Index: /trunk/src/VBox/VMM/VMMAll/NEMAllNativeTemplate-win.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/NEMAllNativeTemplate-win.cpp.h	(revision 71296)
+++ /trunk/src/VBox/VMM/VMMAll/NEMAllNativeTemplate-win.cpp.h	(revision 71297)
@@ -1262,4 +1262,5 @@
            || pMsg->Header.InterceptAccessType == HV_INTERCEPT_ACCESS_WRITE
            || pMsg->Header.InterceptAccessType == HV_INTERCEPT_ACCESS_EXECUTE);
+    AssertMsg(pMsg->Header.InstructionLength < 0x10, ("%#x\n", pMsg->Header.InstructionLength));
 
     /*
@@ -1268,4 +1269,22 @@
     if (pMsg->Header.ExecutionState.InterruptionPending)
         pCtx->fExtrn &= ~CPUMCTX_EXTRN_NEM_WIN_MASK;
+
+#if 0 /* Experiment: 20K -> 34K exit/s. */
+    if (   pMsg->Header.ExecutionState.EferLma
+        && pMsg->Header.CsSegment.Long
+        && pMsg->Header.InterceptAccessType == HV_INTERCEPT_ACCESS_WRITE)
+    {
+        if (   pMsg->Header.Rip - (uint64_t)0xf65a < (uint64_t)(0xf662 - 0xf65a)
+            && pMsg->InstructionBytes[0] == 0x89
+            && pMsg->InstructionBytes[1] == 0x03)
+        {
+            pCtx->rip    = pMsg->Header.Rip + 2;
+            pCtx->fExtrn &= ~CPUMCTX_EXTRN_RIP;
+            AssertMsg(pMsg->Header.InstructionLength == 2, ("%#x\n", pMsg->Header.InstructionLength));
+            //Log(("%RX64 msg:\n%.80Rhxd\n", pCtx->rip, pMsg));
+            return VINF_SUCCESS;
+        }
+    }
+#endif
 
     /*
@@ -1318,4 +1337,11 @@
 # endif
 
+    if (pMsg->Reserved1)
+        Log(("MemExit/Reserved1=%#x\n", pMsg->Reserved1));
+    if (pMsg->Header.ExecutionState.Reserved0 || pMsg->Header.ExecutionState.Reserved1)
+        Log(("MemExit/Hdr/State: Reserved0=%#x Reserved1=%#x\n", pMsg->Header.ExecutionState.Reserved0, pMsg->Header.ExecutionState.Reserved1));
+    //if (pMsg->InstructionByteCount > 0)
+    //    Log4(("InstructionByteCount=%#x %.16Rhxs\n", pMsg->InstructionByteCount, pMsg->InstructionBytes));
+
     if (pMsg->InstructionByteCount > 0)
         rcStrict = IEMExecOneWithPrefetchedByPC(pVCpu, CPUMCTX2CORE(pCtx), pMsg->Header.Rip,
@@ -1346,4 +1372,5 @@
     Assert(   pMsg->Header.InterceptAccessType == HV_INTERCEPT_ACCESS_READ
            || pMsg->Header.InterceptAccessType == HV_INTERCEPT_ACCESS_WRITE);
+    AssertMsg(pMsg->Header.InstructionLength < 0x10, ("%#x\n", pMsg->Header.InstructionLength));
 
     /*
Index: /trunk/src/VBox/VMM/VMMR3/NEMR3Native-win.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/NEMR3Native-win.cpp	(revision 71296)
+++ /trunk/src/VBox/VMM/VMMR3/NEMR3Native-win.cpp	(revision 71297)
@@ -101,5 +101,4 @@
 static decltype(WHvDeleteVirtualProcessor) *        g_pfnWHvDeleteVirtualProcessor;
 static decltype(WHvRunVirtualProcessor) *           g_pfnWHvRunVirtualProcessor;
-static decltype(WHvGetRunExitContextSize) *         g_pfnWHvGetRunExitContextSize;
 static decltype(WHvCancelRunVirtualProcessor) *     g_pfnWHvCancelRunVirtualProcessor;
 static decltype(WHvGetVirtualProcessorRegisters) *  g_pfnWHvGetVirtualProcessorRegisters;
@@ -153,5 +152,4 @@
     NEM_WIN_IMPORT(0, false, WHvRunVirtualProcessor),
     NEM_WIN_IMPORT(0, false, WHvCancelRunVirtualProcessor),
-    NEM_WIN_IMPORT(0, false, WHvGetRunExitContextSize),
     NEM_WIN_IMPORT(0, false, WHvGetVirtualProcessorRegisters),
     NEM_WIN_IMPORT(0, false, WHvSetVirtualProcessorRegisters),
@@ -1535,5 +1533,6 @@
         if (fExitInstr && pExitReason->IoPortAccess.InstructionByteCount > 0)
             Log2(("Exit: + Instruction %.*Rhxs\n",
-                  pExitReason->IoPortAccess.InstructionByteCount, pExitReason->IoPortAccess.InstructionBytes));
+                  pExitReason->IoPortAccess.InstructionByteCount,
+                  &pExitReason->IoPortAccess.InstructionBytes[g_uBuildNo >= 17110 ? 3 : 0]));
     }
 }
@@ -1654,5 +1653,6 @@
     if (pMemCtx->InstructionByteCount > 0)
         rcStrict = IEMExecOneWithPrefetchedByPC(pVCpu, CPUMCTX2CORE(pCtx), pMemCtx->VpContext.Rip,
-                                                pMemCtx->InstructionBytes, pMemCtx->InstructionByteCount);
+                                                &pMemCtx->InstructionBytes[g_uBuildNo >= 17110 ? 3 : 0],
+                                                pMemCtx->InstructionByteCount);
     else
         rcStrict = IEMExecOne(pVCpu);
@@ -1686,5 +1686,5 @@
          * Simple port I/O.
          */
-        Assert(pCtx->rax == pIoPortCtx->Rax);
+        //Assert(pCtx->rax == pIoPortCtx->Rax); - sledgehammer
 
         static uint32_t const s_fAndMask[8] =
@@ -2523,4 +2523,12 @@
  *
  *
+ * - Wrong instruction length in the VpContext with unmapped GPA memory exit
+ *   contexts on 17115/AMD.
+ *
+ *   One byte "PUSH CS" was reported as 2 bytes, while a two byte
+ *   "MOV [EBX],EAX" was reported with a 1 byte instruction length.  Problem
+ *   naturally present in untranslated hyper-v messages.
+ *
+ *
  * - The I/O port exit context information seems to be missing the address size
  *   information needed for correct string I/O emulation.
