Index: trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.c
===================================================================
--- trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.c	(revision 83022)
+++ trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.c	(revision 83318)
@@ -102,7 +102,9 @@
 
 BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_FNStEnv)(void BS3_FAR *pvMmioReg);
-BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovDQU_Read)(void BS3_FAR *pvMmioReg);
+BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovDQU_Read)(void BS3_FAR *pvMmioReg, void BS3_FAR *pvResult);
 BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovDQU_Write)(void BS3_FAR *pvMmioReg);
-BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_FMul)(void BS3_FAR *pvMmioReg);
+BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovUPS_Read)(void BS3_FAR *pvMmioReg, void BS3_FAR *pvResult);
+BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovUPS_Write)(void BS3_FAR *pvMmioReg);
+BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_FMul)(void BS3_FAR *pvMmioReg, void BS3_FAR *pvNoResult);
 
 
@@ -129,4 +131,5 @@
     bool                fMmioReadback;
     bool                fReadBackError = false;
+    bool                fReadError = false;
     BS3PTRUNION         MmioReg;
 
@@ -255,17 +258,30 @@
 
 # undef  CHECK_READBACK_READ_RUN
-# define CHECK_READBACK_READ_RUN(a_Instr, a_Worker, a_Type) \
+#define CHECK_READBACK_READ_RUN(a_Instr, a_Worker, a_Type) \
             do { \
                 off = (unsigned)(iLoop & (VMMDEV_TESTING_READBACK_SIZE / 2 - 1)); \
                 if (off + sizeof(a_Type) > VMMDEV_TESTING_READBACK_SIZE) \
                     off = VMMDEV_TESTING_READBACK_SIZE - sizeof(a_Type); \
-                a_Worker((a_Type *)&MmioReg.pb[off]); \
+                a_Worker((a_Type *)&MmioReg.pb[off], (a_Type *)&abReadback[0]); \
                 TMPL_NM(bs3FpuState1_Save)(pChecking); \
             } while (0)
 # undef  CHECK_READBACK_READ
 # define CHECK_READBACK_READ(a_Instr, a_Worker, a_Type) \
-            CHECK_READBACK_READ_RUN(a_Instr, a_Worker, a_Type); \
-            CHECK_STATE(a_Instr)
-
+            do { \
+                Bs3MemSet(&abReadback[0], 0xcc, sizeof(abReadback)); \
+                CHECK_READBACK_READ_RUN(a_Instr, a_Worker, a_Type); \
+                CHECK_STATE(a_Instr); \
+                if (!fReadError || iLoop == 0) \
+                { \
+                    Bs3MemZero(&abCompare[0], sizeof(abCompare)); \
+                    Bs3MemCpy(&abCompare[0], &MmioReg.pb[off], sizeof(a_Type)); \
+                    if (Bs3MemCmp(abReadback, abCompare, sizeof(a_Type)) != 0) \
+                    { \
+                        Bs3TestFailedF("Read result check for " #a_Instr " in loop #%RU32:\n%.*Rhxs expected:\n%.*Rhxs\n", \
+                                       iLoop, sizeof(a_Type), abReadback, sizeof(a_Type), abCompare); \
+                        fReadError = true; \
+                    } \
+                } \
+            } while (0)
 
         /* The tests. */
@@ -274,8 +290,17 @@
         CHECK_READBACK_WRITE(  MOVDQU,   TMPL_NM(bs3FpuState1_MovDQU_Write), X86XMMREG);
         CHECK_READBACK_READ(   MOVDQU,   TMPL_NM(bs3FpuState1_MovDQU_Read),  X86XMMREG);
+        CHECK_READBACK_WRITE(  MOVUPS,   TMPL_NM(bs3FpuState1_MovUPS_Write), X86XMMREG);
+        CHECK_READBACK_READ(   MOVUPS,   TMPL_NM(bs3FpuState1_MovUPS_Read),  X86XMMREG);
 
         /* Using the FPU is a little complicated, but we really need to check these things. */
         CHECK_READBACK_READ_RUN(FMUL,    TMPL_NM(bs3FpuState1_FMul),         uint64_t);
-        pExpected->FOP    = 0x7dc;
+        if (1)
+# if BS3_MODE_IS_16BIT_CODE(TMPL_MODE)
+            pExpected->FOP    =  0x40f; // skylake 6700k
+# else
+            pExpected->FOP    =  0x40b; // skylake 6700k
+# endif
+        else
+            pExpected->FOP    = 0x7dc; // dunno where we got this.
 # if ARCH_BITS == 64
         pExpected->FPUDP  = (uint32_t) (uintptr_t)&MmioReg.pb[off];
Index: trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.mac
===================================================================
--- trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.mac	(revision 83022)
+++ trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.mac	(revision 83318)
@@ -84,6 +84,6 @@
         movdqu  xmm1, [TMPL_DATA16_WRT(g_r32_Two)]
         movdqu  xmm2, [TMPL_DATA16_WRT(g_r32_ThirtyTwo)]
-        movdqu  xmm3, [TMPL_DATA16_WRT(g_r32_ThirtyTwo)]
-        movdqu  xmm4, [TMPL_DATA16_WRT(g_r32_SNaN)]
+        movdqu  xmm3, [TMPL_DATA16_WRT(g_r32_SNaN)]
+        movdqu  xmm4, [TMPL_DATA16_WRT(g_r80_ThirtyTwo)]
         movdqu  xmm5, [TMPL_DATA16_WRT(g_r32_NegQNaN)]
         movdqu  xmm6, [TMPL_DATA16_WRT(g_r64_Zero)]
@@ -211,5 +211,5 @@
 
         ; Do read.
-        movdqu  [xBX], xmm3
+        movdqu  [xBX], xmm0
 
 TONLY16 pop     ds
@@ -227,5 +227,5 @@
 ;
 BS3_PROC_BEGIN_MODE bs3FpuState1_MovDQU_Read, BS3_PBC_NEAR
-        BS3_CALL_CONV_PROLOG 1
+        BS3_CALL_CONV_PROLOG 2
         push    xBP
         mov     xBP, xSP
@@ -247,4 +247,9 @@
         movdqu  xmm2, [xBX]
 
+        ; Save the result.
+        mov     xBX, [xBP + xCB + cbCurRetAddr + sCB]
+TONLY16 mov     ds,  [xBP + xCB + cbCurRetAddr + sCB + 2]
+        movups  [xBX], xmm2
+
 %if TMPL_BITS == 16
         movdqu  xmm2, [xBP - xCB - xCB - 2 - 18h]
@@ -257,7 +262,80 @@
         mov     xSP, xBP
         pop     xBP
+        BS3_CALL_CONV_EPILOG 2
+        BS3_HYBRID_RET
+BS3_PROC_END_MODE   bs3FpuState1_MovDQU_Read
+
+
+;;
+; Performs a MOVUPS write on the specified memory.
+;
+; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovUPS_Write)(void *pvMmioReg);
+;
+BS3_PROC_BEGIN_MODE bs3FpuState1_MovUPS_Write, BS3_PBC_NEAR
+        BS3_CALL_CONV_PROLOG 1
+        push    xBP
+        mov     xBP, xSP
+        push    xBX
+TONLY16 push    ds
+
+        ; Load the register pointer.
+        mov     xBX, [xBP + xCB + cbCurRetAddr]
+TONLY16 mov     ds,  [xBP + xCB + cbCurRetAddr + 2]
+
+        ; Do read.
+        movups  [xBX], xmm3
+
+TONLY16 pop     ds
+        pop     xBX
+        leave
         BS3_CALL_CONV_EPILOG 1
         BS3_HYBRID_RET
-BS3_PROC_END_MODE   bs3FpuState1_MovDQU_Read
+BS3_PROC_END_MODE   bs3FpuState1_MovUPS_Write
+
+
+;;
+; Performs a MOVUPS write to the specified memory.
+;
+; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovUPS_Read)(void *pvMmioReg, void *pvResult);
+;
+BS3_PROC_BEGIN_MODE bs3FpuState1_MovUPS_Read, BS3_PBC_NEAR
+        BS3_CALL_CONV_PROLOG 2
+        push    xBP
+        mov     xBP, xSP
+        push    xBX
+TONLY16 push    ds
+        sub     xSP, 20h
+%if TMPL_BITS == 16
+        movups  [xBP - xCB - xCB - 2 - 18h], xmm1
+%else
+        movups  [xSP], xmm1
+%endif
+
+        ; Load the register pointer.
+        mov     xBX, [xBP + xCB + cbCurRetAddr]
+TONLY16 mov     ds,  [xBP + xCB + cbCurRetAddr + 2]
+
+
+        ; Do read.
+        movups  xmm1, [xBX]
+
+        ; Save the result.
+        mov     xBX, [xBP + xCB + cbCurRetAddr + sCB]
+TONLY16 mov     ds,  [xBP + xCB + cbCurRetAddr + sCB + 2]
+        movups  [xBX], xmm1
+
+%if TMPL_BITS == 16
+        movups  xmm1, [xBP - xCB - xCB - 2 - 18h]
+%else
+        movups  xmm1, [xSP]
+%endif
+        add     xSP, 20h
+TONLY16 pop     ds
+        pop     xBX
+        mov     xSP, xBP
+        pop     xBP
+        BS3_CALL_CONV_EPILOG 2
+        BS3_HYBRID_RET
+BS3_PROC_END_MODE   bs3FpuState1_MovUPS_Read
 
 
@@ -293,8 +371,8 @@
 ; Performs a FMUL on the specified memory, after writing a 64-bit value to it first.
 ;
-; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_FMul)(void *pvMmioReg);
+; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_FMul)(void *pvMmioReg, void *pvResultIgnored);
 ;
 BS3_PROC_BEGIN_MODE bs3FpuState1_FMul, BS3_PBC_NEAR
-        BS3_CALL_CONV_PROLOG 1
+        BS3_CALL_CONV_PROLOG 2
         push    xBP
         mov     xBP, xSP
@@ -319,5 +397,5 @@
         mov     xSP, xBP
         pop     xBP
-        BS3_CALL_CONV_EPILOG 1
+        BS3_CALL_CONV_EPILOG 2
         BS3_HYBRID_RET
 .do_it:
