Index: trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm	(revision 104208)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm	(revision 104209)
@@ -1083,6 +1083,7 @@
 ; where the 64-bit accesses requires hand coding.
 ;
-; All the functions takes a pointer to the destination memory operand in A0,
-; the source register operand in A1 and a pointer to eflags in A2.
+; All the functions takes a pointer to the destination memory operand in A1,
+; the source register operand in A2 and incoming EFLAGS in A0.  Updated EFLAGS
+; are returned in EAX.
 ;
 ; @param        1       The instruction mnemonic.
@@ -1094,9 +1095,9 @@
 BEGINPROC_FASTCALL iemAImpl_ %+ %1 %+ _u32, 12
         PROLOGUE_4_ARGS
-        IEM_MAYBE_LOAD_FLAGS_OLD           A2, %2, %3, 0 ;; @todo check if any undefined flags are passed thru
-        mov     T0_32, [A0]
-        %1      T0_32, A1_32
-        mov     [A0], T0_32
-        IEM_SAVE_FLAGS_OLD                 A2, %2, %3, %4
+        IEM_MAYBE_LOAD_FLAGS               A0_32, %2, %3, 0 ;; @todo check if any undefined flags are passed thru
+        mov     T0_32, [A1]
+        %1      T0_32, A2_32
+        mov     [A1], T0_32
+        IEM_SAVE_FLAGS_RETVAL              A0_32, %2, %3, %4
         EPILOGUE_4_ARGS
 ENDPROC iemAImpl_ %+ %1 %+ _u32
@@ -1105,9 +1106,9 @@
 BEGINPROC_FASTCALL iemAImpl_ %+ %1 %+ _u64, 12
         PROLOGUE_4_ARGS
-        IEM_MAYBE_LOAD_FLAGS_OLD           A2, %2, %3, 0
-        mov     T0, [A0]
-        %1      T0, A1
-        mov     [A0], T0
-        IEM_SAVE_FLAGS_OLD                 A2, %2, %3, %4
+        IEM_MAYBE_LOAD_FLAGS               A0_32, %2, %3, 0
+        mov     T0, [A1]
+        %1      T0, A2
+        mov     [A1], T0
+        IEM_SAVE_FLAGS_RETVAL              A0_32, %2, %3, %4
         EPILOGUE_4_ARGS
 ENDPROC iemAImpl_ %+ %1 %+ _u64
Index: trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp	(revision 104208)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp	(revision 104209)
@@ -1821,11 +1821,9 @@
  */
 #define EMIT_BLSR(a_cBits, a_Type, a_Suffix) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_blsr_u,a_cBits,a_Suffix),(a_Type *puDst, a_Type uSrc, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_blsr_u,a_cBits,a_Suffix),(uint32_t fEFlags, a_Type *puDst, a_Type uSrc)) \
 { \
-    uint32_t fEfl1 = *pfEFlags; \
-    uint32_t fEfl2 = fEfl1; \
     *puDst = uSrc; \
-    fEfl1 = iemAImpl_sub_u ## a_cBits(fEfl1, &uSrc, 1); \
-    fEfl2 = iemAImpl_and_u ## a_cBits(fEfl2, puDst, uSrc); \
+    uint32_t fEfl1 = iemAImpl_sub_u ## a_cBits(fEFlags, &uSrc, 1); \
+    uint32_t fEfl2 = iemAImpl_and_u ## a_cBits(fEFlags, puDst, uSrc); \
     \
     /* AMD: The carry flag is from the SUB operation. */ \
@@ -1833,5 +1831,5 @@
     fEfl2 &= ~(X86_EFL_CF | X86_EFL_PF); \
     fEfl2 |= fEfl1 & X86_EFL_CF; \
-    *pfEFlags = fEfl2; \
+    return fEfl2; \
 }
 
@@ -1849,11 +1847,9 @@
  */
 #define EMIT_BLSMSK(a_cBits, a_Type, a_Suffix) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_blsmsk_u,a_cBits,a_Suffix),(a_Type *puDst, a_Type uSrc, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_blsmsk_u,a_cBits,a_Suffix),(uint32_t fEFlags, a_Type *puDst, a_Type uSrc)) \
 { \
-    uint32_t fEfl1 = *pfEFlags; \
-    uint32_t fEfl2 = fEfl1; \
     *puDst = uSrc; \
-    fEfl1 = iemAImpl_sub_u ## a_cBits(fEfl1, &uSrc, 1); \
-    fEfl2 = iemAImpl_xor_u ## a_cBits(fEfl2, puDst, uSrc); \
+    uint32_t fEfl1 = iemAImpl_sub_u ## a_cBits(fEFlags, &uSrc, 1); \
+    uint32_t fEfl2 = iemAImpl_xor_u ## a_cBits(fEFlags, puDst, uSrc); \
     \
     /* AMD: The carry flag is from the SUB operation. */ \
@@ -1861,5 +1857,5 @@
     fEfl2 &= ~(X86_EFL_CF | X86_EFL_PF); \
     fEfl2 |= fEfl1 & X86_EFL_CF; \
-    *pfEFlags = fEfl2; \
+    return fEfl2; \
 }
 
@@ -1877,11 +1873,10 @@
  */
 #define EMIT_BLSI(a_cBits, a_Type, a_Suffix) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_blsi_u,a_cBits,a_Suffix),(a_Type *puDst, a_Type uSrc, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_blsi_u,a_cBits,a_Suffix),(uint32_t fEFlags, a_Type *puDst, a_Type uSrc)) \
 { \
-    uint32_t fEfl1 = *pfEFlags; \
-    uint32_t fEfl2 = fEfl1; \
+    uint32_t fEfl1 = fEFlags; \
     *puDst = uSrc; \
     iemAImpl_neg_u ## a_cBits(&uSrc, &fEfl1); \
-    fEfl2 = iemAImpl_and_u ## a_cBits(fEfl2, puDst, uSrc); \
+    uint32_t fEfl2 = iemAImpl_and_u ## a_cBits(fEFlags, puDst, uSrc); \
     \
     /* AMD: The carry flag is from the SUB operation. */ \
@@ -1889,5 +1884,5 @@
     fEfl2 &= ~(X86_EFL_CF | X86_EFL_PF); \
     fEfl2 |= fEfl1 & X86_EFL_CF; \
-    *pfEFlags = fEfl2; \
+    return fEfl2; \
 }
 
Index: trunk/src/VBox/VMM/VMMAll/IEMAllInstVexMap2.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllInstVexMap2.cpp.h	(revision 104208)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllInstVexMap2.cpp.h	(revision 104209)
@@ -1822,12 +1822,13 @@
             IEM_MC_BEGIN(IEM_MC_F_64BIT, 0); \
             IEMOP_HLP_DONE_VEX_DECODING_L0_EX(fBmi1); \
-            IEM_MC_ARG(uint64_t *,          pDst,    0); \
-            IEM_MC_ARG(uint64_t,            uSrc,    1); \
-            IEM_MC_ARG(uint32_t *,          pEFlags, 2); \
+            IEM_MC_ARG(uint64_t,            uSrc,       2); \
             IEM_MC_FETCH_GREG_U64(uSrc, IEM_GET_MODRM_RM(pVCpu, bRm)); \
+            IEM_MC_ARG(uint64_t *,          pDst,       1); \
             IEM_MC_REF_GREG_U64(pDst,   IEM_GET_EFFECTIVE_VVVV(pVCpu)); \
-            IEM_MC_REF_EFLAGS(pEFlags); \
-            IEM_MC_CALL_VOID_AIMPL_3(IEM_SELECT_HOST_OR_FALLBACK(fBmi1, iemAImpl_ ## a_Instr ## _u64, \
-                                                                 iemAImpl_ ## a_Instr ## _u64_fallback), pDst, uSrc, pEFlags); \
+            IEM_MC_ARG_EFLAGS(              fEFlagsIn,  0); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, \
+                                IEM_SELECT_HOST_OR_FALLBACK(fBmi1, iemAImpl_ ## a_Instr ## _u64, \
+                                                                   iemAImpl_ ## a_Instr ## _u64_fallback), fEFlagsIn, pDst, uSrc); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
@@ -1837,13 +1838,14 @@
             IEM_MC_BEGIN(IEM_MC_F_NOT_286_OR_OLDER, 0); \
             IEMOP_HLP_DONE_VEX_DECODING_L0_EX(fBmi1); \
-            IEM_MC_ARG(uint32_t *,          pDst,    0); \
-            IEM_MC_ARG(uint32_t,            uSrc,    1); \
-            IEM_MC_ARG(uint32_t *,          pEFlags, 2); \
+            IEM_MC_ARG(uint32_t,            uSrc,       2); \
             IEM_MC_FETCH_GREG_U32(uSrc, IEM_GET_MODRM_RM(pVCpu, bRm)); \
+            IEM_MC_ARG(uint32_t *,          pDst,       1); \
             IEM_MC_REF_GREG_U32(pDst,   IEM_GET_EFFECTIVE_VVVV(pVCpu)); \
-            IEM_MC_REF_EFLAGS(pEFlags); \
-            IEM_MC_CALL_VOID_AIMPL_3(IEM_SELECT_HOST_OR_FALLBACK(fBmi1, iemAImpl_ ## a_Instr ## _u32, \
-                                                                 iemAImpl_ ## a_Instr ## _u32_fallback), pDst, uSrc, pEFlags); \
+            IEM_MC_ARG_EFLAGS(              fEFlagsIn,  0); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, \
+                                IEM_SELECT_HOST_OR_FALLBACK(fBmi1, iemAImpl_ ## a_Instr ## _u32, \
+                                                                   iemAImpl_ ## a_Instr ## _u32_fallback), fEFlagsIn, pDst, uSrc); \
             IEM_MC_CLEAR_HIGH_GREG_U64(IEM_GET_EFFECTIVE_VVVV(pVCpu)); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
@@ -1858,15 +1860,17 @@
         { \
             IEM_MC_BEGIN(IEM_MC_F_64BIT, 0); \
-            IEM_MC_ARG(uint64_t *,          pDst,    0); \
-            IEM_MC_ARG(uint64_t,            uSrc,    1); \
-            IEM_MC_ARG(uint32_t *,          pEFlags, 2); \
             IEM_MC_LOCAL(RTGCPTR,           GCPtrEffSrc); \
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0); \
             IEMOP_HLP_DONE_VEX_DECODING_L0_EX(fBmi1); \
+            \
+            IEM_MC_ARG(uint64_t,            uSrc,       2); \
             IEM_MC_FETCH_MEM_U64(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc); \
+            IEM_MC_ARG(uint64_t *,          pDst,       1); \
             IEM_MC_REF_GREG_U64(pDst,  IEM_GET_EFFECTIVE_VVVV(pVCpu)); \
-            IEM_MC_REF_EFLAGS(pEFlags); \
-            IEM_MC_CALL_VOID_AIMPL_3(IEM_SELECT_HOST_OR_FALLBACK(fBmi1, iemAImpl_ ## a_Instr ## _u64, \
-                                                                 iemAImpl_ ## a_Instr ## _u64_fallback), pDst, uSrc, pEFlags); \
+            IEM_MC_ARG_EFLAGS(              fEFlagsIn,  0); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, \
+                                IEM_SELECT_HOST_OR_FALLBACK(fBmi1, iemAImpl_ ## a_Instr ## _u64, \
+                                                                   iemAImpl_ ## a_Instr ## _u64_fallback), fEFlagsIn, pDst, uSrc); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
@@ -1875,16 +1879,18 @@
         { \
             IEM_MC_BEGIN(IEM_MC_F_NOT_286_OR_OLDER, 0); \
-            IEM_MC_ARG(uint32_t *,          pDst,    0); \
-            IEM_MC_ARG(uint32_t,            uSrc,    1); \
-            IEM_MC_ARG(uint32_t *,          pEFlags, 2); \
             IEM_MC_LOCAL(RTGCPTR,           GCPtrEffSrc); \
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0); \
             IEMOP_HLP_DONE_VEX_DECODING_L0_EX(fBmi1); \
+            \
+            IEM_MC_ARG(uint32_t,            uSrc,       2); \
             IEM_MC_FETCH_MEM_U32(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc); \
+            IEM_MC_ARG(uint32_t *,          pDst,       1); \
             IEM_MC_REF_GREG_U32(pDst,  IEM_GET_EFFECTIVE_VVVV(pVCpu)); \
-            IEM_MC_REF_EFLAGS(pEFlags); \
-            IEM_MC_CALL_VOID_AIMPL_3(IEM_SELECT_HOST_OR_FALLBACK(fBmi1, iemAImpl_ ## a_Instr ## _u32, \
-                                                                 iemAImpl_ ## a_Instr ## _u32_fallback), pDst, uSrc, pEFlags); \
+            IEM_MC_ARG_EFLAGS(              fEFlagsIn,  0); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, \
+                                IEM_SELECT_HOST_OR_FALLBACK(fBmi1, iemAImpl_ ## a_Instr ## _u32, \
+                                                                   iemAImpl_ ## a_Instr ## _u32_fallback), fEFlagsIn, pDst, uSrc); \
             IEM_MC_CLEAR_HIGH_GREG_U64(IEM_GET_EFFECTIVE_VVVV(pVCpu)); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
Index: trunk/src/VBox/VMM/include/IEMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/IEMInternal.h	(revision 104208)
+++ trunk/src/VBox/VMM/include/IEMInternal.h	(revision 104209)
@@ -2601,7 +2601,4 @@
 FNIEMAIMPLBINU8 iemAImpl_xor_u8, iemAImpl_xor_u8_locked;
 FNIEMAIMPLBINU8 iemAImpl_and_u8, iemAImpl_and_u8_locked;
-
-typedef IEM_DECL_IMPL_TYPE(void, FNIEMAIMPLBINTODOU8, (uint8_t *pu8Dst, uint8_t u8Src, uint32_t *pEFlags));
-typedef FNIEMAIMPLBINTODOU8 *PFNIEMAIMPLBINTODOU8;
 /** @} */
 
@@ -2617,7 +2614,4 @@
 FNIEMAIMPLBINU16 iemAImpl_xor_u16, iemAImpl_xor_u16_locked;
 FNIEMAIMPLBINU16 iemAImpl_and_u16, iemAImpl_and_u16_locked;
-
-typedef IEM_DECL_IMPL_TYPE(void, FNIEMAIMPLBINTODOU16, (uint16_t *pu16Dst, uint16_t u16Src, uint32_t *pEFlags));
-typedef FNIEMAIMPLBINTODOU16 *PFNIEMAIMPLBINTODOU16;
 /** @}  */
 
@@ -2634,10 +2628,7 @@
 FNIEMAIMPLBINU32 iemAImpl_xor_u32, iemAImpl_xor_u32_locked;
 FNIEMAIMPLBINU32 iemAImpl_and_u32, iemAImpl_and_u32_locked;
-
-typedef IEM_DECL_IMPL_TYPE(void, FNIEMAIMPLBINTODOU32, (uint32_t *pu32Dst, uint32_t u32Src, uint32_t *pEFlags));
-typedef FNIEMAIMPLBINTODOU32 *PFNIEMAIMPLBINTODOU32;
-FNIEMAIMPLBINTODOU32 iemAImpl_blsi_u32, iemAImpl_blsi_u32_fallback;
-FNIEMAIMPLBINTODOU32 iemAImpl_blsr_u32, iemAImpl_blsr_u32_fallback;
-FNIEMAIMPLBINTODOU32 iemAImpl_blsmsk_u32, iemAImpl_blsmsk_u32_fallback;
+FNIEMAIMPLBINU32 iemAImpl_blsi_u32, iemAImpl_blsi_u32_fallback;
+FNIEMAIMPLBINU32 iemAImpl_blsr_u32, iemAImpl_blsr_u32_fallback;
+FNIEMAIMPLBINU32 iemAImpl_blsmsk_u32, iemAImpl_blsmsk_u32_fallback;
 /** @}  */
 
@@ -2653,10 +2644,7 @@
 FNIEMAIMPLBINU64 iemAImpl_xor_u64, iemAImpl_xor_u64_locked;
 FNIEMAIMPLBINU64 iemAImpl_and_u64, iemAImpl_and_u64_locked;
-
-typedef IEM_DECL_IMPL_TYPE(void, FNIEMAIMPLBINTODOU64, (uint64_t *pu64Dst, uint64_t u64Src, uint32_t *pEFlags));
-typedef FNIEMAIMPLBINTODOU64 *PFNIEMAIMPLBINTODOU64;
-FNIEMAIMPLBINTODOU64 iemAImpl_blsi_u64, iemAImpl_blsi_u64_fallback;
-FNIEMAIMPLBINTODOU64 iemAImpl_blsr_u64, iemAImpl_blsr_u64_fallback;
-FNIEMAIMPLBINTODOU64 iemAImpl_blsmsk_u64, iemAImpl_blsmsk_u64_fallback;
+FNIEMAIMPLBINU64 iemAImpl_blsi_u64, iemAImpl_blsi_u64_fallback;
+FNIEMAIMPLBINU64 iemAImpl_blsr_u64, iemAImpl_blsr_u64_fallback;
+FNIEMAIMPLBINU64 iemAImpl_blsmsk_u64, iemAImpl_blsmsk_u64_fallback;
 /** @}  */
 
@@ -3984,19 +3972,4 @@
 /** Pointer to a binary operator function table. */
 typedef IEMOPBINSIZES const *PCIEMOPBINSIZES;
-
-
-/**
- * Function table for a binary operator providing implementation based on
- * operand size.
- */
-typedef struct IEMOPBINTODOSIZES
-{
-    PFNIEMAIMPLBINTODOU8  pfnNormalU8,    pfnLockedU8;
-    PFNIEMAIMPLBINTODOU16 pfnNormalU16,   pfnLockedU16;
-    PFNIEMAIMPLBINTODOU32 pfnNormalU32,   pfnLockedU32;
-    PFNIEMAIMPLBINTODOU64 pfnNormalU64,   pfnLockedU64;
-} IEMOPBINTODOSIZES;
-/** Pointer to a binary operator function table. */
-typedef IEMOPBINTODOSIZES const *PCIEMOPBINTODOSIZES;
 
 
