Index: trunk/src/VBox/VMM/EM.cpp
===================================================================
--- trunk/src/VBox/VMM/EM.cpp	(revision 8984)
+++ trunk/src/VBox/VMM/EM.cpp	(revision 8985)
@@ -2056,5 +2056,5 @@
                         EMR3CheckRawForcedActions(pVM);
 
-                        rc = TRPMForwardTrap(pVM, CPUMCTX2CORE(pCtx), u8Interrupt, uErrorCode, enmError, TRPM_TRAP);
+                        rc = TRPMForwardTrap(pVM, CPUMCTX2CORE(pCtx), u8Interrupt, uErrorCode, enmError, TRPM_TRAP, -1);
                         if (rc == VINF_SUCCESS /* Don't use VBOX_SUCCESS */)
                         {
Index: trunk/src/VBox/VMM/TRPM.cpp
===================================================================
--- trunk/src/VBox/VMM/TRPM.cpp	(revision 8984)
+++ trunk/src/VBox/VMM/TRPM.cpp	(revision 8985)
@@ -1385,5 +1385,5 @@
 
                 /* There's a handler -> let's execute it in raw mode */
-                rc = TRPMForwardTrap(pVM, CPUMCTX2CORE(pCtx), u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, enmEvent);
+                rc = TRPMForwardTrap(pVM, CPUMCTX2CORE(pCtx), u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, enmEvent, -1);
                 if (rc == VINF_SUCCESS /* Don't use VBOX_SUCCESS */)
                 {
Index: trunk/src/VBox/VMM/VMMAll/TRPMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/TRPMAll.cpp	(revision 8984)
+++ trunk/src/VBox/VMM/VMMAll/TRPMAll.cpp	(revision 8985)
@@ -1,2 +1,3 @@
+#define VBOX_WITH_STATISTICS
 /* $Id$ */
 /** @file
@@ -30,4 +31,5 @@
 #include <VBox/patm.h>
 #include <VBox/selm.h>
+#include <VBox/stam.h>
 #include "TRPMInternal.h"
 #include <VBox/vm.h>
@@ -356,7 +358,8 @@
  * @param   enmError    TRPM_TRAP_HAS_ERRORCODE or TRPM_TRAP_NO_ERRORCODE.
  * @param   enmType     TRPM event type
+ * @param   iOrgTrap    The original trap.
  * @internal
  */
-TRPMDECL(int) TRPMForwardTrap(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t iGate, uint32_t opsize, TRPMERRORCODE enmError, TRPMEVENT enmType)
+TRPMDECL(int) TRPMForwardTrap(PVM pVM, PCPUMCTXCORE pRegFrame, uint32_t iGate, uint32_t opsize, TRPMERRORCODE enmError, TRPMEVENT enmType, int32_t iOrgTrap)
 {
 #ifdef TRPM_FORWARD_TRAPS_IN_GC
@@ -414,12 +417,9 @@
      * Well, only if the IF flag is set.
      */
-    /*
-     * @todo if the trap handler was modified and marked invalid, then we should *now* go back to the host context and install a new patch.
-     *
-     */
+    /** @todo if the trap handler was modified and marked invalid, then we should *now* go back to the host context and install a new patch. */
     if (    pVM->trpm.s.aGuestTrapHandler[iGate]
         && (eflags.Bits.u1IF)
 #ifndef VBOX_RAW_V86
-        && !(eflags.Bits.u1VM) /* @todo implement when needed (illegal for same privilege level transfers). */
+        && !(eflags.Bits.u1VM) /** @todo implement when needed (illegal for same privilege level transfers). */
 #endif
         && !PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip)
@@ -456,5 +456,5 @@
         if (VBOX_FAILURE(rc))
         {
-            /* The page might be out of sync. (@todo might cross a page boundary) */
+            /* The page might be out of sync. */ /** @todo might cross a page boundary) */
             Log(("Page %VGv out of sync -> prefetch and try again\n", pIDTEntry));
             rc = PGMPrefetchPage(pVM, pIDTEntry); /** @todo r=bird: rainy day: this isn't entirely safe because of access bit virtualiziation and CSAM. */
@@ -516,5 +516,5 @@
                 if (VBOX_FAILURE(rc))
                 {
-                    /* The page might be out of sync. (@todo might cross a page boundary) */
+                    /* The page might be out of sync. */ /** @todo might cross a page boundary) */
                     Log(("Page %VGv out of sync -> prefetch and try again\n", pGdtEntry));
                     rc = PGMPrefetchPage(pVM, pGdtEntry);  /** @todo r=bird: rainy day: this isn't entirely safe because of access bit virtualiziation and CSAM. */
@@ -662,7 +662,4 @@
                         Log4(("Stack %VGv pos %02d: %08x\n", &pTrapStack[j], j, pTrapStack[j]));
 
-                    const char *pszPrefix = "";
-                    const char *szEFlags = "";
-
                     Log4(("eax=%08x ebx=%08x ecx=%08x edx=%08x esi=%08x edi=%08x\n"
                           "eip=%08x esp=%08x ebp=%08x iopl=%d\n"
@@ -695,4 +692,6 @@
                     STAM_COUNTER_INC(&pVM->trpm.s.CTXALLSUFF(paStatForwardedIRQ)[iGate]);
                     STAM_PROFILE_ADV_STOP(CTXSUFF(&pVM->trpm.s.StatForwardProf), a);
+                    if (iOrgTrap >= 0 && iOrgTrap < (int)RT_ELEMENTS(pVM->trpm.s.aStatGCTraps))
+                        STAM_PROFILE_ADV_STOP(&pVM->trpm.s.aStatGCTraps[iOrgTrap], o);
 
                     CPUMGCCallGuestTrapHandler(pRegFrame, GuestIdte.Gen.u16SegSel | 1, pVM->trpm.s.aGuestTrapHandler[iGate], eflags.u32, ss_r0, (RTGCPTR)esp_r0);
Index: trunk/src/VBox/VMM/VMMGC/TRPMGCHandlers.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMGC/TRPMGCHandlers.cpp	(revision 8984)
+++ trunk/src/VBox/VMM/VMMGC/TRPMGCHandlers.cpp	(revision 8985)
@@ -48,4 +48,7 @@
 #include <iprt/assert.h>
 
+/*******************************************************************************
+*   Defined Constants And Macros                                               *
+*******************************************************************************/
 /* still here. MODR/M byte parsing */
 #define X86_OPCODE_MODRM_MOD_MASK       0xc0
@@ -53,4 +56,11 @@
 #define X86_OPCODE_MODRM_RM_MASK        0x07
 
+/** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
+#define DTRACE_EXPERIMENT
+
+
+/*******************************************************************************
+*   Structures and Typedefs                                                    *
+*******************************************************************************/
 /** Pointer to a readonly hypervisor trap record. */
 typedef const struct TRPMGCHYPER *PCTRPMGCHYPER;
@@ -193,5 +203,5 @@
             Log(("trpmGCExitTrap: u8Interrupt=%d (%#x) rc=%Vrc\n", u8Interrupt, u8Interrupt, rc));
             AssertFatalMsgRC(rc, ("PDMGetInterrupt failed with %Vrc\n", rc));
-            rc = TRPMForwardTrap(pVM, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT);
+            rc = TRPMForwardTrap(pVM, pRegFrame, (uint32_t)u8Interrupt, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_HARDWARE_INT, uOldActiveVector);
             /* can't return if successful */
             Assert(rc != VINF_SUCCESS);
@@ -362,12 +372,35 @@
             return trpmGCExitTrap(pVM, VINF_EM_RAW_EMULATE_INSTR, pRegFrame);
 
-        if (    PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip)
-            &&  Cpu.pCurInstr->opcode == OP_ILLUD2)
+        /*
+         * UD2 in a patch?
+         */
+        if (    Cpu.pCurInstr->opcode == OP_ILLUD2
+            &&  PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip))
         {
             rc = PATMGCHandleIllegalInstrTrap(pVM, pRegFrame);
-            if (rc == VINF_SUCCESS || rc == VINF_EM_RAW_EMULATE_INSTR || rc == VINF_PATM_DUPLICATE_FUNCTION || rc == VINF_PATM_PENDING_IRQ_AFTER_IRET || rc == VINF_EM_RESCHEDULE)
+            if (    rc == VINF_SUCCESS
+                ||  rc == VINF_EM_RAW_EMULATE_INSTR
+                ||  rc == VINF_PATM_DUPLICATE_FUNCTION
+                ||  rc == VINF_PATM_PENDING_IRQ_AFTER_IRET
+                ||  rc == VINF_EM_RESCHEDULE)
                 return trpmGCExitTrap(pVM, rc, pRegFrame);
         }
-        /* Note: monitor causes an #UD exception instead of #GP when not executed in ring 0. */
+        /*
+         * Speed up dtrace and don't entrust invalid lock sequences to the recompiler.
+         */
+        else if (Cpu.prefix & PREFIX_LOCK)
+        {
+            Log(("TRPMGCTrap06Handler: pc=%RGv op=%d\n", pRegFrame->eip, Cpu.pCurInstr->opcode));
+#ifdef DTRACE_EXPERIMENT /** @todo fix/remove/permanent-enable this when DIS/PATM handles invalid lock sequences. */
+            Assert(!PATMIsPatchGCAddr(pVM, (RTGCPTR)pRegFrame->eip));
+            rc = TRPMForwardTrap(pVM, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
+            Assert(rc == VINF_EM_RAW_GUEST_TRAP);
+#else
+            rc = VINF_EM_RAW_EMULATE_INSTR;
+#endif
+        }
+        /*
+         * Handle MONITOR - it causes an #UD exception instead of #GP when not executed in ring 0.
+         */
         else if (Cpu.pCurInstr->opcode == OP_MONITOR)
         {
@@ -377,16 +410,4 @@
                 pRegFrame->eip += Cpu.opsize;
         }
-        /* Speed up dtrace and don't entrust invalid lock sequences to the recompiler. */
-        else if (Cpu.prefix & PREFIX_LOCK)
-        {
-            Log(("TRPMGCTrap06Handler: pc=%RGv op=%d\n", pRegFrame->eip, Cpu.pCurInstr->opcode));
-            /** @todo Clear this with PATM - it gets upset when returning VINF_EM_RAW_GUEST_TRAP on a patch address. */
-#ifdef DTRACE_EXPERIMENT
-            rc = TRPMForwardTrap(pVM, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP);
-            Assert(rc == VINF_EM_RAW_GUEST_TRAP);
-#else
-            rc = VINF_EM_RAW_EMULATE_INSTR;
-#endif
-        }
         /* Never generate a raw trap here; it might be an instruction, that requires emulation. */
         else
@@ -395,5 +416,5 @@
     else
     {
-        rc = TRPMForwardTrap(pVM, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP);
+        rc = TRPMForwardTrap(pVM, pRegFrame, 0x6, 0, TRPM_TRAP_NO_ERRORCODE, TRPM_TRAP, 0x6);
         Assert(rc == VINF_EM_RAW_GUEST_TRAP);
     }
@@ -560,5 +581,5 @@
                 }
             }
-            rc = TRPMForwardTrap(pVM, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT);
+            rc = TRPMForwardTrap(pVM, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
             if (VBOX_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
                 return trpmGCExitTrap(pVM, VINF_SUCCESS, pRegFrame);
@@ -651,5 +672,5 @@
         {
             Assert(pCpu->param1.flags & USE_IMMEDIATE8);
-            rc = TRPMForwardTrap(pVM, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT);
+            rc = TRPMForwardTrap(pVM, pRegFrame, (uint32_t)pCpu->param1.parval, pCpu->opsize, TRPM_TRAP_NO_ERRORCODE, TRPM_SOFTWARE_INT, 0xd);
             if (VBOX_SUCCESS(rc) && rc != VINF_EM_RAW_GUEST_TRAP)
                 return trpmGCExitTrap(pVM, VINF_SUCCESS, pRegFrame);
@@ -834,5 +855,5 @@
         Assert(eflags.Bits.u2IOPL == 0);
 
-        int rc = TRPMForwardTrap(pVM, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP);
+        int rc = TRPMForwardTrap(pVM, pRegFrame, 0xD, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xd);
         Assert(rc == VINF_EM_RAW_GUEST_TRAP);
         return trpmGCExitTrap(pVM, rc, pRegFrame);
@@ -932,5 +953,5 @@
             return VINF_PATM_PATCH_TRAP_PF;
 
-        rc = TRPMForwardTrap(pVM, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP);
+        rc = TRPMForwardTrap(pVM, pRegFrame, 0xE, 0, TRPM_TRAP_HAS_ERRORCODE, TRPM_TRAP, 0xe);
         Assert(rc == VINF_EM_RAW_GUEST_TRAP);
         break;
