Index: trunk/src/VBox/VMM/testcase/Makefile.kmk
===================================================================
--- trunk/src/VBox/VMM/testcase/Makefile.kmk	(revision 36861)
+++ trunk/src/VBox/VMM/testcase/Makefile.kmk	(revision 36862)
@@ -44,5 +44,5 @@
   	tstVMMR0CallHost-1 \
   	tstVMMR0CallHost-2
-  ifn1of ($(KBUILD_TARGET).$(KBUILD_TARGET_ARCH), darwin.amd64 linux.amd64 solaris.x86 solaris.amd64 win.amd64 ) ## TODO: Fix the code.
+  ifn1of ($(KBUILD_TARGET).$(KBUILD_TARGET_ARCH), darwin.amd64 solaris.x86 solaris.amd64 win.amd64 ) ## TODO: Fix the code.
    PROGRAMS  +=  tstX86-1
   endif
Index: trunk/src/VBox/VMM/testcase/tstX86-1.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstX86-1.cpp	(revision 36861)
+++ trunk/src/VBox/VMM/testcase/tstX86-1.cpp	(revision 36862)
@@ -22,4 +22,7 @@
 #include <iprt/test.h>
 #include <iprt/param.h>
+#include <iprt/mem.h>
+#include <iprt/err.h>
+#include <iprt/assert.h>
 
 #ifdef RT_OS_WINDOWS
@@ -53,4 +56,5 @@
 RT_C_DECLS_BEGIN
 uint8_t *g_pbEfPage = NULL;
+uint8_t *g_pbEfExecPage = NULL;
 extern TRAPINFO g_aTrapInfo[];
 RT_C_DECLS_END
@@ -64,8 +68,15 @@
 
 
-static PCTRAPINFO findTrapInfo(uintptr_t uTrapPC)
+static PCTRAPINFO findTrapInfo(uintptr_t uTrapPC, uintptr_t uTrapSP)
 {
+    /* Search by trap program counter. */
     for (unsigned i = 0; g_aTrapInfo[i].uTrapPC; i++)
         if (g_aTrapInfo[i].uTrapPC == uTrapPC)
+            return &g_aTrapInfo[i];
+
+    /* Search by return address. */
+    uintptr_t uReturn = *(uintptr_t *)uTrapSP;
+    for (unsigned i = 0; g_aTrapInfo[i].uTrapPC; i++)
+        if (g_aTrapInfo[i].uTrapPC + g_aTrapInfo[i].cbInstr == uReturn)
             return &g_aTrapInfo[i];
 
@@ -77,21 +88,49 @@
 {
     ucontext_t *pCtx = (ucontext_t *)pvSigCtx;
+
 # if defined(RT_ARCH_AMD64) && defined(RT_OS_DARWIN)
-    uintptr_t  *puPC = (uintptr_t *)&pCtx->uc_mcontext->__ss.__rip;
+    uintptr_t  *puPC    = (uintptr_t *)&pCtx->uc_mcontext->__ss.__rip;
+    uintptr_t   uSP     = pCtx->uc_mcontext->__ss.__rsp;
+    uintptr_t   uTrapNo = ~(uintptr_t)0;
+    uintptr_t   uErr    = ~(uintptr_t)0;
+
 # elif defined(RT_ARCH_AMD64) && defined(RT_OS_FREEBSD)
-    uintptr_t  *puPC = (uintptr_t *)&pCtx->uc_mcontext.mc_rip;
+    uintptr_t  *puPC    = (uintptr_t *)&pCtx->uc_mcontext.mc_rip;
+    uintptr_t   uSP     = pCtx->uc_mcontext.mc_rsp;
+    uintptr_t   uTrapNo = ~(uintptr_t)0;
+    uintptr_t   uErr    = ~(uintptr_t)0;
+
 # elif defined(RT_ARCH_AMD64)
-    uintptr_t  *puPC = (uintptr_t *)&pCtx->uc_mcontext.gregs[REG_RIP];
+    uintptr_t  *puPC    = (uintptr_t *)&pCtx->uc_mcontext.gregs[REG_RIP];
+    uintptr_t   uSP     = pCtx->uc_mcontext.gregs[REG_RSP];
+    uintptr_t   uTrapNo = pCtx->uc_mcontext.gregs[REG_TRAPNO];
+    uintptr_t   uErr    = pCtx->uc_mcontext.gregs[REG_ERR];
+
 # elif defined(RT_ARCH_X86) && defined(RT_OS_DARWIN)
-    uintptr_t  *puPC = (uintptr_t *)&pCtx->uc_mcontext->__ss.__eip;
+    uintptr_t  *puPC    = (uintptr_t *)&pCtx->uc_mcontext->__ss.__eip;
+    uintptr_t   uSP     = pCtx->uc_mcontext->__ss.__esp;
+    uintptr_t   uTrapNo = ~(uintptr_t)0;
+    uintptr_t   uErr    = ~(uintptr_t)0;
+
 # elif defined(RT_ARCH_X86) && defined(RT_OS_FREEBSD)
-    uintptr_t  *puPC = (uintptr_t *)&pCtx->uc_mcontext.mc_eip;
+    uintptr_t  *puPC    = (uintptr_t *)&pCtx->uc_mcontext.mc_eip;
+    uintptr_t   uSP     = pCtx->uc_mcontext.mc_esp;
+    uintptr_t   uTrapNo = ~(uintptr_t)0;
+    uintptr_t   uErr    = ~(uintptr_t)0;
+
 # elif defined(RT_ARCH_X86)
-    uintptr_t  *puPC = (uintptr_t *)&pCtx->uc_mcontext.gregs[REG_EIP];
+    uintptr_t  *puPC    = (uintptr_t *)&pCtx->uc_mcontext.gregs[REG_EIP];
+    uintptr_t   uSP     = pCtx->uc_mcontext.gregs[REG_ESP];
+    uintptr_t   uTrapNo = pCtx->uc_mcontext.gregs[REG_TRAPNO];
+    uintptr_t   uErr    = pCtx->uc_mcontext.gregs[REG_ERR];
+
 # else
-    uintptr_t  *puPC = NULL;
+    uintptr_t  *puPC    = NULL;
+    uintptr_t   uTrapNo = ~(uintptr_t)0;
+    uintptr_t   uErr    = ~(uintptr_t)0;
 # endif
+    RTAssertMsg2("tstX86-1: Trap #%#04x err=%#06x at %p\n", uTrapNo, uErr, *puPC);
 
-    PCTRAPINFO  pTrapInfo = findTrapInfo(*puPC);
+    PCTRAPINFO  pTrapInfo = findTrapInfo(*puPC, uSP);
     if (pTrapInfo)
     {
@@ -117,9 +156,16 @@
     if (rcExit != RTEXITCODE_SUCCESS)
         return rcExit;
+    RTTestBanner(hTest);
+
     g_pbEfPage = (uint8_t *)RTTestGuardedAllocTail(hTest, PAGE_SIZE);
     RTTESTI_CHECK(g_pbEfPage != NULL);
 
+    g_pbEfExecPage = (uint8_t *)RTMemExecAlloc(PAGE_SIZE*2);
+    RTTESTI_CHECK(g_pbEfExecPage != NULL);
+    RTTESTI_CHECK(!((uintptr_t)g_pbEfExecPage & PAGE_OFFSET_MASK));
+    RTTESTI_CHECK_RC(RTMemProtect(g_pbEfExecPage + PAGE_SIZE, PAGE_SIZE, RTMEM_PROT_NONE), VINF_SUCCESS);
+
 #ifdef USE_SIGNAL
-    static int const s_aiSigs[] = { SIGBUS, SIGSEGV, SIGFPE };
+    static int const s_aiSigs[] = { SIGBUS, SIGSEGV, SIGFPE, SIGILL };
     for (unsigned i = 0; i < RT_ELEMENTS(s_aiSigs); i++)
     {
Index: trunk/src/VBox/VMM/testcase/tstX86-1A.asm
===================================================================
--- trunk/src/VBox/VMM/testcase/tstX86-1A.asm	(revision 36861)
+++ trunk/src/VBox/VMM/testcase/tstX86-1A.asm	(revision 36862)
@@ -38,4 +38,5 @@
 BEGINDATA
 extern NAME(g_pbEfPage)
+extern NAME(g_pbEfExecPage)
 
 g_szAlpha:
@@ -53,6 +54,14 @@
 ;   Defined Constants And Macros                                              ;
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+%define X86_XCPT_UD 6
 %define X86_XCPT_GP 13
 %define X86_XCPT_PF 14
+
+;; Reference a global variable
+%ifdef RT_ARCH_AMD64
+ %define REF_GLOBAL(a_Name)     [NAME(a_Name) wrt rip]
+%else
+ %define REF_GLOBAL(a_Name)     [NAME(a_Name)]
+%endif
 
 ;;
@@ -62,18 +71,18 @@
 ; @param        2+      The instruction which should trap.
 %macro ShouldTrap 2+
-..trap:
+%%trap:
         %2
-..trap_end:
+%%trap_end:
         mov     eax, __LINE__
         jmp     .failed
 BEGINDATA
-..trapinfo: istruc TRAPINFO
-        at TRAPINFO.uTrapPC,    RTCCPTR_DEF     ..trap
-        at TRAPINFO.uResumePC,  RTCCPTR_DEF     ..resume
+%%trapinfo: istruc TRAPINFO
+        at TRAPINFO.uTrapPC,    RTCCPTR_DEF     %%trap
+        at TRAPINFO.uResumePC,  RTCCPTR_DEF     %%resume
         at TRAPINFO.u8TrapNo,   db              %1
-        at TRAPINFO.cbInstr,    db              (..trap_end - ..trap)
+        at TRAPINFO.cbInstr,    db              (%%trap_end - %%trap)
 iend
 BEGINCODE
-..resume:
+%%resume:
 %endmacro
 
@@ -300,5 +309,5 @@
         ; Loading is always a word access.
         mov     eax, __LINE__
-        mov     xDI, [NAME(g_pbEfPage)]
+        mov     xDI, REF_GLOBAL(g_pbEfPage)
         lea     xDI, [xDI + 0x1000 - 2]
         mov     xDX, es
@@ -308,5 +317,5 @@
         ; Saving is always a word access.
         mov     eax, __LINE__
-        mov     xDI, [NAME(g_pbEfPage)]
+        mov     xDI, REF_GLOBAL(g_pbEfPage)
         mov     dword [xDI + 0x1000 - 4], -1
         mov     [xDI + 0x1000 - 2], ss ; Should not crash.
@@ -320,5 +329,5 @@
         call    x861_ClearRegisters
         mov     eax, __LINE__
-        mov     xDI, [NAME(g_pbEfPage)]
+        mov     xDI, REF_GLOBAL(g_pbEfPage)
         mov     dword [xDI + 0x1000 - 4], -1
         db 04ah
@@ -384,10 +393,10 @@
         mov     dx, ds
         mov     es, dx
-        mov     xDI, [NAME(g_pbEfPage)]
+        mov     xDI, REF_GLOBAL(g_pbEfPage)
         xor     eax, eax
         mov     ecx, 01000h
         rep stosb
 
-        mov     xDI, [NAME(g_pbEfPage)]
+        mov     xDI, REF_GLOBAL(g_pbEfPage)
         mov     ecx, 4
         mov     eax, 0ffh
@@ -398,5 +407,5 @@
         jne     .failed
         mov     eax, __LINE__
-        mov     xDI, [NAME(g_pbEfPage)]
+        mov     xDI, REF_GLOBAL(g_pbEfPage)
         cmp     dword [xDI], 0ffffffffh
         jne     .failed
@@ -404,5 +413,5 @@
         jne     .failed
 
-        mov     xDI, [NAME(g_pbEfPage)]
+        mov     xDI, REF_GLOBAL(g_pbEfPage)
         mov     ecx, 4
         mov     eax, 0feh
@@ -413,5 +422,5 @@
         jne     .failed
         mov     eax, __LINE__
-        mov     xDI, [NAME(g_pbEfPage)]
+        mov     xDI, REF_GLOBAL(g_pbEfPage)
         cmp     dword [xDI], 0fefefefeh
         jne     .failed
@@ -426,5 +435,5 @@
         mov     dx, ds
         mov     es, dx
-        mov     xDI, [NAME(g_pbEfPage)]
+        mov     xDI, REF_GLOBAL(g_pbEfPage)
         xor     xCX, xCX
         rep stosb                       ; no trap
@@ -452,4 +461,26 @@
         jz      .failed
 
+        ;
+        ; Will the CPU decode the whole r/m+sib stuff before signalling a lock
+        ; prefix error?  Use the EF exec page and a LOCK ADD CL,[rDI + disp32]
+        ; instruction at the very end of it.
+        ;
+        mov     eax, __LINE__
+        mov     xDI, REF_GLOBAL(g_pbEfExecPage)
+        add     xDI, 1000h - 4h
+        mov     byte [xDI+0], 0f0h
+        mov     byte [xDI+1], 002h
+        mov     byte [xDI+2], 08Fh
+        mov     byte [xDI+3], 000h
+        ShouldTrap X86_XCPT_PF, call xDI
+
+        mov     eax, __LINE__
+        mov     xDI, REF_GLOBAL(g_pbEfExecPage)
+        add     xDI, 1000h - 7h
+        mov     byte [xDI+0], 0f0h
+        mov     byte [xDI+1], 002h
+        mov     byte [xDI+2], 08Fh
+        mov     dword [xDI+3], 000000000h
+        ShouldTrap X86_XCPT_UD, call xDI
 
 
