# DF-5484 — raw rdmsr/wrmsr P-state MSRs: fatal #GP on CPUID-lying platforms

`sys/platform/pc64/acpica/acpi_pstate_machdep.c` touches fixed MSRs with raw
`rdmsr()`/`wrmsr()` gated only by CPUID bits:

    Intel: 0x1a0 (:506/:509/:511), 0x199 (:530/:533), 0x198 (:555)   [gate: CPUID2_EST]
    AMD:   0xc0010064..6b (:227), 0xc0010062 (:259), 0xc0010063 (:280)
                                                             [gate: family>=0x10 + APMI bit]

A #GP in kernel mode is a fatal trap. The first P-state transition happens
unattended at boot (`acpi_pst_postattach` -> `acpi_pst_global_set_pstate`),
again on every root `px_global`/`px_domN.select` sysctl write, and on every
type-0x80 _PPC notify fixup.

## Build (on the guest)

    sh build.sh     # msrprobe.ko, msrprobe2.ko, rawpst.ko (bsd.kmod.mk)

## Run (KVM `-cpu host`)

    dfbsd-qemu/vm.sh down
    QEMU_EXTRA="-cpu host" dfbsd-qemu/vm.sh up 150
    sh run.sh       # kldload rawpst.ko

## Expected (observed)

    rawpst: safe probe: rdmsr_safe(0x199) -> error 0 val 0
    rawpst: safe probe: wrmsr_safe(0x199, val) -> error 14
    rawpst: raw driver sequence (pstate_machdep.c:530-533), cval=0x0e00 ...

    Fatal trap 9: general protection fault while in kernel mode
    ...
    Stopped at      rawpst_modevent+0xb7:   wrmsr
    db>

Guest dead in DDB; `vm.sh status` -> down. Full console: panic.txt /
panic_run_fullconsole.log. Safe-accessor inventory of all six MSR sites:
run_probe.log / msrprobe2.log.

## Honest gap (DF-5155 methodology)

No QEMU config on this host can advertise CPUID2_EST (KVM: host Xeon
E3-1275 v5 lacks CPUID.01H:ECX bit 7 and KVM_GET_SUPPORTED_CPUID does not
virtualize it; TCG masks est as unimplemented), so the *driver* path with
the md engaged is not constructible here; rawpst executes the driver's
exact instruction pair instead. On any VMM that advertises EST without
virtualizing PERF_CTL, the stock driver takes this trap at boot.