Index: trunk/src/VBox/VMM/PGMMap.cpp
===================================================================
--- trunk/src/VBox/VMM/PGMMap.cpp	(revision 14978)
+++ trunk/src/VBox/VMM/PGMMap.cpp	(revision 14979)
@@ -761,9 +761,5 @@
     PPGM pPGM = &pVM->pgm.s;
 
-    /* If mappings are not supposed to be put in the shadow page table, then this function is a nop. */
-    if (!pgmMapAreMappingsEnabled(&pVM->pgm.s))
-        return;
-
-    Assert(PGMGetGuestMode(pVM) <= PGMMODE_PAE_NX);
+    Assert(!pgmMapAreMappingsEnabled(&pVM->pgm.s) || PGMGetGuestMode(pVM) <= PGMMODE_PAE_NX);
 
     /*
@@ -780,5 +776,6 @@
          */
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
-        if (pPGM->pShw32BitPdR3->a[iNewPDE].n.u1Present)
+        if (   pgmMapAreMappingsEnabled(&pVM->pgm.s)
+            && pPGM->pShw32BitPdR3->a[iNewPDE].n.u1Present)
             pgmPoolFree(pVM, pPGM->pShw32BitPdR3->a[iNewPDE].u & X86_PDE_PG_MASK, PGMPOOL_IDX_PD, iNewPDE);
 #endif
@@ -788,5 +785,6 @@
         pPGM->pInterPD->a[iNewPDE]        = Pde;
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
-        pPGM->pShw32BitPdR3->a[iNewPDE]   = Pde;
+        if (pgmMapAreMappingsEnabled(&pVM->pgm.s))
+            pPGM->pShw32BitPdR3->a[iNewPDE]   = Pde;
 #endif
         /*
@@ -796,5 +794,6 @@
         unsigned iPDE = iNewPDE * 2 % 512;
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
-        if (pPGM->apShwPaePDsR3[iPD]->a[iPDE].n.u1Present)
+        if (   pgmMapAreMappingsEnabled(&pVM->pgm.s)
+            && pPGM->apShwPaePDsR3[iPD]->a[iPDE].n.u1Present)
             pgmPoolFree(pVM, pPGM->apShwPaePDsR3[iPD]->a[iPDE].u & X86_PDE_PAE_PG_MASK, PGMPOOL_IDX_PAE_PD, iNewPDE * 2);
 #endif
@@ -803,9 +802,11 @@
         pPGM->apInterPaePDs[iPD]->a[iPDE] = PdePae0;
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
-        pPGM->apShwPaePDsR3[iPD]->a[iPDE] = PdePae0;
+        if (pgmMapAreMappingsEnabled(&pVM->pgm.s))
+            pPGM->apShwPaePDsR3[iPD]->a[iPDE] = PdePae0;
 #endif
         iPDE++;
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
-        if (pPGM->apShwPaePDsR3[iPD]->a[iPDE].n.u1Present)
+        if (   pgmMapAreMappingsEnabled(&pVM->pgm.s)
+            && pPGM->apShwPaePDsR3[iPD]->a[iPDE].n.u1Present)
             pgmPoolFree(pVM, pPGM->apShwPaePDsR3[iPD]->a[iPDE].u & X86_PDE_PAE_PG_MASK, PGMPOOL_IDX_PAE_PD, iNewPDE * 2 + 1);
 #endif
@@ -814,8 +815,11 @@
         pPGM->apInterPaePDs[iPD]->a[iPDE] = PdePae1;
 #ifndef VBOX_WITH_PGMPOOL_PAGING_ONLY
-        pPGM->apShwPaePDsR3[iPD]->a[iPDE] = PdePae1;
-
-        /* Set the PGM_PDFLAGS_MAPPING flag in the page directory pointer entry. (legacy PAE guest mode) */
-        pPGM->pShwPaePdptR3->a[iPD].u |= PGM_PLXFLAGS_MAPPING;
+        if (pgmMapAreMappingsEnabled(&pVM->pgm.s))
+        {
+            pPGM->apShwPaePDsR3[iPD]->a[iPDE] = PdePae1;
+
+            /* Set the PGM_PDFLAGS_MAPPING flag in the page directory pointer entry. (legacy PAE guest mode) */
+            pPGM->pShwPaePdptR3->a[iPD].u |= PGM_PLXFLAGS_MAPPING;
+        }
 #endif
     }
Index: trunk/src/VBox/VMM/VMMSwitcher.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMSwitcher.cpp	(revision 14978)
+++ trunk/src/VBox/VMM/VMMSwitcher.cpp	(revision 14979)
@@ -615,9 +615,19 @@
             {
                 Assert(offSrc < pSwitcher->cbCode);
-#if defined(RT_OS_DARWIN) && defined(VBOX_WITH_HYBIRD_32BIT_KERNEL)
+# if defined(RT_OS_DARWIN) && defined(VBOX_WITH_HYBIRD_32BIT_KERNEL)
                 *uSrc.pu16 = 0x80; /* KERNEL64_CS from i386/seg.h */
-#else
+# else
                 AssertFatalMsgFailed(("FIX_HC_64BIT_CS not implemented for this host\n"));
-#endif
+# endif
+                break;
+            }
+
+            /*
+             * 64-bit HC pointer to the CPUM instance data (no argument).
+             */
+            case FIX_HC_64BIT_CPUM:
+            {
+                Assert(offSrc < pSwitcher->cbCode);
+                *uSrc.pu64 = pVM->pVMR0 + RT_OFFSETOF(VM, cpum);
                 break;
             }
@@ -635,13 +645,13 @@
             }
 
-            /*
-             * 64-bit HC pointer to the CPUM instance data (no argument).
-             */
-            case FIX_HC_64BIT_CPUM:
-            {
-                Assert(offSrc < pSwitcher->cbCode);
-                *uSrc.pu64 = pVM->pVMR0 + RT_OFFSETOF(VM, cpum);
-                break;
-            }
+#if defined(RT_ARCH_X86) && defined(VBOX_WITH_64_BITS_GUESTS)
+            case FIX_GC_64_BIT_CPUM_OFF:
+            {
+                uint32_t offCPUM = *u.pu32++;
+                Assert(offCPUM < sizeof(pVM->cpum));
+                *uSrc.pu64 = (uint32_t)(VM_RC_ADDR(pVM, &pVM->cpum) + offCPUM);
+                break;
+            }
+#endif
 
             /*
Index: trunk/src/VBox/VMM/VMMSwitcher/AMD64andLegacy.mac
===================================================================
--- trunk/src/VBox/VMM/VMMSwitcher/AMD64andLegacy.mac	(revision 14978)
+++ trunk/src/VBox/VMM/VMMSwitcher/AMD64andLegacy.mac	(revision 14979)
@@ -388,5 +388,5 @@
     DEBUG_CHAR('4')
 
-    ; 3. Load 32-bit intermediate page table.
+    ; 3. Load intermediate page table.
     FIXUP SWITCHER_FIX_INTER_CR3_GC, 1
     mov     edx, 0ffffffffh
Index: trunk/src/VBox/VMM/VMMSwitcher/LegacyandAMD64.mac
===================================================================
--- trunk/src/VBox/VMM/VMMSwitcher/LegacyandAMD64.mac	(revision 14978)
+++ trunk/src/VBox/VMM/VMMSwitcher/LegacyandAMD64.mac	(revision 14979)
@@ -151,5 +151,5 @@
 
     CPUM_FROM_CPUMCPU(edx)
-    ; Load new gdt so we can do far jump after going into 64 bits mode
+    ; Load new gdt so we can do a far jump after going into 64 bits mode
     lgdt    [edx + CPUM.Hyper.gdtr]
 
@@ -224,5 +224,5 @@
 ; 64-bit pCpum address.
 NAME(pCpumIC):
-FIXUP FIX_HC_64BIT_CPUM, 0
+FIXUP FIX_GC_64_BIT_CPUM_OFF, 0, 0
 dq 0ffffffffffffffffh
 
@@ -234,29 +234,27 @@
     ; Load CPUM pointer into rdx
     mov     rdx, [NAME(pCpumIC) wrt rip]
-    
+
     mov     rax, cs
     mov     ds, rax
     mov     es, rax
-    mov     fs, rax
-    mov     gs, rax
-    
+   
     ; Setup stack; use the lss_esp, ss pair for lss
-    DEBUG_CHAR('7')
-    mov     rsp, 0
-    mov     eax, [rdx + CPUM.Hyper.esp]
-    mov     [rdx + CPUM.Hyper.lss_esp], eax
-    lss     esp, [rdx + CPUM.Hyper.lss_esp]
+;;    DEBUG_CHAR('7')
+;;    mov     rsp, 0
+;;    mov     eax, [rdx + CPUM.Hyper.esp]
+;;    mov     [rdx + CPUM.Hyper.lss_esp], eax
+;;    lss     esp, [rdx + CPUM.Hyper.lss_esp]
 
     ; call the hypervisor function with rdx=pCpumCpu
-    mov     eax, [rdx + r8 + CPUM.Hyper.eip]
-    CPUMCPU_FROM_CPUM(rdx)    
-    call    rax
+;;    mov     eax, [rdx + r8 + CPUM.Hyper.eip]
+;;    CPUMCPU_FROM_CPUM(rdx)    
+;;    call    rax
     
     ; Load CPUM pointer into rdx
     mov     rdx, [NAME(pCpumIC) wrt rip]
-    CPUMCPU_FROM_CPUM(rdx)
+;;    CPUMCPU_FROM_CPUM(rdx)
     
     ; Save the return code
-    mov     [rdx + CPUMCPU.u32RetCode], eax
+;;    mov     [rdx + CPUMCPU.u32RetCode], eax
     
     ; now let's switch back
@@ -320,9 +318,5 @@
 ALIGNCODE(16)
 BEGINPROC VMMGCGuestToHostAsm
-    CPUMCPU_FROM_CPUM(rdx)
-    FIXUP FIX_INTER_AMD64_CR3, 1
-    mov     rax, 0ffffffffh
-    mov     cr3, rax
-    ;; We're now in the intermediate memory context!
+    ;; We're still in the intermediate memory context!
 
     ;;
@@ -393,5 +387,12 @@
 GLOBALNAME ICExitTarget
     DEBUG_CHAR('8')
-    FIXUP FIX_HC_CPUM_OFF, 1, 0
+
+    ; load the hypervisor data selector into ds & es
+    FIXUP FIX_HYPER_DS, 1
+    mov     eax, 0ffffh
+    mov     ds, eax
+    mov     es, eax
+
+    FIXUP FIX_GC_CPUM_OFF, 1, 0
     mov     edx, 0ffffffffh
     CPUMCPU_FROM_CPUM(edx)
@@ -400,5 +401,9 @@
 
     ;; now we're in host memory context, let's restore regs
-        
+    FIXUP FIX_HC_CPUM_OFF, 1, 0
+    mov     edx, 0ffffffffh
+    CPUMCPU_FROM_CPUM(edx)
+
+       
     ; activate host gdt and idt
     lgdt    [edx + CPUMCPU.Host.gdtr]
@@ -418,4 +423,5 @@
     DEBUG_CHAR('2')
     lldt    [edx + CPUMCPU.Host.ldtr]
+
     ; Restore segment registers
     mov     eax, [edx + CPUMCPU.Host.ds]
Index: trunk/src/VBox/VMM/VMMSwitcher/VMMSwitcher.h
===================================================================
--- trunk/src/VBox/VMM/VMMSwitcher/VMMSwitcher.h	(revision 14978)
+++ trunk/src/VBox/VMM/VMMSwitcher/VMMSwitcher.h	(revision 14979)
@@ -64,4 +64,5 @@
 #define FIX_GC_APIC_BASE_32BIT  34
 #define FIX_HC_64BIT_NOCHECK    35
+#define FIX_GC_64_BIT_CPUM_OFF  36
 #define FIX_THE_END             255
 /** @} */
Index: trunk/src/VBox/VMM/VMMSwitcher/VMMSwitcher.mac
===================================================================
--- trunk/src/VBox/VMM/VMMSwitcher/VMMSwitcher.mac	(revision 14978)
+++ trunk/src/VBox/VMM/VMMSwitcher/VMMSwitcher.mac	(revision 14979)
@@ -108,4 +108,5 @@
 %define FIX_GC_APIC_BASE_32BIT  34
 %define FIX_HC_64BIT_NOCHECK    35
+%define FIX_GC_64_BIT_CPUM_OFF  36
 %define FIX_THE_END             255
 ;/** @} */
