Index: trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h	(revision 100833)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h	(revision 100834)
@@ -5272,20 +5272,22 @@
         switch (pVCpu->iem.s.enmEffOpSize)
         {
-/** @todo the register must be committed separately! */
             case IEMMODE_16BIT:
-                IEM_MC_BEGIN(2, 2);
-                IEM_MC_ARG(uint16_t *,  pu16Mem, 0);
-                IEM_MC_ARG(uint16_t *,  pu16Reg, 1);
-                IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
+                IEM_MC_BEGIN(2, 4);
+                IEM_MC_LOCAL(RTGCPTR,  GCPtrEffDst);
+                IEM_MC_LOCAL(uint8_t,  bUnmapInfo);
+                IEM_MC_LOCAL(uint16_t, uTmpReg);
+                IEM_MC_ARG(uint16_t *,           pu16Mem,          0);
+                IEM_MC_ARG_LOCAL_REF(uint16_t *, pu16Reg, uTmpReg, 1);
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_MEM_MAP(pu16Mem, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_REF_GREG_U16(pu16Reg, IEM_GET_MODRM_REG(pVCpu, bRm));
+                IEM_MC_MEM_MAP_U16_RW(pu16Mem, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_GREG_U16(uTmpReg, IEM_GET_MODRM_REG(pVCpu, bRm));
                 if (!(pVCpu->iem.s.fExec & IEM_F_X86_DISREGARD_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u16_locked, pu16Mem, pu16Reg);
                 else
                     IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u16_unlocked, pu16Mem, pu16Reg);
-                IEM_MC_MEM_COMMIT_AND_UNMAP(pu16Mem, IEM_ACCESS_DATA_RW);
+                IEM_MC_MEM_COMMIT_AND_UNMAP_RW(pu16Mem, bUnmapInfo);
+                IEM_MC_STORE_GREG_U16(IEM_GET_MODRM_REG(pVCpu, bRm), uTmpReg);
 
                 IEM_MC_ADVANCE_RIP_AND_FINISH();
@@ -5294,18 +5296,21 @@
 
             case IEMMODE_32BIT:
-                IEM_MC_BEGIN(2, 2);
-                IEM_MC_ARG(uint32_t *,  pu32Mem, 0);
-                IEM_MC_ARG(uint32_t *,  pu32Reg, 1);
-                IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
+                IEM_MC_BEGIN(2, 4);
+                IEM_MC_LOCAL(RTGCPTR,  GCPtrEffDst);
+                IEM_MC_LOCAL(uint8_t,  bUnmapInfo);
+                IEM_MC_LOCAL(uint32_t, uTmpReg);
+                IEM_MC_ARG(uint32_t *,           pu32Mem,          0);
+                IEM_MC_ARG_LOCAL_REF(uint32_t *, pu32Reg, uTmpReg, 1);
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_MEM_MAP(pu32Mem, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_REF_GREG_U32(pu32Reg, IEM_GET_MODRM_REG(pVCpu, bRm));
+                IEM_MC_MEM_MAP_U32_RW(pu32Mem, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_GREG_U32(uTmpReg, IEM_GET_MODRM_REG(pVCpu, bRm));
                 if (!(pVCpu->iem.s.fExec & IEM_F_X86_DISREGARD_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u32_locked, pu32Mem, pu32Reg);
                 else
                     IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u32_unlocked, pu32Mem, pu32Reg);
-                IEM_MC_MEM_COMMIT_AND_UNMAP(pu32Mem, IEM_ACCESS_DATA_RW);
+                IEM_MC_MEM_COMMIT_AND_UNMAP_RW(pu32Mem, bUnmapInfo);
+                IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_REG(pVCpu, bRm), uTmpReg);
 
                 IEM_MC_CLEAR_HIGH_GREG_U64_BY_REF(pu32Reg);
@@ -5315,18 +5320,21 @@
 
             case IEMMODE_64BIT:
-                IEM_MC_BEGIN(2, 2);
-                IEM_MC_ARG(uint64_t *,  pu64Mem, 0);
-                IEM_MC_ARG(uint64_t *,  pu64Reg, 1);
-                IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst);
+                IEM_MC_BEGIN(2, 4);
+                IEM_MC_LOCAL(RTGCPTR,  GCPtrEffDst);
+                IEM_MC_LOCAL(uint8_t,  bUnmapInfo);
+                IEM_MC_LOCAL(uint64_t, uTmpReg);
+                IEM_MC_ARG(uint64_t *,           pu64Mem,          0);
+                IEM_MC_ARG_LOCAL_REF(uint64_t *, pu64Reg, uTmpReg, 1);
 
                 IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0);
                 IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX();
-                IEM_MC_MEM_MAP(pu64Mem, IEM_ACCESS_DATA_RW, pVCpu->iem.s.iEffSeg, GCPtrEffDst, 0 /*arg*/);
-                IEM_MC_REF_GREG_U64(pu64Reg, IEM_GET_MODRM_REG(pVCpu, bRm));
+                IEM_MC_MEM_MAP_U64_RW(pu64Mem, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst);
+                IEM_MC_FETCH_GREG_U64(uTmpReg, IEM_GET_MODRM_REG(pVCpu, bRm));
                 if (!(pVCpu->iem.s.fExec & IEM_F_X86_DISREGARD_LOCK))
                     IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u64_locked, pu64Mem, pu64Reg);
                 else
                     IEM_MC_CALL_VOID_AIMPL_2(iemAImpl_xchg_u64_unlocked, pu64Mem, pu64Reg);
-                IEM_MC_MEM_COMMIT_AND_UNMAP(pu64Mem, IEM_ACCESS_DATA_RW);
+                IEM_MC_MEM_COMMIT_AND_UNMAP_RW(pu64Mem, bUnmapInfo);
+                IEM_MC_STORE_GREG_U64(IEM_GET_MODRM_REG(pVCpu, bRm), uTmpReg);
 
                 IEM_MC_ADVANCE_RIP_AND_FINISH();
