Index: trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 48139)
+++ trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 48140)
@@ -2926,5 +2926,4 @@
     ASMSetFlags(pSvmTransient->uEflags);                        /* Enable interrupts. */
 
-    VMMRZCallRing3SetNotification(pVCpu, hmR0SvmCallRing3Callback, pMixedCtx);
     VMMRZCallRing3Enable(pVCpu);                                /* It is now safe to do longjmps to ring-3!!! */
 
@@ -2975,4 +2974,5 @@
     Assert(VMMRZCallRing3IsEnabled(pVCpu));
     HMSVM_ASSERT_PREEMPT_SAFE();
+    VMMRZCallRing3SetNotification(pVCpu, hmR0SvmCallRing3Callback, pCtx);
 
     SVMTRANSIENT SvmTransient;
@@ -2999,5 +2999,4 @@
          */
         VMMRZCallRing3Disable(pVCpu);
-        VMMRZCallRing3RemoveNotification(pVCpu);
         hmR0SvmPreRunGuestCommitted(pVM, pVCpu, pCtx, &SvmTransient);
 
@@ -3016,5 +3015,5 @@
             STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit1, x);
             hmR0SvmReportWorldSwitchError(pVM, pVCpu, rc, pCtx);
-            return rc;
+            break;
         }
 
@@ -3039,5 +3038,7 @@
     else if (rc == VINF_EM_RESET)
         rc = VINF_EM_TRIPLE_FAULT;
+
     hmR0SvmExitToRing3(pVM, pVCpu, pCtx, rc);
+    VMMRZCallRing3RemoveNotification(pVCpu);
     return rc;
 }
Index: trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 48139)
+++ trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 48140)
@@ -6091,5 +6091,4 @@
     Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
     Assert(!VMMRZCallRing3IsEnabled(pVCpu));
-    Assert(VMMR0IsLogFlushDisabled(pVCpu));
 
     RTCPUID idCpu = RTMpCpuId();
@@ -6123,5 +6122,6 @@
 
     /* Restore host-state bits that VT-x only restores partially. */
-    if (pVCpu->hm.s.vmx.fRestoreHostFlags)
+    if (   (pVCpu->hm.s.vmx.fRestoreHostFlags & VMX_RESTORE_HOST_REQUIRED)
+        && (pVCpu->hm.s.vmx.fRestoreHostFlags & ~VMX_RESTORE_HOST_REQUIRED))
     {
         Log4Func(("Restoring Host State: fRestoreHostFlags=%#RX32 HostCpuId=%u\n", pVCpu->hm.s.vmx.fRestoreHostFlags, idCpu));
@@ -7526,5 +7526,5 @@
         /** @todo Find a way to fix hardcoding a guestimate.  */
         TMCpuTickSetLastSeen(pVCpu, ASMReadTSC()
-                             + pVCpu->hm.s.vmx.u64TSCOffset - 0x400 /* guestimate of world switch overhead in clock ticks */);
+                             + pVCpu->hm.s.vmx.u64TSCOffset - 0x400   /* guestimate of world switch overhead in clock ticks */);
     }
 
@@ -7534,8 +7534,7 @@
     VMCPU_SET_STATE(pVCpu, VMCPUSTATE_STARTED_HM);
 
+    pVCpu->hm.s.vmx.fRestoreHostFlags |= VMX_RESTORE_HOST_REQUIRED;   /* Host state messed up by VT-x, we must restore. */
     pVCpu->hm.s.vmx.uVmcsState |= HMVMX_VMCS_STATE_LAUNCHED;    /* Use VMRESUME instead of VMLAUNCH in the next run. */
     ASMSetFlags(pVmxTransient->uEflags);                        /* Enable interrupts. */
-
-    VMMRZCallRing3SetNotification(pVCpu, hmR0VmxCallRing3Callback, pMixedCtx);
     VMMRZCallRing3Enable(pVCpu);                                /* It is now safe to do longjmps to ring-3!!! */
 
@@ -7617,5 +7616,4 @@
          */
         VMMRZCallRing3Disable(pVCpu);
-        VMMRZCallRing3RemoveNotification(pVCpu);
         hmR0VmxPreRunGuestCommitted(pVM, pVCpu, pCtx, &VmxTransient);
 
@@ -7698,5 +7696,4 @@
          */
         VMMRZCallRing3Disable(pVCpu);
-        VMMRZCallRing3RemoveNotification(pVCpu);
         hmR0VmxPreRunGuestCommitted(pVM, pVCpu, pCtx, &VmxTransient);
 
@@ -7770,5 +7767,8 @@
 {
     Assert(VMMRZCallRing3IsEnabled(pVCpu));
+    Assert(pVCpu->hm.s.vmx.fUpdatedGuestState == HMVMX_UPDATED_GUEST_ALL);
     HMVMX_ASSERT_PREEMPT_SAFE();
+
+    VMMRZCallRing3SetNotification(pVCpu, hmR0VmxCallRing3Callback, pCtx);
 
     int rc;
@@ -7782,5 +7782,7 @@
     else if (rc == VINF_EM_RESET)
         rc = VINF_EM_TRIPLE_FAULT;
+
     hmR0VmxExitToRing3(pVM, pVCpu, pCtx, rc);
+    VMMRZCallRing3RemoveNotification(pVCpu);
     return rc;
 }
