Index: /trunk/include/VBox/VMMDevTesting.h
===================================================================
--- /trunk/include/VBox/VMMDevTesting.h	(revision 92527)
+++ /trunk/include/VBox/VMMDevTesting.h	(revision 92528)
@@ -132,4 +132,7 @@
 /** Print string, sending a string including newline. (RTTestPrintf) */
 #define VMMDEV_TESTING_CMD_PRINT        UINT32_C(0xcab1e008)
+/** Query a config value, sending a 16-bit word (VMMDEV_TESTING_CFG_XXX) to the
+ * DATA port and reading back the result. */
+#define VMMDEV_TESTING_CMD_QUERY_CFG    UINT32_C(0xcab1e009)
 
 /** The magic part of the command. */
@@ -216,4 +219,35 @@
 /** @} */
 
+/** @name VMMDEV_TESTING_CFG_XXX - Configuration values that can be queried.
+ * @{ */
+/** Generic 32-bit value \#0 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD0            UINT16_C(0x0000)
+/** Generic 32-bit value \#1 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD1            UINT16_C(0x0001)
+/** Generic 32-bit value \#2 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD2            UINT16_C(0x0002)
+/** Generic 32-bit value \#3 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD3            UINT16_C(0x0003)
+/** Generic 32-bit value \#4 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD4            UINT16_C(0x0004)
+/** Generic 32-bit value \#5 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD5            UINT16_C(0x0005)
+/** Generic 32-bit value \#6 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD6            UINT16_C(0x0006)
+/** Generic 32-bit value \#7 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD7            UINT16_C(0x0007)
+/** Generic 32-bit value \#8 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD8            UINT16_C(0x0008)
+/** Generic 32-bit value \#9 - testcase defined meaning. */
+#define VMMDEV_TESTING_CFG_DWORD9            UINT16_C(0x0009)
+
+/** Boolean (8-bit): Running in NEM on Linux? */
+#define VMMDEV_TESTING_CFG_IS_NEM_LINUX      UINT16_C(0x0100)
+/** Boolean (8-bit): Running in NEM on Windows? */
+#define VMMDEV_TESTING_CFG_IS_NEM_WINDOWS    UINT16_C(0x0101)
+/** Boolean (8-bit): Running in NEM on Darwin? */
+#define VMMDEV_TESTING_CFG_IS_NEM_DARWIN     UINT16_C(0x0102)
+/** @} */
+
 /** @} */
 
Index: /trunk/include/VBox/VMMDevTesting.mac
===================================================================
--- /trunk/include/VBox/VMMDevTesting.mac	(revision 92527)
+++ /trunk/include/VBox/VMMDevTesting.mac	(revision 92528)
@@ -60,4 +60,5 @@
 %define VMMDEV_TESTING_CMD_VALUE_REG    0xcab1e007
 %define VMMDEV_TESTING_CMD_PRINT        0xcab1e008
+%define VMMDEV_TESTING_CMD_QUERY_CFG    0xcab1e009
 %define VMMDEV_TESTING_CMD_MAGIC        0xcab1e000
 %define VMMDEV_TESTING_CMD_MAGIC_MASK   0xffffff00
Index: /trunk/src/VBox/Devices/VMMDev/VMMDev.cpp
===================================================================
--- /trunk/src/VBox/Devices/VMMDev/VMMDev.cpp	(revision 92527)
+++ /trunk/src/VBox/Devices/VMMDev/VMMDev.cpp	(revision 92528)
@@ -4590,5 +4590,15 @@
                                   "TestingEnabled|"
                                   "TestingMMIO|"
-                                  "TestintXmlOutputFile|"
+                                  "TestingXmlOutputFile|"
+                                  "TestingCfgDword0|"
+                                  "TestingCfgDword1|"
+                                  "TestingCfgDword2|"
+                                  "TestingCfgDword3|"
+                                  "TestingCfgDword4|"
+                                  "TestingCfgDword5|"
+                                  "TestingCfgDword6|"
+                                  "TestingCfgDword7|"
+                                  "TestingCfgDword8|"
+                                  "TestingCfgDword9|"
                                   "HGCMHeapBudgetDefault|"
                                   "HGCMHeapBudgetLegacy|"
@@ -4671,7 +4681,18 @@
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc, N_("Configuration error: Failed querying \"TestingMMIO\" as a boolean"));
-    rc = pHlp->pfnCFGMQueryStringAllocDef(pCfg, "TestintXmlOutputFile", &pThisCC->pszTestingXmlOutput, NULL);
+    rc = pHlp->pfnCFGMQueryStringAllocDef(pCfg, "TestingXmlOutputFile", &pThisCC->pszTestingXmlOutput, NULL);
     if (RT_FAILURE(rc))
-        return PDMDEV_SET_ERROR(pDevIns, rc, N_("Configuration error: Failed querying \"TestintXmlOutputFile\" as a string"));
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("Configuration error: Failed querying \"TestingXmlOutputFile\" as a string"));
+
+    for (unsigned i = 0; i < RT_ELEMENTS(pThis->au32TestingCfgDwords); i++)
+    {
+        char szName[32];
+        RTStrPrintf(szName, sizeof(szName), "TestingCfgDword%u", i);
+        rc = pHlp->pfnCFGMQueryU32Def(pCfg, szName, &pThis->au32TestingCfgDwords[i], 0);
+        if (RT_FAILURE(rc))
+            return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
+                                       N_("Configuration error: Failed querying \"%s\" as a string"), szName);
+    }
+
 
     /** @todo image-to-load-filename? */
Index: /trunk/src/VBox/Devices/VMMDev/VMMDevState.h
===================================================================
--- /trunk/src/VBox/Devices/VMMDev/VMMDevState.h	(revision 92527)
+++ /trunk/src/VBox/Devices/VMMDev/VMMDevState.h	(revision 92528)
@@ -292,7 +292,10 @@
     /** Set if testing the MMIO testing range is enabled. */
     bool                fTestingMMIO;
+#if defined(VBOX_WITHOUT_TESTING_FEATURES) && !defined(DOXYGEN_RUNNING)
     /** Alignment padding. */
     bool                afPadding9[2];
-#if !defined(VBOX_WITHOUT_TESTING_FEATURES) || defined(DOXYGEN_RUNNING)
+#else
+    /** The amount of readable testing data (for query response). */
+    uint16_t            cbReadableTestingData;
     /** The high timestamp value. */
     uint32_t            u32TestingHighTimestamp;
@@ -304,5 +307,6 @@
     union
     {
-        char            padding[1024];
+        /** Plain byte view. */
+        uint8_t         ab[1024];
 
         /** VMMDEV_TESTING_CMD_INIT, VMMDEV_TESTING_CMD_SUB_NEW,
@@ -326,4 +330,9 @@
             char        szName[1024 - 8 - 4];
         } Value;
+
+        /** A 8-bit VMMDEV_TESTING_QUERY_CFG response. */
+        uint8_t         b;
+        /** A 32-bit VMMDEV_TESTING_QUERY_CFG response. */
+        uint32_t        u32;
 
         /** The read back register (VMMDEV_TESTING_MMIO_OFF_READBACK,
@@ -371,4 +380,6 @@
     /** Handle for the MMIO region used by the testing component. */
     IOMMMIOHANDLE       hMmioTesting;
+    /** User defined configuration dwords. */
+    uint32_t            au32TestingCfgDwords[10];
 #endif /* !VBOX_WITHOUT_TESTING_FEATURES || DOXYGEN_RUNNING */
     /** @} */
Index: /trunk/src/VBox/Devices/VMMDev/VMMDevTesting.cpp
===================================================================
--- /trunk/src/VBox/Devices/VMMDev/VMMDevTesting.cpp	(revision 92527)
+++ /trunk/src/VBox/Devices/VMMDev/VMMDevTesting.cpp	(revision 92528)
@@ -355,6 +355,7 @@
             if (cb == 4)
             {
-                pThis->u32TestingCmd  = u32;
-                pThis->offTestingData = 0;
+                pThis->u32TestingCmd         = u32;
+                pThis->offTestingData        = 0;
+                pThis->cbReadableTestingData = 0;
                 RT_ZERO(pThis->TestingData);
                 return VINF_SUCCESS;
@@ -581,4 +582,48 @@
                 }
 
+                /*
+                 * Query configuration.
+                 */
+                case VMMDEV_TESTING_CMD_QUERY_CFG:
+                {
+                    switch (u32)
+                    {
+                        case VMMDEV_TESTING_CFG_DWORD0:
+                        case VMMDEV_TESTING_CFG_DWORD1:
+                        case VMMDEV_TESTING_CFG_DWORD2:
+                        case VMMDEV_TESTING_CFG_DWORD3:
+                        case VMMDEV_TESTING_CFG_DWORD4:
+                        case VMMDEV_TESTING_CFG_DWORD5:
+                        case VMMDEV_TESTING_CFG_DWORD6:
+                        case VMMDEV_TESTING_CFG_DWORD7:
+                        case VMMDEV_TESTING_CFG_DWORD8:
+                        case VMMDEV_TESTING_CFG_DWORD9:
+                            pThis->cbReadableTestingData = sizeof(pThis->TestingData.u32);
+                            pThis->TestingData.u32       = pThis->au32TestingCfgDwords[u32 - VMMDEV_TESTING_CFG_DWORD0];
+                            break;
+
+                        case VMMDEV_TESTING_CFG_IS_NEM_LINUX:
+                        case VMMDEV_TESTING_CFG_IS_NEM_WINDOWS:
+                        case VMMDEV_TESTING_CFG_IS_NEM_DARWIN:
+                        {
+                            pThis->cbReadableTestingData = sizeof(pThis->TestingData.b);
+#if   defined(RT_OS_DARWIN)
+                            pThis->TestingData.b = u32 == VMMDEV_TESTING_CFG_IS_NEM_DARWIN
+                                                && PDMDevHlpGetMainExecutionEngine(pDevIns) == VM_EXEC_ENGINE_NATIVE_API;
+#elif defined(RT_OS_LINUX)
+                            pThis->TestingData.b = u32 == VMMDEV_TESTING_CFG_IS_NEM_LINUX
+                                                && PDMDevHlpGetMainExecutionEngine(pDevIns) == VM_EXEC_ENGINE_NATIVE_API;
+#elif defined(RT_OS_WINDOWS)
+                            pThis->TestingData.b = u32 == VMMDEV_TESTING_CFG_IS_NEM_WINDOWS
+                                                && PDMDevHlpGetMainExecutionEngine(pDevIns) == VM_EXEC_ENGINE_NATIVE_API;
+#else
+                            pThis->TestingData.b = false;
+#endif
+                            break;
+                        }
+                    }
+                    break;
+                }
+
                 default:
                     break;
@@ -809,8 +854,47 @@
 
         /*
-         * The command and data registers are write-only.
+         * The command registers is write-only.
          */
         case VMMDEV_TESTING_IOPORT_CMD  - VMMDEV_TESTING_IOPORT_BASE:
+            break;
+
+        /*
+         * The data register is only readable after a query command, otherwise it
+         * behaves as an undefined port.  Return zeros if the guest reads too much.
+         */
         case VMMDEV_TESTING_IOPORT_DATA - VMMDEV_TESTING_IOPORT_BASE:
+            if (pThis->cbReadableTestingData > 0)
+            {
+                if (pThis->offTestingData < pThis->cbReadableTestingData)
+                {
+                    switch (RT_MIN(cb, pThis->cbReadableTestingData - pThis->offTestingData))
+                    {
+                        case 1:
+                            *pu32 = pThis->TestingData.ab[pThis->offTestingData++];
+                            break;
+                        case 2:
+                            *pu32 =            pThis->TestingData.ab[pThis->offTestingData]
+                                  | ((uint32_t)pThis->TestingData.ab[pThis->offTestingData + 1] << 8);
+                            pThis->offTestingData += 2;
+                            break;
+                        case 3:
+                            *pu32 =            pThis->TestingData.ab[pThis->offTestingData]
+                                  | ((uint32_t)pThis->TestingData.ab[pThis->offTestingData + 1] << 8)
+                                  | ((uint32_t)pThis->TestingData.ab[pThis->offTestingData + 2] << 16);
+                            pThis->offTestingData += 3;
+                            break;
+                        case 4:
+                            *pu32 =            pThis->TestingData.ab[pThis->offTestingData]
+                                  | ((uint32_t)pThis->TestingData.ab[pThis->offTestingData + 1] << 8)
+                                  | ((uint32_t)pThis->TestingData.ab[pThis->offTestingData + 2] << 16)
+                                  | ((uint32_t)pThis->TestingData.ab[pThis->offTestingData + 3] << 24);
+                            pThis->offTestingData += 4;
+                            break;
+                    }
+                }
+                else
+                    *pu32 = 0;
+                return VINF_SUCCESS;
+            }
             break;
 
