Index: trunk/src/VBox/Devices/VMMDev/VBoxDev.cpp
===================================================================
--- trunk/src/VBox/Devices/VMMDev/VBoxDev.cpp	(revision 12686)
+++ trunk/src/VBox/Devices/VMMDev/VBoxDev.cpp	(revision 12687)
@@ -1606,23 +1606,51 @@
     int rc;
 
-    AssertReturn(iRegion == 1 && enmType == PCI_ADDRESS_SPACE_MEM, VERR_INTERNAL_ERROR);
+    AssertReturn(iRegion <= 2 && enmType == PCI_ADDRESS_SPACE_MEM, VERR_INTERNAL_ERROR);
     Assert(pThis->pVMMDevRAMR3 != NULL);
-
-    if (GCPhysAddress != NIL_RTGCPHYS)
-    {
-        /*
-         * Map the MMIO2 memory.
-         */
-        pThis->GCPhysVMMDevRAM = GCPhysAddress;
-        Assert(pThis->GCPhysVMMDevRAM == GCPhysAddress);
-        rc = PDMDevHlpMMIO2Map(pPciDev->pDevIns, iRegion, GCPhysAddress);
+    Assert(pThis->pVMMDevHeapR3 != NULL);
+
+    if (iRegion == 1)
+    {
+        if (GCPhysAddress != NIL_RTGCPHYS)
+        {
+            /*
+             * Map the MMIO2 memory.
+             */
+            pThis->GCPhysVMMDevRAM = GCPhysAddress;
+            Assert(pThis->GCPhysVMMDevRAM == GCPhysAddress);
+            rc = PDMDevHlpMMIO2Map(pPciDev->pDevIns, iRegion, GCPhysAddress);
+        }
+        else
+        {
+            /*
+             * It is about to be unmapped, just clean up.
+             */
+            pThis->GCPhysVMMDevRAM = NIL_RTGCPHYS32;
+            rc = VINF_SUCCESS;
+        }
     }
     else
-    {
-        /*
-         * It is about to be unmapped, just clean up.
-         */
-        pThis->GCPhysVMMDevRAM = NIL_RTGCPHYS32;
-        rc = VINF_SUCCESS;
+    if (iRegion == 2)
+    {
+        if (GCPhysAddress != NIL_RTGCPHYS)
+        {
+            /*
+             * Map the MMIO2 memory.
+             */
+            pThis->GCPhysVMMDevHeap = GCPhysAddress;
+            Assert(pThis->GCPhysVMMDevHeap == GCPhysAddress);
+            rc = PDMDevHlpMMIO2Map(pPciDev->pDevIns, iRegion, GCPhysAddress);
+            if (VBOX_SUCCESS(rc))
+                rc = PDMDevHlpRegisterVMMDevHeap(pPciDev->pDevIns, GCPhysAddress, pThis->pVMMDevHeapR3, VMMDEV_HEAP_SIZE);
+        }
+        else
+        {
+            /*
+             * It is about to be unmapped, just clean up.
+             */
+            PDMDevHlpUnregisterVMMDevHeap(pPciDev->pDevIns, GCPhysAddress);
+            pThis->GCPhysVMMDevHeap = NIL_RTGCPHYS32;
+            rc = VINF_SUCCESS;
+        }
     }
 
@@ -2245,4 +2273,9 @@
     vmmdevInitRam(pThis);
 
+    rc = PDMDevHlpMMIO2Register(pDevIns, 2 /*iRegion*/, VMMDEV_HEAP_SIZE, 0, (void **)&pThis->pVMMDevHeapR3, "VMMDev Heap");
+    if (RT_FAILURE(rc))
+        return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
+                                   N_("Failed to allocate %u bytes of memory for the VMM device"), PAGE_SIZE);
+
     /*
      * Register the PCI device.
@@ -2257,4 +2290,7 @@
         return rc;
     rc = PDMDevHlpPCIIORegionRegister(pDevIns, 1, VMMDEV_RAM_SIZE, PCI_ADDRESS_SPACE_MEM, vmmdevIORAMRegionMap);
+    if (RT_FAILURE(rc))
+        return rc;
+    rc = PDMDevHlpPCIIORegionRegister(pDevIns, 2, VMMDEV_HEAP_SIZE, PCI_ADDRESS_SPACE_MEM, vmmdevIORAMRegionMap);
     if (RT_FAILURE(rc))
         return rc;
Index: trunk/src/VBox/Devices/VMMDev/VMMDevState.h
===================================================================
--- trunk/src/VBox/Devices/VMMDev/VMMDevState.h	(revision 12686)
+++ trunk/src/VBox/Devices/VMMDev/VMMDevState.h	(revision 12687)
@@ -91,4 +91,10 @@
     RTGCPHYS32 GCPhysVMMDevRAM;
 
+    /** R3 pointer to VMMDev Heap RAM area 
+     */
+    R3PTRTYPE(VMMDevMemory *) pVMMDevHeapR3;
+    /** GC physical address of VMMDev Heap RAM area */
+    RTGCPHYS32 GCPhysVMMDevHeap;
+
     /** Information reported by guest via VMMDevReportGuestInfo generic request.
      * Until this information is reported the VMMDev refuses any other requests.
Index: trunk/src/VBox/VMM/HWACCM.cpp
===================================================================
--- trunk/src/VBox/VMM/HWACCM.cpp	(revision 12686)
+++ trunk/src/VBox/VMM/HWACCM.cpp	(revision 12687)
@@ -517,5 +517,4 @@
 
             LogRel(("HWACCM: VMCS physaddr                 = %VHp\n", pVM->hwaccm.s.vmx.pVMCSPhys));
-            LogRel(("HWACCM: Real mode TSS physaddr        = %VHp\n", pVM->hwaccm.s.vmx.pRealModeTSSPhys));
             LogRel(("HWACCM: TPR shadow physaddr           = %VHp\n", pVM->hwaccm.s.vmx.pAPICPhys));
             LogRel(("HWACCM: MSR bitmap physaddr           = %VHp\n", pVM->hwaccm.s.vmx.pMSRBitmapPhys));
@@ -523,4 +522,17 @@
             /* Only try once. */
             pVM->hwaccm.s.fInitialized = true;
+
+            /* Allocate one page for the TSS we need for real mode emulation. */
+            rc = PDMR3VMMDevHeapAlloc(pVM, sizeof(*pVM->hwaccm.s.vmx.pRealModeTSS), (RTR3PTR *)&pVM->hwaccm.s.vmx.pRealModeTSS);
+            AssertRC(rc);
+            if (RT_FAILURE(rc))
+                return rc;
+
+            /* The I/O bitmap starts right after the virtual interrupt redirection bitmap. Outside the TSS on purpose; the CPU will not check it
+            * for I/O operations. */
+            ASMMemZero32(pVM->hwaccm.s.vmx.pRealModeTSS, sizeof(*pVM->hwaccm.s.vmx.pRealModeTSS));
+            pVM->hwaccm.s.vmx.pRealModeTSS->offIoBitmap = sizeof(*pVM->hwaccm.s.vmx.pRealModeTSS);
+            /* Bit set to 0 means redirection enabled. */
+            memset(pVM->hwaccm.s.vmx.pRealModeTSS->IntRedirBitmap, 0x0, sizeof(pVM->hwaccm.s.vmx.pRealModeTSS->IntRedirBitmap));
 
             rc = SUPCallVMMR0Ex(pVM->pVMR0, VMMR0_DO_HWACC_SETUP_VM, 0, NULL);
@@ -689,4 +701,10 @@
 HWACCMR3DECL(int) HWACCMR3Term(PVM pVM)
 {
+    if (pVM->hwaccm.s.vmx.pRealModeTSS)
+    {
+        PDMR3VMMDevHeapFree(pVM, pVM->hwaccm.s.vmx.pRealModeTSS);
+        pVM->hwaccm.s.vmx.pRealModeTSS       = 0;
+    }
+
     if (pVM->hwaccm.s.pStatExitReason)
     {
Index: trunk/src/VBox/VMM/HWACCMInternal.h
===================================================================
--- trunk/src/VBox/VMM/HWACCMInternal.h	(revision 12686)
+++ trunk/src/VBox/VMM/HWACCMInternal.h	(revision 12687)
@@ -205,10 +205,6 @@
         R0PTRTYPE(void *)           pVMCS;
 
-        /** R0 memory object for the TSS page used for real mode emulation. */
-        RTR0MEMOBJ                  pMemObjRealModeTSS;
-        /** Physical address of the TSS page used for real mode emulation. */
-        RTHCPHYS                    pRealModeTSSPhys;
         /** Virtual address of the TSS page used for real mode emulation. */
-        R0PTRTYPE(PVBOXTSS)         pRealModeTSS;
+        R3PTRTYPE(PVBOXTSS)         pRealModeTSS;
 
         /** R0 memory object for the virtual APIC mmio cache. */
Index: trunk/src/VBox/VMM/PDM.cpp
===================================================================
--- trunk/src/VBox/VMM/PDM.cpp	(revision 12686)
+++ trunk/src/VBox/VMM/PDM.cpp	(revision 12687)
@@ -1188,2 +1188,71 @@
 }
 
+/**
+ * Registers the VMM device heap
+ *
+ * @returns VBox status code.
+ * @param   pVM             VM handle.
+ * @param   GCPhys          The physical address.
+ * @param   pvHeap          Ring-3 pointer.
+ * @param   cbSize          Size of the heap.
+ */
+PDMR3DECL(int) PDMR3RegisterVMMDevHeap(PVM pVM, RTGCPHYS GCPhys, RTR3PTR pvHeap, unsigned cbSize)
+{
+    Assert(pVM->pdm.s.pvVMMDevHeap == NULL);
+
+    pVM->pdm.s.pvVMMDevHeap     = pvHeap;
+    pVM->pdm.s.GCPhysVMMDevHeap = GCPhys;
+    pVM->pdm.s.cbVMMDevHeap     = cbSize;
+    pVM->pdm.s.cbVMMDevHeapLeft = cbSize;
+    return VINF_SUCCESS;
+}
+
+/**
+ * Unregisters the VMM device heap
+ *
+ * @returns VBox status code.
+ * @param   pVM             VM handle.
+ * @param   GCPhys          The physical address.
+ */
+PDMR3DECL(int) PDMR3UnregisterVMMDevHeap(PVM pVM, RTGCPHYS GCPhys)
+{
+    Assert(pVM->pdm.s.GCPhysVMMDevHeap == GCPhys);
+
+    pVM->pdm.s.pvVMMDevHeap     = NULL;
+    pVM->pdm.s.GCPhysVMMDevHeap = NIL_RTGCPHYS;
+    pVM->pdm.s.cbVMMDevHeap     = 0;
+    pVM->pdm.s.cbVMMDevHeapLeft = 0;
+    return VINF_SUCCESS;
+}
+
+/**
+ * Allocates memory from the VMM device heap
+ *
+ * @returns VBox status code.
+ * @param   pVM             VM handle.
+ * @param   cbSize          Allocation size.
+ * @param   pv              Ring-3 pointer. (out)
+ */
+PDMR3DECL(int) PDMR3VMMDevHeapAlloc(PVM pVM, unsigned cbSize, RTR3PTR *ppv)
+{
+    AssertReturn(cbSize && cbSize <= pVM->pdm.s.cbVMMDevHeapLeft, VERR_NO_MEMORY);
+
+    /* @todo not a real heap as there's currently only one user. */
+    *ppv = pVM->pdm.s.pvVMMDevHeap;
+    pVM->pdm.s.cbVMMDevHeapLeft = 0;
+    return VINF_SUCCESS;
+}
+
+/**
+ * Frees memory from the VMM device heap
+ *
+ * @returns VBox status code.
+ * @param   pVM             VM handle.
+ * @param   pv              Ring-3 pointer. 
+ */
+PDMR3DECL(int) PDMR3VMMDevHeapFree(PVM pVM, RTR3PTR pv)
+{
+    Assert(pVM->pdm.s.cbVMMDevHeapLeft == 0);
+    pVM->pdm.s.cbVMMDevHeapLeft = pVM->pdm.s.cbVMMDevHeap;
+    return VINF_SUCCESS;
+}
Index: trunk/src/VBox/VMM/PDMDevice.cpp
===================================================================
--- trunk/src/VBox/VMM/PDMDevice.cpp	(revision 12686)
+++ trunk/src/VBox/VMM/PDMDevice.cpp	(revision 12687)
@@ -173,4 +173,6 @@
 static DECLCALLBACK(int) pdmR3DevHlp_MMIO2Unmap(PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS GCPhys);
 static DECLCALLBACK(int) pdmR3DevHlp_MMHyperMapMMIO2(PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS off, RTGCPHYS cb, const char *pszDesc, PRTRCPTR pRCPtr);
+static DECLCALLBACK(int) pdmR3DevHlp_RegisterVMMDevHeap(PPDMDEVINS pDevIns, RTGCPHYS GCPhys, RTR3PTR pvHeap, unsigned cbSize);
+static DECLCALLBACK(int) pdmR3DevHlp_UnregisterVMMDevHeap(PPDMDEVINS pDevIns, RTGCPHYS GCPhys);
 
 static DECLCALLBACK(PVM) pdmR3DevHlp_Untrusted_GetVM(PPDMDEVINS pDevIns);
@@ -212,4 +214,6 @@
 static DECLCALLBACK(int) pdmR3DevHlp_Untrusted_MMIO2Unmap(PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS GCPhys);
 static DECLCALLBACK(int) pdmR3DevHlp_Untrusted_MMHyperMapMMIO2(PPDMDEVINS pDevIns, uint32_t iRegion, RTGCPHYS off, RTGCPHYS cb, const char *pszDesc, PRTRCPTR pRCPtr);
+static DECLCALLBACK(int) pdmR3DevHlp_Untrusted_RegisterVMMDevHeap(PPDMDEVINS pDevIns, RTGCPHYS GCPhys, RTR3PTR pvHeap, unsigned cbSize);
+static DECLCALLBACK(int) pdmR3DevHlp_Untrusted_UnregisterVMMDevHeap(PPDMDEVINS pDevIns, RTGCPHYS GCPhys);
 /** @} */
 
@@ -381,4 +385,6 @@
     pdmR3DevHlp_MMIO2Unmap,
     pdmR3DevHlp_MMHyperMapMMIO2,
+    pdmR3DevHlp_RegisterVMMDevHeap,
+    pdmR3DevHlp_UnregisterVMMDevHeap,
     PDM_DEVHLP_VERSION /* the end */
 };
@@ -475,4 +481,6 @@
     pdmR3DevHlp_Untrusted_MMIO2Unmap,
     pdmR3DevHlp_Untrusted_MMHyperMapMMIO2,
+    pdmR3DevHlp_Untrusted_RegisterVMMDevHeap,
+    pdmR3DevHlp_Untrusted_UnregisterVMMDevHeap,
     PDM_DEVHLP_VERSION /* the end */
 };
@@ -3643,5 +3651,28 @@
 
 
-
+/**
+ * @copydoc PDMDEVHLP::pfnRegisterVMMDevHeap
+ */
+static DECLCALLBACK(int) pdmR3DevHlp_RegisterVMMDevHeap(PPDMDEVINS pDevIns, RTGCPHYS GCPhys, RTR3PTR pvHeap, unsigned cbSize)
+{
+    PDMDEV_ASSERT_DEVINS(pDevIns);
+    VM_ASSERT_EMT(pDevIns->Internal.s.pVMHC);
+
+    int rc = PDMR3RegisterVMMDevHeap(pDevIns->Internal.s.pVMHC, GCPhys, pvHeap, cbSize);
+    return rc;
+}
+
+
+/**
+ * @copydoc PDMDEVHLP::pfnUnregisterVMMDevHeap
+ */
+static DECLCALLBACK(int) pdmR3DevHlp_UnregisterVMMDevHeap(PPDMDEVINS pDevIns, RTGCPHYS GCPhys)
+{
+    PDMDEV_ASSERT_DEVINS(pDevIns);
+    VM_ASSERT_EMT(pDevIns->Internal.s.pVMHC);
+
+    int rc = PDMR3UnregisterVMMDevHeap(pDevIns->Internal.s.pVMHC, GCPhys);
+    return rc;
+}
 
 
@@ -3999,4 +4030,23 @@
 }
 
+/**
+ * @copydoc PDMDEVHLP::pfnRegisterVMMDevHeap
+ */
+static DECLCALLBACK(int) pdmR3DevHlp_Untrusted_RegisterVMMDevHeap(PPDMDEVINS pDevIns, RTGCPHYS GCPhys, RTR3PTR pvHeap, unsigned cbSize)
+{
+    PDMDEV_ASSERT_DEVINS(pDevIns);
+    AssertReleaseMsgFailed(("Untrusted device called trusted helper! '%s'/%d\n", pDevIns->pDevReg->szDeviceName, pDevIns->iInstance));
+    return VERR_ACCESS_DENIED;
+}
+
+/**
+ * @copydoc PDMDEVHLP::pfnUnregisterVMMDevHeap
+ */
+static DECLCALLBACK(int) pdmR3DevHlp_Untrusted_UnregisterVMMDevHeap(PPDMDEVINS pDevIns, RTGCPHYS GCPhys)
+{
+    PDMDEV_ASSERT_DEVINS(pDevIns);
+    AssertReleaseMsgFailed(("Untrusted device called trusted helper! '%s'/%d\n", pDevIns->pDevReg->szDeviceName, pDevIns->iInstance));
+    return VERR_ACCESS_DENIED;
+}
 
 
Index: trunk/src/VBox/VMM/PDMInternal.h
===================================================================
--- trunk/src/VBox/VMM/PDMInternal.h	(revision 12686)
+++ trunk/src/VBox/VMM/PDMInternal.h	(revision 12687)
@@ -844,4 +844,12 @@
     R3PTRTYPE(PPDMASYNCCOMPLETIONTEMPLATE) pAsyncCompletionTemplates;
 
+    /** PDM VMM device heap
+     * @{ */
+    RTR3PTR                         pvVMMDevHeap;
+    RTUINT                          cbVMMDevHeap;
+    RTUINT                          cbVMMDevHeapLeft;
+    RTGCPHYS                        GCPhysVMMDevHeap;
+    /** @} */
+
     /** TEMPORARY HACKS FOR NETWORK POLLING.
      * @todo fix NAT and kill this!
Index: trunk/src/VBox/VMM/VMMAll/PDMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PDMAll.cpp	(revision 12686)
+++ trunk/src/VBox/VMM/VMMAll/PDMAll.cpp	(revision 12687)
@@ -303,2 +303,18 @@
 }
 
+
+/**
+ * Converts ring 3 VMM heap pointer to a guest physical address
+ *
+ * @returns VBox status code.
+ * @param   pVM             VM handle.
+ * @param   pv              Ring-3 pointer.
+ * @param   pGCPhys         GC phys address (out).
+ */
+PDMDECL(int) PDMVMMDevHeapR3ToGCPhys(PVM pVM, RTR3PTR pv, RTGCPHYS *pGCPhys)
+{
+    AssertReturn(pv >= pVM->pdm.s.pvVMMDevHeap && (RTR3UINTPTR)pv < (RTR3UINTPTR)pVM->pdm.s.pvVMMDevHeap + pVM->pdm.s.cbVMMDevHeap, VERR_INVALID_PARAMETER);
+
+    *pGCPhys = (pVM->pdm.s.GCPhysVMMDevHeap + ((RTR3UINTPTR)pv - (RTR3UINTPTR)pVM->pdm.s.pvVMMDevHeap));
+    return VINF_SUCCESS;
+}
Index: trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 12686)
+++ trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 12687)
@@ -141,5 +141,4 @@
     pVM->hwaccm.s.vmx.pMemObjVMCS = NIL_RTR0MEMOBJ;
     pVM->hwaccm.s.vmx.pMemObjAPIC = NIL_RTR0MEMOBJ;
-    pVM->hwaccm.s.vmx.pMemObjRealModeTSS = NIL_RTR0MEMOBJ;
 
 
@@ -154,20 +153,4 @@
     ASMMemZero32(pVM->hwaccm.s.vmx.pVMCS, PAGE_SIZE);
 
-    /* Allocate one page for the TSS we need for real mode emulation. */
-    rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.vmx.pMemObjRealModeTSS, 1 << PAGE_SHIFT, true /* executable R0 mapping */);
-    AssertRC(rc);
-    if (RT_FAILURE(rc))
-        return rc;
-
-    pVM->hwaccm.s.vmx.pRealModeTSS     = (PVBOXTSS)RTR0MemObjAddress(pVM->hwaccm.s.vmx.pMemObjRealModeTSS);
-    pVM->hwaccm.s.vmx.pRealModeTSSPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.vmx.pMemObjRealModeTSS, 0);
-
-    /* The I/O bitmap starts right after the virtual interrupt redirection bitmap. Outside the TSS on purpose; the CPU will not check it
-     * for I/O operations. */
-    ASMMemZero32(pVM->hwaccm.s.vmx.pRealModeTSS, PAGE_SIZE);
-    pVM->hwaccm.s.vmx.pRealModeTSS->offIoBitmap = sizeof(*pVM->hwaccm.s.vmx.pRealModeTSS);
-    /* Bit set to 0 means redirection enabled. */
-    memset(pVM->hwaccm.s.vmx.pRealModeTSS->IntRedirBitmap, 0x0, sizeof(pVM->hwaccm.s.vmx.pRealModeTSS->IntRedirBitmap));
-
     if (pVM->hwaccm.s.vmx.msr.vmx_proc_ctls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_USE_TPR_SHADOW)
     {
@@ -203,5 +186,5 @@
 
 #ifdef LOG_ENABLED
-    SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x) RealModeTSS=%x (%x)\n", pVM, pVM->hwaccm.s.vmx.pVMCS, (uint32_t)pVM->hwaccm.s.vmx.pVMCSPhys, pVM->hwaccm.s.vmx.pRealModeTSS, (uint32_t)pVM->hwaccm.s.vmx.pRealModeTSSPhys);
+    SUPR0Printf("VMXR0InitVM %x VMCS=%x (%x)\n", pVM, pVM->hwaccm.s.vmx.pVMCS, (uint32_t)pVM->hwaccm.s.vmx.pVMCSPhys);
 #endif
     return VINF_SUCCESS;
@@ -222,11 +205,4 @@
         pVM->hwaccm.s.vmx.pVMCS       = 0;
         pVM->hwaccm.s.vmx.pVMCSPhys   = 0;
-    }
-    if (pVM->hwaccm.s.vmx.pMemObjRealModeTSS != NIL_RTR0MEMOBJ)
-    {
-        RTR0MemObjFree(pVM->hwaccm.s.vmx.pMemObjRealModeTSS, false);
-        pVM->hwaccm.s.vmx.pMemObjRealModeTSS = NIL_RTR0MEMOBJ;
-        pVM->hwaccm.s.vmx.pRealModeTSS       = 0;
-        pVM->hwaccm.s.vmx.pRealModeTSSPhys   = 0;
     }
     if (pVM->hwaccm.s.vmx.pMemObjAPIC != NIL_RTR0MEMOBJ)
@@ -803,7 +779,13 @@
         if (!(pCtx->cr0 & X86_CR0_PROTECTION_ENABLE))
         {
+            RTGCPHYS GCPhys;
+
+            /* We convert it here every time as pci regions could be reconfigured. */
+            rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pRealModeTSS, &GCPhys);
+            AssertRC(rc);
+
             Assert(pCtx->tr == 0);
-            rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT,         sizeof(*pVM->hwaccm.s.vmx.pRealModeTSS));
-            rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE,          0);
+            rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_LIMIT,         sizeof(VBOXTSS));
+            rc |= VMXWriteVMCS(VMX_VMCS_GUEST_TR_BASE,          GCPhys /* phys = virt in this mode */);
 
             val = X86_DESC_P | X86_SEL_TYPE_SYS_386_TSS_BUSY;
