Index: trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 103913)
+++ trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 103916)
@@ -7226,4 +7226,11 @@
 #include "IEMAllMemRWTmpl.cpp.h"
 
+#define TMPL_MEM_TYPE       RTUINT256U
+#define TMPL_MEM_TYPE_ALIGN 0
+#define TMPL_MEM_FN_SUFF    U256NoAc
+#define TMPL_MEM_FMT_TYPE   "%.32Rhxs"
+#define TMPL_MEM_FMT_DESC   "qqword"
+#include "IEMAllMemRWTmpl.cpp.h"
+
 /**
  * Fetches a data dword and zero extends it to a qword.
@@ -7282,60 +7289,4 @@
 #endif
     return rc;
-}
-#endif
-
-
-/**
- * Fetches a data oword (octo word), generally AVX related.
- *
- * @returns Strict VBox status code.
- * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
- * @param   pu256Dst            Where to return the qword.
- * @param   iSegReg             The index of the segment register to use for
- *                              this access.  The base and limits are checked.
- * @param   GCPtrMem            The address of the guest memory.
- */
-VBOXSTRICTRC iemMemFetchDataU256NoAc(PVMCPUCC pVCpu, PRTUINT256U pu256Dst, uint8_t iSegReg, RTGCPTR GCPtrMem) RT_NOEXCEPT
-{
-    /* The lazy approach for now... */
-    uint8_t      bUnmapInfo;
-    PCRTUINT256U pu256Src;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Src, &bUnmapInfo, sizeof(*pu256Src), iSegReg, GCPtrMem,
-                                IEM_ACCESS_DATA_R, 0 /* NO_AC variant */);
-    if (rc == VINF_SUCCESS)
-    {
-        pu256Dst->au64[0] = pu256Src->au64[0];
-        pu256Dst->au64[1] = pu256Src->au64[1];
-        pu256Dst->au64[2] = pu256Src->au64[2];
-        pu256Dst->au64[3] = pu256Src->au64[3];
-        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
-        Log(("IEM RD qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
-    }
-    return rc;
-}
-
-
-#ifdef IEM_WITH_SETJMP
-/**
- * Fetches a data oword (octo word), generally AVX related.
- *
- * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
- * @param   pu256Dst            Where to return the qword.
- * @param   iSegReg             The index of the segment register to use for
- *                              this access.  The base and limits are checked.
- * @param   GCPtrMem            The address of the guest memory.
- */
-void iemMemFetchDataU256NoAcJmp(PVMCPUCC pVCpu, PRTUINT256U pu256Dst, uint8_t iSegReg, RTGCPTR GCPtrMem) IEM_NOEXCEPT_MAY_LONGJMP
-{
-    /* The lazy approach for now... */
-    uint8_t      bUnmapInfo;
-    PCRTUINT256U pu256Src = (PCRTUINT256U)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*pu256Src), iSegReg, GCPtrMem,
-                                                       IEM_ACCESS_DATA_R, 0 /* NO_AC variant */);
-    pu256Dst->au64[0] = pu256Src->au64[0];
-    pu256Dst->au64[1] = pu256Src->au64[1];
-    pu256Dst->au64[2] = pu256Src->au64[2];
-    pu256Dst->au64[3] = pu256Src->au64[3];
-    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
-    Log(("IEM RD qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
 }
 #endif
@@ -7572,60 +7523,4 @@
  */
 void iemMemStoreDataU256Jmp(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, PCRTUINT256U pu256Value) IEM_NOEXCEPT_MAY_LONGJMP
-{
-    /* The lazy approach for now... */
-    uint8_t     bUnmapInfo;
-    PRTUINT256U pu256Dst = (PRTUINT256U)iemMemMapJmp(pVCpu, &bUnmapInfo, sizeof(*pu256Dst), iSegReg, GCPtrMem,
-                                                     IEM_ACCESS_DATA_W, 0 /* NO_AC variant */);
-    pu256Dst->au64[0] = pu256Value->au64[0];
-    pu256Dst->au64[1] = pu256Value->au64[1];
-    pu256Dst->au64[2] = pu256Value->au64[2];
-    pu256Dst->au64[3] = pu256Value->au64[3];
-    iemMemCommitAndUnmapJmp(pVCpu, bUnmapInfo);
-    Log5(("IEM WR qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
-}
-#endif
-
-
-/**
- * Stores a data qqword.
- *
- * @returns Strict VBox status code.
- * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
- * @param   iSegReg             The index of the segment register to use for
- *                              this access.  The base and limits are checked.
- * @param   GCPtrMem            The address of the guest memory.
- * @param   pu256Value          Pointer to the value to store.
- */
-VBOXSTRICTRC iemMemStoreDataU256NoAc(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, PCRTUINT256U pu256Value) RT_NOEXCEPT
-{
-    /* The lazy approach for now... */
-    uint8_t      bUnmapInfo;
-    PRTUINT256U  pu256Dst;
-    VBOXSTRICTRC rc = iemMemMap(pVCpu, (void **)&pu256Dst, &bUnmapInfo, sizeof(*pu256Dst), iSegReg, GCPtrMem,
-                                IEM_ACCESS_DATA_W, 0 /* NO_AC variant */);
-    if (rc == VINF_SUCCESS)
-    {
-        pu256Dst->au64[0] = pu256Value->au64[0];
-        pu256Dst->au64[1] = pu256Value->au64[1];
-        pu256Dst->au64[2] = pu256Value->au64[2];
-        pu256Dst->au64[3] = pu256Value->au64[3];
-        rc = iemMemCommitAndUnmap(pVCpu, bUnmapInfo);
-        Log5(("IEM WR qqword %d|%RGv: %.32Rhxs\n", iSegReg, GCPtrMem, pu256Dst));
-    }
-    return rc;
-}
-
-
-#ifdef IEM_WITH_SETJMP
-/**
- * Stores a data qqword, longjmp on error.
- *
- * @param   pVCpu               The cross context virtual CPU structure of the calling thread.
- * @param   iSegReg             The index of the segment register to use for
- *                              this access.  The base and limits are checked.
- * @param   GCPtrMem            The address of the guest memory.
- * @param   pu256Value          Pointer to the value to store.
- */
-void iemMemStoreDataU256NoAcJmp(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, PCRTUINT256U pu256Value) IEM_NOEXCEPT_MAY_LONGJMP
 {
     /* The lazy approach for now... */
Index: trunk/src/VBox/VMM/VMMAll/IEMAllInstPython.py
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllInstPython.py	(revision 103913)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllInstPython.py	(revision 103916)
@@ -3069,5 +3069,5 @@
     'IEM_MC_FETCH_MEM_U256':                                     (McBlock.parseMcGeneric,           True,  True,  False, ),
     'IEM_MC_FETCH_MEM_U256_ALIGN_AVX':                           (McBlock.parseMcGeneric,           True,  True,  False, ),
-    'IEM_MC_FETCH_MEM_U256_NO_AC':                               (McBlock.parseMcGeneric,           True,  True,  False, ),
+    'IEM_MC_FETCH_MEM_U256_NO_AC':                               (McBlock.parseMcGeneric,           True,  True,  g_fNativeSimd),
     'IEM_MC_FETCH_MEM_U32':                                      (McBlock.parseMcGeneric,           True,  True,  True,  ),
     'IEM_MC_FETCH_MEM_U32_DISP':                                 (McBlock.parseMcGeneric,           True,  True,  True,  ), #bounds only
Index: trunk/src/VBox/VMM/VMMAll/IEMAllN8vePython.py
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllN8vePython.py	(revision 103913)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllN8vePython.py	(revision 103916)
@@ -149,5 +149,5 @@
     'IEM_MC_FETCH_MEM_FLAT_U16_ZX_U64':                                  (None, True,  True,  True,  ),
     'IEM_MC_FETCH_MEM_FLAT_U256_ALIGN_AVX':                              (None, True,  True,  False, ),
-    'IEM_MC_FETCH_MEM_FLAT_U256_NO_AC':                                  (None, True,  True,  False, ),
+    'IEM_MC_FETCH_MEM_FLAT_U256_NO_AC':                                  (None, True,  True,  g_fNativeSimd),
     'IEM_MC_FETCH_MEM_FLAT_U256':                                        (None, True,  True,  False, ),
     'IEM_MC_FETCH_MEM_FLAT_U32':                                         (None, True,  True,  True,  ),
Index: trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompFuncs.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompFuncs.h	(revision 103913)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompFuncs.h	(revision 103916)
@@ -4715,4 +4715,11 @@
                            && (pfnFunction == UINT64_C(0xc000b000a0009000))));
                 break;
+            case sizeof(RTUINT256U):
+                Assert(enmOp == kIemNativeEmitMemOp_Store || enmOp == kIemNativeEmitMemOp_Fetch);
+                Assert(   (   enmOp == kIemNativeEmitMemOp_Fetch
+                           && (pfnFunction == (uintptr_t)iemNativeHlpMemFlatFetchDataU256NoAc))
+                       || (   enmOp == kIemNativeEmitMemOp_Store
+                           && (pfnFunction == UINT64_C(0xc000b000a0009000))));
+                break;
 #endif
         }
@@ -4765,4 +4772,11 @@
                            && (   pfnFunction == (uintptr_t)iemNativeHlpMemFetchDataU128AlignedSse
                                || pfnFunction == (uintptr_t)iemNativeHlpMemFetchDataU128NoAc))
+                       || (   enmOp == kIemNativeEmitMemOp_Store
+                           && (pfnFunction == UINT64_C(0xc000b000a0009000))));
+                break;
+            case sizeof(RTUINT256U):
+                Assert(enmOp == kIemNativeEmitMemOp_Store || enmOp == kIemNativeEmitMemOp_Fetch);
+                Assert(   (   enmOp == kIemNativeEmitMemOp_Fetch
+                           && (pfnFunction == (uintptr_t)iemNativeHlpMemFetchDataU256NoAc))
                        || (   enmOp == kIemNativeEmitMemOp_Store
                            && (pfnFunction == UINT64_C(0xc000b000a0009000))));
@@ -5079,11 +5093,20 @@
                         off = iemNativeEmitLoadGprByGprU64Ex(pCodeBuf, off, idxRegValueFetch, idxRegMemResult);
                         break;
+#ifdef IEMNATIVE_WITH_SIMD_REG_ALLOCATOR
                     case sizeof(RTUINT128U):
                         /*
-                         * No need to back the register with the stack, this is done by the generic variable handling
+                         * No need to sync back the register with the stack, this is done by the generic variable handling
                          * code if there is a register assigned to a variable and the stack must be accessed.
                          */
                         off = iemNativeEmitLoadVecRegByGprU128Ex(pCodeBuf, off, idxRegValueFetch, idxRegMemResult);
                         break;
+                    case sizeof(RTUINT256U):
+                        /*
+                         * No need to sync back the register with the stack, this is done by the generic variable handling
+                         * code if there is a register assigned to a variable and the stack must be accessed.
+                         */
+                        off = iemNativeEmitLoadVecRegByGprU256Ex(pCodeBuf, off, idxRegValueFetch, idxRegMemResult);
+                        break;
+#endif
                     default:
                         AssertFailed();
@@ -5371,4 +5394,16 @@
                                                sizeof(RTUINT128U), sizeof(RTUINT128U) - 1, kIemNativeEmitMemOp_Fetch, \
                                                (uintptr_t)iemNativeHlpMemFlatFetchDataU128NoAc, pCallEntry->idxInstr)
+
+/* 256-bit segmented: */
+#define IEM_MC_FETCH_MEM_U256_NO_AC(a_u256Dst, a_iSeg, a_GCPtrMem) \
+    off = iemNativeEmitMemFetchStoreDataCommon(pReNative, off, a_u256Dst, a_iSeg, a_GCPtrMem, \
+                                               sizeof(RTUINT256U), sizeof(RTUINT256U) - 1, kIemNativeEmitMemOp_Fetch, \
+                                               (uintptr_t)iemNativeHlpMemFetchDataU256NoAc, pCallEntry->idxInstr)
+
+/* 256-bit flat: */
+#define IEM_MC_FETCH_MEM_FLAT_U256_NO_AC(a_u256Dst, a_GCPtrMem) \
+    off = iemNativeEmitMemFetchStoreDataCommon(pReNative, off, a_u256Dst, UINT8_MAX, a_GCPtrMem, \
+                                               sizeof(RTUINT256U), sizeof(RTUINT256U) - 1, kIemNativeEmitMemOp_Fetch, \
+                                               (uintptr_t)iemNativeHlpMemFlatFetchDataU256NoAc, pCallEntry->idxInstr)
 #endif
 
Index: trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp	(revision 103913)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllN8veRecompiler.cpp	(revision 103916)
@@ -1896,4 +1896,17 @@
 #endif
 }
+
+
+/**
+ * Used by TB code to load 256-bit data w/ segmentation.
+ */
+IEM_DECL_NATIVE_HLP_DEF(void, iemNativeHlpMemFetchDataU256NoAc,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, uint8_t iSegReg, PRTUINT256U pu256Dst))
+{
+#ifdef IEMNATIVE_WITH_TLB_LOOKUP_FETCH
+    iemMemFetchDataU256NoAcSafeJmp(pVCpu, pu256Dst, iSegReg, GCPtrMem);
+#else
+    iemMemFetchDataU256NoAcJmp(pVCpu, pu256Dst, iSegReg, GCPtrMem);
+#endif
+}
 #endif
 
@@ -2217,4 +2230,17 @@
 #else
     return iemMemFlatFetchDataU128NoAcJmp(pVCpu, pu128Dst, UINT8_MAX, GCPtrMem);
+#endif
+}
+
+
+/**
+ * Used by TB code to load unsigned 256-bit data w/ flat address.
+ */
+IEM_DECL_NATIVE_HLP_DEF(void, iemNativeHlpMemFlatFetchDataU256NoAc,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, PRTUINT256U pu256Dst))
+{
+#ifdef IEMNATIVE_WITH_TLB_LOOKUP_FETCH
+    return iemMemFetchDataU256NoAcSafeJmp(pVCpu, pu256Dst, UINT8_MAX, GCPtrMem);
+#else
+    return iemMemFlatFetchDataU256NoAcJmp(pVCpu, pu256Dst, UINT8_MAX, GCPtrMem);
 #endif
 }
Index: trunk/src/VBox/VMM/include/IEMInline.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMInline.h	(revision 103913)
+++ trunk/src/VBox/VMM/include/IEMInline.h	(revision 103916)
@@ -4106,4 +4106,13 @@
 #undef  TMPL_MEM_NO_MAPPING
 
+#define TMPL_MEM_NO_MAPPING
+#define TMPL_MEM_TYPE       RTUINT256U
+#define TMPL_MEM_TYPE_ALIGN 0
+#define TMPL_MEM_TYPE_SIZE  32
+#define TMPL_MEM_FN_SUFF    U256NoAc
+#define TMPL_MEM_FMT_TYPE   "%.32Rhxs"
+#define TMPL_MEM_FMT_DESC   "qqword"
+#include "../VMMAll/IEMAllMemRWTmplInline.cpp.h"
+#undef TMPL_MEM_NO_MAPPING
 
 #undef TMPL_MEM_CHECK_UNALIGNED_WITHIN_PAGE_OK
Index: trunk/src/VBox/VMM/include/IEMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMInternal.h	(revision 103913)
+++ trunk/src/VBox/VMM/include/IEMInternal.h	(revision 103916)
@@ -5488,7 +5488,7 @@
 void            iemMemFetchDataU128NoAcJmp(PVMCPUCC pVCpu, PRTUINT128U pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem) IEM_NOEXCEPT_MAY_LONGJMP;
 void            iemMemFetchDataU128AlignedSseJmp(PVMCPUCC pVCpu, PRTUINT128U pu128Dst, uint8_t iSegReg, RTGCPTR GCPtrMem) IEM_NOEXCEPT_MAY_LONGJMP;
+void            iemMemFetchDataU256NoAcJmp(PVMCPUCC pVCpu, PRTUINT256U pu256Dst, uint8_t iSegReg, RTGCPTR GCPtrMem) IEM_NOEXCEPT_MAY_LONGJMP;
 # endif
 void            iemMemFetchDataU256Jmp(PVMCPUCC pVCpu, PRTUINT256U pu256Dst, uint8_t iSegReg, RTGCPTR GCPtrMem) IEM_NOEXCEPT_MAY_LONGJMP;
-void            iemMemFetchDataU256NoAcJmp(PVMCPUCC pVCpu, PRTUINT256U pu256Dst, uint8_t iSegReg, RTGCPTR GCPtrMem) IEM_NOEXCEPT_MAY_LONGJMP;
 void            iemMemFetchDataU256AlignedSseJmp(PVMCPUCC pVCpu, PRTUINT256U pu256Dst, uint8_t iSegReg, RTGCPTR GCPtrMem) IEM_NOEXCEPT_MAY_LONGJMP;
 #endif
@@ -5531,8 +5531,8 @@
 void            iemMemStoreDataU128Jmp(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, RTUINT128U u128Value) IEM_NOEXCEPT_MAY_LONGJMP;
 void            iemMemStoreDataNoAcU128Jmp(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, RTUINT128U u128Value) IEM_NOEXCEPT_MAY_LONGJMP;
+void            iemMemStoreDataU256NoAcJmp(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, PCRTUINT256U pu256Value) IEM_NOEXCEPT_MAY_LONGJMP;
 #endif
 void            iemMemStoreDataU128AlignedSseJmp(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, RTUINT128U u128Value) IEM_NOEXCEPT_MAY_LONGJMP;
 void            iemMemStoreDataU256Jmp(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, PCRTUINT256U pu256Value) IEM_NOEXCEPT_MAY_LONGJMP;
-void            iemMemStoreDataU256NoAcJmp(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, PCRTUINT256U pu256Value) IEM_NOEXCEPT_MAY_LONGJMP;
 void            iemMemStoreDataU256AlignedAvxJmp(PVMCPUCC pVCpu, uint8_t iSegReg, RTGCPTR GCPtrMem, PCRTUINT256U pu256Value) IEM_NOEXCEPT_MAY_LONGJMP;
 #endif
Index: trunk/src/VBox/VMM/include/IEMN8veRecompiler.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMN8veRecompiler.h	(revision 103913)
+++ trunk/src/VBox/VMM/include/IEMN8veRecompiler.h	(revision 103916)
@@ -1648,4 +1648,5 @@
 IEM_DECL_NATIVE_HLP_PROTO(void,     iemNativeHlpMemFetchDataU128AlignedSse,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, uint8_t iSegReg, PRTUINT128U pu128Dst));
 IEM_DECL_NATIVE_HLP_PROTO(void,     iemNativeHlpMemFetchDataU128NoAc,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, uint8_t iSegReg, PRTUINT128U pu128Dst));
+IEM_DECL_NATIVE_HLP_PROTO(void,     iemNativeHlpMemFetchDataU256NoAc,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, uint8_t iSegReg, PRTUINT256U pu256Dst));
 #endif
 IEM_DECL_NATIVE_HLP_PROTO(void,     iemNativeHlpMemStoreDataU8,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, uint8_t iSegReg, uint8_t u8Value));
@@ -1674,4 +1675,5 @@
 IEM_DECL_NATIVE_HLP_PROTO(void,     iemNativeHlpMemFlatFetchDataU128AlignedSse,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, PRTUINT128U pu128Dst));
 IEM_DECL_NATIVE_HLP_PROTO(void,     iemNativeHlpMemFlatFetchDataU128NoAc,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, PRTUINT128U pu128Dst));
+IEM_DECL_NATIVE_HLP_PROTO(void,     iemNativeHlpMemFlatFetchDataU256NoAc,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, PRTUINT256U pu256Dst));
 #endif
 IEM_DECL_NATIVE_HLP_PROTO(void,     iemNativeHlpMemFlatStoreDataU8,(PVMCPUCC pVCpu, RTGCPTR GCPtrMem, uint8_t u8Value));
Index: trunk/src/VBox/VMM/include/IEMN8veRecompilerEmit.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMN8veRecompilerEmit.h	(revision 103913)
+++ trunk/src/VBox/VMM/include/IEMN8veRecompilerEmit.h	(revision 103916)
@@ -2464,4 +2464,42 @@
 }
 
+# ifdef IEMNATIVE_WITH_SIMD_REG_ALLOCATOR
+/**
+ * Common bit of iemNativeEmitLoadVecRegByGprU128 and friends.
+ *
+ * @note Odd and large @a offDisp values requires a temporary, unless it's a
+ *       load and @a iGprReg differs from @a iGprBase.  Will assert / throw if
+ *       caller does not heed this.
+ *
+ * @note DON'T try this with prefetch.
+ */
+DECL_FORCE_INLINE_THROW(uint32_t)
+iemNativeEmitVecRegByGprLdStEx(PIEMNATIVEINSTR pCodeBuf, uint32_t off, uint8_t iVecReg, uint8_t iGprBase, int32_t offDisp,
+                               ARMV8A64INSTRLDSTTYPE enmOperation, unsigned cbData, uint8_t iGprTmp = UINT8_MAX)
+{
+    if ((uint32_t)offDisp < _4K * cbData && !((uint32_t)offDisp & (cbData - 1)))
+    {
+        /* Use the unsigned variant of ldr Wt, [<Xn|SP>, #off]. */
+        pCodeBuf[off++] = Armv8A64MkInstrStLdRUOff(enmOperation, iVecReg, iGprBase, (uint32_t)offDisp / cbData);
+    }
+    else if (   !ARMV8A64INSTRLDSTTYPE_IS_STORE(enmOperation)
+             || iGprTmp != UINT8_MAX)
+    {
+        /* The offset is too large, so we must load it into a register and use
+           ldr Wt, [<Xn|SP>, (<Wm>|<Xm>)]. */
+        /** @todo reduce by offVCpu by >> 3 or >> 2? if it saves instructions? */
+        off = iemNativeEmitLoadGprImmEx(pCodeBuf, off, iGprTmp, (int64_t)offDisp);
+        pCodeBuf[off++] = Armv8A64MkInstrStLdRegIdx(enmOperation, iVecReg, iGprBase, iGprTmp);
+    }
+    else
+# ifdef IEM_WITH_THROW_CATCH
+        AssertFailedStmt(IEMNATIVE_DO_LONGJMP(NULL, VERR_IEM_IPE_9));
+# else
+        AssertReleaseFailedStmt(off = UINT32_MAX);
+# endif
+    return off;
+}
+# endif
+
 #endif /* RT_ARCH_ARM64 */
 
@@ -2878,6 +2916,6 @@
 
 #elif defined(RT_ARCH_ARM64)
-    off = iemNativeEmitGprByGprLdStEx(pCodeBuf, off, iVecRegDst, iGprBase, offDisp,
-                                      kArmv8A64InstrLdStType_Ld_Vr_128, sizeof(RTUINT128U), iGprTmp);
+    off = iemNativeEmitVecRegByGprLdStEx(pCodeBuf, off, iVecRegDst, iGprBase, offDisp,
+                                         kArmv8A64InstrLdStType_Ld_Vr_128, sizeof(RTUINT128U), iGprTmp);
 
 #else
@@ -2900,4 +2938,65 @@
 #elif defined(RT_ARCH_ARM64)
     off = iemNativeEmitGprByGprLdSt(pReNative, off, iVecRegDst, iGprBase, offDisp, kArmv8A64InstrLdStType_Ld_Vr_128, sizeof(RTUINT128U));
+
+#else
+# error "port me"
+#endif
+    return off;
+}
+
+
+/**
+ * Emits a 256-bit vector register load via a GPR base address with a displacement.
+ *
+ * @note ARM64: Misaligned @a offDisp values and values not in the
+ *       -0x7ff8...0x7ff8 range will require a temporary register (@a iGprTmp) if
+ *       @a iGprReg and @a iGprBase are the same. Will assert / throw if caller
+ *       does not heed this.
+ */
+DECL_FORCE_INLINE_THROW(uint32_t)
+iemNativeEmitLoadVecRegByGprU256Ex(PIEMNATIVEINSTR pCodeBuf, uint32_t off, uint8_t iVecRegDst, uint8_t iGprBase,
+                                   int32_t offDisp = 0, uint8_t iGprTmp = UINT8_MAX)
+{
+#ifdef RT_ARCH_AMD64
+    /* vmovdqu reg256, mem256 */
+    pCodeBuf[off++] = X86_OP_VEX3;
+    pCodeBuf[off++] =   (iVecRegDst < 8 ? X86_OP_VEX3_BYTE1_R : 0)
+                      | X86_OP_VEX3_BYTE1_X
+                      | (iGprBase < 8 ? X86_OP_VEX3_BYTE1_B : 0)
+                      | UINT8_C(0x01);
+    pCodeBuf[off++] = X86_OP_VEX3_BYTE2_MAKE_NO_VVVV(false /*f64BitOpSz*/, true /*f256BitAvx*/, X86_OP_VEX2_BYTE1_P_0F3H);
+    pCodeBuf[off++] = 0x6f;
+    off = iemNativeEmitGprByGprDisp(pCodeBuf, off, iVecRegDst, iGprBase, offDisp);
+    RT_NOREF(iGprTmp);
+
+#elif defined(RT_ARCH_ARM64)
+    Assert(!(iVecRegDst & 0x1));
+    off = iemNativeEmitVecRegByGprLdStEx(pCodeBuf, off, iVecRegDst, iGprBase, offDisp,
+                                         kArmv8A64InstrLdStType_Ld_Vr_128, sizeof(RTUINT128U), iGprTmp);
+    off = iemNativeEmitVecRegByGprLdStEx(pCodeBuf, off, iVecRegDst + 1, iGprBase, offDisp + sizeof(RTUINT128U),
+                                         kArmv8A64InstrLdStType_Ld_Vr_128, sizeof(RTUINT128U), iGprTmp);
+#else
+# error "port me"
+#endif
+    return off;
+}
+
+
+/**
+ * Emits a 256-bit GPR load via a GPR base address with a displacement.
+ */
+DECL_INLINE_THROW(uint32_t)
+iemNativeEmitLoadVecRegByGprU256(PIEMRECOMPILERSTATE pReNative, uint32_t off, uint8_t iVecRegDst, uint8_t iGprBase, int32_t offDisp)
+{
+#ifdef RT_ARCH_AMD64
+    off = iemNativeEmitLoadVecRegByGprU128Ex(iemNativeInstrBufEnsure(pReNative, off, 8), off, iVecRegDst, iGprBase, offDisp);
+    IEMNATIVE_ASSERT_INSTR_BUF_ENSURE(pReNative, off);
+
+#elif defined(RT_ARCH_ARM64)
+    Assert(!(iVecRegDst & 0x1));
+    off = iemNativeEmitGprByGprLdSt(pReNative, off, iVecRegDst, iGprBase, offDisp,
+                                    kArmv8A64InstrLdStType_Ld_Vr_128, sizeof(RTUINT128U));
+    off = iemNativeEmitGprByGprLdSt(pReNative, off, iVecRegDst + 1, iGprBase, offDisp + sizeof(RTUINT128U),
+                                    kArmv8A64InstrLdStType_Ld_Vr_128, sizeof(RTUINT128U));
 
 #else
