Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsOneByte.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsOneByte.cpp.h	(revision 66113)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsOneByte.cpp.h	(revision 66114)
@@ -52,5 +52,8 @@
  * @opstats     add_Eb_Gb
  * @opgroup     op_gen_arith_bin
- * @optest      op1=1 op2=1 -> op1=2 efl&|=nv,pl,nz,na,pe
+ * @optest              op1=1   op2=1   -> op1=2   efl&|=nv,pl,nz,na,pe,nc
+ * @optest      efl|=cf op1=1   op2=2   -> op1=3   efl&|=nv,pl,nz,na,po,nc
+ * @optest              op1=254 op2=1   -> op1=255 efl&|=nv,ng,nz,na,po,nc
+ * @optest              op1=128 op2=128 -> op1=0   efl&|=ov,pl,zf,na,po,cf
  */
 FNIEMOP_DEF(iemOp_add_Eb_Gb)
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsPython.py
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsPython.py	(revision 66113)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllInstructionsPython.py	(revision 66114)
@@ -579,4 +579,6 @@
             assert sHex[:2] == '0x';
             sHex = ''.join([self.kdHexInv[sDigit] for sDigit in sHex[2:]]);
+            if fSignExtend and sHex[0] not in [ '8', '9', 'a', 'b', 'c', 'd', 'e', 'f']:
+                sHex = 'f' + sHex;
 
         cDigits = len(sHex);
@@ -644,5 +646,5 @@
         aoSet = TestType.get(self, '0x%x' % (fSet,));
         if fClear != 0:
-            aoClear = TestType.get(self, '%#x' % (~fClear))
+            aoClear = TestType.get(self, '%#x' % (fClear,))
             assert self.isAndOrPair(sValue) is True;
             return (aoClear[0], aoSet[0]);
@@ -667,5 +669,5 @@
     ## Assigned operators.
     kasOperators = [
-        '&|=',  # Special AND+OR operator for use with EFLAGS.
+        '&|=',  # Special AND(INV)+OR operator for use with EFLAGS.
         '&~=',
         '&=',
@@ -951,4 +953,5 @@
         self.sRawIemOpFlags = None;
         self.sRawOldOpcodes = None;
+        self.asCopyTests    = [];
         ## @}
 
@@ -1059,4 +1062,7 @@
 g_aoAllInstructions = []; # type: Instruction
 
+## All the instructions indexed by statistics name (opstat).
+g_dAllInstructionsByStat = {}; # type: Instruction
+
 ## Instruction maps.
 g_dInstructionMaps = {
@@ -1188,4 +1194,5 @@
             '@opinvlstyle': self.parseTagOpUnusedInvalid,
             '@optest':      self.parseTagOpTest,
+            '@opcopytests': self.parseTagOpCopyTests,
             '@opstats':     self.parseTagOpStats,
             '@opfunction':  self.parseTagOpFunction,
@@ -1342,4 +1349,14 @@
         for oMap in oInstr.aoMaps:
             oMap.aoInstructions.append(oInstr);
+
+        #
+        # Check the opstat value and add it to the opstat indexed dictionary.
+        #
+        if oInstr.sStats:
+            if oInstr.sStats not in g_dAllInstructionsByStat:
+                g_dAllInstructionsByStat[oInstr.sStats] = oInstr;
+            else:
+                self.error('Duplicate opstat value "%s"\nnew: %s\nold: %s'
+                           % (oInstr.sStats, oInstr, g_dAllInstructionsByStat[oInstr.sStats],));
 
         #self.debug('%d..%d: %s; %d @op tags' % (oInstr.iLineCreated, oInstr.iLineCompleted, oInstr.sFunction, oInstr.cOpTags));
@@ -2058,4 +2075,33 @@
         return True;
 
+    def parseTagOpCopyTests(self, sTag, aasSections, iTagLine, iEndLine):
+        """
+        Tag:        \@opcopytests
+        Value:      <opstat value> [..]
+        Example:    \@opcopytests add_Eb_Gb
+
+        Trick to avoid duplicating tests for different encodings of the same
+        operation.
+        """
+        oInstr = self.ensureInstructionForOpTag(iTagLine);
+
+        # Flatten, validate and append the copy job to the instruction.  We execute
+        # them after parsing all the input so we can handle forward references.
+        asToCopy = self.flattenAllSections(aasSections).split();
+        if not asToCopy:
+            return self.errorComment(iTagLine, '%s: requires at least on reference value' % (sTag,));
+        for sToCopy in asToCopy:
+            if sToCopy not in oInstr.asCopyTests:
+                if self.oReStatsName.match(sToCopy):
+                    oInstr.asCopyTests.append(sToCopy);
+                else:
+                    self.errorComment(iTagLine, '%s: invalid instruction reference (opstat) "%s" (valid: %s)'
+                                                % (sTag, sToCopy, self.oReStatsName.pattern));
+            else:
+                self.errorComment(iTagLine, '%s: ignoring duplicate "%s"' % (sTag, sToCopy,));
+
+        _ = iEndLine;
+        return True;
+
     def parseTagOpFunction(self, sTag, aasSections, iTagLine, iEndLine):
         """
@@ -2611,4 +2657,27 @@
 
 
+def __doTestCopying():
+    """
+    Executes the asCopyTests instructions.
+    """
+    asErrors = [];
+    for oDstInstr in g_aoAllInstructions:
+        if oDstInstr.asCopyTests:
+            for sSrcInstr in oDstInstr.asCopyTests:
+                oSrcInstr = g_dAllInstructionsByStat.get(sSrcInstr, None);
+                if oSrcInstr and oSrcInstr != oDstInstr:
+                    oDstInstr.aoTests.extend(oSrcInstr.aoTests);
+                elif oSrcInstr:
+                    asErrors.append('%s:%s: error: @opcopytests reference "%s" matches the destination\n'
+                                    % ( oDstInstr.sSrcFile, oDstInstr.iLineCreated, sSrcInstr));
+                else:
+                    asErrors.append('%s:%s: error: @opcopytests reference "%s" not found\n'
+                                    % ( oDstInstr.sSrcFile, oDstInstr.iLineCreated, sSrcInstr));
+
+    if asErrors:
+        sys.stderr.write(u''.join(asErrors));
+    return len(asErrors);
+
+
 def __parseAll():
     """
@@ -2624,4 +2693,6 @@
     ]:
         cErrors += __parseFileByName(os.path.join(sSrcDir, sName), sDefaultMap);
+    cErrors += __doTestCopying();
+
 
     if cErrors != 0:
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-data.py
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-data.py	(revision 66113)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-data.py	(revision 66114)
@@ -149,5 +149,5 @@
             sOp = oOperation.sOp;
             if sOp == '&|=':
-                sOp = '|=' if len(aaoValues) == 1 else '&=';
+                sOp = '|=' if len(aaoValues) == 1 else '&~=';
 
             for fSignExtend, abValue in aaoValues:
@@ -432,6 +432,9 @@
             '{',
         ];
+        fAdvanceMnemonic = True;
         for oInstr in self.aoInstructions:
-            asLines.append('    \"%s\"' % (oInstr.oInstr.sMnemonic,));
+            if fAdvanceMnemonic:
+                asLines.append('    \"%s\"' % (oInstr.oInstr.sMnemonic,));
+            fAdvanceMnemonic = oInstr.fAdvanceMnemonic;
         asLines += [
             '};',
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c	(revision 66113)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-cpu-generated-1-template.c	(revision 66114)
@@ -999,6 +999,6 @@
             switch (cbDst)
             {
-                case 1:  BS3CG1_DPRINTF(("dbg:    --> %s: %#04RX32\n", g_aszBs3Cg1DstFields[idxField].sz, *PtrField.pu8));   break;
-                case 2:  BS3CG1_DPRINTF(("dbg:    --> %s: %#06RX32\n", g_aszBs3Cg1DstFields[idxField].sz, *PtrField.pu16));  break;
+                case 1:  BS3CG1_DPRINTF(("dbg:    --> %s: %#04RX8\n",   g_aszBs3Cg1DstFields[idxField].sz, *PtrField.pu8));  break;
+                case 2:  BS3CG1_DPRINTF(("dbg:    --> %s: %#06RX16\n",  g_aszBs3Cg1DstFields[idxField].sz, *PtrField.pu16)); break;
                 case 4:  BS3CG1_DPRINTF(("dbg:    --> %s: %#010RX32\n", g_aszBs3Cg1DstFields[idxField].sz, *PtrField.pu32)); break;
                 default: BS3CG1_DPRINTF(("dbg:    --> %s: %#018RX64\n", g_aszBs3Cg1DstFields[idxField].sz, *PtrField.pu64)); break;
@@ -1228,5 +1228,5 @@
                                     This.Ctx.cr2.u = This.uCodePgFlat + X86_PAGE_SIZE;
                                 This.Ctx.rflags.u32 &= ~X86_EFL_RF;
-                                This.Ctx.rflags.u32 |= X86_EFL_RF & This.TrapFrame.Ctx.rflags.u32;
+                                This.Ctx.rflags.u32 |= This.TrapFrame.Ctx.rflags.u32 & X86_EFL_RF;
                                 if (Bs3Cg1RunContextModifier(&This, &This.Ctx, pHdr,
                                                              pHdr->cbSelector + pHdr->cbInput, pHdr->cbOutput,
