Index: /trunk/src/VBox/VMM/HWACCMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/HWACCMInternal.h	(revision 22015)
+++ /trunk/src/VBox/VMM/HWACCMInternal.h	(revision 22016)
@@ -417,11 +417,4 @@
         R0PTRTYPE(void *)           pIOBitmap;
 
-        /** R0 memory object for the MSR bitmap (8kb). */
-        RTR0MEMOBJ                  pMemObjMSRBitmap;
-        /** Physical address of the MSR bitmap (8kb). */
-        RTHCPHYS                    pMSRBitmapPhys;
-        /** Virtual address of the MSR bitmap. */
-        R0PTRTYPE(void *)           pMSRBitmap;
-
         /** SVM revision. */
         uint32_t                    u32Rev;
@@ -641,4 +634,10 @@
         PFNHWACCMSVMVMRUN           pfnVMRun;
 
+        /** R0 memory object for the MSR bitmap (8kb). */
+        RTR0MEMOBJ                  pMemObjMSRBitmap;
+        /** Physical address of the MSR bitmap (8kb). */
+        RTHCPHYS                    pMSRBitmapPhys;
+        /** Virtual address of the MSR bitmap. */
+        R0PTRTYPE(void *)           pMSRBitmap;
     } svm;
 
Index: /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 22015)
+++ /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 22016)
@@ -55,5 +55,5 @@
 static int svmR0InterpretInvpg(PVM pVM, PVMCPU pVCpu, PCPUMCTXCORE pRegFrame, uint32_t uASID);
 static int svmR0EmulateTprVMMCall(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
-static void svmR0SetMSRPermission(PVM pVM, unsigned ulMSR, bool fRead, bool fWrite);
+static void svmR0SetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite);
 
 /*******************************************************************************
@@ -132,5 +132,4 @@
 
     pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
-    pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
 
     /* Allocate 12 KB for the IO bitmap (doesn't seem to be a way to convince SVM not to use it) */
@@ -143,14 +142,4 @@
     /* Set all bits to intercept all IO accesses. */
     ASMMemFill32(pVM->hwaccm.s.svm.pIOBitmap, PAGE_SIZE*3, 0xffffffff);
-
-    /* Allocate 8 KB for the MSR bitmap (doesn't seem to be a way to convince SVM not to use it) */
-    rc = RTR0MemObjAllocCont(&pVM->hwaccm.s.svm.pMemObjMSRBitmap, 2 << PAGE_SHIFT, true /* executable R0 mapping */);
-    if (RT_FAILURE(rc))
-        return rc;
-
-    pVM->hwaccm.s.svm.pMSRBitmap     = RTR0MemObjAddress(pVM->hwaccm.s.svm.pMemObjMSRBitmap);
-    pVM->hwaccm.s.svm.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVM->hwaccm.s.svm.pMemObjMSRBitmap, 0);
-    /* Set all bits to intercept all MSR accesses. */
-    ASMMemFill32(pVM->hwaccm.s.svm.pMSRBitmap, PAGE_SIZE*2, 0xffffffff);
 
     /* Erratum 170 which requires a forced TLB flush for each world switch:
@@ -190,6 +179,7 @@
         PVMCPU pVCpu = &pVM->aCpus[i];
 
-        pVCpu->hwaccm.s.svm.pMemObjVMCBHost = NIL_RTR0MEMOBJ;
-        pVCpu->hwaccm.s.svm.pMemObjVMCB     = NIL_RTR0MEMOBJ;
+        pVCpu->hwaccm.s.svm.pMemObjVMCBHost  = NIL_RTR0MEMOBJ;
+        pVCpu->hwaccm.s.svm.pMemObjVMCB      = NIL_RTR0MEMOBJ;
+        pVCpu->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
 
         /* Allocate one page for the host context */
@@ -210,4 +200,14 @@
         pVCpu->hwaccm.s.svm.pVMCBPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.svm.pMemObjVMCB, 0);
         ASMMemZeroPage(pVCpu->hwaccm.s.svm.pVMCB);
+
+        /* Allocate 8 KB for the MSR bitmap (doesn't seem to be a way to convince SVM not to use it) */
+        rc = RTR0MemObjAllocCont(&pVCpu->hwaccm.s.svm.pMemObjMSRBitmap, 2 << PAGE_SHIFT, true /* executable R0 mapping */);
+        if (RT_FAILURE(rc))
+            return rc;
+
+        pVCpu->hwaccm.s.svm.pMSRBitmap     = RTR0MemObjAddress(pVCpu->hwaccm.s.svm.pMemObjMSRBitmap);
+        pVCpu->hwaccm.s.svm.pMSRBitmapPhys = RTR0MemObjGetPagePhysAddr(pVCpu->hwaccm.s.svm.pMemObjMSRBitmap, 0);
+        /* Set all bits to intercept all MSR accesses. */
+        ASMMemFill32(pVCpu->hwaccm.s.svm.pMSRBitmap, PAGE_SIZE*2, 0xffffffff);
     }
 
@@ -242,4 +242,11 @@
             pVCpu->hwaccm.s.svm.pMemObjVMCB = NIL_RTR0MEMOBJ;
         }
+        if (pVCpu->hwaccm.s.svm.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
+        {
+            RTR0MemObjFree(pVCpu->hwaccm.s.svm.pMemObjMSRBitmap, false);
+            pVCpu->hwaccm.s.svm.pMSRBitmap       = 0;
+            pVCpu->hwaccm.s.svm.pMSRBitmapPhys   = 0;
+            pVCpu->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
+        }
     }
     if (pVM->hwaccm.s.svm.pMemObjIOBitmap != NIL_RTR0MEMOBJ)
@@ -249,11 +256,4 @@
         pVM->hwaccm.s.svm.pIOBitmapPhys   = 0;
         pVM->hwaccm.s.svm.pMemObjIOBitmap = NIL_RTR0MEMOBJ;
-    }
-    if (pVM->hwaccm.s.svm.pMemObjMSRBitmap != NIL_RTR0MEMOBJ)
-    {
-        RTR0MemObjFree(pVM->hwaccm.s.svm.pMemObjMSRBitmap, false);
-        pVM->hwaccm.s.svm.pMSRBitmap       = 0;
-        pVM->hwaccm.s.svm.pMSRBitmapPhys   = 0;
-        pVM->hwaccm.s.svm.pMemObjMSRBitmap = NIL_RTR0MEMOBJ;
     }
     return VINF_SUCCESS;
@@ -269,5 +269,4 @@
 {
     int         rc = VINF_SUCCESS;
-    SVM_VMCB   *pVMCB;
 
     AssertReturn(pVM, VERR_INVALID_PARAMETER);
@@ -277,5 +276,7 @@
     for (unsigned i=0;i<pVM->cCPUs;i++)
     {
-        pVMCB = (SVM_VMCB *)pVM->aCpus[i].hwaccm.s.svm.pVMCB;
+        PVMCPU    pVCpu = &pVM->aCpus[i];
+        SVM_VMCB *pVMCB = (SVM_VMCB *)pVM->aCpus[i].hwaccm.s.svm.pVMCB;
+
         AssertMsgReturn(pVMCB, ("Invalid pVMCB\n"), VERR_EM_INTERNAL_ERROR);
 
@@ -352,5 +353,5 @@
         /* Set IO and MSR bitmap addresses. */
         pVMCB->ctrl.u64IOPMPhysAddr  = pVM->hwaccm.s.svm.pIOBitmapPhys;
-        pVMCB->ctrl.u64MSRPMPhysAddr = pVM->hwaccm.s.svm.pMSRBitmapPhys;
+        pVMCB->ctrl.u64MSRPMPhysAddr = pVCpu->hwaccm.s.svm.pMSRBitmapPhys;
 
         /* No LBR virtualization. */
@@ -362,19 +363,19 @@
         /** Setup the PAT msr (nested paging only) */
         pVMCB->guest.u64GPAT = 0x0007040600070406ULL;
-    }
-
-    /* The following MSRs are saved automatically by vmload/vmsave, so we allow the guest
-     * to modify them directly. 
-     */
-    svmR0SetMSRPermission(pVM, MSR_K8_LSTAR, true, true);
-    svmR0SetMSRPermission(pVM, MSR_K8_CSTAR, true, true);
-    svmR0SetMSRPermission(pVM, MSR_K6_STAR, true, true);
-    svmR0SetMSRPermission(pVM, MSR_K8_SF_MASK, true, true);
-    svmR0SetMSRPermission(pVM, MSR_K8_FS_BASE, true, true);
-    svmR0SetMSRPermission(pVM, MSR_K8_GS_BASE, true, true);
-    svmR0SetMSRPermission(pVM, MSR_K8_KERNEL_GS_BASE, true, true);
-    svmR0SetMSRPermission(pVM, MSR_IA32_SYSENTER_CS, true, true);
-    svmR0SetMSRPermission(pVM, MSR_IA32_SYSENTER_ESP, true, true);
-    svmR0SetMSRPermission(pVM, MSR_IA32_SYSENTER_EIP, true, true);
+        /* The following MSRs are saved automatically by vmload/vmsave, so we allow the guest
+         * to modify them directly. 
+         */
+        svmR0SetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
+        svmR0SetMSRPermission(pVCpu, MSR_K8_CSTAR, true, true);
+        svmR0SetMSRPermission(pVCpu, MSR_K6_STAR, true, true);
+        svmR0SetMSRPermission(pVCpu, MSR_K8_SF_MASK, true, true);
+        svmR0SetMSRPermission(pVCpu, MSR_K8_FS_BASE, true, true);
+        svmR0SetMSRPermission(pVCpu, MSR_K8_GS_BASE, true, true);
+        svmR0SetMSRPermission(pVCpu, MSR_K8_KERNEL_GS_BASE, true, true);
+        svmR0SetMSRPermission(pVCpu, MSR_IA32_SYSENTER_CS, true, true);
+        svmR0SetMSRPermission(pVCpu, MSR_IA32_SYSENTER_ESP, true, true);
+        svmR0SetMSRPermission(pVCpu, MSR_IA32_SYSENTER_EIP, true, true);
+    }
+
     return rc;
 }
@@ -384,13 +385,13 @@
  * Sets the permission bits for the specified MSR
  *
- * @param   pVM         The VM to operate on.
+ * @param   pVCpu       The VMCPU to operate on.
  * @param   ulMSR       MSR value
  * @param   fRead       Reading allowed/disallowed
  * @param   fWrite      Writing allowed/disallowed
  */
-static void svmR0SetMSRPermission(PVM pVM, unsigned ulMSR, bool fRead, bool fWrite)
+static void svmR0SetMSRPermission(PVMCPU pVCpu, unsigned ulMSR, bool fRead, bool fWrite)
 {
     unsigned ulBit;
-    uint8_t *pMSRBitmap = (uint8_t *)pVM->hwaccm.s.svm.pMSRBitmap;
+    uint8_t *pMSRBitmap = (uint8_t *)pVCpu->hwaccm.s.svm.pMSRBitmap;
 
     if (ulMSR <= 0x00001FFF)
@@ -1085,5 +1086,5 @@
             {
                 /* A TPR change could activate a pending interrupt, so catch lstar writes. */
-                svmR0SetMSRPermission(pVM, MSR_K8_LSTAR, true, false);
+                svmR0SetMSRPermission(pVCpu, MSR_K8_LSTAR, true, false);
             }
             else
@@ -1091,5 +1092,5 @@
                  * There are enough world switches for detecting pending interrupts.
                  */
-                svmR0SetMSRPermission(pVM, MSR_K8_LSTAR, true, true);
+                svmR0SetMSRPermission(pVCpu, MSR_K8_LSTAR, true, true);
         }
         else
@@ -1236,5 +1237,5 @@
     Assert(pVMCB->ctrl.IntCtrl.n.u1VIrqMasking);
     Assert(pVMCB->ctrl.u64IOPMPhysAddr  == pVM->hwaccm.s.svm.pIOBitmapPhys);
-    Assert(pVMCB->ctrl.u64MSRPMPhysAddr == pVM->hwaccm.s.svm.pMSRBitmapPhys);
+    Assert(pVMCB->ctrl.u64MSRPMPhysAddr == pVCpu->hwaccm.s.svm.pMSRBitmapPhys);
     Assert(pVMCB->ctrl.u64LBRVirt == 0);
 
