Index: trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 72617)
+++ trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 72619)
@@ -6255,4 +6255,5 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
+#if 0 /** @todo Needs testing. @bugref{6973} */
     VBOXSTRICTRC rcStrict = IEMExecDecodedRdtsc(pVCpu, hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 2));
     if (rcStrict == VINF_SUCCESS)
@@ -6263,4 +6264,20 @@
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
     return VBOXSTRICTRC_TODO(rcStrict);
+#else
+    int rc = EMInterpretRdtsc(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
+    if (RT_LIKELY(rc == VINF_SUCCESS))
+    {
+        pSvmTransient->fUpdateTscOffsetting = true;
+        hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
+        HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
+    }
+    else
+    {
+        AssertMsgFailed(("hmR0SvmExitRdtsc: EMInterpretRdtsc failed with %Rrc\n", rc));
+        rc = VERR_EM_INTERPRETER;
+    }
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
+    return rc;
+#endif
 }
 
@@ -6272,4 +6289,5 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
+#if 0 /** @todo Needs testing. @bugref{6973} */
     VBOXSTRICTRC rcStrict = IEMExecDecodedRdtscp(pVCpu, hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3));
     if (rcStrict == VINF_SUCCESS)
@@ -6280,4 +6298,20 @@
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
     return VBOXSTRICTRC_TODO(rcStrict);
+#else
+    int rc = EMInterpretRdtscp(pVCpu->CTX_SUFF(pVM), pVCpu, pCtx);
+    if (RT_LIKELY(rc == VINF_SUCCESS))
+    {
+        pSvmTransient->fUpdateTscOffsetting = true;
+        hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 3);
+        HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
+    }
+    else
+    {
+        AssertMsgFailed(("hmR0SvmExitRdtsc: EMInterpretRdtscp failed with %Rrc\n", rc));
+        rc = VERR_EM_INTERPRETER;
+    }
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
+    return rc;
+#endif
 }
 
Index: trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 72617)
+++ trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 72619)
@@ -11917,4 +11917,5 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
+#if 0 /** @todo Needs testing. @bugref{6973} */
     int rc = hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);      /* Needed for CPL < 0 only, really. */
     rc    |= hmR0VmxSaveGuestRegsForIemExec(pVCpu, pMixedCtx, false /*fMemory*/, false /*fNeedRsp*/);
@@ -11932,4 +11933,23 @@
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
     return rcStrict;
+#else
+    int rc = hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);
+    AssertRCReturn(rc, rc);
+
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
+    rc = EMInterpretRdtsc(pVM, pVCpu, CPUMCTX2CORE(pMixedCtx));
+    if (RT_LIKELY(rc == VINF_SUCCESS))
+    {
+        rc = hmR0VmxAdvanceGuestRip(pVCpu, pMixedCtx, pVmxTransient);
+        Assert(pVmxTransient->cbInstr == 2);
+        /* If we get a spurious VM-exit when offsetting is enabled, we must reset offsetting on VM-reentry. See @bugref{6634}. */
+        if (pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_TSC_OFFSETTING)
+            pVmxTransient->fUpdateTscOffsettingAndPreemptTimer = true;
+    }
+    else
+        rc = VERR_EM_INTERPRETER;
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
+    return rc;
+#endif
 }
 
@@ -11941,4 +11961,5 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
+#if 0 /** @todo Needs testing. @bugref{6973} */
     int rc = hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);      /* Needed for CPL < 0 only, really. */
     rc    |= hmR0VmxSaveGuestRegsForIemExec(pVCpu, pMixedCtx, false /*fMemory*/, false /*fNeedRsp*/);
@@ -11957,4 +11978,27 @@
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
     return rcStrict;
+#else
+    int rc = hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);
+    rc    |= hmR0VmxSaveGuestAutoLoadStoreMsrs(pVCpu, pMixedCtx);  /* For MSR_K8_TSC_AUX */
+    AssertRCReturn(rc, rc);
+
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
+    rc = EMInterpretRdtscp(pVM, pVCpu, pMixedCtx);
+    if (RT_SUCCESS(rc))
+    {
+        rc  = hmR0VmxAdvanceGuestRip(pVCpu, pMixedCtx, pVmxTransient);
+        Assert(pVmxTransient->cbInstr == 3);
+        /* If we get a spurious VM-exit when offsetting is enabled, we must reset offsetting on VM-reentry. See @bugref{6634}. */
+        if (pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_TSC_OFFSETTING)
+            pVmxTransient->fUpdateTscOffsettingAndPreemptTimer = true;
+    }
+    else
+    {
+        AssertMsgFailed(("hmR0VmxExitRdtscp: EMInterpretRdtscp failed with %Rrc\n", rc));
+        rc = VERR_EM_INTERPRETER;
+    }
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
+    return rc;
+#endif
 }
 
