Index: trunk/include/VBox/vmm/em.h
===================================================================
--- trunk/include/VBox/vmm/em.h	(revision 72565)
+++ trunk/include/VBox/vmm/em.h	(revision 72569)
@@ -238,6 +238,6 @@
 #define EMEXIT_F_KIND_XCPT      UINT32_C(0x00004000)    /**< Exception numbers (raw-mode). */
 #define EMEXIT_F_KIND_MASK      UINT32_C(0x00007000)
-#define EMEXIT_F_CS_EIP         UINT32_C(0x00008000)    /**< The PC is EIP in the low dword and CS in the high. */
-#define EMEXIT_F_UNFLATTENED_PC UINT32_C(0x00010000)    /**< The PC hasn't had CS.BASE added to it. */
+#define EMEXIT_F_CS_EIP         UINT32_C(0x00010000)    /**< The PC is EIP in the low dword and CS in the high. */
+#define EMEXIT_F_UNFLATTENED_PC UINT32_C(0x00020000)    /**< The PC hasn't had CS.BASE added to it. */
 /** Combines flags and exit type into EMHistoryAddExit() input. */
 #define EMEXIT_MAKE_FLAGS_AND_TYPE(a_fFlags, a_uType)   ((a_fFlags) | (uint32_t)(a_uType))
@@ -246,11 +246,46 @@
 typedef enum EMEXITACTION
 {
+    /** The record is free. */
+    EMEXITACTION_FREE_RECORD = 0,
     /** Take normal action on the exit. */
-    EMEXITACTION_NORMAL = 0,
-    EMEXITACTION_TODO
+    EMEXITACTION_NORMAL,
+    /** Take normal action on the exit, already probed and found nothing. */
+    EMEXITACTION_NORMAL_PROBED,
+    /** Do a probe execution. */
+    EMEXITACTION_EXEC_PROBE,
+    /** Execute using EMEXITREC::cMaxInstructionsWithoutExit. */
+    EMEXITACTION_EXEC_WITH_MAX
 } EMEXITACTION;
 AssertCompileSize(EMEXITACTION, 4);
 
-VMM_INT_DECL(EMEXITACTION)      EMHistoryAddExit(PVMCPU pVCpu, uint32_t uFlagsAndType, uint64_t uFlatPC, uint64_t uTimestamp);
+/**
+ * Accumulative exit record.
+ *
+ * This could perhaps be squeezed down a bit, but there isn't too much point.
+ * We'll probably need more data as time goes by.
+ */
+typedef struct EMEXITREC
+{
+    /** The flat PC of the exit. */
+    uint64_t            uFlatPC;
+    /** Flags and type, see EMEXIT_MAKE_FLAGS_AND_TYPE. */
+    uint32_t            uFlagsAndType;
+    /** The action to take (EMEXITACTION). */
+    uint8_t             enmAction;
+    uint8_t             bUnused;
+    /** Maximum number of instructions to execute without hitting an exit. */
+    uint16_t            cMaxInstructionsWithoutExit;
+    /** The exit number (EMCPU::iNextExit) at which it was last updated. */
+    uint64_t            uLastExitNo;
+    /** Number of hits. */
+    uint64_t            cHits;
+} EMEXITREC;
+AssertCompileSize(EMEXITREC, 32);
+/** Pointer to an accumulative exit record. */
+typedef EMEXITREC *PEMEXITREC;
+/** Pointer to a const accumulative exit record. */
+typedef EMEXITREC const *PCEMEXITREC;
+
+VMM_INT_DECL(PCEMEXITREC)       EMHistoryAddExit(PVMCPU pVCpu, uint32_t uFlagsAndType, uint64_t uFlatPC, uint64_t uTimestamp);
 #ifdef IN_RC
 VMMRC_INT_DECL(void)            EMRCHistoryAddExitCsEip(PVMCPU pVCpu, uint32_t uFlagsAndType, uint16_t uCs, uint32_t uEip,
@@ -260,6 +295,7 @@
 VMMR0_INT_DECL(void)            EMR0HistoryUpdatePC(PVMCPU pVCpu, uint64_t uFlatPC, bool fFlattened);
 #endif
-VMM_INT_DECL(EMEXITACTION)      EMHistoryUpdateFlagsAndType(PVMCPU pVCpu, uint32_t uFlagsAndType);
-VMM_INT_DECL(EMEXITACTION)      EMHistoryUpdateFlagsAndTypeAndPC(PVMCPU pVCpu, uint32_t uFlagsAndType, uint64_t uFlatPC);
+VMM_INT_DECL(PCEMEXITREC)       EMHistoryUpdateFlagsAndType(PVMCPU pVCpu, uint32_t uFlagsAndType);
+VMM_INT_DECL(PCEMEXITREC)       EMHistoryUpdateFlagsAndTypeAndPC(PVMCPU pVCpu, uint32_t uFlagsAndType, uint64_t uFlatPC);
+VMM_INT_DECL(VBOXSTRICTRC)      EMHistoryExec(PVMCPU pVCpu, PCEMEXITREC pExitRec, uint32_t fWillExit);
 
 
Index: trunk/include/VBox/vmm/iem.h
===================================================================
--- trunk/include/VBox/vmm/iem.h	(revision 72565)
+++ trunk/include/VBox/vmm/iem.h	(revision 72569)
@@ -210,4 +210,16 @@
                                                                       uint32_t *pcbWritten);
 VMMDECL(VBOXSTRICTRC)       IEMExecLots(PVMCPU pVCpu, uint32_t *pcInstructions);
+/** Statistics returned by IEMExecForExits. */
+typedef struct IEMEXECFOREXITSTATS
+{
+    uint32_t cInstructions;
+    uint32_t cExits;
+    uint32_t cMaxExitDistance;
+    uint32_t cReserved;
+} IEMEXECFOREXITSTATS;
+/** Pointer to statistics returned by IEMExecForExits. */
+typedef IEMEXECFOREXITSTATS *PIEMEXECFOREXITSTATS;
+VMMDECL(VBOXSTRICTRC)       IEMExecForExits(PVMCPU pVCpu, uint32_t fWillExit, uint32_t cMinInstructions, uint32_t cMaxInstructions,
+                                            uint32_t cMaxInstructionsWithoutExits, PIEMEXECFOREXITSTATS pStats);
 VMMDECL(VBOXSTRICTRC)       IEMInjectTrpmEvent(PVMCPU pVCpu);
 VMM_INT_DECL(VBOXSTRICTRC)  IEMInjectTrap(PVMCPU pVCpu, uint8_t u8TrapNo, TRPMEVENT enmType, uint16_t uErrCode, RTGCPTR uCr2,
Index: trunk/include/VBox/vmm/vm.h
===================================================================
--- trunk/include/VBox/vmm/vm.h	(revision 72565)
+++ trunk/include/VBox/vmm/vm.h	(revision 72569)
@@ -290,5 +290,5 @@
         struct EMCPU        s;
 #endif
-        uint8_t             padding[8192];      /* multiple of 4096 */
+        uint8_t             padding[40960];      /* multiple of 4096 */
     } em;
 } VMCPU;
Index: trunk/include/VBox/vmm/vm.mac
===================================================================
--- trunk/include/VBox/vmm/vm.mac	(revision 72565)
+++ trunk/include/VBox/vmm/vm.mac	(revision 72569)
@@ -83,5 +83,5 @@
     .cpum                   resb 4096
     alignb 4096
-    .em                     resb 8192
+    .em                     resb 40960
     alignb 4096
 endstruc
