Index: /trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm	(revision 104181)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm	(revision 104182)
@@ -572,17 +572,78 @@
 
 ;;
-; Checks that the size expression %1 matches %2 adjusted according to
-; RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK and for 256 entries.
-; @param 1  The jump array size assembly expression.
-; @param 2  The size without accounting for the IBT_ENDBRxx_WITHOUT_NOTRACK instruction.
-;
-%macro IEMCHECK_256_JUMP_ARRAY_SIZE 2
+; Loads register with offset of imm8 instruction -- used by all of the instruction
+; implementations which lay out jump tables of 256x immediate byte variants.
+; Also checks that the instruction size matches the offsets in the table.
+;
+; @param    1       The register to receive the jump target address (T1).
+; @param    2       The register containing the imm8 index (A1 / A2 / A3).
+; @param    3       Byte size of one instruction + ret (+ ?int3) in the table
+; @note             Implicitly uses local symbols .imm0, .imm1, and .immEmd
+;                   (implementation artifacts of each instruction jump table).
+;
+; Emits the equivalent (in actual code) of `lea %1, [.imm0 + %2 * %3]`.
+;
+%macro IEMIMPL_JUMP_TABLE_TARGET_INT 3
+        lea     %1, [.imm0 xWrtRIP]
+  %if   %3 == 5
+        lea     T0, [%2 + %2*4]  ; *5
+        lea     %1, [%1 + T0]    ; *5 + .imm0
+  %elif %3 == 6
+        lea     T0, [%2 + %2*2]  ; *3
+        lea     %1, [%1 + T0*2]  ; *6 + .imm0
+  %elif %3 == 7
+        lea     T0, [%2 + %2*2]  ; *3
+        lea     T0, [T0 + %2*4]  ; *7
+        lea     %1, [%1 + T0]    ; *7 + .imm0
+  %elif %3 == 8
+        lea     %1, [%1 + %2*8]  ; *8 + .imm0
+  %elif %3 == 9
+        lea     T0, [%2 + %2*8]  ; *9
+        lea     %1, [%1 + T0]    ; *9 + .imm0
+  %elif %3 == 10
+        lea     T0, [%2 + %2*4]  ; *5
+        lea     %1, [%1 + T0*2]  ; *10 + .imm0
+  %elif %3 == 11
+        lea     T0, [%2 + %2*4]  ; *5
+        lea     T0, [%2 + T0*2]  ; *11
+        lea     %1, [%1 + T0]    ; *11 + .imm0
+  %elif %3 == 12
+        lea     T0, [%2 + %2*2]  ; *3
+        lea     %1, [%1 + T0*4]  ; *12 + .imm0
+  %else
+   %error Unexpected instruction byte count in IEMIMPL_JUMP_TABLE_TARGET_INT
+  %endif
+        ; check size: 'warning: value does not fit in 8 bit field' if bad
+        times (.imm1 - .imm0 + %3) %% %3 db 999 * \
+              (.imm1 - .imm0 + %3)
+        ; check alignment: 'warning: value does not fit in 8 bit field' if bad
+        times ((.immEnd - .imm0) - 256 * %3) db 999 * \
+              ((.immEnd - .imm0) - 256 * %3)
+%endmacro
+
+%macro IEMIMPL_JUMP_TABLE_TARGET 3
  %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        dw      (0xffff - %2 - 256*4) + %1  ; will cause warning if entries are too big.
-        dw      (0xffff + %2 + 256*4) - %1  ; will cause warning if entries are too small.
+        IEMIMPL_JUMP_TABLE_TARGET_INT %1, %2, (%3 + 4)
  %else
-        dw      (0xffff - %2)         + %1  ; will cause warning if entries are too big.
-        dw      (0xffff + %2)         - %1  ; will cause warning if entries are too small.
+        IEMIMPL_JUMP_TABLE_TARGET_INT %1, %2, %3
  %endif
+%endmacro
+
+
+;;
+; Calls the given imm8 instruction -- used by all of the instruction
+; implementations which lay out jump tables of 256x immediate byte variants.
+;
+; @param    1       The register to receive the jump target address (T1).
+; @param    2       The register containing the imm8 index (A1 / A2 / A3).
+; @param    3       Byte size of one instruction + ret (+ ?int3) in the table
+;
+; Emits the equivalent (in actual code) of `lea %1, [.imm0 + %2 * %3]` +
+; `IBT_NOTRACK, call %1`.
+;
+%macro IEMIMPL_CALL_JUMP_TABLE_TARGET 3
+        IEMIMPL_JUMP_TABLE_TARGET %1, %2, %3
+        IBT_NOTRACK
+        call    %1
 %endmacro
 
@@ -4182,13 +4243,5 @@
         movq    mm1, [A1]
         movq    mm0, mm0                ; paranoia!
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*8]         ; sizeof(pshufw+ret) == 9
- %else
-        lea     T0, [A2 + A2*4]         ; sizeof(pshufw+ret) == 5
- %endif
-        lea     T1, [T1 + T0]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, 5
         movq    [A0], mm0
 
@@ -4203,5 +4256,5 @@
  %assign bImm bImm + 1
 %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x500
+.immEnd:
 ENDPROC iemAImpl_pshufw_u64
 
@@ -4215,13 +4268,5 @@
         movdqu  xmm1, [A1]
         movdqu  xmm0, xmm1              ; paranoia!
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*4]         ; sizeof(pshufXX+ret) == 10: A2 * 10 = (A2 * 5) * 2
- %else
-        lea     T0, [A2 + A2*2]         ; sizeof(pshufXX+ret) ==  6: A2 *  6 = (A2 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, 6
         movdqu  [A0], xmm0
 
@@ -4237,5 +4282,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _u128
 %endmacro
@@ -4252,15 +4297,7 @@
 
         movzx   A2, A2_8                ; must clear top bits
-        vmovdqu  ymm1, [A1]
-        vmovdqu  ymm0, ymm1             ; paranoia!
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*4]         ; sizeof(pshufXX+ret) == 10: A2 * 10 = (A2 * 5) * 2
- %else
-        lea     T0, [A2 + A2*2]         ; sizeof(pshufXX+ret) ==  6: A2 *  6 = (A2 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        vmovdqu ymm1, [A1]
+        vmovdqu ymm0, ymm1              ; paranoia!
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, 6
         vmovdqu  [A0], ymm0
 
@@ -4275,5 +4312,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _u256
 %endmacro
@@ -4295,13 +4332,5 @@
         movzx   A1, A1_8                ; must clear top bits
         movq    mm0, [A0]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A1 + A1*8]         ; sizeof(psXX+ret) == 9
- %else
-        lea     T0, [A1 + A1*4]         ; sizeof(psXX+ret) == 5
- %endif
-        lea     T1, [T1 + T0]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A1, 5
         movq    [A0], mm0
 
@@ -4316,5 +4345,5 @@
  %assign bImm bImm + 1
 %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x500
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _imm_u64
 %endmacro
@@ -4337,13 +4366,5 @@
         movzx   A1, A1_8                ; must clear top bits
         movdqu  xmm0, [A0]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A1 + A1*4]         ; sizeof(psXX+ret) == 10: A1 * 10 = (A1 * 5) * 2
- %else
-        lea     T0, [A1 + A1*2]         ; sizeof(psXX+ret) ==  6: A1 *  6 = (A1 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A1, 6
         movdqu  [A0], xmm0
 
@@ -4358,5 +4379,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _imm_u128
 %endmacro
@@ -4370,6 +4391,4 @@
 IEMIMPL_MEDIA_SSE_PSHIFTXX psraw
 IEMIMPL_MEDIA_SSE_PSHIFTXX psrad
-IEMIMPL_MEDIA_SSE_PSHIFTXX pslldq
-IEMIMPL_MEDIA_SSE_PSHIFTXX psrldq
 
 
@@ -5177,13 +5196,5 @@
         movdqu  xmm0, [A0]
         movdqu  xmm1, [A1]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*4]         ; sizeof(shufpX+ret+int3) == 10: A2 * 10 = (A2 * 5) * 2
- %else
-        lea     T0, [A2 + A2*2]         ; sizeof(shufpX+ret+int3) ==  6: A2 *  6 = (A2 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, 6
         movdqu  [A0], xmm0
 
@@ -5199,5 +5210,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_shufps_u128
 
@@ -5217,13 +5228,5 @@
         movdqu  xmm0, [A0]
         movdqu  xmm1, [A1]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*4]         ; sizeof(shufpX+ret) == 10: A2 * 10 = (A2 * 5) * 2
- %else
-        lea     T0, [A2 + A2*2]         ; sizeof(shufpX+ret) ==  6: A2 *  6 = (A2 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, 6
         movdqu  [A0], xmm0
 
@@ -5238,5 +5241,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_shufpd_u128
 
@@ -5260,13 +5263,5 @@
         movdqu  xmm0, [A1]
         movdqu  xmm1, [A2]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*4]         ; sizeof(vshufpX+ret) == 10: A3 * 10 = (A3 * 5) * 2
- %else
-        lea     T0, [A3 + A3*2]         ; sizeof(vshufpX+ret) ==  6: A3 *  6 = (A3 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A3, 6
         movdqu  [A0], xmm0
 
@@ -5281,5 +5276,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _u128
 
@@ -5291,13 +5286,5 @@
         vmovdqu ymm0, [A1]
         vmovdqu ymm1, [A2]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*4]         ; sizeof(vshufpX+ret) == 10: A3 * 10 = (A3 * 5) * 2
- %else
-        lea     T0, [A3 + A3*2]         ; sizeof(vshufpX+ret) ==  6: A3 *  6 = (A3 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A3, 6
         vmovdqu [A0], ymm0
 
@@ -5312,5 +5299,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _u256
 %endmacro
@@ -5407,13 +5394,5 @@
         movq    mm0, [A0]
         movq    mm1, A1
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*4]         ; sizeof(endbrxx+palignr+ret) == 10: A2 * 10 = (A2 * 5) * 2
- %else
-        lea     T0, [A2 + A2*2]         ; sizeof(palignr+ret)         ==  6: A2 *  6 = (A2 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, 6
         movq    [A0], mm0
 
@@ -5428,5 +5407,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_palignr_u64
 
@@ -5451,13 +5430,5 @@
         movdqu  xmm0, [A0]
         movdqu  xmm1, [A1]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*2]         ; sizeof(endbrxx+insnX+ret+int3) == 12: A2 * 12 = (A2 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A2*8]         ; sizeof(insnX+ret+int3)         ==  8: A2 * 8
- %endif
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, 8
         movdqu  [A0], xmm0
 
@@ -5473,5 +5444,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _u128
 %endmacro
@@ -5509,13 +5480,5 @@
         movdqu  xmm0, [A1]
         movdqu  xmm1, [A2]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*2]         ; sizeof(endbrxx+insnX+ret+int3) == 12: A3 * 12 = (A3 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A3*8]         ; sizeof(insnX+ret+int3)         ==  8: A3 * 8
- %endif
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A3, 8
         movdqu  [A0], xmm0
 
@@ -5531,5 +5494,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _u128
  %endif
@@ -5543,13 +5506,5 @@
         vmovdqu ymm0, [A1]
         vmovdqu ymm1, [A2]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*2]         ; sizeof(endbrxx+insnX+ret+int3) == 12: A3 * 12 = (A3 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A3*8]         ; sizeof(insnX+ret+int3)         ==  8: A3 *  8
- %endif
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A3, 8
         vmovdqu [A0], ymm0
 
@@ -5565,5 +5520,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _u256
  %endif
@@ -5589,4 +5544,5 @@
 ; @param    2       Whether the instruction has a 128-bit variant (1) or not (0).
 ; @param    3       Whether the instruction has a 256-bit variant (1) or not (0).
+; @param    4       The number of bytes taken up by a single instance of the instruction.
 ;
 ; @param    A0      Pointer to the destination media register size operand (output).
@@ -5594,5 +5550,5 @@
 ; @param    A2      The 8-bit immediate
 ;
-%macro IEMIMPL_MEDIA_AVX_INSN_IMM8_2OP_6 3
+%macro IEMIMPL_MEDIA_AVX_INSN_IMM8_2OP 4
  %if %2 == 1
 BEGINPROC_FASTCALL iemAImpl_ %+ %1 %+ _imm_u128, 16
@@ -5602,13 +5558,5 @@
         movzx   A2, A2_8                ; must clear top bits
         movdqu  xmm1, [A1]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*2]         ; sizeof(endbrxx+insnX+ret+int3) == 12: A2 * 12 = (A2 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A2*8]         ; sizeof(insnX+ret+int3)         ==  8: A2 * 8
- %endif
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, %4
         movdqu  [A0], xmm0
 
@@ -5624,5 +5572,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _imm_u128
  %endif
@@ -5635,13 +5583,5 @@
         movzx   A2, A2_8                ; must clear top bits
         vmovdqu ymm1, [A1]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*2]         ; sizeof(endbrxx+insnX+ret+int3) == 12: A2 * 12 = (A2 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A2*8]         ; sizeof(insnX+ret+int3)         ==  8: A2 *  8
- %endif
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, %4
         vmovdqu [A0], ymm0
 
@@ -5657,11 +5597,13 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _imm_u256
  %endif
 %endmacro
 
-IEMIMPL_MEDIA_AVX_INSN_IMM8_2OP_6 vpermilps,  1, 1
-IEMIMPL_MEDIA_AVX_INSN_IMM8_2OP_6 vpermilpd,  1, 1
+IEMIMPL_MEDIA_AVX_INSN_IMM8_2OP vpermilps, 1, 1, 8
+IEMIMPL_MEDIA_AVX_INSN_IMM8_2OP vpermilpd, 1, 1, 8
+IEMIMPL_MEDIA_AVX_INSN_IMM8_2OP vpslldq,   1, 1, 7
+IEMIMPL_MEDIA_AVX_INSN_IMM8_2OP vpsrldq,   1, 1, 7
 
 
@@ -5697,13 +5639,5 @@
         movdqu  xmm1, [A2 + IEMPCMPISTRXSRC.uSrc2]
         mov     T2, A0                  ; A0 can be ecx/rcx in some calling conventions which gets overwritten later (T2 only available on AMD64)
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*2]         ; sizeof(endbrxx+insnX+ret) == 12: A3 * 12 = (A3 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A3*8]         ; sizeof(insnX+ret)         ==  8: A3 * 8
- %endif
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A3, 8
 
         IEM_SAVE_FLAGS A1, X86_EFL_CF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF, 0, X86_EFL_AF | X86_EFL_PF
@@ -5721,5 +5655,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_pcmpistri_u128
 
@@ -5740,11 +5674,5 @@
         movdqu  xmm1, [A2 + IEMPCMPESTRXSRC.uSrc2]
         mov     T2, A0                  ; A0 can be ecx/rcx in some calling conventions which gets overwritten later (T2 only available on AMD64)
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*2]         ; sizeof(endbrxx+insnX+ret) == 12: A3 * 12 = (A3 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A3*8]         ; sizeof(insnX+ret)         == 8: A3 * 8
- %endif
+        IEMIMPL_JUMP_TABLE_TARGET T1, A3, 8
         push    xDX                                 ; xDX can be A1 or A2 depending on the calling convention
         mov     xAX, [A2 + IEMPCMPESTRXSRC.u64Rax]  ; T0 is rax, so only overwrite it after we're done using it
@@ -5768,5 +5696,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_pcmpestri_u128
 
@@ -5786,13 +5714,5 @@
         movdqu  xmm1, [A2 + IEMPCMPISTRXSRC.uSrc1]
         movdqu  xmm2, [A2 + IEMPCMPISTRXSRC.uSrc2]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*2]         ; sizeof(endbrxx+pcmpistrm+ret) == 12: A3 * 12 = (A3 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A3*8]         ; sizeof(pcmpistrm+ret)         ==  8: A3 * 8
- %endif
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A3, 8
 
         IEM_SAVE_FLAGS A1, X86_EFL_CF | X86_EFL_ZF | X86_EFL_SF | X86_EFL_OF, 0, X86_EFL_AF | X86_EFL_PF
@@ -5810,5 +5730,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_pcmpistrm_u128
 
@@ -5828,11 +5748,5 @@
         movdqu  xmm1, [A2 + IEMPCMPESTRXSRC.uSrc1]
         movdqu  xmm2, [A2 + IEMPCMPESTRXSRC.uSrc2]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*2]         ; sizeof(endbrxx+insnX+ret) == 12: A3 * 12 = (A3 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A3*8]         ; sizeof(insnX+ret)         ==  8: A3 * 8
- %endif
+        IEMIMPL_JUMP_TABLE_TARGET T1, A3, 8
         push    xDX                                 ; xDX can be A1 or A2 depending on the calling convention
         mov     xAX, [A2 + IEMPCMPESTRXSRC.u64Rax]  ; T0 is rax, so only overwrite it after we're done using it
@@ -5856,5 +5770,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_pcmpestrm_u128
 
@@ -6354,13 +6268,5 @@
         movdqu  xmm0, [A2 + IEMMEDIAF2XMMSRC.uSrc1]
         movdqu  xmm1, [A2 + IEMMEDIAF2XMMSRC.uSrc2]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*8]         ; sizeof(endbrxx+cmpps+ret) == 9: A3 * 9
- %else
-        lea     T0, [A3 + A3*4]         ; sizeof(cmpps+ret)         == 5: A3 * 5
- %endif
-        lea     T1, [T1 + T0]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A3, 5
         movdqu  [A1], xmm0
 
@@ -6376,5 +6282,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x500
+.immEnd:
 ENDPROC iemAImpl_cmpps_u128
 
@@ -6402,13 +6308,5 @@
         movdqu  xmm0, [A2 + IEMMEDIAF2XMMSRC.uSrc1]
         movdqu  xmm1, [A2 + IEMMEDIAF2XMMSRC.uSrc2]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*4]         ; sizeof(endbrxx+cmpXX+ret) == 10: A3 * 10 = (A3 * 5) * 2
- %else
-        lea     T0, [A3 + A3*2]         ; sizeof(cmpXX+ret)         ==  6: A3 *  6 = (A3 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A3, 6
         movdqu  [A1], xmm0
 
@@ -6424,5 +6322,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _u128
 %endmacro
@@ -6455,13 +6353,5 @@
         movdqu  xmm0, [A2 + IEMMEDIAF2XMMSRC.uSrc1]
         movdqu  xmm1, [A2 + IEMMEDIAF2XMMSRC.uSrc2]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A3 + A3*2]         ; sizeof(endbrxx+insn+ret+int3) == 12: A3 * 12 = (A3 * 3) * 4
-        lea     T1, [T1 + T0*4]
- %else
-        lea     T1, [T1 + A3*8]         ; sizeof(insn+ret+int3)         ==  8: A3 * 8
- %endif
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A3, 8
         movdqu  [A1], xmm0
 
@@ -6478,5 +6368,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x800
+.immEnd:
 ENDPROC iemAImpl_ %+ %1 %+ _u128
 %endmacro
@@ -6626,13 +6516,5 @@
         movdqu  xmm0, [A0]
         movdqu  xmm1, [A1]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*4]         ; sizeof(endbrxx+sha1rnds4+ret) == 10: A2 * 10 = (A2 * 5) * 2
- %else
-        lea     T0, [A2 + A2*2]         ; sizeof(sha1rnds4+ret)         ==  6: A2 *  6 = (A2 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
+        IEMIMPL_CALL_JUMP_TABLE_TARGET T1, A2, 6
         movdqu  [A0], xmm0
 
@@ -6647,5 +6529,5 @@
   %assign bImm bImm + 1
  %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
+.immEnd:
 ENDPROC iemAImpl_sha1rnds4_u128
 
