Index: trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm	(revision 103908)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllAImpl.asm	(revision 103909)
@@ -5901,109 +5901,4 @@
 
 ;;
-; pextrw instruction.
-;
-; @param    A0      Pointer to the 16bit output operand (output).
-; @param    A1      Pointer to the media register size operand (input).
-; @param    A2      The 8-bit immediate
-;
-BEGINPROC_FASTCALL iemAImpl_pextrw_u64, 16
-        PROLOGUE_3_ARGS
-        IEMIMPL_SSE_PROLOGUE
-
-        movzx   A2, A2_8                ; must clear top bits
-        movq    mm0,  A1
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*8]         ; sizeof(endbrxx+pextrw+ret) == 9: A2 * 9
- %else
-        lea     T0, [A2 + A2*4]         ; sizeof(pextrw+ret)         == 5: A2 * 5
- %endif
-        lea     T1, [T1 + T0]
-        IBT_NOTRACK
-        call    T1
-        mov     word [A0], T0_16
-
-        IEMIMPL_SSE_EPILOGUE
-        EPILOGUE_3_ARGS
- %assign bImm 0
- %rep 256
-.imm %+ bImm:
-        IBT_ENDBRxx_WITHOUT_NOTRACK
-        pextrw  T0_32, mm0, bImm
-        ret
-  %assign bImm bImm + 1
- %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x500
-ENDPROC iemAImpl_pextrw_u64
-
-BEGINPROC_FASTCALL iemAImpl_pextrw_u128, 16
-        PROLOGUE_3_ARGS
-        IEMIMPL_SSE_PROLOGUE
-
-        movzx   A2, A2_8                ; must clear top bits
-        movdqu  xmm0, [A1]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*4]         ; sizeof(endbrxx+pextrw+ret) == 10: A2 * 10 = (A2 * 5) * 2
- %else
-        lea     T0, [A2 + A2*2]         ; sizeof(pextrw+ret)         ==  6: A2 *  6 = (A2 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
-        mov     word [A0], T0_16
-
-        IEMIMPL_SSE_EPILOGUE
-        EPILOGUE_3_ARGS
- %assign bImm 0
- %rep 256
-.imm %+ bImm:
-        IBT_ENDBRxx_WITHOUT_NOTRACK
-        pextrw  T0_32, xmm0, bImm
-        ret
-  %assign bImm bImm + 1
- %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
-ENDPROC iemAImpl_pextrw_u128
-
-;;
-; vpextrw instruction.
-;
-; @param    A0      Pointer to the 16bit output operand (output).
-; @param    A1      Pointer to the source media register size operand (input).
-; @param    A2      The 8-bit immediate
-;
-BEGINPROC_FASTCALL iemAImpl_vpextrw_u128, 16
-        PROLOGUE_3_ARGS
-        IEMIMPL_SSE_PROLOGUE
-
-        movzx   A2, A2_8                ; must clear top bits
-        movdqu  xmm0, [A1]
-        lea     T1, [.imm0 xWrtRIP]
- %ifdef RT_WITH_IBT_BRANCH_PROTECTION_WITHOUT_NOTRACK
-        lea     T0, [A2 + A2*4]         ; sizeof(endbrxx+vpextrw+ret) == 10: A2 * 10 = (A2 * 5) * 2
- %else
-        lea     T0, [A2 + A2*2]         ; sizeof(vpextrw+ret)         ==  6: A2 *  6 = (A2 * 3) * 2
- %endif
-        lea     T1, [T1 + T0*2]
-        IBT_NOTRACK
-        call    T1
-        mov     word [A0], T0_16
-
-        IEMIMPL_SSE_EPILOGUE
-        EPILOGUE_3_ARGS
- %assign bImm 0
- %rep 256
-.imm %+ bImm:
-        IBT_ENDBRxx_WITHOUT_NOTRACK
-        vpextrw T0_32, xmm0, bImm
-        ret
-  %assign bImm bImm + 1
- %endrep
-.immEnd: IEMCHECK_256_JUMP_ARRAY_SIZE (.immEnd - .imm0), 0x600
-ENDPROC iemAImpl_vpextrw_u128
-
-
-;;
 ; movmskp{s,d} SSE instruction template
 ;
Index: trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp	(revision 103908)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllAImplC.cpp	(revision 103909)
@@ -18291,27 +18291,4 @@
 
 /**
- * [V]PEXTRW
- */
-#ifdef IEM_WITHOUT_ASSEMBLY
-IEM_DECL_IMPL_DEF(void, iemAImpl_pextrw_u64,(uint16_t *pu16Dst, uint64_t u64Src, uint8_t bEvil))
-{
-    *pu16Dst = (uint16_t)(u64Src >> ((bEvil & 0x3) * 16));
-}
-
-
-IEM_DECL_IMPL_DEF(void, iemAImpl_pextrw_u128,(uint16_t *pu16Dst, PCRTUINT128U puSrc, uint8_t bEvil))
-{
-    *pu16Dst = puSrc->au16[bEvil & 0x7];
-}
-
-#endif
-
-IEM_DECL_IMPL_DEF(void, iemAImpl_vpextrw_u128_fallback,(uint16_t *pu16Dst, PCRTUINT128U puSrc, uint8_t bEvil))
-{
-    *pu16Dst = puSrc->au16[bEvil & 0x7];
-}
-
-
-/**
  * [V]MOVMSKPS
  */
Index: trunk/src/VBox/VMM/VMMAll/IEMAllInstPython.py
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllInstPython.py	(revision 103908)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllInstPython.py	(revision 103909)
@@ -3096,4 +3096,5 @@
     'IEM_MC_FETCH_MEM16_U8':                                     (McBlock.parseMcGeneric,           True,  True,  False, ),
     'IEM_MC_FETCH_MEM32_U8':                                     (McBlock.parseMcGeneric,           True,  True,  False, ),
+    'IEM_MC_FETCH_MREG_U16':                                     (McBlock.parseMcGeneric,           False, False, False, ),
     'IEM_MC_FETCH_MREG_U32':                                     (McBlock.parseMcGeneric,           False, False, False, ),
     'IEM_MC_FETCH_MREG_U64':                                     (McBlock.parseMcGeneric,           False, False, False, ),
Index: trunk/src/VBox/VMM/VMMAll/IEMAllInstTwoByte0f.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllInstTwoByte0f.cpp.h	(revision 103908)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllInstTwoByte0f.cpp.h	(revision 103909)
@@ -7505,5 +7505,5 @@
             IEM_MC_FPU_TO_MMX_MODE();
 
-            IEM_MC_FETCH_MREG_U32(u32Tmp, IEM_GET_MODRM_REG_8(bRm));
+            IEM_MC_FETCH_MREG_U32(u32Tmp, IEM_GET_MODRM_REG_8(bRm), 0);
             IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_RM(pVCpu, bRm), u32Tmp);
 
@@ -7523,5 +7523,5 @@
             IEM_MC_ACTUALIZE_FPU_STATE_FOR_CHANGE();
 
-            IEM_MC_FETCH_MREG_U32(u32Tmp, IEM_GET_MODRM_REG_8(bRm));
+            IEM_MC_FETCH_MREG_U32(u32Tmp, IEM_GET_MODRM_REG_8(bRm), 0);
             IEM_MC_STORE_MEM_U32(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, u32Tmp);
             IEM_MC_FPU_TO_MMX_MODE();
@@ -12548,17 +12548,13 @@
          * Greg32, MMX, imm8.
          */
-        IEM_MC_BEGIN(3, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
+        IEM_MC_BEGIN(0, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
         uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
         IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX_EX_2_OR(fSse, fAmdMmxExts);
-        IEM_MC_LOCAL(uint16_t,              u16Dst);
-        IEM_MC_ARG_LOCAL_REF(uint16_t *,    pu16Dst,  u16Dst,      0);
-        IEM_MC_ARG(uint64_t,                u64Src,                1);
-        IEM_MC_ARG_CONST(uint8_t,           bImmArg, /*=*/ bImm,   2);
+        IEM_MC_LOCAL(uint16_t,  uValue);
         IEM_MC_MAYBE_RAISE_MMX_RELATED_XCPT();
         IEM_MC_PREPARE_FPU_USAGE();
         IEM_MC_FPU_TO_MMX_MODE();
-        IEM_MC_FETCH_MREG_U64(u64Src, IEM_GET_MODRM_RM_8(bRm));
-        IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_pextrw_u64, pu16Dst, u64Src, bImmArg);
-        IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_REG(pVCpu, bRm), u16Dst);
+        IEM_MC_FETCH_MREG_U16(uValue, IEM_GET_MODRM_RM_8(bRm), bImm & 3);
+        IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_REG(pVCpu, bRm), uValue);
         IEM_MC_ADVANCE_RIP_AND_FINISH();
         IEM_MC_END();
@@ -12580,16 +12576,12 @@
          * Greg32, XMM, imm8.
          */
-        IEM_MC_BEGIN(3, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
+        IEM_MC_BEGIN(0, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
         uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
         IEMOP_HLP_DONE_DECODING_NO_LOCK_PREFIX_EX(fSse2);
-        IEM_MC_LOCAL(uint16_t,              u16Dst);
-        IEM_MC_ARG_LOCAL_REF(uint16_t *,    pu16Dst,  u16Dst,      0);
-        IEM_MC_ARG(PCRTUINT128U,            puSrc,                 1);
-        IEM_MC_ARG_CONST(uint8_t,           bImmArg, /*=*/ bImm,   2);
+        IEM_MC_LOCAL(uint16_t,  uValue);
         IEM_MC_MAYBE_RAISE_SSE_RELATED_XCPT();
         IEM_MC_PREPARE_SSE_USAGE();
-        IEM_MC_REF_XREG_U128_CONST(puSrc, IEM_GET_MODRM_RM(pVCpu, bRm));
-        IEM_MC_CALL_VOID_AIMPL_3(iemAImpl_pextrw_u128, pu16Dst, puSrc, bImmArg);
-        IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_REG(pVCpu, bRm), u16Dst);
+        IEM_MC_FETCH_XREG_U16(uValue, IEM_GET_MODRM_RM(pVCpu, bRm), bImm & 7);
+        IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_REG(pVCpu, bRm), uValue);
         IEM_MC_ADVANCE_RIP_AND_FINISH();
         IEM_MC_END();
Index: trunk/src/VBox/VMM/VMMAll/IEMAllInstVexMap1.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllInstVexMap1.cpp.h	(revision 103908)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllInstVexMap1.cpp.h	(revision 103909)
@@ -4644,5 +4644,5 @@
 /*  Opcode VEX.F2.0F 0xc4 - invalid */
 
-/*  Opcode VEX.0F 0xc5 - invlid */
+/*  Opcode VEX.0F 0xc5 - invalid */
 
 
@@ -4655,19 +4655,14 @@
     {
         /*
-         * Register, register.
+         * greg32, XMM, imm8.
          */
         uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
-        IEM_MC_BEGIN(3, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
+        IEM_MC_BEGIN(0, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
         IEMOP_HLP_DONE_VEX_DECODING_L0_EX(fAvx);
-        IEM_MC_LOCAL(uint16_t,              u16Dst);
-        IEM_MC_ARG_LOCAL_REF(uint16_t *,    pu16Dst,  u16Dst,      0);
-        IEM_MC_ARG(PCRTUINT128U,            puSrc,                 1);
-        IEM_MC_ARG_CONST(uint8_t,           bImmArg, /*=*/ bImm, 2);
+        IEM_MC_LOCAL(uint16_t,  uValue);
         IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
         IEM_MC_PREPARE_AVX_USAGE();
-        IEM_MC_REF_XREG_U128_CONST(puSrc,  IEM_GET_MODRM_RM(pVCpu, bRm));
-        IEM_MC_CALL_VOID_AIMPL_3(IEM_SELECT_HOST_OR_FALLBACK(fAvx, iemAImpl_vpextrw_u128, iemAImpl_vpextrw_u128_fallback),
-                                 pu16Dst, puSrc, bImmArg);
-        IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_REG(pVCpu, bRm), u16Dst);
+        IEM_MC_FETCH_XREG_U16(uValue, IEM_GET_MODRM_RM(pVCpu, bRm), bImm & 7);
+        IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_REG(pVCpu, bRm), uValue);
         IEM_MC_ADVANCE_RIP_AND_FINISH();
         IEM_MC_END();
Index: trunk/src/VBox/VMM/VMMAll/IEMAllInstVexMap3.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllInstVexMap3.cpp.h	(revision 103908)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllInstVexMap3.cpp.h	(revision 103909)
@@ -537,6 +537,50 @@
 /*  Opcode VEX.66.0F3A 0x12 - invalid */
 /*  Opcode VEX.66.0F3A 0x13 - invalid */
-/** Opcode VEX.66.0F3A 0x14. */
-FNIEMOP_STUB(iemOp_vpextrb_RdMb_Vdq_Ib);
+
+
+/** Opcode VEX.66.0F3A 0x14 - vpextrb Eb, Vdq, Ib */
+FNIEMOP_DEF(iemOp_vpextrb_Eb_Vdq_Ib)
+{
+    IEMOP_MNEMONIC3(VEX_MRI, VPEXTRB, vpextrb, Eb, Vdq, Ib, DISOPTYPE_HARMLESS, IEMOPHINT_VEX_L_ZERO | IEMOPHINT_VEX_V_ZERO); /** @todo */
+    uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
+    if (IEM_IS_MODRM_REG_MODE(bRm))
+    {
+        /*
+         * greg32, XMM, imm8.
+         */
+        uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
+        IEM_MC_BEGIN(0, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
+        IEM_MC_LOCAL(uint8_t,   uValue);
+
+        IEMOP_HLP_DONE_VEX_DECODING_L0_AND_NO_VVVV_EX(fAvx);
+        IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
+        IEM_MC_PREPARE_AVX_USAGE();
+
+        IEM_MC_FETCH_XREG_U8(uValue, IEM_GET_MODRM_REG(pVCpu, bRm), bImm & 15 /*a_iByte*/);
+        IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_RM(pVCpu, bRm), uValue);
+        IEM_MC_ADVANCE_RIP_AND_FINISH();
+        IEM_MC_END();
+    }
+    else
+    {
+        /*
+         * [mem8], XMM, imm8.
+         */
+        uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
+        IEM_MC_BEGIN(0, 2, IEM_MC_F_NOT_286_OR_OLDER, 0);
+        IEM_MC_LOCAL(uint8_t,   uValue);
+        IEM_MC_LOCAL(RTGCPTR,   GCPtrEffSrc);
+        IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
+
+        IEMOP_HLP_DONE_VEX_DECODING_L0_AND_NO_VVVV_EX(fAvx);
+        IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
+        IEM_MC_PREPARE_AVX_USAGE();
+
+        IEM_MC_FETCH_XREG_U8(uValue, IEM_GET_MODRM_REG(pVCpu, bRm), bImm & 15 /*a_iByte*/);
+        IEM_MC_STORE_MEM_U8(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uValue);
+        IEM_MC_ADVANCE_RIP_AND_FINISH();
+        IEM_MC_END();
+    }
+}
 
 
@@ -549,19 +593,16 @@
     {
         /*
-         * Register, register.
+         * greg32, XMM, imm8.
          */
         uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
-        IEM_MC_BEGIN(3, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
+        IEM_MC_BEGIN(0, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
+        IEM_MC_LOCAL(uint16_t,  uValue);
+
         IEMOP_HLP_DONE_VEX_DECODING_L0_AND_NO_VVVV_EX(fAvx);
         IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
         IEM_MC_PREPARE_AVX_USAGE();
-        IEM_MC_LOCAL(uint16_t,              u16Dst);
-        IEM_MC_ARG_LOCAL_REF(uint16_t *,    pu16Dst,  u16Dst,      0);
-        IEM_MC_ARG(PCRTUINT128U,            puSrc,                 1);
-        IEM_MC_REF_XREG_U128_CONST(puSrc,  IEM_GET_MODRM_REG(pVCpu, bRm));
-        IEM_MC_ARG_CONST(uint8_t,           bImmArg, /*=*/ bImm, 2);
-        IEM_MC_CALL_VOID_AIMPL_3(IEM_SELECT_HOST_OR_FALLBACK(fAvx, iemAImpl_vpextrw_u128, iemAImpl_vpextrw_u128_fallback),
-                                 pu16Dst, puSrc, bImmArg);
-        IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_RM(pVCpu, bRm), u16Dst);
+
+        IEM_MC_FETCH_XREG_U16(uValue, IEM_GET_MODRM_REG(pVCpu, bRm), bImm & 7);
+        IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_RM(pVCpu, bRm), uValue);
         IEM_MC_ADVANCE_RIP_AND_FINISH();
         IEM_MC_END();
@@ -570,9 +611,10 @@
     {
         /*
-         * Memory, register.
+         * [mem16], XMM, imm8.
          */
         uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
-        IEM_MC_BEGIN(3, 2, IEM_MC_F_NOT_286_OR_OLDER, 0);
-        IEM_MC_LOCAL(RTGCPTR,               GCPtrEffSrc);
+        IEM_MC_BEGIN(0, 2, IEM_MC_F_NOT_286_OR_OLDER, 0);
+        IEM_MC_LOCAL(uint16_t,  uValue);
+        IEM_MC_LOCAL(RTGCPTR,   GCPtrEffSrc);
         IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
 
@@ -581,12 +623,6 @@
         IEM_MC_PREPARE_AVX_USAGE();
 
-        IEM_MC_LOCAL(uint16_t,              u16Dst);
-        IEM_MC_ARG_LOCAL_REF(uint16_t *,    pu16Dst,  u16Dst,       0);
-        IEM_MC_ARG(PCRTUINT128U,            puSrc,                  1);
-        IEM_MC_REF_XREG_U128_CONST(puSrc,  IEM_GET_MODRM_REG(pVCpu, bRm));
-        IEM_MC_ARG_CONST(uint8_t,           bImmArg, /*=*/ bImm,    2);
-        IEM_MC_CALL_VOID_AIMPL_3(IEM_SELECT_HOST_OR_FALLBACK(fAvx, iemAImpl_vpextrw_u128, iemAImpl_vpextrw_u128_fallback),
-                                 pu16Dst, puSrc, bImmArg);
-        IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, u16Dst);
+        IEM_MC_FETCH_XREG_U16(uValue, IEM_GET_MODRM_REG(pVCpu, bRm), bImm & 7);
+        IEM_MC_STORE_MEM_U16(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uValue);
         IEM_MC_ADVANCE_RIP_AND_FINISH();
         IEM_MC_END();
@@ -595,6 +631,98 @@
 
 
-/** Opcode VEX.66.0F3A 0x16. */
-FNIEMOP_STUB(iemOp_vpextrd_q_RdMw_Vdq_Ib);
+/** Opcode VEX.66.0F3A 0x16 - vpextrd / vpextrq Eq / Ey, Vdq, Ib */
+FNIEMOP_DEF(iemOp_vpextrd_q_Ey_Vdq_Ib)
+{
+    uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
+    if (pVCpu->iem.s.fPrefixes & IEM_OP_PRF_SIZE_REX_W)
+    {
+        IEMOP_MNEMONIC3(VEX_MRI, VPEXTRQ, vpextrq, Eq_WO, Vdq, Ib, DISOPTYPE_HARMLESS, IEMOPHINT_IGNORES_OP_SIZES | IEMOPHINT_VEX_L_ZERO); /** @todo */
+        if (IEM_IS_MODRM_REG_MODE(bRm))
+        {
+            /*
+             * greg64, XMM, imm8.
+             */
+            uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
+            IEM_MC_BEGIN(0, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
+            IEM_MC_LOCAL(uint64_t,  uValue);
+
+            IEMOP_HLP_DONE_VEX_DECODING_L0_AND_NO_VVVV_EX(fAvx);
+            IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
+            IEM_MC_PREPARE_AVX_USAGE();
+
+            IEM_MC_FETCH_XREG_U64(uValue, IEM_GET_MODRM_REG(pVCpu, bRm), bImm & 1);
+            IEM_MC_STORE_GREG_U64(IEM_GET_MODRM_RM(pVCpu, bRm), uValue);
+            IEM_MC_ADVANCE_RIP_AND_FINISH();
+            IEM_MC_END();
+        }
+        else
+        {
+            /*
+             * [mem64], XMM, imm8.
+             */
+            uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
+            IEM_MC_BEGIN(0, 2, IEM_MC_F_NOT_286_OR_OLDER, 0);
+            IEM_MC_LOCAL(uint64_t,  uValue);
+            IEM_MC_LOCAL(RTGCPTR,   GCPtrEffSrc);
+            IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 1);
+
+            IEMOP_HLP_DONE_VEX_DECODING_L0_AND_NO_VVVV_EX(fAvx);
+            IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
+            IEM_MC_PREPARE_AVX_USAGE();
+
+            IEM_MC_FETCH_XREG_U64(uValue, IEM_GET_MODRM_REG(pVCpu, bRm), bImm & 1);
+            IEM_MC_STORE_MEM_U64(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uValue);
+            IEM_MC_ADVANCE_RIP_AND_FINISH();
+            IEM_MC_END();
+        }
+    }
+    else
+    {
+        /**
+         * @opdone
+         */
+        IEMOP_MNEMONIC3(VEX_MRI, VPEXTRD, vpextrd, Ey, Vdq, Ib, DISOPTYPE_HARMLESS, IEMOPHINT_IGNORES_OP_SIZES | IEMOPHINT_VEX_L_ZERO); /** @todo */
+        if (IEM_IS_MODRM_REG_MODE(bRm))
+        {
+            /*
+             * greg32, XMM, imm8.
+             */
+            uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
+            IEM_MC_BEGIN(0, 1, IEM_MC_F_NOT_286_OR_OLDER, 0);
+            IEM_MC_LOCAL(uint32_t,  uValue);
+
+            IEMOP_HLP_DONE_VEX_DECODING_L0_AND_NO_VVVV_EX(fAvx);
+            IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
+            IEM_MC_PREPARE_AVX_USAGE();
+
+            IEM_MC_FETCH_XREG_U32(uValue, IEM_GET_MODRM_REG(pVCpu, bRm), bImm & 3);
+            IEM_MC_STORE_GREG_U32(IEM_GET_MODRM_RM(pVCpu, bRm), uValue);
+            IEM_MC_ADVANCE_RIP_AND_FINISH();
+            IEM_MC_END();
+        }
+        else
+        {
+            /*
+             * [mem32], XMM, imm8.
+             */
+            uint8_t bImm; IEM_OPCODE_GET_NEXT_U8(&bImm);
+            IEM_MC_BEGIN(0, 2, IEM_MC_F_NOT_286_OR_OLDER, 0);
+            IEM_MC_LOCAL(uint32_t,  uValue);
+            IEM_MC_LOCAL(RTGCPTR,   GCPtrEffSrc);
+            IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 1);
+
+            IEMOP_HLP_DONE_VEX_DECODING_L0_AND_NO_VVVV_EX(fAvx);
+            IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
+            IEM_MC_PREPARE_AVX_USAGE();
+
+            IEM_MC_FETCH_XREG_U32(uValue, IEM_GET_MODRM_REG(pVCpu, bRm), bImm & 3);
+            IEM_MC_STORE_MEM_U32(pVCpu->iem.s.iEffSeg, GCPtrEffSrc, uValue);
+            IEM_MC_ADVANCE_RIP_AND_FINISH();
+            IEM_MC_END();
+        }
+    }
+}
+
+
 /** Opcode VEX.66.0F3A 0x17. */
 FNIEMOP_STUB(iemOp_vextractps_Ed_Vdq_Ib);
@@ -1417,7 +1545,7 @@
     /* 0x12 */  IEMOP_X4(iemOp_InvalidNeedRMImm8),
     /* 0x13 */  IEMOP_X4(iemOp_InvalidNeedRMImm8),
-    /* 0x14 */  iemOp_InvalidNeedRMImm8,    iemOp_vpextrb_RdMb_Vdq_Ib,  iemOp_InvalidNeedRMImm8,    iemOp_InvalidNeedRMImm8,
+    /* 0x14 */  iemOp_InvalidNeedRMImm8,    iemOp_vpextrb_Eb_Vdq_Ib,    iemOp_InvalidNeedRMImm8,    iemOp_InvalidNeedRMImm8,
     /* 0x15 */  iemOp_InvalidNeedRMImm8,    iemOp_vpextrw_Ew_Vdq_Ib,    iemOp_InvalidNeedRMImm8,    iemOp_InvalidNeedRMImm8,
-    /* 0x16 */  iemOp_InvalidNeedRMImm8,    iemOp_vpextrd_q_RdMw_Vdq_Ib, iemOp_InvalidNeedRMImm8,   iemOp_InvalidNeedRMImm8,
+    /* 0x16 */  iemOp_InvalidNeedRMImm8,    iemOp_vpextrd_q_Ey_Vdq_Ib,  iemOp_InvalidNeedRMImm8,    iemOp_InvalidNeedRMImm8,
     /* 0x17 */  iemOp_InvalidNeedRMImm8,    iemOp_vextractps_Ed_Vdq_Ib, iemOp_InvalidNeedRMImm8,    iemOp_InvalidNeedRMImm8,
     /* 0x18 */  iemOp_InvalidNeedRMImm8,    iemOp_vinsertf128_Vqq_Hqq_Wqq_Ib, iemOp_InvalidNeedRMImm8, iemOp_InvalidNeedRMImm8,
Index: trunk/src/VBox/VMM/VMMAll/IEMAllN8veLiveness.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllN8veLiveness.cpp	(revision 103908)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllN8veLiveness.cpp	(revision 103909)
@@ -663,5 +663,6 @@
 
 #define IEM_MC_FETCH_MREG_U64(a_u64Value, a_iMReg)                  NOP()
-#define IEM_MC_FETCH_MREG_U32(a_u32Value, a_iMReg)                  NOP()
+#define IEM_MC_FETCH_MREG_U32(a_u32Value, a_iMReg, a_iDWord)        NOP()
+#define IEM_MC_FETCH_MREG_U16(a_u16Value, a_iMReg, a_iWord)         NOP()
 #define IEM_MC_STORE_MREG_U64(a_iMReg, a_u64Value)                  NOP()
 #define IEM_MC_STORE_MREG_U32_ZX_U64(a_iMReg, a_u32Value)           NOP()
Index: trunk/src/VBox/VMM/VMMAll/IEMAllThrdPython.py
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllThrdPython.py	(revision 103908)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllThrdPython.py	(revision 103909)
@@ -1762,4 +1762,5 @@
         'IEM_MC_FETCH_MREG_U64':                    '__mreg64',
         'IEM_MC_FETCH_MREG_U32':                    '__mreg32',
+        'IEM_MC_FETCH_MREG_U16':                    '__mreg16',
         'IEM_MC_STORE_MREG_U64':                    '__mreg64',
         'IEM_MC_STORE_MREG_U32_ZX_U64':             '__mreg32zx64',
