Imported from /home/lorry/working-area/delta_VirtualBox/VirtualBox-4.3.10.tar.bz2.HEADVirtualBox-4.3.10master

1 files changed, 391 insertions, 30 deletions

diff --git a/src/VBox/VMM/VMMR3/VMMTests.cpp b/src/VBox/VMM/VMMR3/VMMTests.cpp
index 35616107..066c3c31 100644
--- a/src/VBox/VMM/VMMR3/VMMTests.cpp
+++ b/src/VBox/VMM/VMMR3/VMMTests.cpp
@@ -4,7 +4,7 @@
  */
 
 /*
- * Copyright (C) 2006-2007 Oracle Corporation
+ * Copyright (C) 2006-2013 Oracle Corporation
  *
  * This file is part of VirtualBox Open Source Edition (OSE), as
  * available from http://www.virtualbox.org. This file is free software;
@@ -26,6 +26,7 @@
 #include <VBox/vmm/pdmapi.h>
 #include <VBox/vmm/cpum.h>
 #include <VBox/dbg.h>
+#include <VBox/vmm/hm.h>
 #include <VBox/vmm/mm.h>
 #include <VBox/vmm/trpm.h>
 #include <VBox/vmm/selm.h>
@@ -33,7 +34,6 @@
 #include <VBox/vmm/vm.h>
 #include <VBox/err.h>
 #include <VBox/param.h>
-#include <VBox/vmm/hwaccm.h>
 
 #include <iprt/assert.h>
 #include <iprt/asm.h>
@@ -50,6 +50,139 @@ static void vmmR3TestClearStack(PVMCPU pVCpu)
 }
 
 
+#ifdef VBOX_WITH_RAW_MODE
+
+static int vmmR3ReportMsrRange(PVM pVM, uint32_t uMsr, uint64_t cMsrs, PRTSTREAM pReportStrm, uint32_t *pcMsrsFound)
+{
+    /*
+     * Preps.
+     */
+    RTRCPTR RCPtrEP;
+    int rc = PDMR3LdrGetSymbolRC(pVM, VMMGC_MAIN_MODULE_NAME, "VMMRCTestReadMsrs", &RCPtrEP);
+    AssertMsgRCReturn(rc, ("Failed to resolved VMMRC.rc::VMMRCEntry(), rc=%Rrc\n", rc), rc);
+
+    uint32_t const      cMsrsPerCall = 16384;
+    uint32_t            cbResults = cMsrsPerCall * sizeof(VMMTESTMSRENTRY);
+    PVMMTESTMSRENTRY    paResults;
+    rc = MMHyperAlloc(pVM, cbResults, 0, MM_TAG_VMM, (void **)&paResults);
+    AssertMsgRCReturn(rc, ("Error allocating %#x bytes off the hyper heap: %Rrc\n", cbResults, rc), rc);
+    /*
+     * The loop.
+     */
+    RTRCPTR  RCPtrResults = MMHyperR3ToRC(pVM, paResults);
+    uint32_t cMsrsFound   = 0;
+    uint32_t uLastMsr     = uMsr;
+    uint64_t uNsTsStart   = RTTimeNanoTS();
+
+    for (;;)
+    {
+        if (   pReportStrm
+            && uMsr - uLastMsr > _64K
+            && (uMsr & (_4M - 1)) == 0)
+        {
+            if (uMsr - uLastMsr < 16U*_1M)
+                RTStrmFlush(pReportStrm);
+            RTPrintf("... %#010x [%u ns/msr] ...\n", uMsr, (RTTimeNanoTS() - uNsTsStart) / uMsr);
+        }
+
+        /*RT_BZERO(paResults, cbResults);*/
+        uint32_t const cBatch = RT_MIN(cMsrsPerCall, cMsrs);
+        rc = VMMR3CallRC(pVM, RCPtrEP, 4, pVM->pVMRC, uMsr, cBatch, RCPtrResults);
+        if (RT_FAILURE(rc))
+        {
+            RTPrintf("VMM: VMMR3CallRC failed rc=%Rrc, uMsr=%#x\n", rc, uMsr);
+            break;
+        }
+
+        for (uint32_t i = 0; i < cBatch; i++)
+            if (paResults[i].uMsr != UINT64_MAX)
+            {
+                if (paResults[i].uValue == 0)
+                {
+                    if (pReportStrm)
+                        RTStrmPrintf(pReportStrm,
+                                     "    MVO(%#010llx, \"MSR\", UINT64_C(%#018llx)),\n", paResults[i].uMsr, paResults[i].uValue);
+                    RTPrintf("%#010llx = 0\n", paResults[i].uMsr);
+                }
+                else
+                {
+                    if (pReportStrm)
+                        RTStrmPrintf(pReportStrm,
+                                     "    MVO(%#010llx, \"MSR\", UINT64_C(%#018llx)),\n", paResults[i].uMsr, paResults[i].uValue);
+                    RTPrintf("%#010llx = %#010x`%08x\n", paResults[i].uMsr,
+                             (uint32_t)(paResults[i].uValue >> 32), (uint32_t)paResults[i].uValue);
+                }
+                cMsrsFound++;
+                uLastMsr = paResults[i].uMsr;
+            }
+
+        /* Advance. */
+        if (cMsrs <= cMsrsPerCall)
+            break;
+        cMsrs -= cMsrsPerCall;
+        uMsr  += cMsrsPerCall;
+    }
+
+    *pcMsrsFound += cMsrsFound;
+    MMHyperFree(pVM, paResults);
+    return rc;
+}
+
+
+/**
+ * Produces a quick report of MSRs.
+ *
+ * @returns VBox status code.
+ * @param   pVM             Pointer to the cross context VM structure.
+ * @param   pReportStrm     Pointer to the report output stream. Optional.
+ * @param   fWithCpuId      Whether CPUID should be included.
+ */
+static int vmmR3DoMsrQuickReport(PVM pVM, PRTSTREAM pReportStrm, bool fWithCpuId)
+{
+    uint64_t uTsStart = RTTimeNanoTS();
+    RTPrintf("=== MSR Quick Report Start ===\n");
+    RTStrmFlush(g_pStdOut);
+    if (fWithCpuId)
+    {
+        DBGFR3InfoStdErr(pVM->pUVM, "cpuid", "verbose");
+        RTPrintf("\n");
+    }
+    if (pReportStrm)
+        RTStrmPrintf(pReportStrm, "\n\n{\n");
+
+    static struct { uint32_t uFirst, cMsrs; } const s_aRanges[] =
+    {
+        { 0x00000000, 0x00042000 },
+        { 0x10000000, 0x00001000 },
+        { 0x20000000, 0x00001000 },
+        { 0x40000000, 0x00012000 },
+        { 0x80000000, 0x00012000 },
+//   Need 0xc0000000..0xc001106f (at least), but trouble on solaris w/ 10h and 0fh family cpus:
+//      { 0xc0000000, 0x00022000 },
+        { 0xc0000000, 0x00010000 },
+        { 0xc0010000, 0x00001040 },
+        { 0xc0011040, 0x00004040 }, /* should cause trouble... */
+    };
+    uint32_t cMsrsFound = 0;
+    int rc = VINF_SUCCESS;
+    for (unsigned i = 0; i < RT_ELEMENTS(s_aRanges) && RT_SUCCESS(rc); i++)
+    {
+//if (i >= 3)
+//{
+//RTStrmFlush(g_pStdOut);
+//RTThreadSleep(40);
+//}
+        rc = vmmR3ReportMsrRange(pVM, s_aRanges[i].uFirst, s_aRanges[i].cMsrs, pReportStrm, &cMsrsFound);
+    }
+
+    if (pReportStrm)
+        RTStrmPrintf(pReportStrm, "}; /* %u (%#x) MSRs; rc=%Rrc */\n", cMsrsFound, cMsrsFound, rc);
+    RTPrintf("Total %u (%#x) MSRs\n", cMsrsFound, cMsrsFound);
+    RTPrintf("=== MSR Quick Report End (rc=%Rrc, %'llu ns) ===\n", rc, RTTimeNanoTS() - uTsStart);
+    return rc;
+}
+
+
 /**
  * Performs a testcase.
  *
@@ -67,6 +200,7 @@ static int vmmR3DoGCTest(PVM pVM, VMMGCOPERATION enmTestcase, unsigned uVariatio
     if (RT_FAILURE(rc))
         return rc;
 
+    Log(("vmmR3DoGCTest: %d %#x\n", enmTestcase, uVariation));
     CPUMSetHyperState(pVCpu, pVM->vmm.s.pfnCallTrampolineRC, pVCpu->vmm.s.pbEMTStackBottomRC, 0, 0);
     vmmR3TestClearStack(pVCpu);
     CPUMPushHyper(pVCpu, uVariation);
@@ -76,6 +210,23 @@ static int vmmR3DoGCTest(PVM pVM, VMMGCOPERATION enmTestcase, unsigned uVariatio
     CPUMPushHyper(pVCpu, RCPtrEP);                /* what to call */
     Assert(CPUMGetHyperCR3(pVCpu) && CPUMGetHyperCR3(pVCpu) == PGMGetHyperCR3(pVCpu));
     rc = SUPR3CallVMMR0Fast(pVM->pVMR0, VMMR0_DO_RAW_RUN, 0);
+
+#if 1
+    /* flush the raw-mode logs. */
+# ifdef LOG_ENABLED
+    PRTLOGGERRC pLogger = pVM->vmm.s.pRCLoggerR3;
+    if (   pLogger
+        && pLogger->offScratch > 0)
+        RTLogFlushRC(NULL, pLogger);
+# endif
+# ifdef VBOX_WITH_RC_RELEASE_LOGGING
+    PRTLOGGERRC pRelLogger = pVM->vmm.s.pRCRelLoggerR3;
+    if (RT_UNLIKELY(pRelLogger && pRelLogger->offScratch > 0))
+        RTLogFlushRC(RTLogRelDefaultInstance(), pRelLogger);
+# endif
+#endif
+
+    Log(("vmmR3DoGCTest: rc=%Rrc iLastGZRc=%Rrc\n", rc, pVCpu->vmm.s.iLastGZRc));
     if (RT_LIKELY(rc == VINF_SUCCESS))
         rc = pVCpu->vmm.s.iLastGZRc;
     return rc;
@@ -176,23 +327,28 @@ static int vmmR3DoTrapTest(PVM pVM, uint8_t u8Trap, unsigned uVariation, int rcE
     return rc;
 }
 
+#endif /* VBOX_WITH_RAW_MODE */
+
 
 /* execute the switch. */
 VMMR3DECL(int) VMMDoTest(PVM pVM)
 {
-#if 1
+    int rc = VINF_SUCCESS;
+
+#ifdef VBOX_WITH_RAW_MODE
     PVMCPU pVCpu = &pVM->aCpus[0];
+    PUVM   pUVM  = pVM->pUVM;
 
-#ifdef NO_SUPCALLR0VMM
+# ifdef NO_SUPCALLR0VMM
     RTPrintf("NO_SUPCALLR0VMM\n");
-    return VINF_SUCCESS;
-#endif
+    return rc;
+# endif
 
     /*
      * Setup stack for calling VMMGCEntry().
      */
     RTRCPTR RCPtrEP;
-    int rc = PDMR3LdrGetSymbolRC(pVM, VMMGC_MAIN_MODULE_NAME, "VMMGCEntry", &RCPtrEP);
+    rc = PDMR3LdrGetSymbolRC(pVM, VMMGC_MAIN_MODULE_NAME, "VMMGCEntry", &RCPtrEP);
     if (RT_SUCCESS(rc))
     {
         RTPrintf("VMM: VMMGCEntry=%RRv\n", RCPtrEP);
@@ -203,20 +359,20 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
         vmmR3DoTrapTest(pVM, 0x3, 0, VINF_EM_DBG_HYPER_ASSERTION,  0xf0f0f0f0, "vmmGCTestTrap3_FaultEIP", "int3");
         vmmR3DoTrapTest(pVM, 0x3, 1, VINF_EM_DBG_HYPER_ASSERTION,  0xf0f0f0f0, "vmmGCTestTrap3_FaultEIP", "int3 WP");
 
-#if defined(DEBUG_bird) /* guess most people would like to skip these since they write to com1. */
+# if 0//defined(DEBUG_bird) /* guess most people would like to skip these since they write to com1. */
         vmmR3DoTrapTest(pVM, 0x8, 0, VERR_TRPM_PANIC,       0x00000000, "vmmGCTestTrap8_FaultEIP", "#DF [#PG]");
         SELMR3Relocate(pVM); /* this resets the busy flag of the Trap 08 TSS */
         bool f;
         rc = CFGMR3QueryBool(CFGMR3GetRoot(pVM), "DoubleFault", &f);
-#if !defined(DEBUG_bird)
+# if !defined(DEBUG_bird)
         if (RT_SUCCESS(rc) && f)
-#endif
+# endif
         {
             /* see triple fault warnings in SELM and VMMGC.cpp. */
             vmmR3DoTrapTest(pVM, 0x8, 1, VERR_TRPM_PANIC,       0x00000000, "vmmGCTestTrap8_FaultEIP", "#DF [#PG] WP");
             SELMR3Relocate(pVM); /* this resets the busy flag of the Trap 08 TSS */
         }
-#endif
+# endif
 
         vmmR3DoTrapTest(pVM, 0xd, 0, VERR_TRPM_DONT_PANIC,  0xf0f0f0f0, "vmmGCTestTrap0d_FaultEIP", "ltr #GP");
         ///@todo find a better \#GP case, on intel ltr will \#PF (busy update?) and not \#GP.
@@ -238,34 +394,34 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
         if (rc != VINF_SUCCESS)
         {
             RTPrintf("VMM: Nop test failed, rc=%Rrc not VINF_SUCCESS\n", rc);
-            return rc;
+            return RT_FAILURE(rc) ? rc : VERR_IPE_UNEXPECTED_INFO_STATUS;
         }
 
         /* a harmless breakpoint */
         RTPrintf("VMM: testing hardware bp at 0x10000 (not hit)\n");
         DBGFADDRESS Addr;
-        DBGFR3AddrFromFlat(pVM, &Addr, 0x10000);
+        DBGFR3AddrFromFlat(pUVM, &Addr, 0x10000);
         RTUINT iBp0;
-        rc = DBGFR3BpSetReg(pVM, &Addr, 0,  ~(uint64_t)0, X86_DR7_RW_EO, 1, &iBp0);
+        rc = DBGFR3BpSetReg(pUVM, &Addr, 0,  ~(uint64_t)0, X86_DR7_RW_EO, 1, &iBp0);
         AssertReleaseRC(rc);
         rc = vmmR3DoGCTest(pVM, VMMGC_DO_TESTCASE_NOP, 0);
         if (rc != VINF_SUCCESS)
         {
             RTPrintf("VMM: DR0=0x10000 test failed with rc=%Rrc!\n", rc);
-            return rc;
+            return RT_FAILURE(rc) ? rc : VERR_IPE_UNEXPECTED_INFO_STATUS;
         }
 
         /* a bad one at VMMGCEntry */
         RTPrintf("VMM: testing hardware bp at VMMGCEntry (hit)\n");
-        DBGFR3AddrFromFlat(pVM, &Addr, RCPtrEP);
+        DBGFR3AddrFromFlat(pUVM, &Addr, RCPtrEP);
         RTUINT iBp1;
-        rc = DBGFR3BpSetReg(pVM, &Addr, 0,  ~(uint64_t)0, X86_DR7_RW_EO, 1, &iBp1);
+        rc = DBGFR3BpSetReg(pUVM, &Addr, 0,  ~(uint64_t)0, X86_DR7_RW_EO, 1, &iBp1);
         AssertReleaseRC(rc);
         rc = vmmR3DoGCTest(pVM, VMMGC_DO_TESTCASE_NOP, 0);
         if (rc != VINF_EM_DBG_HYPER_BREAKPOINT)
         {
             RTPrintf("VMM: DR1=VMMGCEntry test failed with rc=%Rrc! expected VINF_EM_RAW_BREAKPOINT_HYPER\n", rc);
-            return rc;
+            return RT_FAILURE(rc) ? rc : VERR_IPE_UNEXPECTED_INFO_STATUS;
         }
 
         /* resume the breakpoint */
@@ -275,7 +431,7 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
         if (rc != VINF_SUCCESS)
         {
             RTPrintf("VMM: failed to resume on hyper breakpoint, rc=%Rrc = KNOWN BUG\n", rc); /** @todo fix VMMR3ResumeHyper */
-            return rc;
+            return RT_FAILURE(rc) ? rc : VERR_IPE_UNEXPECTED_INFO_STATUS;
         }
 
         /* engage the breakpoint again and try single stepping. */
@@ -284,7 +440,7 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
         if (rc != VINF_EM_DBG_HYPER_BREAKPOINT)
         {
             RTPrintf("VMM: DR1=VMMGCEntry test failed with rc=%Rrc! expected VINF_EM_RAW_BREAKPOINT_HYPER\n", rc);
-            return rc;
+            return RT_FAILURE(rc) ? rc : VERR_IPE_UNEXPECTED_INFO_STATUS;
         }
 
         RTGCUINTREG OldPc = CPUMGetHyperEIP(pVCpu);
@@ -297,7 +453,7 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
             if (rc != VINF_EM_DBG_HYPER_STEPPED)
             {
                 RTPrintf("\nVMM: failed to step on hyper breakpoint, rc=%Rrc\n", rc);
-                return rc;
+                return RT_FAILURE(rc) ? rc : VERR_IPE_UNEXPECTED_INFO_STATUS;
             }
             RTGCUINTREG Pc = CPUMGetHyperEIP(pVCpu);
             RTPrintf("%RGr=>", Pc);
@@ -311,8 +467,8 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
         RTPrintf("ok\n");
 
         /* done, clear it */
-        if (    RT_FAILURE(DBGFR3BpClear(pVM, iBp0))
-            ||  RT_FAILURE(DBGFR3BpClear(pVM, iBp1)))
+        if (    RT_FAILURE(DBGFR3BpClear(pUVM, iBp0))
+            ||  RT_FAILURE(DBGFR3BpClear(pUVM, iBp1)))
         {
             RTPrintf("VMM: Failed to clear breakpoints!\n");
             return VERR_GENERAL_FAILURE;
@@ -321,11 +477,11 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
         if (rc != VINF_SUCCESS)
         {
             RTPrintf("VMM: NOP failed, rc=%Rrc\n", rc);
-            return rc;
+            return RT_FAILURE(rc) ? rc : VERR_IPE_UNEXPECTED_INFO_STATUS;
         }
 
         /*
-         * Interrupt masking.
+         * Interrupt masking.  Failure may indiate NMI watchdog activity.
          */
         RTPrintf("VMM: interrupt masking...\n"); RTStrmFlush(g_pStdOut); RTThreadSleep(250);
         for (i = 0; i < 10000; i++)
@@ -335,7 +491,7 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
             if (rc != VINF_SUCCESS)
             {
                 RTPrintf("VMM: Interrupt masking failed: rc=%Rrc\n", rc);
-                return rc;
+                return RT_FAILURE(rc) ? rc : VERR_IPE_UNEXPECTED_INFO_STATUS;
             }
             uint64_t Ticks = ASMReadTSC() - StartTick;
             if (Ticks < (SUPGetCpuHzFromGIP(g_pSUPGlobalInfoPage) / 10000))
@@ -442,6 +598,13 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
              i, Elapsed, cTicksElapsed, PerIteration, cTicksPerIteration, TickMin));
 
         rc = VINF_SUCCESS;
+
+#if 0  /* drop this for now as it causes trouble on AMDs (Opteron 2384 and possibly others). */
+        /*
+         * A quick MSR report.
+         */
+        vmmR3DoMsrQuickReport(pVM, NULL, true);
+#endif
     }
     else
         AssertMsgFailed(("Failed to resolved VMMGC.gc::VMMGCEntry(), rc=%Rrc\n", rc));
@@ -468,7 +631,7 @@ VMMR3DECL(int) VMMDoTest(PVM pVM)
         }
 
 /* execute the switch. */
-VMMR3DECL(int) VMMDoHwAccmTest(PVM pVM)
+VMMR3DECL(int) VMMDoHmTest(PVM pVM)
 {
     uint32_t i;
     int      rc;
@@ -476,17 +639,19 @@ VMMR3DECL(int) VMMDoHwAccmTest(PVM pVM)
     RTGCPHYS CR3Phys = 0x0; /* fake address */
     PVMCPU   pVCpu = &pVM->aCpus[0];
 
-    if (!HWACCMR3IsAllowed(pVM))
+    if (!HMIsEnabled(pVM))
     {
         RTPrintf("VMM: Hardware accelerated test not available!\n");
         return VERR_ACCESS_DENIED;
     }
 
+#ifdef VBOX_WITH_RAW_MODE
     /*
      * These forced actions are not necessary for the test and trigger breakpoints too.
      */
     VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TRPM_SYNC_IDT);
     VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_SELM_SYNC_TSS);
+#endif
 
     /* Enable mapping of the hypervisor into the shadow page table. */
     uint32_t cb;
@@ -541,7 +706,7 @@ VMMR3DECL(int) VMMDoHwAccmTest(PVM pVM)
         {
             CPUMSetHyperState(pVCpu, pVM->vmm.s.pfnCallTrampolineRC, pVCpu->vmm.s.pbEMTStackBottomRC, 0, 0);
             CPUMPushHyper(pVCpu, 0);
-            CPUMPushHyper(pVCpu, VMMGC_DO_TESTCASE_HWACCM_NOP);
+            CPUMPushHyper(pVCpu, VMMGC_DO_TESTCASE_HM_NOP);
             CPUMPushHyper(pVCpu, pVM->pVMRC);
             CPUMPushHyper(pVCpu, 3 * sizeof(RTRCPTR));    /* stack frame size */
             CPUMPushHyper(pVCpu, RCPtrEP);                /* what to call */
@@ -558,7 +723,7 @@ VMMR3DECL(int) VMMDoHwAccmTest(PVM pVM)
             VM_FF_CLEAR(pVM, VM_FF_TM_VIRTUAL_SYNC);
 
             uint64_t TickThisStart = ASMReadTSC();
-            rc = SUPR3CallVMMR0Fast(pVM->pVMR0, VMMR0_DO_HWACC_RUN, 0);
+            rc = SUPR3CallVMMR0Fast(pVM->pVMR0, VMMR0_DO_HM_RUN, 0);
             uint64_t TickThisElapsed = ASMReadTSC() - TickThisStart;
             if (RT_FAILURE(rc))
             {
@@ -590,3 +755,199 @@ VMMR3DECL(int) VMMDoHwAccmTest(PVM pVM)
     return rc;
 }
 
+
+#ifdef VBOX_WITH_RAW_MODE
+
+/**
+ * Used by VMMDoBruteForceMsrs to dump the CPUID info of the host CPU as a
+ * prefix to the MSR report.
+ */
+static DECLCALLBACK(void) vmmDoPrintfVToStream(PCDBGFINFOHLP pHlp, const char *pszFormat, va_list va)
+{
+    PRTSTREAM pOutStrm = ((PRTSTREAM *)pHlp)[-1];
+    RTStrmPrintfV(pOutStrm, pszFormat, va);
+}
+
+/**
+ * Used by VMMDoBruteForceMsrs to dump the CPUID info of the host CPU as a
+ * prefix to the MSR report.
+ */
+static DECLCALLBACK(void) vmmDoPrintfToStream(PCDBGFINFOHLP pHlp, const char *pszFormat, ...)
+{
+    va_list va;
+    va_start(va, pszFormat);
+    vmmDoPrintfVToStream(pHlp, pszFormat, va);
+    va_end(va);
+}
+
+#endif
+
+
+/**
+ * Uses raw-mode to query all possible MSRs on the real hardware.
+ *
+ * This generates a msr-report.txt file (appending, no overwriting) as well as
+ * writing the values and process to stdout.
+ *
+ * @returns VBox status code.
+ * @param   pVM         The VM handle.
+ */
+VMMR3DECL(int) VMMDoBruteForceMsrs(PVM pVM)
+{
+#ifdef VBOX_WITH_RAW_MODE
+    PRTSTREAM pOutStrm;
+    int rc = RTStrmOpen("msr-report.txt", "a", &pOutStrm);
+    if (RT_SUCCESS(rc))
+    {
+        /* Header */
+        struct
+        {
+            PRTSTREAM   pOutStrm;
+            DBGFINFOHLP Hlp;
+        } MyHlp = { pOutStrm, { vmmDoPrintfToStream, vmmDoPrintfVToStream } };
+        DBGFR3Info(pVM->pUVM, "cpuid", "verbose", &MyHlp.Hlp);
+        RTStrmPrintf(pOutStrm, "\n");
+
+        uint32_t cMsrsFound = 0;
+        vmmR3ReportMsrRange(pVM, 0, _4G, pOutStrm, &cMsrsFound);
+
+        RTStrmPrintf(pOutStrm, "Total %u (%#x) MSRs\n", cMsrsFound, cMsrsFound);
+        RTPrintf("Total %u (%#x) MSRs\n", cMsrsFound, cMsrsFound);
+
+        RTStrmClose(pOutStrm);
+    }
+    return rc;
+#else
+    return VERR_NOT_SUPPORTED;
+#endif
+}
+
+
+/**
+ * Uses raw-mode to query all known MSRS on the real hardware.
+ *
+ * This generates a known-msr-report.txt file (appending, no overwriting) as
+ * well as writing the values and process to stdout.
+ *
+ * @returns VBox status code.
+ * @param   pVM         The VM handle.
+ */
+VMMR3DECL(int) VMMDoKnownMsrs(PVM pVM)
+{
+#ifdef VBOX_WITH_RAW_MODE
+    PRTSTREAM pOutStrm;
+    int rc = RTStrmOpen("known-msr-report.txt", "a", &pOutStrm);
+    if (RT_SUCCESS(rc))
+    {
+        vmmR3DoMsrQuickReport(pVM, pOutStrm, false);
+        RTStrmClose(pOutStrm);
+    }
+    return rc;
+#else
+    return VERR_NOT_SUPPORTED;
+#endif
+}
+
+
+/**
+ * MSR experimentation.
+ *
+ * @returns VBox status code.
+ * @param   pVM         The VM handle.
+ */
+VMMR3DECL(int) VMMDoMsrExperiments(PVM pVM)
+{
+#ifdef VBOX_WITH_RAW_MODE
+    /*
+     * Preps.
+     */
+    RTRCPTR RCPtrEP;
+    int rc = PDMR3LdrGetSymbolRC(pVM, VMMGC_MAIN_MODULE_NAME, "VMMRCTestTestWriteMsr", &RCPtrEP);
+    AssertMsgRCReturn(rc, ("Failed to resolved VMMRC.rc::VMMRCEntry(), rc=%Rrc\n", rc), rc);
+
+    uint64_t *pauValues;
+    rc = MMHyperAlloc(pVM, 2 * sizeof(uint64_t), 0, MM_TAG_VMM, (void **)&pauValues);
+    AssertMsgRCReturn(rc, ("Error allocating %#x bytes off the hyper heap: %Rrc\n", 2 * sizeof(uint64_t), rc), rc);
+    RTRCPTR RCPtrValues = MMHyperR3ToRC(pVM, pauValues);
+
+    /*
+     * Do the experiments.
+     */
+    uint32_t uMsr   = 0x00000277;
+    uint64_t uValue = UINT64_C(0x0007010600070106);
+#if 0
+    uValue &= ~(RT_BIT_64(17) | RT_BIT_64(16) | RT_BIT_64(15) | RT_BIT_64(14) | RT_BIT_64(13));
+    uValue |= RT_BIT_64(13);
+    rc = VMMR3CallRC(pVM, RCPtrEP, 6, pVM->pVMRC, uMsr, RT_LODWORD(uValue), RT_HIDWORD(uValue),
+                     RCPtrValues, RCPtrValues + sizeof(uint64_t));
+    RTPrintf("uMsr=%#010x before=%#018llx written=%#018llx after=%#018llx rc=%Rrc\n",
+             uMsr, pauValues[0], uValue, pauValues[1], rc);
+#elif 1
+    const uint64_t uOrgValue = uValue;
+    uint32_t       cChanges = 0;
+    for (int iBit = 63; iBit >= 58; iBit--)
+    {
+        uValue = uOrgValue & ~RT_BIT_64(iBit);
+        rc = VMMR3CallRC(pVM, RCPtrEP, 6, pVM->pVMRC, uMsr, RT_LODWORD(uValue), RT_HIDWORD(uValue),
+                         RCPtrValues, RCPtrValues + sizeof(uint64_t));
+        RTPrintf("uMsr=%#010x before=%#018llx written=%#018llx after=%#018llx rc=%Rrc\nclear bit=%u -> %s\n",
+                 uMsr, pauValues[0], uValue, pauValues[1], rc, iBit,
+                 (pauValues[0] ^  pauValues[1]) & RT_BIT_64(iBit) ?  "changed" : "unchanged");
+        cChanges += RT_BOOL(pauValues[0] ^ pauValues[1]);
+
+        uValue = uOrgValue | RT_BIT_64(iBit);
+        rc = VMMR3CallRC(pVM, RCPtrEP, 6, pVM->pVMRC, uMsr, RT_LODWORD(uValue), RT_HIDWORD(uValue),
+                         RCPtrValues, RCPtrValues + sizeof(uint64_t));
+        RTPrintf("uMsr=%#010x before=%#018llx written=%#018llx after=%#018llx rc=%Rrc\nset   bit=%u -> %s\n",
+                 uMsr, pauValues[0], uValue, pauValues[1], rc, iBit,
+                 (pauValues[0] ^  pauValues[1]) & RT_BIT_64(iBit) ?  "changed" : "unchanged");
+        cChanges += RT_BOOL(pauValues[0] ^ pauValues[1]);
+    }
+    RTPrintf("%u change(s)\n", cChanges);
+#else
+    uint64_t fWriteable = 0;
+    for (uint32_t i = 0; i <= 63; i++)
+    {
+        uValue = RT_BIT_64(i);
+# if 0
+        if (uValue & (0x7))
+            continue;
+# endif
+        rc = VMMR3CallRC(pVM, RCPtrEP, 6, pVM->pVMRC, uMsr, RT_LODWORD(uValue), RT_HIDWORD(uValue),
+                         RCPtrValues, RCPtrValues + sizeof(uint64_t));
+        RTPrintf("uMsr=%#010x before=%#018llx written=%#018llx after=%#018llx rc=%Rrc\n",
+                 uMsr, pauValues[0], uValue, pauValues[1], rc);
+        if (RT_SUCCESS(rc))
+            fWriteable |= RT_BIT_64(i);
+    }
+
+    uValue = 0;
+    rc = VMMR3CallRC(pVM, RCPtrEP, 6, pVM->pVMRC, uMsr, RT_LODWORD(uValue), RT_HIDWORD(uValue),
+                     RCPtrValues, RCPtrValues + sizeof(uint64_t));
+    RTPrintf("uMsr=%#010x before=%#018llx written=%#018llx after=%#018llx rc=%Rrc\n",
+             uMsr, pauValues[0], uValue, pauValues[1], rc);
+
+    uValue = UINT64_MAX;
+    rc = VMMR3CallRC(pVM, RCPtrEP, 6, pVM->pVMRC, uMsr, RT_LODWORD(uValue), RT_HIDWORD(uValue),
+                     RCPtrValues, RCPtrValues + sizeof(uint64_t));
+    RTPrintf("uMsr=%#010x before=%#018llx written=%#018llx after=%#018llx rc=%Rrc\n",
+             uMsr, pauValues[0], uValue, pauValues[1], rc);
+
+    uValue = fWriteable;
+    rc = VMMR3CallRC(pVM, RCPtrEP, 6, pVM->pVMRC, uMsr, RT_LODWORD(uValue), RT_HIDWORD(uValue),
+                     RCPtrValues, RCPtrValues + sizeof(uint64_t));
+    RTPrintf("uMsr=%#010x before=%#018llx written=%#018llx after=%#018llx rc=%Rrc [fWriteable]\n",
+             uMsr, pauValues[0], uValue, pauValues[1], rc);
+
+#endif
+
+    /*
+     * Cleanups.
+     */
+    MMHyperFree(pVM, pauValues);
+    return rc;
+#else
+    return VERR_NOT_SUPPORTED;
+#endif
+}
+