fNoRem;
+    pVCpu->iem.s.fNoRem = true;
 #endif
 }
@@ -877 +878 @@
  * Counterpart to #iemInitExec that undoes evil strict-build stuff.
  *
- * @param   pIemCpu             The per CPU IEM state.
- */
-DECLINLINE(void) iemUninitExec(PIEMCPU pIemCpu)
+ * @param   pVCpu               The cross context virtual CPU structure of the
+ *                              calling thread.
+ */
+DECLINLINE(void) iemUninitExec(PVMCPU pVCpu)
 {
     /* Note! do not touch fInPatchCode here! (see iemUninitExecAndFiddleStatusAndMaybeReenter) */
 #ifdef IEM_VERIFICATION_MODE_FULL
-    pIemCpu->fNoRem = pIemCpu->fNoRemSavedByExec;
+    pVCpu->iem.s.fNoRem = pVCpu->iem.s.fNoRemSavedByExec;
 #endif
 #ifdef VBOX_STRICT
-    pIemCpu->cbOpcode = 0;
+    pVCpu->iem.s.cbOpcode = 0;
 #else
-    NOREF(pIemCpu);
+    NOREF(pVCpu);
 #endif
 }
@@ -898 +900 @@
  * iemReInitDecoder is mostly a copy of this function.
  *
- * @param   pIemCpu             The per CPU IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the
+ *                              calling thread.
  * @param   fBypassHandlers     Whether to bypass access handlers.
  */
-DECLINLINE(void) iemInitDecoder(PIEMCPU pIemCpu, bool fBypassHandlers)
-{
-    PCPUMCTX pCtx  = pIemCpu->CTX_SUFF(pCtx);
-    PVMCPU   pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
+DECLINLINE(void) iemInitDecoder(PVMCPU pVCpu, bool fBypassHandlers)
+{
+    PCPUMCTX pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_IEM));
@@ -922 +924 @@
     CPUMGuestLazyLoadHiddenCsAndSs(pVCpu);
 #endif
-    pIemCpu->uCpl               = CPUMGetGuestCPL(pVCpu);
+    pVCpu->iem.s.uCpl               = CPUMGetGuestCPL(pVCpu);
 #ifdef IEM_VERIFICATION_MODE_FULL
-    if (pIemCpu->uInjectCpl != UINT8_MAX)
-        pIemCpu->uCpl           = pIemCpu->uInjectCpl;
+    if (pVCpu->iem.s.uInjectCpl != UINT8_MAX)
+        pVCpu->iem.s.uCpl           = pVCpu->iem.s.uInjectCpl;
 #endif
     IEMMODE enmMode = iemCalcCpuMode(pCtx);
-    pIemCpu->enmCpuMode         = enmMode;
-    pIemCpu->enmDefAddrMode     = enmMode;  /** @todo check if this is correct... */
-    pIemCpu->enmEffAddrMode     = enmMode;
+    pVCpu->iem.s.enmCpuMode         = enmMode;
+    pVCpu->iem.s.enmDefAddrMode     = enmMode;  /** @todo check if this is correct... */
+    pVCpu->iem.s.enmEffAddrMode     = enmMode;
     if (enmMode != IEMMODE_64BIT)
     {
-        pIemCpu->enmDefOpSize   = enmMode;  /** @todo check if this is correct... */
-        pIemCpu->enmEffOpSize   = enmMode;
+        pVCpu->iem.s.enmDefOpSize   = enmMode;  /** @todo check if this is correct... */
+        pVCpu->iem.s.enmEffOpSize   = enmMode;
     }
     else
     {
-        pIemCpu->enmDefOpSize   = IEMMODE_32BIT;
-        pIemCpu->enmEffOpSize   = IEMMODE_32BIT;
-    }
-    pIemCpu->fPrefixes          = 0;
-    pIemCpu->uRexReg            = 0;
-    pIemCpu->uRexB              = 0;
-    pIemCpu->uRexIndex          = 0;
-    pIemCpu->iEffSeg            = X86_SREG_DS;
-    pIemCpu->offOpcode          = 0;
-    pIemCpu->cbOpcode           = 0;
-    pIemCpu->cActiveMappings    = 0;
-    pIemCpu->iNextMapping       = 0;
-    pIemCpu->rcPassUp           = VINF_SUCCESS;
-    pIemCpu->fBypassHandlers    = fBypassHandlers;
+        pVCpu->iem.s.enmDefOpSize   = IEMMODE_32BIT;
+        pVCpu->iem.s.enmEffOpSize   = IEMMODE_32BIT;
+    }
+    pVCpu->iem.s.fPrefixes          = 0;
+    pVCpu->iem.s.uRexReg            = 0;
+    pVCpu->iem.s.uRexB              = 0;
+    pVCpu->iem.s.uRexIndex          = 0;
+    pVCpu->iem.s.iEffSeg            = X86_SREG_DS;
+    pVCpu->iem.s.offOpcode          = 0;
+    pVCpu->iem.s.cbOpcode           = 0;
+    pVCpu->iem.s.cActiveMappings    = 0;
+    pVCpu->iem.s.iNextMapping       = 0;
+    pVCpu->iem.s.rcPassUp           = VINF_SUCCESS;
+    pVCpu->iem.s.fBypassHandlers    = fBypassHandlers;
 #ifdef VBOX_WITH_RAW_MODE_NOT_R0
-    pIemCpu->fInPatchCode       = pIemCpu->uCpl == 0
+    pVCpu->iem.s.fInPatchCode       = pVCpu->iem.s.uCpl == 0
                                && pCtx->cs.u64Base == 0
                                && pCtx->cs.u32Limit == UINT32_MAX
-                               && PATMIsPatchGCAddr(IEMCPU_TO_VM(pIemCpu), pCtx->eip);
-    if (!pIemCpu->fInPatchCode)
+                               && PATMIsPatchGCAddr(pVCpu->CTX_SUFF(pVM), pCtx->eip);
+    if (!pVCpu->iem.s.fInPatchCode)
         CPUMRawLeave(pVCpu, VINF_SUCCESS);
 #endif
@@ -965 +967 @@
     {
         case IEMMODE_64BIT:
-            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I64/%u %08llx", pIemCpu->uCpl, pCtx->rip);
+            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I64/%u %08llx", pVCpu->iem.s.uCpl, pCtx->rip);
             break;
         case IEMMODE_32BIT:
-            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I32/%u %04x:%08x", pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip);
+            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I32/%u %04x:%08x", pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip);
             break;
         case IEMMODE_16BIT:
-            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I16/%u %04x:%04x", pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip);
+            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I16/%u %04x:%04x", pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip);
             break;
     }
@@ -984 +986 @@
  *
  * @param   pVCpu               The cross context virtual CPU structure of the calling EMT.
- * @param   pIemCpu             The per CPU IEM state.
- */
-DECLINLINE(void) iemReInitDecoder(PVMCPU pVCpu, PIEMCPU pIemCpu)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+ */
+DECLINLINE(void) iemReInitDecoder(PVMCPU pVCpu)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     Assert(!VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_IEM));
@@ -1003 +1004 @@
 #endif
 
-    pIemCpu->uCpl               = CPUMGetGuestCPL(pVCpu);   /** @todo this should be updated during execution! */
+    pVCpu->iem.s.uCpl               = CPUMGetGuestCPL(pVCpu);   /** @todo this should be updated during execution! */
 #ifdef IEM_VERIFICATION_MODE_FULL
-    if (pIemCpu->uInjectCpl != UINT8_MAX)
-        pIemCpu->uCpl           = pIemCpu->uInjectCpl;
+    if (pVCpu->iem.s.uInjectCpl != UINT8_MAX)
+        pVCpu->iem.s.uCpl           = pVCpu->iem.s.uInjectCpl;
 #endif
     IEMMODE enmMode = iemCalcCpuMode(pCtx);
-    pIemCpu->enmCpuMode         = enmMode;                  /** @todo this should be updated during execution! */
-    pIemCpu->enmDefAddrMode     = enmMode;  /** @todo check if this is correct... */
-    pIemCpu->enmEffAddrMode     = enmMode;
+    pVCpu->iem.s.enmCpuMode         = enmMode;                  /** @todo this should be updated during execution! */
+    pVCpu->iem.s.enmDefAddrMode     = enmMode;  /** @todo check if this is correct... */
+    pVCpu->iem.s.enmEffAddrMode     = enmMode;
     if (enmMode != IEMMODE_64BIT)
     {
-        pIemCpu->enmDefOpSize   = enmMode;  /** @todo check if this is correct... */
-        pIemCpu->enmEffOpSize   = enmMode;
+        pVCpu->iem.s.enmDefOpSize   = enmMode;  /** @todo check if this is correct... */
+        pVCpu->iem.s.enmEffOpSize   = enmMode;
     }
     else
     {
-        pIemCpu->enmDefOpSize   = IEMMODE_32BIT;
-        pIemCpu->enmEffOpSize   = IEMMODE_32BIT;
-    }
-    pIemCpu->fPrefixes          = 0;
-    pIemCpu->uRexReg            = 0;
-    pIemCpu->uRexB              = 0;
-    pIemCpu->uRexIndex          = 0;
-    pIemCpu->iEffSeg            = X86_SREG_DS;
-    if (pIemCpu->cbOpcode > pIemCpu->offOpcode) /* No need to check RIP here because branch instructions will update cbOpcode.  */
-    {
-        pIemCpu->cbOpcode      -= pIemCpu->offOpcode;
-        memmove(&pIemCpu->abOpcode[0], &pIemCpu->abOpcode[pIemCpu->offOpcode], pIemCpu->cbOpcode);
+        pVCpu->iem.s.enmDefOpSize   = IEMMODE_32BIT;
+        pVCpu->iem.s.enmEffOpSize   = IEMMODE_32BIT;
+    }
+    pVCpu->iem.s.fPrefixes          = 0;
+    pVCpu->iem.s.uRexReg            = 0;
+    pVCpu->iem.s.uRexB              = 0;
+    pVCpu->iem.s.uRexIndex          = 0;
+    pVCpu->iem.s.iEffSeg            = X86_SREG_DS;
+    if (pVCpu->iem.s.cbOpcode > pVCpu->iem.s.offOpcode) /* No need to check RIP here because branch instructions will update cbOpcode.  */
+    {
+        pVCpu->iem.s.cbOpcode      -= pVCpu->iem.s.offOpcode;
+        memmove(&pVCpu->iem.s.abOpcode[0], &pVCpu->iem.s.abOpcode[pVCpu->iem.s.offOpcode], pVCpu->iem.s.cbOpcode);
     }
     else
-        pIemCpu->cbOpcode       = 0;
-    pIemCpu->offOpcode          = 0;
-    Assert(pIemCpu->cActiveMappings == 0);
-    pIemCpu->iNextMapping       = 0;
-    Assert(pIemCpu->rcPassUp   == VINF_SUCCESS);
-    Assert(pIemCpu->fBypassHandlers == false);
+        pVCpu->iem.s.cbOpcode       = 0;
+    pVCpu->iem.s.offOpcode          = 0;
+    Assert(pVCpu->iem.s.cActiveMappings == 0);
+    pVCpu->iem.s.iNextMapping       = 0;
+    Assert(pVCpu->iem.s.rcPassUp   == VINF_SUCCESS);
+    Assert(pVCpu->iem.s.fBypassHandlers == false);
 #ifdef VBOX_WITH_RAW_MODE_NOT_R0
-    if (!pIemCpu->fInPatchCode)
+    if (!pVCpu->iem.s.fInPatchCode)
     { /* likely */ }
     else
     {
-        pIemCpu->fInPatchCode   = pIemCpu->uCpl == 0
+        pVCpu->iem.s.fInPatchCode   = pVCpu->iem.s.uCpl == 0
                                && pCtx->cs.u64Base == 0
                                && pCtx->cs.u32Limit == UINT32_MAX
-                               && PATMIsPatchGCAddr(IEMCPU_TO_VM(pIemCpu), pCtx->eip);
-        if (!pIemCpu->fInPatchCode)
+                               && PATMIsPatchGCAddr(pVCpu->CTX_SUFF(pVM), pCtx->eip);
+        if (!pVCpu->iem.s.fInPatchCode)
             CPUMRawLeave(pVCpu, VINF_SUCCESS);
     }
@@ -1057 +1058 @@
     {
         case IEMMODE_64BIT:
-            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I64/%u %08llx", pIemCpu->uCpl, pCtx->rip);
+            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I64/%u %08llx", pVCpu->iem.s.uCpl, pCtx->rip);
             break;
         case IEMMODE_32BIT:
-            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I32/%u %04x:%08x", pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip);
+            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I32/%u %04x:%08x", pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip);
             break;
         case IEMMODE_16BIT:
-            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I16/%u %04x:%04x", pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip);
+            RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "I16/%u %04x:%04x", pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip);
             break;
     }
@@ -1075 +1076 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the
+ *                              calling thread.
  * @param   fBypassHandlers     Whether to bypass access handlers.
  */
-IEM_STATIC VBOXSTRICTRC iemInitDecoderAndPrefetchOpcodes(PIEMCPU pIemCpu, bool fBypassHandlers)
+IEM_STATIC VBOXSTRICTRC iemInitDecoderAndPrefetchOpcodes(PVMCPU pVCpu, bool fBypassHandlers)
 {
 #ifdef IEM_VERIFICATION_MODE_FULL
-    uint8_t const cbOldOpcodes = pIemCpu->cbOpcode;
-#endif
-    iemInitDecoder(pIemCpu, fBypassHandlers);
+    uint8_t const cbOldOpcodes = pVCpu->iem.s.cbOpcode;
+#endif
+    iemInitDecoder(pVCpu, fBypassHandlers);
 
     /*
@@ -1090 +1092 @@
      * First translate CS:rIP to a physical address.
      */
-    PCPUMCTX    pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint32_t    cbToTryRead;
     RTGCPTR     GCPtrPC;
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         cbToTryRead = PAGE_SIZE;
         GCPtrPC     = pCtx->rip;
         if (!IEM_IS_CANONICAL(GCPtrPC))
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         cbToTryRead = PAGE_SIZE - (GCPtrPC & PAGE_OFFSET_MASK);
     }
@@ -1104 +1106 @@
     {
         uint32_t GCPtrPC32 = pCtx->eip;
-        AssertMsg(!(GCPtrPC32 & ~(uint32_t)UINT16_MAX) || pIemCpu->enmCpuMode == IEMMODE_32BIT, ("%04x:%RX64\n", pCtx->cs.Sel, pCtx->rip));
+        AssertMsg(!(GCPtrPC32 & ~(uint32_t)UINT16_MAX) || pVCpu->iem.s.enmCpuMode == IEMMODE_32BIT, ("%04x:%RX64\n", pCtx->cs.Sel, pCtx->rip));
         if (GCPtrPC32 > pCtx->cs.u32Limit)
-            return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
+            return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
         cbToTryRead = pCtx->cs.u32Limit - GCPtrPC32 + 1;
         if (!cbToTryRead) /* overflowed */
@@ -1120 +1122 @@
     /* Allow interpretation of patch manager code blocks since they can for
        instance throw #PFs for perfectly good reasons. */
-    if (pIemCpu->fInPatchCode)
+    if (pVCpu->iem.s.fInPatchCode)
     {
         size_t cbRead = 0;
-        int rc = PATMReadPatchCode(IEMCPU_TO_VM(pIemCpu), GCPtrPC, pIemCpu->abOpcode, sizeof(pIemCpu->abOpcode), &cbRead);
+        int rc = PATMReadPatchCode(pVCpu->CTX_SUFF(pVM), GCPtrPC, pVCpu->iem.s.abOpcode, sizeof(pVCpu->iem.s.abOpcode), &cbRead);
         AssertRCReturn(rc, rc);
-        pIemCpu->cbOpcode = (uint8_t)cbRead; Assert(pIemCpu->cbOpcode == cbRead); Assert(cbRead > 0);
+        pVCpu->iem.s.cbOpcode = (uint8_t)cbRead; Assert(pVCpu->iem.s.cbOpcode == cbRead); Assert(cbRead > 0);
         return VINF_SUCCESS;
     }
@@ -1132 +1134 @@
     RTGCPHYS    GCPhys;
     uint64_t    fFlags;
-    int rc = PGMGstGetPage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPC, &fFlags, &GCPhys);
+    int rc = PGMGstGetPage(pVCpu, GCPtrPC, &fFlags, &GCPhys);
     if (RT_FAILURE(rc))
     {
         Log(("iemInitDecoderAndPrefetchOpcodes: %RGv - rc=%Rrc\n", GCPtrPC, rc));
-        return iemRaisePageFault(pIemCpu, GCPtrPC, IEM_ACCESS_INSTRUCTION, rc);
-    }
-    if (!(fFlags & X86_PTE_US) && pIemCpu->uCpl == 3)
+        return iemRaisePageFault(pVCpu, GCPtrPC, IEM_ACCESS_INSTRUCTION, rc);
+    }
+    if (!(fFlags & X86_PTE_US) && pVCpu->iem.s.uCpl == 3)
     {
         Log(("iemInitDecoderAndPrefetchOpcodes: %RGv - supervisor page\n", GCPtrPC));
-        return iemRaisePageFault(pIemCpu, GCPtrPC, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
+        return iemRaisePageFault(pVCpu, GCPtrPC, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
     }
     if ((fFlags & X86_PTE_PAE_NX) && (pCtx->msrEFER & MSR_K6_EFER_NXE))
     {
         Log(("iemInitDecoderAndPrefetchOpcodes: %RGv - NX\n", GCPtrPC));
-        return iemRaisePageFault(pIemCpu, GCPtrPC, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
+        return iemRaisePageFault(pVCpu, GCPtrPC, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
     }
     GCPhys |= GCPtrPC & PAGE_OFFSET_MASK;
@@ -1159 +1161 @@
      */
     /** @todo optimize this differently by not using PGMPhysRead. */
-    RTGCPHYS const offPrevOpcodes = GCPhys - pIemCpu->GCPhysOpcodes;
-    pIemCpu->GCPhysOpcodes = GCPhys;
+    RTGCPHYS const offPrevOpcodes = GCPhys - pVCpu->iem.s.GCPhysOpcodes;
+    pVCpu->iem.s.GCPhysOpcodes = GCPhys;
     if (   offPrevOpcodes < cbOldOpcodes
-        && PAGE_SIZE - (GCPhys & PAGE_OFFSET_MASK) > sizeof(pIemCpu->abOpcode))
+        && PAGE_SIZE - (GCPhys & PAGE_OFFSET_MASK) > sizeof(pVCpu->iem.s.abOpcode))
     {
         uint8_t cbNew = cbOldOpcodes - (uint8_t)offPrevOpcodes;
-        Assert(cbNew <= RT_ELEMENTS(pIemCpu->abOpcode));
-        memmove(&pIemCpu->abOpcode[0], &pIemCpu->abOpcode[offPrevOpcodes], cbNew);
-        pIemCpu->cbOpcode = cbNew;
+        Assert(cbNew <= RT_ELEMENTS(pVCpu->iem.s.abOpcode));
+        memmove(&pVCpu->iem.s.abOpcode[0], &pVCpu->iem.s.abOpcode[offPrevOpcodes], cbNew);
+        pVCpu->iem.s.cbOpcode = cbNew;
         return VINF_SUCCESS;
     }
@@ -1175 +1177 @@
      * Read the bytes at this address.
      */
-    PVM pVM = IEMCPU_TO_VM(pIemCpu);
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
 #if defined(IN_RING3) && defined(VBOX_WITH_RAW_MODE_NOT_R0)
     size_t cbActual;
     if (   PATMIsEnabled(pVM)
-        && RT_SUCCESS(PATMR3ReadOrgInstr(pVM, GCPtrPC, pIemCpu->abOpcode, sizeof(pIemCpu->abOpcode), &cbActual)))
+        && RT_SUCCESS(PATMR3ReadOrgInstr(pVM, GCPtrPC, pVCpu->iem.s.abOpcode, sizeof(pVCpu->iem.s.abOpcode), &cbActual)))
     {
         Log4(("decode - Read %u unpatched bytes at %RGv\n", cbActual, GCPtrPC));
         Assert(cbActual > 0);
-        pIemCpu->cbOpcode = (uint8_t)cbActual;
+        pVCpu->iem.s.cbOpcode = (uint8_t)cbActual;
     }
     else
@@ -1191 +1193 @@
         if (cbToTryRead > cbLeftOnPage)
             cbToTryRead = cbLeftOnPage;
-        if (cbToTryRead > sizeof(pIemCpu->abOpcode))
-            cbToTryRead = sizeof(pIemCpu->abOpcode);
-
-        if (!pIemCpu->fBypassHandlers)
+        if (cbToTryRead > sizeof(pVCpu->iem.s.abOpcode))
+            cbToTryRead = sizeof(pVCpu->iem.s.abOpcode);
+
+        if (!pVCpu->iem.s.fBypassHandlers)
         {
-            VBOXSTRICTRC rcStrict = PGMPhysRead(pVM, GCPhys, pIemCpu->abOpcode, cbToTryRead, PGMACCESSORIGIN_IEM);
+            VBOXSTRICTRC rcStrict = PGMPhysRead(pVM, GCPhys, pVCpu->iem.s.abOpcode, cbToTryRead, PGMACCESSORIGIN_IEM);
             if (RT_LIKELY(rcStrict == VINF_SUCCESS))
             { /* likely */ }
@@ -1203 +1205 @@
                 Log(("iemInitDecoderAndPrefetchOpcodes: %RGv/%RGp LB %#x - read status -  rcStrict=%Rrc\n",
                      GCPtrPC, GCPhys, VBOXSTRICTRC_VAL(rcStrict), cbToTryRead));
-                rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
             }
             else
@@ -1216 +1218 @@
         else
         {
-            rc = PGMPhysSimpleReadGCPhys(pVM, pIemCpu->abOpcode, GCPhys, cbToTryRead);
+            rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->iem.s.abOpcode, GCPhys, cbToTryRead);
             if (RT_SUCCESS(rc))
             { /* likely */ }
@@ -1226 +1228 @@
             }
         }
-        pIemCpu->cbOpcode = cbToTryRead;
+        pVCpu->iem.s.cbOpcode = cbToTryRead;
     }
 
@@ -1238 +1240 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the
+ *                              calling thread.
  * @param   cbMin               The minimum number of bytes relative offOpcode
  *                              that must be read.
  */
-IEM_STATIC VBOXSTRICTRC iemOpcodeFetchMoreBytes(PIEMCPU pIemCpu, size_t cbMin)
+IEM_STATIC VBOXSTRICTRC iemOpcodeFetchMoreBytes(PVMCPU pVCpu, size_t cbMin)
 {
     /*
@@ -1249 +1252 @@
      * First translate CS:rIP to a physical address.
      */
-    PCPUMCTX    pCtx = pIemCpu->CTX_SUFF(pCtx);
-    uint8_t     cbLeft = pIemCpu->cbOpcode - pIemCpu->offOpcode; Assert(cbLeft < cbMin);
+    PCPUMCTX    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    uint8_t     cbLeft = pVCpu->iem.s.cbOpcode - pVCpu->iem.s.offOpcode; Assert(cbLeft < cbMin);
     uint32_t    cbToTryRead;
     RTGCPTR     GCPtrNext;
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         cbToTryRead = PAGE_SIZE;
-        GCPtrNext   = pCtx->rip + pIemCpu->cbOpcode;
+        GCPtrNext   = pCtx->rip + pVCpu->iem.s.cbOpcode;
         if (!IEM_IS_CANONICAL(GCPtrNext))
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
     }
     else
     {
         uint32_t GCPtrNext32 = pCtx->eip;
-        Assert(!(GCPtrNext32 & ~(uint32_t)UINT16_MAX) || pIemCpu->enmCpuMode == IEMMODE_32BIT);
-        GCPtrNext32 += pIemCpu->cbOpcode;
+        Assert(!(GCPtrNext32 & ~(uint32_t)UINT16_MAX) || pVCpu->iem.s.enmCpuMode == IEMMODE_32BIT);
+        GCPtrNext32 += pVCpu->iem.s.cbOpcode;
         if (GCPtrNext32 > pCtx->cs.u32Limit)
-            return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
+            return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
         cbToTryRead = pCtx->cs.u32Limit - GCPtrNext32 + 1;
         if (!cbToTryRead) /* overflowed */
@@ -1275 +1278 @@
         }
         if (cbToTryRead < cbMin - cbLeft)
-            return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
+            return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
         GCPtrNext = (uint32_t)pCtx->cs.u64Base + GCPtrNext32;
     }
@@ -1284 +1287 @@
     if (cbToTryRead > cbLeftOnPage)
         cbToTryRead = cbLeftOnPage;
-    if (cbToTryRead > sizeof(pIemCpu->abOpcode) - pIemCpu->cbOpcode)
-        cbToTryRead = sizeof(pIemCpu->abOpcode) - pIemCpu->cbOpcode;
+    if (cbToTryRead > sizeof(pVCpu->iem.s.abOpcode) - pVCpu->iem.s.cbOpcode)
+        cbToTryRead = sizeof(pVCpu->iem.s.abOpcode) - pVCpu->iem.s.cbOpcode;
 /** @todo r=bird: Convert assertion into undefined opcode exception? */
     Assert(cbToTryRead >= cbMin - cbLeft); /* ASSUMPTION based on iemInitDecoderAndPrefetchOpcodes. */
@@ -1292 +1295 @@
     /* Allow interpretation of patch manager code blocks since they can for
        instance throw #PFs for perfectly good reasons. */
-    if (pIemCpu->fInPatchCode)
+    if (pVCpu->iem.s.fInPatchCode)
     {
         size_t cbRead = 0;
-        int rc = PATMReadPatchCode(IEMCPU_TO_VM(pIemCpu), GCPtrNext, pIemCpu->abOpcode, cbToTryRead, &cbRead);
+        int rc = PATMReadPatchCode(pVCpu->CTX_SUFF(pVM), GCPtrNext, pVCpu->iem.s.abOpcode, cbToTryRead, &cbRead);
         AssertRCReturn(rc, rc);
-        pIemCpu->cbOpcode = (uint8_t)cbRead; Assert(pIemCpu->cbOpcode == cbRead); Assert(cbRead > 0);
+        pVCpu->iem.s.cbOpcode = (uint8_t)cbRead; Assert(pVCpu->iem.s.cbOpcode == cbRead); Assert(cbRead > 0);
         return VINF_SUCCESS;
     }
@@ -1304 +1307 @@
     RTGCPHYS    GCPhys;
     uint64_t    fFlags;
-    int rc = PGMGstGetPage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrNext, &fFlags, &GCPhys);
+    int rc = PGMGstGetPage(pVCpu, GCPtrNext, &fFlags, &GCPhys);
     if (RT_FAILURE(rc))
     {
         Log(("iemOpcodeFetchMoreBytes: %RGv - rc=%Rrc\n", GCPtrNext, rc));
-        return iemRaisePageFault(pIemCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, rc);
-    }
-    if (!(fFlags & X86_PTE_US) && pIemCpu->uCpl == 3)
+        return iemRaisePageFault(pVCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, rc);
+    }
+    if (!(fFlags & X86_PTE_US) && pVCpu->iem.s.uCpl == 3)
     {
         Log(("iemOpcodeFetchMoreBytes: %RGv - supervisor page\n", GCPtrNext));
-        return iemRaisePageFault(pIemCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
+        return iemRaisePageFault(pVCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
     }
     if ((fFlags & X86_PTE_PAE_NX) && (pCtx->msrEFER & MSR_K6_EFER_NXE))
     {
         Log(("iemOpcodeFetchMoreBytes: %RGv - NX\n", GCPtrNext));
-        return iemRaisePageFault(pIemCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
+        return iemRaisePageFault(pVCpu, GCPtrNext, IEM_ACCESS_INSTRUCTION, VERR_ACCESS_DENIED);
     }
     GCPhys |= GCPtrNext & PAGE_OFFSET_MASK;
-    Log5(("GCPtrNext=%RGv GCPhys=%RGp cbOpcodes=%#x\n",  GCPtrNext,  GCPhys,  pIemCpu->cbOpcode));
+    Log5(("GCPtrNext=%RGv GCPhys=%RGp cbOpcodes=%#x\n",  GCPtrNext,  GCPhys,  pVCpu->iem.s.cbOpcode));
     /** @todo Check reserved bits and such stuff. PGM is better at doing
      *        that, so do it when implementing the guest virtual address
@@ -1333 +1336 @@
      * should be no need to check again here.
      */
-    if (!pIemCpu->fBypassHandlers)
-    {
-        VBOXSTRICTRC rcStrict = PGMPhysRead(IEMCPU_TO_VM(pIemCpu), GCPhys, &pIemCpu->abOpcode[pIemCpu->cbOpcode],
+    if (!pVCpu->iem.s.fBypassHandlers)
+    {
+        VBOXSTRICTRC rcStrict = PGMPhysRead(pVCpu->CTX_SUFF(pVM), GCPhys, &pVCpu->iem.s.abOpcode[pVCpu->iem.s.cbOpcode],
                                             cbToTryRead, PGMACCESSORIGIN_IEM);
         if (RT_LIKELY(rcStrict == VINF_SUCCESS))
@@ -1343 +1346 @@
             Log(("iemOpcodeFetchMoreBytes: %RGv/%RGp LB %#x - read status -  rcStrict=%Rrc\n",
                  GCPtrNext, GCPhys, VBOXSTRICTRC_VAL(rcStrict), cbToTryRead));
-            rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+            rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
         }
         else
@@ -1356 +1359 @@
     else
     {
-        rc = PGMPhysSimpleReadGCPhys(IEMCPU_TO_VM(pIemCpu), &pIemCpu->abOpcode[pIemCpu->cbOpcode], GCPhys, cbToTryRead);
+        rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->iem.s.abOpcode[pVCpu->iem.s.cbOpcode], GCPhys, cbToTryRead);
         if (RT_SUCCESS(rc))
         { /* likely */ }
@@ -1365 +1368 @@
         }
     }
-    pIemCpu->cbOpcode += cbToTryRead;
-    Log5(("%.*Rhxs\n", pIemCpu->cbOpcode, pIemCpu->abOpcode));
+    pVCpu->iem.s.cbOpcode += cbToTryRead;
+    Log5(("%.*Rhxs\n", pVCpu->iem.s.cbOpcode, pVCpu->iem.s.abOpcode));
 
     return VINF_SUCCESS;
@@ -1377 +1380 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the
+ *                              calling thread.
  * @param   pb                  Where to return the opcode byte.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU8Slow(PIEMCPU pIemCpu, uint8_t *pb)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 1);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU8Slow(PVMCPU pVCpu, uint8_t *pb)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 1);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        *pb = pIemCpu->abOpcode[offOpcode];
-        pIemCpu->offOpcode = offOpcode + 1;
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        *pb = pVCpu->iem.s.abOpcode[offOpcode];
+        pVCpu->iem.s.offOpcode = offOpcode + 1;
     }
     else
@@ -1399 +1403 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the
+ *                              calling thread.
  * @param   pu8                 Where to return the opcode byte.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU8(PIEMCPU pIemCpu, uint8_t *pu8)
-{
-    uintptr_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_LIKELY((uint8_t)offOpcode < pIemCpu->cbOpcode))
-    {
-        pIemCpu->offOpcode = (uint8_t)offOpcode + 1;
-        *pu8 = pIemCpu->abOpcode[offOpcode];
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU8(PVMCPU pVCpu, uint8_t *pu8)
+{
+    uintptr_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_LIKELY((uint8_t)offOpcode < pVCpu->iem.s.cbOpcode))
+    {
+        pVCpu->iem.s.offOpcode = (uint8_t)offOpcode + 1;
+        *pu8 = pVCpu->iem.s.abOpcode[offOpcode];
         return VINF_SUCCESS;
     }
-    return iemOpcodeGetNextU8Slow(pIemCpu, pu8);
+    return iemOpcodeGetNextU8Slow(pVCpu, pu8);
 }
 
@@ -1420 +1425 @@
  *
  * @returns The opcode byte.
- * @param   pIemCpu             The IEM state.
- */
-DECL_NO_INLINE(IEM_STATIC, uint8_t) iemOpcodeGetNextU8SlowJmp(PIEMCPU pIemCpu)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 1);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECL_NO_INLINE(IEM_STATIC, uint8_t) iemOpcodeGetNextU8SlowJmp(PVMCPU pVCpu)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 1);
     if (rcStrict == VINF_SUCCESS)
-        return pIemCpu->abOpcode[pIemCpu->offOpcode++];
-    longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+        return pVCpu->iem.s.abOpcode[pVCpu->iem.s.offOpcode++];
+    longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
 }
 
@@ -1435 +1440 @@
  *
  * @returns The opcode byte.
- * @param   pIemCpu             The IEM state.
- */
-DECLINLINE(uint8_t) iemOpcodeGetNextU8Jmp(PIEMCPU pIemCpu)
-{
-    uintptr_t offOpcode = pIemCpu->offOpcode;
-    if (RT_LIKELY((uint8_t)offOpcode < pIemCpu->cbOpcode))
-    {
-        pIemCpu->offOpcode = (uint8_t)offOpcode + 1;
-        return pIemCpu->abOpcode[offOpcode];
-    }
-    return iemOpcodeGetNextU8SlowJmp(pIemCpu);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(uint8_t) iemOpcodeGetNextU8Jmp(PVMCPU pVCpu)
+{
+    uintptr_t offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_LIKELY((uint8_t)offOpcode < pVCpu->iem.s.cbOpcode))
+    {
+        pVCpu->iem.s.offOpcode = (uint8_t)offOpcode + 1;
+        return pVCpu->iem.s.abOpcode[offOpcode];
+    }
+    return iemOpcodeGetNextU8SlowJmp(pVCpu);
 }
 
@@ -1454 +1459 @@
  *
  * @param   a_pu8               Where to return the opcode byte.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -1460 +1465 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU8(pIemCpu, (a_pu8)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU8(pVCpu, (a_pu8)); \
         if (rcStrict2 == VINF_SUCCESS) \
         { /* likely */ } \
@@ -1467 +1472 @@
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U8(a_pu8) (*(a_pu8) = iemOpcodeGetNextU8Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_U8(a_pu8) (*(a_pu8) = iemOpcodeGetNextU8Jmp(pVCpu))
 #endif /* IEM_WITH_SETJMP */
 
@@ -1476 +1481 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pi8                 Where to return the signed byte.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS8(PIEMCPU pIemCpu, int8_t *pi8)
-{
-    return iemOpcodeGetNextU8(pIemCpu, (uint8_t *)pi8);
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS8(PVMCPU pVCpu, int8_t *pi8)
+{
+    return iemOpcodeGetNextU8(pVCpu, (uint8_t *)pi8);
 }
 #endif /* !IEM_WITH_SETJMP */
@@ -1491 +1496 @@
  *
  * @param   a_pi8               Where to return the signed byte.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -1497 +1502 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS8(pIemCpu, (a_pi8)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS8(pVCpu, (a_pi8)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else /* IEM_WITH_SETJMP */
-# define IEM_OPCODE_GET_NEXT_S8(a_pi8) (*(a_pi8) = (int8_t)iemOpcodeGetNextU8Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_S8(a_pi8) (*(a_pi8) = (int8_t)iemOpcodeGetNextU8Jmp(pVCpu))
 
 #endif /* IEM_WITH_SETJMP */
@@ -1512 +1517 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu16                Where to return the opcode dword.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextS8SxU16Slow(PIEMCPU pIemCpu, uint16_t *pu16)
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextS8SxU16Slow(PVMCPU pVCpu, uint16_t *pu16)
 {
     uint8_t      u8;
-    VBOXSTRICTRC rcStrict = iemOpcodeGetNextU8Slow(pIemCpu, &u8);
+    VBOXSTRICTRC rcStrict = iemOpcodeGetNextU8Slow(pVCpu, &u8);
     if (rcStrict == VINF_SUCCESS)
         *pu16 = (int8_t)u8;
@@ -1530 +1535 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu16                Where to return the unsigned word.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS8SxU16(PIEMCPU pIemCpu, uint16_t *pu16)
-{
-    uint8_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_UNLIKELY(offOpcode >= pIemCpu->cbOpcode))
-        return iemOpcodeGetNextS8SxU16Slow(pIemCpu, pu16);
-
-    *pu16 = (int8_t)pIemCpu->abOpcode[offOpcode];
-    pIemCpu->offOpcode = offOpcode + 1;
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS8SxU16(PVMCPU pVCpu, uint16_t *pu16)
+{
+    uint8_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_UNLIKELY(offOpcode >= pVCpu->iem.s.cbOpcode))
+        return iemOpcodeGetNextS8SxU16Slow(pVCpu, pu16);
+
+    *pu16 = (int8_t)pVCpu->iem.s.abOpcode[offOpcode];
+    pVCpu->iem.s.offOpcode = offOpcode + 1;
     return VINF_SUCCESS;
 }
@@ -1551 +1556 @@
  *
  * @param   a_pu16              Where to return the word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -1557 +1562 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS8SxU16(pIemCpu, (a_pu16)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS8SxU16(pVCpu, (a_pu16)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_S8_SX_U16(a_pu16) (*(a_pu16) = (int8_t)iemOpcodeGetNextU8Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_S8_SX_U16(a_pu16) (*(a_pu16) = (int8_t)iemOpcodeGetNextU8Jmp(pVCpu))
 #endif
 
@@ -1571 +1576 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32                Where to return the opcode dword.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextS8SxU32Slow(PIEMCPU pIemCpu, uint32_t *pu32)
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextS8SxU32Slow(PVMCPU pVCpu, uint32_t *pu32)
 {
     uint8_t      u8;
-    VBOXSTRICTRC rcStrict = iemOpcodeGetNextU8Slow(pIemCpu, &u8);
+    VBOXSTRICTRC rcStrict = iemOpcodeGetNextU8Slow(pVCpu, &u8);
     if (rcStrict == VINF_SUCCESS)
         *pu32 = (int8_t)u8;
@@ -1589 +1594 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32                Where to return the unsigned dword.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS8SxU32(PIEMCPU pIemCpu, uint32_t *pu32)
-{
-    uint8_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_UNLIKELY(offOpcode >= pIemCpu->cbOpcode))
-        return iemOpcodeGetNextS8SxU32Slow(pIemCpu, pu32);
-
-    *pu32 = (int8_t)pIemCpu->abOpcode[offOpcode];
-    pIemCpu->offOpcode = offOpcode + 1;
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS8SxU32(PVMCPU pVCpu, uint32_t *pu32)
+{
+    uint8_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_UNLIKELY(offOpcode >= pVCpu->iem.s.cbOpcode))
+        return iemOpcodeGetNextS8SxU32Slow(pVCpu, pu32);
+
+    *pu32 = (int8_t)pVCpu->iem.s.abOpcode[offOpcode];
+    pVCpu->iem.s.offOpcode = offOpcode + 1;
     return VINF_SUCCESS;
 }
@@ -1610 +1615 @@
  *
  * @param   a_pu32              Where to return the word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -1616 +1621 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS8SxU32(pIemCpu, (a_pu32)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS8SxU32(pVCpu, (a_pu32)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_S8_SX_U32(a_pu32) (*(a_pu32) = (int8_t)iemOpcodeGetNextU8Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_S8_SX_U32(a_pu32) (*(a_pu32) = (int8_t)iemOpcodeGetNextU8Jmp(pVCpu))
 #endif
 
@@ -1630 +1635 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the opcode qword.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextS8SxU64Slow(PIEMCPU pIemCpu, uint64_t *pu64)
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextS8SxU64Slow(PVMCPU pVCpu, uint64_t *pu64)
 {
     uint8_t      u8;
-    VBOXSTRICTRC rcStrict = iemOpcodeGetNextU8Slow(pIemCpu, &u8);
+    VBOXSTRICTRC rcStrict = iemOpcodeGetNextU8Slow(pVCpu, &u8);
     if (rcStrict == VINF_SUCCESS)
         *pu64 = (int8_t)u8;
@@ -1648 +1653 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the unsigned qword.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS8SxU64(PIEMCPU pIemCpu, uint64_t *pu64)
-{
-    uint8_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_UNLIKELY(offOpcode >= pIemCpu->cbOpcode))
-        return iemOpcodeGetNextS8SxU64Slow(pIemCpu, pu64);
-
-    *pu64 = (int8_t)pIemCpu->abOpcode[offOpcode];
-    pIemCpu->offOpcode = offOpcode + 1;
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS8SxU64(PVMCPU pVCpu, uint64_t *pu64)
+{
+    uint8_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_UNLIKELY(offOpcode >= pVCpu->iem.s.cbOpcode))
+        return iemOpcodeGetNextS8SxU64Slow(pVCpu, pu64);
+
+    *pu64 = (int8_t)pVCpu->iem.s.abOpcode[offOpcode];
+    pVCpu->iem.s.offOpcode = offOpcode + 1;
     return VINF_SUCCESS;
 }
@@ -1670 +1675 @@
  *
  * @param   a_pu64              Where to return the word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -1676 +1681 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS8SxU64(pIemCpu, (a_pu64)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS8SxU64(pVCpu, (a_pu64)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_S8_SX_U64(a_pu64) (*(a_pu64) = (int8_t)iemOpcodeGetNextU8Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_S8_SX_U64(a_pu64) (*(a_pu64) = (int8_t)iemOpcodeGetNextU8Jmp(pVCpu))
 #endif
 
@@ -1691 +1696 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu16                Where to return the opcode word.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU16Slow(PIEMCPU pIemCpu, uint16_t *pu16)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 2);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU16Slow(PVMCPU pVCpu, uint16_t *pu16)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 2);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        *pu16 = RT_MAKE_U16(pIemCpu->abOpcode[offOpcode], pIemCpu->abOpcode[offOpcode + 1]);
-        pIemCpu->offOpcode = offOpcode + 2;
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        *pu16 = RT_MAKE_U16(pVCpu->iem.s.abOpcode[offOpcode], pVCpu->iem.s.abOpcode[offOpcode + 1]);
+        pVCpu->iem.s.offOpcode = offOpcode + 2;
     }
     else
@@ -1713 +1718 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu16                Where to return the opcode word.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU16(PIEMCPU pIemCpu, uint16_t *pu16)
-{
-    uintptr_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_LIKELY((uint8_t)offOpcode + 2 <= pIemCpu->cbOpcode))
-    {
-        pIemCpu->offOpcode = (uint8_t)offOpcode + 2;
-        *pu16 = RT_MAKE_U16(pIemCpu->abOpcode[offOpcode], pIemCpu->abOpcode[offOpcode + 1]);
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU16(PVMCPU pVCpu, uint16_t *pu16)
+{
+    uintptr_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_LIKELY((uint8_t)offOpcode + 2 <= pVCpu->iem.s.cbOpcode))
+    {
+        pVCpu->iem.s.offOpcode = (uint8_t)offOpcode + 2;
+        *pu16 = RT_MAKE_U16(pVCpu->iem.s.abOpcode[offOpcode], pVCpu->iem.s.abOpcode[offOpcode + 1]);
         return VINF_SUCCESS;
     }
-    return iemOpcodeGetNextU16Slow(pIemCpu, pu16);
+    return iemOpcodeGetNextU16Slow(pVCpu, pu16);
 }
 
@@ -1734 +1739 @@
  *
  * @returns The opcode word.
- * @param   pIemCpu             The IEM state.
- */
-DECL_NO_INLINE(IEM_STATIC, uint16_t) iemOpcodeGetNextU16SlowJmp(PIEMCPU pIemCpu)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 2);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECL_NO_INLINE(IEM_STATIC, uint16_t) iemOpcodeGetNextU16SlowJmp(PVMCPU pVCpu)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 2);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        pIemCpu->offOpcode += 2;
-        return RT_MAKE_U16(pIemCpu->abOpcode[offOpcode], pIemCpu->abOpcode[offOpcode + 1]);
-    }
-    longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        pVCpu->iem.s.offOpcode += 2;
+        return RT_MAKE_U16(pVCpu->iem.s.abOpcode[offOpcode], pVCpu->iem.s.abOpcode[offOpcode + 1]);
+    }
+    longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
 }
 
@@ -1753 +1758 @@
  *
  * @returns The opcode word.
- * @param   pIemCpu             The IEM state.
- */
-DECLINLINE(uint16_t) iemOpcodeGetNextU16Jmp(PIEMCPU pIemCpu)
-{
-    uintptr_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_LIKELY((uint8_t)offOpcode + 2 <= pIemCpu->cbOpcode))
-    {
-        pIemCpu->offOpcode = (uint8_t)offOpcode + 2;
-        return RT_MAKE_U16(pIemCpu->abOpcode[offOpcode], pIemCpu->abOpcode[offOpcode + 1]);
-    }
-    return iemOpcodeGetNextU16SlowJmp(pIemCpu);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(uint16_t) iemOpcodeGetNextU16Jmp(PVMCPU pVCpu)
+{
+    uintptr_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_LIKELY((uint8_t)offOpcode + 2 <= pVCpu->iem.s.cbOpcode))
+    {
+        pVCpu->iem.s.offOpcode = (uint8_t)offOpcode + 2;
+        return RT_MAKE_U16(pVCpu->iem.s.abOpcode[offOpcode], pVCpu->iem.s.abOpcode[offOpcode + 1]);
+    }
+    return iemOpcodeGetNextU16SlowJmp(pVCpu);
 }
 
@@ -1773 +1778 @@
  *
  * @param   a_pu16              Where to return the opcode word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -1779 +1784 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU16(pIemCpu, (a_pu16)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU16(pVCpu, (a_pu16)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U16(a_pu16) (*(a_pu16) = iemOpcodeGetNextU16Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_U16(a_pu16) (*(a_pu16) = iemOpcodeGetNextU16Jmp(pVCpu))
 #endif
 
@@ -1793 +1798 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32                Where to return the opcode double word.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU16ZxU32Slow(PIEMCPU pIemCpu, uint32_t *pu32)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 2);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU16ZxU32Slow(PVMCPU pVCpu, uint32_t *pu32)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 2);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        *pu32 = RT_MAKE_U16(pIemCpu->abOpcode[offOpcode], pIemCpu->abOpcode[offOpcode + 1]);
-        pIemCpu->offOpcode = offOpcode + 2;
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        *pu32 = RT_MAKE_U16(pVCpu->iem.s.abOpcode[offOpcode], pVCpu->iem.s.abOpcode[offOpcode + 1]);
+        pVCpu->iem.s.offOpcode = offOpcode + 2;
     }
     else
@@ -1815 +1820 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32                Where to return the opcode double word.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU16ZxU32(PIEMCPU pIemCpu, uint32_t *pu32)
-{
-    uint8_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_UNLIKELY(offOpcode + 2 > pIemCpu->cbOpcode))
-        return iemOpcodeGetNextU16ZxU32Slow(pIemCpu, pu32);
-
-    *pu32 = RT_MAKE_U16(pIemCpu->abOpcode[offOpcode], pIemCpu->abOpcode[offOpcode + 1]);
-    pIemCpu->offOpcode = offOpcode + 2;
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU16ZxU32(PVMCPU pVCpu, uint32_t *pu32)
+{
+    uint8_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_UNLIKELY(offOpcode + 2 > pVCpu->iem.s.cbOpcode))
+        return iemOpcodeGetNextU16ZxU32Slow(pVCpu, pu32);
+
+    *pu32 = RT_MAKE_U16(pVCpu->iem.s.abOpcode[offOpcode], pVCpu->iem.s.abOpcode[offOpcode + 1]);
+    pVCpu->iem.s.offOpcode = offOpcode + 2;
     return VINF_SUCCESS;
 }
@@ -1837 +1842 @@
  *
  * @param   a_pu32              Where to return the opcode double word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -1843 +1848 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU16ZxU32(pIemCpu, (a_pu32)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU16ZxU32(pVCpu, (a_pu32)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U16_ZX_U32(a_pu32) (*(a_pu32) = iemOpcodeGetNextU16Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_U16_ZX_U32(a_pu32) (*(a_pu32) = iemOpcodeGetNextU16Jmp(pVCpu))
 #endif
 
@@ -1857 +1862 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the opcode quad word.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU16ZxU64Slow(PIEMCPU pIemCpu, uint64_t *pu64)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 2);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU16ZxU64Slow(PVMCPU pVCpu, uint64_t *pu64)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 2);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        *pu64 = RT_MAKE_U16(pIemCpu->abOpcode[offOpcode], pIemCpu->abOpcode[offOpcode + 1]);
-        pIemCpu->offOpcode = offOpcode + 2;
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        *pu64 = RT_MAKE_U16(pVCpu->iem.s.abOpcode[offOpcode], pVCpu->iem.s.abOpcode[offOpcode + 1]);
+        pVCpu->iem.s.offOpcode = offOpcode + 2;
     }
     else
@@ -1879 +1884 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the opcode quad word.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU16ZxU64(PIEMCPU pIemCpu, uint64_t *pu64)
-{
-    uint8_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_UNLIKELY(offOpcode + 2 > pIemCpu->cbOpcode))
-        return iemOpcodeGetNextU16ZxU64Slow(pIemCpu, pu64);
-
-    *pu64 = RT_MAKE_U16(pIemCpu->abOpcode[offOpcode], pIemCpu->abOpcode[offOpcode + 1]);
-    pIemCpu->offOpcode = offOpcode + 2;
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU16ZxU64(PVMCPU pVCpu, uint64_t *pu64)
+{
+    uint8_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_UNLIKELY(offOpcode + 2 > pVCpu->iem.s.cbOpcode))
+        return iemOpcodeGetNextU16ZxU64Slow(pVCpu, pu64);
+
+    *pu64 = RT_MAKE_U16(pVCpu->iem.s.abOpcode[offOpcode], pVCpu->iem.s.abOpcode[offOpcode + 1]);
+    pVCpu->iem.s.offOpcode = offOpcode + 2;
     return VINF_SUCCESS;
 }
@@ -1900 +1905 @@
  *
  * @param   a_pu64              Where to return the opcode quad word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -1906 +1911 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU16ZxU64(pIemCpu, (a_pu64)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU16ZxU64(pVCpu, (a_pu64)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U16_ZX_U64(a_pu64)  (*(a_pu64) = iemOpcodeGetNextU16Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_U16_ZX_U64(a_pu64)  (*(a_pu64) = iemOpcodeGetNextU16Jmp(pVCpu))
 #endif
 
@@ -1920 +1925 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pi16                Where to return the signed word.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS16(PIEMCPU pIemCpu, int16_t *pi16)
-{
-    return iemOpcodeGetNextU16(pIemCpu, (uint16_t *)pi16);
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS16(PVMCPU pVCpu, int16_t *pi16)
+{
+    return iemOpcodeGetNextU16(pVCpu, (uint16_t *)pi16);
 }
 #endif /* !IEM_WITH_SETJMP */
@@ -1935 +1940 @@
  *
  * @param   a_pi16              Where to return the signed word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -1941 +1946 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS16(pIemCpu, (a_pi16)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS16(pVCpu, (a_pi16)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_S16(a_pi16) (*(a_pi16) = (int16_t)iemOpcodeGetNextU16Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_S16(a_pi16) (*(a_pi16) = (int16_t)iemOpcodeGetNextU16Jmp(pVCpu))
 #endif
 
@@ -1955 +1960 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32                Where to return the opcode dword.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU32Slow(PIEMCPU pIemCpu, uint32_t *pu32)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 4);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU32Slow(PVMCPU pVCpu, uint32_t *pu32)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 4);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        *pu32 = RT_MAKE_U32_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                    pIemCpu->abOpcode[offOpcode + 1],
-                                    pIemCpu->abOpcode[offOpcode + 2],
-                                    pIemCpu->abOpcode[offOpcode + 3]);
-        pIemCpu->offOpcode = offOpcode + 4;
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        *pu32 = RT_MAKE_U32_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 3]);
+        pVCpu->iem.s.offOpcode = offOpcode + 4;
     }
     else
@@ -1980 +1985 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32                Where to return the opcode double word.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU32(PIEMCPU pIemCpu, uint32_t *pu32)
-{
-    uintptr_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_LIKELY((uint8_t)offOpcode + 4 <= pIemCpu->cbOpcode))
-    {
-        pIemCpu->offOpcode = (uint8_t)offOpcode + 4;
-        *pu32 = RT_MAKE_U32_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                    pIemCpu->abOpcode[offOpcode + 1],
-                                    pIemCpu->abOpcode[offOpcode + 2],
-                                    pIemCpu->abOpcode[offOpcode + 3]);
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU32(PVMCPU pVCpu, uint32_t *pu32)
+{
+    uintptr_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_LIKELY((uint8_t)offOpcode + 4 <= pVCpu->iem.s.cbOpcode))
+    {
+        pVCpu->iem.s.offOpcode = (uint8_t)offOpcode + 4;
+        *pu32 = RT_MAKE_U32_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 3]);
         return VINF_SUCCESS;
     }
-    return iemOpcodeGetNextU32Slow(pIemCpu, pu32);
+    return iemOpcodeGetNextU32Slow(pVCpu, pu32);
 }
 
@@ -2004 +2009 @@
  *
  * @returns The opcode dword.
- * @param   pIemCpu             The IEM state.
- */
-DECL_NO_INLINE(IEM_STATIC, uint32_t) iemOpcodeGetNextU32SlowJmp(PIEMCPU pIemCpu)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 4);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECL_NO_INLINE(IEM_STATIC, uint32_t) iemOpcodeGetNextU32SlowJmp(PVMCPU pVCpu)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 4);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        pIemCpu->offOpcode = offOpcode + 4;
-        return RT_MAKE_U32_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                   pIemCpu->abOpcode[offOpcode + 1],
-                                   pIemCpu->abOpcode[offOpcode + 2],
-                                   pIemCpu->abOpcode[offOpcode + 3]);
-    }
-    longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        pVCpu->iem.s.offOpcode = offOpcode + 4;
+        return RT_MAKE_U32_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 3]);
+    }
+    longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
 }
 
@@ -2026 +2031 @@
  *
  * @returns The opcode dword.
- * @param   pIemCpu             The IEM state.
- */
-DECLINLINE(uint32_t) iemOpcodeGetNextU32Jmp(PIEMCPU pIemCpu)
-{
-    uintptr_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_LIKELY((uint8_t)offOpcode + 4 <= pIemCpu->cbOpcode))
-    {
-        pIemCpu->offOpcode = (uint8_t)offOpcode + 4;
-        return RT_MAKE_U32_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                   pIemCpu->abOpcode[offOpcode + 1],
-                                   pIemCpu->abOpcode[offOpcode + 2],
-                                   pIemCpu->abOpcode[offOpcode + 3]);
-    }
-    return iemOpcodeGetNextU32SlowJmp(pIemCpu);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(uint32_t) iemOpcodeGetNextU32Jmp(PVMCPU pVCpu)
+{
+    uintptr_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_LIKELY((uint8_t)offOpcode + 4 <= pVCpu->iem.s.cbOpcode))
+    {
+        pVCpu->iem.s.offOpcode = (uint8_t)offOpcode + 4;
+        return RT_MAKE_U32_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 3]);
+    }
+    return iemOpcodeGetNextU32SlowJmp(pVCpu);
 }
 
@@ -2049 +2054 @@
  *
  * @param   a_pu32              Where to return the opcode dword.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -2055 +2060 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU32(pIemCpu, (a_pu32)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU32(pVCpu, (a_pu32)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U32(a_pu32) (*(a_pu32) = iemOpcodeGetNextU32Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_U32(a_pu32) (*(a_pu32) = iemOpcodeGetNextU32Jmp(pVCpu))
 #endif
 
@@ -2069 +2074 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the opcode dword.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU32ZxU64Slow(PIEMCPU pIemCpu, uint64_t *pu64)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 4);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU32ZxU64Slow(PVMCPU pVCpu, uint64_t *pu64)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 4);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        *pu64 = RT_MAKE_U32_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                    pIemCpu->abOpcode[offOpcode + 1],
-                                    pIemCpu->abOpcode[offOpcode + 2],
-                                    pIemCpu->abOpcode[offOpcode + 3]);
-        pIemCpu->offOpcode = offOpcode + 4;
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        *pu64 = RT_MAKE_U32_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 3]);
+        pVCpu->iem.s.offOpcode = offOpcode + 4;
     }
     else
@@ -2094 +2099 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the opcode quad word.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU32ZxU64(PIEMCPU pIemCpu, uint64_t *pu64)
-{
-    uint8_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_UNLIKELY(offOpcode + 4 > pIemCpu->cbOpcode))
-        return iemOpcodeGetNextU32ZxU64Slow(pIemCpu, pu64);
-
-    *pu64 = RT_MAKE_U32_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                pIemCpu->abOpcode[offOpcode + 1],
-                                pIemCpu->abOpcode[offOpcode + 2],
-                                pIemCpu->abOpcode[offOpcode + 3]);
-    pIemCpu->offOpcode = offOpcode + 4;
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU32ZxU64(PVMCPU pVCpu, uint64_t *pu64)
+{
+    uint8_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_UNLIKELY(offOpcode + 4 > pVCpu->iem.s.cbOpcode))
+        return iemOpcodeGetNextU32ZxU64Slow(pVCpu, pu64);
+
+    *pu64 = RT_MAKE_U32_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                pVCpu->iem.s.abOpcode[offOpcode + 3]);
+    pVCpu->iem.s.offOpcode = offOpcode + 4;
     return VINF_SUCCESS;
 }
@@ -2119 +2124 @@
  *
  * @param   a_pu64              Where to return the opcode quad word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -2125 +2130 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU32ZxU64(pIemCpu, (a_pu64)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU32ZxU64(pVCpu, (a_pu64)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U32_ZX_U64(a_pu64) (*(a_pu64) = iemOpcodeGetNextU32Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_U32_ZX_U64(a_pu64) (*(a_pu64) = iemOpcodeGetNextU32Jmp(pVCpu))
 #endif
 
@@ -2139 +2144 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pi32                Where to return the signed double word.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS32(PIEMCPU pIemCpu, int32_t *pi32)
-{
-    return iemOpcodeGetNextU32(pIemCpu, (uint32_t *)pi32);
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS32(PVMCPU pVCpu, int32_t *pi32)
+{
+    return iemOpcodeGetNextU32(pVCpu, (uint32_t *)pi32);
 }
 #endif
@@ -2153 +2158 @@
  *
  * @param   a_pi32              Where to return the signed double word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -2159 +2164 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS32(pIemCpu, (a_pi32)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS32(pVCpu, (a_pi32)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_S32(a_pi32)    (*(a_pi32) = (int32_t)iemOpcodeGetNextU32Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_S32(a_pi32)    (*(a_pi32) = (int32_t)iemOpcodeGetNextU32Jmp(pVCpu))
 #endif
 
@@ -2173 +2178 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the opcode qword.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextS32SxU64Slow(PIEMCPU pIemCpu, uint64_t *pu64)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 4);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextS32SxU64Slow(PVMCPU pVCpu, uint64_t *pu64)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 4);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        *pu64 = (int32_t)RT_MAKE_U32_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                             pIemCpu->abOpcode[offOpcode + 1],
-                                             pIemCpu->abOpcode[offOpcode + 2],
-                                             pIemCpu->abOpcode[offOpcode + 3]);
-        pIemCpu->offOpcode = offOpcode + 4;
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        *pu64 = (int32_t)RT_MAKE_U32_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                             pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                             pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                             pVCpu->iem.s.abOpcode[offOpcode + 3]);
+        pVCpu->iem.s.offOpcode = offOpcode + 4;
     }
     else
@@ -2198 +2203 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the opcode quad word.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS32SxU64(PIEMCPU pIemCpu, uint64_t *pu64)
-{
-    uint8_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_UNLIKELY(offOpcode + 4 > pIemCpu->cbOpcode))
-        return iemOpcodeGetNextS32SxU64Slow(pIemCpu, pu64);
-
-    int32_t i32 = RT_MAKE_U32_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                      pIemCpu->abOpcode[offOpcode + 1],
-                                      pIemCpu->abOpcode[offOpcode + 2],
-                                      pIemCpu->abOpcode[offOpcode + 3]);
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextS32SxU64(PVMCPU pVCpu, uint64_t *pu64)
+{
+    uint8_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_UNLIKELY(offOpcode + 4 > pVCpu->iem.s.cbOpcode))
+        return iemOpcodeGetNextS32SxU64Slow(pVCpu, pu64);
+
+    int32_t i32 = RT_MAKE_U32_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                      pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                      pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                      pVCpu->iem.s.abOpcode[offOpcode + 3]);
     *pu64 = i32;
-    pIemCpu->offOpcode = offOpcode + 4;
+    pVCpu->iem.s.offOpcode = offOpcode + 4;
     return VINF_SUCCESS;
 }
@@ -2224 +2229 @@
  *
  * @param   a_pu64              Where to return the opcode quad word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -2230 +2235 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS32SxU64(pIemCpu, (a_pu64)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextS32SxU64(pVCpu, (a_pu64)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_S32_SX_U64(a_pu64) (*(a_pu64) = (int32_t)iemOpcodeGetNextU32Jmp(pIemCpu))
+# define IEM_OPCODE_GET_NEXT_S32_SX_U64(a_pu64) (*(a_pu64) = (int32_t)iemOpcodeGetNextU32Jmp(pVCpu))
 #endif
 
@@ -2244 +2249 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the opcode qword.
  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU64Slow(PIEMCPU pIemCpu, uint64_t *pu64)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 8);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemOpcodeGetNextU64Slow(PVMCPU pVCpu, uint64_t *pu64)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 8);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        *pu64 = RT_MAKE_U64_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                    pIemCpu->abOpcode[offOpcode + 1],
-                                    pIemCpu->abOpcode[offOpcode + 2],
-                                    pIemCpu->abOpcode[offOpcode + 3],
-                                    pIemCpu->abOpcode[offOpcode + 4],
-                                    pIemCpu->abOpcode[offOpcode + 5],
-                                    pIemCpu->abOpcode[offOpcode + 6],
-                                    pIemCpu->abOpcode[offOpcode + 7]);
-        pIemCpu->offOpcode = offOpcode + 8;
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        *pu64 = RT_MAKE_U64_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 3],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 4],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 5],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 6],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 7]);
+        pVCpu->iem.s.offOpcode = offOpcode + 8;
     }
     else
@@ -2273 +2278 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM state.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64                Where to return the opcode qword.
  */
-DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU64(PIEMCPU pIemCpu, uint64_t *pu64)
-{
-    uintptr_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_LIKELY((uint8_t)offOpcode + 8 <= pIemCpu->cbOpcode))
-    {
-        *pu64 = RT_MAKE_U64_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                    pIemCpu->abOpcode[offOpcode + 1],
-                                    pIemCpu->abOpcode[offOpcode + 2],
-                                    pIemCpu->abOpcode[offOpcode + 3],
-                                    pIemCpu->abOpcode[offOpcode + 4],
-                                    pIemCpu->abOpcode[offOpcode + 5],
-                                    pIemCpu->abOpcode[offOpcode + 6],
-                                    pIemCpu->abOpcode[offOpcode + 7]);
-        pIemCpu->offOpcode = (uint8_t)offOpcode + 8;
+DECLINLINE(VBOXSTRICTRC) iemOpcodeGetNextU64(PVMCPU pVCpu, uint64_t *pu64)
+{
+    uintptr_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_LIKELY((uint8_t)offOpcode + 8 <= pVCpu->iem.s.cbOpcode))
+    {
+        *pu64 = RT_MAKE_U64_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 3],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 4],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 5],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 6],
+                                    pVCpu->iem.s.abOpcode[offOpcode + 7]);
+        pVCpu->iem.s.offOpcode = (uint8_t)offOpcode + 8;
         return VINF_SUCCESS;
     }
-    return iemOpcodeGetNextU64Slow(pIemCpu, pu64);
+    return iemOpcodeGetNextU64Slow(pVCpu, pu64);
 }
 
@@ -2301 +2306 @@
  *
  * @returns The opcode qword.
- * @param   pIemCpu             The IEM state.
- */
-DECL_NO_INLINE(IEM_STATIC, uint64_t) iemOpcodeGetNextU64SlowJmp(PIEMCPU pIemCpu)
-{
-    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pIemCpu, 8);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECL_NO_INLINE(IEM_STATIC, uint64_t) iemOpcodeGetNextU64SlowJmp(PVMCPU pVCpu)
+{
+    VBOXSTRICTRC rcStrict = iemOpcodeFetchMoreBytes(pVCpu, 8);
     if (rcStrict == VINF_SUCCESS)
     {
-        uint8_t offOpcode = pIemCpu->offOpcode;
-        pIemCpu->offOpcode = offOpcode + 8;
-        return RT_MAKE_U64_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                   pIemCpu->abOpcode[offOpcode + 1],
-                                   pIemCpu->abOpcode[offOpcode + 2],
-                                   pIemCpu->abOpcode[offOpcode + 3],
-                                   pIemCpu->abOpcode[offOpcode + 4],
-                                   pIemCpu->abOpcode[offOpcode + 5],
-                                   pIemCpu->abOpcode[offOpcode + 6],
-                                   pIemCpu->abOpcode[offOpcode + 7]);
-    }
-    longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+        uint8_t offOpcode = pVCpu->iem.s.offOpcode;
+        pVCpu->iem.s.offOpcode = offOpcode + 8;
+        return RT_MAKE_U64_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 3],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 4],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 5],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 6],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 7]);
+    }
+    longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
 }
 
@@ -2327 +2332 @@
  *
  * @returns The opcode qword.
- * @param   pIemCpu             The IEM state.
- */
-DECLINLINE(uint64_t) iemOpcodeGetNextU64Jmp(PIEMCPU pIemCpu)
-{
-    uintptr_t const offOpcode = pIemCpu->offOpcode;
-    if (RT_LIKELY((uint8_t)offOpcode + 8 <= pIemCpu->cbOpcode))
-    {
-        pIemCpu->offOpcode = (uint8_t)offOpcode + 8;
-        return RT_MAKE_U64_FROM_U8(pIemCpu->abOpcode[offOpcode],
-                                   pIemCpu->abOpcode[offOpcode + 1],
-                                   pIemCpu->abOpcode[offOpcode + 2],
-                                   pIemCpu->abOpcode[offOpcode + 3],
-                                   pIemCpu->abOpcode[offOpcode + 4],
-                                   pIemCpu->abOpcode[offOpcode + 5],
-                                   pIemCpu->abOpcode[offOpcode + 6],
-                                   pIemCpu->abOpcode[offOpcode + 7]);
-    }
-    return iemOpcodeGetNextU64SlowJmp(pIemCpu);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(uint64_t) iemOpcodeGetNextU64Jmp(PVMCPU pVCpu)
+{
+    uintptr_t const offOpcode = pVCpu->iem.s.offOpcode;
+    if (RT_LIKELY((uint8_t)offOpcode + 8 <= pVCpu->iem.s.cbOpcode))
+    {
+        pVCpu->iem.s.offOpcode = (uint8_t)offOpcode + 8;
+        return RT_MAKE_U64_FROM_U8(pVCpu->iem.s.abOpcode[offOpcode],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 1],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 2],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 3],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 4],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 5],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 6],
+                                   pVCpu->iem.s.abOpcode[offOpcode + 7]);
+    }
+    return iemOpcodeGetNextU64SlowJmp(pVCpu);
 }
 
@@ -2353 +2358 @@
  *
  * @param   a_pu64              Where to return the opcode quad word.
- * @remark Implicitly references pIemCpu.
+ * @remark Implicitly references pVCpu.
  */
 #ifndef IEM_WITH_SETJMP
@@ -2359 +2364 @@
     do \
     { \
-        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU64(pIemCpu, (a_pu64)); \
+        VBOXSTRICTRC rcStrict2 = iemOpcodeGetNextU64(pVCpu, (a_pu64)); \
         if (rcStrict2 != VINF_SUCCESS) \
             return rcStrict2; \
     } while (0)
 #else
-# define IEM_OPCODE_GET_NEXT_U64(a_pu64)    ( *(a_pu64) = iemOpcodeGetNextU64Jmp(pIemCpu) )
+# define IEM_OPCODE_GET_NEXT_U64(a_pu64)    ( *(a_pu64) = iemOpcodeGetNextU64Jmp(pVCpu) )
 #endif
 
@@ -2377 +2382 @@
  *
  * @returns VBox strict status code.
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the
+ *                          calling thread.
  * @param   pCtx            The CPU context.
  * @param   NewSS           The new SS selctor.
@@ -2383 +2389 @@
  * @param   pDesc           Where to return the descriptor.
  */
-IEM_STATIC VBOXSTRICTRC iemMiscValidateNewSS(PIEMCPU pIemCpu, PCCPUMCTX pCtx, RTSEL NewSS, uint8_t uCpl, PIEMSELDESC pDesc)
+IEM_STATIC VBOXSTRICTRC iemMiscValidateNewSS(PVMCPU pVCpu, PCCPUMCTX pCtx, RTSEL NewSS, uint8_t uCpl, PIEMSELDESC pDesc)
 {
     NOREF(pCtx);
@@ -2392 +2398 @@
     {
         Log(("iemMiscValidateNewSSandRsp: %#x - null selector -> #TS(0)\n", NewSS));
-        return iemRaiseTaskSwitchFault0(pIemCpu);
+        return iemRaiseTaskSwitchFault0(pVCpu);
     }
 
@@ -2399 +2405 @@
     {
         Log(("iemMiscValidateNewSSandRsp: %#x - RPL and CPL (%d) differs -> #TS\n", NewSS, uCpl));
-        return iemRaiseTaskSwitchFaultBySelector(pIemCpu, NewSS);
+        return iemRaiseTaskSwitchFaultBySelector(pVCpu, NewSS);
     }
 
@@ -2405 +2411 @@
      * Read the descriptor.
      */
-    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, pDesc, NewSS, X86_XCPT_TS);
+    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, pDesc, NewSS, X86_XCPT_TS);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2415 +2421 @@
     {
         Log(("iemMiscValidateNewSSandRsp: %#x - system selector (%#x) -> #TS\n", NewSS, pDesc->Legacy.Gen.u4Type));
-        return iemRaiseTaskSwitchFaultBySelector(pIemCpu, NewSS);
+        return iemRaiseTaskSwitchFaultBySelector(pVCpu, NewSS);
     }
 
@@ -2422 +2428 @@
     {
         Log(("iemMiscValidateNewSSandRsp: %#x - code or read only (%#x) -> #TS\n", NewSS, pDesc->Legacy.Gen.u4Type));
-        return iemRaiseTaskSwitchFaultBySelector(pIemCpu, NewSS);
+        return iemRaiseTaskSwitchFaultBySelector(pVCpu, NewSS);
     }
     if (pDesc->Legacy.Gen.u2Dpl != uCpl)
     {
         Log(("iemMiscValidateNewSSandRsp: %#x - DPL (%d) and CPL (%d) differs -> #TS\n", NewSS, pDesc->Legacy.Gen.u2Dpl, uCpl));
-        return iemRaiseTaskSwitchFaultBySelector(pIemCpu, NewSS);
+        return iemRaiseTaskSwitchFaultBySelector(pVCpu, NewSS);
     }
 
@@ -2435 +2441 @@
     {
         Log(("iemMiscValidateNewSSandRsp: %#x - segment not present -> #NP\n", NewSS));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, NewSS);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, NewSS);
     }
 
@@ -2446 +2452 @@
  * not.
  *
- * @param   a_pIemCpu           The IEM per CPU data.
- * @param   a_pCtx              The CPU context.
+ * @param   a_pVCpu The cross context virtual CPU structure of the calling thread.
+ * @param   a_pCtx  The CPU context.
  */
 #ifdef VBOX_WITH_RAW_MODE_NOT_R0
-# define IEMMISC_GET_EFL(a_pIemCpu, a_pCtx) \
-    ( IEM_VERIFICATION_ENABLED(a_pIemCpu) \
+# define IEMMISC_GET_EFL(a_pVCpu, a_pCtx) \
+    ( IEM_VERIFICATION_ENABLED(a_pVCpu) \
       ? (a_pCtx)->eflags.u \
-      : CPUMRawGetEFlags(IEMCPU_TO_VMCPU(a_pIemCpu)) )
+      : CPUMRawGetEFlags(a_pVCpu) )
 #else
-# define IEMMISC_GET_EFL(a_pIemCpu, a_pCtx) \
+# define IEMMISC_GET_EFL(a_pVCpu, a_pCtx) \
     ( (a_pCtx)->eflags.u  )
 #endif
@@ -2462 +2468 @@
  * Updates the EFLAGS in the correct manner wrt. PATM.
  *
- * @param   a_pIemCpu           The IEM per CPU data.
- * @param   a_pCtx              The CPU context.
- * @param   a_fEfl              The new EFLAGS.
+ * @param   a_pVCpu The cross context virtual CPU structure of the calling thread.
+ * @param   a_pCtx  The CPU context.
+ * @param   a_fEfl  The new EFLAGS.
  */
 #ifdef VBOX_WITH_RAW_MODE_NOT_R0
-# define IEMMISC_SET_EFL(a_pIemCpu, a_pCtx, a_fEfl) \
+# define IEMMISC_SET_EFL(a_pVCpu, a_pCtx, a_fEfl) \
     do { \
-        if (IEM_VERIFICATION_ENABLED(a_pIemCpu)) \
+        if (IEM_VERIFICATION_ENABLED(a_pVCpu)) \
             (a_pCtx)->eflags.u = (a_fEfl); \
         else \
-            CPUMRawSetEFlags(IEMCPU_TO_VMCPU(a_pIemCpu), a_fEfl); \
+            CPUMRawSetEFlags((a_pVCpu), a_fEfl); \
     } while (0)
 #else
-# define IEMMISC_SET_EFL(a_pIemCpu, a_pCtx, a_fEfl) \
+# define IEMMISC_SET_EFL(a_pVCpu, a_pCtx, a_fEfl) \
     do { \
         (a_pCtx)->eflags.u = (a_fEfl); \
@@ -2513 +2519 @@
  *
  * @returns VBox strict status code.
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pCtx            The CPU context.
  * @param   uCpl            The CPL to load the stack for.
@@ -2519 +2525 @@
  * @param   puEsp           Where to return the new stack pointer.
  */
-IEM_STATIC VBOXSTRICTRC iemRaiseLoadStackFromTss32Or16(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint8_t uCpl,
+IEM_STATIC VBOXSTRICTRC iemRaiseLoadStackFromTss32Or16(PVMCPU pVCpu, PCCPUMCTX pCtx, uint8_t uCpl,
                                                        PRTSEL pSelSS, uint32_t *puEsp)
 {
@@ -2538 +2544 @@
                 /** @todo check actual access pattern here. */
                 uint32_t u32Tmp = 0; /* gcc maybe... */
-                rcStrict = iemMemFetchSysU32(pIemCpu, &u32Tmp, UINT8_MAX, pCtx->tr.u64Base + off);
+                rcStrict = iemMemFetchSysU32(pVCpu, &u32Tmp, UINT8_MAX, pCtx->tr.u64Base + off);
                 if (rcStrict == VINF_SUCCESS)
                 {
@@ -2549 +2555 @@
             {
                 Log(("LoadStackFromTss32Or16: out of bounds! uCpl=%d, u32Limit=%#x TSS16\n", uCpl, pCtx->tr.u32Limit));
-                rcStrict = iemRaiseTaskSwitchFaultCurrentTSS(pIemCpu);
+                rcStrict = iemRaiseTaskSwitchFaultCurrentTSS(pVCpu);
             }
             break;
@@ -2565 +2571 @@
 /** @todo check actual access pattern here. */
                 uint64_t u64Tmp;
-                rcStrict = iemMemFetchSysU64(pIemCpu, &u64Tmp, UINT8_MAX, pCtx->tr.u64Base + off);
+                rcStrict = iemMemFetchSysU64(pVCpu, &u64Tmp, UINT8_MAX, pCtx->tr.u64Base + off);
                 if (rcStrict == VINF_SUCCESS)
                 {
@@ -2576 +2582 @@
             {
                 Log(("LoadStackFromTss32Or16: out of bounds! uCpl=%d, u32Limit=%#x TSS16\n", uCpl, pCtx->tr.u32Limit));
-                rcStrict = iemRaiseTaskSwitchFaultCurrentTSS(pIemCpu);
+                rcStrict = iemRaiseTaskSwitchFaultCurrentTSS(pVCpu);
             }
             break;
@@ -2597 +2603 @@
  *
  * @returns VBox strict status code.
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pCtx            The CPU context.
  * @param   uCpl            The CPL to load the stack for.
@@ -2603 +2609 @@
  * @param   puRsp           Where to return the new stack pointer.
  */
-IEM_STATIC VBOXSTRICTRC iemRaiseLoadStackFromTss64(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint8_t uCpl, uint8_t uIst, uint64_t *puRsp)
+IEM_STATIC VBOXSTRICTRC iemRaiseLoadStackFromTss64(PVMCPU pVCpu, PCCPUMCTX pCtx, uint8_t uCpl, uint8_t uIst, uint64_t *puRsp)
 {
     Assert(uCpl < 4);
@@ -2619 +2625 @@
     {
         Log(("iemRaiseLoadStackFromTss64: out of bounds! uCpl=%d uIst=%d, u32Limit=%#x\n", uCpl, uIst, pCtx->tr.u32Limit));
-        return iemRaiseTaskSwitchFaultCurrentTSS(pIemCpu);
-    }
-
-    return iemMemFetchSysU64(pIemCpu, puRsp, UINT8_MAX, pCtx->tr.u64Base + off);
+        return iemRaiseTaskSwitchFaultCurrentTSS(pVCpu);
+    }
+
+    return iemMemFetchSysU64(pVCpu, puRsp, UINT8_MAX, pCtx->tr.u64Base + off);
 }
 
@@ -2648 +2654 @@
  *
  * @returns VBox strict status code.
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pCtx            The CPU context.
  * @param   cbInstr         The number of bytes to offset rIP by in the return
@@ -2658 +2664 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemRaiseXcptOrIntInRealMode(PIEMCPU     pIemCpu,
+iemRaiseXcptOrIntInRealMode(PVMCPU      pVCpu,
                             PCPUMCTX    pCtx,
                             uint8_t     cbInstr,
@@ -2666 +2672 @@
                             uint64_t    uCr2)
 {
-    AssertReturn(pIemCpu->enmCpuMode == IEMMODE_16BIT, VERR_IEM_IPE_6);
+    AssertReturn(pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT, VERR_IEM_IPE_6);
     NOREF(uErr); NOREF(uCr2);
 
@@ -2675 +2681 @@
     {
         Log(("RaiseXcptOrIntInRealMode: %#x is out of bounds (%#x)\n", u8Vector, pCtx->idtr.cbIdt));
-        return iemRaiseGeneralProtectionFault(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+        return iemRaiseGeneralProtectionFault(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
     }
     RTFAR16 Idte;
-    VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pIemCpu, (uint32_t *)&Idte, UINT8_MAX,
-                                               pCtx->idtr.pIdt + UINT32_C(4) * u8Vector);
+    VBOXSTRICTRC rcStrict = iemMemFetchDataU32(pVCpu, (uint32_t *)&Idte, UINT8_MAX, pCtx->idtr.pIdt + UINT32_C(4) * u8Vector);
     if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
         return rcStrict;
@@ -2688 +2693 @@
     uint16_t *pu16Frame;
     uint64_t  uNewRsp;
-    rcStrict = iemMemStackPushBeginSpecial(pIemCpu, 6, (void **)&pu16Frame, &uNewRsp);
+    rcStrict = iemMemStackPushBeginSpecial(pVCpu, 6, (void **)&pu16Frame, &uNewRsp);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
-    uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
 #if IEM_CFG_TARGET_CPU == IEMTARGETCPU_DYNAMIC
     AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
-    if (pIemCpu->uTargetCpu <= IEMTARGETCPU_186)
+    if (pVCpu->iem.s.uTargetCpu <= IEMTARGETCPU_186)
         fEfl |= UINT16_C(0xf000);
 #endif
@@ -2701 +2706 @@
     pu16Frame[1] = (uint16_t)pCtx->cs.Sel;
     pu16Frame[0] = (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT) ? pCtx->ip + cbInstr : pCtx->ip;
-    rcStrict = iemMemStackPushCommitSpecial(pIemCpu, pu16Frame, uNewRsp);
+    rcStrict = iemMemStackPushCommitSpecial(pVCpu, pu16Frame, uNewRsp);
     if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
         return rcStrict;
@@ -2716 +2721 @@
     pCtx->rip              = Idte.off;
     fEfl &= ~X86_EFL_IF;
-    IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
+    IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
 
     /** @todo do we actually do this in real mode? */
@@ -2729 +2734 @@
  * Loads a NULL data selector into when coming from V8086 mode.
  *
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pSReg           Pointer to the segment register.
  */
-IEM_STATIC void iemHlpLoadNullDataSelectorOnV86Xcpt(PIEMCPU pIemCpu, PCPUMSELREG pSReg)
+IEM_STATIC void iemHlpLoadNullDataSelectorOnV86Xcpt(PVMCPU pVCpu, PCPUMSELREG pSReg)
 {
     pSReg->Sel      = 0;
     pSReg->ValidSel = 0;
-    if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+    if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
     {
         /* VT-x (Intel 3960x) doesn't change the base and limit, clears and sets the following attributes */
@@ -2755 +2760 @@
  * Loads a segment selector during a task switch in V8086 mode.
  *
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pSReg           Pointer to the segment register.
  * @param   uSel            The selector value to load.
  */
-IEM_STATIC void iemHlpLoadSelectorInV86Mode(PIEMCPU pIemCpu, PCPUMSELREG pSReg, uint16_t uSel)
+IEM_STATIC void iemHlpLoadSelectorInV86Mode(PVMCPU pVCpu, PCPUMSELREG pSReg, uint16_t uSel)
 {
     /* See Intel spec. 26.3.1.2 "Checks on Guest Segment Registers". */
@@ -2775 +2780 @@
  * visible parts, in protected mode.
  *
- * @param   pIemCpu             The IEM state of the calling EMT.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pSReg               Pointer to the segment register.
  * @param   uRpl                The RPL.
  */
-IEM_STATIC void iemHlpLoadNullDataSelectorProt(PIEMCPU pIemCpu, PCPUMSELREG pSReg, RTSEL uRpl)
+IEM_STATIC void iemHlpLoadNullDataSelectorProt(PVMCPU pVCpu, PCPUMSELREG pSReg, RTSEL uRpl)
 {
     /** @todo Testcase: write a testcase checking what happends when loading a NULL
@@ -2786 +2791 @@
     pSReg->ValidSel = uRpl;
     pSReg->fFlags   = CPUMSELREG_FLAGS_VALID;
-    if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+    if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
     {
         /* VT-x (Intel 3960x) observed doing something like this. */
-        pSReg->Attr.u   = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D | (pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT);
+        pSReg->Attr.u   = X86DESCATTR_UNUSABLE | X86DESCATTR_G | X86DESCATTR_D | (pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT);
         pSReg->u32Limit = UINT32_MAX;
         pSReg->u64Base  = 0;
@@ -2809 +2814 @@
  *
  * @returns VBox strict status code.
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pSReg           Pointer to the segment register.
  * @param   uSel            The new selector value.
  *
  * @remarks This does _not_ handle CS or SS.
- * @remarks This expects pIemCpu->uCpl to be up to date.
- */
-IEM_STATIC VBOXSTRICTRC iemHlpTaskSwitchLoadDataSelectorInProtMode(PIEMCPU pIemCpu, PCPUMSELREG pSReg, uint16_t uSel)
-{
-    Assert(pIemCpu->enmCpuMode != IEMMODE_64BIT);
+ * @remarks This expects pVCpu->iem.s.uCpl to be up to date.
+ */
+IEM_STATIC VBOXSTRICTRC iemHlpTaskSwitchLoadDataSelectorInProtMode(PVMCPU pVCpu, PCPUMSELREG pSReg, uint16_t uSel)
+{
+    Assert(pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT);
 
     /* Null data selector. */
     if (!(uSel & X86_SEL_MASK_OFF_RPL))
     {
-        iemHlpLoadNullDataSelectorProt(pIemCpu, pSReg, uSel);
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
-        CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
+        iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, uSel);
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
+        CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
         return VINF_SUCCESS;
     }
@@ -2831 +2836 @@
     /* Fetch the descriptor. */
     IEMSELDESC Desc;
-    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_TS);
+    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_TS);
     if (rcStrict != VINF_SUCCESS)
     {
@@ -2845 +2850 @@
         Log(("iemHlpTaskSwitchLoadDataSelectorInProtMode: invalid segment type. uSel=%u Desc.u4Type=%#x\n", uSel,
              Desc.Legacy.Gen.u4Type));
-        return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseTaskSwitchFaultWithErr(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -2854 +2859 @@
         /* The RPL and the new CPL must be less than or equal to the DPL. */
         if (   (unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
-            || (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl))
+            || (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl))
         {
             Log(("iemHlpTaskSwitchLoadDataSelectorInProtMode: Invalid priv. uSel=%u uSel.RPL=%u DPL=%u CPL=%u\n",
-                 uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-            return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
+                 uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+            return iemRaiseTaskSwitchFaultWithErr(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
         }
     }
@@ -2866 +2871 @@
     {
         Log(("iemHlpTaskSwitchLoadDataSelectorInProtMode: Segment not present. uSel=%u\n", uSel));
-        return iemRaiseSelectorNotPresentWithErr(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseSelectorNotPresentWithErr(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -2879 +2884 @@
     if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
     {
-        rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
+        rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2892 +2897 @@
     pSReg->ValidSel = uSel;
     pSReg->fFlags   = CPUMSELREG_FLAGS_VALID;
-    if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+    if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
         pSReg->Attr.u &= ~X86DESCATTR_UNUSABLE;
 
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
     return VINF_SUCCESS;
 }
@@ -2914 +2919 @@
  *
  * @returns VBox strict status code.
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pCtx            The CPU context.
  * @param   enmTaskSwitch   What caused this task switch.
@@ -2925 +2930 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemTaskSwitch(PIEMCPU         pIemCpu,
+iemTaskSwitch(PVMCPU          pVCpu,
               PCPUMCTX        pCtx,
               IEMTASKSWITCH   enmTaskSwitch,
@@ -2935 +2940 @@
               PIEMSELDESC     pNewDescTSS)
 {
-    Assert(!IEM_IS_REAL_MODE(pIemCpu));
-    Assert(pIemCpu->enmCpuMode != IEMMODE_64BIT);
+    Assert(!IEM_IS_REAL_MODE(pVCpu));
+    Assert(pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT);
 
     uint32_t const uNewTSSType = pNewDescTSS->Legacy.Gate.u4Type;
@@ -2966 +2971 @@
         Log(("iemTaskSwitch: Invalid new TSS limit. enmTaskSwitch=%u uNewTSSLimit=%#x uNewTSSLimitMin=%#x -> #TS\n",
              enmTaskSwitch, uNewTSSLimit, uNewTSSLimitMin));
-        return iemRaiseTaskSwitchFaultWithErr(pIemCpu, SelTSS & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseTaskSwitchFaultWithErr(pVCpu, SelTSS & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -2983 +2988 @@
         Log(("iemTaskSwitch: Invalid current TSS limit. enmTaskSwitch=%u uCurTSSLimit=%#x uCurTSSLimitMin=%#x -> #TS\n",
              enmTaskSwitch, uCurTSSLimit, uCurTSSLimitMin));
-        return iemRaiseTaskSwitchFaultWithErr(pIemCpu, SelTSS & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseTaskSwitchFaultWithErr(pVCpu, SelTSS & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -2997 +3002 @@
      *        not perform correct translation if this happens. See Intel spec. 7.2.1
      *        "Task-State Segment" */
-    VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvNewTSS, cbNewTSS, UINT8_MAX, GCPtrNewTSS, IEM_ACCESS_SYS_RW);
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvNewTSS, cbNewTSS, UINT8_MAX, GCPtrNewTSS, IEM_ACCESS_SYS_RW);
     if (rcStrict != VINF_SUCCESS)
     {
@@ -3013 +3018 @@
     {
         PX86DESC pDescCurTSS;
-        rcStrict = iemMemMap(pIemCpu, (void **)&pDescCurTSS, sizeof(*pDescCurTSS), UINT8_MAX,
+        rcStrict = iemMemMap(pVCpu, (void **)&pDescCurTSS, sizeof(*pDescCurTSS), UINT8_MAX,
                              pCtx->gdtr.pGdt + (pCtx->tr.Sel & X86_SEL_MASK), IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
@@ -3023 +3028 @@
 
         pDescCurTSS->Gate.u4Type &= ~X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
-        rcStrict = iemMemCommitAndUnmap(pIemCpu, pDescCurTSS, IEM_ACCESS_SYS_RW);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, pDescCurTSS, IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3060 +3065 @@
         uint32_t cbCurTSS  = RT_OFFSETOF(X86TSS32, selLdt) - RT_OFFSETOF(X86TSS32, eip);
         AssertCompile(RTASSERT_OFFSET_OF(X86TSS32, selLdt) - RTASSERT_OFFSET_OF(X86TSS32, eip) == 64);
-        rcStrict = iemMemMap(pIemCpu, &pvCurTSS32, cbCurTSS, UINT8_MAX, GCPtrCurTSS + offCurTSS, IEM_ACCESS_SYS_RW);
+        rcStrict = iemMemMap(pVCpu, &pvCurTSS32, cbCurTSS, UINT8_MAX, GCPtrCurTSS + offCurTSS, IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3087 +3092 @@
         pCurTSS32->gs     = pCtx->gs.Sel;
 
-        rcStrict = iemMemCommitAndUnmap(pIemCpu, pvCurTSS32, IEM_ACCESS_SYS_RW);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, pvCurTSS32, IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3104 +3109 @@
         uint32_t cbCurTSS  = RT_OFFSETOF(X86TSS16, selLdt) - RT_OFFSETOF(X86TSS16, ip);
         AssertCompile(RTASSERT_OFFSET_OF(X86TSS16, selLdt) - RTASSERT_OFFSET_OF(X86TSS16, ip) == 28);
-        rcStrict = iemMemMap(pIemCpu, &pvCurTSS16, cbCurTSS, UINT8_MAX, GCPtrCurTSS + offCurTSS, IEM_ACCESS_SYS_RW);
+        rcStrict = iemMemMap(pVCpu, &pvCurTSS16, cbCurTSS, UINT8_MAX, GCPtrCurTSS + offCurTSS, IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3129 +3134 @@
         pCurTSS16->ds    = pCtx->ds.Sel;
 
-        rcStrict = iemMemCommitAndUnmap(pIemCpu, pvCurTSS16, IEM_ACCESS_SYS_RW);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, pvCurTSS16, IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3210 +3215 @@
      * We're done accessing the new TSS.
      */
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, pvNewTSS, IEM_ACCESS_SYS_RW);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewTSS, IEM_ACCESS_SYS_RW);
     if (rcStrict != VINF_SUCCESS)
     {
@@ -3222 +3227 @@
     if (enmTaskSwitch != IEMTASKSWITCH_IRET)
     {
-        rcStrict = iemMemMap(pIemCpu, (void **)&pNewDescTSS, sizeof(*pNewDescTSS), UINT8_MAX,
+        rcStrict = iemMemMap(pVCpu, (void **)&pNewDescTSS, sizeof(*pNewDescTSS), UINT8_MAX,
                              pCtx->gdtr.pGdt + (SelTSS & X86_SEL_MASK), IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
@@ -3237 +3242 @@
 
         pNewDescTSS->Legacy.Gate.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
-        rcStrict = iemMemCommitAndUnmap(pIemCpu, pNewDescTSS, IEM_ACCESS_SYS_RW);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, pNewDescTSS, IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3256 +3261 @@
     pCtx->tr.u32Limit = X86DESC_LIMIT_G(&pNewDescTSS->Legacy);
     pCtx->tr.u64Base  = X86DESC_BASE(&pNewDescTSS->Legacy);
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_TR);
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_TR);
 
     /* Set the busy bit in TR. */
@@ -3269 +3274 @@
     pCtx->dr[7] &= ~X86_DR7_LE_ALL;     /** @todo Should we clear DR7.LE bit too? */
     pCtx->cr0   |= X86_CR0_TS;
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_CR0);
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_CR0);
 
     pCtx->eip    = uNewEip;
@@ -3283 +3288 @@
     uNewEflags &= X86_EFL_LIVE_MASK;
     uNewEflags |= X86_EFL_RA1_MASK;
-    IEMMISC_SET_EFL(pIemCpu, pCtx, uNewEflags);
+    IEMMISC_SET_EFL(pVCpu, pCtx, uNewEflags);
 
     /*
@@ -3313 +3318 @@
     pCtx->gs.fFlags    = CPUMSELREG_FLAGS_STALE;
     pCtx->gs.Attr.u   &= ~X86DESCATTR_P;
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
 
     pCtx->ldtr.Sel     = uNewLdt;
     pCtx->ldtr.fFlags  = CPUMSELREG_FLAGS_STALE;
     pCtx->ldtr.Attr.u &= ~X86DESCATTR_P;
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_LDTR);
-
-    if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_LDTR);
+
+    if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
     {
         pCtx->es.Attr.u   |= X86DESCATTR_UNUSABLE;
@@ -3338 +3343 @@
     {
         /** @todo Should we update and flush TLBs only if CR3 value actually changes? */
-        if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
+        if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
         {
-            int rc = CPUMSetGuestCR3(IEMCPU_TO_VMCPU(pIemCpu), uNewCr3);
+            int rc = CPUMSetGuestCR3(pVCpu, uNewCr3);
             AssertRCSuccessReturn(rc, rc);
         }
@@ -3347 +3352 @@
 
         /* Inform PGM. */
-        if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
+        if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
         {
-            int rc = PGMFlushTLB(IEMCPU_TO_VMCPU(pIemCpu), pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
+            int rc = PGMFlushTLB(pVCpu, pCtx->cr3, !(pCtx->cr4 & X86_CR4_PGE));
             AssertRCReturn(rc, rc);
             /* ignore informational status codes */
         }
-        CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_CR3);
+        CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_CR3);
     }
 
@@ -3360 +3365 @@
      */
     if (!(uNewLdt & X86_SEL_MASK_OFF_RPL))
-        iemHlpLoadNullDataSelectorProt(pIemCpu, &pCtx->ldtr, uNewLdt);
+        iemHlpLoadNullDataSelectorProt(pVCpu, &pCtx->ldtr, uNewLdt);
     else
     {
@@ -3366 +3371 @@
 
         IEMSELDESC DescNewLdt;
-        rcStrict = iemMemFetchSelDesc(pIemCpu, &DescNewLdt, uNewLdt, X86_XCPT_TS);
+        rcStrict = iemMemFetchSelDesc(pVCpu, &DescNewLdt, uNewLdt, X86_XCPT_TS);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3379 +3384 @@
             Log(("iemTaskSwitch: Invalid LDT. enmTaskSwitch=%u uNewLdt=%u DescNewLdt.Legacy.u=%#RX64 -> #TS\n", enmTaskSwitch,
                  uNewLdt, DescNewLdt.Legacy.u));
-            return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseTaskSwitchFaultWithErr(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -3387 +3392 @@
         pCtx->ldtr.u32Limit = X86DESC_LIMIT_G(&DescNewLdt.Legacy);
         pCtx->ldtr.Attr.u   = X86DESC_GET_HID_ATTR(&DescNewLdt.Legacy);
-        if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+        if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
             pCtx->ldtr.Attr.u &= ~X86DESCATTR_UNUSABLE;
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), &pCtx->ldtr));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ldtr));
     }
 
     IEMSELDESC DescSS;
-    if (IEM_IS_V86_MODE(pIemCpu))
-    {
-        pIemCpu->uCpl = 3;
-        iemHlpLoadSelectorInV86Mode(pIemCpu, &pCtx->es, uNewES);
-        iemHlpLoadSelectorInV86Mode(pIemCpu, &pCtx->cs, uNewCS);
-        iemHlpLoadSelectorInV86Mode(pIemCpu, &pCtx->ss, uNewSS);
-        iemHlpLoadSelectorInV86Mode(pIemCpu, &pCtx->ds, uNewDS);
-        iemHlpLoadSelectorInV86Mode(pIemCpu, &pCtx->fs, uNewFS);
-        iemHlpLoadSelectorInV86Mode(pIemCpu, &pCtx->gs, uNewGS);
+    if (IEM_IS_V86_MODE(pVCpu))
+    {
+        pVCpu->iem.s.uCpl = 3;
+        iemHlpLoadSelectorInV86Mode(pVCpu, &pCtx->es, uNewES);
+        iemHlpLoadSelectorInV86Mode(pVCpu, &pCtx->cs, uNewCS);
+        iemHlpLoadSelectorInV86Mode(pVCpu, &pCtx->ss, uNewSS);
+        iemHlpLoadSelectorInV86Mode(pVCpu, &pCtx->ds, uNewDS);
+        iemHlpLoadSelectorInV86Mode(pVCpu, &pCtx->fs, uNewFS);
+        iemHlpLoadSelectorInV86Mode(pVCpu, &pCtx->gs, uNewGS);
     }
     else
@@ -3413 +3418 @@
         {
             Log(("iemTaskSwitch: Null stack segment. enmTaskSwitch=%u uNewSS=%#x -> #TS\n", enmTaskSwitch, uNewSS));
-            return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uNewSS & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseTaskSwitchFaultWithErr(pVCpu, uNewSS & X86_SEL_MASK_OFF_RPL);
         }
 
         /* Fetch the descriptor. */
-        rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_TS);
+        rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_TS);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3432 +3437 @@
             Log(("iemTaskSwitch: SS invalid descriptor type. uNewSS=%#x u1DescType=%u u4Type=%#x\n",
                  uNewSS, DescSS.Legacy.Gen.u1DescType, DescSS.Legacy.Gen.u4Type));
-            return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uNewSS & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseTaskSwitchFaultWithErr(pVCpu, uNewSS & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -3441 +3446 @@
             Log(("iemTaskSwitch: Invalid priv. for SS. uNewSS=%#x SS.DPL=%u uNewCpl=%u -> #TS\n", uNewSS, DescSS.Legacy.Gen.u2Dpl,
                  uNewCpl));
-            return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uNewSS & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseTaskSwitchFaultWithErr(pVCpu, uNewSS & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -3448 +3453 @@
         {
             Log(("iemTaskSwitch: SS not present. uNewSS=%#x -> #NP\n", uNewSS));
-            return iemRaiseSelectorNotPresentWithErr(pIemCpu, uNewSS & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseSelectorNotPresentWithErr(pVCpu, uNewSS & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -3457 +3462 @@
         if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3470 +3475 @@
         pCtx->ss.u64Base  = u64Base;
         pCtx->ss.fFlags   = CPUMSELREG_FLAGS_VALID;
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), &pCtx->ss));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
 
         /* CPL has changed, update IEM before loading rest of segments. */
-        pIemCpu->uCpl = uNewCpl;
+        pVCpu->iem.s.uCpl = uNewCpl;
 
         /*
          * Load the data segments for the new task.
          */
-        rcStrict = iemHlpTaskSwitchLoadDataSelectorInProtMode(pIemCpu, &pCtx->es, uNewES);
+        rcStrict = iemHlpTaskSwitchLoadDataSelectorInProtMode(pVCpu, &pCtx->es, uNewES);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
-        rcStrict = iemHlpTaskSwitchLoadDataSelectorInProtMode(pIemCpu, &pCtx->ds, uNewDS);
+        rcStrict = iemHlpTaskSwitchLoadDataSelectorInProtMode(pVCpu, &pCtx->ds, uNewDS);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
-        rcStrict = iemHlpTaskSwitchLoadDataSelectorInProtMode(pIemCpu, &pCtx->fs, uNewFS);
+        rcStrict = iemHlpTaskSwitchLoadDataSelectorInProtMode(pVCpu, &pCtx->fs, uNewFS);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
-        rcStrict = iemHlpTaskSwitchLoadDataSelectorInProtMode(pIemCpu, &pCtx->gs, uNewGS);
+        rcStrict = iemHlpTaskSwitchLoadDataSelectorInProtMode(pVCpu, &pCtx->gs, uNewGS);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3497 +3502 @@
         {
             Log(("iemTaskSwitch #TS: Null code segment. enmTaskSwitch=%u uNewCS=%#x\n", enmTaskSwitch, uNewCS));
-            return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseTaskSwitchFaultWithErr(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
         }
 
         /* Fetch the descriptor. */
         IEMSELDESC DescCS;
-        rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCS, X86_XCPT_TS);
+        rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_TS);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3515 +3520 @@
             Log(("iemTaskSwitch: CS invalid descriptor type. uNewCS=%#x u1DescType=%u u4Type=%#x -> #TS\n", uNewCS,
                  DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
-            return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseTaskSwitchFaultWithErr(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -3524 +3529 @@
             Log(("iemTaskSwitch: confirming CS DPL > RPL. uNewCS=%#x u4Type=%#x DPL=%u -> #TS\n", uNewCS, DescCS.Legacy.Gen.u4Type,
                  DescCS.Legacy.Gen.u2Dpl));
-            return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseTaskSwitchFaultWithErr(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -3533 +3538 @@
             Log(("iemTaskSwitch: non-confirming CS DPL RPL mismatch. uNewCS=%#x u4Type=%#x DPL=%u -> #TS\n", uNewCS,
                  DescCS.Legacy.Gen.u4Type, DescCS.Legacy.Gen.u2Dpl));
-            return iemRaiseTaskSwitchFaultWithErr(pIemCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseTaskSwitchFaultWithErr(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -3540 +3545 @@
         {
             Log(("iemTaskSwitch: CS not present. uNewCS=%#x -> #NP\n", uNewCS));
-            return iemRaiseSelectorNotPresentWithErr(pIemCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseSelectorNotPresentWithErr(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -3549 +3554 @@
         if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3562 +3567 @@
         pCtx->cs.u64Base  = u64Base;
         pCtx->cs.fFlags   = CPUMSELREG_FLAGS_VALID;
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), &pCtx->cs));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->cs));
     }
 
@@ -3602 +3607 @@
                 Log(("iemTaskSwitch: SS=%#x ESP=%#x cbStackFrame=%#x is out of bounds -> #SS\n", pCtx->ss.Sel, pCtx->esp,
                      cbStackFrame));
-                return iemRaiseStackSelectorNotPresentWithErr(pIemCpu, uExt);
+                return iemRaiseStackSelectorNotPresentWithErr(pVCpu, uExt);
             }
         }
@@ -3612 +3617 @@
                 Log(("iemTaskSwitch: SS=%#x ESP=%#x cbStackFrame=%#x (expand down) is out of bounds -> #SS\n", pCtx->ss.Sel, pCtx->esp,
                      cbStackFrame));
-                return iemRaiseStackSelectorNotPresentWithErr(pIemCpu, uExt);
+                return iemRaiseStackSelectorNotPresentWithErr(pVCpu, uExt);
             }
         }
@@ -3618 +3623 @@
 
         if (fIsNewTSS386)
-            rcStrict = iemMemStackPushU32(pIemCpu, uErr);
+            rcStrict = iemMemStackPushU32(pVCpu, uErr);
         else
-            rcStrict = iemMemStackPushU16(pIemCpu, uErr);
+            rcStrict = iemMemStackPushU16(pVCpu, uErr);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3635 +3640 @@
              pCtx->eip, pCtx->cs.u32Limit));
         /** @todo Intel says \#GP(EXT) for INT/XCPT, I couldn't figure out AMD yet. */
-        return iemRaiseGeneralProtectionFault(pIemCpu, uExt);
+        return iemRaiseGeneralProtectionFault(pVCpu, uExt);
     }
 
@@ -3647 +3652 @@
  *
  * @returns VBox strict status code.
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pCtx            The CPU context.
  * @param   cbInstr         The number of bytes to offset rIP by in the return
@@ -3657 +3662 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemRaiseXcptOrIntInProtMode(PIEMCPU     pIemCpu,
+iemRaiseXcptOrIntInProtMode(PVMCPU      pVCpu,
                             PCPUMCTX    pCtx,
                             uint8_t     cbInstr,
@@ -3671 +3676 @@
     {
         Log(("RaiseXcptOrIntInProtMode: %#x is out of bounds (%#x)\n", u8Vector, pCtx->idtr.cbIdt));
-        return iemRaiseGeneralProtectionFault(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+        return iemRaiseGeneralProtectionFault(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
     }
     X86DESC Idte;
-    VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &Idte.u, UINT8_MAX,
+    VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &Idte.u, UINT8_MAX,
                                               pCtx->idtr.pIdt + UINT32_C(8) * u8Vector);
     if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
@@ -3689 +3694 @@
     {
         Log(("RaiseXcptOrIntInProtMode %#x - not system selector (%#x) -> #GP\n", u8Vector, Idte.Gate.u4Type));
-        return iemRaiseGeneralProtectionFault(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+        return iemRaiseGeneralProtectionFault(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
     }
     bool     fTaskGate   = false;
@@ -3711 +3716 @@
              *        esp. call gates. */
             Log(("RaiseXcptOrIntInProtMode %#x - invalid type (%#x) -> #GP\n", u8Vector, Idte.Gate.u4Type));
-            return iemRaiseGeneralProtectionFault(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+            return iemRaiseGeneralProtectionFault(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
         }
 
@@ -3738 +3743 @@
     if (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
     {
-        if (pIemCpu->uCpl > Idte.Gate.u2Dpl)
+        if (pVCpu->iem.s.uCpl > Idte.Gate.u2Dpl)
         {
-            Log(("RaiseXcptOrIntInProtMode %#x - CPL (%d) > DPL (%d) -> #GP\n", u8Vector, pIemCpu->uCpl, Idte.Gate.u2Dpl));
-            return iemRaiseGeneralProtectionFault(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+            Log(("RaiseXcptOrIntInProtMode %#x - CPL (%d) > DPL (%d) -> #GP\n", u8Vector, pVCpu->iem.s.uCpl, Idte.Gate.u2Dpl));
+            return iemRaiseGeneralProtectionFault(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
         }
     }
@@ -3749 +3754 @@
     {
         Log(("RaiseXcptOrIntInProtMode %#x - not present -> #NP\n", u8Vector));
-        return iemRaiseSelectorNotPresentWithErr(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+        return iemRaiseSelectorNotPresentWithErr(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
     }
 
@@ -3767 +3772 @@
          */
         IEMSELDESC DescTSS;
-        rcStrict = iemMemFetchSelDescWithErr(pIemCpu, &DescTSS, SelTSS, X86_XCPT_GP, (SelTSS & uSelMask) | uExt);
+        rcStrict = iemMemFetchSelDescWithErr(pVCpu, &DescTSS, SelTSS, X86_XCPT_GP, (SelTSS & uSelMask) | uExt);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3782 +3787 @@
             Log(("RaiseXcptOrIntInProtMode %#x - TSS selector %#x of task gate not a system descriptor or not available %#RX64\n",
                  u8Vector, SelTSS, DescTSS.Legacy.au64));
-            return iemRaiseGeneralProtectionFault(pIemCpu, (SelTSS & uSelMask) | uExt);
+            return iemRaiseGeneralProtectionFault(pVCpu, (SelTSS & uSelMask) | uExt);
         }
 
@@ -3789 +3794 @@
         {
             Log(("RaiseXcptOrIntInProtMode %#x - TSS selector %#x not present %#RX64\n", u8Vector, SelTSS, DescTSS.Legacy.au64));
-            return iemRaiseSelectorNotPresentWithErr(pIemCpu, (SelTSS & uSelMask) | uExt);
+            return iemRaiseSelectorNotPresentWithErr(pVCpu, (SelTSS & uSelMask) | uExt);
         }
 
         /* Do the actual task switch. */
-        return iemTaskSwitch(pIemCpu, pCtx, IEMTASKSWITCH_INT_XCPT, pCtx->eip, fFlags, uErr, uCr2, SelTSS, &DescTSS);
+        return iemTaskSwitch(pVCpu, pCtx, IEMTASKSWITCH_INT_XCPT, pCtx->eip, fFlags, uErr, uCr2, SelTSS, &DescTSS);
     }
 
@@ -3801 +3806 @@
     {
         Log(("RaiseXcptOrIntInProtMode %#x - CS=%#x -> #GP\n", u8Vector, NewCS));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
     /* Fetch the descriptor for the new CS. */
     IEMSELDESC DescCS;
-    rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, NewCS, X86_XCPT_GP); /** @todo correct exception? */
+    rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, NewCS, X86_XCPT_GP); /** @todo correct exception? */
     if (rcStrict != VINF_SUCCESS)
     {
@@ -3817 +3822 @@
     {
         Log(("RaiseXcptOrIntInProtMode %#x - CS=%#x - system selector (%#x) -> #GP\n", u8Vector, NewCS, DescCS.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFault(pIemCpu, NewCS & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFault(pVCpu, NewCS & X86_SEL_MASK_OFF_RPL);
     }
     if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
     {
         Log(("RaiseXcptOrIntInProtMode %#x - CS=%#x - data selector (%#x) -> #GP\n", u8Vector, NewCS, DescCS.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFault(pIemCpu, NewCS & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFault(pVCpu, NewCS & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -3830 +3835 @@
      *        same-privilege stack behavior further down.  A testcase would
      *        be nice. */
-    if (DescCS.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
+    if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
     {
         Log(("RaiseXcptOrIntInProtMode %#x - CS=%#x - DPL (%d) > CPL (%d) -> #GP\n",
-             u8Vector, NewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFault(pIemCpu, NewCS & X86_SEL_MASK_OFF_RPL);
+             u8Vector, NewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFault(pVCpu, NewCS & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -3841 +3846 @@
     {
         Log(("RaiseXcptOrIntInProtMode %#x - CS=%#x - segment not present -> #NP\n", u8Vector, NewCS));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, NewCS);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, NewCS);
     }
 
@@ -3854 +3859 @@
         Log(("RaiseXcptOrIntInProtMode %#x - EIP=%#x > cbLimitCS=%#x (CS=%#x) -> #GP(0)\n",
              u8Vector, uNewEip, cbLimitCS, NewCS));
-        return iemRaiseGeneralProtectionFault(pIemCpu, 0);
+        return iemRaiseGeneralProtectionFault(pVCpu, 0);
     }
 
     /* Calc the flag image to push. */
-    uint32_t        fEfl    = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    uint32_t        fEfl    = IEMMISC_GET_EFL(pVCpu, pCtx);
     if (fFlags & (IEM_XCPT_FLAGS_DRx_INSTR_BP | IEM_XCPT_FLAGS_T_SOFT_INT))
         fEfl &= ~X86_EFL_RF;
-    else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+    else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
         fEfl |= X86_EFL_RF; /* Vagueness is all I've found on this so far... */ /** @todo Automatically pushing EFLAGS.RF. */
 
     /* From V8086 mode only go to CPL 0. */
     uint8_t const   uNewCpl = DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF
-                            ? pIemCpu->uCpl : DescCS.Legacy.Gen.u2Dpl;
+                            ? pVCpu->iem.s.uCpl : DescCS.Legacy.Gen.u2Dpl;
     if ((fEfl & X86_EFL_VM) && uNewCpl != 0) /** @todo When exactly is this raised? */
     {
         Log(("RaiseXcptOrIntInProtMode %#x - CS=%#x - New CPL (%d) != 0 w/ VM=1 -> #GP\n", u8Vector, NewCS, uNewCpl));
-        return iemRaiseGeneralProtectionFault(pIemCpu, 0);
+        return iemRaiseGeneralProtectionFault(pVCpu, 0);
     }
 
@@ -3877 +3882 @@
      * This in turns means validating the new SS and ESP...
      */
-    if (uNewCpl != pIemCpu->uCpl)
+    if (uNewCpl != pVCpu->iem.s.uCpl)
     {
         RTSEL    NewSS;
         uint32_t uNewEsp;
-        rcStrict = iemRaiseLoadStackFromTss32Or16(pIemCpu, pCtx, uNewCpl, &NewSS, &uNewEsp);
+        rcStrict = iemRaiseLoadStackFromTss32Or16(pVCpu, pCtx, uNewCpl, &NewSS, &uNewEsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
 
         IEMSELDESC DescSS;
-        rcStrict = iemMiscValidateNewSS(pIemCpu, pCtx, NewSS, uNewCpl, &DescSS);
+        rcStrict = iemMiscValidateNewSS(pVCpu, pCtx, NewSS, uNewCpl, &DescSS);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3903 +3908 @@
                 Log(("RaiseXcptOrIntInProtMode: %#x - SS=%#x ESP=%#x cbStackFrame=%#x is out of bounds -> #GP\n",
                      u8Vector, NewSS, uNewEsp, cbStackFrame));
-                return iemRaiseSelectorBoundsBySelector(pIemCpu, NewSS);
+                return iemRaiseSelectorBoundsBySelector(pVCpu, NewSS);
             }
         }
@@ -3913 +3918 @@
                 Log(("RaiseXcptOrIntInProtMode: %#x - SS=%#x ESP=%#x cbStackFrame=%#x (expand down) is out of bounds -> #GP\n",
                      u8Vector, NewSS, uNewEsp, cbStackFrame));
-                return iemRaiseSelectorBoundsBySelector(pIemCpu, NewSS);
+                return iemRaiseSelectorBoundsBySelector(pVCpu, NewSS);
             }
         }
@@ -3922 +3927 @@
 
         /* Set the new CPL so that stack accesses use it. */
-        uint8_t const uOldCpl = pIemCpu->uCpl;
-        pIemCpu->uCpl = uNewCpl;
+        uint8_t const uOldCpl = pVCpu->iem.s.uCpl;
+        pVCpu->iem.s.uCpl = uNewCpl;
 
         /* Create the stack frame. */
         RTPTRUNION uStackFrame;
-        rcStrict = iemMemMap(pIemCpu, &uStackFrame.pv, cbStackFrame, UINT8_MAX,
+        rcStrict = iemMemMap(pVCpu, &uStackFrame.pv, cbStackFrame, UINT8_MAX,
                              uNewEsp - cbStackFrame + X86DESC_BASE(&DescSS.Legacy), IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS); /* _SYS is a hack ... */
         if (rcStrict != VINF_SUCCESS)
@@ -3968 +3973 @@
             }
         }
-        rcStrict = iemMemCommitAndUnmap(pIemCpu, pvStackFrame, IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, pvStackFrame, IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3978 +3983 @@
         if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, NewCS);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, NewCS);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3986 +3991 @@
         if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, NewSS);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, NewSS);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -4014 +4019 @@
         if (fEfl & X86_EFL_VM)
         {
-            iemHlpLoadNullDataSelectorOnV86Xcpt(pIemCpu, &pCtx->gs);
-            iemHlpLoadNullDataSelectorOnV86Xcpt(pIemCpu, &pCtx->fs);
-            iemHlpLoadNullDataSelectorOnV86Xcpt(pIemCpu, &pCtx->es);
-            iemHlpLoadNullDataSelectorOnV86Xcpt(pIemCpu, &pCtx->ds);
+            iemHlpLoadNullDataSelectorOnV86Xcpt(pVCpu, &pCtx->gs);
+            iemHlpLoadNullDataSelectorOnV86Xcpt(pVCpu, &pCtx->fs);
+            iemHlpLoadNullDataSelectorOnV86Xcpt(pVCpu, &pCtx->es);
+            iemHlpLoadNullDataSelectorOnV86Xcpt(pVCpu, &pCtx->ds);
         }
     }
@@ -4028 +4033 @@
         RTPTRUNION      uStackFrame;
         uint8_t const   cbStackFrame = (fFlags & IEM_XCPT_FLAGS_ERR ? 8 : 6) << f32BitGate;
-        rcStrict = iemMemStackPushBeginSpecial(pIemCpu, cbStackFrame, &uStackFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbStackFrame, &uStackFrame.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -4038 +4043 @@
                 *uStackFrame.pu32++ = uErr;
             uStackFrame.pu32[0] = fFlags & IEM_XCPT_FLAGS_T_SOFT_INT ? pCtx->eip + cbInstr : pCtx->eip;
-            uStackFrame.pu32[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | pIemCpu->uCpl;
+            uStackFrame.pu32[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | pVCpu->iem.s.uCpl;
             uStackFrame.pu32[2] = fEfl;
         }
@@ -4046 +4051 @@
                 *uStackFrame.pu16++ = uErr;
             uStackFrame.pu16[0] = fFlags & IEM_XCPT_FLAGS_T_SOFT_INT ? pCtx->eip + cbInstr : pCtx->eip;
-            uStackFrame.pu16[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | pIemCpu->uCpl;
+            uStackFrame.pu16[1] = (pCtx->cs.Sel & ~X86_SEL_RPL) | pVCpu->iem.s.uCpl;
             uStackFrame.pu16[2] = fEfl;
         }
-        rcStrict = iemMemCommitAndUnmap(pIemCpu, pvStackFrame, IEM_ACCESS_STACK_W); /* don't use the commit here */
+        rcStrict = iemMemCommitAndUnmap(pVCpu, pvStackFrame, IEM_ACCESS_STACK_W); /* don't use the commit here */
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -4056 +4061 @@
         if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, NewCS);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, NewCS);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -4078 +4083 @@
     pCtx->rip               = uNewEip;  /* (The entire register is modified, see pe16_32 bs3kit tests.) */
     fEfl &= ~fEflToClear;
-    IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
+    IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
 
     if (fFlags & IEM_XCPT_FLAGS_CR2)
@@ -4094 +4099 @@
  *
  * @returns VBox strict status code.
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pCtx            The CPU context.
  * @param   cbInstr         The number of bytes to offset rIP by in the return
@@ -4104 +4109 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemRaiseXcptOrIntInLongMode(PIEMCPU     pIemCpu,
+iemRaiseXcptOrIntInLongMode(PVMCPU      pVCpu,
                             PCPUMCTX    pCtx,
                             uint8_t     cbInstr,
@@ -4119 +4124 @@
     {
         Log(("iemRaiseXcptOrIntInLongMode: %#x is out of bounds (%#x)\n", u8Vector, pCtx->idtr.cbIdt));
-        return iemRaiseGeneralProtectionFault(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+        return iemRaiseGeneralProtectionFault(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
     }
     X86DESC64 Idte;
-    VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &Idte.au64[0], UINT8_MAX, pCtx->idtr.pIdt + offIdt);
+    VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &Idte.au64[0], UINT8_MAX, pCtx->idtr.pIdt + offIdt);
     if (RT_LIKELY(rcStrict == VINF_SUCCESS))
-        rcStrict = iemMemFetchSysU64(pIemCpu, &Idte.au64[1], UINT8_MAX, pCtx->idtr.pIdt + offIdt + 8);
+        rcStrict = iemMemFetchSysU64(pVCpu, &Idte.au64[1], UINT8_MAX, pCtx->idtr.pIdt + offIdt + 8);
     if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
         return rcStrict;
@@ -4138 +4143 @@
     {
         Log(("iemRaiseXcptOrIntInLongMode %#x - not system selector (%#x) -> #GP\n", u8Vector, Idte.Gate.u4Type));
-        return iemRaiseGeneralProtectionFault(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+        return iemRaiseGeneralProtectionFault(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
     }
     uint32_t fEflToClear = X86_EFL_TF | X86_EFL_NT | X86_EFL_RF | X86_EFL_VM;
@@ -4151 +4156 @@
         default:
             Log(("iemRaiseXcptOrIntInLongMode %#x - invalid type (%#x) -> #GP\n", u8Vector, Idte.Gate.u4Type));
-            return iemRaiseGeneralProtectionFault(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+            return iemRaiseGeneralProtectionFault(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
     }
 
@@ -4157 +4162 @@
     if (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT)
     {
-        if (pIemCpu->uCpl > Idte.Gate.u2Dpl)
+        if (pVCpu->iem.s.uCpl > Idte.Gate.u2Dpl)
         {
-            Log(("iemRaiseXcptOrIntInLongMode %#x - CPL (%d) > DPL (%d) -> #GP\n", u8Vector, pIemCpu->uCpl, Idte.Gate.u2Dpl));
-            return iemRaiseGeneralProtectionFault(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+            Log(("iemRaiseXcptOrIntInLongMode %#x - CPL (%d) > DPL (%d) -> #GP\n", u8Vector, pVCpu->iem.s.uCpl, Idte.Gate.u2Dpl));
+            return iemRaiseGeneralProtectionFault(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
         }
     }
@@ -4168 +4173 @@
     {
         Log(("iemRaiseXcptOrIntInLongMode %#x - not present -> #NP\n", u8Vector));
-        return iemRaiseSelectorNotPresentWithErr(pIemCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
+        return iemRaiseSelectorNotPresentWithErr(pVCpu, X86_TRAP_ERR_IDT | ((uint16_t)u8Vector << X86_TRAP_ERR_SEL_SHIFT));
     }
 
@@ -4176 +4181 @@
     {
         Log(("iemRaiseXcptOrIntInLongMode %#x - CS=%#x -> #GP\n", u8Vector, NewCS));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
     /* Fetch the descriptor for the new CS. */
     IEMSELDESC DescCS;
-    rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, NewCS, X86_XCPT_GP);
+    rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, NewCS, X86_XCPT_GP);
     if (rcStrict != VINF_SUCCESS)
     {
@@ -4192 +4197 @@
     {
         Log(("iemRaiseXcptOrIntInLongMode %#x - CS=%#x - system selector (%#x) -> #GP\n", u8Vector, NewCS, DescCS.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFault(pIemCpu, NewCS & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFault(pVCpu, NewCS & X86_SEL_MASK_OFF_RPL);
     }
     if (   !DescCS.Long.Gen.u1Long
@@ -4200 +4205 @@
         Log(("iemRaiseXcptOrIntInLongMode %#x - CS=%#x - not 64-bit code selector (%#x, L=%u, D=%u) -> #GP\n",
              u8Vector, NewCS, DescCS.Legacy.Gen.u4Type, DescCS.Long.Gen.u1Long, DescCS.Long.Gen.u1DefBig));
-        return iemRaiseGeneralProtectionFault(pIemCpu, NewCS & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFault(pVCpu, NewCS & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -4209 +4214 @@
     /** @todo Testcase: Interrupt handler with CS.DPL=1, interrupt dispatched
      *        when CPU in Ring-0. Result \#GP?  */
-    if (DescCS.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
+    if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
     {
         Log(("iemRaiseXcptOrIntInLongMode %#x - CS=%#x - DPL (%d) > CPL (%d) -> #GP\n",
-             u8Vector, NewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFault(pIemCpu, NewCS & X86_SEL_MASK_OFF_RPL);
+             u8Vector, NewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFault(pVCpu, NewCS & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -4221 +4226 @@
     {
         Log(("iemRaiseXcptOrIntInLongMode %#x - CS=%#x - segment not present -> #NP\n", u8Vector, NewCS));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, NewCS);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, NewCS);
     }
 
@@ -4231 +4236 @@
     {
         Log(("iemRaiseXcptOrIntInLongMode %#x - RIP=%#RX64 - Not canonical -> #GP(0)\n", u8Vector, uNewRip));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -4240 +4245 @@
     uint64_t        uNewRsp;
     uint8_t const   uNewCpl = DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF
-                            ? pIemCpu->uCpl : DescCS.Legacy.Gen.u2Dpl;
-    if (   uNewCpl != pIemCpu->uCpl
+                            ? pVCpu->iem.s.uCpl : DescCS.Legacy.Gen.u2Dpl;
+    if (   uNewCpl != pVCpu->iem.s.uCpl
         || Idte.Gate.u3IST != 0)
     {
-        rcStrict = iemRaiseLoadStackFromTss64(pIemCpu, pCtx, uNewCpl, Idte.Gate.u3IST, &uNewRsp);
+        rcStrict = iemRaiseLoadStackFromTss64(pVCpu, pCtx, uNewCpl, Idte.Gate.u3IST, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -4255 +4260 @@
      * Calc the flag image to push.
      */
-    uint32_t        fEfl    = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    uint32_t        fEfl    = IEMMISC_GET_EFL(pVCpu, pCtx);
     if (fFlags & (IEM_XCPT_FLAGS_DRx_INSTR_BP | IEM_XCPT_FLAGS_T_SOFT_INT))
         fEfl &= ~X86_EFL_RF;
-    else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+    else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
         fEfl |= X86_EFL_RF; /* Vagueness is all I've found on this so far... */ /** @todo Automatically pushing EFLAGS.RF. */
 
@@ -4265 +4270 @@
      */
     /* Set the new CPL so that stack accesses use it. */
-    uint8_t const uOldCpl = pIemCpu->uCpl;
-    pIemCpu->uCpl = uNewCpl;
+    uint8_t const uOldCpl = pVCpu->iem.s.uCpl;
+    pVCpu->iem.s.uCpl = uNewCpl;
 
     /* Create the stack frame. */
     uint32_t   cbStackFrame = sizeof(uint64_t) * (5 + !!(fFlags & IEM_XCPT_FLAGS_ERR));
     RTPTRUNION uStackFrame;
-    rcStrict = iemMemMap(pIemCpu, &uStackFrame.pv, cbStackFrame, UINT8_MAX,
+    rcStrict = iemMemMap(pVCpu, &uStackFrame.pv, cbStackFrame, UINT8_MAX,
                          uNewRsp - cbStackFrame, IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS); /* _SYS is a hack ... */
     if (rcStrict != VINF_SUCCESS)
@@ -4284 +4289 @@
     uStackFrame.pu64[3] = pCtx->rsp;
     uStackFrame.pu64[4] = pCtx->ss.Sel;
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, pvStackFrame, IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, pvStackFrame, IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -4294 +4299 @@
     if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
     {
-        rcStrict = iemMemMarkSelDescAccessed(pIemCpu, NewCS);
+        rcStrict = iemMemMarkSelDescAccessed(pVCpu, NewCS);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -4324 +4329 @@
 
     fEfl &= ~fEflToClear;
-    IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
+    IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
 
     if (fFlags & IEM_XCPT_FLAGS_CR2)
@@ -4342 +4347 @@
  *
  * @returns VBox strict status code.
- * @param   pIemCpu         The IEM per CPU instance data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   cbInstr         The number of bytes to offset rIP by in the return
  *                          address.
@@ -4351 +4356 @@
  */
 DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC)
-iemRaiseXcptOrInt(PIEMCPU     pIemCpu,
+iemRaiseXcptOrInt(PVMCPU      pVCpu,
                   uint8_t     cbInstr,
                   uint8_t     u8Vector,
@@ -4358 +4363 @@
                   uint64_t    uCr2)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 #ifdef IN_RING0
-    int rc = HMR0EnsureCompleteBasicContext(IEMCPU_TO_VMCPU(pIemCpu), pCtx);
+    int rc = HMR0EnsureCompleteBasicContext(pVCpu, pCtx);
     AssertRCReturn(rc, rc);
 #endif
@@ -4367 +4372 @@
      * Flush prefetch buffer
      */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     /*
@@ -4383 +4388 @@
     }
 #ifdef DBGFTRACE_ENABLED
-    RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "Xcpt/%u: %02x %u %x %x %llx %04x:%04llx %04x:%04llx",
-                      pIemCpu->cXcptRecursions, u8Vector, cbInstr, fFlags, uErr, uCr2,
+    RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "Xcpt/%u: %02x %u %x %x %llx %04x:%04llx %04x:%04llx",
+                      pVCpu->iem.s.cXcptRecursions, u8Vector, cbInstr, fFlags, uErr, uCr2,
                       pCtx->cs.Sel, pCtx->rip, pCtx->ss.Sel, pCtx->rsp);
 #endif
@@ -4391 +4396 @@
      * Do recursion accounting.
      */
-    uint8_t const  uPrevXcpt = pIemCpu->uCurXcpt;
-    uint32_t const fPrevXcpt = pIemCpu->fCurXcpt;
-    if (pIemCpu->cXcptRecursions == 0)
+    uint8_t const  uPrevXcpt = pVCpu->iem.s.uCurXcpt;
+    uint32_t const fPrevXcpt = pVCpu->iem.s.fCurXcpt;
+    if (pVCpu->iem.s.cXcptRecursions == 0)
         Log(("iemRaiseXcptOrInt: %#x at %04x:%RGv cbInstr=%#x fFlags=%#x uErr=%#x uCr2=%llx\n",
              u8Vector, pCtx->cs.Sel, pCtx->rip, cbInstr, fFlags, uErr, uCr2));
@@ -4399 +4404 @@
     {
         Log(("iemRaiseXcptOrInt: %#x at %04x:%RGv cbInstr=%#x fFlags=%#x uErr=%#x uCr2=%llx; prev=%#x depth=%d flags=%#x\n",
-             u8Vector, pCtx->cs.Sel, pCtx->rip, cbInstr, fFlags, uErr, uCr2, pIemCpu->uCurXcpt, pIemCpu->cXcptRecursions + 1, fPrevXcpt));
+             u8Vector, pCtx->cs.Sel, pCtx->rip, cbInstr, fFlags, uErr, uCr2, pVCpu->iem.s.uCurXcpt, pVCpu->iem.s.cXcptRecursions + 1, fPrevXcpt));
 
         /** @todo double and tripple faults. */
-        if (pIemCpu->cXcptRecursions >= 3)
+        if (pVCpu->iem.s.cXcptRecursions >= 3)
         {
 #ifdef DEBUG_bird
@@ -4416 +4421 @@
         } */
     }
-    pIemCpu->cXcptRecursions++;
-    pIemCpu->uCurXcpt = u8Vector;
-    pIemCpu->fCurXcpt = fFlags;
+    pVCpu->iem.s.cXcptRecursions++;
+    pVCpu->iem.s.uCurXcpt = u8Vector;
+    pVCpu->iem.s.fCurXcpt = fFlags;
 
     /*
@@ -4426 +4431 @@
     if (LogIs3Enabled())
     {
-        PVM     pVM   = IEMCPU_TO_VM(pIemCpu);
-        PVMCPU  pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
+        PVM     pVM = pVCpu->CTX_SUFF(pVM);
         char    szRegs[4096];
         DBGFR3RegPrintf(pVM->pUVM, pVCpu->idCpu, &szRegs[0], sizeof(szRegs),
@@ -4469 +4473 @@
     VBOXSTRICTRC    rcStrict;
     if (!(pCtx->cr0 & X86_CR0_PE))
-        rcStrict = iemRaiseXcptOrIntInRealMode( pIemCpu, pCtx, cbInstr, u8Vector, fFlags, uErr, uCr2);
+        rcStrict = iemRaiseXcptOrIntInRealMode(pVCpu, pCtx, cbInstr, u8Vector, fFlags, uErr, uCr2);
     else if (pCtx->msrEFER & MSR_K6_EFER_LMA)
-        rcStrict = iemRaiseXcptOrIntInLongMode( pIemCpu, pCtx, cbInstr, u8Vector, fFlags, uErr, uCr2);
+        rcStrict = iemRaiseXcptOrIntInLongMode(pVCpu, pCtx, cbInstr, u8Vector, fFlags, uErr, uCr2);
     else
-        rcStrict = iemRaiseXcptOrIntInProtMode( pIemCpu, pCtx, cbInstr, u8Vector, fFlags, uErr, uCr2);
+        rcStrict = iemRaiseXcptOrIntInProtMode(pVCpu, pCtx, cbInstr, u8Vector, fFlags, uErr, uCr2);
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     /*
      * Unwind.
      */
-    pIemCpu->cXcptRecursions--;
-    pIemCpu->uCurXcpt = uPrevXcpt;
-    pIemCpu->fCurXcpt = fPrevXcpt;
+    pVCpu->iem.s.cXcptRecursions--;
+    pVCpu->iem.s.uCurXcpt = uPrevXcpt;
+    pVCpu->iem.s.fCurXcpt = fPrevXcpt;
     Log(("iemRaiseXcptOrInt: returns %Rrc (vec=%#x); cs:rip=%04x:%RGv ss:rsp=%04x:%RGv cpl=%u\n",
-         VBOXSTRICTRC_VAL(rcStrict), u8Vector, pCtx->cs.Sel, pCtx->rip, pCtx->ss.Sel, pCtx->esp, pIemCpu->uCpl));
+         VBOXSTRICTRC_VAL(rcStrict), u8Vector, pCtx->cs.Sel, pCtx->rip, pCtx->ss.Sel, pCtx->esp, pVCpu->iem.s.uCpl));
     return rcStrict;
 }
@@ -4494 +4498 @@
  */
 IEM_STATIC DECL_NO_RETURN(void)
-iemRaiseXcptOrIntJmp(PIEMCPU     pIemCpu,
+iemRaiseXcptOrIntJmp(PVMCPU      pVCpu,
                      uint8_t     cbInstr,
                      uint8_t     u8Vector,
@@ -4501 +4505 @@
                      uint64_t    uCr2)
 {
-    VBOXSTRICTRC rcStrict = iemRaiseXcptOrInt(pIemCpu, cbInstr, u8Vector, fFlags, uErr, uCr2);
-    longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+    VBOXSTRICTRC rcStrict = iemRaiseXcptOrInt(pVCpu, cbInstr, u8Vector, fFlags, uErr, uCr2);
+    longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
 }
 #endif
@@ -4508 +4512 @@
 
 /** \#DE - 00.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseDivideError(PIEMCPU pIemCpu)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_DE, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseDivideError(PVMCPU pVCpu)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_DE, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }
 
@@ -4516 +4520 @@
 /** \#DB - 01.
  * @note This automatically clear DR7.GD.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseDebugException(PIEMCPU pIemCpu)
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseDebugException(PVMCPU pVCpu)
 {
     /** @todo set/clear RF. */
-    pIemCpu->CTX_SUFF(pCtx)->dr[7] &= ~X86_DR7_GD;
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_DB, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
+    pVCpu->iem.s.CTX_SUFF(pCtx)->dr[7] &= ~X86_DR7_GD;
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_DB, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }
 
 
 /** \#UD - 06.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseUndefinedOpcode(PIEMCPU pIemCpu)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_UD, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseUndefinedOpcode(PVMCPU pVCpu)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_UD, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }
 
 
 /** \#NM - 07.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseDeviceNotAvailable(PIEMCPU pIemCpu)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_NM, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseDeviceNotAvailable(PVMCPU pVCpu)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_NM, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }
 
 
 /** \#TS(err) - 0a.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseTaskSwitchFaultWithErr(PIEMCPU pIemCpu, uint16_t uErr)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_TS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErr, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseTaskSwitchFaultWithErr(PVMCPU pVCpu, uint16_t uErr)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_TS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErr, 0);
 }
 
 
 /** \#TS(tr) - 0a.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseTaskSwitchFaultCurrentTSS(PIEMCPU pIemCpu)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_TS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
-                             pIemCpu->CTX_SUFF(pCtx)->tr.Sel, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseTaskSwitchFaultCurrentTSS(PVMCPU pVCpu)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_TS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
+                             pVCpu->iem.s.CTX_SUFF(pCtx)->tr.Sel, 0);
 }
 
 
 /** \#TS(0) - 0a.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseTaskSwitchFault0(PIEMCPU pIemCpu)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_TS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseTaskSwitchFault0(PVMCPU pVCpu)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_TS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
                              0, 0);
 }
@@ -4562 +4566 @@
 
 /** \#TS(err) - 0a.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseTaskSwitchFaultBySelector(PIEMCPU pIemCpu, uint16_t uSel)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_TS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseTaskSwitchFaultBySelector(PVMCPU pVCpu, uint16_t uSel)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_TS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
                              uSel & X86_SEL_MASK_OFF_RPL, 0);
 }
@@ -4570 +4574 @@
 
 /** \#NP(err) - 0b.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorNotPresentWithErr(PIEMCPU pIemCpu, uint16_t uErr)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_NP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErr, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorNotPresentWithErr(PVMCPU pVCpu, uint16_t uErr)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_NP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErr, 0);
 }
 
 
 /** \#NP(seg) - 0b.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorNotPresentBySegReg(PIEMCPU pIemCpu, uint32_t iSegReg)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_NP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
-                             iemSRegFetchU16(pIemCpu, iSegReg) & ~X86_SEL_RPL, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorNotPresentBySegReg(PVMCPU pVCpu, uint32_t iSegReg)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_NP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
+                             iemSRegFetchU16(pVCpu, iSegReg) & ~X86_SEL_RPL, 0);
 }
 
 
 /** \#NP(sel) - 0b.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorNotPresentBySelector(PIEMCPU pIemCpu, uint16_t uSel)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_NP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorNotPresentBySelector(PVMCPU pVCpu, uint16_t uSel)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_NP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
                              uSel & ~X86_SEL_RPL, 0);
 }
@@ -4593 +4597 @@
 
 /** \#SS(seg) - 0c.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseStackSelectorNotPresentBySelector(PIEMCPU pIemCpu, uint16_t uSel)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_SS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseStackSelectorNotPresentBySelector(PVMCPU pVCpu, uint16_t uSel)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_SS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
                              uSel & ~X86_SEL_RPL, 0);
 }
@@ -4601 +4605 @@
 
 /** \#SS(err) - 0c.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseStackSelectorNotPresentWithErr(PIEMCPU pIemCpu, uint16_t uErr)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_SS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErr, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseStackSelectorNotPresentWithErr(PVMCPU pVCpu, uint16_t uErr)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_SS, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErr, 0);
 }
 
 
 /** \#GP(n) - 0d.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseGeneralProtectionFault(PIEMCPU pIemCpu, uint16_t uErr)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErr, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseGeneralProtectionFault(PVMCPU pVCpu, uint16_t uErr)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErr, 0);
 }
 
 
 /** \#GP(0) - 0d.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseGeneralProtectionFault0(PIEMCPU pIemCpu)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseGeneralProtectionFault0(PVMCPU pVCpu)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
 }
 
 #ifdef IEM_WITH_SETJMP
 /** \#GP(0) - 0d.  */
-DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseGeneralProtectionFault0Jmp(PIEMCPU pIemCpu)
-{
-    iemRaiseXcptOrIntJmp(pIemCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
+DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseGeneralProtectionFault0Jmp(PVMCPU pVCpu)
+{
+    iemRaiseXcptOrIntJmp(pVCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
 }
 #endif
@@ -4630 +4634 @@
 
 /** \#GP(sel) - 0d.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseGeneralProtectionFaultBySelector(PIEMCPU pIemCpu, RTSEL Sel)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseGeneralProtectionFaultBySelector(PVMCPU pVCpu, RTSEL Sel)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
                              Sel & ~X86_SEL_RPL, 0);
 }
@@ -4638 +4642 @@
 
 /** \#GP(0) - 0d.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseNotCanonical(PIEMCPU pIemCpu)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseNotCanonical(PVMCPU pVCpu)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
 }
 
 
 /** \#GP(sel) - 0d.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorBounds(PIEMCPU pIemCpu, uint32_t iSegReg, uint32_t fAccess)
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorBounds(PVMCPU pVCpu, uint32_t iSegReg, uint32_t fAccess)
 {
     NOREF(iSegReg); NOREF(fAccess);
-    return iemRaiseXcptOrInt(pIemCpu, 0, iSegReg == X86_SREG_SS ? X86_XCPT_SS : X86_XCPT_GP,
+    return iemRaiseXcptOrInt(pVCpu, 0, iSegReg == X86_SREG_SS ? X86_XCPT_SS : X86_XCPT_GP,
                              IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
 }
@@ -4654 +4658 @@
 #ifdef IEM_WITH_SETJMP
 /** \#GP(sel) - 0d, longjmp.  */
-DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseSelectorBoundsJmp(PIEMCPU pIemCpu, uint32_t iSegReg, uint32_t fAccess)
+DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseSelectorBoundsJmp(PVMCPU pVCpu, uint32_t iSegReg, uint32_t fAccess)
 {
     NOREF(iSegReg); NOREF(fAccess);
-    iemRaiseXcptOrIntJmp(pIemCpu, 0, iSegReg == X86_SREG_SS ? X86_XCPT_SS : X86_XCPT_GP,
+    iemRaiseXcptOrIntJmp(pVCpu, 0, iSegReg == X86_SREG_SS ? X86_XCPT_SS : X86_XCPT_GP,
                          IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
 }
@@ -4663 +4667 @@
 
 /** \#GP(sel) - 0d.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorBoundsBySelector(PIEMCPU pIemCpu, RTSEL Sel)
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorBoundsBySelector(PVMCPU pVCpu, RTSEL Sel)
 {
     NOREF(Sel);
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
 }
 
 #ifdef IEM_WITH_SETJMP
 /** \#GP(sel) - 0d, longjmp.  */
-DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseSelectorBoundsBySelectorJmp(PIEMCPU pIemCpu, RTSEL Sel)
+DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseSelectorBoundsBySelectorJmp(PVMCPU pVCpu, RTSEL Sel)
 {
     NOREF(Sel);
-    iemRaiseXcptOrIntJmp(pIemCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
+    iemRaiseXcptOrIntJmp(pVCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
 }
 #endif
@@ -4680 +4684 @@
 
 /** \#GP(sel) - 0d.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorInvalidAccess(PIEMCPU pIemCpu, uint32_t iSegReg, uint32_t fAccess)
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseSelectorInvalidAccess(PVMCPU pVCpu, uint32_t iSegReg, uint32_t fAccess)
 {
     NOREF(iSegReg); NOREF(fAccess);
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
 }
 
 #ifdef IEM_WITH_SETJMP
 /** \#GP(sel) - 0d, longjmp.  */
-DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseSelectorInvalidAccessJmp(PIEMCPU pIemCpu, uint32_t iSegReg,
+DECL_NO_INLINE(IEM_STATIC, DECL_NO_RETURN(void)) iemRaiseSelectorInvalidAccessJmp(PVMCPU pVCpu, uint32_t iSegReg,
                                                                                   uint32_t fAccess)
 {
     NOREF(iSegReg); NOREF(fAccess);
-    iemRaiseXcptOrIntJmp(pIemCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
+    iemRaiseXcptOrIntJmp(pVCpu, 0, X86_XCPT_GP, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, 0, 0);
 }
 #endif
@@ -4698 +4702 @@
 
 /** \#PF(n) - 0e.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaisePageFault(PIEMCPU pIemCpu, RTGCPTR GCPtrWhere, uint32_t fAccess, int rc)
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaisePageFault(PVMCPU pVCpu, RTGCPTR GCPtrWhere, uint32_t fAccess, int rc)
 {
     uint16_t uErr;
@@ -4719 +4723 @@
     }
 
-    if (pIemCpu->uCpl == 3)
+    if (pVCpu->iem.s.uCpl == 3)
         uErr |= X86_TRAP_PF_US;
 
     if (   (fAccess & IEM_ACCESS_WHAT_MASK) == IEM_ACCESS_WHAT_CODE
-        && (   (pIemCpu->CTX_SUFF(pCtx)->cr4 & X86_CR4_PAE)
-            && (pIemCpu->CTX_SUFF(pCtx)->msrEFER & MSR_K6_EFER_NXE) ) )
+        && (   (pVCpu->iem.s.CTX_SUFF(pCtx)->cr4 & X86_CR4_PAE)
+            && (pVCpu->iem.s.CTX_SUFF(pCtx)->msrEFER & MSR_K6_EFER_NXE) ) )
         uErr |= X86_TRAP_PF_ID;
 
@@ -4736 +4740 @@
     if (fAccess & IEM_ACCESS_TYPE_WRITE)
     {
-        if (!IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu) || !(fAccess & IEM_ACCESS_TYPE_READ))
+        if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu) || !(fAccess & IEM_ACCESS_TYPE_READ))
             uErr |= X86_TRAP_PF_RW;
     }
 #endif
 
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_PF, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR | IEM_XCPT_FLAGS_CR2,
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_PF, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR | IEM_XCPT_FLAGS_CR2,
                              uErr, GCPtrWhere);
 }
@@ -4747 +4751 @@
 
 /** \#MF(0) - 10.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseMathFault(PIEMCPU pIemCpu)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_MF, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseMathFault(PVMCPU pVCpu)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_MF, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }
 
 
 /** \#AC(0) - 11.  */
-DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseAlignmentCheckException(PIEMCPU pIemCpu)
-{
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_AC, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
+DECL_NO_INLINE(IEM_STATIC, VBOXSTRICTRC) iemRaiseAlignmentCheckException(PVMCPU pVCpu)
+{
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_AC, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }
 
@@ -4772 +4776 @@
 {
     NOREF(cbInstr);
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_DE, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_DE, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }
 
@@ -4788 +4792 @@
 {
     NOREF(cbInstr);
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_UD, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_UD, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }
 
@@ -4804 +4808 @@
 {
     NOREF(cbInstr);
-    return iemRaiseXcptOrInt(pIemCpu, 0, X86_XCPT_UD, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
+    return iemRaiseXcptOrInt(pVCpu, 0, X86_XCPT_UD, IEM_XCPT_FLAGS_T_CPU_XCPT, 0, 0);
 }
 
@@ -4822 +4826 @@
  * Recalculates the effective operand size.
  *
- * @param   pIemCpu             The IEM state.
- */
-IEM_STATIC void iemRecalEffOpSize(PIEMCPU pIemCpu)
-{
-    switch (pIemCpu->enmCpuMode)
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemRecalEffOpSize(PVMCPU pVCpu)
+{
+    switch (pVCpu->iem.s.enmCpuMode)
     {
         case IEMMODE_16BIT:
-            pIemCpu->enmEffOpSize = pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP ? IEMMODE_32BIT : IEMMODE_16BIT;
+            pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP ? IEMMODE_32BIT : IEMMODE_16BIT;
             break;
         case IEMMODE_32BIT:
-            pIemCpu->enmEffOpSize = pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP ? IEMMODE_16BIT : IEMMODE_32BIT;
+            pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP ? IEMMODE_16BIT : IEMMODE_32BIT;
             break;
         case IEMMODE_64BIT:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_REX_W | IEM_OP_PRF_SIZE_OP))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_REX_W | IEM_OP_PRF_SIZE_OP))
             {
                 case 0:
-                    pIemCpu->enmEffOpSize = pIemCpu->enmDefOpSize;
+                    pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.enmDefOpSize;
                     break;
                 case IEM_OP_PRF_SIZE_OP:
-                    pIemCpu->enmEffOpSize = IEMMODE_16BIT;
+                    pVCpu->iem.s.enmEffOpSize = IEMMODE_16BIT;
                     break;
                 case IEM_OP_PRF_SIZE_REX_W:
                 case IEM_OP_PRF_SIZE_REX_W | IEM_OP_PRF_SIZE_OP:
-                    pIemCpu->enmEffOpSize = IEMMODE_64BIT;
+                    pVCpu->iem.s.enmEffOpSize = IEMMODE_64BIT;
                     break;
             }
@@ -4859 +4863 @@
  * operand size.
  *
- * @param   pIemCpu             The IEM state.
- */
-IEM_STATIC void iemRecalEffOpSize64Default(PIEMCPU pIemCpu)
-{
-    Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT);
-    pIemCpu->enmDefOpSize = IEMMODE_64BIT;
-    if ((pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_REX_W | IEM_OP_PRF_SIZE_OP)) != IEM_OP_PRF_SIZE_OP)
-        pIemCpu->enmEffOpSize = IEMMODE_64BIT;
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemRecalEffOpSize64Default(PVMCPU pVCpu)
+{
+    Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT);
+    pVCpu->iem.s.enmDefOpSize = IEMMODE_64BIT;
+    if ((pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_REX_W | IEM_OP_PRF_SIZE_OP)) != IEM_OP_PRF_SIZE_OP)
+        pVCpu->iem.s.enmEffOpSize = IEMMODE_64BIT;
     else
-        pIemCpu->enmEffOpSize = IEMMODE_16BIT;
+        pVCpu->iem.s.enmEffOpSize = IEMMODE_16BIT;
 }
 
@@ -4883 +4887 @@
 /**
  * Used to add extra details about a stub case.
- * @param   pIemCpu     The IEM per CPU state.
- */
-IEM_STATIC void iemOpStubMsg2(PIEMCPU pIemCpu)
+ * @param   pVCpu       The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemOpStubMsg2(PVMCPU pVCpu)
 {
 #if defined(LOG_ENABLED) && defined(IN_RING3)
-    PVM     pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU  pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
+    PVM  pVM = pVCpu->CTX_SUFF(pVM);
     char szRegs[4096];
     DBGFR3RegPrintf(pVM->pUVM, pVCpu->idCpu, &szRegs[0], sizeof(szRegs),
@@ -4925 +4928 @@
     RTAssertMsg2Weak("%s%s\n", szRegs, szInstr);
 #else
-    RTAssertMsg2Weak("cs:rip=%04x:%RX64\n", pIemCpu->CTX_SUFF(pCtx)->cs, pIemCpu->CTX_SUFF(pCtx)->rip);
+    RTAssertMsg2Weak("cs:rip=%04x:%RX64\n", pVCpu->iem.s.CTX_SUFF(pCtx)->cs, pVCpu->iem.s.CTX_SUFF(pCtx)->rip);
 #endif
 }
@@ -4939 +4942 @@
     do { \
         RTAssertMsg1(NULL, __LINE__, __FILE__, __FUNCTION__); \
-        iemOpStubMsg2(pIemCpu); \
+        iemOpStubMsg2(pVCpu); \
         RTAssertPanic(); \
     } while (0)
@@ -4994 +4997 @@
  *
  * @returns Hidden register reference.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The segment register.
  */
-IEM_STATIC PCPUMSELREG iemSRegGetHid(PIEMCPU pIemCpu, uint8_t iSegReg)
-{
-    PCPUMCTX    pCtx = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC PCPUMSELREG iemSRegGetHid(PVMCPU pVCpu, uint8_t iSegReg)
+{
+    PCPUMCTX    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     Assert(iSegReg < X86_SREG_COUNT);
@@ -5010 +5013 @@
 
 #ifdef VBOX_WITH_RAW_MODE_NOT_R0
-    if (RT_LIKELY(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg)))
+    if (RT_LIKELY(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg)))
     { /* likely */ }
     else
-        CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
+        CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
 #else
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
 #endif
     return pSReg;
@@ -5025 +5028 @@
  *
  * @returns Hidden register reference.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pSReg               The segment register.
  */
-IEM_STATIC PCPUMSELREG iemSRegUpdateHid(PIEMCPU pIemCpu, PCPUMSELREG pSReg)
+IEM_STATIC PCPUMSELREG iemSRegUpdateHid(PVMCPU pVCpu, PCPUMSELREG pSReg)
 {
 #ifdef VBOX_WITH_RAW_MODE_NOT_R0
-    if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
-        CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
+    if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
+        CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
 #else
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
-    NOREF(pIemCpu);
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
+    NOREF(pVCpu);
 #endif
     return pSReg;
@@ -5046 +5049 @@
  *
  * @returns Pointer to the selector variable.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The segment register.
  */
-IEM_STATIC uint16_t *iemSRegRef(PIEMCPU pIemCpu, uint8_t iSegReg)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC uint16_t *iemSRegRef(PVMCPU pVCpu, uint8_t iSegReg)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     switch (iSegReg)
     {
@@ -5069 +5072 @@
  *
  * @returns The selector value.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The segment register.
  */
-IEM_STATIC uint16_t iemSRegFetchU16(PIEMCPU pIemCpu, uint8_t iSegReg)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC uint16_t iemSRegFetchU16(PVMCPU pVCpu, uint8_t iSegReg)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     switch (iSegReg)
     {
@@ -5092 +5095 @@
  *
  * @returns Register reference.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iReg                The general register.
  */
-IEM_STATIC void *iemGRegRef(PIEMCPU pIemCpu, uint8_t iReg)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void *iemGRegRef(PVMCPU pVCpu, uint8_t iReg)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     switch (iReg)
     {
@@ -5127 +5130 @@
  *
  * @returns Register reference.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iReg                The register.
  */
-IEM_STATIC uint8_t *iemGRegRefU8(PIEMCPU pIemCpu, uint8_t iReg)
-{
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REX)
-        return (uint8_t *)iemGRegRef(pIemCpu, iReg);
-
-    uint8_t *pu8Reg = (uint8_t *)iemGRegRef(pIemCpu, iReg & 3);
+IEM_STATIC uint8_t *iemGRegRefU8(PVMCPU pVCpu, uint8_t iReg)
+{
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REX)
+        return (uint8_t *)iemGRegRef(pVCpu, iReg);
+
+    uint8_t *pu8Reg = (uint8_t *)iemGRegRef(pVCpu, iReg & 3);
     if (iReg >= 4)
         pu8Reg++;
@@ -5146 +5149 @@
  *
  * @returns The register value.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iReg                The register.
  */
-IEM_STATIC uint8_t iemGRegFetchU8(PIEMCPU pIemCpu, uint8_t iReg)
-{
-    uint8_t const *pbSrc = iemGRegRefU8(pIemCpu, iReg);
+IEM_STATIC uint8_t iemGRegFetchU8(PVMCPU pVCpu, uint8_t iReg)
+{
+    uint8_t const *pbSrc = iemGRegRefU8(pVCpu, iReg);
     return *pbSrc;
 }
@@ -5160 +5163 @@
  *
  * @returns The register value.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iReg                The register.
  */
-IEM_STATIC uint16_t iemGRegFetchU16(PIEMCPU pIemCpu, uint8_t iReg)
-{
-    return *(uint16_t *)iemGRegRef(pIemCpu, iReg);
+IEM_STATIC uint16_t iemGRegFetchU16(PVMCPU pVCpu, uint8_t iReg)
+{
+    return *(uint16_t *)iemGRegRef(pVCpu, iReg);
 }
 
@@ -5173 +5176 @@
  *
  * @returns The register value.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iReg                The register.
  */
-IEM_STATIC uint32_t iemGRegFetchU32(PIEMCPU pIemCpu, uint8_t iReg)
-{
-    return *(uint32_t *)iemGRegRef(pIemCpu, iReg);
+IEM_STATIC uint32_t iemGRegFetchU32(PVMCPU pVCpu, uint8_t iReg)
+{
+    return *(uint32_t *)iemGRegRef(pVCpu, iReg);
 }
 
@@ -5186 +5189 @@
  *
  * @returns The register value.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iReg                The register.
  */
-IEM_STATIC uint64_t iemGRegFetchU64(PIEMCPU pIemCpu, uint8_t iReg)
-{
-    return *(uint64_t *)iemGRegRef(pIemCpu, iReg);
+IEM_STATIC uint64_t iemGRegFetchU64(PVMCPU pVCpu, uint8_t iReg)
+{
+    return *(uint64_t *)iemGRegRef(pVCpu, iReg);
 }
 
@@ -5201 +5204 @@
  * segment limit.
  *
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   offNextInstr        The offset of the next instruction.
  */
-IEM_STATIC VBOXSTRICTRC iemRegRipRelativeJumpS8(PIEMCPU pIemCpu, int8_t offNextInstr)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-    switch (pIemCpu->enmEffOpSize)
+IEM_STATIC VBOXSTRICTRC iemRegRipRelativeJumpS8(PVMCPU pVCpu, int8_t offNextInstr)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
         {
-            uint16_t uNewIp = pCtx->ip + offNextInstr + pIemCpu->offOpcode;
+            uint16_t uNewIp = pCtx->ip + offNextInstr + pVCpu->iem.s.offOpcode;
             if (   uNewIp > pCtx->cs.u32Limit
-                && pIemCpu->enmCpuMode != IEMMODE_64BIT) /* no need to check for non-canonical. */
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                && pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT) /* no need to check for non-canonical. */
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             pCtx->rip = uNewIp;
             break;
@@ -5222 +5225 @@
         {
             Assert(pCtx->rip <= UINT32_MAX);
-            Assert(pIemCpu->enmCpuMode != IEMMODE_64BIT);
-
-            uint32_t uNewEip = pCtx->eip + offNextInstr + pIemCpu->offOpcode;
+            Assert(pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT);
+
+            uint32_t uNewEip = pCtx->eip + offNextInstr + pVCpu->iem.s.offOpcode;
             if (uNewEip > pCtx->cs.u32Limit)
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             pCtx->rip = uNewEip;
             break;
@@ -5233 +5236 @@
         case IEMMODE_64BIT:
         {
-            Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT);
-
-            uint64_t uNewRip = pCtx->rip + offNextInstr + pIemCpu->offOpcode;
+            Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT);
+
+            uint64_t uNewRip = pCtx->rip + offNextInstr + pVCpu->iem.s.offOpcode;
             if (!IEM_IS_CANONICAL(uNewRip))
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             pCtx->rip = uNewRip;
             break;
@@ -5248 +5251 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -5261 +5264 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   offNextInstr        The offset of the next instruction.
  */
-IEM_STATIC VBOXSTRICTRC iemRegRipRelativeJumpS16(PIEMCPU pIemCpu, int16_t offNextInstr)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-    Assert(pIemCpu->enmEffOpSize == IEMMODE_16BIT);
-
-    uint16_t uNewIp = pCtx->ip + offNextInstr + pIemCpu->offOpcode;
+IEM_STATIC VBOXSTRICTRC iemRegRipRelativeJumpS16(PVMCPU pVCpu, int16_t offNextInstr)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    Assert(pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT);
+
+    uint16_t uNewIp = pCtx->ip + offNextInstr + pVCpu->iem.s.offOpcode;
     if (   uNewIp > pCtx->cs.u32Limit
-        && pIemCpu->enmCpuMode != IEMMODE_64BIT) /* no need to check for non-canonical. */
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        && pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT) /* no need to check for non-canonical. */
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     /** @todo Test 16-bit jump in 64-bit mode. possible?  */
     pCtx->rip = uNewIp;
@@ -5278 +5281 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -5291 +5294 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   offNextInstr        The offset of the next instruction.
  */
-IEM_STATIC VBOXSTRICTRC iemRegRipRelativeJumpS32(PIEMCPU pIemCpu, int32_t offNextInstr)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-    Assert(pIemCpu->enmEffOpSize != IEMMODE_16BIT);
-
-    if (pIemCpu->enmEffOpSize == IEMMODE_32BIT)
-    {
-        Assert(pCtx->rip <= UINT32_MAX); Assert(pIemCpu->enmCpuMode != IEMMODE_64BIT);
-
-        uint32_t uNewEip = pCtx->eip + offNextInstr + pIemCpu->offOpcode;
+IEM_STATIC VBOXSTRICTRC iemRegRipRelativeJumpS32(PVMCPU pVCpu, int32_t offNextInstr)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    Assert(pVCpu->iem.s.enmEffOpSize != IEMMODE_16BIT);
+
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_32BIT)
+    {
+        Assert(pCtx->rip <= UINT32_MAX); Assert(pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT);
+
+        uint32_t uNewEip = pCtx->eip + offNextInstr + pVCpu->iem.s.offOpcode;
         if (uNewEip > pCtx->cs.u32Limit)
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         pCtx->rip = uNewEip;
     }
     else
     {
-        Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT);
-
-        uint64_t uNewRip = pCtx->rip + offNextInstr + pIemCpu->offOpcode;
+        Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT);
+
+        uint64_t uNewRip = pCtx->rip + offNextInstr + pVCpu->iem.s.offOpcode;
         if (!IEM_IS_CANONICAL(uNewRip))
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         pCtx->rip = uNewRip;
     }
@@ -5320 +5323 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -5332 +5335 @@
  * segment limit.
  *
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   uNewRip             The new RIP value.
  */
-IEM_STATIC VBOXSTRICTRC iemRegRipJump(PIEMCPU pIemCpu, uint64_t uNewRip)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-    switch (pIemCpu->enmEffOpSize)
+IEM_STATIC VBOXSTRICTRC iemRegRipJump(PVMCPU pVCpu, uint64_t uNewRip)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -5344 +5347 @@
             Assert(uNewRip <= UINT16_MAX);
             if (   uNewRip > pCtx->cs.u32Limit
-                && pIemCpu->enmCpuMode != IEMMODE_64BIT) /* no need to check for non-canonical. */
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                && pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT) /* no need to check for non-canonical. */
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             /** @todo Test 16-bit jump in 64-bit mode.  */
             pCtx->rip = uNewRip;
@@ -5355 +5358 @@
             Assert(uNewRip <= UINT32_MAX);
             Assert(pCtx->rip <= UINT32_MAX);
-            Assert(pIemCpu->enmCpuMode != IEMMODE_64BIT);
+            Assert(pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT);
 
             if (uNewRip > pCtx->cs.u32Limit)
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             pCtx->rip = uNewRip;
             break;
@@ -5365 +5368 @@
         case IEMMODE_64BIT:
         {
-            Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT);
+            Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT);
 
             if (!IEM_IS_CANONICAL(uNewRip))
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             pCtx->rip = uNewRip;
             break;
@@ -5379 +5382 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -5388 +5391 @@
  * Get the address of the top of the stack.
  *
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                The CPU context which SP/ESP/RSP should be
  *                              read.
  */
-DECLINLINE(RTGCPTR) iemRegGetEffRsp(PCIEMCPU pIemCpu, PCCPUMCTX pCtx)
-{
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+DECLINLINE(RTGCPTR) iemRegGetEffRsp(PCVMCPU pVCpu, PCCPUMCTX pCtx)
+{
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         return pCtx->rsp;
     if (pCtx->ss.Attr.n.u1DefBig)
@@ -5407 +5410 @@
  * This function leaves the EFLAGS.RF flag alone.
  *
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   cbInstr             The number of bytes to add.
  */
-IEM_STATIC void iemRegAddToRipKeepRF(PIEMCPU pIemCpu, uint8_t cbInstr)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-    switch (pIemCpu->enmCpuMode)
+IEM_STATIC void iemRegAddToRipKeepRF(PVMCPU pVCpu, uint8_t cbInstr)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    switch (pVCpu->iem.s.enmCpuMode)
     {
         case IEMMODE_16BIT:
@@ -5438 +5441 @@
  * Updates the RIP/EIP/IP to point to the next instruction.
  *
- * @param   pIemCpu             The per CPU data.
- */
-IEM_STATIC void iemRegUpdateRipKeepRF(PIEMCPU pIemCpu)
-{
-    return iemRegAddToRipKeepRF(pIemCpu, pIemCpu->offOpcode);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemRegUpdateRipKeepRF(PVMCPU pVCpu)
+{
+    return iemRegAddToRipKeepRF(pVCpu, pVCpu->iem.s.offOpcode);
 }
 #endif
@@ -5451 +5454 @@
  * Updates the RIP/EIP/IP to point to the next instruction and clears EFLAGS.RF.
  *
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   cbInstr             The number of bytes to add.
  */
-IEM_STATIC void iemRegAddToRipAndClearRF(PIEMCPU pIemCpu, uint8_t cbInstr)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemRegAddToRipAndClearRF(PVMCPU pVCpu, uint8_t cbInstr)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     pCtx->eflags.Bits.u1RF = 0;
@@ -5463 +5466 @@
 #if ARCH_BITS >= 64
     static uint64_t const s_aRipMasks[] = { UINT64_C(0xffff), UINT64_C(0xffffffff), UINT64_MAX };
-    Assert(pCtx->rip <= s_aRipMasks[(unsigned)pIemCpu->enmCpuMode]);
-    pCtx->rip = (pCtx->rip + cbInstr) & s_aRipMasks[(unsigned)pIemCpu->enmCpuMode];
+    Assert(pCtx->rip <= s_aRipMasks[(unsigned)pVCpu->iem.s.enmCpuMode]);
+    pCtx->rip = (pCtx->rip + cbInstr) & s_aRipMasks[(unsigned)pVCpu->iem.s.enmCpuMode];
 #else
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         pCtx->rip += cbInstr;
     else
     {
         static uint32_t const s_aEipMasks[] = { UINT32_C(0xffff), UINT32_MAX };
-        pCtx->eip = (pCtx->eip + cbInstr) & s_aEipMasks[(unsigned)pIemCpu->enmCpuMode];
+        pCtx->eip = (pCtx->eip + cbInstr) & s_aEipMasks[(unsigned)pVCpu->iem.s.enmCpuMode];
     }
 #endif
@@ -5480 +5483 @@
  * Updates the RIP/EIP/IP to point to the next instruction and clears EFLAGS.RF.
  *
- * @param   pIemCpu             The per CPU data.
- */
-IEM_STATIC void iemRegUpdateRipAndClearRF(PIEMCPU pIemCpu)
-{
-    return iemRegAddToRipAndClearRF(pIemCpu, pIemCpu->offOpcode);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemRegUpdateRipAndClearRF(PVMCPU pVCpu)
+{
+    return iemRegAddToRipAndClearRF(pVCpu, pVCpu->iem.s.offOpcode);
 }
 
@@ -5491 +5494 @@
  * Adds to the stack pointer.
  *
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                The CPU context which SP/ESP/RSP should be
  *                              updated.
  * @param   cbToAdd             The number of bytes to add (8-bit!).
  */
-DECLINLINE(void) iemRegAddToRsp(PCIEMCPU pIemCpu, PCPUMCTX pCtx, uint8_t cbToAdd)
-{
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+DECLINLINE(void) iemRegAddToRsp(PCVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbToAdd)
+{
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         pCtx->rsp += cbToAdd;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -5510 +5513 @@
  * Subtracts from the stack pointer.
  *
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                The CPU context which SP/ESP/RSP should be
  *                              updated.
  * @param   cbToSub             The number of bytes to subtract (8-bit!).
  */
-DECLINLINE(void) iemRegSubFromRsp(PCIEMCPU pIemCpu, PCPUMCTX pCtx, uint8_t cbToSub)
-{
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+DECLINLINE(void) iemRegSubFromRsp(PCVMCPU pVCpu, PCPUMCTX pCtx, uint8_t cbToSub)
+{
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         pCtx->rsp -= cbToSub;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -5529 +5532 @@
  * Adds to the temporary stack pointer.
  *
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pTmpRsp             The temporary SP/ESP/RSP to update.
  * @param   cbToAdd             The number of bytes to add (16-bit).
  * @param   pCtx                Where to get the current stack mode.
  */
-DECLINLINE(void) iemRegAddToRspEx(PCIEMCPU pIemCpu, PCCPUMCTX pCtx, PRTUINT64U pTmpRsp, uint16_t cbToAdd)
-{
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+DECLINLINE(void) iemRegAddToRspEx(PCVMCPU pVCpu, PCCPUMCTX pCtx, PRTUINT64U pTmpRsp, uint16_t cbToAdd)
+{
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         pTmpRsp->u           += cbToAdd;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -5548 +5551 @@
  * Subtracts from the temporary stack pointer.
  *
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pTmpRsp             The temporary SP/ESP/RSP to update.
  * @param   cbToSub             The number of bytes to subtract.
@@ -5555 +5558 @@
  *          expecting that.
  */
-DECLINLINE(void) iemRegSubFromRspEx(PCIEMCPU pIemCpu, PCCPUMCTX pCtx, PRTUINT64U pTmpRsp, uint16_t cbToSub)
-{
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+DECLINLINE(void) iemRegSubFromRspEx(PCVMCPU pVCpu, PCCPUMCTX pCtx, PRTUINT64U pTmpRsp, uint16_t cbToSub)
+{
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         pTmpRsp->u          -= cbToSub;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -5571 +5574 @@
  *
  * @returns Effective stack addressf for the push.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                Where to get the current stack mode.
  * @param   cbItem              The size of the stack item to pop.
  * @param   puNewRsp            Where to return the new RSP value.
  */
-DECLINLINE(RTGCPTR) iemRegGetRspForPush(PCIEMCPU pIemCpu, PCCPUMCTX pCtx, uint8_t cbItem, uint64_t *puNewRsp)
+DECLINLINE(RTGCPTR) iemRegGetRspForPush(PCVMCPU pVCpu, PCCPUMCTX pCtx, uint8_t cbItem, uint64_t *puNewRsp)
 {
     RTUINT64U   uTmpRsp;
@@ -5582 +5585 @@
     uTmpRsp.u = pCtx->rsp;
 
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         GCPtrTop = uTmpRsp.u            -= cbItem;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -5598 +5601 @@
  *
  * @returns Current stack pointer.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                Where to get the current stack mode.
  * @param   cbItem              The size of the stack item to pop.
  * @param   puNewRsp            Where to return the new RSP value.
  */
-DECLINLINE(RTGCPTR) iemRegGetRspForPop(PCIEMCPU pIemCpu, PCCPUMCTX pCtx, uint8_t cbItem, uint64_t *puNewRsp)
+DECLINLINE(RTGCPTR) iemRegGetRspForPop(PCVMCPU pVCpu, PCCPUMCTX pCtx, uint8_t cbItem, uint64_t *puNewRsp)
 {
     RTUINT64U   uTmpRsp;
@@ -5609 +5612 @@
     uTmpRsp.u = pCtx->rsp;
 
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         GCPtrTop = uTmpRsp.u;
@@ -5634 +5637 @@
  *
  * @returns Effective stack addressf for the push.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                Where to get the current stack mode.
  * @param   pTmpRsp             The temporary stack pointer.  This is updated.
  * @param   cbItem              The size of the stack item to pop.
  */
-DECLINLINE(RTGCPTR) iemRegGetRspForPushEx(PCIEMCPU pIemCpu, PCCPUMCTX pCtx, PRTUINT64U pTmpRsp, uint8_t cbItem)
+DECLINLINE(RTGCPTR) iemRegGetRspForPushEx(PCVMCPU pVCpu, PCCPUMCTX pCtx, PRTUINT64U pTmpRsp, uint8_t cbItem)
 {
     RTGCPTR GCPtrTop;
 
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         GCPtrTop = pTmpRsp->u          -= cbItem;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -5658 +5661 @@
  *
  * @returns Current stack pointer.
- * @param   pIemCpu             The per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                Where to get the current stack mode.
  * @param   pTmpRsp             The temporary stack pointer.  This is updated.
  * @param   cbItem              The size of the stack item to pop.
  */
-DECLINLINE(RTGCPTR) iemRegGetRspForPopEx(PCIEMCPU pIemCpu, PCCPUMCTX pCtx, PRTUINT64U pTmpRsp, uint8_t cbItem)
+DECLINLINE(RTGCPTR) iemRegGetRspForPopEx(PCVMCPU pVCpu, PCCPUMCTX pCtx, PRTUINT64U pTmpRsp, uint8_t cbItem)
 {
     RTGCPTR GCPtrTop;
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         GCPtrTop = pTmpRsp->u;
@@ -5698 +5701 @@
  * This is necessary in ring-0 and raw-mode context (nop in ring-3).
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-DECLINLINE(void) iemFpuPrepareUsage(PIEMCPU pIemCpu)
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(void) iemFpuPrepareUsage(PVMCPU pVCpu)
 {
 #ifdef IN_RING3
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
 #else
-    CPUMRZFpuStatePrepareHostCpuForUse(IEMCPU_TO_VMCPU(pIemCpu));
+    CPUMRZFpuStatePrepareHostCpuForUse(pVCpu);
 #endif
 }
@@ -5715 +5718 @@
  * This is necessary in ring-0 and raw-mode context (nop in ring-3).
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-DECLINLINE(void) iemFpuPrepareUsageSse(PIEMCPU pIemCpu)
-{
-    iemFpuPrepareUsage(pIemCpu);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(void) iemFpuPrepareUsageSse(PVMCPU pVCpu)
+{
+    iemFpuPrepareUsage(pVCpu);
 }
 
@@ -5728 +5731 @@
  * This is necessary in ring-0 and raw-mode context (nop in ring-3).
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-DECLINLINE(void) iemFpuActualizeStateForRead(PIEMCPU pIemCpu)
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(void) iemFpuActualizeStateForRead(PVMCPU pVCpu)
 {
 #ifdef IN_RING3
-    NOREF(pIemCpu);
+    NOREF(pVCpu);
 #else
-    CPUMRZFpuStateActualizeForRead(IEMCPU_TO_VMCPU(pIemCpu));
+    CPUMRZFpuStateActualizeForRead(pVCpu);
 #endif
 }
@@ -5745 +5748 @@
  * This is necessary in ring-0 and raw-mode context (nop in ring-3).
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-DECLINLINE(void) iemFpuActualizeStateForChange(PIEMCPU pIemCpu)
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(void) iemFpuActualizeStateForChange(PVMCPU pVCpu)
 {
 #ifdef IN_RING3
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
 #else
-    CPUMRZFpuStateActualizeForChange(IEMCPU_TO_VMCPU(pIemCpu));
+    CPUMRZFpuStateActualizeForChange(pVCpu);
 #endif
 }
@@ -5762 +5765 @@
  * This is necessary in ring-0 and raw-mode context (nop in ring-3).
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-DECLINLINE(void) iemFpuActualizeSseStateForRead(PIEMCPU pIemCpu)
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(void) iemFpuActualizeSseStateForRead(PVMCPU pVCpu)
 {
 #if defined(IN_RING3) || defined(VBOX_WITH_KERNEL_USING_XMM)
-    NOREF(pIemCpu);
+    NOREF(pVCpu);
 #else
-    CPUMRZFpuStateActualizeSseForRead(IEMCPU_TO_VMCPU(pIemCpu));
+    CPUMRZFpuStateActualizeSseForRead(pVCpu);
 #endif
 }
@@ -5779 +5782 @@
  * This is necessary in ring-0 and raw-mode context (nop in ring-3).
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-DECLINLINE(void) iemFpuActualizeSseStateForChange(PIEMCPU pIemCpu)
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(void) iemFpuActualizeSseStateForChange(PVMCPU pVCpu)
 {
 #if defined(IN_RING3) || defined(VBOX_WITH_KERNEL_USING_XMM)
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
 #else
-    CPUMRZFpuStateActualizeForChange(IEMCPU_TO_VMCPU(pIemCpu));
+    CPUMRZFpuStateActualizeForChange(pVCpu);
 #endif
 }
@@ -5807 +5810 @@
  * Updates the FOP, FPU.CS and FPUIP registers.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                The CPU context.
  * @param   pFpuCtx             The FPU context.
  */
-DECLINLINE(void) iemFpuUpdateOpcodeAndIpWorker(PIEMCPU pIemCpu, PCPUMCTX pCtx, PX86FXSTATE pFpuCtx)
-{
-    pFpuCtx->FOP       = pIemCpu->abOpcode[pIemCpu->offFpuOpcode]
-                       | ((uint16_t)(pIemCpu->abOpcode[pIemCpu->offFpuOpcode - 1] & 0x7) << 8);
+DECLINLINE(void) iemFpuUpdateOpcodeAndIpWorker(PVMCPU pVCpu, PCPUMCTX pCtx, PX86FXSTATE pFpuCtx)
+{
+    pFpuCtx->FOP       = pVCpu->iem.s.abOpcode[pVCpu->iem.s.offFpuOpcode]
+                       | ((uint16_t)(pVCpu->iem.s.abOpcode[pVCpu->iem.s.offFpuOpcode - 1] & 0x7) << 8);
     /** @todo x87.CS and FPUIP needs to be kept seperately. */
-    if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+    if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
     {
         /** @todo Testcase: making assumptions about how FPUIP and FPUDP are handled
@@ -5834 +5837 @@
  * Updates the x87.DS and FPUDP registers.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                The CPU context.
  * @param   pFpuCtx             The FPU context.
@@ -5840 +5843 @@
  * @param   GCPtrEff            The effective address relative to @a iEffSeg.
  */
-DECLINLINE(void) iemFpuUpdateDP(PIEMCPU pIemCpu, PCPUMCTX pCtx, PX86FXSTATE pFpuCtx, uint8_t iEffSeg, RTGCPTR GCPtrEff)
+DECLINLINE(void) iemFpuUpdateDP(PVMCPU pVCpu, PCPUMCTX pCtx, PX86FXSTATE pFpuCtx, uint8_t iEffSeg, RTGCPTR GCPtrEff)
 {
     RTSEL sel;
@@ -5856 +5859 @@
     }
     /** @todo pFpuCtx->DS and FPUDP needs to be kept seperately. */
-    if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+    if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
     {
         pFpuCtx->DS    = 0;
@@ -5915 +5918 @@
  * exception prevents it.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pResult             The FPU operation result to push.
  * @param   pFpuCtx             The FPU context.
  */
-IEM_STATIC void iemFpuMaybePushResult(PIEMCPU pIemCpu, PIEMFPURESULT pResult, PX86FXSTATE pFpuCtx)
+IEM_STATIC void iemFpuMaybePushResult(PVMCPU pVCpu, PIEMFPURESULT pResult, PX86FXSTATE pFpuCtx)
 {
     /* Update FSW and bail if there are pending exceptions afterwards. */
@@ -6023 +6026 @@
  * Pushes a FPU result onto the FPU stack if no pending exception prevents it.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pResult             The FPU operation result to push.
  */
-IEM_STATIC void iemFpuPushResult(PIEMCPU pIemCpu, PIEMFPURESULT pResult)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuPushResult(PVMCPU pVCpu, PIEMFPURESULT pResult)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
-    iemFpuMaybePushResult(pIemCpu, pResult, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
+    iemFpuMaybePushResult(pVCpu, pResult, pFpuCtx);
 }
 
@@ -6039 +6042 @@
  * and sets FPUDP and FPUDS.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pResult             The FPU operation result to push.
  * @param   iEffSeg             The effective segment register.
  * @param   GCPtrEff            The effective address relative to @a iEffSeg.
  */
-IEM_STATIC void iemFpuPushResultWithMemOp(PIEMCPU pIemCpu, PIEMFPURESULT pResult, uint8_t iEffSeg, RTGCPTR GCPtrEff)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuPushResultWithMemOp(PVMCPU pVCpu, PIEMFPURESULT pResult, uint8_t iEffSeg, RTGCPTR GCPtrEff)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateDP(pIemCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
-    iemFpuMaybePushResult(pIemCpu, pResult, pFpuCtx);
+    iemFpuUpdateDP(pVCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
+    iemFpuMaybePushResult(pVCpu, pResult, pFpuCtx);
 }
 
@@ -6058 +6061 @@
  * unless a pending exception prevents it.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pResult             The FPU operation result to store and push.
  */
-IEM_STATIC void iemFpuPushResultTwo(PIEMCPU pIemCpu, PIEMFPURESULTTWO pResult)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuPushResultTwo(PVMCPU pVCpu, PIEMFPURESULTTWO pResult)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
 
     /* Update FSW and bail if there are pending exceptions afterwards. */
@@ -6112 +6115 @@
  * FOP.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pResult             The result to store.
  * @param   iStReg              Which FPU register to store it in.
  */
-IEM_STATIC void iemFpuStoreResult(PIEMCPU pIemCpu, PIEMFPURESULT pResult, uint8_t iStReg)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuStoreResult(PVMCPU pVCpu, PIEMFPURESULT pResult, uint8_t iStReg)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuStoreResultOnly(pFpuCtx, pResult, iStReg);
 }
@@ -6129 +6132 @@
  * FOP, and then pops the stack.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pResult             The result to store.
  * @param   iStReg              Which FPU register to store it in.
  */
-IEM_STATIC void iemFpuStoreResultThenPop(PIEMCPU pIemCpu, PIEMFPURESULT pResult, uint8_t iStReg)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuStoreResultThenPop(PVMCPU pVCpu, PIEMFPURESULT pResult, uint8_t iStReg)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuStoreResultOnly(pFpuCtx, pResult, iStReg);
     iemFpuMaybePopOne(pFpuCtx);
@@ -6147 +6150 @@
  * FPUDP, and FPUDS.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pResult             The result to store.
  * @param   iStReg              Which FPU register to store it in.
@@ -6153 +6156 @@
  * @param   GCPtrEff            The effective memory operand offset.
  */
-IEM_STATIC void iemFpuStoreResultWithMemOp(PIEMCPU pIemCpu, PIEMFPURESULT pResult, uint8_t iStReg,
+IEM_STATIC void iemFpuStoreResultWithMemOp(PVMCPU pVCpu, PIEMFPURESULT pResult, uint8_t iStReg,
                                            uint8_t iEffSeg, RTGCPTR GCPtrEff)
 {
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateDP(pIemCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateDP(pVCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuStoreResultOnly(pFpuCtx, pResult, iStReg);
 }
@@ -6168 +6171 @@
  * FPUDP, and FPUDS, and then pops the stack.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pResult             The result to store.
  * @param   iStReg              Which FPU register to store it in.
@@ -6174 +6177 @@
  * @param   GCPtrEff            The effective memory operand offset.
  */
-IEM_STATIC void iemFpuStoreResultWithMemOpThenPop(PIEMCPU pIemCpu, PIEMFPURESULT pResult,
+IEM_STATIC void iemFpuStoreResultWithMemOpThenPop(PVMCPU pVCpu, PIEMFPURESULT pResult,
                                                   uint8_t iStReg, uint8_t iEffSeg, RTGCPTR GCPtrEff)
 {
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateDP(pIemCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateDP(pVCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuStoreResultOnly(pFpuCtx, pResult, iStReg);
     iemFpuMaybePopOne(pFpuCtx);
@@ -6189 +6192 @@
  * Updates the FOP, FPUIP, and FPUCS.  For FNOP.
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-IEM_STATIC void iemFpuUpdateOpcodeAndIp(PIEMCPU pIemCpu)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemFpuUpdateOpcodeAndIp(PVMCPU pVCpu)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
 }
 
@@ -6202 +6205 @@
  * Marks the specified stack register as free (for FFREE).
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iStReg              The register to free.
  */
-IEM_STATIC void iemFpuStackFree(PIEMCPU pIemCpu, uint8_t iStReg)
+IEM_STATIC void iemFpuStackFree(PVMCPU pVCpu, uint8_t iStReg)
 {
     Assert(iStReg < 8);
-    PX86FXSTATE pFpuCtx = &pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
+    PX86FXSTATE pFpuCtx = &pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
     uint8_t     iReg    = (X86_FSW_TOP_GET(pFpuCtx->FSW) + iStReg) & X86_FSW_TOP_SMASK;
     pFpuCtx->FTW &= ~RT_BIT(iReg);
@@ -6217 +6220 @@
  * Increments FSW.TOP, i.e. pops an item off the stack without freeing it.
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-IEM_STATIC void iemFpuStackIncTop(PIEMCPU pIemCpu)
-{
-    PX86FXSTATE pFpuCtx = &pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemFpuStackIncTop(PVMCPU pVCpu)
+{
+    PX86FXSTATE pFpuCtx = &pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
     uint16_t    uFsw    = pFpuCtx->FSW;
     uint16_t    uTop    = uFsw & X86_FSW_TOP_MASK;
@@ -6234 +6237 @@
  * Decrements FSW.TOP, i.e. push an item off the stack without storing anything.
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-IEM_STATIC void iemFpuStackDecTop(PIEMCPU pIemCpu)
-{
-    PX86FXSTATE pFpuCtx = &pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemFpuStackDecTop(PVMCPU pVCpu)
+{
+    PX86FXSTATE pFpuCtx = &pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
     uint16_t    uFsw    = pFpuCtx->FSW;
     uint16_t    uTop    = uFsw & X86_FSW_TOP_MASK;
@@ -6251 +6254 @@
  * Updates the FSW, FOP, FPUIP, and FPUCS.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u16FSW              The FSW from the current instruction.
  */
-IEM_STATIC void iemFpuUpdateFSW(PIEMCPU pIemCpu, uint16_t u16FSW)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuUpdateFSW(PVMCPU pVCpu, uint16_t u16FSW)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuUpdateFSWOnly(pFpuCtx, u16FSW);
 }
@@ -6266 +6269 @@
  * Updates the FSW, FOP, FPUIP, and FPUCS, then pops the stack.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u16FSW              The FSW from the current instruction.
  */
-IEM_STATIC void iemFpuUpdateFSWThenPop(PIEMCPU pIemCpu, uint16_t u16FSW)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuUpdateFSWThenPop(PVMCPU pVCpu, uint16_t u16FSW)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuUpdateFSWOnly(pFpuCtx, u16FSW);
     iemFpuMaybePopOne(pFpuCtx);
@@ -6282 +6285 @@
  * Updates the FSW, FOP, FPUIP, FPUCS, FPUDP, and FPUDS.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u16FSW              The FSW from the current instruction.
  * @param   iEffSeg             The effective memory operand selector register.
  * @param   GCPtrEff            The effective memory operand offset.
  */
-IEM_STATIC void iemFpuUpdateFSWWithMemOp(PIEMCPU pIemCpu, uint16_t u16FSW, uint8_t iEffSeg, RTGCPTR GCPtrEff)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuUpdateFSWWithMemOp(PVMCPU pVCpu, uint16_t u16FSW, uint8_t iEffSeg, RTGCPTR GCPtrEff)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateDP(pIemCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateDP(pVCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuUpdateFSWOnly(pFpuCtx, u16FSW);
 }
@@ -6300 +6303 @@
  * Updates the FSW, FOP, FPUIP, and FPUCS, then pops the stack twice.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u16FSW              The FSW from the current instruction.
  */
-IEM_STATIC void iemFpuUpdateFSWThenPopPop(PIEMCPU pIemCpu, uint16_t u16FSW)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuUpdateFSWThenPopPop(PVMCPU pVCpu, uint16_t u16FSW)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuUpdateFSWOnly(pFpuCtx, u16FSW);
     iemFpuMaybePopOne(pFpuCtx);
@@ -6317 +6320 @@
  * Updates the FSW, FOP, FPUIP, FPUCS, FPUDP, and FPUDS, then pops the stack.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u16FSW              The FSW from the current instruction.
  * @param   iEffSeg             The effective memory operand selector register.
  * @param   GCPtrEff            The effective memory operand offset.
  */
-IEM_STATIC void iemFpuUpdateFSWWithMemOpThenPop(PIEMCPU pIemCpu, uint16_t u16FSW, uint8_t iEffSeg, RTGCPTR GCPtrEff)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemFpuUpdateFSWWithMemOpThenPop(PVMCPU pVCpu, uint16_t u16FSW, uint8_t iEffSeg, RTGCPTR GCPtrEff)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateDP(pIemCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateDP(pVCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuUpdateFSWOnly(pFpuCtx, u16FSW);
     iemFpuMaybePopOne(pFpuCtx);
@@ -6336 +6339 @@
  * Worker routine for raising an FPU stack underflow exception.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pFpuCtx             The FPU context.
  * @param   iStReg              The stack register being accessed.
  */
-IEM_STATIC void iemFpuStackUnderflowOnly(PIEMCPU pIemCpu, PX86FXSTATE pFpuCtx, uint8_t iStReg)
+IEM_STATIC void iemFpuStackUnderflowOnly(PVMCPU pVCpu, PX86FXSTATE pFpuCtx, uint8_t iStReg)
 {
     Assert(iStReg < 8 || iStReg == UINT8_MAX);
@@ -6366 +6369 @@
  * Raises a FPU stack underflow exception.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iStReg              The destination register that should be loaded
  *                              with QNaN if \#IS is not masked. Specify
  *                              UINT8_MAX if none (like for fcom).
  */
-DECL_NO_INLINE(IEM_STATIC, void) iemFpuStackUnderflow(PIEMCPU pIemCpu, uint8_t iStReg)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+DECL_NO_INLINE(IEM_STATIC, void) iemFpuStackUnderflow(PVMCPU pVCpu, uint8_t iStReg)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
-    iemFpuStackUnderflowOnly(pIemCpu, pFpuCtx, iStReg);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
+    iemFpuStackUnderflowOnly(pVCpu, pFpuCtx, iStReg);
 }
 
 
 DECL_NO_INLINE(IEM_STATIC, void)
-iemFpuStackUnderflowWithMemOp(PIEMCPU pIemCpu, uint8_t iStReg, uint8_t iEffSeg, RTGCPTR GCPtrEff)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+iemFpuStackUnderflowWithMemOp(PVMCPU pVCpu, uint8_t iStReg, uint8_t iEffSeg, RTGCPTR GCPtrEff)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateDP(pIemCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
-    iemFpuStackUnderflowOnly(pIemCpu, pFpuCtx, iStReg);
-}
-
-
-DECL_NO_INLINE(IEM_STATIC, void) iemFpuStackUnderflowThenPop(PIEMCPU pIemCpu, uint8_t iStReg)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+    iemFpuUpdateDP(pVCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
+    iemFpuStackUnderflowOnly(pVCpu, pFpuCtx, iStReg);
+}
+
+
+DECL_NO_INLINE(IEM_STATIC, void) iemFpuStackUnderflowThenPop(PVMCPU pVCpu, uint8_t iStReg)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
-    iemFpuStackUnderflowOnly(pIemCpu, pFpuCtx, iStReg);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
+    iemFpuStackUnderflowOnly(pVCpu, pFpuCtx, iStReg);
     iemFpuMaybePopOne(pFpuCtx);
 }
@@ -6402 +6405 @@
 
 DECL_NO_INLINE(IEM_STATIC, void)
-iemFpuStackUnderflowWithMemOpThenPop(PIEMCPU pIemCpu, uint8_t iStReg, uint8_t iEffSeg, RTGCPTR GCPtrEff)
-{
-    PCPUMCTX    pCtx      = pIemCpu->CTX_SUFF(pCtx);
+iemFpuStackUnderflowWithMemOpThenPop(PVMCPU pVCpu, uint8_t iStReg, uint8_t iEffSeg, RTGCPTR GCPtrEff)
+{
+    PCPUMCTX    pCtx      = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateDP(pIemCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
-    iemFpuStackUnderflowOnly(pIemCpu, pFpuCtx, iStReg);
+    iemFpuUpdateDP(pVCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
+    iemFpuStackUnderflowOnly(pVCpu, pFpuCtx, iStReg);
     iemFpuMaybePopOne(pFpuCtx);
 }
 
 
-DECL_NO_INLINE(IEM_STATIC, void) iemFpuStackUnderflowThenPopPop(PIEMCPU pIemCpu)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+DECL_NO_INLINE(IEM_STATIC, void) iemFpuStackUnderflowThenPopPop(PVMCPU pVCpu)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
-    iemFpuStackUnderflowOnly(pIemCpu, pFpuCtx, UINT8_MAX);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
+    iemFpuStackUnderflowOnly(pVCpu, pFpuCtx, UINT8_MAX);
     iemFpuMaybePopOne(pFpuCtx);
     iemFpuMaybePopOne(pFpuCtx);
@@ -6425 +6428 @@
 
 DECL_NO_INLINE(IEM_STATIC, void)
-iemFpuStackPushUnderflow(PIEMCPU pIemCpu)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+iemFpuStackPushUnderflow(PVMCPU pVCpu)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
 
     if (pFpuCtx->FCW & X86_FCW_IM)
@@ -6452 +6455 @@
 
 DECL_NO_INLINE(IEM_STATIC, void)
-iemFpuStackPushUnderflowTwo(PIEMCPU pIemCpu)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+iemFpuStackPushUnderflowTwo(PVMCPU pVCpu)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
 
     if (pFpuCtx->FCW & X86_FCW_IM)
@@ -6509 +6512 @@
  * Raises a FPU stack overflow exception on a push.
  *
- * @param   pIemCpu             The IEM per CPU data.
- */
-DECL_NO_INLINE(IEM_STATIC, void) iemFpuStackPushOverflow(PIEMCPU pIemCpu)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECL_NO_INLINE(IEM_STATIC, void) iemFpuStackPushOverflow(PVMCPU pVCpu)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuStackPushOverflowOnly(pFpuCtx);
 }
@@ -6523 +6526 @@
  * Raises a FPU stack overflow exception on a push with a memory operand.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iEffSeg             The effective memory operand selector register.
  * @param   GCPtrEff            The effective memory operand offset.
  */
 DECL_NO_INLINE(IEM_STATIC, void)
-iemFpuStackPushOverflowWithMemOp(PIEMCPU pIemCpu, uint8_t iEffSeg, RTGCPTR GCPtrEff)
-{
-    PCPUMCTX    pCtx    = pIemCpu->CTX_SUFF(pCtx);
+iemFpuStackPushOverflowWithMemOp(PVMCPU pVCpu, uint8_t iEffSeg, RTGCPTR GCPtrEff)
+{
+    PCPUMCTX    pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemFpuUpdateDP(pIemCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
+    iemFpuUpdateDP(pVCpu, pCtx, pFpuCtx, iEffSeg, GCPtrEff);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
     iemFpuStackPushOverflowOnly(pFpuCtx);
 }
 
 
-IEM_STATIC int iemFpuStRegNotEmpty(PIEMCPU pIemCpu, uint8_t iStReg)
-{
-    PX86FXSTATE pFpuCtx = &pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
+IEM_STATIC int iemFpuStRegNotEmpty(PVMCPU pVCpu, uint8_t iStReg)
+{
+    PX86FXSTATE pFpuCtx = &pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
     uint16_t    iReg    = (X86_FSW_TOP_GET(pFpuCtx->FSW) + iStReg) & X86_FSW_TOP_SMASK;
     if (pFpuCtx->FTW & RT_BIT(iReg))
@@ -6548 +6551 @@
 
 
-IEM_STATIC int iemFpuStRegNotEmptyRef(PIEMCPU pIemCpu, uint8_t iStReg, PCRTFLOAT80U *ppRef)
-{
-    PX86FXSTATE pFpuCtx = &pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
+IEM_STATIC int iemFpuStRegNotEmptyRef(PVMCPU pVCpu, uint8_t iStReg, PCRTFLOAT80U *ppRef)
+{
+    PX86FXSTATE pFpuCtx = &pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
     uint16_t    iReg    = (X86_FSW_TOP_GET(pFpuCtx->FSW) + iStReg) & X86_FSW_TOP_SMASK;
     if (pFpuCtx->FTW & RT_BIT(iReg))
@@ -6561 +6564 @@
 
 
-IEM_STATIC int iemFpu2StRegsNotEmptyRef(PIEMCPU pIemCpu, uint8_t iStReg0, PCRTFLOAT80U *ppRef0,
+IEM_STATIC int iemFpu2StRegsNotEmptyRef(PVMCPU pVCpu, uint8_t iStReg0, PCRTFLOAT80U *ppRef0,
                                         uint8_t iStReg1, PCRTFLOAT80U *ppRef1)
 {
-    PX86FXSTATE pFpuCtx = &pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
+    PX86FXSTATE pFpuCtx = &pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
     uint16_t    iTop    = X86_FSW_TOP_GET(pFpuCtx->FSW);
     uint16_t    iReg0   = (iTop + iStReg0) & X86_FSW_TOP_SMASK;
@@ -6578 +6581 @@
 
 
-IEM_STATIC int iemFpu2StRegsNotEmptyRefFirst(PIEMCPU pIemCpu, uint8_t iStReg0, PCRTFLOAT80U *ppRef0, uint8_t iStReg1)
-{
-    PX86FXSTATE pFpuCtx = &pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
+IEM_STATIC int iemFpu2StRegsNotEmptyRefFirst(PVMCPU pVCpu, uint8_t iStReg0, PCRTFLOAT80U *ppRef0, uint8_t iStReg1)
+{
+    PX86FXSTATE pFpuCtx = &pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87;
     uint16_t    iTop    = X86_FSW_TOP_GET(pFpuCtx->FSW);
     uint16_t    iReg0   = (iTop + iStReg0) & X86_FSW_TOP_SMASK;
@@ -6682 +6685 @@
  * Updates the IEMCPU::cbWritten counter if applicable.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   fAccess             The access being accounted for.
  * @param   cbMem               The access size.
  */
-DECL_FORCE_INLINE(void) iemMemUpdateWrittenCounter(PIEMCPU pIemCpu, uint32_t fAccess, size_t cbMem)
+DECL_FORCE_INLINE(void) iemMemUpdateWrittenCounter(PVMCPU pVCpu, uint32_t fAccess, size_t cbMem)
 {
     if (   (fAccess & (IEM_ACCESS_WHAT_MASK | IEM_ACCESS_TYPE_WRITE)) == (IEM_ACCESS_WHAT_STACK | IEM_ACCESS_TYPE_WRITE)
         || (fAccess & (IEM_ACCESS_WHAT_MASK | IEM_ACCESS_TYPE_WRITE)) == (IEM_ACCESS_WHAT_DATA | IEM_ACCESS_TYPE_WRITE) )
-        pIemCpu->cbWritten += (uint32_t)cbMem;
+        pVCpu->iem.s.cbWritten += (uint32_t)cbMem;
 }
 
@@ -6700 +6703 @@
  * @returns VBox strict status code.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pHid                Pointer to the hidden register.
  * @param   iSegReg             The register number.
@@ -6708 +6711 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemMemSegCheckWriteAccessEx(PIEMCPU pIemCpu, PCCPUMSELREGHID pHid, uint8_t iSegReg, uint64_t *pu64BaseAddr)
-{
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+iemMemSegCheckWriteAccessEx(PVMCPU pVCpu, PCCPUMSELREGHID pHid, uint8_t iSegReg, uint64_t *pu64BaseAddr)
+{
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         *pu64BaseAddr = iSegReg < X86_SREG_FS ? 0 : pHid->u64Base;
     else
     {
         if (!pHid->Attr.n.u1Present)
-            return iemRaiseSelectorNotPresentBySegReg(pIemCpu, iSegReg);
+            return iemRaiseSelectorNotPresentBySegReg(pVCpu, iSegReg);
 
         if (   (   (pHid->Attr.n.u4Type & X86_SEL_TYPE_CODE)
                 || !(pHid->Attr.n.u4Type & X86_SEL_TYPE_WRITE) )
-            &&  pIemCpu->enmCpuMode != IEMMODE_64BIT )
-            return iemRaiseSelectorInvalidAccess(pIemCpu, iSegReg, IEM_ACCESS_DATA_W);
+            &&  pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT )
+            return iemRaiseSelectorInvalidAccess(pVCpu, iSegReg, IEM_ACCESS_DATA_W);
         *pu64BaseAddr = pHid->u64Base;
     }
@@ -6733 +6736 @@
  * @returns VBox strict status code.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pHid                Pointer to the hidden register.
  * @param   iSegReg             The register number.
@@ -6741 +6744 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemMemSegCheckReadAccessEx(PIEMCPU pIemCpu, PCCPUMSELREGHID pHid, uint8_t iSegReg, uint64_t *pu64BaseAddr)
-{
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+iemMemSegCheckReadAccessEx(PVMCPU pVCpu, PCCPUMSELREGHID pHid, uint8_t iSegReg, uint64_t *pu64BaseAddr)
+{
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         *pu64BaseAddr = iSegReg < X86_SREG_FS ? 0 : pHid->u64Base;
     else
     {
         if (!pHid->Attr.n.u1Present)
-            return iemRaiseSelectorNotPresentBySegReg(pIemCpu, iSegReg);
+            return iemRaiseSelectorNotPresentBySegReg(pVCpu, iSegReg);
 
         if ((pHid->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_READ)) == X86_SEL_TYPE_CODE)
-            return iemRaiseSelectorInvalidAccess(pIemCpu, iSegReg, IEM_ACCESS_DATA_R);
+            return iemRaiseSelectorInvalidAccess(pVCpu, iSegReg, IEM_ACCESS_DATA_R);
         *pu64BaseAddr = pHid->u64Base;
     }
@@ -6765 +6768 @@
  * @returns VBox strict status code.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   fAccess             The kind of access which is being performed.
  * @param   iSegReg             The index of the segment register to apply.
@@ -6775 +6778 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemMemApplySegment(PIEMCPU pIemCpu, uint32_t fAccess, uint8_t iSegReg, size_t cbMem, PRTGCPTR pGCPtrMem)
+iemMemApplySegment(PVMCPU pVCpu, uint32_t fAccess, uint8_t iSegReg, size_t cbMem, PRTGCPTR pGCPtrMem)
 {
     if (iSegReg == UINT8_MAX)
         return VINF_SUCCESS;
 
-    PCPUMSELREGHID pSel = iemSRegGetHid(pIemCpu, iSegReg);
-    switch (pIemCpu->enmCpuMode)
+    PCPUMSELREGHID pSel = iemSRegGetHid(pVCpu, iSegReg);
+    switch (pVCpu->iem.s.enmCpuMode)
     {
         case IEMMODE_16BIT:
@@ -6797 +6800 @@
                     if (   (fAccess & IEM_ACCESS_TYPE_WRITE)
                         && !(pSel->Attr.n.u4Type & X86_SEL_TYPE_WRITE) )
-                        return iemRaiseSelectorInvalidAccess(pIemCpu, iSegReg, fAccess);
-
-                    if (!IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+                        return iemRaiseSelectorInvalidAccess(pVCpu, iSegReg, fAccess);
+
+                    if (!IEM_IS_REAL_OR_V86_MODE(pVCpu))
                     {
                         /** @todo CPL check. */
@@ -6811 +6814 @@
                         if (   GCPtrFirst32 > pSel->u32Limit
                             || GCPtrLast32  > pSel->u32Limit) /* yes, in real mode too (since 80286). */
-                            return iemRaiseSelectorBounds(pIemCpu, iSegReg, fAccess);
+                            return iemRaiseSelectorBounds(pVCpu, iSegReg, fAccess);
                     }
                     else
@@ -6820 +6823 @@
                        if (   GCPtrFirst32 < pSel->u32Limit + UINT32_C(1)
                            || GCPtrLast32  > (pSel->Attr.n.u1DefBig ? UINT32_MAX : UINT32_C(0xffff)))
-                          return iemRaiseSelectorBounds(pIemCpu, iSegReg, fAccess);
+                          return iemRaiseSelectorBounds(pVCpu, iSegReg, fAccess);
                     }
                     *pGCPtrMem = GCPtrFirst32 += (uint32_t)pSel->u64Base;
@@ -6834 +6837 @@
                             || (   (fAccess & IEM_ACCESS_TYPE_READ)
                                && !(pSel->Attr.n.u4Type & X86_SEL_TYPE_READ)) )
-                        && !IEM_IS_REAL_OR_V86_MODE(pIemCpu) )
-                        return iemRaiseSelectorInvalidAccess(pIemCpu, iSegReg, fAccess);
+                        && !IEM_IS_REAL_OR_V86_MODE(pVCpu) )
+                        return iemRaiseSelectorInvalidAccess(pVCpu, iSegReg, fAccess);
 
                     if (   GCPtrFirst32 > pSel->u32Limit
                         || GCPtrLast32  > pSel->u32Limit) /* yes, in real mode too (since 80286). */
-                        return iemRaiseSelectorBounds(pIemCpu, iSegReg, fAccess);
-
-                    if (!IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+                        return iemRaiseSelectorBounds(pVCpu, iSegReg, fAccess);
+
+                    if (!IEM_IS_REAL_OR_V86_MODE(pVCpu))
                     {
                         /** @todo CPL check. */
@@ -6850 +6853 @@
             }
             else
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             return VINF_SUCCESS;
         }
@@ -6863 +6866 @@
             if (RT_LIKELY(X86_IS_CANONICAL(GCPtrMem) && X86_IS_CANONICAL(GCPtrMem + cbMem - 1)))
                 return VINF_SUCCESS;
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         }
 
@@ -6876 +6879 @@
  * can access the page as specified.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   GCPtrMem            The virtual address.
  * @param   fAccess             The intended access.
@@ -6882 +6885 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemMemPageTranslateAndCheckAccess(PIEMCPU pIemCpu, RTGCPTR GCPtrMem, uint32_t fAccess, PRTGCPHYS pGCPhysMem)
+iemMemPageTranslateAndCheckAccess(PVMCPU pVCpu, RTGCPTR GCPtrMem, uint32_t fAccess, PRTGCPHYS pGCPhysMem)
 {
     /** @todo Need a different PGM interface here.  We're currently using
@@ -6888 +6891 @@
     RTGCPHYS    GCPhys;
     uint64_t    fFlags;
-    int rc = PGMGstGetPage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrMem, &fFlags, &GCPhys);
+    int rc = PGMGstGetPage(pVCpu, GCPtrMem, &fFlags, &GCPhys);
     if (RT_FAILURE(rc))
     {
@@ -6894 +6897 @@
         /** @todo Reserved bits in page tables. Requires new PGM interface. */
         *pGCPhysMem = NIL_RTGCPHYS;
-        return iemRaisePageFault(pIemCpu, GCPtrMem, fAccess, rc);
+        return iemRaisePageFault(pVCpu, GCPtrMem, fAccess, rc);
     }
 
@@ -6904 +6907 @@
         if (   (fAccess & IEM_ACCESS_TYPE_WRITE)
             && !(fFlags & X86_PTE_RW)
-            && (   pIemCpu->uCpl != 0
-                || (pIemCpu->CTX_SUFF(pCtx)->cr0 & X86_CR0_WP)))
+            && (   pVCpu->iem.s.uCpl != 0
+                || (pVCpu->iem.s.CTX_SUFF(pCtx)->cr0 & X86_CR0_WP)))
         {
             Log(("iemMemPageTranslateAndCheckAccess: GCPtrMem=%RGv - read-only page -> #PF\n", GCPtrMem));
             *pGCPhysMem = NIL_RTGCPHYS;
-            return iemRaisePageFault(pIemCpu, GCPtrMem, fAccess & ~IEM_ACCESS_TYPE_READ, VERR_ACCESS_DENIED);
+            return iemRaisePageFault(pVCpu, GCPtrMem, fAccess & ~IEM_ACCESS_TYPE_READ, VERR_ACCESS_DENIED);
         }
 
         /* Kernel memory accessed by userland? */
         if (   !(fFlags & X86_PTE_US)
-            && pIemCpu->uCpl == 3
+            && pVCpu->iem.s.uCpl == 3
             && !(fAccess & IEM_ACCESS_WHAT_SYS))
         {
             Log(("iemMemPageTranslateAndCheckAccess: GCPtrMem=%RGv - user access to kernel page -> #PF\n", GCPtrMem));
             *pGCPhysMem = NIL_RTGCPHYS;
-            return iemRaisePageFault(pIemCpu, GCPtrMem, fAccess, VERR_ACCESS_DENIED);
+            return iemRaisePageFault(pVCpu, GCPtrMem, fAccess, VERR_ACCESS_DENIED);
         }
 
@@ -6925 +6928 @@
         if (   (fAccess & IEM_ACCESS_TYPE_EXEC)
             && (fFlags & X86_PTE_PAE_NX)
-            && (pIemCpu->CTX_SUFF(pCtx)->msrEFER & MSR_K6_EFER_NXE) )
+            && (pVCpu->iem.s.CTX_SUFF(pCtx)->msrEFER & MSR_K6_EFER_NXE) )
         {
             Log(("iemMemPageTranslateAndCheckAccess: GCPtrMem=%RGv - NX -> #PF\n", GCPtrMem));
             *pGCPhysMem = NIL_RTGCPHYS;
-            return iemRaisePageFault(pIemCpu, GCPtrMem, fAccess & ~(IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE),
+            return iemRaisePageFault(pVCpu, GCPtrMem, fAccess & ~(IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE),
                                      VERR_ACCESS_DENIED);
         }
@@ -6942 +6945 @@
     if ((fFlags & fAccessedDirty) != fAccessedDirty)
     {
-        int rc2 = PGMGstModifyPage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrMem, 1, fAccessedDirty, ~(uint64_t)fAccessedDirty);
+        int rc2 = PGMGstModifyPage(pVCpu, GCPtrMem, 1, fAccessedDirty, ~(uint64_t)fAccessedDirty);
         AssertRC(rc2);
     }
@@ -6957 +6960 @@
  *
  * @returns VBox status code (see PGMR3PhysTlbGCPhys2Ptr).
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   GCPhysMem           The physical address.
  * @param   fAccess             The intended access.
@@ -6963 +6966 @@
  * @param   pLock               The PGM lock.
  */
-IEM_STATIC int iemMemPageMap(PIEMCPU pIemCpu, RTGCPHYS GCPhysMem, uint32_t fAccess, void **ppvMem, PPGMPAGEMAPLOCK pLock)
+IEM_STATIC int iemMemPageMap(PVMCPU pVCpu, RTGCPHYS GCPhysMem, uint32_t fAccess, void **ppvMem, PPGMPAGEMAPLOCK pLock)
 {
 #ifdef IEM_VERIFICATION_MODE_FULL
     /* Force the alternative path so we can ignore writes. */
-    if ((fAccess & IEM_ACCESS_TYPE_WRITE) && !pIemCpu->fNoRem)
-    {
-        if (IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
+    if ((fAccess & IEM_ACCESS_TYPE_WRITE) && !pVCpu->iem.s.fNoRem)
+    {
+        if (IEM_FULL_VERIFICATION_ENABLED(pVCpu))
         {
-            int rc2 = PGMPhysIemQueryAccess(IEMCPU_TO_VM(pIemCpu), GCPhysMem,
-                                            RT_BOOL(fAccess & IEM_ACCESS_TYPE_WRITE), pIemCpu->fBypassHandlers);
+            int rc2 = PGMPhysIemQueryAccess(pVCpu->CTX_SUFF(pVM), GCPhysMem,
+                                            RT_BOOL(fAccess & IEM_ACCESS_TYPE_WRITE), pVCpu->iem.s.fBypassHandlers);
             if (RT_FAILURE(rc2))
-                pIemCpu->fProblematicMemory = true;
+                pVCpu->iem.s.fProblematicMemory = true;
         }
         return VERR_PGM_PHYS_TLB_CATCH_ALL;
@@ -6991 +6994 @@
      *        living in PGM, but with publicly accessible inlined access methods
      *        could perhaps be an even better solution. */
-    int rc = PGMPhysIemGCPhys2Ptr(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu),
+    int rc = PGMPhysIemGCPhys2Ptr(pVCpu->CTX_SUFF(pVM), pVCpu,
                                   GCPhysMem,
                                   RT_BOOL(fAccess & IEM_ACCESS_TYPE_WRITE),
-                                  pIemCpu->fBypassHandlers,
+                                  pVCpu->iem.s.fBypassHandlers,
                                   ppvMem,
                                   pLock);
@@ -7001 +7004 @@
 
 #ifdef IEM_VERIFICATION_MODE_FULL
-    if (RT_FAILURE(rc) && IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
-        pIemCpu->fProblematicMemory = true;
+    if (RT_FAILURE(rc) && IEM_FULL_VERIFICATION_ENABLED(pVCpu))
+        pVCpu->iem.s.fProblematicMemory = true;
 #endif
     return rc;
@@ -7011 +7014 @@
  * Unmap a page previously mapped by iemMemPageMap.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   GCPhysMem           The physical address.
  * @param   fAccess             The intended access.
@@ -7017 +7020 @@
  * @param   pLock               The PGM lock.
  */
-DECLINLINE(void) iemMemPageUnmap(PIEMCPU pIemCpu, RTGCPHYS GCPhysMem, uint32_t fAccess, const void *pvMem, PPGMPAGEMAPLOCK pLock)
-{
-    NOREF(pIemCpu);
+DECLINLINE(void) iemMemPageUnmap(PVMCPU pVCpu, RTGCPHYS GCPhysMem, uint32_t fAccess, const void *pvMem, PPGMPAGEMAPLOCK pLock)
+{
+    NOREF(pVCpu);
     NOREF(GCPhysMem);
     NOREF(fAccess);
     NOREF(pvMem);
-    PGMPhysReleasePageMappingLock(IEMCPU_TO_VM(pIemCpu), pLock);
+    PGMPhysReleasePageMappingLock(pVCpu->CTX_SUFF(pVM), pLock);
 }
 
@@ -7031 +7034 @@
  *
  * @returns The mapping index (positive) or VERR_NOT_FOUND (negative).
- * @param   pIemCpu         The IEM per CPU data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pvMem           The memory address.
  * @param   fAccess         The access to.
  */
-DECLINLINE(int) iemMapLookup(PIEMCPU pIemCpu, void *pvMem, uint32_t fAccess)
-{
-    Assert(pIemCpu->cActiveMappings < RT_ELEMENTS(pIemCpu->aMemMappings));
+DECLINLINE(int) iemMapLookup(PVMCPU pVCpu, void *pvMem, uint32_t fAccess)
+{
+    Assert(pVCpu->iem.s.cActiveMappings < RT_ELEMENTS(pVCpu->iem.s.aMemMappings));
     fAccess &= IEM_ACCESS_WHAT_MASK | IEM_ACCESS_TYPE_MASK;
-    if (   pIemCpu->aMemMappings[0].pv == pvMem
-        && (pIemCpu->aMemMappings[0].fAccess & (IEM_ACCESS_WHAT_MASK | IEM_ACCESS_TYPE_MASK)) == fAccess)
+    if (   pVCpu->iem.s.aMemMappings[0].pv == pvMem
+        && (pVCpu->iem.s.aMemMappings[0].fAccess & (IEM_ACCESS_WHAT_MASK | IEM_ACCESS_TYPE_MASK)) == fAccess)
         return 0;
-    if (   pIemCpu->aMemMappings[1].pv == pvMem
-        && (pIemCpu->aMemMappings[1].fAccess & (IEM_ACCESS_WHAT_MASK | IEM_ACCESS_TYPE_MASK)) == fAccess)
+    if (   pVCpu->iem.s.aMemMappings[1].pv == pvMem
+        && (pVCpu->iem.s.aMemMappings[1].fAccess & (IEM_ACCESS_WHAT_MASK | IEM_ACCESS_TYPE_MASK)) == fAccess)
         return 1;
-    if (   pIemCpu->aMemMappings[2].pv == pvMem
-        && (pIemCpu->aMemMappings[2].fAccess & (IEM_ACCESS_WHAT_MASK | IEM_ACCESS_TYPE_MASK)) == fAccess)
+    if (   pVCpu->iem.s.aMemMappings[2].pv == pvMem
+        && (pVCpu->iem.s.aMemMappings[2].fAccess & (IEM_ACCESS_WHAT_MASK | IEM_ACCESS_TYPE_MASK)) == fAccess)
         return 2;
     return VERR_NOT_FOUND;
@@ -7056 +7059 @@
  *
  * @returns Memory mapping index, 1024 on failure.
- * @param   pIemCpu             The IEM per CPU data.
- */
-IEM_STATIC unsigned iemMemMapFindFree(PIEMCPU pIemCpu)
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC unsigned iemMemMapFindFree(PVMCPU pVCpu)
 {
     /*
      * The easy case.
      */
-    if (pIemCpu->cActiveMappings == 0)
-    {
-        pIemCpu->iNextMapping = 1;
+    if (pVCpu->iem.s.cActiveMappings == 0)
+    {
+        pVCpu->iem.s.iNextMapping = 1;
         return 0;
     }
 
     /* There should be enough mappings for all instructions. */
-    AssertReturn(pIemCpu->cActiveMappings < RT_ELEMENTS(pIemCpu->aMemMappings), 1024);
-
-    for (unsigned i = 0; i < RT_ELEMENTS(pIemCpu->aMemMappings); i++)
-        if (pIemCpu->aMemMappings[i].fAccess == IEM_ACCESS_INVALID)
+    AssertReturn(pVCpu->iem.s.cActiveMappings < RT_ELEMENTS(pVCpu->iem.s.aMemMappings), 1024);
+
+    for (unsigned i = 0; i < RT_ELEMENTS(pVCpu->iem.s.aMemMappings); i++)
+        if (pVCpu->iem.s.aMemMappings[i].fAccess == IEM_ACCESS_INVALID)
             return i;
 
@@ -7084 +7087 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu         The IEM per CPU data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   iMemMap         The index of the buffer to commit.
  * @param   fPostponeFail   Whether we can postpone writer failures to ring-3.
  *                          Always false in ring-3, obviously.
  */
-IEM_STATIC VBOXSTRICTRC iemMemBounceBufferCommitAndUnmap(PIEMCPU pIemCpu, unsigned iMemMap, bool fPostponeFail)
-{
-    Assert(pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED);
-    Assert(pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE);
+IEM_STATIC VBOXSTRICTRC iemMemBounceBufferCommitAndUnmap(PVMCPU pVCpu, unsigned iMemMap, bool fPostponeFail)
+{
+    Assert(pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED);
+    Assert(pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE);
 #ifdef IN_RING3
     Assert(!fPostponeFail);
@@ -7101 +7104 @@
      */
 #ifndef IEM_VERIFICATION_MODE_MINIMAL
-    PVM          pVM = IEMCPU_TO_VM(pIemCpu);
-    if (   !pIemCpu->aMemBbMappings[iMemMap].fUnassigned
-        && !IEM_VERIFICATION_ENABLED(pIemCpu))
-    {
-        uint16_t const  cbFirst  = pIemCpu->aMemBbMappings[iMemMap].cbFirst;
-        uint16_t const  cbSecond = pIemCpu->aMemBbMappings[iMemMap].cbSecond;
-        uint8_t const  *pbBuf    = &pIemCpu->aBounceBuffers[iMemMap].ab[0];
-        if (!pIemCpu->fBypassHandlers)
+    PVM          pVM = pVCpu->CTX_SUFF(pVM);
+    if (   !pVCpu->iem.s.aMemBbMappings[iMemMap].fUnassigned
+        && !IEM_VERIFICATION_ENABLED(pVCpu))
+    {
+        uint16_t const  cbFirst  = pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst;
+        uint16_t const  cbSecond = pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond;
+        uint8_t const  *pbBuf    = &pVCpu->iem.s.aBounceBuffers[iMemMap].ab[0];
+        if (!pVCpu->iem.s.fBypassHandlers)
         {
             /*
@@ -7115 +7118 @@
              */
             VBOXSTRICTRC rcStrict = PGMPhysWrite(pVM,
-                                                 pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst,
+                                                 pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst,
                                                  pbBuf,
                                                  cbFirst,
@@ -7124 +7127 @@
                 {
                     rcStrict = PGMPhysWrite(pVM,
-                                            pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond,
+                                            pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond,
                                             pbBuf + cbFirst,
                                             cbSecond,
@@ -7133 +7136 @@
                     {
                         Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x GCPhysSecond=%RGp/%#x %Rrc\n",
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
-                        rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
+                        rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                     }
 # ifndef IN_RING3
@@ -7141 +7144 @@
                     {
                         Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x GCPhysSecond=%RGp/%#x %Rrc (postponed)\n",
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
-                        pIemCpu->aMemMappings[iMemMap].fAccess |= IEM_ACCESS_PENDING_R3_WRITE_2ND;
-                        VMCPU_FF_SET(IEMCPU_TO_VMCPU(pIemCpu), VMCPU_FF_IEM);
-                        return iemSetPassUpStatus(pIemCpu, rcStrict);
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
+                        pVCpu->iem.s.aMemMappings[iMemMap].fAccess |= IEM_ACCESS_PENDING_R3_WRITE_2ND;
+                        VMCPU_FF_SET(pVCpu, VMCPU_FF_IEM);
+                        return iemSetPassUpStatus(pVCpu, rcStrict);
                     }
 # endif
@@ -7151 +7154 @@
                     {
                         Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x GCPhysSecond=%RGp/%#x %Rrc (!!)\n",
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
                         return rcStrict;
                     }
@@ -7162 +7165 @@
                 {
                     Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x %Rrc\n",
-                         pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict) ));
-                    rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                         pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict) ));
+                    rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                 }
                 else
                 {
                     VBOXSTRICTRC rcStrict2 = PGMPhysWrite(pVM,
-                                                          pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond,
+                                                          pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond,
                                                           pbBuf + cbFirst,
                                                           cbSecond,
@@ -7175 +7178 @@
                     {
                         Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x %Rrc GCPhysSecond=%RGp/%#x\n",
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict),
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond));
-                        rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict),
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond));
+                        rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                     }
                     else if (PGM_PHYS_RW_IS_SUCCESS(rcStrict2))
                     {
                         Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x %Rrc GCPhysSecond=%RGp/%#x %Rrc\n",
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict),
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict2) ));
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict),
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict2) ));
                         PGM_PHYS_RW_DO_UPDATE_STRICT_RC(rcStrict, rcStrict2);
-                        rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                        rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                     }
 # ifndef IN_RING3
@@ -7191 +7194 @@
                     {
                         Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x GCPhysSecond=%RGp/%#x %Rrc (postponed)\n",
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
-                        pIemCpu->aMemMappings[iMemMap].fAccess |= IEM_ACCESS_PENDING_R3_WRITE_2ND;
-                        VMCPU_FF_SET(IEMCPU_TO_VMCPU(pIemCpu), VMCPU_FF_IEM);
-                        return iemSetPassUpStatus(pIemCpu, rcStrict);
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
+                        pVCpu->iem.s.aMemMappings[iMemMap].fAccess |= IEM_ACCESS_PENDING_R3_WRITE_2ND;
+                        VMCPU_FF_SET(pVCpu, VMCPU_FF_IEM);
+                        return iemSetPassUpStatus(pVCpu, rcStrict);
                     }
 # endif
@@ -7201 +7204 @@
                     {
                         Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x %Rrc GCPhysSecond=%RGp/%#x %Rrc (!!)\n",
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict),
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict2) ));
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict),
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict2) ));
                         return rcStrict2;
                     }
@@ -7211 +7214 @@
             {
                 Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x GCPhysSecond=%RGp/%#x %Rrc (postponed)\n",
-                     pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
-                     pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
+                     pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
+                     pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, VBOXSTRICTRC_VAL(rcStrict) ));
                 if (!cbSecond)
-                    pIemCpu->aMemMappings[iMemMap].fAccess |= IEM_ACCESS_PENDING_R3_WRITE_1ST;
+                    pVCpu->iem.s.aMemMappings[iMemMap].fAccess |= IEM_ACCESS_PENDING_R3_WRITE_1ST;
                 else
-                    pIemCpu->aMemMappings[iMemMap].fAccess |= IEM_ACCESS_PENDING_R3_WRITE_1ST | IEM_ACCESS_PENDING_R3_WRITE_2ND;
-                VMCPU_FF_SET(IEMCPU_TO_VMCPU(pIemCpu), VMCPU_FF_IEM);
-                return iemSetPassUpStatus(pIemCpu, rcStrict);
+                    pVCpu->iem.s.aMemMappings[iMemMap].fAccess |= IEM_ACCESS_PENDING_R3_WRITE_1ST | IEM_ACCESS_PENDING_R3_WRITE_2ND;
+                VMCPU_FF_SET(pVCpu, VMCPU_FF_IEM);
+                return iemSetPassUpStatus(pVCpu, rcStrict);
             }
 # endif
@@ -7224 +7227 @@
             {
                 Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysWrite GCPhysFirst=%RGp/%#x %Rrc [GCPhysSecond=%RGp/%#x] (!!)\n",
-                     pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict),
-                     pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond));
+                     pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, VBOXSTRICTRC_VAL(rcStrict),
+                     pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond));
                 return rcStrict;
             }
@@ -7234 +7237 @@
              * No access handlers, much simpler.
              */
-            int rc = PGMPhysSimpleWriteGCPhys(pVM, pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, pbBuf, cbFirst);
+            int rc = PGMPhysSimpleWriteGCPhys(pVM, pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, pbBuf, cbFirst);
             if (RT_SUCCESS(rc))
             {
                 if (cbSecond)
                 {
-                    rc = PGMPhysSimpleWriteGCPhys(pVM, pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, pbBuf + cbFirst, cbSecond);
+                    rc = PGMPhysSimpleWriteGCPhys(pVM, pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, pbBuf + cbFirst, cbSecond);
                     if (RT_SUCCESS(rc))
                     { /* likely */ }
@@ -7245 +7248 @@
                     {
                         Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysSimpleWriteGCPhys GCPhysFirst=%RGp/%#x GCPhysSecond=%RGp/%#x %Rrc (!!)\n",
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
-                             pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, rc));
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
+                             pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond, rc));
                         return rc;
                     }
@@ -7254 +7257 @@
             {
                 Log(("iemMemBounceBufferCommitAndUnmap: PGMPhysSimpleWriteGCPhys GCPhysFirst=%RGp/%#x %Rrc [GCPhysSecond=%RGp/%#x] (!!)\n",
-                     pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, rc,
-                     pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond));
+                     pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst, rc,
+                     pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond));
                 return rc;
             }
@@ -7266 +7269 @@
      * Record the write(s).
      */
-    if (!pIemCpu->fNoRem)
-    {
-        PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pIemCpu);
+    if (!pVCpu->iem.s.fNoRem)
+    {
+        PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pVCpu);
         if (pEvtRec)
         {
             pEvtRec->enmEvent = IEMVERIFYEVENT_RAM_WRITE;
-            pEvtRec->u.RamWrite.GCPhys  = pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst;
-            pEvtRec->u.RamWrite.cb      = pIemCpu->aMemBbMappings[iMemMap].cbFirst;
-            memcpy(pEvtRec->u.RamWrite.ab, &pIemCpu->aBounceBuffers[iMemMap].ab[0], pIemCpu->aMemBbMappings[iMemMap].cbFirst);
-            AssertCompile(sizeof(pEvtRec->u.RamWrite.ab) == sizeof(pIemCpu->aBounceBuffers[0].ab));
-            pEvtRec->pNext = *pIemCpu->ppIemEvtRecNext;
-            *pIemCpu->ppIemEvtRecNext = pEvtRec;
+            pEvtRec->u.RamWrite.GCPhys  = pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst;
+            pEvtRec->u.RamWrite.cb      = pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst;
+            memcpy(pEvtRec->u.RamWrite.ab, &pVCpu->iem.s.aBounceBuffers[iMemMap].ab[0], pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst);
+            AssertCompile(sizeof(pEvtRec->u.RamWrite.ab) == sizeof(pVCpu->iem.s.aBounceBuffers[0].ab));
+            pEvtRec->pNext = *pVCpu->iem.s.ppIemEvtRecNext;
+            *pVCpu->iem.s.ppIemEvtRecNext = pEvtRec;
         }
-        if (pIemCpu->aMemBbMappings[iMemMap].cbSecond)
+        if (pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond)
         {
-            pEvtRec = iemVerifyAllocRecord(pIemCpu);
+            pEvtRec = iemVerifyAllocRecord(pVCpu);
             if (pEvtRec)
             {
                 pEvtRec->enmEvent = IEMVERIFYEVENT_RAM_WRITE;
-                pEvtRec->u.RamWrite.GCPhys  = pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond;
-                pEvtRec->u.RamWrite.cb      = pIemCpu->aMemBbMappings[iMemMap].cbSecond;
+                pEvtRec->u.RamWrite.GCPhys  = pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond;
+                pEvtRec->u.RamWrite.cb      = pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond;
                 memcpy(pEvtRec->u.RamWrite.ab,
-                       &pIemCpu->aBounceBuffers[iMemMap].ab[pIemCpu->aMemBbMappings[iMemMap].cbFirst],
-                       pIemCpu->aMemBbMappings[iMemMap].cbSecond);
-                pEvtRec->pNext = *pIemCpu->ppIemEvtRecNext;
-                *pIemCpu->ppIemEvtRecNext = pEvtRec;
+                       &pVCpu->iem.s.aBounceBuffers[iMemMap].ab[pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst],
+                       pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond);
+                pEvtRec->pNext = *pVCpu->iem.s.ppIemEvtRecNext;
+                *pVCpu->iem.s.ppIemEvtRecNext = pEvtRec;
             }
         }
@@ -7297 +7300 @@
 #endif
 #if defined(IEM_VERIFICATION_MODE_MINIMAL) || defined(IEM_LOG_MEMORY_WRITES)
-    Log(("IEM Wrote %RGp: %.*Rhxs\n", pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst,
-         RT_MAX(RT_MIN(pIemCpu->aMemBbMappings[iMemMap].cbFirst, 64), 1), &pIemCpu->aBounceBuffers[iMemMap].ab[0]));
-    if (pIemCpu->aMemBbMappings[iMemMap].cbSecond)
-        Log(("IEM Wrote %RGp: %.*Rhxs [2nd page]\n", pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond,
-             RT_MIN(pIemCpu->aMemBbMappings[iMemMap].cbSecond, 64),
-             &pIemCpu->aBounceBuffers[iMemMap].ab[pIemCpu->aMemBbMappings[iMemMap].cbFirst]));
-
-    size_t cbWrote = pIemCpu->aMemBbMappings[iMemMap].cbFirst + pIemCpu->aMemBbMappings[iMemMap].cbSecond;
+    Log(("IEM Wrote %RGp: %.*Rhxs\n", pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst,
+         RT_MAX(RT_MIN(pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst, 64), 1), &pVCpu->iem.s.aBounceBuffers[iMemMap].ab[0]));
+    if (pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond)
+        Log(("IEM Wrote %RGp: %.*Rhxs [2nd page]\n", pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond,
+             RT_MIN(pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond, 64),
+             &pVCpu->iem.s.aBounceBuffers[iMemMap].ab[pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst]));
+
+    size_t cbWrote = pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst + pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond;
     g_cbIemWrote = cbWrote;
-    memcpy(g_abIemWrote, &pIemCpu->aBounceBuffers[iMemMap].ab[0], RT_MIN(cbWrote, sizeof(g_abIemWrote)));
+    memcpy(g_abIemWrote, &pVCpu->iem.s.aBounceBuffers[iMemMap].ab[0], RT_MIN(cbWrote, sizeof(g_abIemWrote)));
 #endif
 
@@ -7312 +7315 @@
      * Free the mapping entry.
      */
-    pIemCpu->aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
-    Assert(pIemCpu->cActiveMappings != 0);
-    pIemCpu->cActiveMappings--;
+    pVCpu->iem.s.aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
+    Assert(pVCpu->iem.s.cActiveMappings != 0);
+    pVCpu->iem.s.cActiveMappings--;
     return VINF_SUCCESS;
 }
@@ -7323 +7326 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemMemBounceBufferMapCrossPage(PIEMCPU pIemCpu, int iMemMap, void **ppvMem, size_t cbMem, RTGCPTR GCPtrFirst, uint32_t fAccess)
+iemMemBounceBufferMapCrossPage(PVMCPU pVCpu, int iMemMap, void **ppvMem, size_t cbMem, RTGCPTR GCPtrFirst, uint32_t fAccess)
 {
     /*
@@ -7329 +7332 @@
      */
     RTGCPHYS GCPhysFirst;
-    VBOXSTRICTRC rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrFirst, fAccess, &GCPhysFirst);
+    VBOXSTRICTRC rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrFirst, fAccess, &GCPhysFirst);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
     RTGCPHYS GCPhysSecond;
-    rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, (GCPtrFirst + (cbMem - 1)) & ~(RTGCPTR)PAGE_OFFSET_MASK,
+    rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, (GCPtrFirst + (cbMem - 1)) & ~(RTGCPTR)PAGE_OFFSET_MASK,
                                                  fAccess, &GCPhysSecond);
     if (rcStrict != VINF_SUCCESS)
@@ -7340 +7343 @@
     GCPhysSecond &= ~(RTGCPHYS)PAGE_OFFSET_MASK;
 
-    PVM pVM = IEMCPU_TO_VM(pIemCpu);
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
 #ifdef IEM_VERIFICATION_MODE_FULL
     /*
@@ -7346 +7349 @@
      * the right execution engine. (TLB: Redo this.)
      */
-    if (IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
-    {
-        int rc2 = PGMPhysIemQueryAccess(pVM, GCPhysFirst,  RT_BOOL(fAccess & IEM_ACCESS_TYPE_WRITE), pIemCpu->fBypassHandlers);
+    if (IEM_FULL_VERIFICATION_ENABLED(pVCpu))
+    {
+        int rc2 = PGMPhysIemQueryAccess(pVM, GCPhysFirst,  RT_BOOL(fAccess & IEM_ACCESS_TYPE_WRITE), pVCpu->iem.s.fBypassHandlers);
         if (RT_SUCCESS(rc2))
-            rc2 = PGMPhysIemQueryAccess(pVM, GCPhysSecond, RT_BOOL(fAccess & IEM_ACCESS_TYPE_WRITE), pIemCpu->fBypassHandlers);
+            rc2 = PGMPhysIemQueryAccess(pVM, GCPhysSecond, RT_BOOL(fAccess & IEM_ACCESS_TYPE_WRITE), pVCpu->iem.s.fBypassHandlers);
         if (RT_FAILURE(rc2))
-            pIemCpu->fProblematicMemory = true;
+            pVCpu->iem.s.fProblematicMemory = true;
     }
 #endif
@@ -7361 +7364 @@
      * write access.
      */
-    uint8_t        *pbBuf        = &pIemCpu->aBounceBuffers[iMemMap].ab[0];
+    uint8_t        *pbBuf        = &pVCpu->iem.s.aBounceBuffers[iMemMap].ab[0];
     uint32_t const  cbFirstPage  = PAGE_SIZE - (GCPhysFirst & PAGE_OFFSET_MASK);
     uint32_t const  cbSecondPage = (uint32_t)(cbMem - cbFirstPage);
@@ -7367 +7370 @@
     if (fAccess & (IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_EXEC | IEM_ACCESS_PARTIAL_WRITE))
     {
-        if (!pIemCpu->fBypassHandlers)
+        if (!pVCpu->iem.s.fBypassHandlers)
         {
             /*
@@ -7380 +7383 @@
                 { /*likely */ }
                 else if (PGM_PHYS_RW_IS_SUCCESS(rcStrict))
-                    rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                    rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                 else
                 {
@@ -7394 +7397 @@
                 {
                     PGM_PHYS_RW_DO_UPDATE_STRICT_RC(rcStrict, rcStrict2);
-                    rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                    rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                 }
                 else
@@ -7436 +7439 @@
 
 #if defined(IEM_VERIFICATION_MODE_FULL) && defined(IN_RING3)
-        if (   !pIemCpu->fNoRem
+        if (   !pVCpu->iem.s.fNoRem
             && (fAccess & (IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_EXEC)) )
         {
@@ -7442 +7445 @@
              * Record the reads.
              */
-            PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pIemCpu);
+            PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pVCpu);
             if (pEvtRec)
             {
@@ -7448 +7451 @@
                 pEvtRec->u.RamRead.GCPhys  = GCPhysFirst;
                 pEvtRec->u.RamRead.cb      = cbFirstPage;
-                pEvtRec->pNext = *pIemCpu->ppIemEvtRecNext;
-                *pIemCpu->ppIemEvtRecNext = pEvtRec;
+                pEvtRec->pNext = *pVCpu->iem.s.ppIemEvtRecNext;
+                *pVCpu->iem.s.ppIemEvtRecNext = pEvtRec;
             }
-            pEvtRec = iemVerifyAllocRecord(pIemCpu);
+            pEvtRec = iemVerifyAllocRecord(pVCpu);
             if (pEvtRec)
             {
@@ -7457 +7460 @@
                 pEvtRec->u.RamRead.GCPhys  = GCPhysSecond;
                 pEvtRec->u.RamRead.cb      = cbSecondPage;
-                pEvtRec->pNext = *pIemCpu->ppIemEvtRecNext;
-                *pIemCpu->ppIemEvtRecNext = pEvtRec;
+                pEvtRec->pNext = *pVCpu->iem.s.ppIemEvtRecNext;
+                *pVCpu->iem.s.ppIemEvtRecNext = pEvtRec;
             }
         }
@@ -7466 +7469 @@
     else
         memset(pbBuf, 0xcc, cbMem);
-    if (cbMem < sizeof(pIemCpu->aBounceBuffers[iMemMap].ab))
-        memset(pbBuf + cbMem, 0xaa, sizeof(pIemCpu->aBounceBuffers[iMemMap].ab) - cbMem);
+    if (cbMem < sizeof(pVCpu->iem.s.aBounceBuffers[iMemMap].ab))
+        memset(pbBuf + cbMem, 0xaa, sizeof(pVCpu->iem.s.aBounceBuffers[iMemMap].ab) - cbMem);
 #endif
 
@@ -7473 +7476 @@
      * Commit the bounce buffer entry.
      */
-    pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst    = GCPhysFirst;
-    pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond   = GCPhysSecond;
-    pIemCpu->aMemBbMappings[iMemMap].cbFirst        = (uint16_t)cbFirstPage;
-    pIemCpu->aMemBbMappings[iMemMap].cbSecond       = (uint16_t)cbSecondPage;
-    pIemCpu->aMemBbMappings[iMemMap].fUnassigned    = false;
-    pIemCpu->aMemMappings[iMemMap].pv               = pbBuf;
-    pIemCpu->aMemMappings[iMemMap].fAccess          = fAccess | IEM_ACCESS_BOUNCE_BUFFERED;
-    pIemCpu->iNextMapping = iMemMap + 1;
-    pIemCpu->cActiveMappings++;
-
-    iemMemUpdateWrittenCounter(pIemCpu, fAccess, cbMem);
+    pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst    = GCPhysFirst;
+    pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond   = GCPhysSecond;
+    pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst        = (uint16_t)cbFirstPage;
+    pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond       = (uint16_t)cbSecondPage;
+    pVCpu->iem.s.aMemBbMappings[iMemMap].fUnassigned    = false;
+    pVCpu->iem.s.aMemMappings[iMemMap].pv               = pbBuf;
+    pVCpu->iem.s.aMemMappings[iMemMap].fAccess          = fAccess | IEM_ACCESS_BOUNCE_BUFFERED;
+    pVCpu->iem.s.iNextMapping = iMemMap + 1;
+    pVCpu->iem.s.cActiveMappings++;
+
+    iemMemUpdateWrittenCounter(pVCpu, fAccess, cbMem);
     *ppvMem = pbBuf;
     return VINF_SUCCESS;
@@ -7492 +7495 @@
  * iemMemMap woker that deals with iemMemPageMap failures.
  */
-IEM_STATIC VBOXSTRICTRC iemMemBounceBufferMapPhys(PIEMCPU pIemCpu, unsigned iMemMap, void **ppvMem, size_t cbMem,
+IEM_STATIC VBOXSTRICTRC iemMemBounceBufferMapPhys(PVMCPU pVCpu, unsigned iMemMap, void **ppvMem, size_t cbMem,
                                                   RTGCPHYS GCPhysFirst, uint32_t fAccess, VBOXSTRICTRC rcMap)
 {
@@ -7505 +7508 @@
         return rcMap;
     }
-    pIemCpu->cPotentialExits++;
+    pVCpu->iem.s.cPotentialExits++;
 
     /*
@@ -7511 +7514 @@
      * write access.
      */
-    uint8_t *pbBuf = &pIemCpu->aBounceBuffers[iMemMap].ab[0];
+    uint8_t *pbBuf = &pVCpu->iem.s.aBounceBuffers[iMemMap].ab[0];
     if (fAccess & (IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_EXEC | IEM_ACCESS_PARTIAL_WRITE))
     {
@@ -7519 +7522 @@
         {
             int rc;
-            if (!pIemCpu->fBypassHandlers)
+            if (!pVCpu->iem.s.fBypassHandlers)
             {
-                VBOXSTRICTRC rcStrict = PGMPhysRead(IEMCPU_TO_VM(pIemCpu), GCPhysFirst, pbBuf, cbMem, PGMACCESSORIGIN_IEM);
+                VBOXSTRICTRC rcStrict = PGMPhysRead(pVCpu->CTX_SUFF(pVM), GCPhysFirst, pbBuf, cbMem, PGMACCESSORIGIN_IEM);
                 if (rcStrict == VINF_SUCCESS)
                 { /* nothing */ }
                 else if (PGM_PHYS_RW_IS_SUCCESS(rcStrict))
-                    rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                    rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                 else
                 {
@@ -7535 +7538 @@
             else
             {
-                rc = PGMPhysSimpleReadGCPhys(IEMCPU_TO_VM(pIemCpu), pbBuf, GCPhysFirst, cbMem);
+                rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pbBuf, GCPhysFirst, cbMem);
                 if (RT_SUCCESS(rc))
                 { /* likely */ }
@@ -7548 +7551 @@
 
 #if defined(IEM_VERIFICATION_MODE_FULL) && defined(IN_RING3)
-        if (   !pIemCpu->fNoRem
+        if (   !pVCpu->iem.s.fNoRem
             && (fAccess & (IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_EXEC)) )
         {
@@ -7554 +7557 @@
              * Record the read.
              */
-            PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pIemCpu);
+            PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pVCpu);
             if (pEvtRec)
             {
@@ -7560 +7563 @@
                 pEvtRec->u.RamRead.GCPhys  = GCPhysFirst;
                 pEvtRec->u.RamRead.cb      = (uint32_t)cbMem;
-                pEvtRec->pNext = *pIemCpu->ppIemEvtRecNext;
-                *pIemCpu->ppIemEvtRecNext = pEvtRec;
+                pEvtRec->pNext = *pVCpu->iem.s.ppIemEvtRecNext;
+                *pVCpu->iem.s.ppIemEvtRecNext = pEvtRec;
             }
         }
@@ -7571 +7574 @@
 #endif
 #ifdef VBOX_STRICT
-    if (cbMem < sizeof(pIemCpu->aBounceBuffers[iMemMap].ab))
-        memset(pbBuf + cbMem, 0xaa, sizeof(pIemCpu->aBounceBuffers[iMemMap].ab) - cbMem);
+    if (cbMem < sizeof(pVCpu->iem.s.aBounceBuffers[iMemMap].ab))
+        memset(pbBuf + cbMem, 0xaa, sizeof(pVCpu->iem.s.aBounceBuffers[iMemMap].ab) - cbMem);
 #endif
 
@@ -7578 +7581 @@
      * Commit the bounce buffer entry.
      */
-    pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst    = GCPhysFirst;
-    pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond   = NIL_RTGCPHYS;
-    pIemCpu->aMemBbMappings[iMemMap].cbFirst        = (uint16_t)cbMem;
-    pIemCpu->aMemBbMappings[iMemMap].cbSecond       = 0;
-    pIemCpu->aMemBbMappings[iMemMap].fUnassigned    = rcMap == VERR_PGM_PHYS_TLB_UNASSIGNED;
-    pIemCpu->aMemMappings[iMemMap].pv               = pbBuf;
-    pIemCpu->aMemMappings[iMemMap].fAccess          = fAccess | IEM_ACCESS_BOUNCE_BUFFERED;
-    pIemCpu->iNextMapping = iMemMap + 1;
-    pIemCpu->cActiveMappings++;
-
-    iemMemUpdateWrittenCounter(pIemCpu, fAccess, cbMem);
+    pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst    = GCPhysFirst;
+    pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond   = NIL_RTGCPHYS;
+    pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst        = (uint16_t)cbMem;
+    pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond       = 0;
+    pVCpu->iem.s.aMemBbMappings[iMemMap].fUnassigned    = rcMap == VERR_PGM_PHYS_TLB_UNASSIGNED;
+    pVCpu->iem.s.aMemMappings[iMemMap].pv               = pbBuf;
+    pVCpu->iem.s.aMemMappings[iMemMap].fAccess          = fAccess | IEM_ACCESS_BOUNCE_BUFFERED;
+    pVCpu->iem.s.iNextMapping = iMemMap + 1;
+    pVCpu->iem.s.cActiveMappings++;
+
+    iemMemUpdateWrittenCounter(pVCpu, fAccess, cbMem);
     *ppvMem = pbBuf;
     return VINF_SUCCESS;
@@ -7607 +7610 @@
  * @returns VBox strict status code.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   ppvMem              Where to return the pointer to the mapped
  *                              memory.
@@ -7625 +7628 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemMemMap(PIEMCPU pIemCpu, void **ppvMem, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t fAccess)
+iemMemMap(PVMCPU pVCpu, void **ppvMem, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t fAccess)
 {
     /*
@@ -7632 +7635 @@
     Assert(cbMem <= 64 || cbMem == 512 || cbMem == 108 || cbMem == 104 || cbMem == 94); /* 512 is the max! */
     Assert(~(fAccess & ~(IEM_ACCESS_TYPE_MASK | IEM_ACCESS_WHAT_MASK)));
-    Assert(pIemCpu->cActiveMappings < RT_ELEMENTS(pIemCpu->aMemMappings));
-
-    unsigned iMemMap = pIemCpu->iNextMapping;
-    if (   iMemMap >= RT_ELEMENTS(pIemCpu->aMemMappings)
-        || pIemCpu->aMemMappings[iMemMap].fAccess != IEM_ACCESS_INVALID)
-    {
-        iMemMap = iemMemMapFindFree(pIemCpu);
-        AssertLogRelMsgReturn(iMemMap < RT_ELEMENTS(pIemCpu->aMemMappings),
-                              ("active=%d fAccess[0] = {%#x, %#x, %#x}\n", pIemCpu->cActiveMappings,
-                               pIemCpu->aMemMappings[0].fAccess, pIemCpu->aMemMappings[1].fAccess,
-                               pIemCpu->aMemMappings[2].fAccess),
+    Assert(pVCpu->iem.s.cActiveMappings < RT_ELEMENTS(pVCpu->iem.s.aMemMappings));
+
+    unsigned iMemMap = pVCpu->iem.s.iNextMapping;
+    if (   iMemMap >= RT_ELEMENTS(pVCpu->iem.s.aMemMappings)
+        || pVCpu->iem.s.aMemMappings[iMemMap].fAccess != IEM_ACCESS_INVALID)
+    {
+        iMemMap = iemMemMapFindFree(pVCpu);
+        AssertLogRelMsgReturn(iMemMap < RT_ELEMENTS(pVCpu->iem.s.aMemMappings),
+                              ("active=%d fAccess[0] = {%#x, %#x, %#x}\n", pVCpu->iem.s.cActiveMappings,
+                               pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemMappings[1].fAccess,
+                               pVCpu->iem.s.aMemMappings[2].fAccess),
                               VERR_IEM_IPE_9);
     }
@@ -7650 +7653 @@
      * slightly complicated happens, fall back on bounce buffering.
      */
-    VBOXSTRICTRC rcStrict = iemMemApplySegment(pIemCpu, fAccess, iSegReg, cbMem, &GCPtrMem);
+    VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, fAccess, iSegReg, cbMem, &GCPtrMem);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
     if ((GCPtrMem & PAGE_OFFSET_MASK) + cbMem > PAGE_SIZE) /* Crossing a page boundary? */
-        return iemMemBounceBufferMapCrossPage(pIemCpu, iMemMap, ppvMem, cbMem, GCPtrMem, fAccess);
+        return iemMemBounceBufferMapCrossPage(pVCpu, iMemMap, ppvMem, cbMem, GCPtrMem, fAccess);
 
     RTGCPHYS GCPhysFirst;
-    rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrMem, fAccess, &GCPhysFirst);
+    rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, fAccess, &GCPhysFirst);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -7668 +7671 @@
 
     void *pvMem;
-    rcStrict = iemMemPageMap(pIemCpu, GCPhysFirst, fAccess, &pvMem, &pIemCpu->aMemMappingLocks[iMemMap].Lock);
+    rcStrict = iemMemPageMap(pVCpu, GCPhysFirst, fAccess, &pvMem, &pVCpu->iem.s.aMemMappingLocks[iMemMap].Lock);
     if (rcStrict != VINF_SUCCESS)
-        return iemMemBounceBufferMapPhys(pIemCpu, iMemMap, ppvMem, cbMem, GCPhysFirst, fAccess, rcStrict);
+        return iemMemBounceBufferMapPhys(pVCpu, iMemMap, ppvMem, cbMem, GCPhysFirst, fAccess, rcStrict);
 
     /*
      * Fill in the mapping table entry.
      */
-    pIemCpu->aMemMappings[iMemMap].pv      = pvMem;
-    pIemCpu->aMemMappings[iMemMap].fAccess = fAccess;
-    pIemCpu->iNextMapping = iMemMap + 1;
-    pIemCpu->cActiveMappings++;
-
-    iemMemUpdateWrittenCounter(pIemCpu, fAccess, cbMem);
+    pVCpu->iem.s.aMemMappings[iMemMap].pv      = pvMem;
+    pVCpu->iem.s.aMemMappings[iMemMap].fAccess = fAccess;
+    pVCpu->iem.s.iNextMapping = iMemMap + 1;
+    pVCpu->iem.s.cActiveMappings++;
+
+    iemMemUpdateWrittenCounter(pVCpu, fAccess, cbMem);
     *ppvMem = pvMem;
     return VINF_SUCCESS;
@@ -7690 +7693 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pvMem               The mapping.
  * @param   fAccess             The kind of access.
  */
-IEM_STATIC VBOXSTRICTRC iemMemCommitAndUnmap(PIEMCPU pIemCpu, void *pvMem, uint32_t fAccess)
-{
-    int iMemMap = iemMapLookup(pIemCpu, pvMem, fAccess);
+IEM_STATIC VBOXSTRICTRC iemMemCommitAndUnmap(PVMCPU pVCpu, void *pvMem, uint32_t fAccess)
+{
+    int iMemMap = iemMapLookup(pVCpu, pvMem, fAccess);
     AssertReturn(iMemMap >= 0, iMemMap);
 
     /* If it's bounce buffered, we may need to write back the buffer. */
-    if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED)
-    {
-        if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE)
-            return iemMemBounceBufferCommitAndUnmap(pIemCpu, iMemMap, false /*fPostponeFail*/);
+    if (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED)
+    {
+        if (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE)
+            return iemMemBounceBufferCommitAndUnmap(pVCpu, iMemMap, false /*fPostponeFail*/);
     }
     /* Otherwise unlock it. */
     else
-        PGMPhysReleasePageMappingLock(IEMCPU_TO_VM(pIemCpu), &pIemCpu->aMemMappingLocks[iMemMap].Lock);
+        PGMPhysReleasePageMappingLock(pVCpu->CTX_SUFF(pVM), &pVCpu->iem.s.aMemMappingLocks[iMemMap].Lock);
 
     /* Free the entry. */
-    pIemCpu->aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
-    Assert(pIemCpu->cActiveMappings != 0);
-    pIemCpu->cActiveMappings--;
+    pVCpu->iem.s.aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
+    Assert(pVCpu->iem.s.cActiveMappings != 0);
+    pVCpu->iem.s.cActiveMappings--;
     return VINF_SUCCESS;
 }
@@ -7731 +7734 @@
  * @returns Pointer to the mapped memory.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   cbMem               The number of bytes to map.  This is usually 1,
  *                              2, 4, 6, 8, 12, 16, 32 or 512.  When used by
@@ -7746 +7749 @@
  *                              exceptions.
  */
-IEM_STATIC void *iemMemMapJmp(PIEMCPU pIemCpu, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t fAccess)
+IEM_STATIC void *iemMemMapJmp(PVMCPU pVCpu, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t fAccess)
 {
     /*
@@ -7753 +7756 @@
     Assert(cbMem <= 64 || cbMem == 512 || cbMem == 108 || cbMem == 104 || cbMem == 94); /* 512 is the max! */
     Assert(~(fAccess & ~(IEM_ACCESS_TYPE_MASK | IEM_ACCESS_WHAT_MASK)));
-    Assert(pIemCpu->cActiveMappings < RT_ELEMENTS(pIemCpu->aMemMappings));
-
-    unsigned iMemMap = pIemCpu->iNextMapping;
-    if (   iMemMap >= RT_ELEMENTS(pIemCpu->aMemMappings)
-        || pIemCpu->aMemMappings[iMemMap].fAccess != IEM_ACCESS_INVALID)
-    {
-        iMemMap = iemMemMapFindFree(pIemCpu);
-        AssertLogRelMsgStmt(iMemMap < RT_ELEMENTS(pIemCpu->aMemMappings),
-                            ("active=%d fAccess[0] = {%#x, %#x, %#x}\n", pIemCpu->cActiveMappings,
-                             pIemCpu->aMemMappings[0].fAccess, pIemCpu->aMemMappings[1].fAccess,
-                             pIemCpu->aMemMappings[2].fAccess),
-                            longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VERR_IEM_IPE_9));
+    Assert(pVCpu->iem.s.cActiveMappings < RT_ELEMENTS(pVCpu->iem.s.aMemMappings));
+
+    unsigned iMemMap = pVCpu->iem.s.iNextMapping;
+    if (   iMemMap >= RT_ELEMENTS(pVCpu->iem.s.aMemMappings)
+        || pVCpu->iem.s.aMemMappings[iMemMap].fAccess != IEM_ACCESS_INVALID)
+    {
+        iMemMap = iemMemMapFindFree(pVCpu);
+        AssertLogRelMsgStmt(iMemMap < RT_ELEMENTS(pVCpu->iem.s.aMemMappings),
+                            ("active=%d fAccess[0] = {%#x, %#x, %#x}\n", pVCpu->iem.s.cActiveMappings,
+                             pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemMappings[1].fAccess,
+                             pVCpu->iem.s.aMemMappings[2].fAccess),
+                            longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VERR_IEM_IPE_9));
     }
 
@@ -7771 +7774 @@
      * slightly complicated happens, fall back on bounce buffering.
      */
-    VBOXSTRICTRC rcStrict = iemMemApplySegment(pIemCpu, fAccess, iSegReg, cbMem, &GCPtrMem);
+    VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, fAccess, iSegReg, cbMem, &GCPtrMem);
     if (rcStrict == VINF_SUCCESS) { /*likely*/ }
-    else longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+    else longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
 
     /* Crossing a page boundary? */
@@ -7781 +7784 @@
     {
         void *pvMem;
-        VBOXSTRICTRC rcStrict = iemMemBounceBufferMapCrossPage(pIemCpu, iMemMap, &pvMem, cbMem, GCPtrMem, fAccess);
+        VBOXSTRICTRC rcStrict = iemMemBounceBufferMapCrossPage(pVCpu, iMemMap, &pvMem, cbMem, GCPtrMem, fAccess);
         if (rcStrict == VINF_SUCCESS)
             return pvMem;
-        longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+        longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
     }
 
     RTGCPHYS GCPhysFirst;
-    rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrMem, fAccess, &GCPhysFirst);
+    rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, fAccess, &GCPhysFirst);
     if (rcStrict == VINF_SUCCESS) { /*likely*/ }
-    else longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+    else longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
 
     if (fAccess & IEM_ACCESS_TYPE_WRITE)
@@ -7798 +7801 @@
 
     void *pvMem;
-    rcStrict = iemMemPageMap(pIemCpu, GCPhysFirst, fAccess, &pvMem, &pIemCpu->aMemMappingLocks[iMemMap].Lock);
+    rcStrict = iemMemPageMap(pVCpu, GCPhysFirst, fAccess, &pvMem, &pVCpu->iem.s.aMemMappingLocks[iMemMap].Lock);
     if (rcStrict == VINF_SUCCESS)
     { /* likely */ }
@@ -7804 +7807 @@
     {
         void *pvMem;
-        rcStrict = iemMemBounceBufferMapPhys(pIemCpu, iMemMap, &pvMem, cbMem, GCPhysFirst, fAccess, rcStrict);
+        rcStrict = iemMemBounceBufferMapPhys(pVCpu, iMemMap, &pvMem, cbMem, GCPhysFirst, fAccess, rcStrict);
         if (rcStrict == VINF_SUCCESS)
             return pvMem;
-        longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+        longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
     }
 
@@ -7813 +7816 @@
      * Fill in the mapping table entry.
      */
-    pIemCpu->aMemMappings[iMemMap].pv      = pvMem;
-    pIemCpu->aMemMappings[iMemMap].fAccess = fAccess;
-    pIemCpu->iNextMapping = iMemMap + 1;
-    pIemCpu->cActiveMappings++;
-
-    iemMemUpdateWrittenCounter(pIemCpu, fAccess, cbMem);
+    pVCpu->iem.s.aMemMappings[iMemMap].pv      = pvMem;
+    pVCpu->iem.s.aMemMappings[iMemMap].fAccess = fAccess;
+    pVCpu->iem.s.iNextMapping = iMemMap + 1;
+    pVCpu->iem.s.cActiveMappings++;
+
+    iemMemUpdateWrittenCounter(pVCpu, fAccess, cbMem);
     return pvMem;
 }
@@ -7826 +7829 @@
  * Commits the guest memory if bounce buffered and unmaps it, longjmp on error.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pvMem               The mapping.
  * @param   fAccess             The kind of access.
  */
-IEM_STATIC void iemMemCommitAndUnmapJmp(PIEMCPU pIemCpu, void *pvMem, uint32_t fAccess)
-{
-    int iMemMap = iemMapLookup(pIemCpu, pvMem, fAccess);
-    AssertStmt(iMemMap >= 0, longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), iMemMap));
+IEM_STATIC void iemMemCommitAndUnmapJmp(PVMCPU pVCpu, void *pvMem, uint32_t fAccess)
+{
+    int iMemMap = iemMapLookup(pVCpu, pvMem, fAccess);
+    AssertStmt(iMemMap >= 0, longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), iMemMap));
 
     /* If it's bounce buffered, we may need to write back the buffer. */
-    if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED)
-    {
-        if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE)
+    if (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED)
+    {
+        if (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE)
         {
-            VBOXSTRICTRC rcStrict = iemMemBounceBufferCommitAndUnmap(pIemCpu, iMemMap, false /*fPostponeFail*/);
+            VBOXSTRICTRC rcStrict = iemMemBounceBufferCommitAndUnmap(pVCpu, iMemMap, false /*fPostponeFail*/);
             if (rcStrict == VINF_SUCCESS)
                 return;
-            longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+            longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
         }
     }
     /* Otherwise unlock it. */
     else
-        PGMPhysReleasePageMappingLock(IEMCPU_TO_VM(pIemCpu), &pIemCpu->aMemMappingLocks[iMemMap].Lock);
+        PGMPhysReleasePageMappingLock(pVCpu->CTX_SUFF(pVM), &pVCpu->iem.s.aMemMappingLocks[iMemMap].Lock);
 
     /* Free the entry. */
-    pIemCpu->aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
-    Assert(pIemCpu->cActiveMappings != 0);
-    pIemCpu->cActiveMappings--;
+    pVCpu->iem.s.aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
+    Assert(pVCpu->iem.s.cActiveMappings != 0);
+    pVCpu->iem.s.cActiveMappings--;
 }
 
@@ -7868 +7871 @@
  * @returns VBox status code (no strict statuses).  Caller must check
  *          VMCPU_FF_IEM before repeating string instructions and similar stuff.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pvMem               The mapping.
  * @param   fAccess             The kind of access.
  */
-IEM_STATIC VBOXSTRICTRC iemMemCommitAndUnmapPostponeTroubleToR3(PIEMCPU pIemCpu, void *pvMem, uint32_t fAccess)
-{
-    int iMemMap = iemMapLookup(pIemCpu, pvMem, fAccess);
+IEM_STATIC VBOXSTRICTRC iemMemCommitAndUnmapPostponeTroubleToR3(PVMCPU pVCpu, void *pvMem, uint32_t fAccess)
+{
+    int iMemMap = iemMapLookup(pVCpu, pvMem, fAccess);
     AssertReturn(iMemMap >= 0, iMemMap);
 
     /* If it's bounce buffered, we may need to write back the buffer. */
-    if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED)
-    {
-        if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE)
-            return iemMemBounceBufferCommitAndUnmap(pIemCpu, iMemMap, true /*fPostponeFail*/);
+    if (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED)
+    {
+        if (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE)
+            return iemMemBounceBufferCommitAndUnmap(pVCpu, iMemMap, true /*fPostponeFail*/);
     }
     /* Otherwise unlock it. */
     else
-        PGMPhysReleasePageMappingLock(IEMCPU_TO_VM(pIemCpu), &pIemCpu->aMemMappingLocks[iMemMap].Lock);
+        PGMPhysReleasePageMappingLock(pVCpu->CTX_SUFF(pVM), &pVCpu->iem.s.aMemMappingLocks[iMemMap].Lock);
 
     /* Free the entry. */
-    pIemCpu->aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
-    Assert(pIemCpu->cActiveMappings != 0);
-    pIemCpu->cActiveMappings--;
+    pVCpu->iem.s.aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
+    Assert(pVCpu->iem.s.cActiveMappings != 0);
+    pVCpu->iem.s.cActiveMappings--;
     return VINF_SUCCESS;
 }
@@ -7902 +7905 @@
  *
  * @returns Strict VBox status code to pass up.
- * @param   pIemCpu     The IEM per CPU data.
- */
-IEM_STATIC void iemMemRollback(PIEMCPU pIemCpu)
-{
-    Assert(pIemCpu->cActiveMappings > 0);
-
-    uint32_t iMemMap = RT_ELEMENTS(pIemCpu->aMemMappings);
+ * @param   pVCpu       The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemMemRollback(PVMCPU pVCpu)
+{
+    Assert(pVCpu->iem.s.cActiveMappings > 0);
+
+    uint32_t iMemMap = RT_ELEMENTS(pVCpu->iem.s.aMemMappings);
     while (iMemMap-- > 0)
     {
-        uint32_t fAccess = pIemCpu->aMemMappings[iMemMap].fAccess;
+        uint32_t fAccess = pVCpu->iem.s.aMemMappings[iMemMap].fAccess;
         if (fAccess != IEM_ACCESS_INVALID)
         {
             AssertMsg(!(fAccess & ~IEM_ACCESS_VALID_MASK) && fAccess != 0, ("%#x\n", fAccess));
-            pIemCpu->aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
+            pVCpu->iem.s.aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
             if (!(fAccess & IEM_ACCESS_BOUNCE_BUFFERED))
-                PGMPhysReleasePageMappingLock(IEMCPU_TO_VM(pIemCpu), &pIemCpu->aMemMappingLocks[iMemMap].Lock);
-            Assert(pIemCpu->cActiveMappings > 0);
-            pIemCpu->cActiveMappings--;
+                PGMPhysReleasePageMappingLock(pVCpu->CTX_SUFF(pVM), &pVCpu->iem.s.aMemMappingLocks[iMemMap].Lock);
+            Assert(pVCpu->iem.s.cActiveMappings > 0);
+            pVCpu->iem.s.cActiveMappings--;
         }
     }
@@ -7929 +7932 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu8Dst              Where to return the byte.
  * @param   iSegReg             The index of the segment register to use for
@@ -7935 +7938 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataU8(PIEMCPU pIemCpu, uint8_t *pu8Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataU8(PVMCPU pVCpu, uint8_t *pu8Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     uint8_t const *pu8Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu8Src, sizeof(*pu8Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu8Src, sizeof(*pu8Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     if (rc == VINF_SUCCESS)
     {
         *pu8Dst = *pu8Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu8Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu8Src, IEM_ACCESS_DATA_R);
     }
     return rc;
@@ -7954 +7957 @@
  *
  * @returns The byte.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
  * @param   GCPtrMem            The address of the guest memory.
  */
-DECL_NO_INLINE(IEM_STATIC, uint8_t) iemMemFetchDataU8Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
+DECL_NO_INLINE(IEM_STATIC, uint8_t) iemMemFetchDataU8Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
-    uint8_t const *pu8Src = (uint8_t const *)iemMemMapJmp(pIemCpu, sizeof(*pu8Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    uint8_t const *pu8Src = (uint8_t const *)iemMemMapJmp(pVCpu, sizeof(*pu8Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     uint8_t const  bRet   = *pu8Src;
-    iemMemCommitAndUnmapJmp(pIemCpu, (void *)pu8Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, (void *)pu8Src, IEM_ACCESS_DATA_R);
     return bRet;
 }
@@ -7974 +7977 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu16Dst             Where to return the word.
  * @param   iSegReg             The index of the segment register to use for
@@ -7980 +7983 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataU16(PIEMCPU pIemCpu, uint16_t *pu16Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataU16(PVMCPU pVCpu, uint16_t *pu16Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     uint16_t const *pu16Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu16Src, sizeof(*pu16Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu16Src, sizeof(*pu16Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     if (rc == VINF_SUCCESS)
     {
         *pu16Dst = *pu16Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu16Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu16Src, IEM_ACCESS_DATA_R);
     }
     return rc;
@@ -7999 +8002 @@
  *
  * @returns The word
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
  * @param   GCPtrMem            The address of the guest memory.
  */
-DECL_NO_INLINE(IEM_STATIC, uint16_t) iemMemFetchDataU16Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
+DECL_NO_INLINE(IEM_STATIC, uint16_t) iemMemFetchDataU16Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
-    uint16_t const *pu16Src = (uint16_t const *)iemMemMapJmp(pIemCpu, sizeof(*pu16Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    uint16_t const *pu16Src = (uint16_t const *)iemMemMapJmp(pVCpu, sizeof(*pu16Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     uint16_t const u16Ret = *pu16Src;
-    iemMemCommitAndUnmapJmp(pIemCpu, (void *)pu16Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, (void *)pu16Src, IEM_ACCESS_DATA_R);
     return u16Ret;
 }
@@ -8019 +8022 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32Dst             Where to return the dword.
  * @param   iSegReg             The index of the segment register to use for
@@ -8025 +8028 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataU32(PIEMCPU pIemCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataU32(PVMCPU pVCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     uint32_t const *pu32Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu32Src, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Src, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     if (rc == VINF_SUCCESS)
     {
         *pu32Dst = *pu32Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu32Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu32Src, IEM_ACCESS_DATA_R);
     }
     return rc;
@@ -8041 +8044 @@
 #ifdef IEM_WITH_SETJMP
 
-IEM_STATIC RTGCPTR iemMemApplySegmentToReadJmp(PIEMCPU pIemCpu, uint8_t iSegReg, size_t cbMem, RTGCPTR GCPtrMem)
+IEM_STATIC RTGCPTR iemMemApplySegmentToReadJmp(PVMCPU pVCpu, uint8_t iSegReg, size_t cbMem, RTGCPTR GCPtrMem)
 {
     Assert(cbMem >= 1);
@@ -8049 +8052 @@
      * 64-bit mode is simpler.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         if (iSegReg >= X86_SREG_FS)
         {
-            PCPUMSELREGHID pSel = iemSRegGetHid(pIemCpu, iSegReg);
+            PCPUMSELREGHID pSel = iemSRegGetHid(pVCpu, iSegReg);
             GCPtrMem += pSel->u64Base;
         }
@@ -8065 +8068 @@
     else
     {
-        PCPUMSELREGHID pSel   = iemSRegGetHid(pIemCpu, iSegReg);
+        PCPUMSELREGHID pSel   = iemSRegGetHid(pVCpu, iSegReg);
         if (      (pSel->Attr.u & (X86DESCATTR_P | X86DESCATTR_UNUSABLE | X86_SEL_TYPE_CODE | X86_SEL_TYPE_DOWN))
                == X86DESCATTR_P /* data, expand up */
@@ -8088 +8091 @@
         }
         else
-            iemRaiseSelectorInvalidAccessJmp(pIemCpu, iSegReg, IEM_ACCESS_DATA_R);
-        iemRaiseSelectorBoundsJmp(pIemCpu, iSegReg, IEM_ACCESS_DATA_R);
-    }
-    iemRaiseGeneralProtectionFault0Jmp(pIemCpu);
+            iemRaiseSelectorInvalidAccessJmp(pVCpu, iSegReg, IEM_ACCESS_DATA_R);
+        iemRaiseSelectorBoundsJmp(pVCpu, iSegReg, IEM_ACCESS_DATA_R);
+    }
+    iemRaiseGeneralProtectionFault0Jmp(pVCpu);
 }
 
@@ -8099 +8102 @@
  *
  * @returns The dword
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC uint32_t iemMemFetchDataU32SafeJmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
-{
-    uint32_t const *pu32Src = (uint32_t const *)iemMemMapJmp(pIemCpu, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+IEM_STATIC uint32_t iemMemFetchDataU32SafeJmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
+{
+    uint32_t const *pu32Src = (uint32_t const *)iemMemMapJmp(pVCpu, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     uint32_t const  u32Ret  = *pu32Src;
-    iemMemCommitAndUnmapJmp(pIemCpu, (void *)pu32Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, (void *)pu32Src, IEM_ACCESS_DATA_R);
     return u32Ret;
 }
@@ -8117 +8120 @@
  *
  * @returns The dword
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
  * @param   GCPtrMem            The address of the guest memory.
  */
-DECL_NO_INLINE(IEM_STATIC, uint32_t) iemMemFetchDataU32Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
+DECL_NO_INLINE(IEM_STATIC, uint32_t) iemMemFetchDataU32Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
 # ifdef IEM_WITH_DATA_TLB
-    RTGCPTR GCPtrEff = iemMemApplySegmentToReadJmp(pIemCpu, iSegReg, sizeof(uint32_t), GCPtrMem);
+    RTGCPTR GCPtrEff = iemMemApplySegmentToReadJmp(pVCpu, iSegReg, sizeof(uint32_t), GCPtrMem);
     if (RT_LIKELY((GCPtrEff & X86_PAGE_OFFSET_MASK) <= X86_PAGE_SIZE - sizeof(uint32_t)))
     {
@@ -8131 +8134 @@
     }
 
-    return iemMemFetchDataU32SafeJmp(pIemCpu, iSegReg, GCPtrMem);
+    return iemMemFetchDataU32SafeJmp(pVCpu, iSegReg, GCPtrMem);
 # else
     /* The lazy approach. */
-    uint32_t const *pu32Src = (uint32_t const *)iemMemMapJmp(pIemCpu, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    uint32_t const *pu32Src = (uint32_t const *)iemMemMapJmp(pVCpu, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     uint32_t const  u32Ret  = *pu32Src;
-    iemMemCommitAndUnmapJmp(pIemCpu, (void *)pu32Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, (void *)pu32Src, IEM_ACCESS_DATA_R);
     return u32Ret;
 # endif
@@ -8148 +8151 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64Dst             Where to return the sign extended value.
  * @param   iSegReg             The index of the segment register to use for
@@ -8154 +8157 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataS32SxU64(PIEMCPU pIemCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataS32SxU64(PVMCPU pVCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     int32_t const *pi32Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pi32Src, sizeof(*pi32Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pi32Src, sizeof(*pi32Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = *pi32Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pi32Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pi32Src, IEM_ACCESS_DATA_R);
     }
 #ifdef __GNUC__ /* warning: GCC may be a royal pain */
@@ -8177 +8180 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64Dst             Where to return the qword.
  * @param   iSegReg             The index of the segment register to use for
@@ -8183 +8186 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataU64(PIEMCPU pIemCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataU64(PVMCPU pVCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     uint64_t const *pu64Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu64Src, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu64Src, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = *pu64Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu64Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu64Src, IEM_ACCESS_DATA_R);
     }
     return rc;
@@ -8202 +8205 @@
  *
  * @returns The qword.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
  * @param   GCPtrMem            The address of the guest memory.
  */
-DECL_NO_INLINE(IEM_STATIC, uint64_t) iemMemFetchDataU64Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
+DECL_NO_INLINE(IEM_STATIC, uint64_t) iemMemFetchDataU64Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
-    uint64_t const *pu64Src = (uint64_t const *)iemMemMapJmp(pIemCpu, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    uint64_t const *pu64Src = (uint64_t const *)iemMemMapJmp(pVCpu, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     uint64_t const u64Ret = *pu64Src;
-    iemMemCommitAndUnmapJmp(pIemCpu, (void *)pu64Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, (void *)pu64Src, IEM_ACCESS_DATA_R);
     return u64Ret;
 }
@@ -8222 +8225 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64Dst             Where to return the qword.
  * @param   iSegReg             The index of the segment register to use for
@@ -8228 +8231 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataU64AlignedU128(PIEMCPU pIemCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataU64AlignedU128(PVMCPU pVCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     /** @todo testcase: Ordering of \#SS(0) vs \#GP() vs \#PF on SSE stuff. */
     if (RT_UNLIKELY(GCPtrMem & 15))
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
 
     uint64_t const *pu64Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu64Src, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu64Src, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = *pu64Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu64Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu64Src, IEM_ACCESS_DATA_R);
     }
     return rc;
@@ -8251 +8254 @@
  *
  * @returns The qword.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
  * @param   GCPtrMem            The address of the guest memory.
  */
-DECL_NO_INLINE(IEM_STATIC, uint64_t) iemMemFetchDataU64AlignedU128Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
+DECL_NO_INLINE(IEM_STATIC, uint64_t) iemMemFetchDataU64AlignedU128Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
@@ -8262 +8265 @@
     if (RT_LIKELY(!(GCPtrMem & 15)))
     {
-        uint64_t const *pu64Src = (uint64_t const *)iemMemMapJmp(pIemCpu, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+        uint64_t const *pu64Src = (uint64_t const *)iemMemMapJmp(pVCpu, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
         uint64_t const u64Ret = *pu64Src;
-        iemMemCommitAndUnmapJmp(pIemCpu, (void *)pu64Src, IEM_ACCESS_DATA_R);
+        iemMemCommitAndUnmapJmp(pVCpu, (void *)pu64Src, IEM_ACCESS_DATA_R);
         return u64Ret;
     }
 
-    VBOXSTRICTRC rc = iemRaiseGeneralProtectionFault0(pIemCpu);
-    longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rc));
+    VBOXSTRICTRC rc = iemRaiseGeneralProtectionFault0(pVCpu);
+    longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rc));
 }
 #endif
@@ -8278 +8281 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pr80Dst             Where to return the tword.
  * @param   iSegReg             The index of the segment register to use for
@@ -8284 +8287 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataR80(PIEMCPU pIemCpu, PRTFLOAT80U pr80Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataR80(PVMCPU pVCpu, PRTFLOAT80U pr80Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     PCRTFLOAT80U pr80Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pr80Src, sizeof(*pr80Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pr80Src, sizeof(*pr80Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     if (rc == VINF_SUCCESS)
     {
         *pr80Dst = *pr80Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pr80Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pr80Src, IEM_ACCESS_DATA_R);
     }
     return rc;
@@ -8302 +8305 @@
  * Fetches a data tword, longjmp on error.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pr80Dst             Where to return the tword.
  * @param   iSegReg             The index of the segment register to use for
@@ -8308 +8311 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-DECL_NO_INLINE(IEM_STATIC, void) iemMemFetchDataR80Jmp(PIEMCPU pIemCpu, PRTFLOAT80U pr80Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+DECL_NO_INLINE(IEM_STATIC, void) iemMemFetchDataR80Jmp(PVMCPU pVCpu, PRTFLOAT80U pr80Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
-    PCRTFLOAT80U pr80Src = (PCRTFLOAT80U)iemMemMapJmp(pIemCpu, sizeof(*pr80Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    PCRTFLOAT80U pr80Src = (PCRTFLOAT80U)iemMemMapJmp(pVCpu, sizeof(*pr80Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     *pr80Dst = *pr80Src;
-    iemMemCommitAndUnmapJmp(pIemCpu, (void *)pr80Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, (void *)pr80Src, IEM_ACCESS_DATA_R);
 }
 #endif
@@ -8322 +8325 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu128Dst            Where to return the qword.
  * @param   iSegReg             The index of the segment register to use for
@@ -8328 +8331 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataU128(PIEMCPU pIemCpu, uint128_t *pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataU128(PVMCPU pVCpu, uint128_t *pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     uint128_t const *pu128Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu128Src, sizeof(*pu128Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu128Src, sizeof(*pu128Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     if (rc == VINF_SUCCESS)
     {
         *pu128Dst = *pu128Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
     }
     return rc;
@@ -8346 +8349 @@
  * Fetches a data dqword (double qword), generally SSE related.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu128Dst            Where to return the qword.
  * @param   iSegReg             The index of the segment register to use for
@@ -8352 +8355 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC void iemMemFetchDataU128Jmp(PIEMCPU pIemCpu, uint128_t *pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC void iemMemFetchDataU128Jmp(PVMCPU pVCpu, uint128_t *pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
-    uint128_t const *pu128Src = (uint128_t const *)iemMemMapJmp(pIemCpu, sizeof(*pu128Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    uint128_t const *pu128Src = (uint128_t const *)iemMemMapJmp(pVCpu, sizeof(*pu128Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     *pu128Dst = *pu128Src;
-    iemMemCommitAndUnmapJmp(pIemCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
 }
 #endif
@@ -8369 +8372 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu128Dst            Where to return the qword.
  * @param   iSegReg             The index of the segment register to use for
@@ -8375 +8378 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataU128AlignedSse(PIEMCPU pIemCpu, uint128_t *pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataU128AlignedSse(PVMCPU pVCpu, uint128_t *pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     /** @todo testcase: Ordering of \#SS(0) vs \#GP() vs \#PF on SSE stuff. */
     if (   (GCPtrMem & 15)
-        && !(pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.MXCSR & X86_MXSCR_MM)) /** @todo should probably check this *after* applying seg.u64Base... Check real HW. */
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        && !(pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.MXCSR & X86_MXSCR_MM)) /** @todo should probably check this *after* applying seg.u64Base... Check real HW. */
+        return iemRaiseGeneralProtectionFault0(pVCpu);
 
     uint128_t const *pu128Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu128Src, sizeof(*pu128Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu128Src, sizeof(*pu128Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R);
     if (rc == VINF_SUCCESS)
     {
         *pu128Dst = *pu128Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
     }
     return rc;
@@ -8401 +8404 @@
  * Raises \#GP(0) if not aligned.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu128Dst            Where to return the qword.
  * @param   iSegReg             The index of the segment register to use for
@@ -8407 +8410 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-DECL_NO_INLINE(IEM_STATIC, void) iemMemFetchDataU128AlignedSseJmp(PIEMCPU pIemCpu, uint128_t *pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+DECL_NO_INLINE(IEM_STATIC, void) iemMemFetchDataU128AlignedSseJmp(PVMCPU pVCpu, uint128_t *pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     /** @todo testcase: Ordering of \#SS(0) vs \#GP() vs \#PF on SSE stuff. */
     if (   (GCPtrMem & 15) == 0
-        || (pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.MXCSR & X86_MXSCR_MM)) /** @todo should probably check this *after* applying seg.u64Base... Check real HW. */
-    {
-        uint128_t const *pu128Src = (uint128_t const *)iemMemMapJmp(pIemCpu, sizeof(*pu128Src), iSegReg, GCPtrMem,
+        || (pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.MXCSR & X86_MXSCR_MM)) /** @todo should probably check this *after* applying seg.u64Base... Check real HW. */
+    {
+        uint128_t const *pu128Src = (uint128_t const *)iemMemMapJmp(pVCpu, sizeof(*pu128Src), iSegReg, GCPtrMem,
                                                                     IEM_ACCESS_DATA_R);
         *pu128Dst = *pu128Src;
-        iemMemCommitAndUnmapJmp(pIemCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
+        iemMemCommitAndUnmapJmp(pVCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
         return;
     }
 
-    VBOXSTRICTRC rcStrict = iemRaiseGeneralProtectionFault0(pIemCpu);
-    longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+    VBOXSTRICTRC rcStrict = iemRaiseGeneralProtectionFault0(pVCpu);
+    longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
 }
 #endif
@@ -8432 +8435 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pcbLimit            Where to return the limit.
  * @param   pGCPtrBase          Where to return the base.
@@ -8440 +8443 @@
  * @param   enmOpSize           The effective operand size.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchDataXdtr(PIEMCPU pIemCpu, uint16_t *pcbLimit, PRTGCPTR pGCPtrBase, uint8_t iSegReg,
+IEM_STATIC VBOXSTRICTRC iemMemFetchDataXdtr(PVMCPU pVCpu, uint16_t *pcbLimit, PRTGCPTR pGCPtrBase, uint8_t iSegReg,
                                             RTGCPTR GCPtrMem, IEMMODE enmOpSize)
 {
@@ -8455 +8458 @@
      */
     VBOXSTRICTRC rcStrict;
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-    {
-        rcStrict = iemMemFetchDataU16(pIemCpu, pcbLimit, iSegReg, GCPtrMem);
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+    {
+        rcStrict = iemMemFetchDataU16(pVCpu, pcbLimit, iSegReg, GCPtrMem);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemFetchDataU64(pIemCpu, pGCPtrBase, iSegReg, GCPtrMem + 2);
+            rcStrict = iemMemFetchDataU64(pVCpu, pGCPtrBase, iSegReg, GCPtrMem + 2);
     }
     else
@@ -8466 +8469 @@
         if (enmOpSize == IEMMODE_32BIT)
         {
-            if (IEM_GET_TARGET_CPU(pIemCpu) != IEMTARGETCPU_486)
+            if (IEM_GET_TARGET_CPU(pVCpu) != IEMTARGETCPU_486)
             {
-                rcStrict = iemMemFetchDataU16(pIemCpu, pcbLimit, iSegReg, GCPtrMem);
+                rcStrict = iemMemFetchDataU16(pVCpu, pcbLimit, iSegReg, GCPtrMem);
                 if (rcStrict == VINF_SUCCESS)
-                    rcStrict = iemMemFetchDataU32(pIemCpu, &uTmp, iSegReg, GCPtrMem + 2);
+                    rcStrict = iemMemFetchDataU32(pVCpu, &uTmp, iSegReg, GCPtrMem + 2);
             }
             else
             {
-                rcStrict = iemMemFetchDataU32(pIemCpu, &uTmp, iSegReg, GCPtrMem);
+                rcStrict = iemMemFetchDataU32(pVCpu, &uTmp, iSegReg, GCPtrMem);
                 if (rcStrict == VINF_SUCCESS)
                 {
                     *pcbLimit = (uint16_t)uTmp;
-                    rcStrict = iemMemFetchDataU32(pIemCpu, &uTmp, iSegReg, GCPtrMem + 2);
+                    rcStrict = iemMemFetchDataU32(pVCpu, &uTmp, iSegReg, GCPtrMem + 2);
                 }
             }
@@ -8486 +8489 @@
         else
         {
-            rcStrict = iemMemFetchDataU16(pIemCpu, pcbLimit, iSegReg, GCPtrMem);
+            rcStrict = iemMemFetchDataU16(pVCpu, pcbLimit, iSegReg, GCPtrMem);
             if (rcStrict == VINF_SUCCESS)
             {
-                rcStrict = iemMemFetchDataU32(pIemCpu, &uTmp, iSegReg, GCPtrMem + 2);
+                rcStrict = iemMemFetchDataU32(pVCpu, &uTmp, iSegReg, GCPtrMem + 2);
                 if (rcStrict == VINF_SUCCESS)
                     *pGCPtrBase = uTmp & UINT32_C(0x00ffffff);
@@ -8504 +8507 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8510 +8513 @@
  * @param   u8Value             The value to store.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStoreDataU8(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint8_t u8Value)
+IEM_STATIC VBOXSTRICTRC iemMemStoreDataU8(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint8_t u8Value)
 {
     /* The lazy approach for now... */
     uint8_t *pu8Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu8Dst, sizeof(*pu8Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu8Dst, sizeof(*pu8Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     if (rc == VINF_SUCCESS)
     {
         *pu8Dst = u8Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu8Dst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu8Dst, IEM_ACCESS_DATA_W);
     }
     return rc;
@@ -8528 +8531 @@
  * Stores a data byte, longjmp on error.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8534 +8537 @@
  * @param   u8Value             The value to store.
  */
-IEM_STATIC void iemMemStoreDataU8Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint8_t u8Value)
+IEM_STATIC void iemMemStoreDataU8Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint8_t u8Value)
 {
     /* The lazy approach for now... */
-    uint8_t *pu8Dst = (uint8_t *)iemMemMapJmp(pIemCpu, sizeof(*pu8Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    uint8_t *pu8Dst = (uint8_t *)iemMemMapJmp(pVCpu, sizeof(*pu8Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     *pu8Dst = u8Value;
-    iemMemCommitAndUnmapJmp(pIemCpu, pu8Dst, IEM_ACCESS_DATA_W);
+    iemMemCommitAndUnmapJmp(pVCpu, pu8Dst, IEM_ACCESS_DATA_W);
 }
 #endif
@@ -8548 +8551 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8554 +8557 @@
  * @param   u16Value            The value to store.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStoreDataU16(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint16_t u16Value)
+IEM_STATIC VBOXSTRICTRC iemMemStoreDataU16(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint16_t u16Value)
 {
     /* The lazy approach for now... */
     uint16_t *pu16Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu16Dst, sizeof(*pu16Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu16Dst, sizeof(*pu16Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     if (rc == VINF_SUCCESS)
     {
         *pu16Dst = u16Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu16Dst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu16Dst, IEM_ACCESS_DATA_W);
     }
     return rc;
@@ -8572 +8575 @@
  * Stores a data word, longjmp on error.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8578 +8581 @@
  * @param   u16Value            The value to store.
  */
-IEM_STATIC void iemMemStoreDataU16Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint16_t u16Value)
+IEM_STATIC void iemMemStoreDataU16Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint16_t u16Value)
 {
     /* The lazy approach for now... */
-    uint16_t *pu16Dst = (uint16_t *)iemMemMapJmp(pIemCpu, sizeof(*pu16Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    uint16_t *pu16Dst = (uint16_t *)iemMemMapJmp(pVCpu, sizeof(*pu16Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     *pu16Dst = u16Value;
-    iemMemCommitAndUnmapJmp(pIemCpu, pu16Dst, IEM_ACCESS_DATA_W);
+    iemMemCommitAndUnmapJmp(pVCpu, pu16Dst, IEM_ACCESS_DATA_W);
 }
 #endif
@@ -8592 +8595 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8598 +8601 @@
  * @param   u32Value            The value to store.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStoreDataU32(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t u32Value)
+IEM_STATIC VBOXSTRICTRC iemMemStoreDataU32(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t u32Value)
 {
     /* The lazy approach for now... */
     uint32_t *pu32Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu32Dst, sizeof(*pu32Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Dst, sizeof(*pu32Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     if (rc == VINF_SUCCESS)
     {
         *pu32Dst = u32Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu32Dst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu32Dst, IEM_ACCESS_DATA_W);
     }
     return rc;
@@ -8617 +8620 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8623 +8626 @@
  * @param   u32Value            The value to store.
  */
-IEM_STATIC void iemMemStoreDataU32Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t u32Value)
+IEM_STATIC void iemMemStoreDataU32Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t u32Value)
 {
     /* The lazy approach for now... */
-    uint32_t *pu32Dst = (uint32_t *)iemMemMapJmp(pIemCpu, sizeof(*pu32Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    uint32_t *pu32Dst = (uint32_t *)iemMemMapJmp(pVCpu, sizeof(*pu32Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     *pu32Dst = u32Value;
-    iemMemCommitAndUnmapJmp(pIemCpu, pu32Dst, IEM_ACCESS_DATA_W);
+    iemMemCommitAndUnmapJmp(pVCpu, pu32Dst, IEM_ACCESS_DATA_W);
 }
 #endif
@@ -8637 +8640 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8643 +8646 @@
  * @param   u64Value            The value to store.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStoreDataU64(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint64_t u64Value)
+IEM_STATIC VBOXSTRICTRC iemMemStoreDataU64(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint64_t u64Value)
 {
     /* The lazy approach for now... */
     uint64_t *pu64Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu64Dst, sizeof(*pu64Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu64Dst, sizeof(*pu64Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = u64Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu64Dst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu64Dst, IEM_ACCESS_DATA_W);
     }
     return rc;
@@ -8661 +8664 @@
  * Stores a data qword, longjmp on error.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8667 +8670 @@
  * @param   u64Value            The value to store.
  */
-IEM_STATIC void iemMemStoreDataU64Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint64_t u64Value)
+IEM_STATIC void iemMemStoreDataU64Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint64_t u64Value)
 {
     /* The lazy approach for now... */
-    uint64_t *pu64Dst = (uint64_t *)iemMemMapJmp(pIemCpu, sizeof(*pu64Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    uint64_t *pu64Dst = (uint64_t *)iemMemMapJmp(pVCpu, sizeof(*pu64Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     *pu64Dst = u64Value;
-    iemMemCommitAndUnmapJmp(pIemCpu, pu64Dst, IEM_ACCESS_DATA_W);
+    iemMemCommitAndUnmapJmp(pVCpu, pu64Dst, IEM_ACCESS_DATA_W);
 }
 #endif
@@ -8681 +8684 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8687 +8690 @@
  * @param   u128Value            The value to store.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStoreDataU128(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint128_t u128Value)
+IEM_STATIC VBOXSTRICTRC iemMemStoreDataU128(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint128_t u128Value)
 {
     /* The lazy approach for now... */
     uint128_t *pu128Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu128Dst, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu128Dst, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     if (rc == VINF_SUCCESS)
     {
         *pu128Dst = u128Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu128Dst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_W);
     }
     return rc;
@@ -8705 +8708 @@
  * Stores a data dqword, longjmp on error.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8711 +8714 @@
  * @param   u128Value            The value to store.
  */
-IEM_STATIC void iemMemStoreDataU128Jmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint128_t u128Value)
+IEM_STATIC void iemMemStoreDataU128Jmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint128_t u128Value)
 {
     /* The lazy approach for now... */
-    uint128_t *pu128Dst = (uint128_t *)iemMemMapJmp(pIemCpu, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    uint128_t *pu128Dst = (uint128_t *)iemMemMapJmp(pVCpu, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     *pu128Dst = u128Value;
-    iemMemCommitAndUnmapJmp(pIemCpu, pu128Dst, IEM_ACCESS_DATA_W);
+    iemMemCommitAndUnmapJmp(pVCpu, pu128Dst, IEM_ACCESS_DATA_W);
 }
 #endif
@@ -8725 +8728 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8731 +8734 @@
  * @param   u128Value           The value to store.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStoreDataU128AlignedSse(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint128_t u128Value)
+IEM_STATIC VBOXSTRICTRC iemMemStoreDataU128AlignedSse(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint128_t u128Value)
 {
     /* The lazy approach for now... */
     if (   (GCPtrMem & 15)
-        && !(pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.MXCSR & X86_MXSCR_MM)) /** @todo should probably check this *after* applying seg.u64Base... Check real HW. */
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        && !(pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.MXCSR & X86_MXSCR_MM)) /** @todo should probably check this *after* applying seg.u64Base... Check real HW. */
+        return iemRaiseGeneralProtectionFault0(pVCpu);
 
     uint128_t *pu128Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu128Dst, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu128Dst, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
     if (rc == VINF_SUCCESS)
     {
         *pu128Dst = u128Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu128Dst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_W);
     }
     return rc;
@@ -8754 +8757 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   iSegReg             The index of the segment register to use for
  *                              this access.  The base and limits are checked.
@@ -8761 +8764 @@
  */
 DECL_NO_INLINE(IEM_STATIC, void)
-iemMemStoreDataU128AlignedSseJmp(PIEMCPU pIemCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint128_t u128Value)
+iemMemStoreDataU128AlignedSseJmp(PVMCPU pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, uint128_t u128Value)
 {
     /* The lazy approach for now... */
     if (   (GCPtrMem & 15) == 0
-        || (pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.MXCSR & X86_MXSCR_MM)) /** @todo should probably check this *after* applying seg.u64Base... Check real HW. */
-    {
-        uint128_t *pu128Dst = (uint128_t *)iemMemMapJmp(pIemCpu, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
+        || (pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.MXCSR & X86_MXSCR_MM)) /** @todo should probably check this *after* applying seg.u64Base... Check real HW. */
+    {
+        uint128_t *pu128Dst = (uint128_t *)iemMemMapJmp(pVCpu, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W);
         *pu128Dst = u128Value;
-        iemMemCommitAndUnmapJmp(pIemCpu, pu128Dst, IEM_ACCESS_DATA_W);
+        iemMemCommitAndUnmapJmp(pVCpu, pu128Dst, IEM_ACCESS_DATA_W);
         return;
     }
 
-    VBOXSTRICTRC rcStrict = iemRaiseGeneralProtectionFault0(pIemCpu);
-    longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
+    VBOXSTRICTRC rcStrict = iemRaiseGeneralProtectionFault0(pVCpu);
+    longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VBOXSTRICTRC_VAL(rcStrict));
 }
 #endif
@@ -8783 +8786 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   cbLimit             The limit.
  * @param   GCPtrBase           The base address.
@@ -8791 +8794 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemMemStoreDataXdtr(PIEMCPU pIemCpu, uint16_t cbLimit, RTGCPTR GCPtrBase, uint8_t iSegReg, RTGCPTR GCPtrMem)
+iemMemStoreDataXdtr(PVMCPU pVCpu, uint16_t cbLimit, RTGCPTR GCPtrBase, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /*
@@ -8797 +8800 @@
      * independent writes.  The instructions does not respond to opsize prefixes.
      */
-    VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pIemCpu, iSegReg, GCPtrMem, cbLimit);
+    VBOXSTRICTRC rcStrict = iemMemStoreDataU16(pVCpu, iSegReg, GCPtrMem, cbLimit);
     if (rcStrict == VINF_SUCCESS)
     {
-        if (pIemCpu->enmCpuMode == IEMMODE_16BIT)
-            rcStrict = iemMemStoreDataU32(pIemCpu, iSegReg, GCPtrMem + 2,
-                                          IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_286
+        if (pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT)
+            rcStrict = iemMemStoreDataU32(pVCpu, iSegReg, GCPtrMem + 2,
+                                          IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_286
                                           ? (uint32_t)GCPtrBase | UINT32_C(0xff000000) : (uint32_t)GCPtrBase);
-        else if (pIemCpu->enmCpuMode == IEMMODE_32BIT)
-            rcStrict = iemMemStoreDataU32(pIemCpu, iSegReg, GCPtrMem + 2, (uint32_t)GCPtrBase);
+        else if (pVCpu->iem.s.enmCpuMode == IEMMODE_32BIT)
+            rcStrict = iemMemStoreDataU32(pVCpu, iSegReg, GCPtrMem + 2, (uint32_t)GCPtrBase);
         else
-            rcStrict = iemMemStoreDataU64(pIemCpu, iSegReg, GCPtrMem + 2, GCPtrBase);
+            rcStrict = iemMemStoreDataU64(pVCpu, iSegReg, GCPtrMem + 2, GCPtrBase);
     }
     return rcStrict;
@@ -8817 +8820 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u16Value            The value to push.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPushU16(PIEMCPU pIemCpu, uint16_t u16Value)
+IEM_STATIC VBOXSTRICTRC iemMemStackPushU16(PVMCPU pVCpu, uint16_t u16Value)
 {
     /* Increment the stack pointer. */
     uint64_t    uNewRsp;
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pIemCpu, pCtx, 2, &uNewRsp);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pVCpu, pCtx, 2, &uNewRsp);
 
     /* Write the word the lazy way. */
     uint16_t *pu16Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu16Dst, sizeof(*pu16Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu16Dst, sizeof(*pu16Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
     if (rc == VINF_SUCCESS)
     {
         *pu16Dst = u16Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu16Dst, IEM_ACCESS_STACK_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu16Dst, IEM_ACCESS_STACK_W);
     }
 
@@ -8848 +8851 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u32Value            The value to push.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPushU32(PIEMCPU pIemCpu, uint32_t u32Value)
+IEM_STATIC VBOXSTRICTRC iemMemStackPushU32(PVMCPU pVCpu, uint32_t u32Value)
 {
     /* Increment the stack pointer. */
     uint64_t    uNewRsp;
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pIemCpu, pCtx, 4, &uNewRsp);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pVCpu, pCtx, 4, &uNewRsp);
 
     /* Write the dword the lazy way. */
     uint32_t *pu32Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu32Dst, sizeof(*pu32Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Dst, sizeof(*pu32Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
     if (rc == VINF_SUCCESS)
     {
         *pu32Dst = u32Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu32Dst, IEM_ACCESS_STACK_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu32Dst, IEM_ACCESS_STACK_W);
     }
 
@@ -8879 +8882 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u32Value            The value to push.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPushU32SReg(PIEMCPU pIemCpu, uint32_t u32Value)
+IEM_STATIC VBOXSTRICTRC iemMemStackPushU32SReg(PVMCPU pVCpu, uint32_t u32Value)
 {
     /* Increment the stack pointer. */
     uint64_t    uNewRsp;
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pIemCpu, pCtx, 4, &uNewRsp);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pVCpu, pCtx, 4, &uNewRsp);
 
     VBOXSTRICTRC rc;
-    if (IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+    if (IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
     {
         /* The recompiler writes a full dword. */
         uint32_t *pu32Dst;
-        rc = iemMemMap(pIemCpu, (void **)&pu32Dst, sizeof(*pu32Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
+        rc = iemMemMap(pVCpu, (void **)&pu32Dst, sizeof(*pu32Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
         if (rc == VINF_SUCCESS)
         {
             *pu32Dst = u32Value;
-            rc = iemMemCommitAndUnmap(pIemCpu, pu32Dst, IEM_ACCESS_STACK_W);
+            rc = iemMemCommitAndUnmap(pVCpu, pu32Dst, IEM_ACCESS_STACK_W);
         }
     }
@@ -8914 +8917 @@
          * ancient hardware when it actually did change. */
         uint16_t *pu16Dst;
-        rc = iemMemMap(pIemCpu, (void **)&pu16Dst, sizeof(uint32_t), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_RW);
+        rc = iemMemMap(pVCpu, (void **)&pu16Dst, sizeof(uint32_t), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_RW);
         if (rc == VINF_SUCCESS)
         {
             *pu16Dst = (uint16_t)u32Value;
-            rc = iemMemCommitAndUnmap(pIemCpu, pu16Dst, IEM_ACCESS_STACK_RW);
+            rc = iemMemCommitAndUnmap(pVCpu, pu16Dst, IEM_ACCESS_STACK_RW);
         }
     }
@@ -8934 +8937 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u64Value            The value to push.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPushU64(PIEMCPU pIemCpu, uint64_t u64Value)
+IEM_STATIC VBOXSTRICTRC iemMemStackPushU64(PVMCPU pVCpu, uint64_t u64Value)
 {
     /* Increment the stack pointer. */
     uint64_t    uNewRsp;
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pIemCpu, pCtx, 8, &uNewRsp);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pVCpu, pCtx, 8, &uNewRsp);
 
     /* Write the word the lazy way. */
     uint64_t *pu64Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu64Dst, sizeof(*pu64Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu64Dst, sizeof(*pu64Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = u64Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu64Dst, IEM_ACCESS_STACK_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu64Dst, IEM_ACCESS_STACK_W);
     }
 
@@ -8965 +8968 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu16Value           Where to store the popped value.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopU16(PIEMCPU pIemCpu, uint16_t *pu16Value)
+IEM_STATIC VBOXSTRICTRC iemMemStackPopU16(PVMCPU pVCpu, uint16_t *pu16Value)
 {
     /* Increment the stack pointer. */
     uint64_t    uNewRsp;
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPop(pIemCpu, pCtx, 2, &uNewRsp);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPop(pVCpu, pCtx, 2, &uNewRsp);
 
     /* Write the word the lazy way. */
     uint16_t const *pu16Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu16Src, sizeof(*pu16Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu16Src, sizeof(*pu16Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
     if (rc == VINF_SUCCESS)
     {
         *pu16Value = *pu16Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu16Src, IEM_ACCESS_STACK_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu16Src, IEM_ACCESS_STACK_R);
 
         /* Commit the new RSP value. */
@@ -8996 +8999 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32Value           Where to store the popped value.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopU32(PIEMCPU pIemCpu, uint32_t *pu32Value)
+IEM_STATIC VBOXSTRICTRC iemMemStackPopU32(PVMCPU pVCpu, uint32_t *pu32Value)
 {
     /* Increment the stack pointer. */
     uint64_t    uNewRsp;
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPop(pIemCpu, pCtx, 4, &uNewRsp);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPop(pVCpu, pCtx, 4, &uNewRsp);
 
     /* Write the word the lazy way. */
     uint32_t const *pu32Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu32Src, sizeof(*pu32Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Src, sizeof(*pu32Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
     if (rc == VINF_SUCCESS)
     {
         *pu32Value = *pu32Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu32Src, IEM_ACCESS_STACK_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu32Src, IEM_ACCESS_STACK_R);
 
         /* Commit the new RSP value. */
@@ -9027 +9030 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64Value           Where to store the popped value.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopU64(PIEMCPU pIemCpu, uint64_t *pu64Value)
+IEM_STATIC VBOXSTRICTRC iemMemStackPopU64(PVMCPU pVCpu, uint64_t *pu64Value)
 {
     /* Increment the stack pointer. */
     uint64_t    uNewRsp;
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPop(pIemCpu, pCtx, 8, &uNewRsp);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPop(pVCpu, pCtx, 8, &uNewRsp);
 
     /* Write the word the lazy way. */
     uint64_t const *pu64Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu64Src, sizeof(*pu64Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu64Src, sizeof(*pu64Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
     if (rc == VINF_SUCCESS)
     {
         *pu64Value = *pu64Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu64Src, IEM_ACCESS_STACK_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu64Src, IEM_ACCESS_STACK_R);
 
         /* Commit the new RSP value. */
@@ -9058 +9061 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u16Value            The value to push.
  * @param   pTmpRsp             Pointer to the temporary stack pointer.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPushU16Ex(PIEMCPU pIemCpu, uint16_t u16Value, PRTUINT64U pTmpRsp)
+IEM_STATIC VBOXSTRICTRC iemMemStackPushU16Ex(PVMCPU pVCpu, uint16_t u16Value, PRTUINT64U pTmpRsp)
 {
     /* Increment the stack pointer. */
-    PCPUMCTX    pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTUINT64U   NewRsp = *pTmpRsp;
-    RTGCPTR     GCPtrTop = iemRegGetRspForPushEx(pIemCpu, pCtx, &NewRsp, 2);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPushEx(pVCpu, pCtx, &NewRsp, 2);
 
     /* Write the word the lazy way. */
     uint16_t *pu16Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu16Dst, sizeof(*pu16Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu16Dst, sizeof(*pu16Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
     if (rc == VINF_SUCCESS)
     {
         *pu16Dst = u16Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu16Dst, IEM_ACCESS_STACK_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu16Dst, IEM_ACCESS_STACK_W);
     }
 
@@ -9090 +9093 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u32Value            The value to push.
  * @param   pTmpRsp             Pointer to the temporary stack pointer.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPushU32Ex(PIEMCPU pIemCpu, uint32_t u32Value, PRTUINT64U pTmpRsp)
+IEM_STATIC VBOXSTRICTRC iemMemStackPushU32Ex(PVMCPU pVCpu, uint32_t u32Value, PRTUINT64U pTmpRsp)
 {
     /* Increment the stack pointer. */
-    PCPUMCTX    pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTUINT64U   NewRsp = *pTmpRsp;
-    RTGCPTR     GCPtrTop = iemRegGetRspForPushEx(pIemCpu, pCtx, &NewRsp, 4);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPushEx(pVCpu, pCtx, &NewRsp, 4);
 
     /* Write the word the lazy way. */
     uint32_t *pu32Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu32Dst, sizeof(*pu32Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Dst, sizeof(*pu32Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
     if (rc == VINF_SUCCESS)
     {
         *pu32Dst = u32Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu32Dst, IEM_ACCESS_STACK_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu32Dst, IEM_ACCESS_STACK_W);
     }
 
@@ -9122 +9125 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u64Value            The value to push.
  * @param   pTmpRsp             Pointer to the temporary stack pointer.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPushU64Ex(PIEMCPU pIemCpu, uint64_t u64Value, PRTUINT64U pTmpRsp)
+IEM_STATIC VBOXSTRICTRC iemMemStackPushU64Ex(PVMCPU pVCpu, uint64_t u64Value, PRTUINT64U pTmpRsp)
 {
     /* Increment the stack pointer. */
-    PCPUMCTX    pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTUINT64U   NewRsp = *pTmpRsp;
-    RTGCPTR     GCPtrTop = iemRegGetRspForPushEx(pIemCpu, pCtx, &NewRsp, 8);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPushEx(pVCpu, pCtx, &NewRsp, 8);
 
     /* Write the word the lazy way. */
     uint64_t *pu64Dst;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu64Dst, sizeof(*pu64Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu64Dst, sizeof(*pu64Dst), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = u64Value;
-        rc = iemMemCommitAndUnmap(pIemCpu, pu64Dst, IEM_ACCESS_STACK_W);
+        rc = iemMemCommitAndUnmap(pVCpu, pu64Dst, IEM_ACCESS_STACK_W);
     }
 
@@ -9154 +9157 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu16Value           Where to store the popped value.
  * @param   pTmpRsp             Pointer to the temporary stack pointer.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopU16Ex(PIEMCPU pIemCpu, uint16_t *pu16Value, PRTUINT64U pTmpRsp)
+IEM_STATIC VBOXSTRICTRC iemMemStackPopU16Ex(PVMCPU pVCpu, uint16_t *pu16Value, PRTUINT64U pTmpRsp)
 {
     /* Increment the stack pointer. */
-    PCPUMCTX    pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTUINT64U   NewRsp = *pTmpRsp;
-    RTGCPTR     GCPtrTop = iemRegGetRspForPopEx(pIemCpu, pCtx, &NewRsp, 2);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPopEx(pVCpu, pCtx, &NewRsp, 2);
 
     /* Write the word the lazy way. */
     uint16_t const *pu16Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu16Src, sizeof(*pu16Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu16Src, sizeof(*pu16Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
     if (rc == VINF_SUCCESS)
     {
         *pu16Value = *pu16Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu16Src, IEM_ACCESS_STACK_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu16Src, IEM_ACCESS_STACK_R);
 
         /* Commit the new RSP value. */
@@ -9186 +9189 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32Value           Where to store the popped value.
  * @param   pTmpRsp             Pointer to the temporary stack pointer.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopU32Ex(PIEMCPU pIemCpu, uint32_t *pu32Value, PRTUINT64U pTmpRsp)
+IEM_STATIC VBOXSTRICTRC iemMemStackPopU32Ex(PVMCPU pVCpu, uint32_t *pu32Value, PRTUINT64U pTmpRsp)
 {
     /* Increment the stack pointer. */
-    PCPUMCTX    pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTUINT64U   NewRsp = *pTmpRsp;
-    RTGCPTR     GCPtrTop = iemRegGetRspForPopEx(pIemCpu, pCtx, &NewRsp, 4);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPopEx(pVCpu, pCtx, &NewRsp, 4);
 
     /* Write the word the lazy way. */
     uint32_t const *pu32Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu32Src, sizeof(*pu32Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Src, sizeof(*pu32Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
     if (rc == VINF_SUCCESS)
     {
         *pu32Value = *pu32Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu32Src, IEM_ACCESS_STACK_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu32Src, IEM_ACCESS_STACK_R);
 
         /* Commit the new RSP value. */
@@ -9218 +9221 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64Value           Where to store the popped value.
  * @param   pTmpRsp             Pointer to the temporary stack pointer.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopU64Ex(PIEMCPU pIemCpu, uint64_t *pu64Value, PRTUINT64U pTmpRsp)
+IEM_STATIC VBOXSTRICTRC iemMemStackPopU64Ex(PVMCPU pVCpu, uint64_t *pu64Value, PRTUINT64U pTmpRsp)
 {
     /* Increment the stack pointer. */
-    PCPUMCTX    pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTUINT64U   NewRsp = *pTmpRsp;
-    RTGCPTR     GCPtrTop = iemRegGetRspForPopEx(pIemCpu, pCtx, &NewRsp, 8);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPopEx(pVCpu, pCtx, &NewRsp, 8);
 
     /* Write the word the lazy way. */
     uint64_t const *pu64Src;
-    VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&pu64Src, sizeof(*pu64Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pu64Src, sizeof(*pu64Src), X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
     if (rcStrict == VINF_SUCCESS)
     {
         *pu64Value = *pu64Src;
-        rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pu64Src, IEM_ACCESS_STACK_R);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pu64Src, IEM_ACCESS_STACK_R);
 
         /* Commit the new RSP value. */
@@ -9252 +9255 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   cbMem               The number of bytes to push onto the stack.
  * @param   ppvMem              Where to return the pointer to the stack memory.
@@ -9263 +9266 @@
  *                              iemMemStackPushCommitSpecial().
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPushBeginSpecial(PIEMCPU pIemCpu, size_t cbMem, void **ppvMem, uint64_t *puNewRsp)
+IEM_STATIC VBOXSTRICTRC iemMemStackPushBeginSpecial(PVMCPU pVCpu, size_t cbMem, void **ppvMem, uint64_t *puNewRsp)
 {
     Assert(cbMem < UINT8_MAX);
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pIemCpu, pCtx, (uint8_t)cbMem, puNewRsp);
-    return iemMemMap(pIemCpu, ppvMem, cbMem, X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pVCpu, pCtx, (uint8_t)cbMem, puNewRsp);
+    return iemMemMap(pVCpu, ppvMem, cbMem, X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W);
 }
 
@@ -9278 +9281 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pvMem               The pointer returned by
  *                              iemMemStackPushBeginSpecial().
@@ -9284 +9287 @@
  *                              iemMemStackPushBeginSpecial().
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPushCommitSpecial(PIEMCPU pIemCpu, void *pvMem, uint64_t uNewRsp)
-{
-    VBOXSTRICTRC rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem, IEM_ACCESS_STACK_W);
+IEM_STATIC VBOXSTRICTRC iemMemStackPushCommitSpecial(PVMCPU pVCpu, void *pvMem, uint64_t uNewRsp)
+{
+    VBOXSTRICTRC rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem, IEM_ACCESS_STACK_W);
     if (rcStrict == VINF_SUCCESS)
-        pIemCpu->CTX_SUFF(pCtx)->rsp = uNewRsp;
+        pVCpu->iem.s.CTX_SUFF(pCtx)->rsp = uNewRsp;
     return rcStrict;
 }
@@ -9299 +9302 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   cbMem               The number of bytes to push onto the stack.
  * @param   ppvMem              Where to return the pointer to the stack memory.
@@ -9307 +9310 @@
  *                              manually if iemMemStackPopDoneSpecial() is used.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopBeginSpecial(PIEMCPU pIemCpu, size_t cbMem, void const **ppvMem, uint64_t *puNewRsp)
+IEM_STATIC VBOXSTRICTRC iemMemStackPopBeginSpecial(PVMCPU pVCpu, size_t cbMem, void const **ppvMem, uint64_t *puNewRsp)
 {
     Assert(cbMem < UINT8_MAX);
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPop(pIemCpu, pCtx, (uint8_t)cbMem, puNewRsp);
-    return iemMemMap(pIemCpu, (void **)ppvMem, cbMem, X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPop(pVCpu, pCtx, (uint8_t)cbMem, puNewRsp);
+    return iemMemMap(pVCpu, (void **)ppvMem, cbMem, X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
 }
 
@@ -9322 +9325 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   cbMem               The number of bytes to push onto the stack.
  * @param   ppvMem              Where to return the pointer to the stack memory.
@@ -9330 +9333 @@
  *                              manually if iemMemStackPopDoneSpecial() is used.
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopContinueSpecial(PIEMCPU pIemCpu, size_t cbMem, void const **ppvMem, uint64_t *puNewRsp)
+IEM_STATIC VBOXSTRICTRC iemMemStackPopContinueSpecial(PVMCPU pVCpu, size_t cbMem, void const **ppvMem, uint64_t *puNewRsp)
 {
     Assert(cbMem < UINT8_MAX);
-    PCPUMCTX    pCtx     = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTUINT64U   NewRsp;
     NewRsp.u = *puNewRsp;
-    RTGCPTR     GCPtrTop = iemRegGetRspForPopEx(pIemCpu, pCtx, &NewRsp, 8);
+    RTGCPTR     GCPtrTop = iemRegGetRspForPopEx(pVCpu, pCtx, &NewRsp, 8);
     *puNewRsp = NewRsp.u;
-    return iemMemMap(pIemCpu, (void **)ppvMem, cbMem, X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
+    return iemMemMap(pVCpu, (void **)ppvMem, cbMem, X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R);
 }
 
@@ -9348 +9351 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pvMem               The pointer returned by
  *                              iemMemStackPopBeginSpecial().
@@ -9354 +9357 @@
  *                              iemMemStackPopBeginSpecial().
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopCommitSpecial(PIEMCPU pIemCpu, void const *pvMem, uint64_t uNewRsp)
-{
-    VBOXSTRICTRC rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pvMem, IEM_ACCESS_STACK_R);
+IEM_STATIC VBOXSTRICTRC iemMemStackPopCommitSpecial(PVMCPU pVCpu, void const *pvMem, uint64_t uNewRsp)
+{
+    VBOXSTRICTRC rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pvMem, IEM_ACCESS_STACK_R);
     if (rcStrict == VINF_SUCCESS)
-        pIemCpu->CTX_SUFF(pCtx)->rsp = uNewRsp;
+        pVCpu->iem.s.CTX_SUFF(pCtx)->rsp = uNewRsp;
     return rcStrict;
 }
@@ -9370 +9373 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pvMem               The pointer returned by
  *                              iemMemStackPopBeginSpecial() or
  *                              iemMemStackPopContinueSpecial().
  */
-IEM_STATIC VBOXSTRICTRC iemMemStackPopDoneSpecial(PIEMCPU pIemCpu, void const *pvMem)
-{
-    return iemMemCommitAndUnmap(pIemCpu, (void *)pvMem, IEM_ACCESS_STACK_R);
+IEM_STATIC VBOXSTRICTRC iemMemStackPopDoneSpecial(PVMCPU pVCpu, void const *pvMem)
+{
+    return iemMemCommitAndUnmap(pVCpu, (void *)pvMem, IEM_ACCESS_STACK_R);
 }
 
@@ -9385 +9388 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pbDst               Where to return the byte.
  * @param   iSegReg             The index of the segment register to use for
@@ -9391 +9394 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchSysU8(PIEMCPU pIemCpu, uint8_t *pbDst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchSysU8(PVMCPU pVCpu, uint8_t *pbDst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     uint8_t const *pbSrc;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pbSrc, sizeof(*pbSrc), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pbSrc, sizeof(*pbSrc), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R);
     if (rc == VINF_SUCCESS)
     {
         *pbDst = *pbSrc;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pbSrc, IEM_ACCESS_SYS_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pbSrc, IEM_ACCESS_SYS_R);
     }
     return rc;
@@ -9409 +9412 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu16Dst             Where to return the word.
  * @param   iSegReg             The index of the segment register to use for
@@ -9415 +9418 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchSysU16(PIEMCPU pIemCpu, uint16_t *pu16Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchSysU16(PVMCPU pVCpu, uint16_t *pu16Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     uint16_t const *pu16Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu16Src, sizeof(*pu16Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu16Src, sizeof(*pu16Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R);
     if (rc == VINF_SUCCESS)
     {
         *pu16Dst = *pu16Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu16Src, IEM_ACCESS_SYS_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu16Src, IEM_ACCESS_SYS_R);
     }
     return rc;
@@ -9433 +9436 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu32Dst             Where to return the dword.
  * @param   iSegReg             The index of the segment register to use for
@@ -9439 +9442 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchSysU32(PIEMCPU pIemCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchSysU32(PVMCPU pVCpu, uint32_t *pu32Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     uint32_t const *pu32Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu32Src, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Src, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R);
     if (rc == VINF_SUCCESS)
     {
         *pu32Dst = *pu32Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu32Src, IEM_ACCESS_SYS_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu32Src, IEM_ACCESS_SYS_R);
     }
     return rc;
@@ -9457 +9460 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pu64Dst             Where to return the qword.
  * @param   iSegReg             The index of the segment register to use for
@@ -9463 +9466 @@
  * @param   GCPtrMem            The address of the guest memory.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchSysU64(PIEMCPU pIemCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
+IEM_STATIC VBOXSTRICTRC iemMemFetchSysU64(PVMCPU pVCpu, uint64_t *pu64Dst, uint8_t iSegReg, RTGCPTR GCPtrMem)
 {
     /* The lazy approach for now... */
     uint64_t const *pu64Src;
-    VBOXSTRICTRC rc = iemMemMap(pIemCpu, (void **)&pu64Src, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu64Src, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = *pu64Src;
-        rc = iemMemCommitAndUnmap(pIemCpu, (void *)pu64Src, IEM_ACCESS_SYS_R);
+        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu64Src, IEM_ACCESS_SYS_R);
     }
     return rc;
@@ -9481 +9484 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pDesc               Where to return the descriptor table entry.
  * @param   uSel                The selector which table entry to fetch.
@@ -9488 +9491 @@
  */
 IEM_STATIC VBOXSTRICTRC
-iemMemFetchSelDescWithErr(PIEMCPU pIemCpu, PIEMSELDESC pDesc, uint16_t uSel, uint8_t uXcpt, uint16_t uErrorCode)
+iemMemFetchSelDescWithErr(PVMCPU pVCpu, PIEMSELDESC pDesc, uint16_t uSel, uint8_t uXcpt, uint16_t uErrorCode)
 {
     AssertPtr(pDesc);
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /** @todo did the 286 require all 8 bytes to be accessible? */
@@ -9505 +9508 @@
             Log(("iemMemFetchSelDesc: LDT selector %#x is out of bounds (%3x) or ldtr is NP (%#x)\n",
                  uSel, pCtx->ldtr.u32Limit, pCtx->ldtr.Sel));
-            return iemRaiseXcptOrInt(pIemCpu, 0, uXcpt, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
+            return iemRaiseXcptOrInt(pVCpu, 0, uXcpt, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
                                      uErrorCode, 0);
         }
@@ -9517 +9520 @@
         {
             Log(("iemMemFetchSelDesc: GDT selector %#x is out of bounds (%3x)\n", uSel, pCtx->gdtr.cbGdt));
-            return iemRaiseXcptOrInt(pIemCpu, 0, uXcpt, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
+            return iemRaiseXcptOrInt(pVCpu, 0, uXcpt, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR,
                                      uErrorCode, 0);
         }
@@ -9527 +9530 @@
      * required.
      */
-    VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
+    VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
     if (rcStrict == VINF_SUCCESS)
     {
-        if (   !IEM_IS_LONG_MODE(pIemCpu)
+        if (   !IEM_IS_LONG_MODE(pVCpu)
             || pDesc->Legacy.Gen.u1DescType)
             pDesc->Long.au64[1] = 0;
         else if ((uint32_t)(uSel | X86_SEL_RPL_LDT) + 8 <= (uSel & X86_SEL_LDT ? pCtx->ldtr.u32Limit : pCtx->gdtr.cbGdt))
-            rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel | X86_SEL_RPL_LDT) + 1);
+            rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel | X86_SEL_RPL_LDT) + 1);
         else
         {
             Log(("iemMemFetchSelDesc: system selector %#x is out of bounds\n", uSel));
             /** @todo is this the right exception? */
-            return iemRaiseXcptOrInt(pIemCpu, 0, uXcpt, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErrorCode, 0);
+            return iemRaiseXcptOrInt(pVCpu, 0, uXcpt, IEM_XCPT_FLAGS_T_CPU_XCPT | IEM_XCPT_FLAGS_ERR, uErrorCode, 0);
         }
     }
@@ -9550 +9553 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pDesc               Where to return the descriptor table entry.
  * @param   uSel                The selector which table entry to fetch.
  * @param   uXcpt               The exception to raise on table lookup error.
  */
-IEM_STATIC VBOXSTRICTRC iemMemFetchSelDesc(PIEMCPU pIemCpu, PIEMSELDESC pDesc, uint16_t uSel, uint8_t uXcpt)
-{
-    return iemMemFetchSelDescWithErr(pIemCpu, pDesc, uSel, uXcpt, uSel & X86_SEL_MASK_OFF_RPL);
+IEM_STATIC VBOXSTRICTRC iemMemFetchSelDesc(PVMCPU pVCpu, PIEMSELDESC pDesc, uint16_t uSel, uint8_t uXcpt)
+{
+    return iemMemFetchSelDescWithErr(pVCpu, pDesc, uSel, uXcpt, uSel & X86_SEL_MASK_OFF_RPL);
 }
 
@@ -9586 +9589 @@
  *
  * @returns Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   uSel                The selector.
  */
-IEM_STATIC VBOXSTRICTRC iemMemMarkSelDescAccessed(PIEMCPU pIemCpu, uint16_t uSel)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC VBOXSTRICTRC iemMemMarkSelDescAccessed(PVMCPU pVCpu, uint16_t uSel)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -9612 +9615 @@
         /* The normal case, map the 32-bit bits around the accessed bit (40). */
         GCPtr += 2 + 2;
-        rcStrict = iemMemMap(pIemCpu, (void **)&pu32, 4, UINT8_MAX, GCPtr, IEM_ACCESS_SYS_RW);
+        rcStrict = iemMemMap(pVCpu, (void **)&pu32, 4, UINT8_MAX, GCPtr, IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -9620 +9623 @@
     {
         /* The misaligned GDT/LDT case, map the whole thing. */
-        rcStrict = iemMemMap(pIemCpu, (void **)&pu32, 8, UINT8_MAX, GCPtr, IEM_ACCESS_SYS_RW);
+        rcStrict = iemMemMap(pVCpu, (void **)&pu32, 8, UINT8_MAX, GCPtr, IEM_ACCESS_SYS_RW);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -9632 +9635 @@
     }
 
-    return iemMemCommitAndUnmap(pIemCpu, (void *)pu32, IEM_ACCESS_SYS_RW);
+    return iemMemCommitAndUnmap(pVCpu, (void *)pu32, IEM_ACCESS_SYS_RW);
 }
 
@@ -9667 +9670 @@
 
 
-#define IEM_MC_ADVANCE_RIP()                            iemRegUpdateRipAndClearRF(pIemCpu)
-#define IEM_MC_REL_JMP_S8(a_i8)                         IEM_MC_RETURN_ON_FAILURE(iemRegRipRelativeJumpS8(pIemCpu, a_i8))
-#define IEM_MC_REL_JMP_S16(a_i16)                       IEM_MC_RETURN_ON_FAILURE(iemRegRipRelativeJumpS16(pIemCpu, a_i16))
-#define IEM_MC_REL_JMP_S32(a_i32)                       IEM_MC_RETURN_ON_FAILURE(iemRegRipRelativeJumpS32(pIemCpu, a_i32))
-#define IEM_MC_SET_RIP_U16(a_u16NewIP)                  IEM_MC_RETURN_ON_FAILURE(iemRegRipJump((pIemCpu), (a_u16NewIP)))
-#define IEM_MC_SET_RIP_U32(a_u32NewIP)                  IEM_MC_RETURN_ON_FAILURE(iemRegRipJump((pIemCpu), (a_u32NewIP)))
-#define IEM_MC_SET_RIP_U64(a_u64NewIP)                  IEM_MC_RETURN_ON_FAILURE(iemRegRipJump((pIemCpu), (a_u64NewIP)))
-#define IEM_MC_RAISE_DIVIDE_ERROR()                     return iemRaiseDivideError(pIemCpu)
+#define IEM_MC_ADVANCE_RIP()                            iemRegUpdateRipAndClearRF(pVCpu)
+#define IEM_MC_REL_JMP_S8(a_i8)                         IEM_MC_RETURN_ON_FAILURE(iemRegRipRelativeJumpS8(pVCpu, a_i8))
+#define IEM_MC_REL_JMP_S16(a_i16)                       IEM_MC_RETURN_ON_FAILURE(iemRegRipRelativeJumpS16(pVCpu, a_i16))
+#define IEM_MC_REL_JMP_S32(a_i32)                       IEM_MC_RETURN_ON_FAILURE(iemRegRipRelativeJumpS32(pVCpu, a_i32))
+#define IEM_MC_SET_RIP_U16(a_u16NewIP)                  IEM_MC_RETURN_ON_FAILURE(iemRegRipJump((pVCpu), (a_u16NewIP)))
+#define IEM_MC_SET_RIP_U32(a_u32NewIP)                  IEM_MC_RETURN_ON_FAILURE(iemRegRipJump((pVCpu), (a_u32NewIP)))
+#define IEM_MC_SET_RIP_U64(a_u64NewIP)                  IEM_MC_RETURN_ON_FAILURE(iemRegRipJump((pVCpu), (a_u64NewIP)))
+#define IEM_MC_RAISE_DIVIDE_ERROR()                     return iemRaiseDivideError(pVCpu)
 #define IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE()       \
     do { \
-        if ((pIemCpu)->CTX_SUFF(pCtx)->cr0 & (X86_CR0_EM | X86_CR0_TS)) \
-            return iemRaiseDeviceNotAvailable(pIemCpu); \
+        if ((pVCpu)->iem.s.CTX_SUFF(pCtx)->cr0 & (X86_CR0_EM | X86_CR0_TS)) \
+            return iemRaiseDeviceNotAvailable(pVCpu); \
     } while (0)
 #define IEM_MC_MAYBE_RAISE_FPU_XCPT() \
     do { \
-        if ((pIemCpu)->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FSW & X86_FSW_ES) \
-            return iemRaiseMathFault(pIemCpu); \
+        if ((pVCpu)->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FSW & X86_FSW_ES) \
+            return iemRaiseMathFault(pVCpu); \
     } while (0)
 #define IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT() \
     do { \
-        if (   (pIemCpu->CTX_SUFF(pCtx)->cr0 & X86_CR0_EM) \
-            || !(pIemCpu->CTX_SUFF(pCtx)->cr4 & X86_CR4_OSFXSR) \
-            || !IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fSse2) \
-            return iemRaiseUndefinedOpcode(pIemCpu); \
-        if (pIemCpu->CTX_SUFF(pCtx)->cr0 & X86_CR0_TS) \
-            return iemRaiseDeviceNotAvailable(pIemCpu); \
+        if (   (pVCpu->iem.s.CTX_SUFF(pCtx)->cr0 & X86_CR0_EM) \
+            || !(pVCpu->iem.s.CTX_SUFF(pCtx)->cr4 & X86_CR4_OSFXSR) \
+            || !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSse2) \
+            return iemRaiseUndefinedOpcode(pVCpu); \
+        if (pVCpu->iem.s.CTX_SUFF(pCtx)->cr0 & X86_CR0_TS) \
+            return iemRaiseDeviceNotAvailable(pVCpu); \
     } while (0)
 #define IEM_MC_MAYBE_RAISE_SSE_RELATED_XCPT() \
     do { \
-        if (   (pIemCpu->CTX_SUFF(pCtx)->cr0 & X86_CR0_EM) \
-            || !(pIemCpu->CTX_SUFF(pCtx)->cr4 & X86_CR4_OSFXSR) \
-            || !IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fSse) \
-            return iemRaiseUndefinedOpcode(pIemCpu); \
-        if (pIemCpu->CTX_SUFF(pCtx)->cr0 & X86_CR0_TS) \
-            return iemRaiseDeviceNotAvailable(pIemCpu); \
+        if (   (pVCpu->iem.s.CTX_SUFF(pCtx)->cr0 & X86_CR0_EM) \
+            || !(pVCpu->iem.s.CTX_SUFF(pCtx)->cr4 & X86_CR4_OSFXSR) \
+            || !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSse) \
+            return iemRaiseUndefinedOpcode(pVCpu); \
+        if (pVCpu->iem.s.CTX_SUFF(pCtx)->cr0 & X86_CR0_TS) \
+            return iemRaiseDeviceNotAvailable(pVCpu); \
     } while (0)
 #define IEM_MC_MAYBE_RAISE_MMX_RELATED_XCPT() \
     do { \
-        if (   ((pIemCpu)->CTX_SUFF(pCtx)->cr0 & X86_CR0_EM) \
-            || !IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMmx) \
-            return iemRaiseUndefinedOpcode(pIemCpu); \
-        if (pIemCpu->CTX_SUFF(pCtx)->cr0 & X86_CR0_TS) \
-            return iemRaiseDeviceNotAvailable(pIemCpu); \
+        if (   ((pVCpu)->iem.s.CTX_SUFF(pCtx)->cr0 & X86_CR0_EM) \
+            || !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMmx) \
+            return iemRaiseUndefinedOpcode(pVCpu); \
+        if (pVCpu->iem.s.CTX_SUFF(pCtx)->cr0 & X86_CR0_TS) \
+            return iemRaiseDeviceNotAvailable(pVCpu); \
     } while (0)
 #define IEM_MC_MAYBE_RAISE_MMX_RELATED_XCPT_CHECK_SSE_OR_MMXEXT() \
     do { \
-        if (   ((pIemCpu)->CTX_SUFF(pCtx)->cr0 & X86_CR0_EM) \
-            || (   !IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fSse \
-                && !IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fAmdMmxExts) ) \
-            return iemRaiseUndefinedOpcode(pIemCpu); \
-        if (pIemCpu->CTX_SUFF(pCtx)->cr0 & X86_CR0_TS) \
-            return iemRaiseDeviceNotAvailable(pIemCpu); \
+        if (   ((pVCpu)->iem.s.CTX_SUFF(pCtx)->cr0 & X86_CR0_EM) \
+            || (   !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSse \
+                && !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fAmdMmxExts) ) \
+            return iemRaiseUndefinedOpcode(pVCpu); \
+        if (pVCpu->iem.s.CTX_SUFF(pCtx)->cr0 & X86_CR0_TS) \
+            return iemRaiseDeviceNotAvailable(pVCpu); \
     } while (0)
 #define IEM_MC_RAISE_GP0_IF_CPL_NOT_ZERO() \
     do { \
-        if (pIemCpu->uCpl != 0) \
-            return iemRaiseGeneralProtectionFault0(pIemCpu); \
+        if (pVCpu->iem.s.uCpl != 0) \
+            return iemRaiseGeneralProtectionFault0(pVCpu); \
     } while (0)
 
@@ -9737 +9740 @@
     uint32_t *a_pName = &a_Name
 #define IEM_MC_COMMIT_EFLAGS(a_EFlags) \
-   do { (pIemCpu)->CTX_SUFF(pCtx)->eflags.u = (a_EFlags); Assert((pIemCpu)->CTX_SUFF(pCtx)->eflags.u & X86_EFL_1); } while (0)
+   do { (pVCpu)->iem.s.CTX_SUFF(pCtx)->eflags.u = (a_EFlags); Assert((pVCpu)->iem.s.CTX_SUFF(pCtx)->eflags.u & X86_EFL_1); } while (0)
 
 #define IEM_MC_ASSIGN(a_VarOrArg, a_CVariableOrConst)   (a_VarOrArg) = (a_CVariableOrConst)
 #define IEM_MC_ASSIGN_TO_SMALLER                        IEM_MC_ASSIGN
 
-#define IEM_MC_FETCH_GREG_U8(a_u8Dst, a_iGReg)          (a_u8Dst)  = iemGRegFetchU8(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U8_ZX_U16(a_u16Dst, a_iGReg)  (a_u16Dst) = iemGRegFetchU8(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U8_ZX_U32(a_u32Dst, a_iGReg)  (a_u32Dst) = iemGRegFetchU8(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U8_ZX_U64(a_u64Dst, a_iGReg)  (a_u64Dst) = iemGRegFetchU8(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U8_SX_U16(a_u16Dst, a_iGReg)  (a_u16Dst) = (int8_t)iemGRegFetchU8(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U8_SX_U32(a_u32Dst, a_iGReg)  (a_u32Dst) = (int8_t)iemGRegFetchU8(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U8_SX_U64(a_u64Dst, a_iGReg)  (a_u64Dst) = (int8_t)iemGRegFetchU8(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U16(a_u16Dst, a_iGReg)        (a_u16Dst) = iemGRegFetchU16(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U16_ZX_U32(a_u32Dst, a_iGReg) (a_u32Dst) = iemGRegFetchU16(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U16_ZX_U64(a_u64Dst, a_iGReg) (a_u64Dst) = iemGRegFetchU16(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U16_SX_U32(a_u32Dst, a_iGReg) (a_u32Dst) = (int16_t)iemGRegFetchU16(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U16_SX_U64(a_u64Dst, a_iGReg) (a_u64Dst) = (int16_t)iemGRegFetchU16(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U32(a_u32Dst, a_iGReg)        (a_u32Dst) = iemGRegFetchU32(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U32_ZX_U64(a_u64Dst, a_iGReg) (a_u64Dst) = iemGRegFetchU32(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U32_SX_U64(a_u64Dst, a_iGReg) (a_u64Dst) = (int32_t)iemGRegFetchU32(pIemCpu, (a_iGReg))
-#define IEM_MC_FETCH_GREG_U64(a_u64Dst, a_iGReg)        (a_u64Dst) = iemGRegFetchU64(pIemCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U8(a_u8Dst, a_iGReg)          (a_u8Dst)  = iemGRegFetchU8(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U8_ZX_U16(a_u16Dst, a_iGReg)  (a_u16Dst) = iemGRegFetchU8(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U8_ZX_U32(a_u32Dst, a_iGReg)  (a_u32Dst) = iemGRegFetchU8(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U8_ZX_U64(a_u64Dst, a_iGReg)  (a_u64Dst) = iemGRegFetchU8(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U8_SX_U16(a_u16Dst, a_iGReg)  (a_u16Dst) = (int8_t)iemGRegFetchU8(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U8_SX_U32(a_u32Dst, a_iGReg)  (a_u32Dst) = (int8_t)iemGRegFetchU8(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U8_SX_U64(a_u64Dst, a_iGReg)  (a_u64Dst) = (int8_t)iemGRegFetchU8(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U16(a_u16Dst, a_iGReg)        (a_u16Dst) = iemGRegFetchU16(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U16_ZX_U32(a_u32Dst, a_iGReg) (a_u32Dst) = iemGRegFetchU16(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U16_ZX_U64(a_u64Dst, a_iGReg) (a_u64Dst) = iemGRegFetchU16(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U16_SX_U32(a_u32Dst, a_iGReg) (a_u32Dst) = (int16_t)iemGRegFetchU16(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U16_SX_U64(a_u64Dst, a_iGReg) (a_u64Dst) = (int16_t)iemGRegFetchU16(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U32(a_u32Dst, a_iGReg)        (a_u32Dst) = iemGRegFetchU32(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U32_ZX_U64(a_u64Dst, a_iGReg) (a_u64Dst) = iemGRegFetchU32(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U32_SX_U64(a_u64Dst, a_iGReg) (a_u64Dst) = (int32_t)iemGRegFetchU32(pVCpu, (a_iGReg))
+#define IEM_MC_FETCH_GREG_U64(a_u64Dst, a_iGReg)        (a_u64Dst) = iemGRegFetchU64(pVCpu, (a_iGReg))
 #define IEM_MC_FETCH_GREG_U64_ZX_U64                    IEM_MC_FETCH_GREG_U64
-#define IEM_MC_FETCH_SREG_U16(a_u16Dst, a_iSReg)        (a_u16Dst) = iemSRegFetchU16(pIemCpu, (a_iSReg))
-#define IEM_MC_FETCH_SREG_ZX_U32(a_u32Dst, a_iSReg)     (a_u32Dst) = iemSRegFetchU16(pIemCpu, (a_iSReg))
-#define IEM_MC_FETCH_SREG_ZX_U64(a_u64Dst, a_iSReg)     (a_u64Dst) = iemSRegFetchU16(pIemCpu, (a_iSReg))
-#define IEM_MC_FETCH_CR0_U16(a_u16Dst)                  (a_u16Dst) = (uint16_t)(pIemCpu)->CTX_SUFF(pCtx)->cr0
-#define IEM_MC_FETCH_CR0_U32(a_u32Dst)                  (a_u32Dst) = (uint32_t)(pIemCpu)->CTX_SUFF(pCtx)->cr0
-#define IEM_MC_FETCH_CR0_U64(a_u64Dst)                  (a_u64Dst) = (pIemCpu)->CTX_SUFF(pCtx)->cr0
-#define IEM_MC_FETCH_LDTR_U16(a_u16Dst)                 (a_u16Dst) = (pIemCpu)->CTX_SUFF(pCtx)->ldtr.Sel
-#define IEM_MC_FETCH_LDTR_U32(a_u32Dst)                 (a_u32Dst) = (pIemCpu)->CTX_SUFF(pCtx)->ldtr.Sel
-#define IEM_MC_FETCH_LDTR_U64(a_u64Dst)                 (a_u64Dst) = (pIemCpu)->CTX_SUFF(pCtx)->ldtr.Sel
-#define IEM_MC_FETCH_TR_U16(a_u16Dst)                   (a_u16Dst) = (pIemCpu)->CTX_SUFF(pCtx)->tr.Sel
-#define IEM_MC_FETCH_TR_U32(a_u32Dst)                   (a_u32Dst) = (pIemCpu)->CTX_SUFF(pCtx)->tr.Sel
-#define IEM_MC_FETCH_TR_U64(a_u64Dst)                   (a_u64Dst) = (pIemCpu)->CTX_SUFF(pCtx)->tr.Sel
+#define IEM_MC_FETCH_SREG_U16(a_u16Dst, a_iSReg)        (a_u16Dst) = iemSRegFetchU16(pVCpu, (a_iSReg))
+#define IEM_MC_FETCH_SREG_ZX_U32(a_u32Dst, a_iSReg)     (a_u32Dst) = iemSRegFetchU16(pVCpu, (a_iSReg))
+#define IEM_MC_FETCH_SREG_ZX_U64(a_u64Dst, a_iSReg)     (a_u64Dst) = iemSRegFetchU16(pVCpu, (a_iSReg))
+#define IEM_MC_FETCH_CR0_U16(a_u16Dst)                  (a_u16Dst) = (uint16_t)(pVCpu)->iem.s.CTX_SUFF(pCtx)->cr0
+#define IEM_MC_FETCH_CR0_U32(a_u32Dst)                  (a_u32Dst) = (uint32_t)(pVCpu)->iem.s.CTX_SUFF(pCtx)->cr0
+#define IEM_MC_FETCH_CR0_U64(a_u64Dst)                  (a_u64Dst) = (pVCpu)->iem.s.CTX_SUFF(pCtx)->cr0
+#define IEM_MC_FETCH_LDTR_U16(a_u16Dst)                 (a_u16Dst) = (pVCpu)->iem.s.CTX_SUFF(pCtx)->ldtr.Sel
+#define IEM_MC_FETCH_LDTR_U32(a_u32Dst)                 (a_u32Dst) = (pVCpu)->iem.s.CTX_SUFF(pCtx)->ldtr.Sel
+#define IEM_MC_FETCH_LDTR_U64(a_u64Dst)                 (a_u64Dst) = (pVCpu)->iem.s.CTX_SUFF(pCtx)->ldtr.Sel
+#define IEM_MC_FETCH_TR_U16(a_u16Dst)                   (a_u16Dst) = (pVCpu)->iem.s.CTX_SUFF(pCtx)->tr.Sel
+#define IEM_MC_FETCH_TR_U32(a_u32Dst)                   (a_u32Dst) = (pVCpu)->iem.s.CTX_SUFF(pCtx)->tr.Sel
+#define IEM_MC_FETCH_TR_U64(a_u64Dst)                   (a_u64Dst) = (pVCpu)->iem.s.CTX_SUFF(pCtx)->tr.Sel
 /** @note Not for IOPL or IF testing or modification. */
-#define IEM_MC_FETCH_EFLAGS(a_EFlags)                   (a_EFlags) = (pIemCpu)->CTX_SUFF(pCtx)->eflags.u
-#define IEM_MC_FETCH_EFLAGS_U8(a_EFlags)                (a_EFlags) = (uint8_t)(pIemCpu)->CTX_SUFF(pCtx)->eflags.u
-#define IEM_MC_FETCH_FSW(a_u16Fsw)                      (a_u16Fsw) = pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FSW
-#define IEM_MC_FETCH_FCW(a_u16Fcw)                      (a_u16Fcw) = pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FCW
-
-#define IEM_MC_STORE_GREG_U8(a_iGReg, a_u8Value)        *iemGRegRefU8(pIemCpu, (a_iGReg)) = (a_u8Value)
-#define IEM_MC_STORE_GREG_U16(a_iGReg, a_u16Value)      *(uint16_t *)iemGRegRef(pIemCpu, (a_iGReg)) = (a_u16Value)
-#define IEM_MC_STORE_GREG_U32(a_iGReg, a_u32Value)      *(uint64_t *)iemGRegRef(pIemCpu, (a_iGReg)) = (uint32_t)(a_u32Value) /* clear high bits. */
-#define IEM_MC_STORE_GREG_U64(a_iGReg, a_u64Value)      *(uint64_t *)iemGRegRef(pIemCpu, (a_iGReg)) = (a_u64Value)
+#define IEM_MC_FETCH_EFLAGS(a_EFlags)                   (a_EFlags) = (pVCpu)->iem.s.CTX_SUFF(pCtx)->eflags.u
+#define IEM_MC_FETCH_EFLAGS_U8(a_EFlags)                (a_EFlags) = (uint8_t)(pVCpu)->iem.s.CTX_SUFF(pCtx)->eflags.u
+#define IEM_MC_FETCH_FSW(a_u16Fsw)                      (a_u16Fsw) = pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FSW
+#define IEM_MC_FETCH_FCW(a_u16Fcw)                      (a_u16Fcw) = pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FCW
+
+#define IEM_MC_STORE_GREG_U8(a_iGReg, a_u8Value)        *iemGRegRefU8(pVCpu, (a_iGReg)) = (a_u8Value)
+#define IEM_MC_STORE_GREG_U16(a_iGReg, a_u16Value)      *(uint16_t *)iemGRegRef(pVCpu, (a_iGReg)) = (a_u16Value)
+#define IEM_MC_STORE_GREG_U32(a_iGReg, a_u32Value)      *(uint64_t *)iemGRegRef(pVCpu, (a_iGReg)) = (uint32_t)(a_u32Value) /* clear high bits. */
+#define IEM_MC_STORE_GREG_U64(a_iGReg, a_u64Value)      *(uint64_t *)iemGRegRef(pVCpu, (a_iGReg)) = (a_u64Value)
 #define IEM_MC_STORE_GREG_U8_CONST                      IEM_MC_STORE_GREG_U8
 #define IEM_MC_STORE_GREG_U16_CONST                     IEM_MC_STORE_GREG_U16
 #define IEM_MC_STORE_GREG_U32_CONST                     IEM_MC_STORE_GREG_U32
 #define IEM_MC_STORE_GREG_U64_CONST                     IEM_MC_STORE_GREG_U64
-#define IEM_MC_CLEAR_HIGH_GREG_U64(a_iGReg)             *(uint64_t *)iemGRegRef(pIemCpu, (a_iGReg)) &= UINT32_MAX
+#define IEM_MC_CLEAR_HIGH_GREG_U64(a_iGReg)             *(uint64_t *)iemGRegRef(pVCpu, (a_iGReg)) &= UINT32_MAX
 #define IEM_MC_CLEAR_HIGH_GREG_U64_BY_REF(a_pu32Dst)    do { (a_pu32Dst)[1] = 0; } while (0)
 #define IEM_MC_STORE_FPUREG_R80_SRC_REF(a_iSt, a_pr80Src) \
-    do { pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[a_iSt].r80 = *(a_pr80Src); } while (0)
-
-#define IEM_MC_REF_GREG_U8(a_pu8Dst, a_iGReg)           (a_pu8Dst) = iemGRegRefU8(pIemCpu, (a_iGReg))
-#define IEM_MC_REF_GREG_U16(a_pu16Dst, a_iGReg)         (a_pu16Dst) = (uint16_t *)iemGRegRef(pIemCpu, (a_iGReg))
+    do { pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[a_iSt].r80 = *(a_pr80Src); } while (0)
+
+#define IEM_MC_REF_GREG_U8(a_pu8Dst, a_iGReg)           (a_pu8Dst) = iemGRegRefU8(pVCpu, (a_iGReg))
+#define IEM_MC_REF_GREG_U16(a_pu16Dst, a_iGReg)         (a_pu16Dst) = (uint16_t *)iemGRegRef(pVCpu, (a_iGReg))
 /** @todo User of IEM_MC_REF_GREG_U32 needs to clear the high bits on commit.
  *        Use IEM_MC_CLEAR_HIGH_GREG_U64_BY_REF! */
-#define IEM_MC_REF_GREG_U32(a_pu32Dst, a_iGReg)         (a_pu32Dst) = (uint32_t *)iemGRegRef(pIemCpu, (a_iGReg))
-#define IEM_MC_REF_GREG_U64(a_pu64Dst, a_iGReg)         (a_pu64Dst) = (uint64_t *)iemGRegRef(pIemCpu, (a_iGReg))
+#define IEM_MC_REF_GREG_U32(a_pu32Dst, a_iGReg)         (a_pu32Dst) = (uint32_t *)iemGRegRef(pVCpu, (a_iGReg))
+#define IEM_MC_REF_GREG_U64(a_pu64Dst, a_iGReg)         (a_pu64Dst) = (uint64_t *)iemGRegRef(pVCpu, (a_iGReg))
 /** @note Not for IOPL or IF testing or modification. */
-#define IEM_MC_REF_EFLAGS(a_pEFlags)                    (a_pEFlags) = &(pIemCpu)->CTX_SUFF(pCtx)->eflags.u
-
-#define IEM_MC_ADD_GREG_U8(a_iGReg, a_u8Value)          *(uint8_t  *)iemGRegRef(pIemCpu, (a_iGReg)) += (a_u8Value)
-#define IEM_MC_ADD_GREG_U16(a_iGReg, a_u16Value)        *(uint16_t *)iemGRegRef(pIemCpu, (a_iGReg)) += (a_u16Value)
+#define IEM_MC_REF_EFLAGS(a_pEFlags)                    (a_pEFlags) = &(pVCpu)->iem.s.CTX_SUFF(pCtx)->eflags.u
+
+#define IEM_MC_ADD_GREG_U8(a_iGReg, a_u8Value)          *(uint8_t  *)iemGRegRef(pVCpu, (a_iGReg)) += (a_u8Value)
+#define IEM_MC_ADD_GREG_U16(a_iGReg, a_u16Value)        *(uint16_t *)iemGRegRef(pVCpu, (a_iGReg)) += (a_u16Value)
 #define IEM_MC_ADD_GREG_U32(a_iGReg, a_u32Value) \
     do { \
-        uint32_t *pu32Reg = (uint32_t *)iemGRegRef(pIemCpu, (a_iGReg)); \
+        uint32_t *pu32Reg = (uint32_t *)iemGRegRef(pVCpu, (a_iGReg)); \
         *pu32Reg += (a_u32Value); \
         pu32Reg[1] = 0; /* implicitly clear the high bit. */ \
     } while (0)
-#define IEM_MC_ADD_GREG_U64(a_iGReg, a_u64Value)        *(uint64_t *)iemGRegRef(pIemCpu, (a_iGReg)) += (a_u64Value)
-
-#define IEM_MC_SUB_GREG_U8(a_iGReg,  a_u8Value)         *(uint8_t *)iemGRegRef(pIemCpu, (a_iGReg)) -= (a_u8Value)
-#define IEM_MC_SUB_GREG_U16(a_iGReg, a_u16Value)        *(uint16_t *)iemGRegRef(pIemCpu, (a_iGReg)) -= (a_u16Value)
+#define IEM_MC_ADD_GREG_U64(a_iGReg, a_u64Value)        *(uint64_t *)iemGRegRef(pVCpu, (a_iGReg)) += (a_u64Value)
+
+#define IEM_MC_SUB_GREG_U8(a_iGReg,  a_u8Value)         *(uint8_t *)iemGRegRef(pVCpu, (a_iGReg)) -= (a_u8Value)
+#define IEM_MC_SUB_GREG_U16(a_iGReg, a_u16Value)        *(uint16_t *)iemGRegRef(pVCpu, (a_iGReg)) -= (a_u16Value)
 #define IEM_MC_SUB_GREG_U32(a_iGReg, a_u32Value) \
     do { \
-        uint32_t *pu32Reg = (uint32_t *)iemGRegRef(pIemCpu, (a_iGReg)); \
+        uint32_t *pu32Reg = (uint32_t *)iemGRegRef(pVCpu, (a_iGReg)); \
         *pu32Reg -= (a_u32Value); \
         pu32Reg[1] = 0; /* implicitly clear the high bit. */ \
     } while (0)
-#define IEM_MC_SUB_GREG_U64(a_iGReg, a_u64Value)        *(uint64_t *)iemGRegRef(pIemCpu, (a_iGReg)) -= (a_u64Value)
+#define IEM_MC_SUB_GREG_U64(a_iGReg, a_u64Value)        *(uint64_t *)iemGRegRef(pVCpu, (a_iGReg)) -= (a_u64Value)
 #define IEM_MC_SUB_LOCAL_U16(a_u16Value, a_u16Const)   do { (a_u16Value) -= a_u16Const; } while (0)
 
-#define IEM_MC_ADD_GREG_U8_TO_LOCAL(a_u8Value, a_iGReg)    do { (a_u8Value)  += iemGRegFetchU8( pIemCpu, (a_iGReg)); } while (0)
-#define IEM_MC_ADD_GREG_U16_TO_LOCAL(a_u16Value, a_iGReg)  do { (a_u16Value) += iemGRegFetchU16(pIemCpu, (a_iGReg)); } while (0)
-#define IEM_MC_ADD_GREG_U32_TO_LOCAL(a_u32Value, a_iGReg)  do { (a_u32Value) += iemGRegFetchU32(pIemCpu, (a_iGReg)); } while (0)
-#define IEM_MC_ADD_GREG_U64_TO_LOCAL(a_u64Value, a_iGReg)  do { (a_u64Value) += iemGRegFetchU64(pIemCpu, (a_iGReg)); } while (0)
+#define IEM_MC_ADD_GREG_U8_TO_LOCAL(a_u8Value, a_iGReg)    do { (a_u8Value)  += iemGRegFetchU8( pVCpu, (a_iGReg)); } while (0)
+#define IEM_MC_ADD_GREG_U16_TO_LOCAL(a_u16Value, a_iGReg)  do { (a_u16Value) += iemGRegFetchU16(pVCpu, (a_iGReg)); } while (0)
+#define IEM_MC_ADD_GREG_U32_TO_LOCAL(a_u32Value, a_iGReg)  do { (a_u32Value) += iemGRegFetchU32(pVCpu, (a_iGReg)); } while (0)
+#define IEM_MC_ADD_GREG_U64_TO_LOCAL(a_u64Value, a_iGReg)  do { (a_u64Value) += iemGRegFetchU64(pVCpu, (a_iGReg)); } while (0)
 #define IEM_MC_ADD_LOCAL_S16_TO_EFF_ADDR(a_EffAddr, a_i16) do { (a_EffAddr) += (a_i16); } while (0)
 #define IEM_MC_ADD_LOCAL_S32_TO_EFF_ADDR(a_EffAddr, a_i32) do { (a_EffAddr) += (a_i32); } while (0)
@@ -9853 +9856 @@
 #define IEM_MC_OR_2LOCS_U32(a_u32Local, a_u32Mask)      do { (a_u32Local) |= (a_u32Mask); } while (0)
 
-#define IEM_MC_AND_GREG_U8(a_iGReg, a_u8Value)          *(uint8_t  *)iemGRegRef(pIemCpu, (a_iGReg)) &= (a_u8Value)
-#define IEM_MC_AND_GREG_U16(a_iGReg, a_u16Value)        *(uint16_t *)iemGRegRef(pIemCpu, (a_iGReg)) &= (a_u16Value)
+#define IEM_MC_AND_GREG_U8(a_iGReg, a_u8Value)          *(uint8_t  *)iemGRegRef(pVCpu, (a_iGReg)) &= (a_u8Value)
+#define IEM_MC_AND_GREG_U16(a_iGReg, a_u16Value)        *(uint16_t *)iemGRegRef(pVCpu, (a_iGReg)) &= (a_u16Value)
 #define IEM_MC_AND_GREG_U32(a_iGReg, a_u32Value) \
     do { \
-        uint32_t *pu32Reg = (uint32_t *)iemGRegRef(pIemCpu, (a_iGReg)); \
+        uint32_t *pu32Reg = (uint32_t *)iemGRegRef(pVCpu, (a_iGReg)); \
         *pu32Reg &= (a_u32Value); \
         pu32Reg[1] = 0; /* implicitly clear the high bit. */ \
     } while (0)
-#define IEM_MC_AND_GREG_U64(a_iGReg, a_u64Value)        *(uint64_t *)iemGRegRef(pIemCpu, (a_iGReg)) &= (a_u64Value)
-
-#define IEM_MC_OR_GREG_U8(a_iGReg, a_u8Value)           *(uint8_t  *)iemGRegRef(pIemCpu, (a_iGReg)) |= (a_u8Value)
-#define IEM_MC_OR_GREG_U16(a_iGReg, a_u16Value)         *(uint16_t *)iemGRegRef(pIemCpu, (a_iGReg)) |= (a_u16Value)
+#define IEM_MC_AND_GREG_U64(a_iGReg, a_u64Value)        *(uint64_t *)iemGRegRef(pVCpu, (a_iGReg)) &= (a_u64Value)
+
+#define IEM_MC_OR_GREG_U8(a_iGReg, a_u8Value)           *(uint8_t  *)iemGRegRef(pVCpu, (a_iGReg)) |= (a_u8Value)
+#define IEM_MC_OR_GREG_U16(a_iGReg, a_u16Value)         *(uint16_t *)iemGRegRef(pVCpu, (a_iGReg)) |= (a_u16Value)
 #define IEM_MC_OR_GREG_U32(a_iGReg, a_u32Value) \
     do { \
-        uint32_t *pu32Reg = (uint32_t *)iemGRegRef(pIemCpu, (a_iGReg)); \
+        uint32_t *pu32Reg = (uint32_t *)iemGRegRef(pVCpu, (a_iGReg)); \
         *pu32Reg |= (a_u32Value); \
         pu32Reg[1] = 0; /* implicitly clear the high bit. */ \
     } while (0)
-#define IEM_MC_OR_GREG_U64(a_iGReg, a_u64Value)         *(uint64_t *)iemGRegRef(pIemCpu, (a_iGReg)) |= (a_u64Value)
+#define IEM_MC_OR_GREG_U64(a_iGReg, a_u64Value)         *(uint64_t *)iemGRegRef(pVCpu, (a_iGReg)) |= (a_u64Value)
 
 
 /** @note Not for IOPL or IF modification. */
-#define IEM_MC_SET_EFL_BIT(a_fBit)                      do { (pIemCpu)->CTX_SUFF(pCtx)->eflags.u |= (a_fBit); } while (0)
+#define IEM_MC_SET_EFL_BIT(a_fBit)                      do { (pVCpu)->iem.s.CTX_SUFF(pCtx)->eflags.u |= (a_fBit); } while (0)
 /** @note Not for IOPL or IF modification. */
-#define IEM_MC_CLEAR_EFL_BIT(a_fBit)                    do { (pIemCpu)->CTX_SUFF(pCtx)->eflags.u &= ~(a_fBit); } while (0)
+#define IEM_MC_CLEAR_EFL_BIT(a_fBit)                    do { (pVCpu)->iem.s.CTX_SUFF(pCtx)->eflags.u &= ~(a_fBit); } while (0)
 /** @note Not for IOPL or IF modification. */
-#define IEM_MC_FLIP_EFL_BIT(a_fBit)                     do { (pIemCpu)->CTX_SUFF(pCtx)->eflags.u ^= (a_fBit); } while (0)
-
-#define IEM_MC_CLEAR_FSW_EX()   do { (pIemCpu)->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FSW &= X86_FSW_C_MASK | X86_FSW_TOP_MASK; } while (0)
+#define IEM_MC_FLIP_EFL_BIT(a_fBit)                     do { (pVCpu)->iem.s.CTX_SUFF(pCtx)->eflags.u ^= (a_fBit); } while (0)
+
+#define IEM_MC_CLEAR_FSW_EX()   do { (pVCpu)->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FSW &= X86_FSW_C_MASK | X86_FSW_TOP_MASK; } while (0)
 
 
 #define IEM_MC_FETCH_MREG_U64(a_u64Value, a_iMReg) \
-    do { (a_u64Value) = pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx; } while (0)
+    do { (a_u64Value) = pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx; } while (0)
 #define IEM_MC_FETCH_MREG_U32(a_u32Value, a_iMReg) \
-    do { (a_u32Value) = pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].au32[0]; } while (0)
+    do { (a_u32Value) = pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].au32[0]; } while (0)
 #define IEM_MC_STORE_MREG_U64(a_iMReg, a_u64Value) \
-    do { pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx = (a_u64Value); } while (0)
+    do { pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx = (a_u64Value); } while (0)
 #define IEM_MC_STORE_MREG_U32_ZX_U64(a_iMReg, a_u32Value) \
-    do { pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx = (uint32_t)(a_u32Value); } while (0)
+    do { pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx = (uint32_t)(a_u32Value); } while (0)
 #define IEM_MC_REF_MREG_U64(a_pu64Dst, a_iMReg)         \
-        (a_pu64Dst) = (&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx)
+        (a_pu64Dst) = (&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx)
 #define IEM_MC_REF_MREG_U64_CONST(a_pu64Dst, a_iMReg) \
-        (a_pu64Dst) = ((uint64_t const *)&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx)
+        (a_pu64Dst) = ((uint64_t const *)&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx)
 #define IEM_MC_REF_MREG_U32_CONST(a_pu32Dst, a_iMReg) \
-        (a_pu32Dst) = ((uint32_t const *)&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx)
+        (a_pu32Dst) = ((uint32_t const *)&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aRegs[(a_iMReg)].mmx)
 
 #define IEM_MC_FETCH_XREG_U128(a_u128Value, a_iXReg) \
-    do { (a_u128Value) = pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].xmm; } while (0)
+    do { (a_u128Value) = pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].xmm; } while (0)
 #define IEM_MC_FETCH_XREG_U64(a_u64Value, a_iXReg) \
-    do { (a_u64Value) = pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0]; } while (0)
+    do { (a_u64Value) = pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0]; } while (0)
 #define IEM_MC_FETCH_XREG_U32(a_u32Value, a_iXReg) \
-    do { (a_u32Value) = pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au32[0]; } while (0)
+    do { (a_u32Value) = pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au32[0]; } while (0)
 #define IEM_MC_STORE_XREG_U128(a_iXReg, a_u128Value) \
-    do { pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].xmm = (a_u128Value); } while (0)
+    do { pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].xmm = (a_u128Value); } while (0)
 #define IEM_MC_STORE_XREG_U64(a_iXReg, a_u64Value) \
-    do { pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0] = (a_u64Value); } while (0)
+    do { pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0] = (a_u64Value); } while (0)
 #define IEM_MC_STORE_XREG_U64_ZX_U128(a_iXReg, a_u64Value) \
-    do { pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0] = (a_u64Value); \
-         pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[1] = 0; \
+    do { pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0] = (a_u64Value); \
+         pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[1] = 0; \
     } while (0)
 #define IEM_MC_STORE_XREG_U32_ZX_U128(a_iXReg, a_u32Value) \
-    do { pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0] = (uint32_t)(a_u32Value); \
-         pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[1] = 0; \
+    do { pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0] = (uint32_t)(a_u32Value); \
+         pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[1] = 0; \
     } while (0)
 #define IEM_MC_REF_XREG_U128(a_pu128Dst, a_iXReg)       \
-    (a_pu128Dst) = (&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].xmm)
+    (a_pu128Dst) = (&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].xmm)
 #define IEM_MC_REF_XREG_U128_CONST(a_pu128Dst, a_iXReg) \
-    (a_pu128Dst) = ((uint128_t const *)&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].xmm)
+    (a_pu128Dst) = ((uint128_t const *)&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].xmm)
 #define IEM_MC_REF_XREG_U64_CONST(a_pu64Dst, a_iXReg) \
-    (a_pu64Dst) = ((uint64_t const *)&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0])
+    (a_pu64Dst) = ((uint64_t const *)&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXReg)].au64[0])
 #define IEM_MC_COPY_XREG_U128(a_iXRegDst, a_iXRegSrc) \
-    do { pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXRegDst)].xmm \
-            = pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXRegSrc)].xmm; } while (0)
+    do { pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXRegDst)].xmm \
+            = pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.aXMM[(a_iXRegSrc)].xmm; } while (0)
 
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_FETCH_MEM_U8(a_u8Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pIemCpu, &(a_u8Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pVCpu, &(a_u8Dst), (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM16_U8(a_u8Dst, a_iSeg, a_GCPtrMem16) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pIemCpu, &(a_u8Dst), (a_iSeg), (a_GCPtrMem16)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pVCpu, &(a_u8Dst), (a_iSeg), (a_GCPtrMem16)))
 # define IEM_MC_FETCH_MEM32_U8(a_u8Dst, a_iSeg, a_GCPtrMem32) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pIemCpu, &(a_u8Dst), (a_iSeg), (a_GCPtrMem32)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pVCpu, &(a_u8Dst), (a_iSeg), (a_GCPtrMem32)))
 #else
 # define IEM_MC_FETCH_MEM_U8(a_u8Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u8Dst) = iemMemFetchDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u8Dst) = iemMemFetchDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM16_U8(a_u8Dst, a_iSeg, a_GCPtrMem16) \
-    ((a_u8Dst) = iemMemFetchDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem16)))
+    ((a_u8Dst) = iemMemFetchDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem16)))
 # define IEM_MC_FETCH_MEM32_U8(a_u8Dst, a_iSeg, a_GCPtrMem32) \
-    ((a_u8Dst) = iemMemFetchDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem32)))
+    ((a_u8Dst) = iemMemFetchDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem32)))
 #endif
 
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_FETCH_MEM_U16(a_u16Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pIemCpu, &(a_u16Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pVCpu, &(a_u16Dst), (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U16_DISP(a_u16Dst, a_iSeg, a_GCPtrMem, a_offDisp) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pIemCpu, &(a_u16Dst), (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pVCpu, &(a_u16Dst), (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
 # define IEM_MC_FETCH_MEM_I16(a_i16Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pIemCpu, (uint16_t *)&(a_i16Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pVCpu, (uint16_t *)&(a_i16Dst), (a_iSeg), (a_GCPtrMem)))
 #else
 # define IEM_MC_FETCH_MEM_U16(a_u16Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u16Dst) = iemMemFetchDataU16Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u16Dst) = iemMemFetchDataU16Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U16_DISP(a_u16Dst, a_iSeg, a_GCPtrMem, a_offDisp) \
-    ((a_u16Dst) = iemMemFetchDataU16Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
+    ((a_u16Dst) = iemMemFetchDataU16Jmp(pVCpu, (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
 # define IEM_MC_FETCH_MEM_I16(a_i16Dst, a_iSeg, a_GCPtrMem) \
-    ((a_i16Dst) = (int16_t)iemMemFetchDataU16Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_i16Dst) = (int16_t)iemMemFetchDataU16Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 #endif
 
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_FETCH_MEM_U32(a_u32Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pIemCpu, &(a_u32Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pVCpu, &(a_u32Dst), (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U32_DISP(a_u32Dst, a_iSeg, a_GCPtrMem, a_offDisp) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pIemCpu, &(a_u32Dst), (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pVCpu, &(a_u32Dst), (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
 # define IEM_MC_FETCH_MEM_I32(a_i32Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pIemCpu, (uint32_t *)&(a_i32Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pVCpu, (uint32_t *)&(a_i32Dst), (a_iSeg), (a_GCPtrMem)))
 #else
 # define IEM_MC_FETCH_MEM_U32(a_u32Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u32Dst) = iemMemFetchDataU32Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u32Dst) = iemMemFetchDataU32Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U32_DISP(a_u32Dst, a_iSeg, a_GCPtrMem, a_offDisp) \
-    ((a_u32Dst) = iemMemFetchDataU32Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
+    ((a_u32Dst) = iemMemFetchDataU32Jmp(pVCpu, (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
 # define IEM_MC_FETCH_MEM_I32(a_i32Dst, a_iSeg, a_GCPtrMem) \
-    ((a_i32Dst) = (int32_t)iemMemFetchDataU32Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_i32Dst) = (int32_t)iemMemFetchDataU32Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 #endif
 
 #ifdef SOME_UNUSED_FUNCTION
 # define IEM_MC_FETCH_MEM_S32_SX_U64(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataS32SxU64(pIemCpu, &(a_u64Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataS32SxU64(pVCpu, &(a_u64Dst), (a_iSeg), (a_GCPtrMem)))
 #endif
 
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_FETCH_MEM_U64(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64(pIemCpu, &(a_u64Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64(pVCpu, &(a_u64Dst), (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U64_DISP(a_u64Dst, a_iSeg, a_GCPtrMem, a_offDisp) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64(pIemCpu, &(a_u64Dst), (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64(pVCpu, &(a_u64Dst), (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
 # define IEM_MC_FETCH_MEM_U64_ALIGN_U128(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64AlignedU128(pIemCpu, &(a_u64Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64AlignedU128(pVCpu, &(a_u64Dst), (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_I64(a_i64Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64(pIemCpu, (uint64_t *)&(a_i64Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64(pVCpu, (uint64_t *)&(a_i64Dst), (a_iSeg), (a_GCPtrMem)))
 #else
 # define IEM_MC_FETCH_MEM_U64(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u64Dst) = iemMemFetchDataU64Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u64Dst) = iemMemFetchDataU64Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U64_DISP(a_u64Dst, a_iSeg, a_GCPtrMem, a_offDisp) \
-    ((a_u64Dst) = iemMemFetchDataU64Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
+    ((a_u64Dst) = iemMemFetchDataU64Jmp(pVCpu, (a_iSeg), (a_GCPtrMem) + (a_offDisp)))
 # define IEM_MC_FETCH_MEM_U64_ALIGN_U128(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u64Dst) = iemMemFetchDataU64AlignedU128Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u64Dst) = iemMemFetchDataU64AlignedU128Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_I64(a_i64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_i64Dst) = (int64_t)iemMemFetchDataU64Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_i64Dst) = (int64_t)iemMemFetchDataU64Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 #endif
 
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_FETCH_MEM_R32(a_r32Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pIemCpu, &(a_r32Dst).u32, (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pVCpu, &(a_r32Dst).u32, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_R64(a_r64Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64(pIemCpu, &(a_r64Dst).au64[0], (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU64(pVCpu, &(a_r64Dst).au64[0], (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_R80(a_r80Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataR80(pIemCpu, &(a_r80Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataR80(pVCpu, &(a_r80Dst), (a_iSeg), (a_GCPtrMem)))
 #else
 # define IEM_MC_FETCH_MEM_R32(a_r32Dst, a_iSeg, a_GCPtrMem) \
-    ((a_r32Dst).u32 = iemMemFetchDataU32Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_r32Dst).u32 = iemMemFetchDataU32Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_R64(a_r64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_r64Dst).au64[0] = iemMemFetchDataU64Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_r64Dst).au64[0] = iemMemFetchDataU64Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_R80(a_r80Dst, a_iSeg, a_GCPtrMem) \
-    iemMemFetchDataR80Jmp(pIemCpu, &(a_r80Dst), (a_iSeg), (a_GCPtrMem))
+    iemMemFetchDataR80Jmp(pVCpu, &(a_r80Dst), (a_iSeg), (a_GCPtrMem))
 #endif
 
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_FETCH_MEM_U128(a_u128Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU128(pIemCpu, &(a_u128Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU128(pVCpu, &(a_u128Dst), (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U128_ALIGN_SSE(a_u128Dst, a_iSeg, a_GCPtrMem) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU128AlignedSse(pIemCpu, &(a_u128Dst), (a_iSeg), (a_GCPtrMem)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU128AlignedSse(pVCpu, &(a_u128Dst), (a_iSeg), (a_GCPtrMem)))
 #else
 # define IEM_MC_FETCH_MEM_U128(a_u128Dst, a_iSeg, a_GCPtrMem) \
-    iemMemFetchDataU128Jmp(pIemCpu, &(a_u128Dst), (a_iSeg), (a_GCPtrMem))
+    iemMemFetchDataU128Jmp(pVCpu, &(a_u128Dst), (a_iSeg), (a_GCPtrMem))
 # define IEM_MC_FETCH_MEM_U128_ALIGN_SSE(a_u128Dst, a_iSeg, a_GCPtrMem) \
-    iemMemFetchDataU128AlignedSseJmp(pIemCpu, &(a_u128Dst), (a_iSeg), (a_GCPtrMem))
+    iemMemFetchDataU128AlignedSseJmp(pVCpu, &(a_u128Dst), (a_iSeg), (a_GCPtrMem))
 #endif
 
@@ -10034 +10037 @@
     do { \
         uint8_t u8Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pIemCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pVCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u16Dst) = u8Tmp; \
     } while (0)
@@ -10040 +10043 @@
     do { \
         uint8_t u8Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pIemCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pVCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u32Dst) = u8Tmp; \
     } while (0)
@@ -10046 +10049 @@
     do { \
         uint8_t u8Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pIemCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pVCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u64Dst) = u8Tmp; \
     } while (0)
@@ -10052 +10055 @@
     do { \
         uint16_t u16Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pIemCpu, &u16Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pVCpu, &u16Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u32Dst) = u16Tmp; \
     } while (0)
@@ -10058 +10061 @@
     do { \
         uint16_t u16Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pIemCpu, &u16Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pVCpu, &u16Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u64Dst) = u16Tmp; \
     } while (0)
@@ -10064 +10067 @@
     do { \
         uint32_t u32Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pIemCpu, &u32Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pVCpu, &u32Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u64Dst) = u32Tmp; \
     } while (0)
 #else  /* IEM_WITH_SETJMP */
 # define IEM_MC_FETCH_MEM_U8_ZX_U16(a_u16Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u16Dst) = iemMemFetchDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u16Dst) = iemMemFetchDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U8_ZX_U32(a_u32Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u32Dst) = iemMemFetchDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u32Dst) = iemMemFetchDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U8_ZX_U64(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u64Dst) = iemMemFetchDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u64Dst) = iemMemFetchDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U16_ZX_U32(a_u32Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u32Dst) = iemMemFetchDataU16Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u32Dst) = iemMemFetchDataU16Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U16_ZX_U64(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u64Dst) = iemMemFetchDataU16Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u64Dst) = iemMemFetchDataU16Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U32_ZX_U64(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u64Dst) = iemMemFetchDataU32Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u64Dst) = iemMemFetchDataU32Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 #endif /* IEM_WITH_SETJMP */
 
@@ -10086 +10089 @@
     do { \
         uint8_t u8Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pIemCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pVCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u16Dst) = (int8_t)u8Tmp; \
     } while (0)
@@ -10092 +10095 @@
     do { \
         uint8_t u8Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pIemCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pVCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u32Dst) = (int8_t)u8Tmp; \
     } while (0)
@@ -10098 +10101 @@
     do { \
         uint8_t u8Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pIemCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU8(pVCpu, &u8Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u64Dst) = (int8_t)u8Tmp; \
     } while (0)
@@ -10104 +10107 @@
     do { \
         uint16_t u16Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pIemCpu, &u16Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pVCpu, &u16Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u32Dst) = (int16_t)u16Tmp; \
     } while (0)
@@ -10110 +10113 @@
     do { \
         uint16_t u16Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pIemCpu, &u16Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU16(pVCpu, &u16Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u64Dst) = (int16_t)u16Tmp; \
     } while (0)
@@ -10116 +10119 @@
     do { \
         uint32_t u32Tmp; \
-        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pIemCpu, &u32Tmp, (a_iSeg), (a_GCPtrMem))); \
+        IEM_MC_RETURN_ON_FAILURE(iemMemFetchDataU32(pVCpu, &u32Tmp, (a_iSeg), (a_GCPtrMem))); \
         (a_u64Dst) = (int32_t)u32Tmp; \
     } while (0)
 #else  /* IEM_WITH_SETJMP */
 # define IEM_MC_FETCH_MEM_U8_SX_U16(a_u16Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u16Dst) = (int8_t)iemMemFetchDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u16Dst) = (int8_t)iemMemFetchDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U8_SX_U32(a_u32Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u32Dst) = (int8_t)iemMemFetchDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u32Dst) = (int8_t)iemMemFetchDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U8_SX_U64(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u64Dst) = (int8_t)iemMemFetchDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u64Dst) = (int8_t)iemMemFetchDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U16_SX_U32(a_u32Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u32Dst) = (int16_t)iemMemFetchDataU16Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u32Dst) = (int16_t)iemMemFetchDataU16Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U16_SX_U64(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u64Dst) = (int16_t)iemMemFetchDataU16Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u64Dst) = (int16_t)iemMemFetchDataU16Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 # define IEM_MC_FETCH_MEM_U32_SX_U64(a_u64Dst, a_iSeg, a_GCPtrMem) \
-    ((a_u64Dst) = (int32_t)iemMemFetchDataU32Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem)))
+    ((a_u64Dst) = (int32_t)iemMemFetchDataU32Jmp(pVCpu, (a_iSeg), (a_GCPtrMem)))
 #endif /* IEM_WITH_SETJMP */
 
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_STORE_MEM_U8(a_iSeg, a_GCPtrMem, a_u8Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU8(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u8Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU8(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u8Value)))
 # define IEM_MC_STORE_MEM_U16(a_iSeg, a_GCPtrMem, a_u16Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU16(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u16Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU16(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u16Value)))
 # define IEM_MC_STORE_MEM_U32(a_iSeg, a_GCPtrMem, a_u32Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU32(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u32Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU32(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u32Value)))
 # define IEM_MC_STORE_MEM_U64(a_iSeg, a_GCPtrMem, a_u64Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU64(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u64Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU64(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u64Value)))
 #else
 # define IEM_MC_STORE_MEM_U8(a_iSeg, a_GCPtrMem, a_u8Value) \
-    iemMemStoreDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u8Value))
+    iemMemStoreDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u8Value))
 # define IEM_MC_STORE_MEM_U16(a_iSeg, a_GCPtrMem, a_u16Value) \
-    iemMemStoreDataU16Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u16Value))
+    iemMemStoreDataU16Jmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u16Value))
 # define IEM_MC_STORE_MEM_U32(a_iSeg, a_GCPtrMem, a_u32Value) \
-    iemMemStoreDataU32Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u32Value))
+    iemMemStoreDataU32Jmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u32Value))
 # define IEM_MC_STORE_MEM_U64(a_iSeg, a_GCPtrMem, a_u64Value) \
-    iemMemStoreDataU64Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u64Value))
+    iemMemStoreDataU64Jmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u64Value))
 #endif
 
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_STORE_MEM_U8_CONST(a_iSeg, a_GCPtrMem, a_u8C) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU8(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u8C)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU8(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u8C)))
 # define IEM_MC_STORE_MEM_U16_CONST(a_iSeg, a_GCPtrMem, a_u16C) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU16(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u16C)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU16(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u16C)))
 # define IEM_MC_STORE_MEM_U32_CONST(a_iSeg, a_GCPtrMem, a_u32C) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU32(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u32C)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU32(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u32C)))
 # define IEM_MC_STORE_MEM_U64_CONST(a_iSeg, a_GCPtrMem, a_u64C) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU64(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u64C)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU64(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u64C)))
 #else
 # define IEM_MC_STORE_MEM_U8_CONST(a_iSeg, a_GCPtrMem, a_u8C) \
-    iemMemStoreDataU8Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u8C))
+    iemMemStoreDataU8Jmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u8C))
 # define IEM_MC_STORE_MEM_U16_CONST(a_iSeg, a_GCPtrMem, a_u16C) \
-    iemMemStoreDataU16Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u16C))
+    iemMemStoreDataU16Jmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u16C))
 # define IEM_MC_STORE_MEM_U32_CONST(a_iSeg, a_GCPtrMem, a_u32C) \
-    iemMemStoreDataU32Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u32C))
+    iemMemStoreDataU32Jmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u32C))
 # define IEM_MC_STORE_MEM_U64_CONST(a_iSeg, a_GCPtrMem, a_u64C) \
-    iemMemStoreDataU64Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u64C))
+    iemMemStoreDataU64Jmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u64C))
 #endif
 
@@ -10188 +10191 @@
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_STORE_MEM_U128(a_iSeg, a_GCPtrMem, a_u128Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU128(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u128Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU128(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u128Value)))
 # define IEM_MC_STORE_MEM_U128_ALIGN_SSE(a_iSeg, a_GCPtrMem, a_u128Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU128AlignedSse(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u128Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStoreDataU128AlignedSse(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u128Value)))
 #else
 # define IEM_MC_STORE_MEM_U128(a_iSeg, a_GCPtrMem, a_u128Value) \
-    iemMemStoreDataU128Jmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u128Value))
+    iemMemStoreDataU128Jmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u128Value))
 # define IEM_MC_STORE_MEM_U128_ALIGN_SSE(a_iSeg, a_GCPtrMem, a_u128Value) \
-    iemMemStoreDataU128AlignedSseJmp(pIemCpu, (a_iSeg), (a_GCPtrMem), (a_u128Value))
+    iemMemStoreDataU128AlignedSseJmp(pVCpu, (a_iSeg), (a_GCPtrMem), (a_u128Value))
 #endif
 
 
 #define IEM_MC_PUSH_U16(a_u16Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStackPushU16(pIemCpu, (a_u16Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStackPushU16(pVCpu, (a_u16Value)))
 #define IEM_MC_PUSH_U32(a_u32Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStackPushU32(pIemCpu, (a_u32Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStackPushU32(pVCpu, (a_u32Value)))
 #define IEM_MC_PUSH_U32_SREG(a_u32Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStackPushU32SReg(pIemCpu, (a_u32Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStackPushU32SReg(pVCpu, (a_u32Value)))
 #define IEM_MC_PUSH_U64(a_u64Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStackPushU64(pIemCpu, (a_u64Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStackPushU64(pVCpu, (a_u64Value)))
 
 #define IEM_MC_POP_U16(a_pu16Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStackPopU16(pIemCpu, (a_pu16Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStackPopU16(pVCpu, (a_pu16Value)))
 #define IEM_MC_POP_U32(a_pu32Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStackPopU32(pIemCpu, (a_pu32Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStackPopU32(pVCpu, (a_pu32Value)))
 #define IEM_MC_POP_U64(a_pu64Value) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemStackPopU64(pIemCpu, (a_pu64Value)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemStackPopU64(pVCpu, (a_pu64Value)))
 
 /** Maps guest memory for direct or bounce buffered access.
@@ -10220 +10223 @@
  */
 #define IEM_MC_MEM_MAP(a_pMem, a_fAccess, a_iSeg, a_GCPtrMem, a_iArg) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pIemCpu, (void **)&(a_pMem), sizeof(*(a_pMem)), (a_iSeg), (a_GCPtrMem), (a_fAccess)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pMem), sizeof(*(a_pMem)), (a_iSeg), (a_GCPtrMem), (a_fAccess)))
 
 /** Maps guest memory for direct or bounce buffered access.
@@ -10227 +10230 @@
  */
 #define IEM_MC_MEM_MAP_EX(a_pvMem, a_fAccess, a_cbMem, a_iSeg, a_GCPtrMem, a_iArg) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pIemCpu, (void **)&(a_pvMem), (a_cbMem), (a_iSeg), (a_GCPtrMem), (a_fAccess)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pvMem), (a_cbMem), (a_iSeg), (a_GCPtrMem), (a_fAccess)))
 
 /** Commits the memory and unmaps the guest memory.
@@ -10233 +10236 @@
  */
 #define IEM_MC_MEM_COMMIT_AND_UNMAP(a_pvMem, a_fAccess) \
-    IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pIemCpu, (a_pvMem), (a_fAccess)))
+    IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, (a_pvMem), (a_fAccess)))
 
 /** Commits the memory and unmaps the guest memory unless the FPU status word
@@ -10248 +10251 @@
         if (   !(a_u16FSW & X86_FSW_ES) \
             || !(  (a_u16FSW & (X86_FSW_UE | X86_FSW_OE | X86_FSW_IE)) \
-                 & ~(pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FCW & X86_FCW_MASK_ALL) ) ) \
-            IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pIemCpu, (a_pvMem), (a_fAccess))); \
+                 & ~(pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FCW & X86_FCW_MASK_ALL) ) ) \
+            IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, (a_pvMem), (a_fAccess))); \
     } while (0)
 
@@ -10255 +10258 @@
 #ifndef IEM_WITH_SETJMP
 # define IEM_MC_CALC_RM_EFF_ADDR(a_GCPtrEff, bRm, cbImm) \
-    IEM_MC_RETURN_ON_FAILURE(iemOpHlpCalcRmEffAddr(pIemCpu, (bRm), (cbImm), &(a_GCPtrEff)))
+    IEM_MC_RETURN_ON_FAILURE(iemOpHlpCalcRmEffAddr(pVCpu, (bRm), (cbImm), &(a_GCPtrEff)))
 #else
 # define IEM_MC_CALC_RM_EFF_ADDR(a_GCPtrEff, bRm, cbImm) \
-    ((a_GCPtrEff) = iemOpHlpCalcRmEffAddrJmp(pIemCpu, (bRm), (cbImm)))
+    ((a_GCPtrEff) = iemOpHlpCalcRmEffAddrJmp(pVCpu, (bRm), (cbImm)))
 #endif
 
@@ -10276 +10279 @@
  * @sa      IEM_DECL_IMPL_C_TYPE_0 and IEM_CIMPL_DEF_0.
  */
-#define IEM_MC_CALL_CIMPL_0(a_pfnCImpl)                 return (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode)
+#define IEM_MC_CALL_CIMPL_0(a_pfnCImpl)                 return (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode)
 
 /**
@@ -10285 +10288 @@
  * @param   a0              The argument.
  */
-#define IEM_MC_CALL_CIMPL_1(a_pfnCImpl, a0)             return (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode, a0)
+#define IEM_MC_CALL_CIMPL_1(a_pfnCImpl, a0)             return (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode, a0)
 
 /**
@@ -10295 +10298 @@
  * @param   a1              The second extra argument.
  */
-#define IEM_MC_CALL_CIMPL_2(a_pfnCImpl, a0, a1)         return (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode, a0, a1)
+#define IEM_MC_CALL_CIMPL_2(a_pfnCImpl, a0, a1)         return (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode, a0, a1)
 
 /**
@@ -10306 +10309 @@
  * @param   a2              The third extra argument.
  */
-#define IEM_MC_CALL_CIMPL_3(a_pfnCImpl, a0, a1, a2)     return (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode, a0, a1, a2)
+#define IEM_MC_CALL_CIMPL_3(a_pfnCImpl, a0, a1, a2)     return (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode, a0, a1, a2)
 
 /**
@@ -10318 +10321 @@
  * @param   a3              The fourth extra argument.
  */
-#define IEM_MC_CALL_CIMPL_4(a_pfnCImpl, a0, a1, a2, a3)     return (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode, a0, a1, a2, a3)
+#define IEM_MC_CALL_CIMPL_4(a_pfnCImpl, a0, a1, a2, a3)     return (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode, a0, a1, a2, a3)
 
 /**
@@ -10331 +10334 @@
  * @param   a4              The fifth extra argument.
  */
-#define IEM_MC_CALL_CIMPL_5(a_pfnCImpl, a0, a1, a2, a3, a4) return (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode, a0, a1, a2, a3, a4)
+#define IEM_MC_CALL_CIMPL_5(a_pfnCImpl, a0, a1, a2, a3, a4) return (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode, a0, a1, a2, a3, a4)
 
 /**
@@ -10342 +10345 @@
  * @sa      IEM_DECL_IMPL_C_TYPE_0 and IEM_CIMPL_DEF_0.
  */
-#define IEM_MC_DEFER_TO_CIMPL_0(a_pfnCImpl)             (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode)
+#define IEM_MC_DEFER_TO_CIMPL_0(a_pfnCImpl)             (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode)
 
 /**
@@ -10353 +10356 @@
  * @param   a0              The argument.
  */
-#define IEM_MC_DEFER_TO_CIMPL_1(a_pfnCImpl, a0)         (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode, a0)
+#define IEM_MC_DEFER_TO_CIMPL_1(a_pfnCImpl, a0)         (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode, a0)
 
 /**
@@ -10365 +10368 @@
  * @param   a1              The second extra argument.
  */
-#define IEM_MC_DEFER_TO_CIMPL_2(a_pfnCImpl, a0, a1)     (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode, a0, a1)
+#define IEM_MC_DEFER_TO_CIMPL_2(a_pfnCImpl, a0, a1)     (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode, a0, a1)
 
 /**
@@ -10378 +10381 @@
  * @param   a2              The third extra argument.
  */
-#define IEM_MC_DEFER_TO_CIMPL_3(a_pfnCImpl, a0, a1, a2) (a_pfnCImpl)(pIemCpu, pIemCpu->offOpcode, a0, a1, a2)
+#define IEM_MC_DEFER_TO_CIMPL_3(a_pfnCImpl, a0, a1, a2) (a_pfnCImpl)(pVCpu, pVCpu->iem.s.offOpcode, a0, a1, a2)
 
 /**
@@ -10388 +10391 @@
 #define IEM_MC_CALL_FPU_AIMPL_1(a_pfnAImpl, a0) \
     do { \
-        a_pfnAImpl(&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0)); \
+        a_pfnAImpl(&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0)); \
     } while (0)
 
@@ -10400 +10403 @@
 #define IEM_MC_CALL_FPU_AIMPL_2(a_pfnAImpl, a0, a1) \
     do { \
-        a_pfnAImpl(&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1)); \
+        a_pfnAImpl(&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1)); \
     } while (0)
 
@@ -10413 +10416 @@
 #define IEM_MC_CALL_FPU_AIMPL_3(a_pfnAImpl, a0, a1, a2) \
     do { \
-        a_pfnAImpl(&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1), (a2)); \
+        a_pfnAImpl(&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1), (a2)); \
     } while (0)
 
@@ -10424 +10427 @@
 /** Pushes FPU result onto the stack. */
 #define IEM_MC_PUSH_FPU_RESULT(a_FpuData) \
-    iemFpuPushResult(pIemCpu, &a_FpuData)
+    iemFpuPushResult(pVCpu, &a_FpuData)
 /** Pushes FPU result onto the stack and sets the FPUDP. */
 #define IEM_MC_PUSH_FPU_RESULT_MEM_OP(a_FpuData, a_iEffSeg, a_GCPtrEff) \
-    iemFpuPushResultWithMemOp(pIemCpu, &a_FpuData, a_iEffSeg, a_GCPtrEff)
+    iemFpuPushResultWithMemOp(pVCpu, &a_FpuData, a_iEffSeg, a_GCPtrEff)
 
 /** Replaces ST0 with value one and pushes value 2 onto the FPU stack. */
 #define IEM_MC_PUSH_FPU_RESULT_TWO(a_FpuDataTwo) \
-    iemFpuPushResultTwo(pIemCpu, &a_FpuDataTwo)
+    iemFpuPushResultTwo(pVCpu, &a_FpuDataTwo)
 
 /** Stores FPU result in a stack register. */
 #define IEM_MC_STORE_FPU_RESULT(a_FpuData, a_iStReg) \
-    iemFpuStoreResult(pIemCpu, &a_FpuData, a_iStReg)
+    iemFpuStoreResult(pVCpu, &a_FpuData, a_iStReg)
 /** Stores FPU result in a stack register and pops the stack. */
 #define IEM_MC_STORE_FPU_RESULT_THEN_POP(a_FpuData, a_iStReg) \
-    iemFpuStoreResultThenPop(pIemCpu, &a_FpuData, a_iStReg)
+    iemFpuStoreResultThenPop(pVCpu, &a_FpuData, a_iStReg)
 /** Stores FPU result in a stack register and sets the FPUDP. */
 #define IEM_MC_STORE_FPU_RESULT_MEM_OP(a_FpuData, a_iStReg, a_iEffSeg, a_GCPtrEff) \
-    iemFpuStoreResultWithMemOp(pIemCpu, &a_FpuData, a_iStReg, a_iEffSeg, a_GCPtrEff)
+    iemFpuStoreResultWithMemOp(pVCpu, &a_FpuData, a_iStReg, a_iEffSeg, a_GCPtrEff)
 /** Stores FPU result in a stack register, sets the FPUDP, and pops the
  *  stack. */
 #define IEM_MC_STORE_FPU_RESULT_WITH_MEM_OP_THEN_POP(a_FpuData, a_iStReg, a_iEffSeg, a_GCPtrEff) \
-    iemFpuStoreResultWithMemOpThenPop(pIemCpu, &a_FpuData, a_iStReg, a_iEffSeg, a_GCPtrEff)
+    iemFpuStoreResultWithMemOpThenPop(pVCpu, &a_FpuData, a_iStReg, a_iEffSeg, a_GCPtrEff)
 
 /** Only update the FOP, FPUIP, and FPUCS. (For FNOP.) */
 #define IEM_MC_UPDATE_FPU_OPCODE_IP() \
-    iemFpuUpdateOpcodeAndIp(pIemCpu)
+    iemFpuUpdateOpcodeAndIp(pVCpu)
 /** Free a stack register (for FFREE and FFREEP). */
 #define IEM_MC_FPU_STACK_FREE(a_iStReg) \
-    iemFpuStackFree(pIemCpu, a_iStReg)
+    iemFpuStackFree(pVCpu, a_iStReg)
 /** Increment the FPU stack pointer. */
 #define IEM_MC_FPU_STACK_INC_TOP() \
-    iemFpuStackIncTop(pIemCpu)
+    iemFpuStackIncTop(pVCpu)
 /** Decrement the FPU stack pointer. */
 #define IEM_MC_FPU_STACK_DEC_TOP() \
-    iemFpuStackDecTop(pIemCpu)
+    iemFpuStackDecTop(pVCpu)
 
 /** Updates the FSW, FOP, FPUIP, and FPUCS. */
 #define IEM_MC_UPDATE_FSW(a_u16FSW) \
-    iemFpuUpdateFSW(pIemCpu, a_u16FSW)
+    iemFpuUpdateFSW(pVCpu, a_u16FSW)
 /** Updates the FSW with a constant value as well as FOP, FPUIP, and FPUCS. */
 #define IEM_MC_UPDATE_FSW_CONST(a_u16FSW) \
-    iemFpuUpdateFSW(pIemCpu, a_u16FSW)
+    iemFpuUpdateFSW(pVCpu, a_u16FSW)
 /** Updates the FSW, FOP, FPUIP, FPUCS, FPUDP, and FPUDS. */
 #define IEM_MC_UPDATE_FSW_WITH_MEM_OP(a_u16FSW, a_iEffSeg, a_GCPtrEff) \
-    iemFpuUpdateFSWWithMemOp(pIemCpu, a_u16FSW, a_iEffSeg, a_GCPtrEff)
+    iemFpuUpdateFSWWithMemOp(pVCpu, a_u16FSW, a_iEffSeg, a_GCPtrEff)
 /** Updates the FSW, FOP, FPUIP, and FPUCS, and then pops the stack. */
 #define IEM_MC_UPDATE_FSW_THEN_POP(a_u16FSW) \
-    iemFpuUpdateFSWThenPop(pIemCpu, a_u16FSW)
+    iemFpuUpdateFSWThenPop(pVCpu, a_u16FSW)
 /** Updates the FSW, FOP, FPUIP, FPUCS, FPUDP and FPUDS, and then pops the
  *  stack. */
 #define IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(a_u16FSW, a_iEffSeg, a_GCPtrEff) \
-    iemFpuUpdateFSWWithMemOpThenPop(pIemCpu, a_u16FSW, a_iEffSeg, a_GCPtrEff)
+    iemFpuUpdateFSWWithMemOpThenPop(pVCpu, a_u16FSW, a_iEffSeg, a_GCPtrEff)
 /** Updates the FSW, FOP, FPUIP, and FPUCS, and then pops the stack twice. */
 #define IEM_MC_UPDATE_FSW_THEN_POP_POP(a_u16FSW) \
-    iemFpuUpdateFSWThenPop(pIemCpu, a_u16FSW)
+    iemFpuUpdateFSWThenPop(pVCpu, a_u16FSW)
 
 /** Raises a FPU stack underflow exception.  Sets FPUIP, FPUCS and FOP. */
 #define IEM_MC_FPU_STACK_UNDERFLOW(a_iStDst) \
-    iemFpuStackUnderflow(pIemCpu, a_iStDst)
+    iemFpuStackUnderflow(pVCpu, a_iStDst)
 /** Raises a FPU stack underflow exception.  Sets FPUIP, FPUCS and FOP. Pops
  *  stack. */
 #define IEM_MC_FPU_STACK_UNDERFLOW_THEN_POP(a_iStDst) \
-    iemFpuStackUnderflowThenPop(pIemCpu, a_iStDst)
+    iemFpuStackUnderflowThenPop(pVCpu, a_iStDst)
 /** Raises a FPU stack underflow exception.  Sets FPUIP, FPUCS, FOP, FPUDP and
  *  FPUDS. */
 #define IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(a_iStDst, a_iEffSeg, a_GCPtrEff) \
-    iemFpuStackUnderflowWithMemOp(pIemCpu, a_iStDst, a_iEffSeg, a_GCPtrEff)
+    iemFpuStackUnderflowWithMemOp(pVCpu, a_iStDst, a_iEffSeg, a_GCPtrEff)
 /** Raises a FPU stack underflow exception.  Sets FPUIP, FPUCS, FOP, FPUDP and
  *  FPUDS. Pops stack. */
 #define IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(a_iStDst, a_iEffSeg, a_GCPtrEff) \
-    iemFpuStackUnderflowWithMemOpThenPop(pIemCpu, a_iStDst, a_iEffSeg, a_GCPtrEff)
+    iemFpuStackUnderflowWithMemOpThenPop(pVCpu, a_iStDst, a_iEffSeg, a_GCPtrEff)
 /** Raises a FPU stack underflow exception.  Sets FPUIP, FPUCS and FOP. Pops
  *  stack twice. */
 #define IEM_MC_FPU_STACK_UNDERFLOW_THEN_POP_POP() \
-    iemFpuStackUnderflowThenPopPop(pIemCpu)
+    iemFpuStackUnderflowThenPopPop(pVCpu)
 /** Raises a FPU stack underflow exception for an instruction pushing a result
  *  value onto the stack. Sets FPUIP, FPUCS and FOP. */
 #define IEM_MC_FPU_STACK_PUSH_UNDERFLOW() \
-    iemFpuStackPushUnderflow(pIemCpu)
+    iemFpuStackPushUnderflow(pVCpu)
 /** Raises a FPU stack underflow exception for an instruction pushing a result
  *  value onto the stack and replacing ST0. Sets FPUIP, FPUCS and FOP. */
 #define IEM_MC_FPU_STACK_PUSH_UNDERFLOW_TWO() \
-    iemFpuStackPushUnderflowTwo(pIemCpu)
+    iemFpuStackPushUnderflowTwo(pVCpu)
 
 /** Raises a FPU stack overflow exception as part of a push attempt.  Sets
  *  FPUIP, FPUCS and FOP. */
 #define IEM_MC_FPU_STACK_PUSH_OVERFLOW() \
-    iemFpuStackPushOverflow(pIemCpu)
+    iemFpuStackPushOverflow(pVCpu)
 /** Raises a FPU stack overflow exception as part of a push attempt.  Sets
  *  FPUIP, FPUCS, FOP, FPUDP and FPUDS. */
 #define IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(a_iEffSeg, a_GCPtrEff) \
-    iemFpuStackPushOverflowWithMemOp(pIemCpu, a_iEffSeg, a_GCPtrEff)
+    iemFpuStackPushOverflowWithMemOp(pVCpu, a_iEffSeg, a_GCPtrEff)
 /** Prepares for using the FPU state.
  * Ensures that we can use the host FPU in the current context (RC+R0.
  * Ensures the guest FPU state in the CPUMCTX is up to date. */
-#define IEM_MC_PREPARE_FPU_USAGE()              iemFpuPrepareUsage(pIemCpu)
+#define IEM_MC_PREPARE_FPU_USAGE()              iemFpuPrepareUsage(pVCpu)
 /** Actualizes the guest FPU state so it can be accessed read-only fashion. */
-#define IEM_MC_ACTUALIZE_FPU_STATE_FOR_READ()   iemFpuActualizeStateForRead(pIemCpu)
+#define IEM_MC_ACTUALIZE_FPU_STATE_FOR_READ()   iemFpuActualizeStateForRead(pVCpu)
 /** Actualizes the guest FPU state so it can be accessed and modified. */
-#define IEM_MC_ACTUALIZE_FPU_STATE_FOR_CHANGE() iemFpuActualizeStateForChange(pIemCpu)
+#define IEM_MC_ACTUALIZE_FPU_STATE_FOR_CHANGE() iemFpuActualizeStateForChange(pVCpu)
 
 /** Prepares for using the SSE state.
  * Ensures that we can use the host SSE/FPU in the current context (RC+R0.
  * Ensures the guest SSE state in the CPUMCTX is up to date. */
-#define IEM_MC_PREPARE_SSE_USAGE()              iemFpuPrepareUsageSse(pIemCpu)
+#define IEM_MC_PREPARE_SSE_USAGE()              iemFpuPrepareUsageSse(pVCpu)
 /** Actualizes the guest XMM0..15 register state for read-only access. */
-#define IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ()   iemFpuActualizeSseStateForRead(pIemCpu)
+#define IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ()   iemFpuActualizeSseStateForRead(pVCpu)
 /** Actualizes the guest XMM0..15 register state for read-write access. */
-#define IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE() iemFpuActualizeSseStateForChange(pIemCpu)
+#define IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE() iemFpuActualizeSseStateForChange(pVCpu)
 
 /**
@@ -10544 +10547 @@
     do { \
         IEM_MC_PREPARE_FPU_USAGE(); \
-        a_pfnAImpl(&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1)); \
+        a_pfnAImpl(&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1)); \
     } while (0)
 
@@ -10558 +10561 @@
     do { \
         IEM_MC_PREPARE_FPU_USAGE(); \
-        a_pfnAImpl(&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1), (a2)); \
+        a_pfnAImpl(&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1), (a2)); \
     } while (0)
 
@@ -10572 +10575 @@
     do { \
         IEM_MC_PREPARE_SSE_USAGE(); \
-        a_pfnAImpl(&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1)); \
+        a_pfnAImpl(&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1)); \
     } while (0)
 
@@ -10586 +10589 @@
     do { \
         IEM_MC_PREPARE_SSE_USAGE(); \
-        a_pfnAImpl(&pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1), (a2)); \
+        a_pfnAImpl(&pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87, (a0), (a1), (a2)); \
     } while (0)
 
 /** @note Not for IOPL or IF testing. */
-#define IEM_MC_IF_EFL_BIT_SET(a_fBit)                   if (pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit)) {
+#define IEM_MC_IF_EFL_BIT_SET(a_fBit)                   if (pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit)) {
 /** @note Not for IOPL or IF testing. */
-#define IEM_MC_IF_EFL_BIT_NOT_SET(a_fBit)               if (!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit))) {
+#define IEM_MC_IF_EFL_BIT_NOT_SET(a_fBit)               if (!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit))) {
 /** @note Not for IOPL or IF testing. */
-#define IEM_MC_IF_EFL_ANY_BITS_SET(a_fBits)             if (pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBits)) {
+#define IEM_MC_IF_EFL_ANY_BITS_SET(a_fBits)             if (pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBits)) {
 /** @note Not for IOPL or IF testing. */
-#define IEM_MC_IF_EFL_NO_BITS_SET(a_fBits)              if (!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBits))) {
+#define IEM_MC_IF_EFL_NO_BITS_SET(a_fBits)              if (!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBits))) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_EFL_BITS_NE(a_fBit1, a_fBit2)         \
-    if (   !!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit1)) \
-        != !!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit2)) ) {
+    if (   !!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit1)) \
+        != !!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit2)) ) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_EFL_BITS_EQ(a_fBit1, a_fBit2)         \
-    if (   !!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit1)) \
-        == !!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit2)) ) {
+    if (   !!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit1)) \
+        == !!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit2)) ) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_EFL_BIT_SET_OR_BITS_NE(a_fBit, a_fBit1, a_fBit2) \
-    if (   (pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit)) \
-        ||    !!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit1)) \
-           != !!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit2)) ) {
+    if (   (pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit)) \
+        ||    !!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit1)) \
+           != !!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit2)) ) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_EFL_BIT_NOT_SET_AND_BITS_EQ(a_fBit, a_fBit1, a_fBit2) \
-    if (   !(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit)) \
-        &&    !!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit1)) \
-           == !!(pIemCpu->CTX_SUFF(pCtx)->eflags.u & (a_fBit2)) ) {
-#define IEM_MC_IF_CX_IS_NZ()                            if (pIemCpu->CTX_SUFF(pCtx)->cx != 0) {
-#define IEM_MC_IF_ECX_IS_NZ()                           if (pIemCpu->CTX_SUFF(pCtx)->ecx != 0) {
-#define IEM_MC_IF_RCX_IS_NZ()                           if (pIemCpu->CTX_SUFF(pCtx)->rcx != 0) {
+    if (   !(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit)) \
+        &&    !!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit1)) \
+           == !!(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & (a_fBit2)) ) {
+#define IEM_MC_IF_CX_IS_NZ()                            if (pVCpu->iem.s.CTX_SUFF(pCtx)->cx != 0) {
+#define IEM_MC_IF_ECX_IS_NZ()                           if (pVCpu->iem.s.CTX_SUFF(pCtx)->ecx != 0) {
+#define IEM_MC_IF_RCX_IS_NZ()                           if (pVCpu->iem.s.CTX_SUFF(pCtx)->rcx != 0) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_CX_IS_NZ_AND_EFL_BIT_SET(a_fBit) \
-        if (   pIemCpu->CTX_SUFF(pCtx)->cx != 0 \
-            && (pIemCpu->CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
+        if (   pVCpu->iem.s.CTX_SUFF(pCtx)->cx != 0 \
+            && (pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_ECX_IS_NZ_AND_EFL_BIT_SET(a_fBit) \
-        if (   pIemCpu->CTX_SUFF(pCtx)->ecx != 0 \
-            && (pIemCpu->CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
+        if (   pVCpu->iem.s.CTX_SUFF(pCtx)->ecx != 0 \
+            && (pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_RCX_IS_NZ_AND_EFL_BIT_SET(a_fBit) \
-        if (   pIemCpu->CTX_SUFF(pCtx)->rcx != 0 \
-            && (pIemCpu->CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
+        if (   pVCpu->iem.s.CTX_SUFF(pCtx)->rcx != 0 \
+            && (pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_CX_IS_NZ_AND_EFL_BIT_NOT_SET(a_fBit) \
-        if (   pIemCpu->CTX_SUFF(pCtx)->cx != 0 \
-            && !(pIemCpu->CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
+        if (   pVCpu->iem.s.CTX_SUFF(pCtx)->cx != 0 \
+            && !(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_ECX_IS_NZ_AND_EFL_BIT_NOT_SET(a_fBit) \
-        if (   pIemCpu->CTX_SUFF(pCtx)->ecx != 0 \
-            && !(pIemCpu->CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
+        if (   pVCpu->iem.s.CTX_SUFF(pCtx)->ecx != 0 \
+            && !(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
 /** @note Not for IOPL or IF testing. */
 #define IEM_MC_IF_RCX_IS_NZ_AND_EFL_BIT_NOT_SET(a_fBit) \
-        if (   pIemCpu->CTX_SUFF(pCtx)->rcx != 0 \
-            && !(pIemCpu->CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
+        if (   pVCpu->iem.s.CTX_SUFF(pCtx)->rcx != 0 \
+            && !(pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.u & a_fBit)) {
 #define IEM_MC_IF_LOCAL_IS_Z(a_Local)                   if ((a_Local) == 0) {
-#define IEM_MC_IF_GREG_BIT_SET(a_iGReg, a_iBitNo)       if (*(uint64_t *)iemGRegRef(pIemCpu, (a_iGReg)) & RT_BIT_64(a_iBitNo)) {
+#define IEM_MC_IF_GREG_BIT_SET(a_iGReg, a_iBitNo)       if (*(uint64_t *)iemGRegRef(pVCpu, (a_iGReg)) & RT_BIT_64(a_iBitNo)) {
 
 #define IEM_MC_IF_FPUREG_NOT_EMPTY(a_iSt) \
-    if (iemFpuStRegNotEmpty(pIemCpu, (a_iSt)) == VINF_SUCCESS) {
+    if (iemFpuStRegNotEmpty(pVCpu, (a_iSt)) == VINF_SUCCESS) {
 #define IEM_MC_IF_FPUREG_IS_EMPTY(a_iSt) \
-    if (iemFpuStRegNotEmpty(pIemCpu, (a_iSt)) != VINF_SUCCESS) {
+    if (iemFpuStRegNotEmpty(pVCpu, (a_iSt)) != VINF_SUCCESS) {
 #define IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(a_pr80Dst, a_iSt) \
-    if (iemFpuStRegNotEmptyRef(pIemCpu, (a_iSt), &(a_pr80Dst)) == VINF_SUCCESS) {
+    if (iemFpuStRegNotEmptyRef(pVCpu, (a_iSt), &(a_pr80Dst)) == VINF_SUCCESS) {
 #define IEM_MC_IF_TWO_FPUREGS_NOT_EMPTY_REF_R80(a_pr80Dst0, a_iSt0, a_pr80Dst1, a_iSt1) \
-    if (iemFpu2StRegsNotEmptyRef(pIemCpu, (a_iSt0), &(a_pr80Dst0), (a_iSt1), &(a_pr80Dst1)) == VINF_SUCCESS) {
+    if (iemFpu2StRegsNotEmptyRef(pVCpu, (a_iSt0), &(a_pr80Dst0), (a_iSt1), &(a_pr80Dst1)) == VINF_SUCCESS) {
 #define IEM_MC_IF_TWO_FPUREGS_NOT_EMPTY_REF_R80_FIRST(a_pr80Dst0, a_iSt0, a_iSt1) \
-    if (iemFpu2StRegsNotEmptyRefFirst(pIemCpu, (a_iSt0), &(a_pr80Dst0), (a_iSt1)) == VINF_SUCCESS) {
+    if (iemFpu2StRegsNotEmptyRefFirst(pVCpu, (a_iSt0), &(a_pr80Dst0), (a_iSt1)) == VINF_SUCCESS) {
 #define IEM_MC_IF_FCW_IM() \
-    if (pIemCpu->CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FCW & X86_FCW_IM) {
+    if (pVCpu->iem.s.CTX_SUFF(pCtx)->CTX_SUFF(pXState)->x87.FCW & X86_FCW_IM) {
 
 #define IEM_MC_ELSE()                                   } else {
@@ -10669 +10672 @@
 #ifdef DEBUG
 # define IEMOP_MNEMONIC(a_szMnemonic) \
-    Log4(("decode - %04x:%RGv %s%s [#%u]\n", pIemCpu->CTX_SUFF(pCtx)->cs.Sel, pIemCpu->CTX_SUFF(pCtx)->rip, \
-          pIemCpu->fPrefixes & IEM_OP_PRF_LOCK ? "lock " : "", a_szMnemonic, pIemCpu->cInstructions))
+    Log4(("decode - %04x:%RGv %s%s [#%u]\n", pVCpu->iem.s.CTX_SUFF(pCtx)->cs.Sel, pVCpu->iem.s.CTX_SUFF(pCtx)->rip, \
+          pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK ? "lock " : "", a_szMnemonic, pVCpu->iem.s.cInstructions))
 # define IEMOP_MNEMONIC2(a_szMnemonic, a_szOps) \
-    Log4(("decode - %04x:%RGv %s%s %s [#%u]\n", pIemCpu->CTX_SUFF(pCtx)->cs.Sel, pIemCpu->CTX_SUFF(pCtx)->rip, \
-          pIemCpu->fPrefixes & IEM_OP_PRF_LOCK ? "lock " : "", a_szMnemonic, a_szOps, pIemCpu->cInstructions))
+    Log4(("decode - %04x:%RGv %s%s %s [#%u]\n", pVCpu->iem.s.CTX_SUFF(pCtx)->cs.Sel, pVCpu->iem.s.CTX_SUFF(pCtx)->rip, \
+          pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK ? "lock " : "", a_szMnemonic, a_szOps, pVCpu->iem.s.cInstructions))
 #else
 # define IEMOP_MNEMONIC(a_szMnemonic) do { } while (0)
@@ -10689 +10692 @@
 # define IEMOP_HLP_MIN_CPU(a_uMinCpu, a_fOnlyIf) \
     do { \
-        if (IEM_GET_TARGET_CPU(pIemCpu) >= (a_uMinCpu) || !(a_fOnlyIf)) { } \
+        if (IEM_GET_TARGET_CPU(pVCpu) >= (a_uMinCpu) || !(a_fOnlyIf)) { } \
         else \
         { \
-            DBGFSTOP(IEMCPU_TO_VM(pIemCpu)); \
+            DBGFSTOP(pVCpu->CTX_SUFF(pVM)); \
             return IEMOP_RAISE_INVALID_OPCODE(); \
         } \
@@ -10699 +10702 @@
 # define IEMOP_HLP_MIN_CPU(a_uMinCpu, a_fOnlyIf) \
     do { \
-        if (IEM_GET_TARGET_CPU(pIemCpu) >= (a_uMinCpu) || !(a_fOnlyIf)) { } \
+        if (IEM_GET_TARGET_CPU(pVCpu) >= (a_uMinCpu) || !(a_fOnlyIf)) { } \
         else return IEMOP_RAISE_INVALID_OPCODE(); \
     } while (0)
@@ -10758 +10761 @@
     do \
     { \
-        if (IEM_IS_REAL_OR_V86_MODE(pIemCpu)) \
+        if (IEM_IS_REAL_OR_V86_MODE(pVCpu)) \
             return IEMOP_RAISE_INVALID_LOCK_PREFIX(); \
     } while (0)
@@ -10768 +10771 @@
     do \
     { \
-        if (pIemCpu->fPrefixes & IEM_OP_PRF_LOCK) \
+        if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK) \
             return IEMOP_RAISE_INVALID_LOCK_PREFIX(); \
     } while (0)
@@ -10777 +10780 @@
     do \
     { \
-        if (pIemCpu->enmCpuMode == IEMMODE_64BIT) \
+        if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT) \
             return IEMOP_RAISE_INVALID_OPCODE(); \
     } while (0)
@@ -10786 +10789 @@
     do \
     { \
-        if (pIemCpu->enmCpuMode != IEMMODE_64BIT) \
+        if (pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT) \
             return IEMOP_RAISE_INVALID_OPCODE(); \
     } while (0)
@@ -10794 +10797 @@
     do \
     { \
-        if (pIemCpu->enmCpuMode == IEMMODE_64BIT) \
-            iemRecalEffOpSize64Default(pIemCpu); \
+        if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT) \
+            iemRecalEffOpSize64Default(pVCpu); \
     } while (0)
 
@@ -10802 +10805 @@
     do \
     { \
-        if (pIemCpu->enmCpuMode == IEMMODE_64BIT) \
-            pIemCpu->enmEffOpSize = pIemCpu->enmDefOpSize = IEMMODE_64BIT; \
+        if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT) \
+            pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.enmDefOpSize = IEMMODE_64BIT; \
     } while (0)
 
@@ -10811 +10814 @@
     do \
     { \
-        if (RT_UNLIKELY(pIemCpu->fPrefixes & IEM_OP_PRF_REX)) \
+        if (RT_UNLIKELY(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REX)) \
         { \
             Log5((a_szPrf ": Overriding REX prefix at %RX16! fPrefixes=%#x\n", \
-                  pIemCpu->CTX_SUFF(pCtx)->rip, pIemCpu->fPrefixes)); \
-            pIemCpu->fPrefixes &= ~IEM_OP_PRF_REX_MASK; \
-            pIemCpu->uRexB     = 0; \
-            pIemCpu->uRexIndex = 0; \
-            pIemCpu->uRexReg   = 0; \
-            iemRecalEffOpSize(pIemCpu); \
+                  pVCpu->iem.s.CTX_SUFF(pCtx)->rip, pVCpu->iem.s.fPrefixes)); \
+            pVCpu->iem.s.fPrefixes &= ~IEM_OP_PRF_REX_MASK; \
+            pVCpu->iem.s.uRexB     = 0; \
+            pVCpu->iem.s.uRexIndex = 0; \
+            pVCpu->iem.s.uRexReg   = 0; \
+            iemRecalEffOpSize(pVCpu); \
         } \
     } while (0)
@@ -10838 +10841 @@
     do \
     { \
-        if (RT_LIKELY(!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))) \
+        if (RT_LIKELY(!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))) \
         { /* likely */ } \
         else \
@@ -10846 +10849 @@
     do \
     { \
-        if (RT_LIKELY(!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))) \
+        if (RT_LIKELY(!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))) \
         { /* likely */ } \
         else \
@@ -10857 +10860 @@
     do \
     { \
-        if (RT_LIKELY(!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))) \
+        if (RT_LIKELY(!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))) \
         { /* likely */ } \
         else \
@@ -10872 +10875 @@
     do \
     { \
-        if (RT_LIKELY(!(pIemCpu->fPrefixes & (IEM_OP_PRF_LOCK | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ)))) \
+        if (RT_LIKELY(!(pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_LOCK | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ)))) \
         { /* likely */ } \
         else \
@@ -10885 +10888 @@
  *
  * @return  Strict VBox status code.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   bRm                 The ModRM byte.
  * @param   cbImm               The size of any immediate following the
@@ -10892 +10895 @@
  * @param   pGCPtrEff           Where to return the effective address.
  */
-IEM_STATIC VBOXSTRICTRC iemOpHlpCalcRmEffAddr(PIEMCPU pIemCpu, uint8_t bRm, uint8_t cbImm, PRTGCPTR pGCPtrEff)
+IEM_STATIC VBOXSTRICTRC iemOpHlpCalcRmEffAddr(PVMCPU pVCpu, uint8_t bRm, uint8_t cbImm, PRTGCPTR pGCPtrEff)
 {
     Log5(("iemOpHlpCalcRmEffAddr: bRm=%#x\n", bRm));
-    PCCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 # define SET_SS_DEF() \
     do \
     { \
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_SEG_MASK)) \
-            pIemCpu->iEffSeg = X86_SREG_SS; \
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SEG_MASK)) \
+            pVCpu->iem.s.iEffSeg = X86_SREG_SS; \
     } while (0)
 
-    if (pIemCpu->enmCpuMode != IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT)
     {
 /** @todo Check the effective address size crap! */
-        if (pIemCpu->enmEffAddrMode == IEMMODE_16BIT)
+        if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT)
         {
             uint16_t u16EffAddr;
@@ -10942 +10945 @@
         else
         {
-            Assert(pIemCpu->enmEffAddrMode == IEMMODE_32BIT);
+            Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT);
             uint32_t u32EffAddr;
 
@@ -11031 +11034 @@
 
             }
-            if (pIemCpu->enmEffAddrMode == IEMMODE_32BIT)
+            if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT)
                 *pGCPtrEff = u32EffAddr;
             else
             {
-                Assert(pIemCpu->enmEffAddrMode == IEMMODE_16BIT);
+                Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT);
                 *pGCPtrEff = u32EffAddr & UINT16_MAX;
             }
@@ -11048 +11051 @@
         {
             IEM_OPCODE_GET_NEXT_S32_SX_U64(&u64EffAddr);
-            u64EffAddr += pCtx->rip + pIemCpu->offOpcode + cbImm;
+            u64EffAddr += pCtx->rip + pVCpu->iem.s.offOpcode + cbImm;
         }
         else
         {
             /* Get the register (or SIB) value. */
-            switch ((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB)
+            switch ((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB)
             {
                 case  0: u64EffAddr = pCtx->rax; break;
@@ -11076 +11079 @@
 
                     /* Get the index and scale it. */
-                    switch (((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) | pIemCpu->uRexIndex)
+                    switch (((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) | pVCpu->iem.s.uRexIndex)
                     {
                         case  0: u64EffAddr = pCtx->rax; break;
@@ -11099 +11102 @@
 
                     /* add base */
-                    switch ((bSib & X86_SIB_BASE_MASK) | pIemCpu->uRexB)
+                    switch ((bSib & X86_SIB_BASE_MASK) | pVCpu->iem.s.uRexB)
                     {
                         case  0: u64EffAddr += pCtx->rax; break;
@@ -11120 +11123 @@
                             if ((bRm & X86_MODRM_MOD_MASK) != 0)
                             {
-                                if (!pIemCpu->uRexB)
+                                if (!pVCpu->iem.s.uRexB)
                                 {
                                     u64EffAddr += pCtx->rbp;
@@ -11166 +11169 @@
         }
 
-        if (pIemCpu->enmEffAddrMode == IEMMODE_64BIT)
+        if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
             *pGCPtrEff = u64EffAddr;
         else
         {
-            Assert(pIemCpu->enmEffAddrMode == IEMMODE_32BIT);
+            Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT);
             *pGCPtrEff = u64EffAddr & UINT32_MAX;
         }
@@ -11189 +11192 @@
  *
  * @return  The effective address.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   bRm                 The ModRM byte.
  * @param   cbImm               The size of any immediate following the
@@ -11195 +11198 @@
  *                              RIP relative addressing.
  */
-IEM_STATIC RTGCPTR iemOpHlpCalcRmEffAddrJmp(PIEMCPU pIemCpu, uint8_t bRm, uint8_t cbImm)
+IEM_STATIC RTGCPTR iemOpHlpCalcRmEffAddrJmp(PVMCPU pVCpu, uint8_t bRm, uint8_t cbImm)
 {
     Log5(("iemOpHlpCalcRmEffAddrJmp: bRm=%#x\n", bRm));
-    PCCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 # define SET_SS_DEF() \
     do \
     { \
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_SEG_MASK)) \
-            pIemCpu->iEffSeg = X86_SREG_SS; \
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SEG_MASK)) \
+            pVCpu->iem.s.iEffSeg = X86_SREG_SS; \
     } while (0)
 
-    if (pIemCpu->enmCpuMode != IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT)
     {
 /** @todo Check the effective address size crap! */
-        if (pIemCpu->enmEffAddrMode == IEMMODE_16BIT)
+        if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT)
         {
             uint16_t u16EffAddr;
@@ -11224 +11227 @@
                     case 1:  IEM_OPCODE_GET_NEXT_S8_SX_U16(&u16EffAddr); break;
                     case 2:  IEM_OPCODE_GET_NEXT_U16(&u16EffAddr);       break;
-                    default: AssertFailedStmt(longjmp(*pIemCpu->CTX_SUFF(pJmpBuf), VERR_IEM_IPE_1)); /* (caller checked for these) */
+                    default: AssertFailedStmt(longjmp(*pVCpu->iem.s.CTX_SUFF(pJmpBuf), VERR_IEM_IPE_1)); /* (caller checked for these) */
                 }
 
@@ -11245 +11248 @@
         }
 
-        Assert(pIemCpu->enmEffAddrMode == IEMMODE_32BIT);
+        Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT);
         uint32_t u32EffAddr;
 
@@ -11334 +11337 @@
         }
 
-        if (pIemCpu->enmEffAddrMode == IEMMODE_32BIT)
+        if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT)
         {
             Log5(("iemOpHlpCalcRmEffAddrJmp: EffAddr=%#010RX32\n", u32EffAddr));
             return u32EffAddr;
         }
-        Assert(pIemCpu->enmEffAddrMode == IEMMODE_16BIT);
+        Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_16BIT);
         Log5(("iemOpHlpCalcRmEffAddrJmp: EffAddr=%#06RX32\n", u32EffAddr & UINT16_MAX));
         return u32EffAddr & UINT16_MAX;
@@ -11350 +11353 @@
     {
         IEM_OPCODE_GET_NEXT_S32_SX_U64(&u64EffAddr);
-        u64EffAddr += pCtx->rip + pIemCpu->offOpcode + cbImm;
+        u64EffAddr += pCtx->rip + pVCpu->iem.s.offOpcode + cbImm;
     }
     else
     {
         /* Get the register (or SIB) value. */
-        switch ((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB)
+        switch ((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB)
         {
             case  0: u64EffAddr = pCtx->rax; break;
@@ -11378 +11381 @@
 
                 /* Get the index and scale it. */
-                switch (((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) | pIemCpu->uRexIndex)
+                switch (((bSib >> X86_SIB_INDEX_SHIFT) & X86_SIB_INDEX_SMASK) | pVCpu->iem.s.uRexIndex)
                 {
                     case  0: u64EffAddr = pCtx->rax; break;
@@ -11401 +11404 @@
 
                 /* add base */
-                switch ((bSib & X86_SIB_BASE_MASK) | pIemCpu->uRexB)
+                switch ((bSib & X86_SIB_BASE_MASK) | pVCpu->iem.s.uRexB)
                 {
                     case  0: u64EffAddr += pCtx->rax; break;
@@ -11422 +11425 @@
                         if ((bRm & X86_MODRM_MOD_MASK) != 0)
                         {
-                            if (!pIemCpu->uRexB)
+                            if (!pVCpu->iem.s.uRexB)
                             {
                                 u64EffAddr += pCtx->rbp;
@@ -11468 +11471 @@
     }
 
-    if (pIemCpu->enmEffAddrMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmEffAddrMode == IEMMODE_64BIT)
     {
         Log5(("iemOpHlpCalcRmEffAddrJmp: EffAddr=%#010RGv\n", u64EffAddr));
         return u64EffAddr;
     }
-    Assert(pIemCpu->enmEffAddrMode == IEMMODE_32BIT);
+    Assert(pVCpu->iem.s.enmEffAddrMode == IEMMODE_32BIT);
     Log5(("iemOpHlpCalcRmEffAddrJmp: EffAddr=%#010RGv\n", u64EffAddr & UINT32_MAX));
     return u64EffAddr & UINT32_MAX;
@@ -11497 +11500 @@
  * Sets up execution verification mode.
  */
-IEM_STATIC void iemExecVerificationModeSetup(PIEMCPU pIemCpu)
-{
-    PVMCPU   pVCpu   = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX pOrgCtx = pIemCpu->CTX_SUFF(pCtx);
+IEM_STATIC void iemExecVerificationModeSetup(PVMCPU pVCpu)
+{
+    PVMCPU   pVCpu   = pVCpu;
+    PCPUMCTX pOrgCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
      * Always note down the address of the current instruction.
      */
-    pIemCpu->uOldCs  = pOrgCtx->cs.Sel;
-    pIemCpu->uOldRip = pOrgCtx->rip;
+    pVCpu->iem.s.uOldCs  = pOrgCtx->cs.Sel;
+    pVCpu->iem.s.uOldRip = pOrgCtx->rip;
 
     /*
@@ -11593 +11596 @@
         fNewNoRem = false;
     }
-    if (fNewNoRem != pIemCpu->fNoRem)
-    {
-        pIemCpu->fNoRem = fNewNoRem;
+    if (fNewNoRem != pVCpu->iem.s.fNoRem)
+    {
+        pVCpu->iem.s.fNoRem = fNewNoRem;
         if (!fNewNoRem)
         {
@@ -11608 +11611 @@
      * Switch state.
      */
-    if (IEM_VERIFICATION_ENABLED(pIemCpu))
+    if (IEM_VERIFICATION_ENABLED(pVCpu))
     {
         static CPUMCTX  s_DebugCtx; /* Ugly! */
 
         s_DebugCtx = *pOrgCtx;
-        pIemCpu->CTX_SUFF(pCtx) = &s_DebugCtx;
+        pVCpu->iem.s.CTX_SUFF(pCtx) = &s_DebugCtx;
     }
 
@@ -11619 +11622 @@
      * See if there is an interrupt pending in TRPM and inject it if we can.
      */
-    pIemCpu->uInjectCpl = UINT8_MAX;
+    pVCpu->iem.s.uInjectCpl = UINT8_MAX;
     if (   pOrgCtx->eflags.Bits.u1IF
         && TRPMHasTrap(pVCpu)
@@ -11630 +11633 @@
         int rc2 = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrCode, &uCr2, NULL /* pu8InstLen */); AssertRC(rc2);
         IEMInjectTrap(pVCpu, u8TrapNo, enmType, (uint16_t)uErrCode, uCr2, 0 /* cbInstr */);
-        if (!IEM_VERIFICATION_ENABLED(pIemCpu))
+        if (!IEM_VERIFICATION_ENABLED(pVCpu))
             TRPMResetTrap(pVCpu);
-        pIemCpu->uInjectCpl = pIemCpu->uCpl;
+        pVCpu->iem.s.uInjectCpl = pVCpu->iem.s.uCpl;
     }
 
@@ -11638 +11641 @@
      * Reset the counters.
      */
-    pIemCpu->cIOReads    = 0;
-    pIemCpu->cIOWrites   = 0;
-    pIemCpu->fIgnoreRaxRdx = false;
-    pIemCpu->fOverlappingMovs = false;
-    pIemCpu->fProblematicMemory = false;
-    pIemCpu->fUndefinedEFlags = 0;
-
-    if (IEM_VERIFICATION_ENABLED(pIemCpu))
+    pVCpu->iem.s.cIOReads    = 0;
+    pVCpu->iem.s.cIOWrites   = 0;
+    pVCpu->iem.s.fIgnoreRaxRdx = false;
+    pVCpu->iem.s.fOverlappingMovs = false;
+    pVCpu->iem.s.fProblematicMemory = false;
+    pVCpu->iem.s.fUndefinedEFlags = 0;
+
+    if (IEM_VERIFICATION_ENABLED(pVCpu))
     {
         /*
          * Free all verification records.
          */
-        PIEMVERIFYEVTREC pEvtRec = pIemCpu->pIemEvtRecHead;
-        pIemCpu->pIemEvtRecHead = NULL;
-        pIemCpu->ppIemEvtRecNext = &pIemCpu->pIemEvtRecHead;
+        PIEMVERIFYEVTREC pEvtRec = pVCpu->iem.s.pIemEvtRecHead;
+        pVCpu->iem.s.pIemEvtRecHead = NULL;
+        pVCpu->iem.s.ppIemEvtRecNext = &pVCpu->iem.s.pIemEvtRecHead;
         do
         {
@@ -11658 +11661 @@
             {
                 PIEMVERIFYEVTREC pNext = pEvtRec->pNext;
-                pEvtRec->pNext = pIemCpu->pFreeEvtRec;
-                pIemCpu->pFreeEvtRec = pEvtRec;
+                pEvtRec->pNext = pVCpu->iem.s.pFreeEvtRec;
+                pVCpu->iem.s.pFreeEvtRec = pEvtRec;
                 pEvtRec = pNext;
             }
-            pEvtRec = pIemCpu->pOtherEvtRecHead;
-            pIemCpu->pOtherEvtRecHead = NULL;
-            pIemCpu->ppOtherEvtRecNext = &pIemCpu->pOtherEvtRecHead;
+            pEvtRec = pVCpu->iem.s.pOtherEvtRecHead;
+            pVCpu->iem.s.pOtherEvtRecHead = NULL;
+            pVCpu->iem.s.ppOtherEvtRecNext = &pVCpu->iem.s.pOtherEvtRecHead;
         } while (pEvtRec);
     }
@@ -11674 +11677 @@
  * @returns Pointer to a record.
  */
-IEM_STATIC PIEMVERIFYEVTREC iemVerifyAllocRecord(PIEMCPU pIemCpu)
-{
-    if (!IEM_VERIFICATION_ENABLED(pIemCpu))
+IEM_STATIC PIEMVERIFYEVTREC iemVerifyAllocRecord(PVMCPU pVCpu)
+{
+    if (!IEM_VERIFICATION_ENABLED(pVCpu))
         return NULL;
 
-    PIEMVERIFYEVTREC pEvtRec = pIemCpu->pFreeEvtRec;
+    PIEMVERIFYEVTREC pEvtRec = pVCpu->iem.s.pFreeEvtRec;
     if (pEvtRec)
-        pIemCpu->pFreeEvtRec = pEvtRec->pNext;
+        pVCpu->iem.s.pFreeEvtRec = pEvtRec->pNext;
     else
     {
-        if (!pIemCpu->ppIemEvtRecNext)
+        if (!pVCpu->iem.s.ppIemEvtRecNext)
             return NULL; /* Too early (fake PCIBIOS), ignore notification. */
 
-        pEvtRec = (PIEMVERIFYEVTREC)MMR3HeapAlloc(IEMCPU_TO_VM(pIemCpu), MM_TAG_EM /* lazy bird*/, sizeof(*pEvtRec));
+        pEvtRec = (PIEMVERIFYEVTREC)MMR3HeapAlloc(pVCpu->CTX_SUFF(pVM), MM_TAG_EM /* lazy bird*/, sizeof(*pEvtRec));
         if (!pEvtRec)
             return NULL;
@@ -11705 +11708 @@
     if (!pVCpu)
         return;
-    PIEMCPU             pIemCpu = &pVCpu->iem.s;
-    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pIemCpu);
+    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pVCpu);
     if (!pEvtRec)
         return;
@@ -11712 +11714 @@
     pEvtRec->u.RamRead.GCPhys  = GCPhys;
     pEvtRec->u.RamRead.cb      = (uint32_t)cbValue;
-    pEvtRec->pNext = *pIemCpu->ppOtherEvtRecNext;
-    *pIemCpu->ppOtherEvtRecNext = pEvtRec;
+    pEvtRec->pNext = *pVCpu->iem.s.ppOtherEvtRecNext;
+    *pVCpu->iem.s.ppOtherEvtRecNext = pEvtRec;
 }
 
@@ -11725 +11727 @@
     if (!pVCpu)
         return;
-    PIEMCPU             pIemCpu = &pVCpu->iem.s;
-    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pIemCpu);
+    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pVCpu);
     if (!pEvtRec)
         return;
@@ -11736 +11737 @@
     pEvtRec->u.RamWrite.ab[2]    = RT_BYTE3(u32Value);
     pEvtRec->u.RamWrite.ab[3]    = RT_BYTE4(u32Value);
-    pEvtRec->pNext = *pIemCpu->ppOtherEvtRecNext;
-    *pIemCpu->ppOtherEvtRecNext = pEvtRec;
+    pEvtRec->pNext = *pVCpu->iem.s.ppOtherEvtRecNext;
+    *pVCpu->iem.s.ppOtherEvtRecNext = pEvtRec;
 }
 
@@ -11749 +11750 @@
     if (!pVCpu)
         return;
-    PIEMCPU             pIemCpu = &pVCpu->iem.s;
-    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pIemCpu);
+    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pVCpu);
     if (!pEvtRec)
         return;
@@ -11756 +11756 @@
     pEvtRec->u.IOPortRead.Port    = Port;
     pEvtRec->u.IOPortRead.cbValue = (uint8_t)cbValue;
-    pEvtRec->pNext = *pIemCpu->ppOtherEvtRecNext;
-    *pIemCpu->ppOtherEvtRecNext = pEvtRec;
+    pEvtRec->pNext = *pVCpu->iem.s.ppOtherEvtRecNext;
+    *pVCpu->iem.s.ppOtherEvtRecNext = pEvtRec;
 }
 
@@ -11768 +11768 @@
     if (!pVCpu)
         return;
-    PIEMCPU             pIemCpu = &pVCpu->iem.s;
-    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pIemCpu);
+    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pVCpu);
     if (!pEvtRec)
         return;
@@ -11776 +11775 @@
     pEvtRec->u.IOPortWrite.cbValue  = (uint8_t)cbValue;
     pEvtRec->u.IOPortWrite.u32Value = u32Value;
-    pEvtRec->pNext = *pIemCpu->ppOtherEvtRecNext;
-    *pIemCpu->ppOtherEvtRecNext = pEvtRec;
+    pEvtRec->pNext = *pVCpu->iem.s.ppOtherEvtRecNext;
+    *pVCpu->iem.s.ppOtherEvtRecNext = pEvtRec;
 }
 
@@ -11786 +11785 @@
     if (!pVCpu)
         return;
-    PIEMCPU             pIemCpu = &pVCpu->iem.s;
-    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pIemCpu);
+    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pVCpu);
     if (!pEvtRec)
         return;
@@ -11794 +11792 @@
     pEvtRec->u.IOPortStrRead.cbValue    = (uint8_t)cbValue;
     pEvtRec->u.IOPortStrRead.cTransfers = cTransfers;
-    pEvtRec->pNext = *pIemCpu->ppOtherEvtRecNext;
-    *pIemCpu->ppOtherEvtRecNext = pEvtRec;
+    pEvtRec->pNext = *pVCpu->iem.s.ppOtherEvtRecNext;
+    *pVCpu->iem.s.ppOtherEvtRecNext = pEvtRec;
 }
 
@@ -11804 +11802 @@
     if (!pVCpu)
         return;
-    PIEMCPU             pIemCpu = &pVCpu->iem.s;
-    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pIemCpu);
+    PIEMVERIFYEVTREC    pEvtRec = iemVerifyAllocRecord(pVCpu);
     if (!pEvtRec)
         return;
@@ -11812 +11809 @@
     pEvtRec->u.IOPortStrWrite.cbValue    = (uint8_t)cbValue;
     pEvtRec->u.IOPortStrWrite.cTransfers = cTransfers;
-    pEvtRec->pNext = *pIemCpu->ppOtherEvtRecNext;
-    *pIemCpu->ppOtherEvtRecNext = pEvtRec;
+    pEvtRec->pNext = *pVCpu->iem.s.ppOtherEvtRecNext;
+    *pVCpu->iem.s.ppOtherEvtRecNext = pEvtRec;
 }
 
@@ -11821 +11818 @@
  *
  * @returns VINF_SUCCESS.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   Port                The I/O port.
  * @param   pu32Value           Where to store the fake value.
  * @param   cbValue             The size of the access.
  */
-IEM_STATIC VBOXSTRICTRC iemVerifyFakeIOPortRead(PIEMCPU pIemCpu, RTIOPORT Port, uint32_t *pu32Value, size_t cbValue)
-{
-    PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pIemCpu);
+IEM_STATIC VBOXSTRICTRC iemVerifyFakeIOPortRead(PVMCPU pVCpu, RTIOPORT Port, uint32_t *pu32Value, size_t cbValue)
+{
+    PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pVCpu);
     if (pEvtRec)
     {
@@ -11834 +11831 @@
         pEvtRec->u.IOPortRead.Port    = Port;
         pEvtRec->u.IOPortRead.cbValue = (uint8_t)cbValue;
-        pEvtRec->pNext = *pIemCpu->ppIemEvtRecNext;
-        *pIemCpu->ppIemEvtRecNext = pEvtRec;
-    }
-    pIemCpu->cIOReads++;
+        pEvtRec->pNext = *pVCpu->iem.s.ppIemEvtRecNext;
+        *pVCpu->iem.s.ppIemEvtRecNext = pEvtRec;
+    }
+    pVCpu->iem.s.cIOReads++;
     *pu32Value = 0xcccccccc;
     return VINF_SUCCESS;
@@ -11847 +11844 @@
  *
  * @returns VINF_SUCCESS.
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   Port                The I/O port.
  * @param   u32Value            The value being written.
  * @param   cbValue             The size of the access.
  */
-IEM_STATIC VBOXSTRICTRC iemVerifyFakeIOPortWrite(PIEMCPU pIemCpu, RTIOPORT Port, uint32_t u32Value, size_t cbValue)
-{
-    PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pIemCpu);
+IEM_STATIC VBOXSTRICTRC iemVerifyFakeIOPortWrite(PVMCPU pVCpu, RTIOPORT Port, uint32_t u32Value, size_t cbValue)
+{
+    PIEMVERIFYEVTREC pEvtRec = iemVerifyAllocRecord(pVCpu);
     if (pEvtRec)
     {
@@ -11861 +11858 @@
         pEvtRec->u.IOPortWrite.cbValue  = (uint8_t)cbValue;
         pEvtRec->u.IOPortWrite.u32Value = u32Value;
-        pEvtRec->pNext = *pIemCpu->ppIemEvtRecNext;
-        *pIemCpu->ppIemEvtRecNext = pEvtRec;
-    }
-    pIemCpu->cIOWrites++;
+        pEvtRec->pNext = *pVCpu->iem.s.ppIemEvtRecNext;
+        *pVCpu->iem.s.ppIemEvtRecNext = pEvtRec;
+    }
+    pVCpu->iem.s.cIOWrites++;
     return VINF_SUCCESS;
 }
@@ -11871 +11868 @@
 /**
  * Used to add extra details about a stub case.
- * @param   pIemCpu     The IEM per CPU state.
- */
-IEM_STATIC void iemVerifyAssertMsg2(PIEMCPU pIemCpu)
-{
-    PCPUMCTX pCtx  = pIemCpu->CTX_SUFF(pCtx);
-    PVM      pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU   pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
+ * @param   pVCpu       The cross context virtual CPU structure of the calling thread.
+ */
+IEM_STATIC void iemVerifyAssertMsg2(PVMCPU pVCpu)
+{
+    PCPUMCTX pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
+    PVM      pVM   = pVCpu->CTX_SUFF(pVM);
+    PVMCPU   pVCpu = pVCpu;
     char szRegs[4096];
     DBGFR3RegPrintf(pVM->pUVM, pVCpu->idCpu, &szRegs[0], sizeof(szRegs),
@@ -11907 +11904 @@
 
     char szInstr1[256];
-    DBGFR3DisasInstrEx(pVM->pUVM, pVCpu->idCpu, pIemCpu->uOldCs, pIemCpu->uOldRip,
+    DBGFR3DisasInstrEx(pVM->pUVM, pVCpu->idCpu, pVCpu->iem.s.uOldCs, pVCpu->iem.s.uOldRip,
                        DBGF_DISAS_FLAGS_DEFAULT_MODE,
                        szInstr1, sizeof(szInstr1), NULL);
@@ -11975 +11972 @@
  * a record dump attached.
  *
- * @param   pIemCpu         The IEM per CPU data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pEvtRec1        The first record.
  * @param   pEvtRec2        The second record.
  * @param   pszMsg          The message explaining why we're asserting.
  */
-IEM_STATIC void iemVerifyAssertRecords(PIEMCPU pIemCpu, PIEMVERIFYEVTREC pEvtRec1, PIEMVERIFYEVTREC pEvtRec2, const char *pszMsg)
+IEM_STATIC void iemVerifyAssertRecords(PVMCPU pVCpu, PIEMVERIFYEVTREC pEvtRec1, PIEMVERIFYEVTREC pEvtRec2, const char *pszMsg)
 {
     RTAssertMsg1(pszMsg, __LINE__, __FILE__, __PRETTY_FUNCTION__);
     iemVerifyAssertAddRecordDump(pEvtRec1);
     iemVerifyAssertAddRecordDump(pEvtRec2);
-    iemVerifyAssertMsg2(pIemCpu);
+    iemVerifyAssertMsg2(pVCpu);
     RTAssertPanic();
 }
@@ -11994 +11991 @@
  * a record dump attached.
  *
- * @param   pIemCpu         The IEM per CPU data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pEvtRec1        The first record.
  * @param   pszMsg          The message explaining why we're asserting.
  */
-IEM_STATIC void iemVerifyAssertRecord(PIEMCPU pIemCpu, PIEMVERIFYEVTREC pEvtRec, const char *pszMsg)
+IEM_STATIC void iemVerifyAssertRecord(PVMCPU pVCpu, PIEMVERIFYEVTREC pEvtRec, const char *pszMsg)
 {
     RTAssertMsg1(pszMsg, __LINE__, __FILE__, __PRETTY_FUNCTION__);
     iemVerifyAssertAddRecordDump(pEvtRec);
-    iemVerifyAssertMsg2(pIemCpu);
+    iemVerifyAssertMsg2(pVCpu);
     RTAssertPanic();
 }
@@ -12010 +12007 @@
  * Verifies a write record.
  *
- * @param   pIemCpu         The IEM per CPU data.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling thread.
  * @param   pEvtRec         The write record.
  * @param   fRem            Set if REM was doing the other executing. If clear
  *                          it was HM.
  */
-IEM_STATIC void iemVerifyWriteRecord(PIEMCPU pIemCpu, PIEMVERIFYEVTREC pEvtRec, bool fRem)
+IEM_STATIC void iemVerifyWriteRecord(PVMCPU pVCpu, PIEMVERIFYEVTREC pEvtRec, bool fRem)
 {
     uint8_t abBuf[sizeof(pEvtRec->u.RamWrite.ab)]; RT_ZERO(abBuf);
     Assert(sizeof(abBuf) >= pEvtRec->u.RamWrite.cb);
-    int rc = PGMPhysSimpleReadGCPhys(IEMCPU_TO_VM(pIemCpu), abBuf, pEvtRec->u.RamWrite.GCPhys, pEvtRec->u.RamWrite.cb);
+    int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), abBuf, pEvtRec->u.RamWrite.GCPhys, pEvtRec->u.RamWrite.cb);
     if (   RT_FAILURE(rc)
         || memcmp(abBuf, pEvtRec->u.RamWrite.ab, pEvtRec->u.RamWrite.cb) )
     {
         /* fend off ins */
-        if (   !pIemCpu->cIOReads
+        if (   !pVCpu->iem.s.cIOReads
             || pEvtRec->u.RamWrite.ab[0] != 0xcc
             || (   pEvtRec->u.RamWrite.cb != 1
@@ -12037 +12034 @@
                 if (pEvtRec->u.RamWrite.cb != 512)
                 {
-                    const char *pszWho = fRem ? "rem" : HMR3IsVmxEnabled(IEMCPU_TO_VM(pIemCpu)->pUVM) ? "vmx" : "svm";
+                    const char *pszWho = fRem ? "rem" : HMR3IsVmxEnabled(pVCpu->CTX_SUFF(pVM)->pUVM) ? "vmx" : "svm";
                     RTAssertMsg1(NULL, __LINE__, __FILE__, __PRETTY_FUNCTION__);
                     RTAssertMsg2Weak("Memory at %RGv differs\n", pEvtRec->u.RamWrite.GCPhys);
@@ -12045 +12042 @@
                                     pEvtRec->u.RamWrite.cb, pEvtRec->u.RamWrite.ab);
                     iemVerifyAssertAddRecordDump(pEvtRec);
-                    iemVerifyAssertMsg2(pIemCpu);
+                    iemVerifyAssertMsg2(pVCpu);
                     RTAssertPanic();
                 }
@@ -12057 +12054 @@
  * Performs the post-execution verfication checks.
  */
-IEM_STATIC VBOXSTRICTRC iemExecVerificationModeCheck(PIEMCPU pIemCpu, VBOXSTRICTRC rcStrictIem)
-{
-    if (!IEM_VERIFICATION_ENABLED(pIemCpu))
+IEM_STATIC VBOXSTRICTRC iemExecVerificationModeCheck(PVMCPU pVCpu, VBOXSTRICTRC rcStrictIem)
+{
+    if (!IEM_VERIFICATION_ENABLED(pVCpu))
         return rcStrictIem;
 
@@ -12065 +12062 @@
      * Switch back the state.
      */
-    PCPUMCTX    pOrgCtx   = CPUMQueryGuestCtxPtr(IEMCPU_TO_VMCPU(pIemCpu));
-    PCPUMCTX    pDebugCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX    pOrgCtx   = CPUMQueryGuestCtxPtr(pVCpu);
+    PCPUMCTX    pDebugCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     Assert(pOrgCtx != pDebugCtx);
-    pIemCpu->CTX_SUFF(pCtx) = pOrgCtx;
+    pVCpu->iem.s.CTX_SUFF(pCtx) = pOrgCtx;
 
     /*
@@ -12074 +12071 @@
      */
     bool   fRem  = false;
-    PVM    pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
+    PVM    pVM   = pVCpu->CTX_SUFF(pVM);
+    PVMCPU pVCpu = pVCpu;
     VBOXSTRICTRC rc = VERR_EM_CANNOT_EXEC_GUEST;
 #ifdef IEM_VERIFICATION_MODE_FULL_HM
     if (   HMIsEnabled(pVM)
-        && pIemCpu->cIOReads == 0
-        && pIemCpu->cIOWrites == 0
-        && !pIemCpu->fProblematicMemory)
+        && pVCpu->iem.s.cIOReads == 0
+        && pVCpu->iem.s.cIOWrites == 0
+        && !pVCpu->iem.s.fProblematicMemory)
     {
         uint64_t uStartRip = pOrgCtx->rip;
@@ -12094 +12091 @@
                      && EMGetInhibitInterruptsPC(pVCpu) == pOrgCtx->rip)
                  || (   pOrgCtx->rip != pDebugCtx->rip
-                     && pIemCpu->uInjectCpl != UINT8_MAX
+                     && pVCpu->iem.s.uInjectCpl != UINT8_MAX
                      && iLoops < 8) );
         if (rc == VINF_EM_RESCHEDULE && pOrgCtx->rip != uStartRip)
@@ -12121 +12118 @@
     if (rcStrictIem == VERR_IEM_INSTR_NOT_IMPLEMENTED)
     {
-        pIemCpu->CTX_SUFF(pCtx) = pOrgCtx;
+        pVCpu->iem.s.CTX_SUFF(pCtx) = pOrgCtx;
         if (rc == VINF_EM_DBG_STEPPED)
             return VINF_SUCCESS;
@@ -12252 +12249 @@
         }
         CHECK_FIELD(rip);
-        uint32_t fFlagsMask = UINT32_MAX & ~pIemCpu->fUndefinedEFlags;
+        uint32_t fFlagsMask = UINT32_MAX & ~pVCpu->iem.s.fUndefinedEFlags;
         if ((pOrgCtx->rflags.u & fFlagsMask) != (pDebugCtx->rflags.u & fFlagsMask))
         {
@@ -12280 +12277 @@
         }
 
-        if (pIemCpu->cIOReads != 1 && !pIemCpu->fIgnoreRaxRdx)
+        if (pVCpu->iem.s.cIOReads != 1 && !pVCpu->iem.s.fIgnoreRaxRdx)
             CHECK_FIELD(rax);
         CHECK_FIELD(rcx);
-        if (!pIemCpu->fIgnoreRaxRdx)
+        if (!pVCpu->iem.s.fIgnoreRaxRdx)
             CHECK_FIELD(rdx);
         CHECK_FIELD(rbx);
@@ -12310 +12307 @@
         if (pOrgCtx->cr2 != pDebugCtx->cr2)
         {
-            if (pIemCpu->uOldCs == 0x1b && pIemCpu->uOldRip == 0x77f61ff3 && fRem)
+            if (pVCpu->iem.s.uOldCs == 0x1b && pVCpu->iem.s.uOldRip == 0x77f61ff3 && fRem)
             { /* ignore */ }
             else if (   (pOrgCtx->cr2 & ~(uint64_t)3) == (pDebugCtx->cr2 & ~(uint64_t)3)
@@ -12367 +12364 @@
      * records.
      */
-    if (cDiffs == 0 && !pIemCpu->fOverlappingMovs)
+    if (cDiffs == 0 && !pVCpu->iem.s.fOverlappingMovs)
     {
         /*
@@ -12373 +12370 @@
          *  - I/O port accesses should be a 1:1 match.
          */
-        PIEMVERIFYEVTREC pIemRec   = pIemCpu->pIemEvtRecHead;
-        PIEMVERIFYEVTREC pOtherRec = pIemCpu->pOtherEvtRecHead;
+        PIEMVERIFYEVTREC pIemRec   = pVCpu->iem.s.pIemEvtRecHead;
+        PIEMVERIFYEVTREC pOtherRec = pVCpu->iem.s.pOtherEvtRecHead;
         while (pIemRec && pOtherRec)
         {
@@ -12384 +12381 @@
             {
                 if (pIemRec->enmEvent == IEMVERIFYEVENT_RAM_WRITE)
-                    iemVerifyWriteRecord(pIemCpu, pIemRec, fRem);
+                    iemVerifyWriteRecord(pVCpu, pIemRec, fRem);
                 pIemRec = pIemRec->pNext;
             }
@@ -12391 +12388 @@
             if (pIemRec->enmEvent != pOtherRec->enmEvent)
             {
-                iemVerifyAssertRecords(pIemCpu, pIemRec, pOtherRec, "Type mismatches");
+                iemVerifyAssertRecords(pVCpu, pIemRec, pOtherRec, "Type mismatches");
                 break;
             }
@@ -12431 +12428 @@
             if (!fEquals)
             {
-                iemVerifyAssertRecords(pIemCpu, pIemRec, pOtherRec, "Mismatch");
+                iemVerifyAssertRecords(pVCpu, pIemRec, pOtherRec, "Mismatch");
                 break;
             }
@@ -12444 +12441 @@
         {
             if (pIemRec->enmEvent == IEMVERIFYEVENT_RAM_WRITE)
-                iemVerifyWriteRecord(pIemCpu, pIemRec, fRem);
+                iemVerifyWriteRecord(pVCpu, pIemRec, fRem);
             pIemRec = pIemRec->pNext;
         }
         if (pIemRec != NULL)
-            iemVerifyAssertRecord(pIemCpu, pIemRec, "Extra IEM record!");
+            iemVerifyAssertRecord(pVCpu, pIemRec, "Extra IEM record!");
         else if (pOtherRec != NULL)
-            iemVerifyAssertRecord(pIemCpu, pOtherRec, "Extra Other record!");
-    }
-    pIemCpu->CTX_SUFF(pCtx) = pOrgCtx;
+            iemVerifyAssertRecord(pVCpu, pOtherRec, "Extra Other record!");
+    }
+    pVCpu->iem.s.CTX_SUFF(pCtx) = pOrgCtx;
 
     return rcStrictIem;
@@ -12460 +12457 @@
 
 /* stubs */
-IEM_STATIC VBOXSTRICTRC     iemVerifyFakeIOPortRead(PIEMCPU pIemCpu, RTIOPORT Port, uint32_t *pu32Value, size_t cbValue)
-{
-    NOREF(pIemCpu); NOREF(Port); NOREF(pu32Value); NOREF(cbValue);
+IEM_STATIC VBOXSTRICTRC     iemVerifyFakeIOPortRead(PVMCPU pVCpu, RTIOPORT Port, uint32_t *pu32Value, size_t cbValue)
+{
+    NOREF(pVCpu); NOREF(Port); NOREF(pu32Value); NOREF(cbValue);
     return VERR_INTERNAL_ERROR;
 }
 
-IEM_STATIC VBOXSTRICTRC     iemVerifyFakeIOPortWrite(PIEMCPU pIemCpu, RTIOPORT Port, uint32_t u32Value, size_t cbValue)
-{
-    NOREF(pIemCpu); NOREF(Port); NOREF(u32Value); NOREF(cbValue);
+IEM_STATIC VBOXSTRICTRC     iemVerifyFakeIOPortWrite(PVMCPU pVCpu, RTIOPORT Port, uint32_t u32Value, size_t cbValue)
+{
+    NOREF(pVCpu); NOREF(Port); NOREF(u32Value); NOREF(cbValue);
     return VERR_INTERNAL_ERROR;
 }
@@ -12545 +12542 @@
  *
  * @returns Strict VBox status code to pass up.
- * @param   pIemCpu     The IEM per CPU data.
+ * @param   pVCpu       The cross context virtual CPU structure of the calling thread.
  * @param   rcStrict    The status from executing an instruction.
  */
-DECL_FORCE_INLINE(VBOXSTRICTRC) iemExecStatusCodeFiddling(PIEMCPU pIemCpu, VBOXSTRICTRC rcStrict)
+DECL_FORCE_INLINE(VBOXSTRICTRC) iemExecStatusCodeFiddling(PVMCPU pVCpu, VBOXSTRICTRC rcStrict)
 {
     if (rcStrict != VINF_SUCCESS)
@@ -12577 +12574 @@
                       , ("rcStrict=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
 /** @todo adjust for VINF_EM_RAW_EMULATE_INSTR   */
-            int32_t const rcPassUp = pIemCpu->rcPassUp;
+            int32_t const rcPassUp = pVCpu->iem.s.rcPassUp;
             if (rcPassUp == VINF_SUCCESS)
-                pIemCpu->cRetInfStatuses++;
+                pVCpu->iem.s.cRetInfStatuses++;
             else if (   rcPassUp < VINF_EM_FIRST
                      || rcPassUp > VINF_EM_LAST
@@ -12585 +12582 @@
             {
                 Log(("IEM: rcPassUp=%Rrc! rcStrict=%Rrc\n", rcPassUp, VBOXSTRICTRC_VAL(rcStrict)));
-                pIemCpu->cRetPassUpStatus++;
+                pVCpu->iem.s.cRetPassUpStatus++;
                 rcStrict = rcPassUp;
             }
@@ -12591 +12588 @@
             {
                 Log(("IEM: rcPassUp=%Rrc  rcStrict=%Rrc!\n", rcPassUp, VBOXSTRICTRC_VAL(rcStrict)));
-                pIemCpu->cRetInfStatuses++;
+                pVCpu->iem.s.cRetInfStatuses++;
             }
         }
         else if (rcStrict == VERR_IEM_ASPECT_NOT_IMPLEMENTED)
-            pIemCpu->cRetAspectNotImplemented++;
+            pVCpu->iem.s.cRetAspectNotImplemented++;
         else if (rcStrict == VERR_IEM_INSTR_NOT_IMPLEMENTED)
-            pIemCpu->cRetInstrNotImplemented++;
+            pVCpu->iem.s.cRetInstrNotImplemented++;
 #ifdef IEM_VERIFICATION_MODE_FULL
         else if (rcStrict == VERR_IEM_RESTART_INSTRUCTION)
@@ -12603 +12600 @@
 #endif
         else
-            pIemCpu->cRetErrStatuses++;
-    }
-    else if (pIemCpu->rcPassUp != VINF_SUCCESS)
-    {
-        pIemCpu->cRetPassUpStatus++;
-        rcStrict = pIemCpu->rcPassUp;
+            pVCpu->iem.s.cRetErrStatuses++;
+    }
+    else if (pVCpu->iem.s.rcPassUp != VINF_SUCCESS)
+    {
+        pVCpu->iem.s.cRetPassUpStatus++;
+        rcStrict = pVCpu->iem.s.rcPassUp;
     }
 
@@ -12623 +12620 @@
  * @return  Strict VBox status code.
  * @param   pVCpu       The cross context virtual CPU structure of the calling EMT.
- * @param   pIemCpu     The IEM per CPU data.
+ * @param   pVCpu       The cross context virtual CPU structure of the calling thread.
  * @param   fExecuteInhibit     If set, execute the instruction following CLI,
  *                      POP SS and MOV SS,GR.
  */
-DECL_FORCE_INLINE(VBOXSTRICTRC) iemExecOneInner(PVMCPU pVCpu, PIEMCPU pIemCpu, bool fExecuteInhibit)
+DECL_FORCE_INLINE(VBOXSTRICTRC) iemExecOneInner(PVMCPU pVCpu, bool fExecuteInhibit)
 {
 #ifdef IEM_WITH_SETJMP
     VBOXSTRICTRC rcStrict;
     jmp_buf      JmpBuf;
-    jmp_buf     *pSavedJmpBuf  = pIemCpu->CTX_SUFF(pJmpBuf);
-    pIemCpu->CTX_SUFF(pJmpBuf) = &JmpBuf;
+    jmp_buf     *pSavedJmpBuf  = pVCpu->iem.s.CTX_SUFF(pJmpBuf);
+    pVCpu->iem.s.CTX_SUFF(pJmpBuf) = &JmpBuf;
     if ((rcStrict = setjmp(JmpBuf)) == 0)
     {
@@ -12640 +12637 @@
     }
     else
-        pIemCpu->cLongJumps++;
-    pIemCpu->CTX_SUFF(pJmpBuf) = pSavedJmpBuf;
+        pVCpu->iem.s.cLongJumps++;
+    pVCpu->iem.s.CTX_SUFF(pJmpBuf) = pSavedJmpBuf;
 #else
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -12647 +12644 @@
 #endif
     if (rcStrict == VINF_SUCCESS)
-        pIemCpu->cInstructions++;
-    if (pIemCpu->cActiveMappings > 0)
+        pVCpu->iem.s.cInstructions++;
+    if (pVCpu->iem.s.cActiveMappings > 0)
     {
         Assert(rcStrict != VINF_SUCCESS);
-        iemMemRollback(pIemCpu);
+        iemMemRollback(pVCpu);
     }
 //#ifdef DEBUG
-//    AssertMsg(pIemCpu->offOpcode == cbInstr || rcStrict != VINF_SUCCESS, ("%u %u\n", pIemCpu->offOpcode, cbInstr));
+//    AssertMsg(pVCpu->iem.s.offOpcode == cbInstr || rcStrict != VINF_SUCCESS, ("%u %u\n", pVCpu->iem.s.offOpcode, cbInstr));
 //#endif
 
@@ -12662 +12659 @@
         && rcStrict == VINF_SUCCESS
         && VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS)
-        && EMGetInhibitInterruptsPC(pVCpu) == pIemCpu->CTX_SUFF(pCtx)->rip )
-    {
-        rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, pIemCpu->fBypassHandlers);
+        && EMGetInhibitInterruptsPC(pVCpu) == pVCpu->iem.s.CTX_SUFF(pCtx)->rip )
+    {
+        rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, pVCpu->iem.s.fBypassHandlers);
         if (rcStrict == VINF_SUCCESS)
         {
 #ifdef LOG_ENABLED
-            iemLogCurInstr(IEMCPU_TO_VMCPU(pIemCpu), pIemCpu->CTX_SUFF(pCtx), false);
+            iemLogCurInstr(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx), false);
 #endif
 #ifdef IEM_WITH_SETJMP
-            pIemCpu->CTX_SUFF(pJmpBuf) = &JmpBuf;
+            pVCpu->iem.s.CTX_SUFF(pJmpBuf) = &JmpBuf;
             if ((rcStrict = setjmp(JmpBuf)) == 0)
             {
@@ -12678 +12675 @@
             }
             else
-                pIemCpu->cLongJumps++;
-            pIemCpu->CTX_SUFF(pJmpBuf) = pSavedJmpBuf;
+                pVCpu->iem.s.cLongJumps++;
+            pVCpu->iem.s.CTX_SUFF(pJmpBuf) = pSavedJmpBuf;
 #else
             IEM_OPCODE_GET_NEXT_U8(&b);
@@ -12685 +12682 @@
 #endif
             if (rcStrict == VINF_SUCCESS)
-                pIemCpu->cInstructions++;
-            if (pIemCpu->cActiveMappings > 0)
+                pVCpu->iem.s.cInstructions++;
+            if (pVCpu->iem.s.cActiveMappings > 0)
             {
                 Assert(rcStrict != VINF_SUCCESS);
-                iemMemRollback(pIemCpu);
+                iemMemRollback(pVCpu);
             }
         }
@@ -12698 +12695 @@
      * Return value fiddling, statistics and sanity assertions.
      */
-    rcStrict = iemExecStatusCodeFiddling(pIemCpu, rcStrict);
-
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->cs));
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->ss));
+    rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
+
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->cs));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->ss));
 #if defined(IEM_VERIFICATION_MODE_FULL)
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->es));
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->ds));
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->fs));
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->gs));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->es));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->ds));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->fs));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->gs));
 #endif
     return rcStrict;
@@ -12717 +12714 @@
  *
  * @returns rcStrict, maybe modified.
- * @param   pIemCpu     The IEM CPU structure.
- * @param   pVCpu       The cross context virtual CPU structure of the calling EMT.
+ * @param   pVCpu       The cross context virtual CPU structure of the calling thread.
  * @param   pCtx        The current CPU context.
  * @param   rcStrict    The status code returne by the interpreter.
  */
-DECLINLINE(VBOXSTRICTRC) iemRCRawMaybeReenter(PIEMCPU pIemCpu, PVMCPU pVCpu, PCPUMCTX pCtx, VBOXSTRICTRC rcStrict)
-{
-    if (   !pIemCpu->fInPatchCode
+DECLINLINE(VBOXSTRICTRC) iemRCRawMaybeReenter(PVMCPU pVCpu, PCPUMCTX pCtx, VBOXSTRICTRC rcStrict)
+{
+    if (   !pVCpu->iem.s.fInPatchCode
         && (   rcStrict == VINF_SUCCESS
             || rcStrict == VERR_IEM_INSTR_NOT_IMPLEMENTED  /* pgmPoolAccessPfHandlerFlush */
@@ -12750 +12746 @@
 VMMDECL(VBOXSTRICTRC) IEMExecOne(PVMCPU pVCpu)
 {
-    PIEMCPU  pIemCpu = &pVCpu->iem.s;
-
 #if defined(IEM_VERIFICATION_MODE_FULL) && defined(IN_RING3)
-    if (++pIemCpu->cVerifyDepth == 1)
-        iemExecVerificationModeSetup(pIemCpu);
+    if (++pVCpu->iem.s.cVerifyDepth == 1)
+        iemExecVerificationModeSetup(pVCpu);
 #endif
 #ifdef LOG_ENABLED
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     iemLogCurInstr(pVCpu, pCtx, true);
 #endif
@@ -12764 +12758 @@
      * Do the decoding and emulation.
      */
-    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, false);
+    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, false);
     if (rcStrict == VINF_SUCCESS)
-        rcStrict = iemExecOneInner(pVCpu, pIemCpu, true);
+        rcStrict = iemExecOneInner(pVCpu, true);
 
 #if defined(IEM_VERIFICATION_MODE_FULL) && defined(IN_RING3)
@@ -12772 +12766 @@
      * Assert some sanity.
      */
-    if (pIemCpu->cVerifyDepth == 1)
-        rcStrict = iemExecVerificationModeCheck(pIemCpu, rcStrict);
-    pIemCpu->cVerifyDepth--;
+    if (pVCpu->iem.s.cVerifyDepth == 1)
+        rcStrict = iemExecVerificationModeCheck(pVCpu, rcStrict);
+    pVCpu->iem.s.cVerifyDepth--;
 #endif
 #ifdef IN_RC
-    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pIemCpu->CTX_SUFF(pCtx), rcStrict);
+    rcStrict = iemRCRawMaybeReenter(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx), rcStrict);
 #endif
     if (rcStrict != VINF_SUCCESS)
@@ -12788 +12782 @@
 VMMDECL(VBOXSTRICTRC)       IEMExecOneEx(PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, uint32_t *pcbWritten)
 {
-    PIEMCPU  pIemCpu = &pVCpu->iem.s;
-    PCPUMCTX pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     AssertReturn(CPUMCTX2CORE(pCtx) == pCtxCore, VERR_IEM_IPE_3);
 
-    uint32_t const cbOldWritten = pIemCpu->cbWritten;
-    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, false);
+    uint32_t const cbOldWritten = pVCpu->iem.s.cbWritten;
+    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, false);
     if (rcStrict == VINF_SUCCESS)
     {
-        rcStrict = iemExecOneInner(pVCpu, pIemCpu, true);
+        rcStrict = iemExecOneInner(pVCpu, true);
         if (pcbWritten)
-            *pcbWritten = pIemCpu->cbWritten - cbOldWritten;
+            *pcbWritten = pVCpu->iem.s.cbWritten - cbOldWritten;
     }
 
 #ifdef IN_RC
-    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
+    rcStrict = iemRCRawMaybeReenter(pVCpu, pCtx, rcStrict);
 #endif
     return rcStrict;
@@ -12811 +12804 @@
                                                          const void *pvOpcodeBytes, size_t cbOpcodeBytes)
 {
-    PIEMCPU  pIemCpu = &pVCpu->iem.s;
-    PCPUMCTX pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     AssertReturn(CPUMCTX2CORE(pCtx) == pCtxCore, VERR_IEM_IPE_3);
 
@@ -12819 +12811 @@
         && pCtx->rip == OpcodeBytesPC)
     {
-        iemInitDecoder(pIemCpu, false);
-        pIemCpu->cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pIemCpu->abOpcode));
-        memcpy(pIemCpu->abOpcode, pvOpcodeBytes, pIemCpu->cbOpcode);
+        iemInitDecoder(pVCpu, false);
+        pVCpu->iem.s.cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pVCpu->iem.s.abOpcode));
+        memcpy(pVCpu->iem.s.abOpcode, pvOpcodeBytes, pVCpu->iem.s.cbOpcode);
         rcStrict = VINF_SUCCESS;
     }
     else
-        rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, false);
+        rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, false);
     if (rcStrict == VINF_SUCCESS)
     {
-        rcStrict = iemExecOneInner(pVCpu, pIemCpu, true);
+        rcStrict = iemExecOneInner(pVCpu, true);
     }
 
 #ifdef IN_RC
-    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
+    rcStrict = iemRCRawMaybeReenter(pVCpu, pCtx, rcStrict);
 #endif
     return rcStrict;
@@ -12840 +12832 @@
 VMMDECL(VBOXSTRICTRC)       IEMExecOneBypassEx(PVMCPU pVCpu, PCPUMCTXCORE pCtxCore, uint32_t *pcbWritten)
 {
-    PIEMCPU  pIemCpu = &pVCpu->iem.s;
-    PCPUMCTX pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     AssertReturn(CPUMCTX2CORE(pCtx) == pCtxCore, VERR_IEM_IPE_3);
 
-    uint32_t const cbOldWritten = pIemCpu->cbWritten;
-    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, true);
+    uint32_t const cbOldWritten = pVCpu->iem.s.cbWritten;
+    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, true);
     if (rcStrict == VINF_SUCCESS)
     {
-        rcStrict = iemExecOneInner(pVCpu, pIemCpu, false);
+        rcStrict = iemExecOneInner(pVCpu, false);
         if (pcbWritten)
-            *pcbWritten = pIemCpu->cbWritten - cbOldWritten;
+            *pcbWritten = pVCpu->iem.s.cbWritten - cbOldWritten;
     }
 
 #ifdef IN_RC
-    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
+    rcStrict = iemRCRawMaybeReenter(pVCpu, pCtx, rcStrict);
 #endif
     return rcStrict;
@@ -12863 +12854 @@
                                                                const void *pvOpcodeBytes, size_t cbOpcodeBytes)
 {
-    PIEMCPU  pIemCpu = &pVCpu->iem.s;
-    PCPUMCTX pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     AssertReturn(CPUMCTX2CORE(pCtx) == pCtxCore, VERR_IEM_IPE_3);
 
@@ -12871 +12861 @@
         && pCtx->rip == OpcodeBytesPC)
     {
-        iemInitDecoder(pIemCpu, true);
-        pIemCpu->cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pIemCpu->abOpcode));
-        memcpy(pIemCpu->abOpcode, pvOpcodeBytes, pIemCpu->cbOpcode);
+        iemInitDecoder(pVCpu, true);
+        pVCpu->iem.s.cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pVCpu->iem.s.abOpcode));
+        memcpy(pVCpu->iem.s.abOpcode, pvOpcodeBytes, pVCpu->iem.s.cbOpcode);
         rcStrict = VINF_SUCCESS;
     }
     else
-        rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, true);
+        rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, true);
     if (rcStrict == VINF_SUCCESS)
-        rcStrict = iemExecOneInner(pVCpu, pIemCpu, false);
+        rcStrict = iemExecOneInner(pVCpu, false);
 
 #ifdef IN_RC
-    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
+    rcStrict = iemRCRawMaybeReenter(pVCpu, pCtx, rcStrict);
 #endif
     return rcStrict;
@@ -12905 +12895 @@
                                                                       uint32_t *pcbWritten)
 {
-    PIEMCPU  pIemCpu = &pVCpu->iem.s;
     PCPUMCTX pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
     AssertReturn(CPUMCTX2CORE(pCtx) == pCtxCore, VERR_IEM_IPE_3);
 
-    uint32_t const cbOldWritten = pIemCpu->cbWritten;
+    uint32_t const cbOldWritten = pVCpu->iem.s.cbWritten;
     VBOXSTRICTRC rcStrict;
     if (   cbOpcodeBytes
         && pCtx->rip == OpcodeBytesPC)
     {
-        iemInitDecoder(pIemCpu, true);
-        pIemCpu->cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pIemCpu->abOpcode));
-        memcpy(pIemCpu->abOpcode, pvOpcodeBytes, pIemCpu->cbOpcode);
+        iemInitDecoder(pVCpu, true);
+        pVCpu->iem.s.cbOpcode = (uint8_t)RT_MIN(cbOpcodeBytes, sizeof(pVCpu->iem.s.abOpcode));
+        memcpy(pVCpu->iem.s.abOpcode, pvOpcodeBytes, pVCpu->iem.s.cbOpcode);
         rcStrict = VINF_SUCCESS;
     }
     else
-        rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, true);
+        rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, true);
     if (rcStrict == VINF_SUCCESS)
     {
-        rcStrict = iemExecOneInner(pVCpu, pIemCpu, false);
+        rcStrict = iemExecOneInner(pVCpu, false);
         if (pcbWritten)
-            *pcbWritten = pIemCpu->cbWritten - cbOldWritten;
+            *pcbWritten = pVCpu->iem.s.cbWritten - cbOldWritten;
     }
 
 #ifdef IN_RC
-    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pCtx, rcStrict);
+    rcStrict = iemRCRawMaybeReenter(pVCpu, pCtx, rcStrict);
 #endif
     return rcStrict;
@@ -12937 +12926 @@
 VMMDECL(VBOXSTRICTRC) IEMExecLots(PVMCPU pVCpu, uint32_t *pcInstructions)
 {
-    PIEMCPU         pIemCpu              = &pVCpu->iem.s;
-    uint32_t const  cInstructionsAtStart = pIemCpu->cInstructions;
+    uint32_t const cInstructionsAtStart = pVCpu->iem.s.cInstructions;
 
 #if defined(IEM_VERIFICATION_MODE_FULL) && defined(IN_RING3)
@@ -12944 +12932 @@
      * See if there is an interrupt pending in TRPM, inject it if we can.
      */
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 # ifdef IEM_VERIFICATION_MODE_FULL
-    pIemCpu->uInjectCpl = UINT8_MAX;
+    pVCpu->iem.s.uInjectCpl = UINT8_MAX;
 # endif
     if (   pCtx->eflags.Bits.u1IF
@@ -12958 +12946 @@
         int rc2 = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrCode, &uCr2, NULL /* pu8InstLen */); AssertRC(rc2);
         IEMInjectTrap(pVCpu, u8TrapNo, enmType, (uint16_t)uErrCode, uCr2, 0 /* cbInstr */);
-        if (!IEM_VERIFICATION_ENABLED(pIemCpu))
+        if (!IEM_VERIFICATION_ENABLED(pVCpu))
             TRPMResetTrap(pVCpu);
     }
@@ -12972 +12960 @@
      * Do the decoding and emulation.
      */
-    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, false);
+    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, false);
     if (rcStrict == VINF_SUCCESS)
-        rcStrict = iemExecOneInner(pVCpu, pIemCpu, true);
+        rcStrict = iemExecOneInner(pVCpu, true);
 
     /*
      * Assert some sanity.
      */
-    rcStrict = iemExecVerificationModeCheck(pIemCpu, rcStrict);
+    rcStrict = iemExecVerificationModeCheck(pVCpu, rcStrict);
 
     /*
@@ -12988 +12976 @@
                  pCtx->cs.Sel, pCtx->rip, pCtx->ss.Sel, pCtx->rsp, pCtx->eflags.u, VBOXSTRICTRC_VAL(rcStrict)));
     if (pcInstructions)
-        *pcInstructions = pIemCpu->cInstructions - cInstructionsAtStart;
+        *pcInstructions = pVCpu->iem.s.cInstructions - cInstructionsAtStart;
     return rcStrict;
 
@@ -12996 +12984 @@
      * See if there is an interrupt pending in TRPM, inject it if we can.
      */
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 # ifdef IEM_VERIFICATION_MODE_FULL
-    pIemCpu->uInjectCpl = UINT8_MAX;
+    pVCpu->iem.s.uInjectCpl = UINT8_MAX;
 # endif
     if (   pCtx->eflags.Bits.u1IF
@@ -13010 +12998 @@
         int rc2 = TRPMQueryTrapAll(pVCpu, &u8TrapNo, &enmType, &uErrCode, &uCr2, NULL /* pu8InstLen */); AssertRC(rc2);
         IEMInjectTrap(pVCpu, u8TrapNo, enmType, (uint16_t)uErrCode, uCr2, 0 /* cbInstr */);
-        if (!IEM_VERIFICATION_ENABLED(pIemCpu))
+        if (!IEM_VERIFICATION_ENABLED(pVCpu))
             TRPMResetTrap(pVCpu);
     }
@@ -13017 +13005 @@
      * Initial decoder init w/ prefetch, then setup setjmp.
      */
-    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pIemCpu, false);
+    VBOXSTRICTRC rcStrict = iemInitDecoderAndPrefetchOpcodes(pVCpu, false);
     if (rcStrict == VINF_SUCCESS)
     {
 # ifdef IEM_WITH_SETJMP
         jmp_buf         JmpBuf;
-        jmp_buf        *pSavedJmpBuf = pIemCpu->CTX_SUFF(pJmpBuf);
-        pIemCpu->CTX_SUFF(pJmpBuf)   = &JmpBuf;
-        pIemCpu->cActiveMappings     = 0;
+        jmp_buf        *pSavedJmpBuf = pVCpu->iem.s.CTX_SUFF(pJmpBuf);
+        pVCpu->iem.s.CTX_SUFF(pJmpBuf)   = &JmpBuf;
+        pVCpu->iem.s.cActiveMappings     = 0;
         if ((rcStrict = setjmp(JmpBuf)) == 0)
 # endif
@@ -13049 +13037 @@
                 if (RT_LIKELY(rcStrict == VINF_SUCCESS))
                 {
-                    Assert(pIemCpu->cActiveMappings == 0);
-                    pIemCpu->cInstructions++;
-                    if (RT_LIKELY(pIemCpu->rcPassUp == VINF_SUCCESS))
+                    Assert(pVCpu->iem.s.cActiveMappings == 0);
+                    pVCpu->iem.s.cInstructions++;
+                    if (RT_LIKELY(pVCpu->iem.s.rcPassUp == VINF_SUCCESS))
                     {
                         if (RT_LIKELY(   !VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_ALL_MASK & ~VMCPU_FF_INHIBIT_INTERRUPTS)
@@ -13057 +13045 @@
                                       && cInstr-- > 0 ))
                         {
-                            iemReInitDecoder(pVCpu, pIemCpu);
+                            iemReInitDecoder(pVCpu);
                             continue;
                         }
                     }
                 }
-                else if (pIemCpu->cActiveMappings > 0) /** @todo This should only happen when rcStrict != VINF_SUCCESS! */
-                    iemMemRollback(pIemCpu);
-                rcStrict = iemExecStatusCodeFiddling(pIemCpu, rcStrict);
+                else if (pVCpu->iem.s.cActiveMappings > 0) /** @todo This should only happen when rcStrict != VINF_SUCCESS! */
+                    iemMemRollback(pVCpu);
+                rcStrict = iemExecStatusCodeFiddling(pVCpu, rcStrict);
                 break;
             }
@@ -13071 +13059 @@
         else
         {
-            if (pIemCpu->cActiveMappings > 0)
-                iemMemRollback(pIemCpu);
-            pIemCpu->cLongJumps++;
+            if (pVCpu->iem.s.cActiveMappings > 0)
+                iemMemRollback(pVCpu);
+            pVCpu->iem.s.cLongJumps++;
         }
 # endif
@@ -13080 +13068 @@
          * Assert hidden register sanity (also done in iemInitDecoder and iemReInitDecoder).
          */
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->cs));
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->ss));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->cs));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->ss));
 # if defined(IEM_VERIFICATION_MODE_FULL)
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->es));
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->ds));
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->fs));
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pIemCpu->CTX_SUFF(pCtx)->gs));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->es));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->ds));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->fs));
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pVCpu->iem.s.CTX_SUFF(pCtx)->gs));
 # endif
     }
@@ -13094 +13082 @@
      */
 # ifdef IN_RC
-    rcStrict = iemRCRawMaybeReenter(pIemCpu, pVCpu, pIemCpu->CTX_SUFF(pCtx), rcStrict);
+    rcStrict = iemRCRawMaybeReenter(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx), rcStrict);
 # endif
     if (rcStrict != VINF_SUCCESS)
@@ -13100 +13088 @@
                  pCtx->cs.Sel, pCtx->rip, pCtx->ss.Sel, pCtx->rsp, pCtx->eflags.u, VBOXSTRICTRC_VAL(rcStrict)));
     if (pcInstructions)
-        *pcInstructions = pIemCpu->cInstructions - cInstructionsAtStart;
+        *pcInstructions = pVCpu->iem.s.cInstructions - cInstructionsAtStart;
     return rcStrict;
 #endif /* Not verification mode */
@@ -13125 +13113 @@
                                          uint8_t cbInstr)
 {
-    iemInitDecoder(&pVCpu->iem.s, false);
+    iemInitDecoder(pVCpu, false);
 #ifdef DBGFTRACE_ENABLED
     RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "IEMInjectTrap: %x %d %x %llx",
@@ -13171 +13159 @@
     }
 
-    return iemRaiseXcptOrInt(&pVCpu->iem.s, cbInstr, u8TrapNo, fFlags, uErrCode, uCr2);
+    return iemRaiseXcptOrInt(pVCpu, cbInstr, u8TrapNo, fFlags, uErrCode, uCr2);
 }
 
@@ -13233 +13221 @@
 VMM_INT_DECL(int) IEMExecInstr_iret(PVMCPU pVCpu, PCPUMCTXCORE pCtxCore)
 {
-    PIEMCPU  pIemCpu = &pVCpu->iem.s;
-    PCPUMCTX pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     iemCtxCoreToCtx(pCtx, pCtxCore);
-    iemInitDecoder(pIemCpu);
-    VBOXSTRICTRC rcStrict = iemCImpl_iret(pIemCpu, 1, pIemCpu->enmDefOpSize);
+    iemInitDecoder(pVCpu);
+    VBOXSTRICTRC rcStrict = iemCImpl_iret(pVCpu, 1, pVCpu->iem.s.enmDefOpSize);
     if (rcStrict == VINF_SUCCESS)
         iemCtxToCtxCore(pCtxCore, pCtx);
@@ -13268 +13255 @@
  *
  * @returns Fiddled strict vbox status code, ready to return to non-IEM caller.
- * @param   pIemCpu             The IEM per-CPU structure.
- * @param   rcStrict            The status code to fiddle.
- */
-DECLINLINE(VBOXSTRICTRC) iemUninitExecAndFiddleStatusAndMaybeReenter(PIEMCPU pIemCpu, VBOXSTRICTRC rcStrict)
-{
-    iemUninitExec(pIemCpu);
+ * @param   pVCpu       The cross context virtual CPU structure of the calling thread.
+ * @param   rcStrict    The status code to fiddle.
+ */
+DECLINLINE(VBOXSTRICTRC) iemUninitExecAndFiddleStatusAndMaybeReenter(PVMCPU pVCpu, VBOXSTRICTRC rcStrict)
+{
+    iemUninitExec(pVCpu);
 #ifdef IN_RC
-    return iemRCRawMaybeReenter(pIemCpu, IEMCPU_TO_VMCPU(pIemCpu), pIemCpu->CTX_SUFF(pCtx),
-                                iemExecStatusCodeFiddling(pIemCpu, rcStrict));
+    return iemRCRawMaybeReenter(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx),
+                                iemExecStatusCodeFiddling(pVCpu, rcStrict));
 #else
-    return iemExecStatusCodeFiddling(pIemCpu, rcStrict);
+    return iemExecStatusCodeFiddling(pVCpu, rcStrict);
 #endif
 }
@@ -13311 +13298 @@
      * State init.
      */
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-    iemInitExec(pIemCpu, false /*fBypassHandlers*/);
+    iemInitExec(pVCpu, false /*fBypassHandlers*/);
 
     /*
@@ -13325 +13311 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_rep_outs_op8_addr16(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_rep_outs_op16_addr16(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_rep_outs_op32_addr16(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_rep_outs_op8_addr16(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_rep_outs_op16_addr16(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_rep_outs_op32_addr16(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13336 +13322 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_rep_outs_op8_addr32(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_rep_outs_op16_addr32(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_rep_outs_op32_addr32(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_rep_outs_op8_addr32(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_rep_outs_op16_addr32(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_rep_outs_op32_addr32(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13347 +13333 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_rep_outs_op8_addr64(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_rep_outs_op16_addr64(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_rep_outs_op32_addr64(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_rep_outs_op8_addr64(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_rep_outs_op16_addr64(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_rep_outs_op32_addr64(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13366 +13352 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_outs_op8_addr16(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_outs_op16_addr16(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_outs_op32_addr16(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_outs_op8_addr16(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_outs_op16_addr16(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_outs_op32_addr16(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13377 +13363 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_outs_op8_addr32(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_outs_op16_addr32(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_outs_op32_addr32(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_outs_op8_addr32(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_outs_op16_addr32(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_outs_op32_addr32(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13388 +13374 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_outs_op8_addr64(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_outs_op16_addr64(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_outs_op32_addr64(pIemCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_outs_op8_addr64(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_outs_op16_addr64(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_outs_op32_addr64(pVCpu, cbInstr, iEffSeg, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13401 +13387 @@
     }
 
-    return iemUninitExecAndFiddleStatusAndMaybeReenter(pIemCpu, rcStrict);
+    return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
 }
 
@@ -13431 +13417 @@
      * State init.
      */
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-    iemInitExec(pIemCpu, false /*fBypassHandlers*/);
+    iemInitExec(pVCpu, false /*fBypassHandlers*/);
 
     /*
@@ -13445 +13430 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_rep_ins_op8_addr16(pIemCpu, cbInstr, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_rep_ins_op16_addr16(pIemCpu, cbInstr, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_rep_ins_op32_addr16(pIemCpu, cbInstr, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_rep_ins_op8_addr16(pVCpu, cbInstr, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_rep_ins_op16_addr16(pVCpu, cbInstr, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_rep_ins_op32_addr16(pVCpu, cbInstr, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13456 +13441 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_rep_ins_op8_addr32(pIemCpu, cbInstr, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_rep_ins_op16_addr32(pIemCpu, cbInstr, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_rep_ins_op32_addr32(pIemCpu, cbInstr, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_rep_ins_op8_addr32(pVCpu, cbInstr, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_rep_ins_op16_addr32(pVCpu, cbInstr, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_rep_ins_op32_addr32(pVCpu, cbInstr, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13467 +13452 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_rep_ins_op8_addr64(pIemCpu, cbInstr, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_rep_ins_op16_addr64(pIemCpu, cbInstr, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_rep_ins_op32_addr64(pIemCpu, cbInstr, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_rep_ins_op8_addr64(pVCpu, cbInstr, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_rep_ins_op16_addr64(pVCpu, cbInstr, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_rep_ins_op32_addr64(pVCpu, cbInstr, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13486 +13471 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_ins_op8_addr16(pIemCpu, cbInstr, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_ins_op16_addr16(pIemCpu, cbInstr, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_ins_op32_addr16(pIemCpu, cbInstr, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_ins_op8_addr16(pVCpu, cbInstr, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_ins_op16_addr16(pVCpu, cbInstr, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_ins_op32_addr16(pVCpu, cbInstr, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13497 +13482 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_ins_op8_addr32(pIemCpu, cbInstr, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_ins_op16_addr32(pIemCpu, cbInstr, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_ins_op32_addr32(pIemCpu, cbInstr, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_ins_op8_addr32(pVCpu, cbInstr, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_ins_op16_addr32(pVCpu, cbInstr, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_ins_op32_addr32(pVCpu, cbInstr, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13508 +13493 @@
                 switch (cbValue)
                 {
-                    case 1: rcStrict = iemCImpl_ins_op8_addr64(pIemCpu, cbInstr, fIoChecked); break;
-                    case 2: rcStrict = iemCImpl_ins_op16_addr64(pIemCpu, cbInstr, fIoChecked); break;
-                    case 4: rcStrict = iemCImpl_ins_op32_addr64(pIemCpu, cbInstr, fIoChecked); break;
+                    case 1: rcStrict = iemCImpl_ins_op8_addr64(pVCpu, cbInstr, fIoChecked); break;
+                    case 2: rcStrict = iemCImpl_ins_op16_addr64(pVCpu, cbInstr, fIoChecked); break;
+                    case 4: rcStrict = iemCImpl_ins_op32_addr64(pVCpu, cbInstr, fIoChecked); break;
                     default:
                         AssertMsgFailedReturn(("cbValue=%#x\n", cbValue), VERR_IEM_INVALID_OPERAND_SIZE);
@@ -13521 +13506 @@
     }
 
-    return iemUninitExecAndFiddleStatusAndMaybeReenter(pIemCpu, rcStrict);
+    return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
 }
 
@@ -13541 +13526 @@
     Assert(cbReg <= 4 && cbReg != 3);
 
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-    iemInitExec(pIemCpu, false /*fBypassHandlers*/);
+    iemInitExec(pVCpu, false /*fBypassHandlers*/);
     VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_out, u16Port, cbReg);
-    return iemUninitExecAndFiddleStatusAndMaybeReenter(pIemCpu, rcStrict);
+    return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
 }
 
@@ -13562 +13546 @@
     Assert(cbReg <= 4 && cbReg != 3);
 
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-    iemInitExec(pIemCpu, false /*fBypassHandlers*/);
+    iemInitExec(pVCpu, false /*fBypassHandlers*/);
     VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_in, u16Port, cbReg);
-    return iemUninitExecAndFiddleStatusAndMaybeReenter(pIemCpu, rcStrict);
+    return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
 }
 
@@ -13586 +13569 @@
     Assert(iGReg < 16);
 
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-    iemInitExec(pIemCpu, false /*fBypassHandlers*/);
+    iemInitExec(pVCpu, false /*fBypassHandlers*/);
     VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_mov_Cd_Rd, iCrReg, iGReg);
-    return iemUninitExecAndFiddleStatusAndMaybeReenter(pIemCpu, rcStrict);
+    return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
 }
 
@@ -13610 +13592 @@
     Assert(iGReg < 16);
 
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-    iemInitExec(pIemCpu, false /*fBypassHandlers*/);
+    iemInitExec(pVCpu, false /*fBypassHandlers*/);
     VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_2(iemCImpl_mov_Rd_Cd, iGReg, iCrReg);
-    return iemUninitExecAndFiddleStatusAndMaybeReenter(pIemCpu, rcStrict);
+    return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
 }
 
@@ -13630 +13611 @@
     IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 2);
 
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-    iemInitExec(pIemCpu, false /*fBypassHandlers*/);
+    iemInitExec(pVCpu, false /*fBypassHandlers*/);
     VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_clts);
-    return iemUninitExecAndFiddleStatusAndMaybeReenter(pIemCpu, rcStrict);
+    return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
 }
 
@@ -13651 +13631 @@
     IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
 
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-    iemInitExec(pIemCpu, false /*fBypassHandlers*/);
+    iemInitExec(pVCpu, false /*fBypassHandlers*/);
     VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_1(iemCImpl_lmsw, uValue);
-    return iemUninitExecAndFiddleStatusAndMaybeReenter(pIemCpu, rcStrict);
+    return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
 }
 
@@ -13673 +13652 @@
     IEMEXEC_ASSERT_INSTR_LEN_RETURN(cbInstr, 3);
 
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-    iemInitExec(pIemCpu, false /*fBypassHandlers*/);
+    iemInitExec(pVCpu, false /*fBypassHandlers*/);
     VBOXSTRICTRC rcStrict = IEM_CIMPL_CALL_0(iemCImpl_xsetbv);
-    return iemUninitExecAndFiddleStatusAndMaybeReenter(pIemCpu, rcStrict);
+    return iemUninitExecAndFiddleStatusAndMaybeReenter(pVCpu, rcStrict);
 }
 
@@ -13689 +13667 @@
  *                          with @a rcStrict.
  * @param   iMemMap         The memory mapping index. For error reporting only.
- * @param   pIemCpu         The IEMCPU structure of the calling EMT, for error
- *                          reporting only.
+ * @param   pVCpu           The cross context virtual CPU structure of the calling
+ *                          thread, for error reporting only.
  */
 DECL_NO_INLINE(static, VBOXSTRICTRC) iemR3MergeStatusSlow(VBOXSTRICTRC rcStrict, VBOXSTRICTRC rcStrictCommit,
-                                                          unsigned iMemMap, PIEMCPU pIemCpu)
+                                                          unsigned iMemMap, PVMCPU pVCpu)
 {
     if (RT_FAILURE_NP(rcStrict))
@@ -13706 +13684 @@
     AssertLogRelMsgFailed(("rcStrictCommit=%Rrc rcStrict=%Rrc iMemMap=%u fAccess=%#x FirstPg=%RGp LB %u SecondPg=%RGp LB %u\n",
                            VBOXSTRICTRC_VAL(rcStrictCommit), VBOXSTRICTRC_VAL(rcStrict), iMemMap,
-                           pIemCpu->aMemMappings[iMemMap].fAccess,
-                           pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, pIemCpu->aMemBbMappings[iMemMap].cbFirst,
-                           pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, pIemCpu->aMemBbMappings[iMemMap].cbSecond));
+                           pVCpu->iem.s.aMemMappings[iMemMap].fAccess,
+                           pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst,
+                           pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond));
     return VERR_IOM_FF_STATUS_IPE;
 }
@@ -13721 +13699 @@
  *                          with @a rcStrict.
  * @param   iMemMap         The memory mapping index. For error reporting only.
- * @param   pIemCpu         The IEMCPU structure of the calling EMT, for error
- *                          reporting only.
- */
-DECLINLINE(VBOXSTRICTRC) iemR3MergeStatus(VBOXSTRICTRC rcStrict, VBOXSTRICTRC rcStrictCommit, unsigned iMemMap, PIEMCPU pIemCpu)
+ * @param   pVCpu           The cross context virtual CPU structure of the calling
+ *                          thread, for error reporting only.
+ */
+DECLINLINE(VBOXSTRICTRC) iemR3MergeStatus(VBOXSTRICTRC rcStrict, VBOXSTRICTRC rcStrictCommit, unsigned iMemMap, PVMCPU pVCpu)
 {
     /* Simple. */
@@ -13743 +13721 @@
 
     /* Unlikely */
-    return iemR3MergeStatusSlow(rcStrict, rcStrictCommit, iMemMap, pIemCpu);
+    return iemR3MergeStatusSlow(rcStrict, rcStrictCommit, iMemMap, pVCpu);
 }
 
@@ -13757 +13735 @@
 VMMR3_INT_DECL(VBOXSTRICTRC) IEMR3ProcessForceFlag(PVM pVM, PVMCPU pVCpu, VBOXSTRICTRC rcStrict)
 {
-    PIEMCPU pIemCpu = &pVCpu->iem.s;
-
     /*
      * Reset the pending commit.
      */
-    AssertMsg(  (pIemCpu->aMemMappings[0].fAccess | pIemCpu->aMemMappings[1].fAccess | pIemCpu->aMemMappings[2].fAccess)
+    AssertMsg(  (pVCpu->iem.s.aMemMappings[0].fAccess | pVCpu->iem.s.aMemMappings[1].fAccess | pVCpu->iem.s.aMemMappings[2].fAccess)
               & (IEM_ACCESS_PENDING_R3_WRITE_1ST | IEM_ACCESS_PENDING_R3_WRITE_2ND),
               ("%#x %#x %#x\n",
-               pIemCpu->aMemMappings[0].fAccess, pIemCpu->aMemMappings[1].fAccess, pIemCpu->aMemMappings[2].fAccess));
+               pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemMappings[1].fAccess, pVCpu->iem.s.aMemMappings[2].fAccess));
     VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_IEM);
 
@@ -13772 +13748 @@
      */
     unsigned cBufs = 0;
-    unsigned iMemMap = RT_ELEMENTS(pIemCpu->aMemMappings);
+    unsigned iMemMap = RT_ELEMENTS(pVCpu->iem.s.aMemMappings);
     while (iMemMap-- > 0)
-        if (pIemCpu->aMemMappings[iMemMap].fAccess & (IEM_ACCESS_PENDING_R3_WRITE_1ST | IEM_ACCESS_PENDING_R3_WRITE_2ND))
+        if (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & (IEM_ACCESS_PENDING_R3_WRITE_1ST | IEM_ACCESS_PENDING_R3_WRITE_2ND))
         {
-            Assert(pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE);
-            Assert(pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED);
-            Assert(!pIemCpu->aMemBbMappings[iMemMap].fUnassigned);
-
-            uint16_t const  cbFirst  = pIemCpu->aMemBbMappings[iMemMap].cbFirst;
-            uint16_t const  cbSecond = pIemCpu->aMemBbMappings[iMemMap].cbSecond;
-            uint8_t const  *pbBuf    = &pIemCpu->aBounceBuffers[iMemMap].ab[0];
-
-            if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_PENDING_R3_WRITE_1ST)
+            Assert(pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_TYPE_WRITE);
+            Assert(pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_BOUNCE_BUFFERED);
+            Assert(!pVCpu->iem.s.aMemBbMappings[iMemMap].fUnassigned);
+
+            uint16_t const  cbFirst  = pVCpu->iem.s.aMemBbMappings[iMemMap].cbFirst;
+            uint16_t const  cbSecond = pVCpu->iem.s.aMemBbMappings[iMemMap].cbSecond;
+            uint8_t const  *pbBuf    = &pVCpu->iem.s.aBounceBuffers[iMemMap].ab[0];
+
+            if (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_PENDING_R3_WRITE_1ST)
             {
                 VBOXSTRICTRC rcStrictCommit1 = PGMPhysWrite(pVM,
-                                                            pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst,
+                                                            pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst,
                                                             pbBuf,
                                                             cbFirst,
                                                             PGMACCESSORIGIN_IEM);
-                rcStrict = iemR3MergeStatus(rcStrict, rcStrictCommit1, iMemMap, pIemCpu);
+                rcStrict = iemR3MergeStatus(rcStrict, rcStrictCommit1, iMemMap, pVCpu);
                 Log(("IEMR3ProcessForceFlag: iMemMap=%u GCPhysFirst=%RGp LB %#x %Rrc => %Rrc\n",
-                     iMemMap, pIemCpu->aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
+                     iMemMap, pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysFirst, cbFirst,
                      VBOXSTRICTRC_VAL(rcStrictCommit1), VBOXSTRICTRC_VAL(rcStrict)));
             }
 
-            if (pIemCpu->aMemMappings[iMemMap].fAccess & IEM_ACCESS_PENDING_R3_WRITE_2ND)
+            if (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & IEM_ACCESS_PENDING_R3_WRITE_2ND)
             {
                 VBOXSTRICTRC rcStrictCommit2 = PGMPhysWrite(pVM,
-                                                            pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond,
+                                                            pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond,
                                                             pbBuf + cbFirst,
                                                             cbSecond,
                                                             PGMACCESSORIGIN_IEM);
-                rcStrict = iemR3MergeStatus(rcStrict, rcStrictCommit2, iMemMap, pIemCpu);
+                rcStrict = iemR3MergeStatus(rcStrict, rcStrictCommit2, iMemMap, pVCpu);
                 Log(("IEMR3ProcessForceFlag: iMemMap=%u GCPhysSecond=%RGp LB %#x %Rrc => %Rrc\n",
-                     iMemMap, pIemCpu->aMemBbMappings[iMemMap].GCPhysSecond, cbSecond,
+                     iMemMap, pVCpu->iem.s.aMemBbMappings[iMemMap].GCPhysSecond, cbSecond,
                      VBOXSTRICTRC_VAL(rcStrictCommit2), VBOXSTRICTRC_VAL(rcStrict)));
             }
             cBufs++;
-            pIemCpu->aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
+            pVCpu->iem.s.aMemMappings[iMemMap].fAccess = IEM_ACCESS_INVALID;
         }
 
-    AssertMsg(cBufs > 0 && cBufs == pIemCpu->cActiveMappings,
-              ("cBufs=%u cActiveMappings=%u - %#x %#x %#x\n", cBufs, pIemCpu->cActiveMappings,
-               pIemCpu->aMemMappings[0].fAccess, pIemCpu->aMemMappings[1].fAccess, pIemCpu->aMemMappings[2].fAccess));
-    pIemCpu->cActiveMappings = 0;
+    AssertMsg(cBufs > 0 && cBufs == pVCpu->iem.s.cActiveMappings,
+              ("cBufs=%u cActiveMappings=%u - %#x %#x %#x\n", cBufs, pVCpu->iem.s.cActiveMappings,
+               pVCpu->iem.s.aMemMappings[0].fAccess, pVCpu->iem.s.aMemMappings[1].fAccess, pVCpu->iem.s.aMemMappings[2].fAccess));
+    pVCpu->iem.s.cActiveMappings = 0;
     return rcStrict;
 }

trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h

@@ -26 +26 @@
  * @returns Strict VBox status code.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                The register context.
  * @param   u16Port             The port number.
  * @param   cbOperand           The operand size.
  */
-static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
+static VBOXSTRICTRC iemHlpCheckPortIOPermissionBitmap(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
 {
     /* The TSS bits we're interested in are the same on 386 and AMD64. */
@@ -48 +48 @@
         Log(("iemHlpCheckPortIOPermissionBitmap: Port=%#x cb=%d - TSS type %#x (attr=%#x) has no I/O bitmap -> #GP(0)\n",
              u16Port, cbOperand, pCtx->tr.Attr.n.u4Type, pCtx->tr.Attr.u));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -55 +55 @@
      */
     uint16_t offBitmap;
-    VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &offBitmap, UINT8_MAX,
+    VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &offBitmap, UINT8_MAX,
                                               pCtx->tr.u64Base + RT_OFFSETOF(X86TSS64, offIoBitmap));
     if (rcStrict != VINF_SUCCESS)
@@ -75 +75 @@
         Log(("iemHlpCheckPortIOPermissionBitmap: offFirstBit=%#x + 1 is beyond u32Limit=%#x -> #GP(0)\n",
              offFirstBit, pCtx->tr.u32Limit));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -85 +85 @@
      *        2nd byte when it's not required. */
     uint16_t bmBytes = UINT16_MAX;
-    rcStrict = iemMemFetchSysU16(pIemCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
+    rcStrict = iemMemFetchSysU16(pVCpu, &bmBytes, UINT8_MAX, pCtx->tr.u64Base + offFirstBit);
     if (rcStrict != VINF_SUCCESS)
     {
@@ -101 +101 @@
         Log(("iemHlpCheckPortIOPermissionBitmap: u16Port=%#x LB %u - access denied (bm=%#x mask=%#x) -> #GP(0)\n",
              u16Port, cbOperand, bmBytes, fPortMask));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -115 +115 @@
  * @returns Strict VBox status code.
  *
- * @param   pIemCpu             The IEM per CPU data.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   pCtx                The register context.
  * @param   u16Port             The port number.
  * @param   cbOperand           The operand size.
  */
-DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PIEMCPU pIemCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
+DECLINLINE(VBOXSTRICTRC) iemHlpCheckPortIOPermission(PVMCPU pVCpu, PCCPUMCTX pCtx, uint16_t u16Port, uint8_t cbOperand)
 {
     X86EFLAGS Efl;
-    Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
     if (   (pCtx->cr0 & X86_CR0_PE)
-        && (    pIemCpu->uCpl > Efl.Bits.u2IOPL
+        && (    pVCpu->iem.s.uCpl > Efl.Bits.u2IOPL
             ||  Efl.Bits.u1VM) )
-        return iemHlpCheckPortIOPermissionBitmap(pIemCpu, pCtx, u16Port, cbOperand);
+        return iemHlpCheckPortIOPermissionBitmap(pVCpu, pCtx, u16Port, cbOperand);
     return VINF_SUCCESS;
 }
@@ -169 +169 @@
  * Updates the specified flags according to a 8-bit result.
  *
- * @param   pIemCpu             The IEM state of the calling EMT.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   u8Result            The result to set the flags according to.
  * @param   fToUpdate           The flags to update.
  * @param   fUndefined          The flags that are specified as undefined.
  */
-static void iemHlpUpdateArithEFlagsU8(PIEMCPU pIemCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
-{
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+static void iemHlpUpdateArithEFlagsU8(PVMCPU pVCpu, uint8_t u8Result, uint32_t fToUpdate, uint32_t fUndefined)
+{
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     uint32_t fEFlags = pCtx->eflags.u;
@@ -183 +183 @@
     pCtx->eflags.u |= (fToUpdate | fUndefined) & fEFlags;
 #ifdef IEM_VERIFICATION_MODE_FULL
-    pIemCpu->fUndefinedEFlags |= fUndefined;
+    pVCpu->iem.s.fUndefinedEFlags |= fUndefined;
 #endif
 }
@@ -194 +194 @@
  * @param   pSReg               Pointer to the segment register.
  */
-static void iemHlpAdjustSelectorForNewCpl(PIEMCPU pIemCpu, uint8_t uCpl, PCPUMSELREG pSReg)
+static void iemHlpAdjustSelectorForNewCpl(PVMCPU pVCpu, uint8_t uCpl, PCPUMSELREG pSReg)
 {
 #ifdef VBOX_WITH_RAW_MODE_NOT_R0
-    if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg))
-        CPUMGuestLazyLoadHiddenSelectorReg(IEMCPU_TO_VMCPU(pIemCpu), pSReg);
+    if (!CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg))
+        CPUMGuestLazyLoadHiddenSelectorReg(pVCpu, pSReg);
 #else
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pSReg));
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pSReg));
 #endif
 
@@ -207 +207 @@
         &&    (pSReg->Attr.n.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
            !=                         (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF)) /* not conforming code */
-        iemHlpLoadNullDataSelectorProt(pIemCpu, pSReg, 0);
+        iemHlpLoadNullDataSelectorProt(pVCpu, pSReg, 0);
 }
 
@@ -214 +214 @@
  * Indicates that we have modified the FPU state.
  *
- * @param   pIemCpu             The IEM state of the calling EMT.
- */
-DECLINLINE(void) iemHlpUsedFpu(PIEMCPU pIemCpu)
-{
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_FPU_REM);
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
+ */
+DECLINLINE(void) iemHlpUsedFpu(PVMCPU pVCpu)
+{
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_FPU_REM);
 }
 
@@ -232 +232 @@
 IEM_CIMPL_DEF_0(iemCImpl_popa_16)
 {
-    PCPUMCTX        pCtx        = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR         GCPtrStart  = iemRegGetEffRsp(pIemCpu, pCtx);
+    PCPUMCTX        pCtx        = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR         GCPtrStart  = iemRegGetEffRsp(pVCpu, pCtx);
     RTGCPTR         GCPtrLast   = GCPtrStart + 15;
     VBOXSTRICTRC    rcStrict;
@@ -245 +245 @@
      */
     /** @todo do popa boundary / wrap-around checks.  */
-    if (RT_UNLIKELY(   IEM_IS_REAL_OR_V86_MODE(pIemCpu)
+    if (RT_UNLIKELY(   IEM_IS_REAL_OR_V86_MODE(pVCpu)
                     && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
     {
@@ -251 +251 @@
         RTUINT64U TmpRsp;
         TmpRsp.u = pCtx->rsp;
-        rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->di, &TmpRsp);
+        rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->di, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->si, &TmpRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->si, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bp, &TmpRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bp, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
         {
-            iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->bx, &TmpRsp);
+            iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->bx, &TmpRsp);
         }
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->dx, &TmpRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->dx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->cx, &TmpRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->cx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &pCtx->ax, &TmpRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &pCtx->ax, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
         {
             pCtx->rsp = TmpRsp.u;
-            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         }
     }
@@ -276 +276 @@
     {
         uint16_t const *pa16Mem = NULL;
-        rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
+        rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -287 +287 @@
             pCtx->cx = pa16Mem[7 - X86_GREG_xCX];
             pCtx->ax = pa16Mem[7 - X86_GREG_xAX];
-            rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
+            rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
             if (rcStrict == VINF_SUCCESS)
             {
-                iemRegAddToRsp(pIemCpu, pCtx, 16);
-                iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+                iemRegAddToRsp(pVCpu, pCtx, 16);
+                iemRegAddToRipAndClearRF(pVCpu, cbInstr);
             }
         }
@@ -304 +304 @@
 IEM_CIMPL_DEF_0(iemCImpl_popa_32)
 {
-    PCPUMCTX        pCtx        = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR         GCPtrStart  = iemRegGetEffRsp(pIemCpu, pCtx);
+    PCPUMCTX        pCtx        = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR         GCPtrStart  = iemRegGetEffRsp(pVCpu, pCtx);
     RTGCPTR         GCPtrLast   = GCPtrStart + 31;
     VBOXSTRICTRC    rcStrict;
@@ -317 +317 @@
      */
     /** @todo do popa boundary / wrap-around checks.  */
-    if (RT_UNLIKELY(   IEM_IS_REAL_OR_V86_MODE(pIemCpu)
+    if (RT_UNLIKELY(   IEM_IS_REAL_OR_V86_MODE(pVCpu)
                     && (pCtx->cs.u32Limit < GCPtrLast)) ) /* ASSUMES 64-bit RTGCPTR */
     {
@@ -323 +323 @@
         RTUINT64U TmpRsp;
         TmpRsp.u = pCtx->rsp;
-        rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edi, &TmpRsp);
+        rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edi, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->esi, &TmpRsp);
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->esi, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebp, &TmpRsp);
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebp, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
         {
-            iemRegAddToRspEx(pIemCpu, pCtx, &TmpRsp, 2); /* sp */
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ebx, &TmpRsp);
+            iemRegAddToRspEx(pVCpu, pCtx, &TmpRsp, 2); /* sp */
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ebx, &TmpRsp);
         }
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->edx, &TmpRsp);
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->edx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->ecx, &TmpRsp);
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->ecx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &pCtx->eax, &TmpRsp);
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &pCtx->eax, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -351 +351 @@
 #endif
             pCtx->rsp = TmpRsp.u;
-            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         }
     }
@@ -357 +357 @@
     {
         uint32_t const *pa32Mem;
-        rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
+        rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -368 +368 @@
             pCtx->rcx = pa32Mem[7 - X86_GREG_xCX];
             pCtx->rax = pa32Mem[7 - X86_GREG_xAX];
-            rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
+            rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
             if (rcStrict == VINF_SUCCESS)
             {
-                iemRegAddToRsp(pIemCpu, pCtx, 32);
-                iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+                iemRegAddToRsp(pVCpu, pCtx, 32);
+                iemRegAddToRipAndClearRF(pVCpu, cbInstr);
             }
         }
@@ -385 +385 @@
 IEM_CIMPL_DEF_0(iemCImpl_pusha_16)
 {
-    PCPUMCTX        pCtx        = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR         GCPtrTop    = iemRegGetEffRsp(pIemCpu, pCtx);
+    PCPUMCTX        pCtx        = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR         GCPtrTop    = iemRegGetEffRsp(pVCpu, pCtx);
     RTGCPTR         GCPtrBottom = GCPtrTop - 15;
     VBOXSTRICTRC    rcStrict;
@@ -399 +399 @@
     /** @todo do pusha boundary / wrap-around checks.  */
     if (RT_UNLIKELY(   GCPtrBottom > GCPtrTop
-                    && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
+                    && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
     {
         /* word-by-word */
         RTUINT64U TmpRsp;
         TmpRsp.u = pCtx->rsp;
-        rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->ax, &TmpRsp);
+        rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->ax, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->cx, &TmpRsp);
+            rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->cx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->dx, &TmpRsp);
+            rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->dx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bx, &TmpRsp);
+            rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->sp, &TmpRsp);
+            rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->sp, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->bp, &TmpRsp);
+            rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->bp, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->si, &TmpRsp);
+            rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->si, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU16Ex(pIemCpu, pCtx->di, &TmpRsp);
+            rcStrict = iemMemStackPushU16Ex(pVCpu, pCtx->di, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
         {
             pCtx->rsp = TmpRsp.u;
-            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         }
     }
@@ -429 +429 @@
         GCPtrBottom--;
         uint16_t *pa16Mem = NULL;
-        rcStrict = iemMemMap(pIemCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
+        rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -440 +440 @@
             pa16Mem[7 - X86_GREG_xCX] = pCtx->cx;
             pa16Mem[7 - X86_GREG_xAX] = pCtx->ax;
-            rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
+            rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
             if (rcStrict == VINF_SUCCESS)
             {
-                iemRegSubFromRsp(pIemCpu, pCtx, 16);
-                iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+                iemRegSubFromRsp(pVCpu, pCtx, 16);
+                iemRegAddToRipAndClearRF(pVCpu, cbInstr);
             }
         }
@@ -457 +457 @@
 IEM_CIMPL_DEF_0(iemCImpl_pusha_32)
 {
-    PCPUMCTX        pCtx        = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR         GCPtrTop    = iemRegGetEffRsp(pIemCpu, pCtx);
+    PCPUMCTX        pCtx        = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR         GCPtrTop    = iemRegGetEffRsp(pVCpu, pCtx);
     RTGCPTR         GCPtrBottom = GCPtrTop - 31;
     VBOXSTRICTRC    rcStrict;
@@ -471 +471 @@
     /** @todo do pusha boundary / wrap-around checks.  */
     if (RT_UNLIKELY(   GCPtrBottom > GCPtrTop
-                    && IEM_IS_REAL_OR_V86_MODE(pIemCpu) ) )
+                    && IEM_IS_REAL_OR_V86_MODE(pVCpu) ) )
     {
         /* word-by-word */
         RTUINT64U TmpRsp;
         TmpRsp.u = pCtx->rsp;
-        rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->eax, &TmpRsp);
+        rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->eax, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ecx, &TmpRsp);
+            rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ecx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edx, &TmpRsp);
+            rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebx, &TmpRsp);
+            rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebx, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esp, &TmpRsp);
+            rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esp, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->ebp, &TmpRsp);
+            rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->ebp, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->esi, &TmpRsp);
+            rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->esi, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
-            rcStrict = iemMemStackPushU32Ex(pIemCpu, pCtx->edi, &TmpRsp);
+            rcStrict = iemMemStackPushU32Ex(pVCpu, pCtx->edi, &TmpRsp);
         if (rcStrict == VINF_SUCCESS)
         {
             pCtx->rsp = TmpRsp.u;
-            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         }
     }
@@ -501 +501 @@
         GCPtrBottom--;
         uint32_t *pa32Mem;
-        rcStrict = iemMemMap(pIemCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
+        rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -512 +512 @@
             pa32Mem[7 - X86_GREG_xCX] = pCtx->ecx;
             pa32Mem[7 - X86_GREG_xAX] = pCtx->eax;
-            rcStrict = iemMemCommitAndUnmap(pIemCpu, pa32Mem, IEM_ACCESS_STACK_W);
+            rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
             if (rcStrict == VINF_SUCCESS)
             {
-                iemRegSubFromRsp(pIemCpu, pCtx, 32);
-                iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+                iemRegSubFromRsp(pVCpu, pCtx, 32);
+                iemRegAddToRipAndClearRF(pVCpu, cbInstr);
             }
         }
@@ -532 +532 @@
 IEM_CIMPL_DEF_1(iemCImpl_pushf, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -538 +538 @@
      * doing this in a C implementation).
      */
-    uint32_t fEfl = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    uint32_t fEfl = IEMMISC_GET_EFL(pVCpu, pCtx);
     if (   (fEfl & X86_EFL_VM)
         && X86_EFL_GET_IOPL(fEfl) != 3 )
@@ -545 +545 @@
         if (   enmEffOpSize != IEMMODE_16BIT
             || !(pCtx->cr4 & X86_CR4_VME))
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         fEfl &= ~X86_EFL_IF;          /* (RF and VM are out of range) */
         fEfl |= (fEfl & X86_EFL_VIF) >> (19 - 9);
-        return iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
+        return iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
     }
 
@@ -561 +561 @@
         case IEMMODE_16BIT:
             AssertCompile(IEMTARGETCPU_8086 <= IEMTARGETCPU_186 && IEMTARGETCPU_V20 <= IEMTARGETCPU_186 && IEMTARGETCPU_286 > IEMTARGETCPU_186);
-            if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_186)
+            if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_186)
                 fEfl |= UINT16_C(0xf000);
-            rcStrict = iemMemStackPushU16(pIemCpu, (uint16_t)fEfl);
+            rcStrict = iemMemStackPushU16(pVCpu, (uint16_t)fEfl);
             break;
         case IEMMODE_32BIT:
-            rcStrict = iemMemStackPushU32(pIemCpu, fEfl);
+            rcStrict = iemMemStackPushU32(pVCpu, fEfl);
             break;
         case IEMMODE_64BIT:
-            rcStrict = iemMemStackPushU64(pIemCpu, fEfl);
+            rcStrict = iemMemStackPushU64(pVCpu, fEfl);
             break;
         IEM_NOT_REACHED_DEFAULT_CASE_RET();
@@ -576 +576 @@
         return rcStrict;
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -588 +588 @@
 IEM_CIMPL_DEF_1(iemCImpl_popf, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX        pCtx    = pIemCpu->CTX_SUFF(pCtx);
-    uint32_t const  fEflOld = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    PCPUMCTX        pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
+    uint32_t const  fEflOld = IEMMISC_GET_EFL(pVCpu, pCtx);
     VBOXSTRICTRC    rcStrict;
     uint32_t        fEflNew;
@@ -608 +608 @@
                 {
                     uint16_t u16Value;
-                    rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
+                    rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
                     if (rcStrict != VINF_SUCCESS)
                         return rcStrict;
@@ -615 +615 @@
                 }
                 case IEMMODE_32BIT:
-                    rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
+                    rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
                     if (rcStrict != VINF_SUCCESS)
                         return rcStrict;
@@ -622 +622 @@
             }
 
-            const uint32_t fPopfBits = IEMCPU_TO_VM(pIemCpu)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
+            const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
                                      ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
             fEflNew &=   fPopfBits & ~(X86_EFL_IOPL);
@@ -636 +636 @@
             RTUINT64U   TmpRsp;
             TmpRsp.u = pCtx->rsp;
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -645 +645 @@
                      && (fEflOld  & X86_EFL_VIP))
                 ||  (u16Value & X86_EFL_TF) )
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
 
             fEflNew = u16Value | (fEflOld & UINT32_C(0xffff0000) & ~X86_EFL_VIF);
@@ -655 +655 @@
         }
         else
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
 
     }
@@ -669 +669 @@
             {
                 uint16_t u16Value;
-                rcStrict = iemMemStackPopU16(pIemCpu, &u16Value);
+                rcStrict = iemMemStackPopU16(pVCpu, &u16Value);
                 if (rcStrict != VINF_SUCCESS)
                     return rcStrict;
@@ -685 +685 @@
                  *    therefore be used to detect 286 or 386 CPU in real mode.
                  */
-                if (   IEM_GET_TARGET_CPU(pIemCpu) == IEMTARGETCPU_286
+                if (   IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286
                     && !(pCtx->cr0 & X86_CR0_PE) )
                     fEflNew &= ~(X86_EFL_NT | X86_EFL_IOPL);
@@ -691 +691 @@
             }
             case IEMMODE_32BIT:
-                rcStrict = iemMemStackPopU32(pIemCpu, &fEflNew);
+                rcStrict = iemMemStackPopU32(pVCpu, &fEflNew);
                 if (rcStrict != VINF_SUCCESS)
                     return rcStrict;
@@ -698 +698 @@
             {
                 uint64_t u64Value;
-                rcStrict = iemMemStackPopU64(pIemCpu, &u64Value);
+                rcStrict = iemMemStackPopU64(pVCpu, &u64Value);
                 if (rcStrict != VINF_SUCCESS)
                     return rcStrict;
@@ -708 +708 @@
 
         /* Merge them with the current flags. */
-        const uint32_t fPopfBits = IEMCPU_TO_VM(pIemCpu)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
+        const uint32_t fPopfBits = pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.enmMicroarch != kCpumMicroarch_Intel_80386
                                  ? X86_EFL_POPF_BITS : X86_EFL_POPF_BITS_386;
         if (   (fEflNew & (X86_EFL_IOPL | X86_EFL_IF)) == (fEflOld & (X86_EFL_IOPL | X86_EFL_IF))
-            || pIemCpu->uCpl == 0)
+            || pVCpu->iem.s.uCpl == 0)
         {
             fEflNew &=  fPopfBits;
             fEflNew |= ~fPopfBits & fEflOld;
         }
-        else if (pIemCpu->uCpl <= X86_EFL_GET_IOPL(fEflOld))
+        else if (pVCpu->iem.s.uCpl <= X86_EFL_GET_IOPL(fEflOld))
         {
             fEflNew &=   fPopfBits & ~(X86_EFL_IOPL);
@@ -732 +732 @@
      */
     Assert(fEflNew & RT_BIT_32(1));
-    IEMMISC_SET_EFL(pIemCpu, pCtx, fEflNew);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    IEMMISC_SET_EFL(pVCpu, pCtx, fEflNew);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
 
     return VINF_SUCCESS;
@@ -748 +748 @@
 IEM_CIMPL_DEF_1(iemCImpl_call_16, uint16_t, uNewPC)
 {
-    PCPUMCTX pCtx   = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx   = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint16_t uOldPC = pCtx->ip + cbInstr;
     if (uNewPC > pCtx->cs.u32Limit)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-
-    VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+
+    VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -761 +761 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
     return VINF_SUCCESS;
 }
@@ -773 +773 @@
 IEM_CIMPL_DEF_1(iemCImpl_call_rel_16, int16_t, offDisp)
 {
-    PCPUMCTX pCtx   = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx   = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint16_t uOldPC = pCtx->ip + cbInstr;
     uint16_t uNewPC = uOldPC + offDisp;
     if (uNewPC > pCtx->cs.u32Limit)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-
-    VBOXSTRICTRC rcStrict = iemMemStackPushU16(pIemCpu, uOldPC);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+
+    VBOXSTRICTRC rcStrict = iemMemStackPushU16(pVCpu, uOldPC);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -787 +787 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
     return VINF_SUCCESS;
 }
@@ -801 +801 @@
 IEM_CIMPL_DEF_1(iemCImpl_call_32, uint32_t, uNewPC)
 {
-    PCPUMCTX pCtx   = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx   = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint32_t uOldPC = pCtx->eip + cbInstr;
     if (uNewPC > pCtx->cs.u32Limit)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-
-    VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+
+    VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -816 +816 @@
     if (   !pCtx->eflags.Bits.u1IF
         && (pCtx->cr0 & X86_CR0_PG)
-        && !CSAMIsEnabled(IEMCPU_TO_VM(pIemCpu))
-        && pIemCpu->uCpl == 0)
-    {
-        EMSTATE enmState = EMGetState(IEMCPU_TO_VMCPU(pIemCpu));
+        && !CSAMIsEnabled(pVCpu->CTX_SUFF(pVM))
+        && pVCpu->iem.s.uCpl == 0)
+    {
+        EMSTATE enmState = EMGetState(pVCpu);
         if (   enmState == EMSTATE_IEM_THEN_REM
             || enmState == EMSTATE_IEM
             || enmState == EMSTATE_REM)
-            CSAMR3RecordCallAddress(IEMCPU_TO_VM(pIemCpu), pCtx->eip);
+            CSAMR3RecordCallAddress(pVCpu->CTX_SUFF(pVM), pCtx->eip);
     }
 #endif
@@ -831 +831 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
     return VINF_SUCCESS;
 }
@@ -843 +843 @@
 IEM_CIMPL_DEF_1(iemCImpl_call_rel_32, int32_t, offDisp)
 {
-    PCPUMCTX pCtx   = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx   = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint32_t uOldPC = pCtx->eip + cbInstr;
     uint32_t uNewPC = uOldPC + offDisp;
     if (uNewPC > pCtx->cs.u32Limit)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-
-    VBOXSTRICTRC rcStrict = iemMemStackPushU32(pIemCpu, uOldPC);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+
+    VBOXSTRICTRC rcStrict = iemMemStackPushU32(pVCpu, uOldPC);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -857 +857 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
     return VINF_SUCCESS;
 }
@@ -871 +871 @@
 IEM_CIMPL_DEF_1(iemCImpl_call_64, uint64_t, uNewPC)
 {
-    PCPUMCTX pCtx   = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx   = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint64_t uOldPC = pCtx->rip + cbInstr;
     if (!IEM_IS_CANONICAL(uNewPC))
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-
-    VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+
+    VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -884 +884 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
     return VINF_SUCCESS;
 }
@@ -896 +896 @@
 IEM_CIMPL_DEF_1(iemCImpl_call_rel_64, int64_t, offDisp)
 {
-    PCPUMCTX pCtx   = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx   = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint64_t uOldPC = pCtx->rip + cbInstr;
     uint64_t uNewPC = uOldPC + offDisp;
     if (!IEM_IS_CANONICAL(uNewPC))
-        return iemRaiseNotCanonical(pIemCpu);
-
-    VBOXSTRICTRC rcStrict = iemMemStackPushU64(pIemCpu, uOldPC);
+        return iemRaiseNotCanonical(pVCpu);
+
+    VBOXSTRICTRC rcStrict = iemMemStackPushU64(pVCpu, uOldPC);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -910 +910 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -934 +934 @@
            || pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL);
 
-    if (   pDesc->Legacy.Gate.u2Dpl < pIemCpu->uCpl
+    if (   pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
         || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
     {
         Log(("BranchTaskSegment invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
-             pIemCpu->uCpl, (uSel & X86_SEL_RPL)));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
+             pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -948 +948 @@
     {
         Log(("BranchTaskSegment TSS not present uSel=%04x -> #NP\n", uSel));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
-    }
-
-    PCPUMCTX pCtx     = pIemCpu->CTX_SUFF(pCtx);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
+    }
+
+    PCPUMCTX pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint32_t uNextEip = pCtx->eip + cbInstr;
-    return iemTaskSwitch(pIemCpu, pIemCpu->CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
+    return iemTaskSwitch(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
                          uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSel, pDesc);
 #endif
@@ -975 +975 @@
     Assert(enmBranch == IEMBRANCH_JUMP || enmBranch == IEMBRANCH_CALL);
 
-    if (   pDesc->Legacy.Gate.u2Dpl < pIemCpu->uCpl
+    if (   pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
         || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
     {
         Log(("BranchTaskGate invalid priv. uSel=%04x TSS DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
-             pIemCpu->uCpl, (uSel & X86_SEL_RPL)));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
+             pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -989 +989 @@
     {
         Log(("BranchTaskSegment segment not present uSel=%04x -> #NP\n", uSel));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -999 +999 @@
     {
         Log(("BranchTaskGate TSS is in LDT. uSel=%04x uSelTss=%04x -> #GP\n", uSel, uSelTss));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
     }
 
     IEMSELDESC TssDesc;
-    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &TssDesc, uSelTss, X86_XCPT_GP);
+    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelTss, X86_XCPT_GP);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -1011 +1011 @@
         Log(("BranchTaskGate TSS is busy. uSel=%04x uSelTss=%04x DescType=%#x -> #GP\n", uSel, uSelTss,
              TssDesc.Legacy.Gate.u4Type));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -1017 +1017 @@
     {
         Log(("BranchTaskGate TSS is not present. uSel=%04x uSelTss=%04x -> #NP\n", uSel, uSelTss));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
-    }
-
-    PCPUMCTX pCtx     = pIemCpu->CTX_SUFF(pCtx);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelTss & X86_SEL_MASK_OFF_RPL);
+    }
+
+    PCPUMCTX pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint32_t uNextEip = pCtx->eip + cbInstr;
-    return iemTaskSwitch(pIemCpu, pIemCpu->CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
+    return iemTaskSwitch(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx), enmBranch == IEMBRANCH_JUMP ? IEMTASKSWITCH_JUMP : IEMTASKSWITCH_CALL,
                          uNextEip, 0 /* fFlags */, 0 /* uErr */, 0 /* uCr2 */, uSelTss, &TssDesc);
 #endif
@@ -1074 +1074 @@
 
     /* Perform DPL checks on the gate descriptor. */
-    if (   pDesc->Legacy.Gate.u2Dpl < pIemCpu->uCpl
+    if (   pDesc->Legacy.Gate.u2Dpl < pVCpu->iem.s.uCpl
         || pDesc->Legacy.Gate.u2Dpl < (uSel & X86_SEL_RPL))
     {
         Log(("BranchCallGate invalid priv. uSel=%04x Gate DPL=%d CPL=%u Sel RPL=%u -> #GP\n", uSel, pDesc->Legacy.Gate.u2Dpl,
-             pIemCpu->uCpl, (uSel & X86_SEL_RPL)));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+             pVCpu->iem.s.uCpl, (uSel & X86_SEL_RPL)));
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
     }
 
@@ -1086 +1086 @@
     {
         Log(("BranchCallGate Gate not present uSel=%04x -> #NP\n", uSel));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
     }
 
@@ -1093 +1093 @@
      */
     uNewCS = pDesc->Legacy.Gate.u16Sel;
-    rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCS, X86_XCPT_GP);
+    rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCS, X86_XCPT_GP);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -1103 +1103 @@
         Log(("BranchCallGate %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
              uNewCS, uNewRip, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
     }
 
@@ -1111 +1111 @@
         if (DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
         {
-            if (DescCS.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
+            if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
             {
                 Log(("BranchCallGate jump (conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
-                     uNewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-                return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
+                     uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+                return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
             }
         }
         else
         {
-            if (DescCS.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
+            if (DescCS.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
             {
                 Log(("BranchCallGate jump (non-conforming) bad DPL uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
-                     uNewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-                return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
+                     uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+                return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
             }
         }
@@ -1131 +1131 @@
     {
         Assert(enmBranch == IEMBRANCH_CALL);
-        if (DescCS.Legacy.Gen.u2Dpl > pIemCpu->uCpl)
+        if (DescCS.Legacy.Gen.u2Dpl > pVCpu->iem.s.uCpl)
         {
             Log(("BranchCallGate call invalid priv. uNewCS=%04x Gate DPL=%d CPL=%u -> #GP\n",
-                 uNewCS, DescCS.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
+                 uNewCS, DescCS.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS & X86_SEL_MASK_OFF_RPL);
         }
     }
 
     /* Additional long mode checks. */
-    if (IEM_IS_LONG_MODE(pIemCpu))
+    if (IEM_IS_LONG_MODE(pVCpu))
     {
         if (!DescCS.Legacy.Gen.u1Long)
         {
             Log(("BranchCallGate uNewCS %04x -> not a 64-bit code segment.\n", uNewCS));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
         }
 
@@ -1153 +1153 @@
         {
             Log(("BranchCallGate uNewCS %04x -> both L and D are set.\n", uNewCS));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCS);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCS);
         }
     }
@@ -1160 +1160 @@
     {
         Log(("BranchCallGate target CS is not present. uSel=%04x uNewCS=%04x -> #NP(CS)\n", uSel, uNewCS));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCS);
-    }
-
-    pCtx = pIemCpu->CTX_SUFF(pCtx);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCS);
+    }
+
+    pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     if (enmBranch == IEMBRANCH_JUMP)
@@ -1183 +1183 @@
             {
                 Log(("BranchCallGate jump %04x:%08RX64 -> out of bounds (%#x) -> #GP(0)\n", uNewCS, uNewRip, cbLimit));
-                return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, 0);
+                return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
             }
             u64Base = X86DESC_BASE(&DescCS.Legacy);
@@ -1192 +1192 @@
         {
             Log(("BranchCallGate jump %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
-            return iemRaiseNotCanonical(pIemCpu);
+            return iemRaiseNotCanonical(pVCpu);
         }
 
@@ -1201 +1201 @@
         if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -1211 +1211 @@
         pCtx->rip         = uNewRip;
         pCtx->cs.Sel      = uNewCS & X86_SEL_MASK_OFF_RPL;
-        pCtx->cs.Sel     |= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
+        pCtx->cs.Sel     |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
         pCtx->cs.ValidSel = pCtx->cs.Sel;
         pCtx->cs.fFlags   = CPUMSELREG_FLAGS_VALID;
@@ -1217 +1217 @@
         pCtx->cs.u32Limit = cbLimit;
         pCtx->cs.u64Base  = u64Base;
-        pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
+        pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
     }
     else
@@ -1224 +1224 @@
         /* Calls are much more complicated. */
 
-        if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pIemCpu->uCpl))
+        if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < pVCpu->iem.s.uCpl))
         {
             uint16_t    offNewStack;    /* Offset of new stack in TSS. */
@@ -1249 +1249 @@
             /* Figure out where the new stack pointer is stored in the TSS. */
             uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
-            if (!IEM_IS_LONG_MODE(pIemCpu))
+            if (!IEM_IS_LONG_MODE(pVCpu))
             {
                 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
@@ -1274 +1274 @@
             {
                 Log(("BranchCallGate inner stack past TSS limit - %u > %u -> #TS(TSS)\n", offNewStack + cbNewStack - 1, pCtx->tr.u32Limit));
-                return iemRaiseTaskSwitchFaultBySelector(pIemCpu, pCtx->tr.Sel);
+                return iemRaiseTaskSwitchFaultBySelector(pVCpu, pCtx->tr.Sel);
             }
 
             GCPtrTSS = pCtx->tr.u64Base + offNewStack;
-            rcStrict = iemMemMap(pIemCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
+            rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R);
             if (rcStrict != VINF_SUCCESS)
             {
@@ -1285 +1285 @@
             }
 
-            if (!IEM_IS_LONG_MODE(pIemCpu))
+            if (!IEM_IS_LONG_MODE(pVCpu))
             {
                 if (pCtx->tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
@@ -1308 +1308 @@
 
             /* Done with the TSS now. */
-            rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
+            rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
             if (rcStrict != VINF_SUCCESS)
             {
@@ -1319 +1319 @@
 
             /* If EFER.LMA is 0, there's extra work to do. */
-            if (!IEM_IS_LONG_MODE(pIemCpu))
+            if (!IEM_IS_LONG_MODE(pVCpu))
             {
                 if ((uNewSS & X86_SEL_MASK_OFF_RPL) == 0)
                 {
                     Log(("BranchCallGate new SS NULL -> #TS(NewSS)\n"));
-                    return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uNewSS);
+                    return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
                 }
 
                 /* Grab the new SS descriptor. */
-                rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_SS);
+                rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
                 if (rcStrict != VINF_SUCCESS)
                     return rcStrict;
@@ -1338 +1338 @@
                     Log(("BranchCallGate call bad RPL/DPL uNewSS=%04x SS DPL=%d CS DPL=%u -> #TS(NewSS)\n",
                          uNewSS, DescCS.Legacy.Gen.u2Dpl, DescCS.Legacy.Gen.u2Dpl));
-                    return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uNewSS);
+                    return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
                 }
 
@@ -1345 +1345 @@
                 {
                     Log(("BranchCallGate call new SS -> not a writable data selector (u4Type=%#x)\n", DescSS.Legacy.Gen.u4Type));
-                    return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uNewSS);
+                    return iemRaiseTaskSwitchFaultBySelector(pVCpu, uNewSS);
                 }
 
@@ -1351 +1351 @@
                 {
                     Log(("BranchCallGate New stack not present uSel=%04x -> #SS(NewSS)\n", uNewSS));
-                    return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
+                    return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
                 }
                 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
@@ -1361 +1361 @@
             {
                 /* Just grab the new (NULL) SS descriptor. */
-                rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_SS);
+                rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_SS);
                 if (rcStrict != VINF_SUCCESS)
                     return rcStrict;
@@ -1382 +1382 @@
             if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
             {
-                rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
+                rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
                 if (rcStrict != VINF_SUCCESS)
                     return rcStrict;
@@ -1402 +1402 @@
             pCtx->ss.fFlags   = CPUMSELREG_FLAGS_VALID;
             pCtx->rsp         = uNewRsp;
-            pIemCpu->uCpl     = uNewCSDpl;
-            Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), &pCtx->ss));
-            CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
+            pVCpu->iem.s.uCpl     = uNewCSDpl;
+            Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, &pCtx->ss));
+            CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
 
             /* Check new stack - may #SS(NewSS). */
-            rcStrict = iemMemStackPushBeginSpecial(pIemCpu, cbNewStack,
+            rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
                                                    &uPtrRet.pv, &uNewRsp);
             if (rcStrict != VINF_SUCCESS)
@@ -1415 +1415 @@
             }
 
-            if (!IEM_IS_LONG_MODE(pIemCpu))
+            if (!IEM_IS_LONG_MODE(pVCpu))
             {
                 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
@@ -1424 +1424 @@
 
                     /* Map the relevant chunk of the old stack. */
-                    rcStrict = iemMemMap(pIemCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
+                    rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
                     if (rcStrict != VINF_SUCCESS)
                     {
@@ -1436 +1436 @@
 
                     /* Unmap the old stack. */
-                    rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
+                    rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
                     if (rcStrict != VINF_SUCCESS)
                     {
@@ -1456 +1456 @@
 
                     /* Map the relevant chunk of the old stack. */
-                    rcStrict = iemMemMap(pIemCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
+                    rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds, IEM_ACCESS_DATA_R);
                     if (rcStrict != VINF_SUCCESS)
                     {
@@ -1468 +1468 @@
 
                     /* Unmap the old stack. */
-                    rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
+                    rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
                     if (rcStrict != VINF_SUCCESS)
                     {
@@ -1491 +1491 @@
             }
 
-            rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
+            rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
             if (rcStrict != VINF_SUCCESS)
             {
@@ -1504 +1504 @@
             /* Limit / canonical check. */
             cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
-            if (!IEM_IS_LONG_MODE(pIemCpu))
+            if (!IEM_IS_LONG_MODE(pVCpu))
             {
                 if (uNewRip > cbLimit)
                 {
                     Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
-                    return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, 0);
+                    return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
                 }
                 u64Base = X86DESC_BASE(&DescCS.Legacy);
@@ -1519 +1519 @@
                 {
                     Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
-                    return iemRaiseNotCanonical(pIemCpu);
+                    return iemRaiseNotCanonical(pVCpu);
                 }
                 u64Base = 0;
@@ -1532 +1532 @@
             if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
             {
-                rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
+                rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
                 if (rcStrict != VINF_SUCCESS)
                     return rcStrict;
@@ -1542 +1542 @@
             pCtx->rip         = uNewRip;
             pCtx->cs.Sel      = uNewCS & X86_SEL_MASK_OFF_RPL;
-            pCtx->cs.Sel     |= pIemCpu->uCpl;
+            pCtx->cs.Sel     |= pVCpu->iem.s.uCpl;
             pCtx->cs.ValidSel = pCtx->cs.Sel;
             pCtx->cs.fFlags   = CPUMSELREG_FLAGS_VALID;
@@ -1548 +1548 @@
             pCtx->cs.u32Limit = cbLimit;
             pCtx->cs.u64Base  = u64Base;
-            pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
+            pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
         }
         else
@@ -1558 +1558 @@
             /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
              *        16-bit code cause a two or four byte CS to be pushed? */
-            rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
-                                                   IEM_IS_LONG_MODE(pIemCpu) ? 8+8
+            rcStrict = iemMemStackPushBeginSpecial(pVCpu,
+                                                   IEM_IS_LONG_MODE(pVCpu) ? 8+8
                                                    : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 4+4 : 2+2,
                                                    &uPtrRet.pv, &uNewRsp);
@@ -1571 +1571 @@
             /* Limit / canonical check. */
             cbLimit = X86DESC_LIMIT_G(&DescCS.Legacy);
-            if (!IEM_IS_LONG_MODE(pIemCpu))
+            if (!IEM_IS_LONG_MODE(pVCpu))
             {
                 if (uNewRip > cbLimit)
                 {
                     Log(("BranchCallGate %04x:%08RX64 -> out of bounds (%#x)\n", uNewCS, uNewRip, cbLimit));
-                    return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, 0);
+                    return iemRaiseGeneralProtectionFaultBySelector(pVCpu, 0);
                 }
                 u64Base = X86DESC_BASE(&DescCS.Legacy);
@@ -1585 +1585 @@
                 {
                     Log(("BranchCallGate call %04x:%016RX64 - not canonical -> #GP\n", uNewCS, uNewRip));
-                    return iemRaiseNotCanonical(pIemCpu);
+                    return iemRaiseNotCanonical(pVCpu);
                 }
                 u64Base = 0;
@@ -1598 +1598 @@
             if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
             {
-                rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCS);
+                rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCS);
                 if (rcStrict != VINF_SUCCESS)
                     return rcStrict;
@@ -1606 +1606 @@
 
             /* stack */
-            if (!IEM_IS_LONG_MODE(pIemCpu))
+            if (!IEM_IS_LONG_MODE(pVCpu))
             {
                 if (pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE)
@@ -1627 +1627 @@
             }
 
-            rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
+            rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -1634 +1634 @@
             pCtx->rip         = uNewRip;
             pCtx->cs.Sel      = uNewCS & X86_SEL_MASK_OFF_RPL;
-            pCtx->cs.Sel     |= pIemCpu->uCpl;
+            pCtx->cs.Sel     |= pVCpu->iem.s.uCpl;
             pCtx->cs.ValidSel = pCtx->cs.Sel;
             pCtx->cs.fFlags   = CPUMSELREG_FLAGS_VALID;
@@ -1640 +1640 @@
             pCtx->cs.u32Limit = cbLimit;
             pCtx->cs.u64Base  = u64Base;
-            pIemCpu->enmCpuMode  = iemCalcCpuMode(pCtx);
+            pVCpu->iem.s.enmCpuMode  = iemCalcCpuMode(pCtx);
         }
     }
@@ -1646 +1646 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
     return VINF_SUCCESS;
 #endif
@@ -1665 +1665 @@
     Assert((uSel & X86_SEL_MASK_OFF_RPL));
 
-    if (IEM_IS_LONG_MODE(pIemCpu))
+    if (IEM_IS_LONG_MODE(pVCpu))
         switch (pDesc->Legacy.Gen.u4Type)
         {
@@ -1678 +1678 @@
             case AMD64_SEL_TYPE_SYS_INT_GATE:
                 Log(("branch %04x -> wrong sys selector (64-bit): %d\n", uSel, pDesc->Legacy.Gen.u4Type));
-                return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+                return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
 
@@ -1696 +1696 @@
         case X86_SEL_TYPE_SYS_286_TSS_BUSY:
             Log(("branch %04x -> busy 286 TSS\n", uSel));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
 
         case X86_SEL_TYPE_SYS_386_TSS_BUSY:
             Log(("branch %04x -> busy 386 TSS\n", uSel));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
 
         default:
@@ -1709 +1709 @@
         case X86_SEL_TYPE_SYS_386_TRAP_GATE:
             Log(("branch %04x -> wrong sys selector: %d\n", uSel, pDesc->Legacy.Gen.u4Type));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
     }
 }
@@ -1723 +1723 @@
 IEM_CIMPL_DEF_3(iemCImpl_FarJmp, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     NOREF(cbInstr);
     Assert(offSeg <= UINT32_MAX);
@@ -1732 +1732 @@
      * limit.
      */
-    if (   pIemCpu->enmCpuMode == IEMMODE_16BIT
-        && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+    if (   pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
+        && IEM_IS_REAL_OR_V86_MODE(pVCpu))
     {
         if (offSeg > pCtx->cs.u32Limit)
         {
             Log(("iemCImpl_FarJmp: 16-bit limit\n"));
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         }
 
@@ -1759 +1759 @@
     {
         Log(("jmpf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
     /* Fetch the descriptor. */
     IEMSELDESC Desc;
-    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
+    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -1772 +1772 @@
     {
         Log(("jmpf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
     }
 
@@ -1786 +1786 @@
     {
         Log(("jmpf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
     }
 
@@ -1792 +1792 @@
     if (   Desc.Legacy.Gen.u1Long
         && Desc.Legacy.Gen.u1DefBig
-        && IEM_IS_LONG_MODE(pIemCpu))
+        && IEM_IS_LONG_MODE(pVCpu))
     {
         Log(("jmpf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
     }
 
@@ -1801 +1801 @@
     if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
     {
-        if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
+        if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
         {
             Log(("jmpf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
-                 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+                 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
     }
     else
     {
-        if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
-        {
-            Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
-        }
-        if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
-        {
-            Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+        if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
+        {
+            Log(("jmpf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
+        }
+        if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
+        {
+            Log(("jmpf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
     }
@@ -1838 +1838 @@
             Log(("jmpf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
             /** @todo: Intel says this is #GP(0)! */
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
         u64Base = X86DESC_BASE(&Desc.Legacy);
@@ -1849 +1849 @@
     if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
     {
-        rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
+        rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -1859 +1859 @@
     pCtx->rip = offSeg;
     pCtx->cs.Sel         = uSel & X86_SEL_MASK_OFF_RPL;
-    pCtx->cs.Sel        |= pIemCpu->uCpl; /** @todo is this right for conforming segs? or in general? */
+    pCtx->cs.Sel        |= pVCpu->iem.s.uCpl; /** @todo is this right for conforming segs? or in general? */
     pCtx->cs.ValidSel    = pCtx->cs.Sel;
     pCtx->cs.fFlags      = CPUMSELREG_FLAGS_VALID;
@@ -1865 +1865 @@
     pCtx->cs.u32Limit    = cbLimit;
     pCtx->cs.u64Base     = u64Base;
-    pIemCpu->enmCpuMode  = iemCalcCpuMode(pCtx);
+    pVCpu->iem.s.enmCpuMode  = iemCalcCpuMode(pCtx);
     pCtx->eflags.Bits.u1RF = 0;
     /** @todo check if the hidden bits are loaded correctly for 64-bit
@@ -1871 +1871 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -1888 +1888 @@
 IEM_CIMPL_DEF_3(iemCImpl_callf, uint16_t, uSel, uint64_t, offSeg, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     VBOXSTRICTRC    rcStrict;
     uint64_t        uNewRsp;
@@ -1898 +1898 @@
      * limit.
      */
-    if (   pIemCpu->enmCpuMode == IEMMODE_16BIT
-        && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+    if (   pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
+        && IEM_IS_REAL_OR_V86_MODE(pVCpu))
     {
         Assert(enmEffOpSize == IEMMODE_16BIT || enmEffOpSize == IEMMODE_32BIT);
 
         /* Check stack first - may #SS(0). */
-        rcStrict = iemMemStackPushBeginSpecial(pIemCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
+        rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 6 : 4,
                                                &uPtrRet.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
@@ -1911 +1911 @@
         /* Check the target address range. */
         if (offSeg > UINT32_MAX)
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
 
         /* Everything is fine, push the return address. */
@@ -1924 +1924 @@
             uPtrRet.pu16[3] = pCtx->cs.Sel;
         }
-        rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
+        rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -1944 +1944 @@
     {
         Log(("callf %04x:%08RX64 -> invalid selector, #GP(0)\n", uSel, offSeg));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
     /* Fetch the descriptor. */
     IEMSELDESC Desc;
-    rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP);
+    rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -1964 +1964 @@
     {
         Log(("callf %04x:%08RX64 -> not a code selector (u4Type=%#x).\n", uSel, offSeg, Desc.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
     }
 
@@ -1970 +1970 @@
     if (   Desc.Legacy.Gen.u1Long
         && Desc.Legacy.Gen.u1DefBig
-        && IEM_IS_LONG_MODE(pIemCpu))
+        && IEM_IS_LONG_MODE(pVCpu))
     {
         Log(("callf %04x:%08RX64 -> both L and D are set.\n", uSel, offSeg));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
     }
 
@@ -1979 +1979 @@
     if (Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF)
     {
-        if (pIemCpu->uCpl < Desc.Legacy.Gen.u2Dpl)
+        if (pVCpu->iem.s.uCpl < Desc.Legacy.Gen.u2Dpl)
         {
             Log(("callf %04x:%08RX64 -> DPL violation (conforming); DPL=%d CPL=%u\n",
-                 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+                 uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
     }
     else
     {
-        if (pIemCpu->uCpl != Desc.Legacy.Gen.u2Dpl)
-        {
-            Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
-        }
-        if ((uSel & X86_SEL_RPL) > pIemCpu->uCpl)
-        {
-            Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pIemCpu->uCpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+        if (pVCpu->iem.s.uCpl != Desc.Legacy.Gen.u2Dpl)
+        {
+            Log(("callf %04x:%08RX64 -> CPL != DPL; DPL=%d CPL=%u\n", uSel, offSeg, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
+        }
+        if ((uSel & X86_SEL_RPL) > pVCpu->iem.s.uCpl)
+        {
+            Log(("callf %04x:%08RX64 -> RPL > DPL; RPL=%d CPL=%u\n", uSel, offSeg, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl));
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
     }
@@ -2004 +2004 @@
     {
         Log(("callf %04x:%08RX64 -> segment not present\n", uSel, offSeg));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
     }
 
@@ -2010 +2010 @@
     /** @todo check how operand prefix affects pushing of CS! Does callf 16:32 in
      *        16-bit code cause a two or four byte CS to be pushed? */
-    rcStrict = iemMemStackPushBeginSpecial(pIemCpu,
+    rcStrict = iemMemStackPushBeginSpecial(pVCpu,
                                            enmEffOpSize == IEMMODE_64BIT   ? 8+8
                                            : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
@@ -2024 +2024 @@
     uint64_t u64Base;
     uint32_t cbLimit = X86DESC_LIMIT_G(&Desc.Legacy);
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         if (!IEM_IS_CANONICAL(offSeg))
         {
             Log(("callf %04x:%016RX64 - not canonical -> #GP\n", uSel, offSeg));
-            return iemRaiseNotCanonical(pIemCpu);
+            return iemRaiseNotCanonical(pVCpu);
         }
         u64Base = 0;
@@ -2039 +2039 @@
             Log(("callf %04x:%08RX64 -> out of bounds (%#x)\n", uSel, offSeg, cbLimit));
             /** @todo: Intel says this is #GP(0)! */
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
         u64Base = X86DESC_BASE(&Desc.Legacy);
@@ -2052 +2052 @@
     if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
     {
-        rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
+        rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2075 +2075 @@
         uPtrRet.pu64[1] = pCtx->cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
     }
-    rcStrict = iemMemStackPushCommitSpecial(pIemCpu, uPtrRet.pv, uNewRsp);
+    rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2082 +2082 @@
     pCtx->rip = offSeg;
     pCtx->cs.Sel         = uSel & X86_SEL_MASK_OFF_RPL;
-    pCtx->cs.Sel        |= pIemCpu->uCpl;
+    pCtx->cs.Sel        |= pVCpu->iem.s.uCpl;
     pCtx->cs.ValidSel    = pCtx->cs.Sel;
     pCtx->cs.fFlags      = CPUMSELREG_FLAGS_VALID;
@@ -2088 +2088 @@
     pCtx->cs.u32Limit    = cbLimit;
     pCtx->cs.u64Base     = u64Base;
-    pIemCpu->enmCpuMode  = iemCalcCpuMode(pCtx);
+    pVCpu->iem.s.enmCpuMode  = iemCalcCpuMode(pCtx);
     pCtx->eflags.Bits.u1RF = 0;
     /** @todo check if the hidden bits are loaded correctly for 64-bit
@@ -2094 +2094 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -2109 +2109 @@
 IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
 {
-    PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     VBOXSTRICTRC    rcStrict;
     RTCPTRUNION     uPtrFrame;
@@ -2122 +2122 @@
     uint32_t        cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
                              : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
-    rcStrict = iemMemStackPopBeginSpecial(pIemCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
+    rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr, &uPtrFrame.pv, &uNewRsp);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2144 +2144 @@
      * Real mode and V8086 mode are easy.
      */
-    if (   pIemCpu->enmCpuMode == IEMMODE_16BIT
-        && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+    if (   pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
+        && IEM_IS_REAL_OR_V86_MODE(pVCpu))
     {
         Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
@@ -2154 +2154 @@
          *        operands, AMD does not make any distinction. What is right? */
         if (uNewRip > pCtx->cs.u32Limit)
-            return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
+            return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
 
         /* commit the operation. */
-        rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
+        rcStrict = iemMemStackPopCommitSpecial(pVCpu, uPtrFrame.pv, uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2168 +2168 @@
         /** @todo do we load attribs and limit as well? */
         if (cbPop)
-            iemRegAddToRsp(pIemCpu, pCtx, cbPop);
+            iemRegAddToRsp(pVCpu, pCtx, cbPop);
         return VINF_SUCCESS;
     }
@@ -2178 +2178 @@
     {
         Log(("retf %04x:%08RX64 -> invalid selector, #GP(0)\n", uNewCs, uNewRip));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
     /* Fetch the descriptor. */
     IEMSELDESC DescCs;
-    rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCs, uNewCs, X86_XCPT_GP);
+    rcStrict = iemMemFetchSelDesc(pVCpu, &DescCs, uNewCs, X86_XCPT_GP);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2193 +2193 @@
         Log(("retf %04x:%08RX64 -> not a code selector (u1DescType=%u u4Type=%#x).\n",
              uNewCs, uNewRip, DescCs.Legacy.Gen.u1DescType, DescCs.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
     }
 
@@ -2199 +2199 @@
     if (   DescCs.Legacy.Gen.u1Long /** @todo Testcase: far return to a selector with both L and D set. */
         && DescCs.Legacy.Gen.u1DefBig
-        && IEM_IS_LONG_MODE(pIemCpu))
+        && IEM_IS_LONG_MODE(pVCpu))
     {
         Log(("retf %04x:%08RX64 -> both L & D set.\n", uNewCs, uNewRip));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
     }
 
     /* DPL/RPL/CPL checks. */
-    if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
-    {
-        Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+    if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
+    {
+        Log(("retf %04x:%08RX64 -> RPL < CPL(%d).\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
     }
 
@@ -2218 +2218 @@
             Log(("retf %04x:%08RX64 -> DPL violation (conforming); DPL=%u RPL=%u\n",
                  uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
         }
     }
@@ -2227 +2227 @@
             Log(("retf %04x:%08RX64 -> RPL != DPL; DPL=%u RPL=%u\n",
                  uNewCs, uNewRip, DescCs.Legacy.Gen.u2Dpl, (uNewCs & X86_SEL_RPL)));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
         }
     }
@@ -2235 +2235 @@
     {
         Log(("retf %04x:%08RX64 -> segment not present\n", uNewCs, uNewRip));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
     }
 
@@ -2241 +2241 @@
      * Return to outer privilege? (We'll typically have entered via a call gate.)
      */
-    if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
+    if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
     {
         /* Read the outer stack pointer stored *after* the parameters. */
         RTCPTRUNION uPtrStack;
-        rcStrict = iemMemStackPopContinueSpecial(pIemCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
+        rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop + cbRetPtr, &uPtrStack.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2279 +2279 @@
                 Log(("retf %04x:%08RX64 %04x:%08RX64 -> invalid stack selector, #GP\n",
                      uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
             /** @todo Testcase: Return far to ring-1 or ring-2 with SS=0. */
@@ -2287 +2287 @@
         {
             /* Fetch the descriptor for the new stack segment. */
-            rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
+            rcStrict = iemMemFetchSelDesc(pVCpu, &DescSs, uNewOuterSs, X86_XCPT_GP);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -2296 +2296 @@
         {
             Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.RPL != CS.RPL -> #GP(SS)\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
         }
 
@@ -2306 +2306 @@
             Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not a writable data segment (u1DescType=%u u4Type=%#x) -> #GP(SS).\n",
                  uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u1DescType, DescSs.Legacy.Gen.u4Type));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
         }
 
@@ -2312 +2312 @@
         if (   DescSs.Legacy.Gen.u1Long /** @todo Testcase: far return to a stack selector with both L and D set. */
             && DescSs.Legacy.Gen.u1DefBig
-            && IEM_IS_LONG_MODE(pIemCpu))
+            && IEM_IS_LONG_MODE(pVCpu))
         {
             Log(("retf %04x:%08RX64 %04x:%08RX64 - SS has both L & D set -> #GP(SS).\n",
                  uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
         }
 
@@ -2324 +2324 @@
             Log(("retf %04x:%08RX64 %04x:%08RX64 - SS.DPL(%u) != CS.RPL (%u) -> #GP(SS).\n",
                  uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, DescSs.Legacy.Gen.u2Dpl, uNewCs & X86_SEL_RPL));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewOuterSs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewOuterSs);
         }
 
@@ -2331 +2331 @@
         {
             Log(("retf %04x:%08RX64 %04x:%08RX64 - SS not present -> #NP(SS).\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
-            return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
+            return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
         }
 
@@ -2343 +2343 @@
         /** @todo Testcase: Is this correct? */
         if (   DescCs.Legacy.Gen.u1Long
-            && IEM_IS_LONG_MODE(pIemCpu) )
+            && IEM_IS_LONG_MODE(pVCpu) )
         {
             if (!IEM_IS_CANONICAL(uNewRip))
             {
                 Log(("retf %04x:%08RX64 %04x:%08RX64 - not canonical -> #GP.\n", uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp));
-                return iemRaiseNotCanonical(pIemCpu);
+                return iemRaiseNotCanonical(pVCpu);
             }
             u64Base = 0;
@@ -2359 +2359 @@
                      uNewCs, uNewRip, uNewOuterSs, uNewOuterRsp, cbLimitCs));
                 /** @todo: Intel says this is #GP(0)! */
-                return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+                return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
             }
             u64Base = X86DESC_BASE(&DescCs.Legacy);
@@ -2372 +2372 @@
         if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -2381 +2381 @@
         if (!(DescSs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewOuterSs);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewOuterSs);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -2389 +2389 @@
 
         /* commit */
-        rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
+        rcStrict = iemMemStackPopCommitSpecial(pVCpu, uPtrFrame.pv, uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2402 +2402 @@
         pCtx->cs.u32Limit       = cbLimitCs;
         pCtx->cs.u64Base        = u64Base;
-        pIemCpu->enmCpuMode     = iemCalcCpuMode(pCtx);
+        pVCpu->iem.s.enmCpuMode     = iemCalcCpuMode(pCtx);
         pCtx->rsp               = uNewOuterRsp;
         pCtx->ss.Sel            = uNewOuterSs;
@@ -2409 +2409 @@
         pCtx->ss.Attr.u         = X86DESC_GET_HID_ATTR(&DescSs.Legacy);
         pCtx->ss.u32Limit       = cbLimitSs;
-        if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+        if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
             pCtx->ss.u64Base    = 0;
         else
             pCtx->ss.u64Base    = X86DESC_BASE(&DescSs.Legacy);
 
-        pIemCpu->uCpl           = (uNewCs & X86_SEL_RPL);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
+        pVCpu->iem.s.uCpl           = (uNewCs & X86_SEL_RPL);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
 
         /** @todo check if the hidden bits are loaded correctly for 64-bit
@@ -2424 +2424 @@
 
         if (cbPop)
-            iemRegAddToRsp(pIemCpu, pCtx, cbPop);
+            iemRegAddToRsp(pVCpu, pCtx, cbPop);
         pCtx->eflags.Bits.u1RF = 0;
 
@@ -2440 +2440 @@
         /** @todo Testcase: Is this correct? */
         if (   DescCs.Legacy.Gen.u1Long
-            && IEM_IS_LONG_MODE(pIemCpu) )
+            && IEM_IS_LONG_MODE(pVCpu) )
         {
             if (!IEM_IS_CANONICAL(uNewRip))
             {
                 Log(("retf %04x:%08RX64 - not canonical -> #GP\n", uNewCs, uNewRip));
-                return iemRaiseNotCanonical(pIemCpu);
+                return iemRaiseNotCanonical(pVCpu);
             }
             u64Base = 0;
@@ -2455 +2455 @@
                 Log(("retf %04x:%08RX64 -> out of bounds (%#x)\n", uNewCs, uNewRip, cbLimitCs));
                 /** @todo: Intel says this is #GP(0)! */
-                return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+                return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
             }
             u64Base = X86DESC_BASE(&DescCs.Legacy);
@@ -2468 +2468 @@
         if (!(DescCs.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -2476 +2476 @@
 
         /* commit */
-        rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uPtrFrame.pv, uNewRsp);
+        rcStrict = iemMemStackPopCommitSpecial(pVCpu, uPtrFrame.pv, uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2491 +2491 @@
         /** @todo check if the hidden bits are loaded correctly for 64-bit
          *        mode.  */
-        pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
+        pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
         if (cbPop)
-            iemRegAddToRsp(pIemCpu, pCtx, cbPop);
+            iemRegAddToRsp(pVCpu, pCtx, cbPop);
         pCtx->eflags.Bits.u1RF = 0;
     }
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
     return VINF_SUCCESS;
 }
@@ -2515 +2515 @@
 IEM_CIMPL_DEF_2(iemCImpl_retn, IEMMODE, enmEffOpSize, uint16_t, cbPop)
 {
-    PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     NOREF(cbInstr);
 
@@ -2527 +2527 @@
         case IEMMODE_16BIT:
             NewRip.u = 0;
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRip.Words.w0, &NewRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRip.Words.w0, &NewRsp);
             break;
         case IEMMODE_32BIT:
             NewRip.u = 0;
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRip.DWords.dw0, &NewRsp);
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRip.DWords.dw0, &NewRsp);
             break;
         case IEMMODE_64BIT:
-            rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRip.u, &NewRsp);
+            rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRip.u, &NewRsp);
             break;
         IEM_NOT_REACHED_DEFAULT_CASE_RET();
@@ -2549 +2549 @@
         {
             Log(("retn newrip=%llx - out of bounds (%x) -> #GP\n", NewRip.u, pCtx->cs.u32Limit));
-            return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
+            return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
         }
     }
@@ -2557 +2557 @@
         {
             Log(("retn newrip=%llx - not canonical -> #GP\n", NewRip.u));
-            return iemRaiseNotCanonical(pIemCpu);
+            return iemRaiseNotCanonical(pVCpu);
         }
     }
@@ -2563 +2563 @@
     /* Apply cbPop */
     if (cbPop)
-        iemRegAddToRspEx(pIemCpu, pCtx, &NewRsp, cbPop);
+        iemRegAddToRspEx(pVCpu, pCtx, &NewRsp, cbPop);
 
     /* Commit it. */
@@ -2571 +2571 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -2587 +2587 @@
 IEM_CIMPL_DEF_3(iemCImpl_enter, IEMMODE, enmEffOpSize, uint16_t, cbFrame, uint8_t, cParameters)
 {
-    PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /* Push RBP, saving the old value in TmpRbp. */
@@ -2596 +2596 @@
     if (enmEffOpSize == IEMMODE_64BIT)
     {
-        rcStrict = iemMemStackPushU64Ex(pIemCpu, TmpRbp.u, &NewRsp);
+        rcStrict = iemMemStackPushU64Ex(pVCpu, TmpRbp.u, &NewRsp);
         NewRbp = NewRsp;
     }
     else if (enmEffOpSize == IEMMODE_32BIT)
     {
-        rcStrict = iemMemStackPushU32Ex(pIemCpu, TmpRbp.DWords.dw0, &NewRsp);
+        rcStrict = iemMemStackPushU32Ex(pVCpu, TmpRbp.DWords.dw0, &NewRsp);
         NewRbp = NewRsp;
     }
     else
     {
-        rcStrict = iemMemStackPushU16Ex(pIemCpu, TmpRbp.Words.w0, &NewRsp);
+        rcStrict = iemMemStackPushU16Ex(pVCpu, TmpRbp.Words.w0, &NewRsp);
         NewRbp = TmpRbp;
         NewRbp.Words.w0 = NewRsp.Words.w0;
@@ -2627 +2627 @@
                 {
                     uint16_t u16Tmp;
-                    rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Tmp, &TmpRbp);
+                    rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Tmp, &TmpRbp);
                     if (rcStrict != VINF_SUCCESS)
                         break;
-                    rcStrict = iemMemStackPushU16Ex(pIemCpu, u16Tmp, &NewRsp);
+                    rcStrict = iemMemStackPushU16Ex(pVCpu, u16Tmp, &NewRsp);
                 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
                 break;
@@ -2642 +2642 @@
                 {
                     uint32_t u32Tmp;
-                    rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Tmp, &TmpRbp);
+                    rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Tmp, &TmpRbp);
                     if (rcStrict != VINF_SUCCESS)
                         break;
-                    rcStrict = iemMemStackPushU32Ex(pIemCpu, u32Tmp, &NewRsp);
+                    rcStrict = iemMemStackPushU32Ex(pVCpu, u32Tmp, &NewRsp);
                 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
                 break;
@@ -2654 +2654 @@
                 {
                     uint64_t u64Tmp;
-                    rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Tmp, &TmpRbp);
+                    rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Tmp, &TmpRbp);
                     if (rcStrict != VINF_SUCCESS)
                         break;
-                    rcStrict = iemMemStackPushU64Ex(pIemCpu, u64Tmp, &NewRsp);
+                    rcStrict = iemMemStackPushU64Ex(pVCpu, u64Tmp, &NewRsp);
                 } while (--cParameters > 0 && rcStrict == VINF_SUCCESS);
                 break;
@@ -2668 +2668 @@
         /* Push the new RBP */
         if (enmEffOpSize == IEMMODE_64BIT)
-            rcStrict = iemMemStackPushU64Ex(pIemCpu, NewRbp.u, &NewRsp);
+            rcStrict = iemMemStackPushU64Ex(pVCpu, NewRbp.u, &NewRsp);
         else if (enmEffOpSize == IEMMODE_32BIT)
-            rcStrict = iemMemStackPushU32Ex(pIemCpu, NewRbp.DWords.dw0, &NewRsp);
+            rcStrict = iemMemStackPushU32Ex(pVCpu, NewRbp.DWords.dw0, &NewRsp);
         else
-            rcStrict = iemMemStackPushU16Ex(pIemCpu, NewRbp.Words.w0, &NewRsp);
+            rcStrict = iemMemStackPushU16Ex(pVCpu, NewRbp.Words.w0, &NewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2679 +2679 @@
 
     /* Recalc RSP. */
-    iemRegSubFromRspEx(pIemCpu, pCtx, &NewRsp, cbFrame);
+    iemRegSubFromRspEx(pVCpu, pCtx, &NewRsp, cbFrame);
 
     /** @todo Should probe write access at the new RSP according to AMD. */
@@ -2686 +2686 @@
     pCtx->rbp = NewRbp.u;
     pCtx->rsp = NewRsp.u;
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
 
     return VINF_SUCCESS;
@@ -2703 +2703 @@
 IEM_CIMPL_DEF_1(iemCImpl_leave, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /* Calculate the intermediate RSP from RBP and the stack attributes. */
     RTUINT64U       NewRsp;
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         NewRsp.u = pCtx->rbp;
     else if (pCtx->ss.Attr.n.u1DefBig)
@@ -2725 +2725 @@
         case IEMMODE_16BIT:
             NewRbp.u = pCtx->rbp;
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &NewRbp.Words.w0, &NewRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &NewRbp.Words.w0, &NewRsp);
             break;
         case IEMMODE_32BIT:
             NewRbp.u = 0;
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &NewRbp.DWords.dw0, &NewRsp);
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &NewRbp.DWords.dw0, &NewRsp);
             break;
         case IEMMODE_64BIT:
-            rcStrict = iemMemStackPopU64Ex(pIemCpu, &NewRbp.u, &NewRsp);
+            rcStrict = iemMemStackPopU64Ex(pVCpu, &NewRbp.u, &NewRsp);
             break;
         IEM_NOT_REACHED_DEFAULT_CASE_RET();
@@ -2743 +2743 @@
     pCtx->rbp = NewRbp.u;
     pCtx->rsp = NewRsp.u;
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
 
     return VINF_SUCCESS;
@@ -2757 +2757 @@
 IEM_CIMPL_DEF_2(iemCImpl_int, uint8_t, u8Int, bool, fIsBpInstr)
 {
-    Assert(pIemCpu->cXcptRecursions == 0);
-    return iemRaiseXcptOrInt(pIemCpu,
+    Assert(pVCpu->iem.s.cXcptRecursions == 0);
+    return iemRaiseXcptOrInt(pVCpu,
                              cbInstr,
                              u8Int,
@@ -2774 +2774 @@
 IEM_CIMPL_DEF_1(iemCImpl_iret_real_v8086, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX  pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX  pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
     X86EFLAGS Efl;
-    Efl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    Efl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
     NOREF(cbInstr);
 
@@ -2785 +2785 @@
         && Efl.Bits.u2IOPL != 3
         && !(pCtx->cr4 & X86_CR4_VME))
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
 
     /*
@@ -2800 +2800 @@
     if (enmEffOpSize == IEMMODE_32BIT)
     {
-        rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
         uNewEip    = uFrame.pu32[0];
         if (uNewEip > UINT16_MAX)
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
 
         uNewCs     = (uint16_t)uFrame.pu32[1];
@@ -2813 +2813 @@
                    | X86_EFL_RF /*| X86_EFL_VM*/ | X86_EFL_AC /*|X86_EFL_VIF*/ /*|X86_EFL_VIP*/
                    | X86_EFL_ID;
-        if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_386)
+        if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
             uNewFlags &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
         uNewFlags |= Efl.u & (X86_EFL_VM | X86_EFL_VIF | X86_EFL_VIP | X86_EFL_1);
@@ -2819 +2819 @@
     else
     {
-        rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2831 +2831 @@
          *        reserved flags. We just ignore them. */
         /* Ancient CPU adjustments: See iemCImpl_popf. */
-        if (IEM_GET_TARGET_CPU(pIemCpu) == IEMTARGETCPU_286)
+        if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_286)
             uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
     }
@@ -2844 +2844 @@
      *        right? */
     if (uNewEip > pCtx->cs.u32Limit)
-        return iemRaiseSelectorBounds(pIemCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
+        return iemRaiseSelectorBounds(pVCpu, X86_SREG_CS, IEM_ACCESS_INSTRUCTION);
 
     /*
@@ -2869 +2869 @@
         }
         else
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         Log7(("iemCImpl_iret_real_v8086: u1VM=1: adjusted uNewFlags=%#x\n", uNewFlags));
     }
@@ -2876 +2876 @@
      * Commit the operation.
      */
-    rcStrict = iemMemStackPopCommitSpecial(pIemCpu, uFrame.pv, uNewRsp);
+    rcStrict = iemMemStackPopCommitSpecial(pVCpu, uFrame.pv, uNewRsp);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 #ifdef DBGFTRACE_ENABLED
-    RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
+    RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/rm %04x:%04x -> %04x:%04x %x %04llx",
                       pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewRsp);
 #endif
@@ -2891 +2891 @@
     /** @todo do we load attribs and limit as well? */
     Assert(uNewFlags & X86_EFL_1);
-    IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
+    IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -2938 +2938 @@
     VBOXSTRICTRC    rcStrict;
     RTCPTRUNION     uFrame;
-    rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 24, &uFrame.pv, &uNewRsp);
+    rcStrict = iemMemStackPopContinueSpecial(pVCpu, 24, &uFrame.pv, &uNewRsp);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2947 +2947 @@
     uint16_t uNewFs  = uFrame.pu32[4];
     uint16_t uNewGs  = uFrame.pu32[5];
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
+    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2957 +2957 @@
     uNewFlags |= X86_EFL_RA1_MASK;
 #ifdef DBGFTRACE_ENABLED
-    RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
+    RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/p/v %04x:%08x -> %04x:%04x %x %04x:%04x",
                       pCtx->cs.Sel, pCtx->eip, uNewCs, uNewEip, uNewFlags, uNewSs, uNewEsp);
 #endif
 
-    IEMMISC_SET_EFL(pIemCpu, pCtx, uNewFlags);
+    IEMMISC_SET_EFL(pVCpu, pCtx, uNewFlags);
     iemCImplCommonV8086LoadSeg(&pCtx->cs, uNewCs);
     iemCImplCommonV8086LoadSeg(&pCtx->ss, uNewSs);
@@ -2970 +2970 @@
     pCtx->rip      = (uint16_t)uNewEip;
     pCtx->rsp      = uNewEsp; /** @todo check this out! */
-    pIemCpu->uCpl  = 3;
+    pVCpu->iem.s.uCpl  = 3;
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -2994 +2994 @@
      */
     RTSEL        uSelRet;
-    PCPUMCTX     pCtx = pIemCpu->CTX_SUFF(pCtx);
-    VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pIemCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
+    PCPUMCTX     pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    VBOXSTRICTRC rcStrict = iemMemFetchSysU16(pVCpu, &uSelRet, UINT8_MAX, pCtx->tr.u64Base);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -3005 +3005 @@
     {
         Log(("iret_prot_NestedTask TSS not in LDT. uSelRet=%04x -> #TS\n", uSelRet));
-        return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uSelRet);
+        return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet);
     }
 
     IEMSELDESC TssDesc;
-    rcStrict = iemMemFetchSelDesc(pIemCpu, &TssDesc, uSelRet, X86_XCPT_GP);
+    rcStrict = iemMemFetchSelDesc(pVCpu, &TssDesc, uSelRet, X86_XCPT_GP);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -3016 +3016 @@
     {
         Log(("iret_prot_NestedTask Invalid TSS type. uSelRet=%04x -> #TS\n", uSelRet));
-        return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -3023 +3023 @@
     {
         Log(("iret_prot_NestedTask TSS is not busy. uSelRet=%04x DescType=%#x -> #TS\n", uSelRet, TssDesc.Legacy.Gate.u4Type));
-        return iemRaiseTaskSwitchFaultBySelector(pIemCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseTaskSwitchFaultBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -3029 +3029 @@
     {
         Log(("iret_prot_NestedTask TSS is not present. uSelRet=%04x -> #NP\n", uSelRet));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uSelRet & X86_SEL_MASK_OFF_RPL);
     }
 
     uint32_t uNextEip = pCtx->eip + cbInstr;
-    return iemTaskSwitch(pIemCpu, pIemCpu->CTX_SUFF(pCtx), IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
+    return iemTaskSwitch(pVCpu, pVCpu->iem.s.CTX_SUFF(pCtx), IEMTASKSWITCH_IRET, uNextEip, 0 /* fFlags */, 0 /* uErr */,
                          0 /* uCr2 */, uSelRet, &TssDesc);
 #endif
@@ -3046 +3046 @@
 IEM_CIMPL_DEF_1(iemCImpl_iret_prot, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     NOREF(cbInstr);
     Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
@@ -3071 +3071 @@
     if (enmEffOpSize == IEMMODE_32BIT)
     {
-        rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 12, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, &uFrame.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3080 +3080 @@
     else
     {
-        rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 6, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, &uFrame.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3087 +3087 @@
         uNewFlags  = uFrame.pu16[2];
     }
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
+    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -3096 +3096 @@
      */
     if (   (uNewFlags & X86_EFL_VM)
-        && pIemCpu->uCpl == 0)
+        && pVCpu->iem.s.uCpl == 0)
     {
         Assert(enmEffOpSize == IEMMODE_32BIT);
@@ -3109 +3109 @@
     {
         Log(("iret %04x:%08x -> invalid CS selector, #GP(0)\n", uNewCs, uNewEip));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
     IEMSELDESC DescCS;
-    rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
+    rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
     if (rcStrict != VINF_SUCCESS)
     {
@@ -3124 +3124 @@
     {
         Log(("iret %04x:%08x - CS is system segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
     }
     if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CODE))
     {
         Log(("iret %04x:%08x - not code segment (%#x) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
     }
 
 #ifdef VBOX_WITH_RAW_MODE_NOT_R0
     /* Raw ring-0 and ring-1 compression adjustments for PATM performance tricks and other CS leaks. */
-    PVM pVM = IEMCPU_TO_VM(pIemCpu);
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
     if (EMIsRawRing0Enabled(pVM) && !HMIsEnabled(pVM))
     {
         if ((uNewCs & X86_SEL_RPL) == 1)
         {
-            if (   pIemCpu->uCpl == 0
+            if (   pVCpu->iem.s.uCpl == 0
                 && (   !EMIsRawRing1Enabled(pVM)
                     || pCtx->cs.Sel == (uNewCs & X86_SEL_MASK_OFF_RPL)) )
@@ -3147 +3147 @@
             }
 # ifdef LOG_ENABLED
-            else if (pIemCpu->uCpl <= 1 && EMIsRawRing1Enabled(pVM))
+            else if (pVCpu->iem.s.uCpl <= 1 && EMIsRawRing1Enabled(pVM))
                 Log(("iret: uNewCs=%#x genuine return to ring-1.\n", uNewCs));
 # endif
@@ -3153 +3153 @@
         else if (   (uNewCs & X86_SEL_RPL) == 2
                  && EMIsRawRing1Enabled(pVM)
-                 && pIemCpu->uCpl <= 1)
+                 && pVCpu->iem.s.uCpl <= 1)
         {
             Log(("iret: Ring-1 compression fix: uNewCS=%#x -> %#x\n", uNewCs, (uNewCs & X86_SEL_MASK_OFF_RPL) | 1));
@@ -3168 +3168 @@
         {
             Log(("iret %04x:%08x - RPL != DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
         }
     }
@@ -3174 +3174 @@
     {
         Log(("iret %04x:%08x - RPL < DPL (%d) -> #GP\n", uNewCs, uNewEip, DescCS.Legacy.Gen.u2Dpl));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
-    }
-    if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
-    {
-        Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
+    }
+    if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
+    {
+        Log(("iret %04x:%08x - RPL < CPL (%d) -> #GP\n", uNewCs, uNewEip, pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
     }
 
@@ -3186 +3186 @@
     {
         Log(("iret %04x:%08x - CS not present -> #NP\n", uNewCs, uNewEip));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
     }
 
@@ -3194 +3194 @@
      * Return to outer level?
      */
-    if ((uNewCs & X86_SEL_RPL) != pIemCpu->uCpl)
+    if ((uNewCs & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
     {
         uint16_t    uNewSS;
@@ -3200 +3200 @@
         if (enmEffOpSize == IEMMODE_32BIT)
         {
-            rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 8, &uFrame.pv, &uNewRsp);
+            rcStrict = iemMemStackPopContinueSpecial(pVCpu, 8, &uFrame.pv, &uNewRsp);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3211 +3211 @@
         else
         {
-            rcStrict = iemMemStackPopContinueSpecial(pIemCpu, 4, &uFrame.pv, &uNewRsp);
+            rcStrict = iemMemStackPopContinueSpecial(pVCpu, 4, &uFrame.pv, &uNewRsp);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3217 +3217 @@
             uNewSS  = uFrame.pu16[1];
         }
-        rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3226 +3226 @@
         {
             Log(("iret %04x:%08x/%04x:%08x -> invalid SS selector, #GP(0)\n", uNewCs, uNewEip, uNewSS, uNewESP));
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         }
 
         IEMSELDESC DescSS;
-        rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
+        rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSS, X86_XCPT_GP); /** @todo Correct exception? */
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3242 +3242 @@
         {
             Log(("iret %04x:%08x/%04x:%08x -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewEip, uNewSS, uNewESP));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
         }
         if (DescSS.Legacy.Gen.u2Dpl != (uNewCs & X86_SEL_RPL))
@@ -3248 +3248 @@
             Log(("iret %04x:%08x/%04x:%08x -> SS.DPL (%d) != CS.RPL -> #GP\n",
                  uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u2Dpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
         }
 
@@ -3256 +3256 @@
             Log(("iret %04x:%08x/%04x:%08x -> SS is system segment (%#x) -> #GP\n",
                  uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
         }
         if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
@@ -3262 +3262 @@
             Log(("iret %04x:%08x/%04x:%08x - not writable data segment (%#x) -> #GP\n",
                  uNewCs, uNewEip, uNewSS, uNewESP, DescSS.Legacy.Gen.u4Type));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSS);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSS);
         }
 
@@ -3269 +3269 @@
         {
             Log(("iret %04x:%08x/%04x:%08x -> SS not present -> #SS\n", uNewCs, uNewEip, uNewSS, uNewESP));
-            return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSS);
+            return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSS);
         }
 
@@ -3280 +3280 @@
                  uNewCs, uNewEip, uNewSS, uNewESP, cbLimitCS));
             /** @todo: Which is it, #GP(0) or #GP(sel)? */
-            return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
+            return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
         }
 
@@ -3289 +3289 @@
         if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3296 +3296 @@
         if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSS);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSS);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3306 +3306 @@
         if (enmEffOpSize != IEMMODE_16BIT)
             fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
-        if (pIemCpu->uCpl == 0)
+        if (pVCpu->iem.s.uCpl == 0)
             fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
-        else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
+        else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
             fEFlagsMask |= X86_EFL_IF;
-        if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_386)
+        if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
             fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
-        uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
+        uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
         fEFlagsNew         &= ~fEFlagsMask;
         fEFlagsNew         |= uNewFlags & fEFlagsMask;
 #ifdef DBGFTRACE_ENABLED
-        RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
-                          pIemCpu->uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
+        RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up%u %04x:%08x -> %04x:%04x %x %04x:%04x",
+                          pVCpu->iem.s.uCpl, uNewCs & X86_SEL_RPL, pCtx->cs.Sel, pCtx->eip,
                           uNewCs, uNewEip, uNewFlags,  uNewSS, uNewESP);
 #endif
 
-        IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
+        IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
         pCtx->rip           = uNewEip;
         pCtx->cs.Sel        = uNewCs;
@@ -3329 +3329 @@
         pCtx->cs.u32Limit   = cbLimitCS;
         pCtx->cs.u64Base    = X86DESC_BASE(&DescCS.Legacy);
-        pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
+        pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
         if (!pCtx->ss.Attr.n.u1DefBig)
             pCtx->sp        = (uint16_t)uNewESP;
@@ -3341 +3341 @@
         pCtx->ss.u64Base    = X86DESC_BASE(&DescSS.Legacy);
 
-        pIemCpu->uCpl       = uNewCs & X86_SEL_RPL;
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
+        pVCpu->iem.s.uCpl       = uNewCs & X86_SEL_RPL;
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->ds);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->es);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->fs);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCs & X86_SEL_RPL, &pCtx->gs);
 
         /* Done! */
@@ -3360 +3360 @@
             Log(("iret %04x:%08x - EIP is out of bounds (%#x) -> #GP(0)\n", uNewCs, uNewEip, cbLimitCS));
             /** @todo: Which is it, #GP(0) or #GP(sel)? */
-            return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
+            return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
         }
 
@@ -3368 +3368 @@
         if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
         {
-            rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
+            rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3375 +3375 @@
 
         X86EFLAGS NewEfl;
-        NewEfl.u = IEMMISC_GET_EFL(pIemCpu, pCtx);
+        NewEfl.u = IEMMISC_GET_EFL(pVCpu, pCtx);
         uint32_t fEFlagsMask = X86_EFL_CF | X86_EFL_PF | X86_EFL_AF | X86_EFL_ZF | X86_EFL_SF
                              | X86_EFL_TF | X86_EFL_DF | X86_EFL_OF | X86_EFL_NT;
         if (enmEffOpSize != IEMMODE_16BIT)
             fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
-        if (pIemCpu->uCpl == 0)
+        if (pVCpu->iem.s.uCpl == 0)
             fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is 0 */
-        else if (pIemCpu->uCpl <= NewEfl.Bits.u2IOPL)
+        else if (pVCpu->iem.s.uCpl <= NewEfl.Bits.u2IOPL)
             fEFlagsMask |= X86_EFL_IF;
-        if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_386)
+        if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
             fEFlagsMask &= ~(X86_EFL_AC | X86_EFL_ID | X86_EFL_VIF | X86_EFL_VIP);
         NewEfl.u           &= ~fEFlagsMask;
         NewEfl.u           |= fEFlagsMask & uNewFlags;
 #ifdef DBGFTRACE_ENABLED
-        RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
-                          pIemCpu->uCpl, pCtx->cs.Sel, pCtx->eip,
+        RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%up %04x:%08x -> %04x:%04x %x %04x:%04llx",
+                          pVCpu->iem.s.uCpl, pCtx->cs.Sel, pCtx->eip,
                           uNewCs, uNewEip, uNewFlags, pCtx->ss.Sel, uNewRsp);
 #endif
 
-        IEMMISC_SET_EFL(pIemCpu, pCtx, NewEfl.u);
+        IEMMISC_SET_EFL(pVCpu, pCtx, NewEfl.u);
         pCtx->rip           = uNewEip;
         pCtx->cs.Sel        = uNewCs;
@@ -3402 +3402 @@
         pCtx->cs.u32Limit   = cbLimitCS;
         pCtx->cs.u64Base    = X86DESC_BASE(&DescCS.Legacy);
-        pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
+        pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
         pCtx->rsp           = uNewRsp;
         /* Done! */
@@ -3408 +3408 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -3421 +3421 @@
 IEM_CIMPL_DEF_1(iemCImpl_iret_64bit, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     NOREF(cbInstr);
 
@@ -3430 +3430 @@
     {
         Log(("iretq with NT=1 (eflags=%#x) -> #GP(0)\n", pCtx->eflags.u));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -3448 +3448 @@
     if (enmEffOpSize == IEMMODE_64BIT)
     {
-        rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*8, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, &uFrame.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3459 +3459 @@
     else if (enmEffOpSize == IEMMODE_32BIT)
     {
-        rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*4, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, &uFrame.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3471 +3471 @@
     {
         Assert(enmEffOpSize == IEMMODE_16BIT);
-        rcStrict = iemMemStackPopBeginSpecial(pIemCpu, 5*2, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, &uFrame.pv, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3480 +3480 @@
         uNewSs     = uFrame.pu16[4];
     }
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
+    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -3492 +3492 @@
     {
         Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid CS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
     IEMSELDESC DescCS;
-    rcStrict = iemMemFetchSelDesc(pIemCpu, &DescCS, uNewCs, X86_XCPT_GP);
+    rcStrict = iemMemFetchSelDesc(pVCpu, &DescCS, uNewCs, X86_XCPT_GP);
     if (rcStrict != VINF_SUCCESS)
     {
@@ -3510 +3510 @@
         Log(("iret %04x:%016RX64/%04x:%016RX64 - CS is not a code segment T=%u T=%#xu -> #GP\n",
              uNewCs, uNewRip, uNewSs, uNewRsp, DescCS.Legacy.Gen.u1DescType, DescCS.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
     }
 
@@ -3520 +3520 @@
         {
             Log(("iret %04x:%016RX64 - RPL != DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
         }
     }
@@ -3526 +3526 @@
     {
         Log(("iret %04x:%016RX64 - RPL < DPL (%d) -> #GP\n", uNewCs, uNewRip, DescCS.Legacy.Gen.u2Dpl));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
-    }
-    if ((uNewCs & X86_SEL_RPL) < pIemCpu->uCpl)
-    {
-        Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewCs);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
+    }
+    if ((uNewCs & X86_SEL_RPL) < pVCpu->iem.s.uCpl)
+    {
+        Log(("iret %04x:%016RX64 - RPL < CPL (%d) -> #GP\n", uNewCs, uNewRip, pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewCs);
     }
 
@@ -3538 +3538 @@
     {
         Log(("iret %04x:%016RX64/%04x:%016RX64 - CS not present -> #NP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewCs);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewCs);
     }
 
@@ -3552 +3552 @@
         {
             Log(("iret %04x:%016RX64/%04x:%016RX64 -> invalid SS selector, #GP(0)\n", uNewCs, uNewRip, uNewSs, uNewRsp));
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         }
         DescSS.Legacy.u = 0;
@@ -3558 +3558 @@
     else
     {
-        rcStrict = iemMemFetchSelDesc(pIemCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
+        rcStrict = iemMemFetchSelDesc(pVCpu, &DescSS, uNewSs, X86_XCPT_GP); /** @todo Correct exception? */
         if (rcStrict != VINF_SUCCESS)
         {
@@ -3571 +3571 @@
     {
         Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.RPL != CS.RPL -> #GP\n", uNewCs, uNewRip, uNewSs, uNewRsp));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
     }
 
@@ -3583 +3583 @@
             Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS.DPL (%d) != CS.RPL -> #GP\n",
                  uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u2Dpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
         }
 
@@ -3591 +3591 @@
             Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS is system segment (%#x) -> #GP\n",
                  uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
         }
         if ((DescSS.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_WRITE)) != X86_SEL_TYPE_WRITE)
@@ -3597 +3597 @@
             Log(("iret %04x:%016RX64/%04x:%016RX64 - not writable data segment (%#x) -> #GP\n",
                  uNewCs, uNewRip, uNewSs, uNewRsp, DescSS.Legacy.Gen.u4Type));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewSs);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewSs);
         }
 
@@ -3604 +3604 @@
         {
             Log(("iret %04x:%016RX64/%04x:%016RX64 -> SS not present -> #SS\n", uNewCs, uNewRip, uNewSs, uNewRsp));
-            return iemRaiseStackSelectorNotPresentBySelector(pIemCpu, uNewSs);
+            return iemRaiseStackSelectorNotPresentBySelector(pVCpu, uNewSs);
         }
         cbLimitSs = X86DESC_LIMIT_G(&DescSS.Legacy);
@@ -3616 +3616 @@
             Log(("iret %04x:%016RX64/%04x:%016RX64 -> RIP is not canonical -> #GP(0)\n",
                  uNewCs, uNewRip, uNewSs, uNewRsp));
-            return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
+            return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
         }
     }
@@ -3626 +3626 @@
                  uNewCs, uNewRip, uNewSs, uNewRsp, cbLimitCS));
             /** @todo: Which is it, #GP(0) or #GP(sel)? */
-            return iemRaiseSelectorBoundsBySelector(pIemCpu, uNewCs);
+            return iemRaiseSelectorBoundsBySelector(pVCpu, uNewCs);
         }
     }
@@ -3637 +3637 @@
     if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
     {
-        rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewCs);
+        rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewCs);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3644 +3644 @@
     if (!(DescSS.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
     {
-        rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uNewSs);
+        rcStrict = iemMemMarkSelDescAccessed(pVCpu, uNewSs);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3654 +3654 @@
     if (enmEffOpSize != IEMMODE_16BIT)
         fEFlagsMask |= X86_EFL_RF | X86_EFL_AC | X86_EFL_ID;
-    if (pIemCpu->uCpl == 0)
+    if (pVCpu->iem.s.uCpl == 0)
         fEFlagsMask |= X86_EFL_IF | X86_EFL_IOPL | X86_EFL_VIF | X86_EFL_VIP; /* VM is ignored */
-    else if (pIemCpu->uCpl <= pCtx->eflags.Bits.u2IOPL)
+    else if (pVCpu->iem.s.uCpl <= pCtx->eflags.Bits.u2IOPL)
         fEFlagsMask |= X86_EFL_IF;
-    uint32_t fEFlagsNew = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    uint32_t fEFlagsNew = IEMMISC_GET_EFL(pVCpu, pCtx);
     fEFlagsNew         &= ~fEFlagsMask;
     fEFlagsNew         |= uNewFlags & fEFlagsMask;
 #ifdef DBGFTRACE_ENABLED
-    RTTraceBufAddMsgF(IEMCPU_TO_VM(pIemCpu)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
-                      pIemCpu->uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
+    RTTraceBufAddMsgF(pVCpu->CTX_SUFF(pVM)->CTX_SUFF(hTraceBuf), "iret/%ul%u %08llx -> %04x:%04llx %llx %04x:%04llx",
+                      pVCpu->iem.s.uCpl, uNewCpl, pCtx->rip, uNewCs, uNewRip, uNewFlags, uNewSs, uNewRsp);
 #endif
 
-    IEMMISC_SET_EFL(pIemCpu, pCtx, fEFlagsNew);
+    IEMMISC_SET_EFL(pVCpu, pCtx, fEFlagsNew);
     pCtx->rip           = uNewRip;
     pCtx->cs.Sel        = uNewCs;
@@ -3674 +3674 @@
     pCtx->cs.u32Limit   = cbLimitCS;
     pCtx->cs.u64Base    = X86DESC_BASE(&DescCS.Legacy);
-    pIemCpu->enmCpuMode = iemCalcCpuMode(pCtx);
+    pVCpu->iem.s.enmCpuMode = iemCalcCpuMode(pCtx);
     if (pCtx->cs.Attr.n.u1Long || pCtx->cs.Attr.n.u1DefBig)
         pCtx->rsp       = uNewRsp;
@@ -3698 +3698 @@
     }
 
-    if (pIemCpu->uCpl != uNewCpl)
-    {
-        pIemCpu->uCpl = uNewCpl;
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->ds);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->es);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->fs);
-        iemHlpAdjustSelectorForNewCpl(pIemCpu, uNewCpl, &pCtx->gs);
+    if (pVCpu->iem.s.uCpl != uNewCpl)
+    {
+        pVCpu->iem.s.uCpl = uNewCpl;
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->ds);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->es);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->fs);
+        iemHlpAdjustSelectorForNewCpl(pVCpu, uNewCpl, &pCtx->gs);
     }
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -3724 +3724 @@
      * First, clear NMI blocking, if any, before causing any exceptions.
      */
-    PVMCPU pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
     VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
 
@@ -3730 +3729 @@
      * Call a mode specific worker.
      */
-    if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+    if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
         return IEM_CIMPL_CALL_1(iemCImpl_iret_real_v8086, enmEffOpSize);
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
         return IEM_CIMPL_CALL_1(iemCImpl_iret_64bit, enmEffOpSize);
     return     IEM_CIMPL_CALL_1(iemCImpl_iret_prot, enmEffOpSize);
@@ -3745 +3744 @@
 IEM_CIMPL_DEF_0(iemCImpl_syscall)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -3757 +3756 @@
     {
         Log(("syscall: Not enabled in EFER -> #UD\n"));
-        return iemRaiseUndefinedOpcode(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
     }
     if (!(pCtx->cr0 & X86_CR0_PE))
     {
         Log(("syscall: Protected mode is required -> #GP(0)\n"));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-    }
-    if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+    }
+    if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
     {
         Log(("syscall: Only available in long mode on intel -> #UD\n"));
-        return iemRaiseUndefinedOpcode(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
     }
 
@@ -3777 +3776 @@
     {
         Log(("syscall: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -3783 +3782 @@
     if (CPUMIsGuestInLongModeEx(pCtx))
     {
-        uint64_t uNewRip = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
+        uint64_t uNewRip = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->msrLSTAR : pCtx-> msrCSTAR;
 
         /* This test isn't in the docs, but I'm not trusting the guys writing
@@ -3790 +3789 @@
         {
             Log(("syscall: Only available in long mode on intel -> #UD\n"));
-            return iemRaiseUndefinedOpcode(pIemCpu);
+            return iemRaiseUndefinedOpcode(pVCpu);
         }
 
@@ -3835 +3834 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -3847 +3846 @@
 
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -3859 +3858 @@
     {
         Log(("sysret: Not enabled in EFER -> #UD\n"));
-        return iemRaiseUndefinedOpcode(pIemCpu);
-    }
-    if (IEM_IS_GUEST_CPU_INTEL(pIemCpu) && !CPUMIsGuestInLongModeEx(pCtx))
+        return iemRaiseUndefinedOpcode(pVCpu);
+    }
+    if (IEM_IS_GUEST_CPU_INTEL(pVCpu) && !CPUMIsGuestInLongModeEx(pCtx))
     {
         Log(("sysret: Only available in long mode on intel -> #UD\n"));
-        return iemRaiseUndefinedOpcode(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
     }
     if (!(pCtx->cr0 & X86_CR0_PE))
     {
         Log(("sysret: Protected mode is required -> #GP(0)\n"));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-    }
-    if (pIemCpu->uCpl != 0)
-    {
-        Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+    }
+    if (pVCpu->iem.s.uCpl != 0)
+    {
+        Log(("sysret: CPL must be 0 not %u -> #GP(0)\n", pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -3880 +3879 @@
     uint16_t uNewCs = (pCtx->msrSTAR >> MSR_K6_STAR_SYSRET_CS_SS_SHIFT) & X86_SEL_MASK_OFF_RPL;
     uint16_t uNewSs = uNewCs + 8;
-    if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
         uNewCs += 16;
     if (uNewCs == 0 || uNewSs == 0)
     {
         Log(("sysret: msrSTAR.CS = 0 or SS = 0 -> #GP(0)\n"));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -3893 +3892 @@
     if (CPUMIsGuestInLongModeEx(pCtx))
     {
-        if (pIemCpu->enmEffOpSize == IEMMODE_64BIT)
+        if (pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT)
         {
             Log(("sysret: %04x:%016RX64 [efl=%#llx] -> %04x:%016RX64 [r11=%#llx]\n",
@@ -3939 +3938 @@
 
     /* Flush the prefetch buffer. */
-    pIemCpu->cbOpcode = pIemCpu->offOpcode;
+    pVCpu->iem.s.cbOpcode = pVCpu->iem.s.offOpcode;
 
     return VINF_SUCCESS;
@@ -3953 +3952 @@
 IEM_CIMPL_DEF_2(iemCImpl_LoadSReg, uint8_t, iSegReg, uint16_t, uSel)
 {
-    /*PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);*/
-    uint16_t       *pSel = iemSRegRef(pIemCpu, iSegReg);
-    PCPUMSELREGHID  pHid = iemSRegGetHid(pIemCpu, iSegReg);
+    /*PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);*/
+    uint16_t       *pSel = iemSRegRef(pVCpu, iSegReg);
+    PCPUMSELREGHID  pHid = iemSRegGetHid(pVCpu, iSegReg);
 
     Assert(iSegReg <= X86_SREG_GS && iSegReg != X86_SREG_CS);
@@ -3962 +3961 @@
      * Real mode and V8086 mode are easy.
      */
-    if (   pIemCpu->enmCpuMode == IEMMODE_16BIT
-        && IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+    if (   pVCpu->iem.s.enmCpuMode == IEMMODE_16BIT
+        && IEM_IS_REAL_OR_V86_MODE(pVCpu))
     {
         *pSel           = uSel;
@@ -3981 +3980 @@
                                 : X86_SEL_TYPE_READ | X86_SEL_TYPE_CODE;
 #endif
-        CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
@@ -4001 +4000 @@
                relaxed relationship to SS.RPL than intel does. */
             /** @todo We cannot 'mov ss, 3' in 64-bit kernel mode, can we? There is a testcase (bs-cpu-xcpt-1), but double check this! */
-            if (   pIemCpu->enmCpuMode != IEMMODE_64BIT
-                || pIemCpu->uCpl > 2
-                || (   uSel != pIemCpu->uCpl
-                    && !IEM_IS_GUEST_CPU_AMD(pIemCpu)) )
+            if (   pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
+                || pVCpu->iem.s.uCpl > 2
+                || (   uSel != pVCpu->iem.s.uCpl
+                    && !IEM_IS_GUEST_CPU_AMD(pVCpu)) )
             {
                 Log(("load sreg %#x -> invalid stack selector, #GP(0)\n", uSel));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
         }
 
         *pSel = uSel;   /* Not RPL, remember :-) */
-        iemHlpLoadNullDataSelectorProt(pIemCpu, pHid, uSel);
+        iemHlpLoadNullDataSelectorProt(pVCpu, pHid, uSel);
         if (iSegReg == X86_SREG_SS)
-            pHid->Attr.u |= pIemCpu->uCpl << X86DESCATTR_DPL_SHIFT;
-
-        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
-        CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
-
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+            pHid->Attr.u |= pVCpu->iem.s.uCpl << X86DESCATTR_DPL_SHIFT;
+
+        Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
+        CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
+
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
@@ -4025 +4024 @@
     /* Fetch the descriptor. */
     IEMSELDESC Desc;
-    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
+    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uSel, X86_XCPT_GP); /** @todo Correct exception? */
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -4033 +4032 @@
     {
         Log(("load sreg %d (=%#x) - system selector (%#x) -> #GP\n", iSegReg, uSel, Desc.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
     }
     if (iSegReg == X86_SREG_SS) /* SS gets different treatment */
@@ -4041 +4040 @@
         {
             Log(("load sreg SS, %#x - code or read only (%#x) -> #GP\n", uSel, Desc.Legacy.Gen.u4Type));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
-        }
-        if ((uSel & X86_SEL_RPL) != pIemCpu->uCpl)
-        {
-            Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pIemCpu->uCpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
-        }
-        if (Desc.Legacy.Gen.u2Dpl != pIemCpu->uCpl)
-        {
-            Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pIemCpu->uCpl));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
+        }
+        if ((uSel & X86_SEL_RPL) != pVCpu->iem.s.uCpl)
+        {
+            Log(("load sreg SS, %#x - RPL and CPL (%d) differs -> #GP\n", uSel, pVCpu->iem.s.uCpl));
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
+        }
+        if (Desc.Legacy.Gen.u2Dpl != pVCpu->iem.s.uCpl)
+        {
+            Log(("load sreg SS, %#x - DPL (%d) and CPL (%d) differs -> #GP\n", uSel, Desc.Legacy.Gen.u2Dpl, pVCpu->iem.s.uCpl));
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
     }
@@ -4059 +4058 @@
         {
             Log(("load sreg%u, %#x - execute only segment -> #GP\n", iSegReg, uSel));
-            return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+            return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
         }
         if (   (Desc.Legacy.Gen.u4Type & (X86_SEL_TYPE_CODE | X86_SEL_TYPE_CONF))
@@ -4066 +4065 @@
 #if 0 /* this is what intel says. */
             if (   (uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl
-                && pIemCpu->uCpl        > Desc.Legacy.Gen.u2Dpl)
+                && pVCpu->iem.s.uCpl        > Desc.Legacy.Gen.u2Dpl)
             {
                 Log(("load sreg%u, %#x - both RPL (%d) and CPL (%d) are greater than DPL (%d) -> #GP\n",
-                     iSegReg, uSel, (uSel & X86_SEL_RPL), pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
-                return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+                     iSegReg, uSel, (uSel & X86_SEL_RPL), pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
+                return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
             }
 #else /* this is what makes more sense. */
@@ -4077 +4076 @@
                 Log(("load sreg%u, %#x - RPL (%d) is greater than DPL (%d) -> #GP\n",
                      iSegReg, uSel, (uSel & X86_SEL_RPL), Desc.Legacy.Gen.u2Dpl));
-                return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+                return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
             }
-            if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
+            if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
             {
                 Log(("load sreg%u, %#x - CPL (%d) is greater than DPL (%d) -> #GP\n",
-                     iSegReg, uSel, pIemCpu->uCpl, Desc.Legacy.Gen.u2Dpl));
-                return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uSel);
+                     iSegReg, uSel, pVCpu->iem.s.uCpl, Desc.Legacy.Gen.u2Dpl));
+                return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uSel);
             }
 #endif
@@ -4093 +4092 @@
     {
         Log(("load sreg%d,%#x - segment not present -> #NP\n", iSegReg, uSel));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uSel);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uSel);
     }
 
@@ -4106 +4105 @@
     if (!(Desc.Legacy.Gen.u4Type & X86_SEL_TYPE_ACCESSED))
     {
-        rcStrict = iemMemMarkSelDescAccessed(pIemCpu, uSel);
+        rcStrict = iemMemMarkSelDescAccessed(pVCpu, uSel);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -4122 +4121 @@
     /** @todo check if the hidden bits are loaded correctly for 64-bit
      *        mode.  */
-    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(IEMCPU_TO_VMCPU(pIemCpu), pHid));
-
-    CPUMSetChangedFlags(IEMCPU_TO_VMCPU(pIemCpu), CPUM_CHANGED_HIDDEN_SEL_REGS);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    Assert(CPUMSELREG_ARE_HIDDEN_PARTS_VALID(pVCpu, pHid));
+
+    CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_HIDDEN_SEL_REGS);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -4143 +4142 @@
         if (iSegReg == X86_SREG_SS)
         {
-            PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-            EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
+            PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+            EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
         }
     }
@@ -4159 +4158 @@
 IEM_CIMPL_DEF_2(iemCImpl_pop_Sreg, uint8_t, iSegReg, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     VBOXSTRICTRC    rcStrict;
 
@@ -4172 +4171 @@
         {
             uint16_t uSel;
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &uSel, &TmpRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &uSel, &TmpRsp);
             if (rcStrict == VINF_SUCCESS)
                 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, uSel);
@@ -4181 +4180 @@
         {
             uint32_t u32Value;
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
             if (rcStrict == VINF_SUCCESS)
                 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u32Value);
@@ -4190 +4189 @@
         {
             uint64_t u64Value;
-            rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
+            rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
             if (rcStrict == VINF_SUCCESS)
                 rcStrict = IEM_CIMPL_CALL_2(iemCImpl_LoadSReg, iSegReg, (uint16_t)u64Value);
@@ -4205 +4204 @@
         pCtx->rsp = TmpRsp.u;
         if (iSegReg == X86_SREG_SS)
-            EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
+            EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
     }
     return rcStrict;
@@ -4221 +4220 @@
                 IEMMODE,  enmEffOpSize)
 {
-    /*PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);*/
+    /*PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);*/
     VBOXSTRICTRC    rcStrict;
 
@@ -4235 +4234 @@
         {
             case IEMMODE_16BIT:
-                *(uint16_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
+                *(uint16_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
                 break;
             case IEMMODE_32BIT:
-                *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
+                *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
                 break;
             case IEMMODE_64BIT:
-                *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = offSeg;
+                *(uint64_t *)iemGRegRef(pVCpu, iGReg) = offSeg;
                 break;
             IEM_NOT_REACHED_DEFAULT_CASE_RET();
@@ -4258 +4257 @@
  * @retval iemMemFetchSysU64 return value.
  *
- * @param   pIemCpu             The IEM state of the calling EMT.
+ * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
  * @param   uSel                The selector value.
  * @param   fAllowSysDesc       Whether system descriptors are OK or not.
  * @param   pDesc               Where to return the descriptor on success.
  */
-static VBOXSTRICTRC iemCImpl_LoadDescHelper(PIEMCPU pIemCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
+static VBOXSTRICTRC iemCImpl_LoadDescHelper(PVMCPU pVCpu, uint16_t uSel, bool fAllowSysDesc, PIEMSELDESC pDesc)
 {
     pDesc->Long.au64[0] = 0;
@@ -4272 +4271 @@
 
     /* Within the table limits? */
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTGCPTR GCPtrBase;
     if (uSel & X86_SEL_LDT)
@@ -4289 +4288 @@
 
     /* Fetch the descriptor. */
-    VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
+    VBOXSTRICTRC rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Legacy.u, UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK));
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -4298 +4297 @@
         if (CPUMIsGuestInLongModeEx(pCtx))
         {
-            rcStrict = iemMemFetchSysU64(pIemCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
+            rcStrict = iemMemFetchSysU64(pVCpu, &pDesc->Long.au64[1], UINT8_MAX, GCPtrBase + (uSel & X86_SEL_MASK) + 8);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -4314 +4313 @@
 IEM_CIMPL_DEF_2(iemCImpl_VerX, uint16_t, uSel, bool, fWrite)
 {
-    Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
+    Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
 
     /** @todo figure whether the accessed bit is set or not. */
@@ -4320 +4319 @@
     bool         fAccessible = true;
     IEMSELDESC   Desc;
-    VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /*fAllowSysDesc*/, &Desc);
+    VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
     if (rcStrict == VINF_SUCCESS)
     {
@@ -4340 +4339 @@
                 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
                     fAccessible = false;
-                else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
+                else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
                     fAccessible = false;
             }
@@ -4352 +4351 @@
 
     /* commit */
-    pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fAccessible;
-
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fAccessible;
+
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -4370 +4369 @@
 IEM_CIMPL_DEF_4(iemCImpl_LarLsl_u64, uint64_t *, pu64Dst, uint16_t, uSel, uint32_t *, pEFlags, bool, fIsLar)
 {
-    Assert(!IEM_IS_REAL_OR_V86_MODE(pIemCpu));
+    Assert(!IEM_IS_REAL_OR_V86_MODE(pVCpu));
 
     /** @todo figure whether the accessed bit is set or not. */
@@ -4376 +4375 @@
     bool         fDescOk = true;
     IEMSELDESC   Desc;
-    VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pIemCpu, uSel, false /*fAllowSysDesc*/, &Desc);
+    VBOXSTRICTRC rcStrict = iemCImpl_LoadDescHelper(pVCpu, uSel, false /*fAllowSysDesc*/, &Desc);
     if (rcStrict == VINF_SUCCESS)
     {
@@ -4384 +4383 @@
         if (!Desc.Legacy.Gen.u1DescType)
         {
-            if (CPUMIsGuestInLongModeEx(pIemCpu->CTX_SUFF(pCtx)))
+            if (CPUMIsGuestInLongModeEx(pVCpu->iem.s.CTX_SUFF(pCtx)))
             {
                 if (Desc.Long.Gen.u5Zeros)
@@ -4436 +4435 @@
                 if ((unsigned)(uSel & X86_SEL_RPL) > Desc.Legacy.Gen.u2Dpl)
                     fDescOk = false;
-                else if (pIemCpu->uCpl > Desc.Legacy.Gen.u2Dpl)
+                else if (pVCpu->iem.s.uCpl > Desc.Legacy.Gen.u2Dpl)
                     fDescOk = false;
             }
@@ -4459 +4458 @@
 
     /* commit flags value and advance rip. */
-    pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fDescOk;
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1ZF = fDescOk;
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
 
     return VINF_SUCCESS;
@@ -4493 +4492 @@
 IEM_CIMPL_DEF_3(iemCImpl_lgdt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
 {
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-    Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+    Assert(!pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1VM);
 
     /*
@@ -4502 +4501 @@
     uint16_t cbLimit;
     RTGCPTR  GCPtrBase;
-    VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
+    VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
     if (rcStrict == VINF_SUCCESS)
     {
-        if (   pIemCpu->enmCpuMode != IEMMODE_64BIT
+        if (   pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
             || X86_IS_CANONICAL(GCPtrBase))
         {
-            if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
-                rcStrict = CPUMSetGuestGDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
+            if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
+                rcStrict = CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
             else
             {
-                PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+                PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
                 pCtx->gdtr.cbGdt = cbLimit;
                 pCtx->gdtr.pGdt  = GCPtrBase;
             }
             if (rcStrict == VINF_SUCCESS)
-                iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+                iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         }
         else
         {
             Log(("iemCImpl_lgdt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         }
     }
@@ -4542 +4541 @@
      *       you really must know.
      */
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-    VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->gdtr.cbGdt, pCtx->gdtr.pGdt, iEffSeg, GCPtrEffDst);
     if (rcStrict == VINF_SUCCESS)
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return rcStrict;
 }
@@ -4559 +4558 @@
 IEM_CIMPL_DEF_3(iemCImpl_lidt, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc, IEMMODE, enmEffOpSize)
 {
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-    Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+    Assert(!pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1VM);
 
     /*
@@ -4568 +4567 @@
     uint16_t cbLimit;
     RTGCPTR  GCPtrBase;
-    VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pIemCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
+    VBOXSTRICTRC rcStrict = iemMemFetchDataXdtr(pVCpu, &cbLimit, &GCPtrBase, iEffSeg, GCPtrEffSrc, enmEffOpSize);
     if (rcStrict == VINF_SUCCESS)
     {
-        if (   pIemCpu->enmCpuMode != IEMMODE_64BIT
+        if (   pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
             || X86_IS_CANONICAL(GCPtrBase))
         {
-            if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
-                CPUMSetGuestIDTR(IEMCPU_TO_VMCPU(pIemCpu), GCPtrBase, cbLimit);
+            if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
+                CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
             else
             {
-                PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+                PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
                 pCtx->idtr.cbIdt = cbLimit;
                 pCtx->idtr.pIdt  = GCPtrBase;
             }
-            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         }
         else
         {
             Log(("iemCImpl_lidt: Non-canonical base %04x:%RGv\n", cbLimit, GCPtrBase));
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         }
     }
@@ -4607 +4606 @@
      *       you really must know.
      */
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-    VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pIemCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    VBOXSTRICTRC rcStrict = iemMemStoreDataXdtr(pVCpu, pCtx->idtr.cbIdt, pCtx->idtr.pIdt, iEffSeg, GCPtrEffDst);
     if (rcStrict == VINF_SUCCESS)
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return rcStrict;
 }
@@ -4622 +4621 @@
 IEM_CIMPL_DEF_1(iemCImpl_lldt, uint16_t, uNewLdt)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
      * Check preconditions.
      */
-    if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+    if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
     {
         Log(("lldt %04x - real or v8086 mode -> #GP(0)\n", uNewLdt));
-        return iemRaiseUndefinedOpcode(pIemCpu);
-    }
-    if (pIemCpu->uCpl != 0)
-    {
-        Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
+    }
+    if (pVCpu->iem.s.uCpl != 0)
+    {
+        Log(("lldt %04x - CPL is %d -> #GP(0)\n", uNewLdt, pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
     if (uNewLdt & X86_SEL_LDT)
     {
         Log(("lldt %04x - LDT selector -> #GP\n", uNewLdt));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewLdt);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewLdt);
     }
 
@@ -4649 +4648 @@
     {
         Log(("lldt %04x: Loading NULL selector.\n",  uNewLdt));
-        if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
-            CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt);
+        if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
+            CPUMSetGuestLDTR(pVCpu, uNewLdt);
         else
             pCtx->ldtr.Sel = uNewLdt;
         pCtx->ldtr.ValidSel = uNewLdt;
         pCtx->ldtr.fFlags   = CPUMSELREG_FLAGS_VALID;
-        if (IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+        if (IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
         {
             pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
             pCtx->ldtr.u64Base = pCtx->ldtr.u32Limit = 0; /* For verfication against REM. */
         }
-        else if (IEM_IS_GUEST_CPU_AMD(pIemCpu))
+        else if (IEM_IS_GUEST_CPU_AMD(pVCpu))
         {
             /* AMD-V seems to leave the base and limit alone. */
             pCtx->ldtr.Attr.u = X86DESCATTR_UNUSABLE;
         }
-        else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
+        else if (!IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
         {
             /* VT-x (Intel 3960x) seems to be doing the following. */
@@ -4673 +4672 @@
         }
 
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
@@ -4681 +4680 @@
      */
     IEMSELDESC Desc;
-    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
+    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewLdt, X86_XCPT_GP); /** @todo Correct exception? */
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -4689 +4688 @@
     {
         Log(("lldt %#x - not system selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
     }
     if (Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_LDT)
     {
         Log(("lldt %#x - not LDT selector (type %x) -> #GP\n", uNewLdt, Desc.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
     }
     uint64_t u64Base;
-    if (!IEM_IS_LONG_MODE(pIemCpu))
+    if (!IEM_IS_LONG_MODE(pVCpu))
         u64Base = X86DESC_BASE(&Desc.Legacy);
     else
@@ -4704 +4703 @@
         {
             Log(("lldt %#x - u5Zeros=%#x -> #GP\n", uNewLdt, Desc.Long.Gen.u5Zeros));
-            return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -4711 +4710 @@
         {
             Log(("lldt %#x - non-canonical base address %#llx -> #GP\n", uNewLdt, u64Base));
-            return iemRaiseGeneralProtectionFault(pIemCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseGeneralProtectionFault(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
         }
     }
@@ -4719 +4718 @@
     {
         Log(("lldt %#x - segment not present -> #NP\n", uNewLdt));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewLdt);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewLdt);
     }
 
@@ -4726 +4725 @@
      */
 /** @todo check if the actual value is loaded or if the RPL is dropped */
-    if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
-        CPUMSetGuestLDTR(IEMCPU_TO_VMCPU(pIemCpu), uNewLdt & X86_SEL_MASK_OFF_RPL);
+    if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
+        CPUMSetGuestLDTR(pVCpu, uNewLdt & X86_SEL_MASK_OFF_RPL);
     else
         pCtx->ldtr.Sel  = uNewLdt & X86_SEL_MASK_OFF_RPL;
@@ -4736 +4735 @@
     pCtx->ldtr.u64Base  = u64Base;
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -4748 +4747 @@
 IEM_CIMPL_DEF_1(iemCImpl_ltr, uint16_t, uNewTr)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
      * Check preconditions.
      */
-    if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+    if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
     {
         Log(("ltr %04x - real or v8086 mode -> #GP(0)\n", uNewTr));
-        return iemRaiseUndefinedOpcode(pIemCpu);
-    }
-    if (pIemCpu->uCpl != 0)
-    {
-        Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
+    }
+    if (pVCpu->iem.s.uCpl != 0)
+    {
+        Log(("ltr %04x - CPL is %d -> #GP(0)\n", uNewTr, pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
     if (uNewTr & X86_SEL_LDT)
     {
         Log(("ltr %04x - LDT selector -> #GP\n", uNewTr));
-        return iemRaiseGeneralProtectionFaultBySelector(pIemCpu, uNewTr);
+        return iemRaiseGeneralProtectionFaultBySelector(pVCpu, uNewTr);
     }
     if (!(uNewTr & X86_SEL_MASK_OFF_RPL))
     {
         Log(("ltr %04x - NULL selector -> #GP(0)\n", uNewTr));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -4778 +4777 @@
      */
     IEMSELDESC Desc;
-    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pIemCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
+    VBOXSTRICTRC rcStrict = iemMemFetchSelDesc(pVCpu, &Desc, uNewTr, X86_XCPT_GP); /** @todo Correct exception? */
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -4786 +4785 @@
     {
         Log(("ltr %#x - not system selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
     }
     if (   Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_386_TSS_AVAIL /* same as AMD64_SEL_TYPE_SYS_TSS_AVAIL */
         && (   Desc.Legacy.Gen.u4Type != X86_SEL_TYPE_SYS_286_TSS_AVAIL
-            || IEM_IS_LONG_MODE(pIemCpu)) )
+            || IEM_IS_LONG_MODE(pVCpu)) )
     {
         Log(("ltr %#x - not an available TSS selector (type %x) -> #GP\n", uNewTr, Desc.Legacy.Gen.u4Type));
-        return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
+        return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
     }
     uint64_t u64Base;
-    if (!IEM_IS_LONG_MODE(pIemCpu))
+    if (!IEM_IS_LONG_MODE(pVCpu))
         u64Base = X86DESC_BASE(&Desc.Legacy);
     else
@@ -4803 +4802 @@
         {
             Log(("ltr %#x - u5Zeros=%#x -> #GP\n", uNewTr, Desc.Long.Gen.u5Zeros));
-            return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
         }
 
@@ -4810 +4809 @@
         {
             Log(("ltr %#x - non-canonical base address %#llx -> #GP\n", uNewTr, u64Base));
-            return iemRaiseGeneralProtectionFault(pIemCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
+            return iemRaiseGeneralProtectionFault(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
         }
     }
@@ -4818 +4817 @@
     {
         Log(("ltr %#x - segment not present -> #NP\n", uNewTr));
-        return iemRaiseSelectorNotPresentBySelector(pIemCpu, uNewTr);
+        return iemRaiseSelectorNotPresentBySelector(pVCpu, uNewTr);
     }
 
@@ -4828 +4827 @@
      */
     void *pvDesc;
-    rcStrict = iemMemMap(pIemCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
+    rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pCtx->gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -4838 +4837 @@
         case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 -  8); break;
     }
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, pvDesc, IEM_ACCESS_DATA_RW);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -4847 +4846 @@
      */
 /** @todo check if the actual value is loaded or if the RPL is dropped */
-    if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
-        CPUMSetGuestTR(IEMCPU_TO_VMCPU(pIemCpu), uNewTr & X86_SEL_MASK_OFF_RPL);
+    if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
+        CPUMSetGuestTR(pVCpu, uNewTr & X86_SEL_MASK_OFF_RPL);
     else
         pCtx->tr.Sel  = uNewTr & X86_SEL_MASK_OFF_RPL;
@@ -4857 +4856 @@
     pCtx->tr.u64Base  = u64Base;
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -4870 +4869 @@
 IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Cd, uint8_t, iGReg, uint8_t, iCrReg)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     Assert(!pCtx->eflags.Bits.u1VM);
 
@@ -4881 +4880 @@
         case 0:
             crX = pCtx->cr0;
-            if (IEM_GET_TARGET_CPU(pIemCpu) <= IEMTARGETCPU_386)
+            if (IEM_GET_TARGET_CPU(pVCpu) <= IEMTARGETCPU_386)
                 crX |= UINT32_C(0x7fffffe0); /* All reserved CR0 flags are set on a 386, just like MSW on 286. */
             break;
@@ -4890 +4889 @@
         {
             uint8_t uTpr;
-            int rc = PDMApicGetTPR(IEMCPU_TO_VMCPU(pIemCpu), &uTpr, NULL, NULL);
+            int rc = PDMApicGetTPR(pVCpu, &uTpr, NULL, NULL);
             if (RT_SUCCESS(rc))
                 crX = uTpr >> 4;
@@ -4901 +4900 @@
 
     /* store it */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-        *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = crX;
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+        *(uint64_t *)iemGRegRef(pVCpu, iGReg) = crX;
     else
-        *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)crX;
-
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)crX;
+
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -4919 +4918 @@
 IEM_CIMPL_DEF_2(iemCImpl_load_CrX, uint8_t, iCrReg, uint64_t, uNewCrX)
 {
-    PCPUMCTX        pCtx  = pIemCpu->CTX_SUFF(pCtx);
-    PVMCPU          pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
+    PCPUMCTX        pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
     VBOXSTRICTRC    rcStrict;
     int             rc;
@@ -4941 +4939 @@
 
             /* ET is hardcoded on 486 and later. */
-            if (IEM_GET_TARGET_CPU(pIemCpu) > IEMTARGETCPU_486)
+            if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_486)
                 uNewCrX |= X86_CR0_ET;
             /* The 386 and 486 didn't #GP(0) on attempting to set reserved CR0 bits. ET was settable on 386. */
-            else if (IEM_GET_TARGET_CPU(pIemCpu) == IEMTARGETCPU_486)
+            else if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_486)
             {
                 uNewCrX &= fValid;
@@ -4956 +4954 @@
             {
                 Log(("Trying to set reserved CR0 bits: NewCR0=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
 
@@ -4964 +4962 @@
             {
                 Log(("Trying to set CR0.PG without CR0.PE\n"));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
 
@@ -4971 +4969 @@
             {
                 Log(("Trying to clear CR0.CD while leaving CR0.NW set\n"));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
 
@@ -4982 +4980 @@
                 {
                     Log(("Trying to enabled long mode paging without CR4.PAE set\n"));
-                    return iemRaiseGeneralProtectionFault0(pIemCpu);
+                    return iemRaiseGeneralProtectionFault0(pVCpu);
                 }
                 if (pCtx->cs.Attr.n.u1Long)
                 {
                     Log(("Trying to enabled long mode paging with a long CS descriptor loaded.\n"));
-                    return iemRaiseGeneralProtectionFault0(pIemCpu);
+                    return iemRaiseGeneralProtectionFault0(pVCpu);
                 }
             }
@@ -4996 +4994 @@
              * Change CR0.
              */
-            if (!IEM_VERIFICATION_ENABLED(pIemCpu))
+            if (!IEM_VERIFICATION_ENABLED(pVCpu))
                 CPUMSetGuestCR0(pVCpu, uNewCrX);
             else
@@ -5014 +5012 @@
                     NewEFER &= ~MSR_K6_EFER_LMA;
 
-                if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
+                if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
                     CPUMSetGuestEFER(pVCpu, NewEFER);
                 else
@@ -5024 +5022 @@
              * Inform PGM.
              */
-            if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
+            if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
             {
                 if (    (uNewCrX & (X86_CR0_PG | X86_CR0_WP | X86_CR0_PE))
@@ -5071 +5069 @@
             {
                 Log(("Trying to load CR3 with invalid high bits set: %#llx\n", uNewCrX));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
 
@@ -5091 +5089 @@
 
             /* Make the change. */
-            if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
+            if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
             {
                 rc = CPUMSetGuestCR3(pVCpu, uNewCrX);
@@ -5100 +5098 @@
 
             /* Inform PGM. */
-            if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
+            if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
             {
                 if (pCtx->cr0 & X86_CR0_PG)
@@ -5133 +5131 @@
             //if (xxx)
             //    fValid |= X86_CR4_VMXE;
-            if (IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fXSaveRstor)
+            if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
                 fValid |= X86_CR4_OSXSAVE;
             if (uNewCrX & ~(uint64_t)fValid)
             {
                 Log(("Trying to set reserved CR4 bits: NewCR4=%#llx InvalidBits=%#llx\n", uNewCrX, uNewCrX & ~(uint64_t)fValid));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
 
@@ -5147 +5145 @@
             {
                 Log(("Trying to set clear CR4.PAE while long mode is active\n"));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
 
@@ -5154 +5152 @@
              * Change it.
              */
-            if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
+            if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
             {
                 rc = CPUMSetGuestCR4(pVCpu, uNewCrX);
@@ -5166 +5164 @@
              * Notify SELM and PGM.
              */
-            if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
+            if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
             {
                 /* SELM - VME may change things wrt to the TSS shadowing. */
@@ -5174 +5172 @@
                          RT_BOOL(uOldCrX & X86_CR4_VME), RT_BOOL(uNewCrX & X86_CR4_VME) ));
 #ifdef VBOX_WITH_RAW_MODE
-                    if (!HMIsEnabled(IEMCPU_TO_VM(pIemCpu)))
+                    if (!HMIsEnabled(pVCpu->CTX_SUFF(pVM)))
                         VMCPU_FF_SET(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
 #endif
@@ -5200 +5198 @@
             {
                 Log(("Trying to set reserved CR8 bits (%#RX64)\n", uNewCrX));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
 
-            if (!IEM_FULL_VERIFICATION_ENABLED(pIemCpu))
-                PDMApicSetTPR(IEMCPU_TO_VMCPU(pIemCpu), (uint8_t)uNewCrX << 4);
+            if (!IEM_FULL_VERIFICATION_ENABLED(pVCpu))
+                PDMApicSetTPR(pVCpu, (uint8_t)uNewCrX << 4);
             rcStrict = VINF_SUCCESS;
             break;
@@ -5217 +5215 @@
     {
         if (rcStrict != VINF_SUCCESS)
-            rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+            rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     }
 
@@ -5233 +5231 @@
 IEM_CIMPL_DEF_2(iemCImpl_mov_Cd_Rd, uint8_t, iCrReg, uint8_t, iGReg)
 {
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-    Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+    Assert(!pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1VM);
 
     /*
@@ -5241 +5239 @@
      */
     uint64_t uNewCrX;
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-        uNewCrX = iemGRegFetchU64(pIemCpu, iGReg);
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+        uNewCrX = iemGRegFetchU64(pVCpu, iGReg);
     else
-        uNewCrX = iemGRegFetchU32(pIemCpu, iGReg);
+        uNewCrX = iemGRegFetchU32(pVCpu, iGReg);
     return IEM_CIMPL_CALL_2(iemCImpl_load_CrX, iCrReg, uNewCrX);
 }
@@ -5256 +5254 @@
 IEM_CIMPL_DEF_1(iemCImpl_lmsw, uint16_t, u16NewMsw)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     Assert(!pCtx->eflags.Bits.u1VM);
 
@@ -5276 +5274 @@
 IEM_CIMPL_DEF_0(iemCImpl_clts)
 {
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint64_t uNewCr0 = pCtx->cr0;
     uNewCr0 &= ~X86_CR0_TS;
@@ -5294 +5292 @@
 IEM_CIMPL_DEF_2(iemCImpl_mov_Rd_Dd, uint8_t, iGReg, uint8_t, iDrReg)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -5301 +5299 @@
 
     /* Raise GPs. */
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     Assert(!pCtx->eflags.Bits.u1VM);
 
@@ -5309 +5307 @@
     {
         Log(("mov r%u,dr%u: CR4.DE=1 -> #GP(0)\n", iGReg, iDrReg));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -5316 +5314 @@
     {
         Log(("mov r%u,dr%u: DR7.GD=1 -> #DB\n", iGReg, iDrReg));
-        return iemRaiseDebugException(pIemCpu);
+        return iemRaiseDebugException(pVCpu);
     }
 
@@ -5344 +5342 @@
     }
 
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-        *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = drX;
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+        *(uint64_t *)iemGRegRef(pVCpu, iGReg) = drX;
     else
-        *(uint64_t *)iemGRegRef(pIemCpu, iGReg) = (uint32_t)drX;
-
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        *(uint64_t *)iemGRegRef(pVCpu, iGReg) = (uint32_t)drX;
+
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -5362 +5360 @@
 IEM_CIMPL_DEF_2(iemCImpl_mov_Dd_Rd, uint8_t, iDrReg, uint8_t, iGReg)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
      * Check preconditions.
      */
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     Assert(!pCtx->eflags.Bits.u1VM);
 
@@ -5376 +5374 @@
         {
             Log(("mov dr%u,r%u: CR4.DE=1 -> #GP(0)\n", iDrReg, iGReg));
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         }
         iDrReg += 2;
@@ -5387 +5385 @@
     {
         Log(("mov dr%u,r%u: DR7.GD=1 -> #DB\n", iDrReg, iGReg));
-        return iemRaiseDebugException(pIemCpu);
+        return iemRaiseDebugException(pVCpu);
     }
 
@@ -5394 +5392 @@
      */
     uint64_t uNewDrX;
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-        uNewDrX = iemGRegFetchU64(pIemCpu, iGReg);
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+        uNewDrX = iemGRegFetchU64(pVCpu, iGReg);
     else
-        uNewDrX = iemGRegFetchU32(pIemCpu, iGReg);
+        uNewDrX = iemGRegFetchU32(pVCpu, iGReg);
 
     /*
@@ -5415 +5413 @@
             {
                 Log(("mov dr%u,%#llx: DR6 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
             uNewDrX |= X86_DR6_RA1_MASK;
@@ -5425 +5423 @@
             {
                 Log(("mov dr%u,%#llx: DR7 high bits are not zero -> #GP(0)\n", iDrReg, uNewDrX));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
             }
             uNewDrX |= X86_DR7_RA1_MASK;
@@ -5437 +5435 @@
      * Do the actual setting.
      */
-    if (!IEM_VERIFICATION_ENABLED(pIemCpu))
-    {
-        int rc = CPUMSetGuestDRx(IEMCPU_TO_VMCPU(pIemCpu), iDrReg, uNewDrX);
+    if (!IEM_VERIFICATION_ENABLED(pVCpu))
+    {
+        int rc = CPUMSetGuestDRx(pVCpu, iDrReg, uNewDrX);
         AssertRCSuccessReturn(rc, RT_SUCCESS_NP(rc) ? VERR_IEM_IPE_1 : rc);
     }
@@ -5445 +5443 @@
         pCtx->dr[iDrReg] = uNewDrX;
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -5459 +5457 @@
 {
     /* ring-0 only. */
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-    Assert(!pIemCpu->CTX_SUFF(pCtx)->eflags.Bits.u1VM);
-
-    int rc = PGMInvalidatePage(IEMCPU_TO_VMCPU(pIemCpu), GCPtrPage);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+    Assert(!pVCpu->iem.s.CTX_SUFF(pCtx)->eflags.Bits.u1VM);
+
+    int rc = PGMInvalidatePage(pVCpu, GCPtrPage);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
 
     if (rc == VINF_SUCCESS)
         return VINF_SUCCESS;
     if (rc == VINF_PGM_SYNC_CR3)
-        return iemSetPassUpStatus(pIemCpu, rc);
+        return iemSetPassUpStatus(pVCpu, rc);
 
     AssertMsg(rc == VINF_EM_RAW_EMULATE_INSTR || RT_FAILURE_NP(rc), ("%Rrc\n", rc));
@@ -5482 +5480 @@
 IEM_CIMPL_DEF_0(iemCImpl_rdtsc)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
      * Check preconditions.
      */
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fTsc)
-        return iemRaiseUndefinedOpcode(pIemCpu);
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fTsc)
+        return iemRaiseUndefinedOpcode(pVCpu);
 
     if (   (pCtx->cr4 & X86_CR4_TSD)
-        && pIemCpu->uCpl != 0)
-    {
-        Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        && pVCpu->iem.s.uCpl != 0)
+    {
+        Log(("rdtsc: CR4.TSD and CPL=%u -> #GP(0)\n", pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -5500 +5498 @@
      * Do the job.
      */
-    uint64_t uTicks = TMCpuTickGet(IEMCPU_TO_VMCPU(pIemCpu));
+    uint64_t uTicks = TMCpuTickGet(pVCpu);
     pCtx->rax = (uint32_t)uTicks;
     pCtx->rdx = uTicks >> 32;
 #ifdef IEM_VERIFICATION_MODE_FULL
-    pIemCpu->fIgnoreRaxRdx = true;
+    pVCpu->iem.s.fIgnoreRaxRdx = true;
 #endif
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -5517 +5515 @@
 IEM_CIMPL_DEF_0(iemCImpl_rdmsr)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
      * Check preconditions.
      */
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMsr)
-        return iemRaiseUndefinedOpcode(pIemCpu);
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
+        return iemRaiseUndefinedOpcode(pVCpu);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
 
     /*
@@ -5531 +5529 @@
      */
     RTUINT64U uValue;
-    VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, &uValue.u);
+    VBOXSTRICTRC rcStrict = CPUMQueryGuestMsr(pVCpu, pCtx->ecx, &uValue.u);
     if (rcStrict == VINF_SUCCESS)
     {
@@ -5537 +5535 @@
         pCtx->rdx = uValue.s.Hi;
 
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
@@ -5557 +5555 @@
         Log(("IEM: rdmsr(%#x) -> #GP(0)\n", pCtx->ecx));
     AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
-    return iemRaiseGeneralProtectionFault0(pIemCpu);
+    return iemRaiseGeneralProtectionFault0(pVCpu);
 }
 
@@ -5566 +5564 @@
 IEM_CIMPL_DEF_0(iemCImpl_wrmsr)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
      * Check preconditions.
      */
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMsr)
-        return iemRaiseUndefinedOpcode(pIemCpu);
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMsr)
+        return iemRaiseUndefinedOpcode(pVCpu);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
 
     /*
@@ -5584 +5582 @@
 
     VBOXSTRICTRC rcStrict;
-    if (!IEM_VERIFICATION_ENABLED(pIemCpu))
-        rcStrict = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
+    if (!IEM_VERIFICATION_ENABLED(pVCpu))
+        rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
     else
     {
 #ifdef IN_RING3
         CPUMCTX CtxTmp = *pCtx;
-        rcStrict = CPUMSetGuestMsr(IEMCPU_TO_VMCPU(pIemCpu), pCtx->ecx, uValue.u);
-        PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(IEMCPU_TO_VMCPU(pIemCpu));
+        rcStrict = CPUMSetGuestMsr(pVCpu, pCtx->ecx, uValue.u);
+        PCPUMCTX pCtx2 = CPUMQueryGuestCtxPtr(pVCpu);
         *pCtx = *pCtx2;
         *pCtx2 = CtxTmp;
@@ -5600 +5598 @@
     if (rcStrict == VINF_SUCCESS)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
@@ -5620 +5618 @@
         Log(("IEM: wrmsr(%#x,%#x`%08x) -> #GP(0)\n", pCtx->ecx, uValue.s.Hi, uValue.s.Lo));
     AssertMsgReturn(rcStrict == VERR_CPUM_RAISE_GP_0, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), VERR_IPE_UNEXPECTED_STATUS);
-    return iemRaiseGeneralProtectionFault0(pIemCpu);
+    return iemRaiseGeneralProtectionFault0(pVCpu);
 }
 
@@ -5632 +5630 @@
 IEM_CIMPL_DEF_2(iemCImpl_in, uint16_t, u16Port, uint8_t, cbReg)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
      * CPL check
      */
-    VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
+    VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -5645 +5643 @@
      */
     uint32_t u32Value;
-    if (!IEM_VERIFICATION_ENABLED(pIemCpu))
-        rcStrict = IOMIOPortRead(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, &u32Value, cbReg);
+    if (!IEM_VERIFICATION_ENABLED(pVCpu))
+        rcStrict = IOMIOPortRead(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, &u32Value, cbReg);
     else
-        rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, cbReg);
+        rcStrict = iemVerifyFakeIOPortRead(pVCpu, u16Port, &u32Value, cbReg);
     if (IOM_SUCCESS(rcStrict))
     {
@@ -5658 +5656 @@
             default: AssertFailedReturn(VERR_IEM_IPE_3);
         }
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
-        pIemCpu->cPotentialExits++;
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
+        pVCpu->iem.s.cPotentialExits++;
         if (rcStrict != VINF_SUCCESS)
-            rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+            rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
         Assert(rcStrict == VINF_SUCCESS); /* assumed below */
 
@@ -5671 +5669 @@
                             && X86_DR7_ANY_RW_IO(uDr7)
                             && (pCtx->cr4 & X86_CR4_DE))
-                        || DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
-        {
-            rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
+                        || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
+        {
+            rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
             if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
-                rcStrict = iemRaiseDebugException(pIemCpu);
+                rcStrict = iemRaiseDebugException(pVCpu);
         }
     }
@@ -5690 +5688 @@
 IEM_CIMPL_DEF_1(iemCImpl_in_eAX_DX, uint8_t, cbReg)
 {
-    return IEM_CIMPL_CALL_2(iemCImpl_in, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
+    return IEM_CIMPL_CALL_2(iemCImpl_in, pVCpu->iem.s.CTX_SUFF(pCtx)->dx, cbReg);
 }
 
@@ -5702 +5700 @@
 IEM_CIMPL_DEF_2(iemCImpl_out, uint16_t, u16Port, uint8_t, cbReg)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
      * CPL check
      */
-    VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, cbReg);
+    VBOXSTRICTRC rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, cbReg);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -5722 +5720 @@
         default: AssertFailedReturn(VERR_IEM_IPE_4);
     }
-    if (!IEM_VERIFICATION_ENABLED(pIemCpu))
-        rcStrict = IOMIOPortWrite(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), u16Port, u32Value, cbReg);
+    if (!IEM_VERIFICATION_ENABLED(pVCpu))
+        rcStrict = IOMIOPortWrite(pVCpu->CTX_SUFF(pVM), pVCpu, u16Port, u32Value, cbReg);
     else
-        rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, u32Value, cbReg);
+        rcStrict = iemVerifyFakeIOPortWrite(pVCpu, u16Port, u32Value, cbReg);
     if (IOM_SUCCESS(rcStrict))
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
-        pIemCpu->cPotentialExits++;
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
+        pVCpu->iem.s.cPotentialExits++;
         if (rcStrict != VINF_SUCCESS)
-            rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+            rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
         Assert(rcStrict == VINF_SUCCESS); /* assumed below */
 
@@ -5741 +5739 @@
                             && X86_DR7_ANY_RW_IO(uDr7)
                             && (pCtx->cr4 & X86_CR4_DE))
-                        || DBGFBpIsHwIoArmed(IEMCPU_TO_VM(pIemCpu))))
-        {
-            rcStrict = DBGFBpCheckIo(IEMCPU_TO_VM(pIemCpu), IEMCPU_TO_VMCPU(pIemCpu), pCtx, u16Port, cbReg);
+                        || DBGFBpIsHwIoArmed(pVCpu->CTX_SUFF(pVM))))
+        {
+            rcStrict = DBGFBpCheckIo(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx, u16Port, cbReg);
             if (rcStrict == VINF_EM_RAW_GUEST_TRAP)
-                rcStrict = iemRaiseDebugException(pIemCpu);
+                rcStrict = iemRaiseDebugException(pVCpu);
         }
     }
@@ -5759 +5757 @@
 IEM_CIMPL_DEF_1(iemCImpl_out_DX_eAX, uint8_t, cbReg)
 {
-    return IEM_CIMPL_CALL_2(iemCImpl_out, pIemCpu->CTX_SUFF(pCtx)->dx, cbReg);
+    return IEM_CIMPL_CALL_2(iemCImpl_out, pVCpu->iem.s.CTX_SUFF(pCtx)->dx, cbReg);
 }
 
@@ -5768 +5766 @@
 IEM_CIMPL_DEF_0(iemCImpl_cli)
 {
-    PCPUMCTX        pCtx    = pIemCpu->CTX_SUFF(pCtx);
-    uint32_t        fEfl    = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    PCPUMCTX        pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
+    uint32_t        fEfl    = IEMMISC_GET_EFL(pVCpu, pCtx);
     uint32_t const  fEflOld = fEfl;
     if (pCtx->cr0 & X86_CR0_PE)
@@ -5776 +5774 @@
         if (!(fEfl & X86_EFL_VM))
         {
-            if (pIemCpu->uCpl <= uIopl)
+            if (pVCpu->iem.s.uCpl <= uIopl)
                 fEfl &= ~X86_EFL_IF;
-            else if (   pIemCpu->uCpl == 3
+            else if (   pVCpu->iem.s.uCpl == 3
                      && (pCtx->cr4 & X86_CR4_PVI) )
                 fEfl &= ~X86_EFL_VIF;
             else
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
         }
         /* V8086 */
@@ -5791 +5789 @@
             fEfl &= ~X86_EFL_VIF;
         else
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
     }
     /* real mode */
@@ -5798 +5796 @@
 
     /* Commit. */
-    IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     Log2(("CLI: %#x -> %#x\n", fEflOld, fEfl)); NOREF(fEflOld);
     return VINF_SUCCESS;
@@ -5810 +5808 @@
 IEM_CIMPL_DEF_0(iemCImpl_sti)
 {
-    PCPUMCTX        pCtx    = pIemCpu->CTX_SUFF(pCtx);
-    uint32_t        fEfl    = IEMMISC_GET_EFL(pIemCpu, pCtx);
+    PCPUMCTX        pCtx    = pVCpu->iem.s.CTX_SUFF(pCtx);
+    uint32_t        fEfl    = IEMMISC_GET_EFL(pVCpu, pCtx);
     uint32_t const  fEflOld = fEfl;
 
@@ -5819 +5817 @@
         if (!(fEfl & X86_EFL_VM))
         {
-            if (pIemCpu->uCpl <= uIopl)
+            if (pVCpu->iem.s.uCpl <= uIopl)
                 fEfl |= X86_EFL_IF;
-            else if (   pIemCpu->uCpl == 3
+            else if (   pVCpu->iem.s.uCpl == 3
                      && (pCtx->cr4 & X86_CR4_PVI)
                      && !(fEfl & X86_EFL_VIP) )
                 fEfl |= X86_EFL_VIF;
             else
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
         }
         /* V8086 */
@@ -5836 +5834 @@
             fEfl |= X86_EFL_VIF;
         else
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
     }
     /* real mode */
@@ -5843 +5841 @@
 
     /* Commit. */
-    IEMMISC_SET_EFL(pIemCpu, pCtx, fEfl);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
-    if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pIemCpu))
-        EMSetInhibitInterruptsPC(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rip);
+    IEMMISC_SET_EFL(pVCpu, pCtx, fEfl);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
+    if ((!(fEflOld & X86_EFL_IF) && (fEfl & X86_EFL_IF)) || IEM_FULL_VERIFICATION_REM_ENABLED(pVCpu))
+        EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
     Log2(("STI: %#x -> %#x\n", fEflOld, fEfl));
     return VINF_SUCCESS;
@@ -5857 +5855 @@
 IEM_CIMPL_DEF_0(iemCImpl_hlt)
 {
-    if (pIemCpu->uCpl != 0)
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    if (pVCpu->iem.s.uCpl != 0)
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_EM_HALT;
 }
@@ -5872 +5870 @@
      * Permission checks.
      */
-    if (pIemCpu->uCpl != 0)
+    if (pVCpu->iem.s.uCpl != 0)
     {
         Log2(("monitor: CPL != 0\n"));
-        return iemRaiseUndefinedOpcode(pIemCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
-    }
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMonitorMWait)
+        return iemRaiseUndefinedOpcode(pVCpu); /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. */
+    }
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
     {
         Log2(("monitor: Not in CPUID\n"));
-        return iemRaiseUndefinedOpcode(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
     }
 
@@ -5886 +5884 @@
      * Gather the operands and validate them.
      */
-    PCPUMCTX pCtx       = pIemCpu->CTX_SUFF(pCtx);
-    RTGCPTR  GCPtrMem   = pIemCpu->enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
+    PCPUMCTX pCtx       = pVCpu->iem.s.CTX_SUFF(pCtx);
+    RTGCPTR  GCPtrMem   = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT ? pCtx->rax : pCtx->eax;
     uint32_t uEcx       = pCtx->ecx;
     uint32_t uEdx       = pCtx->edx;
@@ -5895 +5893 @@
     {
         Log2(("monitor rax=%RX64, ecx=%RX32, edx=%RX32; ECX != 0 -> #GP(0)\n", GCPtrMem, uEcx, uEdx)); NOREF(uEdx);
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
-    }
-
-    VBOXSTRICTRC rcStrict = iemMemApplySegment(pIemCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
+    }
+
+    VBOXSTRICTRC rcStrict = iemMemApplySegment(pVCpu, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, iEffSeg, 1, &GCPtrMem);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
     RTGCPHYS GCPhysMem;
-    rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
+    rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, GCPtrMem, IEM_ACCESS_TYPE_READ | IEM_ACCESS_WHAT_DATA, &GCPhysMem);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -5910 +5908 @@
      * Call EM to prepare the monitor/wait.
      */
-    rcStrict = EMMonitorWaitPrepare(IEMCPU_TO_VMCPU(pIemCpu), pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
+    rcStrict = EMMonitorWaitPrepare(pVCpu, pCtx->rax, pCtx->rcx, pCtx->rdx, GCPhysMem);
     Assert(rcStrict == VINF_SUCCESS);
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return rcStrict;
 }
@@ -5926 +5924 @@
      * Permission checks.
      */
-    if (pIemCpu->uCpl != 0)
+    if (pVCpu->iem.s.uCpl != 0)
     {
         Log2(("mwait: CPL != 0\n"));
         /** @todo MSR[0xC0010015].MonMwaitUserEn if we care. (Remember to check
          *        EFLAGS.VM then.) */
-        return iemRaiseUndefinedOpcode(pIemCpu);
-    }
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMonitorMWait)
+        return iemRaiseUndefinedOpcode(pVCpu);
+    }
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMonitorMWait)
     {
         Log2(("mwait: Not in CPUID\n"));
-        return iemRaiseUndefinedOpcode(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
     }
 
@@ -5942 +5940 @@
      * Gather the operands and validate them.
      */
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint32_t uEax = pCtx->eax;
     uint32_t uEcx = pCtx->ecx;
@@ -5951 +5949 @@
         {
             Log2(("mwait eax=%RX32, ecx=%RX32; ECX > 1 -> #GP(0)\n", uEax, uEcx));
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         }
         uint32_t fMWaitFeatures = 0;
         uint32_t uIgnore = 0;
-        CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
+        CPUMGetGuestCpuId(pVCpu, 5, 0, &uIgnore, &uIgnore, &fMWaitFeatures, &uIgnore);
         if (    (fMWaitFeatures & (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
             !=                    (X86_CPUID_MWAIT_ECX_EXT | X86_CPUID_MWAIT_ECX_BREAKIRQIF0))
         {
             Log2(("mwait eax=%RX32, ecx=%RX32; break-on-IRQ-IF=0 extension not enabled -> #GP(0)\n", uEax, uEcx));
-            return iemRaiseGeneralProtectionFault0(pIemCpu);
+            return iemRaiseGeneralProtectionFault0(pVCpu);
         }
     }
@@ -5967 +5965 @@
      * Call EM to prepare the monitor/wait.
      */
-    VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(IEMCPU_TO_VMCPU(pIemCpu), uEax, uEcx);
-
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    VBOXSTRICTRC rcStrict = EMMonitorWaitPerform(pVCpu, uEax, uEcx);
+
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return rcStrict;
 }
@@ -5979 +5977 @@
 IEM_CIMPL_DEF_0(iemCImpl_swapgs)
 {
-    Assert(pIemCpu->enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
+    Assert(pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT); /* Caller checks this. */
 
     /*
      * Permission checks.
      */
-    if (pIemCpu->uCpl != 0)
+    if (pVCpu->iem.s.uCpl != 0)
     {
         Log2(("swapgs: CPL != 0\n"));
-        return iemRaiseUndefinedOpcode(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
     }
 
@@ -5993 +5991 @@
      * Do the job.
      */
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint64_t uOtherGsBase = pCtx->msrKERNELGSBASE;
     pCtx->msrKERNELGSBASE = pCtx->gs.u64Base;
     pCtx->gs.u64Base = uOtherGsBase;
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6008 +6006 @@
 IEM_CIMPL_DEF_0(iemCImpl_cpuid)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
-
-    CPUMGetGuestCpuId(IEMCPU_TO_VMCPU(pIemCpu), pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
+
+    CPUMGetGuestCpuId(pVCpu, pCtx->eax, pCtx->ecx, &pCtx->eax, &pCtx->ebx, &pCtx->ecx, &pCtx->edx);
     pCtx->rax &= UINT32_C(0xffffffff);
     pCtx->rbx &= UINT32_C(0xffffffff);
@@ -6016 +6014 @@
     pCtx->rdx &= UINT32_C(0xffffffff);
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6028 +6026 @@
 IEM_CIMPL_DEF_1(iemCImpl_aad, uint8_t, bImm)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     uint16_t const ax = pCtx->ax;
     uint8_t const  al = (uint8_t)ax + (uint8_t)(ax >> 8) * bImm;
     pCtx->ax = al;
-    iemHlpUpdateArithEFlagsU8(pIemCpu, al,
+    iemHlpUpdateArithEFlagsU8(pVCpu, al,
                               X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
                               X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6049 +6047 @@
 IEM_CIMPL_DEF_1(iemCImpl_aam, uint8_t, bImm)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     Assert(bImm != 0); /* #DE on 0 is handled in the decoder. */
 
@@ -6056 +6054 @@
     uint8_t const  ah = (uint8_t)ax / bImm;
     pCtx->ax = (ah << 8) + al;
-    iemHlpUpdateArithEFlagsU8(pIemCpu, al,
+    iemHlpUpdateArithEFlagsU8(pVCpu, al,
                               X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF,
                               X86_EFL_OF | X86_EFL_AF | X86_EFL_CF);
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6070 +6068 @@
 IEM_CIMPL_DEF_0(iemCImpl_daa)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     uint8_t const  al       = pCtx->al;
@@ -6092 +6090 @@
         pCtx->eflags.Bits.u1CF = 0;
 
-    iemHlpUpdateArithEFlagsU8(pIemCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6103 +6101 @@
 IEM_CIMPL_DEF_0(iemCImpl_das)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     uint8_t const  uInputAL = pCtx->al;
@@ -6128 +6126 @@
     }
 
-    iemHlpUpdateArithEFlagsU8(pIemCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemHlpUpdateArithEFlagsU8(pVCpu, pCtx->al, X86_EFL_SF | X86_EFL_ZF | X86_EFL_PF, X86_EFL_OF);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6182 +6180 @@
 IEM_CIMPL_DEF_0(iemCImpl_xgetbv)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     if (pCtx->cr4 & X86_CR4_OSXSAVE)
     {
@@ -6194 +6192 @@
             default:
                 Log(("xgetbv ecx=%RX32 -> #GP(0)\n", uEcx));
-                return iemRaiseGeneralProtectionFault0(pIemCpu);
+                return iemRaiseGeneralProtectionFault0(pVCpu);
 
         }
@@ -6200 +6198 @@
         pCtx->rdx = RT_HI_U32(pCtx->aXcr[uEcx]);
 
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
     Log(("xgetbv CR4.OSXSAVE=0 -> UD\n"));
-    return iemRaiseUndefinedOpcode(pIemCpu);
+    return iemRaiseUndefinedOpcode(pVCpu);
 }
 
@@ -6213 +6211 @@
 IEM_CIMPL_DEF_0(iemCImpl_xsetbv)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     if (pCtx->cr4 & X86_CR4_OSXSAVE)
     {
-        if (pIemCpu->uCpl == 0)
+        if (pVCpu->iem.s.uCpl == 0)
         {
             uint32_t uEcx = pCtx->ecx;
@@ -6224 +6222 @@
                 case 0:
                 {
-                    int rc = CPUMSetGuestXcr0(IEMCPU_TO_VMCPU(pIemCpu), uNewValue);
+                    int rc = CPUMSetGuestXcr0(pVCpu, uNewValue);
                     if (rc == VINF_SUCCESS)
                         break;
                     Assert(rc == VERR_CPUM_RAISE_GP_0);
                     Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
-                    return iemRaiseGeneralProtectionFault0(pIemCpu);
+                    return iemRaiseGeneralProtectionFault0(pVCpu);
                 }
 
@@ -6235 +6233 @@
                 default:
                     Log(("xsetbv ecx=%RX32 (newvalue=%RX64) -> #GP(0)\n", uEcx, uNewValue));
-                    return iemRaiseGeneralProtectionFault0(pIemCpu);
+                    return iemRaiseGeneralProtectionFault0(pVCpu);
 
             }
 
-            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
             return VINF_SUCCESS;
         }
 
-        Log(("xsetbv cpl=%u -> GP(0)\n", pIemCpu->uCpl));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        Log(("xsetbv cpl=%u -> GP(0)\n", pVCpu->iem.s.uCpl));
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
     Log(("xsetbv CR4.OSXSAVE=0 -> UD\n"));
-    return iemRaiseUndefinedOpcode(pIemCpu);
+    return iemRaiseUndefinedOpcode(pVCpu);
 }
 
@@ -6260 +6258 @@
 IEM_CIMPL_DEF_1(iemCImpl_finit, bool, fCheckXcpts)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
-        return iemRaiseDeviceNotAvailable(pIemCpu);
+        return iemRaiseDeviceNotAvailable(pVCpu);
 
     NOREF(fCheckXcpts); /** @todo trigger pending exceptions:
         if (fCheckXcpts && TODO )
-        return iemRaiseMathFault(pIemCpu);
+        return iemRaiseMathFault(pVCpu);
      */
 
@@ -6282 +6280 @@
     pXState->x87.FOP   = 0;
 
-    iemHlpUsedFpu(pIemCpu);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemHlpUsedFpu(pVCpu);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6297 +6295 @@
 IEM_CIMPL_DEF_3(iemCImpl_fxsave, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -6303 +6301 @@
      */
     if (pCtx->cr0 & X86_CR0_EM)
-        return iemRaiseUndefinedOpcode(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
     if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
-        return iemRaiseDeviceNotAvailable(pIemCpu);
+        return iemRaiseDeviceNotAvailable(pVCpu);
     if (GCPtrEff & 15)
     {
@@ -6312 +6310 @@
         if (   (pCtx->cr0 & X86_CR0_AM)
             && pCtx->eflags.Bits.u1AC
-            && pIemCpu->uCpl == 3)
-            return iemRaiseAlignmentCheckException(pIemCpu);
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+            && pVCpu->iem.s.uCpl == 3)
+            return iemRaiseAlignmentCheckException(pVCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -6321 +6319 @@
      */
     void *pvMem512;
-    VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -6371 +6369 @@
     /* XMM registers. */
     if (   !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
-        || pIemCpu->enmCpuMode != IEMMODE_64BIT
-        || pIemCpu->uCpl != 0)
+        || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
+        || pVCpu->iem.s.uCpl != 0)
     {
         uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
@@ -6384 +6382 @@
      * Commit the memory.
      */
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6401 +6399 @@
 IEM_CIMPL_DEF_3(iemCImpl_fxrstor, uint8_t, iEffSeg, RTGCPTR, GCPtrEff, IEMMODE, enmEffOpSize)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -6407 +6405 @@
      */
     if (pCtx->cr0 & X86_CR0_EM)
-        return iemRaiseUndefinedOpcode(pIemCpu);
+        return iemRaiseUndefinedOpcode(pVCpu);
     if (pCtx->cr0 & (X86_CR0_TS | X86_CR0_EM))
-        return iemRaiseDeviceNotAvailable(pIemCpu);
+        return iemRaiseDeviceNotAvailable(pVCpu);
     if (GCPtrEff & 15)
     {
@@ -6416 +6414 @@
         if (   (pCtx->cr0 & X86_CR0_AM)
             && pCtx->eflags.Bits.u1AC
-            && pIemCpu->uCpl == 3)
-            return iemRaiseAlignmentCheckException(pIemCpu);
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+            && pVCpu->iem.s.uCpl == 3)
+            return iemRaiseAlignmentCheckException(pVCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -6425 +6423 @@
      */
     void *pvMem512;
-    VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -6439 +6437 @@
     {
         Log(("fxrstor: MXCSR=%#x (MXCSR_MASK=%#x) -> #GP(0)\n", fMXCSR, fMXCSR_MASK));
-        return iemRaiseGeneralProtectionFault0(pIemCpu);
+        return iemRaiseGeneralProtectionFault0(pVCpu);
     }
 
@@ -6464 +6462 @@
 
     /* FPU IP, CS, DP and DS. */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         pDst->FPUIP  = pSrc->FPUIP;
@@ -6485 +6483 @@
     /* XMM registers. */
     if (   !(pCtx->msrEFER & MSR_K6_EFER_FFXSR)
-        || pIemCpu->enmCpuMode != IEMMODE_64BIT
-        || pIemCpu->uCpl != 0)
+        || pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT
+        || pVCpu->iem.s.uCpl != 0)
     {
         uint32_t cXmmRegs = enmEffOpSize == IEMMODE_64BIT ? 16 : 8;
@@ -6496 +6494 @@
      * Commit the memory.
      */
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, pvMem512, IEM_ACCESS_DATA_R);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
-    iemHlpUsedFpu(pIemCpu);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemHlpUsedFpu(pVCpu);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6512 +6510 @@
  * @param   pCtx                The CPU context.
  */
-static void iemCImplCommonFpuStoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
+static void iemCImplCommonFpuStoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTPTRUNION uPtr, PCCPUMCTX pCtx)
 {
     PCX86FXSTATE pSrcX87 = &pCtx->CTX_SUFF(pXState)->x87;
@@ -6520 +6518 @@
         uPtr.pu16[1] = pSrcX87->FSW;
         uPtr.pu16[2] = iemFpuCalcFullFtw(pSrcX87);
-        if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+        if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
         {
             /** @todo Testcase: How does this work when the FPUIP/CS was saved in
@@ -6549 +6547 @@
         uPtr.pu16[2*2]   = iemFpuCalcFullFtw(pSrcX87);
         uPtr.pu16[2*2+1] = 0xffff;
-        if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+        if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
         {
             uPtr.pu16[3*2]   = (uint16_t)pSrcX87->FPUIP;
@@ -6575 +6573 @@
  * @param   pCtx                The CPU context.
  */
-static void iemCImplCommonFpuRestoreEnv(PIEMCPU pIemCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
+static void iemCImplCommonFpuRestoreEnv(PVMCPU pVCpu, IEMMODE enmEffOpSize, RTCPTRUNION uPtr, PCPUMCTX pCtx)
 {
     PX86FXSTATE pDstX87 = &pCtx->CTX_SUFF(pXState)->x87;
@@ -6583 +6581 @@
         pDstX87->FSW = uPtr.pu16[1];
         pDstX87->FTW = uPtr.pu16[2];
-        if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+        if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
         {
             pDstX87->FPUIP = uPtr.pu16[3] | ((uint32_t)(uPtr.pu16[4] & UINT16_C(0xf000)) << 4);
@@ -6609 +6607 @@
         pDstX87->FSW = uPtr.pu16[1*2];
         pDstX87->FTW = uPtr.pu16[2*2];
-        if (IEM_IS_REAL_OR_V86_MODE(pIemCpu))
+        if (IEM_IS_REAL_OR_V86_MODE(pVCpu))
         {
             pDstX87->FPUIP = uPtr.pu16[3*2] | ((uPtr.pu32[4] & UINT32_C(0x0ffff000)) << 4);
@@ -6649 +6647 @@
 IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
 {
-    PCPUMCTX     pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX     pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTPTRUNION   uPtr;
-    VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
                                       iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
-    iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
-
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
+    iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
+
+    rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
     /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6676 +6674 @@
 IEM_CIMPL_DEF_3(iemCImpl_fnsave, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
 {
-    PCPUMCTX     pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX     pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTPTRUNION   uPtr;
-    VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
                                       iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
     if (rcStrict != VINF_SUCCESS)
@@ -6684 +6682 @@
 
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemCImplCommonFpuStoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
+    iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
     PRTFLOAT80U paRegs = (PRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
     for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
@@ -6693 +6691 @@
     }
 
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -6711 +6709 @@
     pFpuCtx->FOP   = 0;
 
-    iemHlpUsedFpu(pIemCpu);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemHlpUsedFpu(pVCpu);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6727 +6725 @@
 IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
 {
-    PCPUMCTX     pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX     pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTCPTRUNION  uPtr;
-    VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
                                       iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
-    iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
-
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
+    iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
+
+    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
-    iemHlpUsedFpu(pIemCpu);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemHlpUsedFpu(pVCpu);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6754 +6752 @@
 IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
 {
-    PCPUMCTX     pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX     pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     RTCPTRUNION  uPtr;
-    VBOXSTRICTRC rcStrict = iemMemMap(pIemCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
                                       iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R);
     if (rcStrict != VINF_SUCCESS)
@@ -6762 +6760 @@
 
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
-    iemCImplCommonFpuRestoreEnv(pIemCpu, enmEffOpSize, uPtr, pCtx);
+    iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr, pCtx);
     PCRTFLOAT80U paRegs = (PCRTFLOAT80U)(uPtr.pu8 + (enmEffOpSize == IEMMODE_16BIT ? 14 : 28));
     for (uint32_t i = 0; i < RT_ELEMENTS(pFpuCtx->aRegs); i++)
@@ -6772 +6770 @@
     }
 
-    rcStrict = iemMemCommitAndUnmap(pIemCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
-    iemHlpUsedFpu(pIemCpu);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemHlpUsedFpu(pVCpu);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6789 +6787 @@
 IEM_CIMPL_DEF_1(iemCImpl_fldcw, uint16_t, u16Fcw)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /** @todo Testcase: Check what happens when trying to load X86_FCW_PC_RSVD. */
@@ -6801 +6799 @@
 
     /* Note: C0, C1, C2 and C3 are documented as undefined, we leave them untouched! */
-    iemHlpUsedFpu(pIemCpu);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemHlpUsedFpu(pVCpu);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6815 +6813 @@
 IEM_CIMPL_DEF_1(iemCImpl_fxch_underflow, uint8_t, iStReg)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
@@ -6850 +6848 @@
     }
 
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
-    iemHlpUsedFpu(pIemCpu);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
+    iemHlpUsedFpu(pVCpu);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -6864 +6862 @@
 IEM_CIMPL_DEF_3(iemCImpl_fcomi_fucomi, uint8_t, iStReg, PFNIEMAIMPLFPUR80EFL, pfnAImpl, bool, fPop)
 {
-    PCPUMCTX pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PCPUMCTX pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     Assert(iStReg < 8);
 
@@ -6871 +6869 @@
      */
     if (pCtx->cr0 & (X86_CR0_EM | X86_CR0_TS))
-        return iemRaiseDeviceNotAvailable(pIemCpu);
+        return iemRaiseDeviceNotAvailable(pVCpu);
 
     PX86FXSTATE pFpuCtx = &pCtx->CTX_SUFF(pXState)->x87;
     uint16_t u16Fsw = pFpuCtx->FSW;
     if (u16Fsw & X86_FSW_ES)
-        return iemRaiseMathFault(pIemCpu);
+        return iemRaiseMathFault(pVCpu);
 
     /*
@@ -6923 +6921 @@
     }
 
-    iemFpuUpdateOpcodeAndIpWorker(pIemCpu, pCtx, pFpuCtx);
-    iemHlpUsedFpu(pIemCpu);
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemFpuUpdateOpcodeAndIpWorker(pVCpu, pCtx, pFpuCtx);
+    iemHlpUsedFpu(pVCpu);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }

trunk/src/VBox/VMM/VMMAll/IEMAllCImplStrInstr.cpp.h

@@ -48 +48 @@
 # define ADDR_rCX   rcx
 # define ADDR2_TYPE uint64_t
-# define IS_64_BIT_CODE(a_pIemCpu) (true)
+# define IS_64_BIT_CODE(a_pVCpu)    (true)
 #else
 # error "Bad ADDR_SIZE."
@@ -55 +55 @@
 
 #if ADDR_SIZE == 64 || OP_SIZE == 64
-# define IS_64_BIT_CODE(a_pIemCpu)  (true)
+# define IS_64_BIT_CODE(a_pVCpu)    (true)
 #elif ADDR_SIZE == 32
-# define IS_64_BIT_CODE(a_pIemCpu)  ((a_pIemCpu)->enmCpuMode == IEMMODE_64BIT)
+# define IS_64_BIT_CODE(a_pVCpu)    ((a_pVCpu)->iem.s.enmCpuMode == IEMMODE_64BIT)
 #else
-# define IS_64_BIT_CODE(a_pIemCpu)  (false)
+# define IS_64_BIT_CODE(a_pVCpu)    (false)
 #endif
 
@@ -69 +69 @@
  */
 #ifdef IN_RC
-# define IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_pIemCpu, a_fEflags) \
+# define IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_fEflags) \
     do { \
         if (RT_LIKELY(   (   !VMCPU_FF_IS_PENDING(a_pVCpu, (a_fEflags) & X86_EFL_IF ? VMCPU_FF_YIELD_REPSTR_MASK \
                                                                                    : VMCPU_FF_YIELD_REPSTR_NOINT_MASK) \
                           && !VM_FF_IS_PENDING(a_pVM, VM_FF_YIELD_REPSTR_MASK) ) \
-                      || IEM_VERIFICATION_ENABLED(a_pIemCpu) )) \
+                      || IEM_VERIFICATION_ENABLED(a_pVCpu) )) \
         { \
             RTCCUINTREG fSavedFlags = ASMGetFlags(); \
@@ -92 +92 @@
     } while (0)
 #else
-# define IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_pIemCpu, a_fEflags) \
+# define IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_fEflags) \
     do { \
         if (RT_LIKELY(   (   !VMCPU_FF_IS_PENDING(a_pVCpu, (a_fEflags) & X86_EFL_IF ? VMCPU_FF_YIELD_REPSTR_MASK \
                                                                                    : VMCPU_FF_YIELD_REPSTR_NOINT_MASK) \
                           && !VM_FF_IS_PENDING(a_pVM, VM_FF_YIELD_REPSTR_MASK) ) \
-                      || IEM_VERIFICATION_ENABLED(a_pIemCpu) )) \
+                      || IEM_VERIFICATION_ENABLED(a_pVCpu) )) \
         { /* probable */ } \
         else  \
@@ -113 +113 @@
  * instructions. Use IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN for
  * ones that are typically cheap. */
-#define IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_pIemCpu, a_fExitExpr) \
+#define IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_fExitExpr) \
     do { \
         if (RT_LIKELY(   (   !VMCPU_FF_IS_PENDING(a_pVCpu, VMCPU_FF_HIGH_PRIORITY_POST_REPSTR_MASK) \
                           && !VM_FF_IS_PENDING(a_pVM,         VM_FF_HIGH_PRIORITY_POST_REPSTR_MASK)) \
                       || (a_fExitExpr) \
-                      || IEM_VERIFICATION_ENABLED(a_pIemCpu) )) \
+                      || IEM_VERIFICATION_ENABLED(a_pVCpu) )) \
         { /* very likely */ } \
         else \
@@ -135 +135 @@
  * (status code is hidden in IEMCPU::rcPassUp by IEM memory commit code).
  */
-#define IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_pIemCpu, a_fExitExpr) \
+#define IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(a_pVM, a_pVCpu, a_fExitExpr) \
     do { \
         if (RT_LIKELY(   !VMCPU_FF_IS_PENDING(a_pVCpu, VMCPU_FF_HIGH_PRIORITY_POST_REPSTR_MASK) \
                       || (a_fExitExpr) \
-                      || IEM_VERIFICATION_ENABLED(a_pIemCpu) )) \
+                      || IEM_VERIFICATION_ENABLED(a_pVCpu) )) \
         { /* very likely */ } \
         else \
@@ -155 +155 @@
 IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_repe_cmps_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg)
 {
-    PVM         pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU      pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX    pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PVM         pVM   = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX    pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -165 +164 @@
     if (uCounterReg == 0)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
 
-    PCCPUMSELREGHID pSrc1Hid     = iemSRegGetHid(pIemCpu, iEffSeg);
+    PCCPUMSELREGHID pSrc1Hid     = iemSRegGetHid(pVCpu, iEffSeg);
     uint64_t        uSrc1Base;
-    VBOXSTRICTRC    rcStrict     = iemMemSegCheckReadAccessEx(pIemCpu, pSrc1Hid, iEffSeg, &uSrc1Base);
+    VBOXSTRICTRC    rcStrict     = iemMemSegCheckReadAccessEx(pVCpu, pSrc1Hid, iEffSeg, &uSrc1Base);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
     uint64_t        uSrc2Base;
-    rcStrict = iemMemSegCheckReadAccessEx(pIemCpu, iemSRegUpdateHid(pIemCpu, &pCtx->es), X86_SREG_ES, &uSrc2Base);
+    rcStrict = iemMemSegCheckReadAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pCtx->es), X86_SREG_ES, &uSrc2Base);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -203 +202 @@
         if (   cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
             && cbIncr > 0    /** @todo Optimize reverse direction string ops. */
-            && (   IS_64_BIT_CODE(pIemCpu)
+            && (   IS_64_BIT_CODE(pVCpu)
                 || (   uSrc1AddrReg < pSrc1Hid->u32Limit
                     && uSrc1AddrReg + (cLeftPage * (OP_SIZE / 8)) <= pSrc1Hid->u32Limit
@@ -212 +211 @@
         {
             RTGCPHYS GCPhysSrc1Mem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtSrc1Addr, IEM_ACCESS_DATA_R, &GCPhysSrc1Mem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrc1Addr, IEM_ACCESS_DATA_R, &GCPhysSrc1Mem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
 
             RTGCPHYS GCPhysSrc2Mem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtSrc2Addr, IEM_ACCESS_DATA_R, &GCPhysSrc2Mem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrc2Addr, IEM_ACCESS_DATA_R, &GCPhysSrc2Mem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -227 +226 @@
             PGMPAGEMAPLOCK PgLockSrc2Mem;
             OP_TYPE const *puSrc2Mem;
-            rcStrict = iemMemPageMap(pIemCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, (void **)&puSrc2Mem, &PgLockSrc2Mem);
+            rcStrict = iemMemPageMap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, (void **)&puSrc2Mem, &PgLockSrc2Mem);
             if (rcStrict == VINF_SUCCESS)
             {
                 PGMPAGEMAPLOCK PgLockSrc1Mem;
                 OP_TYPE const *puSrc1Mem;
-                rcStrict = iemMemPageMap(pIemCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, (void **)&puSrc1Mem, &PgLockSrc1Mem);
+                rcStrict = iemMemPageMap(pVCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, (void **)&puSrc1Mem, &PgLockSrc1Mem);
                 if (rcStrict == VINF_SUCCESS)
                 {
@@ -265 +264 @@
                     pCtx->eflags.u = uEFlags;
 
-                    iemMemPageUnmap(pIemCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, puSrc1Mem, &PgLockSrc1Mem);
-                    iemMemPageUnmap(pIemCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
+                    iemMemPageUnmap(pVCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, puSrc1Mem, &PgLockSrc1Mem);
+                    iemMemPageUnmap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
                     if (   uCounterReg == 0
                         || !(uEFlags & X86_EFL_ZF))
                         break;
-                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uEFlags);
+                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
                     continue;
                 }
-                iemMemPageUnmap(pIemCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
+                iemMemPageUnmap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
             }
         }
@@ -285 +284 @@
         {
             OP_TYPE uValue1;
-            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uValue1, iEffSeg, uSrc1AddrReg);
+            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue1, iEffSeg, uSrc1AddrReg);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
             OP_TYPE uValue2;
-            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uValue2, X86_SREG_ES, uSrc2AddrReg);
+            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue2, X86_SREG_ES, uSrc2AddrReg);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -299 +298 @@
             pCtx->eflags.u = uEFlags;
             cLeftPage--;
-            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu,
-                                                                    uCounterReg == 0 || !(uEFlags & X86_EFL_ZF));
+            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0 || !(uEFlags & X86_EFL_ZF));
         } while (   (int32_t)cLeftPage > 0
                  && (uEFlags & X86_EFL_ZF));
@@ -310 +308 @@
             || !(uEFlags & X86_EFL_ZF))
             break;
-        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uEFlags);
+        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
     }
 
@@ -316 +314 @@
      * Done.
      */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -326 +324 @@
 IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_repne_cmps_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg)
 {
-    PVM         pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU      pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX    pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PVM         pVM   = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX    pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -336 +333 @@
     if (uCounterReg == 0)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
 
-    PCCPUMSELREGHID pSrc1Hid = iemSRegGetHid(pIemCpu, iEffSeg);
+    PCCPUMSELREGHID pSrc1Hid = iemSRegGetHid(pVCpu, iEffSeg);
     uint64_t        uSrc1Base;
-    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pIemCpu, pSrc1Hid, iEffSeg, &uSrc1Base);
+    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, pSrc1Hid, iEffSeg, &uSrc1Base);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
     uint64_t        uSrc2Base;
-    rcStrict = iemMemSegCheckReadAccessEx(pIemCpu, iemSRegUpdateHid(pIemCpu, &pCtx->es), X86_SREG_ES, &uSrc2Base);
+    rcStrict = iemMemSegCheckReadAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pCtx->es), X86_SREG_ES, &uSrc2Base);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -374 +371 @@
         if (   cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
             && cbIncr > 0    /** @todo Optimize reverse direction string ops. */
-            && (   IS_64_BIT_CODE(pIemCpu)
+            && (   IS_64_BIT_CODE(pVCpu)
                 || (   uSrc1AddrReg < pSrc1Hid->u32Limit
                     && uSrc1AddrReg + (cLeftPage * (OP_SIZE / 8)) <= pSrc1Hid->u32Limit
@@ -383 +380 @@
         {
             RTGCPHYS GCPhysSrc1Mem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtSrc1Addr, IEM_ACCESS_DATA_R, &GCPhysSrc1Mem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrc1Addr, IEM_ACCESS_DATA_R, &GCPhysSrc1Mem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
 
             RTGCPHYS GCPhysSrc2Mem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtSrc2Addr, IEM_ACCESS_DATA_R, &GCPhysSrc2Mem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrc2Addr, IEM_ACCESS_DATA_R, &GCPhysSrc2Mem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -398 +395 @@
             OP_TYPE const *puSrc2Mem;
             PGMPAGEMAPLOCK PgLockSrc2Mem;
-            rcStrict = iemMemPageMap(pIemCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, (void **)&puSrc2Mem, &PgLockSrc2Mem);
+            rcStrict = iemMemPageMap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, (void **)&puSrc2Mem, &PgLockSrc2Mem);
             if (rcStrict == VINF_SUCCESS)
             {
                 OP_TYPE const *puSrc1Mem;
                 PGMPAGEMAPLOCK PgLockSrc1Mem;
-                rcStrict = iemMemPageMap(pIemCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, (void **)&puSrc1Mem, &PgLockSrc1Mem);
+                rcStrict = iemMemPageMap(pVCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, (void **)&puSrc1Mem, &PgLockSrc1Mem);
                 if (rcStrict == VINF_SUCCESS)
                 {
@@ -436 +433 @@
                     pCtx->eflags.u = uEFlags;
 
-                    iemMemPageUnmap(pIemCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, puSrc1Mem, &PgLockSrc1Mem);
-                    iemMemPageUnmap(pIemCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
+                    iemMemPageUnmap(pVCpu, GCPhysSrc1Mem, IEM_ACCESS_DATA_R, puSrc1Mem, &PgLockSrc1Mem);
+                    iemMemPageUnmap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
                     if (   uCounterReg == 0
                         || (uEFlags & X86_EFL_ZF))
                         break;
-                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uEFlags);
+                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
                     continue;
                 }
-                iemMemPageUnmap(pIemCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
+                iemMemPageUnmap(pVCpu, GCPhysSrc2Mem, IEM_ACCESS_DATA_R, puSrc2Mem, &PgLockSrc2Mem);
             }
         }
@@ -456 +453 @@
         {
             OP_TYPE uValue1;
-            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uValue1, iEffSeg, uSrc1AddrReg);
+            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue1, iEffSeg, uSrc1AddrReg);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
             OP_TYPE uValue2;
-            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uValue2, X86_SREG_ES, uSrc2AddrReg);
+            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue2, X86_SREG_ES, uSrc2AddrReg);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -470 +467 @@
             pCtx->eflags.u = uEFlags;
             cLeftPage--;
-            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu,
-                                                                    uCounterReg == 0 || (uEFlags & X86_EFL_ZF));
+            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0 || (uEFlags & X86_EFL_ZF));
         } while (   (int32_t)cLeftPage > 0
                  && !(uEFlags & X86_EFL_ZF));
@@ -481 +477 @@
             || (uEFlags & X86_EFL_ZF))
             break;
-        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uEFlags);
+        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
     }
 
@@ -487 +483 @@
      * Done.
      */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -497 +493 @@
 IEM_CIMPL_DEF_0(RT_CONCAT4(iemCImpl_repe_scas_,OP_rAX,_m,ADDR_SIZE))
 {
-    PVM         pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU      pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX    pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PVM         pVM   = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX    pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -507 +502 @@
     if (uCounterReg == 0)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
 
     uint64_t        uBaseAddr;
-    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pIemCpu, iemSRegUpdateHid(pIemCpu, &pCtx->es), X86_SREG_ES, &uBaseAddr);
+    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pCtx->es), X86_SREG_ES, &uBaseAddr);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -535 +530 @@
         if (   cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
             && cbIncr > 0    /** @todo Implement reverse direction string ops. */
-            && (   IS_64_BIT_CODE(pIemCpu)
+            && (   IS_64_BIT_CODE(pVCpu)
                 || (   uAddrReg < pCtx->es.u32Limit
                     && uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pCtx->es.u32Limit)
@@ -542 +537 @@
         {
             RTGCPHYS GCPhysMem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtAddr, IEM_ACCESS_DATA_R, &GCPhysMem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, IEM_ACCESS_DATA_R, &GCPhysMem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -552 +547 @@
             PGMPAGEMAPLOCK PgLockMem;
             OP_TYPE const *puMem;
-            rcStrict = iemMemPageMap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
+            rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -571 +566 @@
                 pCtx->eflags.u = uEFlags;
                 Assert(!(uEFlags & X86_EFL_ZF) == fQuit);
-                iemMemPageUnmap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
+                iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
                 if (   fQuit
                     || uCounterReg == 0)
@@ -580 +575 @@
                 if (!(uVirtAddr & (OP_SIZE - 1)))
                 {
-                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uEFlags);
+                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
                     continue;
                 }
@@ -595 +590 @@
         {
             OP_TYPE uTmpValue;
-            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uTmpValue, X86_SREG_ES, uAddrReg);
+            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uTmpValue, X86_SREG_ES, uAddrReg);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -604 +599 @@
             pCtx->eflags.u = uEFlags;
             cLeftPage--;
-            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu,
-                                                                    uCounterReg == 0 || !(uEFlags & X86_EFL_ZF));
+            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0 || !(uEFlags & X86_EFL_ZF));
         } while (   (int32_t)cLeftPage > 0
                  && (uEFlags & X86_EFL_ZF));
@@ -615 +609 @@
             || !(uEFlags & X86_EFL_ZF))
             break;
-        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uEFlags);
+        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
     }
 
@@ -621 +615 @@
      * Done.
      */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -631 +625 @@
 IEM_CIMPL_DEF_0(RT_CONCAT4(iemCImpl_repne_scas_,OP_rAX,_m,ADDR_SIZE))
 {
-    PVM         pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU      pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX    pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PVM         pVM   = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX    pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -641 +634 @@
     if (uCounterReg == 0)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
 
     uint64_t        uBaseAddr;
-    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pIemCpu, iemSRegUpdateHid(pIemCpu, &pCtx->es), X86_SREG_ES, &uBaseAddr);
+    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pCtx->es), X86_SREG_ES, &uBaseAddr);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -669 +662 @@
         if (   cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
             && cbIncr > 0    /** @todo Implement reverse direction string ops. */
-            && (   IS_64_BIT_CODE(pIemCpu)
+            && (   IS_64_BIT_CODE(pVCpu)
                 || (   uAddrReg < pCtx->es.u32Limit
                     && uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pCtx->es.u32Limit)
@@ -676 +669 @@
         {
             RTGCPHYS GCPhysMem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtAddr, IEM_ACCESS_DATA_R, &GCPhysMem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, IEM_ACCESS_DATA_R, &GCPhysMem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -686 +679 @@
             PGMPAGEMAPLOCK PgLockMem;
             OP_TYPE const *puMem;
-            rcStrict = iemMemPageMap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
+            rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -705 +698 @@
                 pCtx->eflags.u = uEFlags;
                 Assert(!!(uEFlags & X86_EFL_ZF) == fQuit);
-                iemMemPageUnmap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
+                iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
                 if (   fQuit
                     || uCounterReg == 0)
@@ -714 +707 @@
                 if (!(uVirtAddr & (OP_SIZE - 1)))
                 {
-                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uEFlags);
+                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
                     continue;
                 }
@@ -729 +722 @@
         {
             OP_TYPE uTmpValue;
-            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uTmpValue, X86_SREG_ES, uAddrReg);
+            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uTmpValue, X86_SREG_ES, uAddrReg);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -737 +730 @@
             pCtx->eflags.u = uEFlags;
             cLeftPage--;
-            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu,
-                                                                    uCounterReg == 0 || (uEFlags & X86_EFL_ZF));
+            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0 || (uEFlags & X86_EFL_ZF));
         } while (   (int32_t)cLeftPage > 0
                  && !(uEFlags & X86_EFL_ZF));
@@ -748 +740 @@
             || (uEFlags & X86_EFL_ZF))
             break;
-        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uEFlags);
+        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, uEFlags);
     }
 
@@ -754 +746 @@
      * Done.
      */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -766 +758 @@
 IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_rep_movs_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg)
 {
-    PVM         pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU      pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX    pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PVM         pVM   = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX    pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -776 +767 @@
     if (uCounterReg == 0)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
 
-    PCCPUMSELREGHID pSrcHid = iemSRegGetHid(pIemCpu, iEffSeg);
+    PCCPUMSELREGHID pSrcHid = iemSRegGetHid(pVCpu, iEffSeg);
     uint64_t        uSrcBase;
-    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pIemCpu, pSrcHid, iEffSeg, &uSrcBase);
+    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, pSrcHid, iEffSeg, &uSrcBase);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
     uint64_t        uDstBase;
-    rcStrict = iemMemSegCheckWriteAccessEx(pIemCpu, iemSRegUpdateHid(pIemCpu, &pCtx->es), X86_SREG_ES, &uDstBase);
+    rcStrict = iemMemSegCheckWriteAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pCtx->es), X86_SREG_ES, &uDstBase);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -798 +789 @@
      * Be careful with handle bypassing.
      */
-    if (pIemCpu->fBypassHandlers)
+    if (pVCpu->iem.s.fBypassHandlers)
     {
         Log(("%s: declining because we're bypassing handlers\n", __FUNCTION__));
@@ -810 +801 @@
      */
 #ifdef IEM_VERIFICATION_MODE_FULL
-    if (   IEM_VERIFICATION_ENABLED(pIemCpu)
+    if (   IEM_VERIFICATION_ENABLED(pVCpu)
         && (cbIncr > 0
             ?    uSrcAddrReg <= uDstAddrReg
@@ -816 +807 @@
             :    uDstAddrReg <= uSrcAddrReg
               && uDstAddrReg + cbIncr * uCounterReg > uSrcAddrReg))
-        pIemCpu->fOverlappingMovs = true;
+        pVCpu->iem.s.fOverlappingMovs = true;
 #endif
 
@@ -837 +828 @@
         if (   cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
             && cbIncr > 0    /** @todo Implement reverse direction string ops. */
-            && (   IS_64_BIT_CODE(pIemCpu)
+            && (   IS_64_BIT_CODE(pVCpu)
                 || (   uSrcAddrReg < pSrcHid->u32Limit
                     && uSrcAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pSrcHid->u32Limit
@@ -846 +837 @@
         {
             RTGCPHYS GCPhysSrcMem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtSrcAddr, IEM_ACCESS_DATA_R, &GCPhysSrcMem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtSrcAddr, IEM_ACCESS_DATA_R, &GCPhysSrcMem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
 
             RTGCPHYS GCPhysDstMem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtDstAddr, IEM_ACCESS_DATA_W, &GCPhysDstMem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtDstAddr, IEM_ACCESS_DATA_W, &GCPhysDstMem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -861 +852 @@
             PGMPAGEMAPLOCK PgLockDstMem;
             OP_TYPE *puDstMem;
-            rcStrict = iemMemPageMap(pIemCpu, GCPhysDstMem, IEM_ACCESS_DATA_W, (void **)&puDstMem, &PgLockDstMem);
+            rcStrict = iemMemPageMap(pVCpu, GCPhysDstMem, IEM_ACCESS_DATA_W, (void **)&puDstMem, &PgLockDstMem);
             if (rcStrict == VINF_SUCCESS)
             {
                 PGMPAGEMAPLOCK PgLockSrcMem;
                 OP_TYPE const *puSrcMem;
-                rcStrict = iemMemPageMap(pIemCpu, GCPhysSrcMem, IEM_ACCESS_DATA_R, (void **)&puSrcMem, &PgLockSrcMem);
+                rcStrict = iemMemPageMap(pVCpu, GCPhysSrcMem, IEM_ACCESS_DATA_R, (void **)&puSrcMem, &PgLockSrcMem);
                 if (rcStrict == VINF_SUCCESS)
                 {
@@ -886 +877 @@
                     pCtx->ADDR_rCX = uCounterReg -= cLeftPage;
 
-                    iemMemPageUnmap(pIemCpu, GCPhysSrcMem, IEM_ACCESS_DATA_R, puSrcMem, &PgLockSrcMem);
-                    iemMemPageUnmap(pIemCpu, GCPhysDstMem, IEM_ACCESS_DATA_W, puDstMem, &PgLockDstMem);
+                    iemMemPageUnmap(pVCpu, GCPhysSrcMem, IEM_ACCESS_DATA_R, puSrcMem, &PgLockSrcMem);
+                    iemMemPageUnmap(pVCpu, GCPhysDstMem, IEM_ACCESS_DATA_W, puDstMem, &PgLockDstMem);
 
                     if (uCounterReg == 0)
                         break;
-                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
                     continue;
                 }
-                iemMemPageUnmap(pIemCpu, GCPhysDstMem, IEM_ACCESS_DATA_W, puDstMem, &PgLockDstMem);
+                iemMemPageUnmap(pVCpu, GCPhysDstMem, IEM_ACCESS_DATA_W, puDstMem, &PgLockDstMem);
             }
         }
@@ -906 +897 @@
         {
             OP_TYPE uValue;
-            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uValue, iEffSeg, uSrcAddrReg);
-            if (rcStrict != VINF_SUCCESS)
-                return rcStrict;
-            rcStrict = RT_CONCAT(iemMemStoreDataU,OP_SIZE)(pIemCpu, X86_SREG_ES, uDstAddrReg, uValue);
+            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue, iEffSeg, uSrcAddrReg);
+            if (rcStrict != VINF_SUCCESS)
+                return rcStrict;
+            rcStrict = RT_CONCAT(iemMemStoreDataU,OP_SIZE)(pVCpu, X86_SREG_ES, uDstAddrReg, uValue);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -917 +908 @@
             pCtx->ADDR_rCX = --uCounterReg;
             cLeftPage--;
-            IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uCounterReg == 0);
+            IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
         } while ((int32_t)cLeftPage > 0);
 
@@ -925 +916 @@
         if (uCounterReg == 0)
             break;
-        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
     }
 
@@ -931 +922 @@
      * Done.
      */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -941 +932 @@
 IEM_CIMPL_DEF_0(RT_CONCAT4(iemCImpl_stos_,OP_rAX,_m,ADDR_SIZE))
 {
-    PVM         pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU      pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX    pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PVM         pVM   = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX    pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -951 +941 @@
     if (uCounterReg == 0)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
 
     uint64_t        uBaseAddr;
-    VBOXSTRICTRC rcStrict = iemMemSegCheckWriteAccessEx(pIemCpu, iemSRegUpdateHid(pIemCpu, &pCtx->es), X86_SREG_ES, &uBaseAddr);
+    VBOXSTRICTRC rcStrict = iemMemSegCheckWriteAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pCtx->es), X86_SREG_ES, &uBaseAddr);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -968 +958 @@
      */
     /** @todo Permit doing a page if correctly aligned. */
-    if (pIemCpu->fBypassHandlers)
+    if (pVCpu->iem.s.fBypassHandlers)
     {
         Log(("%s: declining because we're bypassing handlers\n", __FUNCTION__));
@@ -988 +978 @@
         if (   cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
             && cbIncr > 0    /** @todo Implement reverse direction string ops. */
-            && (   IS_64_BIT_CODE(pIemCpu)
+            && (   IS_64_BIT_CODE(pVCpu)
                 || (   uAddrReg < pCtx->es.u32Limit
                     && uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pCtx->es.u32Limit)
@@ -995 +985 @@
         {
             RTGCPHYS GCPhysMem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtAddr, IEM_ACCESS_DATA_W, &GCPhysMem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, IEM_ACCESS_DATA_W, &GCPhysMem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -1005 +995 @@
             PGMPAGEMAPLOCK PgLockMem;
             OP_TYPE *puMem;
-            rcStrict = iemMemPageMap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_W, (void **)&puMem, &PgLockMem);
+            rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_W, (void **)&puMem, &PgLockMem);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -1022 +1012 @@
 #endif
 
-                iemMemPageUnmap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_W, puMem, &PgLockMem);
+                iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_W, puMem, &PgLockMem);
 
                 if (uCounterReg == 0)
@@ -1031 +1021 @@
                 if (!(uVirtAddr & (OP_SIZE - 1)))
                 {
-                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
                     continue;
                 }
@@ -1045 +1035 @@
         do
         {
-            rcStrict = RT_CONCAT(iemMemStoreDataU,OP_SIZE)(pIemCpu, X86_SREG_ES, uAddrReg, uValue);
+            rcStrict = RT_CONCAT(iemMemStoreDataU,OP_SIZE)(pVCpu, X86_SREG_ES, uAddrReg, uValue);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -1051 +1041 @@
             pCtx->ADDR_rCX = --uCounterReg;
             cLeftPage--;
-            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uCounterReg == 0);
+            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
         } while ((int32_t)cLeftPage > 0);
 
@@ -1059 +1049 @@
         if (uCounterReg == 0)
             break;
-        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
     }
 
@@ -1065 +1055 @@
      * Done.
      */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -1075 +1065 @@
 IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_lods_,OP_rAX,_m,ADDR_SIZE), int8_t, iEffSeg)
 {
-    PVM         pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU      pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX    pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PVM         pVM   = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX    pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -1085 +1074 @@
     if (uCounterReg == 0)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
 
-    PCCPUMSELREGHID pSrcHid = iemSRegGetHid(pIemCpu, iEffSeg);
+    PCCPUMSELREGHID pSrcHid = iemSRegGetHid(pVCpu, iEffSeg);
     uint64_t        uBaseAddr;
-    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pIemCpu, pSrcHid, iEffSeg, &uBaseAddr);
+    VBOXSTRICTRC rcStrict = iemMemSegCheckReadAccessEx(pVCpu, pSrcHid, iEffSeg, &uBaseAddr);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -1112 +1101 @@
         if (   cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
             && cbIncr > 0    /** @todo Implement reverse direction string ops. */
-            && (   IS_64_BIT_CODE(pIemCpu)
+            && (   IS_64_BIT_CODE(pVCpu)
                 || (   uAddrReg < pSrcHid->u32Limit
                     && uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pSrcHid->u32Limit)
@@ -1119 +1108 @@
         {
             RTGCPHYS GCPhysMem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtAddr, IEM_ACCESS_DATA_R, &GCPhysMem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, IEM_ACCESS_DATA_R, &GCPhysMem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -1129 +1118 @@
             PGMPAGEMAPLOCK PgLockMem;
             OP_TYPE const *puMem;
-            rcStrict = iemMemPageMap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
+            rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -1140 +1129 @@
                 pCtx->ADDR_rCX = uCounterReg -= cLeftPage;
                 pCtx->ADDR_rSI = uAddrReg    += cLeftPage * cbIncr;
-                iemMemPageUnmap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
+                iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
 
                 if (uCounterReg == 0)
@@ -1149 +1138 @@
                 if (!(uVirtAddr & (OP_SIZE - 1)))
                 {
-                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
                     continue;
                 }
@@ -1164 +1153 @@
         {
             OP_TYPE uTmpValue;
-            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uTmpValue, iEffSeg, uAddrReg);
+            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uTmpValue, iEffSeg, uAddrReg);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -1175 +1164 @@
             pCtx->ADDR_rCX = --uCounterReg;
             cLeftPage--;
-            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uCounterReg == 0);
+            IEM_CHECK_FF_CPU_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
         } while ((int32_t)cLeftPage > 0);
 
@@ -1186 +1175 @@
         if (uCounterReg == 0)
             break;
-        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
     }
 
@@ -1192 +1181 @@
      * Done.
      */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -1204 +1193 @@
 IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_ins_op,OP_SIZE,_addr,ADDR_SIZE), bool, fIoChecked)
 {
-    PVM             pVM  = IEMCPU_TO_VM(pIemCpu);
-    PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PVM             pVM  = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     VBOXSTRICTRC    rcStrict;
 
@@ -1211 +1200 @@
      * Be careful with handle bypassing.
      */
-    if (pIemCpu->fBypassHandlers)
+    if (pVCpu->iem.s.fBypassHandlers)
     {
         Log(("%s: declining because we're bypassing handlers\n", __FUNCTION__));
@@ -1224 +1213 @@
     if (!fIoChecked)
     {
-        rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, pCtx->dx, OP_SIZE / 8);
+        rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, pCtx->dx, OP_SIZE / 8);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -1230 +1219 @@
 
     OP_TYPE        *puMem;
-    rcStrict = iemMemMap(pIemCpu, (void **)&puMem, OP_SIZE / 8, X86_SREG_ES, pCtx->ADDR_rDI, IEM_ACCESS_DATA_W);
+    rcStrict = iemMemMap(pVCpu, (void **)&puMem, OP_SIZE / 8, X86_SREG_ES, pCtx->ADDR_rDI, IEM_ACCESS_DATA_W);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
     uint32_t        u32Value = 0;
-    if (!IEM_VERIFICATION_ENABLED(pIemCpu))
-        rcStrict = IOMIOPortRead(pVM, IEMCPU_TO_VMCPU(pIemCpu), pCtx->dx, &u32Value, OP_SIZE / 8);
+    if (!IEM_VERIFICATION_ENABLED(pVCpu))
+        rcStrict = IOMIOPortRead(pVM, pVCpu, pCtx->dx, &u32Value, OP_SIZE / 8);
     else
-        rcStrict = iemVerifyFakeIOPortRead(pIemCpu, pCtx->dx, &u32Value, OP_SIZE / 8);
+        rcStrict = iemVerifyFakeIOPortRead(pVCpu, pCtx->dx, &u32Value, OP_SIZE / 8);
     if (IOM_SUCCESS(rcStrict))
     {
         *puMem = (OP_TYPE)u32Value;
 # ifdef IN_RING3
-        VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pIemCpu, puMem, IEM_ACCESS_DATA_W);
+        VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pVCpu, puMem, IEM_ACCESS_DATA_W);
 # else
-        VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pIemCpu, puMem, IEM_ACCESS_DATA_W);
+        VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pVCpu, puMem, IEM_ACCESS_DATA_W);
 # endif
         if (RT_LIKELY(rcStrict2 == VINF_SUCCESS))
@@ -1253 +1242 @@
             else
                 pCtx->ADDR_rDI -= OP_SIZE / 8;
-            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         }
         else
@@ -1267 +1256 @@
 IEM_CIMPL_DEF_1(RT_CONCAT4(iemCImpl_rep_ins_op,OP_SIZE,_addr,ADDR_SIZE), bool, fIoChecked)
 {
-    PVM         pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU      pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX    pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PVM         pVM   = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX    pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -1278 +1266 @@
     if (!fIoChecked)
     {
-        rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, OP_SIZE / 8);
+        rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, OP_SIZE / 8);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -1286 +1274 @@
     if (uCounterReg == 0)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
 
     uint64_t        uBaseAddr;
-    rcStrict = iemMemSegCheckWriteAccessEx(pIemCpu, iemSRegUpdateHid(pIemCpu, &pCtx->es), X86_SREG_ES, &uBaseAddr);
+    rcStrict = iemMemSegCheckWriteAccessEx(pVCpu, iemSRegUpdateHid(pVCpu, &pCtx->es), X86_SREG_ES, &uBaseAddr);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -1301 +1289 @@
      * Be careful with handle bypassing.
      */
-    if (pIemCpu->fBypassHandlers)
+    if (pVCpu->iem.s.fBypassHandlers)
     {
         Log(("%s: declining because we're bypassing handlers\n", __FUNCTION__));
@@ -1321 +1309 @@
         if (   cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
             && cbIncr > 0    /** @todo Implement reverse direction string ops. */
-            && (   IS_64_BIT_CODE(pIemCpu)
+            && (   IS_64_BIT_CODE(pVCpu)
                 || (   uAddrReg < pCtx->es.u32Limit
                     && uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pCtx->es.u32Limit)
                )
-            && !IEM_VERIFICATION_ENABLED(pIemCpu)
+            && !IEM_VERIFICATION_ENABLED(pVCpu)
            )
         {
             RTGCPHYS GCPhysMem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtAddr, IEM_ACCESS_DATA_W, &GCPhysMem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, IEM_ACCESS_DATA_W, &GCPhysMem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -1339 +1327 @@
             PGMPAGEMAPLOCK PgLockMem;
             OP_TYPE *puMem;
-            rcStrict = iemMemPageMap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_W, (void **)&puMem, &PgLockMem);
+            rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_W, (void **)&puMem, &PgLockMem);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -1351 +1339 @@
                 puMem += cActualTransfers;
 
-                iemMemPageUnmap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_W, puMem, &PgLockMem);
+                iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_W, puMem, &PgLockMem);
 
                 if (rcStrict != VINF_SUCCESS)
@@ -1357 +1345 @@
                     if (IOM_SUCCESS(rcStrict))
                     {
-                        rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                        rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                         if (uCounterReg == 0)
-                            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+                            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
                     }
                     return rcStrict;
@@ -1370 +1358 @@
                 if (!(uVirtAddr & (OP_SIZE - 1)))
                 {
-                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
                     continue;
                 }
@@ -1390 +1378 @@
         {
             OP_TYPE *puMem;
-            rcStrict = iemMemMap(pIemCpu, (void **)&puMem, OP_SIZE / 8, X86_SREG_ES, uAddrReg, IEM_ACCESS_DATA_W);
+            rcStrict = iemMemMap(pVCpu, (void **)&puMem, OP_SIZE / 8, X86_SREG_ES, uAddrReg, IEM_ACCESS_DATA_W);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
 
             uint32_t u32Value = 0;
-            if (!IEM_VERIFICATION_ENABLED(pIemCpu))
+            if (!IEM_VERIFICATION_ENABLED(pVCpu))
                 rcStrict = IOMIOPortRead(pVM, pVCpu, u16Port, &u32Value, OP_SIZE / 8);
             else
-                rcStrict = iemVerifyFakeIOPortRead(pIemCpu, u16Port, &u32Value, OP_SIZE / 8);
+                rcStrict = iemVerifyFakeIOPortRead(pVCpu, u16Port, &u32Value, OP_SIZE / 8);
             if (!IOM_SUCCESS(rcStrict))
                 return rcStrict;
@@ -1404 +1392 @@
             *puMem = (OP_TYPE)u32Value;
 # ifdef IN_RING3
-            VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pIemCpu, puMem, IEM_ACCESS_DATA_W);
+            VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pVCpu, puMem, IEM_ACCESS_DATA_W);
 # else
-            VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pIemCpu, puMem, IEM_ACCESS_DATA_W);
+            VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pVCpu, puMem, IEM_ACCESS_DATA_W);
 # endif
             if (rcStrict2 == VINF_SUCCESS)
@@ -1421 +1409 @@
             {
                 if (uCounterReg == 0)
-                    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
-                rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
+                rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                 return rcStrict;
             }
 
-            IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uCounterReg == 0);
+            IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
         } while ((int32_t)cLeftPage > 0);
 
@@ -1435 +1423 @@
         if (uCounterReg == 0)
             break;
-        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
     }
 
@@ -1441 +1429 @@
      * Done.
      */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }
@@ -1451 +1439 @@
 IEM_CIMPL_DEF_2(RT_CONCAT4(iemCImpl_outs_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg, bool, fIoChecked)
 {
-    PVM             pVM  = IEMCPU_TO_VM(pIemCpu);
-    PCPUMCTX        pCtx = pIemCpu->CTX_SUFF(pCtx);
+    PVM             pVM  = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX        pCtx = pVCpu->iem.s.CTX_SUFF(pCtx);
     VBOXSTRICTRC    rcStrict;
 
@@ -1462 +1450 @@
     if (!fIoChecked)
     {
-        rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, pCtx->dx, OP_SIZE / 8);
+        rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, pCtx->dx, OP_SIZE / 8);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -1468 +1456 @@
 
     OP_TYPE uValue;
-    rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uValue, iEffSeg, pCtx->ADDR_rSI);
+    rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue, iEffSeg, pCtx->ADDR_rSI);
     if (rcStrict == VINF_SUCCESS)
     {
-        if (!IEM_VERIFICATION_ENABLED(pIemCpu))
-            rcStrict = IOMIOPortWrite(pVM, IEMCPU_TO_VMCPU(pIemCpu), pCtx->dx, uValue, OP_SIZE / 8);
+        if (!IEM_VERIFICATION_ENABLED(pVCpu))
+            rcStrict = IOMIOPortWrite(pVM, pVCpu, pCtx->dx, uValue, OP_SIZE / 8);
         else
-            rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, pCtx->dx, uValue, OP_SIZE / 8);
+            rcStrict = iemVerifyFakeIOPortWrite(pVCpu, pCtx->dx, uValue, OP_SIZE / 8);
         if (IOM_SUCCESS(rcStrict))
         {
@@ -1481 +1469 @@
             else
                 pCtx->ADDR_rSI -= OP_SIZE / 8;
-            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
-            if (rcStrict != VINF_SUCCESS)
-                rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
+            if (rcStrict != VINF_SUCCESS)
+                rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
         }
     }
@@ -1495 +1483 @@
 IEM_CIMPL_DEF_2(RT_CONCAT4(iemCImpl_rep_outs_op,OP_SIZE,_addr,ADDR_SIZE), uint8_t, iEffSeg, bool, fIoChecked)
 {
-    PVM         pVM   = IEMCPU_TO_VM(pIemCpu);
-    PVMCPU      pVCpu = IEMCPU_TO_VMCPU(pIemCpu);
-    PCPUMCTX    pCtx  = pIemCpu->CTX_SUFF(pCtx);
+    PVM         pVM   = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX    pCtx  = pVCpu->iem.s.CTX_SUFF(pCtx);
 
     /*
@@ -1506 +1493 @@
     if (!fIoChecked)
     {
-        rcStrict = iemHlpCheckPortIOPermission(pIemCpu, pCtx, u16Port, OP_SIZE / 8);
+        rcStrict = iemHlpCheckPortIOPermission(pVCpu, pCtx, u16Port, OP_SIZE / 8);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -1514 +1501 @@
     if (uCounterReg == 0)
     {
-        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
         return VINF_SUCCESS;
     }
 
-    PCCPUMSELREGHID pHid = iemSRegGetHid(pIemCpu, iEffSeg);
+    PCCPUMSELREGHID pHid = iemSRegGetHid(pVCpu, iEffSeg);
     uint64_t        uBaseAddr;
-    rcStrict = iemMemSegCheckReadAccessEx(pIemCpu, pHid, iEffSeg, &uBaseAddr);
+    rcStrict = iemMemSegCheckReadAccessEx(pVCpu, pHid, iEffSeg, &uBaseAddr);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -1541 +1528 @@
         if (   cLeftPage > 0 /* can be null if unaligned, do one fallback round. */
             && cbIncr > 0    /** @todo Implement reverse direction string ops. */
-            && (   IS_64_BIT_CODE(pIemCpu)
+            && (   IS_64_BIT_CODE(pVCpu)
                 || (   uAddrReg < pHid->u32Limit
                     && uAddrReg + (cLeftPage * (OP_SIZE / 8)) <= pHid->u32Limit)
                )
-            && !IEM_VERIFICATION_ENABLED(pIemCpu)
+            && !IEM_VERIFICATION_ENABLED(pVCpu)
            )
         {
             RTGCPHYS GCPhysMem;
-            rcStrict = iemMemPageTranslateAndCheckAccess(pIemCpu, uVirtAddr, IEM_ACCESS_DATA_R, &GCPhysMem);
+            rcStrict = iemMemPageTranslateAndCheckAccess(pVCpu, uVirtAddr, IEM_ACCESS_DATA_R, &GCPhysMem);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -1559 +1546 @@
             PGMPAGEMAPLOCK PgLockMem;
             OP_TYPE const *puMem;
-            rcStrict = iemMemPageMap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
+            rcStrict = iemMemPageMap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, (void **)&puMem, &PgLockMem);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -1571 +1558 @@
                 puMem += cActualTransfers;
 
-                iemMemPageUnmap(pIemCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
+                iemMemPageUnmap(pVCpu, GCPhysMem, IEM_ACCESS_DATA_R, puMem, &PgLockMem);
 
                 if (rcStrict != VINF_SUCCESS)
@@ -1577 +1564 @@
                     if (IOM_SUCCESS(rcStrict))
                     {
-                        rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                        rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                         if (uCounterReg == 0)
-                            iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+                            iemRegAddToRipAndClearRF(pVCpu, cbInstr);
                     }
                     return rcStrict;
@@ -1591 +1578 @@
                 if (!(uVirtAddr & (OP_SIZE - 1)))
                 {
-                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+                    IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
                     continue;
                 }
@@ -1611 +1598 @@
         {
             OP_TYPE uValue;
-            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pIemCpu, &uValue, iEffSeg, uAddrReg);
-            if (rcStrict != VINF_SUCCESS)
-                return rcStrict;
-
-            if (!IEM_VERIFICATION_ENABLED(pIemCpu))
+            rcStrict = RT_CONCAT(iemMemFetchDataU,OP_SIZE)(pVCpu, &uValue, iEffSeg, uAddrReg);
+            if (rcStrict != VINF_SUCCESS)
+                return rcStrict;
+
+            if (!IEM_VERIFICATION_ENABLED(pVCpu))
                 rcStrict = IOMIOPortWrite(pVM, pVCpu, u16Port, uValue, OP_SIZE / 8);
             else
-                rcStrict = iemVerifyFakeIOPortWrite(pIemCpu, u16Port, uValue, OP_SIZE / 8);
+                rcStrict = iemVerifyFakeIOPortWrite(pVCpu, u16Port, uValue, OP_SIZE / 8);
             if (IOM_SUCCESS(rcStrict))
             {
@@ -1630 +1617 @@
                 {
                     if (uCounterReg == 0)
-                        iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
-                    rcStrict = iemSetPassUpStatus(pIemCpu, rcStrict);
+                        iemRegAddToRipAndClearRF(pVCpu, cbInstr);
+                    rcStrict = iemSetPassUpStatus(pVCpu, rcStrict);
                 }
                 return rcStrict;
             }
-            IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, uCounterReg == 0);
+            IEM_CHECK_FF_HIGH_PRIORITY_POST_REPSTR_MAYBE_RETURN(pVM, pVCpu, uCounterReg == 0);
         } while ((int32_t)cLeftPage > 0);
 
@@ -1644 +1631 @@
         if (uCounterReg == 0)
             break;
-        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pIemCpu, pCtx->eflags.u);
+        IEM_CHECK_FF_YIELD_REPSTR_MAYBE_RETURN(pVM, pVCpu, pCtx->eflags.u);
     }
 
@@ -1650 +1637 @@
      * Done.
      */
-    iemRegAddToRipAndClearRF(pIemCpu, cbInstr);
+    iemRegAddToRipAndClearRF(pVCpu, cbInstr);
     return VINF_SUCCESS;
 }

trunk/src/VBox/VMM/VMMAll/IEMAllInstructions.cpp.h

@@ -45 +45 @@
         IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-        IEM_MC_FETCH_GREG_U8(u8Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_FETCH_GREG_U8(u8Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_REF_EFLAGS(pEFlags);
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, u8Src, pEFlags);
@@ -68 +68 @@
 
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_MEM_MAP(pu8Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-        IEM_MC_FETCH_GREG_U8(u8Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+        IEM_MC_MEM_MAP(pu8Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_FETCH_GREG_U8(u8Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
         IEM_MC_FETCH_EFLAGS(EFlags);
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
             IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, u8Src, pEFlags);
         else
@@ -102 +102 @@
         IEMOP_HLP_NO_LOCK_PREFIX();
 
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -110 +110 @@
                 IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
@@ -125 +125 @@
                 IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
@@ -142 +142 @@
                 IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
@@ -160 +160 @@
          */
         uint32_t const fAccess = pImpl->pfnLockedU8 ? IEM_ACCESS_DATA_RW : IEM_ACCESS_DATA_R /* CMP,TEST */;
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -170 +170 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu16Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu16Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
                 else
@@ -192 +192 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu32Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu32Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
                 else
@@ -214 +214 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu64Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu64Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
                 else
@@ -254 +254 @@
         IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-        IEM_MC_FETCH_GREG_U8(u8Src, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-        IEM_MC_REF_GREG_U8(pu8Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+        IEM_MC_FETCH_GREG_U8(u8Src, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+        IEM_MC_REF_GREG_U8(pu8Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
         IEM_MC_REF_EFLAGS(pEFlags);
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, u8Src, pEFlags);
@@ -274 +274 @@
 
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_FETCH_MEM_U8(u8Src, pIemCpu->iEffSeg, GCPtrEffDst);
-        IEM_MC_REF_GREG_U8(pu8Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+        IEM_MC_FETCH_MEM_U8(u8Src, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+        IEM_MC_REF_GREG_U8(pu8Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
         IEM_MC_REF_EFLAGS(pEFlags);
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, u8Src, pEFlags);
@@ -302 +302 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -310 +310 @@
                 IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-                IEM_MC_FETCH_GREG_U16(u16Src, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_REF_GREG_U16(pu16Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U16(u16Src, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
@@ -325 +325 @@
                 IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-                IEM_MC_FETCH_GREG_U32(u32Src, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_REF_GREG_U32(pu32Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U32(u32Src, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_REF_GREG_U32(pu32Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
@@ -341 +341 @@
                 IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-                IEM_MC_FETCH_GREG_U64(u64Src, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_REF_GREG_U64(pu64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U64(u64Src, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
@@ -356 +356 @@
          * We're accessing memory.
          */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -366 +366 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U16(u16Src, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_REF_GREG_U16(pu16Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_MEM_U16(u16Src, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_REF_GREG_U16(pu16Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
@@ -383 +383 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U32(u32Src, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_REF_GREG_U32(pu32Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_MEM_U32(u32Src, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_REF_GREG_U32(pu32Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
@@ -401 +401 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U64(u64Src, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_REF_GREG_U64(pu64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_MEM_U64(u64Src, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_REF_GREG_U64(pu64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
@@ -449 +449 @@
 FNIEMOP_DEF_1(iemOpHlpBinaryOperator_rAX_Iz, PCIEMOPBINSIZES, pImpl)
 {
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -555 +555 @@
     {
         IEMOP_HLP_DECODED_NL_1(OP_SLDT, IEMOPFORM_M_REG, OP_PARM_Ew, DISOPTYPE_DANGEROUS | DISOPTYPE_PRIVILEGED_NOTRAP);
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -561 +561 @@
                 IEM_MC_LOCAL(uint16_t, u16Ldtr);
                 IEM_MC_FETCH_LDTR_U16(u16Ldtr);
-                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u16Ldtr);
+                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u16Ldtr);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -570 +570 @@
                 IEM_MC_LOCAL(uint32_t, u32Ldtr);
                 IEM_MC_FETCH_LDTR_U32(u32Ldtr);
-                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u32Ldtr);
+                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Ldtr);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -579 +579 @@
                 IEM_MC_LOCAL(uint64_t, u64Ldtr);
                 IEM_MC_FETCH_LDTR_U64(u64Ldtr);
-                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u64Ldtr);
+                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Ldtr);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -595 +595 @@
         IEMOP_HLP_DECODED_NL_1(OP_SLDT, IEMOPFORM_M_MEM, OP_PARM_Ew, DISOPTYPE_DANGEROUS | DISOPTYPE_PRIVILEGED_NOTRAP);
         IEM_MC_FETCH_LDTR_U16(u16Ldtr);
-        IEM_MC_STORE_MEM_U16(pIemCpu->iEffSeg, GCPtrEffDst, u16Ldtr);
+        IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u16Ldtr);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -613 +613 @@
     {
         IEMOP_HLP_DECODED_NL_1(OP_STR, IEMOPFORM_M_REG, OP_PARM_Ew, DISOPTYPE_DANGEROUS | DISOPTYPE_PRIVILEGED_NOTRAP);
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -619 +619 @@
                 IEM_MC_LOCAL(uint16_t, u16Tr);
                 IEM_MC_FETCH_TR_U16(u16Tr);
-                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u16Tr);
+                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u16Tr);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -628 +628 @@
                 IEM_MC_LOCAL(uint32_t, u32Tr);
                 IEM_MC_FETCH_TR_U32(u32Tr);
-                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u32Tr);
+                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Tr);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -637 +637 @@
                 IEM_MC_LOCAL(uint64_t, u64Tr);
                 IEM_MC_FETCH_TR_U64(u64Tr);
-                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u64Tr);
+                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Tr);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -653 +653 @@
         IEMOP_HLP_DECODED_NL_1(OP_STR, IEMOPFORM_M_MEM, OP_PARM_Ew, DISOPTYPE_DANGEROUS | DISOPTYPE_PRIVILEGED_NOTRAP);
         IEM_MC_FETCH_TR_U16(u16Tr);
-        IEM_MC_STORE_MEM_U16(pIemCpu->iEffSeg, GCPtrEffDst, u16Tr);
+        IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u16Tr);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -673 +673 @@
         IEM_MC_BEGIN(1, 0);
         IEM_MC_ARG(uint16_t, u16Sel, 0);
-        IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_CALL_CIMPL_1(iemCImpl_lldt, u16Sel);
         IEM_MC_END();
@@ -685 +685 @@
         IEMOP_HLP_DECODED_NL_1(OP_LLDT, IEMOPFORM_M_MEM, OP_PARM_Ew, DISOPTYPE_DANGEROUS);
         IEM_MC_RAISE_GP0_IF_CPL_NOT_ZERO(); /** @todo test order */
-        IEM_MC_FETCH_MEM_U16(u16Sel, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FETCH_MEM_U16(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
         IEM_MC_CALL_CIMPL_1(iemCImpl_lldt, u16Sel);
         IEM_MC_END();
@@ -705 +705 @@
         IEM_MC_BEGIN(1, 0);
         IEM_MC_ARG(uint16_t, u16Sel, 0);
-        IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_CALL_CIMPL_1(iemCImpl_ltr, u16Sel);
         IEM_MC_END();
@@ -717 +717 @@
         IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
         IEM_MC_RAISE_GP0_IF_CPL_NOT_ZERO(); /** @todo test ordre */
-        IEM_MC_FETCH_MEM_U16(u16Sel, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FETCH_MEM_U16(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
         IEM_MC_CALL_CIMPL_1(iemCImpl_ltr, u16Sel);
         IEM_MC_END();
@@ -737 +737 @@
         IEM_MC_ARG(uint16_t,    u16Sel,            0);
         IEM_MC_ARG_CONST(bool,  fWriteArg, fWrite, 1);
-        IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_CALL_CIMPL_2(iemCImpl_VerX, u16Sel, fWriteArg);
         IEM_MC_END();
@@ -749 +749 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
         IEMOP_HLP_DECODED_NL_1(fWrite ? OP_VERW : OP_VERR, IEMOPFORM_M_MEM, OP_PARM_Ew, DISOPTYPE_DANGEROUS | DISOPTYPE_PRIVILEGED_NOTRAP);
-        IEM_MC_FETCH_MEM_U16(u16Sel, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FETCH_MEM_U16(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
         IEM_MC_CALL_CIMPL_2(iemCImpl_VerX, u16Sel, fWriteArg);
         IEM_MC_END();
@@ -809 +809 @@
     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_2(iemCImpl_sgdt, iEffSeg, GCPtrEffSrc);
     IEM_MC_END();
@@ -859 +859 @@
     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_2(iemCImpl_sidt, iEffSeg, GCPtrEffSrc);
     IEM_MC_END();
@@ -871 +871 @@
     IEMOP_MNEMONIC("monitor");
     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); /** @todo Verify that monitor is allergic to lock prefixes. */
-    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_monitor, pIemCpu->iEffSeg);
+    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_monitor, pVCpu->iem.s.iEffSeg);
 }
 
@@ -892 +892 @@
     IEM_MC_ARG(uint8_t,         iEffSeg,                                    0);
     IEM_MC_ARG(RTGCPTR,         GCPtrEffSrc,                                1);
-    IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSizeArg,/*=*/pIemCpu->enmEffOpSize, 2);
+    IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSizeArg,/*=*/pVCpu->iem.s.enmEffOpSize, 2);
     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_3(iemCImpl_lgdt, iEffSeg, GCPtrEffSrc, enmEffOpSizeArg);
     IEM_MC_END();
@@ -906 +906 @@
 {
     IEMOP_MNEMONIC("xgetbv");
-    if (IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fXSaveRstor)
+    if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
     {
         IEMOP_HLP_DONE_DECODING_NO_LOCK_REPZ_OR_REPNZ_PREFIXES();
@@ -919 +919 @@
 {
     IEMOP_MNEMONIC("xsetbv");
-    if (IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fXSaveRstor)
+    if (IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fXSaveRstor)
     {
         IEMOP_HLP_DONE_DECODING_NO_LOCK_REPZ_OR_REPNZ_PREFIXES();
@@ -931 +931 @@
 FNIEMOP_DEF_1(iemOp_Grp7_lidt, uint8_t, bRm)
 {
-    IEMMODE enmEffOpSize = pIemCpu->enmCpuMode == IEMMODE_64BIT
+    IEMMODE enmEffOpSize = pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT
                          ? IEMMODE_64BIT
-                         : pIemCpu->enmEffOpSize;
+                         : pVCpu->iem.s.enmEffOpSize;
     IEM_MC_BEGIN(3, 1);
     IEM_MC_ARG(uint8_t,         iEffSeg,                            0);
@@ -940 +940 @@
     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_3(iemCImpl_lidt, iEffSeg, GCPtrEffSrc, enmEffOpSizeArg);
     IEM_MC_END();
@@ -979 +979 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -985 +985 @@
                 IEM_MC_LOCAL(uint16_t, u16Tmp);
                 IEM_MC_FETCH_CR0_U16(u16Tmp);
-                if (IEM_GET_TARGET_CPU(pIemCpu) > IEMTARGETCPU_386)
+                if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
                 { /* likely */ }
-                else if (IEM_GET_TARGET_CPU(pIemCpu) >= IEMTARGETCPU_386)
+                else if (IEM_GET_TARGET_CPU(pVCpu) >= IEMTARGETCPU_386)
                     IEM_MC_OR_LOCAL_U16(u16Tmp, 0xffe0);
                 else
                     IEM_MC_OR_LOCAL_U16(u16Tmp, 0xfff0);
-                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u16Tmp);
+                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u16Tmp);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -1000 +1000 @@
                 IEM_MC_LOCAL(uint32_t, u32Tmp);
                 IEM_MC_FETCH_CR0_U32(u32Tmp);
-                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u32Tmp);
+                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Tmp);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -1009 +1009 @@
                 IEM_MC_LOCAL(uint64_t, u64Tmp);
                 IEM_MC_FETCH_CR0_U64(u64Tmp);
-                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u64Tmp);
+                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Tmp);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -1025 +1025 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_FETCH_CR0_U16(u16Tmp);
-        if (IEM_GET_TARGET_CPU(pIemCpu) > IEMTARGETCPU_386)
+        if (IEM_GET_TARGET_CPU(pVCpu) > IEMTARGETCPU_386)
         { /* likely */ }
-        else if (pIemCpu->uTargetCpu >= IEMTARGETCPU_386)
+        else if (pVCpu->iem.s.uTargetCpu >= IEMTARGETCPU_386)
             IEM_MC_OR_LOCAL_U16(u16Tmp, 0xffe0);
         else
             IEM_MC_OR_LOCAL_U16(u16Tmp, 0xfff0);
-        IEM_MC_STORE_MEM_U16(pIemCpu->iEffSeg, GCPtrEffDst, u16Tmp);
+        IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u16Tmp);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -1051 +1051 @@
         IEM_MC_BEGIN(1, 0);
         IEM_MC_ARG(uint16_t, u16Tmp, 0);
-        IEM_MC_FETCH_GREG_U16(u16Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_FETCH_GREG_U16(u16Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_CALL_CIMPL_1(iemCImpl_lmsw, u16Tmp);
         IEM_MC_END();
@@ -1061 +1061 @@
         IEM_MC_LOCAL(RTGCPTR,  GCPtrEffDst);
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_FETCH_MEM_U16(u16Tmp, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FETCH_MEM_U16(u16Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
         IEM_MC_CALL_CIMPL_1(iemCImpl_lmsw, u16Tmp);
         IEM_MC_END();
@@ -1097 +1097 @@
 FNIEMOP_DEF(iemOp_Grp7_rdtscp)
 {
-    NOREF(pIemCpu);
+    NOREF(pVCpu);
     IEMOP_BITCH_ABOUT_STUB();
     return VERR_IEM_INSTR_NOT_IMPLEMENTED;
@@ -1189 +1189 @@
     {
         IEMOP_HLP_DECODED_NL_2(fIsLar ? OP_LAR : OP_LSL, IEMOPFORM_RM_REG, OP_PARM_Gv, OP_PARM_Ew, DISOPTYPE_DANGEROUS | DISOPTYPE_PRIVILEGED_NOTRAP);
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -1199 +1199 @@
                 IEM_MC_ARG_CONST(bool,  fIsLarArg, fIsLar, 3);
 
-                IEM_MC_REF_GREG_U16(pu16Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_CIMPL_4(iemCImpl_LarLsl_u16, pu16Dst, u16Sel, pEFlags, fIsLarArg);
@@ -1217 +1217 @@
                 IEM_MC_ARG_CONST(bool,  fIsLarArg, fIsLar, 3);
 
-                IEM_MC_REF_GREG_U64(pu64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_FETCH_GREG_U16(u16Sel, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_CIMPL_4(iemCImpl_LarLsl_u64, pu64Dst, u16Sel, pEFlags, fIsLarArg);
@@ -1231 +1231 @@
     else
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -1245 +1245 @@
                 IEMOP_HLP_DECODED_NL_2(fIsLar ? OP_LAR : OP_LSL, IEMOPFORM_RM_MEM, OP_PARM_Gv, OP_PARM_Ew, DISOPTYPE_DANGEROUS | DISOPTYPE_PRIVILEGED_NOTRAP);
 
-                IEM_MC_FETCH_MEM_U16(u16Sel, pIemCpu->iEffSeg, GCPtrEffSrc);
-                IEM_MC_REF_GREG_U16(pu16Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_MEM_U16(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+                IEM_MC_REF_GREG_U16(pu16Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_CIMPL_4(iemCImpl_LarLsl_u16, pu16Dst, u16Sel, pEFlags, fIsLarArg);
@@ -1268 +1268 @@
 /** @todo testcase: make sure it's a 16-bit read. */
 
-                IEM_MC_FETCH_MEM_U16(u16Sel, pIemCpu->iEffSeg, GCPtrEffSrc);
-                IEM_MC_REF_GREG_U64(pu64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_MEM_U16(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+                IEM_MC_REF_GREG_U64(pu64Dst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_CIMPL_4(iemCImpl_LarLsl_u64, pu64Dst, u16Sel, pEFlags, fIsLarArg);
@@ -1357 +1357 @@
 {
     /* AMD prefetch group, Intel implements this as NOP Ev (and so do we). */
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->f3DNowPrefetch)
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->f3DNowPrefetch)
     {
         IEMOP_MNEMONIC("GrpP");
@@ -1474 +1474 @@
 FNIEMOP_DEF(iemOp_3Dnow)
 {
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->f3DNow)
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->f3DNow)
     {
         IEMOP_MNEMONIC("3Dnow");
@@ -1522 +1522 @@
 {
     /* Quick hack. Need to restructure all of this later some time. */
-    uint32_t const fRelevantPrefix = pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ);
+    uint32_t const fRelevantPrefix = pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ);
     if (fRelevantPrefix == 0)
     {
@@ -1536 +1536 @@
             IEM_MC_MAYBE_RAISE_SSE_RELATED_XCPT();
             IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
-            IEM_MC_COPY_XREG_U128((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB,
-                                  ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+            IEM_MC_COPY_XREG_U128((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB,
+                                  ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -1555 +1555 @@
             IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ();
 
-            IEM_MC_FETCH_XREG_U128(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-            IEM_MC_STORE_MEM_U128(pIemCpu->iEffSeg, GCPtrEffSrc, uSrc);
+            IEM_MC_FETCH_XREG_U128(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+            IEM_MC_STORE_MEM_U128(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uSrc);
 
             IEM_MC_ADVANCE_RIP();
@@ -1577 +1577 @@
             IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
             IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
-            IEM_MC_FETCH_XREG_U64(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-            IEM_MC_STORE_XREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, uSrc);
+            IEM_MC_FETCH_XREG_U64(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+            IEM_MC_STORE_XREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, uSrc);
 
             IEM_MC_ADVANCE_RIP();
@@ -1597 +1597 @@
             IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ();
 
-            IEM_MC_FETCH_XREG_U64(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-            IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrEffSrc, uSrc);
+            IEM_MC_FETCH_XREG_U64(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+            IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uSrc);
 
             IEM_MC_ADVANCE_RIP();
@@ -1621 +1621 @@
 {
     /* Quick hack. Need to restructure all of this later some time. */
-    if (pIemCpu->fPrefixes == IEM_OP_PRF_SIZE_OP)
+    if (pVCpu->iem.s.fPrefixes == IEM_OP_PRF_SIZE_OP)
     {
         IEMOP_MNEMONIC("movlpd Mq,Vq");
@@ -1636 +1636 @@
             IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
             IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
-            IEM_MC_FETCH_XREG_U64(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-            IEM_MC_STORE_XREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, uSrc);
+            IEM_MC_FETCH_XREG_U64(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+            IEM_MC_STORE_XREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, uSrc);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -1658 +1658 @@
             IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ();
 
-            IEM_MC_FETCH_XREG_U64(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-            IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrEffSrc, uSrc);
+            IEM_MC_FETCH_XREG_U64(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+            IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uSrc);
 
             IEM_MC_ADVANCE_RIP();
@@ -1745 +1745 @@
     IEMOP_MNEMONIC("mov Rd,Cd");
     IEMOP_HLP_MIN_386();
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-        pIemCpu->enmEffOpSize = pIemCpu->enmDefOpSize = IEMMODE_64BIT;
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+        pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.enmDefOpSize = IEMMODE_64BIT;
     else
-        pIemCpu->enmEffOpSize = pIemCpu->enmDefOpSize = IEMMODE_32BIT;
+        pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.enmDefOpSize = IEMMODE_32BIT;
 
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    uint8_t iCrReg = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg;
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_LOCK)
+    uint8_t iCrReg = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg;
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK)
     {
         /* The lock prefix can be used to encode CR8 accesses on some CPUs. */
-        if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMovCr8In32Bit)
+        if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMovCr8In32Bit)
             return IEMOP_RAISE_INVALID_OPCODE(); /* #UD takes precedence over #GP(), see test. */
         iCrReg |= 8;
@@ -1768 +1768 @@
     IEMOP_HLP_DONE_DECODING();
 
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_mov_Rd_Cd, (X86_MODRM_RM_MASK & bRm) | pIemCpu->uRexB, iCrReg);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_mov_Rd_Cd, (X86_MODRM_RM_MASK & bRm) | pVCpu->iem.s.uRexB, iCrReg);
 }
 
@@ -1779 +1779 @@
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REX_R)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REX_R)
         return IEMOP_RAISE_INVALID_OPCODE();
     return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_mov_Rd_Dd,
-                                   (X86_MODRM_RM_MASK & bRm) | pIemCpu->uRexB,
+                                   (X86_MODRM_RM_MASK & bRm) | pVCpu->iem.s.uRexB,
                                    ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK));
 }
@@ -1793 +1793 @@
     IEMOP_MNEMONIC("mov Cd,Rd");
     IEMOP_HLP_MIN_386();
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-        pIemCpu->enmEffOpSize = pIemCpu->enmDefOpSize = IEMMODE_64BIT;
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+        pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.enmDefOpSize = IEMMODE_64BIT;
     else
-        pIemCpu->enmEffOpSize = pIemCpu->enmDefOpSize = IEMMODE_32BIT;
+        pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.enmDefOpSize = IEMMODE_32BIT;
 
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    uint8_t iCrReg = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg;
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_LOCK)
+    uint8_t iCrReg = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg;
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK)
     {
         /* The lock prefix can be used to encode CR8 accesses on some CPUs. */
-        if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fMovCr8In32Bit)
+        if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fMovCr8In32Bit)
             return IEMOP_RAISE_INVALID_OPCODE(); /* #UD takes precedence over #GP(), see test. */
         iCrReg |= 8;
@@ -1816 +1816 @@
     IEMOP_HLP_DONE_DECODING();
 
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_mov_Cd_Rd, iCrReg, (X86_MODRM_RM_MASK & bRm) | pIemCpu->uRexB);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_mov_Cd_Rd, iCrReg, (X86_MODRM_RM_MASK & bRm) | pVCpu->iem.s.uRexB);
 }
 
@@ -1827 +1827 @@
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REX_R)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REX_R)
         return IEMOP_RAISE_INVALID_OPCODE();
     return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_mov_Dd_Rd,
                                    ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK),
-                                   (X86_MODRM_RM_MASK & bRm) | pIemCpu->uRexB);
+                                   (X86_MODRM_RM_MASK & bRm) | pVCpu->iem.s.uRexB);
 }
 
@@ -1858 +1858 @@
 FNIEMOP_DEF(iemOp_movaps_Vps_Wps__movapd_Vpd_Wpd)
 {
-    IEMOP_MNEMONIC(!(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP) ? "movaps r,mr" : "movapd r,mr");
+    IEMOP_MNEMONIC(!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP) ? "movaps r,mr" : "movapd r,mr");
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
@@ -1867 +1867 @@
         IEMOP_HLP_DONE_DECODING_NO_LOCK_REPZ_OR_REPNZ_PREFIXES();
         IEM_MC_BEGIN(0, 0);
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP))
             IEM_MC_MAYBE_RAISE_SSE_RELATED_XCPT();
         else
             IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
         IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
-        IEM_MC_COPY_XREG_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg,
-                              (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_COPY_XREG_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg,
+                              (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -1888 +1888 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
         IEMOP_HLP_DONE_DECODING_NO_LOCK_REPZ_OR_REPNZ_PREFIXES(); /** @todo check if this is delayed this long for REPZ/NZ */
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP))
             IEM_MC_MAYBE_RAISE_SSE_RELATED_XCPT();
         else
@@ -1894 +1894 @@
         IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
 
-        IEM_MC_FETCH_MEM_U128_ALIGN_SSE(uSrc, pIemCpu->iEffSeg, GCPtrEffSrc);
-        IEM_MC_STORE_XREG_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, uSrc);
+        IEM_MC_FETCH_MEM_U128_ALIGN_SSE(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+        IEM_MC_STORE_XREG_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, uSrc);
 
         IEM_MC_ADVANCE_RIP();
@@ -1907 +1907 @@
 FNIEMOP_DEF(iemOp_movaps_Wps_Vps__movapd_Wpd_Vpd)
 {
-    IEMOP_MNEMONIC(!(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP) ? "movaps mr,r" : "movapd mr,r");
+    IEMOP_MNEMONIC(!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP) ? "movaps mr,r" : "movapd mr,r");
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
@@ -1916 +1916 @@
         IEMOP_HLP_DONE_DECODING_NO_LOCK_REPZ_OR_REPNZ_PREFIXES();
         IEM_MC_BEGIN(0, 0);
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP))
             IEM_MC_MAYBE_RAISE_SSE_RELATED_XCPT();
         else
             IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
         IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
-        IEM_MC_COPY_XREG_U128((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB,
-                              ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+        IEM_MC_COPY_XREG_U128((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB,
+                              ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -1937 +1937 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
         IEMOP_HLP_DONE_DECODING_NO_LOCK_REPZ_OR_REPNZ_PREFIXES(); /** @todo check if this is delayed this long for REPZ/NZ */
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP))
             IEM_MC_MAYBE_RAISE_SSE_RELATED_XCPT();
         else
@@ -1943 +1943 @@
         IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ();
 
-        IEM_MC_FETCH_XREG_U128(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-        IEM_MC_STORE_MEM_U128_ALIGN_SSE(pIemCpu->iEffSeg, GCPtrEffSrc, uSrc);
+        IEM_MC_FETCH_XREG_U128(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_STORE_MEM_U128_ALIGN_SSE(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uSrc);
 
         IEM_MC_ADVANCE_RIP();
@@ -1960 +1960 @@
 FNIEMOP_DEF(iemOp_movntps_Mps_Vps__movntpd_Mpd_Vpd)
 {
-    IEMOP_MNEMONIC(!(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP) ? "movntps mr,r" : "movntpd mr,r");
+    IEMOP_MNEMONIC(!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP) ? "movntps mr,r" : "movntpd mr,r");
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) != (3 << X86_MODRM_MOD_SHIFT))
@@ -1973 +1973 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
         IEMOP_HLP_DONE_DECODING_NO_LOCK_REPZ_OR_REPNZ_PREFIXES(); /** @todo check if this is delayed this long for REPZ/NZ */
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP))
             IEM_MC_MAYBE_RAISE_SSE_RELATED_XCPT();
         else
@@ -1979 +1979 @@
         IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
 
-        IEM_MC_FETCH_XREG_U128(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-        IEM_MC_STORE_MEM_U128_ALIGN_SSE(pIemCpu->iEffSeg, GCPtrEffSrc, uSrc);
+        IEM_MC_FETCH_XREG_U128(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_STORE_MEM_U128_ALIGN_SSE(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uSrc);
 
         IEM_MC_ADVANCE_RIP();
@@ -2055 +2055 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT)) \
     { \
-        switch (pIemCpu->enmEffOpSize) \
+        switch (pVCpu->iem.s.enmEffOpSize) \
         { \
             case IEMMODE_16BIT: \
@@ -2061 +2061 @@
                 IEM_MC_LOCAL(uint16_t, u16Tmp); \
                 a_Cnd { \
-                    IEM_MC_FETCH_GREG_U16(u16Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB); \
-                    IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Tmp); \
+                    IEM_MC_FETCH_GREG_U16(u16Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB); \
+                    IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Tmp); \
                 } IEM_MC_ENDIF(); \
                 IEM_MC_ADVANCE_RIP(); \
@@ -2072 +2072 @@
                 IEM_MC_LOCAL(uint32_t, u32Tmp); \
                 a_Cnd { \
-                    IEM_MC_FETCH_GREG_U32(u32Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB); \
-                    IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Tmp); \
+                    IEM_MC_FETCH_GREG_U32(u32Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB); \
+                    IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Tmp); \
                 } IEM_MC_ELSE() { \
-                    IEM_MC_CLEAR_HIGH_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg); \
+                    IEM_MC_CLEAR_HIGH_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg); \
                 } IEM_MC_ENDIF(); \
                 IEM_MC_ADVANCE_RIP(); \
@@ -2085 +2085 @@
                 IEM_MC_LOCAL(uint64_t, u64Tmp); \
                 a_Cnd { \
-                    IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB); \
-                    IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Tmp); \
+                    IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB); \
+                    IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Tmp); \
                 } IEM_MC_ENDIF(); \
                 IEM_MC_ADVANCE_RIP(); \
@@ -2097 +2097 @@
     else \
     { \
-        switch (pIemCpu->enmEffOpSize) \
+        switch (pVCpu->iem.s.enmEffOpSize) \
         { \
             case IEMMODE_16BIT: \
@@ -2104 +2104 @@
                 IEM_MC_LOCAL(uint16_t, u16Tmp); \
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0); \
-                IEM_MC_FETCH_MEM_U16(u16Tmp, pIemCpu->iEffSeg, GCPtrEffSrc); \
+                IEM_MC_FETCH_MEM_U16(u16Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc); \
                 a_Cnd { \
-                    IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Tmp); \
+                    IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Tmp); \
                 } IEM_MC_ENDIF(); \
                 IEM_MC_ADVANCE_RIP(); \
@@ -2117 +2117 @@
                 IEM_MC_LOCAL(uint32_t, u32Tmp); \
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0); \
-                IEM_MC_FETCH_MEM_U32(u32Tmp, pIemCpu->iEffSeg, GCPtrEffSrc); \
+                IEM_MC_FETCH_MEM_U32(u32Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc); \
                 a_Cnd { \
-                    IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Tmp); \
+                    IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Tmp); \
                 } IEM_MC_ELSE() { \
-                    IEM_MC_CLEAR_HIGH_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg); \
+                    IEM_MC_CLEAR_HIGH_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg); \
                 } IEM_MC_ENDIF(); \
                 IEM_MC_ADVANCE_RIP(); \
@@ -2132 +2132 @@
                 IEM_MC_LOCAL(uint64_t, u64Tmp); \
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0); \
-                IEM_MC_FETCH_MEM_U64(u64Tmp, pIemCpu->iEffSeg, GCPtrEffSrc); \
+                IEM_MC_FETCH_MEM_U64(u64Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc); \
                 a_Cnd { \
-                    IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Tmp); \
+                    IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Tmp); \
                 } IEM_MC_ENDIF(); \
                 IEM_MC_ADVANCE_RIP(); \
@@ -2323 +2323 @@
 {
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         case IEM_OP_PRF_SIZE_OP: /* SSE */
@@ -2337 +2337 @@
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
                 IEM_MC_PREPARE_SSE_USAGE();
-                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_XREG_U64_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_XREG_U64_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_CALL_SSE_AIMPL_2(pImpl->pfnU128, pDst, pSrc);
                 IEM_MC_ADVANCE_RIP();
@@ -2357 +2357 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
-                IEM_MC_FETCH_MEM_U64_ALIGN_U128(uSrc, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U64_ALIGN_U128(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
                 IEM_MC_PREPARE_SSE_USAGE();
-                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_CALL_SSE_AIMPL_2(pImpl->pfnU128, pDst, pSrc);
 
@@ -2404 +2404 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_MAYBE_RAISE_MMX_RELATED_XCPT();
-                IEM_MC_FETCH_MEM_U32(uSrc, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U32(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
                 IEM_MC_PREPARE_FPU_USAGE();
@@ -2471 +2471 @@
 {
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         case IEM_OP_PRF_SIZE_OP: /* SSE */
@@ -2485 +2485 @@
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
                 IEM_MC_PREPARE_SSE_USAGE();
-                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_XREG_U128_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_XREG_U128_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_CALL_SSE_AIMPL_2(pImpl->pfnU128, pDst, pSrc);
                 IEM_MC_ADVANCE_RIP();
@@ -2505 +2505 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
-                IEM_MC_FETCH_MEM_U128_ALIGN_SSE(uSrc, pIemCpu->iEffSeg, GCPtrEffSrc); /* Most CPUs probably only right high qword */
+                IEM_MC_FETCH_MEM_U128_ALIGN_SSE(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc); /* Most CPUs probably only right high qword */
 
                 IEM_MC_PREPARE_SSE_USAGE();
-                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_CALL_SSE_AIMPL_2(pImpl->pfnU128, pDst, pSrc);
 
@@ -2552 +2552 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_MAYBE_RAISE_MMX_RELATED_XCPT();
-                IEM_MC_FETCH_MEM_U64(uSrc, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U64(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
                 IEM_MC_PREPARE_FPU_USAGE();
@@ -2616 +2616 @@
 {
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         case IEM_OP_PRF_SIZE_OP: /* SSE */
@@ -2627 +2627 @@
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
                 IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
-                if (pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_REX_W)
+                if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_REX_W)
                 {
                     IEM_MC_LOCAL(uint64_t, u64Tmp);
-                    IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                    IEM_MC_STORE_XREG_U64_ZX_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Tmp);
+                    IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                    IEM_MC_STORE_XREG_U64_ZX_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Tmp);
                 }
                 else
                 {
                     IEM_MC_LOCAL(uint32_t, u32Tmp);
-                    IEM_MC_FETCH_GREG_U32(u32Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                    IEM_MC_STORE_XREG_U32_ZX_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Tmp);
+                    IEM_MC_FETCH_GREG_U32(u32Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                    IEM_MC_STORE_XREG_U32_ZX_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Tmp);
                 }
                 IEM_MC_ADVANCE_RIP();
@@ -2651 +2651 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
-                if (pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_REX_W)
+                if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_REX_W)
                 {
                     IEM_MC_LOCAL(uint64_t, u64Tmp);
-                    IEM_MC_FETCH_MEM_U64(u64Tmp, pIemCpu->iEffSeg, GCPtrEffSrc);
-                    IEM_MC_STORE_XREG_U64_ZX_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Tmp);
+                    IEM_MC_FETCH_MEM_U64(u64Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+                    IEM_MC_STORE_XREG_U64_ZX_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Tmp);
                 }
                 else
                 {
                     IEM_MC_LOCAL(uint32_t, u32Tmp);
-                    IEM_MC_FETCH_MEM_U32(u32Tmp, pIemCpu->iEffSeg, GCPtrEffSrc);
-                    IEM_MC_STORE_XREG_U32_ZX_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Tmp);
+                    IEM_MC_FETCH_MEM_U32(u32Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+                    IEM_MC_STORE_XREG_U32_ZX_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Tmp);
                 }
                 IEM_MC_ADVANCE_RIP();
@@ -2678 +2678 @@
                 IEM_MC_ACTUALIZE_FPU_STATE_FOR_CHANGE();
                 IEM_MC_LOCAL(uint64_t, u64Tmp);
-                if (pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_REX_W)
-                    IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_REX_W)
+                    IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 else
-                    IEM_MC_FETCH_GREG_U32_ZX_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                    IEM_MC_FETCH_GREG_U32_ZX_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_STORE_MREG_U64((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK, u64Tmp);
                 IEM_MC_ADVANCE_RIP();
@@ -2695 +2695 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_ACTUALIZE_FPU_STATE_FOR_CHANGE();
-                if (pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_REX_W)
+                if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_REX_W)
                 {
                     IEM_MC_LOCAL(uint64_t, u64Tmp);
-                    IEM_MC_FETCH_MEM_U64(u64Tmp, pIemCpu->iEffSeg, GCPtrEffSrc);
+                    IEM_MC_FETCH_MEM_U64(u64Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                     IEM_MC_STORE_MREG_U64((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK, u64Tmp);
                 }
@@ -2704 +2704 @@
                 {
                     IEM_MC_LOCAL(uint32_t, u32Tmp);
-                    IEM_MC_FETCH_MEM_U32(u32Tmp, pIemCpu->iEffSeg, GCPtrEffSrc);
+                    IEM_MC_FETCH_MEM_U32(u32Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                     IEM_MC_STORE_MREG_U32_ZX_U64((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK, u32Tmp);
                 }
@@ -2723 +2723 @@
     bool fAligned = false;
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         case IEM_OP_PRF_SIZE_OP: /* SSE aligned */
@@ -2741 +2741 @@
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
                 IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
-                IEM_MC_COPY_XREG_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg,
-                                      (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_COPY_XREG_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg,
+                                      (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -2760 +2760 @@
                 IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
                 if (fAligned)
-                    IEM_MC_FETCH_MEM_U128_ALIGN_SSE(u128Tmp, pIemCpu->iEffSeg, GCPtrEffSrc);
+                    IEM_MC_FETCH_MEM_U128_ALIGN_SSE(u128Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 else
-                    IEM_MC_FETCH_MEM_U128(u128Tmp, pIemCpu->iEffSeg, GCPtrEffSrc);
-                IEM_MC_STORE_XREG_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u128Tmp);
+                    IEM_MC_FETCH_MEM_U128(u128Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+                IEM_MC_STORE_XREG_U128(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u128Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -2802 +2802 @@
                 IEM_MC_MAYBE_RAISE_MMX_RELATED_XCPT();
                 IEM_MC_ACTUALIZE_FPU_STATE_FOR_CHANGE();
-                IEM_MC_FETCH_MEM_U64(u64Tmp, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U64(u64Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_STORE_MREG_U64((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK, u64Tmp);
 
@@ -2820 +2820 @@
 {
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         case IEM_OP_PRF_SIZE_OP: /* SSE */
@@ -2827 +2827 @@
         {
             PFNIEMAIMPLMEDIAPSHUF pfnAImpl;
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
             {
                 case IEM_OP_PRF_SIZE_OP:
@@ -2857 +2857 @@
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
                 IEM_MC_PREPARE_SSE_USAGE();
-                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_XREG_U128_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_XREG_U128_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_CALL_SSE_AIMPL_3(pfnAImpl, pDst, pSrc, bEvilArg);
                 IEM_MC_ADVANCE_RIP();
@@ -2880 +2880 @@
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
 
-                IEM_MC_FETCH_MEM_U128_ALIGN_SSE(uSrc, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U128_ALIGN_SSE(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_PREPARE_SSE_USAGE();
-                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_CALL_SSE_AIMPL_3(pfnAImpl, pDst, pSrc, bEvilArg);
 
@@ -2930 +2930 @@
                 IEM_MC_MAYBE_RAISE_MMX_RELATED_XCPT_CHECK_SSE_OR_MMXEXT();
 
-                IEM_MC_FETCH_MEM_U64(uSrc, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U64(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_PREPARE_FPU_USAGE();
                 IEM_MC_REF_MREG_U64(pDst, (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK);
@@ -2976 +2976 @@
             return IEMOP_RAISE_INVALID_OPCODE();
         case 2:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case 0:                     return FNIEMOP_CALL_1(iemOp_Grp12_psrlw_Nq_Ib, bRm);
@@ -2983 +2983 @@
             }
         case 4:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case 0:                     return FNIEMOP_CALL_1(iemOp_Grp12_psraw_Nq_Ib, bRm);
@@ -2990 +2990 @@
             }
         case 6:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case 0:                     return FNIEMOP_CALL_1(iemOp_Grp12_psllw_Nq_Ib, bRm);
@@ -3031 +3031 @@
             return IEMOP_RAISE_INVALID_OPCODE();
         case 2:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case 0:                     return FNIEMOP_CALL_1(iemOp_Grp13_psrld_Nq_Ib, bRm);
@@ -3038 +3038 @@
             }
         case 4:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case 0:                     return FNIEMOP_CALL_1(iemOp_Grp13_psrad_Nq_Ib, bRm);
@@ -3045 +3045 @@
             }
         case 6:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case 0:                     return FNIEMOP_CALL_1(iemOp_Grp13_pslld_Nq_Ib, bRm);
@@ -3086 +3086 @@
             return IEMOP_RAISE_INVALID_OPCODE();
         case 2:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case 0:                     return FNIEMOP_CALL_1(iemOp_Grp14_psrlq_Nq_Ib, bRm);
@@ -3093 +3093 @@
             }
         case 3:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case IEM_OP_PRF_SIZE_OP:    return FNIEMOP_CALL_1(iemOp_Grp14_psrldq_Udq_Ib, bRm);
@@ -3099 +3099 @@
             }
         case 6:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case 0:                     return FNIEMOP_CALL_1(iemOp_Grp14_psllq_Nq_Ib, bRm);
@@ -3106 +3106 @@
             }
         case 7:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
             {
                 case IEM_OP_PRF_SIZE_OP:    return FNIEMOP_CALL_1(iemOp_Grp14_pslldq_Udq_Ib, bRm);
@@ -3127 +3127 @@
 {
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         case IEM_OP_PRF_SIZE_OP: /* SSE */
@@ -3141 +3141 @@
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
                 IEM_MC_PREPARE_SSE_USAGE();
-                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_XREG_U128_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_XREG_U128_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_CALL_SSE_AIMPL_2(pImpl->pfnU128, pDst, pSrc);
                 IEM_MC_ADVANCE_RIP();
@@ -3161 +3161 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
-                IEM_MC_FETCH_MEM_U128_ALIGN_SSE(uSrc, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U128_ALIGN_SSE(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
                 IEM_MC_PREPARE_SSE_USAGE();
-                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_REF_XREG_U128(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_CALL_SSE_AIMPL_2(pImpl->pfnU128, pDst, pSrc);
 
@@ -3206 +3206 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_MAYBE_RAISE_MMX_RELATED_XCPT();
-                IEM_MC_FETCH_MEM_U64(uSrc, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U64(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
                 IEM_MC_PREPARE_FPU_USAGE();
@@ -3263 +3263 @@
 {
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         case IEM_OP_PRF_SIZE_OP: /* SSE */
@@ -3274 +3274 @@
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
                 IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ();
-                if (pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_REX_W)
+                if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_REX_W)
                 {
                     IEM_MC_LOCAL(uint64_t, u64Tmp);
-                    IEM_MC_FETCH_XREG_U64(u64Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                    IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u64Tmp);
+                    IEM_MC_FETCH_XREG_U64(u64Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                    IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Tmp);
                 }
                 else
                 {
                     IEM_MC_LOCAL(uint32_t, u32Tmp);
-                    IEM_MC_FETCH_XREG_U32(u32Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                    IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u32Tmp);
+                    IEM_MC_FETCH_XREG_U32(u32Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                    IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Tmp);
                 }
                 IEM_MC_ADVANCE_RIP();
@@ -3298 +3298 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ();
-                if (pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_REX_W)
+                if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_REX_W)
                 {
                     IEM_MC_LOCAL(uint64_t, u64Tmp);
-                    IEM_MC_FETCH_XREG_U64(u64Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                    IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrEffSrc, u64Tmp);
+                    IEM_MC_FETCH_XREG_U64(u64Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                    IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, u64Tmp);
                 }
                 else
                 {
                     IEM_MC_LOCAL(uint32_t, u32Tmp);
-                    IEM_MC_FETCH_XREG_U32(u32Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                    IEM_MC_STORE_MEM_U32(pIemCpu->iEffSeg, GCPtrEffSrc, u32Tmp);
+                    IEM_MC_FETCH_XREG_U32(u32Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                    IEM_MC_STORE_MEM_U32(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, u32Tmp);
                 }
                 IEM_MC_ADVANCE_RIP();
@@ -3324 +3324 @@
                 IEM_MC_MAYBE_RAISE_MMX_RELATED_XCPT();
                 IEM_MC_ACTUALIZE_FPU_STATE_FOR_READ();
-                if (pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_REX_W)
+                if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_REX_W)
                 {
                     IEM_MC_LOCAL(uint64_t, u64Tmp);
                     IEM_MC_FETCH_MREG_U64(u64Tmp, (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK);
-                    IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u64Tmp);
+                    IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Tmp);
                 }
                 else
@@ -3334 +3334 @@
                     IEM_MC_LOCAL(uint32_t, u32Tmp);
                     IEM_MC_FETCH_MREG_U32(u32Tmp, (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK);
-                    IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u32Tmp);
+                    IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Tmp);
                 }
                 IEM_MC_ADVANCE_RIP();
@@ -3348 +3348 @@
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
                 IEM_MC_ACTUALIZE_FPU_STATE_FOR_READ();
-                if (pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_REX_W)
+                if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_REX_W)
                 {
                     IEM_MC_LOCAL(uint64_t, u64Tmp);
                     IEM_MC_FETCH_MREG_U64(u64Tmp, (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK);
-                    IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrEffSrc, u64Tmp);
+                    IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, u64Tmp);
                 }
                 else
@@ -3358 +3358 @@
                     IEM_MC_LOCAL(uint32_t, u32Tmp);
                     IEM_MC_FETCH_MREG_U32(u32Tmp, (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK);
-                    IEM_MC_STORE_MEM_U32(pIemCpu->iEffSeg, GCPtrEffSrc, u32Tmp);
+                    IEM_MC_STORE_MEM_U32(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, u32Tmp);
                 }
                 IEM_MC_ADVANCE_RIP();
@@ -3376 +3376 @@
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     bool fAligned = false;
-    switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         case IEM_OP_PRF_SIZE_OP: /* SSE aligned */
@@ -3394 +3394 @@
                 IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
                 IEM_MC_ACTUALIZE_SSE_STATE_FOR_CHANGE();
-                IEM_MC_COPY_XREG_U128((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB,
-                                      ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_COPY_XREG_U128((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB,
+                                      ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -3413 +3413 @@
                 IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ();
 
-                IEM_MC_FETCH_XREG_U128(u128Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_XREG_U128(u128Tmp, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 if (fAligned)
-                    IEM_MC_STORE_MEM_U128_ALIGN_SSE(pIemCpu->iEffSeg, GCPtrEffSrc, u128Tmp);
+                    IEM_MC_STORE_MEM_U128_ALIGN_SSE(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, u128Tmp);
                 else
-                    IEM_MC_STORE_MEM_U128(pIemCpu->iEffSeg, GCPtrEffSrc, u128Tmp);
+                    IEM_MC_STORE_MEM_U128(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, u128Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -3459 +3459 @@
 
                 IEM_MC_FETCH_MREG_U64(u64Tmp, (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK);
-                IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrEffSrc, u64Tmp);
+                IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, u64Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -3479 +3479 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3515 +3515 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3551 +3551 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3587 +3587 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3623 +3623 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3659 +3659 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3695 +3695 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3731 +3731 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3767 +3767 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3803 +3803 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3839 +3839 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3875 +3875 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3911 +3911 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3947 +3947 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -3983 +3983 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -4019 +4019 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
     {
         int16_t i16Imm; IEM_OPCODE_GET_NEXT_S16(&i16Imm);
@@ -4065 +4065 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_OF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4079 +4079 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_OF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4106 +4106 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_OF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4120 +4120 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_OF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4147 +4147 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_CF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4161 +4161 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_CF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4188 +4188 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_CF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4202 +4202 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_CF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4229 +4229 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_ZF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4243 +4243 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_ZF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4270 +4270 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_ZF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4284 +4284 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_ZF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4311 +4311 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_ANY_BITS_SET(X86_EFL_CF | X86_EFL_ZF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4325 +4325 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_ANY_BITS_SET(X86_EFL_CF | X86_EFL_ZF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4352 +4352 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_ANY_BITS_SET(X86_EFL_CF | X86_EFL_ZF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4366 +4366 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_ANY_BITS_SET(X86_EFL_CF | X86_EFL_ZF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4393 +4393 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_SF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4407 +4407 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_SF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4434 +4434 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_SF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4448 +4448 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_SF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4475 +4475 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_PF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4489 +4489 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_PF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4516 +4516 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_PF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4530 +4530 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_PF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4557 +4557 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BITS_NE(X86_EFL_SF, X86_EFL_OF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4571 +4571 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BITS_NE(X86_EFL_SF, X86_EFL_OF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4598 +4598 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BITS_NE(X86_EFL_SF, X86_EFL_OF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4612 +4612 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BITS_NE(X86_EFL_SF, X86_EFL_OF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4639 +4639 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET_OR_BITS_NE(X86_EFL_ZF, X86_EFL_SF, X86_EFL_OF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4653 +4653 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET_OR_BITS_NE(X86_EFL_ZF, X86_EFL_SF, X86_EFL_OF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4680 +4680 @@
         IEM_MC_BEGIN(0, 0);
         IEM_MC_IF_EFL_BIT_SET_OR_BITS_NE(X86_EFL_ZF, X86_EFL_SF, X86_EFL_OF) {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 0);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, 1);
+            IEM_MC_STORE_GREG_U8_CONST((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4694 +4694 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_IF_EFL_BIT_SET_OR_BITS_NE(X86_EFL_ZF, X86_EFL_SF, X86_EFL_OF) {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 0);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
         } IEM_MC_ELSE() {
-            IEM_MC_STORE_MEM_U8_CONST(pIemCpu->iEffSeg, GCPtrEffDst, 1);
+            IEM_MC_STORE_MEM_U8_CONST(pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1);
         } IEM_MC_ENDIF();
         IEM_MC_ADVANCE_RIP();
@@ -4715 +4715 @@
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
 
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -4765 +4765 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_FS, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_FS, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -4792 +4792 @@
         /* register destination. */
         IEMOP_HLP_NO_LOCK_PREFIX();
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -4800 +4800 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                2);
 
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_AND_LOCAL_U16(u16Src, 0xf);
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
@@ -4816 +4816 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                2);
 
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_AND_LOCAL_U32(u32Src, 0x1f);
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
@@ -4833 +4833 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                2);
 
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_AND_LOCAL_U64(u64Src, 0x3f);
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
@@ -4862 +4862 @@
 
         /** @todo test negative bit offsets! */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -4873 +4873 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_ASSIGN(i16AddrAdj, u16Src);
                 IEM_MC_AND_ARG_U16(u16Src, 0x0f);
@@ -4881 +4881 @@
                 IEM_MC_FETCH_EFLAGS(EFlags);
 
-                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
                 else
@@ -4902 +4902 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_ASSIGN(i32AddrAdj, u32Src);
                 IEM_MC_AND_ARG_U32(u32Src, 0x1f);
@@ -4910 +4910 @@
                 IEM_MC_FETCH_EFLAGS(EFlags);
 
-                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
                 else
@@ -4931 +4931 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_ASSIGN(i64AddrAdj, u64Src);
                 IEM_MC_AND_ARG_U64(u64Src, 0x3f);
@@ -4939 +4939 @@
                 IEM_MC_FETCH_EFLAGS(EFlags);
 
-                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
                 else
@@ -4980 +4980 @@
         IEMOP_HLP_NO_LOCK_PREFIX();
 
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -4989 +4989 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_4(pImpl->pfnNormalU16, pu16Dst, u16Src, cShiftArg, pEFlags);
@@ -5005 +5005 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_4(pImpl->pfnNormalU32, pu32Dst, u32Src, cShiftArg, pEFlags);
@@ -5022 +5022 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_4(pImpl->pfnNormalU64, pu64Dst, u64Src, cShiftArg, pEFlags);
@@ -5038 +5038 @@
         IEMOP_HLP_NO_LOCK_PREFIX(); /** @todo too early? */
 
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -5051 +5051 @@
                 uint8_t cShift; IEM_OPCODE_GET_NEXT_U8(&cShift);
                 IEM_MC_ASSIGN(cShiftArg, cShift);
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
+                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
                 IEM_MC_CALL_VOID_AIMPL_4(pImpl->pfnNormalU16, pu16Dst, u16Src, cShiftArg, pEFlags);
 
@@ -5073 +5073 @@
                 uint8_t cShift; IEM_OPCODE_GET_NEXT_U8(&cShift);
                 IEM_MC_ASSIGN(cShiftArg, cShift);
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
+                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
                 IEM_MC_CALL_VOID_AIMPL_4(pImpl->pfnNormalU32, pu32Dst, u32Src, cShiftArg, pEFlags);
 
@@ -5095 +5095 @@
                 uint8_t cShift; IEM_OPCODE_GET_NEXT_U8(&cShift);
                 IEM_MC_ASSIGN(cShiftArg, cShift);
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
+                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
                 IEM_MC_CALL_VOID_AIMPL_4(pImpl->pfnNormalU64, pu64Dst, u64Src, cShiftArg, pEFlags);
 
@@ -5125 +5125 @@
         IEMOP_HLP_NO_LOCK_PREFIX();
 
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -5134 +5134 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_REF_EFLAGS(pEFlags);
@@ -5151 +5151 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_REF_EFLAGS(pEFlags);
@@ -5169 +5169 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_REF_EFLAGS(pEFlags);
@@ -5186 +5186 @@
         IEMOP_HLP_NO_LOCK_PREFIX(); /** @todo too early? */
 
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -5197 +5197 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
+                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
                 IEM_MC_CALL_VOID_AIMPL_4(pImpl->pfnNormalU16, pu16Dst, u16Src, cShiftArg, pEFlags);
 
@@ -5218 +5218 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
+                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
                 IEM_MC_CALL_VOID_AIMPL_4(pImpl->pfnNormalU32, pu32Dst, u32Src, cShiftArg, pEFlags);
 
@@ -5239 +5239 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
+                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
                 IEM_MC_CALL_VOID_AIMPL_4(pImpl->pfnNormalU64, pu64Dst, u64Src, cShiftArg, pEFlags);
 
@@ -5292 +5292 @@
     IEMOP_HLP_MIN_386();
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_GS, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_GS, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -5332 +5332 @@
 {
     IEMOP_MNEMONIC("fxsave m512");
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fFxSaveRstor)
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fFxSaveRstor)
         return IEMOP_RAISE_INVALID_OPCODE();
 
@@ -5338 +5338 @@
     IEM_MC_ARG(uint8_t,         iEffSeg,                                 0);
     IEM_MC_ARG(RTGCPTR,         GCPtrEff,                                1);
-    IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pIemCpu->enmEffOpSize, 2);
+    IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 2);
     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_3(iemCImpl_fxsave, iEffSeg, GCPtrEff, enmEffOpSize);
     IEM_MC_END();
@@ -5352 +5352 @@
 {
     IEMOP_MNEMONIC("fxrstor m512");
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fFxSaveRstor)
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fFxSaveRstor)
         return IEMOP_RAISE_INVALID_OPCODE();
 
@@ -5358 +5358 @@
     IEM_MC_ARG(uint8_t,         iEffSeg,                                 0);
     IEM_MC_ARG(RTGCPTR,         GCPtrEff,                                1);
-    IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pIemCpu->enmEffOpSize, 2);
+    IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 2);
     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_3(iemCImpl_fxrstor, iEffSeg, GCPtrEff, enmEffOpSize);
     IEM_MC_END();
@@ -5392 +5392 @@
     IEMOP_MNEMONIC("lfence");
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fSse2)
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSse2)
         return IEMOP_RAISE_INVALID_OPCODE();
 
     IEM_MC_BEGIN(0, 0);
-    if (IEM_GET_HOST_CPU_FEATURES(pIemCpu)->fSse2)
+    if (IEM_GET_HOST_CPU_FEATURES(pVCpu)->fSse2)
         IEM_MC_CALL_VOID_AIMPL_0(iemAImpl_lfence);
     else
@@ -5411 +5411 @@
     IEMOP_MNEMONIC("mfence");
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fSse2)
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSse2)
         return IEMOP_RAISE_INVALID_OPCODE();
 
     IEM_MC_BEGIN(0, 0);
-    if (IEM_GET_HOST_CPU_FEATURES(pIemCpu)->fSse2)
+    if (IEM_GET_HOST_CPU_FEATURES(pVCpu)->fSse2)
         IEM_MC_CALL_VOID_AIMPL_0(iemAImpl_mfence);
     else
@@ -5430 +5430 @@
     IEMOP_MNEMONIC("sfence");
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fSse2)
+    if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSse2)
         return IEMOP_RAISE_INVALID_OPCODE();
 
     IEM_MC_BEGIN(0, 0);
-    if (IEM_GET_HOST_CPU_FEATURES(pIemCpu)->fSse2)
+    if (IEM_GET_HOST_CPU_FEATURES(pVCpu)->fSse2)
         IEM_MC_CALL_VOID_AIMPL_0(iemAImpl_sfence);
     else
@@ -5479 +5479 @@
     else
     {
-        switch (pIemCpu->fPrefixes & (IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ | IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_LOCK))
+        switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ | IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_LOCK))
         {
             case 0:
@@ -5544 +5544 @@
         IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-        IEM_MC_FETCH_GREG_U8(u8Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_FETCH_GREG_U8(u8Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_REF_GREG_U8(pu8Al, X86_GREG_xAX);
         IEM_MC_REF_EFLAGS(pEFlags);
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
             IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u8, pu8Dst, pu8Al, u8Src, pEFlags);
         else
@@ -5568 +5568 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEMOP_HLP_DONE_DECODING();
-        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
-        IEM_MC_FETCH_GREG_U8(u8Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
+        IEM_MC_FETCH_GREG_U8(u8Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
         IEM_MC_FETCH_GREG_U8(u8Al, X86_GREG_xAX);
         IEM_MC_FETCH_EFLAGS(EFlags);
         IEM_MC_REF_LOCAL(pu8Al, u8Al);
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
             IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u8, pu8Dst, pu8Al, u8Src, pEFlags);
         else
@@ -5597 +5597 @@
     {
         IEMOP_HLP_DONE_DECODING();
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -5606 +5606 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_GREG_U16(pu16Ax, X86_GREG_xAX);
                 IEM_MC_REF_EFLAGS(pEFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u16, pu16Dst, pu16Ax, u16Src, pEFlags);
                 else
@@ -5626 +5626 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_GREG_U32(pu32Eax, X86_GREG_xAX);
                 IEM_MC_REF_EFLAGS(pEFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u32, pu32Dst, pu32Eax, u32Src, pEFlags);
                 else
@@ -5652 +5652 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                3);
 
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_GREG_U64(pu64Rax, X86_GREG_xAX);
                 IEM_MC_REF_EFLAGS(pEFlags);
 #ifdef RT_ARCH_X86
-                IEM_MC_REF_GREG_U64(pu64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_REF_GREG_U64(pu64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u64, pu64Dst, pu64Rax, pu64Src, pEFlags);
                 else
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u64_locked, pu64Dst, pu64Rax, pu64Src, pEFlags);
 #else
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u64, pu64Dst, pu64Rax, u64Src, pEFlags);
                 else
@@ -5678 +5678 @@
     else
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -5691 +5691 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEMOP_HLP_DONE_DECODING();
-                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
-                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
+                IEM_MC_FETCH_GREG_U16(u16Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_GREG_U16(u16Ax, X86_GREG_xAX);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_REF_LOCAL(pu16Ax, u16Ax);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u16, pu16Dst, pu16Ax, u16Src, pEFlags);
                 else
@@ -5719 +5719 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEMOP_HLP_DONE_DECODING();
-                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
-                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
+                IEM_MC_FETCH_GREG_U32(u32Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_FETCH_GREG_U32(u32Eax, X86_GREG_xAX);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_REF_LOCAL(pu32Eax, u32Eax);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u32, pu32Dst, pu32Eax, u32Src, pEFlags);
                 else
@@ -5751 +5751 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEMOP_HLP_DONE_DECODING();
-                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0);
+                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
                 IEM_MC_FETCH_GREG_U64(u64Rax, X86_GREG_xAX);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_REF_LOCAL(pu64Rax, u64Rax);
 #ifdef RT_ARCH_X86
-                IEM_MC_REF_GREG_U64(pu64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_REF_GREG_U64(pu64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u64, pu64Dst, pu64Rax, pu64Src, pEFlags);
                 else
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u64_locked, pu64Dst, pu64Rax, pu64Src, pEFlags);
 #else
-                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_FETCH_GREG_U64(u64Src, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg_u64, pu64Dst, pu64Rax, u64Src, pEFlags);
                 else
@@ -5785 +5785 @@
 {
     Assert((bRm & X86_MODRM_MOD_MASK) != (3 << X86_MODRM_MOD_SHIFT)); /* Caller checks this */
-    uint8_t const iGReg = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg;
-
-    switch (pIemCpu->enmEffOpSize)
+    uint8_t const iGReg = ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg;
+
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -5795 +5795 @@
             IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
             IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
-            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pIemCpu->enmEffOpSize, 4);
+            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
             IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-            IEM_MC_FETCH_MEM_U16(offSeg, pIemCpu->iEffSeg, GCPtrEff);
-            IEM_MC_FETCH_MEM_U16_DISP(uSel, pIemCpu->iEffSeg, GCPtrEff, 2);
+            IEM_MC_FETCH_MEM_U16(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff);
+            IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 2);
             IEM_MC_CALL_CIMPL_5(iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
             IEM_MC_END();
@@ -5811 +5811 @@
             IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
             IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
-            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pIemCpu->enmEffOpSize, 4);
+            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
             IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-            IEM_MC_FETCH_MEM_U32(offSeg, pIemCpu->iEffSeg, GCPtrEff);
-            IEM_MC_FETCH_MEM_U16_DISP(uSel, pIemCpu->iEffSeg, GCPtrEff, 4);
+            IEM_MC_FETCH_MEM_U32(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff);
+            IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 4);
             IEM_MC_CALL_CIMPL_5(iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
             IEM_MC_END();
@@ -5827 +5827 @@
             IEM_MC_ARG_CONST(uint8_t,   iSegRegArg,/*=*/iSegReg,                 2);
             IEM_MC_ARG_CONST(uint8_t,   iGRegArg,  /*=*/iGReg,                   3);
-            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pIemCpu->enmEffOpSize, 4);
+            IEM_MC_ARG_CONST(IEMMODE,   enmEffOpSize,/*=*/pVCpu->iem.s.enmEffOpSize, 4);
             IEM_MC_LOCAL(RTGCPTR,       GCPtrEff);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEff, bRm, 0);
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-            if (IEM_IS_GUEST_CPU_AMD(pIemCpu)) /** @todo testcase: rev 3.15 of the amd manuals claims it only loads a 32-bit greg. */
-                IEM_MC_FETCH_MEM_U32_SX_U64(offSeg, pIemCpu->iEffSeg, GCPtrEff);
+            if (IEM_IS_GUEST_CPU_AMD(pVCpu)) /** @todo testcase: rev 3.15 of the amd manuals claims it only loads a 32-bit greg. */
+                IEM_MC_FETCH_MEM_U32_SX_U64(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff);
             else
-                IEM_MC_FETCH_MEM_U64(offSeg, pIemCpu->iEffSeg, GCPtrEff);
-            IEM_MC_FETCH_MEM_U16_DISP(uSel, pIemCpu->iEffSeg, GCPtrEff, 8);
+                IEM_MC_FETCH_MEM_U64(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEff);
+            IEM_MC_FETCH_MEM_U16_DISP(uSel, pVCpu->iem.s.iEffSeg, GCPtrEff, 8);
             IEM_MC_CALL_CIMPL_5(iemCImpl_load_SReg_Greg, uSel, offSeg, iSegRegArg, iGRegArg, enmEffOpSize);
             IEM_MC_END();
@@ -5903 +5903 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint16_t, u16Value);
-                IEM_MC_FETCH_GREG_U8_ZX_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Value);
+                IEM_MC_FETCH_GREG_U8_ZX_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -5917 +5917 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint32_t, u32Value);
-                IEM_MC_FETCH_GREG_U8_ZX_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+                IEM_MC_FETCH_GREG_U8_ZX_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -5926 +5926 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint64_t, u64Value);
-                IEM_MC_FETCH_GREG_U8_ZX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+                IEM_MC_FETCH_GREG_U8_ZX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -5940 +5940 @@
          * We're loading a register from memory.
          */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -5947 +5947 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U8_ZX_U16(u16Value, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Value);
+                IEM_MC_FETCH_MEM_U8_ZX_U16(u16Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -5958 +5958 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U8_ZX_U32(u32Value, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+                IEM_MC_FETCH_MEM_U8_ZX_U32(u32Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -5969 +5969 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U8_ZX_U64(u64Value, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+                IEM_MC_FETCH_MEM_U8_ZX_U64(u64Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -5998 +5998 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
-        if (pIemCpu->enmEffOpSize != IEMMODE_64BIT)
+        if (pVCpu->iem.s.enmEffOpSize != IEMMODE_64BIT)
         {
             IEM_MC_BEGIN(0, 1);
             IEM_MC_LOCAL(uint32_t, u32Value);
-            IEM_MC_FETCH_GREG_U16_ZX_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+            IEM_MC_FETCH_GREG_U16_ZX_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -6011 +6011 @@
             IEM_MC_BEGIN(0, 1);
             IEM_MC_LOCAL(uint64_t, u64Value);
-            IEM_MC_FETCH_GREG_U16_ZX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+            IEM_MC_FETCH_GREG_U16_ZX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -6022 +6022 @@
          * We're loading a register from memory.
          */
-        if (pIemCpu->enmEffOpSize != IEMMODE_64BIT)
+        if (pVCpu->iem.s.enmEffOpSize != IEMMODE_64BIT)
         {
             IEM_MC_BEGIN(0, 2);
@@ -6028 +6028 @@
             IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-            IEM_MC_FETCH_MEM_U16_ZX_U32(u32Value, pIemCpu->iEffSeg, GCPtrEffDst);
-            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+            IEM_MC_FETCH_MEM_U16_ZX_U32(u32Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -6039 +6039 @@
             IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-            IEM_MC_FETCH_MEM_U16_ZX_U64(u64Value, pIemCpu->iEffSeg, GCPtrEffDst);
-            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+            IEM_MC_FETCH_MEM_U16_ZX_U64(u64Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -6085 +6085 @@
         IEMOP_HLP_NO_LOCK_PREFIX();
 
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -6093 +6093 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                    2);
 
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
@@ -6107 +6107 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                    2);
 
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
@@ -6122 +6122 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                    2);
 
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
@@ -6147 +6147 @@
 
         /** @todo test negative bit offsets! */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -6160 +6160 @@
                 IEM_MC_ASSIGN(u16Src, u8Bit & 0x0f);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                IEM_MC_MEM_MAP(pu16Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_MEM_MAP(pu16Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
                 else
@@ -6183 +6183 @@
                 IEM_MC_ASSIGN(u32Src, u8Bit & 0x1f);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                IEM_MC_MEM_MAP(pu32Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_MEM_MAP(pu32Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
                 else
@@ -6206 +6206 @@
                 IEM_MC_ASSIGN(u64Src, u8Bit & 0x3f);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                IEM_MC_MEM_MAP(pu64Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                IEM_MC_MEM_MAP(pu64Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0);
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
                 else
@@ -6268 +6268 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint16_t, u16Value);
-                IEM_MC_FETCH_GREG_U8_SX_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Value);
+                IEM_MC_FETCH_GREG_U8_SX_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6282 +6282 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint32_t, u32Value);
-                IEM_MC_FETCH_GREG_U8_SX_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+                IEM_MC_FETCH_GREG_U8_SX_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6291 +6291 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint64_t, u64Value);
-                IEM_MC_FETCH_GREG_U8_SX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+                IEM_MC_FETCH_GREG_U8_SX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6305 +6305 @@
          * We're loading a register from memory.
          */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -6312 +6312 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U8_SX_U16(u16Value, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Value);
+                IEM_MC_FETCH_MEM_U8_SX_U16(u16Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6323 +6323 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U8_SX_U32(u32Value, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+                IEM_MC_FETCH_MEM_U8_SX_U32(u32Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6334 +6334 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U8_SX_U64(u64Value, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+                IEM_MC_FETCH_MEM_U8_SX_U64(u64Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6363 +6363 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
-        if (pIemCpu->enmEffOpSize != IEMMODE_64BIT)
+        if (pVCpu->iem.s.enmEffOpSize != IEMMODE_64BIT)
         {
             IEM_MC_BEGIN(0, 1);
             IEM_MC_LOCAL(uint32_t, u32Value);
-            IEM_MC_FETCH_GREG_U16_SX_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+            IEM_MC_FETCH_GREG_U16_SX_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -6376 +6376 @@
             IEM_MC_BEGIN(0, 1);
             IEM_MC_LOCAL(uint64_t, u64Value);
-            IEM_MC_FETCH_GREG_U16_SX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+            IEM_MC_FETCH_GREG_U16_SX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -6387 +6387 @@
          * We're loading a register from memory.
          */
-        if (pIemCpu->enmEffOpSize != IEMMODE_64BIT)
+        if (pVCpu->iem.s.enmEffOpSize != IEMMODE_64BIT)
         {
             IEM_MC_BEGIN(0, 2);
@@ -6393 +6393 @@
             IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-            IEM_MC_FETCH_MEM_U16_SX_U32(u32Value, pIemCpu->iEffSeg, GCPtrEffDst);
-            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+            IEM_MC_FETCH_MEM_U16_SX_U32(u32Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -6404 +6404 @@
             IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-            IEM_MC_FETCH_MEM_U16_SX_U64(u64Value, pIemCpu->iEffSeg, GCPtrEffDst);
-            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+            IEM_MC_FETCH_MEM_U16_SX_U64(u64Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -6433 +6433 @@
         IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-        IEM_MC_REF_GREG_U8(pu8Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+        IEM_MC_REF_GREG_U8(pu8Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
         IEM_MC_REF_EFLAGS(pEFlags);
         IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_xadd_u8, pu8Dst, pu8Reg, pEFlags);
@@ -6454 +6454 @@
 
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-        IEM_MC_FETCH_GREG_U8(u8RegCopy, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_FETCH_GREG_U8(u8RegCopy, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
         IEM_MC_REF_LOCAL(pu8Reg, u8RegCopy);
         IEM_MC_FETCH_EFLAGS(EFlags);
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
             IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_xadd_u8, pu8Dst, pu8Reg, pEFlags);
         else
@@ -6465 +6465 @@
         IEM_MC_MEM_COMMIT_AND_UNMAP(pu8Dst, IEM_ACCESS_DATA_RW);
         IEM_MC_COMMIT_EFLAGS(EFlags);
-        IEM_MC_STORE_GREG_U8(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u8RegCopy);
+        IEM_MC_STORE_GREG_U8(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u8RegCopy);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -6488 +6488 @@
         IEMOP_HLP_NO_LOCK_PREFIX();
 
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -6496 +6496 @@
                 IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_REF_GREG_U16(pu16Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_REF_GREG_U16(pu16Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_xadd_u16, pu16Dst, pu16Reg, pEFlags);
@@ -6511 +6511 @@
                 IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_REF_GREG_U32(pu32Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_REF_GREG_U32(pu32Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_xadd_u32, pu32Dst, pu32Reg, pEFlags);
@@ -6528 +6528 @@
                 IEM_MC_ARG(uint32_t *, pEFlags, 2);
 
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_REF_GREG_U64(pu64Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_REF_GREG_U64(pu64Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_xadd_u64, pu64Dst, pu64Reg, pEFlags);
@@ -6545 +6545 @@
          * We're accessing memory.
          */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -6556 +6556 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_FETCH_GREG_U16(u16RegCopy, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_FETCH_GREG_U16(u16RegCopy, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_LOCAL(pu16Reg, u16RegCopy);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_xadd_u16, pu16Dst, pu16Reg, pEFlags);
                 else
@@ -6567 +6567 @@
                 IEM_MC_MEM_COMMIT_AND_UNMAP(pu16Dst, IEM_ACCESS_DATA_RW);
                 IEM_MC_COMMIT_EFLAGS(EFlags);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16RegCopy);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16RegCopy);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6581 +6581 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_FETCH_GREG_U32(u32RegCopy, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_FETCH_GREG_U32(u32RegCopy, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_LOCAL(pu32Reg, u32RegCopy);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_xadd_u32, pu32Dst, pu32Reg, pEFlags);
                 else
@@ -6592 +6592 @@
                 IEM_MC_MEM_COMMIT_AND_UNMAP(pu32Dst, IEM_ACCESS_DATA_RW);
                 IEM_MC_COMMIT_EFLAGS(EFlags);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32RegCopy);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32RegCopy);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6606 +6606 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_FETCH_GREG_U64(u64RegCopy, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_FETCH_GREG_U64(u64RegCopy, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_REF_LOCAL(pu64Reg, u64RegCopy);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_xadd_u64, pu64Dst, pu64Reg, pEFlags);
                 else
@@ -6617 +6617 @@
                 IEM_MC_MEM_COMMIT_AND_UNMAP(pu64Dst, IEM_ACCESS_DATA_RW);
                 IEM_MC_COMMIT_EFLAGS(EFlags);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64RegCopy);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64RegCopy);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6641 +6641 @@
     if ((bRm & X86_MODRM_MOD_MASK) != (3 << X86_MODRM_MOD_SHIFT))
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_32BIT:
@@ -6650 +6650 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fSse2)
+                if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSse2)
                     return IEMOP_RAISE_INVALID_OPCODE();
 
-                IEM_MC_FETCH_GREG_U32(u32Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_STORE_MEM_U32(pIemCpu->iEffSeg, GCPtrEffDst, u32Value);
+                IEM_MC_FETCH_GREG_U32(u32Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_STORE_MEM_U32(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6666 +6666 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                if (!IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fSse2)
+                if (!IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fSse2)
                     return IEMOP_RAISE_INVALID_OPCODE();
 
-                IEM_MC_FETCH_GREG_U64(u64Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrEffDst, u64Value);
+                IEM_MC_FETCH_GREG_U64(u64Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -6712 +6712 @@
     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
     IEMOP_HLP_DONE_DECODING();
-    IEM_MC_MEM_MAP(pu64MemDst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+    IEM_MC_MEM_MAP(pu64MemDst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
 
     IEM_MC_FETCH_GREG_U32(u64EaxEdx.s.Lo, X86_GREG_xAX);
@@ -6723 +6723 @@
 
     IEM_MC_FETCH_EFLAGS(EFlags);
-    if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+    if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
         IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg8b, pu64MemDst, pu64EaxEdx, pu64EbxEcx, pEFlags);
     else
@@ -6773 +6773 @@
             /** @todo Testcase: Check prefix effects on cmpxchg8b/16b. */
             if (   (bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT)
-                || (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ))) /** @todo Testcase: AMD seems to express a different idea here wrt prefixes. */
+                || (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ))) /** @todo Testcase: AMD seems to express a different idea here wrt prefixes. */
                 return IEMOP_RAISE_INVALID_OPCODE();
             if (bRm & IEM_OP_PRF_SIZE_REX_W)
@@ -6781 +6781 @@
             if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
                 return FNIEMOP_CALL_1(iemOp_Grp9_rdrand_Rv, bRm);
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ))
             {
                 case 0:
@@ -6793 +6793 @@
             }
         case 7:
-            switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ))
+            switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPZ))
             {
                 case 0:
@@ -6812 +6812 @@
 {
     IEMOP_HLP_NO_LOCK_PREFIX();
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -6855 +6855 @@
              case, see iemOp_mov_AL_Ib and iemOp_mov_eAX_Iv. */
     IEMOP_HLP_MIN_486();
-    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xAX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xAX | pVCpu->iem.s.uRexB);
 }
 
@@ -6864 +6864 @@
     IEMOP_MNEMONIC("bswap rCX/r9");
     IEMOP_HLP_MIN_486();
-    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xCX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xCX | pVCpu->iem.s.uRexB);
 }
 
@@ -6873 +6873 @@
     IEMOP_MNEMONIC("bswap rDX/r9");
     IEMOP_HLP_MIN_486();
-    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xDX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xDX | pVCpu->iem.s.uRexB);
 }
 
@@ -6882 +6882 @@
     IEMOP_MNEMONIC("bswap rBX/r9");
     IEMOP_HLP_MIN_486();
-    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xBX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xBX | pVCpu->iem.s.uRexB);
 }
 
@@ -6891 +6891 @@
     IEMOP_MNEMONIC("bswap rSP/r12");
     IEMOP_HLP_MIN_486();
-    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xSP | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xSP | pVCpu->iem.s.uRexB);
 }
 
@@ -6900 +6900 @@
     IEMOP_MNEMONIC("bswap rBP/r13");
     IEMOP_HLP_MIN_486();
-    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xBP | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xBP | pVCpu->iem.s.uRexB);
 }
 
@@ -6909 +6909 @@
     IEMOP_MNEMONIC("bswap rSI/r14");
     IEMOP_HLP_MIN_486();
-    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xSI | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xSI | pVCpu->iem.s.uRexB);
 }
 
@@ -6918 +6918 @@
     IEMOP_MNEMONIC("bswap rDI/r15");
     IEMOP_HLP_MIN_486();
-    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xDI | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonBswapGReg, X86_GREG_xDI | pVCpu->iem.s.uRexB);
 }
 
@@ -6952 +6952 @@
      *        and opcode modifications are made to work with the whole width (not
      *        just 128). */
-    switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         case IEM_OP_PRF_SIZE_OP: /* SSE */
@@ -6962 +6962 @@
             IEM_MC_MAYBE_RAISE_SSE2_RELATED_XCPT();
             IEM_MC_PREPARE_SSE_USAGE();
-            IEM_MC_REF_GREG_U64(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-            IEM_MC_REF_XREG_U128_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+            IEM_MC_REF_GREG_U64(pDst, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+            IEM_MC_REF_XREG_U128_CONST(pSrc, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
             IEM_MC_CALL_SSE_AIMPL_2(iemAImpl_pmovmskb_u128, pDst, pSrc);
             IEM_MC_ADVANCE_RIP();
@@ -7025 +7025 @@
 FNIEMOP_DEF(iemOp_movntq_Mq_Pq__movntdq_Mdq_Vdq)
 {
-    IEMOP_MNEMONIC(!(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP) ? "movntq mr,r" : "movntdq mr,r");
+    IEMOP_MNEMONIC(!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP) ? "movntq mr,r" : "movntdq mr,r");
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) != (3 << X86_MODRM_MOD_SHIFT))
@@ -7033 +7033 @@
          */
 /** @todo check when the REPNZ/Z bits kick in. Same as lock, probably... */
-        switch (pIemCpu->fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+        switch (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
         {
 
@@ -7046 +7046 @@
                 IEM_MC_ACTUALIZE_SSE_STATE_FOR_READ();
 
-                IEM_MC_FETCH_XREG_U128(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_STORE_MEM_U128_ALIGN_SSE(pIemCpu->iEffSeg, GCPtrEffSrc, uSrc);
+                IEM_MC_FETCH_XREG_U128(uSrc, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_STORE_MEM_U128_ALIGN_SSE(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uSrc);
 
                 IEM_MC_ADVANCE_RIP();
@@ -7064 +7064 @@
 
                 IEM_MC_FETCH_MREG_U64(uSrc, (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK);
-                IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrEffSrc, uSrc);
+                IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uSrc);
 
                 IEM_MC_ADVANCE_RIP();
@@ -7467 +7467 @@
     IEMOP_HLP_NO_64BIT();
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_ES, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_ES, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -7604 +7604 @@
     IEMOP_HLP_NO_LOCK_PREFIX();
     IEMOP_HLP_NO_64BIT();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_SS, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_SS, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -7670 +7670 @@
     IEMOP_HLP_NO_LOCK_PREFIX();
     IEMOP_HLP_NO_64BIT();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_DS, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_pop_Sreg, X86_SREG_DS, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -7732 +7732 @@
 {
     IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("seg es");
-    pIemCpu->fPrefixes |= IEM_OP_PRF_SEG_ES;
-    pIemCpu->iEffSeg    = X86_SREG_ES;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_SEG_ES;
+    pVCpu->iem.s.iEffSeg    = X86_SREG_ES;
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -7803 +7803 @@
 {
     IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("seg cs");
-    pIemCpu->fPrefixes |= IEM_OP_PRF_SEG_CS;
-    pIemCpu->iEffSeg    = X86_SREG_CS;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_SEG_CS;
+    pVCpu->iem.s.iEffSeg    = X86_SREG_CS;
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -7880 +7880 @@
 {
     IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("seg ss");
-    pIemCpu->fPrefixes |= IEM_OP_PRF_SEG_SS;
-    pIemCpu->iEffSeg    = X86_SREG_SS;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_SEG_SS;
+    pVCpu->iem.s.iEffSeg    = X86_SREG_SS;
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -7946 +7946 @@
 {
     IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("seg ds");
-    pIemCpu->fPrefixes |= IEM_OP_PRF_SEG_DS;
-    pIemCpu->iEffSeg    = X86_SREG_DS;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_SEG_DS;
+    pVCpu->iem.s.iEffSeg    = X86_SREG_DS;
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -7963 +7963 @@
 {
     IEMOP_HLP_NO_LOCK_PREFIX();
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -8009 +8009 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX;
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX;
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8029 +8029 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.b");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_B;
-        pIemCpu->uRexB     = 1 << 3;
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_B;
+        pVCpu->iem.s.uRexB     = 1 << 3;
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8050 +8050 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.x");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_X;
-        pIemCpu->uRexIndex = 1 << 3;
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_X;
+        pVCpu->iem.s.uRexIndex = 1 << 3;
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8072 +8072 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.bx");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_B | IEM_OP_PRF_REX_X;
-        pIemCpu->uRexB     = 1 << 3;
-        pIemCpu->uRexIndex = 1 << 3;
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_B | IEM_OP_PRF_REX_X;
+        pVCpu->iem.s.uRexB     = 1 << 3;
+        pVCpu->iem.s.uRexIndex = 1 << 3;
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8094 +8094 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.r");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R;
-        pIemCpu->uRexReg   = 1 << 3;
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R;
+        pVCpu->iem.s.uRexReg   = 1 << 3;
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8115 +8115 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.rb");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_B;
-        pIemCpu->uRexReg   = 1 << 3;
-        pIemCpu->uRexB     = 1 << 3;
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_B;
+        pVCpu->iem.s.uRexReg   = 1 << 3;
+        pVCpu->iem.s.uRexB     = 1 << 3;
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8137 +8137 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.rx");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_X;
-        pIemCpu->uRexReg   = 1 << 3;
-        pIemCpu->uRexIndex = 1 << 3;
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_X;
+        pVCpu->iem.s.uRexReg   = 1 << 3;
+        pVCpu->iem.s.uRexIndex = 1 << 3;
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8159 +8159 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.rbx");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_B | IEM_OP_PRF_REX_X;
-        pIemCpu->uRexReg   = 1 << 3;
-        pIemCpu->uRexB     = 1 << 3;
-        pIemCpu->uRexIndex = 1 << 3;
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_B | IEM_OP_PRF_REX_X;
+        pVCpu->iem.s.uRexReg   = 1 << 3;
+        pVCpu->iem.s.uRexB     = 1 << 3;
+        pVCpu->iem.s.uRexIndex = 1 << 3;
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8182 +8182 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.w");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_SIZE_REX_W;
-        iemRecalEffOpSize(pIemCpu);
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_SIZE_REX_W;
+        iemRecalEffOpSize(pVCpu);
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8203 +8203 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.bw");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_B | IEM_OP_PRF_SIZE_REX_W;
-        pIemCpu->uRexB     = 1 << 3;
-        iemRecalEffOpSize(pIemCpu);
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_B | IEM_OP_PRF_SIZE_REX_W;
+        pVCpu->iem.s.uRexB     = 1 << 3;
+        iemRecalEffOpSize(pVCpu);
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8225 +8225 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.xw");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_X | IEM_OP_PRF_SIZE_REX_W;
-        pIemCpu->uRexIndex = 1 << 3;
-        iemRecalEffOpSize(pIemCpu);
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_X | IEM_OP_PRF_SIZE_REX_W;
+        pVCpu->iem.s.uRexIndex = 1 << 3;
+        iemRecalEffOpSize(pVCpu);
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8247 +8247 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.bxw");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_B | IEM_OP_PRF_REX_X | IEM_OP_PRF_SIZE_REX_W;
-        pIemCpu->uRexB     = 1 << 3;
-        pIemCpu->uRexIndex = 1 << 3;
-        iemRecalEffOpSize(pIemCpu);
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_B | IEM_OP_PRF_REX_X | IEM_OP_PRF_SIZE_REX_W;
+        pVCpu->iem.s.uRexB     = 1 << 3;
+        pVCpu->iem.s.uRexIndex = 1 << 3;
+        iemRecalEffOpSize(pVCpu);
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8270 +8270 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.rw");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_SIZE_REX_W;
-        pIemCpu->uRexReg   = 1 << 3;
-        iemRecalEffOpSize(pIemCpu);
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_SIZE_REX_W;
+        pVCpu->iem.s.uRexReg   = 1 << 3;
+        iemRecalEffOpSize(pVCpu);
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8292 +8292 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.rbw");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_B | IEM_OP_PRF_SIZE_REX_W;
-        pIemCpu->uRexReg   = 1 << 3;
-        pIemCpu->uRexB     = 1 << 3;
-        iemRecalEffOpSize(pIemCpu);
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_B | IEM_OP_PRF_SIZE_REX_W;
+        pVCpu->iem.s.uRexReg   = 1 << 3;
+        pVCpu->iem.s.uRexB     = 1 << 3;
+        iemRecalEffOpSize(pVCpu);
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8315 +8315 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.rxw");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_X | IEM_OP_PRF_SIZE_REX_W;
-        pIemCpu->uRexReg   = 1 << 3;
-        pIemCpu->uRexIndex = 1 << 3;
-        iemRecalEffOpSize(pIemCpu);
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_X | IEM_OP_PRF_SIZE_REX_W;
+        pVCpu->iem.s.uRexReg   = 1 << 3;
+        pVCpu->iem.s.uRexIndex = 1 << 3;
+        iemRecalEffOpSize(pVCpu);
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8338 +8338 @@
      * This is a REX prefix in 64-bit mode.
      */
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
     {
         IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("rex.rbxw");
-        pIemCpu->fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_B | IEM_OP_PRF_REX_X | IEM_OP_PRF_SIZE_REX_W;
-        pIemCpu->uRexReg   = 1 << 3;
-        pIemCpu->uRexB     = 1 << 3;
-        pIemCpu->uRexIndex = 1 << 3;
-        iemRecalEffOpSize(pIemCpu);
+        pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REX | IEM_OP_PRF_REX_R | IEM_OP_PRF_REX_B | IEM_OP_PRF_REX_X | IEM_OP_PRF_SIZE_REX_W;
+        pVCpu->iem.s.uRexReg   = 1 << 3;
+        pVCpu->iem.s.uRexB     = 1 << 3;
+        pVCpu->iem.s.uRexIndex = 1 << 3;
+        iemRecalEffOpSize(pVCpu);
 
         uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8362 +8362 @@
 {
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-    {
-        iReg |= pIemCpu->uRexB;
-        pIemCpu->enmDefOpSize = IEMMODE_64BIT;
-        pIemCpu->enmEffOpSize = !(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP) ? IEMMODE_64BIT : IEMMODE_16BIT;
-    }
-
-    switch (pIemCpu->enmEffOpSize)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+    {
+        iReg |= pVCpu->iem.s.uRexB;
+        pVCpu->iem.s.enmDefOpSize = IEMMODE_64BIT;
+        pVCpu->iem.s.enmEffOpSize = !(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP) ? IEMMODE_64BIT : IEMMODE_16BIT;
+    }
+
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -8439 +8439 @@
 {
     IEMOP_MNEMONIC("push rSP");
-    if (IEM_GET_TARGET_CPU(pIemCpu) == IEMTARGETCPU_8086)
+    if (IEM_GET_TARGET_CPU(pVCpu) == IEMTARGETCPU_8086)
     {
         IEM_MC_BEGIN(0, 1);
@@ -8483 +8483 @@
 {
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-    {
-        iReg |= pIemCpu->uRexB;
-        pIemCpu->enmDefOpSize = IEMMODE_64BIT;
-        pIemCpu->enmEffOpSize = !(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP) ? IEMMODE_64BIT : IEMMODE_16BIT;
-    }
-
-    switch (pIemCpu->enmEffOpSize)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+    {
+        iReg |= pVCpu->iem.s.uRexB;
+        pVCpu->iem.s.enmDefOpSize = IEMMODE_64BIT;
+        pVCpu->iem.s.enmEffOpSize = !(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP) ? IEMMODE_64BIT : IEMMODE_16BIT;
+    }
+
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -8561 +8561 @@
 {
     IEMOP_MNEMONIC("pop rSP");
-    if (pIemCpu->enmCpuMode == IEMMODE_64BIT)
-    {
-        if (pIemCpu->uRexB)
+    if (pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT)
+    {
+        if (pVCpu->iem.s.uRexB)
             return FNIEMOP_CALL_1(iemOpCommonPopGReg, X86_GREG_xSP);
-        pIemCpu->enmDefOpSize = IEMMODE_64BIT;
-        pIemCpu->enmEffOpSize = !(pIemCpu->fPrefixes & IEM_OP_PRF_SIZE_OP) ? IEMMODE_64BIT : IEMMODE_16BIT;
+        pVCpu->iem.s.enmDefOpSize = IEMMODE_64BIT;
+        pVCpu->iem.s.enmEffOpSize = !(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_OP) ? IEMMODE_64BIT : IEMMODE_16BIT;
     }
 
@@ -8572 +8572 @@
                            DISOPTYPE_HARMLESS | DISOPTYPE_DEFAULT_64_OP_SIZE | DISOPTYPE_REXB_EXTENDS_OPREG);
     /** @todo add testcase for this instruction. */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -8636 +8636 @@
     IEMOP_HLP_MIN_186();
     IEMOP_HLP_NO_64BIT();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
         return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_pusha_16);
-    Assert(pIemCpu->enmEffOpSize == IEMMODE_32BIT);
+    Assert(pVCpu->iem.s.enmEffOpSize == IEMMODE_32BIT);
     return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_pusha_32);
 }
@@ -8649 +8649 @@
     IEMOP_HLP_MIN_186();
     IEMOP_HLP_NO_64BIT();
-    if (pIemCpu->enmEffOpSize == IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT)
         return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_popa_16);
-    Assert(pIemCpu->enmEffOpSize == IEMMODE_32BIT);
+    Assert(pVCpu->iem.s.enmEffOpSize == IEMMODE_32BIT);
     return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_popa_32);
 }
@@ -8697 +8697 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEMOP_HLP_DECODED_NL_2(OP_ARPL, IEMOPFORM_MR_REG, OP_PARM_Ew, OP_PARM_Gw, DISOPTYPE_HARMLESS);
-        IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
         IEM_MC_FETCH_GREG_U16(u16Src, (bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK);
         IEM_MC_FETCH_EFLAGS(EFlags);
@@ -8718 +8718 @@
 FNIEMOP_DEF(iemOp_movsxd_Gv_Ev)
 {
-    Assert(pIemCpu->enmEffOpSize == IEMMODE_64BIT); /* Caller branched already . */
+    Assert(pVCpu->iem.s.enmEffOpSize == IEMMODE_64BIT); /* Caller branched already . */
 
     IEMOP_MNEMONIC("movsxd Gv,Ev");
@@ -8731 +8731 @@
         IEM_MC_BEGIN(0, 1);
         IEM_MC_LOCAL(uint64_t, u64Value);
-        IEM_MC_FETCH_GREG_U32_SX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-        IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+        IEM_MC_FETCH_GREG_U32_SX_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+        IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -8746 +8746 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-        IEM_MC_FETCH_MEM_U32_SX_U64(u64Value, pIemCpu->iEffSeg, GCPtrEffDst);
-        IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+        IEM_MC_FETCH_MEM_U32_SX_U64(u64Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+        IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -8761 +8761 @@
     IEMOP_HLP_MIN_386();
 
-    pIemCpu->fPrefixes |= IEM_OP_PRF_SEG_FS;
-    pIemCpu->iEffSeg    = X86_SREG_FS;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_SEG_FS;
+    pVCpu->iem.s.iEffSeg    = X86_SREG_FS;
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8775 +8775 @@
     IEMOP_HLP_MIN_386();
 
-    pIemCpu->fPrefixes |= IEM_OP_PRF_SEG_GS;
-    pIemCpu->iEffSeg    = X86_SREG_GS;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_SEG_GS;
+    pVCpu->iem.s.iEffSeg    = X86_SREG_GS;
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8789 +8789 @@
     IEMOP_HLP_MIN_386();
 
-    pIemCpu->fPrefixes |= IEM_OP_PRF_SIZE_OP;
-    iemRecalEffOpSize(pIemCpu);
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_SIZE_OP;
+    iemRecalEffOpSize(pVCpu);
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -8803 +8803 @@
     IEMOP_HLP_MIN_386();
 
-    pIemCpu->fPrefixes |= IEM_OP_PRF_SIZE_ADDR;
-    switch (pIemCpu->enmDefAddrMode)
-    {
-        case IEMMODE_16BIT: pIemCpu->enmEffAddrMode = IEMMODE_32BIT; break;
-        case IEMMODE_32BIT: pIemCpu->enmEffAddrMode = IEMMODE_16BIT; break;
-        case IEMMODE_64BIT: pIemCpu->enmEffAddrMode = IEMMODE_32BIT; break;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_SIZE_ADDR;
+    switch (pVCpu->iem.s.enmDefAddrMode)
+    {
+        case IEMMODE_16BIT: pVCpu->iem.s.enmEffAddrMode = IEMMODE_32BIT; break;
+        case IEMMODE_32BIT: pVCpu->iem.s.enmEffAddrMode = IEMMODE_16BIT; break;
+        case IEMMODE_64BIT: pVCpu->iem.s.enmEffAddrMode = IEMMODE_32BIT; break;
         default: AssertFailed();
     }
@@ -8823 +8823 @@
     IEMOP_HLP_MIN_186();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -8871 +8871 @@
     IEMOP_VERIFICATION_UNDEFINED_EFLAGS(X86_EFL_SF | X86_EFL_ZF | X86_EFL_AF | X86_EFL_PF);
 
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -8887 +8887 @@
                 IEM_MC_LOCAL(uint16_t,      u16Tmp);
 
-                IEM_MC_FETCH_GREG_U16(u16Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U16(u16Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_LOCAL(pu16Dst, u16Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u16, pu16Dst, u16Src, pEFlags);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Tmp);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -8910 +8910 @@
                 IEM_MC_ASSIGN(u16Src, u16Imm);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_FETCH_MEM_U16(u16Tmp, pIemCpu->iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_MEM_U16(u16Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
                 IEM_MC_REF_LOCAL(pu16Dst, u16Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u16, pu16Dst, u16Src, pEFlags);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Tmp);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -8936 +8936 @@
                 IEM_MC_LOCAL(uint32_t,      u32Tmp);
 
-                IEM_MC_FETCH_GREG_U32(u32Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U32(u32Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_LOCAL(pu32Dst, u32Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u32, pu32Dst, u32Src, pEFlags);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Tmp);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -8959 +8959 @@
                 IEM_MC_ASSIGN(u32Src, u32Imm);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_FETCH_MEM_U32(u32Tmp, pIemCpu->iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_MEM_U32(u32Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
                 IEM_MC_REF_LOCAL(pu32Dst, u32Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u32, pu32Dst, u32Src, pEFlags);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Tmp);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -8985 +8985 @@
                 IEM_MC_LOCAL(uint64_t,      u64Tmp);
 
-                IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_LOCAL(pu64Dst, u64Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u64, pu64Dst, u64Src, pEFlags);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Tmp);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -9008 +9008 @@
                 IEM_MC_ASSIGN(u64Src, u64Imm);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_FETCH_MEM_U64(u64Tmp, pIemCpu->iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_MEM_U64(u64Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
                 IEM_MC_REF_LOCAL(pu64Dst, u64Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u64, pu64Dst, u64Src, pEFlags);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Tmp);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -9034 +9034 @@
 
     IEM_MC_BEGIN(0,0);
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -9060 +9060 @@
     IEMOP_VERIFICATION_UNDEFINED_EFLAGS(X86_EFL_SF | X86_EFL_ZF | X86_EFL_AF | X86_EFL_PF);
 
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -9075 +9075 @@
                 IEM_MC_LOCAL(uint16_t,      u16Tmp);
 
-                IEM_MC_FETCH_GREG_U16(u16Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U16(u16Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_LOCAL(pu16Dst, u16Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u16, pu16Dst, u16Src, pEFlags);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Tmp);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -9098 +9098 @@
                 IEM_MC_ASSIGN(u16Src, u16Imm);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_FETCH_MEM_U16(u16Tmp, pIemCpu->iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_MEM_U16(u16Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
                 IEM_MC_REF_LOCAL(pu16Dst, u16Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u16, pu16Dst, u16Src, pEFlags);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Tmp);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -9122 +9122 @@
                 IEM_MC_LOCAL(uint32_t,      u32Tmp);
 
-                IEM_MC_FETCH_GREG_U32(u32Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U32(u32Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_LOCAL(pu32Dst, u32Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u32, pu32Dst, u32Src, pEFlags);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Tmp);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -9145 +9145 @@
                 IEM_MC_ASSIGN(u32Src, u32Imm);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_FETCH_MEM_U32(u32Tmp, pIemCpu->iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_MEM_U32(u32Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
                 IEM_MC_REF_LOCAL(pu32Dst, u32Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u32, pu32Dst, u32Src, pEFlags);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Tmp);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -9169 +9169 @@
                 IEM_MC_LOCAL(uint64_t,      u64Tmp);
 
-                IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U64(u64Tmp, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_LOCAL(pu64Dst, u64Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u64, pu64Dst, u64Src, pEFlags);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Tmp);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -9192 +9192 @@
                 IEM_MC_ASSIGN(u64Src, u64Imm);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_FETCH_MEM_U64(u64Tmp, pIemCpu->iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_MEM_U64(u64Tmp, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
                 IEM_MC_REF_LOCAL(pu64Dst, u64Tmp);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_imul_two_u64, pu64Dst, u64Src, pEFlags);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Tmp);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Tmp);
 
                 IEM_MC_ADVANCE_RIP();
@@ -9212 +9212 @@
     IEMOP_HLP_MIN_186();
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         IEMOP_MNEMONIC("rep ins Yb,DX");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
             case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_ins_op8_addr16, false);
@@ -9226 +9226 @@
     {
         IEMOP_MNEMONIC("ins Yb,DX");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
             case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_ins_op8_addr16, false);
@@ -9242 +9242 @@
     IEMOP_HLP_MIN_186();
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
     {
         IEMOP_MNEMONIC("rep ins Yv,DX");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_ins_op16_addr16, false);
@@ -9258 +9258 @@
             case IEMMODE_64BIT:
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_ins_op32_addr16, false);
@@ -9272 +9272 @@
     {
         IEMOP_MNEMONIC("ins Yv,DX");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_ins_op16_addr16, false);
@@ -9285 +9285 @@
             case IEMMODE_64BIT:
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_ins_op32_addr16, false);
@@ -9304 +9304 @@
     IEMOP_HLP_MIN_186();
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         IEMOP_MNEMONIC("rep outs DX,Yb");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
-            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op8_addr16, pIemCpu->iEffSeg, false);
-            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op8_addr32, pIemCpu->iEffSeg, false);
-            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op8_addr64, pIemCpu->iEffSeg, false);
+            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op8_addr16, pVCpu->iem.s.iEffSeg, false);
+            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op8_addr32, pVCpu->iem.s.iEffSeg, false);
+            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op8_addr64, pVCpu->iem.s.iEffSeg, false);
             IEM_NOT_REACHED_DEFAULT_CASE_RET();
         }
@@ -9318 +9318 @@
     {
         IEMOP_MNEMONIC("outs DX,Yb");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
-            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op8_addr16, pIemCpu->iEffSeg, false);
-            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op8_addr32, pIemCpu->iEffSeg, false);
-            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op8_addr64, pIemCpu->iEffSeg, false);
+            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op8_addr16, pVCpu->iem.s.iEffSeg, false);
+            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op8_addr32, pVCpu->iem.s.iEffSeg, false);
+            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op8_addr64, pVCpu->iem.s.iEffSeg, false);
             IEM_NOT_REACHED_DEFAULT_CASE_RET();
         }
@@ -9334 +9334 @@
     IEMOP_HLP_MIN_186();
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPZ | IEM_OP_PRF_REPNZ))
     {
         IEMOP_MNEMONIC("rep outs DX,Yv");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op16_addr16, pIemCpu->iEffSeg, false);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op16_addr32, pIemCpu->iEffSeg, false);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op16_addr64, pIemCpu->iEffSeg, false);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op16_addr16, pVCpu->iem.s.iEffSeg, false);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op16_addr32, pVCpu->iem.s.iEffSeg, false);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op16_addr64, pVCpu->iem.s.iEffSeg, false);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
@@ -9350 +9350 @@
             case IEMMODE_64BIT:
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op32_addr16, pIemCpu->iEffSeg, false);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op32_addr32, pIemCpu->iEffSeg, false);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op32_addr64, pIemCpu->iEffSeg, false);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op32_addr16, pVCpu->iem.s.iEffSeg, false);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op32_addr32, pVCpu->iem.s.iEffSeg, false);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_rep_outs_op32_addr64, pVCpu->iem.s.iEffSeg, false);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
@@ -9364 +9364 @@
     {
         IEMOP_MNEMONIC("outs DX,Yv");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op16_addr16, pIemCpu->iEffSeg, false);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op16_addr32, pIemCpu->iEffSeg, false);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op16_addr64, pIemCpu->iEffSeg, false);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op16_addr16, pVCpu->iem.s.iEffSeg, false);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op16_addr32, pVCpu->iem.s.iEffSeg, false);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op16_addr64, pVCpu->iem.s.iEffSeg, false);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
@@ -9377 +9377 @@
             case IEMMODE_64BIT:
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op32_addr16, pIemCpu->iEffSeg, false);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op32_addr32, pIemCpu->iEffSeg, false);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op32_addr64, pIemCpu->iEffSeg, false);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op32_addr16, pVCpu->iem.s.iEffSeg, false);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op32_addr32, pVCpu->iem.s.iEffSeg, false);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_outs_op32_addr64, pVCpu->iem.s.iEffSeg, false);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
@@ -9711 +9711 @@
         IEM_MC_ARG(uint32_t *,      pEFlags,                2);
 
-        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_REF_EFLAGS(pEFlags);
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, u8Src, pEFlags);
@@ -9738 +9738 @@
         IEM_MC_ARG_CONST(uint8_t,   u8Src, /*=*/ u8Imm,     1);
 
-        IEM_MC_MEM_MAP(pu8Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_MEM_MAP(pu8Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
         IEM_MC_FETCH_EFLAGS(EFlags);
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
             IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, u8Src, pEFlags);
         else
@@ -9761 +9761 @@
     PCIEMOPBINSIZES pImpl = g_apIemImplGrp1[(bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK];
 
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -9775 +9775 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                2);
 
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
@@ -9802 +9802 @@
                 uint16_t u16Imm; IEM_OPCODE_GET_NEXT_U16(&u16Imm);
                 IEM_MC_ASSIGN(u16Src, u16Imm);
-                IEM_MC_MEM_MAP(pu16Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu16Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
                 else
@@ -9829 +9829 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                2);
 
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
@@ -9857 +9857 @@
                 uint32_t u32Imm; IEM_OPCODE_GET_NEXT_U32(&u32Imm);
                 IEM_MC_ASSIGN(u32Src, u32Imm);
-                IEM_MC_MEM_MAP(pu32Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu32Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
                 else
@@ -9884 +9884 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                2);
 
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
@@ -9911 +9911 @@
                 uint64_t u64Imm; IEM_OPCODE_GET_NEXT_S32_SX_U64(&u64Imm);
                 IEM_MC_ASSIGN(u64Src, u64Imm);
-                IEM_MC_MEM_MAP(pu64Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu64Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
                 else
@@ -9955 +9955 @@
         IEMOP_HLP_NO_LOCK_PREFIX();
         uint8_t u8Imm; IEM_OPCODE_GET_NEXT_U8(&u8Imm);
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -9964 +9964 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                    2);
 
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
@@ -9980 +9980 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                    2);
 
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
@@ -9997 +9997 @@
                 IEM_MC_ARG(uint32_t *,      pEFlags,                    2);
 
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
@@ -10021 +10021 @@
         }
 
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -10034 +10034 @@
                 uint8_t u8Imm; IEM_OPCODE_GET_NEXT_U8(&u8Imm);
                 IEM_MC_ASSIGN(u16Src, (int8_t)u8Imm);
-                IEM_MC_MEM_MAP(pu16Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu16Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, u16Src, pEFlags);
                 else
@@ -10059 +10059 @@
                 uint8_t u8Imm; IEM_OPCODE_GET_NEXT_U8(&u8Imm);
                 IEM_MC_ASSIGN(u32Src, (int8_t)u8Imm);
-                IEM_MC_MEM_MAP(pu32Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu32Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, u32Src, pEFlags);
                 else
@@ -10084 +10084 @@
                 uint8_t u8Imm; IEM_OPCODE_GET_NEXT_U8(&u8Imm);
                 IEM_MC_ASSIGN(u64Src, (int8_t)u8Imm);
-                IEM_MC_MEM_MAP(pu64Dst, fAccess, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu64Dst, fAccess, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
-                if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+                if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, u64Src, pEFlags);
                 else
@@ -10140 +10140 @@
         IEM_MC_LOCAL(uint8_t, uTmp2);
 
-        IEM_MC_FETCH_GREG_U8(uTmp1, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-        IEM_MC_FETCH_GREG_U8(uTmp2, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-        IEM_MC_STORE_GREG_U8((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB,                              uTmp1);
-        IEM_MC_STORE_GREG_U8(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, uTmp2);
+        IEM_MC_FETCH_GREG_U8(uTmp1, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_FETCH_GREG_U8(uTmp2, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+        IEM_MC_STORE_GREG_U8((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB,                              uTmp1);
+        IEM_MC_STORE_GREG_U8(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, uTmp2);
 
         IEM_MC_ADVANCE_RIP();
@@ -10160 +10160 @@
 
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_MEM_MAP(pu8Mem, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-        IEM_MC_REF_GREG_U8(pu8Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+        IEM_MC_MEM_MAP(pu8Mem, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_REF_GREG_U8(pu8Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
         IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u8, pu8Mem, pu8Reg);
         IEM_MC_MEM_COMMIT_AND_UNMAP(pu8Mem, IEM_ACCESS_DATA_RW);
@@ -10185 +10185 @@
         IEMOP_HLP_NO_LOCK_PREFIX();
 
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -10192 +10192 @@
                 IEM_MC_LOCAL(uint16_t, uTmp2);
 
-                IEM_MC_FETCH_GREG_U16(uTmp1, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_FETCH_GREG_U16(uTmp2, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB,                              uTmp1);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, uTmp2);
+                IEM_MC_FETCH_GREG_U16(uTmp1, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_FETCH_GREG_U16(uTmp2, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB,                              uTmp1);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, uTmp2);
 
                 IEM_MC_ADVANCE_RIP();
@@ -10206 +10206 @@
                 IEM_MC_LOCAL(uint32_t, uTmp2);
 
-                IEM_MC_FETCH_GREG_U32(uTmp1, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_FETCH_GREG_U32(uTmp2, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB,                              uTmp1);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, uTmp2);
+                IEM_MC_FETCH_GREG_U32(uTmp1, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_FETCH_GREG_U32(uTmp2, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB,                              uTmp1);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, uTmp2);
 
                 IEM_MC_ADVANCE_RIP();
@@ -10220 +10220 @@
                 IEM_MC_LOCAL(uint64_t, uTmp2);
 
-                IEM_MC_FETCH_GREG_U64(uTmp1, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_FETCH_GREG_U64(uTmp2, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB,                              uTmp1);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, uTmp2);
+                IEM_MC_FETCH_GREG_U64(uTmp1, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_FETCH_GREG_U64(uTmp2, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB,                              uTmp1);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, uTmp2);
 
                 IEM_MC_ADVANCE_RIP();
@@ -10237 +10237 @@
          * We're accessing memory.
          */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
 /** @todo the register must be committed separately! */
@@ -10247 +10247 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu16Mem, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_REF_GREG_U16(pu16Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu16Mem, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_REF_GREG_U16(pu16Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u16, pu16Mem, pu16Reg);
                 IEM_MC_MEM_COMMIT_AND_UNMAP(pu16Mem, IEM_ACCESS_DATA_RW);
@@ -10263 +10263 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu32Mem, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_REF_GREG_U32(pu32Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu32Mem, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_REF_GREG_U32(pu32Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u32, pu32Mem, pu32Reg);
                 IEM_MC_MEM_COMMIT_AND_UNMAP(pu32Mem, IEM_ACCESS_DATA_RW);
@@ -10280 +10280 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu64Mem, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_REF_GREG_U64(pu64Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
+                IEM_MC_MEM_MAP(pu64Mem, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_REF_GREG_U64(pu64Reg, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
                 IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u64, pu64Mem, pu64Reg);
                 IEM_MC_MEM_COMMIT_AND_UNMAP(pu64Mem, IEM_ACCESS_DATA_RW);
@@ -10311 +10311 @@
         IEM_MC_BEGIN(0, 1);
         IEM_MC_LOCAL(uint8_t, u8Value);
-        IEM_MC_FETCH_GREG_U8(u8Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-        IEM_MC_STORE_GREG_U8((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u8Value);
+        IEM_MC_FETCH_GREG_U8(u8Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_STORE_GREG_U8((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u8Value);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -10325 +10325 @@
         IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_FETCH_GREG_U8(u8Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-        IEM_MC_STORE_MEM_U8(pIemCpu->iEffSeg, GCPtrEffDst, u8Value);
+        IEM_MC_FETCH_GREG_U8(u8Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+        IEM_MC_STORE_MEM_U8(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u8Value);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -10348 +10348 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint16_t, u16Value);
-                IEM_MC_FETCH_GREG_U16(u16Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u16Value);
+                IEM_MC_FETCH_GREG_U16(u16Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u16Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10362 +10362 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint32_t, u32Value);
-                IEM_MC_FETCH_GREG_U32(u32Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u32Value);
+                IEM_MC_FETCH_GREG_U32(u32Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10371 +10371 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint64_t, u64Value);
-                IEM_MC_FETCH_GREG_U64(u64Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u64Value);
+                IEM_MC_FETCH_GREG_U64(u64Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10383 +10383 @@
          * We're writing a register to memory.
          */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -10390 +10390 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_GREG_U16(u16Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_STORE_MEM_U16(pIemCpu->iEffSeg, GCPtrEffDst, u16Value);
+                IEM_MC_FETCH_GREG_U16(u16Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u16Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10401 +10401 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_GREG_U32(u32Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_STORE_MEM_U32(pIemCpu->iEffSeg, GCPtrEffDst, u32Value);
+                IEM_MC_FETCH_GREG_U32(u32Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_STORE_MEM_U32(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10412 +10412 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_GREG_U64(u64Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg);
-                IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrEffDst, u64Value);
+                IEM_MC_FETCH_GREG_U64(u64Value, ((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg);
+                IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10438 +10438 @@
         IEM_MC_BEGIN(0, 1);
         IEM_MC_LOCAL(uint8_t, u8Value);
-        IEM_MC_FETCH_GREG_U8(u8Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-        IEM_MC_STORE_GREG_U8(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u8Value);
+        IEM_MC_FETCH_GREG_U8(u8Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+        IEM_MC_STORE_GREG_U8(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u8Value);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -10452 +10452 @@
         IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_FETCH_MEM_U8(u8Value, pIemCpu->iEffSeg, GCPtrEffDst);
-        IEM_MC_STORE_GREG_U8(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u8Value);
+        IEM_MC_FETCH_MEM_U8(u8Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+        IEM_MC_STORE_GREG_U8(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u8Value);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -10474 +10474 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint16_t, u16Value);
-                IEM_MC_FETCH_GREG_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Value);
+                IEM_MC_FETCH_GREG_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10488 +10488 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint32_t, u32Value);
-                IEM_MC_FETCH_GREG_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+                IEM_MC_FETCH_GREG_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10497 +10497 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint64_t, u64Value);
-                IEM_MC_FETCH_GREG_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+                IEM_MC_FETCH_GREG_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10509 +10509 @@
          * We're loading a register from memory.
          */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -10516 +10516 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U16(u16Value, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Value);
+                IEM_MC_FETCH_MEM_U16(u16Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10527 +10527 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U32(u32Value, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Value);
+                IEM_MC_FETCH_MEM_U32(u32Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10538 +10538 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U64(u64Value, pIemCpu->iEffSeg, GCPtrEffDst);
-                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u64Value);
+                IEM_MC_FETCH_MEM_U64(u64Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10552 +10552 @@
 FNIEMOP_DEF(iemOp_arpl_Ew_Gw_movsx_Gv_Ev)
 {
-    if (pIemCpu->enmCpuMode != IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT)
         return FNIEMOP_CALL(iemOp_arpl_Ew_Gw);
-    if (pIemCpu->enmEffOpSize != IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmEffOpSize != IEMMODE_64BIT)
         return FNIEMOP_CALL(iemOp_mov_Gv_Ev);
     return FNIEMOP_CALL(iemOp_movsxd_Gv_Ev);
@@ -10582 +10582 @@
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -10588 +10588 @@
                 IEM_MC_LOCAL(uint16_t, u16Value);
                 IEM_MC_FETCH_SREG_U16(u16Value, iSegReg);
-                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u16Value);
+                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u16Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10597 +10597 @@
                 IEM_MC_LOCAL(uint32_t, u32Value);
                 IEM_MC_FETCH_SREG_ZX_U32(u32Value, iSegReg);
-                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u32Value);
+                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10606 +10606 @@
                 IEM_MC_LOCAL(uint64_t, u64Value);
                 IEM_MC_FETCH_SREG_ZX_U64(u64Value, iSegReg);
-                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u64Value);
+                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Value);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -10619 +10619 @@
          */
 #if 0 /* not necessary */
-        pIemCpu->enmEffOpSize = pIemCpu->enmDefOpSize = IEMMODE_16BIT;
+        pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.enmDefOpSize = IEMMODE_16BIT;
 #endif
         IEM_MC_BEGIN(0, 2);
@@ -10626 +10626 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_FETCH_SREG_U16(u16Value, iSegReg);
-        IEM_MC_STORE_MEM_U16(pIemCpu->iEffSeg, GCPtrEffDst, u16Value);
+        IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u16Value);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -10645 +10645 @@
         return IEMOP_RAISE_INVALID_OPCODE(); /* no register form */
 
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -10653 +10653 @@
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
             IEM_MC_ASSIGN_TO_SMALLER(u16Cast, GCPtrEffSrc);
-            IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u16Cast);
+            IEM_MC_STORE_GREG_U16(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u16Cast);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -10664 +10664 @@
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
             IEM_MC_ASSIGN_TO_SMALLER(u32Cast, GCPtrEffSrc);
-            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, u32Cast);
+            IEM_MC_STORE_GREG_U32(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, u32Cast);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -10673 +10673 @@
             IEM_MC_LOCAL(RTGCPTR, GCPtrEffSrc);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pIemCpu->uRexReg, GCPtrEffSrc);
+            IEM_MC_STORE_GREG_U64(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, GCPtrEffSrc);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -10694 +10694 @@
      */
 #if 0 /* not necessary */
-    pIemCpu->enmEffOpSize = pIemCpu->enmDefOpSize = IEMMODE_16BIT;
+    pVCpu->iem.s.enmEffOpSize = pVCpu->iem.s.enmDefOpSize = IEMMODE_16BIT;
 #endif
 
@@ -10714 +10714 @@
         IEM_MC_ARG_CONST(uint8_t, iSRegArg, iSegReg, 0);
         IEM_MC_ARG(uint16_t,      u16Value,          1);
-        IEM_MC_FETCH_GREG_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_FETCH_GREG_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_CALL_CIMPL_2(iemCImpl_load_SReg, iSRegArg, u16Value);
         IEM_MC_END();
@@ -10729 +10729 @@
         IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_FETCH_MEM_U16(u16Value, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FETCH_MEM_U16(u16Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
         IEM_MC_CALL_CIMPL_2(iemCImpl_load_SReg, iSRegArg, u16Value);
         IEM_MC_END();
@@ -10755 +10755 @@
     /* Register access is relatively easy and can share code. */
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
-        return FNIEMOP_CALL_1(iemOpCommonPopGReg, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        return FNIEMOP_CALL_1(iemOpCommonPopGReg, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
 
     /*
@@ -10772 +10772 @@
 #ifndef TST_IEM_CHECK_MC
     /* Calc effective address with modified ESP. */
-    uint8_t const   offOpcodeSaved = pIemCpu->offOpcode;
+    uint8_t const   offOpcodeSaved = pVCpu->iem.s.offOpcode;
     RTGCPTR         GCPtrEff;
     VBOXSTRICTRC    rcStrict;
-    rcStrict = iemOpHlpCalcRmEffAddr(pIemCpu, bRm, 0, &GCPtrEff);
+    rcStrict = iemOpHlpCalcRmEffAddr(pVCpu, bRm, 0, &GCPtrEff);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
-    pIemCpu->offOpcode = offOpcodeSaved;
-
-    PCPUMCTX        pCtx     = pIemCpu->CTX_SUFF(pCtx);
+    pVCpu->iem.s.offOpcode = offOpcodeSaved;
+
+    PCPUMCTX        pCtx     = pVCpu->iem.s.CTX_SUFF(pCtx);
     uint64_t const  RspSaved = pCtx->rsp;
-    switch (pIemCpu->enmEffOpSize)
-    {
-        case IEMMODE_16BIT: iemRegAddToRsp(pIemCpu, pCtx, 2); break;
-        case IEMMODE_32BIT: iemRegAddToRsp(pIemCpu, pCtx, 4); break;
-        case IEMMODE_64BIT: iemRegAddToRsp(pIemCpu, pCtx, 8); break;
+    switch (pVCpu->iem.s.enmEffOpSize)
+    {
+        case IEMMODE_16BIT: iemRegAddToRsp(pVCpu, pCtx, 2); break;
+        case IEMMODE_32BIT: iemRegAddToRsp(pVCpu, pCtx, 4); break;
+        case IEMMODE_64BIT: iemRegAddToRsp(pVCpu, pCtx, 8); break;
         IEM_NOT_REACHED_DEFAULT_CASE_RET();
     }
-    rcStrict = iemOpHlpCalcRmEffAddr(pIemCpu, bRm, 0, &GCPtrEff);
+    rcStrict = iemOpHlpCalcRmEffAddr(pVCpu, bRm, 0, &GCPtrEff);
     Assert(rcStrict == VINF_SUCCESS);
     pCtx->rsp = RspSaved;
@@ -10796 +10796 @@
     RTUINT64U TmpRsp;
     TmpRsp.u = pCtx->rsp;
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
         {
             uint16_t u16Value;
-            rcStrict = iemMemStackPopU16Ex(pIemCpu, &u16Value, &TmpRsp);
+            rcStrict = iemMemStackPopU16Ex(pVCpu, &u16Value, &TmpRsp);
             if (rcStrict == VINF_SUCCESS)
-                rcStrict = iemMemStoreDataU16(pIemCpu, pIemCpu->iEffSeg, GCPtrEff, u16Value);
+                rcStrict = iemMemStoreDataU16(pVCpu, pVCpu->iem.s.iEffSeg, GCPtrEff, u16Value);
             break;
         }
@@ -10810 +10810 @@
         {
             uint32_t u32Value;
-            rcStrict = iemMemStackPopU32Ex(pIemCpu, &u32Value, &TmpRsp);
+            rcStrict = iemMemStackPopU32Ex(pVCpu, &u32Value, &TmpRsp);
             if (rcStrict == VINF_SUCCESS)
-                rcStrict = iemMemStoreDataU32(pIemCpu, pIemCpu->iEffSeg, GCPtrEff, u32Value);
+                rcStrict = iemMemStoreDataU32(pVCpu, pVCpu->iem.s.iEffSeg, GCPtrEff, u32Value);
             break;
         }
@@ -10819 +10819 @@
         {
             uint64_t u64Value;
-            rcStrict = iemMemStackPopU64Ex(pIemCpu, &u64Value, &TmpRsp);
+            rcStrict = iemMemStackPopU64Ex(pVCpu, &u64Value, &TmpRsp);
             if (rcStrict == VINF_SUCCESS)
-                rcStrict = iemMemStoreDataU64(pIemCpu, pIemCpu->iEffSeg, GCPtrEff, u64Value);
+                rcStrict = iemMemStoreDataU64(pVCpu, pVCpu->iem.s.iEffSeg, GCPtrEff, u64Value);
             break;
         }
@@ -10830 +10830 @@
     {
         pCtx->rsp = TmpRsp.u;
-        iemRegUpdateRipAndClearRF(pIemCpu);
+        iemRegUpdateRipAndClearRF(pVCpu);
     }
     return rcStrict;
@@ -10861 +10861 @@
     IEMOP_HLP_NO_LOCK_PREFIX();
 
-    iReg |= pIemCpu->uRexB;
-    switch (pIemCpu->enmEffOpSize)
+    iReg |= pVCpu->iem.s.uRexB;
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -10909 +10909 @@
 {
     /* R8/R8D and RAX/EAX can be exchanged. */
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REX_B)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REX_B)
     {
         IEMOP_MNEMONIC("xchg r8,rAX");
@@ -10915 +10915 @@
     }
 
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_LOCK)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK)
         IEMOP_MNEMONIC("pause");
     else
@@ -10986 +10986 @@
 {
     IEMOP_HLP_NO_LOCK_PREFIX();
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -11033 +11033 @@
 {
     IEMOP_HLP_NO_LOCK_PREFIX();
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -11084 +11084 @@
     /* Decode the far pointer address and pass it on to the far call C implementation. */
     uint32_t offSeg;
-    if (pIemCpu->enmEffOpSize != IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize != IEMMODE_16BIT)
         IEM_OPCODE_GET_NEXT_U32(&offSeg);
     else
@@ -11090 +11090 @@
     uint16_t uSel;  IEM_OPCODE_GET_NEXT_U16(&uSel);
     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_3(iemCImpl_callf, uSel, offSeg, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_3(iemCImpl_callf, uSel, offSeg, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -11114 +11114 @@
     IEMOP_HLP_NO_LOCK_PREFIX();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_pushf, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_pushf, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -11123 +11123 @@
     IEMOP_HLP_NO_LOCK_PREFIX();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_popf, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_popf, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -11132 +11132 @@
     IEMOP_MNEMONIC("sahf");
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (   pIemCpu->enmCpuMode == IEMMODE_64BIT
-        && !IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fLahfSahf)
+    if (   pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT
+        && !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLahfSahf)
         return IEMOP_RAISE_INVALID_OPCODE();
     IEM_MC_BEGIN(0, 2);
@@ -11156 +11156 @@
     IEMOP_MNEMONIC("lahf");
     IEMOP_HLP_NO_LOCK_PREFIX();
-    if (   pIemCpu->enmCpuMode == IEMMODE_64BIT
-        && !IEM_GET_GUEST_CPU_FEATURES(pIemCpu)->fLahfSahf)
+    if (   pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT
+        && !IEM_GET_GUEST_CPU_FEATURES(pVCpu)->fLahfSahf)
         return IEMOP_RAISE_INVALID_OPCODE();
     IEM_MC_BEGIN(0, 1);
@@ -11178 +11178 @@
     do \
     { \
-        switch (pIemCpu->enmEffAddrMode) \
+        switch (pVCpu->iem.s.enmEffAddrMode) \
         { \
             case IEMMODE_16BIT: \
@@ -11208 +11208 @@
     IEM_MC_BEGIN(0,1);
     IEM_MC_LOCAL(uint8_t, u8Tmp);
-    IEM_MC_FETCH_MEM_U8(u8Tmp, pIemCpu->iEffSeg, GCPtrMemOff);
+    IEM_MC_FETCH_MEM_U8(u8Tmp, pVCpu->iem.s.iEffSeg, GCPtrMemOff);
     IEM_MC_STORE_GREG_U8(X86_GREG_xAX, u8Tmp);
     IEM_MC_ADVANCE_RIP();
@@ -11229 +11229 @@
      * Fetch rAX.
      */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
             IEM_MC_BEGIN(0,1);
             IEM_MC_LOCAL(uint16_t, u16Tmp);
-            IEM_MC_FETCH_MEM_U16(u16Tmp, pIemCpu->iEffSeg, GCPtrMemOff);
+            IEM_MC_FETCH_MEM_U16(u16Tmp, pVCpu->iem.s.iEffSeg, GCPtrMemOff);
             IEM_MC_STORE_GREG_U16(X86_GREG_xAX, u16Tmp);
             IEM_MC_ADVANCE_RIP();
@@ -11243 +11243 @@
             IEM_MC_BEGIN(0,1);
             IEM_MC_LOCAL(uint32_t, u32Tmp);
-            IEM_MC_FETCH_MEM_U32(u32Tmp, pIemCpu->iEffSeg, GCPtrMemOff);
+            IEM_MC_FETCH_MEM_U32(u32Tmp, pVCpu->iem.s.iEffSeg, GCPtrMemOff);
             IEM_MC_STORE_GREG_U32(X86_GREG_xAX, u32Tmp);
             IEM_MC_ADVANCE_RIP();
@@ -11252 +11252 @@
             IEM_MC_BEGIN(0,1);
             IEM_MC_LOCAL(uint64_t, u64Tmp);
-            IEM_MC_FETCH_MEM_U64(u64Tmp, pIemCpu->iEffSeg, GCPtrMemOff);
+            IEM_MC_FETCH_MEM_U64(u64Tmp, pVCpu->iem.s.iEffSeg, GCPtrMemOff);
             IEM_MC_STORE_GREG_U64(X86_GREG_xAX, u64Tmp);
             IEM_MC_ADVANCE_RIP();
@@ -11278 +11278 @@
     IEM_MC_LOCAL(uint8_t, u8Tmp);
     IEM_MC_FETCH_GREG_U8(u8Tmp, X86_GREG_xAX);
-    IEM_MC_STORE_MEM_U8(pIemCpu->iEffSeg, GCPtrMemOff, u8Tmp);
+    IEM_MC_STORE_MEM_U8(pVCpu->iem.s.iEffSeg, GCPtrMemOff, u8Tmp);
     IEM_MC_ADVANCE_RIP();
     IEM_MC_END();
@@ -11297 +11297 @@
      * Store rAX.
      */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -11303 +11303 @@
             IEM_MC_LOCAL(uint16_t, u16Tmp);
             IEM_MC_FETCH_GREG_U16(u16Tmp, X86_GREG_xAX);
-            IEM_MC_STORE_MEM_U16(pIemCpu->iEffSeg, GCPtrMemOff, u16Tmp);
+            IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrMemOff, u16Tmp);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -11312 +11312 @@
             IEM_MC_LOCAL(uint32_t, u32Tmp);
             IEM_MC_FETCH_GREG_U32(u32Tmp, X86_GREG_xAX);
-            IEM_MC_STORE_MEM_U32(pIemCpu->iEffSeg, GCPtrMemOff, u32Tmp);
+            IEM_MC_STORE_MEM_U32(pVCpu->iem.s.iEffSeg, GCPtrMemOff, u32Tmp);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -11321 +11321 @@
             IEM_MC_LOCAL(uint64_t, u64Tmp);
             IEM_MC_FETCH_GREG_U64(u64Tmp, X86_GREG_xAX);
-            IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrMemOff, u64Tmp);
+            IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrMemOff, u64Tmp);
             IEM_MC_ADVANCE_RIP();
             IEM_MC_END();
@@ -11336 +11336 @@
         IEM_MC_LOCAL(RTGCPTR,           uAddr); \
         IEM_MC_FETCH_GREG_U##AddrBits##_ZX_U64(uAddr, X86_GREG_xSI); \
-        IEM_MC_FETCH_MEM_U##ValBits(uValue, pIemCpu->iEffSeg, uAddr); \
+        IEM_MC_FETCH_MEM_U##ValBits(uValue, pVCpu->iem.s.iEffSeg, uAddr); \
         IEM_MC_FETCH_GREG_U##AddrBits##_ZX_U64(uAddr, X86_GREG_xDI); \
         IEM_MC_STORE_MEM_U##ValBits(X86_SREG_ES, uAddr, uValue); \
@@ -11357 +11357 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         IEMOP_MNEMONIC("rep movsb Xb,Yb");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
-            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op8_addr16, pIemCpu->iEffSeg);
-            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op8_addr32, pIemCpu->iEffSeg);
-            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op8_addr64, pIemCpu->iEffSeg);
+            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op8_addr16, pVCpu->iem.s.iEffSeg);
+            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op8_addr32, pVCpu->iem.s.iEffSeg);
+            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op8_addr64, pVCpu->iem.s.iEffSeg);
             IEM_NOT_REACHED_DEFAULT_CASE_RET();
         }
@@ -11373 +11373 @@
      * Sharing case implementation with movs[wdq] below.
      */
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT: IEM_MOVS_CASE(8, 16); break;
@@ -11392 +11392 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         IEMOP_MNEMONIC("rep movs Xv,Yv");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op16_addr16, pIemCpu->iEffSeg);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op16_addr32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op16_addr64, pIemCpu->iEffSeg);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op16_addr16, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op16_addr32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op16_addr64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
                 break;
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op32_addr16, pIemCpu->iEffSeg);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op32_addr32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op32_addr64, pIemCpu->iEffSeg);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op32_addr16, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op32_addr32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op32_addr64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
             case IEMMODE_64BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_6);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op64_addr32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op64_addr64, pIemCpu->iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op64_addr32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_rep_movs_op64_addr64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
@@ -11431 +11431 @@
      * Using ugly macro for implementing the cases, sharing it with movsb.
      */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_MOVS_CASE(16, 16); break;
@@ -11444 +11444 @@
 
         case IEMMODE_32BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_MOVS_CASE(32, 16); break;
@@ -11454 +11454 @@
 
         case IEMMODE_64BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_1); /* cannot be encoded */ break;
@@ -11479 +11479 @@
         \
         IEM_MC_FETCH_GREG_U##AddrBits##_ZX_U64(uAddr, X86_GREG_xSI); \
-        IEM_MC_FETCH_MEM_U##ValBits(uValue1, pIemCpu->iEffSeg, uAddr); \
+        IEM_MC_FETCH_MEM_U##ValBits(uValue1, pVCpu->iem.s.iEffSeg, uAddr); \
         IEM_MC_FETCH_GREG_U##AddrBits##_ZX_U64(uAddr, X86_GREG_xDI); \
         IEM_MC_FETCH_MEM_U##ValBits(uValue2, X86_SREG_ES, uAddr); \
@@ -11504 +11504 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REPZ)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REPZ)
     {
         IEMOP_MNEMONIC("repe cmps Xb,Yb");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
-            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op8_addr16, pIemCpu->iEffSeg);
-            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op8_addr32, pIemCpu->iEffSeg);
-            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op8_addr64, pIemCpu->iEffSeg);
+            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op8_addr16, pVCpu->iem.s.iEffSeg);
+            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op8_addr32, pVCpu->iem.s.iEffSeg);
+            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op8_addr64, pVCpu->iem.s.iEffSeg);
             IEM_NOT_REACHED_DEFAULT_CASE_RET();
         }
     }
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REPNZ)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REPNZ)
     {
         IEMOP_MNEMONIC("repe cmps Xb,Yb");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
-            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op8_addr16, pIemCpu->iEffSeg);
-            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op8_addr32, pIemCpu->iEffSeg);
-            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op8_addr64, pIemCpu->iEffSeg);
+            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op8_addr16, pVCpu->iem.s.iEffSeg);
+            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op8_addr32, pVCpu->iem.s.iEffSeg);
+            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op8_addr64, pVCpu->iem.s.iEffSeg);
             IEM_NOT_REACHED_DEFAULT_CASE_RET();
         }
@@ -11531 +11531 @@
      * Sharing case implementation with cmps[wdq] below.
      */
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT: IEM_CMPS_CASE(8, 16); break;
@@ -11551 +11551 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REPZ)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REPZ)
     {
         IEMOP_MNEMONIC("repe cmps Xv,Yv");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op16_addr16, pIemCpu->iEffSeg);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op16_addr32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op16_addr64, pIemCpu->iEffSeg);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op16_addr16, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op16_addr32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op16_addr64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
                 break;
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op32_addr16, pIemCpu->iEffSeg);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op32_addr32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op32_addr64, pIemCpu->iEffSeg);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op32_addr16, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op32_addr32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op32_addr64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
             case IEMMODE_64BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_4);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op64_addr32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op64_addr64, pIemCpu->iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op64_addr32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repe_cmps_op64_addr64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
@@ -11585 +11585 @@
     }
 
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REPNZ)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REPNZ)
     {
         IEMOP_MNEMONIC("repne cmps Xv,Yv");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op16_addr16, pIemCpu->iEffSeg);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op16_addr32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op16_addr64, pIemCpu->iEffSeg);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op16_addr16, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op16_addr32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op16_addr64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
                 break;
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op32_addr16, pIemCpu->iEffSeg);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op32_addr32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op32_addr64, pIemCpu->iEffSeg);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op32_addr16, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op32_addr32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op32_addr64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
             case IEMMODE_64BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_2);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op64_addr32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op64_addr64, pIemCpu->iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op64_addr32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_repne_cmps_op64_addr64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
@@ -11625 +11625 @@
      * Using ugly macro for implementing the cases, sharing it with cmpsb.
      */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_CMPS_CASE(16, 16); break;
@@ -11638 +11638 @@
 
         case IEMMODE_32BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_CMPS_CASE(32, 16); break;
@@ -11648 +11648 @@
 
         case IEMMODE_64BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_1); /* cannot be encoded */ break;
@@ -11706 +11706 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         IEMOP_MNEMONIC("rep stos Yb,al");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
             case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_stos_al_m16);
@@ -11722 +11722 @@
      * Sharing case implementation with stos[wdq] below.
      */
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT: IEM_STOS_CASE(8, 16); break;
@@ -11741 +11741 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         IEMOP_MNEMONIC("rep stos Yv,rAX");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_stos_ax_m16);
@@ -11756 +11756 @@
                 break;
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_stos_eax_m16);
@@ -11764 +11764 @@
                 }
             case IEMMODE_64BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_9);
@@ -11780 +11780 @@
      * Using ugly macro for implementing the cases, sharing it with stosb.
      */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_STOS_CASE(16, 16); break;
@@ -11793 +11793 @@
 
         case IEMMODE_32BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_STOS_CASE(32, 16); break;
@@ -11803 +11803 @@
 
         case IEMMODE_64BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_1); /* cannot be encoded */ break;
@@ -11824 +11824 @@
         IEM_MC_LOCAL(RTGCPTR, uAddr); \
         IEM_MC_FETCH_GREG_U##AddrBits##_ZX_U64(uAddr, X86_GREG_xSI); \
-        IEM_MC_FETCH_MEM_U##ValBits(uValue, pIemCpu->iEffSeg, uAddr); \
+        IEM_MC_FETCH_MEM_U##ValBits(uValue, pVCpu->iem.s.iEffSeg, uAddr); \
         IEM_MC_STORE_GREG_U##ValBits(X86_GREG_xAX, uValue); \
         IEM_MC_IF_EFL_BIT_SET(X86_EFL_DF) { \
@@ -11842 +11842 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         IEMOP_MNEMONIC("rep lodsb al,Xb");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
-            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_al_m16, pIemCpu->iEffSeg);
-            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_al_m32, pIemCpu->iEffSeg);
-            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_al_m64, pIemCpu->iEffSeg);
+            case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_al_m16, pVCpu->iem.s.iEffSeg);
+            case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_al_m32, pVCpu->iem.s.iEffSeg);
+            case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_al_m64, pVCpu->iem.s.iEffSeg);
             IEM_NOT_REACHED_DEFAULT_CASE_RET();
         }
@@ -11858 +11858 @@
      * Sharing case implementation with stos[wdq] below.
      */
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT: IEM_LODS_CASE(8, 16); break;
@@ -11877 +11877 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
+    if (pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ))
     {
         IEMOP_MNEMONIC("rep lods rAX,Xv");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_ax_m16, pIemCpu->iEffSeg);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_ax_m32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_ax_m64, pIemCpu->iEffSeg);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_ax_m16, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_ax_m32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_ax_m64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
                 break;
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
-                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_eax_m16, pIemCpu->iEffSeg);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_eax_m32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_eax_m64, pIemCpu->iEffSeg);
+                    case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_eax_m16, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_eax_m32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_eax_m64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
             case IEMMODE_64BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_7);
-                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_rax_m32, pIemCpu->iEffSeg);
-                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_rax_m64, pIemCpu->iEffSeg);
+                    case IEMMODE_32BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_rax_m32, pVCpu->iem.s.iEffSeg);
+                    case IEMMODE_64BIT: return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_lods_rax_m64, pVCpu->iem.s.iEffSeg);
                     IEM_NOT_REACHED_DEFAULT_CASE_RET();
                 }
@@ -11916 +11916 @@
      * Using ugly macro for implementing the cases, sharing it with lodsb.
      */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_LODS_CASE(16, 16); break;
@@ -11929 +11929 @@
 
         case IEMMODE_32BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_LODS_CASE(32, 16); break;
@@ -11939 +11939 @@
 
         case IEMMODE_64BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_1); /* cannot be encoded */ break;
@@ -11984 +11984 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REPZ)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REPZ)
     {
         IEMOP_MNEMONIC("repe scasb al,Xb");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
             case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_repe_scas_al_m16);
@@ -11995 +11995 @@
         }
     }
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REPNZ)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REPNZ)
     {
         IEMOP_MNEMONIC("repne scasb al,Xb");
-        switch (pIemCpu->enmEffAddrMode)
+        switch (pVCpu->iem.s.enmEffAddrMode)
         {
             case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_repne_scas_al_m16);
@@ -12011 +12011 @@
      * Sharing case implementation with stos[wdq] below.
      */
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT: IEM_SCAS_CASE(8, 16); break;
@@ -12030 +12030 @@
      * Use the C implementation if a repeat prefix is encountered.
      */
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REPZ)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REPZ)
     {
         IEMOP_MNEMONIC("repe scas rAX,Xv");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_repe_scas_ax_m16);
@@ -12045 +12045 @@
                 break;
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_repe_scas_eax_m16);
@@ -12053 +12053 @@
                 }
             case IEMMODE_64BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_6); /** @todo It's this wrong, we can do 16-bit addressing in 64-bit mode, but not 32-bit. right? */
@@ -12063 +12063 @@
         }
     }
-    if (pIemCpu->fPrefixes & IEM_OP_PRF_REPNZ)
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_REPNZ)
     {
         IEMOP_MNEMONIC("repne scas rAX,Xv");
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_repne_scas_ax_m16);
@@ -12078 +12078 @@
                 break;
             case IEMMODE_32BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: return IEM_MC_DEFER_TO_CIMPL_0(iemCImpl_repne_scas_eax_m16);
@@ -12086 +12086 @@
                 }
             case IEMMODE_64BIT:
-                switch (pIemCpu->enmEffAddrMode)
+                switch (pVCpu->iem.s.enmEffAddrMode)
                 {
                     case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_5);
@@ -12102 +12102 @@
      * Using ugly macro for implementing the cases, sharing it with scasb.
      */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_SCAS_CASE(16, 16); break;
@@ -12115 +12115 @@
 
         case IEMMODE_32BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: IEM_SCAS_CASE(32, 16); break;
@@ -12125 +12125 @@
 
         case IEMMODE_64BIT:
-            switch (pIemCpu->enmEffAddrMode)
+            switch (pVCpu->iem.s.enmEffAddrMode)
             {
                 case IEMMODE_16BIT: AssertFailedReturn(VERR_IEM_IPE_1); /* cannot be encoded */ break;
@@ -12162 +12162 @@
 {
     IEMOP_MNEMONIC("mov AL,Ib");
-    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xAX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xAX | pVCpu->iem.s.uRexB);
 }
 
@@ -12170 +12170 @@
 {
     IEMOP_MNEMONIC("mov CL,Ib");
-    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xCX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xCX | pVCpu->iem.s.uRexB);
 }
 
@@ -12178 +12178 @@
 {
     IEMOP_MNEMONIC("mov DL,Ib");
-    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xDX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xDX | pVCpu->iem.s.uRexB);
 }
 
@@ -12186 +12186 @@
 {
     IEMOP_MNEMONIC("mov BL,Ib");
-    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xBX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xBX | pVCpu->iem.s.uRexB);
 }
 
@@ -12194 +12194 @@
 {
     IEMOP_MNEMONIC("mov AH,Ib");
-    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xSP | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xSP | pVCpu->iem.s.uRexB);
 }
 
@@ -12202 +12202 @@
 {
     IEMOP_MNEMONIC("mov CH,Ib");
-    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xBP | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xBP | pVCpu->iem.s.uRexB);
 }
 
@@ -12210 +12210 @@
 {
     IEMOP_MNEMONIC("mov DH,Ib");
-    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xSI | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xSI | pVCpu->iem.s.uRexB);
 }
 
@@ -12218 +12218 @@
 {
     IEMOP_MNEMONIC("mov BH,Ib");
-    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xDI | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_r8_Ib, X86_GREG_xDI | pVCpu->iem.s.uRexB);
 }
 
@@ -12227 +12227 @@
 FNIEMOP_DEF_1(iemOpCommonMov_Rv_Iv, uint8_t, iReg)
 {
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -12276 +12276 @@
 {
     IEMOP_MNEMONIC("mov rAX,IV");
-    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xAX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xAX | pVCpu->iem.s.uRexB);
 }
 
@@ -12284 +12284 @@
 {
     IEMOP_MNEMONIC("mov rCX,IV");
-    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xCX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xCX | pVCpu->iem.s.uRexB);
 }
 
@@ -12292 +12292 @@
 {
     IEMOP_MNEMONIC("mov rDX,IV");
-    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xDX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xDX | pVCpu->iem.s.uRexB);
 }
 
@@ -12300 +12300 @@
 {
     IEMOP_MNEMONIC("mov rBX,IV");
-    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xBX | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xBX | pVCpu->iem.s.uRexB);
 }
 
@@ -12308 +12308 @@
 {
     IEMOP_MNEMONIC("mov rSP,IV");
-    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xSP | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xSP | pVCpu->iem.s.uRexB);
 }
 
@@ -12316 +12316 @@
 {
     IEMOP_MNEMONIC("mov rBP,IV");
-    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xBP | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xBP | pVCpu->iem.s.uRexB);
 }
 
@@ -12324 +12324 @@
 {
     IEMOP_MNEMONIC("mov rSI,IV");
-    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xSI | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xSI | pVCpu->iem.s.uRexB);
 }
 
@@ -12332 +12332 @@
 {
     IEMOP_MNEMONIC("mov rDI,IV");
-    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xDI | pIemCpu->uRexB);
+    return FNIEMOP_CALL_1(iemOpCommonMov_Rv_Iv, X86_GREG_xDI | pVCpu->iem.s.uRexB);
 }
 
@@ -12365 +12365 @@
         IEM_MC_ARG_CONST(uint8_t,   cShiftArg, cShift, 1);
         IEM_MC_ARG(uint32_t *,      pEFlags,           2);
-        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_REF_EFLAGS(pEFlags);
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags);
@@ -12384 +12384 @@
         uint8_t cShift; IEM_OPCODE_GET_NEXT_U8(&cShift);
         IEM_MC_ASSIGN(cShiftArg, cShift);
-        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
         IEM_MC_FETCH_EFLAGS(EFlags);
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags);
@@ -12422 +12422 @@
         uint8_t cShift; IEM_OPCODE_GET_NEXT_U8(&cShift);
         IEMOP_HLP_NO_LOCK_PREFIX();
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -12429 +12429 @@
                 IEM_MC_ARG_CONST(uint8_t,   cShiftArg, cShift, 1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,           2);
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags);
@@ -12441 +12441 @@
                 IEM_MC_ARG_CONST(uint8_t,   cShiftArg, cShift, 1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,           2);
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags);
@@ -12454 +12454 @@
                 IEM_MC_ARG_CONST(uint8_t,   cShiftArg, cShift, 1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,           2);
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags);
@@ -12468 +12468 @@
         /* memory */
         IEMOP_HLP_NO_LOCK_PREFIX(); /** @todo should probably not be raised until we've fetched all the opcode bytes? */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -12480 +12480 @@
                 uint8_t cShift; IEM_OPCODE_GET_NEXT_U8(&cShift);
                 IEM_MC_ASSIGN(cShiftArg, cShift);
-                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags);
@@ -12500 +12500 @@
                 uint8_t cShift; IEM_OPCODE_GET_NEXT_U8(&cShift);
                 IEM_MC_ASSIGN(cShiftArg, cShift);
-                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags);
@@ -12520 +12520 @@
                 uint8_t cShift; IEM_OPCODE_GET_NEXT_U8(&cShift);
                 IEM_MC_ASSIGN(cShiftArg, cShift);
-                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags);
@@ -12543 +12543 @@
     IEMOP_HLP_NO_LOCK_PREFIX();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_retn, pIemCpu->enmEffOpSize, u16Imm);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_retn, pVCpu->iem.s.enmEffOpSize, u16Imm);
 }
 
@@ -12553 +12553 @@
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_retn, pIemCpu->enmEffOpSize, 0);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_retn, pVCpu->iem.s.enmEffOpSize, 0);
 }
 
@@ -12561 +12561 @@
 {
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    if (   pIemCpu->enmCpuMode == IEMMODE_64BIT
+    if (   pVCpu->iem.s.enmCpuMode == IEMMODE_64BIT
         || (bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
     {
@@ -12588 +12588 @@
        outside of 64-bit mode.  VEX is not available in real or v86 mode. */
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
-    if (pIemCpu->enmCpuMode != IEMMODE_64BIT)
+    if (pVCpu->iem.s.enmCpuMode != IEMMODE_64BIT)
     {
         if ((bRm & X86_MODRM_MOD_MASK) != (3 << X86_MODRM_MOD_SHIFT))
@@ -12605 +12605 @@
     uint8_t bOpcode; IEM_OPCODE_GET_NEXT_U8(&bOpcode);
 #if 0 /* will make sense of this next week... */
-    if (   !(pIemCpu->fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPZ | IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REX))
+    if (   !(pVCpu->iem.s.fPrefixes & (IEM_OP_PRF_REPNZ | IEM_OP_PRF_REPZ | IEM_OP_PRF_REPZ | IEM_OP_PRF_SIZE_OP | IEM_OP_PRF_REX))
         &&
         )
@@ -12632 +12632 @@
         uint8_t u8Imm; IEM_OPCODE_GET_NEXT_U8(&u8Imm);
         IEM_MC_BEGIN(0, 0);
-        IEM_MC_STORE_GREG_U8((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u8Imm);
+        IEM_MC_STORE_GREG_U8((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u8Imm);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -12643 +12643 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 1);
         uint8_t u8Imm; IEM_OPCODE_GET_NEXT_U8(&u8Imm);
-        IEM_MC_STORE_MEM_U8(pIemCpu->iEffSeg, GCPtrEffDst, u8Imm);
+        IEM_MC_STORE_MEM_U8(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u8Imm);
         IEM_MC_ADVANCE_RIP();
         IEM_MC_END();
@@ -12663 +12663 @@
     {
         /* register access */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
                 IEM_MC_BEGIN(0, 0);
                 uint16_t u16Imm; IEM_OPCODE_GET_NEXT_U16(&u16Imm);
-                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u16Imm);
+                IEM_MC_STORE_GREG_U16((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u16Imm);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -12676 +12676 @@
                 IEM_MC_BEGIN(0, 0);
                 uint32_t u32Imm; IEM_OPCODE_GET_NEXT_U32(&u32Imm);
-                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u32Imm);
+                IEM_MC_STORE_GREG_U32((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u32Imm);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -12684 +12684 @@
                 IEM_MC_BEGIN(0, 0);
                 uint64_t u64Imm; IEM_OPCODE_GET_NEXT_S32_SX_U64(&u64Imm);
-                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB, u64Imm);
+                IEM_MC_STORE_GREG_U64((bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB, u64Imm);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -12695 +12695 @@
     {
         /* memory access. */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -12702 +12702 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 2);
                 uint16_t u16Imm; IEM_OPCODE_GET_NEXT_U16(&u16Imm);
-                IEM_MC_STORE_MEM_U16(pIemCpu->iEffSeg, GCPtrEffDst, u16Imm);
+                IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u16Imm);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -12712 +12712 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 4);
                 uint32_t u32Imm; IEM_OPCODE_GET_NEXT_U32(&u32Imm);
-                IEM_MC_STORE_MEM_U32(pIemCpu->iEffSeg, GCPtrEffDst, u32Imm);
+                IEM_MC_STORE_MEM_U32(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u32Imm);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -12722 +12722 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 4);
                 uint64_t u64Imm; IEM_OPCODE_GET_NEXT_S32_SX_U64(&u64Imm);
-                IEM_MC_STORE_MEM_U64(pIemCpu->iEffSeg, GCPtrEffDst, u64Imm);
+                IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u64Imm);
                 IEM_MC_ADVANCE_RIP();
                 IEM_MC_END();
@@ -12744 +12744 @@
     uint16_t cbFrame;        IEM_OPCODE_GET_NEXT_U16(&cbFrame);
     uint8_t  u8NestingLevel; IEM_OPCODE_GET_NEXT_U8(&u8NestingLevel);
-    return IEM_MC_DEFER_TO_CIMPL_3(iemCImpl_enter, pIemCpu->enmEffOpSize, cbFrame, u8NestingLevel);
+    return IEM_MC_DEFER_TO_CIMPL_3(iemCImpl_enter, pVCpu->iem.s.enmEffOpSize, cbFrame, u8NestingLevel);
 }
 
@@ -12755 +12755 @@
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_leave, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_leave, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -12766 +12766 @@
     IEMOP_HLP_NO_LOCK_PREFIX();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_retf, pIemCpu->enmEffOpSize, u16Imm);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_retf, pVCpu->iem.s.enmEffOpSize, u16Imm);
 }
 
@@ -12776 +12776 @@
     IEMOP_HLP_NO_LOCK_PREFIX();
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_retf, pIemCpu->enmEffOpSize, 0);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_retf, pVCpu->iem.s.enmEffOpSize, 0);
 }
 
@@ -12817 +12817 @@
     IEMOP_MNEMONIC("iret");
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_iret, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_iret, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -12848 +12848 @@
         IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/1,   1);
         IEM_MC_ARG(uint32_t *,      pEFlags,            2);
-        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_REF_EFLAGS(pEFlags);
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags);
@@ -12865 +12865 @@
 
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
         IEM_MC_FETCH_EFLAGS(EFlags);
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags);
@@ -12902 +12902 @@
         /* register */
         IEMOP_HLP_NO_LOCK_PREFIX();
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -12909 +12909 @@
                 IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=1*/1, 1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,           2);
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags);
@@ -12921 +12921 @@
                 IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=1*/1, 1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,           2);
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags);
@@ -12934 +12934 @@
                 IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=1*/1, 1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,           2);
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags);
@@ -12948 +12948 @@
         /* memory */
         IEMOP_HLP_NO_LOCK_PREFIX(); /** @todo should probably not be raised until we've fetched all the opcode bytes? */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -12958 +12958 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags);
@@ -12976 +12976 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags);
@@ -12994 +12994 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags);
@@ -13037 +13037 @@
         IEM_MC_ARG(uint8_t,     cShiftArg,  1);
         IEM_MC_ARG(uint32_t *,  pEFlags,    2);
-        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
         IEM_MC_REF_EFLAGS(pEFlags);
@@ -13056 +13056 @@
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
         IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
-        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
         IEM_MC_FETCH_EFLAGS(EFlags);
         IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags);
@@ -13092 +13092 @@
         /* register */
         IEMOP_HLP_NO_LOCK_PREFIX();
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -13099 +13099 @@
                 IEM_MC_ARG(uint8_t,         cShiftArg,  1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,    2);
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_REF_EFLAGS(pEFlags);
@@ -13112 +13112 @@
                 IEM_MC_ARG(uint8_t,         cShiftArg,  1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,    2);
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_REF_EFLAGS(pEFlags);
@@ -13126 +13126 @@
                 IEM_MC_ARG(uint8_t,         cShiftArg,  1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,    2);
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
                 IEM_MC_REF_EFLAGS(pEFlags);
@@ -13141 +13141 @@
         /* memory */
         IEMOP_HLP_NO_LOCK_PREFIX(); /** @todo should probably not be raised until we've fetched all the opcode bytes? */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -13152 +13152 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
-                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags);
@@ -13171 +13171 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
-                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags);
@@ -13190 +13190 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX);
-                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags);
@@ -13255 +13255 @@
     IEMOP_MNEMONIC("xlat");
     IEMOP_HLP_NO_LOCK_PREFIX();
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT:
@@ -13263 +13263 @@
             IEM_MC_FETCH_GREG_U8_ZX_U16(u16Addr, X86_GREG_xAX);
             IEM_MC_ADD_GREG_U16_TO_LOCAL(u16Addr, X86_GREG_xBX);
-            IEM_MC_FETCH_MEM16_U8(u8Tmp, pIemCpu->iEffSeg, u16Addr);
+            IEM_MC_FETCH_MEM16_U8(u8Tmp, pVCpu->iem.s.iEffSeg, u16Addr);
             IEM_MC_STORE_GREG_U8(X86_GREG_xAX, u8Tmp);
             IEM_MC_ADVANCE_RIP();
@@ -13275 +13275 @@
             IEM_MC_FETCH_GREG_U8_ZX_U32(u32Addr, X86_GREG_xAX);
             IEM_MC_ADD_GREG_U32_TO_LOCAL(u32Addr, X86_GREG_xBX);
-            IEM_MC_FETCH_MEM32_U8(u8Tmp, pIemCpu->iEffSeg, u32Addr);
+            IEM_MC_FETCH_MEM32_U8(u8Tmp, pVCpu->iem.s.iEffSeg, u32Addr);
             IEM_MC_STORE_GREG_U8(X86_GREG_xAX, u8Tmp);
             IEM_MC_ADVANCE_RIP();
@@ -13287 +13287 @@
             IEM_MC_FETCH_GREG_U8_ZX_U64(u64Addr, X86_GREG_xAX);
             IEM_MC_ADD_GREG_U64_TO_LOCAL(u64Addr, X86_GREG_xBX);
-            IEM_MC_FETCH_MEM_U8(u8Tmp, pIemCpu->iEffSeg, u64Addr);
+            IEM_MC_FETCH_MEM_U8(u8Tmp, pVCpu->iem.s.iEffSeg, u64Addr);
             IEM_MC_STORE_GREG_U8(X86_GREG_xAX, u8Tmp);
             IEM_MC_ADVANCE_RIP();
@@ -13479 +13479 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_R32(r32Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_R32(r32Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
@@ -13529 +13529 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_R32(r32Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_R32(r32Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value1, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fcom_r80_by_r32, pu16Fsw, pr80Value1, pr32Val2);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -13563 +13563 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_R32(r32Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_R32(r32Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value1, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fcom_r80_by_r32, pu16Fsw, pr80Value1, pr32Val2);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -13614 +13614 @@
 FNIEMOP_DEF(iemOp_EscF0)
 {
-    pIemCpu->offFpuOpcode = pIemCpu->offOpcode - 1;
+    pVCpu->iem.s.offFpuOpcode = pVCpu->iem.s.offOpcode - 1;
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
 
@@ -13668 +13668 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_R32(r32Val, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_R32(r32Val, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_IS_EMPTY(7)
         IEM_MC_CALL_FPU_AIMPL_2(iemAImpl_fld_r32_to_r80, pFpuRes, pr32Val);
-        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -13700 +13700 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pr32Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pr32Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fst_r80_to_r32, pu16Fsw, pr32Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pr32Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -13711 +13711 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pr32Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -13736 +13736 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pr32Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pr32Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fst_r80_to_r32, pu16Fsw, pr32Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pr32Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -13747 +13747 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pr32Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -13761 +13761 @@
     IEMOP_MNEMONIC("fldenv m14/28byte");
     IEM_MC_BEGIN(3, 0);
-    IEM_MC_ARG_CONST(IEMMODE,           enmEffOpSize, /*=*/ pIemCpu->enmEffOpSize,  0);
+    IEM_MC_ARG_CONST(IEMMODE,           enmEffOpSize, /*=*/ pVCpu->iem.s.enmEffOpSize,  0);
     IEM_MC_ARG(uint8_t,                 iEffSeg,                                    1);
     IEM_MC_ARG(RTGCPTR,                 GCPtrEffSrc,                                2);
@@ -13768 +13768 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_ACTUALIZE_FPU_STATE_FOR_CHANGE();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_3(iemCImpl_fldenv, enmEffOpSize, iEffSeg, GCPtrEffSrc);
     IEM_MC_END();
@@ -13786 +13786 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_ACTUALIZE_FPU_STATE_FOR_CHANGE();
-    IEM_MC_FETCH_MEM_U16(u16Fsw, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_U16(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_CALL_CIMPL_1(iemCImpl_fldcw, u16Fsw);
     IEM_MC_END();
@@ -13798 +13798 @@
     IEMOP_MNEMONIC("fstenv m14/m28byte");
     IEM_MC_BEGIN(3, 0);
-    IEM_MC_ARG_CONST(IEMMODE,           enmEffOpSize, /*=*/ pIemCpu->enmEffOpSize,  0);
+    IEM_MC_ARG_CONST(IEMMODE,           enmEffOpSize, /*=*/ pVCpu->iem.s.enmEffOpSize,  0);
     IEM_MC_ARG(uint8_t,                 iEffSeg,                                    1);
     IEM_MC_ARG(RTGCPTR,                 GCPtrEffDst,                                2);
@@ -13805 +13805 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_ACTUALIZE_FPU_STATE_FOR_READ();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_3(iemCImpl_fnstenv, enmEffOpSize, iEffSeg, GCPtrEffDst);
     IEM_MC_END();
@@ -13824 +13824 @@
     IEM_MC_ACTUALIZE_FPU_STATE_FOR_READ();
     IEM_MC_FETCH_FCW(u16Fcw);
-    IEM_MC_STORE_MEM_U16(pIemCpu->iEffSeg, GCPtrEffDst, u16Fcw);
+    IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u16Fcw);
     IEM_MC_ADVANCE_RIP(); /* C0-C3 are documented as undefined, we leave them unmodified. */
     IEM_MC_END();
@@ -14400 +14400 @@
 FNIEMOP_DEF(iemOp_EscF1)
 {
-    pIemCpu->offFpuOpcode = pIemCpu->offOpcode - 1;
+    pVCpu->iem.s.offFpuOpcode = pVCpu->iem.s.offOpcode - 1;
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
@@ -14614 +14614 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_I32(i32Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_I32(i32Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
@@ -14664 +14664 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_I32(i32Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_I32(i32Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value1, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_ficom_r80_by_i32, pu16Fsw, pr80Value1, pi32Val2);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -14698 +14698 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_I32(i32Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_I32(i32Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value1, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_ficom_r80_by_i32, pu16Fsw, pr80Value1, pi32Val2);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -14749 +14749 @@
 FNIEMOP_DEF(iemOp_EscF2)
 {
-    pIemCpu->offFpuOpcode = pIemCpu->offOpcode - 1;
+    pVCpu->iem.s.offFpuOpcode = pVCpu->iem.s.offOpcode - 1;
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
@@ -14804 +14804 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_I32(i32Val, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_I32(i32Val, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_IS_EMPTY(7)
         IEM_MC_CALL_FPU_AIMPL_2(iemAImpl_fild_i32_to_r80, pFpuRes, pi32Val);
-        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -14836 +14836 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pi32Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pi32Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fistt_r80_to_i32, pu16Fsw, pi32Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pi32Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -14847 +14847 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pi32Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -14872 +14872 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pi32Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pi32Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fist_r80_to_i32, pu16Fsw, pi32Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pi32Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -14883 +14883 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pi32Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -14908 +14908 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pi32Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pi32Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fist_r80_to_i32, pu16Fsw, pi32Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pi32Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -14919 +14919 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pi32Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -14945 +14945 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_R80(r80Val, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_R80(r80Val, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_IS_EMPTY(7)
         IEM_MC_CALL_FPU_AIMPL_2(iemAImpl_fld_r80_from_r80, pFpuRes, pr80Val);
-        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -14977 +14977 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pr80Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pr80Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fst_r80_to_r80, pu16Fsw, pr80Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pr80Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -14988 +14988 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pr80Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -15209 +15209 @@
 FNIEMOP_DEF(iemOp_EscF3)
 {
-    pIemCpu->offFpuOpcode = pIemCpu->offOpcode - 1;
+    pVCpu->iem.s.offFpuOpcode = pVCpu->iem.s.offOpcode - 1;
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
@@ -15359 +15359 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_FETCH_MEM_R64(r64Factor2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_R64(r64Factor2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Factor1, 0)
         IEM_MC_CALL_FPU_AIMPL_3(pfnImpl, pFpuRes, pr80Factor1, pr64Factor2);
-        IEM_MC_STORE_FPU_RESULT_MEM_OP(FpuRes, 0, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_STORE_FPU_RESULT_MEM_OP(FpuRes, 0, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(0, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(0, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -15408 +15408 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_R64(r64Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_R64(r64Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value1, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fcom_r80_by_r64, pu16Fsw, pr80Value1, pr64Val2);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -15442 +15442 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_R64(r64Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_R64(r64Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value1, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fcom_r80_by_r64, pu16Fsw, pr80Value1, pr64Val2);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -15493 +15493 @@
 FNIEMOP_DEF(iemOp_EscF4)
 {
-    pIemCpu->offFpuOpcode = pIemCpu->offOpcode - 1;
+    pVCpu->iem.s.offFpuOpcode = pVCpu->iem.s.offOpcode - 1;
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
@@ -15546 +15546 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_FETCH_MEM_R64(r64Val, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_R64(r64Val, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_IS_EMPTY(7)
         IEM_MC_CALL_FPU_AIMPL_2(iemAImpl_fld_r64_to_r80, pFpuRes, pr64Val);
-        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -15577 +15577 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pi64Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pi64Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fistt_r80_to_i64, pu16Fsw, pi64Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pi64Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -15588 +15588 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pi64Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -15613 +15613 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pr64Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pr64Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fst_r80_to_r64, pu16Fsw, pr64Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pr64Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -15624 +15624 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pr64Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -15651 +15651 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pr64Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pr64Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fst_r80_to_r64, pu16Fsw, pr64Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pr64Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -15662 +15662 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pr64Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -15676 +15676 @@
     IEMOP_MNEMONIC("frstor m94/108byte");
     IEM_MC_BEGIN(3, 0);
-    IEM_MC_ARG_CONST(IEMMODE,           enmEffOpSize, /*=*/ pIemCpu->enmEffOpSize,  0);
+    IEM_MC_ARG_CONST(IEMMODE,           enmEffOpSize, /*=*/ pVCpu->iem.s.enmEffOpSize,  0);
     IEM_MC_ARG(uint8_t,                 iEffSeg,                                    1);
     IEM_MC_ARG(RTGCPTR,                 GCPtrEffSrc,                                2);
@@ -15683 +15683 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_ACTUALIZE_FPU_STATE_FOR_CHANGE();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_3(iemCImpl_frstor, enmEffOpSize, iEffSeg, GCPtrEffSrc);
     IEM_MC_END();
@@ -15695 +15695 @@
     IEMOP_MNEMONIC("fnsave m94/108byte");
     IEM_MC_BEGIN(3, 0);
-    IEM_MC_ARG_CONST(IEMMODE,           enmEffOpSize, /*=*/ pIemCpu->enmEffOpSize,  0);
+    IEM_MC_ARG_CONST(IEMMODE,           enmEffOpSize, /*=*/ pVCpu->iem.s.enmEffOpSize,  0);
     IEM_MC_ARG(uint8_t,                 iEffSeg,                                    1);
     IEM_MC_ARG(RTGCPTR,                 GCPtrEffDst,                                2);
@@ -15702 +15702 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_ACTUALIZE_FPU_STATE_FOR_READ();
-    IEM_MC_ASSIGN(iEffSeg, pIemCpu->iEffSeg);
+    IEM_MC_ASSIGN(iEffSeg, pVCpu->iem.s.iEffSeg);
     IEM_MC_CALL_CIMPL_3(iemCImpl_fnsave, enmEffOpSize, iEffSeg, GCPtrEffDst);
     IEM_MC_END();
@@ -15724 +15724 @@
     IEM_MC_ACTUALIZE_FPU_STATE_FOR_READ();
     IEM_MC_FETCH_FSW(u16Tmp);
-    IEM_MC_STORE_MEM_U16(pIemCpu->iEffSeg, GCPtrEffDst, u16Tmp);
+    IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffDst, u16Tmp);
     IEM_MC_ADVANCE_RIP();
 
@@ -15803 +15803 @@
 FNIEMOP_DEF(iemOp_EscF5)
 {
-    pIemCpu->offFpuOpcode = pIemCpu->offOpcode - 1;
+    pVCpu->iem.s.offFpuOpcode = pVCpu->iem.s.offOpcode - 1;
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
@@ -15915 +15915 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_I16(i16Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_I16(i16Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
@@ -15965 +15965 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_I16(i16Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_I16(i16Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value1, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_ficom_r80_by_i16, pu16Fsw, pr80Value1, pi16Val2);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -15999 +15999 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_I16(i16Val2, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_I16(i16Val2, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value1, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_ficom_r80_by_i16, pu16Fsw, pr80Value1, pi16Val2);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -16050 +16050 @@
 FNIEMOP_DEF(iemOp_EscF6)
 {
-    pIemCpu->offFpuOpcode = pIemCpu->offOpcode - 1;
+    pVCpu->iem.s.offFpuOpcode = pVCpu->iem.s.offOpcode - 1;
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
@@ -16161 +16161 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_I16(i16Val, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_I16(i16Val, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_IS_EMPTY(7)
         IEM_MC_CALL_FPU_AIMPL_2(iemAImpl_fild_i16_to_r80, pFpuRes, pi16Val);
-        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -16193 +16193 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pi16Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pi16Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fistt_r80_to_i16, pu16Fsw, pi16Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pi16Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -16204 +16204 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pi16Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -16229 +16229 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pi16Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pi16Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fist_r80_to_i16, pu16Fsw, pi16Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pi16Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -16240 +16240 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pi16Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -16265 +16265 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pi16Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pi16Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fist_r80_to_i16, pu16Fsw, pi16Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pi16Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -16276 +16276 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pi16Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -16306 +16306 @@
     IEM_MC_MAYBE_RAISE_DEVICE_NOT_AVAILABLE();
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
-    IEM_MC_FETCH_MEM_I64(i64Val, pIemCpu->iEffSeg, GCPtrEffSrc);
+    IEM_MC_FETCH_MEM_I64(i64Val, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
 
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_IS_EMPTY(7)
         IEM_MC_CALL_FPU_AIMPL_2(iemAImpl_fild_i64_to_r80, pFpuRes, pi64Val);
-        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_PUSH_FPU_RESULT_MEM_OP(FpuRes, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ELSE()
-        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pIemCpu->iEffSeg, GCPtrEffSrc);
+        IEM_MC_FPU_STACK_PUSH_OVERFLOW_MEM_OP(pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -16342 +16342 @@
     IEM_MC_MAYBE_RAISE_FPU_XCPT();
 
-    IEM_MC_MEM_MAP(pi64Dst, IEM_ACCESS_DATA_W, pIemCpu->iEffSeg, GCPtrEffDst, 1 /*arg*/);
+    IEM_MC_MEM_MAP(pi64Dst, IEM_ACCESS_DATA_W, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 1 /*arg*/);
     IEM_MC_PREPARE_FPU_USAGE();
     IEM_MC_IF_FPUREG_NOT_EMPTY_REF_R80(pr80Value, 0)
         IEM_MC_CALL_FPU_AIMPL_3(iemAImpl_fist_r80_to_i64, pu16Fsw, pi64Dst, pr80Value);
         IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(pi64Dst, IEM_ACCESS_DATA_W, u16Fsw);
-        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_UPDATE_FSW_WITH_MEM_OP_THEN_POP(u16Fsw, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ELSE()
         IEM_MC_IF_FCW_IM()
@@ -16353 +16353 @@
             IEM_MC_MEM_COMMIT_AND_UNMAP(pi64Dst, IEM_ACCESS_DATA_W);
         IEM_MC_ENDIF();
-        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FPU_STACK_UNDERFLOW_MEM_OP_THEN_POP(UINT8_MAX, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
     IEM_MC_ENDIF();
     IEM_MC_ADVANCE_RIP();
@@ -16409 +16409 @@
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
 
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT:
@@ -16457 +16457 @@
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
 
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT:
@@ -16508 +16508 @@
      * using the 32-bit operand size override.  How can that be restarted?  See
      * weird pseudo code in intel manual. */
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT:
             IEM_MC_BEGIN(0,0);
-            if (-(int8_t)pIemCpu->offOpcode != i8Imm)
+            if (-(int8_t)pVCpu->iem.s.offOpcode != i8Imm)
             {
                 IEM_MC_SUB_GREG_U16(X86_GREG_xCX, 1);
@@ -16531 +16531 @@
         case IEMMODE_32BIT:
             IEM_MC_BEGIN(0,0);
-            if (-(int8_t)pIemCpu->offOpcode != i8Imm)
+            if (-(int8_t)pVCpu->iem.s.offOpcode != i8Imm)
             {
                 IEM_MC_SUB_GREG_U32(X86_GREG_xCX, 1);
@@ -16550 +16550 @@
         case IEMMODE_64BIT:
             IEM_MC_BEGIN(0,0);
-            if (-(int8_t)pIemCpu->offOpcode != i8Imm)
+            if (-(int8_t)pVCpu->iem.s.offOpcode != i8Imm)
             {
                 IEM_MC_SUB_GREG_U64(X86_GREG_xCX, 1);
@@ -16580 +16580 @@
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
 
-    switch (pIemCpu->enmEffAddrMode)
+    switch (pVCpu->iem.s.enmEffAddrMode)
     {
         case IEMMODE_16BIT:
@@ -16633 +16633 @@
     uint8_t u8Imm; IEM_OPCODE_GET_NEXT_U8(&u8Imm);
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_in, u8Imm, pIemCpu->enmEffOpSize == IEMMODE_16BIT ? 2 : 4);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_in, u8Imm, pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT ? 2 : 4);
 }
 
@@ -16653 +16653 @@
     uint8_t u8Imm; IEM_OPCODE_GET_NEXT_U8(&u8Imm);
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_out, u8Imm, pIemCpu->enmEffOpSize == IEMMODE_16BIT ? 2 : 4);
+    return IEM_MC_DEFER_TO_CIMPL_2(iemCImpl_out, u8Imm, pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT ? 2 : 4);
 }
 
@@ -16662 +16662 @@
     IEMOP_MNEMONIC("call Jv");
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -16692 +16692 @@
     IEMOP_MNEMONIC("jmp Jv");
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -16726 +16726 @@
     /* Decode the far pointer address and pass it on to the far call C implementation. */
     uint32_t offSeg;
-    if (pIemCpu->enmEffOpSize != IEMMODE_16BIT)
+    if (pVCpu->iem.s.enmEffOpSize != IEMMODE_16BIT)
         IEM_OPCODE_GET_NEXT_U32(&offSeg);
     else
@@ -16732 +16732 @@
     uint16_t uSel;  IEM_OPCODE_GET_NEXT_U16(&uSel);
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_3(iemCImpl_FarJmp, uSel, offSeg, pIemCpu->enmEffOpSize);
+    return IEM_MC_DEFER_TO_CIMPL_3(iemCImpl_FarJmp, uSel, offSeg, pVCpu->iem.s.enmEffOpSize);
 }
 
@@ -16765 +16765 @@
     IEMOP_MNEMONIC("in  eAX,DX");
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_in_eAX_DX, pIemCpu->enmEffOpSize == IEMMODE_16BIT ? 2 : 4);
+    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_in_eAX_DX, pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT ? 2 : 4);
 }
 
@@ -16783 +16783 @@
     IEMOP_MNEMONIC("out DX,eAX");
     IEMOP_HLP_NO_LOCK_PREFIX();
-    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_out_DX_eAX, pIemCpu->enmEffOpSize == IEMMODE_16BIT ? 2 : 4);
+    return IEM_MC_DEFER_TO_CIMPL_1(iemCImpl_out_DX_eAX, pVCpu->iem.s.enmEffOpSize == IEMMODE_16BIT ? 2 : 4);
 }
 
@@ -16791 +16791 @@
 {
     IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("lock");
-    pIemCpu->fPrefixes |= IEM_OP_PRF_LOCK;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_LOCK;
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -16812 +16812 @@
 {
     /* This overrides any previous REPE prefix. */
-    pIemCpu->fPrefixes &= ~IEM_OP_PRF_REPZ;
+    pVCpu->iem.s.fPrefixes &= ~IEM_OP_PRF_REPZ;
     IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("repne");
-    pIemCpu->fPrefixes |= IEM_OP_PRF_REPNZ;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REPNZ;
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -16825 +16825 @@
 {
     /* This overrides any previous REPNE prefix. */
-    pIemCpu->fPrefixes &= ~IEM_OP_PRF_REPNZ;
+    pVCpu->iem.s.fPrefixes &= ~IEM_OP_PRF_REPNZ;
     IEMOP_HLP_CLEAR_REX_NOT_BEFORE_OPCODE("repe");
-    pIemCpu->fPrefixes |= IEM_OP_PRF_REPZ;
+    pVCpu->iem.s.fPrefixes |= IEM_OP_PRF_REPZ;
 
     uint8_t b; IEM_OPCODE_GET_NEXT_U8(&b);
@@ -16869 +16869 @@
         IEM_MC_ARG(uint8_t *,   pu8Dst, 0);
         IEM_MC_ARG(uint32_t *,  pEFlags, 1);
-        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_REF_EFLAGS(pEFlags);
         IEM_MC_CALL_VOID_AIMPL_2(pImpl->pfnNormalU8, pu8Dst, pEFlags);
@@ -16884 +16884 @@
 
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
         IEM_MC_FETCH_EFLAGS(EFlags);
-        if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
             IEM_MC_CALL_VOID_AIMPL_2(pImpl->pfnNormalU8, pu8Dst, pEFlags);
         else
@@ -16910 +16910 @@
     /* Registers are handled by a common worker. */
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
-        return FNIEMOP_CALL_2(iemOpCommonUnaryGReg, pImpl, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        return FNIEMOP_CALL_2(iemOpCommonUnaryGReg, pImpl, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
 
     /* Memory we do here. */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -16922 +16922 @@
 
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-            IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+            IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
             IEM_MC_FETCH_EFLAGS(EFlags);
-            if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+            if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                 IEM_MC_CALL_VOID_AIMPL_2(pImpl->pfnNormalU16, pu16Dst, pEFlags);
             else
@@ -16942 +16942 @@
 
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-            IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+            IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
             IEM_MC_FETCH_EFLAGS(EFlags);
-            if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+            if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                 IEM_MC_CALL_VOID_AIMPL_2(pImpl->pfnNormalU32, pu32Dst, pEFlags);
             else
@@ -16962 +16962 @@
 
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-            IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+            IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
             IEM_MC_FETCH_EFLAGS(EFlags);
-            if (!(pIemCpu->fPrefixes & IEM_OP_PRF_LOCK))
+            if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
                 IEM_MC_CALL_VOID_AIMPL_2(pImpl->pfnNormalU64, pu64Dst, pEFlags);
             else
@@ -16996 +16996 @@
         IEM_MC_ARG_CONST(uint8_t,   u8Src,/*=*/u8Imm,   1);
         IEM_MC_ARG(uint32_t *,      pEFlags,            2);
-        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_REF_GREG_U8(pu8Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_REF_EFLAGS(pEFlags);
         IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_test_u8, pu8Dst, u8Src, pEFlags);
@@ -17016 +17016 @@
         uint8_t u8Imm; IEM_OPCODE_GET_NEXT_U8(&u8Imm);
         IEM_MC_ASSIGN(u8Src, u8Imm);
-        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_R, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+        IEM_MC_MEM_MAP(pu8Dst, IEM_ACCESS_DATA_R, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
         IEM_MC_FETCH_EFLAGS(EFlags);
         IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_test_u8, pu8Dst, u8Src, pEFlags);
@@ -17039 +17039 @@
     {
         /* register access */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -17048 +17048 @@
                 IEM_MC_ARG_CONST(uint16_t,  u16Src,/*=*/u16Imm,     1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,                2);
-                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U16(pu16Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_test_u16, pu16Dst, u16Src, pEFlags);
@@ -17063 +17063 @@
                 IEM_MC_ARG_CONST(uint32_t,  u32Src,/*=*/u32Imm,     1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,                2);
-                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U32(pu32Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_test_u32, pu32Dst, u32Src, pEFlags);
@@ -17079 +17079 @@
                 IEM_MC_ARG_CONST(uint64_t,  u64Src,/*=*/u64Imm,     1);
                 IEM_MC_ARG(uint32_t *,      pEFlags,                2);
-                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_REF_GREG_U64(pu64Dst, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_EFLAGS(pEFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_test_u64, pu64Dst, u64Src, pEFlags);
@@ -17093 +17093 @@
     {
         /* memory access. */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -17106 +17106 @@
                 uint16_t u16Imm; IEM_OPCODE_GET_NEXT_U16(&u16Imm);
                 IEM_MC_ASSIGN(u16Src, u16Imm);
-                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_R, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_R, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_test_u16, pu16Dst, u16Src, pEFlags);
@@ -17128 +17128 @@
                 uint32_t u32Imm; IEM_OPCODE_GET_NEXT_U32(&u32Imm);
                 IEM_MC_ASSIGN(u32Src, u32Imm);
-                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_R, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_R, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_test_u32, pu32Dst, u32Src, pEFlags);
@@ -17150 +17150 @@
                 uint64_t u64Imm; IEM_OPCODE_GET_NEXT_S32_SX_U64(&u64Imm);
                 IEM_MC_ASSIGN(u64Src, u64Imm);
-                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_R, pIemCpu->iEffSeg, GCPtrEffDst, 0 /*arg*/);
+                IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_R, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
                 IEM_MC_FETCH_EFLAGS(EFlags);
                 IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_test_u64, pu64Dst, u64Src, pEFlags);
@@ -17182 +17182 @@
         IEM_MC_LOCAL(int32_t,       rc);
 
-        IEM_MC_FETCH_GREG_U8(u8Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        IEM_MC_FETCH_GREG_U8(u8Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
         IEM_MC_REF_GREG_U16(pu16AX, X86_GREG_xAX);
         IEM_MC_REF_EFLAGS(pEFlags);
@@ -17207 +17207 @@
 
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-        IEM_MC_FETCH_MEM_U8(u8Value, pIemCpu->iEffSeg, GCPtrEffDst);
+        IEM_MC_FETCH_MEM_U8(u8Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
         IEM_MC_REF_GREG_U16(pu16AX, X86_GREG_xAX);
         IEM_MC_REF_EFLAGS(pEFlags);
@@ -17232 +17232 @@
     {
         /* register access */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -17244 +17244 @@
                 IEM_MC_LOCAL(int32_t,       rc);
 
-                IEM_MC_FETCH_GREG_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U16(u16Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_GREG_U16(pu16AX, X86_GREG_xAX);
                 IEM_MC_REF_GREG_U16(pu16DX, X86_GREG_xDX);
@@ -17269 +17269 @@
                 IEM_MC_LOCAL(int32_t,       rc);
 
-                IEM_MC_FETCH_GREG_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U32(u32Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_GREG_U32(pu32AX, X86_GREG_xAX);
                 IEM_MC_REF_GREG_U32(pu32DX, X86_GREG_xDX);
@@ -17296 +17296 @@
                 IEM_MC_LOCAL(int32_t,       rc);
 
-                IEM_MC_FETCH_GREG_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U64(u64Value, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_REF_GREG_U64(pu64AX, X86_GREG_xAX);
                 IEM_MC_REF_GREG_U64(pu64DX, X86_GREG_xDX);
@@ -17317 +17317 @@
     {
         /* memory access. */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -17331 +17331 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U16(u16Value, pIemCpu->iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_MEM_U16(u16Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
                 IEM_MC_REF_GREG_U16(pu16AX, X86_GREG_xAX);
                 IEM_MC_REF_GREG_U16(pu16DX, X86_GREG_xDX);
@@ -17358 +17358 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U32(u32Value, pIemCpu->iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_MEM_U32(u32Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
                 IEM_MC_REF_GREG_U32(pu32AX, X86_GREG_xAX);
                 IEM_MC_REF_GREG_U32(pu32DX, X86_GREG_xDX);
@@ -17387 +17387 @@
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
-                IEM_MC_FETCH_MEM_U64(u64Value, pIemCpu->iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_MEM_U64(u64Value, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
                 IEM_MC_REF_GREG_U64(pu64AX, X86_GREG_xAX);
                 IEM_MC_REF_GREG_U64(pu64DX, X86_GREG_xDX);
@@ -17584 +17584 @@
     {
         /* The new RIP is taken from a register. */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
                 IEM_MC_BEGIN(1, 0);
                 IEM_MC_ARG(uint16_t, u16Target, 0);
-                IEM_MC_FETCH_GREG_U16(u16Target, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U16(u16Target, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_CALL_CIMPL_1(iemCImpl_call_16, u16Target);
                 IEM_MC_END()
@@ -17597 +17597 @@
                 IEM_MC_BEGIN(1, 0);
                 IEM_MC_ARG(uint32_t, u32Target, 0);
-                IEM_MC_FETCH_GREG_U32(u32Target, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U32(u32Target, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_CALL_CIMPL_1(iemCImpl_call_32, u32Target);
                 IEM_MC_END()
@@ -17605 +17605 @@
                 IEM_MC_BEGIN(1, 0);
                 IEM_MC_ARG(uint64_t, u64Target, 0);
-                IEM_MC_FETCH_GREG_U64(u64Target, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U64(u64Target, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_CALL_CIMPL_1(iemCImpl_call_64, u64Target);
                 IEM_MC_END()
@@ -17616 +17616 @@
     {
         /* The new RIP is taken from a register. */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -17623 +17623 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffSrc);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-                IEM_MC_FETCH_MEM_U16(u16Target, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U16(u16Target, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_CALL_CIMPL_1(iemCImpl_call_16, u16Target);
                 IEM_MC_END()
@@ -17633 +17633 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffSrc);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-                IEM_MC_FETCH_MEM_U32(u32Target, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U32(u32Target, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_CALL_CIMPL_1(iemCImpl_call_32, u32Target);
                 IEM_MC_END()
@@ -17643 +17643 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffSrc);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-                IEM_MC_FETCH_MEM_U64(u64Target, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U64(u64Target, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_CALL_CIMPL_1(iemCImpl_call_64, u64Target);
                 IEM_MC_END()
@@ -17662 +17662 @@
 
     /* Far pointer loaded from memory. */
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -17672 +17672 @@
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-            IEM_MC_FETCH_MEM_U16(offSeg, pIemCpu->iEffSeg, GCPtrEffSrc);
-            IEM_MC_FETCH_MEM_U16_DISP(u16Sel, pIemCpu->iEffSeg, GCPtrEffSrc, 2);
+            IEM_MC_FETCH_MEM_U16(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+            IEM_MC_FETCH_MEM_U16_DISP(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc, 2);
             IEM_MC_CALL_CIMPL_3(pfnCImpl, u16Sel, offSeg, enmEffOpSize);
             IEM_MC_END();
@@ -17682 +17682 @@
              *        and will apparently ignore REX.W, at least for the jmp far qword [rsp]
              *        and call far qword [rsp] encodings. */
-            if (!IEM_IS_GUEST_CPU_AMD(pIemCpu))
+            if (!IEM_IS_GUEST_CPU_AMD(pVCpu))
             {
                 IEM_MC_BEGIN(3, 1);
@@ -17691 +17691 @@
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_FETCH_MEM_U64(offSeg, pIemCpu->iEffSeg, GCPtrEffSrc);
-                IEM_MC_FETCH_MEM_U16_DISP(u16Sel, pIemCpu->iEffSeg, GCPtrEffSrc, 8);
+                IEM_MC_FETCH_MEM_U64(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U16_DISP(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc, 8);
                 IEM_MC_CALL_CIMPL_3(pfnCImpl, u16Sel, offSeg, enmEffOpSize);
                 IEM_MC_END();
@@ -17707 +17707 @@
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-            IEM_MC_FETCH_MEM_U32(offSeg, pIemCpu->iEffSeg, GCPtrEffSrc);
-            IEM_MC_FETCH_MEM_U16_DISP(u16Sel, pIemCpu->iEffSeg, GCPtrEffSrc, 4);
+            IEM_MC_FETCH_MEM_U32(offSeg, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+            IEM_MC_FETCH_MEM_U16_DISP(u16Sel, pVCpu->iem.s.iEffSeg, GCPtrEffSrc, 4);
             IEM_MC_CALL_CIMPL_3(pfnCImpl, u16Sel, offSeg, enmEffOpSize);
             IEM_MC_END();
@@ -17742 +17742 @@
     {
         /* The new RIP is taken from a register. */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint16_t, u16Target);
-                IEM_MC_FETCH_GREG_U16(u16Target, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U16(u16Target, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_SET_RIP_U16(u16Target);
                 IEM_MC_END()
@@ -17755 +17755 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint32_t, u32Target);
-                IEM_MC_FETCH_GREG_U32(u32Target, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U32(u32Target, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_SET_RIP_U32(u32Target);
                 IEM_MC_END()
@@ -17763 +17763 @@
                 IEM_MC_BEGIN(0, 1);
                 IEM_MC_LOCAL(uint64_t, u64Target);
-                IEM_MC_FETCH_GREG_U64(u64Target, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+                IEM_MC_FETCH_GREG_U64(u64Target, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
                 IEM_MC_SET_RIP_U64(u64Target);
                 IEM_MC_END()
@@ -17774 +17774 @@
     {
         /* The new RIP is taken from a memory location. */
-        switch (pIemCpu->enmEffOpSize)
+        switch (pVCpu->iem.s.enmEffOpSize)
         {
             case IEMMODE_16BIT:
@@ -17781 +17781 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffSrc);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-                IEM_MC_FETCH_MEM_U16(u16Target, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U16(u16Target, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_SET_RIP_U16(u16Target);
                 IEM_MC_END()
@@ -17791 +17791 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffSrc);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-                IEM_MC_FETCH_MEM_U32(u32Target, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U32(u32Target, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_SET_RIP_U32(u32Target);
                 IEM_MC_END()
@@ -17801 +17801 @@
                 IEM_MC_LOCAL(RTGCPTR, GCPtrEffSrc);
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-                IEM_MC_FETCH_MEM_U64(u64Target, pIemCpu->iEffSeg, GCPtrEffSrc);
+                IEM_MC_FETCH_MEM_U64(u64Target, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
                 IEM_MC_SET_RIP_U64(u64Target);
                 IEM_MC_END()
@@ -17834 +17834 @@
     /* Registers are handled by a common worker. */
     if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
-        return FNIEMOP_CALL_1(iemOpCommonPushGReg, (bRm & X86_MODRM_RM_MASK) | pIemCpu->uRexB);
+        return FNIEMOP_CALL_1(iemOpCommonPushGReg, (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB);
 
     /* Memory we do here. */
     IEMOP_HLP_DEFAULT_64BIT_OP_SIZE();
-    switch (pIemCpu->enmEffOpSize)
+    switch (pVCpu->iem.s.enmEffOpSize)
     {
         case IEMMODE_16BIT:
@@ -17845 +17845 @@
             IEM_MC_LOCAL(RTGCPTR,   GCPtrEffSrc);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-            IEM_MC_FETCH_MEM_U16(u16Src, pIemCpu->iEffSeg, GCPtrEffSrc);
+            IEM_MC_FETCH_MEM_U16(u16Src, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
             IEM_MC_PUSH_U16(u16Src);
             IEM_MC_ADVANCE_RIP();
@@ -17856 +17856 @@
             IEM_MC_LOCAL(RTGCPTR,   GCPtrEffSrc);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-            IEM_MC_FETCH_MEM_U32(u32Src, pIemCpu->iEffSeg, GCPtrEffSrc);
+            IEM_MC_FETCH_MEM_U32(u32Src, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
             IEM_MC_PUSH_U32(u32Src);
             IEM_MC_ADVANCE_RIP();
@@ -17867 +17867 @@
             IEM_MC_LOCAL(RTGCPTR,   GCPtrEffSrc);
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
-            IEM_MC_FETCH_MEM_U64(u64Src, pIemCpu->iEffSeg, GCPtrEffSrc);
+            IEM_MC_FETCH_MEM_U64(u64Src, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
             IEM_MC_PUSH_U64(u64Src);
             IEM_MC_ADVANCE_RIP();

trunk/src/VBox/VMM/include/IEMInternal.h

@@ -264 +264 @@
         mov     r8d, ACCESS_FLAGS
         mov     rdx, [VA]
-        mov     rcx, [pIemCpu]
+        mov     rcx, [pVCpu]
         call    iemTlbTypeMiss
     .Done:
@@ -648 +648 @@
 /** Gets the current IEMTARGETCPU value.
  * @returns IEMTARGETCPU value.
- * @param   a_pIemCpu       The IEM per CPU instance data.
+ * @param   a_pVCpu         The IEM per CPU instance data.
  */
 #if IEM_CFG_TARGET_CPU != IEMTARGETCPU_DYNAMIC
-# define IEM_GET_TARGET_CPU(a_pIemCpu)   (IEM_CFG_TARGET_CPU)
+# define IEM_GET_TARGET_CPU(a_pVCpu)   (IEM_CFG_TARGET_CPU)
 #else
-# define IEM_GET_TARGET_CPU(a_pIemCpu)   ((a_pIemCpu)->uTargetCpu)
+# define IEM_GET_TARGET_CPU(a_pVCpu)   ((a_pVCpu)->iem.s.uTargetCpu)
 #endif
 
@@ -785 +785 @@
  * of an if statement.  */
 #ifdef IEM_VERIFICATION_MODE_FULL
-# define IEM_VERIFICATION_ENABLED(a_pIemCpu)    (!(a_pIemCpu)->fNoRem)
+# define IEM_VERIFICATION_ENABLED(a_pVCpu)      (!(a_pVCpu)->iem.s.fNoRem)
 #elif defined(IEM_VERIFICATION_MODE_MINIMAL)
-# define IEM_VERIFICATION_ENABLED(a_pIemCpu)    (true)
+# define IEM_VERIFICATION_ENABLED(a_pVCpu)      (true)
 #else
-# define IEM_VERIFICATION_ENABLED(a_pIemCpu)    (false)
+# define IEM_VERIFICATION_ENABLED(a_pVCpu)      (false)
 #endif
 
@@ -799 +799 @@
  * of an if statement.  */
 #ifdef IEM_VERIFICATION_MODE_FULL
-# define IEM_FULL_VERIFICATION_ENABLED(a_pIemCpu) (!(a_pIemCpu)->fNoRem)
+# define IEM_FULL_VERIFICATION_ENABLED(a_pVCpu) (!(a_pVCpu)->iem.s.fNoRem)
 #else
-# define IEM_FULL_VERIFICATION_ENABLED(a_pIemCpu) (false)
+# define IEM_FULL_VERIFICATION_ENABLED(a_pVCpu) (false)
 #endif
 
@@ -812 +812 @@
 #ifdef IEM_VERIFICATION_MODE_FULL
 # ifdef IEM_VERIFICATION_MODE_FULL_HM
-#  define IEM_FULL_VERIFICATION_REM_ENABLED(a_pIemCpu) (!(a_pIemCpu)->fNoRem && !HMIsEnabled(IEMCPU_TO_VM(a_pIemCpu)))
+#  define IEM_FULL_VERIFICATION_REM_ENABLED(a_pVCpu)    (!(a_pVCpu)->iem.s.fNoRem && !HMIsEnabled((a_pVCpu)->CTX_SUFF(pVM)))
 # else
-#  define IEM_FULL_VERIFICATION_REM_ENABLED(a_pIemCpu) (!(a_pIemCpu)->fNoRem)
+#  define IEM_FULL_VERIFICATION_REM_ENABLED(a_pVCpu)    (!(a_pVCpu)->iem.s.fNoRem)
 # endif
 #else
-# define IEM_FULL_VERIFICATION_REM_ENABLED(a_pIemCpu) (false)
+# define IEM_FULL_VERIFICATION_REM_ENABLED(a_pVCpu)     (false)
 #endif
 
@@ -836 +836 @@
  */
 #ifdef IEM_VERIFICATION_MODE_FULL
-# define IEMOP_VERIFICATION_UNDEFINED_EFLAGS(a_fEfl) do { pIemCpu->fUndefinedEFlags |= (a_fEfl); } while (0)
+# define IEMOP_VERIFICATION_UNDEFINED_EFLAGS(a_fEfl) do { pVCpu->iem.s.fUndefinedEFlags |= (a_fEfl); } while (0)
 #else
 # define IEMOP_VERIFICATION_UNDEFINED_EFLAGS(a_fEfl) do { } while (0)
@@ -1544 +1544 @@
  */
 # define IEM_CIMPL_DECL_TYPE_0(a_Name) \
-    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr))
+    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr))
 /**
  * For defining a C instruction implementation function taking no extra
@@ -1552 +1552 @@
  */
 # define IEM_CIMPL_DEF_0(a_Name) \
-    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr))
+    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr))
 /**
  * For calling a C instruction implementation function taking no extra
@@ -1562 +1562 @@
  * @param   a_fn                The name of the function.
  */
-# define IEM_CIMPL_CALL_0(a_fn)            a_fn(pIemCpu, cbInstr)
+# define IEM_CIMPL_CALL_0(a_fn)            a_fn(pVCpu, cbInstr)
 
 /**
@@ -1573 +1573 @@
  */
 # define IEM_CIMPL_DECL_TYPE_1(a_Name, a_Type0, a_Arg0) \
-    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, a_Type0 a_Arg0))
+    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, a_Type0 a_Arg0))
 /**
  * For defining a C instruction implementation function taking one extra
@@ -1583 +1583 @@
  */
 # define IEM_CIMPL_DEF_1(a_Name, a_Type0, a_Arg0) \
-    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, a_Type0 a_Arg0))
+    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, a_Type0 a_Arg0))
 /**
  * For calling a C instruction implementation function taking one extra
@@ -1594 +1594 @@
  * @param   a0                  The name of the 1st argument.
  */
-# define IEM_CIMPL_CALL_1(a_fn, a0)        a_fn(pIemCpu, cbInstr, (a0))
+# define IEM_CIMPL_CALL_1(a_fn, a0)        a_fn(pVCpu, cbInstr, (a0))
 
 /**
@@ -1607 +1607 @@
  */
 # define IEM_CIMPL_DECL_TYPE_2(a_Name, a_Type0, a_Arg0, a_Type1, a_Arg1) \
-    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1))
+    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1))
 /**
  * For defining a C instruction implementation function taking two extra
@@ -1619 +1619 @@
  */
 # define IEM_CIMPL_DEF_2(a_Name, a_Type0, a_Arg0, a_Type1, a_Arg1) \
-    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1))
+    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1))
 /**
  * For calling a C instruction implementation function taking two extra
@@ -1631 +1631 @@
  * @param   a1                  The name of the 2nd argument.
  */
-# define IEM_CIMPL_CALL_2(a_fn, a0, a1)    a_fn(pIemCpu, cbInstr, (a0), (a1))
+# define IEM_CIMPL_CALL_2(a_fn, a0, a1)    a_fn(pVCpu, cbInstr, (a0), (a1))
 
 /**
@@ -1646 +1646 @@
  */
 # define IEM_CIMPL_DECL_TYPE_3(a_Name, a_Type0, a_Arg0, a_Type1, a_Arg1, a_Type2, a_Arg2) \
-    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1, a_Type2 a_Arg2))
+    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1, a_Type2 a_Arg2))
 /**
  * For defining a C instruction implementation function taking three extra
@@ -1660 +1660 @@
  */
 # define IEM_CIMPL_DEF_3(a_Name, a_Type0, a_Arg0, a_Type1, a_Arg1, a_Type2, a_Arg2) \
-    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1, a_Type2 a_Arg2))
+    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1, a_Type2 a_Arg2))
 /**
  * For calling a C instruction implementation function taking three extra
@@ -1673 +1673 @@
  * @param   a2                  The name of the 3rd argument.
  */
-# define IEM_CIMPL_CALL_3(a_fn, a0, a1, a2) a_fn(pIemCpu, cbInstr, (a0), (a1), (a2))
+# define IEM_CIMPL_CALL_3(a_fn, a0, a1, a2) a_fn(pVCpu, cbInstr, (a0), (a1), (a2))
 
 
@@ -1691 +1691 @@
  */
 # define IEM_CIMPL_DECL_TYPE_4(a_Name, a_Type0, a_Arg0, a_Type1, a_Arg1, a_Type2, a_Arg2, a_Type3, a_Arg3) \
-    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1, a_Type2 a_Arg2, a_Type3 a_Arg3))
+    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1, a_Type2 a_Arg2, a_Type3 a_Arg3))
 /**
  * For defining a C instruction implementation function taking four extra
@@ -1707 +1707 @@
  */
 # define IEM_CIMPL_DEF_4(a_Name, a_Type0, a_Arg0, a_Type1, a_Arg1, a_Type2, a_Arg2, a_Type3, a_Arg3) \
-    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1, \
+    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, a_Type0 a_Arg0, a_Type1 a_Arg1, \
                                              a_Type2 a_Arg2, a_Type3 a_Arg3))
 /**
@@ -1722 +1722 @@
  * @param   a3                  The name of the 4th argument.
  */
-# define IEM_CIMPL_CALL_4(a_fn, a0, a1, a2, a3) a_fn(pIemCpu, cbInstr, (a0), (a1), (a2), (a3))
+# define IEM_CIMPL_CALL_4(a_fn, a0, a1, a2, a3) a_fn(pVCpu, cbInstr, (a0), (a1), (a2), (a3))
 
 
@@ -1742 +1742 @@
  */
 # define IEM_CIMPL_DECL_TYPE_5(a_Name, a_Type0, a_Arg0, a_Type1, a_Arg1, a_Type2, a_Arg2, a_Type3, a_Arg3, a_Type4, a_Arg4) \
-    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, \
+    IEM_DECL_IMPL_TYPE(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, \
                                                a_Type0 a_Arg0, a_Type1 a_Arg1, a_Type2 a_Arg2, \
                                                a_Type3 a_Arg3, a_Type4 a_Arg4))
@@ -1762 +1762 @@
  */
 # define IEM_CIMPL_DEF_5(a_Name, a_Type0, a_Arg0, a_Type1, a_Arg1, a_Type2, a_Arg2, a_Type3, a_Arg3, a_Type4, a_Arg4) \
-    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PIEMCPU pIemCpu, uint8_t cbInstr, \
+    IEM_DECL_IMPL_DEF(VBOXSTRICTRC, a_Name, (PVMCPU pVCpu, uint8_t cbInstr, \
                                              a_Type0 a_Arg0, a_Type1 a_Arg1, a_Type2 a_Arg2, \
                                              a_Type3 a_Arg3, a_Type4 a_Arg4))
@@ -1779 +1779 @@
  * @param   a4                  The name of the 5th argument.
  */
-# define IEM_CIMPL_CALL_5(a_fn, a0, a1, a2, a3, a4) a_fn(pIemCpu, cbInstr, (a0), (a1), (a2), (a3), (a4))
+# define IEM_CIMPL_CALL_5(a_fn, a0, a1, a2, a3, a4) a_fn(pVCpu, cbInstr, (a0), (a1), (a2), (a3), (a4))
 
 /** @}  */

trunk/src/VBox/VMM/testcase/tstIEMCheckMc.cpp

@@ -28 +28 @@
 #include <VBox/log.h>
 #include "../include/IEMInternal.h"
+#include <VBox/vmm/vm.h>
 
 
@@ -73 +74 @@
  * @{   */
 
-typedef VBOXSTRICTRC (* PFNIEMOP)(PIEMCPU pIemCpu);
+typedef VBOXSTRICTRC (* PFNIEMOP)(PVMCPU pVCpu);
 #define FNIEMOP_DEF(a_Name) \
-    static VBOXSTRICTRC a_Name(PIEMCPU pIemCpu) RT_NO_THROW_DEF
+    static VBOXSTRICTRC a_Name(PVMCPU pVCpu) RT_NO_THROW_DEF
 #define FNIEMOP_DEF_1(a_Name, a_Type0, a_Name0) \
-    static VBOXSTRICTRC a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0) RT_NO_THROW_DEF
+    static VBOXSTRICTRC a_Name(PVMCPU pVCpu, a_Type0 a_Name0) RT_NO_THROW_DEF
 #define FNIEMOP_DEF_2(a_Name, a_Type0, a_Name0, a_Type1, a_Name1) \
-    static VBOXSTRICTRC a_Name(PIEMCPU pIemCpu, a_Type0 a_Name0, a_Type1 a_Name1) RT_NO_THROW_DEF
-
-typedef VBOXSTRICTRC (* PFNIEMOPRM)(PIEMCPU pIemCpu, uint8_t bRm);
+    static VBOXSTRICTRC a_Name(PVMCPU pVCpu, a_Type0 a_Name0, a_Type1 a_Name1) RT_NO_THROW_DEF
+
+typedef VBOXSTRICTRC (* PFNIEMOPRM)(PVMCPU pVCpu, uint8_t bRm);
 #define FNIEMOPRM_DEF(a_Name) \
-    static VBOXSTRICTRC a_Name(PIEMCPU pIemCpu, uint8_t bRm) RT_NO_THROW_DEF
+    static VBOXSTRICTRC a_Name(PVMCPU pVCpu, uint8_t bRm) RT_NO_THROW_DEF
 
 #define IEM_NOT_REACHED_DEFAULT_CASE_RET()                  default: return VERR_IPE_NOT_REACHED_DEFAULT_CASE
@@ -144 +145 @@
 
 
-#define FNIEMOP_CALL(a_pfn)                                 (a_pfn)(pIemCpu)
-#define FNIEMOP_CALL_1(a_pfn, a0)                           (a_pfn)(pIemCpu, a0)
-#define FNIEMOP_CALL_2(a_pfn, a0, a1)                       (a_pfn)(pIemCpu, a0, a1)
-
-#define IEM_IS_REAL_OR_V86_MODE(a_pIemCpu)                  (g_fRandom)
-#define IEM_IS_LONG_MODE(a_pIemCpu)                         (g_fRandom)
-#define IEM_IS_REAL_MODE(a_pIemCpu)                         (g_fRandom)
-#define IEM_IS_GUEST_CPU_AMD(a_pIemCpu)                     (g_fRandom)
-#define IEM_IS_GUEST_CPU_INTEL(a_pIemCpu)                   (g_fRandom)
-#define IEM_GET_GUEST_CPU_FEATURES(a_pIemCpu)               ((PCCPUMFEATURES)(uintptr_t)42)
-#define IEM_GET_HOST_CPU_FEATURES(a_pIemCpu)                ((PCCPUMFEATURES)(uintptr_t)88)
-
-#define iemRecalEffOpSize(a_pIemCpu)                        do { } while (0)
+#define FNIEMOP_CALL(a_pfn)                                 (a_pfn)(pVCpu)
+#define FNIEMOP_CALL_1(a_pfn, a0)                           (a_pfn)(pVCpu, a0)
+#define FNIEMOP_CALL_2(a_pfn, a0, a1)                       (a_pfn)(pVCpu, a0, a1)
+
+#define IEM_IS_REAL_OR_V86_MODE(a_pVCpu)                    (g_fRandom)
+#define IEM_IS_LONG_MODE(a_pVCpu)                           (g_fRandom)
+#define IEM_IS_REAL_MODE(a_pVCpu)                           (g_fRandom)
+#define IEM_IS_GUEST_CPU_AMD(a_pVCpu)                       (g_fRandom)
+#define IEM_IS_GUEST_CPU_INTEL(a_pVCpu)                     (g_fRandom)
+#define IEM_GET_GUEST_CPU_FEATURES(a_pVCpu)                 ((PCCPUMFEATURES)(uintptr_t)42)
+#define IEM_GET_HOST_CPU_FEATURES(a_pVCpu)                  ((PCCPUMFEATURES)(uintptr_t)88)
+
+#define iemRecalEffOpSize(a_pVCpu)                          do { } while (0)
 
 IEMOPBINSIZES g_iemAImpl_add;