Index: trunk/src/VBox/VMM/PATM/PATM.cpp
===================================================================
--- trunk/src/VBox/VMM/PATM/PATM.cpp	(revision 2042)
+++ trunk/src/VBox/VMM/PATM/PATM.cpp	(revision 2043)
@@ -1662,5 +1662,19 @@
                 Log(("Force recompilation of next instruction for OP_MOV at %VGv\n", pCurInstrGC));
                 pPatch->flags |= PATMFL_RECOMPILE_NEXT;
-            }
+                /** @todo this could cause a fault (ring 0 selector being loaded in ring 1) */
+            }
+#if 0
+            else
+            if (    (pCpu->param2.flags & USE_REG_SEG)
+                &&  (pCpu->param2.base.reg_seg == USE_REG_SS)
+                &&  (pCpu->param1.flags & (USE_REG_GEN32|USE_REG_GEN16)))     /** @todo memory operand must in theory be handled too */
+            {
+                /* mov GPR, ss */
+                rc = patmPatchGenMovFromSS(pVM, pPatch, pCpu);
+                if (VBOX_SUCCESS(rc))
+                    rc = VWRN_CONTINUE_RECOMPILE;
+                break;
+            }
+#endif
         }
         goto duplicate_instr;
Index: trunk/src/VBox/VMM/PATM/PATMA.asm
===================================================================
--- trunk/src/VBox/VMM/PATM/PATMA.asm	(revision 2042)
+++ trunk/src/VBox/VMM/PATM/PATMA.asm	(revision 2043)
@@ -2533,4 +2533,36 @@
     DD      0ffffffffh
 
+
+; push ss, check and correct RPL
+BEGINPROC PATMMovFromSS
+PATMMovFromSS_Start:
+    push    ss
+    push    eax
+    pushfd
+    mov     ax, ss
+    and     ax, 3
+    cmp     ax, 1
+    jne     near PATMMovFromSS_Continue
+
+    and     dword [esp+8], ~3     ; clear RPL 1
+PATMMovFromSS_Continue:
+    popfd
+    pop     eax
+    add     esp, 2          ; ss popped off as 16 bits value
+PATMMovFromSS_Start_End:
+ENDPROC PATMMovFromSS
+
+GLOBALNAME PATMMovFromSSRecord
+    RTCCPTR_DEF PATMMovFromSS_Start
+    DD      0
+    DD      0
+    DD      PATMMovFromSS_Start_End - PATMMovFromSS_Start
+    DD      0
+    DD      0
+    DD      0ffffffffh
+
+
+
+
 ; For assertion during init (to make absolutely sure the flags are in sync in vm.mac & vm.h)
 GLOBALNAME PATMInterruptFlag
Index: trunk/src/VBox/VMM/PATM/PATMA.h
===================================================================
--- trunk/src/VBox/VMM/PATM/PATMA.h	(revision 2042)
+++ trunk/src/VBox/VMM/PATM/PATMA.h	(revision 2043)
@@ -184,4 +184,6 @@
 extern PATCHASMRECORD PATMClearInhibitIRQContIF0Record;
 
+extern PATCHASMRECORD PATMMovFromSSRecord;
+
 extern uint32_t       PATMInterruptFlag;
 #ifdef __cplusplus
Index: trunk/src/VBox/VMM/PATM/PATMPatch.cpp
===================================================================
--- trunk/src/VBox/VMM/PATM/PATMPatch.cpp	(revision 2042)
+++ trunk/src/VBox/VMM/PATM/PATMPatch.cpp	(revision 2043)
@@ -1278,4 +1278,36 @@
 }
 
+/*
+ * mov GPR, SS
+ */
+int patmPatchGenMovFromSS(PVM pVM, PPATCHINFO pPatch, DISCPUSTATE *pCpu)
+{
+    uint32_t size, offset;
+
+    PATCHGEN_PROLOG(pVM, pPatch);
+    size = patmPatchGenCode(pVM, pPatch, pPB, &PATMSetPIFRecord, 0, false);
+    PATCHGEN_EPILOG(pPatch, size);
+
+    /* pushes ss, checks and corrects RPL */
+    PATCHGEN_PROLOG_NODEF(pVM, pPatch);
+    size = patmPatchGenCode(pVM, pPatch, pPB, &PATMMovFromSSRecord, 0, false);
+    PATCHGEN_EPILOG(pPatch, size);
+
+    /* pop general purpose register */
+    PATCHGEN_PROLOG_NODEF(pVM, pPatch);
+    offset = 0;
+    if (pPatch->flags & PATMFL_CODE32)
+        pPB[offset++] = 0x66; /* size override -> 16 bits pop */
+    pPB[offset++] = 0x50 + pCpu->param1.base.reg_gen32;
+    PATCHGEN_EPILOG(pPatch, offset);
+
+
+    PATCHGEN_PROLOG_NODEF(pVM, pPatch);
+    size = patmPatchGenCode(pVM, pPatch, pPB, &PATMClearPIFRecord, 0, false);
+    PATCHGEN_EPILOG(pPatch, size);
+
+    return VINF_SUCCESS;
+}
+
 
 /**
Index: trunk/src/VBox/VMM/PATM/PATMPatch.h
===================================================================
--- trunk/src/VBox/VMM/PATM/PATMPatch.h	(revision 2042)
+++ trunk/src/VBox/VMM/PATM/PATMPatch.h	(revision 2043)
@@ -30,4 +30,5 @@
 int patmPatchGenMovControl(PVM pVM, PPATCHINFO pPatch, DISCPUSTATE *pCpu);
 int patmPatchGenMovDebug(PVM pVM, PPATCHINFO pPatch, DISCPUSTATE *pCpu);
+int patmPatchGenMovFromSS(PVM pVM, PPATCHINFO pPatch, DISCPUSTATE *pCpu);
 int patmPatchGenRelJump(PVM pVM, PPATCHINFO pPatch, GCPTRTYPE(uint8_t *)pTargetGC, uint32_t opcode, bool fSizeOverride);
 int patmPatchGenLoop(PVM pVM, PPATCHINFO pPatch, GCPTRTYPE(uint8_t *)pTargetGC, uint32_t opcode, bool fSizeOverride);
