Index: /trunk/include/VBox/VMMDevTesting.h
===================================================================
--- /trunk/include/VBox/VMMDevTesting.h	(revision 42584)
+++ /trunk/include/VBox/VMMDevTesting.h	(revision 42585)
@@ -79,4 +79,7 @@
 /** Report a failure, sending reason (zero terminated string). (RTTestSkipped) */
 #define VMMDEV_TESTING_CMD_SKIPPED      UINT32_C(0xcab1e006)
+/** Report a value found in a VMM register, sending a string on the form
+ * "value-name:register-name". */
+#define VMMDEV_TESTING_CMD_VALUE_REG    UINT32_C(0xcab1e007)
 /** @} */
 
Index: /trunk/include/VBox/VMMDevTesting.mac
===================================================================
--- /trunk/include/VBox/VMMDevTesting.mac	(revision 42584)
+++ /trunk/include/VBox/VMMDevTesting.mac	(revision 42585)
@@ -21,4 +21,5 @@
 %define VMMDEV_TESTING_CMD_VALUE        0xcab1e005
 %define VMMDEV_TESTING_CMD_SKIPPED      0xcab1e006
+%define VMMDEV_TESTING_CMD_VALUE_REG    0xcab1e007
 %define VMMDEV_TESTING_UNIT_PCT                 0x01
 %define VMMDEV_TESTING_UNIT_BYTES               0x02
Index: /trunk/include/VBox/err.mac
===================================================================
--- /trunk/include/VBox/err.mac	(revision 42584)
+++ /trunk/include/VBox/err.mac	(revision 42585)
@@ -208,4 +208,5 @@
 %define VERR_CPUM_RAISE_GP_0    (-1750)
 %define VERR_CPUM_INCOMPATIBLE_CONFIG    (-1751)
+%define VERR_CPUM_HIDDEN_CS_LOAD_ERROR    (-1752)
 %define VERR_SSM_UNIT_EXISTS    (-1800)
 %define VERR_SSM_UNIT_NOT_FOUND    (-1801)
Index: /trunk/include/iprt/x86.mac
===================================================================
--- /trunk/include/iprt/x86.mac	(revision 42584)
+++ /trunk/include/iprt/x86.mac	(revision 42585)
@@ -626,8 +626,10 @@
 %ifndef VBOX_FOR_DTRACE_LIB
 %endif
-%define X86_SEL_SHIFT       3
-%define X86_SEL_MASK        0xfff8
-%define X86_SEL_LDT         0x0004
-%define X86_SEL_RPL         0x0003
+%define X86_SEL_SHIFT           3
+%define X86_SEL_MASK            0xfff8
+%define X86_SEL_MASK_OFF_RPL    0xfffc
+%define X86_SEL_LDT             0x0004
+%define X86_SEL_RPL             0x0003
+%define X86_SEL_RPL_LDT         0x0007
 %define X86_TRAP_ERR_EXTERNAL       1
 %define X86_TRAP_ERR_IDT            2
Index: /trunk/src/VBox/Devices/VMMDev/VMMDevTesting.cpp
===================================================================
--- /trunk/src/VBox/Devices/VMMDev/VMMDevTesting.cpp	(revision 42584)
+++ /trunk/src/VBox/Devices/VMMDev/VMMDevTesting.cpp	(revision 42585)
@@ -2,4 +2,6 @@
 /** @file
  * VMMDev - Testing Extensions.
+ *
+ * To enable: VBoxManage setextradata vmname VBoxInternal/Devices/VMMDev/0/Config/TestingEnabled  1
  */
 
@@ -22,4 +24,5 @@
 #define LOG_GROUP LOG_GROUP_DEV_VMM
 #include <VBox/VMMDev.h>
+#include <VBox/vmm/vmapi.h>
 #include <VBox/log.h>
 #include <VBox/err.h>
@@ -111,4 +114,45 @@
 }
 
+#ifdef IN_RING3
+
+/**
+ * Executes the VMMDEV_TESTING_CMD_VALUE_REG command when the data is ready.
+ *
+ * @param   pDevIns             The PDM device instance.
+ * @param   pThis               The instance VMMDev data.
+ */
+static void vmmdevTestingCmdExec_ValueReg(PPDMDEVINS pDevIns, VMMDevState *pThis)
+{
+    char *pszRegNm = strchr(pThis->TestingData.String.sz, ':');
+    if (pszRegNm)
+    {
+        *pszRegNm++ = '\0';
+        pszRegNm = RTStrStrip(pszRegNm);
+    }
+    char        *pszValueNm = RTStrStrip(pThis->TestingData.String.sz);
+    size_t const cchValueNm = strlen(pszValueNm);
+    if (cchValueNm && pszRegNm && *pszRegNm)
+    {
+        PVM         pVM = PDMDevHlpGetVM(pDevIns);
+        VMCPUID     idCpu = VMMGetCpuId(pVM);
+        uint64_t    u64Value;
+        int rc2 = DBGFR3RegNmQueryU64(pVM, idCpu, pszRegNm, &u64Value);
+        if (RT_SUCCESS(rc2))
+        {
+            const char *pszWarn = rc2 == VINF_DBGF_TRUNCATED_REGISTER ? "truncated" : "";
+            VMMDEV_TESTING_OUTPUT(("testing: VALUE '%s'%*s: %'9llu (%#llx) [0] {reg=%s}\n",
+                                   pszValueNm,
+                                   (ssize_t)cchValueNm - 12 > 48 ? 0 : 48 - ((ssize_t)cchValueNm - 12), "",
+                                   u64Value, u64Value, pszRegNm, pszWarn));
+        }
+        else
+            VMMDEV_TESTING_OUTPUT(("testing: error querying register '%s' for value '%s': %Rrc\n",
+                                   pszRegNm, pszValueNm, rc2));
+    }
+    else
+        VMMDEV_TESTING_OUTPUT(("testing: malformed register value '%s'/'%s'\n", pszValueNm, pszRegNm));
+}
+
+#endif /* IN_RING3 */
 
 /**
@@ -121,4 +165,7 @@
     switch (Port)
     {
+        /*
+         * The NOP I/O ports are used for performance measurements.
+         */
         case VMMDEV_TESTING_IOPORT_NOP:
             switch (cb)
@@ -134,10 +181,12 @@
             return VINF_SUCCESS;
 
+        /* The timestamp I/O ports are read-only. */
         case VMMDEV_TESTING_IOPORT_TS_LOW:
-            break;
-
         case VMMDEV_TESTING_IOPORT_TS_HIGH:
             break;
 
+        /*
+         * The command port (DWORD write only).
+         */
         case VMMDEV_TESTING_IOPORT_CMD:
             if (cb == 4)
@@ -150,4 +199,7 @@
             break;
 
+        /*
+         * The data port.  Used of providing data for a command.
+         */
         case VMMDEV_TESTING_IOPORT_DATA:
         {
@@ -266,4 +318,28 @@
                     break;
 
+
+                /*
+                 * RTTestValue with the return from DBGFR3RegNmQuery.
+                 */
+                case VMMDEV_TESTING_CMD_VALUE_REG:
+                {
+                    if (   off < sizeof(pThis->TestingData.String.sz) - 1
+                        && cb == 1)
+                    {
+                        pThis->TestingData.String.sz[off] = u32;
+                        if (u32)
+                            pThis->offTestingData = off + 1;
+                        else
+#ifdef IN_RING3
+                            vmmdevTestingCmdExec_ValueReg(pDevIns, pThis);
+#else
+                            return VINF_IOM_R3_IOPORT_WRITE;
+#endif
+                        return VINF_SUCCESS;
+                    }
+                    break;
+
+                }
+
                 default:
                     break;
@@ -290,4 +366,7 @@
     switch (Port)
     {
+        /*
+         * The NOP I/O ports are used for performance measurements.
+         */
         case VMMDEV_TESTING_IOPORT_NOP:
             switch (cb)
@@ -304,4 +383,11 @@
             return VINF_SUCCESS;
 
+        /*
+         * The timestamp I/O ports are obviously used for getting a good fix
+         * on the current time (as seen by the host?).
+         *
+         * The high word is latched when reading the low, so reading low + high
+         * gives you a 64-bit timestamp value.
+         */
         case VMMDEV_TESTING_IOPORT_TS_LOW:
             if (cb == 4)
@@ -322,4 +408,7 @@
             break;
 
+        /*
+         * The command and data registers are write-only.
+         */
         case VMMDEV_TESTING_IOPORT_CMD:
         case VMMDEV_TESTING_IOPORT_DATA: