Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsOneByte.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsOneByte.cpp.h	(revision 65958)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsOneByte.cpp.h	(revision 65959)
@@ -101,4 +101,5 @@
  * @opgroup     op_gen_arith_bin
  * @opflmodify  of,sf,zf,af,pf,cf
+ * @optest      op1=1 op2=1 -> op1=2 efl=of,sf,zf,af
  */
 FNIEMOP_DEF(iemOp_add_Al_Ib)
@@ -113,4 +114,5 @@
  * @opgroup     op_gen_arith_bin
  * @opflmodify  of,sf,zf,af,pf,cf
+ * @optest      op1=1 op2=1 -> op1=2 efl=of,sf,zf,af
  */
 FNIEMOP_DEF(iemOp_add_eAX_Iz)
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-data.py
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-data.py	(revision 65958)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-data.py	(revision 65959)
@@ -271,4 +271,12 @@
         self.asFlags            = [];
         self.fAdvanceMnemonic   = True; ##< Set by the caller.
+        if self.sEncoding == 'ModR/M':
+            if 'ignores_op_size' not in oInstr.dHints:
+                self.sPfxKind   = 'BS3CGPFXKIND_MODRM';
+            else:
+                self.sPfxKind   = 'BS3CGPFXKIND_MODRM_NO_OP_SIZES';
+        else:
+            self.sPfxKind       = '0';
+
 
     def getOperands(self):
@@ -279,5 +287,5 @@
         """ Returns an array of BS3CG1INSTR member initializers. """
         return [
-            '        /* cbOpcode = */         %s,' % (len(self.asOpcodes),),
+            '        /* cbOpcodes = */        %s,' % (len(self.asOpcodes),),
             '        /* cOperands = */        %s,' % (len(self.oInstr.aoOperands),),
             '        /* cchMnemonic = */      %s,' % (len(self.oInstr.sMnemonic),),
@@ -285,4 +293,5 @@
             '        /* offTests = */         %s,' % (self.oTests.offTests,),
             '        /* enmEncoding = */      (unsigned)%s,' % (self.sEncoding,),
+            '        /* enmPfxKind = */       (unsigned)%s,' % (self.sPfxKind,),
             '        /* uUnused = */          0,',
             '        /* fFlags = */           %s' % (' | '.join(self.asFlags) if self.asFlags else '0'),
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c	(revision 65958)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c	(revision 65959)
@@ -40,4 +40,37 @@
 
 /*********************************************************************************************************************************
+*   Defined Constants And Macros                                                                                                 *
+*********************************************************************************************************************************/
+#define P_CS        X86_OP_PRF_CS
+#define P_SS        X86_OP_PRF_SS
+#define P_DS        X86_OP_PRF_DS
+#define P_ES        X86_OP_PRF_ES
+#define P_FS        X86_OP_PRF_FS
+#define P_GS        X86_OP_PRF_GS
+#define P_OZ        X86_OP_PRF_SIZE_OP
+#define P_AZ        X86_OP_PRF_SIZE_ADDR
+#define P_LK        X86_OP_PRF_LOCK
+#define P_RN        X86_OP_PRF_REPNZ
+#define P_RZ        X86_OP_PRF_REPZ
+
+#define REX_WRBX    (X86_OP_REX_W | X86_OP_REX_R | X86_OP_REX_B | X86_OP_REX_X)
+#define REX_W___    (X86_OP_REX_W)
+#define REX_WR__    (X86_OP_REX_W | X86_OP_REX_R)
+#define REX_W_B_    (X86_OP_REX_W | X86_OP_REX_B)
+#define REX_W__X    (X86_OP_REX_W | X86_OP_REX_X)
+#define REX_WRB_    (X86_OP_REX_W | X86_OP_REX_R | X86_OP_REX_B)
+#define REX_WR_X    (X86_OP_REX_W | X86_OP_REX_R | X86_OP_REX_X)
+#define REX_W_BX    (X86_OP_REX_W | X86_OP_REX_B | X86_OP_REX_X)
+#define REX__R__    (X86_OP_REX_R)
+#define REX__RB_    (X86_OP_REX_R | X86_OP_REX_B)
+#define REX__R_X    (X86_OP_REX_R | X86_OP_REX_X)
+#define REX__RBX    (X86_OP_REX_R | X86_OP_REX_B | X86_OP_REX_X)
+#define REX___B_    (X86_OP_REX_B)
+#define REX___BX    (X86_OP_REX_B | X86_OP_REX_X)
+#define REX____X    (X86_OP_REX_X)
+#define REX_____    (0x40)
+
+
+/*********************************************************************************************************************************
 *   Structures and Typedefs                                                                                                      *
 *********************************************************************************************************************************/
@@ -75,5 +108,5 @@
     uint8_t                 fAdvanceMnemonic;
     /** The number of opcode bytes.   */
-    uint8_t                 cbOpcode;
+    uint8_t                 cbOpcodes;
     /** Number of operands. */
     uint8_t                 cOperands;
@@ -88,5 +121,24 @@
     uint8_t                 bMode;
 
-    uint8_t                 abPadding1[2];
+    /** @name Current encoded instruction.
+     * @{ */
+    /** The size of the current instruction that we're testing. */
+    uint8_t                 cbCurInstr;
+    /** The size the prefixes. */
+    uint8_t                 cbCurPrefix;
+    /** The offset into abCurInstr of the immediate. */
+    uint8_t                 offCurImm;
+    /** Buffer for assembling the current instruction. */
+    uint8_t                 abCurInstr[31];
+
+    /** Operands details. */
+    struct
+    {
+        uint8_t             cbOp;
+        bool                fMem;
+        bool                afUnused[2];
+        BS3PTRUNION         uOpPtr;
+    } aOperands[4];
+    /** @} */
 
     /** Page to put code in.  When paging is enabled, the page before and after
@@ -113,8 +165,118 @@
     } MemOp;
 } BS3CG1STATE;
-
-
-
-BS3_DECL_FAR(uint8_t) BS3_CMN_NM(bs3CpuInstr2_mul)(uint8_t bMode)
+/** Pointer to the generated test state. */
+typedef BS3CG1STATE *PBS3CG1STATE;
+
+
+#define BS3CG1_PF_OZ  UINT16_C(0x0001)
+#define BS3CG1_PF_AZ  UINT16_C(0x0002)
+#define BS3CG1_PF_CS  UINT16_C(0x0004)
+#define BS3CG1_PF_DS  UINT16_C(0x0008)
+#define BS3CG1_PF_ES  UINT16_C(0x0010)
+#define BS3CG1_PF_FS  UINT16_C(0x0020)
+#define BS3CG1_PF_GS  UINT16_C(0x0040)
+#define BS3CG1_PF_SS  UINT16_C(0x0080)
+#define BS3CG1_PF_SEGS (BS3CG1_PF_CS | BS3CG1_PF_DS | BS3CG1_PF_ES | BS3CG1_PF_FS | BS3CG1_PF_GS | BS3CG1_PF_SS)
+#define BS3CG1_PF_MEM  (BS3CG1_PF_SEGS | BS3CG1_PF_AZ)
+#define BS3CG1_PF_LK  UINT16_C(0x0100)
+#define BS3CG1_PF_RN  UINT16_C(0x0200)
+#define BS3CG1_PF_RZ  UINT16_C(0x0400)
+#define BS3CG1_PF_W   UINT16_C(0x0800) /**< REX.W */
+#define BS3CG1_PF_R   UINT16_C(0x1000) /**< REX.R */
+#define BS3CG1_PF_B   UINT16_C(0x2000) /**< REX.B */
+#define BS3CG1_PF_X   UINT16_C(0x4000) /**< REX.X */
+
+
+/*********************************************************************************************************************************
+*   Global Variables                                                                                                             *
+*********************************************************************************************************************************/
+#if 0
+static const struct
+{
+    uint8_t     cbPrefixes;
+    uint8_t     abPrefixes[14];
+    uint16_t    fEffective;
+} g_aPrefixVariations[] =
+{
+    { 0, { 0x00 }, BS3CG1_PF_NONE },
+
+    { 1, { P_OZ }, BS3CG1_PF_OZ },
+    { 1, { P_CS }, BS3CG1_PF_CS },
+    { 1, { P_DS }, BS3CG1_PF_DS },
+    { 1, { P_ES }, BS3CG1_PF_ES },
+    { 1, { P_FS }, BS3CG1_PF_FS },
+    { 1, { P_GS }, BS3CG1_PF_GS },
+    { 1, { P_SS }, BS3CG1_PF_SS },
+    { 1, { P_LK }, BS3CG1_PF_LK },
+
+    { 2, { P_CS, P_OZ, }, BS3CG1_PF_CS | BS3CFG1_PF_OZ },
+    { 2, { P_DS, P_OZ, }, BS3CG1_PF_DS | BS3CFG1_PF_OZ },
+    { 2, { P_ES, P_OZ, }, BS3CG1_PF_ES | BS3CFG1_PF_OZ },
+    { 2, { P_FS, P_OZ, }, BS3CG1_PF_FS | BS3CFG1_PF_OZ },
+    { 2, { P_GS, P_OZ, }, BS3CG1_PF_GS | BS3CFG1_PF_OZ },
+    { 2, { P_GS, P_OZ, }, BS3CG1_PF_SS | BS3CFG1_PF_OZ },
+    { 2, { P_SS, P_OZ, }, BS3CG1_PF_SS | BS3CFG1_PF_OZ },
+
+    { 2, { P_OZ, P_CS, }, BS3CG1_PF_CS | BS3CFG1_PF_OZ },
+    { 2, { P_OZ, P_DS, }, BS3CG1_PF_DS | BS3CFG1_PF_OZ },
+    { 2, { P_OZ, P_ES, }, BS3CG1_PF_ES | BS3CFG1_PF_OZ },
+    { 2, { P_OZ, P_FS, }, BS3CG1_PF_FS | BS3CFG1_PF_OZ },
+    { 2, { P_OZ, P_GS, }, BS3CG1_PF_GS | BS3CFG1_PF_OZ },
+    { 2, { P_OZ, P_GS, }, BS3CG1_PF_SS | BS3CFG1_PF_OZ },
+    { 2, { P_OZ, P_SS, }, BS3CG1_PF_SS | BS3CFG1_PF_OZ },
+};
+
+static const uint16_t g_afPfxKindToIgnoredFlags[BS3CGPFXKIND_END] =
+{
+    /* [BS3CGPFXKIND_INVALID] = */              UINT16_MAX,
+    /* [BS3CGPFXKIND_MODRM] = */                0,
+    /* [BS3CGPFXKIND_MODRM_NO_OP_SIZES] = */    BS3CG1_PF_OZ | BS3CG1_PF_W,
+};
+
+#endif
+
+
+DECLINLINE(void) Bs3Cg1InsertOpcodes(PBS3CG1STATE pThis, unsigned offDst)
+{
+    switch (pThis->cbOpcodes)
+    {
+        case 4: pThis->abCurInstr[offDst + 3] = pThis->abOpcodes[3];
+        case 3: pThis->abCurInstr[offDst + 2] = pThis->abOpcodes[2];
+        case 2: pThis->abCurInstr[offDst + 1] = pThis->abOpcodes[1];
+        case 1: pThis->abCurInstr[offDst]     = pThis->abOpcodes[0];
+            return;
+
+        default:
+            BS3_ASSERT(0);
+    }
+}
+
+
+static bool Bs3Cg1EncodeNext(PBS3CG1STATE pThis, unsigned iEncoding)
+{
+    bool fDone = false;
+    switch (pThis->enmEncoding)
+    {
+        case BS3CG1ENC_MODRM_Eb_Gb:
+            //Bs3CgiInsertOpcodes(pThis, 0);
+            //This.aenmOperands[0]
+
+            break;
+
+        case BS3CG1ENC_MODRM_Ev_Gv:
+        case BS3CG1ENC_FIXED_AL_Ib:
+        case BS3CG1ENC_FIXED_rAX_Iz:
+            fDone = true;
+            break;
+
+        case BS3CG1ENC_END: case BS3CG1ENC_INVALID: /* Impossible; to shut up gcc. */ fDone = true; break;
+    }
+
+
+    return false;
+}
+
+
+BS3_DECL_FAR(uint8_t) BS3_CMN_NM(Bs3Cg1Worker)(uint8_t bMode)
 {
     BS3CG1STATE         This;
@@ -131,8 +293,9 @@
     Bs3MemSet(&This, 0, sizeof(This));
 
-    This.bMode          = bMode;
-    This.pchMnemonic    = g_achBs3Cg1Mnemonics;
-    This.pabOperands    = g_abBs3Cg1Operands;
-    This.pabOpcodes     = g_abBs3Cg1Opcodes;
+    This.bMode              = bMode;
+    This.pchMnemonic        = g_achBs3Cg1Mnemonics;
+    This.pabOperands        = g_abBs3Cg1Operands;
+    This.pabOpcodes         = g_abBs3Cg1Opcodes;
+    This.fAdvanceMnemonic   = 1;
 
     /* Allocate guarded exectuable and data memory. */
@@ -181,5 +344,5 @@
          This.pchMnemonic += This.fAdvanceMnemonic * This.cchMnemonic,
          This.pabOperands += This.cOperands,
-         This.pabOpcodes  += This.cbOpcode )
+         This.pabOpcodes  += This.cbOpcodes)
     {
         unsigned iEncoding;
@@ -194,7 +357,9 @@
         This.enmEncoding     = (BS3CG1ENC)pInstr->enmEncoding;
         This.cchMnemonic     = pInstr->cchMnemonic;
-        This.fAdvanceMnemonic= pInstr->fAdvanceMnemonic;
+        if (This.fAdvanceMnemonic)
+            Bs3TestSubF("%.*s", This.cchMnemonic, This.pchMnemonic);
+        This.fAdvanceMnemonic = pInstr->fAdvanceMnemonic;
         This.cOperands       = pInstr->cOperands;
-        This.cbOpcode        = pInstr->cbOpcode;
+        This.cbOpcodes       = pInstr->cbOpcodes;
         switch (This.cOperands)
         {
@@ -205,5 +370,5 @@
         }
 
-        switch (This.cbOpcode)
+        switch (This.cbOpcodes)
         {
             case 3: This.abOpcodes[3] = This.pabOpcodes[3];
@@ -213,9 +378,22 @@
         }
 
-        if (This.enmEncoding <= BS3CG1ENC_INVALID || This.enmEncoding >= BS3CG1ENC_END)
-        {
-            Bs3TestFailedF("Invalid enmEncoding for instruction #%u (%.*s): %d",
-                           iInstr, This.cchMnemonic, This.pchMnemonic, This.enmEncoding);
-            continue;
+        /*
+         * Prep the operands and encoding handling.
+         */
+        switch (This.enmEncoding)
+        {
+            case BS3CG1ENC_MODRM_Eb_Gb:
+                break;
+            case BS3CG1ENC_MODRM_Ev_Gv:
+                break;
+            case BS3CG1ENC_FIXED_AL_Ib:
+                break;
+            case BS3CG1ENC_FIXED_rAX_Iz:
+                break;
+
+            default:
+                Bs3TestFailedF("Invalid enmEncoding for instruction #%u (%.*s): %d",
+                               iInstr, This.cchMnemonic, This.pchMnemonic, This.enmEncoding);
+                continue;
         }
 
@@ -225,9 +403,9 @@
         for (iEncoding = 0; ; iEncoding++)
         {
-            //switch (This.enmEncoding)
-            //{
-            //
-            //}
-
+            /*
+             * Encode the next instruction variation.
+             */
+            if (Bs3Cg1EncodeNext(&This, iEncoding)) { /* likely*/ }
+            else break;
 
             /*
@@ -235,4 +413,5 @@
              */
 
+
         }
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.c	(revision 65958)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.c	(revision 65959)
@@ -36,4 +36,5 @@
 *   Internal Functions                                                                                                           *
 *********************************************************************************************************************************/
+BS3TESTMODE_PROTOTYPES_CMN(Bs3Cg1Worker);
 
 
@@ -41,7 +42,8 @@
 *   Global Variables                                                                                                             *
 *********************************************************************************************************************************/
-
-
-
+static const BS3TESTMODEENTRY g_aModeTest[] =
+{
+    BS3TESTMODEENTRY_CMN(NULL, Bs3Cg1Worker),
+};
 
 
@@ -51,4 +53,5 @@
     Bs3TestInit("bs3-cpu-generated-1");
 
+    Bs3TestDoModes_rm(g_aModeTest, RT_ELEMENTS(g_aModeTest));
 
     Bs3TestTerm();
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.h
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.h	(revision 65958)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1.h	(revision 65959)
@@ -48,4 +48,10 @@
     BS3CG1OP_Gv,
 
+    BS3CG1OP_Ib,
+    BS3CG1OP_Iz,
+
+    BS3CG1OP_AL,
+    BS3CG1OP_rAX,
+
     BS3CG1OP_END
 } BS3CG1OP;
@@ -64,11 +70,10 @@
     BS3CG1ENC_INVALID = 0,
 
-    BS3CG1ENC_FIXED_Iz,
-    BS3CG1ENC_FIXED_FIRST = BS3CG1ENC_FIXED_Iz,
-    BS3CG1ENC_FIXED_Iv,
-
     BS3CG1ENC_MODRM_Eb_Gb,
     BS3CG1ENC_MODRM_Ev_Gv,
 
+    BS3CG1ENC_FIXED_AL_Ib,
+    BS3CG1ENC_FIXED_rAX_Iz,
+
     BS3CG1ENC_END
 } BS3CG1ENC;
@@ -76,4 +81,18 @@
 
 /**
+ * Prefix sensitivitiy kind.
+ */
+typedef enum BS3CGPFXKIND
+{
+    BS3CGPFXKIND_INVALID = 0,
+
+    BS3CGPFXKIND_MODRM,
+    BS3CGPFXKIND_MODRM_NO_OP_SIZES,
+
+    BS3CGPFXKIND_END
+} BS3CGPFXKIND;
+
+
+/**
  * Generated instruction info.
  */
@@ -81,5 +100,5 @@
 {
     /** The opcode size.   */
-    uint32_t    cbOpcode : 2;
+    uint32_t    cbOpcodes : 2;
     /** The number of operands.   */
     uint32_t    cOperands : 2;
@@ -92,6 +111,8 @@
     /** BS3CG1ENC values. */
     uint32_t    enmEncoding : 10;
-    /** BS3CG1ENC values. */
-    uint32_t    uUnused : 22;
+    /** BS3CGPFXKIND values. */
+    uint32_t    enmPrefixKind : 4;
+    /** Currently unused bits. */
+    uint32_t    uUnused : 18;
     /** BS3CG1INSTR_F_XXX. */
     uint32_t    fFlags;
@@ -104,5 +125,6 @@
 /** @name BS3CG1INSTR_F_XXX
  * @{ */
-#define BS3CG1INSTR_F_          UINT32_C(0x00000000)
+/** Defaults to SS rather than DS. */
+#define BS3CG1INSTR_F_DEF_SS            UINT32_C(0x00000001)
 /** @} */
 
@@ -331,5 +353,5 @@
 /** The opcodes (generated).
  * Variable length sequence of opcode bytes that runs in parallel to
- * g_aBs3Cg1Instructions, advancing by BS3CG1INSTR::cbOpcode each time. */
+ * g_aBs3Cg1Instructions, advancing by BS3CG1INSTR::cbOpcodes each time. */
 extern const uint8_t BS3_FAR_DATA       g_abBs3Cg1Opcodes[];
 /** The operands (generated).
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c	(revision 65958)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-mode-TestDoModes.c	(revision 65959)
@@ -206,5 +206,7 @@
         bool        fSkipped  = true;
         uint8_t     bErrNo;
-        Bs3TestSub(paEntries[i].pszSubTest);
+
+        if (paEntries[i].pszSubTest != NULL)
+            Bs3TestSub(paEntries[i].pszSubTest);
 
 #define PRE_DO_CALL(a_szModeName) do { if (fVerbose) Bs3TestPrintf("...%s\n", a_szModeName); } while (0)
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h	(revision 65958)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h	(revision 65959)
@@ -3038,4 +3038,5 @@
 typedef struct BS3TESTMODEENTRY
 {
+    /** The sub-test name to be passed to Bs3TestSub if not NULL. */
     const char * BS3_FAR    pszSubTest;
 
