Index: trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp	(revision 100830)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp	(revision 100831)
@@ -1012,5 +1012,5 @@
  */
 
-IEM_DECL_IMPL_DEF(void, iemAImpl_cmp_u64,(uint64_t *puDst, uint64_t uSrc, uint32_t *pfEFlags))
+IEM_DECL_IMPL_DEF(void, iemAImpl_cmp_u64,(uint64_t const *puDst, uint64_t uSrc, uint32_t *pfEFlags))
 {
     uint64_t uDstTmp = *puDst;
@@ -1020,5 +1020,5 @@
 # if !defined(RT_ARCH_X86) || defined(IEM_WITHOUT_ASSEMBLY)
 
-IEM_DECL_IMPL_DEF(void, iemAImpl_cmp_u32,(uint32_t *puDst, uint32_t uSrc, uint32_t *pfEFlags))
+IEM_DECL_IMPL_DEF(void, iemAImpl_cmp_u32,(uint32_t const *puDst, uint32_t uSrc, uint32_t *pfEFlags))
 {
     uint32_t uDstTmp = *puDst;
@@ -1027,5 +1027,5 @@
 
 
-IEM_DECL_IMPL_DEF(void, iemAImpl_cmp_u16,(uint16_t *puDst, uint16_t uSrc, uint32_t *pfEFlags))
+IEM_DECL_IMPL_DEF(void, iemAImpl_cmp_u16,(uint16_t const *puDst, uint16_t uSrc, uint32_t *pfEFlags))
 {
     uint16_t uDstTmp = *puDst;
@@ -1046,5 +1046,5 @@
  */
 
-IEM_DECL_IMPL_DEF(void, iemAImpl_test_u64,(uint64_t *puDst, uint64_t uSrc, uint32_t *pfEFlags))
+IEM_DECL_IMPL_DEF(void, iemAImpl_test_u64,(uint64_t const *puDst, uint64_t uSrc, uint32_t *pfEFlags))
 {
     uint64_t uResult = *puDst & uSrc;
@@ -1054,5 +1054,5 @@
 # if !defined(RT_ARCH_X86) || defined(IEM_WITHOUT_ASSEMBLY)
 
-IEM_DECL_IMPL_DEF(void, iemAImpl_test_u32,(uint32_t *puDst, uint32_t uSrc, uint32_t *pfEFlags))
+IEM_DECL_IMPL_DEF(void, iemAImpl_test_u32,(uint32_t const *puDst, uint32_t uSrc, uint32_t *pfEFlags))
 {
     uint32_t uResult = *puDst & uSrc;
@@ -1061,5 +1061,5 @@
 
 
-IEM_DECL_IMPL_DEF(void, iemAImpl_test_u16,(uint16_t *puDst, uint16_t uSrc, uint32_t *pfEFlags))
+IEM_DECL_IMPL_DEF(void, iemAImpl_test_u16,(uint16_t const *puDst, uint16_t uSrc, uint32_t *pfEFlags))
 {
     uint16_t uResult = *puDst & uSrc;
Index: trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h	(revision 100830)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h	(revision 100831)
@@ -261,5 +261,5 @@
  * memory/register as the destination.
  */
-#define IEMOP_BODY_BINARY_rm_rv(a_fnNormalU16, a_fnNormalU32, a_fnNormalU64, a_fRW) \
+#define IEMOP_BODY_BINARY_rm_rv_RW(a_fnNormalU16, a_fnNormalU32, a_fnNormalU64) \
     uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm); \
     \
@@ -299,6 +299,5 @@
                 IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU32, pu32Dst, u32Src, pEFlags); \
                 \
-                if ((a_fRW) == IEM_ACCESS_DATA_RW) /* not TEST and CMP */ \
-                    IEM_MC_CLEAR_HIGH_GREG_U64_BY_REF(pu32Dst); \
+                IEM_MC_CLEAR_HIGH_GREG_U64_BY_REF(pu32Dst); \
                 IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                 IEM_MC_END(); \
@@ -336,18 +335,19 @@
             { \
                 case IEMMODE_16BIT: \
-                    IEM_MC_BEGIN(3, 2); \
+                    IEM_MC_BEGIN(3, 3); \
                     IEM_MC_ARG(uint16_t *, pu16Dst,          0); \
                     IEM_MC_ARG(uint16_t,   u16Src,           1); \
                     IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
                     IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
+                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
                     \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING(); \
-                    IEM_MC_MEM_MAP(pu16Dst, a_fRW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/); \
+                    IEM_MC_MEM_MAP_U16_RW(pu16Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
                     IEM_MC_FETCH_GREG_U16(u16Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
                     IEM_MC_FETCH_EFLAGS(EFlags); \
                     IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU16, pu16Dst, u16Src, pEFlags); \
                     \
-                    IEM_MC_MEM_COMMIT_AND_UNMAP(pu16Dst, a_fRW); \
+                    IEM_MC_MEM_COMMIT_AND_UNMAP_RW(pu16Dst, bUnmapInfo); \
                     IEM_MC_COMMIT_EFLAGS(EFlags); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
@@ -356,18 +356,19 @@
                 \
                 case IEMMODE_32BIT: \
-                    IEM_MC_BEGIN(3, 2); \
+                    IEM_MC_BEGIN(3, 3); \
                     IEM_MC_ARG(uint32_t *, pu32Dst,          0); \
                     IEM_MC_ARG(uint32_t,   u32Src,           1); \
                     IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
                     IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
+                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
                     \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING(); \
-                    IEM_MC_MEM_MAP(pu32Dst, a_fRW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/); \
+                    IEM_MC_MEM_MAP_U32_RW(pu32Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
                     IEM_MC_FETCH_GREG_U32(u32Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
                     IEM_MC_FETCH_EFLAGS(EFlags); \
                     IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU32, pu32Dst, u32Src, pEFlags); \
                     \
-                    IEM_MC_MEM_COMMIT_AND_UNMAP(pu32Dst, a_fRW); \
+                    IEM_MC_MEM_COMMIT_AND_UNMAP_RW(pu32Dst, bUnmapInfo); \
                     IEM_MC_COMMIT_EFLAGS(EFlags); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
@@ -376,18 +377,19 @@
                 \
                 case IEMMODE_64BIT: \
-                    IEM_MC_BEGIN(3, 2); \
+                    IEM_MC_BEGIN(3, 3); \
                     IEM_MC_ARG(uint64_t *, pu64Dst,          0); \
                     IEM_MC_ARG(uint64_t,   u64Src,           1); \
                     IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
                     IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
+                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
                     \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING(); \
-                    IEM_MC_MEM_MAP(pu64Dst, a_fRW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/); \
+                    IEM_MC_MEM_MAP_U64_RW(pu64Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
                     IEM_MC_FETCH_GREG_U64(u64Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
                     IEM_MC_FETCH_EFLAGS(EFlags); \
                     IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU64, pu64Dst, u64Src, pEFlags); \
                     \
-                    IEM_MC_MEM_COMMIT_AND_UNMAP(pu64Dst, a_fRW); \
+                    IEM_MC_MEM_COMMIT_AND_UNMAP_RW(pu64Dst, bUnmapInfo); \
                     IEM_MC_COMMIT_EFLAGS(EFlags); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
@@ -401,30 +403,24 @@
         { \
             (void)0
-
-#define IEMOP_BODY_BINARY_rm_rv_NO_LOCK() \
-            IEMOP_HLP_DONE_DECODING(); \
-            IEMOP_RAISE_INVALID_LOCK_PREFIX_RET(); \
-        } \
-    } \
-    (void)0
-
+/* Separate macro to work around parsing issue in IEMAllInstPython.py */
 #define IEMOP_BODY_BINARY_rm_rv_LOCKED(a_fnLockedU16, a_fnLockedU32, a_fnLockedU64) \
             switch (pVCpu->iem.s.enmEffOpSize) \
             { \
                 case IEMMODE_16BIT: \
-                    IEM_MC_BEGIN(3, 2); \
+                    IEM_MC_BEGIN(3, 3); \
                     IEM_MC_ARG(uint16_t *, pu16Dst,          0); \
                     IEM_MC_ARG(uint16_t,   u16Src,           1); \
                     IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
                     IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
+                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
                     \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING(); \
-                    IEM_MC_MEM_MAP(pu16Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/); \
+                    IEM_MC_MEM_MAP_U16_RW(pu16Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
                     IEM_MC_FETCH_GREG_U16(u16Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
                     IEM_MC_FETCH_EFLAGS(EFlags); \
                     IEM_MC_CALL_VOID_AIMPL_3(a_fnLockedU16, pu16Dst, u16Src, pEFlags); \
                     \
-                    IEM_MC_MEM_COMMIT_AND_UNMAP(pu16Dst, IEM_ACCESS_DATA_RW); \
+                    IEM_MC_MEM_COMMIT_AND_UNMAP_RW(pu16Dst, bUnmapInfo); \
                     IEM_MC_COMMIT_EFLAGS(EFlags); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
@@ -433,18 +429,19 @@
                 \
                 case IEMMODE_32BIT: \
-                    IEM_MC_BEGIN(3, 2); \
+                    IEM_MC_BEGIN(3, 3); \
                     IEM_MC_ARG(uint32_t *, pu32Dst,          0); \
                     IEM_MC_ARG(uint32_t,   u32Src,           1); \
                     IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
                     IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
+                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
                     \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING(); \
-                    IEM_MC_MEM_MAP(pu32Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/); \
+                    IEM_MC_MEM_MAP_U32_RW(pu32Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
                     IEM_MC_FETCH_GREG_U32(u32Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
                     IEM_MC_FETCH_EFLAGS(EFlags); \
                     IEM_MC_CALL_VOID_AIMPL_3(a_fnLockedU32, pu32Dst, u32Src, pEFlags); \
                     \
-                    IEM_MC_MEM_COMMIT_AND_UNMAP(pu32Dst, IEM_ACCESS_DATA_RW /* CMP,TEST */); \
+                    IEM_MC_MEM_COMMIT_AND_UNMAP_RW(pu32Dst, bUnmapInfo /* CMP,TEST */); \
                     IEM_MC_COMMIT_EFLAGS(EFlags); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
@@ -453,18 +450,19 @@
                 \
                 case IEMMODE_64BIT: \
-                    IEM_MC_BEGIN(3, 2); \
+                    IEM_MC_BEGIN(3, 3); \
                     IEM_MC_ARG(uint64_t *, pu64Dst,          0); \
                     IEM_MC_ARG(uint64_t,   u64Src,           1); \
                     IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
                     IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
+                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
                     \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING(); \
-                    IEM_MC_MEM_MAP(pu64Dst, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/); \
+                    IEM_MC_MEM_MAP_U64_RW(pu64Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
                     IEM_MC_FETCH_GREG_U64(u64Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
                     IEM_MC_FETCH_EFLAGS(EFlags); \
                     IEM_MC_CALL_VOID_AIMPL_3(a_fnLockedU64, pu64Dst, u64Src, pEFlags); \
                     \
-                    IEM_MC_MEM_COMMIT_AND_UNMAP(pu64Dst, IEM_ACCESS_DATA_RW); \
+                    IEM_MC_MEM_COMMIT_AND_UNMAP_RW(pu64Dst, bUnmapInfo); \
                     IEM_MC_COMMIT_EFLAGS(EFlags); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
@@ -474,4 +472,154 @@
                 IEM_NOT_REACHED_DEFAULT_CASE_RET(); \
             } \
+        } \
+    } \
+    (void)0
+
+/**
+ * Body for read-only word/dword/qword instructions like TEST and CMP with
+ * memory/register as the destination.
+ */
+#define IEMOP_BODY_BINARY_rm_rv_RO(a_fnNormalU16, a_fnNormalU32, a_fnNormalU64) \
+    uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm); \
+    \
+    /* \
+     * If rm is denoting a register, no more instruction bytes. \
+     */ \
+    if (IEM_IS_MODRM_REG_MODE(bRm)) \
+    { \
+        switch (pVCpu->iem.s.enmEffOpSize) \
+        { \
+            case IEMMODE_16BIT: \
+                IEM_MC_BEGIN(3, 0); \
+                IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+                IEM_MC_ARG(uint16_t *, pu16Dst, 0); \
+                IEM_MC_ARG(uint16_t,   u16Src,  1); \
+                IEM_MC_ARG(uint32_t *, pEFlags, 2); \
+                \
+                IEM_MC_FETCH_GREG_U16(u16Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
+                IEM_MC_REF_GREG_U16(pu16Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
+                IEM_MC_REF_EFLAGS(pEFlags); \
+                IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU16, pu16Dst, u16Src, pEFlags); \
+                \
+                IEM_MC_ADVANCE_RIP_AND_FINISH(); \
+                IEM_MC_END(); \
+                break; \
+            \
+            case IEMMODE_32BIT: \
+                IEM_MC_BEGIN(3, 0); \
+                IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+                IEM_MC_ARG(uint32_t *, pu32Dst, 0); \
+                IEM_MC_ARG(uint32_t,   u32Src,  1); \
+                IEM_MC_ARG(uint32_t *, pEFlags, 2); \
+                \
+                IEM_MC_FETCH_GREG_U32(u32Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
+                IEM_MC_REF_GREG_U32(pu32Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
+                IEM_MC_REF_EFLAGS(pEFlags); \
+                IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU32, pu32Dst, u32Src, pEFlags); \
+                \
+                IEM_MC_ADVANCE_RIP_AND_FINISH(); \
+                IEM_MC_END(); \
+                break; \
+            \
+            case IEMMODE_64BIT: \
+                IEM_MC_BEGIN(3, 0); \
+                IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+                IEM_MC_ARG(uint64_t *, pu64Dst, 0); \
+                IEM_MC_ARG(uint64_t,   u64Src,  1); \
+                IEM_MC_ARG(uint32_t *, pEFlags, 2); \
+                \
+                IEM_MC_FETCH_GREG_U64(u64Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
+                IEM_MC_REF_GREG_U64(pu64Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
+                IEM_MC_REF_EFLAGS(pEFlags); \
+                IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU64, pu64Dst, u64Src, pEFlags); \
+                \
+                IEM_MC_ADVANCE_RIP_AND_FINISH(); \
+                IEM_MC_END(); \
+                break; \
+            \
+            IEM_NOT_REACHED_DEFAULT_CASE_RET(); \
+        } \
+    } \
+    else \
+    { \
+        /* \
+         * We're accessing memory. \
+         * Note! We're putting the eflags on the stack here so we can commit them \
+         *       after the memory. \
+         */ \
+        if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK)) \
+        { \
+            switch (pVCpu->iem.s.enmEffOpSize) \
+            { \
+                case IEMMODE_16BIT: \
+                    IEM_MC_BEGIN(3, 3); \
+                    IEM_MC_ARG(uint16_t const *, pu16Dst,         0); \
+                    IEM_MC_ARG(uint16_t,         u16Src,          1); \
+                    IEM_MC_ARG_LOCAL_EFLAGS(     pEFlags, EFlags, 2); \
+                    IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
+                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
+                    \
+                    IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
+                    IEMOP_HLP_DONE_DECODING(); \
+                    IEM_MC_MEM_MAP_U16_RO(pu16Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
+                    IEM_MC_FETCH_GREG_U16(u16Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
+                    IEM_MC_FETCH_EFLAGS(EFlags); \
+                    IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU16, pu16Dst, u16Src, pEFlags); \
+                    \
+                    IEM_MC_MEM_COMMIT_AND_UNMAP_RO(pu16Dst, bUnmapInfo); \
+                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_ADVANCE_RIP_AND_FINISH(); \
+                    IEM_MC_END(); \
+                    break; \
+                \
+                case IEMMODE_32BIT: \
+                    IEM_MC_BEGIN(3, 3); \
+                    IEM_MC_ARG(uint32_t const *, pu32Dst,         0); \
+                    IEM_MC_ARG(uint32_t,         u32Src,          1); \
+                    IEM_MC_ARG_LOCAL_EFLAGS(     pEFlags, EFlags, 2); \
+                    IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
+                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
+                    \
+                    IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
+                    IEMOP_HLP_DONE_DECODING(); \
+                    IEM_MC_MEM_MAP_U32_RO(pu32Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
+                    IEM_MC_FETCH_GREG_U32(u32Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
+                    IEM_MC_FETCH_EFLAGS(EFlags); \
+                    IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU32, pu32Dst, u32Src, pEFlags); \
+                    \
+                    IEM_MC_MEM_COMMIT_AND_UNMAP_RO(pu32Dst, bUnmapInfo); \
+                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_ADVANCE_RIP_AND_FINISH(); \
+                    IEM_MC_END(); \
+                    break; \
+                \
+                case IEMMODE_64BIT: \
+                    IEM_MC_BEGIN(3, 3); \
+                    IEM_MC_ARG(uint64_t const *, pu64Dst,         0); \
+                    IEM_MC_ARG(uint64_t,         u64Src,          1); \
+                    IEM_MC_ARG_LOCAL_EFLAGS(     pEFlags, EFlags, 2); \
+                    IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
+                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
+                    \
+                    IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
+                    IEMOP_HLP_DONE_DECODING(); \
+                    IEM_MC_MEM_MAP_U64_RO(pu64Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
+                    IEM_MC_FETCH_GREG_U64(u64Src, IEM_GET_MODRM_REG(pVCpu, bRm)); \
+                    IEM_MC_FETCH_EFLAGS(EFlags); \
+                    IEM_MC_CALL_VOID_AIMPL_3(a_fnNormalU64, pu64Dst, u64Src, pEFlags); \
+                    \
+                    IEM_MC_MEM_COMMIT_AND_UNMAP_RO(pu64Dst, bUnmapInfo); \
+                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_ADVANCE_RIP_AND_FINISH(); \
+                    IEM_MC_END(); \
+                    break; \
+                \
+                IEM_NOT_REACHED_DEFAULT_CASE_RET(); \
+            } \
+        } \
+        else \
+        { \
+            IEMOP_HLP_DONE_DECODING(); \
+            IEMOP_RAISE_INVALID_LOCK_PREFIX_RET(); \
         } \
     } \
@@ -606,5 +754,5 @@
 {
     IEMOP_MNEMONIC2(MR, ADD, add, Ev, Gv, DISOPTYPE_HARMLESS, IEMOPHINT_LOCK_ALLOWED);
-    IEMOP_BODY_BINARY_rm_rv(       iemAImpl_add_u16,        iemAImpl_add_u32,        iemAImpl_add_u64, IEM_ACCESS_DATA_RW);
+    IEMOP_BODY_BINARY_rm_rv_RW(    iemAImpl_add_u16,        iemAImpl_add_u32,        iemAImpl_add_u64);
     IEMOP_BODY_BINARY_rm_rv_LOCKED(iemAImpl_add_u16_locked, iemAImpl_add_u32_locked, iemAImpl_add_u64_locked);
 }
@@ -728,5 +876,5 @@
     IEMOP_MNEMONIC2(MR, OR, or, Ev, Gv, DISOPTYPE_HARMLESS, IEMOPHINT_LOCK_ALLOWED);
     IEMOP_VERIFICATION_UNDEFINED_EFLAGS(X86_EFL_AF);
-    IEMOP_BODY_BINARY_rm_rv(       iemAImpl_or_u16,        iemAImpl_or_u32,        iemAImpl_or_u64, IEM_ACCESS_DATA_RW);
+    IEMOP_BODY_BINARY_rm_rv_RW(    iemAImpl_or_u16,        iemAImpl_or_u32,        iemAImpl_or_u64);
     IEMOP_BODY_BINARY_rm_rv_LOCKED(iemAImpl_or_u16_locked, iemAImpl_or_u32_locked, iemAImpl_or_u64_locked);
 }
@@ -892,5 +1040,5 @@
 {
     IEMOP_MNEMONIC2(MR, ADC, adc, Ev, Gv, DISOPTYPE_HARMLESS, IEMOPHINT_LOCK_ALLOWED);
-    IEMOP_BODY_BINARY_rm_rv(       iemAImpl_adc_u16,        iemAImpl_adc_u32,        iemAImpl_adc_u64, IEM_ACCESS_DATA_RW);
+    IEMOP_BODY_BINARY_rm_rv_RW(    iemAImpl_adc_u16,        iemAImpl_adc_u32,        iemAImpl_adc_u64);
     IEMOP_BODY_BINARY_rm_rv_LOCKED(iemAImpl_adc_u16_locked, iemAImpl_adc_u32_locked, iemAImpl_adc_u64_locked);
 }
@@ -1002,5 +1150,5 @@
 {
     IEMOP_MNEMONIC2(MR, SBB, sbb, Ev, Gv, DISOPTYPE_HARMLESS, IEMOPHINT_LOCK_ALLOWED);
-    IEMOP_BODY_BINARY_rm_rv(       iemAImpl_sbb_u16,        iemAImpl_sbb_u32,        iemAImpl_sbb_u64, IEM_ACCESS_DATA_RW);
+    IEMOP_BODY_BINARY_rm_rv_RW(    iemAImpl_sbb_u16,        iemAImpl_sbb_u32,        iemAImpl_sbb_u64);
     IEMOP_BODY_BINARY_rm_rv_LOCKED(iemAImpl_sbb_u16_locked, iemAImpl_sbb_u32_locked, iemAImpl_sbb_u64_locked);
 }
@@ -1111,5 +1259,5 @@
     IEMOP_MNEMONIC2(MR, AND, and, Ev, Gv, DISOPTYPE_HARMLESS, IEMOPHINT_LOCK_ALLOWED);
     IEMOP_VERIFICATION_UNDEFINED_EFLAGS(X86_EFL_AF);
-    IEMOP_BODY_BINARY_rm_rv(       iemAImpl_and_u16,        iemAImpl_and_u32,        iemAImpl_and_u64, IEM_ACCESS_DATA_RW);
+    IEMOP_BODY_BINARY_rm_rv_RW(    iemAImpl_and_u16,        iemAImpl_and_u32,        iemAImpl_and_u64);
     IEMOP_BODY_BINARY_rm_rv_LOCKED(iemAImpl_and_u16_locked, iemAImpl_and_u32_locked, iemAImpl_and_u64_locked);
 }
@@ -1233,5 +1381,5 @@
 {
     IEMOP_MNEMONIC2(MR, SUB, sub, Ev, Gv, DISOPTYPE_HARMLESS, IEMOPHINT_LOCK_ALLOWED);
-    IEMOP_BODY_BINARY_rm_rv(       iemAImpl_sub_u16,        iemAImpl_sub_u32,        iemAImpl_sub_u64, IEM_ACCESS_DATA_RW);
+    IEMOP_BODY_BINARY_rm_rv_RW(    iemAImpl_sub_u16,        iemAImpl_sub_u32,        iemAImpl_sub_u64);
     IEMOP_BODY_BINARY_rm_rv_LOCKED(iemAImpl_sub_u16_locked, iemAImpl_sub_u32_locked, iemAImpl_sub_u64_locked);
 }
@@ -1349,5 +1497,5 @@
     IEMOP_MNEMONIC2(MR, XOR, xor, Ev, Gv, DISOPTYPE_HARMLESS, IEMOPHINT_LOCK_ALLOWED);
     IEMOP_VERIFICATION_UNDEFINED_EFLAGS(X86_EFL_AF);
-    IEMOP_BODY_BINARY_rm_rv(       iemAImpl_xor_u16,        iemAImpl_xor_u32,        iemAImpl_xor_u64, IEM_ACCESS_DATA_RW);
+    IEMOP_BODY_BINARY_rm_rv_RW(    iemAImpl_xor_u16,        iemAImpl_xor_u32,        iemAImpl_xor_u64);
     IEMOP_BODY_BINARY_rm_rv_LOCKED(iemAImpl_xor_u16_locked, iemAImpl_xor_u32_locked, iemAImpl_xor_u64_locked);
 }
@@ -1500,6 +1648,5 @@
 {
     IEMOP_MNEMONIC(cmp_Ev_Gv, "cmp Ev,Gv");
-    IEMOP_BODY_BINARY_rm_rv(iemAImpl_cmp_u16, iemAImpl_cmp_u32, iemAImpl_cmp_u64, IEM_ACCESS_DATA_R);
-    IEMOP_BODY_BINARY_rm_rv_NO_LOCK();
+    IEMOP_BODY_BINARY_rm_rv_RO(iemAImpl_cmp_u16, iemAImpl_cmp_u32, iemAImpl_cmp_u64);
 }
 
@@ -4691,6 +4838,5 @@
     IEMOP_MNEMONIC(test_Ev_Gv, "test Ev,Gv");
     IEMOP_VERIFICATION_UNDEFINED_EFLAGS(X86_EFL_AF);
-    IEMOP_BODY_BINARY_rm_rv(iemAImpl_test_u16, iemAImpl_test_u32, iemAImpl_test_u64, IEM_ACCESS_DATA_R);
-    IEMOP_BODY_BINARY_rm_rv_NO_LOCK();
+    IEMOP_BODY_BINARY_rm_rv_RO(iemAImpl_test_u16, iemAImpl_test_u32, iemAImpl_test_u64);
 }
 
Index: trunk/src/VBox/VMM/include/IEMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMInternal.h	(revision 100830)
+++ trunk/src/VBox/VMM/include/IEMInternal.h	(revision 100831)
@@ -1821,7 +1821,7 @@
  * @{ */
 FNIEMAIMPLBINROU8  iemAImpl_cmp_u8;
-FNIEMAIMPLBINU16 iemAImpl_cmp_u16;
-FNIEMAIMPLBINU32 iemAImpl_cmp_u32;
-FNIEMAIMPLBINU64 iemAImpl_cmp_u64;
+FNIEMAIMPLBINROU16 iemAImpl_cmp_u16;
+FNIEMAIMPLBINROU32 iemAImpl_cmp_u32;
+FNIEMAIMPLBINROU64 iemAImpl_cmp_u64;
 /** @}  */
 
@@ -1829,7 +1829,7 @@
  * @{ */
 FNIEMAIMPLBINROU8  iemAImpl_test_u8;
-FNIEMAIMPLBINU16 iemAImpl_test_u16;
-FNIEMAIMPLBINU32 iemAImpl_test_u32;
-FNIEMAIMPLBINU64 iemAImpl_test_u64;
+FNIEMAIMPLBINROU16 iemAImpl_test_u16;
+FNIEMAIMPLBINROU32 iemAImpl_test_u32;
+FNIEMAIMPLBINROU64 iemAImpl_test_u64;
 /** @}  */
 
Index: trunk/src/VBox/VMM/include/IEMMc.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMMc.h	(revision 100830)
+++ trunk/src/VBox/VMM/include/IEMMc.h	(revision 100831)
@@ -1362,4 +1362,6 @@
 
 
+/* 8-bit */
+
 /**
  * Maps guest memory for byte read+write direct (or bounce) buffer acccess.
@@ -1488,4 +1490,393 @@
 #endif
 
+
+/* 16-bit */
+
+/**
+ * Maps guest memory for word read+write direct (or bounce) buffer acccess.
+ *
+ * @param[out] a_pu16Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_iSeg       The segment register to access via. No UINT8_MAX!
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RW
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), (a_iSeg), \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint16_t) - 1)); \
+        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    (a_pu16Mem) = iemMemMapDataU16RwJmp(pVCpu, &(a_bUnmapInfo), (a_iSeg), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for word writeonly direct (or bounce) buffer acccess.
+ *
+ * @param[out] a_pu16Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_iSeg       The segment register to access via. No UINT8_MAX!
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_WO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), (a_iSeg), \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint16_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    (a_pu16Mem) = iemMemMapDataU16WoJmp(pVCpu, &(a_bUnmapInfo), (a_iSeg), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for word readonly direct (or bounce) buffer acccess.
+ *
+ * @param[out] a_pu16Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_iSeg       The segment register to access via. No UINT8_MAX!
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), (a_iSeg), \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint16_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    (a_pu16Mem) = iemMemMapDataU16RoJmp(pVCpu, &(a_bUnmapInfo), (a_iSeg), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for word read+write direct (or bounce) buffer acccess, flat
+ * address variant.
+ *
+ * @param[out] a_pu16Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RW
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_FLAT_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), UINT8_MAX, \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint16_t) - 1)); \
+        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_FLAT_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) \
+    (a_pu16Mem) = iemMemFlatMapDataU16RwJmp(pVCpu, &(a_bUnmapInfo), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for word writeonly direct (or bounce) buffer acccess, flat
+ * address variant.
+ *
+ * @param[out] a_pu16Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_WO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_FLAT_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), UINT8_MAX, \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint16_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_FLAT_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) \
+    (a_pu16Mem) = iemMemFlatMapDataU16WoJmp(pVCpu, &(a_bUnmapInfo), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for word readonly direct (or bounce) buffer acccess, flat
+ * address variant.
+ *
+ * @param[out] a_pu16Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_FLAT_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), UINT8_MAX, \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint16_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_FLAT_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) \
+    (a_pu16Mem) = iemMemFlatMapDataU16RoJmp(pVCpu, &(a_bUnmapInfo), (a_GCPtrMem))
+#endif
+
+
+/* 32-bit */
+
+/**
+ * Maps guest memory for dword read+write direct (or bounce) buffer acccess.
+ *
+ * @param[out] a_pu32Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_iSeg       The segment register to access via. No UINT8_MAX!
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RW
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), (a_iSeg), \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint32_t) - 1)); \
+        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    (a_pu32Mem) = iemMemMapDataU32RwJmp(pVCpu, &(a_bUnmapInfo), (a_iSeg), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for dword writeonly direct (or bounce) buffer acccess.
+ *
+ * @param[out] a_pu32Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_iSeg       The segment register to access via. No UINT8_MAX!
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_WO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), (a_iSeg), \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint32_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    (a_pu32Mem) = iemMemMapDataU32WoJmp(pVCpu, &(a_bUnmapInfo), (a_iSeg), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for dword readonly direct (or bounce) buffer acccess.
+ *
+ * @param[out] a_pu32Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_iSeg       The segment register to access via. No UINT8_MAX!
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), (a_iSeg), \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint32_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    (a_pu32Mem) = iemMemMapDataU32RoJmp(pVCpu, &(a_bUnmapInfo), (a_iSeg), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for dword read+write direct (or bounce) buffer acccess,
+ * flat address variant.
+ *
+ * @param[out] a_pu32Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RW
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_FLAT_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), UINT8_MAX, \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint32_t) - 1)); \
+        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_FLAT_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) \
+    (a_pu32Mem) = iemMemFlatMapDataU32RwJmp(pVCpu, &(a_bUnmapInfo), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for dword writeonly direct (or bounce) buffer acccess, flat
+ * address variant.
+ *
+ * @param[out] a_pu32Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_WO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_FLAT_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), UINT8_MAX, \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint32_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_FLAT_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) \
+    (a_pu32Mem) = iemMemFlatMapDataU32WoJmp(pVCpu, &(a_bUnmapInfo), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for dword readonly direct (or bounce) buffer acccess, flat
+ * address variant.
+ *
+ * @param[out] a_pu32Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_FLAT_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), UINT8_MAX, \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint32_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_FLAT_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) \
+    (a_pu32Mem) = iemMemFlatMapDataU32RoJmp(pVCpu, &(a_bUnmapInfo), (a_GCPtrMem))
+#endif
+
+
+/* 64-bit */
+
+/**
+ * Maps guest memory for qword read+write direct (or bounce) buffer acccess.
+ *
+ * @param[out] a_pu64Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_iSeg       The segment register to access via. No UINT8_MAX!
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RW
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), (a_iSeg), \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint64_t) - 1)); \
+        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    (a_pu64Mem) = iemMemMapDataU64RwJmp(pVCpu, &(a_bUnmapInfo), (a_iSeg), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for qword writeonly direct (or bounce) buffer acccess.
+ *
+ * @param[out] a_pu64Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_iSeg       The segment register to access via. No UINT8_MAX!
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_WO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), (a_iSeg), \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    (a_pu64Mem) = iemMemMapDataU64WoJmp(pVCpu, &(a_bUnmapInfo), (a_iSeg), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for qword readonly direct (or bounce) buffer acccess.
+ *
+ * @param[out] a_pu64Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_iSeg       The segment register to access via. No UINT8_MAX!
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), (a_iSeg), \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint64_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    (a_pu64Mem) = iemMemMapDataU64RoJmp(pVCpu, &(a_bUnmapInfo), (a_iSeg), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for qword read+write direct (or bounce) buffer acccess,
+ * flat address variant.
+ *
+ * @param[out] a_pu64Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RW
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_FLAT_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), UINT8_MAX, \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint64_t) - 1)); \
+        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_FLAT_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) \
+    (a_pu64Mem) = iemMemFlatMapDataU64RwJmp(pVCpu, &(a_bUnmapInfo), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for qword writeonly direct (or bounce) buffer acccess, flat
+ * address variant.
+ *
+ * @param[out] a_pu64Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_WO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_FLAT_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), UINT8_MAX, \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_FLAT_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) \
+    (a_pu64Mem) = iemMemFlatMapDataU64WoJmp(pVCpu, &(a_bUnmapInfo), (a_GCPtrMem))
+#endif
+
+/**
+ * Maps guest memory for qword readonly direct (or bounce) buffer acccess, flat
+ * address variant.
+ *
+ * @param[out] a_pu64Mem    Where to return the pointer to the mapping.
+ * @param[out] a_bUnmapInfo Where to return umapping instructions. uint8_t.
+ * @param[in]  a_GCPtrMem   The memory address.
+ * @remarks Will return/long jump on errors.
+ * @see     IEM_MC_MEM_COMMIT_AND_UNMAP_RO
+ */
+#ifndef IEM_WITH_SETJMP
+# define IEM_MC_MEM_FLAT_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) do { \
+        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), UINT8_MAX, \
+                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint64_t) - 1)); \
+        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
+    } while (0)
+#else
+# define IEM_MC_MEM_FLAT_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) \
+    (a_pu64Mem) = iemMemFlatMapDataU64RoJmp(pVCpu, &(a_bUnmapInfo), (a_GCPtrMem))
+#endif
+
+
+/* commit + unmap */
 
 /** Commits the memory and unmaps guest memory previously mapped RW.
Index: trunk/src/VBox/VMM/testcase/tstIEMAImpl.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstIEMAImpl.cpp	(revision 100830)
+++ trunk/src/VBox/VMM/testcase/tstIEMAImpl.cpp	(revision 100831)
@@ -1415,5 +1415,5 @@
     ENTRY(and_u8),
     ENTRY(and_u8_locked),
-    ENTRY_PFN_CAST(cmp_u8, PFNIEMAIMPLBINU8),
+    ENTRY_PFN_CAST(cmp_u8,  PFNIEMAIMPLBINU8),
     ENTRY_PFN_CAST(test_u8, PFNIEMAIMPLBINU8),
 };
@@ -1440,6 +1440,6 @@
     ENTRY(and_u16),
     ENTRY(and_u16_locked),
-    ENTRY(cmp_u16),
-    ENTRY(test_u16),
+    ENTRY_PFN_CAST(cmp_u16,  PFNIEMAIMPLBINU16),
+    ENTRY_PFN_CAST(test_u16, PFNIEMAIMPLBINU16),
     ENTRY_EX(bt_u16, 1),
     ENTRY_EX(btc_u16, 1),
@@ -1479,6 +1479,6 @@
     ENTRY(and_u32),
     ENTRY(and_u32_locked),
-    ENTRY(cmp_u32),
-    ENTRY(test_u32),
+    ENTRY_PFN_CAST(cmp_u32,  PFNIEMAIMPLBINU32),
+    ENTRY_PFN_CAST(test_u32, PFNIEMAIMPLBINU32),
     ENTRY_EX(bt_u32, 1),
     ENTRY_EX(btc_u32, 1),
@@ -1517,6 +1517,6 @@
     ENTRY(and_u64),
     ENTRY(and_u64_locked),
-    ENTRY(cmp_u64),
-    ENTRY(test_u64),
+    ENTRY_PFN_CAST(cmp_u64,  PFNIEMAIMPLBINU64),
+    ENTRY_PFN_CAST(test_u64, PFNIEMAIMPLBINU64),
     ENTRY_EX(bt_u64, 1),
     ENTRY_EX(btc_u64, 1),
