Changeset 102430 in vbox

Timestamp:

Dec 2, 2023 2:39:20 AM (14 months ago)

Author:

vboxsync

Message:

VMM/IEM: Refactored iemMemMap and friends to work with bUnmapInfo / bMapInfo. bugref:10371

Location:

trunk/src/VBox/VMM

Files:

• VMMAll/IEMAll.cpp (modified) (103 diffs)
• VMMAll/IEMAllCImpl.cpp (modified) (83 diffs)
• VMMAll/IEMAllCImplStrInstr.cpp.h (modified) (4 diffs)
• VMMAll/IEMAllInstTwoByte0f.cpp.h (modified) (10 diffs)
• VMMAll/IEMAllMemRWTmpl.cpp.h (modified) (17 diffs)
• include/IEMInline.h (modified) (5 diffs)
• include/IEMInternal.h (modified) (4 diffs)
• include/IEMMc.h (modified) (39 diffs)

trunk/src/VBox/VMM/VMMAll/IEMAll.cpp

@@ -2106 +2106 @@
      * Push the stack frame.
      */
+    uint8_t   bUnmapInfo;
     uint16_t *pu16Frame;
     uint64_t  uNewRsp;
-    rcStrict = iemMemStackPushBeginSpecial(pVCpu, 6, 3, (void **)&pu16Frame, &uNewRsp);
+    rcStrict = iemMemStackPushBeginSpecial(pVCpu, 6, 3, (void **)&pu16Frame, &bUnmapInfo, &uNewRsp);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2121 +2122 @@
     pu16Frame[1] = (uint16_t)pVCpu->cpum.GstCtx.cs.Sel;
     pu16Frame[0] = (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT) ? pVCpu->cpum.GstCtx.ip + cbInstr : pVCpu->cpum.GstCtx.ip;
-    rcStrict = iemMemStackPushCommitSpecial(pVCpu, pu16Frame, uNewRsp);
+    rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfo, uNewRsp);
     if (RT_UNLIKELY(rcStrict != VINF_SUCCESS))
         return rcStrict;
@@ -2311 +2312 @@
  * @param   uErr            The error value if IEM_XCPT_FLAGS_ERR is set.
  * @param   uCr2            The CR2 value if IEM_XCPT_FLAGS_CR2 is set.
- * @param   SelTSS          The TSS selector of the new task.
- * @param   pNewDescTSS     Pointer to the new TSS descriptor.
+ * @param   SelTss          The TSS selector of the new task.
+ * @param   pNewDescTss     Pointer to the new TSS descriptor.
  */
 VBOXSTRICTRC
@@ -2321 +2322 @@
               uint16_t        uErr,
               uint64_t        uCr2,
-              RTSEL           SelTSS,
-              PIEMSELDESC     pNewDescTSS) RT_NOEXCEPT
+              RTSEL           SelTss,
+              PIEMSELDESC     pNewDescTss) RT_NOEXCEPT
 {
     Assert(!IEM_IS_REAL_MODE(pVCpu));
@@ -2328 +2329 @@
     IEM_CTX_ASSERT(pVCpu, IEM_CPUMCTX_EXTRN_XCPT_MASK);
 
-    uint32_t const uNewTSSType = pNewDescTSS->Legacy.Gate.u4Type;
-    Assert(   uNewTSSType == X86_SEL_TYPE_SYS_286_TSS_AVAIL
-           || uNewTSSType == X86_SEL_TYPE_SYS_286_TSS_BUSY
-           || uNewTSSType == X86_SEL_TYPE_SYS_386_TSS_AVAIL
-           || uNewTSSType == X86_SEL_TYPE_SYS_386_TSS_BUSY);
-
-    bool const fIsNewTSS386 = (   uNewTSSType == X86_SEL_TYPE_SYS_386_TSS_AVAIL
-                               || uNewTSSType == X86_SEL_TYPE_SYS_386_TSS_BUSY);
-
-    Log(("iemTaskSwitch: enmTaskSwitch=%u NewTSS=%#x fIsNewTSS386=%RTbool EIP=%#RX32 uNextEip=%#RX32\n", enmTaskSwitch, SelTSS,
-         fIsNewTSS386, pVCpu->cpum.GstCtx.eip, uNextEip));
+    uint32_t const uNewTssType = pNewDescTss->Legacy.Gate.u4Type;
+    Assert(   uNewTssType == X86_SEL_TYPE_SYS_286_TSS_AVAIL
+           || uNewTssType == X86_SEL_TYPE_SYS_286_TSS_BUSY
+           || uNewTssType == X86_SEL_TYPE_SYS_386_TSS_AVAIL
+           || uNewTssType == X86_SEL_TYPE_SYS_386_TSS_BUSY);
+
+    bool const fIsNewTss386 = (   uNewTssType == X86_SEL_TYPE_SYS_386_TSS_AVAIL
+                               || uNewTssType == X86_SEL_TYPE_SYS_386_TSS_BUSY);
+
+    Log(("iemTaskSwitch: enmTaskSwitch=%u NewTss=%#x fIsNewTss386=%RTbool EIP=%#RX32 uNextEip=%#RX32\n", enmTaskSwitch, SelTss,
+         fIsNewTss386, pVCpu->cpum.GstCtx.eip, uNextEip));
 
     /* Update CR2 in case it's a page-fault. */
@@ -2350 +2351 @@
      * subsection "Interrupt 10 - Invalid TSS Exception (#TS)".
      */
-    uint32_t const uNewTSSLimit    = pNewDescTSS->Legacy.Gen.u16LimitLow | (pNewDescTSS->Legacy.Gen.u4LimitHigh << 16);
-    uint32_t const uNewTSSLimitMin = fIsNewTSS386 ? X86_SEL_TYPE_SYS_386_TSS_LIMIT_MIN : X86_SEL_TYPE_SYS_286_TSS_LIMIT_MIN;
-    if (uNewTSSLimit < uNewTSSLimitMin)
-    {
-        Log(("iemTaskSwitch: Invalid new TSS limit. enmTaskSwitch=%u uNewTSSLimit=%#x uNewTSSLimitMin=%#x -> #TS\n",
-             enmTaskSwitch, uNewTSSLimit, uNewTSSLimitMin));
-        return iemRaiseTaskSwitchFaultWithErr(pVCpu, SelTSS & X86_SEL_MASK_OFF_RPL);
+    uint32_t const uNewTssLimit    = pNewDescTss->Legacy.Gen.u16LimitLow | (pNewDescTss->Legacy.Gen.u4LimitHigh << 16);
+    uint32_t const uNewTssLimitMin = fIsNewTss386 ? X86_SEL_TYPE_SYS_386_TSS_LIMIT_MIN : X86_SEL_TYPE_SYS_286_TSS_LIMIT_MIN;
+    if (uNewTssLimit < uNewTssLimitMin)
+    {
+        Log(("iemTaskSwitch: Invalid new TSS limit. enmTaskSwitch=%u uNewTssLimit=%#x uNewTssLimitMin=%#x -> #TS\n",
+             enmTaskSwitch, uNewTssLimit, uNewTssLimitMin));
+        return iemRaiseTaskSwitchFaultWithErr(pVCpu, SelTss & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -2368 +2369 @@
     if (IEM_VMX_IS_NON_ROOT_MODE(pVCpu))
     {
-        Log(("iemTaskSwitch: Guest intercept (source=%u, sel=%#x) -> VM-exit.\n", enmTaskSwitch, SelTSS));
-        IEM_VMX_VMEXIT_TASK_SWITCH_RET(pVCpu, enmTaskSwitch, SelTSS, uNextEip - pVCpu->cpum.GstCtx.eip);
+        Log(("iemTaskSwitch: Guest intercept (source=%u, sel=%#x) -> VM-exit.\n", enmTaskSwitch, SelTss));
+        IEM_VMX_VMEXIT_TASK_SWITCH_RET(pVCpu, enmTaskSwitch, SelTss, uNextEip - pVCpu->cpum.GstCtx.eip);
     }
 
@@ -2378 +2379 @@
     if (IEM_SVM_IS_CTRL_INTERCEPT_SET(pVCpu, SVM_CTRL_INTERCEPT_TASK_SWITCH))
     {
-        uint32_t const uExitInfo1 = SelTSS;
+        uint32_t const uExitInfo1 = SelTss;
         uint32_t       uExitInfo2 = uErr;
         switch (enmTaskSwitch)
@@ -2404 +2405 @@
      * end up with smaller than "legal" TSS limits.
      */
-    uint32_t const uCurTSSLimit    = pVCpu->cpum.GstCtx.tr.u32Limit;
-    uint32_t const uCurTSSLimitMin = fIsNewTSS386 ? 0x5F : 0x29;
-    if (uCurTSSLimit < uCurTSSLimitMin)
-    {
-        Log(("iemTaskSwitch: Invalid current TSS limit. enmTaskSwitch=%u uCurTSSLimit=%#x uCurTSSLimitMin=%#x -> #TS\n",
-             enmTaskSwitch, uCurTSSLimit, uCurTSSLimitMin));
-        return iemRaiseTaskSwitchFaultWithErr(pVCpu, SelTSS & X86_SEL_MASK_OFF_RPL);
+    uint32_t const uCurTssLimit    = pVCpu->cpum.GstCtx.tr.u32Limit;
+    uint32_t const uCurTssLimitMin = fIsNewTss386 ? 0x5F : 0x29;
+    if (uCurTssLimit < uCurTssLimitMin)
+    {
+        Log(("iemTaskSwitch: Invalid current TSS limit. enmTaskSwitch=%u uCurTssLimit=%#x uCurTssLimitMin=%#x -> #TS\n",
+             enmTaskSwitch, uCurTssLimit, uCurTssLimitMin));
+        return iemRaiseTaskSwitchFaultWithErr(pVCpu, SelTss & X86_SEL_MASK_OFF_RPL);
     }
 
@@ -2417 +2418 @@
      * and not the entire TSS.
      */
-    void           *pvNewTSS;
-    uint32_t  const cbNewTSS    = uNewTSSLimitMin + 1;
-    RTGCPTR   const GCPtrNewTSS = X86DESC_BASE(&pNewDescTSS->Legacy);
+    uint8_t         bUnmapInfoNewTss;
+    void           *pvNewTss;
+    uint32_t  const cbNewTss    = uNewTssLimitMin + 1;
+    RTGCPTR   const GCPtrNewTss = X86DESC_BASE(&pNewDescTss->Legacy);
     AssertCompile(sizeof(X86TSS32) == X86_SEL_TYPE_SYS_386_TSS_LIMIT_MIN + 1);
     /** @todo Handle if the TSS crosses a page boundary. Intel specifies that it may
      *        not perform correct translation if this happens. See Intel spec. 7.2.1
      *        "Task-State Segment". */
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvNewTSS, cbNewTSS, UINT8_MAX, GCPtrNewTSS, IEM_ACCESS_SYS_RW, 0);
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvNewTss, &bUnmapInfoNewTss, cbNewTss, UINT8_MAX, GCPtrNewTss, IEM_ACCESS_SYS_RW, 0);
+/** @todo Not cleaning up bUnmapInfoNewTss mapping in any early exits here.
+ * Consider wrapping the remainder into a function for simpler cleanup. */
     if (rcStrict != VINF_SUCCESS)
     {
-        Log(("iemTaskSwitch: Failed to read new TSS. enmTaskSwitch=%u cbNewTSS=%u uNewTSSLimit=%u rc=%Rrc\n", enmTaskSwitch,
-             cbNewTSS, uNewTSSLimit, VBOXSTRICTRC_VAL(rcStrict)));
+        Log(("iemTaskSwitch: Failed to read new TSS. enmTaskSwitch=%u cbNewTss=%u uNewTssLimit=%u rc=%Rrc\n", enmTaskSwitch,
+             cbNewTss, uNewTssLimit, VBOXSTRICTRC_VAL(rcStrict)));
         return rcStrict;
     }
@@ -2439 +2443 @@
         || enmTaskSwitch == IEMTASKSWITCH_IRET)
     {
-        PX86DESC pDescCurTSS;
-        rcStrict = iemMemMap(pVCpu, (void **)&pDescCurTSS, sizeof(*pDescCurTSS), UINT8_MAX,
+        uint8_t  bUnmapInfoDescCurTss;
+        PX86DESC pDescCurTss;
+        rcStrict = iemMemMap(pVCpu, (void **)&pDescCurTss, &bUnmapInfoDescCurTss, sizeof(*pDescCurTss), UINT8_MAX,
                              pVCpu->cpum.GstCtx.gdtr.pGdt + (pVCpu->cpum.GstCtx.tr.Sel & X86_SEL_MASK), IEM_ACCESS_SYS_RW, 0);
         if (rcStrict != VINF_SUCCESS)
@@ -2449 +2454 @@
         }
 
-        pDescCurTSS->Gate.u4Type &= ~X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
-        rcStrict = iemMemCommitAndUnmap(pVCpu, pDescCurTSS, IEM_ACCESS_SYS_RW);
+        pDescCurTss->Gate.u4Type &= ~X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
+        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoDescCurTss);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -2461 +2466 @@
         if (enmTaskSwitch == IEMTASKSWITCH_IRET)
         {
-            Assert(   uNewTSSType == X86_SEL_TYPE_SYS_286_TSS_BUSY
-                   || uNewTSSType == X86_SEL_TYPE_SYS_386_TSS_BUSY);
+            Assert(   uNewTssType == X86_SEL_TYPE_SYS_286_TSS_BUSY
+                   || uNewTssType == X86_SEL_TYPE_SYS_386_TSS_BUSY);
             fEFlags &= ~X86_EFL_NT;
         }
@@ -2470 +2475 @@
      * Save the CPU state into the current TSS.
      */
-    RTGCPTR const GCPtrCurTSS = pVCpu->cpum.GstCtx.tr.u64Base;
-    if (GCPtrNewTSS == GCPtrCurTSS)
-    {
-        Log(("iemTaskSwitch: Switching to the same TSS! enmTaskSwitch=%u GCPtr[Cur|New]TSS=%#RGv\n", enmTaskSwitch, GCPtrCurTSS));
+    RTGCPTR const GCPtrCurTss = pVCpu->cpum.GstCtx.tr.u64Base;
+    if (GCPtrNewTss == GCPtrCurTss)
+    {
+        Log(("iemTaskSwitch: Switching to the same TSS! enmTaskSwitch=%u GCPtr[Cur|New]TSS=%#RGv\n", enmTaskSwitch, GCPtrCurTss));
         Log(("uCurCr3=%#x uCurEip=%#x uCurEflags=%#x uCurEax=%#x uCurEsp=%#x uCurEbp=%#x uCurCS=%#04x uCurSS=%#04x uCurLdt=%#x\n",
              pVCpu->cpum.GstCtx.cr3, pVCpu->cpum.GstCtx.eip, pVCpu->cpum.GstCtx.eflags.u, pVCpu->cpum.GstCtx.eax,
@@ -2479 +2484 @@
              pVCpu->cpum.GstCtx.ldtr.Sel));
     }
-    if (fIsNewTSS386)
+    if (fIsNewTss386)
     {
         /*
@@ -2485 +2490 @@
          * See Intel spec. 7.2.1 "Task-State Segment (TSS)" for static and dynamic fields.
          */
-        void          *pvCurTSS32;
-        uint32_t const offCurTSS = RT_UOFFSETOF(X86TSS32, eip);
-        uint32_t const cbCurTSS  = RT_UOFFSETOF(X86TSS32, selLdt) - RT_UOFFSETOF(X86TSS32, eip);
+        uint8_t        bUnmapInfoCurTss32;
+        void          *pvCurTss32;
+        uint32_t const offCurTss = RT_UOFFSETOF(X86TSS32, eip);
+        uint32_t const cbCurTss  = RT_UOFFSETOF(X86TSS32, selLdt) - RT_UOFFSETOF(X86TSS32, eip);
         AssertCompile(RTASSERT_OFFSET_OF(X86TSS32, selLdt) - RTASSERT_OFFSET_OF(X86TSS32, eip) == 64);
-        rcStrict = iemMemMap(pVCpu, &pvCurTSS32, cbCurTSS, UINT8_MAX, GCPtrCurTSS + offCurTSS, IEM_ACCESS_SYS_RW, 0);
+        rcStrict = iemMemMap(pVCpu, &pvCurTss32, &bUnmapInfoCurTss32, cbCurTss, UINT8_MAX,
+                             GCPtrCurTss + offCurTss, IEM_ACCESS_SYS_RW, 0);
         if (rcStrict != VINF_SUCCESS)
         {
-            Log(("iemTaskSwitch: Failed to read current 32-bit TSS. enmTaskSwitch=%u GCPtrCurTSS=%#RGv cb=%u rc=%Rrc\n",
-                 enmTaskSwitch, GCPtrCurTSS, cbCurTSS, VBOXSTRICTRC_VAL(rcStrict)));
+            Log(("iemTaskSwitch: Failed to read current 32-bit TSS. enmTaskSwitch=%u GCPtrCurTss=%#RGv cb=%u rc=%Rrc\n",
+                 enmTaskSwitch, GCPtrCurTss, cbCurTss, VBOXSTRICTRC_VAL(rcStrict)));
             return rcStrict;
         }
 
-        /* !! WARNING !! Access -only- the members (dynamic fields) that are mapped, i.e interval [offCurTSS..cbCurTSS). */
-        PX86TSS32 pCurTSS32 = (PX86TSS32)((uintptr_t)pvCurTSS32 - offCurTSS);
-        pCurTSS32->eip    = uNextEip;
-        pCurTSS32->eflags = fEFlags;
-        pCurTSS32->eax    = pVCpu->cpum.GstCtx.eax;
-        pCurTSS32->ecx    = pVCpu->cpum.GstCtx.ecx;
-        pCurTSS32->edx    = pVCpu->cpum.GstCtx.edx;
-        pCurTSS32->ebx    = pVCpu->cpum.GstCtx.ebx;
-        pCurTSS32->esp    = pVCpu->cpum.GstCtx.esp;
-        pCurTSS32->ebp    = pVCpu->cpum.GstCtx.ebp;
-        pCurTSS32->esi    = pVCpu->cpum.GstCtx.esi;
-        pCurTSS32->edi    = pVCpu->cpum.GstCtx.edi;
-        pCurTSS32->es     = pVCpu->cpum.GstCtx.es.Sel;
-        pCurTSS32->cs     = pVCpu->cpum.GstCtx.cs.Sel;
-        pCurTSS32->ss     = pVCpu->cpum.GstCtx.ss.Sel;
-        pCurTSS32->ds     = pVCpu->cpum.GstCtx.ds.Sel;
-        pCurTSS32->fs     = pVCpu->cpum.GstCtx.fs.Sel;
-        pCurTSS32->gs     = pVCpu->cpum.GstCtx.gs.Sel;
-
-        rcStrict = iemMemCommitAndUnmap(pVCpu, pvCurTSS32, IEM_ACCESS_SYS_RW);
+        /* !! WARNING !! Access -only- the members (dynamic fields) that are mapped, i.e interval [offCurTss..cbCurTss). */
+        PX86TSS32 pCurTss32 = (PX86TSS32)((uintptr_t)pvCurTss32 - offCurTss);
+        pCurTss32->eip    = uNextEip;
+        pCurTss32->eflags = fEFlags;
+        pCurTss32->eax    = pVCpu->cpum.GstCtx.eax;
+        pCurTss32->ecx    = pVCpu->cpum.GstCtx.ecx;
+        pCurTss32->edx    = pVCpu->cpum.GstCtx.edx;
+        pCurTss32->ebx    = pVCpu->cpum.GstCtx.ebx;
+        pCurTss32->esp    = pVCpu->cpum.GstCtx.esp;
+        pCurTss32->ebp    = pVCpu->cpum.GstCtx.ebp;
+        pCurTss32->esi    = pVCpu->cpum.GstCtx.esi;
+        pCurTss32->edi    = pVCpu->cpum.GstCtx.edi;
+        pCurTss32->es     = pVCpu->cpum.GstCtx.es.Sel;
+        pCurTss32->cs     = pVCpu->cpum.GstCtx.cs.Sel;
+        pCurTss32->ss     = pVCpu->cpum.GstCtx.ss.Sel;
+        pCurTss32->ds     = pVCpu->cpum.GstCtx.ds.Sel;
+        pCurTss32->fs     = pVCpu->cpum.GstCtx.fs.Sel;
+        pCurTss32->gs     = pVCpu->cpum.GstCtx.gs.Sel;
+
+        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoCurTss32);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -2529 +2536 @@
          * Verify that the current TSS (16-bit) can be accessed. Again, only the minimum required size.
          */
-        void          *pvCurTSS16;
-        uint32_t const offCurTSS = RT_UOFFSETOF(X86TSS16, ip);
-        uint32_t const cbCurTSS  = RT_UOFFSETOF(X86TSS16, selLdt) - RT_UOFFSETOF(X86TSS16, ip);
+        uint8_t        bUnmapInfoCurTss16;
+        void          *pvCurTss16;
+        uint32_t const offCurTss = RT_UOFFSETOF(X86TSS16, ip);
+        uint32_t const cbCurTss  = RT_UOFFSETOF(X86TSS16, selLdt) - RT_UOFFSETOF(X86TSS16, ip);
         AssertCompile(RTASSERT_OFFSET_OF(X86TSS16, selLdt) - RTASSERT_OFFSET_OF(X86TSS16, ip) == 28);
-        rcStrict = iemMemMap(pVCpu, &pvCurTSS16, cbCurTSS, UINT8_MAX, GCPtrCurTSS + offCurTSS, IEM_ACCESS_SYS_RW, 0);
+        rcStrict = iemMemMap(pVCpu, &pvCurTss16, &bUnmapInfoCurTss16, cbCurTss, UINT8_MAX,
+                             GCPtrCurTss + offCurTss, IEM_ACCESS_SYS_RW, 0);
         if (rcStrict != VINF_SUCCESS)
         {
-            Log(("iemTaskSwitch: Failed to read current 16-bit TSS. enmTaskSwitch=%u GCPtrCurTSS=%#RGv cb=%u rc=%Rrc\n",
-                 enmTaskSwitch, GCPtrCurTSS, cbCurTSS, VBOXSTRICTRC_VAL(rcStrict)));
+            Log(("iemTaskSwitch: Failed to read current 16-bit TSS. enmTaskSwitch=%u GCPtrCurTss=%#RGv cb=%u rc=%Rrc\n",
+                 enmTaskSwitch, GCPtrCurTss, cbCurTss, VBOXSTRICTRC_VAL(rcStrict)));
             return rcStrict;
         }
 
-        /* !! WARNING !! Access -only- the members (dynamic fields) that are mapped, i.e interval [offCurTSS..cbCurTSS). */
-        PX86TSS16 pCurTSS16 = (PX86TSS16)((uintptr_t)pvCurTSS16 - offCurTSS);
-        pCurTSS16->ip    = uNextEip;
-        pCurTSS16->flags = (uint16_t)fEFlags;
-        pCurTSS16->ax    = pVCpu->cpum.GstCtx.ax;
-        pCurTSS16->cx    = pVCpu->cpum.GstCtx.cx;
-        pCurTSS16->dx    = pVCpu->cpum.GstCtx.dx;
-        pCurTSS16->bx    = pVCpu->cpum.GstCtx.bx;
-        pCurTSS16->sp    = pVCpu->cpum.GstCtx.sp;
-        pCurTSS16->bp    = pVCpu->cpum.GstCtx.bp;
-        pCurTSS16->si    = pVCpu->cpum.GstCtx.si;
-        pCurTSS16->di    = pVCpu->cpum.GstCtx.di;
-        pCurTSS16->es    = pVCpu->cpum.GstCtx.es.Sel;
-        pCurTSS16->cs    = pVCpu->cpum.GstCtx.cs.Sel;
-        pCurTSS16->ss    = pVCpu->cpum.GstCtx.ss.Sel;
-        pCurTSS16->ds    = pVCpu->cpum.GstCtx.ds.Sel;
-
-        rcStrict = iemMemCommitAndUnmap(pVCpu, pvCurTSS16, IEM_ACCESS_SYS_RW);
+        /* !! WARNING !! Access -only- the members (dynamic fields) that are mapped, i.e interval [offCurTss..cbCurTss). */
+        PX86TSS16 pCurTss16 = (PX86TSS16)((uintptr_t)pvCurTss16 - offCurTss);
+        pCurTss16->ip    = uNextEip;
+        pCurTss16->flags = (uint16_t)fEFlags;
+        pCurTss16->ax    = pVCpu->cpum.GstCtx.ax;
+        pCurTss16->cx    = pVCpu->cpum.GstCtx.cx;
+        pCurTss16->dx    = pVCpu->cpum.GstCtx.dx;
+        pCurTss16->bx    = pVCpu->cpum.GstCtx.bx;
+        pCurTss16->sp    = pVCpu->cpum.GstCtx.sp;
+        pCurTss16->bp    = pVCpu->cpum.GstCtx.bp;
+        pCurTss16->si    = pVCpu->cpum.GstCtx.si;
+        pCurTss16->di    = pVCpu->cpum.GstCtx.di;
+        pCurTss16->es    = pVCpu->cpum.GstCtx.es.Sel;
+        pCurTss16->cs    = pVCpu->cpum.GstCtx.cs.Sel;
+        pCurTss16->ss    = pVCpu->cpum.GstCtx.ss.Sel;
+        pCurTss16->ds    = pVCpu->cpum.GstCtx.ds.Sel;
+
+        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoCurTss16);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -2574 +2583 @@
     {
         /* 16 or 32-bit TSS doesn't matter, we only access the first, common 16-bit field (selPrev) here. */
-        PX86TSS32 pNewTSS = (PX86TSS32)pvNewTSS;
+        PX86TSS32 pNewTSS = (PX86TSS32)pvNewTss;
         pNewTSS->selPrev  = pVCpu->cpum.GstCtx.tr.Sel;
     }
@@ -2585 +2594 @@
     uint16_t uNewES,  uNewCS, uNewSS, uNewDS, uNewFS, uNewGS, uNewLdt;
     bool     fNewDebugTrap;
-    if (fIsNewTSS386)
-    {
-        PCX86TSS32 pNewTSS32 = (PCX86TSS32)pvNewTSS;
-        uNewCr3       = (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG) ? pNewTSS32->cr3 : 0;
-        uNewEip       = pNewTSS32->eip;
-        uNewEflags    = pNewTSS32->eflags;
-        uNewEax       = pNewTSS32->eax;
-        uNewEcx       = pNewTSS32->ecx;
-        uNewEdx       = pNewTSS32->edx;
-        uNewEbx       = pNewTSS32->ebx;
-        uNewEsp       = pNewTSS32->esp;
-        uNewEbp       = pNewTSS32->ebp;
-        uNewEsi       = pNewTSS32->esi;
-        uNewEdi       = pNewTSS32->edi;
-        uNewES        = pNewTSS32->es;
-        uNewCS        = pNewTSS32->cs;
-        uNewSS        = pNewTSS32->ss;
-        uNewDS        = pNewTSS32->ds;
-        uNewFS        = pNewTSS32->fs;
-        uNewGS        = pNewTSS32->gs;
-        uNewLdt       = pNewTSS32->selLdt;
-        fNewDebugTrap = RT_BOOL(pNewTSS32->fDebugTrap);
+    if (fIsNewTss386)
+    {
+        PCX86TSS32 pNewTss32 = (PCX86TSS32)pvNewTss;
+        uNewCr3       = (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG) ? pNewTss32->cr3 : 0;
+        uNewEip       = pNewTss32->eip;
+        uNewEflags    = pNewTss32->eflags;
+        uNewEax       = pNewTss32->eax;
+        uNewEcx       = pNewTss32->ecx;
+        uNewEdx       = pNewTss32->edx;
+        uNewEbx       = pNewTss32->ebx;
+        uNewEsp       = pNewTss32->esp;
+        uNewEbp       = pNewTss32->ebp;
+        uNewEsi       = pNewTss32->esi;
+        uNewEdi       = pNewTss32->edi;
+        uNewES        = pNewTss32->es;
+        uNewCS        = pNewTss32->cs;
+        uNewSS        = pNewTss32->ss;
+        uNewDS        = pNewTss32->ds;
+        uNewFS        = pNewTss32->fs;
+        uNewGS        = pNewTss32->gs;
+        uNewLdt       = pNewTss32->selLdt;
+        fNewDebugTrap = RT_BOOL(pNewTss32->fDebugTrap);
     }
     else
     {
-        PCX86TSS16 pNewTSS16 = (PCX86TSS16)pvNewTSS;
+        PCX86TSS16 pNewTss16 = (PCX86TSS16)pvNewTss;
         uNewCr3       = 0;
-        uNewEip       = pNewTSS16->ip;
-        uNewEflags    = pNewTSS16->flags;
-        uNewEax       = UINT32_C(0xffff0000) | pNewTSS16->ax;
-        uNewEcx       = UINT32_C(0xffff0000) | pNewTSS16->cx;
-        uNewEdx       = UINT32_C(0xffff0000) | pNewTSS16->dx;
-        uNewEbx       = UINT32_C(0xffff0000) | pNewTSS16->bx;
-        uNewEsp       = UINT32_C(0xffff0000) | pNewTSS16->sp;
-        uNewEbp       = UINT32_C(0xffff0000) | pNewTSS16->bp;
-        uNewEsi       = UINT32_C(0xffff0000) | pNewTSS16->si;
-        uNewEdi       = UINT32_C(0xffff0000) | pNewTSS16->di;
-        uNewES        = pNewTSS16->es;
-        uNewCS        = pNewTSS16->cs;
-        uNewSS        = pNewTSS16->ss;
-        uNewDS        = pNewTSS16->ds;
+        uNewEip       = pNewTss16->ip;
+        uNewEflags    = pNewTss16->flags;
+        uNewEax       = UINT32_C(0xffff0000) | pNewTss16->ax;
+        uNewEcx       = UINT32_C(0xffff0000) | pNewTss16->cx;
+        uNewEdx       = UINT32_C(0xffff0000) | pNewTss16->dx;
+        uNewEbx       = UINT32_C(0xffff0000) | pNewTss16->bx;
+        uNewEsp       = UINT32_C(0xffff0000) | pNewTss16->sp;
+        uNewEbp       = UINT32_C(0xffff0000) | pNewTss16->bp;
+        uNewEsi       = UINT32_C(0xffff0000) | pNewTss16->si;
+        uNewEdi       = UINT32_C(0xffff0000) | pNewTss16->di;
+        uNewES        = pNewTss16->es;
+        uNewCS        = pNewTss16->cs;
+        uNewSS        = pNewTss16->ss;
+        uNewDS        = pNewTss16->ds;
         uNewFS        = 0;
         uNewGS        = 0;
-        uNewLdt       = pNewTSS16->selLdt;
+        uNewLdt       = pNewTss16->selLdt;
         fNewDebugTrap = false;
     }
 
-    if (GCPtrNewTSS == GCPtrCurTSS)
+    if (GCPtrNewTss == GCPtrCurTss)
         Log(("uNewCr3=%#x uNewEip=%#x uNewEflags=%#x uNewEax=%#x uNewEsp=%#x uNewEbp=%#x uNewCS=%#04x uNewSS=%#04x uNewLdt=%#x\n",
              uNewCr3, uNewEip, uNewEflags, uNewEax, uNewEsp, uNewEbp, uNewCS, uNewSS, uNewLdt));
@@ -2639 +2648 @@
      * We're done accessing the new TSS.
      */
-    rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewTSS, IEM_ACCESS_SYS_RW);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoNewTss);
     if (rcStrict != VINF_SUCCESS)
     {
@@ -2651 +2660 @@
     if (enmTaskSwitch != IEMTASKSWITCH_IRET)
     {
-        rcStrict = iemMemMap(pVCpu, (void **)&pNewDescTSS, sizeof(*pNewDescTSS), UINT8_MAX,
-                             pVCpu->cpum.GstCtx.gdtr.pGdt + (SelTSS & X86_SEL_MASK), IEM_ACCESS_SYS_RW, 0);
+        rcStrict = iemMemMap(pVCpu, (void **)&pNewDescTss, &bUnmapInfoNewTss, sizeof(*pNewDescTss), UINT8_MAX,
+                             pVCpu->cpum.GstCtx.gdtr.pGdt + (SelTss & X86_SEL_MASK), IEM_ACCESS_SYS_RW, 0);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -2661 +2670 @@
 
         /* Check that the descriptor indicates the new TSS is available (not busy). */
-        AssertMsg(   pNewDescTSS->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
-                  || pNewDescTSS->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL,
-                     ("Invalid TSS descriptor type=%#x", pNewDescTSS->Legacy.Gate.u4Type));
-
-        pNewDescTSS->Legacy.Gate.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
-        rcStrict = iemMemCommitAndUnmap(pVCpu, pNewDescTSS, IEM_ACCESS_SYS_RW);
+        AssertMsg(   pNewDescTss->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_286_TSS_AVAIL
+                  || pNewDescTss->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_TSS_AVAIL,
+                  ("Invalid TSS descriptor type=%#x", pNewDescTss->Legacy.Gate.u4Type));
+
+        pNewDescTss->Legacy.Gate.u4Type |= X86_SEL_TYPE_SYS_TSS_BUSY_MASK;
+        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoNewTss);
         if (rcStrict != VINF_SUCCESS)
         {
@@ -2679 +2688 @@
      * until the completion of the task switch but before executing any instructions in the new task.
      */
-    pVCpu->cpum.GstCtx.tr.Sel      = SelTSS;
-    pVCpu->cpum.GstCtx.tr.ValidSel = SelTSS;
+    pVCpu->cpum.GstCtx.tr.Sel      = SelTss;
+    pVCpu->cpum.GstCtx.tr.ValidSel = SelTss;
     pVCpu->cpum.GstCtx.tr.fFlags   = CPUMSELREG_FLAGS_VALID;
-    pVCpu->cpum.GstCtx.tr.Attr.u   = X86DESC_GET_HID_ATTR(&pNewDescTSS->Legacy);
-    pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&pNewDescTSS->Legacy);
-    pVCpu->cpum.GstCtx.tr.u64Base  = X86DESC_BASE(&pNewDescTSS->Legacy);
+    pVCpu->cpum.GstCtx.tr.Attr.u   = X86DESC_GET_HID_ATTR(&pNewDescTss->Legacy);
+    pVCpu->cpum.GstCtx.tr.u32Limit = X86DESC_LIMIT_G(&pNewDescTss->Legacy);
+    pVCpu->cpum.GstCtx.tr.u64Base  = X86DESC_BASE(&pNewDescTss->Legacy);
     CPUMSetChangedFlags(pVCpu, CPUM_CHANGED_TR);
 
@@ -2758 +2767 @@
      * Switch CR3 for the new task.
      */
-    if (   fIsNewTSS386
+    if (   fIsNewTss386
         && (pVCpu->cpum.GstCtx.cr0 & X86_CR0_PG))
     {
@@ -3000 +3009 @@
 
     /** @todo Debug trap. */
-    if (fIsNewTSS386 && fNewDebugTrap)
+    if (fIsNewTss386 && fNewDebugTrap)
         Log(("iemTaskSwitch: Debug Trap set in new TSS. Not implemented!\n"));
 
@@ -3022 +3031 @@
         Assert(enmTaskSwitch == IEMTASKSWITCH_INT_XCPT);
         uint32_t      cbLimitSS    = X86DESC_LIMIT_G(&DescSS.Legacy);
-        uint8_t const cbStackFrame = fIsNewTSS386 ? 4 : 2;
+        uint8_t const cbStackFrame = fIsNewTss386 ? 4 : 2;
 
         /* Check that there is sufficient space on the stack. */
@@ -3050 +3059 @@
 
 
-        if (fIsNewTSS386)
+        if (fIsNewTss386)
             rcStrict = iemMemStackPushU32(pVCpu, uErr);
         else
@@ -3057 +3066 @@
         {
             Log(("iemTaskSwitch: Can't push error code to new task's stack. %s-bit TSS. rc=%Rrc\n",
-                 fIsNewTSS386 ? "32" : "16", VBOXSTRICTRC_VAL(rcStrict)));
+                 fIsNewTss386 ? "32" : "16", VBOXSTRICTRC_VAL(rcStrict)));
             return rcStrict;
         }
@@ -3201 +3210 @@
                                    && !(fFlags & IEM_XCPT_FLAGS_ICEBP_INSTR)) ? 0 : 1;
         uint16_t const uSelMask = X86_SEL_MASK_OFF_RPL;
-        RTSEL          SelTSS   = Idte.Gate.u16Sel;
+        RTSEL          SelTss   = Idte.Gate.u16Sel;
 
         /*
@@ -3207 +3216 @@
          */
         IEMSELDESC DescTSS;
-        rcStrict = iemMemFetchSelDescWithErr(pVCpu, &DescTSS, SelTSS, X86_XCPT_GP, (SelTSS & uSelMask) | uExt);
+        rcStrict = iemMemFetchSelDescWithErr(pVCpu, &DescTSS, SelTss, X86_XCPT_GP, (SelTss & uSelMask) | uExt);
         if (rcStrict != VINF_SUCCESS)
         {
-            Log(("RaiseXcptOrIntInProtMode %#x - failed to fetch TSS selector %#x, rc=%Rrc\n", u8Vector, SelTSS,
+            Log(("RaiseXcptOrIntInProtMode %#x - failed to fetch TSS selector %#x, rc=%Rrc\n", u8Vector, SelTss,
                  VBOXSTRICTRC_VAL(rcStrict)));
             return rcStrict;
@@ -3221 +3230 @@
         {
             Log(("RaiseXcptOrIntInProtMode %#x - TSS selector %#x of task gate not a system descriptor or not available %#RX64\n",
-                 u8Vector, SelTSS, DescTSS.Legacy.au64));
-            return iemRaiseGeneralProtectionFault(pVCpu, (SelTSS & uSelMask) | uExt);
+                 u8Vector, SelTss, DescTSS.Legacy.au64));
+            return iemRaiseGeneralProtectionFault(pVCpu, (SelTss & uSelMask) | uExt);
         }
 
@@ -3228 +3237 @@
         if (!DescTSS.Legacy.Gen.u1Present)
         {
-            Log(("RaiseXcptOrIntInProtMode %#x - TSS selector %#x not present %#RX64\n", u8Vector, SelTSS, DescTSS.Legacy.au64));
-            return iemRaiseSelectorNotPresentWithErr(pVCpu, (SelTSS & uSelMask) | uExt);
+            Log(("RaiseXcptOrIntInProtMode %#x - TSS selector %#x not present %#RX64\n", u8Vector, SelTss, DescTSS.Legacy.au64));
+            return iemRaiseSelectorNotPresentWithErr(pVCpu, (SelTss & uSelMask) | uExt);
         }
 
@@ -3235 +3244 @@
         return iemTaskSwitch(pVCpu, IEMTASKSWITCH_INT_XCPT,
                              (fFlags & IEM_XCPT_FLAGS_T_SOFT_INT) ? pVCpu->cpum.GstCtx.eip + cbInstr : pVCpu->cpum.GstCtx.eip,
-                             fFlags, uErr, uCr2, SelTSS, &DescTSS);
+                             fFlags, uErr, uCr2, SelTss, &DescTSS);
     }
 
@@ -3384 +3393 @@
 
         /* Create the stack frame. */
+        uint8_t    bUnmapInfoStackFrame;
         RTPTRUNION uStackFrame;
-        rcStrict = iemMemMap(pVCpu, &uStackFrame.pv, cbStackFrame, UINT8_MAX,
+        rcStrict = iemMemMap(pVCpu, &uStackFrame.pv, &bUnmapInfoStackFrame, cbStackFrame, UINT8_MAX,
                              uNewEsp - cbStackFrame + X86DESC_BASE(&DescSS.Legacy),
                              IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS, 0); /* _SYS is a hack ... */
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
-        void * const pvStackFrame = uStackFrame.pv;
         if (f32BitGate)
         {
@@ -3429 +3438 @@
             }
         }
-        rcStrict = iemMemCommitAndUnmap(pVCpu, pvStackFrame, IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoStackFrame);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3487 +3496 @@
     {
         uint64_t        uNewRsp;
+        uint8_t         bUnmapInfoStackFrame;
         RTPTRUNION      uStackFrame;
         uint8_t const   cbStackFrame = (fFlags & IEM_XCPT_FLAGS_ERR ? 8 : 6) << f32BitGate;
-        rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbStackFrame, f32BitGate ? 3 : 1, &uStackFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbStackFrame, f32BitGate ? 3 : 1,
+                                               &uStackFrame.pv, &bUnmapInfoStackFrame, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
-        void * const pvStackFrame = uStackFrame.pv;
 
         if (f32BitGate)
@@ -3510 +3520 @@
             uStackFrame.pu16[2] = fEfl;
         }
-        rcStrict = iemMemCommitAndUnmap(pVCpu, pvStackFrame, IEM_ACCESS_STACK_W); /* don't use the commit here */
+        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoStackFrame); /* don't use the commit here */
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3747 +3757 @@
 
     /* Create the stack frame. */
+    uint8_t    bUnmapInfoStackFrame;
     uint32_t   cbStackFrame = sizeof(uint64_t) * (5 + !!(fFlags & IEM_XCPT_FLAGS_ERR));
     RTPTRUNION uStackFrame;
-    rcStrict = iemMemMap(pVCpu, &uStackFrame.pv, cbStackFrame, UINT8_MAX,
+    rcStrict = iemMemMap(pVCpu, &uStackFrame.pv, &bUnmapInfoStackFrame, cbStackFrame, UINT8_MAX,
                          uNewRsp - cbStackFrame, IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS, 0); /* _SYS is a hack ... */
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
-    void * const pvStackFrame = uStackFrame.pv;
 
     if (fFlags & IEM_XCPT_FLAGS_ERR)
@@ -3762 +3772 @@
     uStackFrame.pu64[3] = pVCpu->cpum.GstCtx.rsp;
     uStackFrame.pu64[4] = pVCpu->cpum.GstCtx.ss.Sel;
-    rcStrict = iemMemCommitAndUnmap(pVCpu, pvStackFrame, IEM_ACCESS_STACK_W | IEM_ACCESS_WHAT_SYS);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoStackFrame);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -6031 +6041 @@
  */
 static VBOXSTRICTRC
-iemMemBounceBufferMapCrossPage(PVMCPUCC pVCpu, int iMemMap, void **ppvMem, size_t cbMem, RTGCPTR GCPtrFirst, uint32_t fAccess)
+iemMemBounceBufferMapCrossPage(PVMCPUCC pVCpu, int iMemMap, void **ppvMem, uint8_t *pbUnmapInfo,
+                               size_t cbMem, RTGCPTR GCPtrFirst, uint32_t fAccess)
 {
     Assert(cbMem <= GUEST_PAGE_SIZE);
@@ -6158 +6169 @@
     iemMemUpdateWrittenCounter(pVCpu, fAccess, cbMem);
     *ppvMem = pbBuf;
+    *pbUnmapInfo = iMemMap | 0x08 | ((fAccess & IEM_ACCESS_TYPE_MASK) << 4);
     return VINF_SUCCESS;
 }
@@ -6165 +6177 @@
  * iemMemMap woker that deals with iemMemPageMap failures.
  */
-static VBOXSTRICTRC iemMemBounceBufferMapPhys(PVMCPUCC pVCpu, unsigned iMemMap, void **ppvMem, size_t cbMem,
+static VBOXSTRICTRC iemMemBounceBufferMapPhys(PVMCPUCC pVCpu, unsigned iMemMap, void **ppvMem, uint8_t *pbUnmapInfo, size_t cbMem,
                                               RTGCPHYS GCPhysFirst, uint32_t fAccess, VBOXSTRICTRC rcMap)
 {
@@ -6244 +6256 @@
     iemMemUpdateWrittenCounter(pVCpu, fAccess, cbMem);
     *ppvMem = pbBuf;
+    *pbUnmapInfo = iMemMap | 0x08 | ((fAccess & IEM_ACCESS_TYPE_MASK) << 4);
     return VINF_SUCCESS;
 }
@@ -6263 +6276 @@
  * @param   pVCpu       The cross context virtual CPU structure of the calling thread.
  * @param   ppvMem      Where to return the pointer to the mapped memory.
+ * @param   bUnmapInfo  Where to return unmap info to be passed to
+ *                      iemMemCommitAndUnmap or iemMemRollbackAndUnmap when
+ *                      done.
  * @param   cbMem       The number of bytes to map.  This is usually 1, 2, 4, 6,
  *                      8, 12, 16, 32 or 512.  When used by string operations
@@ -6282 +6298 @@
  *                      Pass zero to skip alignment.
  */
-VBOXSTRICTRC iemMemMap(PVMCPUCC pVCpu, void **ppvMem, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem,
+VBOXSTRICTRC iemMemMap(PVMCPUCC pVCpu, void **ppvMem, uint8_t *pbUnmapInfo, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem,
                        uint32_t fAccess, uint32_t uAlignCtl) RT_NOEXCEPT
 {
@@ -6319 +6335 @@
     { /* likely */ }
     else
-        return iemMemBounceBufferMapCrossPage(pVCpu, iMemMap, ppvMem, cbMem, GCPtrMem, fAccess);
+        return iemMemBounceBufferMapCrossPage(pVCpu, iMemMap, ppvMem, pbUnmapInfo, cbMem, GCPtrMem, fAccess);
 
     /*
@@ -6484 +6500 @@
     { /* probably likely */ }
     else
-        return iemMemBounceBufferMapPhys(pVCpu, iMemMap, ppvMem, cbMem,
+        return iemMemBounceBufferMapPhys(pVCpu, iMemMap, ppvMem, pbUnmapInfo, cbMem,
                                          pTlbe->GCPhys | (GCPtrMem & GUEST_PAGE_OFFSET_MASK), fAccess,
                                            pTlbe->fFlagsAndPhysRev & IEMTLBE_F_PG_UNASSIGNED ? VERR_PGM_PHYS_TLB_UNASSIGNED
@@ -6503 +6519 @@
         rcStrict = iemMemPageMap(pVCpu, GCPhysFirst, fAccess, (void **)&pbMem, &pVCpu->iem.s.aMemMappingLocks[iMemMap].Lock);
         if (rcStrict != VINF_SUCCESS)
-            return iemMemBounceBufferMapPhys(pVCpu, iMemMap, ppvMem, cbMem, GCPhysFirst, fAccess, rcStrict);
+            return iemMemBounceBufferMapPhys(pVCpu, iMemMap, ppvMem, pbUnmapInfo, cbMem, GCPhysFirst, fAccess, rcStrict);
     }
 
@@ -6528 +6544 @@
     rcStrict = iemMemPageMap(pVCpu, GCPhysFirst, fAccess, &pvMem, &pVCpu->iem.s.aMemMappingLocks[iMemMap].Lock);
     if (rcStrict != VINF_SUCCESS)
-        return iemMemBounceBufferMapPhys(pVCpu, iMemMap, ppvMem, cbMem, GCPhysFirst, fAccess, rcStrict);
+        return iemMemBounceBufferMapPhys(pVCpu, iMemMap, ppvMem, pbUnmapInfo, cbMem, GCPhysFirst, fAccess, rcStrict);
 
 #endif /* !IEM_WITH_DATA_TLB */
@@ -6542 +6558 @@
     iemMemUpdateWrittenCounter(pVCpu, fAccess, cbMem);
     *ppvMem = pvMem;
+    *pbUnmapInfo = iMemMap | 0x08 | ((fAccess & IEM_ACCESS_TYPE_MASK) << 4);
+    AssertCompile(IEM_ACCESS_TYPE_MASK <= 0xf);
+    AssertCompile(RT_ELEMENTS(pVCpu->iem.s.aMemMappings) < 8);
 
     return VINF_SUCCESS;
@@ -6552 +6571 @@
  * @returns Strict VBox status code.
  * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
- * @param   pvMem               The mapping.
- * @param   fAccess             The kind of access.
- */
-VBOXSTRICTRC iemMemCommitAndUnmap(PVMCPUCC pVCpu, void *pvMem, uint32_t fAccess) RT_NOEXCEPT
-{
-    int iMemMap = iemMapLookup(pVCpu, pvMem, fAccess);
-    AssertReturn(iMemMap >= 0, iMemMap);
+ * @param   bUnmapInfo          Unmap info set by iemMemMap.
+ */
+VBOXSTRICTRC iemMemCommitAndUnmap(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT
+{
+    uintptr_t const iMemMap = bUnmapInfo & 0x7;
+    AssertMsgReturn(   (bUnmapInfo & 0x08)
+                    && iMemMap < RT_ELEMENTS(pVCpu->iem.s.aMemMappings)
+                    && (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & (IEM_ACCESS_TYPE_MASK | 0xf)) == ((unsigned)bUnmapInfo >> 4),
+                    ("%#x fAccess=%#x\n", bUnmapInfo, pVCpu->iem.s.aMemMappings[iMemMap].fAccess),
+                    VERR_NOT_FOUND);
 
     /* If it's bounce buffered, we may need to write back the buffer. */
@@ -6582 +6604 @@
  *
  * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
- * @param   pvMem               The mapping.
- * @param   fAccess             The kind of access.
- */
-void iemMemRollbackAndUnmap(PVMCPUCC pVCpu, void *pvMem, uint32_t fAccess) RT_NOEXCEPT
-{
-    int iMemMap = iemMapLookup(pVCpu, pvMem, fAccess);
-    AssertReturnVoid(iMemMap >= 0);
+ * @param   bUnmapInfo          Unmap info set by iemMemMap.
+ */
+void iemMemRollbackAndUnmap(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT
+{
+    uintptr_t const iMemMap = bUnmapInfo & 0x7;
+    AssertMsgReturnVoid(   (bUnmapInfo & 0x08)
+                        && iMemMap < RT_ELEMENTS(pVCpu->iem.s.aMemMappings)
+                        &&    (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & (IEM_ACCESS_TYPE_MASK | 0xf))
+                           == ((unsigned)bUnmapInfo >> 4),
+                        ("%#x fAccess=%#x\n", bUnmapInfo, pVCpu->iem.s.aMemMappings[iMemMap].fAccess));
 
     /* Unlock it if necessary. */
@@ -6616 +6641 @@
  *
  * @param   pVCpu       The cross context virtual CPU structure of the calling thread.
+ * @param   bUnmapInfo  Where to return unmap info to be passed to
+ *                      iemMemCommitAndUnmapJmp, iemMemCommitAndUnmapRwSafeJmp,
+ *                      iemMemCommitAndUnmapWoSafeJmp,
+ *                      iemMemCommitAndUnmapRoSafeJmp,
+ *                      iemMemRollbackAndUnmapWoSafe or iemMemRollbackAndUnmap
+ *                      when done.
  * @param   cbMem       The number of bytes to map.  This is usually 1,
  *                      2, 4, 6, 8, 12, 16, 32 or 512.  When used by
@@ -6636 +6667 @@
  *                      Pass zero to skip alignment.
  */
-void *iemMemMapJmp(PVMCPUCC pVCpu, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t fAccess,
+void *iemMemMapJmp(PVMCPUCC pVCpu, uint8_t *pbUnmapInfo, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem, uint32_t fAccess,
                    uint32_t uAlignCtl) IEM_NOEXCEPT_MAY_LONGJMP
 {
@@ -6705 +6736 @@
     {
         void *pvMem;
-        rcStrict = iemMemBounceBufferMapCrossPage(pVCpu, iMemMap, &pvMem, cbMem, GCPtrMem, fAccess);
+        rcStrict = iemMemBounceBufferMapCrossPage(pVCpu, iMemMap, &pvMem, pbUnmapInfo, cbMem, GCPtrMem, fAccess);
         if (rcStrict == VINF_SUCCESS)
             return pvMem;
@@ -6842 +6873 @@
         else
         {
-            rcStrict = iemMemBounceBufferMapPhys(pVCpu, iMemMap, (void **)&pbMem, cbMem,
+            rcStrict = iemMemBounceBufferMapPhys(pVCpu, iMemMap, (void **)&pbMem, pbUnmapInfo, cbMem,
                                                  pTlbe->GCPhys | (GCPtrMem & GUEST_PAGE_OFFSET_MASK), fAccess,
                                                    pTlbe->fFlagsAndPhysRev & IEMTLBE_F_PG_UNASSIGNED ? VERR_PGM_PHYS_TLB_UNASSIGNED
@@ -6866 +6897 @@
         rcStrict = iemMemPageMap(pVCpu, GCPhysFirst, fAccess, (void **)&pbMem, &pVCpu->iem.s.aMemMappingLocks[iMemMap].Lock);
         if (rcStrict == VINF_SUCCESS)
+        {
+            *pbUnmapInfo = iMemMap | 0x08 | ((fAccess & IEM_ACCESS_TYPE_MASK) << 4);
             return pbMem;
+        }
         IEM_DO_LONGJMP(pVCpu, VBOXSTRICTRC_VAL(rcStrict));
     }
@@ -6896 +6930 @@
     else
     {
-        rcStrict = iemMemBounceBufferMapPhys(pVCpu, iMemMap, &pvMem, cbMem, GCPhysFirst, fAccess, rcStrict);
+        rcStrict = iemMemBounceBufferMapPhys(pVCpu, iMemMap, &pvMem, pbUnmapInfo, cbMem, GCPhysFirst, fAccess, rcStrict);
         if (rcStrict == VINF_SUCCESS)
             return pvMem;
@@ -6913 +6947 @@
 
     iemMemUpdateWrittenCounter(pVCpu, fAccess, cbMem);
+
+    *pbUnmapInfo = iMemMap | 0x08 | ((fAccess & IEM_ACCESS_TYPE_MASK) << 4);
     return pvMem;
 }
@@ -6924 +6960 @@
  * @param   fAccess             The kind of access.
  */
-void iemMemCommitAndUnmapJmp(PVMCPUCC pVCpu, void *pvMem, uint32_t fAccess) IEM_NOEXCEPT_MAY_LONGJMP
-{
-    int iMemMap = iemMapLookup(pVCpu, pvMem, fAccess);
-    AssertStmt(iMemMap >= 0, IEM_DO_LONGJMP(pVCpu, iMemMap));
+void iemMemCommitAndUnmapJmp(PVMCPUCC pVCpu, uint8_t bUnmapInfo) IEM_NOEXCEPT_MAY_LONGJMP
+{
+    uintptr_t const iMemMap = bUnmapInfo & 0x7;
+    AssertMsgReturnVoid(   (bUnmapInfo & 0x08)
+                        && iMemMap < RT_ELEMENTS(pVCpu->iem.s.aMemMappings)
+                        &&    (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & (IEM_ACCESS_TYPE_MASK | 0xf))
+                           == ((unsigned)bUnmapInfo >> 4),
+                        ("%#x fAccess=%#x\n", bUnmapInfo, pVCpu->iem.s.aMemMappings[iMemMap].fAccess));
 
     /* If it's bounce buffered, we may need to write back the buffer. */
@@ -6952 +6992 @@
 
 /** Fallback for iemMemCommitAndUnmapRwJmp.  */
-void iemMemCommitAndUnmapRwSafeJmp(PVMCPUCC pVCpu, void *pvMem, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP
-{
-    Assert(bMapInfo == (1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4)) ); RT_NOREF_PV(bMapInfo);
-    iemMemCommitAndUnmapJmp(pVCpu, pvMem, IEM_ACCESS_DATA_RW);
+void iemMemCommitAndUnmapRwSafeJmp(PVMCPUCC pVCpu, uint8_t bUnmapInfo) IEM_NOEXCEPT_MAY_LONGJMP
+{
+    Assert(((bUnmapInfo >> 4) & IEM_ACCESS_TYPE_MASK) == (IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE));
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
 }
 
 
 /** Fallback for iemMemCommitAndUnmapWoJmp.  */
-void iemMemCommitAndUnmapWoSafeJmp(PVMCPUCC pVCpu, void *pvMem, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP
-{
-    Assert(bMapInfo == (1 | (IEM_ACCESS_TYPE_WRITE << 4)) ); RT_NOREF_PV(bMapInfo);
-    iemMemCommitAndUnmapJmp(pVCpu, pvMem, IEM_ACCESS_DATA_W);
+void iemMemCommitAndUnmapWoSafeJmp(PVMCPUCC pVCpu, uint8_t bUnmapInfo) IEM_NOEXCEPT_MAY_LONGJMP
+{
+    Assert(((bUnmapInfo >> 4) & IEM_ACCESS_TYPE_MASK) == IEM_ACCESS_TYPE_WRITE);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
 }
 
 
 /** Fallback for iemMemCommitAndUnmapRoJmp.  */
-void iemMemCommitAndUnmapRoSafeJmp(PVMCPUCC pVCpu, const void *pvMem, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP
-{
-    Assert(bMapInfo == (1 | (IEM_ACCESS_TYPE_READ << 4)) ); RT_NOREF_PV(bMapInfo);
-    iemMemCommitAndUnmapJmp(pVCpu, (void *)pvMem, IEM_ACCESS_DATA_R);
+void iemMemCommitAndUnmapRoSafeJmp(PVMCPUCC pVCpu, uint8_t bUnmapInfo) IEM_NOEXCEPT_MAY_LONGJMP
+{
+    Assert(((bUnmapInfo >> 4) & IEM_ACCESS_TYPE_MASK) == IEM_ACCESS_TYPE_READ);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
 }
 
 
 /** Fallback for iemMemRollbackAndUnmapWo.  */
-void iemMemRollbackAndUnmapWoSafe(PVMCPUCC pVCpu, const void *pvMem, uint8_t bMapInfo) RT_NOEXCEPT
-{
-    Assert(bMapInfo == (1 | (IEM_ACCESS_TYPE_READ << 4)) ); RT_NOREF_PV(bMapInfo);
-    iemMemRollbackAndUnmap(pVCpu, (void *)pvMem, IEM_ACCESS_DATA_R);
+void iemMemRollbackAndUnmapWoSafe(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT
+{
+    Assert(((bUnmapInfo >> 4) & IEM_ACCESS_TYPE_MASK) == IEM_ACCESS_TYPE_WRITE);
+    iemMemRollbackAndUnmap(pVCpu, bUnmapInfo);
 }
 
@@ -6998 +7038 @@
  * @param   fAccess             The kind of access.
  */
-VBOXSTRICTRC iemMemCommitAndUnmapPostponeTroubleToR3(PVMCPUCC pVCpu, void *pvMem, uint32_t fAccess) RT_NOEXCEPT
-{
-    int iMemMap = iemMapLookup(pVCpu, pvMem, fAccess);
-    AssertReturn(iMemMap >= 0, iMemMap);
+VBOXSTRICTRC iemMemCommitAndUnmapPostponeTroubleToR3(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT
+{
+    uintptr_t const iMemMap = bUnmapInfo & 0x7;
+    AssertMsgReturn(   (bUnmapInfo & 0x08)
+                    && iMemMap < RT_ELEMENTS(pVCpu->iem.s.aMemMappings)
+                    &&    (pVCpu->iem.s.aMemMappings[iMemMap].fAccess & (IEM_ACCESS_TYPE_MASK | 0xf))
+                       == ((unsigned)bUnmapInfo >> 4),
+                    ("%#x fAccess=%#x\n", bUnmapInfo, pVCpu->iem.s.aMemMappings[iMemMap].fAccess),
+                    VERR_NOT_FOUND);
 
     /* If it's bounce buffered, we may need to write back the buffer. */
@@ -7131 +7176 @@
 {
     /* The lazy approach for now... */
+    uint8_t         bUnmapInfo;
     uint32_t const *pu32Src;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Src, sizeof(*pu32Src), iSegReg, GCPtrMem,
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Src, &bUnmapInfo, sizeof(*pu32Src), iSegReg, GCPtrMem,
                                 IEM_ACCESS_DATA_R, sizeof(*pu32Src) - 1);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = *pu32Src;
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu32Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         Log(("IEM RD dword %d|%RGv: %#010RX64\n", iSegReg, GCPtrMem, *pu64Dst));
     }
@@ -7158 +7204 @@
 {
     /* The lazy approach for now... */
+    uint8_t        bUnmapInfo;
     int32_t const *pi32Src;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pi32Src, sizeof(*pi32Src), iSegReg, GCPtrMem,
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pi32Src, &bUnmapInfo, sizeof(*pi32Src), iSegReg, GCPtrMem,
                                 IEM_ACCESS_DATA_R, sizeof(*pi32Src) - 1);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = *pi32Src;
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)pi32Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         Log(("IEM RD dword %d|%RGv: %#010x\n", iSegReg, GCPtrMem, (uint32_t)*pu64Dst));
     }
@@ -7192 +7239 @@
 {
     /* The lazy approach for now... */
+    uint8_t      bUnmapInfo;
     PCRTUINT128U pu128Src;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu128Src, sizeof(*pu128Src), iSegReg, GCPtrMem,
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu128Src, &bUnmapInfo, sizeof(*pu128Src), iSegReg, GCPtrMem,
                                 IEM_ACCESS_DATA_R, (sizeof(*pu128Src) - 1) | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_SSE);
     if (rc == VINF_SUCCESS)
@@ -7199 +7247 @@
         pu128Dst->au64[0] = pu128Src->au64[0];
         pu128Dst->au64[1] = pu128Src->au64[1];
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         Log(("IEM RD dqword %d|%RGv: %.16Rhxs\n", iSegReg, GCPtrMem, pu128Dst));
     }
@@ -7223 +7271 @@
 {
     /* The lazy approach for now... */
-    PCRTUINT128U pu128Src = (PCRTUINT128U)iemMemMapJmp(pVCpu, sizeof(*pu128Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R,
+    uint8_t      bUnmapInfo;
+    PCRTUINT128U pu128Src = (PCRTUINT128U)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*pu128Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R,
                                                        (sizeof(*pu128Src) - 1) | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_SSE);
     pu128Dst->au64[0] = pu128Src->au64[0];
     pu128Dst->au64[1] = pu128Src->au64[1];
-    iemMemCommitAndUnmapJmp(pVCpu, (void *)pu128Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
     Log(("IEM RD dqword %d|%RGv: %.16Rhxs\n", iSegReg, GCPtrMem, pu128Dst));
 }
@@ -7246 +7295 @@
 {
     /* The lazy approach for now... */
+    uint8_t      bUnmapInfo;
     PCRTUINT256U pu256Src;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Src, sizeof(*pu256Src), iSegReg, GCPtrMem,
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Src, &bUnmapInfo, sizeof(*pu256Src), iSegReg, GCPtrMem,
                                 IEM_ACCESS_DATA_R, 0 /* NO_AC variant */);
     if (rc == VINF_SUCCESS)
@@ -7255 +7305 @@
         pu256Dst->au64[2] = pu256Src->au64[2];
         pu256Dst->au64[3] = pu256Src->au64[3];
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu256Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         Log(("IEM RD qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
     }
@@ -7275 +7325 @@
 {
     /* The lazy approach for now... */
-    PCRTUINT256U pu256Src = (PCRTUINT256U)iemMemMapJmp(pVCpu, sizeof(*pu256Src), iSegReg, GCPtrMem,
+    uint8_t      bUnmapInfo;
+    PCRTUINT256U pu256Src = (PCRTUINT256U)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*pu256Src), iSegReg, GCPtrMem,
                                                        IEM_ACCESS_DATA_R, 0 /* NO_AC variant */);
     pu256Dst->au64[0] = pu256Src->au64[0];
@@ -7281 +7332 @@
     pu256Dst->au64[2] = pu256Src->au64[2];
     pu256Dst->au64[3] = pu256Src->au64[3];
-    iemMemCommitAndUnmapJmp(pVCpu, (void *)pu256Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
     Log(("IEM RD qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
 }
@@ -7303 +7354 @@
 {
     /* The lazy approach for now... */
+    uint8_t      bUnmapInfo;
     PCRTUINT256U pu256Src;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Src, sizeof(*pu256Src), iSegReg, GCPtrMem,
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Src, &bUnmapInfo, sizeof(*pu256Src), iSegReg, GCPtrMem,
                                 IEM_ACCESS_DATA_R, (sizeof(*pu256Src) - 1) | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_SSE);
     if (rc == VINF_SUCCESS)
@@ -7312 +7364 @@
         pu256Dst->au64[2] = pu256Src->au64[2];
         pu256Dst->au64[3] = pu256Src->au64[3];
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu256Src, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         Log(("IEM RD qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
     }
@@ -7336 +7388 @@
 {
     /* The lazy approach for now... */
-    PCRTUINT256U pu256Src = (PCRTUINT256U)iemMemMapJmp(pVCpu, sizeof(*pu256Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R,
+    uint8_t      bUnmapInfo;
+    PCRTUINT256U pu256Src = (PCRTUINT256U)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*pu256Src), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R,
                                                        (sizeof(*pu256Src) - 1) | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_SSE);
     pu256Dst->au64[0] = pu256Src->au64[0];
@@ -7342 +7395 @@
     pu256Dst->au64[2] = pu256Src->au64[2];
     pu256Dst->au64[3] = pu256Src->au64[3];
-    iemMemCommitAndUnmapJmp(pVCpu, (void *)pu256Src, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
     Log(("IEM RD qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
 }
@@ -7433 +7486 @@
 {
     /* The lazy approach for now... */
-    PRTUINT128U pu128Dst;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu128Dst, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W,
+    uint8_t      bUnmapInfo;
+    PRTUINT128U  pu128Dst;
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu128Dst, &bUnmapInfo, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W,
                                 (sizeof(*pu128Dst) - 1) | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_SSE);
     if (rc == VINF_SUCCESS)
@@ -7440 +7494 @@
         pu128Dst->au64[0] = u128Value.au64[0];
         pu128Dst->au64[1] = u128Value.au64[1];
-        rc = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         Log5(("IEM WR dqword %d|%RGv: %.16Rhxs\n", iSegReg, GCPtrMem, pu128Dst));
     }
@@ -7462 +7516 @@
 {
     /* The lazy approach for now... */
-    PRTUINT128U pu128Dst = (PRTUINT128U)iemMemMapJmp(pVCpu, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W,
+    uint8_t     bUnmapInfo;
+    PRTUINT128U pu128Dst = (PRTUINT128U)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*pu128Dst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W,
                                                      (sizeof(*pu128Dst) - 1) | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_SSE);
     pu128Dst->au64[0] = u128Value.au64[0];
     pu128Dst->au64[1] = u128Value.au64[1];
-    iemMemCommitAndUnmapJmp(pVCpu, pu128Dst, IEM_ACCESS_DATA_W);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
     Log5(("IEM WR dqword %d|%RGv: %.16Rhxs\n", iSegReg, GCPtrMem, pu128Dst));
 }
@@ -7485 +7540 @@
 {
     /* The lazy approach for now... */
-    PRTUINT256U pu256Dst;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Dst, sizeof(*pu256Dst), iSegReg, GCPtrMem,
+    uint8_t      bUnmapInfo;
+    PRTUINT256U  pu256Dst;
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Dst, &bUnmapInfo, sizeof(*pu256Dst), iSegReg, GCPtrMem,
                                 IEM_ACCESS_DATA_W, 0 /* NO_AC variant */);
     if (rc == VINF_SUCCESS)
@@ -7494 +7550 @@
         pu256Dst->au64[2] = pu256Value->au64[2];
         pu256Dst->au64[3] = pu256Value->au64[3];
-        rc = iemMemCommitAndUnmap(pVCpu, pu256Dst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         Log5(("IEM WR qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
     }
@@ -7514 +7570 @@
 {
     /* The lazy approach for now... */
-    PRTUINT256U pu256Dst = (PRTUINT256U)iemMemMapJmp(pVCpu, sizeof(*pu256Dst), iSegReg, GCPtrMem,
+    uint8_t     bUnmapInfo;
+    PRTUINT256U pu256Dst = (PRTUINT256U)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*pu256Dst), iSegReg, GCPtrMem,
                                                      IEM_ACCESS_DATA_W, 0 /* NO_AC variant */);
     pu256Dst->au64[0] = pu256Value->au64[0];
@@ -7520 +7577 @@
     pu256Dst->au64[2] = pu256Value->au64[2];
     pu256Dst->au64[3] = pu256Value->au64[3];
-    iemMemCommitAndUnmapJmp(pVCpu, pu256Dst, IEM_ACCESS_DATA_W);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
     Log5(("IEM WR qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
 }
@@ -7539 +7596 @@
 {
     /* The lazy approach for now... */
-    PRTUINT256U pu256Dst;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Dst, sizeof(*pu256Dst), iSegReg, GCPtrMem,
+    uint8_t      bUnmapInfo;
+    PRTUINT256U  pu256Dst;
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Dst, &bUnmapInfo, sizeof(*pu256Dst), iSegReg, GCPtrMem,
                                 IEM_ACCESS_DATA_W, (sizeof(*pu256Dst) - 1) | IEM_MEMMAP_F_ALIGN_GP);
     if (rc == VINF_SUCCESS)
@@ -7548 +7606 @@
         pu256Dst->au64[2] = pu256Value->au64[2];
         pu256Dst->au64[3] = pu256Value->au64[3];
-        rc = iemMemCommitAndUnmap(pVCpu, pu256Dst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         Log5(("IEM WR qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
     }
@@ -7570 +7628 @@
 {
     /* The lazy approach for now... */
-    PRTUINT256U pu256Dst = (PRTUINT256U)iemMemMapJmp(pVCpu, sizeof(*pu256Dst), iSegReg, GCPtrMem,
+    uint8_t     bUnmapInfo;
+    PRTUINT256U pu256Dst = (PRTUINT256U)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*pu256Dst), iSegReg, GCPtrMem,
                                                      IEM_ACCESS_DATA_W, (sizeof(*pu256Dst) - 1) | IEM_MEMMAP_F_ALIGN_GP);
     pu256Dst->au64[0] = pu256Value->au64[0];
@@ -7576 +7635 @@
     pu256Dst->au64[2] = pu256Value->au64[2];
     pu256Dst->au64[3] = pu256Value->au64[3];
-    iemMemCommitAndUnmapJmp(pVCpu, pu256Dst, IEM_ACCESS_DATA_W);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
     Log5(("IEM WR qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
 }
@@ -7630 +7689 @@
  *                              don't commit register until the commit call
  *                              succeeds.
+ * @param   pbUnmapInfo         Where to store unmap info for
+ *                              iemMemStackPushCommitSpecial.
  * @param   puNewRsp            Where to return the new RSP value.  This must be
  *                              passed unchanged to
@@ -7635 +7696 @@
  */
 VBOXSTRICTRC iemMemStackPushBeginSpecial(PVMCPUCC pVCpu, size_t cbMem, uint32_t cbAlign,
-                                         void **ppvMem, uint64_t *puNewRsp) RT_NOEXCEPT
+                                         void **ppvMem, uint8_t *pbUnmapInfo, uint64_t *puNewRsp) RT_NOEXCEPT
 {
     Assert(cbMem < UINT8_MAX);
-    RTGCPTR     GCPtrTop = iemRegGetRspForPush(pVCpu, (uint8_t)cbMem, puNewRsp);
-    return iemMemMap(pVCpu, ppvMem, cbMem, X86_SREG_SS, GCPtrTop,
-                     IEM_ACCESS_STACK_W, cbAlign);
+    RTGCPTR GCPtrTop = iemRegGetRspForPush(pVCpu, (uint8_t)cbMem, puNewRsp);
+    return iemMemMap(pVCpu, ppvMem, pbUnmapInfo, cbMem, X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_W, cbAlign);
 }
 
@@ -7656 +7716 @@
  *                              iemMemStackPushBeginSpecial().
  */
-VBOXSTRICTRC iemMemStackPushCommitSpecial(PVMCPUCC pVCpu, void *pvMem, uint64_t uNewRsp) RT_NOEXCEPT
-{
-    VBOXSTRICTRC rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem, IEM_ACCESS_STACK_W);
+VBOXSTRICTRC iemMemStackPushCommitSpecial(PVMCPUCC pVCpu, uint8_t bUnmapInfo, uint64_t uNewRsp) RT_NOEXCEPT
+{
+    VBOXSTRICTRC rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     if (rcStrict == VINF_SUCCESS)
         pVCpu->cpum.GstCtx.rsp = uNewRsp;
@@ -7675 +7735 @@
  * @param   cbAlign             The alignment mask (7, 3, 1).
  * @param   ppvMem              Where to return the pointer to the stack memory.
+ * @param   pbUnmapInfo         Where to store unmap info for
+ *                              iemMemStackPopDoneSpecial.
  * @param   puNewRsp            Where to return the new RSP value.  This must be
  *                              assigned to CPUMCTX::rsp manually some time
@@ -7681 +7743 @@
  */
 VBOXSTRICTRC iemMemStackPopBeginSpecial(PVMCPUCC pVCpu, size_t cbMem, uint32_t cbAlign,
-                                        void const **ppvMem, uint64_t *puNewRsp) RT_NOEXCEPT
+                                        void const **ppvMem, uint8_t *pbUnmapInfo, uint64_t *puNewRsp) RT_NOEXCEPT
 {
     Assert(cbMem < UINT8_MAX);
     RTGCPTR     GCPtrTop = iemRegGetRspForPop(pVCpu, (uint8_t)cbMem, puNewRsp);
-    return iemMemMap(pVCpu, (void **)ppvMem, cbMem, X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R, cbAlign);
+    return iemMemMap(pVCpu, (void **)ppvMem, pbUnmapInfo, cbMem, X86_SREG_SS, GCPtrTop, IEM_ACCESS_STACK_R, cbAlign);
 }
 
@@ -7701 +7763 @@
  * @param   cbMem               The number of bytes to pop from the stack.
  * @param   ppvMem              Where to return the pointer to the stack memory.
+ * @param   pbUnmapInfo         Where to store unmap info for
+ *                              iemMemStackPopDoneSpecial.
  * @param   uCurNewRsp          The current uncommitted RSP value.  (No need to
  *                              return this because all use of this function is
@@ -7707 +7771 @@
  */
 VBOXSTRICTRC iemMemStackPopContinueSpecial(PVMCPUCC pVCpu, size_t off, size_t cbMem,
-                                           void const **ppvMem, uint64_t uCurNewRsp) RT_NOEXCEPT
+                                           void const **ppvMem, uint8_t *pbUnmapInfo, uint64_t uCurNewRsp) RT_NOEXCEPT
 {
     Assert(cbMem < UINT8_MAX);
@@ -7720 +7784 @@
         GCPtrTop = (uint16_t)uCurNewRsp;
 
-    return iemMemMap(pVCpu, (void **)ppvMem, cbMem, X86_SREG_SS, GCPtrTop + off, IEM_ACCESS_STACK_R,
+    return iemMemMap(pVCpu, (void **)ppvMem, pbUnmapInfo, cbMem, X86_SREG_SS, GCPtrTop + off, IEM_ACCESS_STACK_R,
                      0 /* checked in iemMemStackPopBeginSpecial */);
 }
@@ -7733 +7797 @@
  * @returns Strict VBox status code.
  * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
- * @param   pvMem               The pointer returned by
+ * @param   bUnmapInfo          Unmap information returned by
  *                              iemMemStackPopBeginSpecial() or
  *                              iemMemStackPopContinueSpecial().
  */
-VBOXSTRICTRC iemMemStackPopDoneSpecial(PVMCPUCC pVCpu, void const *pvMem) RT_NOEXCEPT
-{
-    return iemMemCommitAndUnmap(pVCpu, (void *)pvMem, IEM_ACCESS_STACK_R);
+VBOXSTRICTRC iemMemStackPopDoneSpecial(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT
+{
+    return iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
 }
 
@@ -7756 +7820 @@
 {
     /* The lazy approach for now... */
+    uint8_t        bUnmapInfo;
     uint8_t const *pbSrc;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pbSrc, sizeof(*pbSrc), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R, 0);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pbSrc, &bUnmapInfo, sizeof(*pbSrc), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R, 0);
     if (rc == VINF_SUCCESS)
     {
         *pbDst = *pbSrc;
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)pbSrc, IEM_ACCESS_SYS_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     }
     return rc;
@@ -7780 +7845 @@
 {
     /* The lazy approach for now... */
+    uint8_t         bUnmapInfo;
     uint16_t const *pu16Src;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu16Src, sizeof(*pu16Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R, 0);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu16Src, &bUnmapInfo, sizeof(*pu16Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R, 0);
     if (rc == VINF_SUCCESS)
     {
         *pu16Dst = *pu16Src;
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu16Src, IEM_ACCESS_SYS_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     }
     return rc;
@@ -7804 +7870 @@
 {
     /* The lazy approach for now... */
+    uint8_t         bUnmapInfo;
     uint32_t const *pu32Src;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Src, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R, 0);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu32Src, &bUnmapInfo, sizeof(*pu32Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R, 0);
     if (rc == VINF_SUCCESS)
     {
         *pu32Dst = *pu32Src;
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu32Src, IEM_ACCESS_SYS_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     }
     return rc;
@@ -7828 +7895 @@
 {
     /* The lazy approach for now... */
+    uint8_t         bUnmapInfo;
     uint64_t const *pu64Src;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu64Src, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R, 0);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu64Src, &bUnmapInfo, sizeof(*pu64Src), iSegReg, GCPtrMem, IEM_ACCESS_SYS_R, 0);
     if (rc == VINF_SUCCESS)
     {
         *pu64Dst = *pu64Src;
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)pu64Src, IEM_ACCESS_SYS_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     }
     return rc;
@@ -7965 +8033 @@
      */
     VBOXSTRICTRC        rcStrict;
+    uint8_t             bUnmapInfo;
     uint32_t volatile  *pu32;
     if ((GCPtr & 3) == 0)
@@ -7970 +8039 @@
         /* The normal case, map the 32-bit bits around the accessed bit (40). */
         GCPtr += 2 + 2;
-        rcStrict = iemMemMap(pVCpu, (void **)&pu32, 4, UINT8_MAX, GCPtr, IEM_ACCESS_SYS_RW, 0);
+        rcStrict = iemMemMap(pVCpu, (void **)&pu32, &bUnmapInfo, 4, UINT8_MAX, GCPtr, IEM_ACCESS_SYS_RW, 0);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -7978 +8047 @@
     {
         /* The misaligned GDT/LDT case, map the whole thing. */
-        rcStrict = iemMemMap(pVCpu, (void **)&pu32, 8, UINT8_MAX, GCPtr, IEM_ACCESS_SYS_RW, 0);
+        rcStrict = iemMemMap(pVCpu, (void **)&pu32, &bUnmapInfo, 8, UINT8_MAX, GCPtr, IEM_ACCESS_SYS_RW, 0);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -7990 +8059 @@
     }
 
-    return iemMemCommitAndUnmap(pVCpu, (void *)pu32, IEM_ACCESS_SYS_RW);
+    return iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
 }
 

trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp

@@ -432 +432 @@
     else
     {
-        uint16_t const *pa16Mem = NULL;
-        rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa16Mem) - 1);
+        uint8_t         bUnmapInfo;
+        uint16_t const *pau16Mem = NULL;
+        rcStrict = iemMemMap(pVCpu, (void **)&pau16Mem, &bUnmapInfo, 16, X86_SREG_SS, GCPtrStart,
+                             IEM_ACCESS_STACK_R, sizeof(*pau16Mem) - 1);
         if (rcStrict == VINF_SUCCESS)
         {
-            pVCpu->cpum.GstCtx.di = pa16Mem[7 - X86_GREG_xDI];
-            pVCpu->cpum.GstCtx.si = pa16Mem[7 - X86_GREG_xSI];
-            pVCpu->cpum.GstCtx.bp = pa16Mem[7 - X86_GREG_xBP];
+            pVCpu->cpum.GstCtx.di = pau16Mem[7 - X86_GREG_xDI];
+            pVCpu->cpum.GstCtx.si = pau16Mem[7 - X86_GREG_xSI];
+            pVCpu->cpum.GstCtx.bp = pau16Mem[7 - X86_GREG_xBP];
             /* skip sp */
-            pVCpu->cpum.GstCtx.bx = pa16Mem[7 - X86_GREG_xBX];
-            pVCpu->cpum.GstCtx.dx = pa16Mem[7 - X86_GREG_xDX];
-            pVCpu->cpum.GstCtx.cx = pa16Mem[7 - X86_GREG_xCX];
-            pVCpu->cpum.GstCtx.ax = pa16Mem[7 - X86_GREG_xAX];
-            rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_R);
+            pVCpu->cpum.GstCtx.bx = pau16Mem[7 - X86_GREG_xBX];
+            pVCpu->cpum.GstCtx.dx = pau16Mem[7 - X86_GREG_xDX];
+            pVCpu->cpum.GstCtx.cx = pau16Mem[7 - X86_GREG_xCX];
+            pVCpu->cpum.GstCtx.ax = pau16Mem[7 - X86_GREG_xAX];
+            rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -512 +514 @@
     else
     {
-        uint32_t const *pa32Mem;
-        rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrStart, IEM_ACCESS_STACK_R, sizeof(*pa32Mem) - 1);
+        uint8_t         bUnmapInfo;
+        uint32_t const *pau32Mem;
+        rcStrict = iemMemMap(pVCpu, (void **)&pau32Mem, &bUnmapInfo, 32, X86_SREG_SS, GCPtrStart,
+                             IEM_ACCESS_STACK_R, sizeof(*pau32Mem) - 1);
         if (rcStrict == VINF_SUCCESS)
         {
-            pVCpu->cpum.GstCtx.rdi = pa32Mem[7 - X86_GREG_xDI];
-            pVCpu->cpum.GstCtx.rsi = pa32Mem[7 - X86_GREG_xSI];
-            pVCpu->cpum.GstCtx.rbp = pa32Mem[7 - X86_GREG_xBP];
+            pVCpu->cpum.GstCtx.rdi = pau32Mem[7 - X86_GREG_xDI];
+            pVCpu->cpum.GstCtx.rsi = pau32Mem[7 - X86_GREG_xSI];
+            pVCpu->cpum.GstCtx.rbp = pau32Mem[7 - X86_GREG_xBP];
             /* skip esp */
-            pVCpu->cpum.GstCtx.rbx = pa32Mem[7 - X86_GREG_xBX];
-            pVCpu->cpum.GstCtx.rdx = pa32Mem[7 - X86_GREG_xDX];
-            pVCpu->cpum.GstCtx.rcx = pa32Mem[7 - X86_GREG_xCX];
-            pVCpu->cpum.GstCtx.rax = pa32Mem[7 - X86_GREG_xAX];
-            rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa32Mem, IEM_ACCESS_STACK_R);
+            pVCpu->cpum.GstCtx.rbx = pau32Mem[7 - X86_GREG_xBX];
+            pVCpu->cpum.GstCtx.rdx = pau32Mem[7 - X86_GREG_xDX];
+            pVCpu->cpum.GstCtx.rcx = pau32Mem[7 - X86_GREG_xCX];
+            pVCpu->cpum.GstCtx.rax = pau32Mem[7 - X86_GREG_xAX];
+            rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -583 +587 @@
     {
         GCPtrBottom--;
-        uint16_t *pa16Mem = NULL;
-        rcStrict = iemMemMap(pVCpu, (void **)&pa16Mem, 16, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa16Mem) - 1);
+        uint8_t   bUnmapInfo;
+        uint16_t *pau16Mem = NULL;
+        rcStrict = iemMemMap(pVCpu, (void **)&pau16Mem, &bUnmapInfo, 16, X86_SREG_SS, GCPtrBottom,
+                             IEM_ACCESS_STACK_W, sizeof(*pau16Mem) - 1);
         if (rcStrict == VINF_SUCCESS)
         {
-            pa16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
-            pa16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
-            pa16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
-            pa16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
-            pa16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
-            pa16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
-            pa16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
-            pa16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
-            rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pa16Mem, IEM_ACCESS_STACK_W);
+            pau16Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.di;
+            pau16Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.si;
+            pau16Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.bp;
+            pau16Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.sp;
+            pau16Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.bx;
+            pau16Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.dx;
+            pau16Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.cx;
+            pau16Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.ax;
+            rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -654 +660 @@
     {
         GCPtrBottom--;
-        uint32_t *pa32Mem;
-        rcStrict = iemMemMap(pVCpu, (void **)&pa32Mem, 32, X86_SREG_SS, GCPtrBottom, IEM_ACCESS_STACK_W, sizeof(*pa32Mem) - 1);
+        uint8_t   bUnmapInfo;
+        uint32_t *pau32Mem;
+        rcStrict = iemMemMap(pVCpu, (void **)&pau32Mem, &bUnmapInfo, 32, X86_SREG_SS, GCPtrBottom,
+                             IEM_ACCESS_STACK_W, sizeof(*pau32Mem) - 1);
         if (rcStrict == VINF_SUCCESS)
         {
-            pa32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
-            pa32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
-            pa32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
-            pa32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
-            pa32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
-            pa32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
-            pa32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
-            pa32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
-            rcStrict = iemMemCommitAndUnmap(pVCpu, pa32Mem, IEM_ACCESS_STACK_W);
+            pau32Mem[7 - X86_GREG_xDI] = pVCpu->cpum.GstCtx.edi;
+            pau32Mem[7 - X86_GREG_xSI] = pVCpu->cpum.GstCtx.esi;
+            pau32Mem[7 - X86_GREG_xBP] = pVCpu->cpum.GstCtx.ebp;
+            pau32Mem[7 - X86_GREG_xSP] = pVCpu->cpum.GstCtx.esp;
+            pau32Mem[7 - X86_GREG_xBX] = pVCpu->cpum.GstCtx.ebx;
+            pau32Mem[7 - X86_GREG_xDX] = pVCpu->cpum.GstCtx.edx;
+            pau32Mem[7 - X86_GREG_xCX] = pVCpu->cpum.GstCtx.ecx;
+            pau32Mem[7 - X86_GREG_xAX] = pVCpu->cpum.GstCtx.eax;
+            rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
             if (rcStrict == VINF_SUCCESS)
             {
@@ -1379 +1387 @@
         if (!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF) && (DescCS.Legacy.Gen.u2Dpl < IEM_GET_CPL(pVCpu)))
         {
-            uint16_t    offNewStack;    /* Offset of new stack in TSS. */
-            uint16_t    cbNewStack;     /* Number of bytes the stack information takes up in TSS. */
-            uint8_t     uNewCSDpl;
-            uint8_t     cbWords;
-            RTSEL       uNewSS;
-            RTSEL       uOldSS;
-            uint64_t    uOldRsp;
-            IEMSELDESC  DescSS;
-            RTPTRUNION  uPtrTSS;
-            RTGCPTR     GCPtrTSS;
-            RTPTRUNION  uPtrParmWds;
-            RTGCPTR     GCPtrParmWds;
-
             /* More privilege. This is the fun part. */
             Assert(!(DescCS.Legacy.Gen.u4Type & X86_SEL_TYPE_CONF));    /* Filtered out above. */
@@ -1401 +1396 @@
 
             /* Figure out where the new stack pointer is stored in the TSS. */
-            uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
+            uint8_t const uNewCSDpl = DescCS.Legacy.Gen.u2Dpl;
+            uint16_t      offNewStack;    /* Offset of new stack in TSS. */
+            uint16_t      cbNewStack;     /* Number of bytes the stack information takes up in TSS. */
             if (!IEM_IS_LONG_MODE(pVCpu))
             {
@@ -1430 +1427 @@
             }
 
-            GCPtrTSS = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
-            rcStrict = iemMemMap(pVCpu, &uPtrTSS.pv, cbNewStack, UINT8_MAX, GCPtrTSS, IEM_ACCESS_SYS_R, 0);
+            uint8_t     bUnmapInfo;
+            RTPTRUNION  uPtrTss;
+            RTGCPTR     GCPtrTss = pVCpu->cpum.GstCtx.tr.u64Base + offNewStack;
+            rcStrict = iemMemMap(pVCpu, &uPtrTss.pv, &bUnmapInfo, cbNewStack, UINT8_MAX, GCPtrTss, IEM_ACCESS_SYS_R, 0);
             if (rcStrict != VINF_SUCCESS)
             {
@@ -1438 +1437 @@
             }
 
+            RTSEL       uNewSS;
             if (!IEM_IS_LONG_MODE(pVCpu))
             {
                 if (pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_386_TSS_BUSY)
                 {
-                    uNewRsp = uPtrTSS.pu32[0];
-                    uNewSS  = uPtrTSS.pu16[2];
+                    uNewRsp = uPtrTss.pu32[0];
+                    uNewSS  = uPtrTss.pu16[2];
                 }
                 else
                 {
                     Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == X86_SEL_TYPE_SYS_286_TSS_BUSY);
-                    uNewRsp = uPtrTSS.pu16[0];
-                    uNewSS  = uPtrTSS.pu16[1];
+                    uNewRsp = uPtrTss.pu16[0];
+                    uNewSS  = uPtrTss.pu16[1];
                 }
             }
@@ -1456 +1456 @@
                 Assert(pVCpu->cpum.GstCtx.tr.Attr.n.u4Type == AMD64_SEL_TYPE_SYS_TSS_BUSY);
                 /* SS will be a NULL selector, but that's valid. */
-                uNewRsp = uPtrTSS.pu64[0];
+                uNewRsp = uPtrTss.pu64[0];
                 uNewSS  = uNewCSDpl;
             }
 
             /* Done with the TSS now. */
-            rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrTSS.pv, IEM_ACCESS_SYS_R);
+            rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
             if (rcStrict != VINF_SUCCESS)
             {
@@ -1469 +1469 @@
 
             /* Only used outside of long mode. */
-            cbWords = pDesc->Legacy.Gate.u5ParmCount;
+            uint8_t const cbWords = pDesc->Legacy.Gate.u5ParmCount;
 
             /* If EFER.LMA is 0, there's extra work to do. */
+            IEMSELDESC DescSS;
             if (!IEM_IS_LONG_MODE(pVCpu))
             {
@@ -1548 +1549 @@
 
             /* Remember the old SS:rSP and their linear address. */
-            uOldSS  = pVCpu->cpum.GstCtx.ss.Sel;
-            uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
-
-            GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
+            RTSEL const    uOldSS  = pVCpu->cpum.GstCtx.ss.Sel;
+            uint64_t const uOldRsp = pVCpu->cpum.GstCtx.ss.Attr.n.u1DefBig ? pVCpu->cpum.GstCtx.rsp : pVCpu->cpum.GstCtx.sp;
+
+            RTGCPTR const GCPtrParmWds = pVCpu->cpum.GstCtx.ss.u64Base + uOldRsp;
 
             /* HACK ALERT! Probe if the write to the new stack will succeed. May #SS(NewSS)
@@ -1560 +1561 @@
             void    *pvNewFrame;
             RTGCPTR  GCPtrNewStack = X86DESC_BASE(&DescSS.Legacy) + uNewRsp - cbNewStack;
-            rcStrict = iemMemMap(pVCpu, &pvNewFrame, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
+            rcStrict = iemMemMap(pVCpu, &pvNewFrame, &bUnmapInfo, cbNewStack, UINT8_MAX, GCPtrNewStack, IEM_ACCESS_SYS_RW, 0);
             if (rcStrict != VINF_SUCCESS)
             {
@@ -1566 +1567 @@
                 return rcStrict;
             }
-            rcStrict = iemMemCommitAndUnmap(pVCpu, pvNewFrame, IEM_ACCESS_SYS_RW);
+            rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
             if (rcStrict != VINF_SUCCESS)
             {
@@ -1587 +1588 @@
             /* At this point the stack access must not fail because new state was already committed. */
             /** @todo this can still fail due to SS.LIMIT not check.   */
+            uint8_t bUnmapInfoRet;
             rcStrict = iemMemStackPushBeginSpecial(pVCpu, cbNewStack,
                                                    IEM_IS_LONG_MODE(pVCpu) ? 7
                                                    : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 1,
-                                                   &uPtrRet.pv, &uNewRsp);
+                                                   &uPtrRet.pv, &bUnmapInfoRet, &uNewRsp);
             AssertMsgReturn(rcStrict == VINF_SUCCESS, ("BranchCallGate: New stack mapping failed (%Rrc)\n", VBOXSTRICTRC_VAL(rcStrict)),
                             VERR_INTERNAL_ERROR_5);
@@ -1601 +1603 @@
                     {
                         /* Map the relevant chunk of the old stack. */
-                        rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 4, UINT8_MAX, GCPtrParmWds,
+                        RTPTRUNION uPtrParmWds;
+                        rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, &bUnmapInfo, cbWords * 4, UINT8_MAX, GCPtrParmWds,
                                              IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
                         if (rcStrict != VINF_SUCCESS)
@@ -1614 +1617 @@
 
                         /* Unmap the old stack. */
-                        rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
+                        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
                         if (rcStrict != VINF_SUCCESS)
                         {
@@ -1637 +1640 @@
                     {
                         /* Map the relevant chunk of the old stack. */
-                        rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, cbWords * 2, UINT8_MAX, GCPtrParmWds,
+                        RTPTRUNION uPtrParmWds;
+                        rcStrict = iemMemMap(pVCpu, &uPtrParmWds.pv, &bUnmapInfo, cbWords * 2, UINT8_MAX, GCPtrParmWds,
                                              IEM_ACCESS_DATA_R, 0 /** @todo Can uNewCSDpl == 3? Then we need alignment mask here! */);
                         if (rcStrict != VINF_SUCCESS)
@@ -1650 +1654 @@
 
                         /* Unmap the old stack. */
-                        rcStrict = iemMemCommitAndUnmap(pVCpu, uPtrParmWds.pv, IEM_ACCESS_DATA_R);
+                        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
                         if (rcStrict != VINF_SUCCESS)
                         {
@@ -1678 +1682 @@
             }
 
-            rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
+            rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfoRet, uNewRsp);
             if (rcStrict != VINF_SUCCESS)
             {
@@ -1744 +1748 @@
             /** @todo check how gate size affects pushing of CS! Does callf 16:32 in
              *        16-bit code cause a two or four byte CS to be pushed? */
+            uint8_t bUnmapInfoRet;
             rcStrict = iemMemStackPushBeginSpecial(pVCpu,
                                                    IEM_IS_LONG_MODE(pVCpu) ? 8+8
@@ -1749 +1754 @@
                                                    IEM_IS_LONG_MODE(pVCpu) ? 7
                                                    : pDesc->Legacy.Gate.u4Type == X86_SEL_TYPE_SYS_386_CALL_GATE ? 3 : 2,
-                                                   &uPtrRet.pv, &uNewRsp);
+                                                   &uPtrRet.pv, &bUnmapInfoRet, &uNewRsp);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -1815 +1820 @@
             }
 
-            rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
+            rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfoRet, uNewRsp);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -2105 +2110 @@
     uint64_t        uNewRsp;
     RTPTRUNION      uPtrRet;
+    uint8_t         bUnmapInfo;
 
     /*
@@ -2119 +2125 @@
         rcStrict = iemMemStackPushBeginSpecial(pVCpu, enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
                                                enmEffOpSize == IEMMODE_32BIT ? 3 : 1,
-                                               &uPtrRet.pv, &uNewRsp);
+                                               &uPtrRet.pv, &bUnmapInfo, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2139 +2145 @@
             uPtrRet.pu16[2] = pVCpu->cpum.GstCtx.cs.Sel;
         }
-        rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
+        rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfo, uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2228 +2234 @@
                                            enmEffOpSize == IEMMODE_64BIT ? 8+8 : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 2+2,
                                            enmEffOpSize == IEMMODE_64BIT ? 7   : enmEffOpSize == IEMMODE_32BIT ? 3   : 1,
-                                           &uPtrRet.pv, &uNewRsp);
+                                           &uPtrRet.pv, &bUnmapInfo, &uNewRsp);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2290 +2296 @@
         uPtrRet.pu64[1] = pVCpu->cpum.GstCtx.cs.Sel; /** @todo Testcase: What is written to the high words when callf is pushing CS? */
     }
-    rcStrict = iemMemStackPushCommitSpecial(pVCpu, uPtrRet.pv, uNewRsp);
+    rcStrict = iemMemStackPushCommitSpecial(pVCpu, bUnmapInfo, uNewRsp);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -2325 +2331 @@
 IEM_CIMPL_DEF_2(iemCImpl_retf, IEMMODE, enmEffOpSize, uint16_t, cbPop)
 {
-    VBOXSTRICTRC    rcStrict;
+    NOREF(cbInstr);
+
+    /*
+     * Read the stack values first.
+     */
+    RTUINT64U       NewRsp;
+    uint8_t         bUnmapInfo;
     RTCPTRUNION     uPtrFrame;
-    RTUINT64U       NewRsp;
+    uint32_t        cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
+                             : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
+    VBOXSTRICTRC rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
+                                                       enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
+                                                       &uPtrFrame.pv, &bUnmapInfo, &NewRsp.u);
+    if (rcStrict != VINF_SUCCESS)
+        return rcStrict;
+
     uint64_t        uNewRip;
     uint16_t        uNewCs;
-    NOREF(cbInstr);
-
-    /*
-     * Read the stack values first.
-     */
-    uint32_t        cbRetPtr = enmEffOpSize == IEMMODE_16BIT ? 2+2
-                             : enmEffOpSize == IEMMODE_32BIT ? 4+4 : 8+8;
-    rcStrict = iemMemStackPopBeginSpecial(pVCpu, cbRetPtr,
-                                          enmEffOpSize == IEMMODE_16BIT ? 1 : enmEffOpSize == IEMMODE_32BIT ? 3 : 7,
-                                          &uPtrFrame.pv, &NewRsp.u);
-    if (rcStrict != VINF_SUCCESS)
-        return rcStrict;
     if (enmEffOpSize == IEMMODE_16BIT)
     {
@@ -2357 +2364 @@
         uNewCs  = uPtrFrame.pu16[4];
     }
-    rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
+
+    rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
     if (RT_LIKELY(rcStrict == VINF_SUCCESS))
     { /* extremely likely */ }
@@ -2464 +2472 @@
     {
         /* Read the outer stack pointer stored *after* the parameters. */
-        rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, NewRsp.u);
+        rcStrict = iemMemStackPopContinueSpecial(pVCpu, cbPop /*off*/, cbRetPtr, &uPtrFrame.pv, &bUnmapInfo, NewRsp.u);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -2485 +2493 @@
             uNewOuterSs   = uPtrFrame.pu16[4];
         }
-        rcStrict = iemMemStackPopDoneSpecial(pVCpu, uPtrFrame.pv);
+        rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
         if (RT_LIKELY(rcStrict == VINF_SUCCESS))
         { /* extremely likely */ }
@@ -3103 +3111 @@
     Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
     VBOXSTRICTRC    rcStrict;
+    uint8_t         bUnmapInfo;
     RTCPTRUNION     uFrame;
     uint16_t        uNewCs;
@@ -3110 +3119 @@
     if (enmEffOpSize == IEMMODE_32BIT)
     {
-        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3129 +3138 @@
     else
     {
-        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3144 +3153 @@
             uNewFlags &= ~(X86_EFL_NT | X86_EFL_IOPL);
     }
-    rcStrict = iemMemStackPopDoneSpecial(pVCpu, uFrame.pv);
+    rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo);
     if (RT_LIKELY(rcStrict == VINF_SUCCESS))
     { /* extremely likely */ }
@@ -3251 +3260 @@
      * Pop the V8086 specific frame bits off the stack.
      */
-    VBOXSTRICTRC    rcStrict;
-    RTCPTRUNION     uFrame;
-    rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 24 /*cbMem*/, &uFrame.pv, uNewRsp);
+    uint8_t      bUnmapInfo;
+    RTCPTRUNION  uFrame;
+    VBOXSTRICTRC rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 24 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -3262 +3271 @@
     uint16_t uNewFs  = uFrame.pu32[4];
     uint16_t uNewGs  = uFrame.pu32[5];
-    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R); /* don't use iemMemStackPopCommitSpecial here. */
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -3382 +3391 @@
      */
     Assert(enmEffOpSize == IEMMODE_32BIT || enmEffOpSize == IEMMODE_16BIT);
+    uint8_t         bUnmapInfo;
     VBOXSTRICTRC    rcStrict;
     RTCPTRUNION     uFrame;
@@ -3390 +3400 @@
     if (enmEffOpSize == IEMMODE_32BIT)
     {
-        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 12, 3, &uFrame.pv, &bUnmapInfo, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3399 +3409 @@
     else
     {
-        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 6, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3406 +3416 @@
         uNewFlags  = uFrame.pu16[2];
     }
-    rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
+    rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
     if (RT_LIKELY(rcStrict == VINF_SUCCESS))
     { /* extremely likely */ }
@@ -3491 +3501 @@
         if (enmEffOpSize == IEMMODE_32BIT)
         {
-            rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0/*off*/, 8 /*cbMem*/, &uFrame.pv, uNewRsp);
+            rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0/*off*/, 8 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3502 +3512 @@
         else
         {
-            rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 4 /*cbMem*/, &uFrame.pv, uNewRsp);
+            rcStrict = iemMemStackPopContinueSpecial(pVCpu, 0 /*off*/, 4 /*cbMem*/, &uFrame.pv, &bUnmapInfo, uNewRsp);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -3508 +3518 @@
             uNewSS  = uFrame.pu16[1];
         }
-        rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uFrame.pv, IEM_ACCESS_STACK_R);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3737 +3747 @@
      */
     VBOXSTRICTRC    rcStrict;
+    uint8_t         bUnmapInfo;
     RTCPTRUNION     uFrame;
     uint64_t        uNewRip;
@@ -3745 +3756 @@
     if (enmEffOpSize == IEMMODE_64BIT)
     {
-        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*8, 7, &uFrame.pv, &bUnmapInfo, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3756 +3767 @@
     else if (enmEffOpSize == IEMMODE_32BIT)
     {
-        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*4, 3, &uFrame.pv, &bUnmapInfo, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3768 +3779 @@
     {
         Assert(enmEffOpSize == IEMMODE_16BIT);
-        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &uNewRsp);
+        rcStrict = iemMemStackPopBeginSpecial(pVCpu, 5*2, 1, &uFrame.pv, &bUnmapInfo, &uNewRsp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -3777 +3788 @@
         uNewSs     = uFrame.pu16[4];
     }
-    rcStrict = iemMemStackPopDoneSpecial(pVCpu, (void *)uFrame.pv); /* don't use iemMemStackPopCommitSpecial here. */
+    rcStrict = iemMemStackPopDoneSpecial(pVCpu, bUnmapInfo); /* don't use iemMemStackPopCommitSpecial here. */
     if (RT_LIKELY(rcStrict == VINF_SUCCESS))
     { /* extremely like */ }
@@ -4152 +4163 @@
     }
 
-    uint8_t const *pbMem = NULL;
-    uint16_t const *pa16Mem;
-    uint8_t const *pa8Mem;
-    RTGCPHYS GCPtrStart = 0x800;    /* Fixed table location. */
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
+    uint8_t        bUnmapInfo;
+    uint8_t const *pbMem      = NULL;
+    RTGCPHYS       GCPtrStart = 0x800;    /* Fixed table location. */
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&pbMem, &bUnmapInfo, 0x66, UINT8_MAX, GCPtrStart, IEM_ACCESS_SYS_R, 0);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
 
     /* The MSW is at offset 0x06. */
-    pa16Mem = (uint16_t const *)(pbMem + 0x06);
+    uint16_t const *pau16Mem = (uint16_t const *)(pbMem + 0x06);
     /* Even LOADALL can't clear the MSW.PE bit, though it can set it. */
     uint64_t uNewCr0 = pVCpu->cpum.GstCtx.cr0 & ~(X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
-    uNewCr0 |= *pa16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
+    uNewCr0 |= *pau16Mem & (X86_CR0_PE | X86_CR0_MP | X86_CR0_EM | X86_CR0_TS);
     uint64_t const uOldCr0 = pVCpu->cpum.GstCtx.cr0;
 
@@ -4181 +4191 @@
 
     /* TR selector is at offset 0x16. */
-    pa16Mem = (uint16_t const *)(pbMem + 0x16);
-    pVCpu->cpum.GstCtx.tr.Sel      = pa16Mem[0];
-    pVCpu->cpum.GstCtx.tr.ValidSel = pa16Mem[0];
+    pau16Mem = (uint16_t const *)(pbMem + 0x16);
+    pVCpu->cpum.GstCtx.tr.Sel      = pau16Mem[0];
+    pVCpu->cpum.GstCtx.tr.ValidSel = pau16Mem[0];
     pVCpu->cpum.GstCtx.tr.fFlags   = CPUMSELREG_FLAGS_VALID;
 
     /* Followed by FLAGS... */
-    pVCpu->cpum.GstCtx.eflags.u = pa16Mem[1] | X86_EFL_1;
-    pVCpu->cpum.GstCtx.ip       = pa16Mem[2];   /* ...and IP. */
+    pVCpu->cpum.GstCtx.eflags.u = pau16Mem[1] | X86_EFL_1;
+    pVCpu->cpum.GstCtx.ip       = pau16Mem[2];   /* ...and IP. */
 
     /* LDT is at offset 0x1C. */
-    pa16Mem = (uint16_t const *)(pbMem + 0x1C);
-    pVCpu->cpum.GstCtx.ldtr.Sel      = pa16Mem[0];
-    pVCpu->cpum.GstCtx.ldtr.ValidSel = pa16Mem[0];
+    pau16Mem = (uint16_t const *)(pbMem + 0x1C);
+    pVCpu->cpum.GstCtx.ldtr.Sel      = pau16Mem[0];
+    pVCpu->cpum.GstCtx.ldtr.ValidSel = pau16Mem[0];
     pVCpu->cpum.GstCtx.ldtr.fFlags   = CPUMSELREG_FLAGS_VALID;
 
     /* Segment registers are at offset 0x1E. */
-    pa16Mem = (uint16_t const *)(pbMem + 0x1E);
-    iemLoadallSetSelector(pVCpu, X86_SREG_DS, pa16Mem[0]);
-    iemLoadallSetSelector(pVCpu, X86_SREG_SS, pa16Mem[1]);
-    iemLoadallSetSelector(pVCpu, X86_SREG_CS, pa16Mem[2]);
-    iemLoadallSetSelector(pVCpu, X86_SREG_ES, pa16Mem[3]);
+    pau16Mem = (uint16_t const *)(pbMem + 0x1E);
+    iemLoadallSetSelector(pVCpu, X86_SREG_DS, pau16Mem[0]);
+    iemLoadallSetSelector(pVCpu, X86_SREG_SS, pau16Mem[1]);
+    iemLoadallSetSelector(pVCpu, X86_SREG_CS, pau16Mem[2]);
+    iemLoadallSetSelector(pVCpu, X86_SREG_ES, pau16Mem[3]);
 
     /* GPRs are at offset 0x26. */
-    pa16Mem = (uint16_t const *)(pbMem + 0x26);
-    pVCpu->cpum.GstCtx.di = pa16Mem[0];
-    pVCpu->cpum.GstCtx.si = pa16Mem[1];
-    pVCpu->cpum.GstCtx.bp = pa16Mem[2];
-    pVCpu->cpum.GstCtx.sp = pa16Mem[3];
-    pVCpu->cpum.GstCtx.bx = pa16Mem[4];
-    pVCpu->cpum.GstCtx.dx = pa16Mem[5];
-    pVCpu->cpum.GstCtx.cx = pa16Mem[6];
-    pVCpu->cpum.GstCtx.ax = pa16Mem[7];
+    pau16Mem = (uint16_t const *)(pbMem + 0x26);
+    pVCpu->cpum.GstCtx.di = pau16Mem[0];
+    pVCpu->cpum.GstCtx.si = pau16Mem[1];
+    pVCpu->cpum.GstCtx.bp = pau16Mem[2];
+    pVCpu->cpum.GstCtx.sp = pau16Mem[3];
+    pVCpu->cpum.GstCtx.bx = pau16Mem[4];
+    pVCpu->cpum.GstCtx.dx = pau16Mem[5];
+    pVCpu->cpum.GstCtx.cx = pau16Mem[6];
+    pVCpu->cpum.GstCtx.ax = pau16Mem[7];
 
     /* Descriptor caches are at offset 0x36, 6 bytes per entry. */
@@ -4221 +4231 @@
 
     /* GDTR contents are at offset 0x4E, 6 bytes. */
-    RTGCPHYS GCPtrBase;
-    uint16_t cbLimit;
-    pa8Mem = pbMem + 0x4E;
+    uint8_t const *pau8Mem = pbMem + 0x4E;
     /* NB: Fourth byte "should be zero"; we are ignoring it. */
-    GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
-    cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
+    RTGCPHYS GCPtrBase = pau8Mem[0] + ((uint32_t)pau8Mem[1] << 8) + ((uint32_t)pau8Mem[2] << 16);
+    uint16_t cbLimit   = pau8Mem[4] + ((uint32_t)pau8Mem[5] << 8);
     CPUMSetGuestGDTR(pVCpu, GCPtrBase, cbLimit);
 
     /* IDTR contents are at offset 0x5A, 6 bytes. */
-    pa8Mem = pbMem + 0x5A;
-    GCPtrBase = pa8Mem[0] + (pa8Mem[1] << 8) + (pa8Mem[2] << 16);
-    cbLimit = pa8Mem[4] + (pa8Mem[5] << 8);
+    pau8Mem   = pbMem + 0x5A;
+    GCPtrBase = pau8Mem[0] + ((uint32_t)pau8Mem[1] << 8) + ((uint32_t)pau8Mem[2] << 16);
+    cbLimit   = pau8Mem[4] + ((uint32_t)pau8Mem[5] << 8);
     CPUMSetGuestIDTR(pVCpu, GCPtrBase, cbLimit);
 
@@ -4242 +4250 @@
     Log(("LOADALL: SI:%04X, DI:%04X, AX:%04X, BX:%04X, CX:%04X, DX:%04X\n", pVCpu->cpum.GstCtx.si, pVCpu->cpum.GstCtx.di, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.bx, pVCpu->cpum.GstCtx.cx, pVCpu->cpum.GstCtx.dx));
 
-    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pbMem, IEM_ACCESS_SYS_R);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -5731 +5739 @@
      *       assembly and such.
      */
-    void *pvDesc;
-    rcStrict = iemMemMap(pVCpu, &pvDesc, 8, UINT8_MAX, pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL),
-                         IEM_ACCESS_DATA_RW, 0);
+    uint8_t bUnmapInfo;
+    void   *pvDesc;
+    rcStrict = iemMemMap(pVCpu, &pvDesc, &bUnmapInfo, 8, UINT8_MAX,
+                         pVCpu->cpum.GstCtx.gdtr.pGdt + (uNewTr & X86_SEL_MASK_OFF_RPL), IEM_ACCESS_DATA_RW, 0);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -5743 +5752 @@
         case 3: ASMAtomicBitSet((uint8_t *)pvDesc + 1, 40 + 1 -  8); break;
     }
-    rcStrict = iemMemCommitAndUnmap(pVCpu, pvDesc, IEM_ACCESS_DATA_RW);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -8161 +8170 @@
                             if (cbToMap > 512)
                                 cbToMap = 512;
+                            uint8_t      bUnmapInfo;
                             void        *pvSrc    = NULL;
-                            VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvSrc, cbToMap, UINT8_MAX, GCPtrSrc, IEM_ACCESS_DATA_R, 0);
+                            VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvSrc, &bUnmapInfo, cbToMap,
+                                                              UINT8_MAX, GCPtrSrc, IEM_ACCESS_DATA_R, 0);
                             if (rcStrict == VINF_SUCCESS)
                             {
                                 RTLogBulkNestedWrite(pLogger, (const char *)pvSrc, cbToMap, "Gst:");
-                                rcStrict = iemMemCommitAndUnmap(pVCpu, pvSrc, IEM_ACCESS_DATA_R);
+                                rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
                                 AssertRCSuccessReturn(VBOXSTRICTRC_VAL(rcStrict), rcStrict);
                             }
@@ -8654 +8665 @@
  * Implements 'CMPXCHG16B' fallback using rendezvous.
  */
-IEM_CIMPL_DEF_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
-                PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags)
+IEM_CIMPL_DEF_5(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
+                PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags, uint8_t, bUnmapInfo)
 {
 # ifdef IN_RING3
@@ -8672 +8683 @@
     {
         /* Duplicated tail code. */
-        rcStrict = iemMemCommitAndUnmap(pVCpu, pu128Dst, IEM_ACCESS_DATA_RW);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -8686 +8697 @@
     return rcStrict;
 # else
-    RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags);
+    RT_NOREF(pVCpu, cbInstr, pu128Dst, pu128RaxRdx, pu128RbxRcx, pEFlags, bUnmapInfo);
     return VERR_IEM_ASPECT_NOT_IMPLEMENTED; /* This should get us to ring-3 for now.  Should perhaps be replaced later. */
 # endif
@@ -8818 +8829 @@
      * Access the memory.
      */
-    void *pvMem512;
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
+    uint8_t bUnmapInfo;
+    void   *pvMem512;
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfo, 512,
+                                      iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
                                       15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
     if (rcStrict != VINF_SUCCESS)
@@ -8881 +8894 @@
      * Commit the memory.
      */
-    rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -8911 +8924 @@
      * Access the memory.
      */
-    void *pvMem512;
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
+    uint8_t bUnmapInfo;
+    void   *pvMem512;
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfo, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
                                       15 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
     if (rcStrict != VINF_SUCCESS)
@@ -8998 +9012 @@
      * Unmap the memory.
      */
-    rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -9051 +9065 @@
      */
     /* The x87+SSE state.  */
-    void *pvMem512;
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
+    uint8_t bUnmapInfoMem512;
+    void   *pvMem512;
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfoMem512, 512,
+                                      iEffSeg, GCPtrEff, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
                                       63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
     if (rcStrict != VINF_SUCCESS)
@@ -9060 +9076 @@
 
     /* The header.  */
+    uint8_t      bUnmapInfoHdr;
     PX86XSAVEHDR pHdr;
-    rcStrict = iemMemMap(pVCpu, (void **)&pHdr, sizeof(&pHdr), iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
+    rcStrict = iemMemMap(pVCpu, (void **)&pHdr, &bUnmapInfoHdr, sizeof(pHdr),
+                         iEffSeg, GCPtrEff + 512, IEM_ACCESS_DATA_RW, 0 /* checked above */);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -9119 +9137 @@
 
     /* Commit the x87 state bits. (probably wrong) */
-    rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoMem512);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -9130 +9148 @@
         /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
         AssertLogRelReturn(pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT] != UINT16_MAX, VERR_IEM_IPE_9);
+        uint8_t         bUnmapInfoComp;
         PCX86XSAVEYMMHI pCompSrc = CPUMCTX_XSAVE_C_PTR(IEM_GET_CTX(pVCpu), XSAVE_C_YMM_BIT, PCX86XSAVEYMMHI);
         PX86XSAVEYMMHI  pCompDst;
-        rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, sizeof(*pCompDst), iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
+        rcStrict = iemMemMap(pVCpu, (void **)&pCompDst, &bUnmapInfoComp, sizeof(*pCompDst), iEffSeg,
+                             GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
                              IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 0 /* checked above */);
         if (rcStrict != VINF_SUCCESS)
@@ -9141 +9161 @@
             pCompDst->aYmmHi[i] = pCompSrc->aYmmHi[i];
 
-        rcStrict = iemMemCommitAndUnmap(pVCpu, pCompDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
+        rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoComp);
         if (rcStrict != VINF_SUCCESS)
             return rcStrict;
@@ -9152 +9172 @@
                    | (fReqComponents & fXInUse);
 
-    rcStrict = iemMemCommitAndUnmap(pVCpu, pHdr, IEM_ACCESS_DATA_RW);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoHdr);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -9207 +9227 @@
      */
     /* The x87+SSE state.  */
-    void *pvMem512;
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
+    uint8_t bUnmapInfoMem512;
+    void   *pvMem512;
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &pvMem512, &bUnmapInfoMem512, 512, iEffSeg, GCPtrEff, IEM_ACCESS_DATA_R,
                                       63 | IEM_MEMMAP_F_ALIGN_GP | IEM_MEMMAP_F_ALIGN_GP_OR_AC);
     if (rcStrict != VINF_SUCCESS)
@@ -9218 +9239 @@
      * Calc the requested mask
      */
+    uint8_t       bUnmapInfoHdr;
     PX86XSAVEHDR  pHdrDst = &pVCpu->cpum.GstCtx.XState.Hdr;
     PCX86XSAVEHDR pHdrSrc;
-    rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512,
+    rcStrict = iemMemMap(pVCpu, (void **)&pHdrSrc, &bUnmapInfoHdr, sizeof(&pHdrSrc), iEffSeg, GCPtrEff + 512,
                          IEM_ACCESS_DATA_R, 0 /* checked above */);
     if (rcStrict != VINF_SUCCESS)
@@ -9236 +9258 @@
 
     /* We won't need this any longer. */
-    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pHdrSrc, IEM_ACCESS_DATA_R);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoHdr);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -9335 +9357 @@
 
     /* Unmap the x87 state bits (so we've don't run out of mapping). */
-    rcStrict = iemMemCommitAndUnmap(pVCpu, pvMem512, IEM_ACCESS_DATA_R);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoMem512);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -9350 +9372 @@
         {
             /** @todo testcase: xsave64 vs xsave32 wrt XSAVE_C_YMM. */
+            uint8_t         bUnmapInfoComp;
             PCX86XSAVEYMMHI pCompSrc;
-            rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, sizeof(*pCompDst),
+            rcStrict = iemMemMap(pVCpu, (void **)&pCompSrc, &bUnmapInfoComp, sizeof(*pCompDst),
                                  iEffSeg, GCPtrEff + pVCpu->cpum.GstCtx.aoffXState[XSAVE_C_YMM_BIT],
                                  IEM_ACCESS_DATA_R, 0 /* checked above */);
@@ -9363 +9386 @@
             }
 
-            rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)pCompSrc, IEM_ACCESS_DATA_R);
+            rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfoComp);
             if (rcStrict != VINF_SUCCESS)
                 return rcStrict;
@@ -9652 +9675 @@
 IEM_CIMPL_DEF_3(iemCImpl_fnstenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffDst)
 {
+    uint8_t      bUnmapInfo;
     RTPTRUNION   uPtr;
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
                                       iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE,
                                       enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ? */);
@@ -9661 +9685 @@
     iemCImplCommonFpuStoreEnv(pVCpu, enmEffOpSize, uPtr);
 
-    rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -9696 +9720 @@
     IEM_CTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_X87);
 
+    uint8_t      bUnmapInfo;
     RTPTRUNION   uPtr;
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, &uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
                                       iEffSeg, GCPtrEffDst, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE, 3 /** @todo ? */);
     if (rcStrict != VINF_SUCCESS)
@@ -9712 +9737 @@
     }
 
-    rcStrict = iemMemCommitAndUnmap(pVCpu, uPtr.pv, IEM_ACCESS_DATA_W | IEM_ACCESS_PARTIAL_WRITE);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -9748 +9773 @@
 IEM_CIMPL_DEF_3(iemCImpl_fldenv, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
 {
+    uint8_t      bUnmapInfo;
     RTCPTRUNION  uPtr;
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 14 : 28,
                                       iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R,
                                       enmEffOpSize == IEMMODE_16BIT ? 1 : 3 /** @todo ?*/);
@@ -9757 +9783 @@
     iemCImplCommonFpuRestoreEnv(pVCpu, enmEffOpSize, uPtr);
 
-    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;
@@ -9775 +9801 @@
 IEM_CIMPL_DEF_3(iemCImpl_frstor, IEMMODE, enmEffOpSize, uint8_t, iEffSeg, RTGCPTR, GCPtrEffSrc)
 {
+    uint8_t      bUnmapInfo;
     RTCPTRUNION  uPtr;
-    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
+    VBOXSTRICTRC rcStrict = iemMemMap(pVCpu, (void **)&uPtr.pv, &bUnmapInfo, enmEffOpSize == IEMMODE_16BIT ? 94 : 108,
                                       iEffSeg, GCPtrEffSrc, IEM_ACCESS_DATA_R, 3 /** @todo ?*/ );
     if (rcStrict != VINF_SUCCESS)
@@ -9792 +9819 @@
     }
 
-    rcStrict = iemMemCommitAndUnmap(pVCpu, (void *)uPtr.pv, IEM_ACCESS_DATA_R);
+    rcStrict = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
     if (rcStrict != VINF_SUCCESS)
         return rcStrict;

trunk/src/VBox/VMM/VMMAll/IEMAllCImplStrInstr.cpp.h

@@ -1212 +1212 @@
 #endif
 
+    uint8_t         bUnmapInfo;
     OP_TYPE        *puMem;
-    rcStrict = iemMemMap(pVCpu, (void **)&puMem, OP_SIZE / 8, X86_SREG_ES, pVCpu->cpum.GstCtx.ADDR_rDI,
+    rcStrict = iemMemMap(pVCpu, (void **)&puMem, &bUnmapInfo, OP_SIZE / 8, X86_SREG_ES, pVCpu->cpum.GstCtx.ADDR_rDI,
                          IEM_ACCESS_DATA_W, OP_SIZE / 8 - 1);
     if (rcStrict != VINF_SUCCESS)
@@ -1227 +1228 @@
         *puMem = (OP_TYPE)u32Value;
 # ifdef IN_RING3
-        VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pVCpu, puMem, IEM_ACCESS_DATA_W);
+        VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
 # else
-        VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pVCpu, puMem, IEM_ACCESS_DATA_W);
+        VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pVCpu, bUnmapInfo);
 # endif
         if (RT_LIKELY(rcStrict2 == VINF_SUCCESS))
@@ -1417 +1418 @@
         do
         {
+            uint8_t  bUnmapInfo;
             OP_TYPE *puMem;
-            rcStrict = iemMemMap(pVCpu, (void **)&puMem, OP_SIZE / 8, X86_SREG_ES, uAddrReg,
+            rcStrict = iemMemMap(pVCpu, (void **)&puMem, &bUnmapInfo, OP_SIZE / 8, X86_SREG_ES, uAddrReg,
                                  IEM_ACCESS_DATA_W, OP_SIZE / 8 - 1);
             if (rcStrict != VINF_SUCCESS)
@@ -1433 +1435 @@
             *puMem = (OP_TYPE)u32Value;
 # ifdef IN_RING3
-            VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pVCpu, puMem, IEM_ACCESS_DATA_W);
+            VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
 # else
-            VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pVCpu, puMem, IEM_ACCESS_DATA_W);
+            VBOXSTRICTRC rcStrict2 = iemMemCommitAndUnmapPostponeTroubleToR3(pVCpu, bUnmapInfo);
 # endif
             if (rcStrict2 == VINF_SUCCESS)

trunk/src/VBox/VMM/VMMAll/IEMAllInstTwoByte0f.cpp.h

@@ -12481 +12481 @@
          * the patterns IEMAllThrdPython.py requires for the code morphing.
          */
-#define BODY_CMPXCHG16B_HEAD \
-            IEM_MC_BEGIN(4, 4, IEM_MC_F_64BIT, 0); \
+#define BODY_CMPXCHG16B_HEAD(bUnmapInfoStmt) \
+            IEM_MC_BEGIN(5, 4, IEM_MC_F_64BIT, 0); \
             IEM_MC_LOCAL(RTGCPTR,               GCPtrEffDst); \
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
@@ -12488 +12488 @@
             \
             IEM_MC_RAISE_GP0_IF_EFF_ADDR_UNALIGNED(GCPtrEffDst, 16); \
-            IEM_MC_LOCAL(uint8_t,               bUnmapInfo); \
+            bUnmapInfoStmt; \
             IEM_MC_ARG(PRTUINT128U,             pu128MemDst,                0); \
             IEM_MC_MEM_MAP_U128_RW(pu128MemDst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
@@ -12518 +12518 @@
                 && (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
             {
-                BODY_CMPXCHG16B_HEAD;
+                BODY_CMPXCHG16B_HEAD(IEM_MC_LOCAL(uint8_t, bUnmapInfo));
                 IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg16b_locked, pu128MemDst, pu128RaxRdx, pu128RbxRcx, pEFlags);
                 BODY_CMPXCHG16B_TAIL;
@@ -12524 +12524 @@
             else
             {
-                BODY_CMPXCHG16B_HEAD;
+                BODY_CMPXCHG16B_HEAD(IEM_MC_LOCAL(uint8_t, bUnmapInfo));
                 IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg16b, pu128MemDst, pu128RaxRdx, pu128RbxRcx, pEFlags);
                 BODY_CMPXCHG16B_TAIL;
@@ -12533 +12533 @@
             if (pVCpu->CTX_SUFF(pVM)->cCpus == 1)
             {
-                BODY_CMPXCHG16B_HEAD;
+                BODY_CMPXCHG16B_HEAD(IEM_MC_LOCAL(uint8_t, bUnmapInfo));
                 IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg16b_fallback, pu128MemDst, pu128RaxRdx, pu128RbxRcx, pEFlags);
                 BODY_CMPXCHG16B_TAIL;
@@ -12539 +12539 @@
             else
             {
-                BODY_CMPXCHG16B_HEAD;
-                IEM_MC_CALL_CIMPL_4(IEM_CIMPL_F_STATUS_FLAGS,
+                BODY_CMPXCHG16B_HEAD(IEM_MC_ARG(uint8_t, bUnmapInfo, 4));
+                IEM_MC_CALL_CIMPL_5(IEM_CIMPL_F_STATUS_FLAGS,
                                       RT_BIT_64(kIemNativeGstReg_GprFirst + X86_GREG_xAX)
                                     | RT_BIT_64(kIemNativeGstReg_GprFirst + X86_GREG_xDX),
-                                    iemCImpl_cmpxchg16b_fallback_rendezvous, pu128MemDst, pu128RaxRdx, pu128RbxRcx, pEFlags);
+                                    iemCImpl_cmpxchg16b_fallback_rendezvous, pu128MemDst, pu128RaxRdx, pu128RbxRcx,
+                                                                             pEFlags, bUnmapInfo);
                 IEM_MC_END();
             }
@@ -12552 +12553 @@
         if (!(pVCpu->iem.s.fPrefixes & IEM_OP_PRF_LOCK))
         {
-            BODY_CMPXCHG16B_HEAD;
+            BODY_CMPXCHG16B_HEAD(IEM_MC_LOCAL(uint8_t, bUnmapInfo));
             IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg16b, pu128MemDst, pu128RaxRdx, pu128RbxRcx, pEFlags);
             BODY_CMPXCHG16B_TAIL;
@@ -12558 +12559 @@
         else
         {
-            BODY_CMPXCHG16B_HEAD;
+            BODY_CMPXCHG16B_HEAD(IEM_MC_LOCAL(uint8_t, bUnmapInfo));
             IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg16b_locked, pu128MemDst, pu128RaxRdx, pu128RbxRcx, pEFlags);
             BODY_CMPXCHG16B_TAIL;
@@ -12570 +12571 @@
         if (pVCpu->CTX_SUFF(pVM)->cCpus == 1)
         {
-            BODY_CMPXCHG16B_HEAD;
+            BODY_CMPXCHG16B_HEAD(IEM_MC_LOCAL(uint8_t, bUnmapInfo));
             IEM_MC_CALL_VOID_AIMPL_4(iemAImpl_cmpxchg16b_fallback, pu128MemDst, pu128RaxRdx, pu128RbxRcx, pEFlags);
             BODY_CMPXCHG16B_TAIL;
@@ -12576 +12577 @@
         else
         {
-            BODY_CMPXCHG16B_HEAD;
+            BODY_CMPXCHG16B_HEAD(IEM_MC_ARG(uint8_t, bUnmapInfo, 4));
             IEM_MC_CALL_CIMPL_4(IEM_CIMPL_F_STATUS_FLAGS,
                                   RT_BIT_64(kIemNativeGstReg_GprFirst + X86_GREG_xAX)

trunk/src/VBox/VMM/VMMAll/IEMAllMemRWTmpl.cpp.h

@@ -55 +55 @@
 {
     /* The lazy approach for now... */
+    uint8_t              bUnmapInfo;
     TMPL_MEM_TYPE const *puSrc;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puSrc, sizeof(*puSrc), iSegReg, GCPtrMem,
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puSrc, &bUnmapInfo, sizeof(*puSrc), iSegReg, GCPtrMem,
                                 IEM_ACCESS_DATA_R, TMPL_MEM_TYPE_ALIGN);
     if (rc == VINF_SUCCESS)
     {
         *puDst = *puSrc;
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)puSrc, IEM_ACCESS_DATA_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
         Log2(("IEM RD " TMPL_MEM_FMT_DESC " %d|%RGv: " TMPL_MEM_FMT_TYPE "\n", iSegReg, GCPtrMem, *puDst));
     }
@@ -79 +80 @@
     pVCpu->iem.s.DataTlb.cTlbSafeReadPath++;
 #  endif
-    TMPL_MEM_TYPE const *pSrc = (TMPL_MEM_TYPE const *)iemMemMapJmp(pVCpu, sizeof(*pSrc), iSegReg, GCPtrMem,
+    uint8_t              bUnmapInfo;
+    TMPL_MEM_TYPE const *pSrc = (TMPL_MEM_TYPE const *)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*pSrc), iSegReg, GCPtrMem,
                                                                     IEM_ACCESS_DATA_R, TMPL_MEM_TYPE_ALIGN);
     *pDst = *pSrc;
-    iemMemCommitAndUnmapJmp(pVCpu, (void *)pSrc, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
     Log2(("IEM RD " TMPL_MEM_FMT_DESC " %d|%RGv: " TMPL_MEM_FMT_TYPE "\n", iSegReg, GCPtrMem, pDst));
 }
@@ -92 +94 @@
     pVCpu->iem.s.DataTlb.cTlbSafeReadPath++;
 #  endif
-    TMPL_MEM_TYPE const *puSrc = (TMPL_MEM_TYPE const *)iemMemMapJmp(pVCpu, sizeof(*puSrc), iSegReg, GCPtrMem,
+    uint8_t              bUnmapInfo;
+    TMPL_MEM_TYPE const *puSrc = (TMPL_MEM_TYPE const *)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*puSrc), iSegReg, GCPtrMem,
                                                                      IEM_ACCESS_DATA_R, TMPL_MEM_TYPE_ALIGN);
     TMPL_MEM_TYPE const  uRet = *puSrc;
-    iemMemCommitAndUnmapJmp(pVCpu, (void *)puSrc, IEM_ACCESS_DATA_R);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
     Log2(("IEM RD " TMPL_MEM_FMT_DESC " %d|%RGv: " TMPL_MEM_FMT_TYPE "\n", iSegReg, GCPtrMem, uRet));
     return uRet;
@@ -118 +121 @@
 {
     /* The lazy approach for now... */
+    uint8_t        bUnmapInfo;
     TMPL_MEM_TYPE *puDst;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puDst, sizeof(*puDst), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W, TMPL_MEM_TYPE_ALIGN);
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puDst, &bUnmapInfo, sizeof(*puDst),
+                                iSegReg, GCPtrMem, IEM_ACCESS_DATA_W, TMPL_MEM_TYPE_ALIGN);
     if (rc == VINF_SUCCESS)
     {
@@ -127 +132 @@
         *puDst = uValue;
 #endif
-        rc = iemMemCommitAndUnmap(pVCpu, puDst, IEM_ACCESS_DATA_W);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
 #ifdef TMPL_MEM_BY_REF
         Log6(("IEM WR " TMPL_MEM_FMT_DESC " %d|%RGv: " TMPL_MEM_FMT_TYPE "\n", iSegReg, GCPtrMem, pValue));
@@ -163 +168 @@
     Log6(("IEM WR " TMPL_MEM_FMT_DESC " %d|%RGv: " TMPL_MEM_FMT_TYPE "\n", iSegReg, GCPtrMem, uValue));
 #endif
-    TMPL_MEM_TYPE *puDst = (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, sizeof(*puDst), iSegReg, GCPtrMem,
+    uint8_t        bUnmapInfo;
+    TMPL_MEM_TYPE *puDst = (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*puDst), iSegReg, GCPtrMem,
                                                          IEM_ACCESS_DATA_W, TMPL_MEM_TYPE_ALIGN);
 #ifdef TMPL_MEM_BY_REF
@@ -170 +176 @@
     *puDst = uValue;
 #endif
-    iemMemCommitAndUnmapJmp(pVCpu, puDst, IEM_ACCESS_DATA_W);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
 }
 #endif /* IEM_WITH_SETJMP */
@@ -196 +202 @@
     Log8(("IEM RW/map " TMPL_MEM_FMT_DESC " %d|%RGv\n", iSegReg, GCPtrMem));
     *pbUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ  | IEM_ACCESS_TYPE_WRITE) << 4); /* zero is for the TLB hit */
-    return (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, sizeof(TMPL_MEM_TYPE), iSegReg, GCPtrMem, IEM_ACCESS_DATA_RW, TMPL_MEM_TYPE_ALIGN);
+    return (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, pbUnmapInfo, sizeof(TMPL_MEM_TYPE), iSegReg, GCPtrMem,
+                                         IEM_ACCESS_DATA_RW, TMPL_MEM_TYPE_ALIGN);
 }
 
@@ -219 +226 @@
     Log8(("IEM WO/map " TMPL_MEM_FMT_DESC " %d|%RGv\n", iSegReg, GCPtrMem));
     *pbUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); /* zero is for the TLB hit */
-    return (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, sizeof(TMPL_MEM_TYPE), iSegReg, GCPtrMem, IEM_ACCESS_DATA_W, TMPL_MEM_TYPE_ALIGN);
+    return (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, pbUnmapInfo, sizeof(TMPL_MEM_TYPE), iSegReg, GCPtrMem,
+                                         IEM_ACCESS_DATA_W, TMPL_MEM_TYPE_ALIGN);
 }
 
@@ -242 +250 @@
     Log4(("IEM RO/map " TMPL_MEM_FMT_DESC " %d|%RGv\n", iSegReg, GCPtrMem));
     *pbUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); /* zero is for the TLB hit */
-    return (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, sizeof(TMPL_MEM_TYPE), iSegReg, GCPtrMem, IEM_ACCESS_DATA_R, TMPL_MEM_TYPE_ALIGN);
+    return (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, pbUnmapInfo, sizeof(TMPL_MEM_TYPE), iSegReg, GCPtrMem,
+                                         IEM_ACCESS_DATA_R, TMPL_MEM_TYPE_ALIGN);
 }
 
@@ -265 +274 @@
 
     /* Write the dword the lazy way. */
+    uint8_t        bUnmapInfo;
     TMPL_MEM_TYPE *puDst;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puDst, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
-                                IEM_ACCESS_STACK_W, TMPL_MEM_TYPE_ALIGN);
+    VBOXSTRICTRC   rc = iemMemMap(pVCpu, (void **)&puDst, &bUnmapInfo, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
+                                  IEM_ACCESS_STACK_W, TMPL_MEM_TYPE_ALIGN);
     if (rc == VINF_SUCCESS)
     {
         *puDst = uValue;
-        rc = iemMemCommitAndUnmap(pVCpu, puDst, IEM_ACCESS_STACK_W);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
 
         /* Commit the new RSP value unless we an access handler made trouble. */
@@ -302 +312 @@
 
     /* Write the word the lazy way. */
+    uint8_t              bUnmapInfo;
     TMPL_MEM_TYPE const *puSrc;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puSrc, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puSrc, &bUnmapInfo, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
                                 IEM_ACCESS_STACK_R, TMPL_MEM_TYPE_ALIGN);
     if (rc == VINF_SUCCESS)
     {
         *puValue = *puSrc;
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)puSrc, IEM_ACCESS_STACK_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
 
         /* Commit the new RSP value. */
@@ -339 +350 @@
 
     /* Write the word the lazy way. */
+    uint8_t        bUnmapInfo;
     TMPL_MEM_TYPE *puDst;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puDst, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
-                                IEM_ACCESS_STACK_W, TMPL_MEM_TYPE_ALIGN);
+    VBOXSTRICTRC   rc = iemMemMap(pVCpu, (void **)&puDst, &bUnmapInfo, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
+                                  IEM_ACCESS_STACK_W, TMPL_MEM_TYPE_ALIGN);
     if (rc == VINF_SUCCESS)
     {
         *puDst = uValue;
-        rc = iemMemCommitAndUnmap(pVCpu, puDst, IEM_ACCESS_STACK_W);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
 
         /* Commit the new RSP value unless we an access handler made trouble. */
@@ -377 +389 @@
 
     /* Write the word the lazy way. */
+    uint8_t              bUnmapInfo;
     TMPL_MEM_TYPE const *puSrc;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puSrc, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
+    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&puSrc, &bUnmapInfo, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
                                 IEM_ACCESS_STACK_R, TMPL_MEM_TYPE_ALIGN);
     if (rc == VINF_SUCCESS)
     {
         *puValue = *puSrc;
-        rc = iemMemCommitAndUnmap(pVCpu, (void *)puSrc, IEM_ACCESS_STACK_R);
+        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
 
         /* Commit the new RSP value. */
@@ -414 +427 @@
 
     /* Write the data. */
-    TMPL_MEM_TYPE *puDst = (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
+    uint8_t        bUnmapInfo;
+    TMPL_MEM_TYPE *puDst = (TMPL_MEM_TYPE *)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
                                                          IEM_ACCESS_STACK_W, TMPL_MEM_TYPE_ALIGN);
     *puDst = uValue;
-    iemMemCommitAndUnmapJmp(pVCpu, puDst, IEM_ACCESS_STACK_W);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
 
     /* Commit the RSP change. */
@@ -440 +454 @@
 
     /* Read the data. */
-    TMPL_MEM_TYPE const *puSrc = (TMPL_MEM_TYPE const *)iemMemMapJmp(pVCpu, sizeof(TMPL_MEM_TYPE), X86_SREG_SS, GCPtrTop,
-                                                                     IEM_ACCESS_STACK_R, TMPL_MEM_TYPE_ALIGN);
+    uint8_t              bUnmapInfo;
+    TMPL_MEM_TYPE const *puSrc = (TMPL_MEM_TYPE const *)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(TMPL_MEM_TYPE), X86_SREG_SS,
+                                                                     GCPtrTop, IEM_ACCESS_STACK_R, TMPL_MEM_TYPE_ALIGN);
     TMPL_MEM_TYPE const  uRet = *puSrc;
-    iemMemCommitAndUnmapJmp(pVCpu, (void *)puSrc, IEM_ACCESS_STACK_R);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
 
     /* Commit the RSP change and return the popped value. */
@@ -478 +493 @@
      * Docs indicate the behavior changed maybe in Pentium or Pentium Pro. Check
      * ancient hardware when it actually did change. */
-    uint16_t *puDst = (uint16_t *)iemMemMapJmp(pVCpu, sizeof(uint16_t), X86_SREG_SS, GCPtrTop,
+    uint8_t   bUnmapInfo;
+    uint16_t *puDst = (uint16_t *)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(uint16_t), X86_SREG_SS, GCPtrTop,
                                                IEM_ACCESS_STACK_W, sizeof(uint16_t) - 1); /** @todo 2 or 4 alignment check for PUSH SS? */
     *puDst = (uint16_t)uValue;
-    iemMemCommitAndUnmapJmp(pVCpu, puDst, IEM_ACCESS_STACK_W);
+    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
 
     /* Commit the RSP change. */

trunk/src/VBox/VMM/include/IEMInline.h

@@ -3715 +3715 @@
 #ifdef IEM_WITH_SETJMP
 
-DECL_INLINE_THROW(void) iemMemCommitAndUnmapRwJmp(PVMCPUCC pVCpu, void *pvMem, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP
+DECL_INLINE_THROW(void) iemMemCommitAndUnmapRwJmp(PVMCPUCC pVCpu, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP
 {
 # if defined(IEM_WITH_DATA_TLB) && defined(IN_RING3)
@@ -3721 +3721 @@
         return;
 # endif
-    iemMemCommitAndUnmapRwSafeJmp(pVCpu, pvMem, bMapInfo);
-}
-
-
-DECL_INLINE_THROW(void) iemMemCommitAndUnmapWoJmp(PVMCPUCC pVCpu, void *pvMem, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP
+    iemMemCommitAndUnmapRwSafeJmp(pVCpu, bMapInfo);
+}
+
+
+DECL_INLINE_THROW(void) iemMemCommitAndUnmapWoJmp(PVMCPUCC pVCpu, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP
 {
 # if defined(IEM_WITH_DATA_TLB) && defined(IN_RING3)
@@ -3731 +3731 @@
         return;
 # endif
-    iemMemCommitAndUnmapWoSafeJmp(pVCpu, pvMem, bMapInfo);
-}
-
-
-DECL_INLINE_THROW(void) iemMemCommitAndUnmapRoJmp(PVMCPUCC pVCpu, const void *pvMem, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP
+    iemMemCommitAndUnmapWoSafeJmp(pVCpu, bMapInfo);
+}
+
+
+DECL_INLINE_THROW(void) iemMemCommitAndUnmapRoJmp(PVMCPUCC pVCpu, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP
 {
 # if defined(IEM_WITH_DATA_TLB) && defined(IN_RING3)
@@ -3741 +3741 @@
         return;
 # endif
-    iemMemCommitAndUnmapRoSafeJmp(pVCpu, pvMem, bMapInfo);
-}
-
-DECLINLINE(void) iemMemRollbackAndUnmapWo(PVMCPUCC pVCpu, const void *pvMem, uint8_t bMapInfo) RT_NOEXCEPT
+    iemMemCommitAndUnmapRoSafeJmp(pVCpu, bMapInfo);
+}
+
+DECLINLINE(void) iemMemRollbackAndUnmapWo(PVMCPUCC pVCpu, uint8_t bMapInfo) RT_NOEXCEPT
 {
 # if defined(IEM_WITH_DATA_TLB) && defined(IN_RING3)
@@ -3750 +3750 @@
         return;
 # endif
-    iemMemRollbackAndUnmapWoSafe(pVCpu, pvMem, bMapInfo);
+    iemMemRollbackAndUnmapWoSafe(pVCpu, bMapInfo);
 }
 

trunk/src/VBox/VMM/include/IEMInternal.h

@@ -5039 +5039 @@
 #define IEM_MEMMAP_F_ALIGN_GP_OR_AC RT_BIT_32(18)
 
-VBOXSTRICTRC    iemMemMap(PVMCPUCC pVCpu, void **ppvMem, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem,
+VBOXSTRICTRC    iemMemMap(PVMCPUCC pVCpu, void **ppvMem, uint8_t *pbUnmapInfo, size_t cbMem, uint8_t iSegReg, RTGCPTR GCPtrMem,
                           uint32_t fAccess, uint32_t uAlignCtl) RT_NOEXCEPT;
-VBOXSTRICTRC    iemMemCommitAndUnmap(PVMCPUCC pVCpu, void *pvMem, uint32_t fAccess) RT_NOEXCEPT;
+VBOXSTRICTRC    iemMemCommitAndUnmap(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT;
 #ifndef IN_RING3
-VBOXSTRICTRC    iemMemCommitAndUnmapPostponeTroubleToR3(PVMCPUCC pVCpu, void *pvMem, uint32_t fAccess) RT_NOEXCEPT;
-#endif
-void            iemMemRollbackAndUnmap(PVMCPUCC pVCpu, void *pvMem, uint32_t fAccess) RT_NOEXCEPT;
+VBOXSTRICTRC    iemMemCommitAndUnmapPostponeTroubleToR3(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT;
+#endif
+void            iemMemRollbackAndUnmap(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT;
 void            iemMemRollback(PVMCPUCC pVCpu) RT_NOEXCEPT;
 VBOXSTRICTRC    iemMemApplySegment(PVMCPUCC pVCpu, uint32_t fAccess, uint8_t iSegReg, size_t cbMem, PRTGCPTR pGCPtrMem) RT_NOEXCEPT;
@@ -5181 +5181 @@
 PCRTUINT128U    iemMemMapDataU128RoSafeJmp(PVMCPUCC pVCpu, uint8_t *pbUnmapInfo, uint8_t iSegReg, RTGCPTR GCPtrMem) IEM_NOEXCEPT_MAY_LONGJMP;
 
-void            iemMemCommitAndUnmapRwSafeJmp(PVMCPUCC pVCpu, void *pvMem, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP;
-void            iemMemCommitAndUnmapWoSafeJmp(PVMCPUCC pVCpu, void *pvMem, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP;
-void            iemMemCommitAndUnmapRoSafeJmp(PVMCPUCC pVCpu, const void *pvMem, uint8_t bMapInfo) IEM_NOEXCEPT_MAY_LONGJMP;
-void            iemMemRollbackAndUnmapWoSafe(PVMCPUCC pVCpu, const void *pvMem, uint8_t bMapInfo) RT_NOEXCEPT;
+void            iemMemCommitAndUnmapJmp(PVMCPUCC pVCpu, uint8_t bUnmapInfo) IEM_NOEXCEPT_MAY_LONGJMP;
+void            iemMemCommitAndUnmapRwSafeJmp(PVMCPUCC pVCpu, uint8_t bUnmapInfo) IEM_NOEXCEPT_MAY_LONGJMP;
+void            iemMemCommitAndUnmapWoSafeJmp(PVMCPUCC pVCpu, uint8_t bUnmapInfo) IEM_NOEXCEPT_MAY_LONGJMP;
+void            iemMemCommitAndUnmapRoSafeJmp(PVMCPUCC pVCpu, uint8_t bUnmapInfo) IEM_NOEXCEPT_MAY_LONGJMP;
+void            iemMemRollbackAndUnmapWoSafe(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT;
 #endif
 
 VBOXSTRICTRC    iemMemStackPushBeginSpecial(PVMCPUCC pVCpu, size_t cbMem, uint32_t cbAlign,
-                                            void **ppvMem, uint64_t *puNewRsp) RT_NOEXCEPT;
-VBOXSTRICTRC    iemMemStackPushCommitSpecial(PVMCPUCC pVCpu, void *pvMem, uint64_t uNewRsp) RT_NOEXCEPT;
+                                            void **ppvMem, uint8_t *pbUnmapInfo, uint64_t *puNewRsp) RT_NOEXCEPT;
+VBOXSTRICTRC    iemMemStackPushCommitSpecial(PVMCPUCC pVCpu, uint8_t bUnmapInfo, uint64_t uNewRsp) RT_NOEXCEPT;
 VBOXSTRICTRC    iemMemStackPushU16(PVMCPUCC pVCpu, uint16_t u16Value) RT_NOEXCEPT;
 VBOXSTRICTRC    iemMemStackPushU32(PVMCPUCC pVCpu, uint32_t u32Value) RT_NOEXCEPT;
@@ -5198 +5199 @@
 VBOXSTRICTRC    iemMemStackPushU32SReg(PVMCPUCC pVCpu, uint32_t u32Value) RT_NOEXCEPT;
 VBOXSTRICTRC    iemMemStackPopBeginSpecial(PVMCPUCC pVCpu, size_t cbMem, uint32_t cbAlign,
-                                           void const **ppvMem, uint64_t *puNewRsp) RT_NOEXCEPT;
+                                           void const **ppvMem, uint8_t *pbUnmapInfo, uint64_t *puNewRsp) RT_NOEXCEPT;
 VBOXSTRICTRC    iemMemStackPopContinueSpecial(PVMCPUCC pVCpu, size_t off, size_t cbMem,
-                                              void const **ppvMem, uint64_t uCurNewRsp) RT_NOEXCEPT;
-VBOXSTRICTRC    iemMemStackPopDoneSpecial(PVMCPUCC pVCpu, void const *pvMem) RT_NOEXCEPT;
+                                              void const **ppvMem, uint8_t *pbUnmapInfo, uint64_t uCurNewRsp) RT_NOEXCEPT;
+VBOXSTRICTRC    iemMemStackPopDoneSpecial(PVMCPUCC pVCpu, uint8_t bUnmapInfo) RT_NOEXCEPT;
 VBOXSTRICTRC    iemMemStackPopU16(PVMCPUCC pVCpu, uint16_t *pu16Value) RT_NOEXCEPT;
 VBOXSTRICTRC    iemMemStackPopU32(PVMCPUCC pVCpu, uint32_t *pu32Value) RT_NOEXCEPT;
@@ -5334 +5335 @@
 IEM_CIMPL_PROTO_0(iemCImpl_xgetbv);
 IEM_CIMPL_PROTO_0(iemCImpl_xsetbv);
-IEM_CIMPL_PROTO_4(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
-                  PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags);
+IEM_CIMPL_PROTO_5(iemCImpl_cmpxchg16b_fallback_rendezvous, PRTUINT128U, pu128Dst, PRTUINT128U, pu128RaxRdx,
+                  PRTUINT128U, pu128RbxRcx, uint32_t *, pEFlags, uint8_t, bUnmapInfo);
 IEM_CIMPL_PROTO_2(iemCImpl_clflush_clflushopt, uint8_t, iEffSeg, RTGCPTR, GCPtrEff);
 IEM_CIMPL_PROTO_1(iemCImpl_finit, bool, fCheckXcpts);

trunk/src/VBox/VMM/include/IEMMc.h

@@ -1519 +1519 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U8_RW(a_pu8Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), sizeof(uint8_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, 0)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U8_RW(a_pu8Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), &(a_bUnmapInfo), sizeof(uint8_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, 0))
 #else
 # define IEM_MC_MEM_MAP_U8_RW(a_pu8Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1540 +1538 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U8_WO(a_pu8Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), sizeof(uint8_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, 0)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U8_WO(a_pu8Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), &(a_bUnmapInfo), sizeof(uint8_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, 0))
 #else
 # define IEM_MC_MEM_MAP_U8_WO(a_pu8Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1561 +1557 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U8_RO(a_pu8Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), sizeof(uint8_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, 0)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U8_RO(a_pu8Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), &(a_bUnmapInfo), sizeof(uint8_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_R, 0))
 #else
 # define IEM_MC_MEM_MAP_U8_RO(a_pu8Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1582 +1576 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U8_RW(a_pu8Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), sizeof(uint8_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, 0)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U8_RW(a_pu8Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), &(a_bUnmapInfo), sizeof(uint8_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, 0))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U8_RW(a_pu8Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -1603 +1595 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U8_WO(a_pu8Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), sizeof(uint8_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, 0)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U8_WO(a_pu8Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), &(a_bUnmapInfo), sizeof(uint8_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, 0))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U8_WO(a_pu8Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -1624 +1614 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U8_RO(a_pu8Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), sizeof(uint8_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, 0)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U8_RO(a_pu8Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu8Mem), &(a_bUnmapInfo), sizeof(uint8_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_R, 0))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U8_RO(a_pu8Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -1648 +1636 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint16_t) - 1)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), &(a_bUnmapInfo), sizeof(uint16_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint16_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1669 +1655 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint16_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), &(a_bUnmapInfo), sizeof(uint16_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint16_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1690 +1674 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint16_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), &(a_bUnmapInfo), sizeof(uint16_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint16_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1711 +1693 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint16_t) - 1)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), &(a_bUnmapInfo), sizeof(uint16_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint16_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U16_RW(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -1732 +1712 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint16_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), &(a_bUnmapInfo), sizeof(uint16_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint16_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U16_WO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -1753 +1731 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), sizeof(uint16_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint16_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) \
+   IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu16Mem), &(a_bUnmapInfo), sizeof(uint16_t), UINT8_MAX, \
+                                      (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint16_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U16_RO(a_pu16Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -1795 +1771 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint32_t) - 1)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), &(a_bUnmapInfo), sizeof(uint32_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint32_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1816 +1790 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint32_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), &(a_bUnmapInfo), sizeof(uint32_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint32_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1837 +1809 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint32_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), &(a_bUnmapInfo), sizeof(uint32_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint32_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1858 +1828 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint32_t) - 1)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), &(a_bUnmapInfo), sizeof(uint32_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint32_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U32_RW(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -1879 +1847 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint32_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), &(a_bUnmapInfo), sizeof(uint32_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint32_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U32_WO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -1900 +1866 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), sizeof(uint32_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint32_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu32Mem), &(a_bUnmapInfo), sizeof(uint32_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint32_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U32_RO(a_pu32Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -1960 +1924 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), &(a_bUnmapInfo), sizeof(uint64_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -1981 +1943 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), &(a_bUnmapInfo), sizeof(uint64_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -2002 +1962 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), &(a_bUnmapInfo), sizeof(uint64_t), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -2023 +1981 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), &(a_bUnmapInfo), sizeof(uint64_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U64_RW(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -2044 +2000 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), &(a_bUnmapInfo), sizeof(uint64_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U64_WO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -2065 +2019 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), sizeof(uint64_t), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu64Mem), &(a_bUnmapInfo), sizeof(uint64_t), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U64_RO(a_pu64Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -2125 +2077 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U128_RW(a_pu128Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), sizeof(RTUINT128U), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(RTUINT128U) - 1)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U128_RW(a_pu128Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), &(a_bUnmapInfo), sizeof(RTUINT128U), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(RTUINT128U) - 1))
 #else
 # define IEM_MC_MEM_MAP_U128_RW(a_pu128Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -2146 +2096 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U128_WO(a_pu128Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), sizeof(RTUINT128), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(RTUINT128) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U128_WO(a_pu128Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), &(a_bUnmapInfo), sizeof(RTUINT128), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(RTUINT128) - 1))
 #else
 # define IEM_MC_MEM_MAP_U128_WO(a_pu128Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -2167 +2115 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_U128_RO(a_pu128Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), sizeof(RTUINT128), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(RTUINT128) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_U128_RO(a_pu128Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), &(a_bUnmapInfo), sizeof(RTUINT128), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(RTUINT128) - 1))
 #else
 # define IEM_MC_MEM_MAP_U128_RO(a_pu128Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -2188 +2134 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U128_RW(a_pu128Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), sizeof(RTUINT128), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(RTUINT128) - 1)); \
-        a_bUnmapInfo = 1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U128_RW(a_pu128Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), &(a_bUnmapInfo), sizeof(RTUINT128), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_RW, sizeof(RTUINT128) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U128_RW(a_pu128Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -2209 +2153 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U128_WO(a_pu128Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), sizeof(RTUINT128), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(RTUINT128) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U128_WO(a_pu128Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), &(a_bUnmapInfo), sizeof(RTUINT128), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(RTUINT128) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U128_WO(a_pu128Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -2230 +2172 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_U128_RO(a_pu128Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), sizeof(RTUINT128), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(RTUINT128) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_READ << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_U128_RO(a_pu128Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pu128Mem), &(a_bUnmapInfo), sizeof(RTUINT128), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_R, sizeof(RTUINT128) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_U128_RO(a_pu128Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -2254 +2194 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_R80_WO(a_pr80Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pr80Mem), sizeof(RTFLOAT80U), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_R80_WO(a_pr80Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pr80Mem), &(a_bUnmapInfo), sizeof(RTFLOAT80U), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_R80_WO(a_pr80Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -2274 +2212 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_R80_WO(a_pr80Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pr80Mem), sizeof(RTFLOAT80U), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_R80_WO(a_pr80Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pr80Mem), &(a_bUnmapInfo), sizeof(RTFLOAT80U), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_R80_WO(a_pr80Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -2296 +2232 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_MAP_D80_WO(a_pd80Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pd80Mem), sizeof(RTFLOAT80U), (a_iSeg), \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_MAP_D80_WO(a_pd80Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pd80Mem), &(a_bUnmapInfo), sizeof(RTFLOAT80U), (a_iSeg), \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_MAP_D80_WO(a_pd80Mem, a_bUnmapInfo, a_iSeg, a_GCPtrMem) \
@@ -2316 +2250 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_FLAT_MAP_D80_WO(a_pd80Mem, a_bUnmapInfo, a_GCPtrMem) do { \
-        IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pd80Mem), sizeof(RTFLOAT80U), UINT8_MAX, \
-                                           (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1)); \
-        a_bUnmapInfo = 1 | (IEM_ACCESS_TYPE_WRITE << 4); \
-    } while (0)
+# define IEM_MC_MEM_FLAT_MAP_D80_WO(a_pd80Mem, a_bUnmapInfo, a_GCPtrMem) \
+    IEM_MC_RETURN_ON_FAILURE(iemMemMap(pVCpu, (void **)&(a_pd80Mem), &(a_bUnmapInfo), sizeof(RTFLOAT80U), UINT8_MAX, \
+                                       (a_GCPtrMem), IEM_ACCESS_DATA_W, sizeof(uint64_t) - 1))
 #else
 # define IEM_MC_MEM_FLAT_MAP_D80_WO(a_pd80Mem, a_bUnmapInfo, a_GCPtrMem) \
@@ -2334 +2266 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_COMMIT_AND_UNMAP_RW(a_pvMem, a_bMapInfo) do { \
-        RT_NOREF_PV(a_bMapInfo); Assert(a_bMapInfo == (1 | ((IEM_ACCESS_TYPE_READ | IEM_ACCESS_TYPE_WRITE) << 4)) ); \
-        IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, (a_pvMem), IEM_ACCESS_DATA_RW)); \
-    } while (0)
-#else
-# define IEM_MC_MEM_COMMIT_AND_UNMAP_RW(a_pvMem, a_bMapInfo) \
-    iemMemCommitAndUnmapRwJmp(pVCpu, (a_pvMem), (a_bMapInfo))
+# define IEM_MC_MEM_COMMIT_AND_UNMAP_RW(a_pvMem, a_bMapInfo)    IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, a_bMapInfo))
+#else
+# define IEM_MC_MEM_COMMIT_AND_UNMAP_RW(a_pvMem, a_bMapInfo)    iemMemCommitAndUnmapRwJmp(pVCpu, (a_bMapInfo))
 #endif
 
@@ -2347 +2275 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_COMMIT_AND_UNMAP_WO(a_pvMem, a_bMapInfo) do { \
-        RT_NOREF_PV(a_bMapInfo); Assert(a_bMapInfo == (1 | (IEM_ACCESS_TYPE_WRITE << 4)) ); \
-        IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, (a_pvMem), IEM_ACCESS_DATA_W)); \
-    } while (0)
-#else
-# define IEM_MC_MEM_COMMIT_AND_UNMAP_WO(a_pvMem, a_bMapInfo) \
-    iemMemCommitAndUnmapWoJmp(pVCpu, (a_pvMem), (a_bMapInfo))
+# define IEM_MC_MEM_COMMIT_AND_UNMAP_WO(a_pvMem, a_bMapInfo)    IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, a_bMapInfo))
+#else
+# define IEM_MC_MEM_COMMIT_AND_UNMAP_WO(a_pvMem, a_bMapInfo)    iemMemCommitAndUnmapWoJmp(pVCpu, (a_bMapInfo))
 #endif
 
@@ -2360 +2284 @@
  */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_COMMIT_AND_UNMAP_RO(a_pvMem, a_bMapInfo) do { \
-        RT_NOREF_PV(a_bMapInfo); Assert(a_bMapInfo == (1 | (IEM_ACCESS_TYPE_READ << 4)) ); \
-        IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, (void *)(a_pvMem), IEM_ACCESS_DATA_R)); \
-    } while (0)
-#else
-# define IEM_MC_MEM_COMMIT_AND_UNMAP_RO(a_pvMem, a_bMapInfo) \
-    iemMemCommitAndUnmapRoJmp(pVCpu, (a_pvMem), (a_bMapInfo))
+# define IEM_MC_MEM_COMMIT_AND_UNMAP_RO(a_pvMem, a_bMapInfo)    IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, a_bMapInfo))
+#else
+# define IEM_MC_MEM_COMMIT_AND_UNMAP_RO(a_pvMem, a_bMapInfo)    iemMemCommitAndUnmapRoJmp(pVCpu, (a_bMapInfo))
 #endif
 
@@ -2378 +2298 @@
  *
  * @remarks     May in theory return - for now.
- *
- * @deprecated
- */
-#define IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE(a_pvMem, a_fAccess, a_u16FSW) \
-    do { \
-        if (   !(a_u16FSW & X86_FSW_ES) \
-            || !(  (a_u16FSW & (X86_FSW_UE | X86_FSW_OE | X86_FSW_IE)) \
-                 & ~(pVCpu->cpum.GstCtx.XState.x87.FCW & X86_FCW_MASK_ALL) ) ) \
-            IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, (a_pvMem), (a_fAccess))); \
-    } while (0)
-
-
-/** Commits the memory and unmaps the guest memory unless the FPU status word
- * indicates (@a a_u16FSW) and FPU control word indicates a pending exception
- * that would cause FLD not to store.
- *
- * The current understanding is that \#O, \#U, \#IA and \#IS will prevent a
- * store, while \#P will not.
- *
- * @remarks     May in theory return - for now.
- */
-#ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE_WO(a_pvMem, a_bMapInfo, a_u16FSW) do { \
-        RT_NOREF_PV(a_bMapInfo); Assert(a_bMapInfo == (1 | (IEM_ACCESS_TYPE_WRITE << 4)) ); \
-        if (   !(a_u16FSW & X86_FSW_ES) \
-            || !(  (a_u16FSW & (X86_FSW_UE | X86_FSW_OE | X86_FSW_IE)) \
-                 & ~(pVCpu->cpum.GstCtx.XState.x87.FCW & X86_FCW_MASK_ALL) ) ) \
-            IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, (a_pvMem), IEM_ACCESS_DATA_W)); \
-        else \
-            iemMemRollbackAndUnmap(pVCpu, (a_pvMem), IEM_ACCESS_DATA_W); \
-    } while (0)
-#else
+ */
+#ifndef IEM_WITH_SETJMP
 # define IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE_WO(a_pvMem, a_bMapInfo, a_u16FSW) do { \
         if (   !(a_u16FSW & X86_FSW_ES) \
             || !(  (a_u16FSW & (X86_FSW_UE | X86_FSW_OE | X86_FSW_IE)) \
                  & ~(pVCpu->cpum.GstCtx.XState.x87.FCW & X86_FCW_MASK_ALL) ) ) \
-            iemMemCommitAndUnmapWoJmp(pVCpu, (a_pvMem), a_bMapInfo); \
+            IEM_MC_RETURN_ON_FAILURE(iemMemCommitAndUnmap(pVCpu, a_bMapInfo)); \
         else \
-            iemMemRollbackAndUnmapWo(pVCpu, (a_pvMem), a_bMapInfo); \
+            iemMemRollbackAndUnmap(pVCpu, (a_pvMem), IEM_ACCESS_DATA_W); \
+    } while (0)
+#else
+# define IEM_MC_MEM_COMMIT_AND_UNMAP_FOR_FPU_STORE_WO(a_pvMem, a_bMapInfo, a_u16FSW) do { \
+        if (   !(a_u16FSW & X86_FSW_ES) \
+            || !(  (a_u16FSW & (X86_FSW_UE | X86_FSW_OE | X86_FSW_IE)) \
+                 & ~(pVCpu->cpum.GstCtx.XState.x87.FCW & X86_FCW_MASK_ALL) ) ) \
+            iemMemCommitAndUnmapWoJmp(pVCpu, a_bMapInfo); \
+        else \
+            iemMemRollbackAndUnmapWo(pVCpu, a_bMapInfo); \
     } while (0)
 #endif
@@ -2422 +2321 @@
 /** Rolls back (conceptually only, assumes no writes) and unmaps the guest  memory. */
 #ifndef IEM_WITH_SETJMP
-# define IEM_MC_MEM_ROLLBACK_AND_UNMAP_WO(a_pvMem, a_bMapInfo) do { \
-        RT_NOREF_PV(a_bMapInfo); Assert(a_bMapInfo == (1 | (IEM_ACCESS_TYPE_WRITE << 4)) ); \
-        iemMemRollbackAndUnmap(pVCpu, (a_pvMem), IEM_ACCESS_DATA_W); \
-    } while (0)
-#else
 # define IEM_MC_MEM_ROLLBACK_AND_UNMAP_WO(a_pvMem, a_bMapInfo) \
-        iemMemRollbackAndUnmapWo(pVCpu, (a_pvMem), a_bMapInfo)
+        iemMemRollbackAndUnmap(pVCpu, a_bMapInfo)
+#else
+# define IEM_MC_MEM_ROLLBACK_AND_UNMAP_WO(a_pvMem, a_bMapInfo) \
+        iemMemRollbackAndUnmapWo(pVCpu, a_bMapInfo)
 #endif