Index: /trunk/src/VBox/ValidationKit/bootsectors/Makefile.kmk
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/Makefile.kmk	(revision 61384)
+++ /trunk/src/VBox/ValidationKit/bootsectors/Makefile.kmk	(revision 61385)
@@ -268,4 +268,5 @@
 	$$(bs3-fpustate-1_0_OUTDIR)/bs3kit/bs3-cmn-instantiate.o32 \
 	$$(bs3-fpustate-1_0_OUTDIR)/bs3kit/bs3-cmn-instantiate.o64 \
+	$$(bs3-fpustate-1_0_OUTDIR)/bs3-fpustate-1-asm.o16
 
 endif # VBOX_WITH_BS3KIT
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.c	(revision 61384)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.c	(revision 61385)
@@ -31,4 +31,5 @@
 #include <iprt/asm.h>
 #include <iprt/asm-amd64-x86.h>
+#include <VBox/VMMDevTesting.h>
 
 
@@ -40,12 +41,43 @@
 #ifdef BS3_INSTANTIATING_CMN
 
-///**
-// * Wrapper around Bs3TestFailedF that prefixes the error with g_usBs3TestStep
-// * and g_pszTestMode.
-// */
-//# define bs3CpuBasic2_FailedF BS3_CMN_NM(bs3CpuBasic2_FailedF)
-//BS3_DECL_NEAR(void) bs3CpuBasic2_FailedF(const char *pszFormat, ...)
-//{
-//}
+/**
+ * Displays the differences between the two states.
+ */
+# define bs3FpuState1_Diff BS3_CMN_NM(bs3FpuState1_Diff)
+BS3_DECL_NEAR(void) bs3FpuState1_Diff(X86FXSTATE const BS3_FAR *pExpected, X86FXSTATE const BS3_FAR *pChecking)
+{
+    unsigned i;
+
+# define CHECK(a_Member, a_Fmt) \
+        if (pExpected->a_Member != pChecking->a_Member) \
+            Bs3TestPrintf("  " #a_Member ": " a_Fmt ", expected " a_Fmt "\n", pChecking->a_Member, pExpected->a_Member); \
+        else do { } while (0)
+    CHECK(FCW,          "%#RX16");
+    CHECK(FSW,          "%#RX16");
+    CHECK(FTW,          "%#RX16");
+    CHECK(FOP,          "%#RX16");
+    CHECK(FPUIP,        "%#RX32");
+    CHECK(CS,           "%#RX16");
+    CHECK(Rsrvd1,       "%#RX16");
+    CHECK(FPUDP,        "%#RX32");
+    CHECK(DS,           "%#RX16");
+    CHECK(Rsrvd2,       "%#RX16");
+    CHECK(MXCSR,        "%#RX32");
+    CHECK(MXCSR_MASK,   "%#RX32");
+# undef CHECK
+    for (i = 0; i < RT_ELEMENTS(pExpected->aRegs); i++)
+        if (   pChecking->aRegs[i].au64[0] != pExpected->aRegs[i].au64[0]
+            || pChecking->aRegs[i].au64[1] != pExpected->aRegs[i].au64[1])
+            Bs3TestPrintf("st%u: %.16Rhxs\n"
+                          "exp: %.16Rhxs\n",
+                          &pChecking->aRegs[i], &pExpected->aRegs[i]);
+    for (i = 0; i < RT_ELEMENTS(pExpected->aXMM); i++)
+        if (   pChecking->aXMM[i].au64[0] != pExpected->aXMM[i].au64[0]
+            || pChecking->aXMM[i].au64[1] != pExpected->aXMM[i].au64[1])
+            Bs3TestPrintf("xmm%u: %.16Rhxs\n"
+                          " %sexp: %.16Rhxs\n",
+                          &pChecking->aRegs[i], &pExpected->aRegs[i], i >= 10 ? " " : "");
+}
+
 
 #endif /* BS3_INSTANTIATING_CMN */
@@ -61,11 +93,28 @@
   || TMPL_MODE == BS3_MODE_PP32 \
   || TMPL_MODE == BS3_MODE_PAE32 \
-  || TMPL_MODE == BS3_MODE_LM64
-//  || TMPL_MODE == BS3_MODE_RM
-
-BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_InitState)(X86FXSTATE BS3_FAR *pFxState);
+  || TMPL_MODE == BS3_MODE_LM64 \
+  || TMPL_MODE == BS3_MODE_RM
+
+/* Assembly helpers: */
+BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_InitState)(X86FXSTATE BS3_FAR *pFxState, void BS3_FAR *pvMmioReg);
 BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_Restore)(X86FXSTATE const BS3_FAR *pFxState);
 BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_Save)(X86FXSTATE BS3_FAR *pFxState);
 
+BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_FNStEnv)(void BS3_FAR *pvMmioReg);
+BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovDQU_Read)(void BS3_FAR *pvMmioReg);
+BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovDQU_Write)(void BS3_FAR *pvMmioReg);
+BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_FMul)(void BS3_FAR *pvMmioReg);
+
+
+/**
+ * Tests for FPU state corruption.
+ *
+ * First we don't do anything to quit guest context for a while.
+ * Then we start testing weird MMIO accesses, some which amonger other things
+ * forces the use of the FPU state or host FPU to do the emulation.  Both are a
+ * little complicated in raw-mode and ring-0 contexts.
+ *
+ * We ASSUME FXSAVE/FXRSTOR support here.
+ */
 BS3_DECL_FAR(uint8_t) TMPL_NM(bs3FpuState1_Corruption)(uint8_t bMode)
 {
@@ -76,27 +125,148 @@
     X86FXSTATE BS3_FAR *pExpected = (X86FXSTATE BS3_FAR *)pbTmp;
     X86FXSTATE BS3_FAR *pChecking = pExpected + 1;
-    uint32_t            iLoops;
-
-    /** @todo flexible wrt fxsave support? do we care?  */
-    /* First, make 100% sure we don't trap accessing the FPU state and that we can use fxsave/fxrstor. */
+    uint32_t            iLoop;
+    bool                fMmioReadback;
+    bool                fReadBackError = false;
+    BS3PTRUNION         MmioReg;
+
+# undef  CHECK_STATE
+# define CHECK_STATE(a_Instr) \
+        do { \
+            TMPL_NM(bs3FpuState1_Save)(pChecking); \
+            if (Bs3MemCmp(pExpected, pChecking, sizeof(*pExpected)) != 0) \
+            { \
+                Bs3TestFailedF("State differs after " #a_Instr " (write) in loop #%RU32\n", iLoop); \
+                bs3FpuState1_Diff(pExpected, pChecking); \
+                return 1; \
+            } \
+        } while (0)
+
+    /*
+     * Setup the test.
+     */
+
+    /* First, figure out which MMIO region we'll be using so we can correctly initialize FPUDS. */
+# if BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
+    MmioReg.pv = BS3_FP_MAKE(0xffff, VMMDEV_TESTING_MMIO_BASE - _1M + 16);
+# elif BS3_MODE_IS_16BIT_CODE(TMPL_MODE)
+    MmioReg.pv = BS3_FP_MAKE(BS3_SEL_VMMDEV_MMIO16, VMMDEV_TESTING_MMIO_BASE - _1M);
+# else
+    MmioReg.pv = (uint8_t *)VMMDEV_TESTING_MMIO_BASE;
+# endif
+    if (MmioReg.pu32[VMMDEV_TESTING_MMIO_OFF_NOP / sizeof(uint32_t)] == VMMDEV_TESTING_NOP_RET)
+    {
+        fMmioReadback = true;
+        MmioReg.pb += VMMDEV_TESTING_MMIO_OFF_READBACK;
+    }
+    else
+    {
+        Bs3TestPrintf("VMMDev MMIO not found, using VGA instead\n");
+        fMmioReadback = false;
+        MmioReg.pv = Bs3XptrFlatToCurrent(0xa7800);
+    }
+
+    /* Second, make 100% sure we don't trap accessing the FPU state and that we can use fxsave/fxrstor. */
     g_usBs3TestStep = 1;
     ASMSetCR0((ASMGetCR0() & ~(X86_CR0_TS | X86_CR0_EM)) | X86_CR0_MP);
     ASMSetCR4(ASMGetCR4() | X86_CR4_OSFXSR /*| X86_CR4_OSXMMEEXCPT*/);
 
-    /* Second, come up with a distinct state. We do that from assembly. */
+    /* Third, come up with a distinct state. We do that from assembly (will do FPU in R0/RC). */
     g_usBs3TestStep = 2;
     Bs3MemSet(abBuf, 0x42, sizeof(abBuf));
-    TMPL_NM(bs3FpuState1_InitState)(pExpected);
-
-    /* Check that we can keep it consistent for a while. */
+    TMPL_NM(bs3FpuState1_InitState)(pExpected, MmioReg.pb);
+
+    /*
+     * Test #1: Check that we can keep it consistent for a while.
+     */
     g_usBs3TestStep = 3;
-    for (iLoops = 0; iLoops < _4M*16; iLoops++) /** @todo adjust counter. will hardcode for now and do timers later so day... */
+    for (iLoop = 0; iLoop < _1M; iLoop++) /** @todo adjust counter. will hardcode for now and do timers later so day... */
+        CHECK_STATE(nop);
+
+    /*
+     * Test #2: Use various FPU, SSE and weird instructions to do MMIO writes.
+     *
+     * We'll use the VMMDev readback register if possible, but make do
+     * with VGA if not configured.
+     */
+    g_usBs3TestStep = 4;
+    for (iLoop = 0; iLoop < _128K; iLoop++) /** @todo adjust counter. will hardcode for now and do timers later so day... */
     {
-        TMPL_NM(bs3FpuState1_Save)(pChecking);
-        if (Bs3MemCmp(pExpected, pChecking, sizeof(*pExpected)) != 0)
-        {
-            Bs3TestFailedF("State differs after %RU32 save loops\n", iLoops);
-            return 1;
-        }
+        unsigned off;
+        uint8_t  abCompare[64];
+        uint8_t  abReadback[64];
+
+        /* Macros  */
+# undef  CHECK_READBACK_WRITE_RUN
+# define CHECK_READBACK_WRITE_RUN(a_Instr, a_Worker, a_Type) \
+            do { \
+                off = (unsigned)(iLoop & (VMMDEV_TESTING_READBACK_SIZE / 2 - 1)); \
+                if (off + sizeof(a_Type) > VMMDEV_TESTING_READBACK_SIZE) \
+                    off = VMMDEV_TESTING_READBACK_SIZE - sizeof(a_Type); \
+                a_Worker((a_Type *)&MmioReg.pb[off]); \
+                if (fMmioReadback && (!fReadBackError || iLoop == 0)) \
+                { \
+                    a_Worker((a_Type *)&abCompare[0]); \
+                    Bs3MemCpy(abReadback, &MmioReg.pb[off], sizeof(a_Type)); \
+                    if (Bs3MemCmp(abReadback, abCompare, sizeof(a_Type)) != 0) \
+                    { \
+                        Bs3TestFailedF("Read back error for " #a_Instr " in loop #%RU32:\n%.*Rhxs expected:\n%.*Rhxs\n", \
+                                       iLoop, sizeof(a_Type), abReadback, sizeof(a_Type), abCompare); \
+                        fReadBackError = true; \
+                    } \
+                } \
+            } while (0)
+
+# undef  CHECK_READBACK_WRITE
+# define CHECK_READBACK_WRITE(a_Instr, a_Worker, a_Type) \
+            CHECK_READBACK_WRITE_RUN(a_Instr, a_Worker, a_Type); \
+            CHECK_STATE(a_Instr)
+# undef  CHECK_READBACK_WRITE_Z
+# define CHECK_READBACK_WRITE_Z(a_Instr, a_Worker, a_Type) \
+            do { \
+                if (fMmioReadback && (!fReadBackError || iLoop == 0)) \
+                { \
+                    Bs3MemZero(&abCompare[0], sizeof(a_Type)); \
+                    off = (unsigned)(iLoop & (VMMDEV_TESTING_READBACK_SIZE / 2 - 1)); \
+                    if (off + sizeof(a_Type) > VMMDEV_TESTING_READBACK_SIZE) \
+                        off = VMMDEV_TESTING_READBACK_SIZE - sizeof(a_Type); \
+                    Bs3MemZero(&MmioReg.pb[off], sizeof(a_Type)); \
+                } \
+                CHECK_READBACK_WRITE(a_Instr, a_Worker, a_Type); \
+            } while (0)
+
+# undef  CHECK_READBACK_READ_RUN
+# define CHECK_READBACK_READ_RUN(a_Instr, a_Worker, a_Type) \
+            do { \
+                off = (unsigned)(iLoop & (VMMDEV_TESTING_READBACK_SIZE / 2 - 1)); \
+                if (off + sizeof(a_Type) > VMMDEV_TESTING_READBACK_SIZE) \
+                    off = VMMDEV_TESTING_READBACK_SIZE - sizeof(a_Type); \
+                a_Worker((a_Type *)&MmioReg.pb[off]); \
+                TMPL_NM(bs3FpuState1_Save)(pChecking); \
+            } while (0)
+# undef  CHECK_READBACK_READ
+# define CHECK_READBACK_READ(a_Instr, a_Worker, a_Type) \
+            CHECK_READBACK_READ_RUN(a_Instr, a_Worker, a_Type); \
+            CHECK_STATE(a_Instr)
+
+
+        /* The tests. */
+        CHECK_READBACK_WRITE_Z(SIDT,     ASMGetIDTR,                         RTIDTR);
+        CHECK_READBACK_WRITE_Z(FNSTENV,  TMPL_NM(bs3FpuState1_FNStEnv),      X86FSTENV32P); /** @todo x86.h is missing types */
+        CHECK_READBACK_WRITE(  MOVDQU,   TMPL_NM(bs3FpuState1_MovDQU_Write), X86XMMREG);
+        CHECK_READBACK_READ(   MOVDQU,   TMPL_NM(bs3FpuState1_MovDQU_Read),  X86XMMREG);
+
+        /* Using the FPU is a little complicated, but we really need to check these things. */
+        CHECK_READBACK_READ_RUN(FMUL,    TMPL_NM(bs3FpuState1_FMul),         uint64_t);
+        pExpected->FOP    = 0x7dc;
+# if ARCH_BITS == 64
+        pExpected->FPUDP  = (uint32_t) (uintptr_t)&MmioReg.pb[off];
+        pExpected->DS     = (uint16_t)((uintptr_t)&MmioReg.pb[off] >> 32);
+        pExpected->Rsrvd2 = (uint16_t)((uintptr_t)&MmioReg.pb[off] >> 48);
+# elif BS3_MODE_IS_RM_OR_V86(TMPL_MODE)
+        pExpected->FPUDP  = Bs3SelPtrToFlat(&MmioReg.pb[off]);
+# else
+        pExpected->FPUDP  = BS3_FP_OFF(&MmioReg.pb[off]);
+# endif
+        CHECK_STATE(FMUL);
     }
 
@@ -106,3 +276,2 @@
 #endif /* BS3_INSTANTIATING_MODE */
 
-
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.mac
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.mac	(revision 61384)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1-template.mac	(revision 61385)
@@ -41,8 +41,8 @@
 ; Initializes the FPU state and saves it to pFxState.
 ;
-; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_InitState)(X86FXSTATE BS3_FAR *pFxState);
+; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_InitState)(X86FXSTATE BS3_FAR *pFxState, void *pvMmioReg);
 ;
 BS3_PROC_BEGIN_MODE bs3FpuState1_InitState, BS3_PBC_NEAR
-        BS3_CALL_CONV_PROLOG 1
+        BS3_CALL_CONV_PROLOG 2
         push    xBP
         mov     xBP, xSP
@@ -50,4 +50,5 @@
 TONLY16 push    ds
         pushf
+TONLY64 sub     xSP, 20h
 
         ;
@@ -55,14 +56,25 @@
         ;
         fninit
-        fld dword [TMPL_DATA16_WRT(g_r32V1)]
-        fld qword [TMPL_DATA16_WRT(g_r64V1)]
-        fld tword [TMPL_DATA16_WRT(g_r80V1)]
-        fld qword [TMPL_DATA16_WRT(g_r64V1)]
-        fld dword [TMPL_DATA16_WRT(g_r32V2)]
-        fld dword [TMPL_DATA16_WRT(g_r80_QNaNMax)]
-        fld tword [TMPL_DATA16_WRT(g_r80_ThirtyTwo)]
-        fld tword [TMPL_DATA16_WRT(g_r80_SNaNMax)]
-        ;; @todo status regs
-
+        fld     dword [TMPL_DATA16_WRT(g_r32V1)]
+        fld     qword [TMPL_DATA16_WRT(g_r64V1)]
+        fld     tword [TMPL_DATA16_WRT(g_r80V1)]
+        fld     qword [TMPL_DATA16_WRT(g_r64V1)]
+        fld     dword [TMPL_DATA16_WRT(g_r32V2)]
+        fld     dword [TMPL_DATA16_WRT(g_r80_QNaNMax)]
+        fld     tword [TMPL_DATA16_WRT(g_r80_SNaNMax)]
+        fld     tword [TMPL_DATA16_WRT(g_r80_ThirtyTwo)]
+
+        ;
+        ; We'll later be using FMUL to test actually using the FPU in RC & R0,
+        ; so for everything to line up correctly with FPU CS:IP and FPU DS:DP,
+        ; we'll call the function here too.  This has the benefitial side effect
+        ; of loading correct FPU DS/DS values so we can check that they don't
+        ; get lost either.  Also, we now don't have to guess whether the CPU
+        ; emulation sets CS/DS or not.
+        ;
+TONLY16 push    xPRE [xBP + xCB + cbCurRetAddr + sCB + 2]
+        push    xPRE [xBP + xCB + cbCurRetAddr + sCB]
+        BS3_CALL TMPL_NM(bs3FpuState1_FMul), 1
+        add     xSP, sCB
 
         ;
@@ -110,4 +122,5 @@
 
 .return:
+TONLY64 add     xSP, 20h
         popf
 TONLY16 pop     ds
@@ -115,5 +128,5 @@
         mov     xSP, xBP
         pop     xBP
-        BS3_CALL_CONV_EPILOG 1
+        BS3_CALL_CONV_EPILOG 2
         BS3_HYBRID_RET
 BS3_PROC_END_MODE   bs3FpuState1_InitState
@@ -181,4 +194,137 @@
 
 
+;;
+; Performs a MOVDQU write on the specified memory.
+;
+; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovDQU_Write)(void *pvMmioReg);
+;
+BS3_PROC_BEGIN_MODE bs3FpuState1_MovDQU_Write, BS3_PBC_NEAR
+        BS3_CALL_CONV_PROLOG 1
+        push    xBP
+        mov     xBP, xSP
+        push    xBX
+TONLY16 push    ds
+
+        ; Load the register pointer.
+        mov     xBX, [xBP + xCB + cbCurRetAddr]
+TONLY16 mov     ds,  [xBP + xCB + cbCurRetAddr + 2]
+
+        ; Do read.
+        movdqu  [xBX], xmm3
+
+TONLY16 pop     ds
+        pop     xBX
+        leave
+        BS3_CALL_CONV_EPILOG 1
+        BS3_HYBRID_RET
+BS3_PROC_END_MODE   bs3FpuState1_MovDQU_Write
+
+
+;;
+; Performs a MOVDQU write to the specified memory.
+;
+; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_MovDQU_Read)(void *pvMmioReg);
+;
+BS3_PROC_BEGIN_MODE bs3FpuState1_MovDQU_Read, BS3_PBC_NEAR
+        BS3_CALL_CONV_PROLOG 1
+        push    xBP
+        mov     xBP, xSP
+        push    xBX
+TONLY16 push    ds
+        sub     xSP, 20h
+%if TMPL_BITS == 16
+        movdqu  [xBP - xCB - xCB - 2 - 18h], xmm2
+%else
+        movdqu  [xSP], xmm2
+%endif
+
+        ; Load the register pointer.
+        mov     xBX, [xBP + xCB + cbCurRetAddr]
+TONLY16 mov     ds,  [xBP + xCB + cbCurRetAddr + 2]
+
+
+        ; Do read.
+        movdqu  xmm2, [xBX]
+
+%if TMPL_BITS == 16
+        movdqu  xmm2, [xBP - xCB - xCB - 2 - 18h]
+%else
+        movdqu  xmm2, [xSP]
+%endif
+        add     xSP, 20h
+TONLY16 pop     ds
+        pop     xBX
+        mov     xSP, xBP
+        pop     xBP
+        BS3_CALL_CONV_EPILOG 1
+        BS3_HYBRID_RET
+BS3_PROC_END_MODE   bs3FpuState1_MovDQU_Read
+
+
+;;
+; Performs a FNSTENV write on the specified memory.
+;
+; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_FNStEnv)(void *pvMmioReg);
+;
+BS3_PROC_BEGIN_MODE bs3FpuState1_FNStEnv, BS3_PBC_NEAR
+        BS3_CALL_CONV_PROLOG 1
+        push    xBP
+        mov     xBP, xSP
+        push    xBX
+TONLY16 push    ds
+
+        ; Load the register pointer.
+        mov     xBX, [xBP + xCB + cbCurRetAddr]
+TONLY16 mov     ds,  [xBP + xCB + cbCurRetAddr + 2]
+
+        ; Just write.
+        fnstenv [xBX]
+
+TONLY16 pop     ds
+        pop     xBX
+        mov     xSP, xBP
+        pop     xBP
+        BS3_CALL_CONV_EPILOG 1
+        BS3_HYBRID_RET
+BS3_PROC_END_MODE   bs3FpuState1_FNStEnv
+
+
+;;
+; Performs a FMUL on the specified memory, after writing a 64-bit value to it first.
+;
+; BS3_DECL_NEAR(void) TMPL_NM(bs3FpuState1_FMul)(void *pvMmioReg);
+;
+BS3_PROC_BEGIN_MODE bs3FpuState1_FMul, BS3_PBC_NEAR
+        BS3_CALL_CONV_PROLOG 1
+        push    xBP
+        mov     xBP, xSP
+        push    xBX
+TONLY16 push    ds
+
+        ; Load the value we'll be multiplying with into register(s) while ds is DATA16.
+        mov     sAX, [TMPL_DATA16_WRT(g_r64_One)]
+TNOT64  mov     edx, [4 + TMPL_DATA16_WRT(g_r64_One)]
+
+        ; Load the register pointer.
+        mov     xBX, [xBP + xCB + cbCurRetAddr]
+TONLY16 mov     ds,  [xBP + xCB + cbCurRetAddr + 2]
+
+        ; Just write.
+        mov     [xBX], sAX
+TNOT64  mov     [xBX + 4], edx
+        call    .do_it
+
+TONLY16 pop     ds
+        pop     xBX
+        mov     xSP, xBP
+        pop     xBP
+        BS3_CALL_CONV_EPILOG 1
+        BS3_HYBRID_RET
+.do_it:
+        fmul    qword [xBX]
+        ret
+BS3_PROC_END_MODE   bs3FpuState1_FMul
+
+
 %include "bs3kit-template-footer.mac"   ; reset environment
 
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1.c	(revision 61384)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3-fpustate-1.c	(revision 61385)
@@ -46,9 +46,9 @@
     {
         /*pszSubTest =*/ "corruption",
-        /*RM*/        NULL, //bs3FpuState1_Corruption_rm,
+        /*RM*/        bs3FpuState1_Corruption_rm,
         /*PE16*/      NULL, //bs3FpuState1_Corruption_pe16,
         /*PE16_32*/   NULL, //bs3FpuState1_Corruption_pe16_32,
         /*PE16_V86*/  NULL, //bs3FpuState1_Corruption_pe16_v86,
-        /*PE32*/      NULL, //bs3FpuState1_Corruption_pe32,
+        /*PE32*/      bs3FpuState1_Corruption_pe32,
         /*PE32_16*/   NULL, //bs3FpuState1_Corruption_pe32_16,
         /*PEV86*/     NULL, //bs3FpuState1_Corruption_pev86,
@@ -81,6 +81,6 @@
 
     Bs3TestTerm();
-for (;;) { ASMHalt(); }
 }
 
 
+
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitMemory.c
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitMemory.c	(revision 61384)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3-rm-InitMemory.c	(revision 61385)
@@ -32,4 +32,5 @@
 #include "bs3-cmn-memory.h"
 #include <iprt/asm.h>
+#include <VBox/VMMDevTesting.h>
 
 
@@ -248,8 +249,9 @@
 BS3_DECL(void) BS3_FAR_CODE Bs3InitMemory_rm_far(void)
 {
-    uint16_t        i;
-    uint16_t        cPages;
-    uint32_t        u32;
-    INT15E820ENTRY  Entry;
+    uint16_t            i;
+    uint16_t            cPages;
+    uint32_t            u32;
+    INT15E820ENTRY      Entry;
+    uint32_t BS3_FAR   *pu32Mmio;
 
     /*
@@ -332,4 +334,17 @@
 
     /*
+     * Check if we've got the VMMDev MMIO testing memory mapped above 1MB.
+     */
+    pu32Mmio = (uint32_t BS3_FAR *)BS3_FP_MAKE(VMMDEV_TESTING_MMIO_RM_SEL,
+                                               VMMDEV_TESTING_MMIO_RM_OFF2(VMMDEV_TESTING_MMIO_OFF_NOP));
+    if (*pu32Mmio == VMMDEV_TESTING_NOP_RET)
+    {
+        Bs3Printf("Memory: Found VMMDev MMIO testing region\n");
+        if (!ASMBitTestAndSet(g_Bs3Mem4KUpperTiled.Core.bmAllocated, 1))
+            g_Bs3Mem4KUpperTiled.Core.cFreeChunks--;
+
+    }
+
+    /*
      * Initialize the slab lists.
      */
Index: /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h
===================================================================
--- /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h	(revision 61384)
+++ /trunk/src/VBox/ValidationKit/bootsectors/bs3kit/bs3kit.h	(revision 61385)
@@ -3164,5 +3164,5 @@
  * Basic CPU detection.
  *
- * This sets the #g_bBs3CpuDetected global variable to the return value.
+ * This sets the #g_uBs3CpuDetected global variable to the return value.
  *
  * @returns BS3CPU_XXX value with the BS3CPU_F_CPUID flag set depending on
