Index: /trunk/include/VBox/disopcode.h
===================================================================
--- /trunk/include/VBox/disopcode.h	(revision 66905)
+++ /trunk/include/VBox/disopcode.h	(revision 66906)
@@ -740,12 +740,4 @@
     OP_UD1,
     OP_UD2,
-/** @name AVX instructions
- * @{ */
-    OP_VLDMXCSR,
-    OP_VSTMXCSR,
-    OP_VMOVUPS,
-    OP_VMOVUPD,
-    OP_VMOVSS,
-/** @} */
 /** @name VT-x instructions
  * @{ */
@@ -778,6 +770,16 @@
 /** @name 64 bits instruction
  * @{ */
-    OP_MOVSXD
+    OP_MOVSXD,
 /** @} */
+/** @name AVX instructions
+ * @{ */
+    OP_VLDMXCSR,
+    OP_VSTMXCSR,
+    OP_VMOVUPS,
+    OP_VMOVUPD,
+    OP_VMOVSS,
+    OP_VMOVSD,
+/** @} */
+    OP_END_OF_OPCODES
 };
 AssertCompile(OP_LOCK == 7);
@@ -1080,4 +1082,6 @@
 #define OP_PARM_Uq              (OP_PARM_U+OP_PARM_q)
 #define OP_PARM_UqHi            (OP_PARM_U+OP_PARM_dq)
+#define OP_PARM_Uss             (OP_PARM_U+OP_PARM_ss)
+#define OP_PARM_Usd             (OP_PARM_U+OP_PARM_sd)
 #define OP_PARM_Vdq_WO          OP_PARM_Vdq             /**< Annotates that only YMM/XMM[127:64] are accessed. */
 #define OP_PARM_Vpd_WO          OP_PARM_Vpd             /**< Annotates write only operand. */
@@ -1090,4 +1094,5 @@
 #define OP_PARM_VssZx_WO        OP_PARM_Vss             /**< Annotates that the registers get their upper bits cleared. */
 #define OP_PARM_Vss_WO          OP_PARM_Vss             /**< Annotates write only operand. */
+#define OP_PARM_Vsd_WO          OP_PARM_Vsd             /**< Annotates write only operand. */
 #define OP_PARM_Wpd_WO          OP_PARM_Wpd             /**< Annotates write only operand. */
 #define OP_PARM_Wps_WO          OP_PARM_Wps             /**< Annotates write only operand. */
@@ -1096,5 +1101,4 @@
 #define OP_PARM_Wsd_WO          OP_PARM_Wsd             /**< Annotates write only operand. */
 
-
 /** @} */
 
Index: /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 66905)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAll.cpp	(revision 66906)
@@ -11439,5 +11439,5 @@
          IEM_MC_INT_CLEAR_ZMM_256_UP(pXStateTmp, a_iYRegDst); \
     } while (0)
-#define IEM_MC_COPY2_YREG_U32_U96_ZX_VLMAX(a_iYRegDst, a_iYRegSrc32, a_iYRegSrcHx) \
+#define IEM_MC_MERGE_YREG_U32_U96_ZX_VLMAX(a_iYRegDst, a_iYRegSrc32, a_iYRegSrcHx) \
     do { PX86XSAVEAREA   pXStateTmp     = IEM_GET_CTX(pVCpu)->CTX_SUFF(pXState); \
          uintptr_t const iYRegDstTmp    = (a_iYRegDst); \
@@ -11446,4 +11446,15 @@
          pXStateTmp->x87.aXMM[iYRegDstTmp].au32[0]       = pXStateTmp->x87.aXMM[iYRegSrc32Tmp].au32[0]; \
          pXStateTmp->x87.aXMM[iYRegDstTmp].au32[1]       = pXStateTmp->x87.aXMM[iYRegSrcHxTmp].au32[1]; \
+         pXStateTmp->x87.aXMM[iYRegDstTmp].au64[1]       = pXStateTmp->x87.aXMM[iYRegSrcHxTmp].au64[1]; \
+         pXStateTmp->u.YmmHi.aYmmHi[iYRegDstTmp].au64[0] = 0; \
+         pXStateTmp->u.YmmHi.aYmmHi[iYRegDstTmp].au64[1] = 0; \
+         IEM_MC_INT_CLEAR_ZMM_256_UP(pXStateTmp, a_iYRegDst); \
+    } while (0)
+#define IEM_MC_MERGE_YREG_U64_U64_ZX_VLMAX(a_iYRegDst, a_iYRegSrc64, a_iYRegSrcHx) \
+    do { PX86XSAVEAREA   pXStateTmp     = IEM_GET_CTX(pVCpu)->CTX_SUFF(pXState); \
+         uintptr_t const iYRegDstTmp    = (a_iYRegDst); \
+         uintptr_t const iYRegSrc64Tmp  = (a_iYRegSrc64); \
+         uintptr_t const iYRegSrcHxTmp  = (a_iYRegSrcHx); \
+         pXStateTmp->x87.aXMM[iYRegDstTmp].au64[0]       = pXStateTmp->x87.aXMM[iYRegSrc64Tmp].au64[0]; \
          pXStateTmp->x87.aXMM[iYRegDstTmp].au64[1]       = pXStateTmp->x87.aXMM[iYRegSrcHxTmp].au64[1]; \
          pXStateTmp->u.YmmHi.aYmmHi[iYRegDstTmp].au64[0] = 0; \
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsPython.py
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsPython.py	(revision 66905)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsPython.py	(revision 66906)
@@ -232,4 +232,6 @@
     'Uq':           ( 'IDX_UseModRM',       'rm',     '%Uq',  'Uq',      ),
     'UqHi':         ( 'IDX_UseModRM',       'rm',     '%Uq',  'UqHi',    ),
+    'Uss':          ( 'IDX_UseModRM',       'rm',     '%Uss', 'Uss',     ),
+    'Usd':          ( 'IDX_UseModRM',       'rm',     '%Usd', 'Usd',     ),
     'Nq':           ( 'IDX_UseModRM',       'rm',     '%Qq',  'Nq',      ),
 
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsVexMap1.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsVexMap1.cpp.h	(revision 66905)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsVexMap1.cpp.h	(revision 66906)
@@ -214,12 +214,12 @@
          * @opcodesub   11 mr/reg
          * @opcpuid     avx
-         * @opgroup     og_avx_simdfp_datamove
+         * @opgroup     og_avx_simdfp_datamerge
          * @opxcpttype  5
          * @optest      op1=1 op2=0  op3=2    -> op1=2
          * @optest      op1=0 op2=0  op3=-22  -> op1=0xffffffea
          * @optest      op1=3 op2=-1 op3=0x77 -> op1=-4294967177
-         * @oponly
+        * @oponly
          */
-        IEMOP_MNEMONIC3(VEX_RVM, VMOVSS, vmovss, Vss_WO, HdqCss, Wss, DISOPTYPE_HARMLESS, IEMOPHINT_IGNORES_OP_SIZE);
+        IEMOP_MNEMONIC3(VEX_RVM, VMOVSS, vmovss, Vss_WO, HdqCss, Uss, DISOPTYPE_HARMLESS, IEMOPHINT_IGNORES_OP_SIZE);
         IEMOP_HLP_DONE_DECODING_NO_AVX_PREFIX();
         IEM_MC_BEGIN(0, 0);
@@ -227,5 +227,5 @@
         IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
         IEM_MC_ACTUALIZE_AVX_STATE_FOR_CHANGE();
-        IEM_MC_COPY2_YREG_U32_U96_ZX_VLMAX(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg,
+        IEM_MC_MERGE_YREG_U32_U96_ZX_VLMAX(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg,
                                            (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB /*U32*/,
                                            pVCpu->iem.s.uVex3rdReg /*Hss*/);
@@ -246,5 +246,5 @@
          * @optest      op1=1 op2=2 -> op1=2
          * @optest      op1=0 op2=-22 -> op1=-22
-         * @oponly
+        * @oponly
          */
         IEMOP_MNEMONIC2(VEX_XM, VMOVSS, vmovss, VssZx_WO, Wss, DISOPTYPE_HARMLESS, IEMOPHINT_IGNORES_OP_SIZE);
@@ -268,7 +268,70 @@
 }
 
-/** Opcode VEX.F2.0F 0x10 - vmovsd Vx, Hx, Wsd */
-FNIEMOP_STUB(iemOp_vmovsd_Vx_Hx_Wsd);
-
+
+FNIEMOP_DEF(iemOp_vmovsd_Vsd_Hsd_Wsd)
+{
+    Assert(pVCpu->iem.s.uVexLength <= 1);
+    uint8_t bRm; IEM_OPCODE_GET_NEXT_U8(&bRm);
+    if ((bRm & X86_MODRM_MOD_MASK) == (3 << X86_MODRM_MOD_SHIFT))
+    {
+        /**
+         * @opcode      0x10
+         * @oppfx       0xf2
+         * @opcodesub   11 mr/reg
+         * @opcpuid     avx
+         * @opgroup     og_avx_simdfp_datamerge
+         * @opxcpttype  5
+         * @optest      op1=1 op2=0  op3=2    -> op1=2
+         * @optest      op1=0 op2=0  op3=-22  -> op1=0xffffffffffffffea
+         * @optest      op1=3 op2=-1 op3=0x77 ->
+         *              op1=0xffffffffffffffff0000000000000077
+        * @oponly
+         */
+        IEMOP_MNEMONIC3(VEX_RVM, VMOVSD, vmovsd, Vsd_WO, HdqCsd, Usd, DISOPTYPE_HARMLESS, IEMOPHINT_IGNORES_OP_SIZE);
+        IEMOP_HLP_DONE_DECODING_NO_AVX_PREFIX();
+        IEM_MC_BEGIN(0, 0);
+
+        IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
+        IEM_MC_ACTUALIZE_AVX_STATE_FOR_CHANGE();
+        IEM_MC_MERGE_YREG_U64_U64_ZX_VLMAX(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg,
+                                           (bRm & X86_MODRM_RM_MASK) | pVCpu->iem.s.uRexB /*U32*/,
+                                           pVCpu->iem.s.uVex3rdReg /*Hss*/);
+        IEM_MC_ADVANCE_RIP();
+        IEM_MC_END();
+    }
+    else
+    {
+        /**
+         * @opdone
+         * @opcode      0x10
+         * @oppfx       0xf2
+         * @opcodesub   11 mr/reg
+         * @opcpuid     avx
+         * @opgroup     og_avx_simdfp_datamove
+         * @opxcpttype  5
+         * @opfunction  iemOp_vmovss_Vss_Hss_Wss
+         * @optest      op1=1 op2=2 -> op1=2
+         * @optest      op1=0 op2=-22 -> op1=-22
+         * @oponly
+         */
+        IEMOP_MNEMONIC2(VEX_XM, VMOVSD, vmovsd, VsdZx_WO, Mq, DISOPTYPE_HARMLESS, IEMOPHINT_IGNORES_OP_SIZE);
+        IEM_MC_BEGIN(0, 2);
+        IEM_MC_LOCAL(uint64_t,                  uSrc);
+        IEM_MC_LOCAL(RTGCPTR,                   GCPtrEffSrc);
+
+        IEM_MC_CALC_RM_EFF_ADDR(GCPtrEffSrc, bRm, 0);
+        IEMOP_HLP_DONE_DECODING_NO_AVX_PREFIX_AND_NO_VVVV();
+        IEM_MC_MAYBE_RAISE_AVX_RELATED_XCPT();
+        IEM_MC_ACTUALIZE_AVX_STATE_FOR_CHANGE();
+
+        IEM_MC_FETCH_MEM_U64(uSrc, pVCpu->iem.s.iEffSeg, GCPtrEffSrc);
+        IEM_MC_STORE_YREG_U64_ZX_VLMAX(((bRm >> X86_MODRM_REG_SHIFT) & X86_MODRM_REG_SMASK) | pVCpu->iem.s.uRexReg, uSrc);
+
+        IEM_MC_ADVANCE_RIP();
+        IEM_MC_END();
+    }
+
+    return VINF_SUCCESS;
+}
 
 /**
@@ -2961,5 +3024,5 @@
     /* 0x0f */  IEMOP_X4(iemOp_InvalidNeedRM),
 
-    /* 0x10 */  iemOp_vmovups_Vps_Wps,      iemOp_vmovupd_Vpd_Wpd,      iemOp_vmovss_Vss_Hss_Wss,     iemOp_vmovsd_Vx_Hx_Wsd,
+    /* 0x10 */  iemOp_vmovups_Vps_Wps,      iemOp_vmovupd_Vpd_Wpd,      iemOp_vmovss_Vss_Hss_Wss,   iemOp_vmovsd_Vsd_Hsd_Wsd,
     /* 0x11 */  iemOp_vmovups_Wps_Vps,      iemOp_vmovupd_Wpd_Vpd,      iemOp_vmovss_Wss_Hx_Vss,    iemOp_vmovsd_Wsd_Hx_Vsd,
     /* 0x12 */  iemOp_vmovlps_Vq_Hq_Mq__vmovhlps, iemOp_vmovlpd_Vq_Hq_Mq, iemOp_vmovsldup_Vx_Wx,    iemOp_vmovddup_Vx_Wx,
Index: /trunk/src/VBox/VMM/testcase/tstIEMCheckMc.cpp
===================================================================
--- /trunk/src/VBox/VMM/testcase/tstIEMCheckMc.cpp	(revision 66905)
+++ /trunk/src/VBox/VMM/testcase/tstIEMCheckMc.cpp	(revision 66906)
@@ -528,5 +528,6 @@
 #define IEM_MC_COPY_YREG_U256_ZX_VLMAX(a_iYRegDst, a_iYRegSrc)    do { (void)fAvxWrite; } while (0)
 #define IEM_MC_COPY_YREG_U128_ZX_VLMAX(a_iYRegDst, a_iYRegSrc)    do { (void)fAvxWrite; } while (0)
-#define IEM_MC_COPY2_YREG_U32_U96_ZX_VLMAX(a_iYRegDst, a_iYRegSrc32, a_iYRegSrcHx)  do { (void)fAvxWrite; } while (0)
+#define IEM_MC_MERGE_YREG_U32_U96_ZX_VLMAX(a_iYRegDst, a_iYRegSrc32, a_iYRegSrcHx)  do { (void)fAvxWrite; } while (0)
+#define IEM_MC_MERGE_YREG_U64_U64_ZX_VLMAX(a_iYRegDst, a_iYRegSrc64, a_iYRegSrcHx)  do { (void)fAvxWrite; } while (0)
 
 #define IEM_MC_FETCH_MEM_U8(a_u8Dst, a_iSeg, a_GCPtrMem)                do { CHK_GCPTR(a_GCPtrMem); } while (0)
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c	(revision 66905)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c	(revision 66906)
@@ -197,4 +197,8 @@
          * Set to BS3CG1DST_INVALID if memory or immediate.  */
         uint8_t             idxField;
+        /** The base BS3CG1DST value for this field.
+         * Used only by some generalized encoders when dealing with
+         * registers. */
+        uint8_t             idxFieldBase;
         /** Depends on enmLocation.
          * - BS3CG1OPLOC_IMM:       offset relative to start of the instruction.
@@ -2386,5 +2390,5 @@
 
 
-static unsigned Bs3Cg1EncodeNext_VEX_MODRM_Vss_WO_HdqCss_Wss(PBS3CG1STATE pThis, unsigned iEncoding)
+static unsigned Bs3Cg1EncodeNext_VEX_MODRM_VsomethingWO_HdqCsomething_Usomething(PBS3CG1STATE pThis, unsigned iEncoding)
 {
     unsigned off;
@@ -2395,7 +2399,7 @@
             off = Bs3Cg1InsertOpcodes(pThis, off);
             pThis->abCurInstr[off++] = X86_MODRM_MAKE(3, 2, 1);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM2;
-            pThis->aOperands[1].idxField = BS3CG1DST_XMM0;
-            pThis->aOperands[2].idxField = BS3CG1DST_XMM1_DW0;
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 2;
+            pThis->aOperands[1].idxField = pThis->aOperands[1].idxFieldBase + 0;
+            pThis->aOperands[2].idxField = pThis->aOperands[2].idxFieldBase + 1;
             break;
         case 1:
@@ -2403,7 +2407,7 @@
             off = Bs3Cg1InsertOpcodes(pThis, off);
             pThis->abCurInstr[off++] = X86_MODRM_MAKE(3, 3, 1);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM3;
-            pThis->aOperands[1].idxField = BS3CG1DST_XMM7;
-            pThis->aOperands[2].idxField = BS3CG1DST_XMM1_DW0;
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 3;
+            pThis->aOperands[1].idxField = pThis->aOperands[1].idxFieldBase + 7;
+            pThis->aOperands[2].idxField = pThis->aOperands[2].idxFieldBase + 1;
             break;
         case 2:
@@ -2414,7 +2418,7 @@
                 off = Bs3Cg1InsertOpcodes(pThis, off);
                 pThis->abCurInstr[off++] = X86_MODRM_MAKE(3, 3, 2);
-                pThis->aOperands[0].idxField = BS3CG1DST_XMM11;
-                pThis->aOperands[1].idxField = BS3CG1DST_XMM15;
-                pThis->aOperands[2].idxField = BS3CG1DST_XMM2_DW0;
+                pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 11;
+                pThis->aOperands[1].idxField = pThis->aOperands[1].idxFieldBase + 15;
+                pThis->aOperands[2].idxField = pThis->aOperands[2].idxFieldBase + 2;
                 break;
             }
@@ -2425,7 +2429,7 @@
             off = Bs3Cg1InsertOpcodes(pThis, off);
             pThis->abCurInstr[off++] = X86_MODRM_MAKE(3, 2, 1);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM2;
-            pThis->aOperands[1].idxField = BS3CG1DST_XMM0;
-            pThis->aOperands[2].idxField = BS3CG1DST_XMM1_DW0;
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 2;
+            pThis->aOperands[1].idxField = pThis->aOperands[1].idxFieldBase + 0;
+            pThis->aOperands[2].idxField = pThis->aOperands[2].idxFieldBase + 1;
             break;
         case 4:
@@ -2433,7 +2437,7 @@
             off = Bs3Cg1InsertOpcodes(pThis, off);
             pThis->abCurInstr[off++] = X86_MODRM_MAKE(3, 2, 1);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM2;
-            pThis->aOperands[1].idxField = BS3CG1DST_XMM0;
-            pThis->aOperands[2].idxField = BS3CG1DST_XMM1_DW0;
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 2;
+            pThis->aOperands[1].idxField = pThis->aOperands[1].idxFieldBase + 0;
+            pThis->aOperands[2].idxField = pThis->aOperands[2].idxFieldBase + 1;
             break;
         case 5:
@@ -2441,7 +2445,7 @@
             off = Bs3Cg1InsertOpcodes(pThis, off);
             pThis->abCurInstr[off++] = X86_MODRM_MAKE(3, 2, 1);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM2;
-            pThis->aOperands[1].idxField = BS3CG1DST_XMM3;
-            pThis->aOperands[2].idxField = BS3CG1DST_XMM1_DW0;
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 2;
+            pThis->aOperands[1].idxField = pThis->aOperands[1].idxFieldBase + 3;
+            pThis->aOperands[2].idxField = pThis->aOperands[2].idxFieldBase + 1;
             break;
         case 6:
@@ -2449,7 +2453,15 @@
             off = Bs3Cg1InsertOpcodes(pThis, off);
             pThis->abCurInstr[off++] = X86_MODRM_MAKE(3, 2, 1);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM2;
-            pThis->aOperands[1].idxField = BS3_MODE_IS_64BIT_CODE(pThis->bMode) ? BS3CG1DST_XMM15 : BS3CG1DST_XMM7;
-            pThis->aOperands[2].idxField = BS3CG1DST_XMM1_DW0;
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 2;
+            pThis->aOperands[1].idxField = pThis->aOperands[1].idxFieldBase + (BS3_MODE_IS_64BIT_CODE(pThis->bMode) ? 15 : 7);
+            pThis->aOperands[2].idxField = pThis->aOperands[2].idxFieldBase + 1;
+            break;
+        case 7:
+            off = Bs3Cg1InsertVex3bPrefix(pThis, 0 /*offDst*/, 0 /*~V*/, 0 /*L*/, 1 /*~R*/, 1 /*~X*/, 1 /*~B*/, 0 /*W*/);
+            off = Bs3Cg1InsertOpcodes(pThis, off);
+            pThis->abCurInstr[off++] = X86_MODRM_MAKE(3, 2, 1);
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 2;
+            pThis->aOperands[1].idxField = pThis->aOperands[1].idxFieldBase + (BS3_MODE_IS_64BIT_CODE(pThis->bMode) ? 15 : 7);
+            pThis->aOperands[2].idxField = pThis->aOperands[2].idxFieldBase + 1;
             break;
         default:
@@ -2461,5 +2473,5 @@
 
 
-static unsigned Bs3Cg1EncodeNext_VEX_MODRM_VssZx_WO_Wss(PBS3CG1STATE pThis, unsigned iEncoding)
+static unsigned Bs3Cg1EncodeNext_VEX_MODRM_VsomethingWO_Msomething_Wip_Lig(PBS3CG1STATE pThis, unsigned iEncoding)
 {
     unsigned off;
@@ -2469,12 +2481,12 @@
             off = Bs3Cg1InsertVex2bPrefix(pThis, 0 /*offDst*/, 0xf /*~V*/, 0 /*L*/, 1 /*~R*/);
             off = Bs3Cg1InsertOpcodes(pThis, off);
-            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 0, 4, 0, BS3CG1OPLOC_MEM);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM0_DW0;
+            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 0, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 0;
             break;
         case 1:
             off = Bs3Cg1InsertVex2bPrefix(pThis, 0 /*offDst*/, 0xf /*~V*/, 1 /*L - ignored*/, 1 /*~R*/);
             off = Bs3Cg1InsertOpcodes(pThis, off);
-            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 7, 4, 0, BS3CG1OPLOC_MEM);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM7_DW0;
+            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 7, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 7;
             break;
         case 2:
@@ -2484,6 +2496,6 @@
                 off = Bs3Cg1InsertVex2bPrefix(pThis, 0 /*offDst*/, 0xf /*~V*/, 1 /*L - ignored*/, 0 /*~R*/);
                 off = Bs3Cg1InsertOpcodes(pThis, off);
-                off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 7, 4, 0, BS3CG1OPLOC_MEM);
-                pThis->aOperands[0].idxField = BS3CG1DST_XMM15_DW0;
+                off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 7, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+                pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 15;
                 break;
             }
@@ -2494,6 +2506,6 @@
             off = Bs3Cg1InsertVex2bPrefix(pThis, 0 /*offDst*/, 0xe /*~V*/, 0 /*L*/, 1 /*~R*/);
             off = Bs3Cg1InsertOpcodes(pThis, off);
-            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 0, 4, 0, BS3CG1OPLOC_MEM);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM0_DW0;
+            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 0, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 0;
             pThis->fInvalidEncoding = true;
             break;
@@ -2501,18 +2513,18 @@
             off = Bs3Cg1InsertVex3bPrefix(pThis, 0 /*offDst*/, 0xf /*~V*/, 0 /*L*/, 1 /*~R*/, 1 /*~X*/, 1 /*~B*/, 0 /*W*/);
             off = Bs3Cg1InsertOpcodes(pThis, off);
-            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 1, 4, 0, BS3CG1OPLOC_MEM);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM1_DW0;
+            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 1, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 1;
             break;
         case 5:
             off = Bs3Cg1InsertVex3bPrefix(pThis, 0 /*offDst*/, 0xf /*~V*/, 1 /*L-ignored*/, 1 /*~R*/, 1 /*~X*/, 1 /*~B*/, 0 /*W*/);
             off = Bs3Cg1InsertOpcodes(pThis, off);
-            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 1, 4, 0, BS3CG1OPLOC_MEM);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM1_DW0;
+            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 1, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 1;
             break;
         case 6:
             off = Bs3Cg1InsertVex3bPrefix(pThis, 0 /*offDst*/, 0xf /*~V*/, 0 /*L*/, 1 /*~R*/, 1 /*~X*/, 1 /*~B*/, 1 /*W-ignored*/);
             off = Bs3Cg1InsertOpcodes(pThis, off);
-            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 5, 4, 0, BS3CG1OPLOC_MEM);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM5_DW0;
+            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 5, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 5;
             break;
         case 7:
@@ -2522,6 +2534,6 @@
                 off = Bs3Cg1InsertVex3bPrefix(pThis, 0 /*offDst*/, 0xf /*~V*/, 0 /*L*/, 0 /*~R*/, 1 /*~X*/, 1 /*~B*/, 0 /*W*/);
                 off = Bs3Cg1InsertOpcodes(pThis, off);
-                off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 5, 4, 0, BS3CG1OPLOC_MEM);
-                pThis->aOperands[0].idxField = BS3CG1DST_XMM13_DW0;
+                off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 5, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+                pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 13;
                 break;
             }
@@ -2534,6 +2546,6 @@
                 off = Bs3Cg1InsertVex3bPrefix(pThis, 0 /*offDst*/, 0xf /*~V*/, 0 /*L*/, 1 /*~R*/, 1 /*~X*/, 0 /*~B-ignored*/, 0 /*W*/);
                 off = Bs3Cg1InsertOpcodes(pThis, off);
-                off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 1, 4, 0, BS3CG1OPLOC_MEM);
-                pThis->aOperands[0].idxField = BS3CG1DST_XMM1_DW0;
+                off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 1, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+                pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 1;
                 break;
             }
@@ -2546,6 +2558,6 @@
                 off = Bs3Cg1InsertVex3bPrefix(pThis, 0 /*offDst*/, 0xf /*~V*/, 0 /*L*/, 1 /*~R*/, 0 /*~X-ignored*/, 1 /*~B*/, 0 /*W*/);
                 off = Bs3Cg1InsertOpcodes(pThis, off);
-                off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 2, 4, 0, BS3CG1OPLOC_MEM);
-                pThis->aOperands[0].idxField = BS3CG1DST_XMM2_DW0;
+                off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 2, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+                pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 2;
                 break;
             }
@@ -2556,6 +2568,6 @@
             off = Bs3Cg1InsertVex3bPrefix(pThis, 0 /*offDst*/, 0 /*~V*/, 0 /*L*/, 1 /*~R*/, 1 /*~X*/, 1 /*~B*/, 0 /*W*/);
             off = Bs3Cg1InsertOpcodes(pThis, off);
-            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 5, 4, 0, BS3CG1OPLOC_MEM);
-            pThis->aOperands[0].idxField = BS3CG1DST_XMM5_DW0;
+            off = Bs3Cfg1EncodeMemMod0Disp(pThis, false, off, 5, pThis->aOperands[1].cbOp, 0, BS3CG1OPLOC_MEM);
+            pThis->aOperands[0].idxField = pThis->aOperands[0].idxFieldBase + 5;
             pThis->fInvalidEncoding = true;
             break;
@@ -2763,9 +2775,11 @@
             return Bs3Cg1EncodeNext_VEX_MODRM_Vps_WO_Wps__OR__VEX_MODRM_Vpd_WO_Wpd(pThis, iEncoding);
 
-        case BS3CG1ENC_VEX_MODRM_Vss_WO_HdqCss_Wss:
-            return Bs3Cg1EncodeNext_VEX_MODRM_Vss_WO_HdqCss_Wss(pThis, iEncoding);
-
+        case BS3CG1ENC_VEX_MODRM_Vss_WO_HdqCss_Uss:
+        case BS3CG1ENC_VEX_MODRM_Vsd_WO_HdqCsd_Usd:
+            return Bs3Cg1EncodeNext_VEX_MODRM_VsomethingWO_HdqCsomething_Usomething(pThis, iEncoding);
+
+        case BS3CG1ENC_VEX_MODRM_VsdZx_WO_Mq:
         case BS3CG1ENC_VEX_MODRM_VssZx_WO_Wss:
-            return Bs3Cg1EncodeNext_VEX_MODRM_VssZx_WO_Wss(pThis, iEncoding);
+            return Bs3Cg1EncodeNext_VEX_MODRM_VsomethingWO_Msomething_Wip_Lig(pThis, iEncoding);
 
         case BS3CG1ENC_VEX_MODRM_Md_WO:
@@ -3019,9 +3033,11 @@
             pThis->aOperands[0].cbOp = 4;
             pThis->aOperands[1].cbOp = 4;
-            pThis->aOperands[0].enmLocation = BS3CG1OPLOC_CTX_ZX_VLMAX;
-            pThis->aOperands[1].enmLocation = BS3CG1OPLOC_MEM;
+            pThis->aOperands[0].enmLocation  = BS3CG1OPLOC_CTX_ZX_VLMAX;
+            pThis->aOperands[1].enmLocation  = BS3CG1OPLOC_MEM;
+            pThis->aOperands[0].idxFieldBase = BS3CG1DST_XMM0_DW0;
+            pThis->aOperands[1].idxFieldBase = BS3CG1DST_INVALID;
             break;
 
-        case BS3CG1ENC_VEX_MODRM_Vss_WO_HdqCss_Wss:
+        case BS3CG1ENC_VEX_MODRM_Vss_WO_HdqCss_Uss:
             pThis->iRegOp            = 0;
             pThis->iRmOp             = 2;
@@ -3029,7 +3045,35 @@
             pThis->aOperands[1].cbOp = 16;
             pThis->aOperands[2].cbOp = 4;
-            pThis->aOperands[0].enmLocation = BS3CG1OPLOC_CTX_ZX_VLMAX;
-            pThis->aOperands[1].enmLocation = BS3CG1OPLOC_CTX;
-            pThis->aOperands[2].enmLocation = BS3CG1OPLOC_CTX;
+            pThis->aOperands[0].enmLocation  = BS3CG1OPLOC_CTX_ZX_VLMAX;
+            pThis->aOperands[1].enmLocation  = BS3CG1OPLOC_CTX;
+            pThis->aOperands[2].enmLocation  = BS3CG1OPLOC_CTX;
+            pThis->aOperands[0].idxFieldBase = BS3CG1DST_XMM0;
+            pThis->aOperands[1].idxFieldBase = BS3CG1DST_XMM0;
+            pThis->aOperands[2].idxFieldBase = BS3CG1DST_XMM0_DW0;
+            break;
+
+        case BS3CG1ENC_VEX_MODRM_VsdZx_WO_Mq:
+            pThis->iRmOp             = 1;
+            pThis->iRegOp            = 0;
+            pThis->aOperands[0].cbOp = 8;
+            pThis->aOperands[1].cbOp = 8;
+            pThis->aOperands[0].enmLocation  = BS3CG1OPLOC_CTX_ZX_VLMAX;
+            pThis->aOperands[1].enmLocation  = BS3CG1OPLOC_MEM;
+            pThis->aOperands[0].idxFieldBase = BS3CG1DST_XMM0_LO;
+            pThis->aOperands[1].idxFieldBase = BS3CG1DST_INVALID;
+            break;
+
+        case BS3CG1ENC_VEX_MODRM_Vsd_WO_HdqCsd_Usd:
+            pThis->iRegOp            = 0;
+            pThis->iRmOp             = 2;
+            pThis->aOperands[0].cbOp = 16;
+            pThis->aOperands[1].cbOp = 16;
+            pThis->aOperands[2].cbOp = 8;
+            pThis->aOperands[0].enmLocation  = BS3CG1OPLOC_CTX_ZX_VLMAX;
+            pThis->aOperands[1].enmLocation  = BS3CG1OPLOC_CTX;
+            pThis->aOperands[2].enmLocation  = BS3CG1OPLOC_CTX;
+            pThis->aOperands[0].idxFieldBase = BS3CG1DST_XMM0;
+            pThis->aOperands[1].idxFieldBase = BS3CG1DST_XMM0;
+            pThis->aOperands[2].idxFieldBase = BS3CG1DST_XMM0_LO;
             break;
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.h
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.h	(revision 66905)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.h	(revision 66906)
@@ -62,8 +62,11 @@
     BS3CG1OP_Gv_RO,
     BS3CG1OP_HdqCss,
+    BS3CG1OP_HdqCsd,
     BS3CG1OP_Nq,
     BS3CG1OP_Pq_WO,
     BS3CG1OP_Uq,
     BS3CG1OP_UqHi,
+    BS3CG1OP_Uss,
+    BS3CG1OP_Usd,
     BS3CG1OP_Vss,
     BS3CG1OP_Vss_WO,
@@ -144,6 +147,8 @@
     BS3CG1ENC_VEX_MODRM_Vps_WO_Wps,
     BS3CG1ENC_VEX_MODRM_Vpd_WO_Wpd,
-    BS3CG1ENC_VEX_MODRM_Vss_WO_HdqCss_Wss,
+    BS3CG1ENC_VEX_MODRM_Vss_WO_HdqCss_Uss,
     BS3CG1ENC_VEX_MODRM_VssZx_WO_Wss,
+    BS3CG1ENC_VEX_MODRM_Vsd_WO_HdqCsd_Usd,
+    BS3CG1ENC_VEX_MODRM_VsdZx_WO_Mq,
     BS3CG1ENC_VEX_MODRM_Md_WO,
 
