Index: /trunk/include/iprt/asmdefs-arm.h
===================================================================
--- /trunk/include/iprt/asmdefs-arm.h	(revision 104237)
+++ /trunk/include/iprt/asmdefs-arm.h	(revision 104238)
@@ -40,4 +40,7 @@
 #endif
 
+#include <iprt/cdefs.h>
+
+
 #if !defined(RT_ARCH_ARM64) && !defined(RT_ARCH_ARM32)
 # error "Not on ARM64 or ARM32"
@@ -48,4 +51,17 @@
  * @{
  */
+
+/**
+ * Align code, pad with BRK. */
+#define ALIGNCODE(alignment)    .balignl alignment, 0xd42000cc
+
+/**
+ * Align data, pad with ZEROs. */
+#define ALIGNDATA(alignment)    .balign alignment
+
+/**
+ * Align BSS, pad with ZEROs. */
+#define ALIGNBSS(alignment)     .balign alignment
+
 
 /** Marks the beginning of a code section. */
@@ -172,6 +188,4 @@
  */
 .macro BEGINPROC, a_Name
-    .p2align 2
-    .globl          NAME(\a_Name)
 NAME(\a_Name):
 .endm
@@ -184,11 +198,10 @@
  */
 .macro BEGINPROC_HIDDEN, a_Name
-    .p2align 2
 #ifndef ASM_FORMAT_ELF
-    .private_extern NAME(\a_Name)
-#else
-    .hidden         NAME(\a_Name)
-#endif
-    .globl          NAME(\a_Name)
+        .private_extern NAME(\a_Name)
+#else
+        .hidden         NAME(\a_Name)
+#endif
+        .globl          NAME(\a_Name)
 NAME(\a_Name):
 .endm
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllAImpl-arm64.S
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllAImpl-arm64.S	(revision 104237)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllAImpl-arm64.S	(revision 104238)
@@ -32,4 +32,6 @@
 #include <iprt/asmdefs-arm.h>
 #include <iprt/x86.h>
+
+#define IEM_AIMPL_FUNCTION_ALIGNMENT    0x20
 
 
@@ -149,7 +151,5 @@
 BEGINCODE
 
-BEGINPROC_HIDDEN iemAImpl_placeholder
-        brk #1
-        ret
+
 
 /* Some sketches.
@@ -182,4 +182,5 @@
 
 /* uint32_t iemAImpl_cmp_u8(uint32_t fEFlags, uint8_t const *puDst, uint8_t uSrc); */
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN iemAImpl_sub_u8
         .cfi_startproc
@@ -208,4 +209,5 @@
 
 /* uint32_t iemAImpl_cmp_u16(uint32_t fEFlags, uint16_t const *puDst, uint16_t uSrc); */
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN iemAImpl_sub_u16
         .cfi_startproc
@@ -234,4 +236,5 @@
 
 /* uint32_t iemAImpl_cmp_u32(uint32_t fEFlags, uint32_t const *puDst, uint32_t uSrc); */
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN iemAImpl_sub_u32
         .cfi_startproc
@@ -295,4 +298,5 @@
 
 /* uint32_t iemAImpl_cmp_u64(uint32_t fEFlags, uint64_t const *puDst, uint64_t uSrc); */
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN iemAImpl_sub_u64
         .cfi_startproc
@@ -314,32 +318,31 @@
  */
 
-/* void iemAImpl_shl_u8(uint8_t *pu8Dst, uint8_t cShift, uint32_t *pEFlags); */
-/* void iemAImpl_shl_u16(uint16_t *pu16Dst, uint8_t cShift, uint32_t *pEFlags); */
-/* void iemAImpl_shl_u32(uint16_t *pu32Dst, uint8_t cShift, uint32_t *pEFlags); */
+/* uint32_t iemAImpl_shl_u8( uint32_t fEFlagsIn, uint8_t *pu8Dst, uint8_t cShift); */
+/* uint32_t iemAImpl_shl_u16(uint32_t fEFlagsIn, uint16_t *pu16Dst, uint8_t cShift); */
+/* uint32_t iemAImpl_shl_u32(uint32_t fEFlagsIn, uint16_t *pu32Dst, uint8_t cShift); */
 .macro SHL_8_16_32, a_Name, a_cBits, a_fIntelFlags, a_LdStSuff
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN \a_Name
         .cfi_startproc
 
         /* Do we need to shift anything at all? */
-        and     w1, w1, #0x1f
-        cbz     w1, 99f
+        and     w2, w2, #0x1f
+        cbz     w2, 99f
 
         /*
          * Do the shifting
          */
-        ldr\a_LdStSuff  w8, [x0]
+        ldr\a_LdStSuff  w8, [x1]
 .ifne \a_cBits < 32
-        lslv    w9, w8, w1
-.else
-        lslv    x9, x8, x1                      /* use 64-bit registers here so we get CF for free. We know x1 != 0. */
-.endif
-        str\a_LdStSuff  w9, [x0]
+        lslv    w9, w8, w2
+.else
+        lslv    x9, x8, x2                      /* use 64-bit registers here so we get CF for free. We know x1 != 0. */
+.endif
+        str\a_LdStSuff  w9, [x1]
 
         /*
          * Calculate EFLAGS.
          */
-        ldr     w10, [x2]                       /* w10 = eflags; CF=0 PF=2 AF=4 ZF=6 SF=7 OF=11 */
-
-        CALC_EFLAGS_PARITY w10, w9, w12
+        CALC_EFLAGS_PARITY w0, w9, w12
 
 .ifne \a_cBits < 32
@@ -351,16 +354,16 @@
         mrs     x11, NZCV
         lsr     w11, w11, #30                   /* N=1; Z=0 */
-        bfi     w10, w11, X86_EFL_ZF_BIT, 2     /* EFLAGS.ZF and EFLAGS.SF */
+        bfi     w0, w11, X86_EFL_ZF_BIT, 2      /* EFLAGS.ZF and EFLAGS.SF */
 #else
         cset    x11, eq
-        bfi     w10, w11, X86_EFL_ZF_BIT, 1
+        bfi     w0, w11, X86_EFL_ZF_BIT, 1
         cset    x12, pl
-        bfi     w10, w12, X86_EFL_SF_BIT, 1
+        bfi     w0, w12, X86_EFL_SF_BIT, 1
 #endif
 
 .ifne \a_cBits < 32
-        bfxil   w10, w9, #\a_cBits, #1          /* w9 bit 8/16 contains carry. (X86_EFL_CF_BIT == 0) */
-.else
-        bfxil   x10, x9, #\a_cBits, #1          /* x9 bit 32 contains carry. (X86_EFL_CF_BIT == 0) */
+        bfxil   w0, w9, #\a_cBits, #1           /* w9 bit 8/16 contains carry. (X86_EFL_CF_BIT == 0) */
+.else
+        bfxil   x0, x9, #\a_cBits, #1           /* x9 bit 32 contains carry. (X86_EFL_CF_BIT == 0) */
 .endif
 
@@ -369,7 +372,7 @@
         eor     w11, w8, w8, LSL #1
         lsr     w11, w11, #(\a_cBits - 1)
-        bfi     w10, w11, #X86_EFL_OF_BIT, #1
-
-        and     w10, w10, ~X86_EFL_AF           /* AF is cleared */
+        bfi     w0, w11, #X86_EFL_OF_BIT, #1
+
+        and     w0, w0, ~X86_EFL_AF            /* AF is cleared */
 .else
         /* AMD: OF = last bit shifted: fEfl |= ((uResult >> (cOpBits - 1)) ^ fCarry) << X86_EFL_OF_BIT;  */
@@ -381,10 +384,9 @@
         lsr     x11, x11, #(\a_cBits - 1)
  .endif
-        bfi     w10, w11, #X86_EFL_OF_BIT, #1
-
-        orr     w10, w10, X86_EFL_AF           /* AF is set  */
-.endif
-
-        str     w10, [x2]
+        bfi     w0, w11, #X86_EFL_OF_BIT, #1
+
+        orr     w0, w0, X86_EFL_AF             /* AF is set  */
+.endif
+
 99:
         ret
@@ -405,35 +407,34 @@
 
 /** @todo this is slightly slower than the C version (release) on an M2. Investigate why. */
-/* void iemAImpl_shl_u64(uint16_t *pu64Dst, uint8_t cShift, uint32_t *pEFlags); */
+/* uint32_t iemAImpl_shl_u64(uint32_t fEFlagsIn, uint16_t *pu64Dst, uint8_t cShift); */
 .macro SHL_64, a_Name, a_fIntelFlags
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN \a_Name
         .cfi_startproc
 
         /* Do we need to shift anything at all? */
-        and     w1, w1, #0x3f
-        cbz     w1, 99f
+        and     w2, w2, #0x3f
+        cbz     w2, 99f
 
         /*
          * Do the shifting
          */
-        ldr     x8, [x0]
-        lslv    x9, x8, x1
-        str     x9, [x0]
+        ldr     x8, [x1]
+        lslv    x9, x8, x2
+        str     x9, [x1]
 
         /*
          * Calculate EFLAGS.
          */
-        ldr     w10, [x2]                       /* w10 = eflags; CF=0 PF=2 AF=4 ZF=6 SF=7 OF=11 */
-
-        CALC_EFLAGS_PARITY w10, w9, w11
+        CALC_EFLAGS_PARITY w0, w9, w11
 
         ands    xzr, x9, x9                     /* Sets NZ */
         mrs     x11, NZCV
         lsr     w11, w11, #30                   /* N=1; Z=0 */
-        bfi     w10, w11, X86_EFL_ZF_BIT, 2     /* EFLAGS.ZF and EFLAGS.SF */
-
-        neg     w11, w1                         /* the shift count is MODed by the data size, so this is safe. */
+        bfi     w0, w11, X86_EFL_ZF_BIT, 2      /* EFLAGS.ZF and EFLAGS.SF */
+
+        neg     w11, w2                         /* the shift count is MODed by the data size, so this is safe. */
         lsrv    x11, x8, x11
-        bfi     w10, w11, X86_EFL_CF_BIT, 1
+        bfi     w0, w11, X86_EFL_CF_BIT, 1
 
 .ifne \a_fIntelFlags
@@ -441,15 +442,14 @@
         eor     x11, x8, x8, LSL #1
         lsr     x11, x11, #63
-        bfi     w10, w11, #X86_EFL_OF_BIT, #1
-
-        and     w10, w10, ~X86_EFL_AF           /* AF is cleared */
+        bfi     w0, w11, #X86_EFL_OF_BIT, #1
+
+        and     w0, w0, ~X86_EFL_AF             /* AF is cleared */
 .else
         /* AMD: OF = last bit shifted: fEfl |= ((uResult >> (cOpBits - 1)) ^ fCarry) << X86_EFL_OF_BIT;  */
         eor     x11, x11, x9, LSR #63           /* w11[0]=CF from above */
-        bfi     w10, w11, #X86_EFL_OF_BIT, #1
-
-        orr     w10, w10, X86_EFL_AF           /* AF is set  */
-.endif
-        str     w10, [x2]
+        bfi     w0, w11, #X86_EFL_OF_BIT, #1
+
+        orr     w0, w0, X86_EFL_AF              /* AF is set  */
+.endif
 99:
         ret
@@ -466,45 +466,43 @@
  */
 
-/* void iemAImpl_shr_u8(uint8_t *pu8Dst, uint8_t cShift, uint32_t *pEFlags); */
-/* void iemAImpl_shr_u16(uint16_t *pu16Dst, uint8_t cShift, uint32_t *pEFlags); */
-/* void iemAImpl_shr_u32(uint16_t *pu32Dst, uint8_t cShift, uint32_t *pEFlags); */
+/* uint32_t iemAImpl_shr_u8( uint32_t fEFlagsIn, uint8_t *pu8Dst, uint8_t cShift); */
+/* uint32_t iemAImpl_shr_u16(uint32_t fEFlagsIn, uint16_t *pu16Dst, uint8_t cShift); */
+/* uint32_t iemAImpl_shr_u32(uint32_t fEFlagsIn, uint16_t *pu32Dst, uint8_t cShift); */
 .macro shr_8_16_32, a_Name, a_cBits, a_fIntelFlags, a_LdStSuff
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN \a_Name
         .cfi_startproc
 
         /* Do we need to shift anything at all? */
-        and     w1, w1, #0x1f
-        cbz     w1, 99f
-
-        /* Load EFLAGS before we start the calculation. */
-        ldr     w10, [x2]                       /* w10 = eflags; CF=0 PF=2 AF=4 ZF=6 SF=7 OF=11 */
+        and     w2, w2, #0x1f
+        cbz     w2, 99f
 
         /*
          * Do the shifting.
          */
-        ldr\a_LdStSuff  w8, [x0]
-        lsrv    w9, w8, w1
-        str\a_LdStSuff  w9, [x0]
+        ldr\a_LdStSuff  w8, [x1]
+        lsrv    w9, w8, w2
+        str\a_LdStSuff  w9, [x1]
 
         /*
          * Calculate EFLAGS.
          */
-        sub     w11, w1, #1
+        sub     w11, w2, #1
         lsrv    w11, w8, w11
-        bfxil   w10, w11, #X86_EFL_CF_BIT, #1
+        bfxil   w0, w11, #X86_EFL_CF_BIT, #1
 
 .ifne \a_fIntelFlags
-        and     w10, w10, ~X86_EFL_AF           /* AF is cleared */
+        and     w0, w0, ~X86_EFL_AF             /* AF is cleared */
         /* Intel: OF = one bit shift: fEfl |= X86_EFL_GET_OF_ ## cOpBits(uDstIn); */
         lsr     w11, w8, #(\a_cBits - 1)
-        bfi     w10, w11, #X86_EFL_OF_BIT, #1
-.else
-        orr     w10, w10, X86_EFL_AF            /* AF is set  */
+        bfi     w0, w11, #X86_EFL_OF_BIT, #1
+.else
+        orr     w0, w0, X86_EFL_AF              /* AF is set  */
         /* AMD: OF = last bits shifted: fEfl |= (uResult >> (cOpBits - 2)) << X86_EFL_OF_BIT;  */
         lsr     w11, w9, #(\a_cBits - 2)
-        bfi     w10, w11, #X86_EFL_OF_BIT, #1
-.endif
-
-        CALC_EFLAGS_PARITY w10, w9, w11
+        bfi     w0, w11, #X86_EFL_OF_BIT, #1
+.endif
+
+        CALC_EFLAGS_PARITY w0, w9, w11
 
 .ifne \a_cBits < 32
@@ -515,7 +513,6 @@
         mrs     x11, NZCV
         lsr     w11, w11, #30                   /* N=1; Z=0 */
-        bfi     w10, w11, X86_EFL_ZF_BIT, 2     /* EFLAGS.ZF and EFLAGS.SF */
-
-        str     w10, [x2]
+        bfi     w0, w11, X86_EFL_ZF_BIT, 2      /* EFLAGS.ZF and EFLAGS.SF */
+
 99:
         ret
@@ -538,48 +535,45 @@
 /* void iemAImpl_shr_u64(uint16_t *pu64Dst, uint8_t cShift, uint32_t *pEFlags); */
 .macro shr_64, a_Name, a_fIntelFlags
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN \a_Name
         .cfi_startproc
 
         /* Do we need to shift anything at all? */
-        ands    w1, w1, #0x3f
+        ands    w2, w2, #0x3f
         b.eq    99f
 
-        /* Load EFLAGS before we start the calculation. */
-        ldr     w10, [x2]                       /* w10 = eflags; CF=0 PF=2 AF=4 ZF=6 SF=7 OF=11 */
-
         /*
          * Do the shifting
          */
-        ldr     x8, [x0]
-        lsrv    x9, x8, x1
-        str     x9, [x0]
+        ldr     x8, [x1]
+        lsrv    x9, x8, x2
+        str     x9, [x1]
 
         /*
          * Calculate EFLAGS.
          */
-        sub     w11, w1, #1
+        sub     w11, w2, #1
         lsrv    x11, x8, x11
-        bfxil   w10, w11, #X86_EFL_CF_BIT, #1
+        bfxil   w0, w11, #X86_EFL_CF_BIT, #1
 
 .ifne \a_fIntelFlags
-        and     w10, w10, ~X86_EFL_AF           /* AF is cleared */
+        and     w0, w0, ~X86_EFL_AF             /* AF is cleared */
         /* Intel: OF = one bit shift: fEfl |= X86_EFL_GET_OF_ ## cOpBits(uDstIn); */
         lsr     x11, x8, #63
-        bfi     w10, w11, #X86_EFL_OF_BIT, #1
-.else
-        orr     w10, w10, X86_EFL_AF            /* AF is set  */
+        bfi     w0, w11, #X86_EFL_OF_BIT, #1
+.else
+        orr     w0, w0, X86_EFL_AF              /* AF is set  */
         /* AMD: OF = last bits shifted: fEfl |= (uResult >> (cOpBits - 2)) << X86_EFL_OF_BIT;  */
         lsr     x11, x9, #62
-        bfi     w10, w11, #X86_EFL_OF_BIT, #1
-.endif
-
-        CALC_EFLAGS_PARITY w10, w9, w11
+        bfi     w0, w11, #X86_EFL_OF_BIT, #1
+.endif
+
+        CALC_EFLAGS_PARITY w0, w9, w11
 
         ands    xzr, x9, x9                     /* Sets NZ */
         mrs     x11, NZCV
         lsr     w11, w11, #30                   /* N=1; Z=0 */
-        bfi     w10, w11, X86_EFL_ZF_BIT, 2     /* EFLAGS.ZF and EFLAGS.SF */
-
-        str     w10, [x2]
+        bfi     w0, w11, X86_EFL_ZF_BIT, 2      /* EFLAGS.ZF and EFLAGS.SF */
+
 99:
         ret
@@ -596,41 +590,39 @@
  */
 
-/* void iemAImpl_sar_u8(uint8_t *pu8Dst, uint8_t cShift, uint32_t *pEFlags); */
-/* void iemAImpl_sar_u16(uint16_t *pu16Dst, uint8_t cShift, uint32_t *pEFlags); */
-/* void iemAImpl_sar_u32(uint16_t *pu32Dst, uint8_t cShift, uint32_t *pEFlags); */
+/* uint32_t iemAImpl_sar_u8( uint32_t fEFlagsIn, uint8_t *pu8Dst, uint8_t cShift); */
+/* uint32_t iemAImpl_sar_u16(uint32_t fEFlagsIn, uint16_t *pu16Dst, uint8_t cShift); */
+/* uint32_t iemAImpl_sar_u32(uint32_t fEFlagsIn, uint16_t *pu32Dst, uint8_t cShift); */
 .macro sar_8_16_32, a_Name, a_cBits, a_fIntelFlags, a_LdSuff, a_StSuff
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN \a_Name
         .cfi_startproc
 
         /* Do we need to shift anything at all? */
-        and     w1, w1, #0x1f
-        cbz     w1, 99f
-
-        /* Load EFLAGS before we start the calculation. */
-        ldr     w10, [x2]                       /* w10 = eflags; CF=0 PF=2 AF=4 ZF=6 SF=7 OF=11 */
+        and     w2, w2, #0x1f
+        cbz     w2, 99f
 
         /*
          * Do the shifting.
          */
-        ldr\a_LdSuff  w8, [x0]                  /* Sign-extending for 8 and 16 bits! */
-        asrv    w9, w8, w1
-        str\a_StSuff  w9, [x0]
+        ldr\a_LdSuff  w8, [x1]                  /* Sign-extending for 8 and 16 bits! */
+        asrv    w9, w8, w2
+        str\a_StSuff  w9, [x1]
 
         /*
          * Calculate EFLAGS.
          */
-        sub     w11, w1, #1
+        sub     w11, w2, #1
         lsrv    w11, w8, w11
-        bfxil   w10, w11, #X86_EFL_CF_BIT, #1
+        bfxil   w0, w11, #X86_EFL_CF_BIT, #1
 
 .ifne \a_fIntelFlags
         mov     w11, ~(X86_EFL_AF | X86_EFL_OF)
-        and     w10, w10, w11                   /* AF and OF are cleared */
-.else
-        orr     w10, w10, X86_EFL_AF            /* AF is set  */
-        and     w10, w10, ~X86_EFL_OF           /* OF is cleared */
-.endif
-
-        CALC_EFLAGS_PARITY w10, w9, w11
+        and     w0, w0, w11                     /* AF and OF are cleared */
+.else
+        orr     w0, w0, X86_EFL_AF              /* AF is set  */
+        and     w0, w0, ~X86_EFL_OF             /* OF is cleared */
+.endif
+
+        CALC_EFLAGS_PARITY w0, w9, w11
 
 .ifne \a_cBits < 32
@@ -641,7 +633,6 @@
         mrs     x11, NZCV
         lsr     w11, w11, #30                   /* N=1; Z=0 */
-        bfi     w10, w11, X86_EFL_ZF_BIT, 2     /* EFLAGS.ZF and EFLAGS.SF */
-
-        str     w10, [x2]
+        bfi     w0, w11, X86_EFL_ZF_BIT, 2      /* EFLAGS.ZF and EFLAGS.SF */
+
 99:
         ret
@@ -662,46 +653,43 @@
 
 /** @todo this is slightly slower than the C version (release) on an M2. Investigate why. */
-/* void iemAImpl_sar_u64(uint16_t *pu64Dst, uint8_t cShift, uint32_t *pEFlags); */
+/* uint32_t iemAImpl_sar_u64(uint32_t fEFlagsIn, uint16_t *pu64Dst, uint8_t cShift); */
 .macro sar_64, a_Name, a_fIntelFlags
+ALIGNCODE(IEM_AIMPL_FUNCTION_ALIGNMENT)
 BEGINPROC_HIDDEN \a_Name
         .cfi_startproc
 
         /* Do we need to shift anything at all? */
-        ands    w1, w1, #0x3f
+        ands    w2, w2, #0x3f
         b.eq    99f
 
-        /* Load EFLAGS before we start the calculation. */
-        ldr     w10, [x2]                       /* w10 = eflags; CF=0 PF=2 AF=4 ZF=6 SF=7 OF=11 */
-
         /*
          * Do the shifting
          */
-        ldr     x8, [x0]
-        asrv    x9, x8, x1
-        str     x9, [x0]
+        ldr     x8, [x1]
+        asrv    x9, x8, x2
+        str     x9, [x1]
 
         /*
          * Calculate EFLAGS.
          */
-        sub     w11, w1, #1
+        sub     w11, w2, #1
         lsrv    x11, x8, x11
-        bfxil   w10, w11, #X86_EFL_CF_BIT, #1
+        bfxil   w0, w11, #X86_EFL_CF_BIT, #1
 
 .ifne \a_fIntelFlags
         mov     w11, ~(X86_EFL_AF | X86_EFL_OF)
-        and     w10, w10, w11                   /* AF and OF are cleared */
-.else
-        orr     w10, w10, X86_EFL_AF            /* AF is set  */
-        and     w10, w10, ~X86_EFL_OF           /* OF is cleared */
-.endif
-
-        CALC_EFLAGS_PARITY w10, w9, w11
+        and     w0, w0, w11                     /* AF and OF are cleared */
+.else
+        orr     w0, w0, X86_EFL_AF              /* AF is set  */
+        and     w0, w0, ~X86_EFL_OF             /* OF is cleared */
+.endif
+
+        CALC_EFLAGS_PARITY w0, w9, w11
 
         ands    xzr, x9, x9                     /* Sets NZ */
         mrs     x11, NZCV
         lsr     w11, w11, #30                   /* N=1; Z=0 */
-        bfi     w10, w11, X86_EFL_ZF_BIT, 2     /* EFLAGS.ZF and EFLAGS.SF */
-
-        str     w10, [x2]
+        bfi     w0, w11, X86_EFL_ZF_BIT, 2      /* EFLAGS.ZF and EFLAGS.SF */
+
 99:
         ret
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm	(revision 104237)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm	(revision 104238)
@@ -2361,5 +2361,8 @@
 ; @param        4       Force load flags.
 ;
-; Makes ASSUMPTIONS about A0, A1 and A2 assignments.
+; Makes ASSUMPTIONS about A0, A1 and A2 assignments.  Specifically, that with
+; GCC/64 we're free to use RCX/CL as it isn't used for any arguments.  While
+; MSC/64 & 32-bit fastcall are using ECX for the first argument (fEFlagsIn),
+; so we have to switch it around with the shift count parameter registers.
 ;
 ; @note the _intel and _amd variants are implemented in C.
@@ -2369,13 +2372,15 @@
 BEGINPROC_FASTCALL iemAImpl_ %+ %1 %+ _u8, 12
         PROLOGUE_3_ARGS
-        IEM_MAYBE_LOAD_FLAGS_OLD A2, %2, %3, %4
  %ifdef ASM_CALL64_GCC
-        mov     cl, A1_8
-        %1      byte [A0], cl
+        IEM_MAYBE_LOAD_FLAGS     A0_32, %2, %3, %4
+        mov     cl, A2_8
+        %1      byte [A1], cl
+        IEM_SAVE_FLAGS_RETVAL    A0_32, %2, %3, 0
  %else
-        xchg    A1, A0
+        xchg    A2, A0
+        IEM_MAYBE_LOAD_FLAGS     A2_32, %2, %3, %4
         %1      byte [A1], cl
+        IEM_SAVE_FLAGS_RETVAL    A2_32, %2, %3, 0
  %endif
-        IEM_SAVE_FLAGS_OLD       A2, %2, %3, 0
 .zero_shift:
         EPILOGUE_3_ARGS
@@ -2384,13 +2389,15 @@
 BEGINPROC_FASTCALL iemAImpl_ %+ %1 %+ _u16, 12
         PROLOGUE_3_ARGS
-        IEM_MAYBE_LOAD_FLAGS_OLD A2, %2, %3, %4
  %ifdef ASM_CALL64_GCC
-        mov     cl, A1_8
-        %1      word [A0], cl
+        IEM_MAYBE_LOAD_FLAGS     A0_32, %2, %3, %4
+        mov     cl, A2_8
+        %1      word [A1], cl
+        IEM_SAVE_FLAGS_RETVAL    A0_32, %2, %3, 0
  %else
-        xchg    A1, A0
+        xchg    A2, A0
+        IEM_MAYBE_LOAD_FLAGS     A2_32, %2, %3, %4
         %1      word [A1], cl
+        IEM_SAVE_FLAGS_RETVAL    A2_32, %2, %3, 0
  %endif
-        IEM_SAVE_FLAGS_OLD       A2, %2, %3, 0
         EPILOGUE_3_ARGS
 ENDPROC iemAImpl_ %+ %1 %+ _u16
@@ -2398,13 +2405,15 @@
 BEGINPROC_FASTCALL iemAImpl_ %+ %1 %+ _u32, 12
         PROLOGUE_3_ARGS
-        IEM_MAYBE_LOAD_FLAGS_OLD A2, %2, %3, %4
  %ifdef ASM_CALL64_GCC
-        mov     cl, A1_8
-        %1      dword [A0], cl
+        IEM_MAYBE_LOAD_FLAGS     A0_32, %2, %3, %4
+        mov     cl, A2_8
+        %1      dword [A1], cl
+        IEM_SAVE_FLAGS_RETVAL    A0_32, %2, %3, 0
  %else
-        xchg    A1, A0
+        xchg    A2, A0
+        IEM_MAYBE_LOAD_FLAGS     A2_32, %2, %3, %4
         %1      dword [A1], cl
+        IEM_SAVE_FLAGS_RETVAL    A2_32, %2, %3, 0
  %endif
-        IEM_SAVE_FLAGS_OLD       A2, %2, %3, 0
         EPILOGUE_3_ARGS
 ENDPROC iemAImpl_ %+ %1 %+ _u32
@@ -2413,13 +2422,15 @@
 BEGINPROC_FASTCALL iemAImpl_ %+ %1 %+ _u64, 12
         PROLOGUE_3_ARGS
-        IEM_MAYBE_LOAD_FLAGS_OLD A2, %2, %3, %4
   %ifdef ASM_CALL64_GCC
-        mov     cl, A1_8
-        %1      qword [A0], cl
+        IEM_MAYBE_LOAD_FLAGS     A0_32, %2, %3, %4
+        mov     cl, A2_8
+        %1      qword [A1], cl
+        IEM_SAVE_FLAGS_RETVAL    A0_32, %2, %3, 0
   %else
-        xchg    A1, A0
+        xchg    A2, A0
+        IEM_MAYBE_LOAD_FLAGS     A2_32, %2, %3, %4
         %1      qword [A1], cl
+        IEM_SAVE_FLAGS_RETVAL    A2_32, %2, %3, 0
   %endif
-        IEM_SAVE_FLAGS_OLD       A2, %2, %3, 0
         EPILOGUE_3_ARGS
 ENDPROC iemAImpl_ %+ %1 %+ _u64
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp	(revision 104237)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp	(revision 104238)
@@ -3091,5 +3091,5 @@
  */
 #define EMIT_ROL(a_cBitsWidth, a_uType, a_Suffix, a_fIntelFlags, a_fnHlp) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_rol_u,a_cBitsWidth,a_Suffix),(a_uType *puDst, uint8_t cShift, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_rol_u,a_cBitsWidth,a_Suffix),(uint32_t fEFlags, a_uType *puDst, uint8_t cShift)) \
 { \
     cShift &= a_cBitsWidth >= 32 ? a_cBitsWidth - 1 : 31; \
@@ -3105,14 +3105,13 @@
            it the same way as for 1 bit shifts. */ \
         AssertCompile(X86_EFL_CF_BIT == 0); \
-        uint32_t fEfl = *pfEFlags; \
-        fEfl &= ~(X86_EFL_CF | X86_EFL_OF); \
+        fEFlags &= ~(X86_EFL_CF | X86_EFL_OF); \
         uint32_t const fCarry = (uResult & X86_EFL_CF); \
-        fEfl |= fCarry; \
+        fEFlags |= fCarry; \
         if (!a_fIntelFlags) /* AMD 3990X: According to the last sub-shift: */ \
-            fEfl |= ((uResult >> (a_cBitsWidth - 1)) ^ fCarry) << X86_EFL_OF_BIT; \
+            fEFlags |= ((uResult >> (a_cBitsWidth - 1)) ^ fCarry) << X86_EFL_OF_BIT; \
         else                /* Intel 10980XE: According to the first sub-shift: */ \
-            fEfl |= X86_EFL_GET_OF_ ## a_cBitsWidth(uDst ^ (uDst << 1)); \
-        *pfEFlags = fEfl; \
+            fEFlags |= X86_EFL_GET_OF_ ## a_cBitsWidth(uDst ^ (uDst << 1)); \
     } \
+    return fEFlags; \
 }
 
@@ -3154,5 +3153,5 @@
  */
 #define EMIT_ROR(a_cBitsWidth, a_uType, a_Suffix, a_fIntelFlags, a_fnHlp) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_ror_u,a_cBitsWidth,a_Suffix),(a_uType *puDst, uint8_t cShift, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_ror_u,a_cBitsWidth,a_Suffix),(uint32_t fEFlags, a_uType *puDst, uint8_t cShift)) \
 { \
     cShift &= a_cBitsWidth >= 32 ? a_cBitsWidth - 1 : 31; \
@@ -3167,14 +3166,13 @@
         /* Calc EFLAGS:  */ \
         AssertCompile(X86_EFL_CF_BIT == 0); \
-        uint32_t fEfl = *pfEFlags; \
-        fEfl &= ~(X86_EFL_CF | X86_EFL_OF); \
+        fEFlags &= ~(X86_EFL_CF | X86_EFL_OF); \
         uint32_t const fCarry = (uResult >> ((a_cBitsWidth) - 1)) & X86_EFL_CF; \
-        fEfl |= fCarry; \
+        fEFlags |= fCarry; \
         if (!a_fIntelFlags) /* AMD 3990X: According to the last sub-shift: */ \
-            fEfl |= (((uResult >> ((a_cBitsWidth) - 2)) ^ fCarry) & 1) << X86_EFL_OF_BIT; \
+            fEFlags |= (((uResult >> ((a_cBitsWidth) - 2)) ^ fCarry) & 1) << X86_EFL_OF_BIT; \
         else                /* Intel 10980XE: According to the first sub-shift: */ \
-            fEfl |= X86_EFL_GET_OF_ ## a_cBitsWidth(uDst ^ (uDst << (a_cBitsWidth - 1))); \
-        *pfEFlags = fEfl; \
+            fEFlags |= X86_EFL_GET_OF_ ## a_cBitsWidth(uDst ^ (uDst << (a_cBitsWidth - 1))); \
     } \
+    return fEFlags; \
 }
 
@@ -3216,5 +3214,5 @@
  */
 #define EMIT_RCL(a_cBitsWidth, a_uType, a_Suffix, a_fIntelFlags) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_rcl_u,a_cBitsWidth,a_Suffix),(a_uType *puDst, uint8_t cShift, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_rcl_u,a_cBitsWidth,a_Suffix),(uint32_t fEFlags, a_uType *puDst, uint8_t cShift)) \
 { \
     cShift &= a_cBitsWidth >= 32 ? a_cBitsWidth - 1 : 31; \
@@ -3231,6 +3229,5 @@
         \
         AssertCompile(X86_EFL_CF_BIT == 0); \
-        uint32_t fEfl     = *pfEFlags; \
-        uint32_t fInCarry = fEfl & X86_EFL_CF; \
+        uint32_t fInCarry = fEFlags & X86_EFL_CF; \
         uResult |= (a_uType)fInCarry << (cShift - 1); \
         \
@@ -3238,14 +3235,14 @@
         \
         /* Calc EFLAGS. */ \
-        fEfl &= ~(X86_EFL_CF | X86_EFL_OF); \
+        fEFlags &= ~(X86_EFL_CF | X86_EFL_OF); \
         uint32_t const fOutCarry = a_cBitsWidth >= 32 || a_fIntelFlags || cShift \
                                  ? (uDst >> (a_cBitsWidth - cShift)) & X86_EFL_CF : fInCarry; \
-        fEfl |= fOutCarry; \
+        fEFlags |= fOutCarry; \
         if (!a_fIntelFlags) /* AMD 3990X: According to the last sub-shift: */ \
-            fEfl |= ((uResult >> (a_cBitsWidth - 1)) ^ fOutCarry) << X86_EFL_OF_BIT; \
+            fEFlags |= ((uResult >> (a_cBitsWidth - 1)) ^ fOutCarry) << X86_EFL_OF_BIT; \
         else                /* Intel 10980XE: According to the first sub-shift: */ \
-            fEfl |= X86_EFL_GET_OF_ ## a_cBitsWidth(uDst ^ (uDst << 1)); \
-        *pfEFlags = fEfl; \
+            fEFlags |= X86_EFL_GET_OF_ ## a_cBitsWidth(uDst ^ (uDst << 1)); \
     } \
+    return fEFlags; \
 }
 
@@ -3279,5 +3276,5 @@
  */
 #define EMIT_RCR(a_cBitsWidth, a_uType, a_Suffix, a_fIntelFlags) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_rcr_u,a_cBitsWidth,a_Suffix),(a_uType *puDst, uint8_t cShift, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_rcr_u,a_cBitsWidth,a_Suffix),(uint32_t fEFlags, a_uType *puDst, uint8_t cShift)) \
 { \
     cShift &= a_cBitsWidth >= 32 ? a_cBitsWidth - 1 : 31; \
@@ -3294,6 +3291,5 @@
         \
         AssertCompile(X86_EFL_CF_BIT == 0); \
-        uint32_t fEfl     = *pfEFlags; \
-        uint32_t fInCarry = fEfl & X86_EFL_CF; \
+        uint32_t fInCarry = fEFlags & X86_EFL_CF; \
         uResult |= (a_uType)fInCarry << (a_cBitsWidth - cShift); \
         *puDst = uResult; \
@@ -3301,14 +3297,14 @@
         /* Calc EFLAGS.  The OF bit is undefined if cShift > 1, we implement \
            it the same way as for 1 bit shifts. */ \
-        fEfl &= ~(X86_EFL_CF | X86_EFL_OF); \
+        fEFlags &= ~(X86_EFL_CF | X86_EFL_OF); \
         uint32_t const fOutCarry = a_cBitsWidth >= 32 || a_fIntelFlags || cShift \
                                  ? (uDst >> (cShift - 1)) & X86_EFL_CF : fInCarry; \
-        fEfl |= fOutCarry; \
+        fEFlags |= fOutCarry; \
         if (!a_fIntelFlags) /* AMD 3990X: XOR two most signficant bits of the result: */ \
-            fEfl |= X86_EFL_GET_OF_ ## a_cBitsWidth(uResult ^ (uResult << 1));  \
+            fEFlags |= X86_EFL_GET_OF_ ## a_cBitsWidth(uResult ^ (uResult << 1));  \
         else                /* Intel 10980XE: same as AMD, but only for the first sub-shift: */ \
-            fEfl |= (fInCarry ^ (uint32_t)(uDst >> (a_cBitsWidth - 1))) << X86_EFL_OF_BIT; \
-        *pfEFlags = fEfl; \
+            fEFlags |= (fInCarry ^ (uint32_t)(uDst >> (a_cBitsWidth - 1))) << X86_EFL_OF_BIT; \
     } \
+    return fEFlags; \
 }
 
@@ -3342,5 +3338,5 @@
  */
 #define EMIT_SHL(a_cBitsWidth, a_uType, a_Suffix, a_fIntelFlags) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_shl_u,a_cBitsWidth,a_Suffix),(a_uType *puDst, uint8_t cShift, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_shl_u,a_cBitsWidth,a_Suffix),(uint32_t fEFlags, a_uType *puDst, uint8_t cShift)) \
 { \
     cShift &= a_cBitsWidth >= 32 ? a_cBitsWidth - 1 : 31; \
@@ -3353,18 +3349,18 @@
         /* Calc EFLAGS. */ \
         AssertCompile(X86_EFL_CF_BIT == 0); \
-        uint32_t fEfl = *pfEFlags & ~X86_EFL_STATUS_BITS; \
-        uint32_t fCarry = (uDst >> (a_cBitsWidth - cShift)) & X86_EFL_CF; \
-        fEfl |= fCarry; \
+        fEFlags &= ~X86_EFL_STATUS_BITS; \
+        uint32_t const fCarry = (uDst >> (a_cBitsWidth - cShift)) & X86_EFL_CF; \
+        fEFlags |= fCarry; \
         if (!a_fIntelFlags) \
-            fEfl |= ((uResult >> (a_cBitsWidth - 1)) ^ fCarry) << X86_EFL_OF_BIT; /* AMD 3990X: Last shift result. */ \
+            fEFlags |= ((uResult >> (a_cBitsWidth - 1)) ^ fCarry) << X86_EFL_OF_BIT; /* AMD 3990X: Last shift result. */ \
         else \
-            fEfl |= X86_EFL_GET_OF_ ## a_cBitsWidth(uDst ^ (uDst << 1)); /* Intel 10980XE: First shift result. */ \
-        fEfl |= X86_EFL_CALC_SF(uResult, a_cBitsWidth); \
-        fEfl |= X86_EFL_CALC_ZF(uResult); \
-        fEfl |= IEM_EFL_CALC_PARITY(uResult); \
+            fEFlags |= X86_EFL_GET_OF_ ## a_cBitsWidth(uDst ^ (uDst << 1)); /* Intel 10980XE: First shift result. */ \
+        fEFlags |= X86_EFL_CALC_SF(uResult, a_cBitsWidth); \
+        fEFlags |= X86_EFL_CALC_ZF(uResult); \
+        fEFlags |= IEM_EFL_CALC_PARITY(uResult); \
         if (!a_fIntelFlags) \
-            fEfl |= X86_EFL_AF; /* AMD 3990x sets it unconditionally, Intel 10980XE does the oposite */ \
-        *pfEFlags = fEfl; \
+            fEFlags |= X86_EFL_AF; /* AMD 3990x sets it unconditionally, Intel 10980XE does the oposite */ \
     } \
+    return fEFlags; \
 }
 
@@ -3402,5 +3398,5 @@
  */
 #define EMIT_SHR(a_cBitsWidth, a_uType, a_Suffix, a_fIntelFlags) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_shr_u,a_cBitsWidth,a_Suffix),(a_uType *puDst, uint8_t cShift, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_shr_u,a_cBitsWidth,a_Suffix),(uint32_t fEFlags, a_uType *puDst, uint8_t cShift)) \
 { \
     cShift &= a_cBitsWidth >= 32 ? a_cBitsWidth - 1 : 31; \
@@ -3413,15 +3409,15 @@
         /* Calc EFLAGS. */ \
         AssertCompile(X86_EFL_CF_BIT == 0); \
-        uint32_t fEfl = *pfEFlags & ~X86_EFL_STATUS_BITS; \
-        fEfl |= (uDst >> (cShift - 1)) & X86_EFL_CF; \
+        fEFlags &= ~X86_EFL_STATUS_BITS; \
+        fEFlags |= (uDst >> (cShift - 1)) & X86_EFL_CF; \
         if (a_fIntelFlags || cShift == 1) /* AMD 3990x does what intel documents; Intel 10980XE does this for all shift counts. */ \
-            fEfl |= (uDst >> (a_cBitsWidth - 1)) << X86_EFL_OF_BIT; \
-        fEfl |= X86_EFL_CALC_SF(uResult, a_cBitsWidth); \
-        fEfl |= X86_EFL_CALC_ZF(uResult); \
-        fEfl |= IEM_EFL_CALC_PARITY(uResult); \
+            fEFlags |= (uDst >> (a_cBitsWidth - 1)) << X86_EFL_OF_BIT; \
+        fEFlags |= X86_EFL_CALC_SF(uResult, a_cBitsWidth); \
+        fEFlags |= X86_EFL_CALC_ZF(uResult); \
+        fEFlags |= IEM_EFL_CALC_PARITY(uResult); \
         if (!a_fIntelFlags) \
-            fEfl |= X86_EFL_AF; /* AMD 3990x sets it unconditionally, Intel 10980XE does the oposite */ \
-        *pfEFlags = fEfl; \
+            fEFlags |= X86_EFL_AF; /* AMD 3990x sets it unconditionally, Intel 10980XE does the oposite */ \
     } \
+    return fEFlags; \
 }
 
@@ -3459,5 +3455,5 @@
  */
 #define EMIT_SAR(a_cBitsWidth, a_uType, a_iType, a_Suffix, a_fIntelFlags) \
-IEM_DECL_IMPL_DEF(void, RT_CONCAT3(iemAImpl_sar_u,a_cBitsWidth,a_Suffix),(a_uType *puDst, uint8_t cShift, uint32_t *pfEFlags)) \
+IEM_DECL_IMPL_DEF(uint32_t, RT_CONCAT3(iemAImpl_sar_u,a_cBitsWidth,a_Suffix),(uint32_t fEFlags, a_uType *puDst, uint8_t cShift)) \
 { \
     cShift &= a_cBitsWidth >= 32 ? a_cBitsWidth - 1 : 31; \
@@ -3471,13 +3467,13 @@
            Note! The OF flag is always zero because the result never differs from the input. */ \
         AssertCompile(X86_EFL_CF_BIT == 0); \
-        uint32_t fEfl = *pfEFlags & ~X86_EFL_STATUS_BITS; \
-        fEfl |= (iDst >> (cShift - 1)) & X86_EFL_CF; \
-        fEfl |= X86_EFL_CALC_SF(uResult, a_cBitsWidth); \
-        fEfl |= X86_EFL_CALC_ZF(uResult); \
-        fEfl |= IEM_EFL_CALC_PARITY(uResult); \
+        fEFlags &= ~X86_EFL_STATUS_BITS; \
+        fEFlags |= (iDst >> (cShift - 1)) & X86_EFL_CF; \
+        fEFlags |= X86_EFL_CALC_SF(uResult, a_cBitsWidth); \
+        fEFlags |= X86_EFL_CALC_ZF(uResult); \
+        fEFlags |= IEM_EFL_CALC_PARITY(uResult); \
         if (!a_fIntelFlags) \
-            fEfl |= X86_EFL_AF; /* AMD 3990x sets it unconditionally, Intel 10980XE does the oposite */ \
-        *pfEFlags = fEfl; \
+            fEFlags |= X86_EFL_AF; /* AMD 3990x sets it unconditionally, Intel 10980XE does the oposite */ \
     } \
+    return fEFlags; \
 }
 
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h	(revision 104237)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstOneByte.cpp.h	(revision 104238)
@@ -8815,10 +8815,10 @@
             IEM_MC_BEGIN(IEM_MC_F_MIN_186, 0); \
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-            IEM_MC_ARG(uint8_t *,       pu8Dst,            0); \
-            IEM_MC_ARG_CONST(uint8_t,   cShiftArg, cShift, 1); \
-            IEM_MC_ARG(uint32_t *,      pEFlags,           2); \
+            IEM_MC_ARG(uint8_t *,       pu8Dst,                     1); \
             IEM_MC_REF_GREG_U8(pu8Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-            IEM_MC_REF_EFLAGS(pEFlags); \
-            IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags); \
+            IEM_MC_ARG_EFLAGS(          fEFlagsIn,                  0); \
+            IEM_MC_ARG_CONST(uint8_t,   cShiftArg, /*=*/ cShift,    2); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU8, fEFlagsIn, pu8Dst, cShiftArg); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
@@ -8834,14 +8834,14 @@
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
             \
-            IEM_MC_LOCAL(uint8_t,   bUnmapInfo); \
-            IEM_MC_ARG(uint8_t *,   pu8Dst,    0); \
+            IEM_MC_LOCAL(uint8_t,       bUnmapInfo); \
+            IEM_MC_ARG(uint8_t *,       pu8Dst,                     1); \
             IEM_MC_MEM_MAP_U8_RW(pu8Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
             \
-            IEM_MC_ARG_CONST(uint8_t,   cShiftArg, cShift, 1); \
-            IEM_MC_ARG_LOCAL_EFLAGS(    pEFlags,   EFlags, 2); \
-            IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags); \
+            IEM_MC_ARG_EFLAGS(          fEFlagsIn,                  0); \
+            IEM_MC_ARG_CONST(uint8_t,   cShiftArg, /*=*/ cShift,    2); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU8, fEFlagsIn, pu8Dst, cShiftArg); \
             \
             IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-            IEM_MC_COMMIT_EFLAGS(EFlags); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
@@ -8963,10 +8963,10 @@
                     IEM_MC_BEGIN(IEM_MC_F_MIN_186, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-                    IEM_MC_ARG(uint16_t *,      pu16Dst,           0); \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg, cShift, 1); \
-                    IEM_MC_ARG(uint32_t *,      pEFlags,           2); \
+                    IEM_MC_ARG(uint16_t *,      pu16Dst,                    1); \
                     IEM_MC_REF_GREG_U16(pu16Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-                    IEM_MC_REF_EFLAGS(pEFlags); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,                  0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg, /*=*/ cShift,    2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU16, fEFlagsIn, pu16Dst, cShiftArg); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -8976,11 +8976,11 @@
                     IEM_MC_BEGIN(IEM_MC_F_MIN_386, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-                    IEM_MC_ARG(uint32_t *,      pu32Dst,           0); \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg, cShift, 1); \
-                    IEM_MC_ARG(uint32_t *,      pEFlags,           2); \
+                    IEM_MC_ARG(uint32_t *,      pu32Dst,                    1); \
                     IEM_MC_REF_GREG_U32(pu32Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-                    IEM_MC_REF_EFLAGS(pEFlags); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,                  0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg, /*=*/ cShift,    2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU32, fEFlagsIn, pu32Dst, cShiftArg); \
                     IEM_MC_CLEAR_HIGH_GREG_U64(IEM_GET_MODRM_RM(pVCpu, bRm)); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -8990,10 +8990,10 @@
                     IEM_MC_BEGIN(IEM_MC_F_64BIT, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-                    IEM_MC_ARG(uint64_t *,      pu64Dst,           0); \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg, cShift, 1); \
-                    IEM_MC_ARG(uint32_t *,      pEFlags,           2); \
+                    IEM_MC_ARG(uint64_t *,      pu64Dst,                    1); \
                     IEM_MC_REF_GREG_U64(pu64Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-                    IEM_MC_REF_EFLAGS(pEFlags); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,                  0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg, /*=*/ cShift,    2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU64, fEFlagsIn, pu64Dst, cShiftArg); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -9017,13 +9017,13 @@
                     \
                     IEM_MC_LOCAL(uint8_t,       bUnmapInfo); \
-                    IEM_MC_ARG(uint16_t *,      pu16Dst,            0); \
+                    IEM_MC_ARG(uint16_t *,      pu16Dst,                    1); \
                     IEM_MC_MEM_MAP_U16_RW(pu16Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
                     \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,  cShift, 1); \
-                    IEM_MC_ARG_LOCAL_EFLAGS(    pEFlags,    EFlags, 2); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,                  0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg, /*=*/ cShift,    2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU16, fEFlagsIn, pu16Dst, cShiftArg); \
                     \
                     IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -9039,13 +9039,13 @@
                     \
                     IEM_MC_LOCAL(uint8_t,       bUnmapInfo); \
-                    IEM_MC_ARG(uint32_t *,      pu32Dst,            0); \
+                    IEM_MC_ARG(uint32_t *,      pu32Dst,                    1); \
                     IEM_MC_MEM_MAP_U32_RW(pu32Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
                     \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,  cShift, 1); \
-                    IEM_MC_ARG_LOCAL_EFLAGS(    pEFlags,    EFlags, 2); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,                  0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg, /*=*/ cShift,    2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU32, fEFlagsIn, pu32Dst, cShiftArg); \
                     \
                     IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -9061,13 +9061,13 @@
                     \
                     IEM_MC_LOCAL(uint8_t,       bUnmapInfo); \
-                    IEM_MC_ARG(uint64_t *,      pu64Dst,            0); \
+                    IEM_MC_ARG(uint64_t *,      pu64Dst,                    1); \
                     IEM_MC_MEM_MAP_U64_RW(pu64Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
                     \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,  cShift, 1); \
-                    IEM_MC_ARG_LOCAL_EFLAGS(    pEFlags,    EFlags, 2); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,                  0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg, /*=*/ cShift,    2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU64, fEFlagsIn, pu64Dst, cShiftArg); \
                     \
                     IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -9693,10 +9693,10 @@
             IEM_MC_BEGIN(0, 0); \
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-            IEM_MC_ARG(uint8_t *,       pu8Dst,             0); \
-            IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/1,   1); \
-            IEM_MC_ARG(uint32_t *,      pEFlags,            2); \
+            IEM_MC_ARG(uint8_t *,       pu8Dst,             1); \
             IEM_MC_REF_GREG_U8(pu8Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-            IEM_MC_REF_EFLAGS(pEFlags); \
-            IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags); \
+            IEM_MC_ARG_EFLAGS(          fEFlagsIn,          0); \
+            IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/1,   2); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU8, fEFlagsIn, pu8Dst, cShiftArg); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
@@ -9706,17 +9706,18 @@
             /* memory */ \
             IEM_MC_BEGIN(0, 0); \
-            IEM_MC_ARG(uint8_t *,       pu8Dst,             0); \
-            IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/1,   1); \
-            IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
-            IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
-            \
+            IEM_MC_LOCAL(RTGCPTR,       GCPtrEffDst); \
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+            \
+            IEM_MC_LOCAL(uint8_t,       bUnmapInfo); \
+            IEM_MC_ARG(uint8_t *,       pu8Dst,             1); \
             IEM_MC_MEM_MAP_U8_RW(pu8Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
-            IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags,        2); \
-            IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags); \
+            \
+            IEM_MC_ARG_EFLAGS(          fEFlagsIn,          0); \
+            IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/1,   2); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU8, fEFlagsIn, pu8Dst, cShiftArg); \
             \
             IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-            IEM_MC_COMMIT_EFLAGS(EFlags); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
@@ -9829,10 +9830,10 @@
                     IEM_MC_BEGIN(0, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-                    IEM_MC_ARG(uint16_t *,      pu16Dst,           0); \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=1*/1, 1); \
-                    IEM_MC_ARG(uint32_t *,      pEFlags,           2); \
+                    IEM_MC_ARG(uint16_t *,      pu16Dst,           1); \
                     IEM_MC_REF_GREG_U16(pu16Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-                    IEM_MC_REF_EFLAGS(pEFlags); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,         0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/ 1, 2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU16, fEFlagsIn, pu16Dst, cShiftArg); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -9842,11 +9843,11 @@
                     IEM_MC_BEGIN(IEM_MC_F_MIN_386, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-                    IEM_MC_ARG(uint32_t *,      pu32Dst,           0); \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=1*/1, 1); \
-                    IEM_MC_ARG(uint32_t *,      pEFlags,           2); \
+                    IEM_MC_ARG(uint32_t *,      pu32Dst,           1); \
                     IEM_MC_REF_GREG_U32(pu32Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-                    IEM_MC_REF_EFLAGS(pEFlags); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,         0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/ 1, 2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU32, fEFlagsIn, pu32Dst, cShiftArg); \
                     IEM_MC_CLEAR_HIGH_GREG_U64(IEM_GET_MODRM_RM(pVCpu, bRm)); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -9856,10 +9857,10 @@
                     IEM_MC_BEGIN(IEM_MC_F_64BIT, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-                    IEM_MC_ARG(uint64_t *,      pu64Dst,           0); \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=1*/1, 1); \
-                    IEM_MC_ARG(uint32_t *,      pEFlags,           2); \
+                    IEM_MC_ARG(uint64_t *,      pu64Dst,           1); \
                     IEM_MC_REF_GREG_U64(pu64Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-                    IEM_MC_REF_EFLAGS(pEFlags); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,         0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/ 1, 2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU64, fEFlagsIn, pu64Dst, cShiftArg); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -9876,17 +9877,18 @@
                 case IEMMODE_16BIT: \
                     IEM_MC_BEGIN(0, 0); \
-                    IEM_MC_ARG(uint16_t *,      pu16Dst,            0); \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=1*/1,  1); \
-                    IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
-                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
-                    \
+                    IEM_MC_LOCAL(RTGCPTR,       GCPtrEffDst); \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+                    \
+                    IEM_MC_ARG(uint16_t *,      pu16Dst,            1); \
+                    IEM_MC_LOCAL(uint8_t,       bUnmapInfo); \
                     IEM_MC_MEM_MAP_U16_RW(pu16Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
-                    IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags,        2); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags); \
+                    \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,          0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/ 1,  2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU16, fEFlagsIn, pu16Dst, cShiftArg); \
                     \
                     IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -9895,17 +9897,18 @@
                 case IEMMODE_32BIT: \
                     IEM_MC_BEGIN(IEM_MC_F_MIN_386, 0); \
-                    IEM_MC_ARG(uint32_t *,      pu32Dst,            0); \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=1*/1,  1); \
-                    IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
-                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
-                    \
+                    IEM_MC_LOCAL(RTGCPTR,       GCPtrEffDst); \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+                    \
+                    IEM_MC_LOCAL(uint8_t,       bUnmapInfo); \
+                    IEM_MC_ARG(uint32_t *,      pu32Dst,            1); \
                     IEM_MC_MEM_MAP_U32_RW(pu32Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
-                    IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags,        2); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags); \
+                    \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,          0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/ 1,  2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU32, fEFlagsIn, pu32Dst, cShiftArg); \
                     \
                     IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -9914,17 +9917,18 @@
                 case IEMMODE_64BIT: \
                     IEM_MC_BEGIN(IEM_MC_F_64BIT, 0); \
-                    IEM_MC_ARG(uint64_t *,      pu64Dst,            0); \
-                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=1*/1,  1); \
-                    IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
-                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
-                    \
+                    IEM_MC_LOCAL(RTGCPTR,       GCPtrEffDst); \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+                    \
+                    IEM_MC_LOCAL(uint8_t,       bUnmapInfo); \
+                    IEM_MC_ARG(uint64_t *,      pu64Dst,            1); \
                     IEM_MC_MEM_MAP_U64_RW(pu64Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
-                    IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags,        2); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags); \
+                    \
+                    IEM_MC_ARG_EFLAGS(          fEFlagsIn,          0); \
+                    IEM_MC_ARG_CONST(uint8_t,   cShiftArg,/*=*/ 1,  2); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU64, fEFlagsIn, pu64Dst, cShiftArg); \
                     \
                     IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -10057,11 +10061,11 @@
             IEM_MC_BEGIN(0, 0); \
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-            IEM_MC_ARG(uint8_t *,   pu8Dst,     0); \
-            IEM_MC_ARG(uint8_t,     cShiftArg,  1); \
-            IEM_MC_ARG(uint32_t *,  pEFlags,    2); \
+            IEM_MC_ARG(uint8_t,     cShiftArg,  2); \
             IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX); \
+            IEM_MC_ARG(uint8_t *,   pu8Dst,     1); \
             IEM_MC_REF_GREG_U8(pu8Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-            IEM_MC_REF_EFLAGS(pEFlags); \
-            IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags); \
+            IEM_MC_ARG_EFLAGS(      fEFlagsIn,  0); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU8, fEFlagsIn, pu8Dst, cShiftArg); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
@@ -10071,18 +10075,20 @@
             /* memory */ \
             IEM_MC_BEGIN(0, 0); \
-            IEM_MC_ARG(uint8_t *,   pu8Dst,          0); \
-            IEM_MC_ARG(uint8_t,     cShiftArg,       1); \
             IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
-            IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
-            \
             IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
             IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+            \
+            IEM_MC_LOCAL(uint8_t,   bUnmapInfo); \
+            IEM_MC_ARG(uint8_t *,   pu8Dst,     1); \
+            IEM_MC_MEM_MAP_U8_RW(pu8Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
+            \
+            IEM_MC_ARG(uint8_t,     cShiftArg,  2); \
             IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX); \
-            IEM_MC_MEM_MAP_U8_RW(pu8Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
-            IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
-            IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU8, pu8Dst, cShiftArg, pEFlags); \
+            \
+            IEM_MC_ARG_EFLAGS(      fEFlagsIn,  0); \
+            IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU8, fEFlagsIn, pu8Dst, cShiftArg); \
             \
             IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-            IEM_MC_COMMIT_EFLAGS(EFlags); \
+            IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
             IEM_MC_ADVANCE_RIP_AND_FINISH(); \
             IEM_MC_END(); \
@@ -10195,5 +10201,5 @@
                     IEM_MC_BEGIN(0, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-                    IEM_MC_ARG(uint8_t,         cShiftArg,  1); \
+                    IEM_MC_ARG(uint8_t,         cShiftArg,  2); \
                     IEM_MC_NATIVE_IF(a_fRegNativeArchs) { \
                         IEM_MC_NATIVE_SET_AMD64_HOST_REG_FOR_LOCAL(cShiftArg, X86_GREG_xCX); \
@@ -10207,9 +10213,9 @@
                     } IEM_MC_NATIVE_ELSE() { \
                         IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX); \
-                        IEM_MC_ARG(uint16_t *,  pu16Dst,    0); \
+                        IEM_MC_ARG(uint16_t *,  pu16Dst,    1); \
                         IEM_MC_REF_GREG_U16(pu16Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-                        IEM_MC_ARG(uint32_t *,  pEFlags,    2); \
-                        IEM_MC_REF_EFLAGS(pEFlags); \
-                        IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags); \
+                        IEM_MC_ARG_EFLAGS(      fEFlagsIn,  0); \
+                        IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU16, fEFlagsIn, pu16Dst, cShiftArg); \
+                        IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     } IEM_MC_NATIVE_ENDIF(); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
@@ -10220,5 +10226,5 @@
                     IEM_MC_BEGIN(IEM_MC_F_MIN_386, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-                    IEM_MC_ARG(uint8_t,         cShiftArg,  1); \
+                    IEM_MC_ARG(uint8_t,         cShiftArg,  2); \
                     IEM_MC_NATIVE_IF(a_fRegNativeArchs) { \
                         IEM_MC_NATIVE_SET_AMD64_HOST_REG_FOR_LOCAL(cShiftArg, X86_GREG_xCX); \
@@ -10232,10 +10238,10 @@
                     } IEM_MC_NATIVE_ELSE() { \
                         IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX); \
-                        IEM_MC_ARG(uint32_t *,  pu32Dst,    0); \
+                        IEM_MC_ARG(uint32_t *,  pu32Dst,    1); \
                         IEM_MC_REF_GREG_U32(pu32Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-                        IEM_MC_ARG(uint32_t *,  pEFlags,    2); \
-                        IEM_MC_REF_EFLAGS(pEFlags); \
-                        IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags); \
+                        IEM_MC_ARG_EFLAGS(      fEFlagsIn,  0); \
+                        IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU32, fEFlagsIn, pu32Dst, cShiftArg); \
                         IEM_MC_CLEAR_HIGH_GREG_U64(IEM_GET_MODRM_RM(pVCpu, bRm)); \
+                        IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     } IEM_MC_NATIVE_ENDIF(); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
@@ -10246,5 +10252,5 @@
                     IEM_MC_BEGIN(IEM_MC_F_64BIT, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
-                    IEM_MC_ARG(uint8_t,         cShiftArg,  1); \
+                    IEM_MC_ARG(uint8_t,         cShiftArg,  2); \
                     IEM_MC_NATIVE_IF(a_fRegNativeArchs) { \
                         IEM_MC_NATIVE_SET_AMD64_HOST_REG_FOR_LOCAL(cShiftArg, X86_GREG_xCX); \
@@ -10258,9 +10264,9 @@
                     } IEM_MC_NATIVE_ELSE() { \
                         IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX); \
-                        IEM_MC_ARG(uint64_t *,  pu64Dst,    0); \
+                        IEM_MC_ARG(uint64_t *,  pu64Dst,    1); \
                         IEM_MC_REF_GREG_U64(pu64Dst, IEM_GET_MODRM_RM(pVCpu, bRm)); \
-                        IEM_MC_ARG(uint32_t *,  pEFlags,    2); \
-                        IEM_MC_REF_EFLAGS(pEFlags); \
-                        IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags); \
+                        IEM_MC_ARG_EFLAGS(      fEFlagsIn,  0); \
+                        IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU64, fEFlagsIn, pu64Dst, cShiftArg); \
+                        IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     } IEM_MC_NATIVE_ENDIF(); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
@@ -10278,18 +10284,19 @@
                 case IEMMODE_16BIT: \
                     IEM_MC_BEGIN(0, 0); \
-                    IEM_MC_ARG(uint16_t *,  pu16Dst,    0); \
-                    IEM_MC_ARG(uint8_t,     cShiftArg,  1); \
-                    IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
-                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
-                    \
+                    IEM_MC_LOCAL(RTGCPTR,   GCPtrEffDst); \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+                    \
+                    IEM_MC_LOCAL(uint8_t,   bUnmapInfo); \
+                    IEM_MC_ARG(uint16_t *,  pu16Dst,    1); \
+                    IEM_MC_MEM_MAP_U16_RW(pu16Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
+                    \
+                    IEM_MC_ARG(uint8_t,     cShiftArg,  2); \
                     IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX); \
-                    IEM_MC_MEM_MAP_U16_RW(pu16Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
-                    IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU16, pu16Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(      fEFlagsIn,  0); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU16, fEFlagsIn, pu16Dst, cShiftArg); \
                     \
                     IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -10298,18 +10305,19 @@
                 case IEMMODE_32BIT: \
                     IEM_MC_BEGIN(IEM_MC_F_MIN_386, 0); \
-                    IEM_MC_ARG(uint32_t *,  pu32Dst,    0); \
-                    IEM_MC_ARG(uint8_t,     cShiftArg,  1); \
-                    IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
-                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
-                    \
+                    IEM_MC_LOCAL(RTGCPTR,   GCPtrEffDst); \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+                    \
+                    IEM_MC_LOCAL(uint8_t,   bUnmapInfo); \
+                    IEM_MC_ARG(uint32_t *,  pu32Dst,    1); \
+                    IEM_MC_MEM_MAP_U32_RW(pu32Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
+                    \
+                    IEM_MC_ARG(uint8_t,     cShiftArg,  2); \
                     IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX); \
-                    IEM_MC_MEM_MAP_U32_RW(pu32Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
-                    IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU32, pu32Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(      fEFlagsIn,  0); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU32, fEFlagsIn, pu32Dst, cShiftArg); \
                     \
                     IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
@@ -10318,18 +10326,19 @@
                 case IEMMODE_64BIT: \
                     IEM_MC_BEGIN(IEM_MC_F_64BIT, 0); \
-                    IEM_MC_ARG(uint64_t *,  pu64Dst,    0); \
-                    IEM_MC_ARG(uint8_t,     cShiftArg,  1); \
                     IEM_MC_LOCAL(RTGCPTR, GCPtrEffDst); \
-                    IEM_MC_LOCAL(uint8_t, bUnmapInfo); \
-                    \
                     IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffDst, bRm, 0); \
                     IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX(); \
+                    \
+                    IEM_MC_LOCAL(uint8_t,   bUnmapInfo); \
+                    IEM_MC_ARG(uint64_t *,  pu64Dst,    1); \
+                    IEM_MC_MEM_MAP_U64_RW(pu64Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
+                    \
+                    IEM_MC_ARG(uint8_t,     cShiftArg,  2); \
                     IEM_MC_FETCH_GREG_U8(cShiftArg, X86_GREG_xCX); \
-                    IEM_MC_MEM_MAP_U64_RW(pu64Dst, bUnmapInfo, pVCpu->iem.s.iEffSeg, GCPtrEffDst); \
-                    IEM_MC_ARG_LOCAL_EFLAGS(pEFlags, EFlags, 2); \
-                    IEM_MC_CALL_VOID_AIMPL_3(pImpl->pfnNormalU64, pu64Dst, cShiftArg, pEFlags); \
+                    IEM_MC_ARG_EFLAGS(      fEFlagsIn,  0); \
+                    IEM_MC_CALL_AIMPL_3(uint32_t, fEFlagsRet, pImpl->pfnNormalU64, fEFlagsIn, pu64Dst, cShiftArg); \
                     \
                     IEM_MC_MEM_COMMIT_AND_UNMAP_RW(bUnmapInfo); \
-                    IEM_MC_COMMIT_EFLAGS(EFlags); \
+                    IEM_MC_COMMIT_EFLAGS(fEFlagsRet); \
                     IEM_MC_ADVANCE_RIP_AND_FINISH(); \
                     IEM_MC_END(); \
Index: /trunk/src/VBox/VMM/include/IEMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/IEMInternal.h	(revision 104237)
+++ /trunk/src/VBox/VMM/include/IEMInternal.h	(revision 104238)
@@ -2895,5 +2895,5 @@
 /** @name Shift operations on bytes (Group 2).
  * @{ */
-typedef IEM_DECL_IMPL_TYPE(void, FNIEMAIMPLSHIFTU8,(uint8_t *pu8Dst, uint8_t cShift, uint32_t *pEFlags));
+typedef IEM_DECL_IMPL_TYPE(uint32_t, FNIEMAIMPLSHIFTU8,(uint32_t fEFlagsIn, uint8_t *pu8Dst, uint8_t cShift));
 typedef FNIEMAIMPLSHIFTU8  *PFNIEMAIMPLSHIFTU8;
 FNIEMAIMPLSHIFTU8 iemAImpl_rol_u8, iemAImpl_rol_u8_amd, iemAImpl_rol_u8_intel;
@@ -2908,5 +2908,5 @@
 /** @name Shift operations on words (Group 2).
  * @{ */
-typedef IEM_DECL_IMPL_TYPE(void, FNIEMAIMPLSHIFTU16,(uint16_t *pu16Dst, uint8_t cShift, uint32_t *pEFlags));
+typedef IEM_DECL_IMPL_TYPE(uint32_t, FNIEMAIMPLSHIFTU16,(uint32_t fEFlagsIn, uint16_t *pu16Dst, uint8_t cShift));
 typedef FNIEMAIMPLSHIFTU16  *PFNIEMAIMPLSHIFTU16;
 FNIEMAIMPLSHIFTU16 iemAImpl_rol_u16, iemAImpl_rol_u16_amd, iemAImpl_rol_u16_intel;
@@ -2921,5 +2921,5 @@
 /** @name Shift operations on double words (Group 2).
  * @{ */
-typedef IEM_DECL_IMPL_TYPE(void, FNIEMAIMPLSHIFTU32,(uint32_t *pu32Dst, uint8_t cShift, uint32_t *pEFlags));
+typedef IEM_DECL_IMPL_TYPE(uint32_t, FNIEMAIMPLSHIFTU32,(uint32_t fEFlagsIn, uint32_t *pu32Dst, uint8_t cShift));
 typedef FNIEMAIMPLSHIFTU32  *PFNIEMAIMPLSHIFTU32;
 FNIEMAIMPLSHIFTU32 iemAImpl_rol_u32, iemAImpl_rol_u32_amd, iemAImpl_rol_u32_intel;
@@ -2934,5 +2934,5 @@
 /** @name Shift operations on words (Group 2).
  * @{ */
-typedef IEM_DECL_IMPL_TYPE(void, FNIEMAIMPLSHIFTU64,(uint64_t *pu64Dst, uint8_t cShift, uint32_t *pEFlags));
+typedef IEM_DECL_IMPL_TYPE(uint32_t, FNIEMAIMPLSHIFTU64,(uint32_t fEFlagsIn, uint64_t *pu64Dst, uint8_t cShift));
 typedef FNIEMAIMPLSHIFTU64  *PFNIEMAIMPLSHIFTU64;
 FNIEMAIMPLSHIFTU64 iemAImpl_rol_u64, iemAImpl_rol_u64_amd, iemAImpl_rol_u64_intel;
Index: /trunk/src/VBox/VMM/testcase/tstIEMAImpl.cpp
===================================================================
--- /trunk/src/VBox/VMM/testcase/tstIEMAImpl.cpp	(revision 104237)
+++ /trunk/src/VBox/VMM/testcase/tstIEMAImpl.cpp	(revision 104238)
@@ -2783,16 +2783,14 @@
             a_TestType Test; \
             Test.fEflIn    = RandEFlags(); \
-            Test.fEflOut   = Test.fEflIn; \
             Test.uDstIn    = RandU ## a_cBits ## Dst(iTest); \
             Test.uDstOut   = Test.uDstIn; \
             Test.uSrcIn    = 0; \
             Test.uMisc     = RandU8() & (a_cBits * 4 - 1); /* need to go way beyond the a_cBits limit */ \
-            a_aSubTests[iFn].pfnNative(&Test.uDstOut, Test.uMisc, &Test.fEflOut); \
+            Test.fEflOut   = a_aSubTests[iFn].pfnNative(Test.fEflIn, &Test.uDstOut, Test.uMisc); \
             GenerateBinaryWrite(&BinOut, &Test, sizeof(Test)); \
             \
             Test.fEflIn    = (~Test.fEflIn & X86_EFL_LIVE_MASK) | X86_EFL_RA1_MASK; \
-            Test.fEflOut   = Test.fEflIn; \
             Test.uDstOut   = Test.uDstIn; \
-            a_aSubTests[iFn].pfnNative(&Test.uDstOut, Test.uMisc, &Test.fEflOut); \
+            Test.fEflOut   = a_aSubTests[iFn].pfnNative(Test.fEflIn, &Test.uDstOut, Test.uMisc); \
             GenerateBinaryWrite(&BinOut, &Test, sizeof(Test)); \
         } \
@@ -2838,19 +2836,15 @@
     for (uint32_t i = 0; i < cIterations; i++) \
     { \
-        uint32_t fBenchEfl = fEflIn; \
         a_uType  uBenchDst = uDstIn;  \
-        pfn(&uBenchDst, cShift, &fBenchEfl); \
+        pfn(fEflIn, &uBenchDst, cShift); \
         \
-        fBenchEfl = fEflIn; \
         uBenchDst = uDstIn;  \
-        pfn(&uBenchDst, cShift, &fBenchEfl); \
+        pfn(fEflIn, &uBenchDst, cShift); \
         \
-        fBenchEfl = fEflIn; \
         uBenchDst = uDstIn;  \
-        pfn(&uBenchDst, cShift, &fBenchEfl); \
+        pfn(fEflIn, &uBenchDst, cShift); \
         \
-        fBenchEfl = fEflIn; \
         uBenchDst = uDstIn;  \
-        pfn(&uBenchDst, cShift, &fBenchEfl); \
+        pfn(fEflIn, &uBenchDst, cShift); \
     } \
     return RTTimeNanoTS() - nsStart; \
@@ -2872,21 +2866,19 @@
             for (uint32_t iTest = 0; iTest < cTests; iTest++ ) \
             { \
-                uint32_t fEfl = paTests[iTest].fEflIn; \
-                a_uType  uDst = paTests[iTest].uDstIn; \
-                pfn(&uDst, paTests[iTest].uMisc, &fEfl); \
-                if (   uDst != paTests[iTest].uDstOut \
-                    || fEfl != paTests[iTest].fEflOut ) \
+                a_uType  uDst    = paTests[iTest].uDstIn; \
+                uint32_t fEflOut = pfn(paTests[iTest].fEflIn, &uDst, paTests[iTest].uMisc); \
+                if (   uDst    != paTests[iTest].uDstOut \
+                    || fEflOut != paTests[iTest].fEflOut ) \
                     RTTestFailed(g_hTest, "#%u%s: efl=%#08x dst=" a_Fmt " shift=%2u -> efl=%#08x dst=" a_Fmt ", expected %#08x & " a_Fmt "%s\n", \
                                  iTest, iVar == 0 ? "" : "/n", \
                                  paTests[iTest].fEflIn, paTests[iTest].uDstIn, paTests[iTest].uMisc, \
-                                 fEfl, uDst, paTests[iTest].fEflOut, paTests[iTest].uDstOut, \
-                                 EFlagsDiff(fEfl, paTests[iTest].fEflOut)); \
+                                 fEflOut, uDst, paTests[iTest].fEflOut, paTests[iTest].uDstOut, \
+                                 EFlagsDiff(fEflOut, paTests[iTest].fEflOut)); \
                 else \
                 { \
                      *g_pu ## a_cBits  = paTests[iTest].uDstIn; \
-                     *g_pfEfl          = paTests[iTest].fEflIn; \
-                     pfn(g_pu ## a_cBits, paTests[iTest].uMisc, g_pfEfl); \
+                     fEflOut = pfn(paTests[iTest].fEflIn, g_pu ## a_cBits, paTests[iTest].uMisc); \
                      RTTEST_CHECK(g_hTest, *g_pu ## a_cBits == paTests[iTest].uDstOut); \
-                     RTTEST_CHECK(g_hTest, *g_pfEfl == paTests[iTest].fEflOut); \
+                     RTTEST_CHECK(g_hTest, fEflOut == paTests[iTest].fEflOut); \
                 } \
             } \
