Changeset 72744 in vbox for trunk/src/VBox/VMM/VMMR0

Timestamp:

Jun 29, 2018 7:36:19 AM (6 years ago)

Author:

vboxsync

Message:

VMM: Extend HM changed flags. ​bugref:9193 [HM, CPUM]

Location:

trunk/src/VBox/VMM/VMMR0

Files:

• HMR0.cpp (modified) (29 diffs)
• HMSVMR0.cpp (modified) (210 diffs)
• HMSVMR0.h (modified) (1 diff)
• HMVMXR0.cpp (modified) (379 diffs)
• HMVMXR0.h (modified) (2 diffs)

trunk/src/VBox/VMM/VMMR0/HMR0.cpp

@@ -89 +89 @@
     DECLR0CALLBACKMEMBER(int,  pfnEnterSession, (PVM pVM, PVMCPU pVCpu, PHMGLOBALCPUINFO pCpu));
     DECLR0CALLBACKMEMBER(void, pfnThreadCtxCallback, (RTTHREADCTXEVENT enmEvent, PVMCPU pVCpu, bool fGlobalInit));
-    DECLR0CALLBACKMEMBER(int,  pfnSaveHostState, (PVM pVM, PVMCPU pVCpu));
+    DECLR0CALLBACKMEMBER(int,  pfnExportHostState, (PVMCPU pVCpu));
     DECLR0CALLBACKMEMBER(VBOXSTRICTRC, pfnRunGuestCode, (PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx));
     DECLR0CALLBACKMEMBER(int,  pfnEnableCpu, (PHMGLOBALCPUINFO pCpu, PVM pVM, void *pvCpuPage, RTHCPHYS HCPhysCpuPage,
@@ -116 +116 @@
         /** Host CR4 value (set by ring-0 VMX init) */
         uint64_t                    u64HostCr4;
-
         /** Host EFER value (set by ring-0 VMX init) */
         uint64_t                    u64HostEfer;
-
         /** Host SMM monitor control (used for logging/diagnostics) */
         uint64_t                    u64HostSmmMonitorCtl;
@@ -149 +147 @@
         bool                        fSupported;
     } svm;
+
     /** Saved error from detection */
     int32_t                         lLastError;
@@ -176 +175 @@
 
 
-
 /**
  * Initializes a first return code structure.
@@ -237 +235 @@
 static DECLCALLBACK(int) hmR0DummyEnter(PVM pVM, PVMCPU pVCpu, PHMGLOBALCPUINFO pCpu)
 {
-    NOREF(pVM); NOREF(pVCpu); NOREF(pCpu);
+    RT_NOREF3(pVM, pVCpu, pCpu);
     return VINF_SUCCESS;
 }
@@ -243 +241 @@
 static DECLCALLBACK(void) hmR0DummyThreadCtxCallback(RTTHREADCTXEVENT enmEvent, PVMCPU pVCpu, bool fGlobalInit)
 {
-    NOREF(enmEvent); NOREF(pVCpu); NOREF(fGlobalInit);
+    RT_NOREF3(enmEvent, pVCpu, fGlobalInit);
 }
 
@@ -249 +247 @@
                                             bool fEnabledBySystem, void *pvArg)
 {
-    NOREF(pCpu); NOREF(pVM); NOREF(pvCpuPage); NOREF(HCPhysCpuPage); NOREF(fEnabledBySystem); NOREF(pvArg);
+    RT_NOREF6(pCpu, pVM, pvCpuPage, HCPhysCpuPage, fEnabledBySystem, pvArg);
     return VINF_SUCCESS;
 }
@@ -255 +253 @@
 static DECLCALLBACK(int) hmR0DummyDisableCpu(PHMGLOBALCPUINFO pCpu, void *pvCpuPage, RTHCPHYS HCPhysCpuPage)
 {
-    NOREF(pCpu);  NOREF(pvCpuPage); NOREF(HCPhysCpuPage);
+    RT_NOREF3(pCpu, pvCpuPage, HCPhysCpuPage);
     return VINF_SUCCESS;
 }
@@ -261 +259 @@
 static DECLCALLBACK(int) hmR0DummyInitVM(PVM pVM)
 {
-    NOREF(pVM);
+    RT_NOREF1(pVM);
     return VINF_SUCCESS;
 }
@@ -267 +265 @@
 static DECLCALLBACK(int) hmR0DummyTermVM(PVM pVM)
 {
-    NOREF(pVM);
+    RT_NOREF1(pVM);
     return VINF_SUCCESS;
 }
@@ -273 +271 @@
 static DECLCALLBACK(int) hmR0DummySetupVM(PVM pVM)
 {
-    NOREF(pVM);
+    RT_NOREF1(pVM);
     return VINF_SUCCESS;
 }
@@ -279 +277 @@
 static DECLCALLBACK(VBOXSTRICTRC) hmR0DummyRunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
 {
-    NOREF(pVM); NOREF(pVCpu); NOREF(pCtx);
+    RT_NOREF3(pVM, pVCpu, pCtx);
     return VINF_SUCCESS;
 }
 
-static DECLCALLBACK(int) hmR0DummySaveHostState(PVM pVM, PVMCPU pVCpu)
-{
-    NOREF(pVM); NOREF(pVCpu);
+static DECLCALLBACK(int) hmR0DummyExportHostState(PVMCPU pVCpu)
+{
+    RT_NOREF1(pVCpu);
     return VINF_SUCCESS;
 }
@@ -440 +438 @@
 
                 /* Make sure we don't get rescheduled to another cpu during this probe. */
-                RTCCUINTREG fFlags = ASMIntDisableFlags();
+                RTCCUINTREG const fEFlags = ASMIntDisableFlags();
 
                 /*
-                 * Check CR4.VMXE
+                 * Check CR4.VMXE.
                  */
                 g_HmR0.vmx.u64HostCr4 = ASMGetCR4();
                 if (!(g_HmR0.vmx.u64HostCr4 & X86_CR4_VMXE))
                 {
-                    /* In theory this bit could be cleared behind our back.  Which would cause
-                       #UD faults when we try to execute the VMX instructions... */
+                    /* In theory this bit could be cleared behind our back. Which would cause #UD
+                       faults when we try to execute the VMX instructions... */
                     ASMSetCR4(g_HmR0.vmx.u64HostCr4 | X86_CR4_VMXE);
                 }
@@ -481 +479 @@
                 }
 
-                /* Restore CR4 again; don't leave the X86_CR4_VMXE flag set
-                   if it wasn't so before (some software could incorrectly
-                   think it's in VMX mode). */
+                /*
+                 * Restore CR4 again; don't leave the X86_CR4_VMXE flag set if it was not
+                 * set before (some software could incorrectly think it is in VMX mode).
+                 */
                 ASMSetCR4(g_HmR0.vmx.u64HostCr4);
-                ASMSetFlags(fFlags);
+                ASMSetFlags(fEFlags);
 
                 RTR0MemObjFree(hScatchMemObj, false);
@@ -501 +500 @@
                 g_HmR0.pfnEnterSession      = VMXR0Enter;
                 g_HmR0.pfnThreadCtxCallback = VMXR0ThreadCtxCallback;
-                g_HmR0.pfnSaveHostState     = VMXR0SaveHostState;
+                g_HmR0.pfnExportHostState   = VMXR0ExportHostState;
                 g_HmR0.pfnRunGuestCode      = VMXR0RunGuestCode;
                 g_HmR0.pfnEnableCpu         = VMXR0EnableCpu;
@@ -565 +564 @@
         g_HmR0.pfnEnterSession      = SVMR0Enter;
         g_HmR0.pfnThreadCtxCallback = SVMR0ThreadCtxCallback;
-        g_HmR0.pfnSaveHostState     = SVMR0SaveHostState;
+        g_HmR0.pfnExportHostState   = SVMR0ExportHostState;
         g_HmR0.pfnRunGuestCode      = SVMR0RunGuestCode;
         g_HmR0.pfnEnableCpu         = SVMR0EnableCpu;
@@ -642 +641 @@
     g_HmR0.pfnEnterSession      = hmR0DummyEnter;
     g_HmR0.pfnThreadCtxCallback = hmR0DummyThreadCtxCallback;
-    g_HmR0.pfnSaveHostState     = hmR0DummySaveHostState;
+    g_HmR0.pfnExportHostState   = hmR0DummyExportHostState;
     g_HmR0.pfnRunGuestCode      = hmR0DummyRunGuestCode;
     g_HmR0.pfnEnableCpu         = hmR0DummyEnableCpu;
@@ -1338 +1337 @@
     /* On first entry we'll sync everything. */
     for (VMCPUID i = 0; i < pVM->cCpus; i++)
-        HMCPU_CF_RESET_TO(&pVM->aCpus[i], HM_CHANGED_HOST_CONTEXT | HM_CHANGED_ALL_GUEST);
+    {
+        PVMCPU pVCpu = &pVM->aCpus[i];
+        pVCpu->hm.s.fCtxChanged |= HM_CHANGED_HOST_CONTEXT | HM_CHANGED_ALL_GUEST;
+    }
 
     /*
@@ -1346 +1348 @@
     RTTHREADPREEMPTSTATE PreemptState = RTTHREADPREEMPTSTATE_INITIALIZER;
     RTThreadPreemptDisable(&PreemptState);
-    RTCPUID          idCpu  = RTMpCpuId();
+    RTCPUID idCpu = RTMpCpuId();
 
     /* Enable VT-x or AMD-V if local init is required. */
@@ -1400 +1402 @@
 
     /* Reload host-state (back from ring-3/migrated CPUs) and shared guest/host bits. */
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_HOST_CONTEXT | HM_CHANGED_HOST_GUEST_SHARED_STATE);
+    if (g_HmR0.vmx.fSupported)
+        pVCpu->hm.s.fCtxChanged |= HM_CHANGED_HOST_CONTEXT | HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE;
+    else
+        pVCpu->hm.s.fCtxChanged |= HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE;
 
     Assert(pCpu->idCpu == idCpu && pCpu->idCpu != NIL_RTCPUID);
@@ -1435 +1440 @@
     PHMGLOBALCPUINFO pCpu  = &g_HmR0.aCpuInfo[idCpu];
     Assert(pCpu);
-    Assert(HMCPU_CF_IS_SET(pVCpu, HM_CHANGED_HOST_CONTEXT | HM_CHANGED_HOST_GUEST_SHARED_STATE));
+    if (g_HmR0.vmx.fSupported)
+    {
+        Assert((pVCpu->hm.s.fCtxChanged & (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE))
+               == (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE));
+    }
+    else
+    {
+        Assert((pVCpu->hm.s.fCtxChanged & (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE))
+               == (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE));
+    }
 
     rc = g_HmR0.pfnEnterSession(pVM, pVCpu, pCpu);
-    AssertMsgRCReturn(rc, ("pfnEnterSession failed. rc=%Rrc pVCpu=%p HostCpuId=%u\n", rc, pVCpu, idCpu), rc);
-
-    /* Load the host-state as we may be resuming code after a longjmp and quite
+    AssertMsgRCReturn(rc, ("rc=%Rrc pVCpu=%p HostCpuId=%u\n", rc, pVCpu, idCpu), rc);
+
+    /* Exports the host-state as we may be resuming code after a longjmp and quite
        possibly now be scheduled on a different CPU. */
-    rc = g_HmR0.pfnSaveHostState(pVM, pVCpu);
-    AssertMsgRCReturn(rc, ("pfnSaveHostState failed. rc=%Rrc pVCpu=%p HostCpuId=%u\n", rc, pVCpu, idCpu), rc);
+    rc = g_HmR0.pfnExportHostState(pVCpu);
+    AssertMsgRCReturn(rc, ("rc=%Rrc pVCpu=%p HostCpuId=%u\n", rc, pVCpu, idCpu), rc);
 
 #ifdef VBOX_WITH_2X_4GB_ADDR_SPACE
@@ -1556 +1570 @@
 VMMR0_INT_DECL(void) HMR0NotifyCpumUnloadedGuestFpuState(PVMCPU pVCpu)
 {
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR0);
+    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR0);
 }
 
@@ -1567 +1581 @@
 VMMR0_INT_DECL(void) HMR0NotifyCpumModifiedHostCr0(PVMCPU pVCpu)
 {
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_HOST_CONTEXT);
+    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_HOST_CONTEXT);
 }
 
@@ -1585 +1599 @@
     STAM_COUNTER_INC(&pVCpu->hm.s.StatFpu64SwitchBack);
     if (pVM->hm.s.vmx.fSupported)
-        return VMXR0Execute64BitsHandler(pVM, pVCpu, pCtx, HM64ON32OP_HMRCSaveGuestFPU64, 0, NULL);
-    return SVMR0Execute64BitsHandler(pVM, pVCpu, pCtx, HM64ON32OP_HMRCSaveGuestFPU64, 0, NULL);
+        return VMXR0Execute64BitsHandler(pVCpu, HM64ON32OP_HMRCSaveGuestFPU64, 0, NULL);
+    return SVMR0Execute64BitsHandler(pVCpu, HM64ON32OP_HMRCSaveGuestFPU64, 0, NULL);
 }
 
@@ -1602 +1616 @@
     STAM_COUNTER_INC(&pVCpu->hm.s.StatDebug64SwitchBack);
     if (pVM->hm.s.vmx.fSupported)
-        return VMXR0Execute64BitsHandler(pVM, pVCpu, pCtx, HM64ON32OP_HMRCSaveGuestDebug64, 0, NULL);
-    return SVMR0Execute64BitsHandler(pVM, pVCpu, pCtx, HM64ON32OP_HMRCSaveGuestDebug64, 0, NULL);
+        return VMXR0Execute64BitsHandler(pVCpu, HM64ON32OP_HMRCSaveGuestDebug64, 0, NULL);
+    return SVMR0Execute64BitsHandler(pVCpu, HM64ON32OP_HMRCSaveGuestDebug64, 0, NULL);
 }
 
@@ -1622 +1636 @@
     STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatWorldSwitch3264, z);
     if (pVM->hm.s.vmx.fSupported)
-        rc = VMXR0Execute64BitsHandler(pVM, pVCpu, pCtx, HM64ON32OP_HMRCTestSwitcher64, 5, &aParam[0]);
+        rc = VMXR0Execute64BitsHandler(pVCpu, HM64ON32OP_HMRCTestSwitcher64, 5, &aParam[0]);
     else
-        rc = SVMR0Execute64BitsHandler(pVM, pVCpu, pCtx, HM64ON32OP_HMRCTestSwitcher64, 5, &aParam[0]);
+        rc = SVMR0Execute64BitsHandler(pVCpu, HM64ON32OP_HMRCTestSwitcher64, 5, &aParam[0]);
     STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatWorldSwitch3264, z);
 
@@ -1701 +1715 @@
  * @returns VBox status code.
  * @param   pVCpu       The cross context CPU structure.
- * @param   pCtx        The target CPU context.
  * @param   fWhat       What to import, CPUMCTX_EXTRN_XXX.
  */
-VMMR0_INT_DECL(int) HMR0ImportStateOnDemand(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t fWhat)
-{
-    /** @todo Intel. */
-#if 0
-    if (pVCpu->CTX_SUFF(pVM).hm.s.vmx.fSupported)
-        return VMXR0ImportStateOnDemand(pVCpu, pCtx, fWhat);
-#endif
-    return SVMR0ImportStateOnDemand(pVCpu, pCtx, fWhat);
+VMMR0_INT_DECL(int) HMR0ImportStateOnDemand(PVMCPU pVCpu, uint64_t fWhat)
+{
+    if (pVCpu->CTX_SUFF(pVM)->hm.s.vmx.fSupported)
+        return VMXR0ImportStateOnDemand(pVCpu, fWhat);
+    return SVMR0ImportStateOnDemand(pVCpu, fWhat);
 }
 
@@ -1959 +1969 @@
         { "vip", NULL, X86_EFL_VIP },
         { "vif", NULL, X86_EFL_VIF },
-        { "ac",  NULL, X86_EFL_AC },
-        { "vm",  NULL, X86_EFL_VM },
-        { "rf",  NULL, X86_EFL_RF },
-        { "nt",  NULL, X86_EFL_NT },
-        { "ov",  "nv", X86_EFL_OF },
-        { "dn",  "up", X86_EFL_DF },
-        { "ei",  "di", X86_EFL_IF },
-        { "tf",  NULL, X86_EFL_TF },
-        { "nt",  "pl", X86_EFL_SF },
-        { "nz",  "zr", X86_EFL_ZF },
-        { "ac",  "na", X86_EFL_AF },
-        { "po",  "pe", X86_EFL_PF },
-        { "cy",  "nc", X86_EFL_CF },
+        { "ac",  NULL, X86_EFL_AC  },
+        { "vm",  NULL, X86_EFL_VM  },
+        { "rf",  NULL, X86_EFL_RF  },
+        { "nt",  NULL, X86_EFL_NT  },
+        { "ov",  "nv", X86_EFL_OF  },
+        { "dn",  "up", X86_EFL_DF  },
+        { "ei",  "di", X86_EFL_IF  },
+        { "tf",  NULL, X86_EFL_TF  },
+        { "nt",  "pl", X86_EFL_SF  },
+        { "nz",  "zr", X86_EFL_ZF  },
+        { "ac",  "na", X86_EFL_AF  },
+        { "po",  "pe", X86_EFL_PF  },
+        { "cy",  "nc", X86_EFL_CF  },
     };
     char szEFlags[80];
@@ -1987 +1997 @@
     }
     psz[-1] = '\0';
-
 
     /*

trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp

@@ -37 +37 @@
 #include "dtrace/VBoxVMM.h"
 
-#define HMSVM_USE_IEM_EVENT_REFLECTION
 #ifdef DEBUG_ramshankar
 # define HMSVM_SYNC_FULL_GUEST_STATE
@@ -106 +105 @@
                                          | CPUMCTX_EXTRN_HM_SVM_MASK)
 
+/**
+ * Subset of the guest-CPU state that is shared between the guest and host.
+ */
+#define HMSVM_CPUMCTX_SHARED_STATE      CPUMCTX_EXTRN_DR_MASK
+
 /** Macro for importing guest state from the VMCB back into CPUMCTX.  */
-#define HMSVM_CPUMCTX_IMPORT_STATE(a_pVCpu, a_pCtx, a_fWhat) \
+#define HMSVM_CPUMCTX_IMPORT_STATE(a_pVCpu, a_fWhat) \
     do { \
-        if ((a_pCtx)->fExtrn & (a_fWhat)) \
-            hmR0SvmImportGuestState((a_pVCpu), (a_pCtx), (a_fWhat)); \
+        if ((a_pVCpu)->cpum.GstCtx.fExtrn & (a_fWhat)) \
+            hmR0SvmImportGuestState((a_pVCpu), (a_fWhat)); \
     } while (0)
 
@@ -131 +135 @@
                  &&   CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_SHUTDOWN)) \
         { \
-            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK); \
+            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK); \
             return VBOXSTRICTRC_TODO(IEMExecSvmVmexit(pVCpu, SVM_EXIT_SHUTDOWN, 0, 0)); \
         } \
@@ -368 +372 @@
 *   Internal Functions                                                                                                           *
 *********************************************************************************************************************************/
-static void hmR0SvmSetMsrPermission(PCCPUMCTX pCtx, uint8_t *pbMsrBitmap, unsigned uMsr, SVMMSREXITREAD enmRead,
-                                    SVMMSREXITWRITE enmWrite);
 static void hmR0SvmPendingEventToTrpmTrap(PVMCPU pVCpu);
 static void hmR0SvmLeave(PVMCPU pVCpu, bool fImportState);
-static void hmR0SvmImportGuestState(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t fWhat);
 
 
@@ -463 +464 @@
  * @param   pVCpu       The cross context virtual CPU structure.
  * @param   pVmcb       Pointer to the VM control block.
- * @param   pCtx        Pointer to the guest-CPU context.
  * @param   pszPrefix   Log prefix.
  * @param   fFlags      Log flags, see HMSVM_LOG_XXX.
  * @param   uVerbose    The verbosity level, currently unused.
  */
-static void hmR0SvmLogState(PVMCPU pVCpu, PCSVMVMCB pVmcb, PCCPUMCTX pCtx, const char *pszPrefix, uint32_t fFlags,
-                             uint8_t uVerbose)
+static void hmR0SvmLogState(PVMCPU pVCpu, PCSVMVMCB pVmcb, const char *pszPrefix, uint32_t fFlags, uint8_t uVerbose)
 {
     RT_NOREF2(pVCpu, uVerbose);
+    PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
 
     HMSVM_CPUMCTX_ASSERT(pVCpu, CPUMCTX_EXTRN_CS | CPUMCTX_EXTRN_RIP | CPUMCTX_EXTRN_RFLAGS);
@@ -549 +549 @@
 
     /* Paranoid: Disable interrupt as, in theory, interrupt handlers might mess with EFER. */
-    RTCCUINTREG fEFlags = ASMIntDisableFlags();
+    RTCCUINTREG const fEFlags = ASMIntDisableFlags();
 
     /*
@@ -560 +560 @@
         if (   pVM
             && pVM->hm.s.svm.fIgnoreInUseError)
-        {
             pCpu->fIgnoreAMDVInUseError = true;
-        }
 
         if (!pCpu->fIgnoreAMDVInUseError)
@@ -581 +579 @@
 
     /*
-     * Theoretically, other hypervisors may have used ASIDs, ideally we should flush all non-zero ASIDs
-     * when enabling SVM. AMD doesn't have an SVM instruction to flush all ASIDs (flushing is done
-     * upon VMRUN). Therefore, flag that we need to flush the TLB entirely with before executing any
-     * guest code.
+     * Theoretically, other hypervisors may have used ASIDs, ideally we should flush all
+     * non-zero ASIDs when enabling SVM. AMD doesn't have an SVM instruction to flush all
+     * ASIDs (flushing is done upon VMRUN). Therefore, flag that we need to flush the TLB
+     * entirely with before executing any guest code.
      */
     pCpu->fFlushAsidBeforeUse = true;
@@ -614 +612 @@
 
     /* Paranoid: Disable interrupts as, in theory, interrupt handlers might mess with EFER. */
-    RTCCUINTREG fEFlags = ASMIntDisableFlags();
+    RTCCUINTREG const fEFlags = ASMIntDisableFlags();
 
     /* Turn off AMD-V in the EFER MSR. */
@@ -727 +725 @@
     if (HMAmdIsSubjectToErratum170(&u32Family, &u32Model, &u32Stepping))
     {
-        Log4(("SVMR0InitVM: AMD cpu with erratum 170 family %#x model %#x stepping %#x\n", u32Family, u32Model, u32Stepping));
+        Log4Func(("AMD cpu with erratum 170 family %#x model %#x stepping %#x\n", u32Family, u32Model, u32Stepping));
         pVM->hm.s.svm.fAlwaysFlushTLB = true;
     }
@@ -989 +987 @@
     /* If you add any exceptions here, make sure to update hmR0SvmHandleExit(). */
     pVmcbCtrl->u32InterceptXcpt |= 0
-                                 | RT_BIT(X86_XCPT_BP)
-                                 | RT_BIT(X86_XCPT_DE)
-                                 | RT_BIT(X86_XCPT_NM)
-                                 | RT_BIT(X86_XCPT_UD)
-                                 | RT_BIT(X86_XCPT_NP)
-                                 | RT_BIT(X86_XCPT_SS)
-                                 | RT_BIT(X86_XCPT_GP)
-                                 | RT_BIT(X86_XCPT_PF)
-                                 | RT_BIT(X86_XCPT_MF)
-                                 ;
+                                | RT_BIT(X86_XCPT_BP)
+                                | RT_BIT(X86_XCPT_DE)
+                                | RT_BIT(X86_XCPT_NM)
+                                | RT_BIT(X86_XCPT_UD)
+                                | RT_BIT(X86_XCPT_NP)
+                                | RT_BIT(X86_XCPT_SS)
+                                | RT_BIT(X86_XCPT_GP)
+                                | RT_BIT(X86_XCPT_PF)
+                                | RT_BIT(X86_XCPT_MF)
+                                ;
 #endif
 
@@ -1185 +1183 @@
     if (!fFlushPending)
     {
-        Log4(("SVMR0InvalidatePage %RGv\n", GCVirt));
+        Log4Func(("%#RGv\n", GCVirt));
 
         PCPUMCTX pCtx  = CPUMQueryGuestCtxPtr(pVCpu);
@@ -1222 +1220 @@
 
     /*
-     * Force a TLB flush for the first world switch if the current CPU differs from the one we ran on last.
-     * This can happen both for start & resume due to long jumps back to ring-3.
+     * Force a TLB flush for the first world switch if the current CPU differs from the one
+     * we ran on last. This can happen both for start & resume due to long jumps back to
+     * ring-3.
      *
-     * We also force a TLB flush every time when executing a nested-guest VCPU as there is no correlation
-     * between it and the physical CPU.
+     * We also force a TLB flush every time when executing a nested-guest VCPU as there is no
+     * correlation between it and the physical CPU.
      *
-     * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB,
-     * so we cannot reuse the ASIDs without flushing.
+     * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while
+     * flushing the TLB, so we cannot reuse the ASIDs without flushing.
      */
     bool fNewAsid = false;
@@ -1376 +1375 @@
     aParam[7] = 0;
 
-    return SVMR0Execute64BitsHandler(pVM, pVCpu, pCtx, HM64ON32OP_SVMRCVMRun64, RT_ELEMENTS(aParam), &aParam[0]);
+    return SVMR0Execute64BitsHandler(pVCpu, HM64ON32OP_SVMRCVMRun64, RT_ELEMENTS(aParam), &aParam[0]);
 }
 
@@ -1384 +1383 @@
  *
  * @returns VBox status code.
- * @param   pVM         The cross context VM structure.
  * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pCtx        Pointer to the guest-CPU context.
  * @param   enmOp       The operation to perform.
  * @param   cParams     Number of parameters.
  * @param   paParam     Array of 32-bit parameters.
  */
-VMMR0DECL(int) SVMR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, HM64ON32OP enmOp,
-                                         uint32_t cParams, uint32_t *paParam)
-{
+VMMR0DECL(int) SVMR0Execute64BitsHandler(PVMCPU pVCpu, HM64ON32OP enmOp, uint32_t cParams, uint32_t *paParam)
+{
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
     AssertReturn(pVM->hm.s.pfnHost32ToGuest64R0, VERR_HM_NO_32_TO_64_SWITCHER);
     Assert(enmOp > HM64ON32OP_INVALID && enmOp < HM64ON32OP_END);
 
-    NOREF(pCtx);
-
     /* Disable interrupts. */
-    RTHCUINTREG uOldEFlags = ASMIntDisableFlags();
+    RTHCUINTREG const fEFlags = ASMIntDisableFlags();
 
 #ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
@@ -1412 +1407 @@
         CPUMPushHyper(pVCpu, paParam[i]);
 
+    /* Call the switcher. */
     STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatWorldSwitch3264, z);
-    /* Call the switcher. */
     int rc = pVM->hm.s.pfnHost32ToGuest64R0(pVM, RT_OFFSETOF(VM, aCpus[pVCpu->idCpu].cpum) - RT_OFFSETOF(VM, cpum));
     STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatWorldSwitch3264, z);
 
     /* Restore interrupts. */
-    ASMSetFlags(uOldEFlags);
+    ASMSetFlags(fEFlags);
     return rc;
 }
@@ -1446 +1441 @@
  *
  * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pCtx        Pointer to the guest-CPU context.
  * @param   pVmcb       Pointer to the VM control block.
  * @param   uXcpt       The exception (X86_XCPT_*).
@@ -1454 +1448 @@
  *          are not intercepting it.
  */
-DECLINLINE(void) hmR0SvmClearXcptIntercept(PVMCPU pVCpu, PCCPUMCTX pCtx, PSVMVMCB pVmcb, uint8_t uXcpt)
+DECLINLINE(void) hmR0SvmClearXcptIntercept(PVMCPU pVCpu, PSVMVMCB pVmcb, uint8_t uXcpt)
 {
     Assert(uXcpt != X86_XCPT_DB);
@@ -1464 +1458 @@
 #ifdef VBOX_WITH_NESTED_HWVIRT_SVM
         /* Only remove the intercept if the nested-guest is also not intercepting it! */
+        PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
         if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
         {
@@ -1469 +1464 @@
             fRemove = !(pVmcbNstGstCache->u32InterceptXcpt & RT_BIT(uXcpt));
         }
-#else
-        RT_NOREF2(pVCpu, pCtx);
 #endif
         if (fRemove)
@@ -1479 +1472 @@
     }
 #else
-    RT_NOREF3(pVCpu, pCtx, pVmcb);
+    RT_NOREF3(pVCpu, pVmcb, uXcpt);
 #endif
 }
@@ -1540 +1533 @@
 
 /**
- * Loads the guest (or nested-guest) CR0 control register into the guest-state
- * area in the VMCB.
- *
- * Although the guest CR0 is a separate field in the VMCB we have to consider
- * the FPU state itself which is shared between the host and the guest.
- *
- * @returns VBox status code.
+ * Exports the guest (or nested-guest) CR0 into the VMCB.
+ *
  * @param   pVCpu       The cross context virtual CPU structure.
  * @param   pVmcb       Pointer to the VM control block.
- * @param   pCtx        Pointer to the guest-CPU context.
- *
+ *
+ * @remarks This assumes we always pre-load the guest FPU.
  * @remarks No-long-jump zone!!!
  */
-static void hmR0SvmLoadSharedCR0(PVMCPU pVCpu, PSVMVMCB pVmcb, PCCPUMCTX pCtx)
-{
-    /* The guest FPU is now always pre-loaded before executing guest code, see @bugref{7243#c101}. */
-    Assert(CPUMIsGuestFPUStateActive(pVCpu));
-
+static void hmR0SvmExportGuestCR0(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
+
+    PCPUMCTX       pCtx = &pVCpu->cpum.GstCtx;
     uint64_t const uGuestCr0  = pCtx->cr0;
     uint64_t       uShadowCr0 = uGuestCr0;
@@ -1564 +1552 @@
     uShadowCr0 &= ~(X86_CR0_CD | X86_CR0_NW);
 
-    /* When Nested Paging is not available use shadow page tables and intercept #PFs (the latter done in SVMR0SetupVM()). */
+    /* When Nested Paging is not available use shadow page tables and intercept #PFs (latter done in SVMR0SetupVM()). */
     if (!pVCpu->CTX_SUFF(pVM)->hm.s.fNestedPaging)
     {
@@ -1572 +1560 @@
 
     /*
-     * Use the #MF style of legacy-FPU error reporting for now. Although AMD-V has MSRs that lets us
-     * isolate the host from it, IEM/REM still needs work to emulate it properly. see @bugref{7243#c103}.
+     * Use the #MF style of legacy-FPU error reporting for now. Although AMD-V has MSRs that
+     * lets us isolate the host from it, IEM/REM still needs work to emulate it properly,
+     * see @bugref{7243#c103}.
      */
     if (!(uGuestCr0 & X86_CR0_NE))
@@ -1581 +1570 @@
     }
     else
-        hmR0SvmClearXcptIntercept(pVCpu, pCtx, pVmcb, X86_XCPT_MF);
+        hmR0SvmClearXcptIntercept(pVCpu, pVmcb, X86_XCPT_MF);
 
     /*
      * If the shadow and guest CR0 are identical we can avoid intercepting CR0 reads.
      *
-     * CR0 writes still needs interception as PGM requires tracking paging mode changes, see @bugref{6944}.
-     * We also don't ever want to honor weird things like cache disable from the guest. However, we can
-     * avoid intercepting changes to the TS & MP bits by clearing the CR0 write intercept below and keeping
-     * SVM_CTRL_INTERCEPT_CR0_SEL_WRITE instead.
+     * CR0 writes still needs interception as PGM requires tracking paging mode changes,
+     * see @bugref{6944}.
+     *
+     * We also don't ever want to honor weird things like cache disable from the guest.
+     * However, we can avoid intercepting changes to the TS & MP bits by clearing the CR0
+     * write intercept below and keeping SVM_CTRL_INTERCEPT_CR0_SEL_WRITE instead.
      */
     if (uShadowCr0 == uGuestCr0)
@@ -1626 +1617 @@
 
 /**
- * Loads the guest/nested-guest control registers (CR2, CR3, CR4) into the VMCB.
+ * Exports the guest (or nested-guest) CR3 into the VMCB.
+ *
+ * @param   pVCpu       The cross context virtual CPU structure.
+ * @param   pVmcb       Pointer to the VM control block.
+ *
+ * @remarks No-long-jump zone!!!
+ */
+static void hmR0SvmExportGuestCR3(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
+
+    PVM      pVM  = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
+    if (pVM->hm.s.fNestedPaging)
+    {
+        PGMMODE enmShwPagingMode;
+#if HC_ARCH_BITS == 32
+        if (CPUMIsGuestInLongModeEx(pCtx))
+            enmShwPagingMode = PGMMODE_AMD64_NX;
+        else
+#endif
+            enmShwPagingMode = PGMGetHostMode(pVM);
+
+        pVmcb->ctrl.u64NestedPagingCR3 = PGMGetNestedCR3(pVCpu, enmShwPagingMode);
+        pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_NP;
+        pVmcb->guest.u64CR3 = pCtx->cr3;
+        Assert(pVmcb->ctrl.u64NestedPagingCR3);
+    }
+    else
+        pVmcb->guest.u64CR3 = PGMGetHyperCR3(pVCpu);
+
+    pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
+}
+
+
+/**
+ * Exports the guest (or nested-guest) CR4 into the VMCB.
+ *
+ * @param   pVCpu       The cross context virtual CPU structure.
+ * @param   pVmcb       Pointer to the VM control block.
+ *
+ * @remarks No-long-jump zone!!!
+ */
+static int hmR0SvmExportGuestCR4(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
+
+    PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
+    uint64_t uShadowCr4 = pCtx->cr4;
+    if (!pVCpu->CTX_SUFF(pVM)->hm.s.fNestedPaging)
+    {
+        switch (pVCpu->hm.s.enmShadowMode)
+        {
+            case PGMMODE_REAL:
+            case PGMMODE_PROTECTED:     /* Protected mode, no paging. */
+                return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
+
+            case PGMMODE_32_BIT:        /* 32-bit paging. */
+                uShadowCr4 &= ~X86_CR4_PAE;
+                break;
+
+            case PGMMODE_PAE:           /* PAE paging. */
+            case PGMMODE_PAE_NX:        /* PAE paging with NX enabled. */
+                /** Must use PAE paging as we could use physical memory > 4 GB */
+                uShadowCr4 |= X86_CR4_PAE;
+                break;
+
+            case PGMMODE_AMD64:         /* 64-bit AMD paging (long mode). */
+            case PGMMODE_AMD64_NX:      /* 64-bit AMD paging (long mode) with NX enabled. */
+#ifdef VBOX_ENABLE_64_BITS_GUESTS
+                break;
+#else
+                return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
+#endif
+
+            default:                    /* shut up gcc */
+                return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
+        }
+    }
+
+    /* Whether to save/load/restore XCR0 during world switch depends on CR4.OSXSAVE and host+guest XCR0. */
+    pVCpu->hm.s.fLoadSaveGuestXcr0 = (pCtx->cr4 & X86_CR4_OSXSAVE) && pCtx->aXcr[0] != ASMGetXcr0();
+
+    /* Avoid intercepting CR4 reads if the guest and shadow CR4 values are identical. */
+    if (uShadowCr4 == pCtx->cr4)
+    {
+        if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
+            pVmcb->ctrl.u16InterceptRdCRx &= ~RT_BIT(4);
+        else
+        {
+            /* If the nested-hypervisor intercepts CR4 reads, we need to continue intercepting them. */
+            PCSVMNESTEDVMCBCACHE pVmcbNstGstCache = hmR0SvmGetNestedVmcbCache(pVCpu);
+            pVmcb->ctrl.u16InterceptRdCRx = (pVmcb->ctrl.u16InterceptRdCRx       & ~RT_BIT(4))
+                                          | (pVmcbNstGstCache->u16InterceptRdCRx &  RT_BIT(4));
+        }
+    }
+    else
+        pVmcb->ctrl.u16InterceptRdCRx |= RT_BIT(4);
+
+    /* CR4 writes are always intercepted (both guest, nested-guest) for tracking PGM mode changes. */
+    Assert(pVmcb->ctrl.u16InterceptWrCRx & RT_BIT(4));
+
+    /* Update VMCB with the shadow CR4 the appropriate VMCB clean bits. */
+    Assert(RT_HI_U32(uShadowCr4) == 0);
+    pVmcb->guest.u64CR4 = uShadowCr4;
+    pVmcb->ctrl.u32VmcbCleanBits &= ~(HMSVM_VMCB_CLEAN_CRX_EFER | HMSVM_VMCB_CLEAN_INTERCEPTS);
+
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Exports the guest (or nested-guest) control registers into the VMCB.
  *
  * @returns VBox status code.
  * @param   pVCpu       The cross context virtual CPU structure.
  * @param   pVmcb       Pointer to the VM control block.
- * @param   pCtx        Pointer to the guest-CPU context.
  *
  * @remarks No-long-jump zone!!!
  */
-static int hmR0SvmLoadGuestControlRegs(PVMCPU pVCpu, PSVMVMCB pVmcb, PCCPUMCTX pCtx)
-{
-    PVM pVM = pVCpu->CTX_SUFF(pVM);
-
-    /*
-     * Guest CR2.
-     */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR2))
-    {
-        pVmcb->guest.u64CR2 = pCtx->cr2;
-        pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CR2;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_CR2);
-    }
-
-    /*
-     * Guest CR3.
-     */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR3))
-    {
-        if (pVM->hm.s.fNestedPaging)
-        {
-            PGMMODE enmShwPagingMode;
-#if HC_ARCH_BITS == 32
-            if (CPUMIsGuestInLongModeEx(pCtx))
-                enmShwPagingMode = PGMMODE_AMD64_NX;
-            else
-#endif
-                enmShwPagingMode = PGMGetHostMode(pVM);
-
-            pVmcb->ctrl.u64NestedPagingCR3 = PGMGetNestedCR3(pVCpu, enmShwPagingMode);
-            pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_NP;
-            Assert(pVmcb->ctrl.u64NestedPagingCR3);
-            pVmcb->guest.u64CR3 = pCtx->cr3;
-        }
-        else
-        {
-            pVmcb->guest.u64CR3 = PGMGetHyperCR3(pVCpu);
-            Log4(("hmR0SvmLoadGuestControlRegs: CR3=%#RX64 (HyperCR3=%#RX64)\n", pCtx->cr3, pVmcb->guest.u64CR3));
-        }
-
-        pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_CR3);
-    }
-
-    /*
-     * Guest CR4.
-     * ASSUMES this is done everytime we get in from ring-3! (XCR0)
-     */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR4))
-    {
-        uint64_t uShadowCr4 = pCtx->cr4;
-        if (!pVM->hm.s.fNestedPaging)
-        {
-            switch (pVCpu->hm.s.enmShadowMode)
-            {
-                case PGMMODE_REAL:
-                case PGMMODE_PROTECTED:     /* Protected mode, no paging. */
-                    AssertFailed();
-                    return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
-
-                case PGMMODE_32_BIT:        /* 32-bit paging. */
-                    uShadowCr4 &= ~X86_CR4_PAE;
-                    break;
-
-                case PGMMODE_PAE:           /* PAE paging. */
-                case PGMMODE_PAE_NX:        /* PAE paging with NX enabled. */
-                    /** Must use PAE paging as we could use physical memory > 4 GB */
-                    uShadowCr4 |= X86_CR4_PAE;
-                    break;
-
-                case PGMMODE_AMD64:         /* 64-bit AMD paging (long mode). */
-                case PGMMODE_AMD64_NX:      /* 64-bit AMD paging (long mode) with NX enabled. */
-#ifdef VBOX_ENABLE_64_BITS_GUESTS
-                    break;
-#else
-                    AssertFailed();
-                    return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
-#endif
-
-                default:                    /* shut up gcc */
-                    AssertFailed();
-                    return VERR_PGM_UNSUPPORTED_SHADOW_PAGING_MODE;
-            }
-        }
-
-        /* Whether to save/load/restore XCR0 during world switch depends on CR4.OSXSAVE and host+guest XCR0. */
-        pVCpu->hm.s.fLoadSaveGuestXcr0 = (pCtx->cr4 & X86_CR4_OSXSAVE) && pCtx->aXcr[0] != ASMGetXcr0();
-
-        /* Avoid intercepting CR4 reads if the guest and shadow CR4 values are identical. */
-        if (uShadowCr4 == pCtx->cr4)
-        {
-            if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
-                pVmcb->ctrl.u16InterceptRdCRx &= ~RT_BIT(4);
-            else
-            {
-                /* If the nested-hypervisor intercepts CR4 reads, we need to continue intercepting them. */
-                PCSVMNESTEDVMCBCACHE pVmcbNstGstCache = hmR0SvmGetNestedVmcbCache(pVCpu);
-                pVmcb->ctrl.u16InterceptRdCRx = (pVmcb->ctrl.u16InterceptRdCRx       & ~RT_BIT(4))
-                                              | (pVmcbNstGstCache->u16InterceptRdCRx &  RT_BIT(4));
-            }
-        }
-        else
-            pVmcb->ctrl.u16InterceptRdCRx |= RT_BIT(4);
-
-        /* CR4 writes are always intercepted (both guest, nested-guest) from tracking PGM mode changes. */
-        Assert(pVmcb->ctrl.u16InterceptWrCRx & RT_BIT(4));
-
-        /* Update VMCB with the shadow CR4 the appropriate VMCB clean bits. */
-        Assert(RT_HI_U32(uShadowCr4) == 0);
-        pVmcb->guest.u64CR4 = uShadowCr4;
-        pVmcb->ctrl.u32VmcbCleanBits &= ~(HMSVM_VMCB_CLEAN_CRX_EFER | HMSVM_VMCB_CLEAN_INTERCEPTS);
-
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_CR4);
-    }
-
+static int hmR0SvmExportGuestControlRegs(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
+
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR_MASK)
+    {
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR0)
+            hmR0SvmExportGuestCR0(pVCpu, pVmcb);
+
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR2)
+        {
+            pVmcb->guest.u64CR2 = pVCpu->cpum.GstCtx.cr2;
+            pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CR2;
+        }
+
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR3)
+            hmR0SvmExportGuestCR3(pVCpu, pVmcb);
+
+        /* CR4 re-loading is ASSUMED to be done everytime we get in from ring-3! (XCR0) */
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CR4)
+        {
+            int rc = hmR0SvmExportGuestCR4(pVCpu, pVmcb);
+            if (RT_FAILURE(rc))
+                return rc;
+        }
+
+        pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_GUEST_CR_MASK;
+    }
     return VINF_SUCCESS;
 }
@@ -1755 +1770 @@
 
 /**
- * Loads the guest (or nested-guest) segment registers into the VMCB.
+ * Exports the guest (or nested-guest) segment registers into the VMCB.
  *
  * @returns VBox status code.
  * @param   pVCpu       The cross context virtual CPU structure.
  * @param   pVmcb       Pointer to the VM control block.
- * @param   pCtx        Pointer to the guest-CPU or nested-guest-CPU context.
  *
  * @remarks No-long-jump zone!!!
  */
-static void hmR0SvmLoadGuestSegmentRegs(PVMCPU pVCpu, PSVMVMCB pVmcb, PCCPUMCTX pCtx)
-{
-    /* Guest Segment registers: CS, SS, DS, ES, FS, GS. */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_SEGMENT_REGS))
-    {
-        HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, CS, cs);
-        HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, SS, ss);
-        HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, DS, ds);
-        HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, ES, es);
-        HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, FS, fs);
-        HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, GS, gs);
-
-        pVmcb->guest.u8CPL = pCtx->ss.Attr.n.u2Dpl;
+static void hmR0SvmExportGuestSegmentRegs(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
+    PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
+
+    /* Guest segment registers. */
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SREG_MASK)
+    {
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_CS)
+            HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, CS, cs);
+
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SS)
+        {
+            HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, SS, ss);
+            pVmcb->guest.u8CPL = pCtx->ss.Attr.n.u2Dpl;
+        }
+
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_DS)
+            HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, DS, ds);
+
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_ES)
+            HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, ES, es);
+
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_FS)
+            HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, FS, fs);
+
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_GS)
+            HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, GS, gs);
+
         pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_SEG;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_SEGMENT_REGS);
     }
 
     /* Guest TR. */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_TR))
-    {
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_TR)
         HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, TR, tr);
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_TR);
-    }
 
     /* Guest LDTR. */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_LDTR))
-    {
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_LDTR)
         HMSVM_SEG_REG_COPY_TO_VMCB(pCtx, &pVmcb->guest, LDTR, ldtr);
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_LDTR);
-    }
 
     /* Guest GDTR. */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_GDTR))
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_GDTR)
     {
         pVmcb->guest.GDTR.u32Limit = pCtx->gdtr.cbGdt;
         pVmcb->guest.GDTR.u64Base  = pCtx->gdtr.pGdt;
         pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DT;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_GDTR);
     }
 
     /* Guest IDTR. */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_IDTR))
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_IDTR)
     {
         pVmcb->guest.IDTR.u32Limit = pCtx->idtr.cbIdt;
         pVmcb->guest.IDTR.u64Base  = pCtx->idtr.pIdt;
         pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DT;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_IDTR);
-    }
-}
-
-
-/**
- * Loads the guest (or nested-guest) MSRs into the VMCB.
+    }
+
+    pVCpu->hm.s.fCtxChanged &= ~(  HM_CHANGED_GUEST_SREG_MASK
+                                 | HM_CHANGED_GUEST_TABLE_MASK);
+}
+
+
+/**
+ * Exports the guest (or nested-guest) MSRs into the VMCB.
  *
  * @param   pVCpu       The cross context virtual CPU structure.
@@ -1824 +1848 @@
  * @remarks No-long-jump zone!!!
  */
-static void hmR0SvmLoadGuestMsrs(PVMCPU pVCpu, PSVMVMCB pVmcb, PCCPUMCTX pCtx)
-{
+static void hmR0SvmExportGuestMsrs(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
+    PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
+
     /* Guest Sysenter MSRs. */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_SYSENTER_CS_MSR))
-    {
-        pVmcb->guest.u64SysEnterCS  = pCtx->SysEnter.cs;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_SYSENTER_CS_MSR);
-    }
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_SYSENTER_EIP_MSR))
-    {
-        pVmcb->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_SYSENTER_EIP_MSR);
-    }
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_SYSENTER_ESP_MSR))
-    {
-        pVmcb->guest.u64SysEnterESP = pCtx->SysEnter.esp;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_SYSENTER_ESP_MSR);
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSENTER_MSR_MASK)
+    {
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSENTER_CS_MSR)
+            pVmcb->guest.u64SysEnterCS  = pCtx->SysEnter.cs;
+
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSENTER_EIP_MSR)
+            pVmcb->guest.u64SysEnterEIP = pCtx->SysEnter.eip;
+
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSENTER_ESP_MSR)
+            pVmcb->guest.u64SysEnterESP = pCtx->SysEnter.esp;
     }
 
@@ -1848 +1871 @@
      * See AMD spec. 15.5.1 "Basic Operation" | "Canonicalization and Consistency Checks".
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_EFER_MSR))
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_EFER_MSR)
     {
         pVmcb->guest.u64EFER = pCtx->msrEFER | MSR_K6_EFER_SVME;
         pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_EFER_MSR);
-    }
-
-    /* 64-bit MSRs. */
-    if (CPUMIsGuestInLongModeEx(pCtx))
-    {
-        /* Load these always as the guest may modify FS/GS base using MSRs in 64-bit mode which we don't intercept. */
-        //pVmcb->guest.FS.u64Base = pCtx->fs.u64Base;
-        //pVmcb->guest.GS.u64Base = pCtx->gs.u64Base;
-        //pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_SEG;
-    }
-    else
-    {
-        /* If the guest isn't in 64-bit mode, clear MSR_K6_LME bit from guest EFER otherwise AMD-V expects amd64 shadow paging. */
-        if (pCtx->msrEFER & MSR_K6_EFER_LME)
-        {
-            pVmcb->guest.u64EFER &= ~MSR_K6_EFER_LME;
-            pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
-        }
-    }
-
-    /** @todo HM_CHANGED_GUEST_SYSCALL_MSRS,
-     *        HM_CHANGED_GUEST_KERNEL_GS_BASE */
-    pVmcb->guest.u64STAR         = pCtx->msrSTAR;
-    pVmcb->guest.u64LSTAR        = pCtx->msrLSTAR;
-    pVmcb->guest.u64CSTAR        = pCtx->msrCSTAR;
-    pVmcb->guest.u64SFMASK       = pCtx->msrSFMASK;
-    pVmcb->guest.u64KernelGSBase = pCtx->msrKERNELGSBASE;
+    }
+
+    /* If the guest isn't in 64-bit mode, clear MSR_K6_LME bit, otherwise SVM expects amd64 shadow paging. */
+    if (   !CPUMIsGuestInLongModeEx(pCtx)
+        && (pCtx->msrEFER & MSR_K6_EFER_LME))
+    {
+        pVmcb->guest.u64EFER &= ~MSR_K6_EFER_LME;
+        pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
+    }
+
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_SYSCALL_MSRS)
+    {
+        pVmcb->guest.u64STAR   = pCtx->msrSTAR;
+        pVmcb->guest.u64LSTAR  = pCtx->msrLSTAR;
+        pVmcb->guest.u64CSTAR  = pCtx->msrCSTAR;
+        pVmcb->guest.u64SFMASK = pCtx->msrSFMASK;
+    }
+
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_KERNEL_GS_BASE)
+        pVmcb->guest.u64KernelGSBase = pCtx->msrKERNELGSBASE;
+
+    pVCpu->hm.s.fCtxChanged &= ~(  HM_CHANGED_GUEST_SYSENTER_MSR_MASK
+                                 | HM_CHANGED_GUEST_EFER_MSR
+                                 | HM_CHANGED_GUEST_SYSCALL_MSRS
+                                 | HM_CHANGED_GUEST_KERNEL_GS_BASE);
 
     /*
      * Setup the PAT MSR (applicable for Nested Paging only).
      *
-     * While guests can modify and see the modified values throug the shadow values,
+     * While guests can modify and see the modified values through the shadow values,
      * we shall not honor any guest modifications of this MSR to ensure caching is always
-     * enabled similar to how we always run with CR0.CD and NW bits cleared.
+     * enabled similar to how we clear CR0.CD and NW bits.
      *
      * For nested-guests this needs to always be set as well, see @bugref{7243#c109}.
@@ -1899 +1919 @@
 
 /**
- * Loads the guest (or nested-guest) debug state into the VMCB and programs the
- * necessary intercepts accordingly.
+ * Exports the guest (or nested-guest) debug state into the VMCB and programs
+ * the necessary intercepts accordingly.
  *
  * @param   pVCpu       The cross context virtual CPU structure.
  * @param   pVmcb       Pointer to the VM control block.
- * @param   pCtx        Pointer to the guest-CPU context.
  *
  * @remarks No-long-jump zone!!!
  * @remarks Requires EFLAGS to be up-to-date in the VMCB!
  */
-static void hmR0SvmLoadSharedDebugState(PVMCPU pVCpu, PSVMVMCB pVmcb, PCCPUMCTX pCtx)
-{
-    bool fInterceptMovDRx = false;
+static void hmR0SvmExportSharedDebugState(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
 
     /*
@@ -1918 +1937 @@
      * the VMM level like the VT-x implementations does.
      */
+    bool       fInterceptMovDRx = false;
     bool const fStepping = pVCpu->hm.s.fSingleInstruction || DBGFIsStepping(pVCpu);
     if (fStepping)
@@ -1960 +1980 @@
             pVmcb->guest.u64DR6 = X86_DR6_INIT_VAL;
             pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DRX;
-            pVCpu->hm.s.fUsingHyperDR7 = true;
         }
 
@@ -1966 +1985 @@
          *        with the same values. */
         fInterceptMovDRx = true;
-        Log5(("hmR0SvmLoadSharedDebugState: Loaded hyper DRx\n"));
+        pVCpu->hm.s.fUsingHyperDR7 = true;
+        Log5(("hmR0SvmExportSharedDebugState: Loaded hyper DRx\n"));
     }
     else
@@ -1979 +1999 @@
             pVmcb->guest.u64DR6 = pCtx->dr[6];
             pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_DRX;
-            pVCpu->hm.s.fUsingHyperDR7 = false;
-        }
+        }
+        pVCpu->hm.s.fUsingHyperDR7 = false;
 
         /*
@@ -2006 +2026 @@
                 Assert(CPUMIsGuestDebugStateActive(pVCpu));
             }
-            Log5(("hmR0SvmLoadSharedDebugState: Loaded guest DRx\n"));
+            Log5(("hmR0SvmExportSharedDebugState: Loaded guest DRx\n"));
         }
         /*
@@ -2048 +2068 @@
         }
     }
-    Log4(("hmR0SvmLoadSharedDebugState: DR6=%#RX64 DR7=%#RX64\n", pCtx->dr[6], pCtx->dr[7]));
-}
-
+    Log4Func(("DR6=%#RX64 DR7=%#RX64\n", pCtx->dr[6], pCtx->dr[7]));
+}
 
 #ifdef VBOX_WITH_NESTED_HWVIRT_SVM
 /**
- * Loads the nested-guest APIC state (currently just the TPR).
- *
- * @param   pVCpu           The cross context virtual CPU structure.
- * @param   pVmcbNstGst     Pointer to the nested-guest VM control block.
- */
-static void hmR0SvmLoadGuestApicStateNested(PVMCPU pVCpu, PSVMVMCB pVmcbNstGst)
-{
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_APIC_STATE))
-    {
-        Assert(pVmcbNstGst->ctrl.IntCtrl.n.u1VIntrMasking == 1); RT_NOREF(pVmcbNstGst);
-        pVCpu->hm.s.svm.fSyncVTpr = false;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
-    }
-}
-
-
-/**
- * Loads the nested-guest hardware virtualization state.
+ * Exports the nested-guest hardware virtualization state into the nested-guest
+ * VMCB.
  *
  * @param   pVCpu         The cross context virtual CPU structure.
  * @param   pVmcbNstGst   Pointer to the nested-guest VM control block.
- * @param   pCtx          Pointer to the guest-CPU or nested-guest-CPU context.
- */
-static void hmR0SvmLoadGuestHwvirtStateNested(PVMCPU pVCpu, PSVMVMCB pVmcbNstGst, PCCPUMCTX pCtx)
-{
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_HWVIRT))
+ *
+ * @remarks No-long-jump zone!!!
+ */
+static void hmR0SvmExportGuestHwvirtStateNested(PVMCPU pVCpu, PSVMVMCB pVmcbNstGst)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
+
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_HWVIRT)
     {
         /*
@@ -2095 +2101 @@
         if (HMIsGuestSvmCtrlInterceptSet(pVCpu, SVM_CTRL_INTERCEPT_PAUSE))
         {
+            PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
             pVmcbNstGstCtrl->u16PauseFilterCount     = RT_MIN(pCtx->hwvirt.svm.cPauseFilter, uGuestPauseFilterCount);
             pVmcbNstGstCtrl->u16PauseFilterThreshold = RT_MIN(pCtx->hwvirt.svm.cPauseFilterThreshold, uGuestPauseFilterThreshold);
@@ -2105 +2112 @@
         }
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_HWVIRT);
+        pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_GUEST_HWVIRT;
     }
 }
@@ -2111 +2118 @@
 
 /**
- * Loads the guest APIC state (currently just the TPR).
+ * Exports the guest APIC TPR state into the VMCB.
  *
  * @returns VBox status code.
  * @param   pVCpu       The cross context virtual CPU structure.
  * @param   pVmcb       Pointer to the VM control block.
- * @param   pCtx        Pointer to the guest-CPU context.
- */
-static int hmR0SvmLoadGuestApicState(PVMCPU pVCpu, PSVMVMCB pVmcb, PCCPUMCTX pCtx)
-{
-    if (!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_APIC_STATE))
-        return VINF_SUCCESS;
-
-    int rc = VINF_SUCCESS;
-    PVM pVM = pVCpu->CTX_SUFF(pVM);
-    if (   PDMHasApic(pVM)
-        && APICIsEnabled(pVCpu))
-    {
-        bool    fPendingIntr;
-        uint8_t u8Tpr;
-        rc = APICGetTpr(pVCpu, &u8Tpr, &fPendingIntr, NULL /* pu8PendingIrq */);
-        AssertRCReturn(rc, rc);
-
-        /* Assume that we need to trap all TPR accesses and thus need not check on
-           every #VMEXIT if we should update the TPR. */
-        Assert(pVmcb->ctrl.IntCtrl.n.u1VIntrMasking);
-        pVCpu->hm.s.svm.fSyncVTpr = false;
-
-        if (!pVM->hm.s.fTPRPatchingActive)
-        {
-            /* Bits 3-0 of the VTPR field correspond to bits 7-4 of the TPR (which is the Task-Priority Class). */
-            pVmcb->ctrl.IntCtrl.n.u8VTPR = (u8Tpr >> 4);
-
-            /* If there are interrupts pending, intercept CR8 writes to evaluate ASAP if we can deliver the interrupt to the guest. */
-            if (fPendingIntr)
-                pVmcb->ctrl.u16InterceptWrCRx |= RT_BIT(8);
+ */
+static int hmR0SvmExportGuestApicTpr(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_APIC_TPR)
+    {
+        PVM       pVM = pVCpu->CTX_SUFF(pVM);
+        PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
+        if (   PDMHasApic(pVM)
+            && APICIsEnabled(pVCpu))
+        {
+            bool    fPendingIntr;
+            uint8_t u8Tpr;
+            int rc = APICGetTpr(pVCpu, &u8Tpr, &fPendingIntr, NULL /* pu8PendingIrq */);
+            AssertRCReturn(rc, rc);
+
+            /* Assume that we need to trap all TPR accesses and thus need not check on
+               every #VMEXIT if we should update the TPR. */
+            Assert(pVmcb->ctrl.IntCtrl.n.u1VIntrMasking);
+            pVCpu->hm.s.svm.fSyncVTpr = false;
+
+            if (!pVM->hm.s.fTPRPatchingActive)
+            {
+                /* Bits 3-0 of the VTPR field correspond to bits 7-4 of the TPR (which is the Task-Priority Class). */
+                pVmcb->ctrl.IntCtrl.n.u8VTPR = (u8Tpr >> 4);
+
+                /* If there are interrupts pending, intercept CR8 writes to evaluate ASAP if we
+                   can deliver the interrupt to the guest. */
+                if (fPendingIntr)
+                    pVmcb->ctrl.u16InterceptWrCRx |= RT_BIT(8);
+                else
+                {
+                    pVmcb->ctrl.u16InterceptWrCRx &= ~RT_BIT(8);
+                    pVCpu->hm.s.svm.fSyncVTpr = true;
+                }
+
+                pVmcb->ctrl.u32VmcbCleanBits &= ~(HMSVM_VMCB_CLEAN_INTERCEPTS | HMSVM_VMCB_CLEAN_INT_CTRL);
+            }
             else
             {
-                pVmcb->ctrl.u16InterceptWrCRx &= ~RT_BIT(8);
-                pVCpu->hm.s.svm.fSyncVTpr = true;
+                /* 32-bit guests uses LSTAR MSR for patching guest code which touches the TPR. */
+                pVmcb->guest.u64LSTAR = u8Tpr;
+                uint8_t *pbMsrBitmap = (uint8_t *)pVCpu->hm.s.svm.pvMsrBitmap;
+
+                /* If there are interrupts pending, intercept LSTAR writes, otherwise don't intercept reads or writes. */
+                if (fPendingIntr)
+                    hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_LSTAR, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_INTERCEPT_WRITE);
+                else
+                {
+                    hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_LSTAR, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
+                    pVCpu->hm.s.svm.fSyncVTpr = true;
+                }
+                pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_IOPM_MSRPM;
             }
-
-            pVmcb->ctrl.u32VmcbCleanBits &= ~(HMSVM_VMCB_CLEAN_INTERCEPTS | HMSVM_VMCB_CLEAN_INT_CTRL);
-        }
-        else
-        {
-            /* 32-bit guests uses LSTAR MSR for patching guest code which touches the TPR. */
-            pVmcb->guest.u64LSTAR = u8Tpr;
-            uint8_t *pbMsrBitmap = (uint8_t *)pVCpu->hm.s.svm.pvMsrBitmap;
-
-            /* If there are interrupts pending, intercept LSTAR writes, otherwise don't intercept reads or writes. */
-            if (fPendingIntr)
-                hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_LSTAR, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_INTERCEPT_WRITE);
-            else
-            {
-                hmR0SvmSetMsrPermission(pCtx, pbMsrBitmap, MSR_K8_LSTAR, SVMMSREXIT_PASSTHRU_READ, SVMMSREXIT_PASSTHRU_WRITE);
-                pVCpu->hm.s.svm.fSyncVTpr = true;
-            }
-            pVmcb->ctrl.u32VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_IOPM_MSRPM;
-        }
-    }
-
-    HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
-    return rc;
-}
-
-
-/**
- * Loads the exception interrupts required for guest (or nested-guest) execution in
- * the VMCB.
+        }
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_APIC_TPR);
+    }
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Sets up the exception interrupts required for guest (or nested-guest)
+ * execution in the VMCB.
  *
  * @param   pVCpu       The cross context virtual CPU structure.
  * @param   pVmcb       Pointer to the VM control block.
- * @param   pCtx        Pointer to the guest-CPU context.
- */
-static void hmR0SvmLoadGuestXcptIntercepts(PVMCPU pVCpu, PSVMVMCB pVmcb, PCCPUMCTX pCtx)
-{
-    /* If we modify intercepts from here, please check & adjust hmR0SvmLoadGuestXcptInterceptsNested()
-       if required. */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMM_GUEST_XCPT_INTERCEPTS))
+ *
+ * @remarks No-long-jump zone!!!
+ */
+static void hmR0SvmExportGuestXcptIntercepts(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
+
+    /* If we modify intercepts from here, please check & adjust hmR0SvmMergeVmcbCtrlsNested() if required. */
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_SVM_GUEST_XCPT_INTERCEPTS)
     {
         /* Trap #UD for GIM provider (e.g. for hypercalls). */
@@ -2195 +2203 @@
             hmR0SvmSetXcptIntercept(pVmcb, X86_XCPT_UD);
         else
-            hmR0SvmClearXcptIntercept(pVCpu, pCtx, pVmcb, X86_XCPT_UD);
+            hmR0SvmClearXcptIntercept(pVCpu, pVmcb, X86_XCPT_UD);
 
         /* Trap #BP for INT3 debug breakpoints set by the VM debugger. */
@@ -2201 +2209 @@
             hmR0SvmSetXcptIntercept(pVmcb, X86_XCPT_BP);
         else
-            hmR0SvmClearXcptIntercept(pVCpu, pCtx, pVmcb, X86_XCPT_BP);
-
-        /* The remaining intercepts are handled elsewhere, e.g. in hmR0SvmLoadSharedCR0(). */
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_VMM_GUEST_XCPT_INTERCEPTS);
+            hmR0SvmClearXcptIntercept(pVCpu, pVmcb, X86_XCPT_BP);
+
+        /* The remaining intercepts are handled elsewhere, e.g. in hmR0SvmExportGuestCR0(). */
+        pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_SVM_GUEST_XCPT_INTERCEPTS;
     }
 }
@@ -2258 +2266 @@
      *
      * Warning!! This ASSUMES we only intercept \#UD for hypercall purposes and \#BP
-     * for VM debugger breakpoints, see hmR0SvmLoadGuestXcptIntercepts.
+     * for VM debugger breakpoints, see hmR0SvmExportGuestXcptIntercepts().
      */
 #ifndef HMSVM_ALWAYS_TRAP_ALL_XCPTS
@@ -2291 +2299 @@
 
 /**
- * Sets up the appropriate function to run guest code.
+ * Selects the appropriate function to run guest code.
  *
  * @returns VBox status code.
@@ -2298 +2306 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0SvmSetupVMRunHandler(PVMCPU pVCpu)
+static int hmR0SvmSelectVMRunHandler(PVMCPU pVCpu)
 {
     if (CPUMIsGuestInLongMode(pVCpu))
@@ -2340 +2348 @@
 
     LogFlowFunc(("pVM=%p pVCpu=%p\n", pVM, pVCpu));
-    Assert(HMCPU_CF_IS_SET(pVCpu, HM_CHANGED_HOST_CONTEXT | HM_CHANGED_HOST_GUEST_SHARED_STATE));
+    Assert((pVCpu->hm.s.fCtxChanged & (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE))
+                                   == (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE));
 
     pVCpu->hm.s.fLeaveDone = false;
@@ -2401 +2410 @@
             int rc = HMR0EnterCpu(pVCpu);
             AssertRC(rc); NOREF(rc);
-            Assert(HMCPU_CF_IS_SET(pVCpu, HM_CHANGED_HOST_CONTEXT | HM_CHANGED_HOST_GUEST_SHARED_STATE));
+            Assert((pVCpu->hm.s.fCtxChanged & (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE))
+                                           == (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE));
 
             pVCpu->hm.s.fLeaveDone = false;
@@ -2425 +2435 @@
  * @remarks No-long-jump zone!!!
  */
-VMMR0DECL(int) SVMR0SaveHostState(PVM pVM, PVMCPU pVCpu)
-{
-    NOREF(pVM);
+VMMR0DECL(int) SVMR0ExportHostState(PVMCPU pVCpu)
+{
     NOREF(pVCpu);
+
     /* Nothing to do here. AMD-V does this for us automatically during the world-switch. */
-    HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_HOST_CONTEXT);
+    ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_HOST_CONTEXT);
     return VINF_SUCCESS;
 }
@@ -2436 +2446 @@
 
 /**
- * Loads the guest state into the VMCB.
+ * Exports the guest state from the guest-CPU context into the VMCB.
  *
  * The CPU state will be loaded from these fields on every successful VM-entry.
@@ -2449 +2459 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0SvmLoadGuestState(PVM pVM, PVMCPU pVCpu, PCCPUMCTX pCtx)
-{
+static int hmR0SvmExportGuestState(PVMCPU pVCpu)
+{
+    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExportGuestState, x);
+
+    PSVMVMCB  pVmcb = pVCpu->hm.s.svm.pVmcb;
+    PCCPUMCTX pCtx  = &pVCpu->cpum.GstCtx;
+
+    Assert(pVmcb);
     HMSVM_ASSERT_NOT_IN_NESTED_GUEST(pCtx);
-
-    PSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
-    AssertMsgReturn(pVmcb, ("Invalid pVmcb\n"), VERR_SVM_INVALID_PVMCB);
-
-    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestState, x);
-
-    int rc = hmR0SvmLoadGuestControlRegs(pVCpu, pVmcb, pCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0SvmLoadGuestControlRegs! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    hmR0SvmLoadGuestSegmentRegs(pVCpu, pVmcb, pCtx);
-    hmR0SvmLoadGuestMsrs(pVCpu, pVmcb, pCtx);
 
     pVmcb->guest.u64RIP    = pCtx->rip;
@@ -2468 +2473 @@
     pVmcb->guest.u64RFlags = pCtx->eflags.u32;
     pVmcb->guest.u64RAX    = pCtx->rax;
-
 #ifdef VBOX_WITH_NESTED_HWVIRT_SVM
     if (pVmcb->ctrl.IntCtrl.n.u1VGifEnable)
     {
-        Assert(pVM->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_VGIF);
+        Assert(pVCpu->CTX_SUFF(pVM)->hm.s.svm.u32Features & X86_CPUID_SVM_FEATURE_EDX_VGIF);
         pVmcb->ctrl.IntCtrl.n.u1VGif = pCtx->hwvirt.fGif;
     }
 #endif
 
-    /* hmR0SvmLoadGuestApicState() must be called -after- hmR0SvmLoadGuestMsrs() as we
-       may overwrite LSTAR MSR in the VMCB in the case of TPR patching. */
-    rc = hmR0SvmLoadGuestApicState(pVCpu, pVmcb, pCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0SvmLoadGuestApicState! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    hmR0SvmLoadGuestXcptIntercepts(pVCpu, pVmcb, pCtx);
-
-    rc = hmR0SvmSetupVMRunHandler(pVCpu);
-    AssertLogRelMsgRCReturn(rc, ("hmR0SvmSetupVMRunHandler! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    /* Clear any unused and reserved bits. */
-    HMCPU_CF_CLEAR(pVCpu,   HM_CHANGED_GUEST_RIP                  /* Unused (loaded unconditionally). */
-                          | HM_CHANGED_GUEST_RSP
-                          | HM_CHANGED_GUEST_RFLAGS
-                          | HM_CHANGED_GUEST_SYSENTER_CS_MSR
-                          | HM_CHANGED_GUEST_SYSENTER_EIP_MSR
-                          | HM_CHANGED_GUEST_SYSENTER_ESP_MSR
-                          | HM_CHANGED_GUEST_HWVIRT               /* Unused. */
-                          | HM_CHANGED_VMM_GUEST_LAZY_MSRS
-                          | HM_CHANGED_SVM_RESERVED1              /* Reserved. */
-                          | HM_CHANGED_SVM_RESERVED2
-                          | HM_CHANGED_SVM_RESERVED3
-                          | HM_CHANGED_SVM_RESERVED4);
-
-    /* All the guest state bits should be loaded except maybe the host context and/or shared host/guest bits. */
-    AssertMsg(   !HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_ALL_GUEST)
-              ||  HMCPU_CF_IS_PENDING_ONLY(pVCpu, HM_CHANGED_HOST_CONTEXT | HM_CHANGED_HOST_GUEST_SHARED_STATE),
-               ("fContextUseFlags=%#RX32\n", HMCPU_CF_VALUE(pVCpu)));
+    RTCCUINTREG const fEFlags = ASMIntDisableFlags();
+
+    int rc = hmR0SvmExportGuestControlRegs(pVCpu, pVmcb);
+    AssertRCReturnStmt(rc, ASMSetFlags(fEFlags), rc);
+
+    hmR0SvmExportGuestSegmentRegs(pVCpu, pVmcb);
+    hmR0SvmExportGuestMsrs(pVCpu, pVmcb);
+    hmR0SvmExportGuestXcptIntercepts(pVCpu, pVmcb);
+
+    ASMSetFlags(fEFlags);
+
+    /* hmR0SvmExportGuestApicTpr() must be called -after- hmR0SvmExportGuestMsrs() as we
+       otherwise we would overwrite the LSTAR MSR that we use for TPR patching. */
+    hmR0SvmExportGuestApicTpr(pVCpu, pVmcb);
+
+    rc = hmR0SvmSelectVMRunHandler(pVCpu);
+    AssertRCReturn(rc, rc);
+
+    /* Clear any bits that may be set but exported unconditionally or unused/reserved bits. */
+    ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~(   HM_CHANGED_GUEST_RIP
+                                                  |  HM_CHANGED_GUEST_RFLAGS
+                                                  |  HM_CHANGED_GUEST_GPRS_MASK
+                                                  |  HM_CHANGED_GUEST_X87
+                                                  |  HM_CHANGED_GUEST_SSE_AVX
+                                                  |  HM_CHANGED_GUEST_OTHER_XSAVE
+                                                  |  HM_CHANGED_GUEST_XCRx
+                                                  |  HM_CHANGED_GUEST_TSC_AUX
+                                                  |  HM_CHANGED_GUEST_OTHER_MSRS
+                                                  |  HM_CHANGED_GUEST_HWVIRT
+                                                  | (HM_CHANGED_KEEPER_STATE_MASK & ~HM_CHANGED_SVM_GUEST_XCPT_INTERCEPTS)));
 
 #ifdef VBOX_STRICT
-    hmR0SvmLogState(pVCpu, pVmcb, pCtx, "hmR0SvmLoadGuestState", 0 /* fFlags */, 0 /* uVerbose */);
+    /*
+     * All of the guest-CPU state and SVM keeper bits should be exported here by now,
+     * except for the host-context and/or shared host-guest context bits.
+     */
+    uint64_t const fCtxChanged = ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged);
+    AssertMsg(!(fCtxChanged & (HM_CHANGED_ALL_GUEST & ~HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE)),
+              ("fCtxChanged=%#RX64\n", fCtxChanged));
+
+    /*
+     * If we need to log state that isn't always imported, we'll need to import them here.
+     * See hmR0SvmPostRunGuest() for which part of the state is imported uncondtionally.
+     */
+    hmR0SvmLogState(pVCpu, pVmcb, "hmR0SvmExportGuestState", 0 /* fFlags */, 0 /* uVerbose */);
 #endif
-    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestState, x);
-    return rc;
+
+    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExportGuestState, x);
+    return VINF_SUCCESS;
 }
 
@@ -2575 +2594 @@
         pVmcbNstGstCache->fLbrVirt                = pVmcbNstGstCtrl->LbrVirt.n.u1LbrVirt;
         pVmcbNstGstCache->fCacheValid             = true;
-        Log4(("hmR0SvmCacheVmcbNested: Cached VMCB fields\n"));
+        Log4Func(("Cached VMCB fields\n"));
     }
 
@@ -2590 +2609 @@
  *
  * @param   pVCpu           The cross context virtual CPU structure.
- * @param   pCtx            Pointer to the nested-guest-CPU context.
- */
-static void hmR0SvmSetupVmcbNested(PVMCPU pVCpu, PCCPUMCTX pCtx)
-{
+ */
+static void hmR0SvmSetupVmcbNested(PVMCPU pVCpu)
+{
+    PCCPUMCTX    pCtx            = &pVCpu->cpum.GstCtx;
     PSVMVMCB     pVmcbNstGst     = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
     PSVMVMCBCTRL pVmcbNstGstCtrl = &pVmcbNstGst->ctrl;
@@ -2619 +2638 @@
         /* Always enable V_INTR_MASKING as we do not want to allow access to the physical APIC TPR. */
         pVmcbNstGstCtrl->IntCtrl.n.u1VIntrMasking = 1;
+
+        /*
+         * Turn off TPR syncing on #VMEXIT for nested-guests as CR8 intercepts are subject
+         * to the nested-guest intercepts and we always run with V_INTR_MASKING.
+         */
+        pVCpu->hm.s.svm.fSyncVTpr = false;
 
 #ifdef DEBUG_ramshankar
@@ -2649 +2674 @@
     else
     {
+        Assert(!pVCpu->hm.s.svm.fSyncVTpr);
         Assert(pVmcbNstGstCtrl->u64IOPMPhysAddr == g_HCPhysIOBitmap);
         Assert(RT_BOOL(pVmcbNstGstCtrl->NestedPagingCtrl.n.u1NestedPaging) == pVCpu->CTX_SUFF(pVM)->hm.s.fNestedPaging);
@@ -2656 +2682 @@
 
 /**
- * Loads the nested-guest state into the VMCB.
+ * Exports the nested-guest state into the VMCB.
+ *
+ * We need to export the entire state as we could be continuing nested-guest
+ * execution at any point (not just immediately after VMRUN) and thus the VMCB
+ * can be out-of-sync with the nested-guest state if it was executed in IEM.
  *
  * @returns VBox status code.
@@ -2664 +2694 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0SvmLoadGuestStateNested(PVMCPU pVCpu, PCCPUMCTX pCtx)
-{
-    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestState, x);
-
-    PSVMVMCB pVmcbNstGst = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
+static int hmR0SvmExportGuestStateNested(PVMCPU pVCpu)
+{
+    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExportGuestState, x);
+
+    PCCPUMCTX   pCtx        = &pVCpu->cpum.GstCtx;
+    PSVMVMCB    pVmcbNstGst = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
     Assert(pVmcbNstGst);
 
-    hmR0SvmSetupVmcbNested(pVCpu, pCtx);
-
-    int rc = hmR0SvmLoadGuestControlRegs(pVCpu, pVmcbNstGst, pCtx);
-    AssertRCReturn(rc, rc);
-
-    /*
-     * We need to load the entire state (including FS, GS etc.) as we could be continuing
-     * to execute the nested-guest at any point (not just immediately after VMRUN) and thus
-     * the VMCB can possibly be out-of-sync with the actual nested-guest state if it was
-     * executed in IEM.
-     */
-    hmR0SvmLoadGuestSegmentRegs(pVCpu, pVmcbNstGst, pCtx);
-    hmR0SvmLoadGuestMsrs(pVCpu, pVmcbNstGst, pCtx);
-    hmR0SvmLoadGuestApicStateNested(pVCpu, pVmcbNstGst);
-    hmR0SvmLoadGuestHwvirtStateNested(pVCpu, pVmcbNstGst, pCtx);
+    hmR0SvmSetupVmcbNested(pVCpu);
 
     pVmcbNstGst->guest.u64RIP    = pCtx->rip;
@@ -2692 +2709 @@
     pVmcbNstGst->guest.u64RAX    = pCtx->rax;
 
-#ifdef VBOX_WITH_NESTED_HWVIRT_SVM
-    Assert(!pVmcbNstGst->ctrl.IntCtrl.n.u1VGifEnable);            /* Nested VGIF not supported yet. */
+    RTCCUINTREG const fEFlags = ASMIntDisableFlags();
+
+    int rc = hmR0SvmExportGuestControlRegs(pVCpu, pVmcbNstGst);
+    AssertRCReturnStmt(rc, ASMSetFlags(fEFlags), rc);
+
+    hmR0SvmExportGuestSegmentRegs(pVCpu, pVmcbNstGst);
+    hmR0SvmExportGuestMsrs(pVCpu, pVmcbNstGst);
+    hmR0SvmExportGuestHwvirtStateNested(pVCpu, pVmcbNstGst);
+
+    ASMSetFlags(fEFlags);
+
+    /* Nested VGIF not supported yet. */
+    Assert(!pVmcbNstGst->ctrl.IntCtrl.n.u1VGifEnable);
+
+    rc = hmR0SvmSelectVMRunHandler(pVCpu);
+    AssertRCReturn(rc, rc);
+
+    /* Clear any bits that may be set but exported unconditionally or unused/reserved bits. */
+    ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~(   HM_CHANGED_GUEST_RIP
+                                                  |  HM_CHANGED_GUEST_RFLAGS
+                                                  |  HM_CHANGED_GUEST_GPRS_MASK
+                                                  |  HM_CHANGED_GUEST_APIC_TPR
+                                                  |  HM_CHANGED_GUEST_X87
+                                                  |  HM_CHANGED_GUEST_SSE_AVX
+                                                  |  HM_CHANGED_GUEST_OTHER_XSAVE
+                                                  |  HM_CHANGED_GUEST_XCRx
+                                                  |  HM_CHANGED_GUEST_TSC_AUX
+                                                  |  HM_CHANGED_GUEST_OTHER_MSRS
+                                                  |  HM_CHANGED_SVM_GUEST_XCPT_INTERCEPTS
+                                                  | (HM_CHANGED_KEEPER_STATE_MASK & ~HM_CHANGED_SVM_MASK)));
+
+#ifdef VBOX_STRICT
+    /*
+     * All of the guest-CPU state and SVM keeper bits should be exported here by now, except
+     * for the host-context and/or shared host-guest context bits.
+     */
+    uint64_t const fCtxChanged = ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged);
+    AssertMsg(!(fCtxChanged & (HM_CHANGED_ALL_GUEST & ~HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE)),
+              ("fCtxChanged=%#RX64\n", fCtxChanged));
+
+    /*
+     * If we need to log state that isn't always imported, we'll need to import them here.
+     * See hmR0SvmPostRunGuest() for which part of the state is imported uncondtionally.
+     */
+    hmR0SvmLogState(pVCpu, pVmcbNstGst, "hmR0SvmExportGuestStateNested", 0 /* fFlags */, 0 /* uVerbose */);
 #endif
 
-    rc = hmR0SvmSetupVMRunHandler(pVCpu);
-    AssertRCReturn(rc, rc);
-
-    /* Clear any unused and reserved bits. */
-    HMCPU_CF_CLEAR(pVCpu,   HM_CHANGED_GUEST_RIP                  /* Unused (loaded unconditionally). */
-                          | HM_CHANGED_GUEST_RSP
-                          | HM_CHANGED_GUEST_RFLAGS
-                          | HM_CHANGED_GUEST_SYSENTER_CS_MSR
-                          | HM_CHANGED_GUEST_SYSENTER_EIP_MSR
-                          | HM_CHANGED_GUEST_SYSENTER_ESP_MSR
-                          | HM_CHANGED_VMM_GUEST_XCPT_INTERCEPTS  /* Unused. */
-                          | HM_CHANGED_VMM_GUEST_LAZY_MSRS
-                          | HM_CHANGED_SVM_RESERVED1              /* Reserved. */
-                          | HM_CHANGED_SVM_RESERVED2
-                          | HM_CHANGED_SVM_RESERVED3
-                          | HM_CHANGED_SVM_RESERVED4);
-
-    /* All the guest state bits should be loaded except maybe the host context and/or shared host/guest bits. */
-    AssertMsg(   !HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_ALL_GUEST)
-              ||  HMCPU_CF_IS_PENDING_ONLY(pVCpu, HM_CHANGED_HOST_CONTEXT | HM_CHANGED_HOST_GUEST_SHARED_STATE),
-               ("fContextUseFlags=%#RX32\n", HMCPU_CF_VALUE(pVCpu)));
-
-#ifdef VBOX_STRICT
-    hmR0SvmLogState(pVCpu, pVmcbNstGst, pCtx, "hmR0SvmLoadGuestStateNested", HMSVM_LOG_ALL, 0 /* uVerbose */);
-#endif
-    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestState, x);
+    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExportGuestState, x);
     return rc;
 }
@@ -2728 +2763 @@
 
 /**
- * Loads the state shared between the host and guest (or nested-guest) into the
- * VMCB.
+ * Exports the state shared between the host and guest (or nested-guest) into
+ * the VMCB.
  *
  * @param   pVCpu       The cross context virtual CPU structure.
  * @param   pVmcb       Pointer to the VM control block.
- * @param   pCtx        Pointer to the guest-CPU context.
  *
  * @remarks No-long-jump zone!!!
  */
-static void hmR0SvmLoadSharedState(PVMCPU pVCpu, PSVMVMCB pVmcb, PCCPUMCTX pCtx)
+static void hmR0SvmExportSharedState(PVMCPU pVCpu, PSVMVMCB pVmcb)
 {
     Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
     Assert(!VMMRZCallRing3IsEnabled(pVCpu));
 
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR0))
-    {
-        hmR0SvmLoadSharedCR0(pVCpu, pVmcb, pCtx);
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_CR0);
-    }
-
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_DEBUG))
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_DR_MASK)
     {
         /** @todo Figure out stepping with nested-guest. */
+        PCCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
         if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
-            hmR0SvmLoadSharedDebugState(pVCpu, pVmcb, pCtx);
+            hmR0SvmExportSharedDebugState(pVCpu, pVmcb);
         else
         {
             pVmcb->guest.u64DR6 = pCtx->dr[6];
             pVmcb->guest.u64DR7 = pCtx->dr[7];
-            Log4(("hmR0SvmLoadSharedState: DR6=%#RX64 DR7=%#RX64\n", pCtx->dr[6], pCtx->dr[7]));
-        }
-
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_DEBUG);
-    }
-
-    /* Unused on AMD-V (no lazy MSRs). */
-    HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_VMM_GUEST_LAZY_MSRS);
-
-    AssertMsg(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_HOST_GUEST_SHARED_STATE),
-              ("fContextUseFlags=%#RX32\n", HMCPU_CF_VALUE(pVCpu)));
+        }
+    }
+
+    pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_GUEST_DR_MASK;
+    AssertMsg(!(pVCpu->hm.s.fCtxChanged & HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE),
+              ("fCtxChanged=%#RX64\n", pVCpu->hm.s.fCtxChanged));
 }
 
@@ -2778 +2802 @@
  * @param   fWhat   What to import, CPUMCTX_EXTRN_XXX.
  */
-static void hmR0SvmImportGuestState(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t fWhat)
-{
+static void hmR0SvmImportGuestState(PVMCPU pVCpu, uint64_t fWhat)
+{
+    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatImportGuestState, x);
+
+    PCPUMCTX           pCtx       = &pVCpu->cpum.GstCtx;
     PCSVMVMCB          pVmcb      = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
     PCSVMVMCBSTATESAVE pVmcbGuest = &pVmcb->guest;
     PCSVMVMCBCTRL      pVmcbCtrl  = &pVmcb->ctrl;
 
-    Log4(("hmR0SvmImportGuestState: fExtrn=%#RX64 fWhat=%#RX64\n", pCtx->fExtrn, fWhat));
+    Log4Func(("fExtrn=%#RX64 fWhat=%#RX64\n", pCtx->fExtrn, fWhat));
 
     /*
@@ -2790 +2817 @@
      * the fExtrn modification atomic wrt to preemption hooks.
      */
-    RTCCUINTREG const fSavedFlags = ASMIntDisableFlags();
+    RTCCUINTREG const fEFlags = ASMIntDisableFlags();
 
     fWhat &= pCtx->fExtrn;
@@ -2840 +2867 @@
             {
                 HMSVM_SEG_REG_COPY_FROM_VMCB(pCtx, pVmcbGuest, CS, cs);
-                /*
-                 * Correct the hidden CS granularity bit. Haven't seen it being wrong in any other
-                 * register (yet).
-                 */
+                /* Correct the CS granularity bit. Haven't seen it being wrong in any other register (yet). */
                 /** @todo SELM might need to be fixed as it too should not care about the
                  *        granularity bit. See @bugref{6785}. */
@@ -2860 +2884 @@
                 HMSVM_ASSERT_SEG_GRANULARITY(pCtx, ss);
                 /*
-                 * Sync the hidden SS DPL field. AMD CPUs have a separate CPL field in the VMCB and uses that
-                 * and thus it's possible that when the CPL changes during guest execution that the SS DPL
-                 * isn't updated by AMD-V. Observed on some AMD Fusion CPUs with 64-bit guests.
+                 * Sync the hidden SS DPL field. AMD CPUs have a separate CPL field in the
+                 * VMCB and uses that and thus it's possible that when the CPL changes during
+                 * guest execution that the SS DPL isn't updated by AMD-V. Observed on some
+                 * AMD Fusion CPUs with 64-bit guests.
+                 *
                  * See AMD spec. 15.5.1 "Basic operation".
                  */
@@ -2972 +2998 @@
                 uint64_t const uCr0 = (pCtx->cr0          & ~(X86_CR0_TS | X86_CR0_MP))
                                     | (pVmcbGuest->u64CR0 &  (X86_CR0_TS | X86_CR0_MP));
-                VMMRZCallRing3Disable(pVCpu); /* CPUM has log statements and calls into PGM. */
+                VMMRZCallRing3Disable(pVCpu); /* Calls into PGM which has Log statements. */
                 CPUMSetGuestCR0(pVCpu, uCr0);
                 VMMRZCallRing3Enable(pVCpu);
@@ -3006 +3032 @@
         Assert(!pCtx->fExtrn || (pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
 
-    ASMSetFlags(fSavedFlags);
+    ASMSetFlags(fEFlags);
+
+    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatImportGuestState, x);
 
     /*
@@ -3016 +3044 @@
      * handling -> hmR0SvmImportGuestState() and here we are.
      *
-     * The reason for such complicated handling is because VM-exits that call into PGM expect CR3 to be
-     * up-to-date and thus any CR3-saves -before- the VM-exit (longjmp) would've postponed the CR3
-     * update via the force-flag and cleared CR3 from fExtrn. Any SVM R0 VM-exit handler that requests
-     * CR3 to be saved will end up here and we call PGMUpdateCR3().
+     * The reason for such complicated handling is because VM-exits that call into PGM expect
+     * CR3 to be up-to-date and thus any CR3-saves -before- the VM-exit (longjmp) would've
+     * postponed the CR3 update via the force-flag and cleared CR3 from fExtrn. Any SVM R0
+     * VM-exit handler that requests CR3 to be saved will end up here and we call PGMUpdateCR3().
      *
      * The longjmp exit path can't check these CR3 force-flags and call code that takes a lock again,
@@ -3042 +3070 @@
  * @returns VBox status code.
  * @param   pVCpu   The cross context virtual CPU structure.
- * @param   pCtx    Pointer to the guest-CPU or nested-guest-CPU context. The
- *                  data may be out-of-sync. Make sure to update the required
- *                  fields before using them.
  * @param   fWhat   What to import, CPUMCTX_EXTRN_XXX.
  */
-VMMR0DECL(int) SVMR0ImportStateOnDemand(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t fWhat)
-{
-    hmR0SvmImportGuestState(pVCpu, pCtx, fWhat);
+VMMR0DECL(int) SVMR0ImportStateOnDemand(PVMCPU pVCpu, uint64_t fWhat)
+{
+    hmR0SvmImportGuestState(pVCpu, fWhat);
     return VINF_SUCCESS;
-}
-
-
-/**
- * Saves the guest (or nested-guest) state from the VMCB into the guest-CPU
- * context.
- *
- * Currently there is no residual state left in the CPU that is not updated in the
- * VMCB.
- *
- * @returns VBox status code.
- * @param   pVCpu   The cross context virtual CPU structure.
- * @param   pCtx    Pointer to the guest-CPU or nested-guest-CPU context. The
- *                  data may be out-of-sync. Make sure to update the required
- *                  fields before using them.
- * @param   pVmcb   Pointer to the VM control block.
- */
-static void hmR0SvmSaveGuestState(PVMCPU pVCpu, PCPUMCTX pCtx, PCSVMVMCB pVmcb)
-{
-    Assert(VMMRZCallRing3IsEnabled(pVCpu));
-
-    /*
-     * Always import the following:
-     *
-     *   - RIP, RFLAGS, int. shadow, GIF: we need them when as we evaluate
-     *     injecting events before re-entering guest execution.
-     *
-     *   - GPRS: Only RAX, RSP are in the VMCB. All the other GPRs are swapped
-     *     by the assembly switcher code. Import these two always just to simplify
-     *     assumptions on GPRs.
-     *
-     *   - SREG: We load them all together so we have to save all of them.
-     *
-     *   - KERNEL_GS_BASE, SYSCALL MSRS: We don't have a HM_CHANGED_GUEST flag
-     *     for it yet
-     */
-    /** @todo Extend HM_CHANGED_GUEST_xxx so that we avoid saving segment
-     *        registers, kernel GS base and other MSRs each time. */
-    hmR0SvmImportGuestState(pVCpu, pCtx,   CPUMCTX_EXTRN_RIP
-                                         | CPUMCTX_EXTRN_SYSCALL_MSRS
-                                         | CPUMCTX_EXTRN_KERNEL_GS_BASE
-                                         | CPUMCTX_EXTRN_RFLAGS
-                                         | CPUMCTX_EXTRN_RAX
-                                         | CPUMCTX_EXTRN_SREG_MASK
-                                         | CPUMCTX_EXTRN_RSP
-                                         | CPUMCTX_EXTRN_HWVIRT
-                                         | CPUMCTX_EXTRN_HM_SVM_INT_SHADOW
-                                         | CPUMCTX_EXTRN_HM_SVM_HWVIRT_VIRQ);
-
-#ifdef DEBUG_ramshankar
-    if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
-    {
-        hmR0SvmImportGuestState(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
-        hmR0SvmLogState(pVCpu, pVmcb, pCtx, "hmR0SvmSaveGuestStateNested", HMSVM_LOG_ALL & ~HMSVM_LOG_LBR, 0 /* uVerbose */);
-    }
-#else
-    RT_NOREF(pVmcb);
-#endif
 }
 
@@ -3135 +3102 @@
     /* Save the guest state if necessary. */
     if (fImportState)
-        hmR0SvmImportGuestState(pVCpu, &pVCpu->cpum.GstCtx, HMSVM_CPUMCTX_EXTRN_ALL);
-
-    /* Restore host FPU state if necessary and resync on next R0 reentry .*/
+        hmR0SvmImportGuestState(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
+
+    /* Restore host FPU state if necessary and resync on next R0 reentry. */
     CPUMR0FpuStateMaybeSaveGuestAndRestoreHost(pVCpu);
+    Assert(!CPUMIsGuestFPUStateActive(pVCpu));
 
     /*
@@ -3152 +3120 @@
 #endif
     CPUMR0DebugStateMaybeSaveGuestAndRestoreHost(pVCpu, false /* save DR6 */);
-
     Assert(!CPUMIsHyperDebugStateActive(pVCpu));
     Assert(!CPUMIsGuestDebugStateActive(pVCpu));
 
     STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatEntry);
-    STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatLoadGuestState);
+    STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatImportGuestState);
+    STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExportGuestState);
     STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit1);
     STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit2);
@@ -3270 +3238 @@
     Assert(VMMR0IsLogFlushDisabled(pVCpu));
 
-    Log4(("hmR0SvmCallRing3Callback->hmR0SvmLongJmpToRing3\n"));
+    Log4Func(("Calling hmR0SvmLongJmpToRing3\n"));
     int rc = hmR0SvmLongJmpToRing3(pVCpu);
     AssertRCReturn(rc, rc);
@@ -3302 +3270 @@
     /* Please, no longjumps here (any logging shouldn't flush jump back to ring-3). NO LOGGING BEFORE THIS POINT! */
     VMMRZCallRing3Disable(pVCpu);
-    Log4(("hmR0SvmExitToRing3: VCPU[%u]: rcExit=%d LocalFF=%#RX32 GlobalFF=%#RX32\n", pVCpu->idCpu, rcExit,
-          pVCpu->fLocalForcedActions, pVM->fGlobalForcedActions));
+    Log4Func(("rcExit=%d LocalFF=%#RX32 GlobalFF=%#RX32\n", rcExit, pVCpu->fLocalForcedActions, pVM->fGlobalForcedActions));
 
     /* We need to do this only while truly exiting the "inner loop" back to ring-3 and -not- for any longjmp to ring3. */
@@ -3317 +3284 @@
 
     VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_TO_R3);
-    CPUMSetChangedFlags(pVCpu,  CPUM_CHANGED_SYSENTER_MSR
-                              | CPUM_CHANGED_LDTR
-                              | CPUM_CHANGED_GDTR
-                              | CPUM_CHANGED_IDTR
-                              | CPUM_CHANGED_TR
-                              | CPUM_CHANGED_HIDDEN_SEL_REGS);
+    CPUMSetChangedFlags(pVCpu,   CPUM_CHANGED_SYSENTER_MSR
+                               | CPUM_CHANGED_LDTR
+                               | CPUM_CHANGED_GDTR
+                               | CPUM_CHANGED_IDTR
+                               | CPUM_CHANGED_TR
+                               | CPUM_CHANGED_HIDDEN_SEL_REGS);
     if (   pVM->hm.s.fNestedPaging
         && CPUMIsGuestPagingEnabledEx(pCtx))
@@ -3329 +3296 @@
     }
 
+    /* Update the exit-to-ring 3 reason. */
+    pVCpu->hm.s.rcLastExitToR3 = rcExit;
+
     /* On our way back from ring-3 reload the guest state if there is a possibility of it being changed. */
     if (rcExit != VINF_EM_RAW_INTERRUPT)
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+    {
+        Assert(!(pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
+    }
 
     STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchExitToR3);
@@ -3427 +3400 @@
     pVCpu->hm.s.Event.GCPtrFaultAddress = GCPtrFaultAddress;
 
-    Log4(("hmR0SvmSetPendingEvent: u=%#RX64 u8Vector=%#x Type=%#x ErrorCodeValid=%RTbool ErrorCode=%#RX32\n", pEvent->u,
-          pEvent->n.u8Vector, (uint8_t)pEvent->n.u3Type, !!pEvent->n.u1ErrorCodeValid, pEvent->n.u32ErrorCode));
+    Log4Func(("u=%#RX64 u8Vector=%#x Type=%#x ErrorCodeValid=%RTbool ErrorCode=%#RX32\n", pEvent->u, pEvent->n.u8Vector,
+              (uint8_t)pEvent->n.u3Type, !!pEvent->n.u1ErrorCodeValid, pEvent->n.u32ErrorCode));
 }
 
@@ -3490 +3463 @@
         pCtx->cr2 = uFaultAddress;
         /* The VMCB clean bit for CR2 will be updated while re-loading the guest state. */
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR2);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR2);
     }
 
@@ -3549 +3522 @@
     RT_NOREF(pVCpu);
 
-    Log4(("hmR0SvmInjectEventVmcb: u=%#RX64 u8Vector=%#x Type=%#x ErrorCodeValid=%RTbool ErrorCode=%#RX32\n", pEvent->u,
-          pEvent->n.u8Vector, (uint8_t)pEvent->n.u3Type, !!pEvent->n.u1ErrorCodeValid, pEvent->n.u32ErrorCode));
+    Log4Func(("u=%#RX64 u8Vector=%#x Type=%#x ErrorCodeValid=%RTbool ErrorCode=%#RX32\n", pEvent->u, pEvent->n.u8Vector,
+              (uint8_t)pEvent->n.u3Type, !!pEvent->n.u1ErrorCodeValid, pEvent->n.u32ErrorCode));
 }
 
@@ -3680 +3653 @@
 {
     /*
-     * Instructions like STI and MOV SS inhibit interrupts till the next instruction completes. Check if we should
-     * inhibit interrupts or clear any existing interrupt-inhibition.
+     * Instructions like STI and MOV SS inhibit interrupts till the next instruction
+     * completes. Check if we should inhibit interrupts or clear any existing
+     * interrupt inhibition.
      */
     if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
@@ -3688 +3662 @@
         {
             /*
-             * We can clear the inhibit force flag as even if we go back to the recompiler without executing guest code in
-             * AMD-V, the flag's condition to be cleared is met and thus the cleared state is correct.
+             * We can clear the inhibit force flag as even if we go back to the recompiler
+             * without executing guest code in AMD-V, the flag's condition to be cleared is
+             * met and thus the cleared state is correct.
              */
             VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
@@ -3710 +3685 @@
 {
     /*
-     * When AVIC isn't supported, set up an interrupt window to cause a #VMEXIT when
-     * the guest is ready to accept interrupts. At #VMEXIT, we then get the interrupt
-     * from the APIC (updating ISR at the right time) and inject the interrupt.
+     * When AVIC isn't supported, set up an interrupt window to cause a #VMEXIT when the guest
+     * is ready to accept interrupts. At #VMEXIT, we then get the interrupt from the APIC
+     * (updating ISR at the right time) and inject the interrupt.
      *
      * With AVIC is supported, we could make use of the asynchronously delivery without
      * #VMEXIT and we would be passing the AVIC page to SVM.
      *
-     * In AMD-V, an interrupt window is achieved using a combination of
-     * V_IRQ (an interrupt is pending), V_IGN_TPR (ignore TPR priorities) and the
-     * VINTR intercept all being set.
+     * In AMD-V, an interrupt window is achieved using a combination of V_IRQ (an interrupt
+     * is pending), V_IGN_TPR (ignore TPR priorities) and the VINTR intercept all being set.
      */
 #ifdef VBOX_WITH_NESTED_HWVIRT_SVM
     /*
-     * Currently we don't overlay interupt windows and if there's any V_IRQ pending
-     * in the nested-guest VMCB, we avoid setting up any interrupt window on behalf
-     * of the outer guest.
+     * Currently we don't overlay interupt windows and if there's any V_IRQ pending in the
+     * nested-guest VMCB, we avoid setting up any interrupt window on behalf of the outer
+     * guest.
      */
     /** @todo Does this mean we end up prioritizing virtual interrupt
@@ -3799 +3773 @@
     bool const fBlockNmi   = VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS);
 
-    Log4Func(("fVirtualGif=%RTbool fBlockNmi=%RTbool fIntShadow=%RTbool fIntrPending=%RTbool fNmiPending=%RTbool\n",
+    Log4Func(("fVirtualGif=%RTbool fBlockNmi=%RTbool fIntShadow=%RTbool fIntPending=%RTbool fNmiPending=%RTbool\n",
               fVirtualGif, fBlockNmi, fIntShadow, VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC),
               VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_NMI)));
@@ -3819 +3793 @@
             {
                 Log4(("Intercepting NMI -> #VMEXIT\n"));
-                HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
+                HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
                 return IEMExecSvmVmexit(pVCpu, SVM_EXIT_NMI, 0, 0);
             }
@@ -3838 +3812 @@
     }
     /*
-     * Check if the nested-guest can receive external interrupts (generated by
-     * the guest's PIC/APIC).
+     * Check if the nested-guest can receive external interrupts (generated by the guest's
+     * PIC/APIC).
      *
      * External intercepts, NMI, SMI etc. from the physical CPU are -always- intercepted
@@ -3860 +3834 @@
             {
                 Log4(("Intercepting INTR -> #VMEXIT\n"));
-                HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
+                HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
                 return IEMExecSvmVmexit(pVCpu, SVM_EXIT_INTR, 0, 0);
             }
@@ -3924 +3898 @@
     bool const fBlockNmi  = VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS);
 
-    Log4Func(("fGif=%RTbool fBlockNmi=%RTbool fBlockInt=%RTbool fIntShadow=%RTbool Intr. pending=%RTbool NMI pending=%RTbool\n",
+    Log4Func(("fGif=%RTbool fBlockNmi=%RTbool fBlockInt=%RTbool fIntShadow=%RTbool fIntPending=%RTbool NMI pending=%RTbool\n",
               fGif, fBlockNmi, fBlockInt, fIntShadow,
               VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC),
@@ -3957 +3931 @@
     }
     /*
-     * Check if the guest can receive external interrupts (PIC/APIC). Once PDMGetInterrupt() returns
-     * a valid interrupt we -must- deliver the interrupt. We can no longer re-request it from the APIC.
+     * Check if the guest can receive external interrupts (PIC/APIC). Once PDMGetInterrupt()
+     * returns a valid interrupt we -must- deliver the interrupt. We can no longer re-request
+     * it from the APIC device.
      */
     else if (   VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INTERRUPT_APIC | VMCPU_FF_INTERRUPT_PIC)
@@ -4021 +3996 @@
     {
         /*
-         * For nested-guests we have no way to determine if we're injecting a physical or virtual
-         * interrupt at this point. Hence the partial verification below.
+         * For nested-guests we have no way to determine if we're injecting a physical or
+         * virtual interrupt at this point. Hence the partial verification below.
          */
         if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
@@ -4052 +4027 @@
 
         /*
-         * Before injecting an NMI we must set VMCPU_FF_BLOCK_NMIS to prevent nested NMIs. We do this only
-         * when we are surely going to inject the NMI as otherwise if we return to ring-3 prematurely we
-         * could leave NMIs blocked indefinitely upon re-entry into SVM R0.
+         * Before injecting an NMI we must set VMCPU_FF_BLOCK_NMIS to prevent nested NMIs. We
+         * do this only when we are surely going to inject the NMI as otherwise if we return
+         * to ring-3 prematurely we could leave NMIs blocked indefinitely upon re-entry into
+         * SVM R0.
          *
-         * With VT-x, this is handled by the Guest interruptibility information VMCS field which will set
-         * the VMCS field after actually delivering the NMI which we read on VM-exit to determine the state.
+         * With VT-x, this is handled by the Guest interruptibility information VMCS field
+         * which will set the VMCS field after actually delivering the NMI which we read on
+         * VM-exit to determine the state.
          */
         if (    Event.n.u3Type   == SVM_EVENT_NMI
@@ -4114 +4091 @@
     HMSVM_ASSERT_PREEMPT_SAFE();
     HMSVM_ASSERT_NOT_IN_NESTED_GUEST(pCtx);
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
 
     PCSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
@@ -4120 +4097 @@
     {
         hmR0DumpRegs(pVM, pVCpu, pCtx); NOREF(pVM);
+        /** @todo We probably don't need to dump this anymore or we can expand
+         *        hmR0DumpRegs()? */
 #ifdef VBOX_STRICT
         Log4(("ctrl.u32VmcbCleanBits                 %#RX32\n",   pVmcb->ctrl.u32VmcbCleanBits));
@@ -4244 +4223 @@
     }
     else
-        Log4(("hmR0SvmReportWorldSwitchError: rcVMRun=%d\n", rcVMRun));
+        Log4Func(("rcVMRun=%d\n", rcVMRun));
 
     NOREF(pVmcb);
@@ -4274 +4253 @@
     Assert(VMMRZCallRing3IsEnabled(pVCpu));
     Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES));
-    Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_CR3));
 
     /* Could happen as a result of longjump. */
     if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_CR3))
-    {
-        Assert(!(pCtx->fExtrn & CPUMCTX_EXTRN_CR3));
         PGMUpdateCR3(pVCpu, CPUMGetGuestCR3(pVCpu));
-    }
 
     /* Update pending interrupts into the APIC's IRR. */
@@ -4298 +4273 @@
             if (rc != VINF_SUCCESS)
             {
-                Log4(("hmR0SvmCheckForceFlags: PGMSyncCR3 forcing us back to ring-3. rc=%d\n", rc));
+                Log4Func(("PGMSyncCR3 forcing us back to ring-3. rc=%d\n", rc));
                 return rc;
             }
@@ -4310 +4285 @@
             STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
             int rc = RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
-            Log4(("hmR0SvmCheckForceFlags: HM_TO_R3 forcing us back to ring-3. rc=%d\n", rc));
+            Log4Func(("HM_TO_R3 forcing us back to ring-3. rc=%d\n", rc));
             return rc;
         }
@@ -4318 +4293 @@
             || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
         {
-            Log4(("hmR0SvmCheckForceFlags: Pending VM request forcing us back to ring-3\n"));
+            Log4Func(("Pending VM request forcing us back to ring-3\n"));
             return VINF_EM_PENDING_REQUEST;
         }
@@ -4325 +4300 @@
         if (VM_FF_IS_PENDING(pVM, VM_FF_PGM_POOL_FLUSH_PENDING))
         {
-            Log4(("hmR0SvmCheckForceFlags: PGM pool flush pending forcing us back to ring-3\n"));
+            Log4Func(("PGM pool flush pending forcing us back to ring-3\n"));
             return VINF_PGM_POOL_FLUSH_PENDING;
         }
@@ -4332 +4307 @@
         if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
         {
-            Log4(("hmR0SvmCheckForceFlags: Pending DMA request forcing us back to ring-3\n"));
+            Log4Func(("Pending DMA request forcing us back to ring-3\n"));
             return VINF_EM_RAW_TO_R3;
         }
@@ -4397 +4372 @@
 
 #ifdef HMSVM_SYNC_FULL_NESTED_GUEST_STATE
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+    Assert(!(pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
+    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
 #endif
 
     /*
-     * Load the nested-guest state.
+     * Export the nested-guest state bits that are not shared with the host in any way as we
+     * can longjmp or get preempted in the midst of exporting some of the state.
      */
-    rc = hmR0SvmLoadGuestStateNested(pVCpu, pCtx);
+    rc = hmR0SvmExportGuestStateNested(pVCpu);
     AssertRCReturn(rc, rc);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadFull);    /** @todo Get new STAM counter for this? */
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExportFull);
 
     /* Ensure we've cached (and hopefully modified) the VMCB for execution using hardware-assisted SVM. */
@@ -4412 +4389 @@
     /*
      * No longjmps to ring-3 from this point on!!!
-     * Asserts() will still longjmp to ring-3 (but won't return), which is intentional, better than a kernel panic.
-     * This also disables flushing of the R0-logger instance (if any).
+     *
+     * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
+     * better than a kernel panic. This also disables flushing of the R0-logger instance.
      */
     VMMRZCallRing3Disable(pVCpu);
 
     /*
-     * We disable interrupts so that we don't miss any interrupts that would flag
-     * preemption (IPI/timers etc.) when thread-context hooks aren't used and we've
-     * been running with preemption disabled for a while.  Since this is purly to aid
-     * the RTThreadPreemptIsPending code, it doesn't matter that it may temporarily
-     * reenable and disable interrupt on NT.
+     * We disable interrupts so that we don't miss any interrupts that would flag preemption
+     * (IPI/timers etc.) when thread-context hooks aren't used and we've been running with
+     * preemption disabled for a while.  Since this is purly to aid the
+     * RTThreadPreemptIsPending() code, it doesn't matter that it may temporarily reenable and
+     * disable interrupt on NT.
      *
-     * We need to check for force-flags that could've possible been altered since we last checked them (e.g.
-     * by PDMGetInterrupt() leaving the PDM critical section, see @bugref{6398}).
+     * We need to check for force-flags that could've possible been altered since we last
+     * checked them (e.g. by PDMGetInterrupt() leaving the PDM critical section,
+     * see @bugref{6398}).
      *
-     * We also check a couple of other force-flags as a last opportunity to get the EMT back to ring-3 before
-     * executing guest code.
+     * We also check a couple of other force-flags as a last opportunity to get the EMT back
+     * to ring-3 before executing guest code.
      */
     pSvmTransient->fEFlags = ASMIntDisableFlags();
@@ -4497 +4476 @@
 
 #ifdef HMSVM_SYNC_FULL_GUEST_STATE
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+    if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
+    {
+        Assert(!(pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
+    }
 #endif
-
-    /* Load the guest bits that are not shared with the host in any way since we can longjmp or get preempted. */
-    rc = hmR0SvmLoadGuestState(pVM, pVCpu, pCtx);
+#ifdef HMSVM_SYNC_FULL_NESTED_GUEST_STATE
+    if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
+    {
+        Assert(!(pCtx->fExtrn & HMSVM_CPUMCTX_EXTRN_ALL));
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
+    }
+#endif
+
+    /*
+     * Export the guest state bits that are not shared with the host in any way as we can
+     * longjmp or get preempted in the midst of exporting some of the state.
+     */
+    rc = hmR0SvmExportGuestState(pVCpu);
     AssertRCReturn(rc, rc);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadFull);
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExportFull);
 
     /*
-     * If we're not intercepting TPR changes in the guest, save the guest TPR before the world-switch
-     * so we can update it on the way back if the guest changed the TPR.
+     * If we're not intercepting TPR changes in the guest, save the guest TPR before the
+     * world-switch so we can update it on the way back if the guest changed the TPR.
      */
     if (pVCpu->hm.s.svm.fSyncVTpr)
@@ -4520 +4513 @@
     /*
      * No longjmps to ring-3 from this point on!!!
-     * Asserts() will still longjmp to ring-3 (but won't return), which is intentional, better than a kernel panic.
-     * This also disables flushing of the R0-logger instance (if any).
+     *
+     * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
+     * better than a kernel panic. This also disables flushing of the R0-logger instance.
      */
     VMMRZCallRing3Disable(pVCpu);
 
     /*
-     * We disable interrupts so that we don't miss any interrupts that would flag
-     * preemption (IPI/timers etc.) when thread-context hooks aren't used and we've
-     * been running with preemption disabled for a while.  Since this is purly to aid
-     * the RTThreadPreemptIsPending code, it doesn't matter that it may temporarily
-     * reenable and disable interrupt on NT.
+     * We disable interrupts so that we don't miss any interrupts that would flag preemption
+     * (IPI/timers etc.) when thread-context hooks aren't used and we've been running with
+     * preemption disabled for a while.  Since this is purly to aid the
+     * RTThreadPreemptIsPending() code, it doesn't matter that it may temporarily reenable and
+     * disable interrupt on NT.
      *
-     * We need to check for force-flags that could've possible been altered since we last checked them (e.g.
-     * by PDMGetInterrupt() leaving the PDM critical section, see @bugref{6398}).
+     * We need to check for force-flags that could've possible been altered since we last
+     * checked them (e.g. by PDMGetInterrupt() leaving the PDM critical section,
+     * see @bugref{6398}).
      *
-     * We also check a couple of other force-flags as a last opportunity to get the EMT back to ring-3 before
-     * executing guest code.
+     * We also check a couple of other force-flags as a last opportunity to get the EMT back
+     * to ring-3 before executing guest code.
      */
     pSvmTransient->fEFlags = ASMIntDisableFlags();
@@ -4589 +4584 @@
     {
         STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestFpuState, x);
-        CPUMR0LoadGuestFPU(pVM, pVCpu); /* (Ignore rc, no need to set HM_CHANGED_HOST_CONTEXT for SVM.) */
+        CPUMR0LoadGuestFPU(pVM, pVCpu);     /* (Ignore rc, no need to set HM_CHANGED_HOST_CONTEXT for SVM.) */
         STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestFpuState, x);
         STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadGuestFpu);
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR0);
     }
 
     /* Load the state shared between host and guest (FPU, debug). */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_HOST_GUEST_SHARED_STATE))
-        hmR0SvmLoadSharedState(pVCpu, pVmcb, pCtx);
-
-    HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_HOST_CONTEXT);             /* Preemption might set this, nothing to do on AMD-V. */
-    AssertMsg(!HMCPU_CF_VALUE(pVCpu), ("fContextUseFlags=%#RX32\n", HMCPU_CF_VALUE(pVCpu)));
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_SVM_HOST_GUEST_SHARED_STATE)
+        hmR0SvmExportSharedState(pVCpu, pVmcb);
+
+    pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_HOST_CONTEXT;        /* Preemption might set this, nothing to do on AMD-V. */
+    AssertMsg(!pVCpu->hm.s.fCtxChanged, ("fCtxChanged=%#RX64\n", pVCpu->hm.s.fCtxChanged));
 
     PHMGLOBALCPUINFO pHostCpu         = hmR0GetCurrentCpu();
@@ -4659 +4653 @@
 
     /*
-     * Save the current Host TSC_AUX and write the guest TSC_AUX to the host, so that
-     * RDTSCPs (that don't cause exits) reads the guest MSR. See @bugref{3324}.
+     * Save the current Host TSC_AUX and write the guest TSC_AUX to the host, so that RDTSCPs
+     * (that don't cause exits) reads the guest MSR, see @bugref{3324}.
      *
      * This should be done -after- any RDTSCPs for obtaining the host timestamp (TM, STAM etc).
@@ -4682 +4676 @@
 
     /*
-     * If VMCB Clean bits isn't supported by the CPU or exposed to the guest in the
-     * nested virtualization case, mark all state-bits as dirty indicating to the
-     * CPU to re-load from VMCB.
+     * If VMCB Clean bits isn't supported by the CPU or exposed to the guest in the nested
+     * virtualization case, mark all state-bits as dirty indicating to the CPU to re-load
+     * from the VMCB.
      */
     bool const fSupportsVmcbCleanBits = hmR0SvmSupportsVmcbCleanBits(pVCpu, pCtx);
@@ -4708 +4702 @@
 
     /*
-     * 64-bit Windows uses XMM registers in the kernel as the Microsoft compiler expresses floating-point operations
-     * using SSE instructions. Some XMM registers (XMM6-XMM15) are callee-saved and thus the need for this XMM wrapper.
-     * Refer MSDN docs. "Configuring Programs for 64-bit / x64 Software Conventions / Register Usage" for details.
+     * 64-bit Windows uses XMM registers in the kernel as the Microsoft compiler expresses
+     * floating-point operations using SSE instructions. Some XMM registers (XMM6-XMM15) are
+     * callee-saved and thus the need for this XMM wrapper.
+     *
+     * Refer MSDN "Configuring Programs for 64-bit/x64 Software Conventions / Register Usage".
      */
 #ifdef VBOX_WITH_KERNEL_USING_XMM
@@ -4738 +4734 @@
 
     /*
-     * 64-bit Windows uses XMM registers in the kernel as the Microsoft compiler expresses floating-point operations
-     * using SSE instructions. Some XMM registers (XMM6-XMM15) are callee-saved and thus the need for this XMM wrapper.
-     * Refer MSDN docs. "Configuring Programs for 64-bit / x64 Software Conventions / Register Usage" for details.
+     * 64-bit Windows uses XMM registers in the kernel as the Microsoft compiler expresses
+     * floating-point operations using SSE instructions. Some XMM registers (XMM6-XMM15) are
+     * callee-saved and thus the need for this XMM wrapper.
+     *
+     * Refer MSDN "Configuring Programs for 64-bit/x64 Software Conventions / Register Usage".
      */
 #ifdef VBOX_WITH_KERNEL_USING_XMM
@@ -4832 +4830 @@
     if (RT_UNLIKELY(rcVMRun != VINF_SUCCESS))
     {
-        Log4(("VMRUN failure: rcVMRun=%Rrc\n", rcVMRun));
+        Log4Func(("VMRUN failure: rcVMRun=%Rrc\n", rcVMRun));
         return;
     }
@@ -4841 +4839 @@
     pSvmTransient->fVectoringPF       = false;                  /* Vectoring page-fault needs to be determined later. */
 
-    hmR0SvmSaveGuestState(pVCpu, pCtx, pVmcb);                  /* Save the guest state from the VMCB to the guest-CPU context. */
+#ifdef HMSVM_SYNC_FULL_GUEST_STATE
+    if (!CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
+        hmR0SvmImportGuestState(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
+#elif defined(HMSVM_SYNC_FULL_NESTED_GUEST_STATE)
+    if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
+        hmR0SvmImportGuestState(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
+#else
+    /*
+     * Always import the following:
+     *
+     *   - RIP for exit optimizations and evaluating event injection on re-entry.
+     *   - RFLAGS for evaluating event injection on VM re-entry and for exporting shared debug
+     *     state on preemption.
+     *   - Interrupt shadow, GIF for evaluating event injection on VM re-entry.
+     *   - CS for exit optimizations.
+     *   - RAX, RSP for simplifying assumptions on GPRs. All other GPRs are swapped by the
+     *     assembly switcher code.
+     *   - Shared state (only DR7 currently) for exporting shared debug state on preemption.
+     */
+    hmR0SvmImportGuestState(pVCpu,   CPUMCTX_EXTRN_RIP
+                                   | CPUMCTX_EXTRN_RFLAGS
+                                   | CPUMCTX_EXTRN_RAX
+                                   | CPUMCTX_EXTRN_RSP
+                                   | CPUMCTX_EXTRN_CS
+                                   | CPUMCTX_EXTRN_HWVIRT
+                                   | CPUMCTX_EXTRN_HM_SVM_INT_SHADOW
+                                   | CPUMCTX_EXTRN_HM_SVM_HWVIRT_VIRQ
+                                   | HMSVM_CPUMCTX_SHARED_STATE);
+#endif
+
+#ifdef DEBUG_ramshankar
+    if (CPUMIsGuestInSvmNestedHwVirtMode(pCtx))
+    {
+        hmR0SvmImportGuestState(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
+        hmR0SvmLogState(pVCpu, pVmcb, pCtx, "hmR0SvmPostRunGuestNested", HMSVM_LOG_ALL & ~HMSVM_LOG_LBR, 0 /* uVerbose */);
+    }
+#endif
 
     if (   pSvmTransient->u64ExitCode != SVM_EXIT_INVALID
@@ -4853 +4887 @@
             int rc = APICSetTpr(pVCpu, pVmcb->guest.u64LSTAR & 0xff);
             AssertRC(rc);
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
         }
         /* Sync TPR when we aren't intercepting CR8 writes. */
@@ -4860 +4894 @@
             int rc = APICSetTpr(pVCpu, pVmcbCtrl->IntCtrl.n.u8VTPR << 4);
             AssertRC(rc);
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
         }
     }
@@ -4896 +4930 @@
         HMSVM_ASSERT_CPU_SAFE();
 
-        /* Preparatory work for running guest code, this may force us to return
-           to ring-3.  This bugger disables interrupts on VINF_SUCCESS! */
+        /* Preparatory work for running nested-guest code, this may force us to return to
+           ring-3.  This bugger disables interrupts on VINF_SUCCESS! */
         STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
         rc = hmR0SvmPreRunGuest(pVM, pVCpu, pCtx, &SvmTransient);
@@ -4905 +4939 @@
         /*
          * No longjmps to ring-3 from this point on!!!
-         * Asserts() will still longjmp to ring-3 (but won't return), which is intentional, better than a kernel panic.
-         * This also disables flushing of the R0-logger instance (if any).
+         *
+         * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
+         * better than a kernel panic. This also disables flushing of the R0-logger instance.
          */
         hmR0SvmPreRunGuestCommitted(pVCpu, pCtx, &SvmTransient);
         rc = hmR0SvmRunGuest(pVM, pVCpu, pCtx);
 
-        /* Restore any residual host-state and save any bits shared between host
-           and guest into the guest-CPU state.  Re-enables interrupts! */
+        /* Restore any residual host-state and save any bits shared between host and guest
+           into the guest-CPU state.  Re-enables interrupts! */
         hmR0SvmPostRunGuest(pVCpu, pCtx, &SvmTransient, rc);
 
@@ -4977 +5012 @@
                   (unsigned)RTMpCpuId(), *pcLoops));
 
-        /* Preparatory work for running guest code, this may force us to return
-           to ring-3.  This bugger disables interrupts on VINF_SUCCESS! */
+        /* Preparatory work for running nested-guest code, this may force us to return to
+           ring-3.  This bugger disables interrupts on VINF_SUCCESS! */
         STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
         rc = hmR0SvmPreRunGuest(pVM, pVCpu, pCtx, &SvmTransient);
@@ -4986 +5021 @@
         /*
          * No longjmps to ring-3 from this point on!!!
-         * Asserts() will still longjmp to ring-3 (but won't return), which is intentional, better than a kernel panic.
-         * This also disables flushing of the R0-logger instance (if any).
+         *
+         * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
+         * better than a kernel panic. This also disables flushing of the R0-logger instance.
          */
         VMMRZCallRing3Disable(pVCpu);
@@ -4995 +5031 @@
         rc = hmR0SvmRunGuest(pVM, pVCpu, pCtx);
 
-        /*
-         * Restore any residual host-state and save any bits shared between host and guest into the guest-CPU state.
-         * This will also re-enable longjmps to ring-3 when it has reached a safe point!!!
-         */
+        /* Restore any residual host-state and save any bits shared between host and guest
+           into the guest-CPU state.  Re-enables interrupts! */
         hmR0SvmPostRunGuest(pVCpu, pCtx, &SvmTransient, rc);
+
         if (RT_UNLIKELY(   rc != VINF_SUCCESS                               /* Check for VMRUN errors. */
                         || SvmTransient.u64ExitCode == SVM_EXIT_INVALID))   /* Check for invalid guest-state errors. */
@@ -5035 +5070 @@
             break;
         }
-        pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_DEBUG;
+        pVCpu->hm.s.fCtxChanged |= HM_CHANGED_GUEST_DR_MASK;
     }
 
@@ -5081 +5116 @@
         HMSVM_ASSERT_CPU_SAFE();
 
-        /* Preparatory work for running nested-guest code, this may force us to return
-           to ring-3.  This bugger disables interrupts on VINF_SUCCESS! */
+        /* Preparatory work for running nested-guest code, this may force us to return to
+           ring-3.  This bugger disables interrupts on VINF_SUCCESS! */
         STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
         rc = hmR0SvmPreRunGuestNested(pVM, pVCpu, pCtx, &SvmTransient);
@@ -5093 +5128 @@
         /*
          * No longjmps to ring-3 from this point on!!!
-         * Asserts() will still longjmp to ring-3 (but won't return), which is intentional, better than a kernel panic.
-         * This also disables flushing of the R0-logger instance (if any).
+         *
+         * Asserts() will still longjmp to ring-3 (but won't return), which is intentional,
+         * better than a kernel panic. This also disables flushing of the R0-logger instance.
          */
         hmR0SvmPreRunGuestCommitted(pVCpu, pCtx, &SvmTransient);
@@ -5100 +5136 @@
         rc = hmR0SvmRunGuestNested(pVM, pVCpu, pCtx);
 
-        /* Restore any residual host-state and save any bits shared between host
-           and guest into the guest-CPU state.  Re-enables interrupts! */
+        /* Restore any residual host-state and save any bits shared between host and guest
+           into the guest-CPU state.  Re-enables interrupts! */
         hmR0SvmPostRunGuest(pVCpu, pCtx, &SvmTransient, rc);
 
@@ -5114 +5150 @@
 
             /* Invalid nested-guest state. Cause a #VMEXIT but assert on strict builds. */
-            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
             AssertMsgFailed(("Invalid nested-guest state. rc=%Rrc u64ExitCode=%#RX64\n", rc, SvmTransient.u64ExitCode));
             rc = VBOXSTRICTRC_TODO(IEMExecSvmVmexit(pVCpu, SVM_EXIT_INVALID, 0, 0));
@@ -5236 +5272 @@
     Assert(pSvmTransient->u64ExitCode <= SVM_EXIT_MAX);
 
-    /** @todo Use IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK instead of
-     *        HMSVM_CPUMCTX_EXTRN_ALL below. See todo in
-     *        HMSvmNstGstVmExitNotify(). */
+    /** @todo Figure out why using IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK instead of
+     *        HMSVM_CPUMCTX_EXTRN_ALL breaks nested guests (XP Pro, DSL etc.), see
+     *        also HMSvmNstGstVmExitNotify(). */
 #define NST_GST_VMEXIT_CALL_RET(a_pVCpu, a_pCtx, a_uExitCode, a_uExitInfo1, a_uExitInfo2) \
     do { \
-        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL); \
+        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL); \
         return VBOXSTRICTRC_TODO(IEMExecSvmVmexit((a_pVCpu), (a_uExitCode), (a_uExitInfo1), (a_uExitInfo2))); \
     } while (0)
 
     /*
-     * For all the #VMEXITs here we primarily figure out if the #VMEXIT is expected
-     * by the nested-guest. If it isn't, it should be handled by the (outer) guest.
+     * For all the #VMEXITs here we primarily figure out if the #VMEXIT is expected by the
+     * nested-guest. If it isn't, it should be handled by the (outer) guest.
      */
     PSVMVMCB       pVmcbNstGst     = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
@@ -5364 +5400 @@
 
                 /* If the nested-guest is not intercepting #PFs, forward the #PF to the guest. */
-                HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, CPUMCTX_EXTRN_CR2);
+                HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR2);
                 hmR0SvmSetPendingXcptPF(pVCpu, pCtx, u32ErrCode, uFaultAddress);
                 return VINF_SUCCESS;
@@ -5427 +5463 @@
         case SVM_EXIT_WRITE_CR3:
         case SVM_EXIT_WRITE_CR4:
-        case SVM_EXIT_WRITE_CR8:   /** @todo Shouldn't writes to CR8 go to V_TPR instead since we run with V_INTR_MASKING set? */
+        case SVM_EXIT_WRITE_CR8:    /* CR8 writes would go to the V_TPR rather than here, since we run with V_INTR_MASKING. */
         {
             uint8_t const uCr = uExitCode - SVM_EXIT_WRITE_CR0;
-            Log4(("hmR0SvmHandleExitNested: Write CR%u: uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uCr, uExitInfo1, uExitInfo2));
+            Log4Func(("Write CR%u: uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", uCr, uExitInfo1, uExitInfo2));
 
             if (HMIsGuestSvmWriteCRxInterceptSet(pVCpu, uCr))
@@ -5459 +5495 @@
              * We shouldn't direct physical interrupts, NMIs, SMIs to the nested-guest.
              *
-             * Although we don't intercept SMIs, the nested-guest might. Therefore, we
-             * might get an SMI #VMEXIT here so simply ignore rather than causing a
-             * corresponding nested-guest #VMEXIT.
+             * Although we don't intercept SMIs, the nested-guest might. Therefore, we might
+             * get an SMI #VMEXIT here so simply ignore rather than causing a corresponding
+             * nested-guest #VMEXIT.
              */
+            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_SVM_VMEXIT_MASK);
             return hmR0SvmExitIntr(pVCpu, pCtx, pSvmTransient);
         }
@@ -5527 +5564 @@
                 }
 
-                case SVM_EXIT_XCPT_0:      /* #DE                   */
-                /*   SVM_EXIT_XCPT_1: */   /* #DB  - Handled above. */
-                /*   SVM_EXIT_XCPT_2: */   /* #NMI - Handled above. */
-                /*   SVM_EXIT_XCPT_3: */   /* #BP  - Handled above. */
-                case SVM_EXIT_XCPT_4:      /* #OF                   */
-                case SVM_EXIT_XCPT_5:      /* #BR                   */
-                /*   SVM_EXIT_XCPT_6: */   /* #UD  - Handled above. */
-                case SVM_EXIT_XCPT_7:      /* #NM                   */
-                case SVM_EXIT_XCPT_8:      /* #DF                   */
-                case SVM_EXIT_XCPT_9:      /* #CO_SEG_OVERRUN       */
-                case SVM_EXIT_XCPT_10:     /* #TS                   */
-                case SVM_EXIT_XCPT_11:     /* #NP                   */
-                case SVM_EXIT_XCPT_12:     /* #SS                   */
-                case SVM_EXIT_XCPT_13:     /* #GP                   */
-                /*   SVM_EXIT_XCPT_14: */  /* #PF  - Handled above. */
-                case SVM_EXIT_XCPT_15:     /* Reserved.             */
-                /*   SVM_EXIT_XCPT_16: */  /* #MF  - Handled above. */
-                /*   SVM_EXIT_XCPT_17: */  /* #AC  - Handled above. */
-                case SVM_EXIT_XCPT_18:     /* #MC                   */
-                case SVM_EXIT_XCPT_19:     /* #XF                   */
+                case SVM_EXIT_XCPT_DE:
+                /*   SVM_EXIT_XCPT_DB: */       /* Handled above. */
+                /*   SVM_EXIT_XCPT_NMI: */      /* Handled above. */
+                /*   SVM_EXIT_XCPT_BP: */       /* Handled above. */
+                case SVM_EXIT_XCPT_OF:
+                case SVM_EXIT_XCPT_BR:
+                /*   SVM_EXIT_XCPT_UD: */       /* Handled above. */
+                case SVM_EXIT_XCPT_NM:
+                case SVM_EXIT_XCPT_DF:
+                case SVM_EXIT_XCPT_CO_SEG_OVERRUN:
+                case SVM_EXIT_XCPT_TS:
+                case SVM_EXIT_XCPT_NP:
+                case SVM_EXIT_XCPT_SS:
+                case SVM_EXIT_XCPT_GP:
+                /*   SVM_EXIT_XCPT_PF: */       /* Handled above. */
+                case SVM_EXIT_XCPT_15:          /* Reserved.      */
+                /*   SVM_EXIT_XCPT_MF: */       /* Handled above. */
+                /*   SVM_EXIT_XCPT_AC: */       /* Handled above. */
+                case SVM_EXIT_XCPT_MC:
+                case SVM_EXIT_XCPT_XF:
                 case SVM_EXIT_XCPT_20: case SVM_EXIT_XCPT_21: case SVM_EXIT_XCPT_22: case SVM_EXIT_XCPT_23:
                 case SVM_EXIT_XCPT_24: case SVM_EXIT_XCPT_25: case SVM_EXIT_XCPT_26: case SVM_EXIT_XCPT_27:
@@ -5692 +5729 @@
         do { \
             if ((a_fDbg) == 1) \
-                HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL); \
+                HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL); \
             int rc = a_CallExpr; \
-            /* if ((a_fDbg) == 1) */ \
-            /*     HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST); */ \
+            if ((a_fDbg) == 1) \
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST); \
             return rc; \
         } while (0)
@@ -5901 +5938 @@
     else
     {
-        Log4(("hmR0SvmInterpretInvlPgEx invalid parameter type %#x\n", Param1.type));
+        Log4Func(("Invalid parameter type %#x\n", Param1.type));
         rc = VERR_EM_INTERPRETER;
     }
@@ -5939 +5976 @@
         }
         else
-            Log4(("hmR0SvmInterpretInvlpg: EMInterpretDisasCurrent returned %Rrc uOpCode=%#x\n", rc, pDis->pCurInstr->uOpcode));
+            Log4Func(("EMInterpretDisasCurrent failed! rc=%Rrc uOpCode=%#x\n", rc, pDis->pCurInstr->uOpcode));
     }
     return VERR_EM_INTERPRETER;
@@ -5945 +5982 @@
 
 
-#ifdef HMSVM_USE_IEM_EVENT_REFLECTION
 /**
  * Gets the IEM exception flags for the specified SVM event.
@@ -5999 +6035 @@
 }
 
-#else
-/**
- * Determines if an exception is a contributory exception.
- *
- * Contributory exceptions are ones which can cause double-faults unless the
- * original exception was a benign exception. Page-fault is intentionally not
- * included here as it's a conditional contributory exception.
- *
- * @returns @c true if the exception is contributory, @c false otherwise.
- * @param   uVector     The exception vector.
- */
-DECLINLINE(bool) hmR0SvmIsContributoryXcpt(const uint32_t uVector)
-{
-    switch (uVector)
-    {
-        case X86_XCPT_GP:
-        case X86_XCPT_SS:
-        case X86_XCPT_NP:
-        case X86_XCPT_TS:
-        case X86_XCPT_DE:
-            return true;
-        default:
-            break;
-    }
-    return false;
-}
-#endif /* HMSVM_USE_IEM_EVENT_REFLECTION */
-
 
 /**
@@ -6049 +6057 @@
     int rc = VINF_SUCCESS;
     PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, CPUMCTX_EXTRN_CR2);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR2);
 
     Log4(("EXITINTINFO: Pending vectoring event %#RX64 Valid=%RTbool ErrValid=%RTbool Err=%#RX32 Type=%u Vector=%u\n",
@@ -6055 +6063 @@
           pVmcb->ctrl.ExitIntInfo.n.u32ErrorCode, pVmcb->ctrl.ExitIntInfo.n.u3Type, pVmcb->ctrl.ExitIntInfo.n.u8Vector));
 
-    /* See AMD spec. 15.7.3 "EXITINFO Pseudo-Code". The EXITINTINFO (if valid) contains the prior exception (IDT vector)
-     * that was trying to be delivered to the guest which caused a #VMEXIT which was intercepted (Exit vector). */
+    /*
+     * The EXITINTINFO (if valid) contains the prior exception (IDT vector) that was trying to
+     * be delivered to the guest which caused a #VMEXIT which was intercepted (Exit vector).
+     *
+     * See AMD spec. 15.7.3 "EXITINFO Pseudo-Code".
+     */
     if (pVmcb->ctrl.ExitIntInfo.n.u1Valid)
     {
-#ifdef HMSVM_USE_IEM_EVENT_REFLECTION
         IEMXCPTRAISE     enmRaise;
         IEMXCPTRAISEINFO fRaiseInfo;
@@ -6074 +6085 @@
         {
             /*
-             * If delivery of an event caused a #VMEXIT that is not an exception (e.g. #NPF) then we
-             * end up here.
+             * If delivery of an event caused a #VMEXIT that is not an exception (e.g. #NPF)
+             * then we end up here.
              *
              * If the event was:
-             *   - a software interrupt, we can re-execute the instruction which will regenerate
-             *     the event.
+             *   - a software interrupt, we can re-execute the instruction which will
+             *     regenerate the event.
              *   - an NMI, we need to clear NMI blocking and re-inject the NMI.
              *   - a hardware exception or external interrupt, we re-inject it.
@@ -6108 +6119 @@
                     {
                         pSvmTransient->fVectoringPF = true;
-                        Log4(("IDT: Pending vectoring #PF due to delivery of Ext-Int/NMI. uCR2=%#RX64\n", pCtx->cr2));
+                        Log4Func(("IDT: Pending vectoring #PF due to delivery of Ext-Int/NMI. uCR2=%#RX64\n", pCtx->cr2));
                     }
                     else if (   pVmcb->ctrl.ExitIntInfo.n.u3Type == SVM_EVENT_EXCEPTION
@@ -6128 +6139 @@
                     hmR0SvmSetPendingEvent(pVCpu, &pVmcb->ctrl.ExitIntInfo, GCPtrFaultAddress);
 
-                    Log4(("IDT: Pending vectoring event %#RX64 ErrValid=%RTbool Err=%#RX32 GCPtrFaultAddress=%#RX64\n",
-                          pVmcb->ctrl.ExitIntInfo.u, RT_BOOL(pVmcb->ctrl.ExitIntInfo.n.u1ErrorCodeValid),
-                          pVmcb->ctrl.ExitIntInfo.n.u32ErrorCode, GCPtrFaultAddress));
+                    Log4Func(("IDT: Pending vectoring event %#RX64 ErrValid=%RTbool Err=%#RX32 GCPtrFaultAddress=%#RX64\n",
+                              pVmcb->ctrl.ExitIntInfo.u, RT_BOOL(pVmcb->ctrl.ExitIntInfo.n.u1ErrorCodeValid),
+                              pVmcb->ctrl.ExitIntInfo.n.u32ErrorCode, GCPtrFaultAddress));
                 }
                 break;
@@ -6144 +6155 @@
             {
                 /*
-                 * Determing a vectoring double #PF condition. Used later, when PGM evaluates the
-                 * second #PF as a guest #PF (and not a shadow #PF) and needs to be converted into a #DF.
+                 * Determing a vectoring double #PF condition. Used later, when PGM evaluates
+                 * the second #PF as a guest #PF (and not a shadow #PF) and needs to be
+                 * converted into a #DF.
                  */
                 if (fRaiseInfo & IEMXCPTRAISEINFO_PF_PF)
                 {
-                    Log4(("IDT: Pending vectoring double #PF uCR2=%#RX64\n", pCtx->cr2));
+                    Log4Func(("IDT: Pending vectoring double #PF uCR2=%#RX64\n", pCtx->cr2));
                     pSvmTransient->fVectoringDoublePF = true;
                     Assert(rc == VINF_SUCCESS);
@@ -6181 +6193 @@
             }
         }
-#else
-        uint8_t uIdtVector  = pVmcb->ctrl.ExitIntInfo.n.u8Vector;
-
-        typedef enum
-        {
-            SVMREFLECTXCPT_XCPT,    /* Reflect the exception to the guest or for further evaluation by VMM. */
-            SVMREFLECTXCPT_DF,      /* Reflect the exception as a double-fault to the guest. */
-            SVMREFLECTXCPT_TF,      /* Indicate a triple faulted state to the VMM. */
-            SVMREFLECTXCPT_HANG,    /* Indicate bad VM trying to deadlock the CPU. */
-            SVMREFLECTXCPT_NONE     /* Nothing to reflect. */
-        } SVMREFLECTXCPT;
-
-        SVMREFLECTXCPT enmReflect = SVMREFLECTXCPT_NONE;
-        bool fReflectingNmi = false;
-        if (pVmcb->ctrl.ExitIntInfo.n.u3Type == SVM_EVENT_EXCEPTION)
-        {
-            if (pSvmTransient->u64ExitCode - SVM_EXIT_XCPT_0 <= SVM_EXIT_XCPT_31)
-            {
-                uint8_t uExitVector = (uint8_t)(pSvmTransient->u64ExitCode - SVM_EXIT_XCPT_0);
-
-#ifdef VBOX_STRICT
-                if (   hmR0SvmIsContributoryXcpt(uIdtVector)
-                    && uExitVector == X86_XCPT_PF)
-                {
-                    Log4(("IDT: Contributory #PF idCpu=%u uCR2=%#RX64\n", pVCpu->idCpu, pCtx->cr2));
-                }
-#endif
-
-                if (   uIdtVector == X86_XCPT_BP
-                    || uIdtVector == X86_XCPT_OF)
-                {
-                    /* Ignore INT3/INTO, just re-execute. See @bugref{8357}. */
-                }
-                else if (   uExitVector == X86_XCPT_PF
-                         && uIdtVector  == X86_XCPT_PF)
-                {
-                    pSvmTransient->fVectoringDoublePF = true;
-                    Log4(("IDT: Vectoring double #PF uCR2=%#RX64\n", pCtx->cr2));
-                }
-                else if (   uExitVector == X86_XCPT_AC
-                         && uIdtVector == X86_XCPT_AC)
-                {
-                    enmReflect = SVMREFLECTXCPT_HANG;
-                    Log4(("IDT: Nested #AC - Bad guest\n"));
-                }
-                else if (   (pVmcb->ctrl.u32InterceptXcpt & HMSVM_CONTRIBUTORY_XCPT_MASK)
-                         && hmR0SvmIsContributoryXcpt(uExitVector)
-                         && (   hmR0SvmIsContributoryXcpt(uIdtVector)
-                             || uIdtVector == X86_XCPT_PF))
-                {
-                    enmReflect = SVMREFLECTXCPT_DF;
-                    Log4(("IDT: Pending vectoring #DF %#RX64 uIdtVector=%#x uExitVector=%#x\n", pVCpu->hm.s.Event.u64IntInfo,
-                          uIdtVector, uExitVector));
-                }
-                else if (uIdtVector == X86_XCPT_DF)
-                {
-                    enmReflect = SVMREFLECTXCPT_TF;
-                    Log4(("IDT: Pending vectoring triple-fault %#RX64 uIdtVector=%#x uExitVector=%#x\n",
-                          pVCpu->hm.s.Event.u64IntInfo, uIdtVector, uExitVector));
-                }
-                else
-                    enmReflect = SVMREFLECTXCPT_XCPT;
-            }
-            else
-            {
-                /*
-                 * If event delivery caused an #VMEXIT that is not an exception (e.g. #NPF) then reflect the original
-                 * exception to the guest after handling the #VMEXIT.
-                 */
-                enmReflect = SVMREFLECTXCPT_XCPT;
-            }
-        }
-        else if (   pVmcb->ctrl.ExitIntInfo.n.u3Type == SVM_EVENT_EXTERNAL_IRQ
-                 || pVmcb->ctrl.ExitIntInfo.n.u3Type == SVM_EVENT_NMI)
-        {
-            enmReflect = SVMREFLECTXCPT_XCPT;
-            fReflectingNmi = RT_BOOL(pVmcb->ctrl.ExitIntInfo.n.u3Type == SVM_EVENT_NMI);
-
-            if (pSvmTransient->u64ExitCode - SVM_EXIT_XCPT_0 <= SVM_EXIT_XCPT_31)
-            {
-                uint8_t uExitVector = (uint8_t)(pSvmTransient->u64ExitCode - SVM_EXIT_XCPT_0);
-                if (uExitVector == X86_XCPT_PF)
-                {
-                    pSvmTransient->fVectoringPF = true;
-                    Log4(("IDT: Vectoring #PF due to Ext-Int/NMI. uCR2=%#RX64\n", pCtx->cr2));
-                }
-            }
-        }
-        /* else: Ignore software interrupts (INT n) as they reoccur when restarting the instruction. */
-
-        switch (enmReflect)
-        {
-            case SVMREFLECTXCPT_XCPT:
-            {
-                /* If we are re-injecting the NMI, clear NMI blocking. */
-                if (fReflectingNmi)
-                    VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
-
-                Assert(pVmcb->ctrl.ExitIntInfo.n.u3Type != SVM_EVENT_SOFTWARE_INT);
-                STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingReflect);
-                hmR0SvmSetPendingEvent(pVCpu, &pVmcb->ctrl.ExitIntInfo, 0 /* GCPtrFaultAddress */);
-
-                /* If uExitVector is #PF, CR2 value will be updated from the VMCB if it's a guest #PF. See hmR0SvmExitXcptPF(). */
-                Log4(("IDT: Pending vectoring event %#RX64 ErrValid=%RTbool Err=%#RX32\n", pVmcb->ctrl.ExitIntInfo.u,
-                      !!pVmcb->ctrl.ExitIntInfo.n.u1ErrorCodeValid, pVmcb->ctrl.ExitIntInfo.n.u32ErrorCode));
-                break;
-            }
-
-            case SVMREFLECTXCPT_DF:
-            {
-                STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingReflect);
-                hmR0SvmSetPendingXcptDF(pVCpu);
-                rc = VINF_HM_DOUBLE_FAULT;
-                break;
-            }
-
-            case SVMREFLECTXCPT_TF:
-            {
-                rc = VINF_EM_RESET;
-                break;
-            }
-
-            case SVMREFLECTXCPT_HANG:
-            {
-                rc = VERR_EM_GUEST_CPU_HANG;
-                break;
-            }
-
-            default:
-                Assert(rc == VINF_SUCCESS);
-                break;
-        }
-#endif  /* HMSVM_USE_IEM_EVENT_REFLECTION */
     }
     Assert(rc == VINF_SUCCESS || rc == VINF_HM_DOUBLE_FAULT || rc == VINF_EM_RESET || rc == VERR_EM_GUEST_CPU_HANG);
@@ -6414 +6293 @@
 
     /*
-     * AMD-V has no preemption timer and the generic periodic preemption timer has no way to signal -before- the timer
-     * fires if the current interrupt is our own timer or a some other host interrupt. We also cannot examine what
-     * interrupt it is until the host actually take the interrupt.
+     * AMD-V has no preemption timer and the generic periodic preemption timer has no way to
+     * signal -before- the timer fires if the current interrupt is our own timer or a some
+     * other host interrupt. We also cannot examine what interrupt it is until the host
+     * actually take the interrupt.
      *
-     * Going back to executing guest code here unconditionally causes random scheduling problems (observed on an
-     * AMD Phenom 9850 Quad-Core on Windows 64-bit host).
+     * Going back to executing guest code here unconditionally causes random scheduling
+     * problems (observed on an AMD Phenom 9850 Quad-Core on Windows 64-bit host).
      */
     return VINF_EM_RAW_INTERRUPT;
@@ -6433 +6313 @@
 
     hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitWbinvd);
     int rc = VINF_SUCCESS;
     HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
@@ -6448 +6327 @@
 
     hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvd);
     int rc = VINF_SUCCESS;
     HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
@@ -6462 +6340 @@
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
 
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, CPUMCTX_EXTRN_RIP | CPUMCTX_EXTRN_CS);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   CPUMCTX_EXTRN_RIP
+                                      | CPUMCTX_EXTRN_CS);
     VBOXSTRICTRC rcStrict;
     PCEMEXITREC pExitRec = EMHistoryUpdateFlagsAndTypeAndPC(pVCpu,
@@ -6488 +6367 @@
          */
         Assert(pCtx == &pVCpu->cpum.GstCtx);
-        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
 
         Log4(("CpuIdExit/%u: %04x:%08RX64: %#x/%#x -> EMHistoryExec\n",
@@ -6499 +6378 @@
               VBOXSTRICTRC_VAL(rcStrict), pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip));
     }
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCpuid);
     return VBOXSTRICTRC_TODO(rcStrict);
 }
@@ -6510 +6388 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
     VBOXSTRICTRC rcStrict = IEMExecDecodedRdtsc(pVCpu, hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 2));
     if (rcStrict == VINF_SUCCESS)
@@ -6517 +6395 @@
         rcStrict = VINF_SUCCESS;
     HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
     return VBOXSTRICTRC_TODO(rcStrict);
 }
@@ -6529 +6406 @@
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
     VBOXSTRICTRC rcStrict = IEMExecDecodedRdtscp(pVCpu, hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3));
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
     if (rcStrict == VINF_SUCCESS)
         pSvmTransient->fUpdateTscOffsetting = true;
@@ -6535 +6412 @@
         rcStrict = VINF_SUCCESS;
     HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
     return VBOXSTRICTRC_TODO(rcStrict);
 }
@@ -6546 +6422 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx,   CPUMCTX_EXTRN_CR0
-                                    | CPUMCTX_EXTRN_CR4
-                                    | CPUMCTX_EXTRN_SS);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   CPUMCTX_EXTRN_CR0
+                                      | CPUMCTX_EXTRN_CR4
+                                      | CPUMCTX_EXTRN_SS);
 
     int rc = EMInterpretRdpmc(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
@@ -6561 +6437 @@
         rc = VERR_EM_INTERPRETER;
     }
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdpmc);
     return rc;
 }
@@ -6574 +6449 @@
     PVM pVM = pVCpu->CTX_SUFF(pVM);
     Assert(!pVM->hm.s.fNestedPaging);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvlpg);
 
     bool const fSupportsDecodeAssists = hmR0SvmSupportsDecodeAssists(pVCpu, pCtx);
@@ -6581 +6455 @@
         && fSupportsNextRipSave)
     {
-        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
         PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
         uint8_t const cbInstr   = pVmcb->ctrl.u64NextRIP - pCtx->rip;
@@ -6590 +6464 @@
     }
 
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
     int rc = hmR0SvmInterpretInvlpg(pVM, pVCpu, pCtx);    /* Updates RIP if successful. */
     Assert(rc == VINF_SUCCESS || rc == VERR_EM_INTERPRETER);
@@ -6608 +6482 @@
     int rc = EMShouldContinueAfterHalt(pVCpu, pCtx) ? VINF_SUCCESS : VINF_EM_HALT;
     HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
+
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
     if (rc != VINF_SUCCESS)
@@ -6621 +6496 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx,   CPUMCTX_EXTRN_CR0
-                                            | CPUMCTX_EXTRN_SS);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   CPUMCTX_EXTRN_CR0
+                                      | CPUMCTX_EXTRN_SS);
 
     int rc = EMInterpretMonitor(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
@@ -6646 +6521 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx,   CPUMCTX_EXTRN_CR0
-                                            | CPUMCTX_EXTRN_SS);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   CPUMCTX_EXTRN_CR0
+                                      | CPUMCTX_EXTRN_SS);
 
     VBOXSTRICTRC rc2 = EMInterpretMWait(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
@@ -6682 +6557 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
     return VINF_EM_RESET;
 }
@@ -6694 +6569 @@
     RT_NOREF(pCtx);
     PCSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
     AssertMsgFailed(("hmR0SvmExitUnexpected: ExitCode=%#RX64 uExitInfo1=%#RX64 uExitInfo2=%#RX64\n", pSvmTransient->u64ExitCode,
                      pVmcb->ctrl.u64ExitInfo1, pVmcb->ctrl.u64ExitInfo2));
@@ -6710 +6585 @@
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
 
-    Log4(("hmR0SvmExitReadCRx: CS:RIP=%04x:%#RX64\n", pCtx->cs.Sel, pCtx->rip));
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxRead[pSvmTransient->u64ExitCode - SVM_EXIT_READ_CR0]);
+    Log4Func(("CS:RIP=%04x:%#RX64\n", pCtx->cs.Sel, pCtx->rip));
+#ifdef VBOX_WITH_STATISTICS
+    switch (pSvmTransient->u64ExitCode)
+    {
+        case SVM_EXIT_READ_CR0: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR0Read); break;
+        case SVM_EXIT_READ_CR2: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR2Read); break;
+        case SVM_EXIT_READ_CR3: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR3Read); break;
+        case SVM_EXIT_READ_CR4: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR4Read); break;
+        case SVM_EXIT_READ_CR8: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR8Read); break;
+    }
+#endif
 
     bool const fSupportsDecodeAssists = hmR0SvmSupportsDecodeAssists(pVCpu, pCtx);
@@ -6722 +6606 @@
         if (fMovCRx)
         {
-            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
             uint8_t const cbInstr = pVmcb->ctrl.u64NextRIP - pCtx->rip;
             uint8_t const iCrReg  = pSvmTransient->u64ExitCode - SVM_EXIT_READ_CR0;
@@ -6733 +6617 @@
     }
 
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
     VBOXSTRICTRC rc2 = EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0 /* pvFault */);
     int rc = VBOXSTRICTRC_VAL(rc2);
@@ -6766 +6650 @@
         if (fMovCRx)
         {
-            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
             uint8_t const cbInstr = pVmcb->ctrl.u64NextRIP - pCtx->rip;
             uint8_t const iGReg   = pVmcb->ctrl.u64ExitInfo1 & SVM_EXIT1_MOV_CRX_GPR_NUMBER;
-            Log4(("hmR0SvmExitWriteCRx: Mov CR%u w/ iGReg=%#x\n", iCrReg, iGReg));
+            Log4Func(("Mov CR%u w/ iGReg=%#x\n", iCrReg, iGReg));
             rcStrict = IEMExecDecodedMovCRxWrite(pVCpu, cbInstr, iCrReg, iGReg);
             fDecodedInstr = true;
@@ -6778 +6662 @@
     if (!fDecodedInstr)
     {
-        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
-        Log4(("hmR0SvmExitWriteCRx: iCrReg=%#x\n", iCrReg));
+        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
+        Log4Func(("iCrReg=%#x\n", iCrReg));
         rcStrict = IEMExecOneBypassEx(pVCpu, CPUMCTX2CORE(pCtx), NULL);
         if (RT_UNLIKELY(   rcStrict == VERR_IEM_ASPECT_NOT_IMPLEMENTED
@@ -6790 +6674 @@
         switch (iCrReg)
         {
-            case 0: HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR0);        break;
-            case 2: HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR2);        break;
-            case 3: HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR3);        break;
-            case 4: HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR4);        break;
-            case 8: HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_APIC_STATE); break;
+            case 0:
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR0);
+                STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR0Write);
+                break;
+
+            case 2:
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR2);
+                STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR2Write);
+                break;
+
+            case 3:
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR3);
+                STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR3Write);
+                break;
+
+            case 4:
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR4);
+                STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR4Write);
+                break;
+
+            case 8:
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
+                STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR8Write);
+                break;
+
             default:
             {
@@ -6811 +6715 @@
 
 /**
+ * \#VMEXIT helper for read MSRs, see hmR0SvmExitMsr.
+ *
+ * @returns VBox status code.
+ * @param   pVCpu       The cross context virtual CPU structure.
+ * @param   pVmcb       Pointer to the VM control block.
+ */
+static int hmR0SvmExitReadMsr(PVMCPU pVCpu, PSVMVMCB pVmcb)
+{
+    PCPUMCTX pCtx  = &pVCpu->cpum.GstCtx;
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   CPUMCTX_EXTRN_CR0
+                                      | CPUMCTX_EXTRN_RFLAGS
+                                      | CPUMCTX_EXTRN_SS
+                                      | CPUMCTX_EXTRN_ALL_MSRS);
+
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdmsr);
+    Log4Func(("idMsr=%#RX32\n", pCtx->ecx));
+
+    bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
+    if (fSupportsNextRipSave)
+    {
+        int rc = EMInterpretRdmsr(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
+        if (RT_LIKELY(rc == VINF_SUCCESS))
+        {
+            pCtx->rip = pVmcb->ctrl.u64NextRIP;
+            HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
+            return VINF_SUCCESS;
+        }
+
+        AssertMsg(   rc == VERR_EM_INTERPRETER
+                  || rc == VINF_CPUM_R3_MSR_READ, ("EMInterpretRdmsr failed rc=%Rrc\n", rc));
+        return rc;
+    }
+
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
+    int rc = VBOXSTRICTRC_TODO(EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0));
+    if (RT_UNLIKELY(rc != VINF_SUCCESS))
+    {
+        AssertMsg(   rc == VERR_EM_INTERPRETER
+                  || rc == VINF_CPUM_R3_MSR_READ, ("EMInterpretInstruction failed rc=%Rrc\n", rc));
+    }
+    /* RIP updated by EMInterpretInstruction(). */
+    HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
+    return rc;
+}
+
+
+/**
+ * \#VMEXIT helper for write MSRs, see hmR0SvmExitMsr.
+ *
+ * @returns VBox status code.
+ * @param   pVCpu           The cross context virtual CPU structure.
+ * @param   pVmcb       Pointer to the VM control block.
+ * @param   pSvmTransient   Pointer to the SVM-transient structure.
+ */
+static int hmR0SvmExitWriteMsr(PVMCPU pVCpu, PSVMVMCB pVmcb, PSVMTRANSIENT pSvmTransient)
+{
+    PCPUMCTX pCtx  = &pVCpu->cpum.GstCtx;
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   CPUMCTX_EXTRN_CR0
+                                      | CPUMCTX_EXTRN_RFLAGS
+                                      | CPUMCTX_EXTRN_SS
+                                      | CPUMCTX_EXTRN_ALL_MSRS);
+
+    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitWrmsr);
+    Log4Func(("idMsr=%#RX32\n", pCtx->ecx));
+
+    /*
+     * Handle TPR patching MSR writes.
+     * We utilitize the LSTAR MSR for patching.
+     */
+    if (   pVCpu->CTX_SUFF(pVM)->hm.s.fTPRPatchingActive
+        && pCtx->ecx == MSR_K8_LSTAR)
+    {
+        if ((pCtx->eax & 0xff) != pSvmTransient->u8GuestTpr)
+        {
+            /* Our patch code uses LSTAR for TPR caching for 32-bit guests. */
+            int rc2 = APICSetTpr(pVCpu, pCtx->eax & 0xff);
+            AssertRC(rc2);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
+        }
+
+        int rc = VINF_SUCCESS;
+        hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
+        HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
+        return rc;
+    }
+
+    /*
+     * Handle regular MSR writes.
+     */
+    int rc;
+    bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
+    if (fSupportsNextRipSave)
+    {
+        rc = EMInterpretWrmsr(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pCtx));
+        if (RT_LIKELY(rc == VINF_SUCCESS))
+        {
+            pCtx->rip = pVmcb->ctrl.u64NextRIP;
+            HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
+        }
+        else
+            AssertMsg(   rc == VERR_EM_INTERPRETER
+                      || rc == VINF_CPUM_R3_MSR_WRITE, ("hmR0SvmExitMsr: EMInterpretWrmsr failed rc=%Rrc\n", rc));
+    }
+    else
+    {
+        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
+        rc = VBOXSTRICTRC_TODO(EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0 /* pvFault */));
+        if (RT_LIKELY(rc == VINF_SUCCESS))
+            HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);     /* RIP updated by EMInterpretInstruction(). */
+        else
+            AssertMsg(   rc == VERR_EM_INTERPRETER
+                      || rc == VINF_CPUM_R3_MSR_WRITE, ("hmR0SvmExitMsr: WrMsr. EMInterpretInstruction failed rc=%Rrc\n", rc));
+    }
+
+    if (rc == VINF_SUCCESS)
+    {
+        /* If this is an X2APIC WRMSR access, update the APIC TPR state. */
+        if (   pCtx->ecx >= MSR_IA32_X2APIC_START
+            && pCtx->ecx <= MSR_IA32_X2APIC_END)
+        {
+            /*
+             * We've already saved the APIC related guest-state (TPR) in hmR0SvmPostRunGuest().
+             * When full APIC register virtualization is implemented we'll have to make sure
+             * APIC state is saved from the VMCB before EMInterpretWrmsr() changes it.
+             */
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
+        }
+        else
+        {
+            switch (pCtx->ecx)
+            {
+                case MSR_IA32_TSC:          pSvmTransient->fUpdateTscOffsetting = true;                                     break;
+                case MSR_K6_EFER:           ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_EFER_MSR);          break;
+                case MSR_K8_FS_BASE:        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_FS);                break;
+                case MSR_K8_GS_BASE:        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_GS);                break;
+                case MSR_IA32_SYSENTER_CS:  ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_SYSENTER_CS_MSR);   break;
+                case MSR_IA32_SYSENTER_EIP: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_SYSENTER_EIP_MSR);  break;
+                case MSR_IA32_SYSENTER_ESP: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_SYSENTER_ESP_MSR);  break;
+            }
+        }
+    }
+
+    /* RIP has been updated by above after EMInterpretWrmsr() or by EMInterpretInstruction(). */
+    return rc;
+}
+
+
+/**
  * \#VMEXIT handler for MSR read and writes (SVM_EXIT_MSR). Conditional
  * \#VMEXIT.
@@ -6817 +6869 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx,   CPUMCTX_EXTRN_CR0
-                                            | CPUMCTX_EXTRN_RFLAGS
-                                            | CPUMCTX_EXTRN_SS
-                                            | CPUMCTX_EXTRN_ALL_MSRS);
 
     PSVMVMCB pVmcb = hmR0SvmGetCurrentVmcb(pVCpu, pCtx);
-    PVM      pVM   = pVCpu->CTX_SUFF(pVM);
-
-    int rc;
-    if (pVmcb->ctrl.u64ExitInfo1 == SVM_EXIT1_MSR_WRITE)
-    {
-        STAM_COUNTER_INC(&pVCpu->hm.s.StatExitWrmsr);
-        Log4(("MSR Write: idMsr=%#RX32\n", pCtx->ecx));
-
-        /* Handle TPR patching; intercepted LSTAR write. */
-        if (   pVM->hm.s.fTPRPatchingActive
-            && pCtx->ecx == MSR_K8_LSTAR)
-        {
-            if ((pCtx->eax & 0xff) != pSvmTransient->u8GuestTpr)
-            {
-                /* Our patch code uses LSTAR for TPR caching for 32-bit guests. */
-                int rc2 = APICSetTpr(pVCpu, pCtx->eax & 0xff);
-                AssertRC(rc2);
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
-            }
-            rc = VINF_SUCCESS;
-            hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
-            HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
-            return rc;
-        }
-
-        bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
-        if (fSupportsNextRipSave)
-        {
-            rc = EMInterpretWrmsr(pVM, pVCpu, CPUMCTX2CORE(pCtx));
-            if (RT_LIKELY(rc == VINF_SUCCESS))
-            {
-                pCtx->rip = pVmcb->ctrl.u64NextRIP;
-                HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
-            }
-            else
-                AssertMsg(   rc == VERR_EM_INTERPRETER
-                          || rc == VINF_CPUM_R3_MSR_WRITE, ("hmR0SvmExitMsr: EMInterpretWrmsr failed rc=%Rrc\n", rc));
-        }
-        else
-        {
-            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
-            rc = VBOXSTRICTRC_TODO(EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0 /* pvFault */));
-            if (RT_LIKELY(rc == VINF_SUCCESS))
-                HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);     /* RIP updated by EMInterpretInstruction(). */
-            else
-                AssertMsg(   rc == VERR_EM_INTERPRETER
-                          || rc == VINF_CPUM_R3_MSR_WRITE, ("hmR0SvmExitMsr: WrMsr. EMInterpretInstruction failed rc=%Rrc\n", rc));
-        }
-
-        if (rc == VINF_SUCCESS)
-        {
-            /* If this is an X2APIC WRMSR access, update the APIC state as well. */
-            if (   pCtx->ecx >= MSR_IA32_X2APIC_START
-                && pCtx->ecx <= MSR_IA32_X2APIC_END)
-            {
-                /*
-                 * We've already saved the APIC related guest-state (TPR) in hmR0SvmPostRunGuest(). When full APIC register
-                 * virtualization is implemented we'll have to make sure APIC state is saved from the VMCB before
-                 * EMInterpretWrmsr() changes it.
-                 */
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
-            }
-            else
-            {
-                switch (pCtx->ecx)
-                {
-                    case MSR_K6_EFER:           HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_EFER_MSR);         break;
-                    case MSR_IA32_TSC:          pSvmTransient->fUpdateTscOffsetting = true;             break;
-                    case MSR_K8_FS_BASE:
-                    case MSR_K8_GS_BASE:        HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_SEGMENT_REGS);     break;
-                    case MSR_IA32_SYSENTER_CS:  HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_SYSENTER_CS_MSR);  break;
-                    case MSR_IA32_SYSENTER_EIP: HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_SYSENTER_EIP_MSR); break;
-                    case MSR_IA32_SYSENTER_ESP: HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_SYSENTER_ESP_MSR); break;
-                }
-            }
-        }
-    }
-    else
-    {
-        /* MSR Read access. */
-        STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdmsr);
-        Assert(pVmcb->ctrl.u64ExitInfo1 == SVM_EXIT1_MSR_READ);
-        Log4(("MSR Read: idMsr=%#RX32\n", pCtx->ecx));
-
-        bool const fSupportsNextRipSave = hmR0SvmSupportsNextRipSave(pVCpu, pCtx);
-        if (fSupportsNextRipSave)
-        {
-            rc = EMInterpretRdmsr(pVM, pVCpu, CPUMCTX2CORE(pCtx));
-            if (RT_LIKELY(rc == VINF_SUCCESS))
-            {
-                pCtx->rip = pVmcb->ctrl.u64NextRIP;
-                HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
-            }
-            else
-                AssertMsg(   rc == VERR_EM_INTERPRETER
-                          || rc == VINF_CPUM_R3_MSR_READ, ("hmR0SvmExitMsr: EMInterpretRdmsr failed rc=%Rrc\n", rc));
-        }
-        else
-        {
-            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
-            rc = VBOXSTRICTRC_TODO(EMInterpretInstruction(pVCpu, CPUMCTX2CORE(pCtx), 0));
-            if (RT_UNLIKELY(rc != VINF_SUCCESS))
-            {
-                AssertMsg(   rc == VERR_EM_INTERPRETER
-                          || rc == VINF_CPUM_R3_MSR_READ, ("hmR0SvmExitMsr: RdMsr. EMInterpretInstruction failed rc=%Rrc\n", rc));
-            }
-            /* RIP updated by EMInterpretInstruction(). */
-            HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
-        }
-    }
-
-    /* RIP has been updated by EMInterpret[Rd|Wr]msr() or EMInterpretInstruction(). */
-    return rc;
+    if (pVmcb->ctrl.u64ExitInfo1 == SVM_EXIT1_MSR_READ)
+        return hmR0SvmExitReadMsr(pVCpu, pVmcb);
+
+    Assert(pVmcb->ctrl.u64ExitInfo1 == SVM_EXIT1_MSR_WRITE);
+    return hmR0SvmExitWriteMsr(pVCpu, pVmcb, pSvmTransient);
 }
 
@@ -6945 +6885 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
 
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
@@ -7000 +6940 @@
         /* Not necessary for read accesses but whatever doesn't hurt for now, will be fixed with decode assist. */
         /** @todo CPUM should set this flag! */
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_DEBUG);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_DR_MASK);
         HMSVM_CHECK_SINGLE_STEP(pVCpu, rc);
     }
@@ -7029 +6969 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
 
     /** @todo decode assists... */
     VBOXSTRICTRC rcStrict = IEMExecOne(pVCpu);
     if (rcStrict == VINF_IEM_RAISED_XCPT)
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_XCPT_RAISED_MASK);
 
     pVCpu->hm.s.fLoadSaveGuestXcr0 = (pCtx->cr4 & X86_CR4_OSXSAVE) && pCtx->aXcr[0] != ASMGetXcr0();
-    Log4(("hmR0SvmExitXsetbv: New XCR0=%#RX64 fLoadSaveGuestXcr0=%d (cr4=%RX64) rcStrict=%Rrc\n",
-          pCtx->aXcr[0], pVCpu->hm.s.fLoadSaveGuestXcr0, pCtx->cr4, VBOXSTRICTRC_VAL(rcStrict)));
+    Log4Func(("New XCR0=%#RX64 fLoadSaveGuestXcr0=%d (cr4=%RX64) rcStrict=%Rrc\n", pCtx->aXcr[0], pVCpu->hm.s.fLoadSaveGuestXcr0,
+              pCtx->cr4, VBOXSTRICTRC_VAL(rcStrict)));
 
     HMSVM_CHECK_SINGLE_STEP(pVCpu, rcStrict);
@@ -7051 +6991 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK | CPUMCTX_EXTRN_SREG_MASK);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   IEM_CPUMCTX_EXTRN_MUST_MASK
+                                      | CPUMCTX_EXTRN_SREG_MASK);
 
     /* I/O operation lookup arrays. */
@@ -7057 +6998 @@
     static uint32_t const s_aIOOpAnd[8] = { 0, 0xff, 0xffff, 0, 0xffffffff, 0, 0, 0 };  /* AND masks for saving
                                                                                             the result (in AL/AX/EAX). */
-    Log4(("hmR0SvmExitIOInstr: CS:RIP=%04x:%#RX64\n", pCtx->cs.Sel, pCtx->rip));
+    Log4Func(("CS:RIP=%04x:%#RX64\n", pCtx->cs.Sel, pCtx->rip));
 
     PVM      pVM   = pVCpu->CTX_SUFF(pVM);
@@ -7075 +7016 @@
     }
 
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, CPUMCTX_EXTRN_RIP | CPUMCTX_EXTRN_CS | CPUMCTX_EXTRN_RFLAGS);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   CPUMCTX_EXTRN_RIP
+                                      | CPUMCTX_EXTRN_CS
+                                      | CPUMCTX_EXTRN_RFLAGS);
     VBOXSTRICTRC rcStrict;
     PCEMEXITREC pExitRec = NULL;
@@ -7097 +7040 @@
             /** @todo Huh? why can't we use the segment prefix information given by AMD-V
              *        in EXITINFO1? Investigate once this thing is up and running. */
-            Log4(("CS:RIP=%04x:%08RX64 %#06x/%u %c str\n", pCtx->cs.Sel, pCtx->rip, IoExitInfo.n.u16Port, cbValue,
-                  IoExitInfo.n.u1Type == SVM_IOIO_WRITE ? 'w' : 'r'));
+            Log4Func(("CS:RIP=%04x:%08RX64 %#06x/%u %c str\n", pCtx->cs.Sel, pCtx->rip, IoExitInfo.n.u16Port, cbValue,
+                      IoExitInfo.n.u1Type == SVM_IOIO_WRITE ? 'w' : 'r'));
             AssertReturn(pCtx->dx == IoExitInfo.n.u16Port, VERR_SVM_IPE_2);
             static IEMMODE const s_aenmAddrMode[8] =
@@ -7193 +7136 @@
             /** @todo Optimize away the DBGFBpIsHwIoArmed call by having DBGF tell the
              *  execution engines about whether hyper BPs and such are pending. */
-            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, CPUMCTX_EXTRN_DR7);
+            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_DR7);
             uint32_t const uDr7 = pCtx->dr[7];
             if (RT_UNLIKELY(   (   (uDr7 & X86_DR7_ENABLED_MASK)
@@ -7256 +7199 @@
          * Frequent exit or something needing probing.  Get state and call EMHistoryExec.
          */
-        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
         STAM_COUNTER_INC(!IoExitInfo.n.u1Str
                          ? IoExitInfo.n.u1Type == SVM_IOIO_WRITE ? &pVCpu->hm.s.StatExitIOWrite : &pVCpu->hm.s.StatExitIORead
@@ -7265 +7208 @@
 
         rcStrict = EMHistoryExec(pVCpu, pExitRec, 0);
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
 
         Log4(("IOExit/%u: %04x:%08RX64: EMHistoryExec -> %Rrc + %04x:%08RX64\n",
@@ -7281 +7224 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
     HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
 
@@ -7293 +7236 @@
                                                                thus intentionally not copied into u32ErrCode. */
 
-    Log4(("#NPF at CS:RIP=%04x:%#RX64 faultaddr=%RGp errcode=%#x \n", pCtx->cs.Sel, pCtx->rip, GCPhysFaultAddr, u32ErrCode));
+    Log4Func(("#NPF at CS:RIP=%04x:%#RX64 GCPhysFaultAddr=%RGp ErrCode=%#x \n", pCtx->cs.Sel, pCtx->rip, GCPhysFaultAddr,
+              u32ErrCode));
 
     /*
@@ -7299 +7243 @@
      */
     if (   pVM->hm.s.fTprPatchingAllowed
+        && !CPUMIsGuestInSvmNestedHwVirtMode(pCtx)
         && (GCPhysFaultAddr & PAGE_OFFSET_MASK) == XAPIC_OFF_TPR
         && (   !(u32ErrCode & X86_TRAP_PF_P)                                                             /* Not present */
@@ -7335 +7280 @@
     if ((u32ErrCode & (X86_TRAP_PF_RSVD | X86_TRAP_PF_P)) == (X86_TRAP_PF_RSVD | X86_TRAP_PF_P))
     {
-        /* If event delivery causes an MMIO #NPF, go back to instruction emulation as
-           otherwise injecting the original pending event would most likely cause the same MMIO #NPF. */
+        /*
+         * If event delivery causes an MMIO #NPF, go back to instruction emulation as otherwise
+         * injecting the original pending event would most likely cause the same MMIO #NPF.
+         */
         if (pVCpu->hm.s.Event.fPending)
             return VINF_EM_RAW_INJECT_TRPM_EVENT;
 
-        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, CPUMCTX_EXTRN_RIP | CPUMCTX_EXTRN_CS);
+        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   CPUMCTX_EXTRN_RIP
+                                          | CPUMCTX_EXTRN_CS);
         VBOXSTRICTRC rcStrict;
         PCEMEXITREC pExitRec = EMHistoryUpdateFlagsAndTypeAndPC(pVCpu,
@@ -7353 +7301 @@
             /*
              * If we succeed, resume guest execution.
-             * If we fail in interpreting the instruction because we couldn't get the guest physical address
-             * of the page containing the instruction via the guest's page tables (we would invalidate the guest page
-             * in the host TLB), resume execution which would cause a guest page fault to let the guest handle this
-             * weird case. See @bugref{6043}.
+             *
+             * If we fail in interpreting the instruction because we couldn't get the guest
+             * physical address of the page containing the instruction via the guest's page
+             * tables (we would invalidate the guest page in the host TLB), resume execution
+             * which would cause a guest page fault to let the guest handle this weird case.
+             *
+             * See @bugref{6043}.
              */
             if (   rcStrict == VINF_SUCCESS
@@ -7363 +7314 @@
             {
                 /* Successfully handled MMIO operation. */
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
                 rcStrict = VINF_SUCCESS;
             }
@@ -7373 +7324 @@
              */
             Assert(pCtx == &pVCpu->cpum.GstCtx);
-            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+            HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
             Log4(("EptMisscfgExit/%u: %04x:%08RX64: %RGp -> EMHistoryExec\n",
                   pVCpu->idCpu, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip, GCPhysFaultAddr));
 
             rcStrict = EMHistoryExec(pVCpu, pExitRec, 0);
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
 
             Log4(("EptMisscfgExit/%u: %04x:%08RX64: EMHistoryExec -> %Rrc + %04x:%08RX64\n",
@@ -7391 +7342 @@
     TRPMResetTrap(pVCpu);
 
-    Log4(("#NPF: PGMR0Trap0eHandlerNestedPaging returned %Rrc CS:RIP=%04x:%#RX64\n", rc, pCtx->cs.Sel, pCtx->rip));
+    Log4Func(("#NPF: PGMR0Trap0eHandlerNestedPaging returns %Rrc CS:RIP=%04x:%#RX64\n", rc, pCtx->cs.Sel, pCtx->rip));
 
     /*
@@ -7446 +7397 @@
         /*
          * AMD-V provides us with the exception which caused the TS; we collect
-         * the information in the call to hmR0SvmCheckExitDueToEventDelivery.
+         * the information in the call to hmR0SvmCheckExitDueToEventDelivery().
          */
-        Log4(("hmR0SvmExitTaskSwitch: TS occurred during event delivery.\n"));
+        Log4Func(("TS occurred during event delivery\n"));
         STAM_COUNTER_INC(&pVCpu->hm.s.StatExitTaskSwitch);
         return VINF_EM_RAW_INJECT_TRPM_EVENT;
@@ -7466 +7417 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
-
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitVmcall);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
 
     if (pVCpu->CTX_SUFF(pVM)->hm.s.fTprPatchingAllowed)
@@ -7475 +7424 @@
         if (rc != VERR_NOT_FOUND)
         {
-            Log4(("hmR0SvmExitVmmCall: hmSvmEmulateMovTpr returns %Rrc\n", rc));
+            Log4Func(("hmSvmEmulateMovTpr returns %Rrc\n", rc));
             return rc;
         }
@@ -7493 +7442 @@
         }
         else
-            Log4(("hmR0SvmExitVmmCall: GIMHypercall returns %Rrc -> #UD\n", VBOXSTRICTRC_VAL(rcStrict)));
+            Log4Func(("GIMHypercall returns %Rrc -> #UD\n", VBOXSTRICTRC_VAL(rcStrict)));
     }
 
@@ -7507 +7456 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPause);
     hmR0SvmAdvanceRipHwAssist(pVCpu, pCtx, 2);
     /** @todo The guest has likely hit a contended spinlock. We might want to
@@ -7522 +7470 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, CPUMCTX_EXTRN_CR0);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, CPUMCTX_EXTRN_CR0);
     Assert(!(pCtx->cr0 & X86_CR0_NE));
 
-    Log4(("hmR0SvmExitFerrFreeze: Raising IRQ 13 in response to #FERR\n"));
+    Log4Func(("Raising IRQ 13 in response to #FERR\n"));
     return PDMIsaSetIrq(pVCpu->CTX_SUFF(pVM), 13 /* u8Irq */, 1 /* u8Level */, 0 /* uTagSrc */);
 }
@@ -7557 +7505 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
     HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
 
@@ -7575 +7523 @@
             /* A genuine guest #PF, reflect it to the guest. */
             hmR0SvmSetPendingXcptPF(pVCpu, pCtx, uErrCode, uFaultAddress);
-            Log4(("#PF: Guest page fault at %04X:%RGv FaultAddr=%RX64 ErrCode=%#x\n", pCtx->cs.Sel, (RTGCPTR)pCtx->rip,
-                  uFaultAddress, uErrCode));
+            Log4Func(("#PF: Guest page fault at %04X:%RGv FaultAddr=%RX64 ErrCode=%#x\n", pCtx->cs.Sel, (RTGCPTR)pCtx->rip,
+                      uFaultAddress, uErrCode));
         }
         else
@@ -7582 +7530 @@
             /* A guest page-fault occurred during delivery of a page-fault. Inject #DF. */
             hmR0SvmSetPendingXcptDF(pVCpu);
-            Log4(("Pending #DF due to vectoring #PF. NP\n"));
+            Log4Func(("Pending #DF due to vectoring #PF. NP\n"));
         }
         STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
@@ -7619 +7567 @@
     }
 
-    Log4(("#PF: uFaultAddress=%#RX64 CS:RIP=%#04x:%#RX64 uErrCode %#RX32 cr3=%#RX64\n", uFaultAddress, pCtx->cs.Sel,
-          pCtx->rip, uErrCode, pCtx->cr3));
-
-    /* If it's a vectoring #PF, emulate injecting the original event injection as PGMTrap0eHandler() is incapable
-       of differentiating between instruction emulation and event injection that caused a #PF. See @bugref{6607}. */
+    Log4Func(("#PF: uFaultAddress=%#RX64 CS:RIP=%#04x:%#RX64 uErrCode %#RX32 cr3=%#RX64\n", uFaultAddress, pCtx->cs.Sel,
+              pCtx->rip, uErrCode, pCtx->cr3));
+
+    /*
+     * If it's a vectoring #PF, emulate injecting the original event injection as
+     * PGMTrap0eHandler() is incapable of differentiating between instruction emulation and
+     * event injection that caused a #PF. See @bugref{6607}.
+     */
     if (pSvmTransient->fVectoringPF)
     {
@@ -7633 +7584 @@
     int rc = PGMTrap0eHandler(pVCpu, uErrCode, CPUMCTX2CORE(pCtx), (RTGCPTR)uFaultAddress);
 
-    Log4(("#PF: rc=%Rrc\n", rc));
+    Log4Func(("#PF: rc=%Rrc\n", rc));
 
     if (rc == VINF_SUCCESS)
@@ -7640 +7591 @@
         TRPMResetTrap(pVCpu);
         STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPF);
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
         return rc;
     }
@@ -7674 +7625 @@
             TRPMResetTrap(pVCpu);
             hmR0SvmSetPendingXcptDF(pVCpu);
-            Log4(("#PF: Pending #DF due to vectoring #PF\n"));
+            Log4Func(("#PF: Pending #DF due to vectoring #PF\n"));
         }
 
@@ -7703 +7654 @@
     if (pVCpu->hm.s.fGIMTrapXcptUD)
     {
-        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+        HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
         uint8_t cbInstr = 0;
         VBOXSTRICTRC rcStrict = GIMXcptUD(pVCpu, pCtx, NULL /* pDis */, &cbInstr);
@@ -7740 +7691 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
 
     /* Paranoia; Ensure we cannot be called as a result of event delivery. */
@@ -7762 +7713 @@
         }
         else
-            Log4(("hmR0SvmExitXcptMF: EMInterpretDisasCurrent returned %Rrc uOpCode=%#x\n", rc, pDis->pCurInstr->uOpcode));
+            Log4Func(("EMInterpretDisasCurrent returned %Rrc uOpCode=%#x\n", rc, pDis->pCurInstr->uOpcode));
         return rc;
     }
@@ -7778 +7729 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
     HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
 
@@ -7789 +7740 @@
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDB);
 
-    /* This can be a fault-type #DB (instruction breakpoint) or a trap-type #DB (data breakpoint). However, for both cases
-       DR6 and DR7 are updated to what the exception handler expects. See AMD spec. 15.12.2 "#DB (Debug)". */
+    /*
+     * This can be a fault-type #DB (instruction breakpoint) or a trap-type #DB (data
+     * breakpoint). However, for both cases DR6 and DR7 are updated to what the exception
+     * handler expects. See AMD spec. 15.12.2 "#DB (Debug)".
+     */
     PVM      pVM   = pVCpu->CTX_SUFF(pVM);
     PSVMVMCB pVmcb = pVCpu->hm.s.svm.pVmcb;
@@ -7851 +7805 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, HMSVM_CPUMCTX_EXTRN_ALL);
     HMSVM_CHECK_EXIT_DUE_TO_EVENT_DELIVERY();
 
@@ -7884 +7838 @@
     Assert(pSvmTransient->u64ExitCode == pVmcb->ctrl.u64ExitCode);
     Assert(uVector <= X86_XCPT_LAST);
-    Log4(("hmR0SvmExitXcptGeneric: uVector=%#x uErrCode=%u\n", uVector, uErrCode));
+    Log4Func(("uVector=%#x uErrCode=%u\n", uVector, uErrCode));
 
     SVMEVENT Event;
@@ -7920 +7874 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx,   IEM_CPUMCTX_EXTRN_MUST_MASK
-                                            | CPUMCTX_EXTRN_HWVIRT);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   IEM_CPUMCTX_EXTRN_MUST_MASK
+                                      | CPUMCTX_EXTRN_HWVIRT);
 
 #ifdef VBOX_STRICT
@@ -7930 +7884 @@
 #endif
 
-    /** @todo Stat. */
-    /* STAM_COUNTER_INC(&pVCpu->hm.s.StatExitClgi); */
     uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
     VBOXSTRICTRC rcStrict = IEMExecDecodedClgi(pVCpu, cbInstr);
+    if (rcStrict == VINF_SUCCESS)
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_HWVIRT);
     return VBOXSTRICTRC_VAL(rcStrict);
 }
@@ -7944 +7898 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx,   IEM_CPUMCTX_EXTRN_MUST_MASK
-                                            | CPUMCTX_EXTRN_HWVIRT);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   IEM_CPUMCTX_EXTRN_MUST_MASK
+                                      | CPUMCTX_EXTRN_HWVIRT);
 
     /*
@@ -7957 +7911 @@
     uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
     VBOXSTRICTRC rcStrict = IEMExecDecodedStgi(pVCpu, cbInstr);
+    if (rcStrict == VINF_SUCCESS)
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_HWVIRT);
     return VBOXSTRICTRC_VAL(rcStrict);
 }
@@ -7967 +7923 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx,   IEM_CPUMCTX_EXTRN_MUST_MASK
-                                            | CPUMCTX_EXTRN_FS
-                                            | CPUMCTX_EXTRN_GS
-                                            | CPUMCTX_EXTRN_TR
-                                            | CPUMCTX_EXTRN_LDTR
-                                            | CPUMCTX_EXTRN_KERNEL_GS_BASE
-                                            | CPUMCTX_EXTRN_SYSCALL_MSRS
-                                            | CPUMCTX_EXTRN_SYSENTER_MSRS);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   IEM_CPUMCTX_EXTRN_MUST_MASK
+                                      | CPUMCTX_EXTRN_FS
+                                      | CPUMCTX_EXTRN_GS
+                                      | CPUMCTX_EXTRN_TR
+                                      | CPUMCTX_EXTRN_LDTR
+                                      | CPUMCTX_EXTRN_KERNEL_GS_BASE
+                                      | CPUMCTX_EXTRN_SYSCALL_MSRS
+                                      | CPUMCTX_EXTRN_SYSENTER_MSRS);
 
 #ifdef VBOX_STRICT
@@ -7988 +7944 @@
     {
         /* We skip flagging changes made to LSTAR, STAR, SFMASK and other MSRs as they are always re-loaded. */
-        HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_SEGMENT_REGS
-                            | HM_CHANGED_GUEST_TR
-                            | HM_CHANGED_GUEST_LDTR
-                            | HM_CHANGED_GUEST_SYSENTER_CS_MSR
-                            | HM_CHANGED_GUEST_SYSENTER_EIP_MSR
-                            | HM_CHANGED_GUEST_SYSENTER_ESP_MSR);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_FS
+                                                   | HM_CHANGED_GUEST_GS
+                                                   | HM_CHANGED_GUEST_TR
+                                                   | HM_CHANGED_GUEST_LDTR
+                                                   | HM_CHANGED_GUEST_SYSENTER_CS_MSR
+                                                   | HM_CHANGED_GUEST_SYSENTER_EIP_MSR
+                                                   | HM_CHANGED_GUEST_SYSENTER_ESP_MSR);
     }
     return VBOXSTRICTRC_VAL(rcStrict);
@@ -8005 +7962 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
 
 #ifdef VBOX_STRICT
@@ -8026 +7983 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, IEM_CPUMCTX_EXTRN_MUST_MASK);
-
-    /** @todo Stat. */
-    /* STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvlpga); */
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
+
     uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
     VBOXSTRICTRC rcStrict = IEMExecDecodedInvlpga(pVCpu, cbInstr);
@@ -8042 +7997 @@
 {
     HMSVM_VALIDATE_EXIT_HANDLER_PARAMS();
-    /** @todo Only save and reload what VMRUN changes (e.g. skip LDTR, TR etc). */
-    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu, pCtx, HMSVM_CPUMCTX_EXTRN_ALL);
-
+    HMSVM_CPUMCTX_IMPORT_STATE(pVCpu,   IEM_CPUMCTX_EXTRN_MUST_MASK
+                                      | IEM_CPUMCTX_EXTRN_SVM_VMRUN_MASK);
     VBOXSTRICTRC rcStrict;
     uint8_t const cbInstr = hmR0SvmGetInstrLengthHwAssist(pVCpu, pCtx, 3);
     rcStrict = IEMExecDecodedVmrun(pVCpu, cbInstr);
-    Log4(("IEMExecDecodedVmrun: returned %d\n", VBOXSTRICTRC_VAL(rcStrict)));
+    Log4Func(("IEMExecDecodedVmrun returns %Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
     if (rcStrict == VINF_SUCCESS)
     {
         rcStrict = VINF_SVM_VMRUN;
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_SVM_VMRUN_MASK);
     }
     return VBOXSTRICTRC_VAL(rcStrict);

trunk/src/VBox/VMM/VMMR0/HMSVMR0.h

@@ -49 +49 @@
 VMMR0DECL(int)          SVMR0SetupVM(PVM pVM);
 VMMR0DECL(VBOXSTRICTRC) SVMR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
-VMMR0DECL(int)          SVMR0SaveHostState(PVM pVM, PVMCPU pVCpu);
-VMMR0DECL(int)          SVMR0ImportStateOnDemand(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t fWhat);
+VMMR0DECL(int)          SVMR0ExportHostState(PVMCPU pVCpu);
+VMMR0DECL(int)          SVMR0ImportStateOnDemand(PVMCPU pVCpu, uint64_t fWhat);
 VMMR0DECL(int)          SVMR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt);
 
 #if HC_ARCH_BITS == 32 && defined(VBOX_WITH_64_BITS_GUESTS)
 DECLASM(int)            SVMR0VMSwitcherRun64(RTHCPHYS pVMCBHostPhys, RTHCPHYS pVMCBPhys, PCPUMCTX pCtx, PVM pVM, PVMCPU pVCpu);
-VMMR0DECL(int)          SVMR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, HM64ON32OP enmOp, uint32_t cbParam,
-                                                  uint32_t *paParam);
+VMMR0DECL(int)          SVMR0Execute64BitsHandler(PVMCPU pVCpu, HM64ON32OP enmOp, uint32_t cbParam, uint32_t *paParam);
 #endif /* HC_ARCH_BITS == 32 && defined(VBOX_WITH_64_BITS_GUESTS) */
 

trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp

@@ -42 +42 @@
 #include "dtrace/VBoxVMM.h"
 
-#define HMVMX_USE_IEM_EVENT_REFLECTION
 #ifdef DEBUG_ramshankar
 # define HMVMX_ALWAYS_SAVE_GUEST_RFLAGS
@@ -67 +66 @@
 #define HMVMX_FLUSH_TAGGED_TLB_NONE               3
 
-/** @name Updated-guest-state flags.
- * @{ */
-#define HMVMX_UPDATED_GUEST_RIP                   RT_BIT(0)
-#define HMVMX_UPDATED_GUEST_RSP                   RT_BIT(1)
-#define HMVMX_UPDATED_GUEST_RFLAGS                RT_BIT(2)
-#define HMVMX_UPDATED_GUEST_CR0                   RT_BIT(3)
-#define HMVMX_UPDATED_GUEST_CR3                   RT_BIT(4)
-#define HMVMX_UPDATED_GUEST_CR4                   RT_BIT(5)
-#define HMVMX_UPDATED_GUEST_GDTR                  RT_BIT(6)
-#define HMVMX_UPDATED_GUEST_IDTR                  RT_BIT(7)
-#define HMVMX_UPDATED_GUEST_LDTR                  RT_BIT(8)
-#define HMVMX_UPDATED_GUEST_TR                    RT_BIT(9)
-#define HMVMX_UPDATED_GUEST_SEGMENT_REGS          RT_BIT(10)
-#define HMVMX_UPDATED_GUEST_DR7                   RT_BIT(11)
-#define HMVMX_UPDATED_GUEST_SYSENTER_CS_MSR       RT_BIT(12)
-#define HMVMX_UPDATED_GUEST_SYSENTER_EIP_MSR      RT_BIT(13)
-#define HMVMX_UPDATED_GUEST_SYSENTER_ESP_MSR      RT_BIT(14)
-#define HMVMX_UPDATED_GUEST_AUTO_LOAD_STORE_MSRS  RT_BIT(15)
-#define HMVMX_UPDATED_GUEST_LAZY_MSRS             RT_BIT(16)
-#define HMVMX_UPDATED_GUEST_ACTIVITY_STATE        RT_BIT(17)
-#define HMVMX_UPDATED_GUEST_INTR_STATE            RT_BIT(18)
-#define HMVMX_UPDATED_GUEST_APIC_STATE            RT_BIT(19)
-#define HMVMX_UPDATED_GUEST_ALL                   (  HMVMX_UPDATED_GUEST_RIP                   \
-                                                   | HMVMX_UPDATED_GUEST_RSP                   \
-                                                   | HMVMX_UPDATED_GUEST_RFLAGS                \
-                                                   | HMVMX_UPDATED_GUEST_CR0                   \
-                                                   | HMVMX_UPDATED_GUEST_CR3                   \
-                                                   | HMVMX_UPDATED_GUEST_CR4                   \
-                                                   | HMVMX_UPDATED_GUEST_GDTR                  \
-                                                   | HMVMX_UPDATED_GUEST_IDTR                  \
-                                                   | HMVMX_UPDATED_GUEST_LDTR                  \
-                                                   | HMVMX_UPDATED_GUEST_TR                    \
-                                                   | HMVMX_UPDATED_GUEST_SEGMENT_REGS          \
-                                                   | HMVMX_UPDATED_GUEST_DR7                   \
-                                                   | HMVMX_UPDATED_GUEST_SYSENTER_CS_MSR       \
-                                                   | HMVMX_UPDATED_GUEST_SYSENTER_EIP_MSR      \
-                                                   | HMVMX_UPDATED_GUEST_SYSENTER_ESP_MSR      \
-                                                   | HMVMX_UPDATED_GUEST_AUTO_LOAD_STORE_MSRS  \
-                                                   | HMVMX_UPDATED_GUEST_LAZY_MSRS             \
-                                                   | HMVMX_UPDATED_GUEST_ACTIVITY_STATE        \
-                                                   | HMVMX_UPDATED_GUEST_INTR_STATE            \
-                                                   | HMVMX_UPDATED_GUEST_APIC_STATE)
+/** @name HMVMX_READ_XXX
+ * Flags to skip redundant reads of some common VMCS fields that are not part of
+ * the guest-CPU or VCPU state but are needed while handling VM-exits.
+ */
+#define HMVMX_READ_IDT_VECTORING_INFO            RT_BIT_32(0)
+#define HMVMX_READ_IDT_VECTORING_ERROR_CODE      RT_BIT_32(1)
+#define HMVMX_READ_EXIT_QUALIFICATION            RT_BIT_32(2)
+#define HMVMX_READ_EXIT_INSTR_LEN                RT_BIT_32(3)
+#define HMVMX_READ_EXIT_INTERRUPTION_INFO        RT_BIT_32(4)
+#define HMVMX_READ_EXIT_INTERRUPTION_ERROR_CODE  RT_BIT_32(5)
+#define HMVMX_READ_EXIT_INSTR_INFO               RT_BIT_32(6)
 /** @} */
 
-/** @name
- * Flags to skip redundant reads of some common VMCS fields that are not part of
- * the guest-CPU state but are in the transient structure.
- */
-#define HMVMX_UPDATED_TRANSIENT_IDT_VECTORING_INFO            RT_BIT(0)
-#define HMVMX_UPDATED_TRANSIENT_IDT_VECTORING_ERROR_CODE      RT_BIT(1)
-#define HMVMX_UPDATED_TRANSIENT_EXIT_QUALIFICATION            RT_BIT(2)
-#define HMVMX_UPDATED_TRANSIENT_EXIT_INSTR_LEN                RT_BIT(3)
-#define HMVMX_UPDATED_TRANSIENT_EXIT_INTERRUPTION_INFO        RT_BIT(4)
-#define HMVMX_UPDATED_TRANSIENT_EXIT_INTERRUPTION_ERROR_CODE  RT_BIT(5)
-#define HMVMX_UPDATED_TRANSIENT_EXIT_INSTR_INFO               RT_BIT(6)
-/** @} */
-
-/** @name
+/**
  * States of the VMCS.
  *
@@ -131 +86 @@
  * are used. Maybe later this can be extended (i.e. Nested Virtualization).
  */
-#define HMVMX_VMCS_STATE_CLEAR                              RT_BIT(0)
-#define HMVMX_VMCS_STATE_ACTIVE                             RT_BIT(1)
-#define HMVMX_VMCS_STATE_LAUNCHED                           RT_BIT(2)
-/** @} */
+#define HMVMX_VMCS_STATE_CLEAR                   RT_BIT(0)
+#define HMVMX_VMCS_STATE_ACTIVE                  RT_BIT(1)
+#define HMVMX_VMCS_STATE_LAUNCHED                RT_BIT(2)
 
 /**
@@ -144 +98 @@
  * MSR which cannot be modified by the guest without causing a VM-exit.
  */
-#define HMVMX_CPUMCTX_EXTRN_ALL                             (  CPUMCTX_EXTRN_RIP            \
-                                                             | CPUMCTX_EXTRN_RFLAGS         \
-                                                             | CPUMCTX_EXTRN_SREG_MASK      \
-                                                             | CPUMCTX_EXTRN_TABLE_MASK     \
-                                                             | CPUMCTX_EXTRN_SYSENTER_MSRS  \
-                                                             | CPUMCTX_EXTRN_SYSCALL_MSRS   \
-                                                             | CPUMCTX_EXTRN_KERNEL_GS_BASE \
-                                                             | CPUMCTX_EXTRN_TSC_AUX        \
-                                                             | CPUMCTX_EXTRN_OTHER_MSRS     \
-                                                             | CPUMCTX_EXTRN_CR0            \
-                                                             | CPUMCTX_EXTRN_CR3            \
-                                                             | CPUMCTX_EXTRN_CR4            \
-                                                             | CPUMCTX_EXTRN_DR7)
+#define HMVMX_CPUMCTX_EXTRN_ALL                  (  CPUMCTX_EXTRN_RIP             \
+                                                  | CPUMCTX_EXTRN_RFLAGS          \
+                                                  | CPUMCTX_EXTRN_RSP             \
+                                                  | CPUMCTX_EXTRN_SREG_MASK       \
+                                                  | CPUMCTX_EXTRN_TABLE_MASK      \
+                                                  |  CPUMCTX_EXTRN_KERNEL_GS_BASE \
+                                                  | CPUMCTX_EXTRN_SYSCALL_MSRS    \
+                                                  | CPUMCTX_EXTRN_SYSENTER_MSRS   \
+                                                  | CPUMCTX_EXTRN_TSC_AUX         \
+                                                  | CPUMCTX_EXTRN_OTHER_MSRS      \
+                                                  | CPUMCTX_EXTRN_CR0             \
+                                                  | CPUMCTX_EXTRN_CR3             \
+                                                  | CPUMCTX_EXTRN_CR4             \
+                                                  | CPUMCTX_EXTRN_DR7             \
+                                                  | CPUMCTX_EXTRN_HM_VMX_MASK)
 
 /**
@@ -217 +173 @@
  *  context. */
 #ifdef VMX_USE_CACHED_VMCS_ACCESSES
-# define HMVMX_SAVE_SREG(Sel, a_pCtxSelReg) \
-    hmR0VmxSaveSegmentReg(pVCpu, VMX_VMCS16_GUEST_##Sel##_SEL, VMX_VMCS32_GUEST_##Sel##_LIMIT, \
-                          VMX_VMCS_GUEST_##Sel##_BASE_CACHE_IDX, VMX_VMCS32_GUEST_##Sel##_ACCESS_RIGHTS, (a_pCtxSelReg))
+# define HMVMX_IMPORT_SREG(Sel, a_pCtxSelReg) \
+    hmR0VmxImportGuestSegmentReg(pVCpu, VMX_VMCS16_GUEST_##Sel##_SEL, VMX_VMCS32_GUEST_##Sel##_LIMIT, \
+                                 VMX_VMCS_GUEST_##Sel##_BASE_CACHE_IDX, VMX_VMCS32_GUEST_##Sel##_ACCESS_RIGHTS, (a_pCtxSelReg))
 #else
-# define HMVMX_SAVE_SREG(Sel, a_pCtxSelReg) \
-    hmR0VmxSaveSegmentReg(pVCpu, VMX_VMCS16_GUEST_##Sel##_SEL, VMX_VMCS32_GUEST_##Sel##_LIMIT, \
-                          VMX_VMCS_GUEST_##Sel##_BASE, VMX_VMCS32_GUEST_##Sel##_ACCESS_RIGHTS, (a_pCtxSelReg))
+# define HMVMX_IMPORT_SREG(Sel, a_pCtxSelReg) \
+    hmR0VmxImportGuestSegmentReg(pVCpu, VMX_VMCS16_GUEST_##Sel##_SEL, VMX_VMCS32_GUEST_##Sel##_LIMIT, \
+                                 VMX_VMCS_GUEST_##Sel##_BASE, VMX_VMCS32_GUEST_##Sel##_ACCESS_RIGHTS, (a_pCtxSelReg))
 #endif
 
@@ -318 +274 @@
     uint32_t        uIdtVectoringErrorCode;
 
-    /** Mask of currently read VMCS fields; HMVMX_UPDATED_TRANSIENT_*. */
+    /** Mask of currently read VMCS fields; HMVMX_READ_XXX. */
     uint32_t        fVmcsFieldsRead;
 
@@ -417 +373 @@
 static void               hmR0VmxFlushVpid(PVM pVM, PVMCPU pVCpu, VMXFLUSHVPID enmFlush, RTGCPTR GCPtr);
 static void               hmR0VmxClearIntNmiWindowsVmcs(PVMCPU pVCpu);
-static VBOXSTRICTRC       hmR0VmxInjectEventVmcs(PVMCPU pVCpu, PCPUMCTX pMixedCtx, uint64_t u64IntInfo, uint32_t cbInstr,
-                                                 uint32_t u32ErrCode, RTGCUINTREG GCPtrFaultAddress,
-                                                 bool fStepping, uint32_t *puIntState);
+static int                hmR0VmxImportGuestState(PVMCPU pVCpu, uint64_t fWhat);
+static VBOXSTRICTRC       hmR0VmxInjectEventVmcs(PVMCPU pVCpu, uint64_t u64IntInfo, uint32_t cbInstr, uint32_t u32ErrCode,
+                                                 RTGCUINTREG GCPtrFaultAddress, bool fStepping, uint32_t *pfIntrState);
 #if HC_ARCH_BITS == 32
 static int                hmR0VmxInitVmcsReadCache(PVM pVM, PVMCPU pVCpu);
@@ -649 +605 @@
 }
 
-
 #ifdef VBOX_STRICT
 /**
@@ -666 +621 @@
     return VINF_SUCCESS;
 }
-#endif /* VBOX_STRICT */
-
-
-#ifdef VBOX_STRICT
+
+
 /**
  * Reads the VM-entry exception error code field from the VMCS into
@@ -697 +650 @@
 DECLINLINE(int) hmR0VmxReadExitIntInfoVmcs(PVMXTRANSIENT pVmxTransient)
 {
-    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_UPDATED_TRANSIENT_EXIT_INTERRUPTION_INFO))
+    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_READ_EXIT_INTERRUPTION_INFO))
     {
         int rc = VMXReadVmcs32(VMX_VMCS32_RO_EXIT_INTERRUPTION_INFO, &pVmxTransient->uExitIntInfo);
-        AssertRCReturn(rc, rc);
-        pVmxTransient->fVmcsFieldsRead |= HMVMX_UPDATED_TRANSIENT_EXIT_INTERRUPTION_INFO;
+        AssertRCReturn(rc,rc);
+        pVmxTransient->fVmcsFieldsRead |= HMVMX_READ_EXIT_INTERRUPTION_INFO;
     }
     return VINF_SUCCESS;
@@ -716 +669 @@
 DECLINLINE(int) hmR0VmxReadExitIntErrorCodeVmcs(PVMXTRANSIENT pVmxTransient)
 {
-    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_UPDATED_TRANSIENT_EXIT_INTERRUPTION_ERROR_CODE))
+    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_READ_EXIT_INTERRUPTION_ERROR_CODE))
     {
         int rc = VMXReadVmcs32(VMX_VMCS32_RO_EXIT_INTERRUPTION_ERROR_CODE, &pVmxTransient->uExitIntErrorCode);
         AssertRCReturn(rc, rc);
-        pVmxTransient->fVmcsFieldsRead |= HMVMX_UPDATED_TRANSIENT_EXIT_INTERRUPTION_ERROR_CODE;
+        pVmxTransient->fVmcsFieldsRead |= HMVMX_READ_EXIT_INTERRUPTION_ERROR_CODE;
     }
     return VINF_SUCCESS;
@@ -735 +688 @@
 DECLINLINE(int) hmR0VmxReadExitInstrLenVmcs(PVMXTRANSIENT pVmxTransient)
 {
-    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_UPDATED_TRANSIENT_EXIT_INSTR_LEN))
+    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_READ_EXIT_INSTR_LEN))
     {
         int rc = VMXReadVmcs32(VMX_VMCS32_RO_EXIT_INSTR_LENGTH, &pVmxTransient->cbInstr);
         AssertRCReturn(rc, rc);
-        pVmxTransient->fVmcsFieldsRead |= HMVMX_UPDATED_TRANSIENT_EXIT_INSTR_LEN;
+        pVmxTransient->fVmcsFieldsRead |= HMVMX_READ_EXIT_INSTR_LEN;
     }
     return VINF_SUCCESS;
@@ -754 +707 @@
 DECLINLINE(int) hmR0VmxReadExitInstrInfoVmcs(PVMXTRANSIENT pVmxTransient)
 {
-    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_UPDATED_TRANSIENT_EXIT_INSTR_INFO))
+    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_READ_EXIT_INSTR_INFO))
     {
         int rc = VMXReadVmcs32(VMX_VMCS32_RO_EXIT_INSTR_INFO, &pVmxTransient->ExitInstrInfo.u);
         AssertRCReturn(rc, rc);
-        pVmxTransient->fVmcsFieldsRead |= HMVMX_UPDATED_TRANSIENT_EXIT_INSTR_INFO;
+        pVmxTransient->fVmcsFieldsRead |= HMVMX_READ_EXIT_INSTR_INFO;
     }
     return VINF_SUCCESS;
@@ -775 +728 @@
 DECLINLINE(int) hmR0VmxReadExitQualificationVmcs(PVMCPU pVCpu, PVMXTRANSIENT pVmxTransient)
 {
-    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_UPDATED_TRANSIENT_EXIT_QUALIFICATION))
+    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_READ_EXIT_QUALIFICATION))
     {
         int rc = VMXReadVmcsGstN(VMX_VMCS_RO_EXIT_QUALIFICATION, &pVmxTransient->uExitQualification); NOREF(pVCpu);
         AssertRCReturn(rc, rc);
-        pVmxTransient->fVmcsFieldsRead |= HMVMX_UPDATED_TRANSIENT_EXIT_QUALIFICATION;
+        pVmxTransient->fVmcsFieldsRead |= HMVMX_READ_EXIT_QUALIFICATION;
     }
     return VINF_SUCCESS;
@@ -796 +749 @@
 DECLINLINE(int) hmR0VmxReadIdtVectoringInfoVmcs(PVMXTRANSIENT pVmxTransient)
 {
-    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_UPDATED_TRANSIENT_IDT_VECTORING_INFO))
-    {
-        int rc = VMXReadVmcs32(VMX_VMCS32_RO_IDT_INFO, &pVmxTransient->uIdtVectoringInfo);
+    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_READ_IDT_VECTORING_INFO))
+    {
+        int rc = VMXReadVmcs32(VMX_VMCS32_RO_IDT_VECTORING_INFO, &pVmxTransient->uIdtVectoringInfo);
         AssertRCReturn(rc, rc);
-        pVmxTransient->fVmcsFieldsRead |= HMVMX_UPDATED_TRANSIENT_IDT_VECTORING_INFO;
+        pVmxTransient->fVmcsFieldsRead |= HMVMX_READ_IDT_VECTORING_INFO;
     }
     return VINF_SUCCESS;
@@ -815 +768 @@
 DECLINLINE(int) hmR0VmxReadIdtVectoringErrorCodeVmcs(PVMXTRANSIENT pVmxTransient)
 {
-    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_UPDATED_TRANSIENT_IDT_VECTORING_ERROR_CODE))
-    {
-        int rc = VMXReadVmcs32(VMX_VMCS32_RO_IDT_ERROR_CODE, &pVmxTransient->uIdtVectoringErrorCode);
+    if (!(pVmxTransient->fVmcsFieldsRead & HMVMX_READ_IDT_VECTORING_ERROR_CODE))
+    {
+        int rc = VMXReadVmcs32(VMX_VMCS32_RO_IDT_VECTORING_ERROR_CODE, &pVmxTransient->uIdtVectoringErrorCode);
         AssertRCReturn(rc, rc);
-        pVmxTransient->fVmcsFieldsRead |= HMVMX_UPDATED_TRANSIENT_IDT_VECTORING_ERROR_CODE;
+        pVmxTransient->fVmcsFieldsRead |= HMVMX_READ_IDT_VECTORING_ERROR_CODE;
     }
     return VINF_SUCCESS;
@@ -913 +866 @@
  *                          allocation.
  */
-DECLINLINE(int) hmR0VmxPageAllocZ(PRTR0MEMOBJ pMemObj, PRTR0PTR ppVirt, PRTHCPHYS pHCPhys)
+static int hmR0VmxPageAllocZ(PRTR0MEMOBJ pMemObj, PRTR0PTR ppVirt, PRTHCPHYS pHCPhys)
 {
     AssertPtrReturn(pMemObj, VERR_INVALID_PARAMETER);
@@ -938 +891 @@
  *                          allocation as 0.
  */
-DECLINLINE(void) hmR0VmxPageFree(PRTR0MEMOBJ pMemObj, PRTR0PTR ppVirt, PRTHCPHYS pHCPhys)
+static void hmR0VmxPageFree(PRTR0MEMOBJ pMemObj, PRTR0PTR ppVirt, PRTHCPHYS pHCPhys)
 {
     AssertPtr(pMemObj);
@@ -1163 +1116 @@
 
     /*
-     * Flush all EPT tagged-TLB entries (in case VirtualBox or any other hypervisor have been using EPTPs) so
-     * we don't retain any stale guest-physical mappings which won't get invalidated when flushing by VPID.
+     * Flush all EPT tagged-TLB entries (in case VirtualBox or any other hypervisor have been
+     * using EPTPs) so we don't retain any stale guest-physical mappings which won't get
+     * invalidated when flushing by VPID.
      */
     PVMXMSRS pMsrs = (PVMXMSRS)pvMsrs;
@@ -1303 +1257 @@
  * @param   cMsrs       The number of MSRs.
  */
-DECLINLINE(int) hmR0VmxSetAutoLoadStoreMsrCount(PVMCPU pVCpu, uint32_t cMsrs)
+static int hmR0VmxSetAutoLoadStoreMsrCount(PVMCPU pVCpu, uint32_t cMsrs)
 {
     /* Shouldn't ever happen but there -is- a number. We're well within the recommended 512. */
@@ -1382 +1336 @@
      * Update the host MSR only when requested by the caller AND when we're
      * adding it to the auto-load/store area. Otherwise, it would have been
-     * updated by hmR0VmxSaveHostMsrs(). We do this for performance reasons.
+     * updated by hmR0VmxExportHostMsrs(). We do this for performance reasons.
      */
     bool fUpdatedMsrValue = false;
@@ -1451 +1405 @@
             hmR0VmxSetMsrPermission(pVCpu, uMsr, VMXMSREXIT_INTERCEPT_READ, VMXMSREXIT_INTERCEPT_WRITE);
 
-        Log4(("Removed MSR %#RX32 new cMsrs=%u\n", uMsr, pVCpu->hm.s.vmx.cMsrs));
+        Log4Func(("Removed MSR %#RX32 new cMsrs=%u\n", uMsr, pVCpu->hm.s.vmx.cMsrs));
         return VINF_SUCCESS;
     }
@@ -1572 +1526 @@
 #endif
     return false;
-}
-
-
-/**
- * Saves a set of guest MSRs back into the guest-CPU context.
- *
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data may be
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static void hmR0VmxLazySaveGuestMsrs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
-    Assert(!VMMRZCallRing3IsEnabled(pVCpu));
-
-    if (pVCpu->hm.s.vmx.fLazyMsrs & VMX_LAZY_MSRS_LOADED_GUEST)
-    {
-        Assert(pVCpu->hm.s.vmx.fLazyMsrs & VMX_LAZY_MSRS_SAVED_HOST);
-#if HC_ARCH_BITS == 64
-        if (pVCpu->CTX_SUFF(pVM)->hm.s.fAllow64BitGuests)
-        {
-            pMixedCtx->msrLSTAR        = ASMRdMsr(MSR_K8_LSTAR);
-            pMixedCtx->msrSTAR         = ASMRdMsr(MSR_K6_STAR);
-            pMixedCtx->msrSFMASK       = ASMRdMsr(MSR_K8_SF_MASK);
-            pMixedCtx->msrKERNELGSBASE = ASMRdMsr(MSR_K8_KERNEL_GS_BASE);
-        }
-#else
-        NOREF(pMixedCtx);
-#endif
-    }
 }
 
@@ -1678 +1599 @@
  * @remarks No-long-jump zone!!!
  * @remarks The guest MSRs should have been saved back into the guest-CPU
- *          context by hmR0VmxSaveGuestLazyMsrs()!!!
+ *          context by hmR0VmxImportGuestState()!!!
  */
 static void hmR0VmxLazyRestoreHostMsrs(PVMCPU pVCpu)
@@ -1926 +1847 @@
     {
         /*
-         * We must invalidate the guest TLB entry in either case, we cannot ignore it even for the EPT case
-         * See @bugref{6043} and @bugref{6177}.
+         * We must invalidate the guest TLB entry in either case, we cannot ignore it even for
+         * the EPT case. See @bugref{6043} and @bugref{6177}.
          *
-         * Set the VMCPU_FF_TLB_FLUSH force flag and flush before VM-entry in hmR0VmxFlushTLB*() as this
-         * function maybe called in a loop with individual addresses.
+         * Set the VMCPU_FF_TLB_FLUSH force flag and flush before VM-entry in hmR0VmxFlushTLB*()
+         * as this function maybe called in a loop with individual addresses.
          */
         if (pVM->hm.s.vmx.fVpid)
@@ -2024 +1945 @@
 
     /*
-     * Force a TLB flush for the first world-switch if the current CPU differs from the one we ran on last.
-     * If the TLB flush count changed, another VM (VCPU rather) has hit the ASID limit while flushing the TLB
-     * or the host CPU is online after a suspend/resume, so we cannot reuse the current ASID anymore.
+     * Force a TLB flush for the first world-switch if the current CPU differs from the one we
+     * ran on last. If the TLB flush count changed, another VM (VCPU rather) has hit the ASID
+     * limit while flushing the TLB or the host CPU is online after a suspend/resume, so we
+     * cannot reuse the current ASID anymore.
      */
     if (   pVCpu->hm.s.idLastCpu   != pCpu->idCpu
@@ -2057 +1979 @@
     {
         /*
-         * Changes to the EPT paging structure by VMM requires flushing by EPT as the CPU creates
-         * guest-physical (only EPT-tagged) mappings while traversing the EPT tables when EPT is in use.
-         * Flushing by VPID will only flush linear (only VPID-tagged) and combined (EPT+VPID tagged) mappings
-         * but not guest-physical mappings.
-         * See Intel spec. 28.3.2 "Creating and Using Cached Translation Information". See @bugref{6568}.
+         * Changes to the EPT paging structure by VMM requires flushing-by-EPT as the CPU
+         * creates guest-physical (ie. only EPT-tagged) mappings while traversing the EPT
+         * tables when EPT is in use. Flushing-by-VPID will only flush linear (only
+         * VPID-tagged) and combined (EPT+VPID tagged) mappings but not guest-physical
+         * mappings, see @bugref{6568}.
+         *
+         * See Intel spec. 28.3.2 "Creating and Using Cached Translation Information".
          */
         hmR0VmxFlushEpt(pVCpu, pVM->hm.s.vmx.enmFlushEpt);
@@ -2246 +2170 @@
             break;
     }
-
     /* Don't assert that VMCPU_FF_TLB_FLUSH should no longer be pending. It can be set by other EMTs. */
 }
@@ -2331 +2254 @@
         {
             /*  Shouldn't happen. VPID is supported but INVVPID is not supported by the CPU. Ignore VPID capability. */
-            Log4(("hmR0VmxSetupTaggedTlb: VPID supported without INVEPT support. Ignoring VPID.\n"));
+            Log4Func(("VPID supported without INVEPT support. Ignoring VPID.\n"));
             pVM->hm.s.vmx.enmFlushVpid = VMXFLUSHVPID_NOT_SUPPORTED;
             pVM->hm.s.vmx.fVpid = false;
@@ -2364 +2287 @@
     AssertPtr(pVCpu);
 
-    uint32_t val = pVM->hm.s.vmx.Msrs.VmxPinCtls.n.disallowed0;         /* Bits set here must always be set. */
-    uint32_t zap = pVM->hm.s.vmx.Msrs.VmxPinCtls.n.allowed1;            /* Bits cleared here must always be cleared. */
-
-    val |=   VMX_VMCS_CTRL_PIN_EXEC_EXT_INT_EXIT           /* External interrupts cause a VM-exit. */
-           | VMX_VMCS_CTRL_PIN_EXEC_NMI_EXIT;              /* Non-maskable interrupts (NMIs) cause a VM-exit. */
+    uint32_t fVal = pVM->hm.s.vmx.Msrs.VmxPinCtls.n.disallowed0;         /* Bits set here must always be set. */
+    uint32_t fZap = pVM->hm.s.vmx.Msrs.VmxPinCtls.n.allowed1;            /* Bits cleared here must always be cleared. */
+
+    fVal |= VMX_VMCS_CTRL_PIN_EXEC_EXT_INT_EXIT              /* External interrupts cause a VM-exit. */
+         |  VMX_VMCS_CTRL_PIN_EXEC_NMI_EXIT;                 /* Non-maskable interrupts (NMIs) cause a VM-exit. */
 
     if (pVM->hm.s.vmx.Msrs.VmxPinCtls.n.allowed1 & VMX_VMCS_CTRL_PIN_EXEC_VIRTUAL_NMI)
-        val |= VMX_VMCS_CTRL_PIN_EXEC_VIRTUAL_NMI;         /* Use virtual NMIs and virtual-NMI blocking features. */
+        fVal |= VMX_VMCS_CTRL_PIN_EXEC_VIRTUAL_NMI;         /* Use virtual NMIs and virtual-NMI blocking features. */
 
     /* Enable the VMX preemption timer. */
@@ -2377 +2300 @@
     {
         Assert(pVM->hm.s.vmx.Msrs.VmxPinCtls.n.allowed1 & VMX_VMCS_CTRL_PIN_EXEC_PREEMPT_TIMER);
-        val |= VMX_VMCS_CTRL_PIN_EXEC_PREEMPT_TIMER;
+        fVal |= VMX_VMCS_CTRL_PIN_EXEC_PREEMPT_TIMER;
     }
 
@@ -2386 +2309 @@
         Assert(pVM->hm.s.vmx.Msrs.VmxPinCtls.n.allowed1 & VMX_VMCS_CTRL_PIN_EXEC_POSTED_INTR);
         Assert(pVM->hm.s.vmx.Msrs.VmxExit.n.allowed1 & VMX_VMCS_CTRL_EXIT_ACK_EXT_INT);
-        val |= VMX_VMCS_CTRL_PIN_EXEC_POSTED_INTR;
+        fVal |= VMX_VMCS_CTRL_PIN_EXEC_POSTED_INTR;
     }
 #endif
 
-    if ((val & zap) != val)
-    {
-        LogRel(("hmR0VmxSetupPinCtls: Invalid pin-based VM-execution controls combo! cpu=%#RX64 val=%#RX64 zap=%#RX64\n",
-                pVM->hm.s.vmx.Msrs.VmxPinCtls.n.disallowed0, val, zap));
+    if ((fVal & fZap) != fVal)
+    {
+        LogRel(("hmR0VmxSetupPinCtls: Invalid pin-based VM-execution controls combo! Cpu=%#RX64 fVal=%#RX64 fZap=%#RX64\n",
+                pVM->hm.s.vmx.Msrs.VmxPinCtls.n.disallowed0, fVal, fZap));
         pVCpu->hm.s.u32HMError = VMX_UFC_CTRL_PIN_EXEC;
         return VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO;
     }
 
-    int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PIN_EXEC, val);
+    int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PIN_EXEC, fVal);
     AssertRCReturn(rc, rc);
 
-    pVCpu->hm.s.vmx.u32PinCtls = val;
+    pVCpu->hm.s.vmx.u32PinCtls = fVal;
     return rc;
 }
@@ -2419 +2342 @@
 
     int rc = VERR_INTERNAL_ERROR_5;
-    uint32_t val = pVM->hm.s.vmx.Msrs.VmxProcCtls.n.disallowed0;        /* Bits set here must be set in the VMCS. */
-    uint32_t zap = pVM->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1;           /* Bits cleared here must be cleared in the VMCS. */
-
-    val |=   VMX_VMCS_CTRL_PROC_EXEC_HLT_EXIT                  /* HLT causes a VM-exit. */
-           | VMX_VMCS_CTRL_PROC_EXEC_USE_TSC_OFFSETTING        /* Use TSC-offsetting. */
-           | VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT               /* MOV DRx causes a VM-exit. */
-           | VMX_VMCS_CTRL_PROC_EXEC_UNCOND_IO_EXIT            /* All IO instructions cause a VM-exit. */
-           | VMX_VMCS_CTRL_PROC_EXEC_RDPMC_EXIT                /* RDPMC causes a VM-exit. */
-           | VMX_VMCS_CTRL_PROC_EXEC_MONITOR_EXIT              /* MONITOR causes a VM-exit. */
-           | VMX_VMCS_CTRL_PROC_EXEC_MWAIT_EXIT;               /* MWAIT causes a VM-exit. */
+    uint32_t fVal = pVM->hm.s.vmx.Msrs.VmxProcCtls.n.disallowed0; /* Bits set here must be set in the VMCS. */
+    uint32_t fZap = pVM->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1;    /* Bits cleared here must be cleared in the VMCS. */
+
+    fVal |= VMX_VMCS_CTRL_PROC_EXEC_HLT_EXIT                      /* HLT causes a VM-exit. */
+         |  VMX_VMCS_CTRL_PROC_EXEC_USE_TSC_OFFSETTING            /* Use TSC-offsetting. */
+         |  VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT                   /* MOV DRx causes a VM-exit. */
+         |  VMX_VMCS_CTRL_PROC_EXEC_UNCOND_IO_EXIT                /* All IO instructions cause a VM-exit. */
+         |  VMX_VMCS_CTRL_PROC_EXEC_RDPMC_EXIT                    /* RDPMC causes a VM-exit. */
+         |  VMX_VMCS_CTRL_PROC_EXEC_MONITOR_EXIT                  /* MONITOR causes a VM-exit. */
+         |  VMX_VMCS_CTRL_PROC_EXEC_MWAIT_EXIT;                   /* MWAIT causes a VM-exit. */
 
     /* We toggle VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT later, check if it's not -always- needed to be set or clear. */
@@ -2442 +2365 @@
     if (!pVM->hm.s.fNestedPaging)
     {
-        Assert(!pVM->hm.s.vmx.fUnrestrictedGuest);                      /* Paranoia. */
-        val |=   VMX_VMCS_CTRL_PROC_EXEC_INVLPG_EXIT
-               | VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
-               | VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT;
+        Assert(!pVM->hm.s.vmx.fUnrestrictedGuest);                /* Paranoia. */
+        fVal |= VMX_VMCS_CTRL_PROC_EXEC_INVLPG_EXIT
+             |  VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
+             |  VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT;
     }
 
@@ -2453 +2376 @@
     {
         Assert(pVCpu->hm.s.vmx.HCPhysVirtApic);
-        Assert(!(pVCpu->hm.s.vmx.HCPhysVirtApic & 0xfff));              /* Bits 11:0 MBZ. */
+        Assert(!(pVCpu->hm.s.vmx.HCPhysVirtApic & 0xfff));        /* Bits 11:0 MBZ. */
         rc  = VMXWriteVmcs32(VMX_VMCS32_CTRL_TPR_THRESHOLD, 0);
         rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_VAPIC_PAGEADDR_FULL, pVCpu->hm.s.vmx.HCPhysVirtApic);
         AssertRCReturn(rc, rc);
 
-        val |= VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW;         /* CR8 reads from the Virtual-APIC page. */
-                                                               /* CR8 writes cause a VM-exit based on TPR threshold. */
-        Assert(!(val & VMX_VMCS_CTRL_PROC_EXEC_CR8_STORE_EXIT));
-        Assert(!(val & VMX_VMCS_CTRL_PROC_EXEC_CR8_LOAD_EXIT));
+        fVal |= VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW;           /* CR8 reads from the Virtual-APIC page. */
+                                                                  /* CR8 writes cause a VM-exit based on TPR threshold. */
+        Assert(!(fVal & VMX_VMCS_CTRL_PROC_EXEC_CR8_STORE_EXIT));
+        Assert(!(fVal & VMX_VMCS_CTRL_PROC_EXEC_CR8_LOAD_EXIT));
     }
     else
@@ -2471 +2394 @@
         if (pVM->hm.s.fAllow64BitGuests)
         {
-            val |=   VMX_VMCS_CTRL_PROC_EXEC_CR8_STORE_EXIT    /* CR8 reads cause a VM-exit. */
-                   | VMX_VMCS_CTRL_PROC_EXEC_CR8_LOAD_EXIT;    /* CR8 writes cause a VM-exit. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC_CR8_STORE_EXIT        /* CR8 reads cause a VM-exit. */
+                 |  VMX_VMCS_CTRL_PROC_EXEC_CR8_LOAD_EXIT;        /* CR8 writes cause a VM-exit. */
         }
     }
@@ -2479 +2402 @@
     if (pVM->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS)
     {
-        val |= VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS;
+        fVal |= VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS;
 
         Assert(pVCpu->hm.s.vmx.HCPhysMsrBitmap);
-        Assert(!(pVCpu->hm.s.vmx.HCPhysMsrBitmap & 0xfff));             /* Bits 11:0 MBZ. */
+        Assert(!(pVCpu->hm.s.vmx.HCPhysMsrBitmap & 0xfff));       /* Bits 11:0 MBZ. */
         rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_MSR_BITMAP_FULL, pVCpu->hm.s.vmx.HCPhysMsrBitmap);
         AssertRCReturn(rc, rc);
@@ -2520 +2443 @@
     /* Use the secondary processor-based VM-execution controls if supported by the CPU. */
     if (pVM->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL)
-        val |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
-
-    if ((val & zap) != val)
-    {
-        LogRel(("hmR0VmxSetupProcCtls: Invalid processor-based VM-execution controls combo! cpu=%#RX64 val=%#RX64 zap=%#RX64\n",
-                pVM->hm.s.vmx.Msrs.VmxProcCtls.n.disallowed0, val, zap));
+        fVal |= VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL;
+
+    if ((fVal & fZap) != fVal)
+    {
+        LogRel(("hmR0VmxSetupProcCtls: Invalid processor-based VM-execution controls combo! cpu=%#RX64 fVal=%#RX64 fZap=%#RX64\n",
+                pVM->hm.s.vmx.Msrs.VmxProcCtls.n.disallowed0, fVal, fZap));
         pVCpu->hm.s.u32HMError = VMX_UFC_CTRL_PROC_EXEC;
         return VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO;
     }
 
-    rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, val);
+    rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, fVal);
     AssertRCReturn(rc, rc);
 
-    pVCpu->hm.s.vmx.u32ProcCtls = val;
+    pVCpu->hm.s.vmx.u32ProcCtls = fVal;
 
     /*
@@ -2540 +2463 @@
     if (RT_LIKELY(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_SECONDARY_EXEC_CTRL))
     {
-        val = pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.disallowed0;            /* Bits set here must be set in the VMCS. */
-        zap = pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1;               /* Bits cleared here must be cleared in the VMCS. */
+        fVal = pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.disallowed0;     /* Bits set here must be set in the VMCS. */
+        fZap = pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1;        /* Bits cleared here must be cleared in the VMCS. */
 
         if (pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT)
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;                /* WBINVD causes a VM-exit. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_WBINVD_EXIT;         /* WBINVD causes a VM-exit. */
 
         if (pVM->hm.s.fNestedPaging)
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;                        /* Enable EPT. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_EPT;                 /* Enable EPT. */
 
         /*
@@ -2556 +2479 @@
             && pVM->cpum.ro.GuestFeatures.fInvpcid)
         {
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_INVPCID;
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_INVPCID;
         }
 
         if (pVM->hm.s.vmx.fVpid)
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;                       /* Enable VPID. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_VPID;                /* Enable VPID. */
 
         if (pVM->hm.s.vmx.fUnrestrictedGuest)
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_UNRESTRICTED_GUEST;         /* Enable Unrestricted Execution. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_UNRESTRICTED_GUEST;  /* Enable Unrestricted Execution. */
 
 #if 0
@@ -2569 +2492 @@
         {
             Assert(pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_APIC_REG_VIRT);
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_APIC_REG_VIRT;              /* Enable APIC-register virtualization. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_APIC_REG_VIRT;       /* Enable APIC-register virtualization. */
 
             Assert(pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_VIRT_INTR_DELIVERY);
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_INTR_DELIVERY;         /* Enable virtual-interrupt delivery. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_INTR_DELIVERY;  /* Enable virtual-interrupt delivery. */
         }
 #endif
@@ -2582 +2505 @@
         {
             Assert(pVM->hm.s.vmx.HCPhysApicAccess);
-            Assert(!(pVM->hm.s.vmx.HCPhysApicAccess & 0xfff));          /* Bits 11:0 MBZ. */
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC;                  /* Virtualize APIC accesses. */
+            Assert(!(pVM->hm.s.vmx.HCPhysApicAccess & 0xfff));    /* Bits 11:0 MBZ. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_VIRT_APIC;           /* Virtualize APIC accesses. */
             rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_APIC_ACCESSADDR_FULL, pVM->hm.s.vmx.HCPhysApicAccess);
             AssertRCReturn(rc, rc);
@@ -2589 +2512 @@
 
         if (pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP;                     /* Enable RDTSCP support. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP;              /* Enable RDTSCP support. */
 
         if (   pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC2_PAUSE_LOOP_EXIT
@@ -2595 +2518 @@
             && pVM->hm.s.vmx.cPleWindowTicks)
         {
-            val |= VMX_VMCS_CTRL_PROC_EXEC2_PAUSE_LOOP_EXIT;            /* Enable pause-loop exiting. */
+            fVal |= VMX_VMCS_CTRL_PROC_EXEC2_PAUSE_LOOP_EXIT;     /* Enable pause-loop exiting. */
 
             rc  = VMXWriteVmcs32(VMX_VMCS32_CTRL_PLE_GAP, pVM->hm.s.vmx.cPleGapTicks);
@@ -2602 +2525 @@
         }
 
-        if ((val & zap) != val)
+        if ((fVal & fZap) != fVal)
         {
             LogRel(("hmR0VmxSetupProcCtls: Invalid secondary processor-based VM-execution controls combo! "
-                    "cpu=%#RX64 val=%#RX64 zap=%#RX64\n", pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.disallowed0, val, zap));
+                    "cpu=%#RX64 fVal=%#RX64 fZap=%#RX64\n", pVM->hm.s.vmx.Msrs.VmxProcCtls2.n.disallowed0, fVal, fZap));
             pVCpu->hm.s.u32HMError = VMX_UFC_CTRL_PROC_EXEC2;
             return VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO;
         }
 
-        rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC2, val);
+        rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC2, fVal);
         AssertRCReturn(rc, rc);
 
-        pVCpu->hm.s.vmx.u32ProcCtls2 = val;
+        pVCpu->hm.s.vmx.u32ProcCtls2 = fVal;
     }
     else if (RT_UNLIKELY(pVM->hm.s.vmx.fUnrestrictedGuest))
@@ -2645 +2568 @@
     /* All fields are zero-initialized during allocation; but don't remove the commented block below. */
 #if 0
-    /* All CR3 accesses cause VM-exits. Later we optimize CR3 accesses (see hmR0VmxLoadGuestCR3AndCR4())*/
+    /* All CR3 accesses cause VM-exits. Later we optimize CR3 accesses (see hmR0VmxExportGuestCR3AndCR4())*/
     rc  = VMXWriteVmcs32(VMX_VMCS32_CTRL_CR3_TARGET_COUNT, 0);
     rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_TSC_OFFSET_FULL, 0);
@@ -2657 +2580 @@
     rc |= VMXWriteVmcs32(VMX_VMCS32_CTRL_PAGEFAULT_ERROR_MATCH, 0);
 
-    /** @todo Explore possibility of using IO-bitmaps. */
     /* All IO & IOIO instructions cause VM-exits. */
     rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_IO_BITMAP_A_FULL, 0);
@@ -2688 +2610 @@
 #if 0
     /* Setup debug controls */
-    rc  = VMXWriteVmcs64(VMX_VMCS64_GUEST_DEBUGCTL_FULL, 0);       /** @todo We don't support IA32_DEBUGCTL MSR. Should we? */
+    rc  = VMXWriteVmcs64(VMX_VMCS64_GUEST_DEBUGCTL_FULL, 0);
     rc |= VMXWriteVmcs32(VMX_VMCS_GUEST_PENDING_DEBUG_EXCEPTIONS, 0);
     AssertRCReturn(rc, rc);
@@ -2733 +2655 @@
     AssertRCReturn(rc, rc);
     return rc;
-}
-
-
-/**
- * Sets up the initial guest-state mask. The guest-state mask is consulted
- * before reading guest-state fields from the VMCS as VMREADs can be expensive
- * for the nested virtualization case (as it would cause a VM-exit).
- *
- * @param   pVCpu       The cross context virtual CPU structure.
- */
-static int hmR0VmxInitUpdatedGuestStateMask(PVMCPU pVCpu)
-{
-    /* Initially the guest-state is up-to-date as there is nothing in the VMCS. */
-    HMVMXCPU_GST_RESET_TO(pVCpu, HMVMX_UPDATED_GUEST_ALL);
-    return VINF_SUCCESS;
 }
 
@@ -2806 +2713 @@
 
     /*
-     * Without UnrestrictedGuest, pRealModeTSS and pNonPagingModeEPTPageTable *must* always be allocated.
-     * We no longer support the highly unlikely case of UnrestrictedGuest without pRealModeTSS. See hmR3InitFinalizeR0Intel().
+     * Without UnrestrictedGuest, pRealModeTSS and pNonPagingModeEPTPageTable *must* always be
+     * allocated. We no longer support the highly unlikely case of UnrestrictedGuest without
+     * pRealModeTSS, see hmR3InitFinalizeR0Intel().
      */
     if (   !pVM->hm.s.vmx.fUnrestrictedGuest
@@ -2852 +2760 @@
 
         /* Log the VCPU pointers, useful for debugging SMP VMs. */
-        Log4(("VMXR0SetupVM: pVCpu=%p idCpu=%RU32\n", pVCpu, pVCpu->idCpu));
+        Log4Func(("pVCpu=%p idCpu=%RU32\n", pVCpu, pVCpu->idCpu));
 
         /* Set revision dword at the beginning of the VMCS structure. */
@@ -2881 +2789 @@
         rc = hmR0VmxInitXcptBitmap(pVM, pVCpu);
         AssertLogRelMsgRCReturnStmt(rc, ("VMXR0SetupVM: hmR0VmxInitXcptBitmap failed! rc=%Rrc (pVM=%p)\n", rc, pVM),
-                                    hmR0VmxUpdateErrorRecord(pVM, pVCpu, rc), rc);
-
-        rc = hmR0VmxInitUpdatedGuestStateMask(pVCpu);
-        AssertLogRelMsgRCReturnStmt(rc, ("VMXR0SetupVM: hmR0VmxInitUpdatedGuestStateMask failed! rc=%Rrc (pVM=%p)\n", rc, pVM),
                                     hmR0VmxUpdateErrorRecord(pVM, pVCpu, rc), rc);
 
@@ -2912 +2816 @@
  *
  * @returns VBox status code.
- * @param   pVM         The cross context VM structure.
- * @param   pVCpu       The cross context virtual CPU structure.
- */
-DECLINLINE(int) hmR0VmxSaveHostControlRegs(PVM pVM, PVMCPU pVCpu)
-{
-    NOREF(pVM); NOREF(pVCpu);
-
+ */
+static int hmR0VmxExportHostControlRegs(void)
+{
     RTCCUINTREG uReg = ASMGetCR0();
     int rc = VMXWriteVmcsHstN(VMX_VMCS_HOST_CR0, uReg);
@@ -2934 +2834 @@
 
 
+/**
+ * Saves the host segment registers and GDTR, IDTR, (TR, GS and FS bases) into
+ * the host-state area in the VMCS.
+ *
+ * @returns VBox status code.
+ * @param   pVCpu       The cross context virtual CPU structure.
+ */
+static int hmR0VmxExportHostSegmentRegs(PVMCPU pVCpu)
+{
 #if HC_ARCH_BITS == 64
 /**
  * Macro for adjusting host segment selectors to satisfy VT-x's VM-entry
- * requirements. See hmR0VmxSaveHostSegmentRegs().
+ * requirements. See hmR0VmxExportHostSegmentRegs().
  */
 # define VMXLOCAL_ADJUST_HOST_SEG(seg, selValue)  \
@@ -2955 +2864 @@
         (selValue) = 0; \
     }
-#endif
-
-
-/**
- * Saves the host segment registers and GDTR, IDTR, (TR, GS and FS bases) into
- * the host-state area in the VMCS.
- *
- * @returns VBox status code.
- * @param   pVM         The cross context VM structure.
- * @param   pVCpu       The cross context virtual CPU structure.
- */
-DECLINLINE(int) hmR0VmxSaveHostSegmentRegs(PVM pVM, PVMCPU pVCpu)
-{
-    int rc = VERR_INTERNAL_ERROR_5;
-
-#if HC_ARCH_BITS == 64
+
     /*
      * If we've executed guest code using VT-x, the host-state bits will be messed up. We
-     * should -not- save the messed up state without restoring the original host-state. See @bugref{7240}.
+     * should -not- save the messed up state without restoring the original host-state,
+     * see @bugref{7240}.
      *
-     * This apparently can happen (most likely the FPU changes), deal with it rather than asserting.
-     * Was observed booting Solaris10u10 32-bit guest.
+     * This apparently can happen (most likely the FPU changes), deal with it rather than
+     * asserting. Was observed booting Solaris 10u10 32-bit guest.
      */
     if (   (pVCpu->hm.s.vmx.fRestoreHostFlags & VMX_RESTORE_HOST_REQUIRED)
@@ -3018 +2913 @@
 #if HC_ARCH_BITS == 64
     /*
-     * Determine if the host segment registers are suitable for VT-x. Otherwise use zero to gain VM-entry and restore them
-     * before we get preempted. See Intel spec. 26.2.3 "Checks on Host Segment and Descriptor-Table Registers".
+     * Determine if the host segment registers are suitable for VT-x. Otherwise use zero to
+     * gain VM-entry and restore them before we get preempted.
+     *
+     * See Intel spec. 26.2.3 "Checks on Host Segment and Descriptor-Table Registers".
      */
     VMXLOCAL_ADJUST_HOST_SEG(DS, uSelDS);
@@ -3046 +2943 @@
 
     /* Write these host selector fields into the host-state area in the VMCS. */
-    rc  = VMXWriteVmcs32(VMX_VMCS16_HOST_CS_SEL, uSelCS);
-    rc |= VMXWriteVmcs32(VMX_VMCS16_HOST_SS_SEL, uSelSS);
+    int rc  = VMXWriteVmcs32(VMX_VMCS16_HOST_CS_SEL, uSelCS);
+    rc     |= VMXWriteVmcs32(VMX_VMCS16_HOST_SS_SEL, uSelSS);
 #if HC_ARCH_BITS == 64
-    rc |= VMXWriteVmcs32(VMX_VMCS16_HOST_DS_SEL, uSelDS);
-    rc |= VMXWriteVmcs32(VMX_VMCS16_HOST_ES_SEL, uSelES);
-    rc |= VMXWriteVmcs32(VMX_VMCS16_HOST_FS_SEL, uSelFS);
-    rc |= VMXWriteVmcs32(VMX_VMCS16_HOST_GS_SEL, uSelGS);
+    rc     |= VMXWriteVmcs32(VMX_VMCS16_HOST_DS_SEL, uSelDS);
+    rc     |= VMXWriteVmcs32(VMX_VMCS16_HOST_ES_SEL, uSelES);
+    rc     |= VMXWriteVmcs32(VMX_VMCS16_HOST_FS_SEL, uSelFS);
+    rc     |= VMXWriteVmcs32(VMX_VMCS16_HOST_GS_SEL, uSelGS);
 #else
     NOREF(uSelDS);
@@ -3059 +2956 @@
     NOREF(uSelGS);
 #endif
-    rc |= VMXWriteVmcs32(VMX_VMCS16_HOST_TR_SEL, uSelTR);
+    rc     |= VMXWriteVmcs32(VMX_VMCS16_HOST_TR_SEL, uSelTR);
     AssertRCReturn(rc, rc);
 
@@ -3077 +2974 @@
 #if HC_ARCH_BITS == 64
     /*
-     * Determine if we need to manually need to restore the GDTR and IDTR limits as VT-x zaps them to the
-     * maximum limit (0xffff) on every VM-exit.
+     * Determine if we need to manually need to restore the GDTR and IDTR limits as VT-x zaps
+     * them to the maximum limit (0xffff) on every VM-exit.
      */
     if (Gdtr.cbGdt != 0xffff)
@@ -3085 +2982 @@
     /*
      * IDT limit is effectively capped at 0xfff. (See Intel spec. 6.14.1 "64-Bit Mode IDT"
-     * and Intel spec. 6.2 "Exception and Interrupt Vectors".)  Therefore if the host has the limit as 0xfff, VT-x
-     * bloating the limit to 0xffff shouldn't cause any different CPU behavior.  However, several hosts either insists
-     * on 0xfff being the limit (Windows Patch Guard) or uses the limit for other purposes (darwin puts the CPU ID in there
-     * but botches sidt alignment in at least one consumer).  So, we're only allowing IDTR.LIMIT to be left at 0xffff on
-     * hosts where we are pretty sure it won't cause trouble.
+     * and Intel spec. 6.2 "Exception and Interrupt Vectors".)  Therefore if the host has the
+     * limit as 0xfff, VT-x bloating the limit to 0xffff shouldn't cause any different CPU
+     * behavior.  However, several hosts either insists on 0xfff being the limit (Windows
+     * Patch Guard) or uses the limit for other purposes (darwin puts the CPU ID in there
+     * but botches sidt alignment in at least one consumer).  So, we're only allowing the
+     * IDTR.LIMIT to be left at 0xffff on hosts where we are sure it won't cause trouble.
      */
 # if defined(RT_OS_LINUX) || defined(RT_OS_SOLARIS)
@@ -3104 +3002 @@
 
     /*
-     * Host TR base. Verify that TR selector doesn't point past the GDT. Masking off the TI and RPL bits
-     * is effectively what the CPU does for "scaling by 8". TI is always 0 and RPL should be too in most cases.
+     * Host TR base. Verify that TR selector doesn't point past the GDT. Masking off the TI
+     * and RPL bits is effectively what the CPU does for "scaling by 8". TI is always 0 and
+     * RPL should be too in most cases.
      */
     AssertMsgReturn((uSelTR | X86_SEL_RPL_LDT) <= Gdtr.cbGdt,
-                    ("hmR0VmxSaveHostSegmentRegs: TR selector exceeds limit. TR=%RTsel cbGdt=%#x\n", uSelTR, Gdtr.cbGdt),
-                    VERR_VMX_INVALID_HOST_STATE);
+                    ("TR selector exceeds limit. TR=%RTsel cbGdt=%#x\n", uSelTR, Gdtr.cbGdt), VERR_VMX_INVALID_HOST_STATE);
 
     PCX86DESCHC pDesc = (PCX86DESCHC)(Gdtr.pGdt + (uSelTR & X86_SEL_MASK));
@@ -3116 +3014 @@
 
     /*
-     * VT-x unconditionally restores the TR limit to 0x67 and type to 11 (32-bit busy TSS) on all VM-exits.
-     * The type is the same for 64-bit busy TSS[1]. The limit needs manual restoration if the host has something else.
-     * Task switching is not supported in 64-bit mode[2], but the limit still matters as IOPM is supported in 64-bit mode.
-     * Restoring the limit lazily while returning to ring-3 is safe because IOPM is not applicable in ring-0.
+     * VT-x unconditionally restores the TR limit to 0x67 and type to 11 (32-bit busy TSS) on
+     * all VM-exits. The type is the same for 64-bit busy TSS[1]. The limit needs manual
+     * restoration if the host has something else. Task switching is not supported in 64-bit
+     * mode[2], but the limit still matters as IOPM is supported in 64-bit mode. Restoring the
+     * limit lazily while returning to ring-3 is safe because IOPM is not applicable in ring-0.
      *
      * [1] See Intel spec. 3.5 "System Descriptor Types".
      * [2] See Intel spec. 7.2.3 "TSS Descriptor in 64-bit mode".
      */
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
     Assert(pDesc->System.u4Type == 11);
     if (   pDesc->System.u16LimitLow != 0x67
@@ -3152 +3052 @@
     }
 #else
-    NOREF(pVM);
     uintptr_t uTRBase = X86DESC_BASE(pDesc);
 #endif
@@ -3174 +3073 @@
         pVCpu->hm.s.vmx.RestoreHost.uHostGSBase = u64GSBase;
 #endif
-    return rc;
-}
-
-
-/**
- * Saves certain host MSRs in the VM-exit MSR-load area and some in the
- * host-state area of the VMCS. Theses MSRs will be automatically restored on
- * the host after every successful VM-exit.
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Exports certain host MSRs in the VM-exit MSR-load area and some in the
+ * host-state area of the VMCS.
+ *
+ * Theses MSRs will be automatically restored on the host after every successful
+ * VM-exit.
  *
  * @returns VBox status code.
- * @param   pVM         The cross context VM structure.
  * @param   pVCpu       The cross context virtual CPU structure.
  *
  * @remarks No-long-jump zone!!!
  */
-DECLINLINE(int) hmR0VmxSaveHostMsrs(PVM pVM, PVMCPU pVCpu)
-{
-    NOREF(pVM);
-
+static int hmR0VmxExportHostMsrs(PVMCPU pVCpu)
+{
     AssertPtr(pVCpu);
     AssertPtr(pVCpu->hm.s.vmx.pvHostMsr);
@@ -3205 +3103 @@
      * Host Sysenter MSRs.
      */
-    int rc  = VMXWriteVmcs32(VMX_VMCS32_HOST_SYSENTER_CS,   ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
+    int rc = VMXWriteVmcs32(VMX_VMCS32_HOST_SYSENTER_CS, ASMRdMsr_Low(MSR_IA32_SYSENTER_CS));
 #if HC_ARCH_BITS == 32
-    rc |= VMXWriteVmcs32(VMX_VMCS_HOST_SYSENTER_ESP,        ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
-    rc |= VMXWriteVmcs32(VMX_VMCS_HOST_SYSENTER_EIP,        ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
+    rc |= VMXWriteVmcs32(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr_Low(MSR_IA32_SYSENTER_ESP));
+    rc |= VMXWriteVmcs32(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr_Low(MSR_IA32_SYSENTER_EIP));
 #else
-    rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP,        ASMRdMsr(MSR_IA32_SYSENTER_ESP));
-    rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP,        ASMRdMsr(MSR_IA32_SYSENTER_EIP));
+    rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_ESP, ASMRdMsr(MSR_IA32_SYSENTER_ESP));
+    rc |= VMXWriteVmcs64(VMX_VMCS_HOST_SYSENTER_EIP, ASMRdMsr(MSR_IA32_SYSENTER_EIP));
 #endif
     AssertRCReturn(rc, rc);
@@ -3217 +3115 @@
     /*
      * Host EFER MSR.
-     * If the CPU supports the newer VMCS controls for managing EFER, use it.
-     * Otherwise it's done as part of auto-load/store MSR area in the VMCS, see hmR0VmxLoadGuestMsrs().
+     *
+     * If the CPU supports the newer VMCS controls for managing EFER, use it. Otherwise it's
+     * done as part of auto-load/store MSR area in the VMCS, see hmR0VmxExportGuestMsrs().
      */
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
     if (pVM->hm.s.vmx.fSupportsVmcsEfer)
     {
@@ -3226 +3126 @@
     }
 
-    /** @todo IA32_PERF_GLOBALCTRL, IA32_PAT also see
-     *        hmR0VmxLoadGuestExitCtls() !! */
-
-    return rc;
+    /** @todo IA32_PERF_GLOBALCTRL, IA32_PAT also see hmR0VmxExportGuestExitCtls(). */
+
+    return VINF_SUCCESS;
 }
 
@@ -3237 +3136 @@
  *
  * We check all relevant bits. For now, that's everything besides LMA/LME, as
- * these two bits are handled by VM-entry, see hmR0VmxLoadGuestExitCtls() and
- * hmR0VMxLoadGuestEntryCtls().
+ * these two bits are handled by VM-entry, see hmR0VmxExportGuestExitCtls() and
+ * hmR0VMxExportGuestEntryCtls().
  *
  * @returns true if we need to load guest EFER, false otherwise.
@@ -3249 +3148 @@
  * @remarks No-long-jump zone!!!
  */
-static bool hmR0VmxShouldSwapEferMsr(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static bool hmR0VmxShouldSwapEferMsr(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
 {
 #ifdef HMVMX_ALWAYS_SWAP_EFER
@@ -3257 +3156 @@
 #if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
     /* For 32-bit hosts running 64-bit guests, we always swap EFER in the world-switcher. Nothing to do here. */
-    if (CPUMIsGuestInLongMode(pVCpu))
+    if (CPUMIsGuestInLongModeEx(pMixedCtx))
         return false;
 #endif
@@ -3266 +3165 @@
 
     /*
-     * For 64-bit guests, if EFER.SCE bit differs, we need to swap to ensure that the
-     * guest's SYSCALL behaviour isn't screwed. See @bugref{7386}.
+     * For 64-bit guests, if EFER.SCE bit differs, we need to swap EFER to ensure that the
+     * guest's SYSCALL behaviour isn't broken, see @bugref{7386}.
      */
-    if (   CPUMIsGuestInLongMode(pVCpu)
+    if (   CPUMIsGuestInLongModeEx(pMixedCtx)
         && (u64GuestEfer & MSR_K6_EFER_SCE) != (u64HostEfer & MSR_K6_EFER_SCE))
     {
@@ -3289 +3188 @@
     }
 
-    /** @todo Check the latest Intel spec. for any other bits,
-     *        like SMEP/SMAP? */
     return false;
 }
@@ -3296 +3193 @@
 
 /**
- * Sets up VM-entry controls in the VMCS. These controls can affect things done
- * on VM-exit; e.g. "load debug controls", see Intel spec. 24.8.1 "VM-entry
- * controls".
+ * Exports the guest state with appropriate VM-entry controls in the VMCS.
+ *
+ * These controls can affect things done on VM-exit; e.g. "load debug controls",
+ * see Intel spec. 24.8.1 "VM-entry controls".
  *
  * @returns VBox status code.
@@ -3309 +3207 @@
  * @remarks No-long-jump zone!!!
  */
-DECLINLINE(int) hmR0VmxLoadGuestEntryCtls(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    int rc = VINF_SUCCESS;
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMX_ENTRY_CTLS))
-    {
-        PVM pVM      = pVCpu->CTX_SUFF(pVM);
-        uint32_t val = pVM->hm.s.vmx.Msrs.VmxEntry.n.disallowed0;       /* Bits set here must be set in the VMCS. */
-        uint32_t zap = pVM->hm.s.vmx.Msrs.VmxEntry.n.allowed1;          /* Bits cleared here must be cleared in the VMCS. */
+static int hmR0VmxExportGuestEntryCtls(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
+{
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_VMX_ENTRY_CTLS)
+    {
+        PVM pVM       = pVCpu->CTX_SUFF(pVM);
+        uint32_t fVal = pVM->hm.s.vmx.Msrs.VmxEntry.n.disallowed0;       /* Bits set here must be set in the VMCS. */
+        uint32_t fZap = pVM->hm.s.vmx.Msrs.VmxEntry.n.allowed1;          /* Bits cleared here must be cleared in the VMCS. */
 
         /* Load debug controls (DR7 & IA32_DEBUGCTL_MSR). The first VT-x capable CPUs only supports the 1-setting of this bit. */
-        val |= VMX_VMCS_CTRL_ENTRY_LOAD_DEBUG;
+        fVal |= VMX_VMCS_CTRL_ENTRY_LOAD_DEBUG;
 
         /* Set if the guest is in long mode. This will set/clear the EFER.LMA bit on VM-entry. */
         if (CPUMIsGuestInLongModeEx(pMixedCtx))
         {
-            val |= VMX_VMCS_CTRL_ENTRY_IA32E_MODE_GUEST;
-            Log4(("Load[%RU32]: VMX_VMCS_CTRL_ENTRY_IA32E_MODE_GUEST\n", pVCpu->idCpu));
+            fVal |= VMX_VMCS_CTRL_ENTRY_IA32E_MODE_GUEST;
+            Log4Func(("VMX_VMCS_CTRL_ENTRY_IA32E_MODE_GUEST\n"));
         }
         else
-            Assert(!(val & VMX_VMCS_CTRL_ENTRY_IA32E_MODE_GUEST));
+            Assert(!(fVal & VMX_VMCS_CTRL_ENTRY_IA32E_MODE_GUEST));
 
         /* If the CPU supports the newer VMCS controls for managing guest/host EFER, use it. */
@@ -3334 +3231 @@
             && hmR0VmxShouldSwapEferMsr(pVCpu, pMixedCtx))
         {
-            val |= VMX_VMCS_CTRL_ENTRY_LOAD_GUEST_EFER_MSR;
-            Log4(("Load[%RU32]: VMX_VMCS_CTRL_ENTRY_LOAD_GUEST_EFER_MSR\n", pVCpu->idCpu));
+            fVal |= VMX_VMCS_CTRL_ENTRY_LOAD_GUEST_EFER_MSR;
+            Log4Func(("VMX_VMCS_CTRL_ENTRY_LOAD_GUEST_EFER_MSR\n"));
         }
 
@@ -3347 +3244 @@
          *        VMX_VMCS_CTRL_ENTRY_LOAD_GUEST_PAT_MSR. */
 
-        if ((val & zap) != val)
-        {
-            LogRel(("hmR0VmxLoadGuestEntryCtls: Invalid VM-entry controls combo! cpu=%RX64 val=%RX64 zap=%RX64\n",
-                    pVM->hm.s.vmx.Msrs.VmxEntry.n.disallowed0, val, zap));
+        if ((fVal & fZap) != fVal)
+        {
+            Log4Func(("Invalid VM-entry controls combo! Cpu=%RX64 fVal=%RX64 fZap=%RX64\n",
+                      pVM->hm.s.vmx.Msrs.VmxEntry.n.disallowed0, fVal, fZap));
             pVCpu->hm.s.u32HMError = VMX_UFC_CTRL_ENTRY;
             return VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO;
         }
 
-        rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_ENTRY, val);
+        int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_ENTRY, fVal);
         AssertRCReturn(rc, rc);
 
-        pVCpu->hm.s.vmx.u32EntryCtls = val;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_VMX_ENTRY_CTLS);
-    }
-    return rc;
-}
-
-
-/**
- * Sets up the VM-exit controls in the VMCS.
+        pVCpu->hm.s.vmx.u32EntryCtls = fVal;
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_VMX_ENTRY_CTLS);
+    }
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Exports the guest state with appropriate VM-exit controls in the VMCS.
  *
  * @returns VBox status code.
@@ -3376 +3273 @@
  * @remarks Requires EFER.
  */
-DECLINLINE(int) hmR0VmxLoadGuestExitCtls(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    NOREF(pMixedCtx);
-
-    int rc = VINF_SUCCESS;
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMX_EXIT_CTLS))
-    {
-        PVM pVM      = pVCpu->CTX_SUFF(pVM);
-        uint32_t val = pVM->hm.s.vmx.Msrs.VmxExit.n.disallowed0;        /* Bits set here must be set in the VMCS. */
-        uint32_t zap = pVM->hm.s.vmx.Msrs.VmxExit.n.allowed1;           /* Bits cleared here must be cleared in the VMCS. */
+static int hmR0VmxExportGuestExitCtls(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
+{
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_VMX_EXIT_CTLS)
+    {
+        PVM pVM       = pVCpu->CTX_SUFF(pVM);
+        uint32_t fVal = pVM->hm.s.vmx.Msrs.VmxExit.n.disallowed0;        /* Bits set here must be set in the VMCS. */
+        uint32_t fZap = pVM->hm.s.vmx.Msrs.VmxExit.n.allowed1;           /* Bits cleared here must be cleared in the VMCS. */
 
         /* Save debug controls (DR7 & IA32_DEBUGCTL_MSR). The first VT-x CPUs only supported the 1-setting of this bit. */
-        val |= VMX_VMCS_CTRL_EXIT_SAVE_DEBUG;
+        fVal |= VMX_VMCS_CTRL_EXIT_SAVE_DEBUG;
 
         /*
          * Set the host long mode active (EFER.LMA) bit (which Intel calls "Host address-space size") if necessary.
-         * On VM-exit, VT-x sets both the host EFER.LMA and EFER.LME bit to this value. See assertion in hmR0VmxSaveHostMsrs().
+         * On VM-exit, VT-x sets both the host EFER.LMA and EFER.LME bit to this value. See assertion in
+         * hmR0VmxExportHostMsrs().
          */
 #if HC_ARCH_BITS == 64
-        val |= VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE;
-        Log4(("Load[%RU32]: VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE\n", pVCpu->idCpu));
+        fVal |= VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE;
+        Log4Func(("VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE\n"));
 #else
         Assert(   pVCpu->hm.s.vmx.pfnStartVM == VMXR0SwitcherStartVM64
@@ -3404 +3299 @@
         {
             /* The switcher returns to long mode, EFER is managed by the switcher. */
-            val |= VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE;
-            Log4(("Load[%RU32]: VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE\n", pVCpu->idCpu));
+            fVal |= VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE;
+            Log4Func(("VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE\n"));
         }
         else
-            Assert(!(val & VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE));
+            Assert(!(fVal & VMX_VMCS_CTRL_EXIT_HOST_ADDR_SPACE_SIZE));
 #endif
 
@@ -3415 +3310 @@
             && hmR0VmxShouldSwapEferMsr(pVCpu, pMixedCtx))
         {
-            val |=   VMX_VMCS_CTRL_EXIT_SAVE_GUEST_EFER_MSR
-                   | VMX_VMCS_CTRL_EXIT_LOAD_HOST_EFER_MSR;
-            Log4(("Load[%RU32]: VMX_VMCS_CTRL_EXIT_SAVE_GUEST_EFER_MSR, VMX_VMCS_CTRL_EXIT_LOAD_HOST_EFER_MSR\n", pVCpu->idCpu));
+            fVal |= VMX_VMCS_CTRL_EXIT_SAVE_GUEST_EFER_MSR
+                 |  VMX_VMCS_CTRL_EXIT_LOAD_HOST_EFER_MSR;
+            Log4Func(("VMX_VMCS_CTRL_EXIT_SAVE_GUEST_EFER_MSR and VMX_VMCS_CTRL_EXIT_LOAD_HOST_EFER_MSR\n"));
         }
 
         /* Don't acknowledge external interrupts on VM-exit. We want to let the host do that. */
-        Assert(!(val & VMX_VMCS_CTRL_EXIT_ACK_EXT_INT));
+        Assert(!(fVal & VMX_VMCS_CTRL_EXIT_ACK_EXT_INT));
 
         /** @todo VMX_VMCS_CTRL_EXIT_LOAD_PERF_MSR,
@@ -3429 +3324 @@
         if (    pVM->hm.s.vmx.fUsePreemptTimer
             && (pVM->hm.s.vmx.Msrs.VmxExit.n.allowed1 & VMX_VMCS_CTRL_EXIT_SAVE_VMX_PREEMPT_TIMER))
-            val |= VMX_VMCS_CTRL_EXIT_SAVE_VMX_PREEMPT_TIMER;
-
-        if ((val & zap) != val)
-        {
-            LogRel(("hmR0VmxSetupProcCtls: Invalid VM-exit controls combo! cpu=%RX64 val=%RX64 zap=%RX64\n",
-                    pVM->hm.s.vmx.Msrs.VmxExit.n.disallowed0, val, zap));
+            fVal |= VMX_VMCS_CTRL_EXIT_SAVE_VMX_PREEMPT_TIMER;
+
+        if ((fVal & fZap) != fVal)
+        {
+            LogRel(("hmR0VmxSetupProcCtls: Invalid VM-exit controls combo! cpu=%RX64 fVal=%RX64 fZap=%RX64\n",
+                    pVM->hm.s.vmx.Msrs.VmxExit.n.disallowed0, fVal, fZap));
             pVCpu->hm.s.u32HMError = VMX_UFC_CTRL_EXIT;
             return VERR_HM_UNSUPPORTED_CPU_FEATURE_COMBO;
         }
 
-        rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_EXIT, val);
+        int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_EXIT, fVal);
         AssertRCReturn(rc, rc);
 
-        pVCpu->hm.s.vmx.u32ExitCtls = val;
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_VMX_EXIT_CTLS);
-    }
-    return rc;
+        pVCpu->hm.s.vmx.u32ExitCtls = fVal;
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_VMX_EXIT_CTLS);
+    }
+    return VINF_SUCCESS;
 }
 
@@ -3465 +3360 @@
 
 /**
- * Loads the guest APIC and related state.
+ * Exports the guest APIC TPR state into the VMCS.
  *
  * @returns VBox status code.
  * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data may be
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
  *
  * @remarks No-long-jump zone!!!
  */
-DECLINLINE(int) hmR0VmxLoadGuestApicState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    NOREF(pMixedCtx);
-
-    int rc = VINF_SUCCESS;
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_APIC_STATE))
+static int hmR0VmxExportGuestApicTpr(PVMCPU pVCpu)
+{
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_APIC_TPR)
     {
         if (   PDMHasApic(pVCpu->CTX_SUFF(pVM))
@@ -3495 +3384 @@
                 uint8_t u8Tpr         = 0;
                 uint8_t u8PendingIntr = 0;
-                rc = APICGetTpr(pVCpu, &u8Tpr, &fPendingIntr, &u8PendingIntr);
+                int rc = APICGetTpr(pVCpu, &u8Tpr, &fPendingIntr, &u8PendingIntr);
                 AssertRCReturn(rc, rc);
 
                 /*
-                 * If there are interrupts pending but masked by the TPR, instruct VT-x to cause a TPR-below-threshold VM-exit
-                 * when the guest lowers its TPR below the priority of the pending interrupt so we can deliver the interrupt.
-                 * If there are no interrupts pending, set threshold to 0 to not cause any TPR-below-threshold VM-exits.
+                 * If there are interrupts pending but masked by the TPR, instruct VT-x to
+                 * cause a TPR-below-threshold VM-exit when the guest lowers its TPR below the
+                 * priority of the pending interrupt so we can deliver the interrupt. If there
+                 * are no interrupts pending, set threshold to 0 to not cause any
+                 * TPR-below-threshold VM-exits.
                  */
                 pVCpu->hm.s.vmx.pbVirtApic[XAPIC_OFF_TPR] = u8Tpr;
@@ -3518 +3409 @@
             }
         }
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
-    }
-
-    return rc;
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_APIC_TPR);
+    }
+    return VINF_SUCCESS;
 }
 
@@ -3536 +3426 @@
  * @remarks No-long-jump zone!!!
  */
-DECLINLINE(uint32_t) hmR0VmxGetGuestIntrState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static uint32_t hmR0VmxGetGuestIntrState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
 {
     /*
      * Check if we should inhibit interrupt delivery due to instructions like STI and MOV SS.
      */
-    uint32_t uIntrState = 0;
+    uint32_t fIntrState = 0;
     if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
     {
-        /* If inhibition is active, RIP & RFLAGS should've been accessed (i.e. read previously from the VMCS or from ring-3). */
-        AssertMsg(HMVMXCPU_GST_IS_SET(pVCpu, HMVMX_UPDATED_GUEST_RIP | HMVMX_UPDATED_GUEST_RFLAGS),
-                  ("%#x\n", HMVMXCPU_GST_VALUE(pVCpu)));
+        /* If inhibition is active, RIP & RFLAGS should've been accessed
+           (i.e. read previously from the VMCS or from ring-3). */
+#ifdef VBOX_STRICT
+        uint64_t const fExtrn = ASMAtomicUoReadU64(&pMixedCtx->fExtrn);
+        AssertMsg(!(fExtrn & (CPUMCTX_EXTRN_RIP | CPUMCTX_EXTRN_RFLAGS)), ("%#x\n", fExtrn));
+#endif
         if (pMixedCtx->rip == EMGetInhibitInterruptsPC(pVCpu))
         {
             if (pMixedCtx->eflags.Bits.u1IF)
-                uIntrState = VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI;
+                fIntrState = VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI;
             else
-                uIntrState = VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS;
+                fIntrState = VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS;
         }
         else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
         {
             /*
-             * We can clear the inhibit force flag as even if we go back to the recompiler without executing guest code in
-             * VT-x, the flag's condition to be cleared is met and thus the cleared state is correct.
+             * We can clear the inhibit force flag as even if we go back to the recompiler
+             * without executing guest code in VT-x, the flag's condition to be cleared is
+             * met and thus the cleared state is correct.
              */
             VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
@@ -3574 +3468 @@
         && (pVCpu->hm.s.vmx.u32PinCtls & VMX_VMCS_CTRL_PIN_EXEC_VIRTUAL_NMI))
     {
-        uIntrState |= VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_NMI;
-    }
-
-    return uIntrState;
-}
-
-
-/**
- * Loads the guest's interruptibility-state into the guest-state area in the
+        fIntrState |= VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_NMI;
+    }
+
+    return fIntrState;
+}
+
+
+/**
+ * Exports the guest's interruptibility-state into the guest-state area in the
  * VMCS.
  *
  * @returns VBox status code.
  * @param   pVCpu       The cross context virtual CPU structure.
- * @param   uIntrState  The interruptibility-state to set.
- */
-static int hmR0VmxLoadGuestIntrState(PVMCPU pVCpu, uint32_t uIntrState)
+ * @param   fIntrState  The interruptibility-state to set.
+ */
+static int hmR0VmxExportGuestIntrState(PVMCPU pVCpu, uint32_t fIntrState)
 {
     NOREF(pVCpu);
-    AssertMsg(!(uIntrState & 0xfffffff0), ("%#x\n", uIntrState));   /* Bits 31:4 MBZ. */
-    Assert((uIntrState & 0x3) != 0x3);                              /* Block-by-STI and MOV SS cannot be simultaneously set. */
-    int rc = VMXWriteVmcs32(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, uIntrState);
-    AssertRC(rc);
-    return rc;
-}
-
-
-/**
- * Loads the exception intercepts required for guest execution in the VMCS.
+    AssertMsg(!(fIntrState & 0xfffffff0), ("%#x\n", fIntrState));   /* Bits 31:4 MBZ. */
+    Assert((fIntrState & 0x3) != 0x3);                              /* Block-by-STI and MOV SS cannot be simultaneously set. */
+    return VMXWriteVmcs32(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, fIntrState);
+}
+
+
+/**
+ * Exports the exception intercepts required for guest execution in the VMCS.
  *
  * @returns VBox status code.
  * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data may be
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- */
-static int hmR0VmxLoadGuestXcptIntercepts(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    NOREF(pMixedCtx);
-    int rc = VINF_SUCCESS;
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMM_GUEST_XCPT_INTERCEPTS))
-    {
-        /* The remaining exception intercepts are handled elsewhere, e.g. in hmR0VmxLoadSharedCR0(). */
+ *
+ * @remarks No-long-jump zone!!!
+ */
+static int hmR0VmxExportGuestXcptIntercepts(PVMCPU pVCpu)
+{
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_VMX_GUEST_XCPT_INTERCEPTS)
+    {
+        /* The remaining exception intercepts are handled elsewhere, e.g. in hmR0VmxExportSharedCR0(). */
         if (pVCpu->hm.s.fGIMTrapXcptUD)
             pVCpu->hm.s.vmx.u32XcptBitmap |= RT_BIT(X86_XCPT_UD);
@@ -3626 +3515 @@
         Assert(pVCpu->hm.s.vmx.u32XcptBitmap & RT_BIT_32(X86_XCPT_DB));
 
-        rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_EXCEPTION_BITMAP, pVCpu->hm.s.vmx.u32XcptBitmap);
+        int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_EXCEPTION_BITMAP, pVCpu->hm.s.vmx.u32XcptBitmap);
         AssertRCReturn(rc, rc);
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_VMM_GUEST_XCPT_INTERCEPTS);
-        Log4(("Load[%RU32]: VMX_VMCS32_CTRL_EXCEPTION_BITMAP=%#RX64 fContextUseFlags=%#RX32\n", pVCpu->idCpu,
-              pVCpu->hm.s.vmx.u32XcptBitmap, HMCPU_CF_VALUE(pVCpu)));
-    }
-    return rc;
-}
-
-
-/**
- * Loads the guest's RIP into the guest-state area in the VMCS.
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_VMX_GUEST_XCPT_INTERCEPTS);
+        Log4Func(("VMX_VMCS32_CTRL_EXCEPTION_BITMAP=%#RX64\n", pVCpu->hm.s.vmx.u32XcptBitmap));
+    }
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Exports the guest's RIP into the guest-state area in the VMCS.
  *
  * @returns VBox status code.
@@ -3648 +3536 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0VmxLoadGuestRip(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static int hmR0VmxExportGuestRip(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
 {
     int rc = VINF_SUCCESS;
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_RIP))
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_RIP)
     {
         rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_RIP, pMixedCtx->rip);
         AssertRCReturn(rc, rc);
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_RIP);
-        Log4(("Load[%RU32]: VMX_VMCS_GUEST_RIP=%#RX64 fContextUseFlags=%#RX32\n", pVCpu->idCpu, pMixedCtx->rip,
-              HMCPU_CF_VALUE(pVCpu)));
-
         /* Update the exit history entry with the correct CS.BASE + RIP or just RIP. */
-        if (HMCPU_CF_IS_SET(pVCpu, HM_CHANGED_GUEST_SEGMENT_REGS))
+        if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_CS)
             EMR0HistoryUpdatePC(pVCpu, pMixedCtx->cs.u64Base + pMixedCtx->rip, true);
         else
             EMR0HistoryUpdatePC(pVCpu, pMixedCtx->rip, false);
+
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_RIP);
+        Log4Func(("RIP=%#RX64\n", pMixedCtx->rip));
     }
     return rc;
@@ -3671 +3558 @@
 
 /**
- * Loads the guest's RSP into the guest-state area in the VMCS.
+ * Exports the guest's RSP into the guest-state area in the VMCS.
  *
  * @returns VBox status code.
@@ -3681 +3568 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0VmxLoadGuestRsp(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    int rc = VINF_SUCCESS;
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_RSP))
-    {
-        rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_RSP, pMixedCtx->rsp);
+static int hmR0VmxExportGuestRsp(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
+{
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_RSP)
+    {
+        int rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_RSP, pMixedCtx->rsp);
         AssertRCReturn(rc, rc);
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_RSP);
-        Log4(("Load[%RU32]: VMX_VMCS_GUEST_RSP=%#RX64\n", pVCpu->idCpu, pMixedCtx->rsp));
-    }
-    return rc;
-}
-
-
-/**
- * Loads the guest's RFLAGS into the guest-state area in the VMCS.
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_RSP);
+    }
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Exports the guest's RFLAGS into the guest-state area in the VMCS.
  *
  * @returns VBox status code.
@@ -3707 +3592 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0VmxLoadGuestRflags(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    int rc = VINF_SUCCESS;
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_RFLAGS))
+static int hmR0VmxExportGuestRflags(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
+{
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_RFLAGS)
     {
         /* Intel spec. 2.3.1 "System Flags and Fields in IA-32e Mode" claims the upper 32-bits of RFLAGS are reserved (MBZ).
            Let us assert it as such and use 32-bit VMWRITE. */
         Assert(!(pMixedCtx->rflags.u64 >> 32));
-        X86EFLAGS Eflags = pMixedCtx->eflags;
-        /** @todo r=bird: There shall be no need to OR in X86_EFL_1 here, nor
-         * shall there be any reason for clearing bits 63:22, 15, 5 and 3.
-         * These will never be cleared/set, unless some other part of the VMM
-         * code is buggy - in which case we're better of finding and fixing
-         * those bugs than hiding them. */
-        Assert(Eflags.u32 & X86_EFL_RA1_MASK);
-        Assert(!(Eflags.u32 & ~(X86_EFL_1 | X86_EFL_LIVE_MASK)));
-        Eflags.u32 &= VMX_EFLAGS_RESERVED_0;                   /* Bits 22-31, 15, 5 & 3 MBZ. */
-        Eflags.u32 |= VMX_EFLAGS_RESERVED_1;                   /* Bit 1 MB1. */
+        X86EFLAGS fEFlags = pMixedCtx->eflags;
+        Assert(fEFlags.u32 & X86_EFL_RA1_MASK);
+        Assert(!(fEFlags.u32 & ~(X86_EFL_1 | X86_EFL_LIVE_MASK)));
 
         /*
-         * If we're emulating real-mode using Virtual 8086 mode, save the real-mode eflags so we can restore them on VM-exit.
-         * Modify the real-mode guest's eflags so that VT-x can run the real-mode guest code under Virtual 8086 mode.
+         * If we're emulating real-mode using Virtual 8086 mode, save the real-mode eflags so
+         * we can restore them on VM-exit. Modify the real-mode guest's eflags so that VT-x
+         * can run the real-mode guest code under Virtual 8086 mode.
          */
         if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
@@ -3734 +3612 @@
             Assert(pVCpu->CTX_SUFF(pVM)->hm.s.vmx.pRealModeTSS);
             Assert(PDMVmmDevHeapIsEnabled(pVCpu->CTX_SUFF(pVM)));
-            pVCpu->hm.s.vmx.RealMode.Eflags.u32 = Eflags.u32;  /* Save the original eflags of the real-mode guest. */
-            Eflags.Bits.u1VM   = 1;                            /* Set the Virtual 8086 mode bit. */
-            Eflags.Bits.u2IOPL = 0;                            /* Change IOPL to 0, otherwise certain instructions won't fault. */
-        }
-
-        rc = VMXWriteVmcs32(VMX_VMCS_GUEST_RFLAGS, Eflags.u32);
+            pVCpu->hm.s.vmx.RealMode.Eflags.u32 = fEFlags.u32;  /* Save the original eflags of the real-mode guest. */
+            fEFlags.Bits.u1VM   = 1;                            /* Set the Virtual 8086 mode bit. */
+            fEFlags.Bits.u2IOPL = 0;                            /* Change IOPL to 0, otherwise certain instructions won't fault. */
+        }
+
+        int rc = VMXWriteVmcs32(VMX_VMCS_GUEST_RFLAGS, fEFlags.u32);
         AssertRCReturn(rc, rc);
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_RFLAGS);
-        Log4(("Load[%RU32]: VMX_VMCS_GUEST_RFLAGS=%#RX32\n", pVCpu->idCpu, Eflags.u32));
-    }
-    return rc;
-}
-
-
-/**
- * Loads the guest RIP, RSP and RFLAGS into the guest-state area in the VMCS.
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_RFLAGS);
+        Log4Func(("EFlags=%#RX32\n", fEFlags.u32));
+    }
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Exports the guest CR0 control register into the guest-state area in the VMCS.
+ *
+ * The guest FPU state is always pre-loaded hence we don't need to bother about
+ * sharing FPU related CR0 bits between the guest and host.
  *
  * @returns VBox status code.
@@ -3760 +3641 @@
  * @remarks No-long-jump zone!!!
  */
-DECLINLINE(int) hmR0VmxLoadGuestRipRspRflags(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    int rc = hmR0VmxLoadGuestRip(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxLoadGuestRsp(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxLoadGuestRflags(pVCpu, pMixedCtx);
-    AssertRCReturn(rc, rc);
-    return rc;
-}
-
-
-/**
- * Loads the guest CR0 control register into the guest-state area in the VMCS.
- * CR0 is partially shared with the host and we have to consider the FPU bits.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data may be
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxLoadSharedCR0(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    Assert(CPUMIsGuestFPUStateActive(pVCpu));
-
-    /*
-     * Guest CR0.
-     * Guest FPU.
-     */
-    int rc = VINF_SUCCESS;
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR0))
-    {
-        Assert(!(pMixedCtx->cr0 >> 32));
-        uint32_t u32GuestCR0 = pMixedCtx->cr0;
-        PVM      pVM         = pVCpu->CTX_SUFF(pVM);
-
-        /* The guest's view (read access) of its CR0 is unblemished. */
-        rc  = VMXWriteVmcs32(VMX_VMCS_CTRL_CR0_READ_SHADOW, u32GuestCR0);
-        AssertRCReturn(rc, rc);
-        Log4(("Load[%RU32]: VMX_VMCS_CTRL_CR0_READ_SHADOW=%#RX32\n", pVCpu->idCpu, u32GuestCR0));
-
-        /* Setup VT-x's view of the guest CR0. */
-        /* Minimize VM-exits due to CR3 changes when we have NestedPaging. */
+static int hmR0VmxExportGuestCR0(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
+{
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_CR0)
+    {
+        PVM pVM = pVCpu->CTX_SUFF(pVM);
+        Assert(!RT_HI_U32(pMixedCtx->cr0));
+        uint32_t const uShadowCR0 = pMixedCtx->cr0;
+        uint32_t       uGuestCR0  = pMixedCtx->cr0;
+
+        /*
+         * Setup VT-x's view of the guest CR0.
+         * Minimize VM-exits due to CR3 changes when we have NestedPaging.
+         */
+        uint32_t uProcCtls = pVCpu->hm.s.vmx.u32ProcCtls;
         if (pVM->hm.s.fNestedPaging)
         {
-            if (CPUMIsGuestPagingEnabledEx(pMixedCtx))
+            if (CPUMIsGuestPagingEnabled(pVCpu))
             {
                 /* The guest has paging enabled, let it access CR3 without causing a VM-exit if supported. */
-                pVCpu->hm.s.vmx.u32ProcCtls &= ~(  VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
-                                                 | VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT);
+                uProcCtls &= ~(  VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
+                               | VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT);
             }
             else
             {
                 /* The guest doesn't have paging enabled, make CR3 access cause a VM-exit to update our shadow. */
-                pVCpu->hm.s.vmx.u32ProcCtls |=   VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
-                                               | VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT;
+                uProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_CR3_LOAD_EXIT
+                          |  VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT;
             }
 
             /* If we have unrestricted guest execution, we never have to intercept CR3 reads. */
             if (pVM->hm.s.vmx.fUnrestrictedGuest)
-                pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT;
-
-            rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
-            AssertRCReturn(rc, rc);
+                uProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_CR3_STORE_EXIT;
         }
         else
-            u32GuestCR0 |= X86_CR0_WP;     /* Guest CPL 0 writes to its read-only pages should cause a #PF VM-exit. */
+        {
+            /* Guest CPL 0 writes to its read-only pages should cause a #PF VM-exit. */
+            uGuestCR0 |= X86_CR0_WP;
+        }
 
         /*
          * Guest FPU bits.
-         * Intel spec. 23.8 "Restrictions on VMX operation" mentions that CR0.NE bit must always be set on the first
-         * CPUs to support VT-x and no mention of with regards to UX in VM-entry checks.
+         *
+         * Since we pre-load the guest FPU always before VM-entry there is no need to track lazy state
+         * using CR0.TS.
+         *
+         * Intel spec. 23.8 "Restrictions on VMX operation" mentions that CR0.NE bit must always be
+         * set on the first CPUs to support VT-x and no mention of with regards to UX in VM-entry checks.
          */
-        u32GuestCR0 |= X86_CR0_NE;
-
-        /* Catch floating point exceptions if we need to report them to the guest in a different way. */
-        bool fInterceptMF = false;
-        if (!(pMixedCtx->cr0 & X86_CR0_NE))
-            fInterceptMF = true;
-
-        /* Finally, intercept all exceptions as we cannot directly inject them in real-mode, see hmR0VmxInjectEventVmcs(). */
+        uGuestCR0 |= X86_CR0_NE;
+
+        /* If CR0.NE isn't set, we need to intercept #MF exceptions and report them to the guest differently. */
+        bool const fInterceptMF = !(uShadowCR0 & X86_CR0_NE);
+
+        /*
+         * Update exception intercepts.
+         */
+        uint32_t uXcptBitmap = pVCpu->hm.s.vmx.u32XcptBitmap;
         if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
         {
             Assert(PDMVmmDevHeapIsEnabled(pVM));
             Assert(pVM->hm.s.vmx.pRealModeTSS);
-            pVCpu->hm.s.vmx.u32XcptBitmap |= HMVMX_REAL_MODE_XCPT_MASK;
+            uXcptBitmap |= HMVMX_REAL_MODE_XCPT_MASK;
         }
         else
         {
             /* For now, cleared here as mode-switches can happen outside HM/VT-x. See @bugref{7626#c11}. */
-            pVCpu->hm.s.vmx.u32XcptBitmap &= ~HMVMX_REAL_MODE_XCPT_MASK;
+            uXcptBitmap &= ~HMVMX_REAL_MODE_XCPT_MASK;
             if (fInterceptMF)
-                pVCpu->hm.s.vmx.u32XcptBitmap |= RT_BIT(X86_XCPT_MF);
-        }
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_VMM_GUEST_XCPT_INTERCEPTS);
+                uXcptBitmap |= RT_BIT(X86_XCPT_MF);
+        }
 
         /* Additional intercepts for debugging, define these yourself explicitly. */
 #ifdef HMVMX_ALWAYS_TRAP_ALL_XCPTS
-        pVCpu->hm.s.vmx.u32XcptBitmap |= 0
-                                         | RT_BIT(X86_XCPT_BP)
-                                         | RT_BIT(X86_XCPT_DE)
-                                         | RT_BIT(X86_XCPT_NM)
-                                         | RT_BIT(X86_XCPT_TS)
-                                         | RT_BIT(X86_XCPT_UD)
-                                         | RT_BIT(X86_XCPT_NP)
-                                         | RT_BIT(X86_XCPT_SS)
-                                         | RT_BIT(X86_XCPT_GP)
-                                         | RT_BIT(X86_XCPT_PF)
-                                         | RT_BIT(X86_XCPT_MF)
-                                         ;
+        uXcptBitmap |= 0
+                    | RT_BIT(X86_XCPT_BP)
+                    | RT_BIT(X86_XCPT_DE)
+                    | RT_BIT(X86_XCPT_NM)
+                    | RT_BIT(X86_XCPT_TS)
+                    | RT_BIT(X86_XCPT_UD)
+                    | RT_BIT(X86_XCPT_NP)
+                    | RT_BIT(X86_XCPT_SS)
+                    | RT_BIT(X86_XCPT_GP)
+                    | RT_BIT(X86_XCPT_PF)
+                    | RT_BIT(X86_XCPT_MF)
+                    ;
 #elif defined(HMVMX_ALWAYS_TRAP_PF)
-        pVCpu->hm.s.vmx.u32XcptBitmap    |= RT_BIT(X86_XCPT_PF);
+        uXcptBitmap |= RT_BIT(X86_XCPT_PF);
 #endif
-
+        if (uXcptBitmap != pVCpu->hm.s.vmx.u32XcptBitmap)
+        {
+            pVCpu->hm.s.vmx.u32XcptBitmap = uXcptBitmap;
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_VMX_GUEST_XCPT_INTERCEPTS);
+        }
         Assert(pVM->hm.s.fNestedPaging || (pVCpu->hm.s.vmx.u32XcptBitmap & RT_BIT(X86_XCPT_PF)));
 
-        /* Set/clear the CR0 specific bits along with their exceptions (PE, PG, CD, NW). */
-        uint32_t uSetCR0 = (uint32_t)(pVM->hm.s.vmx.Msrs.u64Cr0Fixed0 & pVM->hm.s.vmx.Msrs.u64Cr0Fixed1);
-        uint32_t uZapCR0 = (uint32_t)(pVM->hm.s.vmx.Msrs.u64Cr0Fixed0 | pVM->hm.s.vmx.Msrs.u64Cr0Fixed1);
-        if (pVM->hm.s.vmx.fUnrestrictedGuest)               /* Exceptions for unrestricted-guests for fixed CR0 bits (PE, PG). */
-            uSetCR0 &= ~(X86_CR0_PE | X86_CR0_PG);
+        /*
+         * Set/clear the CR0 specific bits along with their exceptions (PE, PG, CD, NW).
+         */
+        uint32_t fSetCR0 = (uint32_t)(pVM->hm.s.vmx.Msrs.u64Cr0Fixed0 & pVM->hm.s.vmx.Msrs.u64Cr0Fixed1);
+        uint32_t fZapCR0 = (uint32_t)(pVM->hm.s.vmx.Msrs.u64Cr0Fixed0 | pVM->hm.s.vmx.Msrs.u64Cr0Fixed1);
+        if (pVM->hm.s.vmx.fUnrestrictedGuest)             /* Exceptions for unrestricted-guests for fixed CR0 bits (PE, PG). */
+            fSetCR0 &= ~(X86_CR0_PE | X86_CR0_PG);
         else
-            Assert((uSetCR0 & (X86_CR0_PE | X86_CR0_PG)) == (X86_CR0_PE | X86_CR0_PG));
-
-        u32GuestCR0 |= uSetCR0;
-        u32GuestCR0 &= uZapCR0;
-        u32GuestCR0 &= ~(X86_CR0_CD | X86_CR0_NW);          /* Always enable caching. */
-
-        /* Write VT-x's view of the guest CR0 into the VMCS. */
-        rc = VMXWriteVmcs32(VMX_VMCS_GUEST_CR0, u32GuestCR0);
-        AssertRCReturn(rc, rc);
-        Log4(("Load[%RU32]: VMX_VMCS_GUEST_CR0=%#RX32 (uSetCR0=%#RX32 uZapCR0=%#RX32)\n", pVCpu->idCpu, u32GuestCR0, uSetCR0,
-              uZapCR0));
+            Assert((fSetCR0 & (X86_CR0_PE | X86_CR0_PG)) == (X86_CR0_PE | X86_CR0_PG));
+
+        uGuestCR0 |= fSetCR0;
+        uGuestCR0 &= fZapCR0;
+        uGuestCR0 &= ~(X86_CR0_CD | X86_CR0_NW);          /* Always enable caching. */
 
         /*
@@ -3900 +3755 @@
          * we want to be notified immediately of guest CR0 changes (e.g. PG to update our shadow page tables).
          */
-        uint32_t u32CR0Mask = 0;
-        u32CR0Mask =  X86_CR0_PE
-                    | X86_CR0_NE
-                    | X86_CR0_WP
-                    | X86_CR0_PG
-                    | X86_CR0_ET    /* Bit ignored on VM-entry and VM-exit. Don't let the guest modify the host CR0.ET */
-                    | X86_CR0_CD    /* Bit ignored on VM-entry and VM-exit. Don't let the guest modify the host CR0.CD */
-                    | X86_CR0_NW;   /* Bit ignored on VM-entry and VM-exit. Don't let the guest modify the host CR0.NW */
+        uint32_t uCR0Mask = X86_CR0_PE
+                          | X86_CR0_NE
+                          | (pVM->hm.s.fNestedPaging ? 0 : X86_CR0_WP)
+                          | X86_CR0_PG
+                          | X86_CR0_ET    /* Bit ignored on VM-entry and VM-exit. Don't let the guest modify the host CR0.ET */
+                          | X86_CR0_CD    /* Bit ignored on VM-entry and VM-exit. Don't let the guest modify the host CR0.CD */
+                          | X86_CR0_NW;   /* Bit ignored on VM-entry and VM-exit. Don't let the guest modify the host CR0.NW */
 
         /** @todo Avoid intercepting CR0.PE with unrestricted guests. Fix PGM
@@ -3914 +3768 @@
 #if 0
         if (pVM->hm.s.vmx.fUnrestrictedGuest)
-            u32CR0Mask &= ~X86_CR0_PE;
+            uCr0Mask &= ~X86_CR0_PE;
 #endif
-        if (pVM->hm.s.fNestedPaging)
-            u32CR0Mask &= ~X86_CR0_WP;
-
-        /* Write the CR0 mask into the VMCS and update the VCPU's copy of the current CR0 mask. */
-        pVCpu->hm.s.vmx.u32CR0Mask = u32CR0Mask;
-        rc = VMXWriteVmcs32(VMX_VMCS_CTRL_CR0_MASK, u32CR0Mask);
+        /* Update the HMCPU's copy of the CR0 mask. */
+        pVCpu->hm.s.vmx.u32CR0Mask = uCR0Mask;
+
+        /*
+         * Finally, update VMCS fields with the CR0 values.
+         */
+        int rc = VMXWriteVmcs32(VMX_VMCS_GUEST_CR0, uGuestCR0);
+        rc    |= VMXWriteVmcs32(VMX_VMCS_CTRL_CR0_READ_SHADOW, uShadowCR0);
+        rc    |= VMXWriteVmcs32(VMX_VMCS_CTRL_CR0_MASK, uCR0Mask);
+        if (uProcCtls != pVCpu->hm.s.vmx.u32ProcCtls)
+            rc |= VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, uProcCtls);
         AssertRCReturn(rc, rc);
-        Log4(("Load[%RU32]: VMX_VMCS_CTRL_CR0_MASK=%#RX32\n", pVCpu->idCpu, u32CR0Mask));
-
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_CR0);
-    }
-    return rc;
-}
-
-
-/**
- * Loads the guest control registers (CR3, CR4) into the guest-state area
+        pVCpu->hm.s.vmx.u32ProcCtls = uProcCtls;
+
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_CR0);
+
+        Log4Func(("uCr0Mask=%#RX32 uShadowCR0=%#RX32 uGuestCR0=%#RX32 (fSetCR0=%#RX32 fZapCR0=%#RX32\n", uCR0Mask, uShadowCR0,
+                  uGuestCR0, fSetCR0, fZapCR0));
+    }
+
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Exports the guest control registers (CR3, CR4) into the guest-state area
  * in the VMCS.
  *
@@ -3947 +3810 @@
  * @remarks No-long-jump zone!!!
  */
-static VBOXSTRICTRC hmR0VmxLoadGuestCR3AndCR4(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static VBOXSTRICTRC hmR0VmxExportGuestCR3AndCR4(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
 {
     int rc  = VINF_SUCCESS;
@@ -3960 +3823 @@
      * Guest CR3.
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR3))
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_CR3)
     {
         RTGCPHYS GCPhysGuestCR3 = NIL_RTGCPHYS;
@@ -3986 +3849 @@
             rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.HCPhysEPTP);
             AssertRCReturn(rc, rc);
-            Log4(("Load[%RU32]: VMX_VMCS64_CTRL_EPTP_FULL=%#RX64\n", pVCpu->idCpu, pVCpu->hm.s.vmx.HCPhysEPTP));
 
             if (   pVM->hm.s.vmx.fUnrestrictedGuest
@@ -4003 +3865 @@
                 }
 
-                /* The guest's view of its CR3 is unblemished with Nested Paging when the guest is using paging or we
-                   have Unrestricted Execution to handle the guest when it's not using paging. */
+                /*
+                 * The guest's view of its CR3 is unblemished with Nested Paging when the
+                 * guest is using paging or we have unrestricted guest execution to handle
+                 * the guest when it's not using paging.
+                 */
                 GCPhysGuestCR3 = pMixedCtx->cr3;
             }
@@ -4010 +3875 @@
             {
                 /*
-                 * The guest is not using paging, but the CPU (VT-x) has to. While the guest thinks it accesses physical memory
-                 * directly, we use our identity-mapped page table to map guest-linear to guest-physical addresses.
-                 * EPT takes care of translating it to host-physical addresses.
+                 * The guest is not using paging, but the CPU (VT-x) has to. While the guest
+                 * thinks it accesses physical memory directly, we use our identity-mapped
+                 * page  table to map guest-linear to guest-physical addresses. EPT takes care
+                 * of translating it to host-physical addresses.
                  */
                 RTGCPHYS GCPhys;
@@ -4023 +3889 @@
                 else if (rc == VERR_PDM_DEV_HEAP_R3_TO_GCPHYS)
                 {
-                    Log4(("Load[%RU32]: VERR_PDM_DEV_HEAP_R3_TO_GCPHYS -> VINF_EM_RESCHEDULE_REM\n", pVCpu->idCpu));
+                    Log4Func(("VERR_PDM_DEV_HEAP_R3_TO_GCPHYS -> VINF_EM_RESCHEDULE_REM\n"));
                     return VINF_EM_RESCHEDULE_REM;  /* We cannot execute now, switch to REM/IEM till the guest maps in VMMDev. */
                 }
@@ -4032 +3898 @@
             }
 
-            Log4(("Load[%RU32]: VMX_VMCS_GUEST_CR3=%#RGp (GstN)\n", pVCpu->idCpu, GCPhysGuestCR3));
+            Log4Func(("uGuestCR3=%#RGp (GstN)\n", GCPhysGuestCR3));
             rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_CR3, GCPhysGuestCR3);
+            AssertRCReturn(rc, rc);
         }
         else
@@ -4040 +3907 @@
             RTHCPHYS HCPhysGuestCR3 = PGMGetHyperCR3(pVCpu);
 
-            Log4(("Load[%RU32]: VMX_VMCS_GUEST_CR3=%#RHv (HstN)\n", pVCpu->idCpu, HCPhysGuestCR3));
+            Log4Func(("uGuestCR3=%#RHv (HstN)\n", HCPhysGuestCR3));
             rc = VMXWriteVmcsHstN(VMX_VMCS_GUEST_CR3, HCPhysGuestCR3);
-        }
-        AssertRCReturn(rc, rc);
-
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_CR3);
+            AssertRCReturn(rc, rc);
+        }
+
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_CR3);
     }
 
@@ -4052 +3919 @@
      * ASSUMES this is done everytime we get in from ring-3! (XCR0)
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR4))
-    {
-        Assert(!(pMixedCtx->cr4 >> 32));
-        uint32_t u32GuestCR4 = pMixedCtx->cr4;
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_CR4)
+    {
+        Assert(!RT_HI_U32(pMixedCtx->cr4));
+        uint32_t uGuestCR4 = pMixedCtx->cr4;
 
         /* The guest's view of its CR4 is unblemished. */
-        rc = VMXWriteVmcs32(VMX_VMCS_CTRL_CR4_READ_SHADOW, u32GuestCR4);
+        rc = VMXWriteVmcs32(VMX_VMCS_CTRL_CR4_READ_SHADOW, uGuestCR4);
         AssertRCReturn(rc, rc);
-        Log4(("Load[%RU32]: VMX_VMCS_CTRL_CR4_READ_SHADOW=%#RX32\n", pVCpu->idCpu, u32GuestCR4));
-
-        /* Setup VT-x's view of the guest CR4. */
+        Log4Func(("uShadowCR4=%#RX32\n", uGuestCR4));
+
         /*
-         * If we're emulating real-mode using virtual-8086 mode, we want to redirect software interrupts to the 8086 program
-         * interrupt handler. Clear the VME bit (the interrupt redirection bitmap is already all 0, see hmR3InitFinalizeR0())
+         * Setup VT-x's view of the guest CR4.
+         *
+         * If we're emulating real-mode using virtual-8086 mode, we want to redirect software
+         * interrupts to the 8086 program interrupt handler. Clear the VME bit (the interrupt
+         * redirection bitmap is already all 0, see hmR3InitFinalizeR0())
+         *
          * See Intel spec. 20.2 "Software Interrupt Handling Methods While in Virtual-8086 Mode".
          */
@@ -4072 +3942 @@
             Assert(pVM->hm.s.vmx.pRealModeTSS);
             Assert(PDMVmmDevHeapIsEnabled(pVM));
-            u32GuestCR4 &= ~X86_CR4_VME;
+            uGuestCR4 &= ~X86_CR4_VME;
         }
 
@@ -4081 +3951 @@
             {
                 /* We use 4 MB pages in our identity mapping page table when the guest doesn't have paging. */
-                u32GuestCR4 |= X86_CR4_PSE;
+                uGuestCR4 |= X86_CR4_PSE;
                 /* Our identity mapping is a 32-bit page directory. */
-                u32GuestCR4 &= ~X86_CR4_PAE;
+                uGuestCR4 &= ~X86_CR4_PAE;
             }
             /* else use guest CR4.*/
@@ -4099 +3969 @@
                 case PGMMODE_32_BIT:            /* 32-bit paging. */
                 {
-                    u32GuestCR4 &= ~X86_CR4_PAE;
+                    uGuestCR4 &= ~X86_CR4_PAE;
                     break;
                 }
@@ -4106 +3976 @@
                 case PGMMODE_PAE_NX:            /* PAE paging with NX. */
                 {
-                    u32GuestCR4 |= X86_CR4_PAE;
+                    uGuestCR4 |= X86_CR4_PAE;
                     break;
                 }
@@ -4122 +3992 @@
 
         /* We need to set and clear the CR4 specific bits here (mainly the X86_CR4_VMXE bit). */
-        uint64_t uSetCR4 = (pVM->hm.s.vmx.Msrs.u64Cr4Fixed0 & pVM->hm.s.vmx.Msrs.u64Cr4Fixed1);
-        uint64_t uZapCR4 = (pVM->hm.s.vmx.Msrs.u64Cr4Fixed0 | pVM->hm.s.vmx.Msrs.u64Cr4Fixed1);
-        u32GuestCR4 |= uSetCR4;
-        u32GuestCR4 &= uZapCR4;
+        uint64_t fSetCR4 = (pVM->hm.s.vmx.Msrs.u64Cr4Fixed0 & pVM->hm.s.vmx.Msrs.u64Cr4Fixed1);
+        uint64_t fZapCR4 = (pVM->hm.s.vmx.Msrs.u64Cr4Fixed0 | pVM->hm.s.vmx.Msrs.u64Cr4Fixed1);
+        uGuestCR4 |= fSetCR4;
+        uGuestCR4 &= fZapCR4;
 
         /* Write VT-x's view of the guest CR4 into the VMCS. */
-        Log4(("Load[%RU32]: VMX_VMCS_GUEST_CR4=%#RX32 (Set=%#RX32 Zap=%#RX32)\n", pVCpu->idCpu, u32GuestCR4, uSetCR4, uZapCR4));
-        rc = VMXWriteVmcs32(VMX_VMCS_GUEST_CR4, u32GuestCR4);
+        Log4Func(("uGuestCR4=%#RX32 (fSetCR4=%#RX32 fZapCR4=%#RX32)\n", uGuestCR4, fSetCR4, fZapCR4));
+        rc = VMXWriteVmcs32(VMX_VMCS_GUEST_CR4, uGuestCR4);
         AssertRCReturn(rc, rc);
 
@@ -4149 +4019 @@
         pVCpu->hm.s.fLoadSaveGuestXcr0 = (pMixedCtx->cr4 & X86_CR4_OSXSAVE) && pMixedCtx->aXcr[0] != ASMGetXcr0();
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_CR4);
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_CR4);
     }
     return rc;
@@ -4156 +4026 @@
 
 /**
- * Loads the guest debug registers into the guest-state area in the VMCS.
+ * Exports the guest debug registers into the guest-state area in the VMCS.
+ * The guest debug bits are partially shared with the host (e.g. DR6, DR0-3).
  *
  * This also sets up whether \#DB and MOV DRx accesses cause VM-exits.
- *
- * The guest debug bits are partially shared with the host (e.g. DR6, DR0-3).
  *
  * @returns VBox status code.
@@ -4170 +4039 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0VmxLoadSharedDebugState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    if (!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_DEBUG))
-        return VINF_SUCCESS;
+static int hmR0VmxExportSharedDebugState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
 
 #ifdef VBOX_STRICT
@@ -4185 +4053 @@
 #endif
 
-    int  rc;
-    PVM  pVM              = pVCpu->CTX_SUFF(pVM);
-    bool fSteppingDB      = false;
-    bool fInterceptMovDRx = false;
+    bool     fSteppingDB      = false;
+    bool     fInterceptMovDRx = false;
+    uint32_t uProcCtls        = pVCpu->hm.s.vmx.u32ProcCtls;
     if (pVCpu->hm.s.fSingleInstruction)
     {
         /* If the CPU supports the monitor trap flag, use it for single stepping in DBGF and avoid intercepting #DB. */
+        PVM pVM = pVCpu->CTX_SUFF(pVM);
         if (pVM->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_MONITOR_TRAP_FLAG)
         {
-            pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_MONITOR_TRAP_FLAG;
-            rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
-            AssertRCReturn(rc, rc);
+            uProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_MONITOR_TRAP_FLAG;
             Assert(fSteppingDB == false);
         }
@@ -4202 +4068 @@
         {
             pMixedCtx->eflags.u32 |= X86_EFL_TF;
+            pVCpu->hm.s.fCtxChanged |= HM_CHANGED_GUEST_RFLAGS;
             pVCpu->hm.s.fClearTrapFlag = true;
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RFLAGS);
             fSteppingDB = true;
         }
     }
 
+    uint32_t uGuestDR7;
     if (   fSteppingDB
         || (CPUMGetHyperDR7(pVCpu) & X86_DR7_ENABLED_MASK))
     {
         /*
-         * Use the combined guest and host DRx values found in the hypervisor
-         * register set because the debugger has breakpoints active or someone
-         * is single stepping on the host side without a monitor trap flag.
+         * Use the combined guest and host DRx values found in the hypervisor register set
+         * because the debugger has breakpoints active or someone is single stepping on the
+         * host side without a monitor trap flag.
          *
          * Note! DBGF expects a clean DR6 state before executing guest code.
          */
 #if HC_ARCH_BITS == 32 && defined(VBOX_WITH_64_BITS_GUESTS)
-        if (   CPUMIsGuestInLongModeEx(pMixedCtx)
+        if (    CPUMIsGuestInLongModeEx(pMixedCtx)
             && !CPUMIsHyperDebugStateActivePending(pVCpu))
         {
@@ -4235 +4102 @@
         }
 
-        /* Update DR7. (The other DRx values are handled by CPUM one way or the other.) */
-        rc = VMXWriteVmcs32(VMX_VMCS_GUEST_DR7, (uint32_t)CPUMGetHyperDR7(pVCpu));
-        AssertRCReturn(rc, rc);
-
+        /* Update DR7 with the hypervisor value (other DRx registers are handled by CPUM one way or another). */
+        uGuestDR7 = (uint32_t)CPUMGetHyperDR7(pVCpu);
         pVCpu->hm.s.fUsingHyperDR7 = true;
         fInterceptMovDRx = true;
@@ -4248 +4113 @@
          * executing guest code so they'll trigger at the right time.
          */
-        if (pMixedCtx->dr[7] & (X86_DR7_ENABLED_MASK | X86_DR7_GD)) /** @todo Why GD? */
+        if (pMixedCtx->dr[7] & X86_DR7_ENABLED_MASK)
         {
 #if HC_ARCH_BITS == 32 && defined(VBOX_WITH_64_BITS_GUESTS)
-            if (   CPUMIsGuestInLongModeEx(pMixedCtx)
+            if (    CPUMIsGuestInLongModeEx(pMixedCtx)
                 && !CPUMIsGuestDebugStateActivePending(pVCpu))
             {
@@ -4286 +4151 @@
         }
 
-        /* Update guest DR7. */
-        rc = VMXWriteVmcs32(VMX_VMCS_GUEST_DR7, pMixedCtx->dr[7]);
-        AssertRCReturn(rc, rc);
-
+        /* Update DR7 with the actual guest value. */
+        uGuestDR7 = pMixedCtx->dr[7];
         pVCpu->hm.s.fUsingHyperDR7 = false;
     }
 
+    if (fInterceptMovDRx)
+        uProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT;
+    else
+        uProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT;
+
     /*
-     * Update the processor-based VM-execution controls regarding intercepting MOV DRx instructions.
+     * Update the processor-based VM-execution controls for MOV-DRx intercepts and the monitor-trap flag.
      */
-    if (fInterceptMovDRx)
-        pVCpu->hm.s.vmx.u32ProcCtls |= VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT;
-    else
-        pVCpu->hm.s.vmx.u32ProcCtls &= ~VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT;
-    rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
+    if (uProcCtls != pVCpu->hm.s.vmx.u32ProcCtls)
+    {
+        int rc2 = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
+        AssertRCReturn(rc2, rc2);
+        pVCpu->hm.s.vmx.u32ProcCtls = uProcCtls;
+    }
+
+    /*
+     * Update guest DR7.
+     */
+    int rc = VMXWriteVmcs32(VMX_VMCS_GUEST_DR7, uGuestDR7);
     AssertRCReturn(rc, rc);
 
-    HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_DEBUG);
     return VINF_SUCCESS;
 }
@@ -4312 +4185 @@
  * Strict function to validate segment registers.
  *
- * @remarks ASSUMES CR0 is up to date.
- */
-static void hmR0VmxValidateSegmentRegs(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
-{
-    /* Validate segment registers. See Intel spec. 26.3.1.2 "Checks on Guest Segment Registers". */
-    /* NOTE: The reason we check for attribute value 0 and not just the unusable bit here is because hmR0VmxWriteSegmentReg()
-     * only updates the VMCS' copy of the value with the unusable bit and doesn't change the guest-context value. */
+ * @remarks Will import guest CR0 on strict builds during validation of
+ *          segments.
+ */
+static void hmR0VmxValidateSegmentRegs(PVM pVM, PVMCPU pVCpu, PCCPUMCTX pCtx)
+{
+    /*
+     * Validate segment registers. See Intel spec. 26.3.1.2 "Checks on Guest Segment Registers".
+     *
+     * The reason we check for attribute value 0 in this function and not just the unusable bit is
+     * because hmR0VmxWriteSegmentReg() only updates the VMCS' copy of the value with the unusable bit
+     * and doesn't change the guest-context value.
+     */
+    hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_CR0);
     if (   !pVM->hm.s.vmx.fUnrestrictedGuest
         && (   !CPUMIsGuestInRealModeEx(pCtx)
@@ -4492 +4371 @@
  */
 static int hmR0VmxWriteSegmentReg(PVMCPU pVCpu, uint32_t idxSel, uint32_t idxLimit, uint32_t idxBase,
-                                       uint32_t idxAccess, PCPUMSELREG pSelReg)
+                                       uint32_t idxAccess, PCCPUMSELREG pSelReg)
 {
     int rc = VMXWriteVmcs32(idxSel,    pSelReg->Sel);       /* 16-bit guest selector field. */
@@ -4510 +4389 @@
     {
         /*
-         * The way to differentiate between whether this is really a null selector or was just a selector loaded with 0 in
-         * real-mode is using the segment attributes. A selector loaded in real-mode with the value 0 is valid and usable in
-         * protected-mode and we should -not- mark it as an unusable segment. Both the recompiler & VT-x ensures NULL selectors
-         * loaded in protected-mode have their attribute as 0.
+         * The way to differentiate between whether this is really a null selector or was just
+         * a selector loaded with 0 in real-mode is using the segment attributes. A selector
+         * loaded in real-mode with the value 0 is valid and usable in protected-mode and we
+         * should -not- mark it as an unusable segment. Both the recompiler & VT-x ensures
+         * NULL selectors loaded in protected-mode have their attribute as 0.
          */
         if (!u32Access)
@@ -4530 +4410 @@
 
 /**
- * Loads the guest segment registers, GDTR, IDTR, LDTR, (TR, FS and GS bases)
+ * Exports the guest segment registers, GDTR, IDTR, LDTR, (TR, FS and GS bases)
  * into the guest-state area in the VMCS.
  *
@@ -4539 +4419 @@
  *                      before using them.
  *
- * @remarks ASSUMES pMixedCtx->cr0 is up to date (strict builds validation).
+ * @remarks Will import guest CR0 on strict builds during validation of
+ *          segments.
  * @remarks No-long-jump zone!!!
  */
-static int hmR0VmxLoadGuestSegmentRegs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static int hmR0VmxExportGuestSegmentRegs(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
 {
     int rc  = VERR_INTERNAL_ERROR_5;
@@ -4550 +4431 @@
      * Guest Segment registers: CS, SS, DS, ES, FS, GS.
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_SEGMENT_REGS))
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_SREG_MASK)
     {
         /* Save the segment attributes for real-on-v86 mode hack, so we can restore them on VM-exit. */
@@ -4574 +4455 @@
                    in real-mode (e.g. OpenBSD 4.0) */
                 REMFlushTBs(pVM);
-                Log4(("Load[%RU32]: Switch to protected mode detected!\n", pVCpu->idCpu));
+                Log4Func(("Switch to protected mode detected!\n"));
                 pVCpu->hm.s.vmx.fWasInRealMode = false;
             }
@@ -4603 +4484 @@
 #endif
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_SEGMENT_REGS);
-        Log4(("Load[%RU32]: CS=%#RX16 Base=%#RX64 Limit=%#RX32 Attr=%#RX32\n", pVCpu->idCpu, pMixedCtx->cs.Sel,
-              pMixedCtx->cs.u64Base, pMixedCtx->cs.u32Limit, pMixedCtx->cs.Attr.u));
-
         /* Update the exit history entry with the correct CS.BASE + RIP. */
-        if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_RIP))
+        if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_RIP)
             EMR0HistoryUpdatePC(pVCpu, pMixedCtx->cs.u64Base + pMixedCtx->rip, true);
+
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_SREG_MASK);
+        Log4Func(("CS=%#RX16 Base=%#RX64 Limit=%#RX32 Attr=%#RX32\n", pMixedCtx->cs.Sel, pMixedCtx->cs.u64Base,
+                  pMixedCtx->cs.u32Limit, pMixedCtx->cs.Attr.u));
     }
 
@@ -4615 +4496 @@
      * Guest TR.
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_TR))
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_TR)
     {
         /*
@@ -4675 +4556 @@
         AssertRCReturn(rc, rc);
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_TR);
-        Log4(("Load[%RU32]: VMX_VMCS_GUEST_TR_BASE=%#RX64\n", pVCpu->idCpu, u64Base));
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_TR);
+        Log4Func(("TR base=%#RX64\n", pMixedCtx->tr.u64Base));
     }
 
@@ -4682 +4563 @@
      * Guest GDTR.
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_GDTR))
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_GDTR)
     {
         rc  = VMXWriteVmcs32(VMX_VMCS32_GUEST_GDTR_LIMIT, pMixedCtx->gdtr.cbGdt);
@@ -4691 +4572 @@
         Assert(!(pMixedCtx->gdtr.cbGdt & 0xffff0000));          /* Bits 31:16 MBZ. */
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_GDTR);
-        Log4(("Load[%RU32]: VMX_VMCS_GUEST_GDTR_BASE=%#RX64\n", pVCpu->idCpu, pMixedCtx->gdtr.pGdt));
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_GDTR);
+        Log4Func(("GDTR base=%#RX64\n", pMixedCtx->gdtr.pGdt));
     }
 
@@ -4698 +4579 @@
      * Guest LDTR.
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_LDTR))
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_LDTR)
     {
         /* The unusable bit is specific to VT-x, if it's a null selector mark it as an unusable segment. */
@@ -4728 +4609 @@
         }
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_LDTR);
-        Log4(("Load[%RU32]: VMX_VMCS_GUEST_LDTR_BASE=%#RX64\n", pVCpu->idCpu, pMixedCtx->ldtr.u64Base));
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_LDTR);
+        Log4Func(("LDTR base=%#RX64\n", pMixedCtx->ldtr.u64Base));
     }
 
@@ -4735 +4616 @@
      * Guest IDTR.
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_IDTR))
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_IDTR)
     {
         rc  = VMXWriteVmcs32(VMX_VMCS32_GUEST_IDTR_LIMIT, pMixedCtx->idtr.cbIdt);
@@ -4744 +4625 @@
         Assert(!(pMixedCtx->idtr.cbIdt & 0xffff0000));          /* Bits 31:16 MBZ. */
 
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_IDTR);
-        Log4(("Load[%RU32]: VMX_VMCS_GUEST_IDTR_BASE=%#RX64\n", pVCpu->idCpu, pMixedCtx->idtr.pIdt));
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_IDTR);
+        Log4Func(("IDTR base=%#RX64\n", pMixedCtx->idtr.pIdt));
     }
 
@@ -4753 +4634 @@
 
 /**
- * Loads certain guest MSRs into the VM-entry MSR-load and VM-exit MSR-store
+ * Exports certain guest MSRs into the VM-entry MSR-load and VM-exit MSR-store
  * areas.
  *
@@ -4759 +4640 @@
  * VM-entry and stored from the host CPU on every successful VM-exit. This also
  * creates/updates MSR slots for the host MSRs. The actual host MSR values are
- * -not- updated here for performance reasons. See hmR0VmxSaveHostMsrs().
- *
- * Also loads the sysenter MSRs into the guest-state area in the VMCS.
+ * -not- updated here for performance reasons. See hmR0VmxExportHostMsrs().
+ *
+ * Also exports the guest sysenter MSRs into the guest-state area in the VMCS.
  *
  * @returns VBox status code.
@@ -4771 +4652 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0VmxLoadGuestMsrs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static int hmR0VmxExportGuestMsrs(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
 {
     AssertPtr(pVCpu);
@@ -4778 +4659 @@
     /*
      * MSRs that we use the auto-load/store MSR area in the VMCS.
+     * For 64-bit hosts, we load/restore them lazily, see hmR0VmxLazyLoadGuestMsrs().
      */
     PVM pVM = pVCpu->CTX_SUFF(pVM);
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMX_GUEST_AUTO_MSRS))
-    {
-        /* For 64-bit hosts, we load/restore them lazily, see hmR0VmxLazyLoadGuestMsrs(). */
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_VMX_GUEST_AUTO_MSRS)
+    {
+        if (pVM->hm.s.fAllow64BitGuests)
+        {
 #if HC_ARCH_BITS == 32
-        if (pVM->hm.s.fAllow64BitGuests)
-        {
             int rc = hmR0VmxAddAutoLoadStoreMsr(pVCpu, MSR_K8_LSTAR,          pMixedCtx->msrLSTAR,        false, NULL);
             rc    |= hmR0VmxAddAutoLoadStoreMsr(pVCpu, MSR_K6_STAR,           pMixedCtx->msrSTAR,         false, NULL);
@@ -4792 +4673 @@
             AssertRCReturn(rc, rc);
 # ifdef LOG_ENABLED
-            PVMXAUTOMSR pMsr = (PVMXAUTOMSR)pVCpu->hm.s.vmx.pvGuestMsr;
+            PCVMXAUTOMSR pMsr = (PVMXAUTOMSR)CpVCpu->hm.s.vmx.pvGuestMsr;
             for (uint32_t i = 0; i < pVCpu->hm.s.vmx.cMsrs; i++, pMsr++)
-            {
-                Log4(("Load[%RU32]: MSR[%RU32]: u32Msr=%#RX32 u64Value=%#RX64\n", pVCpu->idCpu, i, pMsr->u32Msr,
-                      pMsr->u64Value));
-            }
+                Log4Func(("MSR[%RU32]: u32Msr=%#RX32 u64Value=%#RX64\n", i, pMsr->u32Msr, pMsr->u64Value));
 # endif
-        }
 #endif
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_VMX_GUEST_AUTO_MSRS);
+        }
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_VMX_GUEST_AUTO_MSRS);
     }
 
@@ -4809 +4687 @@
      * VM-exits on WRMSRs for these MSRs.
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_SYSENTER_CS_MSR))
-    {
-        int rc = VMXWriteVmcs32(VMX_VMCS32_GUEST_SYSENTER_CS, pMixedCtx->SysEnter.cs);      AssertRCReturn(rc, rc);
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_SYSENTER_CS_MSR);
-    }
-
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_SYSENTER_EIP_MSR))
-    {
-        int rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_SYSENTER_EIP, pMixedCtx->SysEnter.eip);    AssertRCReturn(rc, rc);
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_SYSENTER_EIP_MSR);
-    }
-
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_SYSENTER_ESP_MSR))
-    {
-        int rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_SYSENTER_ESP, pMixedCtx->SysEnter.esp);    AssertRCReturn(rc, rc);
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_SYSENTER_ESP_MSR);
-    }
-
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_EFER_MSR))
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_SYSENTER_MSR_MASK)
+    {
+        if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_SYSENTER_CS_MSR)
+        {
+            int rc = VMXWriteVmcs32(VMX_VMCS32_GUEST_SYSENTER_CS, pMixedCtx->SysEnter.cs);
+            AssertRCReturn(rc, rc);
+            ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_SYSENTER_CS_MSR);
+        }
+
+        if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_SYSENTER_EIP_MSR)
+        {
+            int rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_SYSENTER_EIP, pMixedCtx->SysEnter.eip);
+            AssertRCReturn(rc, rc);
+            ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_SYSENTER_EIP_MSR);
+        }
+
+        if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_SYSENTER_ESP_MSR)
+        {
+            int rc = VMXWriteVmcsGstN(VMX_VMCS_GUEST_SYSENTER_ESP, pMixedCtx->SysEnter.esp);
+            AssertRCReturn(rc, rc);
+            ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_SYSENTER_ESP_MSR);
+        }
+    }
+
+    if (ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged) & HM_CHANGED_GUEST_EFER_MSR)
     {
         if (hmR0VmxShouldSwapEferMsr(pVCpu, pMixedCtx))
@@ -4839 +4723 @@
                 int rc = VMXWriteVmcs64(VMX_VMCS64_GUEST_EFER_FULL, pMixedCtx->msrEFER);
                 AssertRCReturn(rc,rc);
-                Log4(("Load[%RU32]: VMX_VMCS64_GUEST_EFER_FULL=%#RX64\n", pVCpu->idCpu, pMixedCtx->msrEFER));
+                Log4Func(("EFER=%#RX64\n", pMixedCtx->msrEFER));
             }
             else
@@ -4850 +4734 @@
                 if (pVM->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS)
                     hmR0VmxSetMsrPermission(pVCpu, MSR_K6_EFER, VMXMSREXIT_INTERCEPT_READ, VMXMSREXIT_INTERCEPT_WRITE);
-                Log4(("Load[%RU32]: MSR[--]: u32Msr=%#RX32 u64Value=%#RX64 cMsrs=%u\n", pVCpu->idCpu, MSR_K6_EFER,
-                      pMixedCtx->msrEFER, pVCpu->hm.s.vmx.cMsrs));
+                Log4Func(("MSR[--]: u32Msr=%#RX32 u64Value=%#RX64 cMsrs=%u\n", MSR_K6_EFER, pMixedCtx->msrEFER,
+                          pVCpu->hm.s.vmx.cMsrs));
             }
         }
         else if (!pVM->hm.s.vmx.fSupportsVmcsEfer)
             hmR0VmxRemoveAutoLoadStoreMsr(pVCpu, MSR_K6_EFER);
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_EFER_MSR);
+        ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~HM_CHANGED_GUEST_EFER_MSR);
     }
 
@@ -4863 +4747 @@
 
 
-/**
- * Loads the guest activity state into the guest-state area in the VMCS.
+#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
+/**
+ * Check if guest state allows safe use of 32-bit switcher again.
+ *
+ * Segment bases and protected mode structures must be 32-bit addressable
+ * because the  32-bit switcher will ignore high dword when writing these VMCS
+ * fields.  See @bugref{8432} for details.
+ *
+ * @returns true if safe, false if must continue to use the 64-bit switcher.
+ * @param   pMixedCtx   Pointer to the guest-CPU context. The data may be
+ *                      out-of-sync. Make sure to update the required fields
+ *                      before using them.
+ *
+ * @remarks No-long-jump zone!!!
+ */
+static bool hmR0VmxIs32BitSwitcherSafe(PCCPUMCTX pMixedCtx)
+{
+    if (pMixedCtx->gdtr.pGdt    & UINT64_C(0xffffffff00000000))     return false;
+    if (pMixedCtx->idtr.pIdt    & UINT64_C(0xffffffff00000000))     return false;
+    if (pMixedCtx->ldtr.u64Base & UINT64_C(0xffffffff00000000))     return false;
+    if (pMixedCtx->tr.u64Base   & UINT64_C(0xffffffff00000000))     return false;
+    if (pMixedCtx->es.u64Base   & UINT64_C(0xffffffff00000000))     return false;
+    if (pMixedCtx->cs.u64Base   & UINT64_C(0xffffffff00000000))     return false;
+    if (pMixedCtx->ss.u64Base   & UINT64_C(0xffffffff00000000))     return false;
+    if (pMixedCtx->ds.u64Base   & UINT64_C(0xffffffff00000000))     return false;
+    if (pMixedCtx->fs.u64Base   & UINT64_C(0xffffffff00000000))     return false;
+    if (pMixedCtx->gs.u64Base   & UINT64_C(0xffffffff00000000))     return false;
+
+    /* All good, bases are 32-bit. */
+    return true;
+}
+#endif
+
+
+/**
+ * Selects up the appropriate function to run guest code.
  *
  * @returns VBox status code.
@@ -4874 +4792 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0VmxLoadGuestActivityState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    NOREF(pMixedCtx);
-    /** @todo See if we can make use of other states, e.g.
-     *        VMX_VMCS_GUEST_ACTIVITY_SHUTDOWN or HLT.  */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMX_GUEST_ACTIVITY_STATE))
-    {
-        int rc = VMXWriteVmcs32(VMX_VMCS32_GUEST_ACTIVITY_STATE, VMX_VMCS_GUEST_ACTIVITY_ACTIVE);
-        AssertRCReturn(rc, rc);
-
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_VMX_GUEST_ACTIVITY_STATE);
-    }
-    return VINF_SUCCESS;
-}
-
-
-#if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
-/**
- * Check if guest state allows safe use of 32-bit switcher again.
- *
- * Segment bases and protected mode structures must be 32-bit addressable
- * because the  32-bit switcher will ignore high dword when writing these VMCS
- * fields.  See @bugref{8432} for details.
- *
- * @returns true if safe, false if must continue to use the 64-bit switcher.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data may be
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static bool hmR0VmxIs32BitSwitcherSafe(PCPUMCTX pMixedCtx)
-{
-    if (pMixedCtx->gdtr.pGdt    & UINT64_C(0xffffffff00000000))
-        return false;
-    if (pMixedCtx->idtr.pIdt    & UINT64_C(0xffffffff00000000))
-        return false;
-    if (pMixedCtx->ldtr.u64Base & UINT64_C(0xffffffff00000000))
-        return false;
-    if (pMixedCtx->tr.u64Base   & UINT64_C(0xffffffff00000000))
-        return false;
-    if (pMixedCtx->es.u64Base   & UINT64_C(0xffffffff00000000))
-        return false;
-    if (pMixedCtx->cs.u64Base   & UINT64_C(0xffffffff00000000))
-        return false;
-    if (pMixedCtx->ss.u64Base   & UINT64_C(0xffffffff00000000))
-        return false;
-    if (pMixedCtx->ds.u64Base   & UINT64_C(0xffffffff00000000))
-        return false;
-    if (pMixedCtx->fs.u64Base   & UINT64_C(0xffffffff00000000))
-        return false;
-    if (pMixedCtx->gs.u64Base   & UINT64_C(0xffffffff00000000))
-        return false;
-    /* All good, bases are 32-bit. */
-    return true;
-}
-#endif
-
-
-/**
- * Sets up the appropriate function to run guest code.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data may be
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSetupVMRunHandler(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static int hmR0VmxSelectVMRunHandler(PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
 {
     if (CPUMIsGuestInLongModeEx(pMixedCtx))
@@ -4956 +4804 @@
         if (pVCpu->hm.s.vmx.pfnStartVM != VMXR0SwitcherStartVM64)
         {
+#ifdef VBOX_STRICT
             if (pVCpu->hm.s.vmx.pfnStartVM != NULL) /* Very first entry would have saved host-state already, ignore it. */
             {
                 /* Currently, all mode changes sends us back to ring-3, so these should be set. See @bugref{6944}. */
-                AssertMsg(HMCPU_CF_IS_SET(pVCpu,   HM_CHANGED_VMX_EXIT_CTLS
-                                                 | HM_CHANGED_VMX_ENTRY_CTLS
-                                                 | HM_CHANGED_GUEST_EFER_MSR), ("flags=%#x\n", HMCPU_CF_VALUE(pVCpu)));
+                uint64_t const fCtxChanged = ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged);
+                AssertMsg(fCtxChanged & (  HM_CHANGED_VMX_EXIT_CTLS
+                                         | HM_CHANGED_VMX_ENTRY_CTLS
+                                         | HM_CHANGED_GUEST_EFER_MSR), ("fCtxChanged=%#RX64\n", fCtxChanged));
             }
+#endif
             pVCpu->hm.s.vmx.pfnStartVM = VMXR0SwitcherStartVM64;
 
@@ -4968 +4819 @@
                the rest of the VM run (until VM reset). See @bugref{8432#c7}. */
             pVCpu->hm.s.vmx.fSwitchedTo64on32 = true;
-            Log4(("Load[%RU32]: hmR0VmxSetupVMRunHandler: selected 64-bit switcher\n", pVCpu->idCpu));
+            Log4Func(("Selected 64-bit switcher\n"));
         }
 #else
@@ -4983 +4834 @@
             &&  pVCpu->hm.s.vmx.pfnStartVM != NULL) /* Very first entry would have saved host-state already, ignore it. */
         {
+# ifdef VBOX_STRICT
             /* Currently, all mode changes sends us back to ring-3, so these should be set. See @bugref{6944}. */
-            AssertMsg(HMCPU_CF_IS_SET(pVCpu,   HM_CHANGED_VMX_EXIT_CTLS
-                                             | HM_CHANGED_VMX_ENTRY_CTLS
-                                             | HM_CHANGED_GUEST_EFER_MSR), ("flags=%#x\n", HMCPU_CF_VALUE(pVCpu)));
+            uint64_t const fCtxChanged = ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged);
+            AssertMsg(fCtxChanged & (  HM_CHANGED_VMX_EXIT_CTLS
+                                     | HM_CHANGED_VMX_ENTRY_CTLS
+                                     | HM_CHANGED_GUEST_EFER_MSR), ("fCtxChanged=%#RX64\n", fCtxChanged));
+# endif
         }
 # ifdef VBOX_ENABLE_64_BITS_GUESTS
         /*
-         * Keep using the 64-bit switcher even though we're in 32-bit because of bad Intel design, see @bugref{8432#c7}.
-         * If real-on-v86 mode is active, clear the 64-bit switcher flag because now we know the guest is in a sane
-         * state where it's safe to use the 32-bit switcher. Otherwise check the guest state if it's safe to use
+         * Keep using the 64-bit switcher even though we're in 32-bit because of bad Intel
+         * design, see @bugref{8432#c7}. If real-on-v86 mode is active, clear the 64-bit
+         * switcher flag because now we know the guest is in a sane state where it's safe
+         * to use the 32-bit switcher. Otherwise check the guest state if it's safe to use
          * the much faster 32-bit switcher again.
          */
@@ -4998 +4853 @@
         {
             if (pVCpu->hm.s.vmx.pfnStartVM != VMXR0StartVM32)
-                Log4(("Load[%RU32]: hmR0VmxSetupVMRunHandler: selected 32-bit switcher\n", pVCpu->idCpu));
+                Log4Func(("Selected 32-bit switcher\n"));
             pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM32;
         }
@@ -5009 +4864 @@
                 pVCpu->hm.s.vmx.fSwitchedTo64on32 = false;
                 pVCpu->hm.s.vmx.pfnStartVM = VMXR0StartVM32;
-                HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_EFER_MSR
-                                    | HM_CHANGED_VMX_ENTRY_CTLS
-                                    | HM_CHANGED_VMX_EXIT_CTLS
-                                    | HM_CHANGED_HOST_CONTEXT);
-                Log4(("Load[%RU32]: hmR0VmxSetupVMRunHandler: selected 32-bit switcher (safe)\n", pVCpu->idCpu));
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_EFER_MSR
+                                                           | HM_CHANGED_VMX_ENTRY_CTLS
+                                                           | HM_CHANGED_VMX_EXIT_CTLS
+                                                           | HM_CHANGED_HOST_CONTEXT);
+                Log4Func(("Selected 32-bit switcher (safe)\n"));
             }
         }
@@ -5040 +4895 @@
 DECLINLINE(int) hmR0VmxRunGuest(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
 {
+    /* Mark that HM is the keeper of all guest-CPU registers now that we're going to execute guest code. */
+    pCtx->fExtrn |= HMVMX_CPUMCTX_EXTRN_ALL | CPUMCTX_EXTRN_KEEPER_HM;
+
     /*
-     * 64-bit Windows uses XMM registers in the kernel as the Microsoft compiler expresses floating-point operations
-     * using SSE instructions. Some XMM registers (XMM6-XMM15) are callee-saved and thus the need for this XMM wrapper.
-     * Refer MSDN docs. "Configuring Programs for 64-bit / x64 Software Conventions / Register Usage" for details.
+     * 64-bit Windows uses XMM registers in the kernel as the Microsoft compiler expresses
+     * floating-point operations using SSE instructions. Some XMM registers (XMM6-XMM15) are
+     * callee-saved and thus the need for this XMM wrapper.
+     *
+     * See MSDN "Configuring Programs for 64-bit/x64 Software Conventions / Register Usage".
      */
     bool const fResumeVM = RT_BOOL(pVCpu->hm.s.vmx.uVmcsState & HMVMX_VMCS_STATE_LAUNCHED);
@@ -5075 +4935 @@
     HMVMX_ASSERT_PREEMPT_SAFE();
 
-    Log4(("VM-entry failure: %Rrc\n", rcVMRun));
+    Log4Func(("VM-entry failure: %Rrc\n", rcVMRun));
     switch (rcVMRun)
     {
@@ -5322 +5182 @@
  *
  * @returns VBox status code (no informational status codes).
- * @param   pVM         The cross context VM structure.
  * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pCtx        Pointer to the guest CPU context.
  * @param   enmOp       The operation to perform.
  * @param   cParams     Number of parameters.
  * @param   paParam     Array of 32-bit parameters.
  */
-VMMR0DECL(int) VMXR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, HM64ON32OP enmOp,
+VMMR0DECL(int) VMXR0Execute64BitsHandler(PVMCPU pVCpu, HM64ON32OP enmOp,
                                          uint32_t cParams, uint32_t *paParam)
 {
-    NOREF(pCtx);
-
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
     AssertReturn(pVM->hm.s.pfnHost32ToGuest64R0, VERR_HM_NO_32_TO_64_SWITCHER);
     Assert(enmOp > HM64ON32OP_INVALID && enmOp < HM64ON32OP_END);
@@ -5453 +5310 @@
     *(uint32_t *)(pVM->hm.s.vmx.pScratch + 16 + 8) = 1;
 #endif
-    int rc = VMXR0Execute64BitsHandler(pVM, pVCpu, pCtx, HM64ON32OP_VMXRCStartVM64, RT_ELEMENTS(aParam), &aParam[0]);
+    int rc = VMXR0Execute64BitsHandler(pVCpu, HM64ON32OP_VMXRCStartVM64, RT_ELEMENTS(aParam), &aParam[0]);
 
 #ifdef VBOX_WITH_CRASHDUMP_MAGIC
@@ -5537 +5394 @@
     VMXLOCAL_INIT_READ_CACHE_FIELD(pCache, VMX_VMCS_GUEST_SYSENTER_EIP);
 
-    /* 64-bit guest-state fields; unused as we use two 32-bit VMREADs for these 64-bit fields (using "FULL" and "HIGH" fields). */
+    /* 64-bit guest-state fields; unused as we use two 32-bit VMREADs for
+       these 64-bit fields (using "FULL" and "HIGH" fields). */
 #if 0
     VMXLOCAL_INIT_READ_CACHE_FIELD(pCache, VMX_VMCS64_GUEST_VMCS_LINK_PTR_FULL);
@@ -5774 +5632 @@
 
 
-#ifdef HMVMX_USE_IEM_EVENT_REFLECTION
 /**
  * Gets the IEM exception flags for the specified vector and IDT vectoring /
@@ -5832 +5689 @@
 }
 
-#else
-/**
- * Determines if an exception is a contributory exception.
- *
- * Contributory exceptions are ones which can cause double-faults unless the
- * original exception was a benign exception. Page-fault is intentionally not
- * included here as it's a conditional contributory exception.
- *
- * @returns true if the exception is contributory, false otherwise.
- * @param   uVector     The exception vector.
- */
-DECLINLINE(bool) hmR0VmxIsContributoryXcpt(const uint32_t uVector)
-{
-    switch (uVector)
-    {
-        case X86_XCPT_GP:
-        case X86_XCPT_SS:
-        case X86_XCPT_NP:
-        case X86_XCPT_TS:
-        case X86_XCPT_DE:
-            return true;
-        default:
-            break;
-    }
-    return false;
-}
-#endif /* HMVMX_USE_IEM_EVENT_REFLECTION */
-
 
 /**
@@ -5930 +5759 @@
     uint32_t const uExitVector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVmxTransient->uExitIntInfo);
 
-    int rc2 = hmR0VmxReadIdtVectoringInfoVmcs(pVmxTransient);       AssertRCReturn(rc2, rc2);
-    rc2     = hmR0VmxReadExitIntInfoVmcs(pVmxTransient);            AssertRCReturn(rc2, rc2);
+    int rc2 = hmR0VmxReadIdtVectoringInfoVmcs(pVmxTransient);
+    rc2    |= hmR0VmxReadExitIntInfoVmcs(pVmxTransient);
+    AssertRCReturn(rc2, rc2);
 
     VBOXSTRICTRC rcStrict = VINF_SUCCESS;
@@ -5938 +5768 @@
         uint32_t const uIdtVectorType = VMX_IDT_VECTORING_INFO_TYPE(pVmxTransient->uIdtVectoringInfo);
         uint32_t const uIdtVector     = VMX_IDT_VECTORING_INFO_VECTOR(pVmxTransient->uIdtVectoringInfo);
-#ifdef HMVMX_USE_IEM_EVENT_REFLECTION
+
         /*
-         * If the event was a software interrupt (generated with INT n) or a software exception (generated
-         * by INT3/INTO) or a privileged software exception (generated by INT1), we can handle the VM-exit
-         * and continue guest execution which will re-execute the instruction rather than re-injecting the
-         * exception, as that can cause premature trips to ring-3 before injection and involve TRPM which
-         * currently has no way of storing that these exceptions were caused by these instructions
-         * (ICEBP's #DB poses the problem).
+         * If the event was a software interrupt (generated with INT n) or a software exception
+         * (generated by INT3/INTO) or a privileged software exception (generated by INT1), we
+         * can handle the VM-exit and continue guest execution which will re-execute the
+         * instruction rather than re-injecting the exception, as that can cause premature
+         * trips to ring-3 before injection and involve TRPM which currently has no way of
+         * storing that these exceptions were caused by these instructions (ICEBP's #DB poses
+         * the problem).
          */
         IEMXCPTRAISE     enmRaise;
@@ -5965 +5796 @@
                             ("hmR0VmxCheckExitDueToEventDelivery: Unexpected VM-exit interruption info. %#x!\n",
                              uExitVectorType), VERR_VMX_IPE_5);
+
             enmRaise = IEMEvaluateRecursiveXcpt(pVCpu, fIdtVectorFlags, uIdtVector, fExitVectorFlags, uExitVector, &fRaiseInfo);
 
@@ -6009 +5841 @@
             case IEMXCPTRAISE_CURRENT_XCPT:
             {
-                Log4(("IDT: vcpu[%RU32] Pending secondary xcpt: uIdtVectoringInfo=%#RX64 uExitIntInfo=%#RX64\n", pVCpu->idCpu,
-                      pVmxTransient->uIdtVectoringInfo, pVmxTransient->uExitIntInfo));
+                Log4Func(("IDT: Pending secondary Xcpt: uIdtVectoringInfo=%#RX64 uExitIntInfo=%#RX64\n",
+                          pVmxTransient->uIdtVectoringInfo, pVmxTransient->uExitIntInfo));
                 Assert(rcStrict == VINF_SUCCESS);
                 break;
@@ -6032 +5864 @@
                                        0 /* cbInstr */, u32ErrCode, pMixedCtx->cr2);
 
-                Log4(("IDT: vcpu[%RU32] Pending vectoring event %#RX64 Err=%#RX32\n", pVCpu->idCpu, pVCpu->hm.s.Event.u64IntInfo,
-                      pVCpu->hm.s.Event.u32ErrCode));
+                Log4Func(("IDT: Pending vectoring event %#RX64 Err=%#RX32\n", pVCpu->hm.s.Event.u64IntInfo,
+                          pVCpu->hm.s.Event.u32ErrCode));
                 Assert(rcStrict == VINF_SUCCESS);
                 break;
@@ -6051 +5883 @@
                 {
                     pVmxTransient->fVectoringDoublePF = true;
-                    Log4(("IDT: vcpu[%RU32] Vectoring double #PF %#RX64 cr2=%#RX64\n", pVCpu->idCpu, pVCpu->hm.s.Event.u64IntInfo,
+                    Log4Func(("IDT: Vectoring double #PF %#RX64 cr2=%#RX64\n", pVCpu->hm.s.Event.u64IntInfo,
                           pMixedCtx->cr2));
                     rcStrict = VINF_SUCCESS;
@@ -6059 +5891 @@
                     STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingReflect);
                     hmR0VmxSetPendingXcptDF(pVCpu, pMixedCtx);
-                    Log4(("IDT: vcpu[%RU32] Pending vectoring #DF %#RX64 uIdtVector=%#x uExitVector=%#x\n", pVCpu->idCpu,
-                          pVCpu->hm.s.Event.u64IntInfo, uIdtVector, uExitVector));
+                    Log4Func(("IDT: Pending vectoring #DF %#RX64 uIdtVector=%#x uExitVector=%#x\n", pVCpu->hm.s.Event.u64IntInfo,
+                              uIdtVector, uExitVector));
                     rcStrict = VINF_HM_DOUBLE_FAULT;
                 }
@@ -6068 +5900 @@
             case IEMXCPTRAISE_TRIPLE_FAULT:
             {
-                Log4(("IDT: vcpu[%RU32] Pending vectoring triple-fault uIdt=%#x uExit=%#x\n", pVCpu->idCpu, uIdtVector,
-                      uExitVector));
+                Log4Func(("IDT: Pending vectoring triple-fault uIdt=%#x uExit=%#x\n", uIdtVector, uExitVector));
                 rcStrict = VINF_EM_RESET;
                 break;
@@ -6076 +5907 @@
             case IEMXCPTRAISE_CPU_HANG:
             {
-                Log4(("IDT: vcpu[%RU32] Bad guest! Entering CPU hang. fRaiseInfo=%#x\n", pVCpu->idCpu, fRaiseInfo));
+                Log4Func(("IDT: Bad guest! Entering CPU hang. fRaiseInfo=%#x\n", fRaiseInfo));
                 rcStrict = VERR_EM_GUEST_CPU_HANG;
                 break;
@@ -6088 +5919 @@
             }
         }
-#else
-        typedef enum
-        {
-            VMXREFLECTXCPT_XCPT,    /* Reflect the exception to the guest or for further evaluation by VMM. */
-            VMXREFLECTXCPT_DF,      /* Reflect the exception as a double-fault to the guest. */
-            VMXREFLECTXCPT_TF,      /* Indicate a triple faulted state to the VMM. */
-            VMXREFLECTXCPT_HANG,    /* Indicate bad VM trying to deadlock the CPU. */
-            VMXREFLECTXCPT_NONE     /* Nothing to reflect. */
-        } VMXREFLECTXCPT;
-
-        /* See Intel spec. 30.7.1.1 "Reflecting Exceptions to Guest Software". */
-        VMXREFLECTXCPT enmReflect = VMXREFLECTXCPT_NONE;
-        if (VMX_EXIT_INTERRUPTION_INFO_IS_VALID(pVmxTransient->uExitIntInfo))
-        {
-            if (uIdtVectorType == VMX_IDT_VECTORING_INFO_TYPE_HW_XCPT)
-            {
-                enmReflect = VMXREFLECTXCPT_XCPT;
-#ifdef VBOX_STRICT
-                if (   hmR0VmxIsContributoryXcpt(uIdtVector)
-                    && uExitVector == X86_XCPT_PF)
-                {
-                    Log4(("IDT: vcpu[%RU32] Contributory #PF uCR2=%#RX64\n", pVCpu->idCpu, pMixedCtx->cr2));
-                }
-#endif
-                if (   uExitVector == X86_XCPT_PF
-                    && uIdtVector == X86_XCPT_PF)
-                {
-                    pVmxTransient->fVectoringDoublePF = true;
-                    Log4(("IDT: vcpu[%RU32] Vectoring Double #PF uCR2=%#RX64\n", pVCpu->idCpu, pMixedCtx->cr2));
-                }
-                else if (   uExitVector == X86_XCPT_AC
-                         && uIdtVector == X86_XCPT_AC)
-                {
-                    enmReflect = VMXREFLECTXCPT_HANG;
-                    Log4(("IDT: Nested #AC - Bad guest\n"));
-                }
-                else if (   (pVCpu->hm.s.vmx.u32XcptBitmap & HMVMX_CONTRIBUTORY_XCPT_MASK)
-                         && hmR0VmxIsContributoryXcpt(uExitVector)
-                         && (   hmR0VmxIsContributoryXcpt(uIdtVector)
-                             || uIdtVector == X86_XCPT_PF))
-                {
-                    enmReflect = VMXREFLECTXCPT_DF;
-                }
-                else if (uIdtVector == X86_XCPT_DF)
-                    enmReflect = VMXREFLECTXCPT_TF;
-            }
-            else if (   uIdtVectorType == VMX_IDT_VECTORING_INFO_TYPE_EXT_INT
-                     || uIdtVectorType == VMX_IDT_VECTORING_INFO_TYPE_NMI)
-            {
-                /*
-                 * Ignore software interrupts (INT n), software exceptions (#BP, #OF) and
-                 * privileged software exception (#DB from ICEBP) as they reoccur when restarting the instruction.
-                 */
-                enmReflect = VMXREFLECTXCPT_XCPT;
-
-                if (uExitVector == X86_XCPT_PF)
-                {
-                    pVmxTransient->fVectoringPF = true;
-                    Log4(("IDT: vcpu[%RU32] Vectoring #PF due to Ext-Int/NMI. uCR2=%#RX64\n", pVCpu->idCpu, pMixedCtx->cr2));
-                }
-            }
-        }
-        else if (   uIdtVectorType == VMX_IDT_VECTORING_INFO_TYPE_HW_XCPT
-                 || uIdtVectorType == VMX_IDT_VECTORING_INFO_TYPE_EXT_INT
-                 || uIdtVectorType == VMX_IDT_VECTORING_INFO_TYPE_NMI)
-        {
-            /*
-             * If event delivery caused an EPT violation/misconfig or APIC access VM-exit, then the VM-exit
-             * interruption-information will not be valid as it's not an exception and we end up here. In such cases,
-             * it is sufficient to reflect the original exception to the guest after handling the VM-exit.
-             */
-            enmReflect = VMXREFLECTXCPT_XCPT;
-        }
-
-        /*
-         * On CPUs that support Virtual NMIs, if this VM-exit (be it an exception or EPT violation/misconfig etc.) occurred
-         * while delivering the NMI, we need to clear the block-by-NMI field in the guest interruptibility-state before
-         * re-delivering the NMI after handling the VM-exit. Otherwise the subsequent VM-entry would fail.
-         *
-         * See Intel spec. 30.7.1.2 "Resuming Guest Software after Handling an Exception". See @bugref{7445}.
-         */
-        if (   uIdtVectorType == VMX_IDT_VECTORING_INFO_TYPE_NMI
-            && enmReflect == VMXREFLECTXCPT_XCPT
-            && (pVCpu->hm.s.vmx.u32PinCtls & VMX_VMCS_CTRL_PIN_EXEC_VIRTUAL_NMI)
-            && VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
-        {
-            VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
-        }
-
-        switch (enmReflect)
-        {
-            case VMXREFLECTXCPT_XCPT:
-            {
-                Assert(   uIdtVectorType != VMX_IDT_VECTORING_INFO_TYPE_SW_INT
-                       && uIdtVectorType != VMX_IDT_VECTORING_INFO_TYPE_SW_XCPT
-                       && uIdtVectorType != VMX_IDT_VECTORING_INFO_TYPE_PRIV_SW_XCPT);
-
-                uint32_t u32ErrCode = 0;
-                if (VMX_IDT_VECTORING_INFO_ERROR_CODE_IS_VALID(pVmxTransient->uIdtVectoringInfo))
-                {
-                    rc2 = hmR0VmxReadIdtVectoringErrorCodeVmcs(pVmxTransient);
-                    AssertRCReturn(rc2, rc2);
-                    u32ErrCode = pVmxTransient->uIdtVectoringErrorCode;
-                }
-
-                /* If uExitVector is #PF, CR2 value will be updated from the VMCS if it's a guest #PF. See hmR0VmxExitXcptPF(). */
-                STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingReflect);
-                hmR0VmxSetPendingEvent(pVCpu, VMX_ENTRY_INT_INFO_FROM_EXIT_IDT_INFO(pVmxTransient->uIdtVectoringInfo),
-                                       0 /* cbInstr */,  u32ErrCode, pMixedCtx->cr2);
-                rcStrict = VINF_SUCCESS;
-                Log4(("IDT: vcpu[%RU32] Pending vectoring event %#RX64 Err=%#RX32\n", pVCpu->idCpu,
-                      pVCpu->hm.s.Event.u64IntInfo, pVCpu->hm.s.Event.u32ErrCode));
-
-                break;
-            }
-
-            case VMXREFLECTXCPT_DF:
-            {
-                STAM_COUNTER_INC(&pVCpu->hm.s.StatInjectPendingReflect);
-                hmR0VmxSetPendingXcptDF(pVCpu, pMixedCtx);
-                rcStrict = VINF_HM_DOUBLE_FAULT;
-                Log4(("IDT: vcpu[%RU32] Pending vectoring #DF %#RX64 uIdtVector=%#x uExitVector=%#x\n", pVCpu->idCpu,
-                      pVCpu->hm.s.Event.u64IntInfo, uIdtVector, uExitVector));
-
-                break;
-            }
-
-            case VMXREFLECTXCPT_TF:
-            {
-                rcStrict = VINF_EM_RESET;
-                Log4(("IDT: vcpu[%RU32] Pending vectoring triple-fault uIdt=%#x uExit=%#x\n", pVCpu->idCpu, uIdtVector,
-                      uExitVector));
-                break;
-            }
-
-            case VMXREFLECTXCPT_HANG:
-            {
-                rcStrict = VERR_EM_GUEST_CPU_HANG;
-                break;
-            }
-
-            default:
-                Assert(rcStrict == VINF_SUCCESS);
-                break;
-        }
-#endif /* HMVMX_USE_IEM_EVENT_REFLECTION */
     }
     else if (   VMX_EXIT_INTERRUPTION_INFO_IS_VALID(pVmxTransient->uExitIntInfo)
@@ -6247 +5932 @@
         if (!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
         {
-            Log4(("hmR0VmxCheckExitDueToEventDelivery: vcpu[%RU32] Setting VMCPU_FF_BLOCK_NMIS. Valid=%RTbool uExitReason=%u\n",
-                  pVCpu->idCpu, VMX_EXIT_INTERRUPTION_INFO_IS_VALID(pVmxTransient->uExitIntInfo), pVmxTransient->uExitReason));
+            Log4Func(("Setting VMCPU_FF_BLOCK_NMIS. fValid=%RTbool uExitReason=%u\n",
+                      VMX_EXIT_INTERRUPTION_INFO_IS_VALID(pVmxTransient->uExitIntInfo), pVmxTransient->uExitReason));
             VMCPU_FF_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
         }
@@ -6260 +5945 @@
 
 /**
- * Saves the guest's CR0 register from the VMCS into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestCR0(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    NOREF(pMixedCtx);
-
-    /*
-     * While in the middle of saving guest-CR0, we could get preempted and re-invoked from the preemption hook,
-     * see hmR0VmxLeave(). Safer to just make this code non-preemptible.
-     */
-    VMMRZCallRing3Disable(pVCpu);
-    HM_DISABLE_PREEMPT();
-
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR0))
-    {
-#ifndef DEBUG_bird /** @todo this triggers running bs3-cpu-generated-1.img with --debug-command-line
-                    * and 'dbgc-init' containing:
-                    *     sxe "xcpt_de"
-                    *     sxe "xcpt_bp"
-                    *     sxi "xcpt_gp"
-                    *     sxi "xcpt_ss"
-                    *     sxi "xcpt_np"
-                    */
-        /** @todo r=ramshankar: Should be fixed after r119291. */
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR0));
-#endif
-        uint32_t uVal    = 0;
-        uint32_t uShadow = 0;
-        int rc  = VMXReadVmcs32(VMX_VMCS_GUEST_CR0,            &uVal);
-        rc     |= VMXReadVmcs32(VMX_VMCS_CTRL_CR0_READ_SHADOW, &uShadow);
-        AssertRCReturn(rc, rc);
-
-        uVal = (uShadow & pVCpu->hm.s.vmx.u32CR0Mask) | (uVal & ~pVCpu->hm.s.vmx.u32CR0Mask);
-        CPUMSetGuestCR0(pVCpu, uVal);
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR0);
-    }
-
-    HM_RESTORE_PREEMPT();
-    VMMRZCallRing3Enable(pVCpu);
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Saves the guest's CR4 register from the VMCS into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestCR4(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    NOREF(pMixedCtx);
-
-    int rc = VINF_SUCCESS;
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR4))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR4));
-        uint32_t uVal    = 0;
-        uint32_t uShadow = 0;
-        rc  = VMXReadVmcs32(VMX_VMCS_GUEST_CR4,            &uVal);
-        rc |= VMXReadVmcs32(VMX_VMCS_CTRL_CR4_READ_SHADOW, &uShadow);
-        AssertRCReturn(rc, rc);
-
-        uVal = (uShadow & pVCpu->hm.s.vmx.u32CR4Mask) | (uVal & ~pVCpu->hm.s.vmx.u32CR4Mask);
-        CPUMSetGuestCR4(pVCpu, uVal);
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR4);
-    }
-    return rc;
-}
-
-
-/**
- * Saves the guest's RIP register from the VMCS into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestRip(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    int rc = VINF_SUCCESS;
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RIP))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_RIP));
-        uint64_t u64Val = 0;
-        rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_RIP, &u64Val);
-        AssertRCReturn(rc, rc);
-
-        pMixedCtx->rip = u64Val;
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RIP);
-    }
-    return rc;
-}
-
-
-/**
- * Saves the guest's RSP register from the VMCS into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestRsp(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    int rc = VINF_SUCCESS;
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RSP))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_RSP));
-        uint64_t u64Val = 0;
-        rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_RSP, &u64Val);
-        AssertRCReturn(rc, rc);
-
-        pMixedCtx->rsp = u64Val;
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RSP);
-    }
-    return rc;
-}
-
-
-/**
- * Saves the guest's RFLAGS from the VMCS into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestRflags(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RFLAGS))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_RFLAGS));
-        uint32_t uVal = 0;
-        int rc = VMXReadVmcs32(VMX_VMCS_GUEST_RFLAGS, &uVal);
-        AssertRCReturn(rc, rc);
-
-        pMixedCtx->eflags.u32 = uVal;
-        if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)        /* Undo our real-on-v86-mode changes to eflags if necessary. */
-        {
-            Assert(pVCpu->CTX_SUFF(pVM)->hm.s.vmx.pRealModeTSS);
-            Log4(("Saving real-mode EFLAGS VT-x view=%#RX32\n", pMixedCtx->eflags.u32));
-
-            pMixedCtx->eflags.Bits.u1VM   = 0;
-            pMixedCtx->eflags.Bits.u2IOPL = pVCpu->hm.s.vmx.RealMode.Eflags.Bits.u2IOPL;
-        }
-
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RFLAGS);
-    }
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Wrapper for saving the guest's RIP, RSP and RFLAGS from the VMCS into the
- * guest-CPU context.
- */
-DECLINLINE(int) hmR0VmxSaveGuestRipRspRflags(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    int rc = hmR0VmxSaveGuestRip(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestRsp(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-    return rc;
-}
-
-
-/**
- * Saves the guest's interruptibility-state ("interrupt shadow" as AMD calls it)
- * from the guest-state area in the VMCS.
- *
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static void hmR0VmxSaveGuestIntrState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_INTR_STATE))
-    {
-        uint32_t uIntrState = 0;
-        int rc = VMXReadVmcs32(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &uIntrState);
-        AssertRC(rc);
-
-        if (!uIntrState)
-        {
-            if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
-                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
-
-            if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
-                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
-        }
-        else
-        {
-            if (uIntrState & (  VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS
-                              | VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI))
-            {
-                rc  = hmR0VmxSaveGuestRip(pVCpu, pMixedCtx);
-                AssertRC(rc);
-                rc = hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);    /* for hmR0VmxGetGuestIntrState(). */
-                AssertRC(rc);
-
-                EMSetInhibitInterruptsPC(pVCpu, pMixedCtx->rip);
-                Assert(VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
-            }
-            else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
-                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
-
-            if (uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_NMI)
-            {
-                if (!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
-                    VMCPU_FF_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
-            }
-            else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
-                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
-        }
-
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_INTR_STATE);
-    }
-}
-
-
-/**
- * Saves the guest's activity state.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestActivityState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    NOREF(pMixedCtx);
-    /* Nothing to do for now until we make use of different guest-CPU activity state. Just update the flag. */
-    HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_ACTIVITY_STATE);
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Saves the guest SYSENTER MSRs (SYSENTER_CS, SYSENTER_EIP, SYSENTER_ESP) from
- * the current VMCS into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestSysenterMsrs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SYSENTER_CS_MSR))
-    {
-        Assert(!HMCPU_CF_IS_SET(pVCpu, HM_CHANGED_GUEST_SYSENTER_CS_MSR));
-        uint32_t u32Val = 0;
-        int rc = VMXReadVmcs32(VMX_VMCS32_GUEST_SYSENTER_CS, &u32Val);     AssertRCReturn(rc, rc);
-        pMixedCtx->SysEnter.cs = u32Val;
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SYSENTER_CS_MSR);
-    }
-
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SYSENTER_EIP_MSR))
-    {
-        Assert(!HMCPU_CF_IS_SET(pVCpu, HM_CHANGED_GUEST_SYSENTER_EIP_MSR));
-        uint64_t u64Val = 0;
-        int rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_SYSENTER_EIP, &u64Val);    AssertRCReturn(rc, rc);
-        pMixedCtx->SysEnter.eip = u64Val;
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SYSENTER_EIP_MSR);
-    }
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SYSENTER_ESP_MSR))
-    {
-        Assert(!HMCPU_CF_IS_SET(pVCpu, HM_CHANGED_GUEST_SYSENTER_ESP_MSR));
-        uint64_t u64Val = 0;
-        int rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_SYSENTER_ESP, &u64Val);    AssertRCReturn(rc, rc);
-        pMixedCtx->SysEnter.esp = u64Val;
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SYSENTER_ESP_MSR);
-    }
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Saves the set of guest MSRs (that we restore lazily while leaving VT-x) from
- * the CPU back into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestLazyMsrs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    /* Since this can be called from our preemption hook it's safer to make the guest-MSRs update non-preemptible. */
-    VMMRZCallRing3Disable(pVCpu);
-    HM_DISABLE_PREEMPT();
-
-    /* Doing the check here ensures we don't overwrite already-saved guest MSRs from a preemption hook. */
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_LAZY_MSRS))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMM_GUEST_LAZY_MSRS));
-        hmR0VmxLazySaveGuestMsrs(pVCpu, pMixedCtx);
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_LAZY_MSRS);
-    }
-
-    HM_RESTORE_PREEMPT();
-    VMMRZCallRing3Enable(pVCpu);
-
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Saves the auto load/store'd guest MSRs from the current VMCS into
+ * Imports a guest segment register from the current VMCS into
  * the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestAutoLoadStoreMsrs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    if (HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_AUTO_LOAD_STORE_MSRS))
-        return VINF_SUCCESS;
-
-    Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMX_GUEST_AUTO_MSRS));
-    PVMXAUTOMSR pMsr  = (PVMXAUTOMSR)pVCpu->hm.s.vmx.pvGuestMsr;
-    uint32_t    cMsrs = pVCpu->hm.s.vmx.cMsrs;
-    Log4(("hmR0VmxSaveGuestAutoLoadStoreMsrs: cMsrs=%u\n", cMsrs));
-    for (uint32_t i = 0; i < cMsrs; i++, pMsr++)
-    {
-        switch (pMsr->u32Msr)
-        {
-            case MSR_K8_TSC_AUX:        CPUMSetGuestTscAux(pVCpu, pMsr->u64Value);      break;
-            case MSR_K8_LSTAR:          pMixedCtx->msrLSTAR        = pMsr->u64Value;    break;
-            case MSR_K6_STAR:           pMixedCtx->msrSTAR         = pMsr->u64Value;    break;
-            case MSR_K8_SF_MASK:        pMixedCtx->msrSFMASK       = pMsr->u64Value;    break;
-            case MSR_K8_KERNEL_GS_BASE: pMixedCtx->msrKERNELGSBASE = pMsr->u64Value;    break;
-            case MSR_IA32_SPEC_CTRL:    CPUMSetGuestSpecCtrl(pVCpu, pMsr->u64Value);    break;
-            case MSR_K6_EFER: /* Nothing to do here since we intercept writes, see hmR0VmxLoadGuestMsrs(). */
-                break;
-
-            default:
-            {
-                AssertMsgFailed(("Unexpected MSR in auto-load/store area. uMsr=%#RX32 cMsrs=%u\n", pMsr->u32Msr, cMsrs));
-                pVCpu->hm.s.u32HMError = pMsr->u32Msr;
-                return VERR_HM_UNEXPECTED_LD_ST_MSR;
-            }
-        }
-    }
-
-    HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_AUTO_LOAD_STORE_MSRS);
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Saves the guest control registers from the current VMCS into the guest-CPU
- * context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestControlRegs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    /* Guest CR0. Guest FPU. */
-    int rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-    AssertRCReturn(rc, rc);
-
-    /* Guest CR4. */
-    rc = hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);
-    AssertRCReturn(rc, rc);
-
-    /* Guest CR2 - updated always during the world-switch or in #PF. */
-    /* Guest CR3. Only changes with Nested Paging. This must be done -after- saving CR0 and CR4 from the guest! */
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR3))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR3));
-        Assert(HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR0));
-        Assert(HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR4));
-
-        PVM pVM = pVCpu->CTX_SUFF(pVM);
-        if (   pVM->hm.s.vmx.fUnrestrictedGuest
-            || (   pVM->hm.s.fNestedPaging
-                && CPUMIsGuestPagingEnabledEx(pMixedCtx)))
-        {
-            uint64_t u64Val = 0;
-            rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_CR3, &u64Val);
-            if (pMixedCtx->cr3 != u64Val)
-            {
-                CPUMSetGuestCR3(pVCpu, u64Val);
-                if (VMMRZCallRing3IsEnabled(pVCpu))
-                {
-                    PGMUpdateCR3(pVCpu, u64Val);
-                    Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_CR3));
-                }
-                else
-                {
-                    /* Set the force flag to inform PGM about it when necessary. It is cleared by PGMUpdateCR3().*/
-                    VMCPU_FF_SET(pVCpu, VMCPU_FF_HM_UPDATE_CR3);
-                }
-            }
-
-            /* If the guest is in PAE mode, sync back the PDPE's into the guest state. */
-            if (CPUMIsGuestInPAEModeEx(pMixedCtx))  /* Reads CR0, CR4 and EFER MSR (EFER is always up-to-date). */
-            {
-                rc  = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, &pVCpu->hm.s.aPdpes[0].u);
-                rc |= VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, &pVCpu->hm.s.aPdpes[1].u);
-                rc |= VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, &pVCpu->hm.s.aPdpes[2].u);
-                rc |= VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, &pVCpu->hm.s.aPdpes[3].u);
-                AssertRCReturn(rc, rc);
-
-                if (VMMRZCallRing3IsEnabled(pVCpu))
-                {
-                    PGMGstUpdatePaePdpes(pVCpu, &pVCpu->hm.s.aPdpes[0]);
-                    Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES));
-                }
-                else
-                {
-                    /* Set the force flag to inform PGM about it when necessary. It is cleared by PGMGstUpdatePaePdpes(). */
-                    VMCPU_FF_SET(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES);
-                }
-            }
-        }
-
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR3);
-    }
-
-    /*
-     * Consider this scenario: VM-exit -> VMMRZCallRing3Enable() -> do stuff that causes a longjmp -> hmR0VmxCallRing3Callback()
-     * -> VMMRZCallRing3Disable() -> hmR0VmxSaveGuestState() -> Set VMCPU_FF_HM_UPDATE_CR3 pending -> return from the longjmp
-     * -> continue with VM-exit handling -> hmR0VmxSaveGuestControlRegs() and here we are.
-     *
-     * The reason for such complicated handling is because VM-exits that call into PGM expect CR3 to be up-to-date and thus
-     * if any CR3-saves -before- the VM-exit (longjmp) postponed the CR3 update via the force-flag, any VM-exit handler that
-     * calls into PGM when it re-saves CR3 will end up here and we call PGMUpdateCR3(). This is why the code below should
-     * -NOT- check if HMVMX_UPDATED_GUEST_CR3 is already set or not!
-     *
-     * The longjmp exit path can't check these CR3 force-flags and call code that takes a lock again. We cover for it here.
-     */
-    if (VMMRZCallRing3IsEnabled(pVCpu))
-    {
-        if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_CR3))
-            PGMUpdateCR3(pVCpu, CPUMGetGuestCR3(pVCpu));
-
-        if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES))
-            PGMGstUpdatePaePdpes(pVCpu, &pVCpu->hm.s.aPdpes[0]);
-
-        Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_CR3));
-        Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES));
-    }
-
-    return rc;
-}
-
-
-/**
- * Saves a guest segment register from the current VMCS into the guest-CPU
- * context.
  *
  * @returns VBox status code.
@@ -6768 +5957 @@
  *
  * @remarks No-long-jump zone!!!
+ *
  * @remarks Never call this function directly!!! Use the
- *          HMVMX_SAVE_SREG() macro as that takes care of whether to read
- *          from the VMCS cache or not.
- */
-static int hmR0VmxSaveSegmentReg(PVMCPU pVCpu, uint32_t idxSel, uint32_t idxLimit, uint32_t idxBase, uint32_t idxAccess,
-                                      PCPUMSELREG pSelReg)
+ *          HMVMX_IMPORT_SREG() macro as that takes care
+ *          of whether to read from the VMCS cache or not.
+ */
+static int hmR0VmxImportGuestSegmentReg(PVMCPU pVCpu, uint32_t idxSel, uint32_t idxLimit, uint32_t idxBase, uint32_t idxAccess,
+                                        PCPUMSELREG pSelReg)
 {
     NOREF(pVCpu);
 
-    uint32_t u32Val = 0;
-    int rc = VMXReadVmcs32(idxSel, &u32Val);
+    uint32_t u32Sel;
+    uint32_t u32Limit;
+    uint32_t u32Attr;
+    uint64_t u64Base;
+    int rc = VMXReadVmcs32(idxSel, &u32Sel);
+    rc    |= VMXReadVmcs32(idxLimit, &u32Limit);
+    rc    |= VMXReadVmcs32(idxAccess, &u32Attr);
+    rc    |= VMXReadVmcsGstNByIdxVal(idxBase, &u64Base);
     AssertRCReturn(rc, rc);
-    pSelReg->Sel      = (uint16_t)u32Val;
-    pSelReg->ValidSel = (uint16_t)u32Val;
+
+    pSelReg->Sel      = (uint16_t)u32Sel;
+    pSelReg->ValidSel = (uint16_t)u32Sel;
     pSelReg->fFlags   = CPUMSELREG_FLAGS_VALID;
-
-    rc = VMXReadVmcs32(idxLimit, &u32Val);
-    AssertRCReturn(rc, rc);
-    pSelReg->u32Limit = u32Val;
-
-    uint64_t u64Val = 0;
-    rc = VMXReadVmcsGstNByIdxVal(idxBase, &u64Val);
-    AssertRCReturn(rc, rc);
-    pSelReg->u64Base = u64Val;
-
-    rc = VMXReadVmcs32(idxAccess, &u32Val);
-    AssertRCReturn(rc, rc);
-    pSelReg->Attr.u = u32Val;
+    pSelReg->u32Limit = u32Limit;
+    pSelReg->u64Base  = u64Base;
+    pSelReg->Attr.u   = u32Attr;
 
     /*
@@ -6820 +6007 @@
 
         /* Masking off: X86DESCATTR_P, X86DESCATTR_LIMIT_HIGH, and X86DESCATTR_AVL. The latter two are really irrelevant. */
-        pSelReg->Attr.u &= X86DESCATTR_UNUSABLE | X86DESCATTR_L | X86DESCATTR_D | X86DESCATTR_G
-                         | X86DESCATTR_DPL | X86DESCATTR_TYPE | X86DESCATTR_DT;
-
-        Log4(("hmR0VmxReadSegmentReg: Unusable idxSel=%#x attr=%#x -> %#x\n", idxSel, u32Val, pSelReg->Attr.u));
+        pSelReg->Attr.u &= X86DESCATTR_UNUSABLE | X86DESCATTR_L    | X86DESCATTR_D  | X86DESCATTR_G
+                         | X86DESCATTR_DPL      | X86DESCATTR_TYPE | X86DESCATTR_DT;
+
+        Log4Func(("Unusable idxSel=%#x attr=%#x -> %#x\n", idxSel, u32Sel, pSelReg->Attr.u));
 #ifdef DEBUG_bird
-        AssertMsg((u32Val & ~X86DESCATTR_P) == pSelReg->Attr.u,
+        AssertMsg((u32Attr & ~X86DESCATTR_P) == pSelReg->Attr.u,
                   ("%#x: %#x != %#x (sel=%#x base=%#llx limit=%#x)\n",
                    idxSel, u32Val, pSelReg->Attr.u, pSelReg->Sel, pSelReg->u64Base, pSelReg->u32Limit));
@@ -6833 +6020 @@
 }
 
-/**
- * Saves the guest segment registers from the current VMCS into the guest-CPU
- * context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestSegmentRegs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    /* Guest segment registers. */
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SEGMENT_REGS))
-    {
-        /** @todo r=ramshankar: Why do we save CR0 here? */
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_SEGMENT_REGS));
-        int rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-        AssertRCReturn(rc, rc);
-
-        rc  = HMVMX_SAVE_SREG(CS, &pMixedCtx->cs);
-        rc |= HMVMX_SAVE_SREG(SS, &pMixedCtx->ss);
-        rc |= HMVMX_SAVE_SREG(DS, &pMixedCtx->ds);
-        rc |= HMVMX_SAVE_SREG(ES, &pMixedCtx->es);
-        rc |= HMVMX_SAVE_SREG(FS, &pMixedCtx->fs);
-        rc |= HMVMX_SAVE_SREG(GS, &pMixedCtx->gs);
-        AssertRCReturn(rc, rc);
-
-        /* Restore segment attributes for real-on-v86 mode hack. */
-        if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-        {
-            pMixedCtx->cs.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrCS.u;
-            pMixedCtx->ss.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrSS.u;
-            pMixedCtx->ds.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrDS.u;
-            pMixedCtx->es.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrES.u;
-            pMixedCtx->fs.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrFS.u;
-            pMixedCtx->gs.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrGS.u;
-        }
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SEGMENT_REGS);
-    }
-
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Saves the guest SS register from the current VMCS into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestCs(PVMCPU pVCpu)
-{
-    /** @todo optimize this? */
-    return hmR0VmxSaveGuestSegmentRegs(pVCpu, &pVCpu->cpum.GstCtx);
-}
-
-
-/**
- * Saves the guest descriptor table registers and task register from the current
- * VMCS into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestTableRegs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    int rc = VINF_SUCCESS;
-
-    /* Guest LDTR. */
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_LDTR))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_LDTR));
-        rc = HMVMX_SAVE_SREG(LDTR, &pMixedCtx->ldtr);
-        AssertRCReturn(rc, rc);
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_LDTR);
-    }
-
-    /* Guest GDTR. */
-    uint64_t u64Val = 0;
-    uint32_t u32Val = 0;
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_GDTR))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_GDTR));
-        rc  = VMXReadVmcsGstN(VMX_VMCS_GUEST_GDTR_BASE, &u64Val);
-        rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_GDTR_LIMIT, &u32Val);      AssertRCReturn(rc, rc);
-        pMixedCtx->gdtr.pGdt  = u64Val;
-        pMixedCtx->gdtr.cbGdt = u32Val;
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_GDTR);
-    }
-
-    /* Guest IDTR. */
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_IDTR))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_IDTR));
-        rc  = VMXReadVmcsGstN(VMX_VMCS_GUEST_IDTR_BASE, &u64Val);
-        rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_IDTR_LIMIT, &u32Val);      AssertRCReturn(rc, rc);
-        pMixedCtx->idtr.pIdt  = u64Val;
-        pMixedCtx->idtr.cbIdt = u32Val;
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_IDTR);
-    }
-
-    /* Guest TR. */
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_TR))
-    {
-        Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_TR));
-        rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-        AssertRCReturn(rc, rc);
-
-        /* For real-mode emulation using virtual-8086 mode we have the fake TSS (pRealModeTSS) in TR, don't save the fake one. */
-        if (!pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-        {
-            rc = HMVMX_SAVE_SREG(TR, &pMixedCtx->tr);
-            AssertRCReturn(rc, rc);
-        }
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_TR);
-    }
-    return rc;
-}
-
-
-/**
- * Saves the guest debug-register DR7 from the current VMCS into the guest-CPU
- * context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestDR7(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    if (!HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_DR7))
-    {
-        if (!pVCpu->hm.s.fUsingHyperDR7)
-        {
-            /* Upper 32-bits are always zero. See Intel spec. 2.7.3 "Loading and Storing Debug Registers". */
-            uint32_t u32Val;
-            int rc = VMXReadVmcs32(VMX_VMCS_GUEST_DR7, &u32Val);    AssertRCReturn(rc, rc);
-            pMixedCtx->dr[7] = u32Val;
-        }
-
-        HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_DR7);
-    }
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Saves the guest APIC state from the current VMCS into the guest-CPU context.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data maybe
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- *
- * @remarks No-long-jump zone!!!
- */
-static int hmR0VmxSaveGuestApicState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    NOREF(pMixedCtx);
-
-    /* Updating TPR is already done in hmR0VmxPostRunGuest(). Just update the flag. */
-    HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_APIC_STATE);
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Worker for VMXR0ImportStateOnDemand.
+
+/**
+ * Imports the guest RIP from the VMCS back into the guest-CPU context.
  *
  * @returns VBox status code.
  * @param   pVCpu   The cross context virtual CPU structure.
- * @param   pCtx    Pointer to the guest-CPU context.
+ *
+ * @remarks Called with interrupts and/or preemption disabled, should not assert!
+ * @remarks Do -not- call this function directly, use hmR0VmxImportGuestState()
+ *          instead!!!
+ */
+DECLINLINE(int) hmR0VmxImportGuestRip(PVMCPU pVCpu)
+{
+    uint64_t u64Val;
+    PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
+    if (pCtx->fExtrn & CPUMCTX_EXTRN_RIP)
+    {
+        int rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_RIP, &u64Val);
+        if (RT_SUCCESS(rc))
+        {
+            pCtx->rip = u64Val;
+            pCtx->fExtrn &= ~CPUMCTX_EXTRN_RIP;
+        }
+        return rc;
+    }
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Imports the guest RFLAGS from the VMCS back into the guest-CPU context.
+ *
+ * @returns VBox status code.
+ * @param   pVCpu   The cross context virtual CPU structure.
+ *
+ * @remarks Called with interrupts and/or preemption disabled, should not assert!
+ * @remarks Do -not- call this function directly, use hmR0VmxImportGuestState()
+ *          instead!!!
+ */
+DECLINLINE(int) hmR0VmxImportGuestRFlags(PVMCPU pVCpu)
+{
+    uint32_t u32Val;
+    PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
+    if (pCtx->fExtrn & CPUMCTX_EXTRN_RFLAGS)
+    {
+        int rc = VMXReadVmcs32(VMX_VMCS_GUEST_RFLAGS, &u32Val);
+        if (RT_SUCCESS(rc))
+        {
+            pCtx->eflags.u32 = u32Val;
+
+            /* Restore eflags for real-on-v86-mode hack. */
+            if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
+            {
+                pCtx->eflags.Bits.u1VM   = 0;
+                pCtx->eflags.Bits.u2IOPL = pVCpu->hm.s.vmx.RealMode.Eflags.Bits.u2IOPL;
+            }
+        }
+        pCtx->fExtrn &= ~CPUMCTX_EXTRN_RFLAGS;
+        return rc;
+    }
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Imports the guest interruptibility-state from the VMCS back into the guest-CPU
+ * context.
+ *
+ * @returns VBox status code.
+ * @param   pVCpu   The cross context virtual CPU structure.
+ *
+ * @remarks Called with interrupts and/or preemption disabled, should not assert!
+ * @remarks Do -not- call this function directly, use hmR0VmxImportGuestState()
+ *          instead!!!
+ */
+DECLINLINE(int) hmR0VmxImportGuestIntrState(PVMCPU pVCpu)
+{
+    uint32_t u32Val;
+    PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
+    int rc = VMXReadVmcs32(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &u32Val);
+    if (RT_SUCCESS(rc))
+    {
+        /*
+         * We additionally have a requirement to import RIP, RFLAGS depending on whether we
+         * might need them in hmR0VmxEvaluatePendingEvent().
+         */
+        if (!u32Val)
+        {
+            if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
+            {
+                rc =  hmR0VmxImportGuestRip(pVCpu);
+                rc |= hmR0VmxImportGuestRFlags(pVCpu);
+                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
+            }
+
+            if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
+                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
+        }
+        else
+        {
+            rc =  hmR0VmxImportGuestRip(pVCpu);
+            rc |= hmR0VmxImportGuestRFlags(pVCpu);
+
+            if (u32Val & (  VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS
+                          | VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI))
+            {
+                EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
+            }
+            else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
+                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
+
+            if (u32Val & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_NMI)
+            {
+                if (!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
+                    VMCPU_FF_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
+            }
+            else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
+                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
+        }
+    }
+    return rc;
+}
+
+
+/**
+ * Worker for VMXR0ImportStateOnDemand.
+ *
+ * @returns VBox status code.
+ * @param   pVCpu   The cross context virtual CPU structure.
  * @param   fWhat   What to import, CPUMCTX_EXTRN_XXX.
  */
-static int hmR0VmxImportGuestState(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t fWhat)
-{
-    int      rc = VINF_SUCCESS;
-    PVM      pVM = pVCpu->CTX_SUFF(pVM);
+static int hmR0VmxImportGuestState(PVMCPU pVCpu, uint64_t fWhat)
+{
+#define VMXLOCAL_BREAK_RC(a_rc) \
+    if (RT_FAILURE(a_rc))       \
+        break
+
+    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatImportGuestState, x);
+
+    int      rc   = VINF_SUCCESS;
+    PVM      pVM  = pVCpu->CTX_SUFF(pVM);
+    PCPUMCTX pCtx = &pVCpu->cpum.GstCtx;
     uint64_t u64Val;
     uint32_t u32Val;
-    uint32_t u32Shadow;
+
+    Log4Func(("fExtrn=%#RX64 fWhat=%#RX64\n", pCtx->fExtrn, fWhat));
 
     /*
-     * Though we can longjmp to ring-3 due to log-flushes here and get re-invoked
-     * on the ring-3 callback path, there is no real need to.
+     * We disable interrupts to make the updating of the state and in particular
+     * the fExtrn modification atomic wrt to preemption hooks.
      */
-    if (VMMRZCallRing3IsEnabled(pVCpu))
-        VMMR0LogFlushDisable(pVCpu);
+    RTCCUINTREG const fEFlags = ASMIntDisableFlags();
+
+    fWhat &= pCtx->fExtrn;
+    if (fWhat & pCtx->fExtrn)
+    {
+        do
+        {
+            if (fWhat & CPUMCTX_EXTRN_RIP)
+            {
+                rc = hmR0VmxImportGuestRip(pVCpu);
+                VMXLOCAL_BREAK_RC(rc);
+            }
+
+            if (fWhat & CPUMCTX_EXTRN_RFLAGS)
+            {
+                rc = hmR0VmxImportGuestRFlags(pVCpu);
+                VMXLOCAL_BREAK_RC(rc);
+            }
+
+            if (fWhat & CPUMCTX_EXTRN_HM_VMX_INT_STATE)
+            {
+                rc = hmR0VmxImportGuestIntrState(pVCpu);
+                VMXLOCAL_BREAK_RC(rc);
+            }
+
+            if (fWhat & CPUMCTX_EXTRN_RSP)
+            {
+                rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_RSP, &u64Val);
+                VMXLOCAL_BREAK_RC(rc);
+                pCtx->rsp = u64Val;
+            }
+
+            if (fWhat & CPUMCTX_EXTRN_SREG_MASK)
+            {
+                if (fWhat & CPUMCTX_EXTRN_CS)
+                {
+                    rc = HMVMX_IMPORT_SREG(CS, &pCtx->cs);
+                    VMXLOCAL_BREAK_RC(rc);
+                    if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
+                        pCtx->cs.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrCS.u;
+                }
+                if (fWhat & CPUMCTX_EXTRN_SS)
+                {
+                    rc = HMVMX_IMPORT_SREG(SS, &pCtx->ss);
+                    VMXLOCAL_BREAK_RC(rc);
+                    if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
+                        pCtx->ss.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrSS.u;
+                }
+                if (fWhat & CPUMCTX_EXTRN_DS)
+                {
+                    rc = HMVMX_IMPORT_SREG(DS, &pCtx->ds);
+                    VMXLOCAL_BREAK_RC(rc);
+                    if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
+                        pCtx->ds.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrDS.u;
+                }
+                if (fWhat & CPUMCTX_EXTRN_ES)
+                {
+                    rc = HMVMX_IMPORT_SREG(ES, &pCtx->es);
+                    VMXLOCAL_BREAK_RC(rc);
+                    if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
+                        pCtx->es.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrES.u;
+                }
+               if (fWhat & CPUMCTX_EXTRN_FS)
+               {
+                    rc = HMVMX_IMPORT_SREG(FS, &pCtx->fs);
+                    VMXLOCAL_BREAK_RC(rc);
+                    if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
+                        pCtx->fs.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrFS.u;
+               }
+                if (fWhat & CPUMCTX_EXTRN_GS)
+                {
+                    rc = HMVMX_IMPORT_SREG(GS, &pCtx->gs);
+                    VMXLOCAL_BREAK_RC(rc);
+                    if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
+                        pCtx->gs.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrGS.u;
+                }
+            }
+
+            if (fWhat & CPUMCTX_EXTRN_TABLE_MASK)
+            {
+                if (fWhat & CPUMCTX_EXTRN_LDTR)
+                {
+                    rc = HMVMX_IMPORT_SREG(LDTR, &pCtx->ldtr);
+                    VMXLOCAL_BREAK_RC(rc);
+                }
+
+                if (fWhat & CPUMCTX_EXTRN_GDTR)
+                {
+                    rc  = VMXReadVmcsGstN(VMX_VMCS_GUEST_GDTR_BASE,  &u64Val);
+                    rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_GDTR_LIMIT, &u32Val);
+                    VMXLOCAL_BREAK_RC(rc);
+                    pCtx->gdtr.pGdt  = u64Val;
+                    pCtx->gdtr.cbGdt = u32Val;
+                }
+
+                /* Guest IDTR. */
+                if (fWhat & CPUMCTX_EXTRN_IDTR)
+                {
+                    rc  = VMXReadVmcsGstN(VMX_VMCS_GUEST_IDTR_BASE,  &u64Val);
+                    rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_IDTR_LIMIT, &u32Val);
+                    VMXLOCAL_BREAK_RC(rc);
+                    pCtx->idtr.pIdt  = u64Val;
+                    pCtx->idtr.cbIdt = u32Val;
+                }
+
+                /* Guest TR. */
+                if (fWhat & CPUMCTX_EXTRN_TR)
+                {
+                    /* Real-mode emulation using virtual-8086 mode has the fake TSS (pRealModeTSS) in TR, don't save that one. */
+                    if (!pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
+                    {
+                        rc = HMVMX_IMPORT_SREG(TR, &pCtx->tr);
+                        VMXLOCAL_BREAK_RC(rc);
+                    }
+                }
+            }
+
+            if (fWhat & CPUMCTX_EXTRN_SYSENTER_MSRS)
+            {
+                rc  = VMXReadVmcsGstN(VMX_VMCS_GUEST_SYSENTER_EIP, &pCtx->SysEnter.eip);
+                rc |= VMXReadVmcsGstN(VMX_VMCS_GUEST_SYSENTER_ESP, &pCtx->SysEnter.esp);
+                rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_SYSENTER_CS,  &u32Val);
+                pCtx->SysEnter.cs = u32Val;
+                VMXLOCAL_BREAK_RC(rc);
+            }
+
+#if HC_ARCH_BITS == 64
+            if (fWhat & CPUMCTX_EXTRN_KERNEL_GS_BASE)
+            {
+                if (   pVM->hm.s.fAllow64BitGuests
+                    && (pVCpu->hm.s.vmx.fLazyMsrs & VMX_LAZY_MSRS_LOADED_GUEST))
+                    pCtx->msrKERNELGSBASE = ASMRdMsr(MSR_K8_KERNEL_GS_BASE);
+            }
+
+            if (fWhat & CPUMCTX_EXTRN_SYSCALL_MSRS)
+            {
+                if (   pVM->hm.s.fAllow64BitGuests
+                    && (pVCpu->hm.s.vmx.fLazyMsrs & VMX_LAZY_MSRS_LOADED_GUEST))
+                {
+                    pCtx->msrLSTAR  = ASMRdMsr(MSR_K8_LSTAR);
+                    pCtx->msrSTAR   = ASMRdMsr(MSR_K6_STAR);
+                    pCtx->msrSFMASK = ASMRdMsr(MSR_K8_SF_MASK);
+                }
+            }
+#endif
+
+            if (   (fWhat & (CPUMCTX_EXTRN_TSC_AUX | CPUMCTX_EXTRN_OTHER_MSRS))
+#if HC_ARCH_BITS == 32
+                || (fWhat & (CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_SYSCALL_MSRS))
+#endif
+                )
+            {
+                PCVMXAUTOMSR   pMsr  = (PVMXAUTOMSR)pVCpu->hm.s.vmx.pvGuestMsr;
+                uint32_t const cMsrs = pVCpu->hm.s.vmx.cMsrs;
+                for (uint32_t i = 0; i < cMsrs; i++, pMsr++)
+                {
+                    switch (pMsr->u32Msr)
+                    {
+#if HC_ARCH_BITS == 32
+                        case MSR_K8_LSTAR:          pCtx->msrLSTAR        = pMsr->u64Value;         break;
+                        case MSR_K6_STAR:           pCtx->msrSTAR         = pMsr->u64Value;         break;
+                        case MSR_K8_SF_MASK:        pCtx->msrSFMASK       = pMsr->u64Value;         break;
+                        case MSR_K8_KERNEL_GS_BASE: pCtx->msrKERNELGSBASE = pMsr->u64Value;         break;
+#endif
+                        case MSR_IA32_SPEC_CTRL:    CPUMSetGuestSpecCtrl(pVCpu, pMsr->u64Value);    break;
+                        case MSR_K8_TSC_AUX:        CPUMSetGuestTscAux(pVCpu, pMsr->u64Value);      break;
+                        default:
+                        {
+                            AssertMsgFailed(("Unexpected MSR in auto-load/store area. uMsr=%#RX32 cMsrs=%u\n", pMsr->u32Msr,
+                                             cMsrs));
+                            pVCpu->hm.s.u32HMError = pMsr->u32Msr;
+                            return VERR_HM_UNEXPECTED_LD_ST_MSR;
+                        }
+                    }
+                }
+            }
+
+            if (fWhat & CPUMCTX_EXTRN_DR7)
+            {
+                if (!pVCpu->hm.s.fUsingHyperDR7)
+                {
+                    /* Upper 32-bits are always zero. See Intel spec. 2.7.3 "Loading and Storing Debug Registers". */
+                    rc = VMXReadVmcs32(VMX_VMCS_GUEST_DR7, &u32Val);
+                    VMXLOCAL_BREAK_RC(rc);
+                    pCtx->dr[7] = u32Val;
+                }
+            }
+
+            if (fWhat & CPUMCTX_EXTRN_CR_MASK)
+            {
+                uint32_t u32Shadow;
+                /* CR0 required for saving CR3 below, see CPUMIsGuestPagingEnabledEx(). */
+                if (fWhat & CPUMCTX_EXTRN_CR0)
+                {
+                    rc  = VMXReadVmcs32(VMX_VMCS_GUEST_CR0,            &u32Val);
+                    rc |= VMXReadVmcs32(VMX_VMCS_CTRL_CR0_READ_SHADOW, &u32Shadow);
+                    VMXLOCAL_BREAK_RC(rc);
+                    u32Val = (u32Val & ~pVCpu->hm.s.vmx.u32CR0Mask)
+                           | (u32Shadow & pVCpu->hm.s.vmx.u32CR0Mask);
+                    VMMRZCallRing3Disable(pVCpu);   /* Calls into PGM which has Log statements. */
+                    CPUMSetGuestCR0(pVCpu, u32Val);
+                    VMMRZCallRing3Enable(pVCpu);
+                }
+
+                /* CR4 required for saving CR3 below, see CPUMIsGuestInPAEModeEx(). */
+                if (fWhat & CPUMCTX_EXTRN_CR4)
+                {
+                    rc  = VMXReadVmcs32(VMX_VMCS_GUEST_CR4,            &u32Val);
+                    rc |= VMXReadVmcs32(VMX_VMCS_CTRL_CR4_READ_SHADOW, &u32Shadow);
+                    VMXLOCAL_BREAK_RC(rc);
+                    u32Val = (u32Val & ~pVCpu->hm.s.vmx.u32CR4Mask)
+                           | (u32Shadow & pVCpu->hm.s.vmx.u32CR4Mask);
+                    CPUMSetGuestCR4(pVCpu, u32Val);
+                }
+
+                if (fWhat & CPUMCTX_EXTRN_CR3)
+                {
+                    if (   pVM->hm.s.vmx.fUnrestrictedGuest
+                        || (   pVM->hm.s.fNestedPaging
+                            && CPUMIsGuestPagingEnabledEx(pCtx))) /* PG bit changes are always intercepted, so it's up to date. */
+                    {
+                        rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_CR3, &u64Val);
+                        if (pCtx->cr3 != u64Val)
+                        {
+                            CPUMSetGuestCR3(pVCpu, u64Val);
+                            VMCPU_FF_SET(pVCpu, VMCPU_FF_HM_UPDATE_CR3);
+                        }
+
+                        /* If the guest is in PAE mode, sync back the PDPE's into the guest state. */
+                        if (CPUMIsGuestInPAEModeEx(pCtx))
+                        {
+                            rc  = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, &pVCpu->hm.s.aPdpes[0].u);
+                            rc |= VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, &pVCpu->hm.s.aPdpes[1].u);
+                            rc |= VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, &pVCpu->hm.s.aPdpes[2].u);
+                            rc |= VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, &pVCpu->hm.s.aPdpes[3].u);
+                            VMXLOCAL_BREAK_RC(rc);
+                            VMCPU_FF_SET(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES);
+                        }
+                    }
+                }
+            }
+        } while (0);
+
+        if (RT_SUCCESS(rc))
+        {
+            /* Update fExtrn. */
+            pCtx->fExtrn &= ~fWhat;
+
+            /* If everything has been imported, clear the HM keeper bit. */
+            if (!(pCtx->fExtrn & HMVMX_CPUMCTX_EXTRN_ALL))
+            {
+                pCtx->fExtrn &= ~CPUMCTX_EXTRN_KEEPER_HM;
+                Assert(!pCtx->fExtrn);
+            }
+        }
+    }
     else
-        Assert(VMMR0IsLogFlushDisabled(pVCpu));
-    Log4Func(("fExtrn=%#RX64 fWhat=%#RX64\n", pCtx->fExtrn, fWhat));
+        AssertMsg(!pCtx->fExtrn || (pCtx->fExtrn & HMVMX_CPUMCTX_EXTRN_ALL), ("%#RX64\n", pCtx->fExtrn));
+
+    ASMSetFlags(fEFlags);
+
+    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatImportGuestState, x);
 
     /*
+     * Honor any pending CR3 updates.
+     *
      * Consider this scenario: VM-exit -> VMMRZCallRing3Enable() -> do stuff that causes a longjmp -> hmR0VmxCallRing3Callback()
      * -> VMMRZCallRing3Disable() -> hmR0VmxImportGuestState() -> Sets VMCPU_FF_HM_UPDATE_CR3 pending -> return from the longjmp
@@ -7047 +6444 @@
      * if any CR3-saves -before- the VM-exit (longjmp) postponed the CR3 update via the force-flag, any VM-exit handler that
      * calls into PGM when it re-saves CR3 will end up here and we call PGMUpdateCR3(). This is why the code below should
-     * -NOT- check if HMVMX_UPDATED_GUEST_CR3 is already set or not!
+     * -NOT- check if CPUMCTX_EXTRN_CR3 is set!
      *
      * The longjmp exit path can't check these CR3 force-flags and call code that takes a lock again. We cover for it here.
@@ -7053 +6450 @@
     if (VMMRZCallRing3IsEnabled(pVCpu))
     {
+        VMMR0LogFlushDisable(pVCpu);
+
         if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_CR3))
             PGMUpdateCR3(pVCpu, CPUMGetGuestCR3(pVCpu));
@@ -7065 +6464 @@
     }
 
-    Assert(!(fWhat & CPUMCTX_EXTRN_KEEPER_HM));
-    fWhat &= pCtx->fExtrn;
-
-    /* If there is nothing more to import, bail early. */
-    if (!(fWhat & HMVMX_CPUMCTX_EXTRN_ALL))
-        return VINF_SUCCESS;
-
-    /* RIP required while saving interruptibility-state below, see EMSetInhibitInterruptsPC(). */
-    if (fWhat & (CPUMCTX_EXTRN_RIP | CPUMCTX_EXTRN_HM_VMX_INT_STATE))
-    {
-        rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_RIP, &u64Val);
-        AssertRCReturn(rc, rc);
-        pCtx->rip = u64Val;
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_RIP);
-    }
-
-    /* RFLAGS and interruptibility-state required while re-evaluating interrupt injection, see hmR0VmxGetGuestIntrState(). */
-    if (fWhat & (CPUMCTX_EXTRN_RFLAGS | CPUMCTX_EXTRN_HM_VMX_INT_STATE))
-    {
-        rc = VMXReadVmcs32(VMX_VMCS_GUEST_RFLAGS, &u32Val);
-        AssertRCReturn(rc, rc);
-        pCtx->eflags.u32 = u32Val;
-        /* Restore eflags for real-on-v86-mode hack. */
-        if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-        {
-            Assert(pVM->hm.s.vmx.pRealModeTSS);
-            pCtx->eflags.Bits.u1VM   = 0;
-            pCtx->eflags.Bits.u2IOPL = pVCpu->hm.s.vmx.RealMode.Eflags.Bits.u2IOPL;
-        }
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_RFLAGS);
-    }
-
-    if (fWhat & CPUMCTX_EXTRN_HM_VMX_INT_STATE)
-    {
-        rc = VMXReadVmcs32(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &u32Val);
-        AssertRCReturn(rc, rc);
-        if (!u32Val)
-        {
-            if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
-                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
-
-            if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
-                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
-        }
-        else
-        {
-            if (u32Val & (  VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS
-                          | VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI))
-            {
-                EMSetInhibitInterruptsPC(pVCpu, pCtx->rip);
-                Assert(VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
-            }
-            else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
-                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS);
-
-            if (u32Val & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_NMI)
-            {
-                if (!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
-                    VMCPU_FF_SET(pVCpu, VMCPU_FF_BLOCK_NMIS);
-            }
-            else if (VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_BLOCK_NMIS))
-                VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_BLOCK_NMIS);
-        }
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_HM_VMX_INT_STATE);
-    }
-
-    if (fWhat & CPUMCTX_EXTRN_RSP)
-    {
-        rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_RSP, &u64Val);
-        AssertRCReturn(rc, rc);
-        pCtx->rsp = u64Val;
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_RSP);
-    }
-
-    if (fWhat & CPUMCTX_EXTRN_SREG_MASK)
-    {
-        if (fWhat & CPUMCTX_EXTRN_CS)
-        {
-            rc = HMVMX_SAVE_SREG(CS, &pCtx->cs);
-            AssertRCReturn(rc, rc);
-            if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-                pCtx->cs.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrCS.u;
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_CS);
-        }
-        if (fWhat & CPUMCTX_EXTRN_SS)
-        {
-            rc = HMVMX_SAVE_SREG(SS, &pCtx->ss);
-            if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-                pCtx->ss.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrSS.u;
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_SS);
-        }
-        if (fWhat & CPUMCTX_EXTRN_DS)
-        {
-            rc = HMVMX_SAVE_SREG(DS, &pCtx->ds);
-            AssertRCReturn(rc, rc);
-            if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-                pCtx->ds.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrDS.u;
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_DS);
-        }
-        if (fWhat & CPUMCTX_EXTRN_ES)
-        {
-            rc = HMVMX_SAVE_SREG(ES, &pCtx->es);
-            AssertRCReturn(rc, rc);
-            if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-                pCtx->es.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrES.u;
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_ES);
-        }
-       if (fWhat & CPUMCTX_EXTRN_FS)
-       {
-            rc = HMVMX_SAVE_SREG(FS, &pCtx->fs);
-            AssertRCReturn(rc, rc);
-            if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-                pCtx->fs.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrFS.u;
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_FS);
-       }
-        if (fWhat & CPUMCTX_EXTRN_GS)
-        {
-            rc = HMVMX_SAVE_SREG(GS, &pCtx->gs);
-            AssertRCReturn(rc, rc);
-            if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-                pCtx->gs.Attr.u = pVCpu->hm.s.vmx.RealMode.AttrGS.u;
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_GS);
-        }
-    }
-
-    if (fWhat & CPUMCTX_EXTRN_TABLE_MASK)
-    {
-        if (fWhat & CPUMCTX_EXTRN_LDTR)
-        {
-            rc = HMVMX_SAVE_SREG(LDTR, &pCtx->ldtr);
-            AssertRCReturn(rc, rc);
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_LDTR);
-        }
-
-        if (fWhat & CPUMCTX_EXTRN_GDTR)
-        {
-            rc  = VMXReadVmcsGstN(VMX_VMCS_GUEST_GDTR_BASE,  &u64Val);
-            rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_GDTR_LIMIT, &u32Val);
-            AssertRCReturn(rc, rc);
-            pCtx->gdtr.pGdt  = u64Val;
-            pCtx->gdtr.cbGdt = u32Val;
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_GDTR);
-        }
-
-        /* Guest IDTR. */
-        if (fWhat & CPUMCTX_EXTRN_IDTR)
-        {
-            rc  = VMXReadVmcsGstN(VMX_VMCS_GUEST_IDTR_BASE,  &u64Val);
-            rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_IDTR_LIMIT, &u32Val);
-            AssertRCReturn(rc, rc);
-            pCtx->idtr.pIdt  = u64Val;
-            pCtx->idtr.cbIdt = u32Val;
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_IDTR);
-        }
-
-        /* Guest TR. */
-        if (fWhat & CPUMCTX_EXTRN_TR)
-        {
-            /* Real-mode emulation using virtual-8086 mode has the fake TSS (pRealModeTSS) in TR, don't save that one. */
-            if (!pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
-            {
-                rc = HMVMX_SAVE_SREG(TR, &pCtx->tr);
-                AssertRCReturn(rc, rc);
-            }
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_TR);
-        }
-    }
-
-    if (fWhat & CPUMCTX_EXTRN_SYSENTER_MSRS)
-    {
-        rc  = VMXReadVmcsGstN(VMX_VMCS_GUEST_SYSENTER_EIP, &pCtx->SysEnter.eip);
-        rc |= VMXReadVmcsGstN(VMX_VMCS_GUEST_SYSENTER_ESP, &pCtx->SysEnter.esp);
-        rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_SYSENTER_CS,  &u32Val);
-        pCtx->SysEnter.cs = u32Val;
-        AssertRCReturn(rc, rc);
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_SYSENTER_MSRS);
-    }
-
-#if HC_ARCH_BITS == 64
-    if (fWhat & CPUMCTX_EXTRN_KERNEL_GS_BASE)
-    {
-        if (   pVM->hm.s.fAllow64BitGuests
-            && (pVCpu->hm.s.vmx.fLazyMsrs & VMX_LAZY_MSRS_LOADED_GUEST))
-            pCtx->msrKERNELGSBASE = ASMRdMsr(MSR_K8_KERNEL_GS_BASE);
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_KERNEL_GS_BASE);
-    }
-
-    if (fWhat & CPUMCTX_EXTRN_SYSCALL_MSRS)
-    {
-        if (   pVM->hm.s.fAllow64BitGuests
-            && (pVCpu->hm.s.vmx.fLazyMsrs & VMX_LAZY_MSRS_LOADED_GUEST))
-        {
-            pCtx->msrLSTAR  = ASMRdMsr(MSR_K8_LSTAR);
-            pCtx->msrSTAR   = ASMRdMsr(MSR_K6_STAR);
-            pCtx->msrSFMASK = ASMRdMsr(MSR_K8_SF_MASK);
-        }
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_SYSCALL_MSRS);
-    }
-#endif
-
-    if (   (fWhat & (CPUMCTX_EXTRN_TSC_AUX | CPUMCTX_EXTRN_OTHER_MSRS))
-#if HC_ARCH_BITS == 32
-        || (fWhat & (CPUMCTX_EXTRN_KERNEL_GS_BASE | CPUMCTX_EXTRN_SYSCALL_MSRS))
-#endif
-        )
-    {
-        PCVMXAUTOMSR   pMsr  = (PVMXAUTOMSR)pVCpu->hm.s.vmx.pvGuestMsr;
-        uint32_t const cMsrs = pVCpu->hm.s.vmx.cMsrs;
-        for (uint32_t i = 0; i < cMsrs; i++, pMsr++)
-        {
-            switch (pMsr->u32Msr)
-            {
-#if HC_ARCH_BITS == 32
-                case MSR_K8_LSTAR:          pCtx->msrLSTAR        = pMsr->u64Value;         break;
-                case MSR_K6_STAR:           pCtx->msrSTAR         = pMsr->u64Value;         break;
-                case MSR_K8_SF_MASK:        pCtx->msrSFMASK       = pMsr->u64Value;         break;
-                case MSR_K8_KERNEL_GS_BASE: pCtx->msrKERNELGSBASE = pMsr->u64Value;         break;
-#endif
-                case MSR_IA32_SPEC_CTRL:    CPUMSetGuestSpecCtrl(pVCpu, pMsr->u64Value);    break;
-                case MSR_K8_TSC_AUX:
-                {
-                    /* CPUMSetGuestTscAux alters fExtrn without using atomics, so disable preemption temporarily. */
-                    HM_DISABLE_PREEMPT();
-                    CPUMSetGuestTscAux(pVCpu, pMsr->u64Value);
-                    HM_RESTORE_PREEMPT();
-                    break;
-                }
-                default:
-                {
-                    AssertMsgFailed(("Unexpected MSR in auto-load/store area. uMsr=%#RX32 cMsrs=%u\n", pMsr->u32Msr, cMsrs));
-                    pVCpu->hm.s.u32HMError = pMsr->u32Msr;
-                    return VERR_HM_UNEXPECTED_LD_ST_MSR;
-                }
-            }
-        }
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~(  CPUMCTX_EXTRN_TSC_AUX
-                                           | CPUMCTX_EXTRN_OTHER_MSRS
-#if HC_ARCH_BITS == 32
-                                           | CPUMCTX_EXTRN_KERNEL_GS_BASE
-                                           | CPUMCTX_EXTRN_SYSCALL_MSRS
-#endif
-                                           ));
-    }
-
-    if (fWhat & CPUMCTX_EXTRN_DR7)
-    {
-        if (!pVCpu->hm.s.fUsingHyperDR7)
-        {
-            /* Upper 32-bits are always zero. See Intel spec. 2.7.3 "Loading and Storing Debug Registers". */
-            rc = VMXReadVmcs32(VMX_VMCS_GUEST_DR7, &u32Val);
-            AssertRCReturn(rc, rc);
-            pCtx->dr[7] = u32Val;
-        }
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_DR7);
-    }
-
-    if (fWhat & CPUMCTX_EXTRN_CR_MASK)
-    {
-        /* CR0 required for saving CR3 below, see CPUMIsGuestPagingEnabledEx(). */
-        if (fWhat & (CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3))
-        {
-            rc  = VMXReadVmcs32(VMX_VMCS_GUEST_CR0,            &u32Val);
-            rc |= VMXReadVmcs32(VMX_VMCS_CTRL_CR0_READ_SHADOW, &u32Shadow);
-            AssertRCReturn(rc, rc);
-            u32Val = (u32Val & ~pVCpu->hm.s.vmx.u32CR0Mask)
-                   | (u32Shadow & pVCpu->hm.s.vmx.u32CR0Mask);
-            CPUMSetGuestCR0(pVCpu, u32Val);
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_CR0);
-        }
-
-        /* CR4 required for saving CR3 below, see CPUMIsGuestInPAEModeEx(). */
-        if (fWhat & (CPUMCTX_EXTRN_CR4 | CPUMCTX_EXTRN_CR3))
-        {
-            rc  = VMXReadVmcs32(VMX_VMCS_GUEST_CR4,            &u32Val);
-            rc |= VMXReadVmcs32(VMX_VMCS_CTRL_CR4_READ_SHADOW, &u32Shadow);
-            AssertRCReturn(rc, rc);
-            u32Val = (u32Val & ~pVCpu->hm.s.vmx.u32CR4Mask)
-                   | (u32Shadow & pVCpu->hm.s.vmx.u32CR4Mask);
-            CPUMSetGuestCR4(pVCpu, u32Val);
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_CR4);
-        }
-
-        if (fWhat & CPUMCTX_EXTRN_CR3)
-        {
-            if (   pVM->hm.s.vmx.fUnrestrictedGuest
-                || (   pVM->hm.s.fNestedPaging
-                    && CPUMIsGuestPagingEnabledEx(pCtx)))
-            {
-                rc = VMXReadVmcsGstN(VMX_VMCS_GUEST_CR3, &u64Val);
-                if (pCtx->cr3 != u64Val)
-                {
-                    CPUMSetGuestCR3(pVCpu, u64Val);
-                    if (VMMRZCallRing3IsEnabled(pVCpu))
-                    {
-                        PGMUpdateCR3(pVCpu, u64Val);
-                        Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_CR3));
-                    }
-                    else
-                    {
-                        /* Set the force flag to inform PGM about it when necessary. It is cleared by PGMUpdateCR3().*/
-                        VMCPU_FF_SET(pVCpu, VMCPU_FF_HM_UPDATE_CR3);
-                    }
-                }
-
-                /* If the guest is in PAE mode, sync back the PDPE's into the guest state. */
-                if (CPUMIsGuestInPAEModeEx(pCtx))
-                {
-                    rc  = VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE0_FULL, &pVCpu->hm.s.aPdpes[0].u);
-                    rc |= VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE1_FULL, &pVCpu->hm.s.aPdpes[1].u);
-                    rc |= VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE2_FULL, &pVCpu->hm.s.aPdpes[2].u);
-                    rc |= VMXReadVmcs64(VMX_VMCS64_GUEST_PDPTE3_FULL, &pVCpu->hm.s.aPdpes[3].u);
-                    AssertRCReturn(rc, rc);
-
-                    if (VMMRZCallRing3IsEnabled(pVCpu))
-                    {
-                        PGMGstUpdatePaePdpes(pVCpu, &pVCpu->hm.s.aPdpes[0]);
-                        Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES));
-                    }
-                    else
-                    {
-                        /* Set the force flag to inform PGM about it when necessary. It is cleared by PGMGstUpdatePaePdpes(). */
-                        VMCPU_FF_SET(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES);
-                    }
-                }
-            }
-            ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_CR3);
-        }
-    }
-
-    /* If everything has been imported, clear the HM keeper bit. */
-    if (!(pCtx->fExtrn & HMVMX_CPUMCTX_EXTRN_ALL))
-    {
-        ASMAtomicUoAndU64(&pCtx->fExtrn, ~CPUMCTX_EXTRN_KEEPER_HM);
-        Assert(!pCtx->fExtrn);
-    }
-
     return VINF_SUCCESS;
+#undef VMXLOCAL_BREAK_RC
 }
 
@@ -7410 +6474 @@
  * @returns VBox status code.
  * @param   pVCpu   The cross context virtual CPU structure.
- * @param   pCtx    Pointer to the guest-CPU or nested-guest-CPU context.
  * @param   fWhat   What to import, CPUMCTX_EXTRN_XXX.
  */
-VMMR0DECL(int) VMXR0ImportStateOnDemand(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t fWhat)
-{
-    return hmR0VmxImportGuestState(pVCpu, pCtx, fWhat);
-}
-
-
-/**
- * Saves the entire guest state from the currently active VMCS into the
- * guest-CPU context.
- *
- * This essentially VMREADs all guest-data.
- *
- * @returns VBox status code.
- * @param   pVCpu       The cross context virtual CPU structure.
- * @param   pMixedCtx   Pointer to the guest-CPU context. The data may be
- *                      out-of-sync. Make sure to update the required fields
- *                      before using them.
- */
-static int hmR0VmxSaveGuestState(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    Assert(pVCpu);
-    Assert(pMixedCtx);
-
-    if (HMVMXCPU_GST_VALUE(pVCpu) == HMVMX_UPDATED_GUEST_ALL)
-        return VINF_SUCCESS;
-
-    /* Though we can longjmp to ring-3 due to log-flushes here and get recalled
-       again on the ring-3 callback path, there is no real need to. */
-    if (VMMRZCallRing3IsEnabled(pVCpu))
-        VMMR0LogFlushDisable(pVCpu);
-    else
-        Assert(VMMR0IsLogFlushDisabled(pVCpu));
-    Log4Func(("vcpu[%RU32]\n", pVCpu->idCpu));
-
-    int rc = hmR0VmxSaveGuestRipRspRflags(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestRipRspRflags failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    rc = hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestControlRegs failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    rc = hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestSegmentRegs failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    rc = hmR0VmxSaveGuestTableRegs(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestTableRegs failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    rc = hmR0VmxSaveGuestDR7(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestDR7 failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    rc = hmR0VmxSaveGuestSysenterMsrs(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestSysenterMsrs failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    rc = hmR0VmxSaveGuestLazyMsrs(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestLazyMsrs failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    rc = hmR0VmxSaveGuestAutoLoadStoreMsrs(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestAutoLoadStoreMsrs failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    rc = hmR0VmxSaveGuestActivityState(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestActivityState failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    rc = hmR0VmxSaveGuestApicState(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveGuestApicState failed! rc=%Rrc (pVCpu=%p)\n", rc, pVCpu), rc);
-
-    AssertMsg(HMVMXCPU_GST_VALUE(pVCpu) == HMVMX_UPDATED_GUEST_ALL,
-              ("Missed guest state bits while saving state; missing %RX32 (got %RX32, want %RX32) - check log for any previous errors!\n",
-               HMVMX_UPDATED_GUEST_ALL ^ HMVMXCPU_GST_VALUE(pVCpu), HMVMXCPU_GST_VALUE(pVCpu), HMVMX_UPDATED_GUEST_ALL));
-
-    if (VMMRZCallRing3IsEnabled(pVCpu))
-        VMMR0LogFlushEnable(pVCpu);
-
-    return VINF_SUCCESS;
-}
-
-
-/**
- * Saves basic guest registers needed for IEM instruction execution.
- *
- * @returns VBox status code (OR-able).
- * @param   pVCpu       The cross context virtual CPU structure of the calling EMT.
- * @param   pMixedCtx   Pointer to the CPU context of the guest.
- * @param   fMemory     Whether the instruction being executed operates on
- *                      memory or not.  Only CR0 is synced up if clear.
- * @param   fNeedRsp    Need RSP (any instruction working on GPRs or stack).
- */
-static int hmR0VmxSaveGuestRegsForIemExec(PVMCPU pVCpu, PCPUMCTX pMixedCtx, bool fMemory, bool fNeedRsp)
-{
-    /*
-     * We assume all general purpose registers other than RSP are available.
-     *
-     *   - RIP is a must, as it will be incremented or otherwise changed.
-     *   - RFLAGS are always required to figure the CPL.
-     *   - RSP isn't always required, however it's a GPR, so frequently required.
-     *   - SS and CS are the only segment register needed if IEM doesn't do memory
-     *     access (CPL + 16/32/64-bit mode), but we can only get all segment registers.
-     *   - CR0 is always required by IEM for the CPL, while CR3 and CR4 will only
-     *     be required for memory accesses.
-     *
-     * Note! Before IEM dispatches an exception, it will call us to sync in everything.
-     */
-    int rc  = hmR0VmxSaveGuestRip(pVCpu, pMixedCtx);
-    rc     |= hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-    if (fNeedRsp)
-        rc |= hmR0VmxSaveGuestRsp(pVCpu, pMixedCtx);
-    rc     |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx); /** @todo Only CS and SS are required here. */
-    if (!fMemory)
-        rc |= hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-    else
-        rc |= hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
-    AssertRCReturn(rc, rc);
-    return rc;
-}
-
-
-/**
- * Saves guest registers needed for IEM instruction interpretation.
- *
- * @returns VBox status code (OR-able).
- * @param   pVCpu       The cross context virtual CPU structure of the calling EMT.
- */
-static int hmR0VmxSaveGuestRegsForIemInterpreting(PVMCPU pVCpu)
-{
-    /*
-     * Our goal here is IEM_CPUMCTX_EXTRN_MUST_MASK.
-     *
-     * Note! Before IEM dispatches an exception, it will call us to sync in everything.
-     */
-#if 0 /* later with CPUMCTX_EXTRN_XXX */
-    int rc  = hmR0VmxSaveGuestRip(pVCpu, &pVCpu->cpum.GstCtx);
-    rc     |= hmR0VmxSaveGuestRflags(pVCpu, &pVCpu->cpum.GstCtx);
-    rc     |= hmR0VmxSaveGuestRsp(pVCpu, &pVCpu->cpum.GstCtx);
-    rc     |= hmR0VmxSaveGuestSegmentRegs(pVCpu, &pVCpu->cpum.GstCtx); /** @todo Only CS and SS are strictly required here. */
-    rc     |= hmR0VmxSaveGuestControlRegs(pVCpu, &pVCpu->cpum.GstCtx); /** @todo We don't need CR2 here. */
-    rc     |= hmR0VmxSaveGuestApicState(pVCpu, &pVCpu->cpum.GstCtx);   /** @todo Only TPR is needed here. */
-    rc     |= hmR0VmxSaveGuestDR7(pVCpu, &pVCpu->cpum.GstCtx);
-    /* EFER is always up to date. */
-    AssertRCReturn(rc, rc);
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST - fixme); /** @todo fix me */
-#else
-    int rc = hmR0VmxSaveGuestState(pVCpu, &pVCpu->cpum.GstCtx);
-    AssertRCReturn(rc, rc);
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
-#endif
-
-    return rc;
-}
-
-
-/**
- * Ensures that we've got a complete basic guest-context.
- *
- * This excludes the FPU, SSE, AVX, and similar extended state.  The interface
- * is for the interpreter.
- *
- * @returns VBox status code.
- * @param   pVCpu           The cross context virtual CPU structure of the calling EMT.
- * @param   pMixedCtx       Pointer to the guest-CPU context which may have data
- *                          needing to be synced in.
- * @thread  EMT(pVCpu)
- */
-VMMR0_INT_DECL(int) HMR0EnsureCompleteBasicContext(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
-{
-    /* Note! Since this is only applicable to VT-x, the implementation is placed
-             in the VT-x part of the sources instead of the generic stuff. */
-    int rc;
-    PVM pVM = pVCpu->CTX_SUFF(pVM);
-    if (   pVM->hm.s.vmx.fSupported
-        && VM_IS_HM_ENABLED(pVM))
-        rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
-    else
-        rc = VINF_SUCCESS;
-
-    /*
-     * For now, imply that the caller might change everything too. Do this after
-     * saving the guest state so as to not trigger assertions.
-     *
-     * This is required for AMD-V too as it too only selectively re-loads changed
-     * guest state back in to the VMCB.
-     */
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
-    return rc;
+VMMR0DECL(int) VMXR0ImportStateOnDemand(PVMCPU pVCpu, uint64_t fWhat)
+{
+    return hmR0VmxImportGuestState(pVCpu, fWhat);
 }
 
@@ -7634 +6519 @@
         return VINF_SUCCESS;
 
+#if 0
     /* We need the control registers now, make sure the guest-CPU context is updated. */
-    int rc3 = hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
+    int rc3 = hmR0VmxImportGuestStatae(pVCpu, CPUMCTX_EXTRN_CR0);
     AssertRCReturn(rc3, rc3);
 
@@ -7657 +6543 @@
         Assert(!VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_HM_UPDATE_PAE_PDPES));
     }
+#endif
 
     /* Pending PGM C3 sync. */
     if (VMCPU_FF_IS_PENDING(pVCpu,VMCPU_FF_PGM_SYNC_CR3 | VMCPU_FF_PGM_SYNC_CR3_NON_GLOBAL))
     {
+        Assert(!(ASMAtomicUoReadU64(&pMixedCtx->fExtrn) & (CPUMCTX_EXTRN_CR0 | CPUMCTX_EXTRN_CR3 | CPUMCTX_EXTRN_CR4)));
         VBOXSTRICTRC rcStrict2 = PGMSyncCR3(pVCpu, pMixedCtx->cr0, pMixedCtx->cr3, pMixedCtx->cr4,
                                             VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_PGM_SYNC_CR3));
@@ -7666 +6554 @@
         {
             AssertRC(VBOXSTRICTRC_VAL(rcStrict2));
-            Log4(("hmR0VmxCheckForceFlags: PGMSyncCR3 forcing us back to ring-3. rc2=%d\n", VBOXSTRICTRC_VAL(rcStrict2)));
+            Log4Func(("PGMSyncCR3 forcing us back to ring-3. rc2=%d\n", VBOXSTRICTRC_VAL(rcStrict2)));
             return rcStrict2;
         }
@@ -7677 +6565 @@
         STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchHmToR3FF);
         int rc2 = RT_UNLIKELY(VM_FF_IS_PENDING(pVM, VM_FF_PGM_NO_MEMORY)) ? VINF_EM_NO_MEMORY : VINF_EM_RAW_TO_R3;
-        Log4(("hmR0VmxCheckForceFlags: HM_TO_R3 forcing us back to ring-3. rc=%d\n", rc2));
+        Log4Func(("HM_TO_R3 forcing us back to ring-3. rc=%d\n", rc2));
         return rc2;
     }
@@ -7685 +6573 @@
         || VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_REQUEST))
     {
-        Log4(("hmR0VmxCheckForceFlags: Pending VM request forcing us back to ring-3\n"));
+        Log4Func(("Pending VM request forcing us back to ring-3\n"));
         return VINF_EM_PENDING_REQUEST;
     }
@@ -7692 +6580 @@
     if (VM_FF_IS_PENDING(pVM, VM_FF_PGM_POOL_FLUSH_PENDING))
     {
-        Log4(("hmR0VmxCheckForceFlags: PGM pool flush pending forcing us back to ring-3\n"));
+        Log4Func(("PGM pool flush pending forcing us back to ring-3\n"));
         return VINF_PGM_POOL_FLUSH_PENDING;
     }
@@ -7699 +6587 @@
     if (VM_FF_IS_PENDING(pVM, VM_FF_PDM_DMA))
     {
-        Log4(("hmR0VmxCheckForceFlags: Pending DMA request forcing us back to ring-3\n"));
+        Log4Func(("Pending DMA request forcing us back to ring-3\n"));
         return VINF_EM_RAW_TO_R3;
     }
@@ -7766 +6654 @@
     AssertRC(rc);
     Log4(("TRPM->HM event: u32IntInfo=%#RX32 enmTrpmEvent=%d cbInstr=%u uErrCode=%#RX32 GCPtrFaultAddress=%#RGv\n",
-         u32IntInfo, enmTrpmEvent, cbInstr, uErrCode, GCPtrFaultAddress));
+          u32IntInfo, enmTrpmEvent, cbInstr, uErrCode, GCPtrFaultAddress));
 
     hmR0VmxSetPendingEvent(pVCpu, u32IntInfo, cbInstr, uErrCode, GCPtrFaultAddress);
@@ -7850 +6738 @@
  *
  * @returns VBox status code.
- * @param   pVCpu               The cross context virtual CPU structure.
- * @param   pMixedCtx           Pointer to the guest-CPU context. The data may
- *                              be out-of-sync. Make sure to update the required
- *                              fields before using them.
- * @param   fSaveGuestState     Whether to save the guest state or not.
+ * @param   pVCpu           The cross context virtual CPU structure.
+ * @param   fImportState    Whether to import the guest state from the VMCS back
+ *                          to the guest-CPU context.
  *
  * @remarks No-long-jmp zone!!!
  */
-static int hmR0VmxLeave(PVMCPU pVCpu, PCPUMCTX pMixedCtx, bool fSaveGuestState)
+static int hmR0VmxLeave(PVMCPU pVCpu, bool fImportState)
 {
     Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
@@ -7872 +6758 @@
 
     /* Save the guest state if necessary. */
-    if (   fSaveGuestState
-        && HMVMXCPU_GST_VALUE(pVCpu) != HMVMX_UPDATED_GUEST_ALL)
-    {
-        int rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
+    if (fImportState)
+    {
+        int rc = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
         AssertRCReturn(rc, rc);
-        Assert(HMVMXCPU_GST_VALUE(pVCpu) == HMVMX_UPDATED_GUEST_ALL);
-    }
-
-    /* Restore host FPU state if necessary and resync on next R0 reentry .*/
-    if (CPUMR0FpuStateMaybeSaveGuestAndRestoreHost(pVCpu))
-    {
-        /* We shouldn't reload CR0 without saving it first. */
-        if (!fSaveGuestState)
-        {
-            int rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-            AssertRCReturn(rc, rc);
-        }
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR0);
-    }
-
-    /* Restore host debug registers if necessary and resync on next R0 reentry. */
+    }
+
+    /* Restore host FPU state if necessary. We will resync on next R0 reentry. */
+    CPUMR0FpuStateMaybeSaveGuestAndRestoreHost(pVCpu);
+    Assert(!CPUMIsGuestFPUStateActive(pVCpu));
+
+    /* Restore host debug registers if necessary. We will resync on next R0 reentry. */
 #ifdef VBOX_STRICT
     if (CPUMIsHyperDebugStateActive(pVCpu))
         Assert(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_MOV_DR_EXIT);
 #endif
-    if (CPUMR0DebugStateMaybeSaveGuestAndRestoreHost(pVCpu, true /* save DR6 */))
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_DEBUG);
+    CPUMR0DebugStateMaybeSaveGuestAndRestoreHost(pVCpu, true /* save DR6 */);
     Assert(!CPUMIsGuestDebugStateActive(pVCpu) && !CPUMIsGuestDebugStateActivePending(pVCpu));
     Assert(!CPUMIsHyperDebugStateActive(pVCpu) && !CPUMIsHyperDebugStateActivePending(pVCpu));
@@ -7914 +6789 @@
 
     /* Restore the lazy host MSRs as we're leaving VT-x context. */
-    if (pVCpu->hm.s.vmx.fLazyMsrs)
-    {
-        /* We shouldn't reload the guest MSRs without saving it first. */
-        if (!fSaveGuestState)
-        {
-            int rc = hmR0VmxSaveGuestLazyMsrs(pVCpu, pMixedCtx);
+    if (pVCpu->hm.s.vmx.fLazyMsrs & VMX_LAZY_MSRS_LOADED_GUEST)
+    {
+        /* We shouldn't restore the host MSRs without saving the guest MSRs first. */
+        if (!fImportState)
+        {
+            int rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_KERNEL_GS_BASE
+                                                    | CPUMCTX_EXTRN_SYSCALL_MSRS);
             AssertRCReturn(rc, rc);
         }
-        Assert(HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_LAZY_MSRS));
         hmR0VmxLazyRestoreHostMsrs(pVCpu);
         Assert(!pVCpu->hm.s.vmx.fLazyMsrs);
     }
+    else
+        pVCpu->hm.s.vmx.fLazyMsrs = 0;
 
     /* Update auto-load/store host MSRs values when we re-enter VT-x (as we could be on a different CPU). */
@@ -7931 +6808 @@
 
     STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatEntry);
-    STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatLoadGuestState);
+    STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatImportGuestState);
+    STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExportGuestState);
     STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit1);
     STAM_PROFILE_ADV_SET_STOPPED(&pVCpu->hm.s.StatExit2);
@@ -7972 +6850 @@
  * @remarks No-long-jmp zone!!!
  */
-DECLINLINE(int) hmR0VmxLeaveSession(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static int hmR0VmxLeaveSession(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
 {
     HM_DISABLE_PREEMPT();
@@ -7983 +6861 @@
     if (!pVCpu->hm.s.fLeaveDone)
     {
-        int rc2 = hmR0VmxLeave(pVCpu, pMixedCtx, true /* fSaveGuestState */);
+        int rc2 = hmR0VmxLeave(pVCpu, true /* fImportState */);
         AssertRCReturnStmt(rc2, HM_RESTORE_PREEMPT(), rc2);
         pVCpu->hm.s.fLeaveDone = true;
     }
-    Assert(HMVMXCPU_GST_VALUE(pVCpu) == HMVMX_UPDATED_GUEST_ALL);
+    Assert(!pMixedCtx->fExtrn);
 
     /*
@@ -8059 +6937 @@
     /* Please, no longjumps here (any logging shouldn't flush jump back to ring-3). NO LOGGING BEFORE THIS POINT! */
     VMMRZCallRing3Disable(pVCpu);
-    Log4(("hmR0VmxExitToRing3: pVCpu=%p idCpu=%RU32 rcExit=%d\n", pVCpu, pVCpu->idCpu, VBOXSTRICTRC_VAL(rcExit)));
+    Log4Func(("rcExit=%d\n", VBOXSTRICTRC_VAL(rcExit)));
 
     /* We need to do this only while truly exiting the "inner loop" back to ring-3 and -not- for any longjmp to ring3. */
@@ -8074 +6952 @@
        and if we're injecting an event we should have a TRPM trap pending. */
     AssertMsg(rcExit != VINF_EM_RAW_INJECT_TRPM_EVENT || TRPMHasTrap(pVCpu), ("%Rrc\n", VBOXSTRICTRC_VAL(rcExit)));
-#ifndef DEBUG_bird /* Triggered after firing an NMI against NT4SP1, possibly a tripple fault in progress. */
+#ifndef DEBUG_bird /* Triggered after firing an NMI against NT4SP1, possibly a triple fault in progress. */
     AssertMsg(rcExit != VINF_EM_RAW_EMULATE_INSTR || !TRPMHasTrap(pVCpu), ("%Rrc\n", VBOXSTRICTRC_VAL(rcExit)));
 #endif
@@ -8092 +6970 @@
                               | CPUM_CHANGED_TR
                               | CPUM_CHANGED_HIDDEN_SEL_REGS);
-    Assert(HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR0));
     if (   pVM->hm.s.fNestedPaging
         && CPUMIsGuestPagingEnabledEx(pMixedCtx))
@@ -8101 +6978 @@
     Assert(!pVCpu->hm.s.fClearTrapFlag);
 
+    /* Update the exit-to-ring 3 reason. */
+    pVCpu->hm.s.rcLastExitToR3 = VBOXSTRICTRC_VAL(rcExit);
+
     /* On our way back from ring-3 reload the guest state if there is a possibility of it being changed. */
     if (rcExit != VINF_EM_RAW_INTERRUPT)
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
 
     STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchExitToR3);
@@ -8150 +7030 @@
         pVCpu->hm.s.vmx.fRestoreHostFlags = 0;
 #endif
+
         /* Restore the lazy host MSRs as we're leaving VT-x context. */
-        if (pVCpu->hm.s.vmx.fLazyMsrs)
+        if (pVCpu->hm.s.vmx.fLazyMsrs & VMX_LAZY_MSRS_LOADED_GUEST)
             hmR0VmxLazyRestoreHostMsrs(pVCpu);
 
@@ -8178 +7059 @@
     Assert(VMMR0IsLogFlushDisabled(pVCpu));
 
-    Log4(("hmR0VmxCallRing3Callback->hmR0VmxLongJmpToRing3 pVCpu=%p idCpu=%RU32 enmOperation=%d\n", pVCpu, pVCpu->idCpu,
-          enmOperation));
+    Log4Func((" -> hmR0VmxLongJmpToRing3 enmOperation=%d\n", enmOperation));
 
     int rc = hmR0VmxLongJmpToRing3(pVCpu, (PCPUMCTX)pvUser);
@@ -8204 +7084 @@
             int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
             AssertRC(rc);
-            Log4(("Setup interrupt-window exiting\n"));
+            Log4Func(("Setup interrupt-window exiting\n"));
         }
     } /* else we will deliver interrupts whenever the guest exits next and is in a state to receive events. */
@@ -8221 +7101 @@
     int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
     AssertRC(rc);
-    Log4(("Cleared interrupt-window exiting\n"));
+    Log4Func(("Cleared interrupt-window exiting\n"));
 }
 
@@ -8240 +7120 @@
             int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
             AssertRC(rc);
-            Log4(("Setup NMI-window exiting\n"));
+            Log4Func(("Setup NMI-window exiting\n"));
         }
     } /* else we will deliver NMIs whenever we VM-exit next, even possibly nesting NMIs. Can't be helped on ancient CPUs. */
@@ -8257 +7137 @@
     int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_PROC_EXEC, pVCpu->hm.s.vmx.u32ProcCtls);
     AssertRC(rc);
-    Log4(("Cleared NMI-window exiting\n"));
+    Log4Func(("Cleared NMI-window exiting\n"));
 }
 
@@ -8274 +7154 @@
 {
     /* Get the current interruptibility-state of the guest and then figure out what can be injected. */
-    uint32_t const uIntrState = hmR0VmxGetGuestIntrState(pVCpu, pMixedCtx);
-    bool const fBlockMovSS    = RT_BOOL(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS);
-    bool const fBlockSti      = RT_BOOL(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
-    bool const fBlockNmi      = RT_BOOL(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_NMI);
-
-    Assert(!fBlockSti || HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RFLAGS));
-    Assert(!(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_SMI));    /* We don't support block-by-SMI yet.*/
+    uint32_t const fIntrState = hmR0VmxGetGuestIntrState(pVCpu, pMixedCtx);
+    bool const fBlockMovSS    = RT_BOOL(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS);
+    bool const fBlockSti      = RT_BOOL(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
+    bool const fBlockNmi      = RT_BOOL(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_NMI);
+
+    Assert(!fBlockSti || !(ASMAtomicUoReadU64(&pMixedCtx->fExtrn) & CPUMCTX_EXTRN_RFLAGS));
+    Assert(!(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_SMI));    /* We don't support block-by-SMI yet.*/
     Assert(!fBlockSti || pMixedCtx->eflags.Bits.u1IF);     /* Cannot set block-by-STI when interrupts are disabled. */
     Assert(!TRPMHasTrap(pVCpu));
@@ -8300 +7180 @@
             && !fBlockMovSS)
         {
-            Log4(("Pending NMI vcpu[%RU32]\n", pVCpu->idCpu));
+            Log4Func(("Pending NMI\n"));
             uint32_t u32IntInfo = X86_XCPT_NMI | VMX_EXIT_INTERRUPTION_INFO_VALID;
             u32IntInfo         |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
@@ -8318 +7198 @@
     {
         Assert(!DBGFIsStepping(pVCpu));
-        int rc = hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-        AssertRC(rc);
+        int rc = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_RFLAGS);
+        AssertRCReturn(rc, 0);
         bool const fBlockInt = !(pMixedCtx->eflags.u32 & X86_EFL_IF);
         if (   !pVCpu->hm.s.Event.fPending
@@ -8330 +7210 @@
             if (RT_SUCCESS(rc))
             {
-                Log4(("Pending interrupt vcpu[%RU32] u8Interrupt=%#x \n", pVCpu->idCpu, u8Interrupt));
-                uint32_t u32IntInfo = u8Interrupt | VMX_EXIT_INTERRUPTION_INFO_VALID;
-                u32IntInfo         |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
+                Log4Func(("Pending external interrupt u8Interrupt=%#x\n", u8Interrupt));
+                uint32_t u32IntInfo = u8Interrupt
+                                    | VMX_EXIT_INTERRUPTION_INFO_VALID
+                                    | (VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
 
                 hmR0VmxSetPendingEvent(pVCpu, u32IntInfo, 0 /* cbInstr */, 0 /* u32ErrCode */, 0 /* GCPtrfaultAddress */);
@@ -8355 +7236 @@
     }
 
-    return uIntrState;
+    return fIntrState;
 }
 
@@ -8364 +7245 @@
  *
  * @param   pVCpu           The cross context virtual CPU structure.
- */
-DECLINLINE(void) hmR0VmxSetPendingDebugXcptVmcs(PVMCPU pVCpu)
-{
-    Assert(HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RFLAGS)); NOREF(pVCpu);
-    int rc = VMXWriteVmcs32(VMX_VMCS_GUEST_PENDING_DEBUG_EXCEPTIONS, VMX_VMCS_GUEST_DEBUG_EXCEPTIONS_BS);
-    AssertRC(rc);
+ * @param   pMixedCtx       Pointer to the guest-CPU context. The data may be
+ *                          out-of-sync. Make sure to update the required fields
+ *                          before using them.
+ */
+DECLINLINE(int) hmR0VmxSetPendingDebugXcptVmcs(PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+{
+    RT_NOREF(pVCpu);
+    Assert(!(ASMAtomicUoReadU64(&pMixedCtx->fExtrn) & CPUMCTX_EXTRN_RFLAGS));
+    return VMXWriteVmcs32(VMX_VMCS_GUEST_PENDING_DEBUG_EXCEPTIONS, VMX_VMCS_GUEST_DEBUG_EXCEPTIONS_BS);
 }
 
@@ -8382 +7266 @@
  *                          out-of-sync. Make sure to update the required fields
  *                          before using them.
- * @param   uIntrState      The VT-x guest-interruptibility state.
+ * @param   fIntrState      The VT-x guest-interruptibility state.
  * @param   fStepping       Running in hmR0VmxRunGuestCodeStep() and we should
  *                          return VINF_EM_DBG_STEPPED if the event was
  *                          dispatched directly.
  */
-static VBOXSTRICTRC hmR0VmxInjectPendingEvent(PVMCPU pVCpu, PCPUMCTX pMixedCtx, uint32_t uIntrState, bool fStepping)
+static VBOXSTRICTRC hmR0VmxInjectPendingEvent(PVMCPU pVCpu, PCPUMCTX pMixedCtx, uint32_t fIntrState, bool fStepping)
 {
     HMVMX_ASSERT_PREEMPT_SAFE();
     Assert(VMMRZCallRing3IsEnabled(pVCpu));
 
-    bool fBlockMovSS    = RT_BOOL(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS);
-    bool fBlockSti      = RT_BOOL(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
-
-    Assert(!fBlockSti || HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RFLAGS));
-    Assert(!(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_SMI));     /* We don't support block-by-SMI yet.*/
+    bool fBlockMovSS    = RT_BOOL(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS);
+    bool fBlockSti      = RT_BOOL(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
+
+    Assert(!fBlockSti || !(ASMAtomicUoReadU64(&pMixedCtx->fExtrn) & CPUMCTX_EXTRN_RFLAGS));
+    Assert(!(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_SMI));     /* We don't support block-by-SMI yet.*/
     Assert(!fBlockSti || pMixedCtx->eflags.Bits.u1IF);       /* Cannot set block-by-STI when interrupts are disabled. */
     Assert(!TRPMHasTrap(pVCpu));
@@ -8421 +7305 @@
         else if (uIntType == VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI)
         {
-            bool const fBlockNmi = RT_BOOL(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_NMI);
+            bool const fBlockNmi = RT_BOOL(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_NMI);
             Assert(!fBlockSti);
             Assert(!fBlockMovSS);
@@ -8429 +7313 @@
         Log4(("Injecting pending event vcpu[%RU32] u64IntInfo=%#RX64 Type=%#x\n", pVCpu->idCpu, pVCpu->hm.s.Event.u64IntInfo,
               (uint8_t)uIntType));
-        rcStrict = hmR0VmxInjectEventVmcs(pVCpu, pMixedCtx, pVCpu->hm.s.Event.u64IntInfo, pVCpu->hm.s.Event.cbInstr,
-                                          pVCpu->hm.s.Event.u32ErrCode, pVCpu->hm.s.Event.GCPtrFaultAddress,
-                                          fStepping, &uIntrState);
+        rcStrict = hmR0VmxInjectEventVmcs(pVCpu, pVCpu->hm.s.Event.u64IntInfo, pVCpu->hm.s.Event.cbInstr,
+                                          pVCpu->hm.s.Event.u32ErrCode, pVCpu->hm.s.Event.GCPtrFaultAddress, fStepping,
+                                          &fIntrState);
         AssertRCReturn(VBOXSTRICTRC_VAL(rcStrict), rcStrict);
 
         /* Update the interruptibility-state as it could have been changed by
            hmR0VmxInjectEventVmcs() (e.g. real-on-v86 guest injecting software interrupts) */
-        fBlockMovSS = RT_BOOL(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS);
-        fBlockSti   = RT_BOOL(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
+        fBlockMovSS = RT_BOOL(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS);
+        fBlockSti   = RT_BOOL(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
 
         if (uIntType == VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT)
@@ -8457 +7341 @@
              */
             Assert(!DBGFIsStepping(pVCpu));
-            int rc2 = hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-            AssertRCReturn(rc2, rc2);
+            int rc = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_RFLAGS);
+            AssertRCReturn(rc, rc);
             if (pMixedCtx->eflags.Bits.u1TF)
-                hmR0VmxSetPendingDebugXcptVmcs(pVCpu);
+            {
+                int rc2 = hmR0VmxSetPendingDebugXcptVmcs(pVCpu, pMixedCtx);
+                AssertRCReturn(rc2, rc2);
+            }
         }
         else if (pMixedCtx->eflags.Bits.u1TF)
@@ -8469 +7356 @@
              */
             Assert(!(pVCpu->CTX_SUFF(pVM)->hm.s.vmx.Msrs.VmxProcCtls.n.allowed1 & VMX_VMCS_CTRL_PROC_EXEC_MONITOR_TRAP_FLAG));
-            uIntrState = 0;
+            fIntrState = 0;
         }
     }
@@ -8477 +7364 @@
      * VT-x clears the valid bit on every VM-exit. See Intel spec. 24.8.3 "VM-Entry Controls for Event Injection".
      */
-    int rc2 = hmR0VmxLoadGuestIntrState(pVCpu, uIntrState);
-    AssertRC(rc2);
+    int rc3 = hmR0VmxExportGuestIntrState(pVCpu, fIntrState);
+    AssertRCReturn(rc3, rc3);
 
     Assert(rcStrict == VINF_SUCCESS || rcStrict == VINF_EM_RESET || (rcStrict == VINF_EM_DBG_STEPPED && fStepping));
@@ -8514 +7401 @@
  *                          is injected directly (register modified by us, not
  *                          by hardware on VM-entry).
- * @param   puIntrState     Pointer to the current guest interruptibility-state.
+ * @param   pfIntrState     Pointer to the current guest interruptibility-state.
  *                          This interruptibility-state will be updated if
  *                          necessary. This cannot not be NULL.
  */
-DECLINLINE(VBOXSTRICTRC) hmR0VmxInjectXcptDF(PVMCPU pVCpu, PCPUMCTX pMixedCtx, bool fStepping, uint32_t *puIntrState)
-{
+DECLINLINE(VBOXSTRICTRC) hmR0VmxInjectXcptDF(PVMCPU pVCpu, PCCPUMCTX pMixedCtx, bool fStepping, uint32_t *pfIntrState)
+{
+    NOREF(pMixedCtx);
     uint32_t u32IntInfo  = X86_XCPT_DF | VMX_EXIT_INTERRUPTION_INFO_VALID;
     u32IntInfo          |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
     u32IntInfo          |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
-    return hmR0VmxInjectEventVmcs(pVCpu, pMixedCtx, u32IntInfo, 0 /* cbInstr */, 0 /* u32ErrCode */, 0 /* GCPtrFaultAddress */,
-                                  fStepping, puIntrState);
+    return hmR0VmxInjectEventVmcs(pVCpu, u32IntInfo, 0 /* cbInstr */, 0 /* u32ErrCode */, 0 /* GCPtrFaultAddress */, fStepping,
+                                  pfIntrState);
 }
 
@@ -8580 +7468 @@
  *                              directly (register modified by us, not by
  *                              hardware on VM-entry).
- * @param   puIntrState         Pointer to the current guest interruptibility-state.
+ * @param   pfIntrState         Pointer to the current guest interruptibility-state.
  *                              This interruptibility-state will be updated if
  *                              necessary. This cannot not be NULL.
  */
-DECLINLINE(VBOXSTRICTRC) hmR0VmxInjectXcptGP(PVMCPU pVCpu, PCPUMCTX pMixedCtx, bool fErrorCodeValid, uint32_t u32ErrorCode,
-                                             bool fStepping, uint32_t *puIntrState)
-{
+DECLINLINE(VBOXSTRICTRC) hmR0VmxInjectXcptGP(PVMCPU pVCpu, PCCPUMCTX pMixedCtx, bool fErrorCodeValid, uint32_t u32ErrorCode,
+                                             bool fStepping, uint32_t *pfIntrState)
+{
+    NOREF(pMixedCtx);
     uint32_t u32IntInfo  = X86_XCPT_GP | VMX_EXIT_INTERRUPTION_INFO_VALID;
     u32IntInfo          |= (VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT << VMX_EXIT_INTERRUPTION_INFO_TYPE_SHIFT);
     if (fErrorCodeValid)
         u32IntInfo |= VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
-    return hmR0VmxInjectEventVmcs(pVCpu, pMixedCtx, u32IntInfo, 0 /* cbInstr */, u32ErrorCode, 0 /* GCPtrFaultAddress */,
-                                  fStepping, puIntrState);
+    return hmR0VmxInjectEventVmcs(pVCpu, u32IntInfo, 0 /* cbInstr */, u32ErrorCode, 0 /* GCPtrFaultAddress */, fStepping,
+                                  pfIntrState);
 }
 
@@ -8677 +7566 @@
  *
  * @param   pVCpu               The cross context virtual CPU structure.
- * @param   pMixedCtx           Pointer to the guest-CPU context. The data may
- *                              be out-of-sync. Make sure to update the required
- *                              fields before using them.
  * @param   u64IntInfo          The VM-entry interruption-information field.
  * @param   cbInstr             The VM-entry instruction length in bytes (for
@@ -8686 +7572 @@
  * @param   u32ErrCode          The VM-entry exception error code.
  * @param   GCPtrFaultAddress   The page-fault address for \#PF exceptions.
- * @param   puIntrState         Pointer to the current guest interruptibility-state.
+ * @param   pfIntrState         Pointer to the current guest interruptibility-state.
  *                              This interruptibility-state will be updated if
  *                              necessary. This cannot not be NULL.
@@ -8697 +7583 @@
  * @remarks Requires CR0!
  */
-static VBOXSTRICTRC hmR0VmxInjectEventVmcs(PVMCPU pVCpu, PCPUMCTX pMixedCtx, uint64_t u64IntInfo, uint32_t cbInstr,
-                                           uint32_t u32ErrCode, RTGCUINTREG GCPtrFaultAddress, bool fStepping,
-                                           uint32_t *puIntrState)
+static VBOXSTRICTRC hmR0VmxInjectEventVmcs(PVMCPU pVCpu, uint64_t u64IntInfo, uint32_t cbInstr, uint32_t u32ErrCode,
+                                           RTGCUINTREG GCPtrFaultAddress, bool fStepping, uint32_t *pfIntrState)
 {
     /* Intel spec. 24.8.3 "VM-Entry Controls for Event Injection" specifies the interruption-information field to be 32-bits. */
     AssertMsg(u64IntInfo >> 32 == 0, ("%#RX64\n", u64IntInfo));
-    Assert(puIntrState);
-    uint32_t u32IntInfo = (uint32_t)u64IntInfo;
-
-    uint32_t const uVector  = VMX_EXIT_INTERRUPTION_INFO_VECTOR(u32IntInfo);
-    uint32_t const uIntType = VMX_EXIT_INTERRUPTION_INFO_TYPE(u32IntInfo);
+    Assert(pfIntrState);
+
+    PCPUMCTX       pMixedCtx  = &pVCpu->cpum.GstCtx;
+    uint32_t       u32IntInfo = (uint32_t)u64IntInfo;
+    uint32_t const uVector    = VMX_EXIT_INTERRUPTION_INFO_VECTOR(u32IntInfo);
+    uint32_t const uIntType   = VMX_EXIT_INTERRUPTION_INFO_TYPE(u32IntInfo);
 
 #ifdef VBOX_STRICT
@@ -8737 +7623 @@
     /* Cannot inject an NMI when block-by-MOV SS is in effect. */
     Assert(   uIntType != VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI
-           || !(*puIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS));
+           || !(*pfIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_MOVSS));
 
     STAM_COUNTER_INC(&pVCpu->hm.s.paStatInjectedIrqsR0[uVector & MASK_INJECT_IRQ_STAT]);
 
-    /* We require CR0 to check if the guest is in real-mode. */
-    int rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-    AssertRCReturn(rc, rc);
-
-    /*
-     * Hardware interrupts & exceptions cannot be delivered through the software interrupt redirection bitmap to the real
-     * mode task in virtual-8086 mode. We must jump to the interrupt handler in the (real-mode) guest.
-     * See Intel spec. 20.3 "Interrupt and Exception handling in Virtual-8086 Mode" for interrupt & exception classes.
-     * See Intel spec. 20.1.4 "Interrupt and Exception Handling" for real-mode interrupt handling.
-     */
-    if (CPUMIsGuestInRealModeEx(pMixedCtx))
-    {
-        PVM pVM = pVCpu->CTX_SUFF(pVM);
-        if (!pVM->hm.s.vmx.fUnrestrictedGuest)
-        {
+    if (pVCpu->CTX_SUFF(pVM)->hm.s.vmx.fUnrestrictedGuest)
+    {
+        /*
+         * For unrestricted execution enabled CPUs running real-mode guests, we must not set the deliver-error-code bit.
+         * See Intel spec. 26.2.1.3 "VM-Entry Control Fields".
+         */
+        u32IntInfo &= ~VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
+    }
+    else
+    {
+        /* We require CR0 to check if the guest is in real-mode. */
+        int rc = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_CR0);
+        AssertRCReturn(rc, rc);
+
+        /*
+         * Hardware interrupts & exceptions cannot be delivered through the software interrupt
+         * redirection bitmap to the real mode task in virtual-8086 mode. We must jump to the
+         * interrupt handler in the (real-mode) guest.
+         *
+         * See Intel spec. 20.3 "Interrupt and Exception handling in Virtual-8086 Mode".
+         * See Intel spec. 20.1.4 "Interrupt and Exception Handling" for real-mode interrupt handling.
+         */
+        if (CPUMIsGuestInRealModeEx(pMixedCtx))
+        {
+            PVM pVM = pVCpu->CTX_SUFF(pVM);
             Assert(PDMVmmDevHeapIsEnabled(pVM));
             Assert(pVM->hm.s.vmx.pRealModeTSS);
 
-            /* We require RIP, RSP, RFLAGS, CS, IDTR. Save the required ones from the VMCS. */
-            rc  = hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
-            rc |= hmR0VmxSaveGuestTableRegs(pVCpu, pMixedCtx);
-            rc |= hmR0VmxSaveGuestRipRspRflags(pVCpu, pMixedCtx);
+            /* We require RIP, RSP, RFLAGS, CS, IDTR, import them. */
+            rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_SREG_MASK
+                                                | CPUMCTX_EXTRN_TABLE_MASK
+                                                | CPUMCTX_EXTRN_RIP
+                                                | CPUMCTX_EXTRN_RSP
+                                                | CPUMCTX_EXTRN_RFLAGS);
             AssertRCReturn(rc, rc);
-            Assert(HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_RIP));
 
             /* Check if the interrupt handler is present in the IVT (real-mode IDT). IDT limit is (4N - 1). */
@@ -8776 +7673 @@
                 /* If we're injecting a #GP with no valid IDT entry, inject a double-fault. */
                 if (uVector == X86_XCPT_GP)
-                    return hmR0VmxInjectXcptDF(pVCpu, pMixedCtx, fStepping, puIntrState);
+                    return hmR0VmxInjectXcptDF(pVCpu, pMixedCtx, fStepping, pfIntrState);
 
                 /* If we're injecting an interrupt/exception with no valid IDT entry, inject a general-protection fault. */
                 /* No error codes for exceptions in real-mode. See Intel spec. 20.1.4 "Interrupt and Exception Handling" */
                 return hmR0VmxInjectXcptGP(pVCpu, pMixedCtx, false /* fErrCodeValid */, 0 /* u32ErrCode */,
-                                           fStepping, puIntrState);
+                                           fStepping, pfIntrState);
             }
 
@@ -8803 +7700 @@
             /* Construct the stack frame for the interrupt/exception handler. */
             VBOXSTRICTRC rcStrict;
-            rcStrict  = hmR0VmxRealModeGuestStackPush(pVM, pMixedCtx, pMixedCtx->eflags.u32);
+            rcStrict = hmR0VmxRealModeGuestStackPush(pVM, pMixedCtx, pMixedCtx->eflags.u32);
             if (rcStrict == VINF_SUCCESS)
                 rcStrict = hmR0VmxRealModeGuestStackPush(pVM, pMixedCtx, pMixedCtx->cs.Sel);
@@ -8823 +7720 @@
                 /* If any other guest-state bits are changed here, make sure to update
                    hmR0VmxPreRunGuestCommitted() when thread-context hooks are used. */
-                HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_SEGMENT_REGS
-                                    | HM_CHANGED_GUEST_RIP
-                                    | HM_CHANGED_GUEST_RFLAGS
-                                    | HM_CHANGED_GUEST_RSP);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_CS
+                                                           | HM_CHANGED_GUEST_CR2
+                                                           | HM_CHANGED_GUEST_RIP
+                                                           | HM_CHANGED_GUEST_RFLAGS
+                                                           | HM_CHANGED_GUEST_RSP);
 
                 /* We're clearing interrupts, which means no block-by-STI interrupt-inhibition. */
-                if (*puIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI)
+                if (*pfIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI)
                 {
                     Assert(   uIntType != VMX_EXIT_INTERRUPTION_INFO_TYPE_NMI
                            && uIntType != VMX_EXIT_INTERRUPTION_INFO_TYPE_EXT_INT);
-                    Log4(("Clearing inhibition due to STI.\n"));
-                    *puIntrState &= ~VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI;
+                    Log4Func(("Clearing inhibition due to STI\n"));
+                    *pfIntrState &= ~VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI;
                 }
                 Log4(("Injecting real-mode: u32IntInfo=%#x u32ErrCode=%#x cbInstr=%#x Eflags=%#x CS:EIP=%04x:%04x\n",
@@ -8843 +7741 @@
                 pVCpu->hm.s.Event.fPending = false;
 
-                /* Make hmR0VmxPreRunGuest return if we're stepping since we've changed cs:rip. */
+                /* Make hmR0VmxPreRunGuest() return if we're stepping since we've changed cs:rip. */
                 if (fStepping)
                     rcStrict = VINF_EM_DBG_STEPPED;
@@ -8851 +7749 @@
             return rcStrict;
         }
-
-        /*
-         * For unrestricted execution enabled CPUs running real-mode guests, we must not set the deliver-error-code bit.
-         * See Intel spec. 26.2.1.3 "VM-Entry Control Fields".
-         */
-        u32IntInfo &= ~VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_VALID;
     }
 
@@ -8865 +7757 @@
 
     /* Inject. */
-    rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, u32IntInfo);
+    int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, u32IntInfo);
     if (VMX_EXIT_INTERRUPTION_INFO_ERROR_CODE_IS_VALID(u32IntInfo))
         rc |= VMXWriteVmcs32(VMX_VMCS32_CTRL_ENTRY_EXCEPTION_ERRCODE, u32ErrCode);
     rc |= VMXWriteVmcs32(VMX_VMCS32_CTRL_ENTRY_INSTR_LENGTH, cbInstr);
+    AssertRCReturn(rc, rc);
 
     if (   VMX_EXIT_INTERRUPTION_INFO_TYPE(u32IntInfo) == VMX_EXIT_INTERRUPTION_INFO_TYPE_HW_XCPT
@@ -8874 +7767 @@
         pMixedCtx->cr2 = GCPtrFaultAddress;
 
-    Log4(("Injecting vcpu[%RU32] u32IntInfo=%#x u32ErrCode=%#x cbInstr=%#x pMixedCtx->uCR2=%#RX64\n", pVCpu->idCpu,
-          u32IntInfo, u32ErrCode, cbInstr, pMixedCtx->cr2));
-
-    AssertRCReturn(rc, rc);
+    Log4(("Injecting u32IntInfo=%#x u32ErrCode=%#x cbInstr=%#x pMixedCtx->uCR2=%#RX64\n", u32IntInfo, u32ErrCode, cbInstr,
+          pMixedCtx->cr2));
+
     return VINF_SUCCESS;
 }
@@ -8895 +7787 @@
 static void hmR0VmxClearIntNmiWindowsVmcs(PVMCPU pVCpu)
 {
-    Log4Func(("vcpu[%d]\n", pVCpu->idCpu));
-
     if (pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_INT_WINDOW_EXIT)
+    {
         hmR0VmxClearIntWindowExitVmcs(pVCpu);
+        Log4Func(("Cleared interrupt widow\n"));
+    }
 
     if (pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_NMI_WINDOW_EXIT)
+    {
         hmR0VmxClearNmiWindowExitVmcs(pVCpu);
+        Log4Func(("Cleared interrupt widow\n"));
+    }
 }
 
@@ -8922 +7818 @@
 
     LogFlowFunc(("pVM=%p pVCpu=%p\n", pVM, pVCpu));
-    Assert(HMCPU_CF_IS_SET(pVCpu, HM_CHANGED_HOST_CONTEXT | HM_CHANGED_HOST_GUEST_SHARED_STATE));
+    Assert((pVCpu->hm.s.fCtxChanged &  (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE))
+                                    == (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE));
 
 #ifdef VBOX_STRICT
@@ -8970 +7867 @@
             VMCPU_ASSERT_EMT(pVCpu);
 
-            PCPUMCTX pMixedCtx = CPUMQueryGuestCtxPtr(pVCpu);
-
             /* No longjmps (logger flushes, locks) in this fragile context. */
             VMMRZCallRing3Disable(pVCpu);
@@ -8981 +7876 @@
             if (!pVCpu->hm.s.fLeaveDone)
             {
-                /* Do -not- save guest-state here as we might already be in the middle of saving it (esp. bad if we are
-                   holding the PGM lock while saving the guest state (see hmR0VmxSaveGuestControlRegs()). */
-                hmR0VmxLeave(pVCpu, pMixedCtx, false /* fSaveGuestState */);
+                /*
+                 * Do -not- import the guest-state here as we might already be in the middle of importing
+                 * it, esp. bad if we're holding the PGM lock, see comment in hmR0VmxImportGuestState().
+                 */
+                hmR0VmxLeave(pVCpu, false /* fImportState */);
                 pVCpu->hm.s.fLeaveDone = true;
             }
@@ -9011 +7908 @@
             int rc = HMR0EnterCpu(pVCpu);
             AssertRC(rc);
-            Assert(HMCPU_CF_IS_SET(pVCpu, HM_CHANGED_HOST_CONTEXT | HM_CHANGED_HOST_GUEST_SHARED_STATE));
+            Assert((pVCpu->hm.s.fCtxChanged &  (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE))
+                                            == (HM_CHANGED_HOST_CONTEXT | HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE));
 
             /* Load the active VMCS as the current one. */
@@ -9035 +7933 @@
 
 /**
+ * Exports the host state into the VMCS host-state area.
+ * Sets up the VM-exit MSR-load area.
+ *
+ * The CPU state will be loaded from these fields on every successful VM-exit.
+ *
+ * @returns VBox status code.
+ * @param   pVCpu       The cross context virtual CPU structure.
+ *
+ * @remarks No-long-jump zone!!!
+ */
+static int hmR0VmxExportHostState(PVMCPU pVCpu)
+{
+    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
+
+    int rc = VINF_SUCCESS;
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_HOST_CONTEXT)
+    {
+        rc = hmR0VmxExportHostControlRegs();
+        AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+        rc = hmR0VmxExportHostSegmentRegs(pVCpu);
+        AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+        rc = hmR0VmxExportHostMsrs(pVCpu);
+        AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+        pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_HOST_CONTEXT;
+    }
+    return rc;
+}
+
+
+/**
  * Saves the host state in the VMCS host-state.
- * Sets up the VM-exit MSR-load area.
- *
- * The CPU state will be loaded from these fields on every successful VM-exit.
  *
  * @returns VBox status code.
@@ -9046 +7974 @@
  * @remarks No-long-jump zone!!!
  */
-static int hmR0VmxSaveHostState(PVM pVM, PVMCPU pVCpu)
-{
+VMMR0DECL(int) VMXR0ExportHostState(PVMCPU pVCpu)
+{
+    AssertPtr(pVCpu);
     Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
 
-    int rc = VINF_SUCCESS;
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_HOST_CONTEXT))
-    {
-        rc = hmR0VmxSaveHostControlRegs(pVM, pVCpu);
-        AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveHostControlRegisters failed! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-        rc = hmR0VmxSaveHostSegmentRegs(pVM, pVCpu);
-        AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveHostSegmentRegisters failed! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-        rc = hmR0VmxSaveHostMsrs(pVM, pVCpu);
-        AssertLogRelMsgRCReturn(rc, ("hmR0VmxSaveHostMsrs failed! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_HOST_CONTEXT);
-    }
-    return rc;
-}
-
-
-/**
- * Saves the host state in the VMCS host-state.
- *
- * @returns VBox status code.
- * @param   pVM         The cross context VM structure.
- * @param   pVCpu       The cross context virtual CPU structure.
- *
- * @remarks No-long-jump zone!!!
- */
-VMMR0DECL(int) VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu)
-{
-    AssertPtr(pVM);
-    AssertPtr(pVCpu);
-
-    LogFlowFunc(("pVM=%p pVCpu=%p\n", pVM, pVCpu));
-
-    /* Save the host state here while entering HM context. When thread-context hooks are used, we might get preempted
-       and have to resave the host state but most of the time we won't be, so do it here before we disable interrupts. */
-    Assert(!RTThreadPreemptIsEnabled(NIL_RTTHREAD));
-    return hmR0VmxSaveHostState(pVM, pVCpu);
-}
-
-
-/**
- * Loads the guest state into the VMCS guest-state area.
+    /*
+     * Export the host state here while entering HM context.
+     * When thread-context hooks are used, we might get preempted and have to re-save the host
+     * state but most of the time we won't be, so do it here before we disable interrupts.
+     */
+    return hmR0VmxExportHostState(pVCpu);
+}
+
+
+/**
+ * Exports the guest state into the VMCS guest-state area.
  *
  * The will typically be done before VM-entry when the guest-CPU state and the
@@ -9115 +8012 @@
  * @remarks No-long-jump zone!!!
  */
-static VBOXSTRICTRC hmR0VmxLoadGuestState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static VBOXSTRICTRC hmR0VmxExportGuestState(PVM pVM, PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
 {
     AssertPtr(pVM);
@@ -9124 +8021 @@
     LogFlowFunc(("pVM=%p pVCpu=%p\n", pVM, pVCpu));
 
-    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestState, x);
+    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExportGuestState, x);
 
     /* Determine real-on-v86 mode. */
@@ -9135 +8032 @@
 
     /*
-     * Load the guest-state into the VMCS.
      * Any ordering dependency among the sub-functions below must be explicitly stated using comments.
      * Ideally, assert that the cross-dependent bits are up-to-date at the point of using it.
      */
-    int rc = hmR0VmxSetupVMRunHandler(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSetupVMRunHandler! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    /* This needs to be done after hmR0VmxSetupVMRunHandler() as changing pfnStartVM may require VM-entry control updates. */
-    rc = hmR0VmxLoadGuestEntryCtls(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxLoadGuestEntryCtls! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    /* This needs to be done after hmR0VmxSetupVMRunHandler() as changing pfnStartVM may require VM-exit control updates. */
-    rc = hmR0VmxLoadGuestExitCtls(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxSetupExitCtls failed! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    rc = hmR0VmxLoadGuestActivityState(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxLoadGuestActivityState! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    VBOXSTRICTRC rcStrict = hmR0VmxLoadGuestCR3AndCR4(pVCpu, pMixedCtx);
+    int rc = hmR0VmxSelectVMRunHandler(pVCpu, pMixedCtx);
+    AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+    /* This needs to be done after hmR0VmxSelectVMRunHandler() as changing pfnStartVM may require VM-entry control updates. */
+    rc = hmR0VmxExportGuestEntryCtls(pVCpu, pMixedCtx);
+    AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+    /* This needs to be done after hmR0VmxSelectVMRunHandler() as changing pfnStartVM may require VM-exit control updates. */
+    rc = hmR0VmxExportGuestExitCtls(pVCpu, pMixedCtx);
+    AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+    rc = hmR0VmxExportGuestCR0(pVCpu, pMixedCtx);
+    AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+    VBOXSTRICTRC rcStrict = hmR0VmxExportGuestCR3AndCR4(pVCpu, pMixedCtx);
     if (rcStrict == VINF_SUCCESS)
     { /* likely */ }
@@ -9162 +8058 @@
     }
 
-    /* Assumes pMixedCtx->cr0 is up-to-date (strict builds require CR0 for segment register validation checks). */
-    rc = hmR0VmxLoadGuestSegmentRegs(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxLoadGuestSegmentRegs: rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    /* This needs to be done after hmR0VmxLoadGuestEntryCtls() and hmR0VmxLoadGuestExitCtls() as it may alter controls if we
-       determine we don't have to swap EFER after all. */
-    rc = hmR0VmxLoadGuestMsrs(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxLoadGuestMsrs! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    rc = hmR0VmxLoadGuestApicState(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxLoadGuestApicState! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    rc = hmR0VmxLoadGuestXcptIntercepts(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxLoadGuestXcptIntercepts! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    /*
-     * Loading Rflags here is fine, even though Rflags.TF might depend on guest debug state (which is not loaded here).
-     * It is re-evaluated and updated if necessary in hmR0VmxLoadSharedState().
-     */
-    rc = hmR0VmxLoadGuestRipRspRflags(pVCpu, pMixedCtx);
-    AssertLogRelMsgRCReturn(rc, ("hmR0VmxLoadGuestRipRspRflags! rc=%Rrc (pVM=%p pVCpu=%p)\n", rc, pVM, pVCpu), rc);
-
-    /* Clear any unused and reserved bits. */
-    HMCPU_CF_CLEAR(pVCpu,   HM_CHANGED_GUEST_CR2
-                          | HM_CHANGED_GUEST_HWVIRT);
-
-    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestState, x);
+    rc = hmR0VmxExportGuestSegmentRegs(pVCpu, pMixedCtx);
+    AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+    /* This needs to be done after hmR0VmxExportGuestEntryCtls() and hmR0VmxExportGuestExitCtls() as it
+       may alter controls if we determine we don't have to swap EFER after all. */
+    rc = hmR0VmxExportGuestMsrs(pVCpu, pMixedCtx);
+    AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+    rc = hmR0VmxExportGuestApicTpr(pVCpu);
+    AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+    /* This needs to be done after hmR0VmxExportGuestCR0() as it may alter intercepted exceptions. */
+    rc = hmR0VmxExportGuestXcptIntercepts(pVCpu);
+    AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+    /* Exporting RFLAGS here is fine, even though RFLAGS.TF might depend on guest debug state which is
+       not exported here. It is re-evaluated and updated if necessary in hmR0VmxExportSharedState(). */
+    rc  = hmR0VmxExportGuestRip(pVCpu, pMixedCtx);
+    rc |= hmR0VmxExportGuestRsp(pVCpu, pMixedCtx);
+    rc |= hmR0VmxExportGuestRflags(pVCpu, pMixedCtx);
+    AssertLogRelMsgRCReturn(rc, ("rc=%Rrc\n", rc), rc);
+
+    /* Clear any bits that may be set but exported unconditionally or unused/reserved bits. */
+    ASMAtomicUoAndU64(&pVCpu->hm.s.fCtxChanged, ~(  (HM_CHANGED_GUEST_GPRS_MASK & ~HM_CHANGED_GUEST_RSP)
+                                                  |  HM_CHANGED_GUEST_CR2
+                                                  | (HM_CHANGED_GUEST_DR_MASK & ~HM_CHANGED_GUEST_DR7)
+                                                  |  HM_CHANGED_GUEST_X87
+                                                  |  HM_CHANGED_GUEST_SSE_AVX
+                                                  |  HM_CHANGED_GUEST_OTHER_XSAVE
+                                                  |  HM_CHANGED_GUEST_XCRx
+                                                  |  HM_CHANGED_GUEST_KERNEL_GS_BASE /* Part of lazy or auto load-store MSRs. */
+                                                  |  HM_CHANGED_GUEST_SYSCALL_MSRS   /* Part of lazy or auto load-store MSRs. */
+                                                  |  HM_CHANGED_GUEST_TSC_AUX
+                                                  |  HM_CHANGED_GUEST_OTHER_MSRS
+                                                  |  HM_CHANGED_GUEST_HWVIRT
+                                                  | (HM_CHANGED_KEEPER_STATE_MASK & ~HM_CHANGED_VMX_MASK)));
+
+    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExportGuestState, x);
     return rc;
 }
@@ -9194 +8101 @@
 
 /**
- * Loads the state shared between the host and guest into the VMCS.
+ * Exports the state shared between the host and guest into the VMCS.
  *
  * @param   pVM         The cross context VM structure.
@@ -9202 +8109 @@
  * @remarks No-long-jump zone!!!
  */
-static void hmR0VmxLoadSharedState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
+static void hmR0VmxExportSharedState(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx)
 {
     NOREF(pVM);
@@ -9209 +8116 @@
     Assert(!VMMRZCallRing3IsEnabled(pVCpu));
 
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_CR0))
-    {
-        int rc = hmR0VmxLoadSharedCR0(pVCpu, pCtx);
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_DR_MASK)
+    {
+        int rc = hmR0VmxExportSharedDebugState(pVCpu, pCtx);
         AssertRC(rc);
-    }
-
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_DEBUG))
-    {
-        int rc = hmR0VmxLoadSharedDebugState(pVCpu, pCtx);
-        AssertRC(rc);
+        pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_GUEST_DR_MASK;
 
         /* Loading shared debug bits might have changed eflags.TF bit for debugging purposes. */
-        if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_GUEST_RFLAGS))
-        {
-            rc = hmR0VmxLoadGuestRflags(pVCpu, pCtx);
+        if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_GUEST_RFLAGS)
+        {
+            rc = hmR0VmxExportGuestRflags(pVCpu, pCtx);
             AssertRC(rc);
         }
     }
 
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMM_GUEST_LAZY_MSRS))
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_VMX_GUEST_LAZY_MSRS)
     {
         hmR0VmxLazyLoadGuestMsrs(pVCpu, pCtx);
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_VMM_GUEST_LAZY_MSRS);
-    }
-
-    /* Loading CR0, debug state might have changed intercepts, update VMCS. */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_VMM_GUEST_XCPT_INTERCEPTS))
-    {
-        Assert(pVCpu->hm.s.vmx.u32XcptBitmap & RT_BIT_32(X86_XCPT_AC));
-        Assert(pVCpu->hm.s.vmx.u32XcptBitmap & RT_BIT_32(X86_XCPT_DB));
-        int rc = VMXWriteVmcs32(VMX_VMCS32_CTRL_EXCEPTION_BITMAP, pVCpu->hm.s.vmx.u32XcptBitmap);
-        AssertRC(rc);
-        HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_VMM_GUEST_XCPT_INTERCEPTS);
-    }
-
-    AssertMsg(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_HOST_GUEST_SHARED_STATE),
-              ("fContextUseFlags=%#RX32\n", HMCPU_CF_VALUE(pVCpu)));
+        pVCpu->hm.s.fCtxChanged &= ~HM_CHANGED_VMX_GUEST_LAZY_MSRS;
+    }
+
+    AssertMsg(!(pVCpu->hm.s.fCtxChanged & HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE),
+              ("fCtxChanged=%#RX64\n", pVCpu->hm.s.fCtxChanged));
 }
 
@@ -9265 +8157 @@
  * @remarks No-long-jump zone!!!
  */
-static VBOXSTRICTRC hmR0VmxLoadGuestStateOptimal(PVM pVM, PVMCPU pVCpu, PCPUMCTX pMixedCtx)
+static VBOXSTRICTRC hmR0VmxExportGuestStateOptimal(PVM pVM, PVMCPU pVCpu, PCCPUMCTX pMixedCtx)
 {
     HMVMX_ASSERT_PREEMPT_SAFE();
@@ -9271 +8163 @@
     Assert(VMMR0IsLogFlushDisabled(pVCpu));
 
-    Log5(("LoadFlags=%#RX32\n", HMCPU_CF_VALUE(pVCpu)));
 #ifdef HMVMX_ALWAYS_SYNC_FULL_GUEST_STATE
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+    pVCpu->hm.s.fCtxChanged |= HM_CHANGED_ALL_GUEST;
 #endif
 
     /*
-     * RIP is what changes the most often and hence if it's the only bit needing to be
-     * updated, we shall handle it early for performance reasons.
+     * For many exits it's only RIP that changes and hence try to export it first
+     * without going through a lot of change flag checks.
      */
-    VBOXSTRICTRC rcStrict = VINF_SUCCESS;
-    if (HMCPU_CF_IS_SET_ONLY(pVCpu, HM_CHANGED_GUEST_RIP))
-    {
-        rcStrict = hmR0VmxLoadGuestRip(pVCpu, pMixedCtx);
+    VBOXSTRICTRC rcStrict;
+    uint64_t     fCtxChanged = ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged);
+    if ((fCtxChanged & (HM_CHANGED_ALL_GUEST & ~HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE)) == HM_CHANGED_GUEST_RIP)
+    {
+        rcStrict = hmR0VmxExportGuestRip(pVCpu, pMixedCtx);
         if (RT_LIKELY(rcStrict == VINF_SUCCESS))
         { /* likely */}
         else
-        {
-            AssertMsgFailedReturn(("hmR0VmxLoadGuestStateOptimal: hmR0VmxLoadGuestRip failed! rc=%Rrc\n",
-                                   VBOXSTRICTRC_VAL(rcStrict)), rcStrict);
-        }
-        STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadMinimal);
-    }
-    else if (HMCPU_CF_VALUE(pVCpu))
-    {
-        rcStrict = hmR0VmxLoadGuestState(pVM, pVCpu, pMixedCtx);
+            AssertMsgFailedReturn(("hmR0VmxExportGuestRip failed! rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)), rcStrict);
+        STAM_COUNTER_INC(&pVCpu->hm.s.StatExportMinimal);
+    }
+    else if (fCtxChanged & (HM_CHANGED_ALL_GUEST & ~HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE))
+    {
+        rcStrict = hmR0VmxExportGuestState(pVM, pVCpu, pMixedCtx);
         if (RT_LIKELY(rcStrict == VINF_SUCCESS))
         { /* likely */}
         else
         {
-            AssertMsg(rcStrict == VINF_EM_RESCHEDULE_REM,
-                      ("hmR0VmxLoadGuestStateOptimal: hmR0VmxLoadGuestState failed! rc=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
+            AssertMsg(rcStrict == VINF_EM_RESCHEDULE_REM, ("hmR0VmxExportGuestState failed! rc=%Rrc\n",
+                                                           VBOXSTRICTRC_VAL(rcStrict)));
             Assert(!VMMRZCallRing3IsEnabled(pVCpu));
             return rcStrict;
         }
-        STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadFull);
-    }
-
+        STAM_COUNTER_INC(&pVCpu->hm.s.StatExportFull);
+    }
+    else
+        rcStrict = VINF_SUCCESS;
+
+#ifdef VBOX_STRICT
     /* All the guest state bits should be loaded except maybe the host context and/or the shared host/guest bits. */
-    AssertMsg(   !HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_ALL_GUEST)
-              ||  HMCPU_CF_IS_PENDING_ONLY(pVCpu, HM_CHANGED_HOST_CONTEXT | HM_CHANGED_HOST_GUEST_SHARED_STATE),
-              ("fContextUseFlags=%#RX32\n", HMCPU_CF_VALUE(pVCpu)));
+    fCtxChanged = ASMAtomicUoReadU64(&pVCpu->hm.s.fCtxChanged);
+    AssertMsg(!(fCtxChanged & (HM_CHANGED_ALL_GUEST & ~HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE)),
+              ("fCtxChanged=%#RX64\n", fCtxChanged));
+#endif
     return rcStrict;
 }
@@ -9370 +8263 @@
      * in both PGMHandlerPhysicalReset() and IOMMMIOMapMMIOHCPage(), see @bugref{8721}.
      *
-     * This is the reason we do it here and not in hmR0VmxLoadGuestState().
+     * This is the reason we do it here and not in hmR0VmxExportGuestState().
      */
     if (   !pVCpu->hm.s.vmx.u64MsrApicBase
@@ -9387 +8280 @@
 
         /* Map the HC APIC-access page in place of the MMIO page, also updates the shadow page tables if necessary. */
-        Log4(("hmR0VmxPreRunGuest: VCPU%u: Mapped HC APIC-access page at %#RGp\n", pVCpu->idCpu, GCPhysApicBase));
+        Log4Func(("Mapped HC APIC-access page at %#RGp\n", GCPhysApicBase));
         rc = IOMMMIOMapMMIOHCPage(pVM, pVCpu, GCPhysApicBase, pVM->hm.s.vmx.HCPhysApicAccess, X86_PTE_RW | X86_PTE_P);
         AssertRCReturn(rc, rc);
@@ -9397 +8290 @@
     if (TRPMHasTrap(pVCpu))
         hmR0VmxTrpmTrapToPendingEvent(pVCpu);
-    uint32_t uIntrState = hmR0VmxEvaluatePendingEvent(pVCpu, pMixedCtx);
+    uint32_t fIntrState = hmR0VmxEvaluatePendingEvent(pVCpu, pMixedCtx);
 
     /*
@@ -9403 +8296 @@
      * longjmps or interrupts + preemption enabled. Event injection might also result in triple-faulting the VM.
      */
-    rcStrict = hmR0VmxInjectPendingEvent(pVCpu, pMixedCtx, uIntrState, fStepping);
+    rcStrict = hmR0VmxInjectPendingEvent(pVCpu, pMixedCtx, fIntrState, fStepping);
     if (RT_LIKELY(rcStrict == VINF_SUCCESS))
     { /* likely */ }
@@ -9421 +8314 @@
 
     /*
-     * Load the guest state bits.
+     * Export the guest state bits.
      *
      * We cannot perform longjmps while loading the guest state because we do not preserve the
@@ -9431 +8324 @@
      * Hence, loading of the guest state needs to be done -after- injection of events.
      */
-    rcStrict = hmR0VmxLoadGuestStateOptimal(pVM, pVCpu, pMixedCtx);
+    rcStrict = hmR0VmxExportGuestStateOptimal(pVM, pVCpu, pMixedCtx);
     if (RT_LIKELY(rcStrict == VINF_SUCCESS))
     { /* likely */ }
@@ -9520 +8413 @@
         STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatLoadGuestFpuState, x);
         if (CPUMR0LoadGuestFPU(pVM, pVCpu) == VINF_CPUM_HOST_CR0_MODIFIED)
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_HOST_CONTEXT);
+            pVCpu->hm.s.fCtxChanged |= HM_CHANGED_HOST_CONTEXT;
         STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatLoadGuestFpuState, x);
         STAM_COUNTER_INC(&pVCpu->hm.s.StatLoadGuestFpu);
-        Assert(HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_CR0));
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR0);
     }
 
@@ -9532 +8423 @@
     if (   !pVCpu->hm.s.vmx.fUpdatedHostMsrs
         && pVCpu->hm.s.vmx.cMsrs > 0)
-    {
         hmR0VmxUpdateAutoLoadStoreHostMsrs(pVCpu);
-    }
 
     /*
-     * Load the host state bits as we may've been preempted (only happens when
+     * Re-save the host state bits as we may've been preempted (only happens when
      * thread-context hooks are used or when hmR0VmxSetupVMRunHandler() changes pfnStartVM).
      * Note that the 64-on-32 switcher saves the (64-bit) host state into the VMCS and
@@ -9543 +8432 @@
      * See @bugref{8432}.
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_HOST_CONTEXT))
-    {
-        int rc = hmR0VmxSaveHostState(pVM, pVCpu);
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_HOST_CONTEXT)
+    {
+        int rc = hmR0VmxExportHostState(pVCpu);
         AssertRC(rc);
-        STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchPreemptSaveHostState);
-    }
-    Assert(!HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_HOST_CONTEXT));
+        STAM_COUNTER_INC(&pVCpu->hm.s.StatSwitchPreemptExportHostState);
+    }
+    Assert(!(pVCpu->hm.s.fCtxChanged & HM_CHANGED_HOST_CONTEXT));
 
     /*
-     * Load the state shared between host and guest (FPU, debug, lazy MSRs).
+     * Export the state shared between host and guest (FPU, debug, lazy MSRs).
      */
-    if (HMCPU_CF_IS_PENDING(pVCpu, HM_CHANGED_HOST_GUEST_SHARED_STATE))
-        hmR0VmxLoadSharedState(pVM, pVCpu, pMixedCtx);
-    AssertMsg(!HMCPU_CF_VALUE(pVCpu), ("fContextUseFlags=%#RX32\n", HMCPU_CF_VALUE(pVCpu)));
+    if (pVCpu->hm.s.fCtxChanged & HM_CHANGED_VMX_HOST_GUEST_SHARED_STATE)
+        hmR0VmxExportSharedState(pVM, pVCpu, pMixedCtx);
+    AssertMsg(!pVCpu->hm.s.fCtxChanged, ("fCtxChanged=%#RX64\n", pVCpu->hm.s.fCtxChanged));
 
     /* Store status of the shared guest-host state at the time of VM-entry. */
@@ -9605 +8494 @@
         {
             bool fMsrUpdated;
-            int rc2 = hmR0VmxSaveGuestAutoLoadStoreMsrs(pVCpu, pMixedCtx);
-            AssertRC(rc2);
-            Assert(HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_AUTO_LOAD_STORE_MSRS));
-
-            rc2 = hmR0VmxAddAutoLoadStoreMsr(pVCpu, MSR_K8_TSC_AUX, CPUMGetGuestTscAux(pVCpu), true /* fUpdateHostMsr */,
+            hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_TSC_AUX);
+            int rc2 = hmR0VmxAddAutoLoadStoreMsr(pVCpu, MSR_K8_TSC_AUX, CPUMGetGuestTscAux(pVCpu), true /* fUpdateHostMsr */,
                                              &fMsrUpdated);
             AssertRC(rc2);
             Assert(fMsrUpdated || pVCpu->hm.s.vmx.fUpdatedHostMsrs);
-
             /* Finally, mark that all host MSR values are updated so we don't redo it without leaving VT-x. See @bugref{6956}. */
             pVCpu->hm.s.vmx.fUpdatedHostMsrs = true;
@@ -9627 +8512 @@
     {
         bool fMsrUpdated;
-        int rc2 = hmR0VmxSaveGuestAutoLoadStoreMsrs(pVCpu, pMixedCtx);
-        AssertRC(rc2);
-        Assert(HMVMXCPU_GST_IS_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_AUTO_LOAD_STORE_MSRS));
-
-        rc2 = hmR0VmxAddAutoLoadStoreMsr(pVCpu, MSR_IA32_SPEC_CTRL, CPUMGetGuestSpecCtrl(pVCpu), true /* fUpdateHostMsr */,
-                                         &fMsrUpdated);
+        hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_OTHER_MSRS);
+        int rc2 = hmR0VmxAddAutoLoadStoreMsr(pVCpu, MSR_IA32_SPEC_CTRL, CPUMGetGuestSpecCtrl(pVCpu), true /* fUpdateHostMsr */,
+                                             &fMsrUpdated);
         AssertRC(rc2);
         Assert(fMsrUpdated || pVCpu->hm.s.vmx.fUpdatedHostMsrs);
@@ -9658 +8540 @@
  * @param   pVM             The cross context VM structure.
  * @param   pVCpu           The cross context virtual CPU structure.
- * @param   pMixedCtx       Pointer to the guest-CPU context. The data maybe
- *                          out-of-sync. Make sure to update the required fields
- *                          before using them.
  * @param   pVmxTransient   Pointer to the VMX transient structure.
  * @param   rcVMRun         Return code of VMLAUNCH/VMRESUME.
@@ -9669 +8548 @@
  *          unconditionally when it is safe to do so.
  */
-static void hmR0VmxPostRunGuest(PVM pVM, PVMCPU pVCpu, PCPUMCTX pMixedCtx, PVMXTRANSIENT pVmxTransient, int rcVMRun)
-{
-    NOREF(pVM);
-    uint64_t uHostTsc = ASMReadTSC();
-
+static void hmR0VmxPostRunGuest(PVMCPU pVCpu, PVMXTRANSIENT pVmxTransient, int rcVMRun)
+{
+    uint64_t const uHostTsc = ASMReadTSC();
     Assert(!VMMRZCallRing3IsEnabled(pVCpu));
 
     ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, false);   /* See HMInvalidatePageOnAllVCpus(): used for TLB flushing. */
     ASMAtomicIncU32(&pVCpu->hm.s.cWorldSwitchExits);            /* Initialized in vmR3CreateUVM(): used for EMT poking. */
-    HMVMXCPU_GST_RESET_TO(pVCpu, 0);                            /* Exits/longjmps to ring-3 requires saving the guest state. */
+    pVCpu->hm.s.fCtxChanged            = 0;                     /* Exits/longjmps to ring-3 requires saving the guest state. */
     pVmxTransient->fVmcsFieldsRead     = 0;                     /* Transient fields need to be read from the VMCS. */
     pVmxTransient->fVectoringPF        = false;                 /* Vectoring page-fault needs to be determined later. */
@@ -9735 +8612 @@
         if (!pVmxTransient->fVMEntryFailed)
         {
-            /** @todo We can optimize this by only syncing with our force-flags when
-             *        really needed and keeping the VMCS state as it is for most
-             *        VM-exits. */
-            /* Update the guest interruptibility-state from the VMCS. */
-            hmR0VmxSaveGuestIntrState(pVCpu, pMixedCtx);
+            VMMRZCallRing3Enable(pVCpu);
 
             /*
-             * Allow longjmps to ring-3 -after- saving the guest-interruptibility state
-             * as it's not part of hmR0VmxSaveGuestState() and thus would trigger an assertion
-             * on the longjmp path to ring-3 while saving the (rest of) the guest state,
-             * see @bugref{6208#c63}.
+             * Import the guest-interruptibility state always as we need it while evaluating
+             * injecting events on re-entry.
+             *
+             * We don't import CR0 (when Unrestricted guest execution is unavailable) despite
+             * checking for real-mode while exporting the state because all bits that cause
+             * mode changes wrt CR0 are intercepted.
              */
-            VMMRZCallRing3Enable(pVCpu);
+            rc = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_HM_VMX_INT_STATE);
+            AssertRC(rc);
 
 #if defined(HMVMX_ALWAYS_SYNC_FULL_GUEST_STATE) || defined(HMVMX_ALWAYS_SAVE_FULL_GUEST_STATE)
-            rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
+            rc = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
             AssertRC(rc);
 #elif defined(HMVMX_ALWAYS_SAVE_GUEST_RFLAGS)
-            rc = hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
+            rc = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_RFLAGS);
             AssertRC(rc);
 #endif
@@ -9765 +8641 @@
                 rc = APICSetTpr(pVCpu, pVCpu->hm.s.vmx.pbVirtApic[XAPIC_OFF_TPR]);
                 AssertRC(rc);
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
+                ASMAtomicOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
             }
 
@@ -9773 +8649 @@
     else
     {
-        Log4(("VM-entry failure: pVCpu=%p idCpu=%RU32 rcVMRun=%Rrc fVMEntryFailed=%RTbool\n", pVCpu, pVCpu->idCpu, rcVMRun,
-          pVmxTransient->fVMEntryFailed));
+        Log4Func(("VM-entry failure: rcVMRun=%Rrc fVMEntryFailed=%RTbool\n", rcVMRun, pVmxTransient->fVMEntryFailed));
     }
 
@@ -9816 +8691 @@
         /* Restore any residual host-state and save any bits shared between host
            and guest into the guest-CPU state.  Re-enables interrupts! */
-        hmR0VmxPostRunGuest(pVM, pVCpu, pCtx, &VmxTransient, rcRun);
+        hmR0VmxPostRunGuest(pVCpu, &VmxTransient, rcRun);
 
         /* Check for errors with running the VM (VMLAUNCH/VMRESUME). */
@@ -9931 +8806 @@
  * @param   pDbgState       The structure to initialize.
  */
-DECLINLINE(void) hmR0VmxRunDebugStateInit(PVMCPU pVCpu, PCCPUMCTX pCtx, PVMXRUNDBGSTATE pDbgState)
+static void hmR0VmxRunDebugStateInit(PVMCPU pVCpu, PCCPUMCTX pCtx, PVMXRUNDBGSTATE pDbgState)
 {
     pDbgState->uRipStart            = pCtx->rip;
@@ -9962 +8837 @@
  * @param   pDbgState   The debug state.
  */
-DECLINLINE(void) hmR0VmxPreRunGuestDebugStateApply(PVMCPU pVCpu, PVMXRUNDBGSTATE pDbgState)
+static void hmR0VmxPreRunGuestDebugStateApply(PVMCPU pVCpu, PVMXRUNDBGSTATE pDbgState)
 {
     /*
@@ -10013 +8888 @@
 
 
-DECLINLINE(VBOXSTRICTRC) hmR0VmxRunDebugStateRevert(PVMCPU pVCpu, PVMXRUNDBGSTATE pDbgState, VBOXSTRICTRC rcStrict)
+static VBOXSTRICTRC hmR0VmxRunDebugStateRevert(PVMCPU pVCpu, PVMXRUNDBGSTATE pDbgState, VBOXSTRICTRC rcStrict)
 {
     /*
@@ -10055 +8930 @@
  * the necessary VM-exits demanded by DBGF and DTrace.
  *
- * @param   pVM             The cross context VM structure.
  * @param   pVCpu           The cross context virtual CPU structure.
- * @param   pCtx            Pointer to the guest-CPU context.
  * @param   pDbgState       The debug state.
  * @param   pVmxTransient   Pointer to the VMX transient structure.  May update
  *                          fUpdateTscOffsettingAndPreemptTimer.
  */
-static void hmR0VmxPreRunGuestDebugStateUpdate(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx,
-                                               PVMXRUNDBGSTATE pDbgState, PVMXTRANSIENT pVmxTransient)
+static void hmR0VmxPreRunGuestDebugStateUpdate(PVMCPU pVCpu, PVMXRUNDBGSTATE pDbgState, PVMXTRANSIENT pVmxTransient)
 {
     /*
@@ -10085 +8957 @@
      * Software interrupts (INT XXh) - no idea how to trigger these...
      */
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
     if (   DBGF_IS_EVENT_ENABLED(pVM, DBGFEVENT_INTERRUPT_SOFTWARE)
         || VBOXVMM_INT_SOFTWARE_ENABLED())
@@ -10129 +9002 @@
      * Process events and probes for VM-exits, making sure we get the wanted VM-exits.
      *
-     * Note! This is the reverse of waft hmR0VmxHandleExitDtraceEvents does.
+     * Note! This is the reverse of what hmR0VmxHandleExitDtraceEvents does.
      *       So, when adding/changing/removing please don't forget to update it.
      *
@@ -10211 +9084 @@
         || IS_EITHER_ENABLED(pVM, INSTR_CRX_WRITE))
     {
-        int rc2 = hmR0VmxSaveGuestCR0(pVCpu, pCtx);
-        rc2    |= hmR0VmxSaveGuestCR4(pVCpu, pCtx);
-        rc2    |= hmR0VmxSaveGuestApicState(pVCpu, pCtx);
-        AssertRC(rc2);
+        int rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_CR0
+                                               | CPUMCTX_EXTRN_CR4
+                                               | CPUMCTX_EXTRN_APIC_TPR);
+        AssertRC(rc);
 
 #if 0 /** @todo fix me */
@@ -10234 +9107 @@
         {
             pDbgState->fClearCr0Mask = false;
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR0);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR0);
         }
         if (pDbgState->fClearCr4Mask)
         {
             pDbgState->fClearCr4Mask = false;
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR4);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR4);
         }
     }
@@ -10479 +9352 @@
         case VMX_EXIT_MOV_CRX:
             hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
-/** @todo r=bird: I feel these macros aren't very descriptive and needs to be at least 30 chars longer! ;-)
-* Sensible abbreviations strongly recommended here because even with 130 columns this stuff get too wide! */
-            if (   VMX_EXIT_QUALIFICATION_CRX_ACCESS(pVmxTransient->uExitQualification)
-                == VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ)
+            if (VMX_EXIT_QUAL_CRX_ACCESS(pVmxTransient->uExitQualification) == VMX_EXIT_QUAL_CRX_ACCESS_READ)
                 SET_BOTH(CRX_READ);
             else
                 SET_BOTH(CRX_WRITE);
-            uEventArg = VMX_EXIT_QUALIFICATION_CRX_REGISTER(pVmxTransient->uExitQualification);
+            uEventArg = VMX_EXIT_QUAL_CRX_REGISTER(pVmxTransient->uExitQualification);
             break;
         case VMX_EXIT_MOV_DRX:
             hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
-            if (   VMX_EXIT_QUALIFICATION_DRX_DIRECTION(pVmxTransient->uExitQualification)
-                == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_READ)
+            if (   VMX_EXIT_QUAL_DRX_DIRECTION(pVmxTransient->uExitQualification)
+                == VMX_EXIT_QUAL_DRX_DIRECTION_READ)
                 SET_BOTH(DRX_READ);
             else
                 SET_BOTH(DRX_WRITE);
-            uEventArg = VMX_EXIT_QUALIFICATION_DRX_REGISTER(pVmxTransient->uExitQualification);
+            uEventArg = VMX_EXIT_QUAL_DRX_REGISTER(pVmxTransient->uExitQualification);
             break;
         case VMX_EXIT_RDMSR:            SET_BOTH(RDMSR); break;
@@ -10571 +9441 @@
     {
         hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
-        hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
+        hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
         switch (enmEvent1)
         {
@@ -10759 +9629 @@
     {
         hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
-        hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
+        int rc = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
+        AssertRC(rc);
         VBOXVMM_R0_HMVMX_VMEXIT(pVCpu, pMixedCtx, pVmxTransient->uExitReason, pVmxTransient->uExitQualification);
     }
@@ -10841 +9712 @@
             case VMX_EXIT_XRSTORS:
             {
-                int rc2 = hmR0VmxSaveGuestRip(pVCpu, pMixedCtx);
-                rc2    |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
-                AssertRCReturn(rc2, rc2);
+                int rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_RIP
+                                                        | CPUMCTX_EXTRN_CS);
+                AssertRCReturn(rc, rc);
                 if (   pMixedCtx->rip    != pDbgState->uRipStart
                     || pMixedCtx->cs.Sel != pDbgState->uCsStart)
@@ -10905 +9776 @@
 
     /* Set HMCPU indicators.  */
-    bool const fSavedSingleInstruction  = pVCpu->hm.s.fSingleInstruction;
-    pVCpu->hm.s.fSingleInstruction      = pVCpu->hm.s.fSingleInstruction || DBGFIsStepping(pVCpu);
-    pVCpu->hm.s.fDebugWantRdTscExit     = false;
-    pVCpu->hm.s.fUsingDebugLoop         = true;
+    bool const fSavedSingleInstruction = pVCpu->hm.s.fSingleInstruction;
+    pVCpu->hm.s.fSingleInstruction     = pVCpu->hm.s.fSingleInstruction || DBGFIsStepping(pVCpu);
+    pVCpu->hm.s.fDebugWantRdTscExit    = false;
+    pVCpu->hm.s.fUsingDebugLoop        = true;
 
     /* State we keep to help modify and later restore the VMCS fields we alter, and for detecting steps.  */
     VMXRUNDBGSTATE DbgState;
     hmR0VmxRunDebugStateInit(pVCpu, pCtx, &DbgState);
-    hmR0VmxPreRunGuestDebugStateUpdate(pVM, pVCpu, pCtx, &DbgState, &VmxTransient);
+    hmR0VmxPreRunGuestDebugStateUpdate(pVCpu, &DbgState, &VmxTransient);
 
     /*
@@ -10949 +9820 @@
          * and guest into the guest-CPU state.  Re-enables interrupts!
          */
-        hmR0VmxPostRunGuest(pVM, pVCpu, pCtx, &VmxTransient, rcRun);
+        hmR0VmxPostRunGuest(pVCpu, &VmxTransient, rcRun);
 
         /* Check for errors with running the VM (VMLAUNCH/VMRESUME). */
@@ -10990 +9861 @@
         if (fStepping)
         {
-            int rc2 = hmR0VmxSaveGuestRip(pVCpu, pCtx);
-            rc2    |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pCtx);
-            AssertRCReturn(rc2, rc2);
+            int rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_RIP
+                                                    | CPUMCTX_EXTRN_CS);
+            AssertRC(rc);
             if (   pCtx->rip    != DbgState.uRipStart
                 || pCtx->cs.Sel != DbgState.uCsStart)
@@ -10999 +9870 @@
                 break;
             }
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_DEBUG);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_DR7);
         }
 
@@ -11006 +9877 @@
          */
         if (VBOXVMM_GET_SETTINGS_SEQ_NO() != DbgState.uDtraceSettingsSeqNo)
-            hmR0VmxPreRunGuestDebugStateUpdate(pVM, pVCpu, pCtx, &DbgState, &VmxTransient);
+            hmR0VmxPreRunGuestDebugStateUpdate(pVCpu, &DbgState, &VmxTransient);
     }
 
@@ -11014 +9885 @@
     if (pVCpu->hm.s.fClearTrapFlag)
     {
-        int rc2 = hmR0VmxSaveGuestRflags(pVCpu, pCtx);
-        AssertRCReturn(rc2, rc2);
+        int rc = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_RFLAGS);
+        AssertRC(rc);
         pVCpu->hm.s.fClearTrapFlag = false;
         pCtx->eflags.Bits.u1TF = 0;
@@ -11190 +10061 @@
 {
     Assert(VMMRZCallRing3IsEnabled(pVCpu));
-    Assert(HMVMXCPU_GST_VALUE(pVCpu) == HMVMX_UPDATED_GUEST_ALL);
+    Assert(!ASMAtomicUoReadU64(&pCtx->fExtrn));
     HMVMX_ASSERT_PREEMPT_SAFE();
 
@@ -11223 +10094 @@
 DECLINLINE(VBOXSTRICTRC) hmR0VmxHandleExit(PVMCPU pVCpu, PCPUMCTX pMixedCtx, PVMXTRANSIENT pVmxTransient, uint32_t rcReason)
 {
-# ifdef DEBUG_ramshankar
-#  define VMEXIT_CALL_RET(a_CallExpr) \
+#ifdef DEBUG_ramshankar
+#define VMEXIT_CALL_RET(a_fSave, a_CallExpr) \
        do { \
-            int rc2 = hmR0VmxSaveGuestState(pVCpu, pMixedCtx); AssertRC(rc2); \
+            if (a_fSave != 0) \
+                hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL); \
             VBOXSTRICTRC rcStrict = a_CallExpr; \
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST); \
+            if (a_fSave != 0) \
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST); \
             return rcStrict; \
         } while (0)
-# else
-#  define VMEXIT_CALL_RET(a_CallExpr) return a_CallExpr
-# endif
+#else
+# define VMEXIT_CALL_RET(a_fSave, a_CallExpr) return a_CallExpr
+#endif
     switch (rcReason)
     {
-        case VMX_EXIT_EPT_MISCONFIG:           VMEXIT_CALL_RET(hmR0VmxExitEptMisconfig(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_EPT_VIOLATION:           VMEXIT_CALL_RET(hmR0VmxExitEptViolation(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_IO_INSTR:                VMEXIT_CALL_RET(hmR0VmxExitIoInstr(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_CPUID:                   VMEXIT_CALL_RET(hmR0VmxExitCpuid(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_RDTSC:                   VMEXIT_CALL_RET(hmR0VmxExitRdtsc(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_RDTSCP:                  VMEXIT_CALL_RET(hmR0VmxExitRdtscp(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_APIC_ACCESS:             VMEXIT_CALL_RET(hmR0VmxExitApicAccess(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_XCPT_OR_NMI:             VMEXIT_CALL_RET(hmR0VmxExitXcptOrNmi(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_MOV_CRX:                 VMEXIT_CALL_RET(hmR0VmxExitMovCRx(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_EXT_INT:                 VMEXIT_CALL_RET(hmR0VmxExitExtInt(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_INT_WINDOW:              VMEXIT_CALL_RET(hmR0VmxExitIntWindow(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_MWAIT:                   VMEXIT_CALL_RET(hmR0VmxExitMwait(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_MONITOR:                 VMEXIT_CALL_RET(hmR0VmxExitMonitor(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_TASK_SWITCH:             VMEXIT_CALL_RET(hmR0VmxExitTaskSwitch(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_PREEMPT_TIMER:           VMEXIT_CALL_RET(hmR0VmxExitPreemptTimer(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_RDMSR:                   VMEXIT_CALL_RET(hmR0VmxExitRdmsr(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_WRMSR:                   VMEXIT_CALL_RET(hmR0VmxExitWrmsr(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_MOV_DRX:                 VMEXIT_CALL_RET(hmR0VmxExitMovDRx(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_TPR_BELOW_THRESHOLD:     VMEXIT_CALL_RET(hmR0VmxExitTprBelowThreshold(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_HLT:                     VMEXIT_CALL_RET(hmR0VmxExitHlt(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_INVD:                    VMEXIT_CALL_RET(hmR0VmxExitInvd(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_INVLPG:                  VMEXIT_CALL_RET(hmR0VmxExitInvlpg(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_RSM:                     VMEXIT_CALL_RET(hmR0VmxExitRsm(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_MTF:                     VMEXIT_CALL_RET(hmR0VmxExitMtf(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_PAUSE:                   VMEXIT_CALL_RET(hmR0VmxExitPause(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_XDTR_ACCESS:             VMEXIT_CALL_RET(hmR0VmxExitXdtrAccess(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_TR_ACCESS:               VMEXIT_CALL_RET(hmR0VmxExitXdtrAccess(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_WBINVD:                  VMEXIT_CALL_RET(hmR0VmxExitWbinvd(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_XSETBV:                  VMEXIT_CALL_RET(hmR0VmxExitXsetbv(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_RDRAND:                  VMEXIT_CALL_RET(hmR0VmxExitRdrand(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_INVPCID:                 VMEXIT_CALL_RET(hmR0VmxExitInvpcid(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_GETSEC:                  VMEXIT_CALL_RET(hmR0VmxExitGetsec(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_RDPMC:                   VMEXIT_CALL_RET(hmR0VmxExitRdpmc(pVCpu, pMixedCtx, pVmxTransient));
-        case VMX_EXIT_VMCALL:                  VMEXIT_CALL_RET(hmR0VmxExitVmcall(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_EPT_MISCONFIG:           VMEXIT_CALL_RET(0, hmR0VmxExitEptMisconfig(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_EPT_VIOLATION:           VMEXIT_CALL_RET(0, hmR0VmxExitEptViolation(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_IO_INSTR:                VMEXIT_CALL_RET(0, hmR0VmxExitIoInstr(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_CPUID:                   VMEXIT_CALL_RET(0, hmR0VmxExitCpuid(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_RDTSC:                   VMEXIT_CALL_RET(0, hmR0VmxExitRdtsc(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_RDTSCP:                  VMEXIT_CALL_RET(0, hmR0VmxExitRdtscp(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_APIC_ACCESS:             VMEXIT_CALL_RET(0, hmR0VmxExitApicAccess(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_XCPT_OR_NMI:             VMEXIT_CALL_RET(0, hmR0VmxExitXcptOrNmi(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_MOV_CRX:                 VMEXIT_CALL_RET(0, hmR0VmxExitMovCRx(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_EXT_INT:                 VMEXIT_CALL_RET(0, hmR0VmxExitExtInt(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_INT_WINDOW:              VMEXIT_CALL_RET(0, hmR0VmxExitIntWindow(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_TPR_BELOW_THRESHOLD:     VMEXIT_CALL_RET(0, hmR0VmxExitTprBelowThreshold(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_MWAIT:                   VMEXIT_CALL_RET(0, hmR0VmxExitMwait(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_MONITOR:                 VMEXIT_CALL_RET(0, hmR0VmxExitMonitor(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_TASK_SWITCH:             VMEXIT_CALL_RET(0, hmR0VmxExitTaskSwitch(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_PREEMPT_TIMER:           VMEXIT_CALL_RET(0, hmR0VmxExitPreemptTimer(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_RDMSR:                   VMEXIT_CALL_RET(0, hmR0VmxExitRdmsr(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_WRMSR:                   VMEXIT_CALL_RET(0, hmR0VmxExitWrmsr(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_VMCALL:                  VMEXIT_CALL_RET(0, hmR0VmxExitVmcall(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_MOV_DRX:                 VMEXIT_CALL_RET(0, hmR0VmxExitMovDRx(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_HLT:                     VMEXIT_CALL_RET(0, hmR0VmxExitHlt(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_INVD:                    VMEXIT_CALL_RET(0, hmR0VmxExitInvd(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_INVLPG:                  VMEXIT_CALL_RET(0, hmR0VmxExitInvlpg(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_RSM:                     VMEXIT_CALL_RET(0, hmR0VmxExitRsm(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_MTF:                     VMEXIT_CALL_RET(0, hmR0VmxExitMtf(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_PAUSE:                   VMEXIT_CALL_RET(0, hmR0VmxExitPause(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_XDTR_ACCESS:             VMEXIT_CALL_RET(0, hmR0VmxExitXdtrAccess(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_TR_ACCESS:               VMEXIT_CALL_RET(0, hmR0VmxExitXdtrAccess(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_WBINVD:                  VMEXIT_CALL_RET(0, hmR0VmxExitWbinvd(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_XSETBV:                  VMEXIT_CALL_RET(0, hmR0VmxExitXsetbv(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_RDRAND:                  VMEXIT_CALL_RET(0, hmR0VmxExitRdrand(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_INVPCID:                 VMEXIT_CALL_RET(0, hmR0VmxExitInvpcid(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_GETSEC:                  VMEXIT_CALL_RET(0, hmR0VmxExitGetsec(pVCpu, pMixedCtx, pVmxTransient));
+        case VMX_EXIT_RDPMC:                   VMEXIT_CALL_RET(0, hmR0VmxExitRdpmc(pVCpu, pMixedCtx, pVmxTransient));
 
         case VMX_EXIT_TRIPLE_FAULT:            return hmR0VmxExitTripleFault(pVCpu, pMixedCtx, pVmxTransient);
@@ -11296 +10169 @@
         case VMX_EXIT_XRSTORS:
             return hmR0VmxExitSetPendingXcptUD(pVCpu, pMixedCtx, pVmxTransient);
+
         case VMX_EXIT_ENCLS:
         case VMX_EXIT_RDSEED: /* only spurious VM-exits, so undefined */
@@ -11363 +10237 @@
     /* Advance the RIP. */
     pMixedCtx->rip += cbInstr;
-    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RIP);
+    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_RIP);
 
     /* Update interrupt inhibition. */
@@ -11387 +10261 @@
 {
     int rc = hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
-    rc    |= hmR0VmxSaveGuestRip(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
+    rc    |= hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_RIP
+                                            | CPUMCTX_EXTRN_RFLAGS);
     AssertRCReturn(rc, rc);
 
@@ -11401 +10275 @@
     if (  !pVCpu->hm.s.fSingleInstruction
         && pMixedCtx->eflags.Bits.u1TF)
-        hmR0VmxSetPendingDebugXcptVmcs(pVCpu);
+    {
+        rc = hmR0VmxSetPendingDebugXcptVmcs(pVCpu, pMixedCtx);
+        AssertRCReturn(rc, rc);
+    }
 
     return VINF_SUCCESS;
@@ -11440 +10317 @@
          * CR0.
          */
-        uint32_t uSetCR0 = (uint32_t)(pVM->hm.s.vmx.Msrs.u64Cr0Fixed0 & pVM->hm.s.vmx.Msrs.u64Cr0Fixed1);
-        uint32_t uZapCR0 = (uint32_t)(pVM->hm.s.vmx.Msrs.u64Cr0Fixed0 | pVM->hm.s.vmx.Msrs.u64Cr0Fixed1);
+        uint32_t fSetCR0 = (uint32_t)(pVM->hm.s.vmx.Msrs.u64Cr0Fixed0 & pVM->hm.s.vmx.Msrs.u64Cr0Fixed1);
+        uint32_t fZapCR0 = (uint32_t)(pVM->hm.s.vmx.Msrs.u64Cr0Fixed0 | pVM->hm.s.vmx.Msrs.u64Cr0Fixed1);
         /* Exceptions for unrestricted-guests for fixed CR0 bits (PE, PG).
            See Intel spec. 26.3.1 "Checks on Guest Control Registers, Debug Registers and MSRs." */
         if (fUnrestrictedGuest)
-            uSetCR0 &= ~(X86_CR0_PE | X86_CR0_PG);
-
-        uint32_t u32GuestCR0;
-        rc = VMXReadVmcs32(VMX_VMCS_GUEST_CR0, &u32GuestCR0);
+            fSetCR0 &= ~(X86_CR0_PE | X86_CR0_PG);
+
+        uint32_t uGuestCR0;
+        rc = VMXReadVmcs32(VMX_VMCS_GUEST_CR0, &uGuestCR0);
         AssertRCBreak(rc);
-        HMVMX_CHECK_BREAK((u32GuestCR0 & uSetCR0) == uSetCR0, VMX_IGS_CR0_FIXED1);
-        HMVMX_CHECK_BREAK(!(u32GuestCR0 & ~uZapCR0), VMX_IGS_CR0_FIXED0);
+        HMVMX_CHECK_BREAK((uGuestCR0 & fSetCR0) == fSetCR0, VMX_IGS_CR0_FIXED1);
+        HMVMX_CHECK_BREAK(!(uGuestCR0 & ~fZapCR0), VMX_IGS_CR0_FIXED0);
         if (   !fUnrestrictedGuest
-            && (u32GuestCR0 & X86_CR0_PG)
-            && !(u32GuestCR0 & X86_CR0_PE))
+            &&  (uGuestCR0 & X86_CR0_PG)
+            && !(uGuestCR0 & X86_CR0_PE))
         {
             HMVMX_ERROR_BREAK(VMX_IGS_CR0_PG_PE_COMBO);
@@ -11462 +10339 @@
          * CR4.
          */
-        uint64_t uSetCR4 = (pVM->hm.s.vmx.Msrs.u64Cr4Fixed0 & pVM->hm.s.vmx.Msrs.u64Cr4Fixed1);
-        uint64_t uZapCR4 = (pVM->hm.s.vmx.Msrs.u64Cr4Fixed0 | pVM->hm.s.vmx.Msrs.u64Cr4Fixed1);
-
-        uint32_t u32GuestCR4;
-        rc = VMXReadVmcs32(VMX_VMCS_GUEST_CR4, &u32GuestCR4);
+        uint64_t fSetCR4 = (pVM->hm.s.vmx.Msrs.u64Cr4Fixed0 & pVM->hm.s.vmx.Msrs.u64Cr4Fixed1);
+        uint64_t fZapCR4 = (pVM->hm.s.vmx.Msrs.u64Cr4Fixed0 | pVM->hm.s.vmx.Msrs.u64Cr4Fixed1);
+
+        uint32_t uGuestCR4;
+        rc = VMXReadVmcs32(VMX_VMCS_GUEST_CR4, &uGuestCR4);
         AssertRCBreak(rc);
-        HMVMX_CHECK_BREAK((u32GuestCR4 & uSetCR4) == uSetCR4, VMX_IGS_CR4_FIXED1);
-        HMVMX_CHECK_BREAK(!(u32GuestCR4 & ~uZapCR4), VMX_IGS_CR4_FIXED0);
+        HMVMX_CHECK_BREAK((uGuestCR4 & fSetCR4) == fSetCR4, VMX_IGS_CR4_FIXED1);
+        HMVMX_CHECK_BREAK(!(uGuestCR4 & ~fZapCR4), VMX_IGS_CR4_FIXED0);
 
         /*
@@ -11525 +10402 @@
         if (   fLongModeGuest
             || (   fUnrestrictedGuest
-                && !(u32GuestCR0 & X86_CR0_PE)))
+                && !(uGuestCR0 & X86_CR0_PE)))
         {
             HMVMX_CHECK_BREAK(!(u32Eflags & X86_EFL_VM), VMX_IGS_RFLAGS_VM_INVALID);
@@ -11545 +10422 @@
         if (fLongModeGuest)
         {
-            HMVMX_CHECK_BREAK(u32GuestCR0 & X86_CR0_PG, VMX_IGS_CR0_PG_LONGMODE);
-            HMVMX_CHECK_BREAK(u32GuestCR4 & X86_CR4_PAE, VMX_IGS_CR4_PAE_LONGMODE);
+            HMVMX_CHECK_BREAK(uGuestCR0 & X86_CR0_PG, VMX_IGS_CR0_PG_LONGMODE);
+            HMVMX_CHECK_BREAK(uGuestCR4 & X86_CR4_PAE, VMX_IGS_CR4_PAE_LONGMODE);
         }
 
         if (   !fLongModeGuest
-            && (u32GuestCR4 & X86_CR4_PCIDE))
+            && (uGuestCR4 & X86_CR4_PCIDE))
         {
             HMVMX_ERROR_BREAK(VMX_IGS_CR4_PCIDE);
@@ -11622 +10499 @@
                               VMX_IGS_EFER_LMA_GUEST_MODE_MISMATCH);
             HMVMX_CHECK_BREAK(   fUnrestrictedGuest
-                              || !(u32GuestCR0 & X86_CR0_PG)
+                              || !(uGuestCR0 & X86_CR0_PG)
                               || RT_BOOL(u64Val & MSR_K6_EFER_LMA) == RT_BOOL(u64Val & MSR_K6_EFER_LME),
                               VMX_IGS_EFER_LMA_LME_MISMATCH);
@@ -12048 +10925 @@
     {
         /*
-         * This cannot be a guest NMI as the only way for the guest to receive an NMI is if we injected it ourselves and
-         * anything we inject is not going to cause a VM-exit directly for the event being injected.
-         * See Intel spec. 27.2.3 "Information for VM Exits During Event Delivery".
+         * This cannot be a guest NMI as the only way for the guest to receive an NMI is if we
+         * injected it ourselves and anything we inject is not going to cause a VM-exit directly
+         * for the event being injected[1]. Go ahead and dispatch the NMI to the host[2].
          *
-         * Dispatch the NMI to the host. See Intel spec. 27.5.5 "Updating Non-Register State".
+         * [1] -- See Intel spec. 27.2.3 "Information for VM Exits During Event Delivery".
+         * [2] -- See Intel spec. 27.5.5 "Updating Non-Register State".
          */
         VMXDispatchHostNmi();
@@ -12123 +11001 @@
                 default:
                 {
-                    rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-                    AssertRCReturn(rc, rc);
-
                     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestXcpUnk);
                     if (pVCpu->hm.s.vmx.RealMode.fRealOnV86Active)
@@ -12133 +11008 @@
                         Assert(CPUMIsGuestInRealModeEx(pMixedCtx));
 
-                        rc  = hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
+                        rc  = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_CR0);
+                        rc |= hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
                         rc |= hmR0VmxReadExitIntErrorCodeVmcs(pVmxTransient);
                         AssertRCReturn(rc, rc);
@@ -12139 +11015 @@
                                                pVmxTransient->cbInstr, pVmxTransient->uExitIntErrorCode,
                                                0 /* GCPtrFaultAddress */);
-                        AssertRCReturn(rc, rc);
                     }
                     else
@@ -12200 +11075 @@
      * It is therefore safe to unblock STI and deliver the NMI ourselves. See @bugref{7445}.
      */
-    uint32_t uIntrState = 0;
-    int rc = VMXReadVmcs32(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &uIntrState);
+    uint32_t fIntrState = 0;
+    int rc = VMXReadVmcs32(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &fIntrState);
     AssertRCReturn(rc, rc);
 
-    bool const fBlockSti = RT_BOOL(uIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
+    bool const fBlockSti = RT_BOOL(fIntrState & VMX_VMCS_GUEST_INTERRUPTIBILITY_STATE_BLOCK_STI);
     if (   fBlockSti
         && VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS))
@@ -12225 +11100 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitWbinvd);
     return hmR0VmxAdvanceGuestRip(pVCpu, pMixedCtx, pVmxTransient);
 }
@@ -12236 +11110 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvd);
     return hmR0VmxAdvanceGuestRip(pVCpu, pMixedCtx, pVmxTransient);
 }
@@ -12247 +11120 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCpuid);
     Assert(pMixedCtx == &pVCpu->cpum.GstCtx);
 
@@ -12254 +11126 @@
      */
     int rc = hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
-    rc    |= hmR0VmxSaveGuestRip(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestCs(pVCpu);
+    rc    |= hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_RIP
+                                            | CPUMCTX_EXTRN_CS);
     AssertRCReturn(rc, rc);
 
@@ -12280 +11151 @@
             rcStrict = VERR_EM_INTERPRETER;
         }
-        STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCpuid);
     }
     else
@@ -12288 +11158 @@
          */
         Assert(pMixedCtx == &pVCpu->cpum.GstCtx);
-        int rc2 = hmR0VmxSaveGuestRegsForIemInterpreting(pVCpu);
+        int rc2 = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
         AssertRCReturn(rc2, rc2);
 
@@ -12295 +11165 @@
 
         rcStrict = EMHistoryExec(pVCpu, pExitRec, 0);
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
 
         Log4(("CpuIdExit/%u: %04x:%08RX64: EMHistoryExec -> %Rrc + %04x:%08RX64\n",
@@ -12311 +11181 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    int rc  = hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);
+    int rc  = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_CR4);
     AssertRCReturn(rc, rc);
 
@@ -12328 +11198 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    int rc = hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);      /* Needed for CPL < 0 only, really. */
-    rc    |= hmR0VmxSaveGuestRegsForIemExec(pVCpu, pMixedCtx, false /*fMemory*/, false /*fNeedRsp*/);
+    int rc = hmR0VmxImportGuestState(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
     rc    |= hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
     AssertRCReturn(rc, rc);
+
     VBOXSTRICTRC rcStrict = IEMExecDecodedRdtsc(pVCpu, pVmxTransient->cbInstr);
     if (RT_LIKELY(rcStrict == VINF_SUCCESS))
     {
-        /* If we get a spurious VM-exit when offsetting is enabled, we must reset offsetting on VM-reentry. See @bugref{6634}. */
+        /* If we get a spurious VM-exit when offsetting is enabled,
+           we must reset offsetting on VM-reentry. See @bugref{6634}. */
         if (pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_TSC_OFFSETTING)
             pVmxTransient->fUpdateTscOffsettingAndPreemptTimer = true;
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_RIP
+                                                   | HM_CHANGED_GUEST_RFLAGS);
     }
     else if (rcStrict == VINF_IEM_RAISED_XCPT)
+    {
         rcStrict = VINF_SUCCESS;
-    HMCPU_CF_SET(pVCpu, rcStrict != VINF_IEM_RAISED_XCPT ? HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS : HM_CHANGED_ALL_GUEST);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtsc);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_XCPT_RAISED_MASK);
+    }
     return rcStrict;
 }
@@ -12353 +11227 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    int rc = hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);      /* Needed for CPL < 0 only, really. */
-    rc    |= hmR0VmxSaveGuestRegsForIemExec(pVCpu, pMixedCtx, false /*fMemory*/, false /*fNeedRsp*/);
-    rc    |= hmR0VmxSaveGuestAutoLoadStoreMsrs(pVCpu, pMixedCtx);  /* For MSR_K8_TSC_AUX */
+    int rc = hmR0VmxImportGuestState(pVCpu,   IEM_CPUMCTX_EXTRN_MUST_MASK
+                                            | CPUMCTX_EXTRN_TSC_AUX);
     rc    |= hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
     AssertRCReturn(rc, rc);
+
     VBOXSTRICTRC rcStrict = IEMExecDecodedRdtscp(pVCpu, pVmxTransient->cbInstr);
     if (RT_LIKELY(rcStrict == VINF_SUCCESS))
     {
-        /* If we get a spurious VM-exit when offsetting is enabled, we must reset offsetting on VM-reentry. See @bugref{6634}. */
+        /* If we get a spurious VM-exit when offsetting is enabled,
+           we must reset offsetting on VM-reentry. See @bugref{6634}. */
         if (pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_TSC_OFFSETTING)
             pVmxTransient->fUpdateTscOffsettingAndPreemptTimer = true;
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_RIP
+                                                   | HM_CHANGED_GUEST_RFLAGS);
     }
     else if (rcStrict == VINF_IEM_RAISED_XCPT)
+    {
         rcStrict = VINF_SUCCESS;
-    HMCPU_CF_SET(pVCpu, rcStrict != VINF_IEM_RAISED_XCPT ? HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS : HM_CHANGED_ALL_GUEST);
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdtscp);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_XCPT_RAISED_MASK);
+    }
     return rcStrict;
 }
@@ -12379 +11257 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    int rc = hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
+    int rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_CR4
+                                            | CPUMCTX_EXTRN_CR0
+                                            | CPUMCTX_EXTRN_RFLAGS
+                                            | CPUMCTX_EXTRN_SS);
     AssertRCReturn(rc, rc);
 
@@ -12395 +11275 @@
         rc = VERR_EM_INTERPRETER;
     }
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdpmc);
     return rc;
 }
@@ -12406 +11285 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitVmcall);
 
     VBOXSTRICTRC rcStrict = VERR_VMX_IPE_3;
     if (EMAreHypercallInstructionsEnabled(pVCpu))
     {
-#if 0
-        int rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
-#else
-        /* Aggressive state sync. for now. */
-        int rc  = hmR0VmxSaveGuestRip(pVCpu, pMixedCtx);
-        rc     |= hmR0VmxSaveGuestRflags(pVCpu,pMixedCtx);          /* For CPL checks in gimHvHypercall() & gimKvmHypercall() */
-        rc     |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);    /* For long-mode checks in gimKvmHypercall(). */
+        int rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_RIP
+                                                | CPUMCTX_EXTRN_RFLAGS
+                                                | CPUMCTX_EXTRN_CR0
+                                                | CPUMCTX_EXTRN_SS
+                                                | CPUMCTX_EXTRN_CS
+                                                | CPUMCTX_EXTRN_EFER);
         AssertRCReturn(rc, rc);
-#endif
 
         /* Perform the hypercall. */
@@ -12437 +11313 @@
     }
     else
-        Log4(("hmR0VmxExitVmcall: Hypercalls not enabled\n"));
+        Log4Func(("Hypercalls not enabled\n"));
 
     /* If hypercalls are disabled or the hypercall failed for some reason, raise #UD and continue. */
@@ -12460 +11336 @@
 
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
-    rc    |= hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
+    rc    |= hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_SREG_MASK);
     AssertRCReturn(rc, rc);
 
@@ -12469 +11345 @@
         AssertMsg(rcStrict == VERR_EM_INTERPRETER, ("hmR0VmxExitInvlpg: EMInterpretInvlpg %#RX64 failed with %Rrc\n",
                                                     pVmxTransient->uExitQualification, VBOXSTRICTRC_VAL(rcStrict)));
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitInvlpg);
     return rcStrict;
 }
@@ -12480 +11355 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    int rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
+    int rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_CR0
+                                            | CPUMCTX_EXTRN_RFLAGS
+                                            | CPUMCTX_EXTRN_SS);
     AssertRCReturn(rc, rc);
 
@@ -12505 +11380 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-    int rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
+    int rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_CR0
+                                            | CPUMCTX_EXTRN_RFLAGS
+                                            | CPUMCTX_EXTRN_SS);
     AssertRCReturn(rc, rc);
 
@@ -12521 +11396 @@
         if (   rc == VINF_EM_HALT
             && EMMonitorWaitShouldContinue(pVCpu, pMixedCtx))
-        {
             rc = VINF_SUCCESS;
-        }
     }
     else
@@ -12543 +11416 @@
 {
     /*
-     * Execution of RSM outside of SMM mode causes #UD regardless of VMX root or VMX non-root mode. In theory, we should never
-     * get this VM-exit. This can happen only if dual-monitor treatment of SMI and VMX is enabled, which can (only?) be done by
-     * executing VMCALL in VMX root operation. If we get here, something funny is going on.
-     * See Intel spec. "33.15.5 Enabling the Dual-Monitor Treatment".
+     * Execution of RSM outside of SMM mode causes #UD regardless of VMX root or VMX non-root
+     * mode. In theory, we should never get this VM-exit. This can happen only if dual-monitor
+     * treatment of SMI and VMX is enabled, which can (only?) be done by executing VMCALL in
+     * VMX root operation. If we get here, something funny is going on.
+     *
+     * See Intel spec. 33.15.5 "Enabling the Dual-Monitor Treatment".
      */
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
@@ -12560 +11435 @@
 {
     /*
-     * This can only happen if we support dual-monitor treatment of SMI, which can be activated by executing VMCALL in VMX
-     * root operation. Only an STM (SMM transfer monitor) would get this VM-exit when we (the executive monitor) execute a VMCALL
-     * in VMX root mode or receive an SMI. If we get here, something funny is going on.
-     * See Intel spec. "33.15.6 Activating the Dual-Monitor Treatment" and Intel spec. 25.3 "Other Causes of VM-Exits"
+     * This can only happen if we support dual-monitor treatment of SMI, which can be activated
+     * by executing VMCALL in VMX root operation. Only an STM (SMM transfer monitor) would get
+     * this VM-exit when we (the executive monitor) execute a VMCALL in VMX root mode or receive
+     * an SMI. If we get here, something funny is going on.
+     *
+     * See Intel spec. 33.15.6 "Activating the Dual-Monitor Treatment"
+     * See Intel spec. 25.3 "Other Causes of VM-Exits"
      */
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
@@ -12589 +11467 @@
 {
     /*
-     * SIPI exits can only occur in VMX non-root operation when the "wait-for-SIPI" guest activity state is used. We currently
-     * don't make use of it (see hmR0VmxLoadGuestActivityState()) as our guests don't have direct access to the host LAPIC.
+     * SIPI exits can only occur in VMX non-root operation when the "wait-for-SIPI" guest activity state is used.
+     * We don't make use of it as our guests don't have direct access to the host LAPIC.
      * See Intel spec. 25.3 "Other Causes of VM-exits".
      */
@@ -12689 +11567 @@
 
     int rc = hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
-    rc    |= hmR0VmxSaveGuestRegsForIemExec(pVCpu, pMixedCtx, false /*fMemory*/, false /*fNeedRsp*/);
-    rc    |= hmR0VmxSaveGuestCR4(pVCpu, pMixedCtx);
+    rc    |= hmR0VmxImportGuestState(pVCpu,   IEM_CPUMCTX_EXTRN_MUST_MASK
+                                            | CPUMCTX_EXTRN_CR4);
     AssertRCReturn(rc, rc);
 
     VBOXSTRICTRC rcStrict = IEMExecDecodedXsetbv(pVCpu, pVmxTransient->cbInstr);
-    HMCPU_CF_SET(pVCpu, rcStrict != VINF_IEM_RAISED_XCPT ? HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS : HM_CHANGED_ALL_GUEST);
+    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, rcStrict != VINF_IEM_RAISED_XCPT ? HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS
+                                                                                : HM_CHANGED_XCPT_RAISED_MASK);
 
     pVCpu->hm.s.fLoadSaveGuestXcr0 = (pMixedCtx->cr4 & X86_CR4_OSXSAVE) && pMixedCtx->aXcr[0] != ASMGetXcr0();
@@ -12719 +11598 @@
 HMVMX_EXIT_NSRC_DECL hmR0VmxExitErrInvalidGuestState(PVMCPU pVCpu, PCPUMCTX pMixedCtx, PVMXTRANSIENT pVmxTransient)
 {
-    int rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
-    AssertRCReturn(rc, rc);
-
-    rc = hmR0VmxCheckVmcsCtls(pVCpu);
+    int rc = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
+    rc    |= hmR0VmxCheckVmcsCtls(pVCpu);
     AssertRCReturn(rc, rc);
 
@@ -12729 +11606 @@
 
 #ifdef VBOX_STRICT
-    uint32_t       uIntrState;
+    uint32_t       fIntrState;
     RTHCUINTREG    uHCReg;
     uint64_t       u64Val;
@@ -12737 +11614 @@
     rc |= hmR0VmxReadEntryXcptErrorCodeVmcs(pVmxTransient);
     rc |= hmR0VmxReadEntryInstrLenVmcs(pVmxTransient);
-    rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &uIntrState);
+    rc |= VMXReadVmcs32(VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE, &fIntrState);
     AssertRCReturn(rc, rc);
 
@@ -12744 +11621 @@
     Log4(("VMX_VMCS32_CTRL_ENTRY_EXCEPTION_ERRCODE    %#RX32\n", pVmxTransient->uEntryXcptErrorCode));
     Log4(("VMX_VMCS32_CTRL_ENTRY_INSTR_LENGTH         %#RX32\n", pVmxTransient->cbEntryInstr));
-    Log4(("VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE    %#RX32\n", uIntrState));
+    Log4(("VMX_VMCS32_GUEST_INTERRUPTIBILITY_STATE    %#RX32\n", fIntrState));
 
     rc = VMXReadVmcs32(VMX_VMCS_GUEST_CR0, &u32Val);                        AssertRC(rc);
@@ -12829 +11706 @@
 
     /* By default, we don't enable VMX_VMCS_CTRL_PROC_EXEC2_RDRAND_EXIT. */
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitRdrand);
     if (pVCpu->hm.s.vmx.u32ProcCtls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDRAND_EXIT)
         return VERR_EM_INTERPRETER;
@@ -12845 +11721 @@
 
     /* EMInterpretRdmsr() requires CR0, Eflags and SS segment register. */
-    int rc  = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-    rc     |= hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-    rc     |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
+    int rc = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_CR0
+                                            | CPUMCTX_EXTRN_RFLAGS
+                                            | CPUMCTX_EXTRN_SS);
     if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS))
-    {
-        rc |= hmR0VmxSaveGuestLazyMsrs(pVCpu, pMixedCtx);
-        rc |= hmR0VmxSaveGuestAutoLoadStoreMsrs(pVCpu, pMixedCtx);
-    }
+        rc |= hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
     AssertRCReturn(rc, rc);
-    Log4(("ecx=%#RX32\n", pMixedCtx->ecx));
+    Log4Func(("ecx=%#RX32\n", pMixedCtx->ecx));
 
 #ifdef VBOX_STRICT
@@ -12905 +11778 @@
 
     /* EMInterpretWrmsr() requires CR0, EFLAGS and SS segment register. */
-    rc  = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
-    rc |= hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-    rc |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
+    rc  = hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_CR0
+                                         | CPUMCTX_EXTRN_RFLAGS
+                                         | CPUMCTX_EXTRN_SS);
     if (!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_MSR_BITMAPS))
-    {
-        rc |= hmR0VmxSaveGuestLazyMsrs(pVCpu, pMixedCtx);
-        rc |= hmR0VmxSaveGuestAutoLoadStoreMsrs(pVCpu, pMixedCtx);
-    }
+        rc |= hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_ALL_MSRS);
     AssertRCReturn(rc, rc);
-    Log4(("ecx=%#RX32 edx:eax=%#RX32:%#RX32\n", pMixedCtx->ecx, pMixedCtx->edx, pMixedCtx->eax));
+    Log4Func(("ecx=%#RX32 edx:eax=%#RX32:%#RX32\n", pMixedCtx->ecx, pMixedCtx->edx, pMixedCtx->eax));
 
     rc = EMInterpretWrmsr(pVM, pVCpu, CPUMCTX2CORE(pMixedCtx));
@@ -12934 +11804 @@
              * EMInterpretWrmsr() changes it.
              */
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
         }
         else if (pMixedCtx->ecx == MSR_IA32_TSC)        /* Windows 7 does this during bootup. See @bugref{6398}. */
@@ -12945 +11815 @@
              * the other bits as well, SCE and NXE. See @bugref{7368}.
              */
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_EFER_MSR | HM_CHANGED_VMX_ENTRY_CTLS | HM_CHANGED_VMX_EXIT_CTLS);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_EFER_MSR
+                                                       | HM_CHANGED_VMX_ENTRY_CTLS
+                                                       | HM_CHANGED_VMX_EXIT_CTLS);
         }
 
@@ -12953 +11825 @@
             switch (pMixedCtx->ecx)
             {
-                /*
-                 * For SYSENTER CS, EIP, ESP MSRs, we set both the flags here so we don't accidentally
-                 * overwrite the changed guest-CPU context value while going to ring-3, see @bufref{8745}.
-                 */
-                case MSR_IA32_SYSENTER_CS:
-                    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_SYSENTER_CS_MSR);
-                    HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SYSENTER_CS_MSR);
-                    break;
-                case MSR_IA32_SYSENTER_EIP:
-                    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_SYSENTER_EIP_MSR);
-                    HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SYSENTER_EIP_MSR);
-                    break;
-                case MSR_IA32_SYSENTER_ESP:
-                    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_SYSENTER_ESP_MSR);
-                    HMVMXCPU_GST_SET_UPDATED(pVCpu, HMVMX_UPDATED_GUEST_SYSENTER_ESP_MSR);
-                    break;
-                case MSR_K8_FS_BASE:        RT_FALL_THRU();
-                case MSR_K8_GS_BASE:        HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_SEGMENT_REGS);     break;
-                case MSR_K6_EFER:           /* already handled above */                             break;
+                case MSR_IA32_SYSENTER_CS:  ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_SYSENTER_CS_MSR);   break;
+                case MSR_IA32_SYSENTER_EIP: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_SYSENTER_EIP_MSR);  break;
+                case MSR_IA32_SYSENTER_ESP: ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_SYSENTER_ESP_MSR);  break;
+                case MSR_K8_FS_BASE:        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_FS);                break;
+                case MSR_K8_GS_BASE:        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_GS);                break;
+                case MSR_K6_EFER:           /* Nothing to do, already handled above. */ break;
                 default:
                 {
                     if (hmR0VmxIsAutoLoadStoreGuestMsr(pVCpu, pMixedCtx->ecx))
-                        HMCPU_CF_SET(pVCpu, HM_CHANGED_VMX_GUEST_AUTO_MSRS);
+                        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_VMX_GUEST_AUTO_MSRS);
                     else if (hmR0VmxIsLazyGuestMsr(pVCpu, pMixedCtx->ecx))
-                        HMCPU_CF_SET(pVCpu, HM_CHANGED_VMM_GUEST_LAZY_MSRS);
+                        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_VMX_GUEST_LAZY_MSRS);
                     break;
                 }
@@ -13003 +11862 @@
                     if (hmR0VmxIsAutoLoadStoreGuestMsr(pVCpu, pMixedCtx->ecx))
                     {
-                        /* EFER writes are always intercepted, see hmR0VmxLoadGuestMsrs(). */
+                        /* EFER writes are always intercepted, see hmR0VmxExportGuestMsrs(). */
                         if (pMixedCtx->ecx != MSR_K6_EFER)
                         {
@@ -13040 +11899 @@
 {
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
-
-    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPause);
+    /** @todo The guest has likely hit a contended spinlock. We might want to
+     *        poke a schedule different guest VCPU. */
     return VINF_EM_RAW_INTERRUPT;
 }
@@ -13078 +11937 @@
     HMVMX_VALIDATE_EXIT_HANDLER_PARAMS();
     STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitMovCRx, y2);
+
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
     rc    |= hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
+    rc    |= hmR0VmxImportGuestState(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
     AssertRCReturn(rc, rc);
 
+    VBOXSTRICTRC rcStrict;
+    PVM pVM                              = pVCpu->CTX_SUFF(pVM);
     RTGCUINTPTR const uExitQualification = pVmxTransient->uExitQualification;
-    uint32_t const uAccessType           = VMX_EXIT_QUALIFICATION_CRX_ACCESS(uExitQualification);
-    PVM pVM                              = pVCpu->CTX_SUFF(pVM);
-    VBOXSTRICTRC rcStrict;
-    rc = hmR0VmxSaveGuestRegsForIemExec(pVCpu, pMixedCtx, false /*fMemory*/, true /*fNeedRsp*/);
+    uint32_t const uAccessType           = VMX_EXIT_QUAL_CRX_ACCESS(uExitQualification);
     switch (uAccessType)
     {
-        case VMX_EXIT_QUALIFICATION_CRX_ACCESS_WRITE:       /* MOV to CRx */
-        {
-            rc |= hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
-            AssertRCReturn(rc, rc);
-
+        case VMX_EXIT_QUAL_CRX_ACCESS_WRITE:       /* MOV to CRx */
+        {
             rcStrict = IEMExecDecodedMovCRxWrite(pVCpu, pVmxTransient->cbInstr,
-                                                 VMX_EXIT_QUALIFICATION_CRX_REGISTER(uExitQualification),
-                                                 VMX_EXIT_QUALIFICATION_CRX_GENREG(uExitQualification));
-            AssertMsg(   rcStrict == VINF_SUCCESS || rcStrict == VINF_IEM_RAISED_XCPT || rcStrict == VINF_PGM_CHANGE_MODE
+                                                 VMX_EXIT_QUAL_CRX_REGISTER(uExitQualification),
+                                                 VMX_EXIT_QUAL_CRX_GENREG(uExitQualification));
+            AssertMsg(   rcStrict == VINF_SUCCESS
+                      || rcStrict == VINF_IEM_RAISED_XCPT
+                      || rcStrict == VINF_PGM_CHANGE_MODE
                       || rcStrict == VINF_PGM_SYNC_CR3, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
-            switch (VMX_EXIT_QUALIFICATION_CRX_REGISTER(uExitQualification))
+
+            switch (VMX_EXIT_QUAL_CRX_REGISTER(uExitQualification))
             {
-                case 0: /* CR0 */
-                    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR0);
+                case 0:
+                {
+                    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR0);
+                    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR0Write);
                     Log4(("CRX CR0 write rcStrict=%Rrc CR0=%#RX64\n", VBOXSTRICTRC_VAL(rcStrict), pMixedCtx->cr0));
                     break;
-                case 2: /* CR2 */
+                }
+
+                case 2:
+                {
+                    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR2Write);
                     /* Nothing to do here, CR2 it's not part of the VMCS. */
                     break;
-                case 3: /* CR3 */
+                }
+
+                case 3:
+                {
                     Assert(!pVM->hm.s.fNestedPaging || !CPUMIsGuestPagingEnabledEx(pMixedCtx) || pVCpu->hm.s.fUsingDebugLoop);
-                    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR3);
+                    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR3Write);
+                    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR3);
                     Log4(("CRX CR3 write rcStrict=%Rrc CR3=%#RX64\n", VBOXSTRICTRC_VAL(rcStrict), pMixedCtx->cr3));
                     break;
-                case 4: /* CR4 */
-                    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR4);
-                    Log4(("CRX CR4 write rc=%Rrc CR4=%#RX64 fLoadSaveGuestXcr0=%u\n",
-                          VBOXSTRICTRC_VAL(rcStrict), pMixedCtx->cr4, pVCpu->hm.s.fLoadSaveGuestXcr0));
+                }
+
+                case 4:
+                {
+                    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR4Write);
+                    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR4);
+                    Log4(("CRX CR4 write rc=%Rrc CR4=%#RX64 fLoadSaveGuestXcr0=%u\n", VBOXSTRICTRC_VAL(rcStrict),
+                          pMixedCtx->cr4, pVCpu->hm.s.fLoadSaveGuestXcr0));
                     break;
-                case 8: /* CR8 */
+                }
+
+                case 8:
+                {
+                    STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR8Write);
                     Assert(!(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW));
-                    /* CR8 contains the APIC TPR. Was updated by IEMExecDecodedMovCRxWrite(). */
-                    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_APIC_STATE);
+                    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_APIC_TPR);
                     break;
+                }
                 default:
-                    AssertMsgFailed(("Invalid CRx register %#x\n", VMX_EXIT_QUALIFICATION_CRX_REGISTER(uExitQualification)));
+                    AssertMsgFailed(("Invalid CRx register %#x\n", VMX_EXIT_QUAL_CRX_REGISTER(uExitQualification)));
                     break;
             }
-
-            STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxWrite[VMX_EXIT_QUALIFICATION_CRX_REGISTER(uExitQualification)]);
             break;
         }
 
-        case VMX_EXIT_QUALIFICATION_CRX_ACCESS_READ:        /* MOV from CRx */
-        {
-            rc |= hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
-            AssertRCReturn(rc, rc);
-
+        case VMX_EXIT_QUAL_CRX_ACCESS_READ:        /* MOV from CRx */
+        {
             Assert(   !pVM->hm.s.fNestedPaging
                    || !CPUMIsGuestPagingEnabledEx(pMixedCtx)
                    || pVCpu->hm.s.fUsingDebugLoop
-                   || VMX_EXIT_QUALIFICATION_CRX_REGISTER(uExitQualification) != 3);
-
+                   || VMX_EXIT_QUAL_CRX_REGISTER(uExitQualification) != 3);
             /* CR8 reads only cause a VM-exit when the TPR shadow feature isn't enabled. */
-            Assert(   VMX_EXIT_QUALIFICATION_CRX_REGISTER(uExitQualification) != 8
+            Assert(   VMX_EXIT_QUAL_CRX_REGISTER(uExitQualification) != 8
                    || !(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW));
 
             rcStrict = IEMExecDecodedMovCRxRead(pVCpu, pVmxTransient->cbInstr,
-                                                VMX_EXIT_QUALIFICATION_CRX_GENREG(uExitQualification),
-                                                VMX_EXIT_QUALIFICATION_CRX_REGISTER(uExitQualification));
-            AssertMsg(rcStrict == VINF_SUCCESS || rcStrict == VINF_IEM_RAISED_XCPT, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
-            STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCRxRead[VMX_EXIT_QUALIFICATION_CRX_REGISTER(uExitQualification)]);
-            Log4(("CRX CR%d Read access rcStrict=%Rrc\n", VMX_EXIT_QUALIFICATION_CRX_REGISTER(uExitQualification),
+                                                VMX_EXIT_QUAL_CRX_GENREG(uExitQualification),
+                                                VMX_EXIT_QUAL_CRX_REGISTER(uExitQualification));
+            AssertMsg(   rcStrict == VINF_SUCCESS
+                      || rcStrict == VINF_IEM_RAISED_XCPT, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
+#ifdef VBOX_WITH_STATISTICS
+            switch (VMX_EXIT_QUAL_CRX_REGISTER(uExitQualification))
+            {
+                case 0: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR0Read); break;
+                case 2: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR2Read); break;
+                case 3: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR3Read); break;
+                case 4: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR4Read); break;
+                case 8: STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCR8Read); break;
+            }
+#endif
+            Log4(("CRX CR%d Read access rcStrict=%Rrc\n", VMX_EXIT_QUAL_CRX_REGISTER(uExitQualification),
                   VBOXSTRICTRC_VAL(rcStrict)));
-            if (VMX_EXIT_QUALIFICATION_CRX_GENREG(uExitQualification) == X86_GREG_xSP)
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RSP);
+            if (VMX_EXIT_QUAL_CRX_GENREG(uExitQualification) == X86_GREG_xSP)
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_RSP);
             break;
         }
 
-        case VMX_EXIT_QUALIFICATION_CRX_ACCESS_CLTS:        /* CLTS (Clear Task-Switch Flag in CR0) */
-        {
-            AssertRCReturn(rc, rc);
+        case VMX_EXIT_QUAL_CRX_ACCESS_CLTS:        /* CLTS (Clear Task-Switch Flag in CR0) */
+        {
             rcStrict = IEMExecDecodedClts(pVCpu, pVmxTransient->cbInstr);
-            AssertMsg(rcStrict == VINF_SUCCESS || rcStrict == VINF_IEM_RAISED_XCPT, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR0);
+            AssertMsg(   rcStrict == VINF_SUCCESS
+                      || rcStrict == VINF_IEM_RAISED_XCPT, ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
+
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR0);
             STAM_COUNTER_INC(&pVCpu->hm.s.StatExitClts);
             Log4(("CRX CLTS rcStrict=%d\n", VBOXSTRICTRC_VAL(rcStrict)));
@@ -13169 +12052 @@
         }
 
-        case VMX_EXIT_QUALIFICATION_CRX_ACCESS_LMSW:        /* LMSW (Load Machine-Status Word into CR0) */
-        {
-            AssertRCReturn(rc, rc);
+        case VMX_EXIT_QUAL_CRX_ACCESS_LMSW:        /* LMSW (Load Machine-Status Word into CR0) */
+        {
             rcStrict = IEMExecDecodedLmsw(pVCpu, pVmxTransient->cbInstr,
-                                          VMX_EXIT_QUALIFICATION_CRX_LMSW_DATA(uExitQualification));
-            AssertMsg(rcStrict == VINF_SUCCESS || rcStrict == VINF_IEM_RAISED_XCPT || rcStrict == VINF_PGM_CHANGE_MODE,
+                                          VMX_EXIT_QUAL_CRX_LMSW_DATA(uExitQualification));
+            AssertMsg(   rcStrict == VINF_SUCCESS
+                      || rcStrict == VINF_IEM_RAISED_XCPT
+                      || rcStrict == VINF_PGM_CHANGE_MODE,
                       ("%Rrc\n", VBOXSTRICTRC_VAL(rcStrict)));
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_CR0);
+
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_CR0);
             STAM_COUNTER_INC(&pVCpu->hm.s.StatExitLmsw);
             Log4(("CRX LMSW rcStrict=%d\n", VBOXSTRICTRC_VAL(rcStrict)));
@@ -13187 +12072 @@
     }
 
-    HMCPU_CF_SET(pVCpu, rcStrict != VINF_IEM_RAISED_XCPT ? HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS : HM_CHANGED_ALL_GUEST);
+    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, rcStrict != VINF_IEM_RAISED_XCPT ? HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS
+                                                                                : HM_CHANGED_XCPT_RAISED_MASK);
     STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitMovCRx, y2);
     NOREF(pVM);
@@ -13206 +12092 @@
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
     rc    |= hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
-    rc    |= hmR0VmxSaveGuestRip(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestRflags(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
+    rc    |= hmR0VmxImportGuestState(pVCpu,   IEM_CPUMCTX_EXTRN_MUST_MASK
+                                            | CPUMCTX_EXTRN_SREG_MASK
+                                            | CPUMCTX_EXTRN_EFER);
     /* EFER also required for longmode checks in EMInterpretDisasCurrent(), but it's always up-to-date. */
     AssertRCReturn(rc, rc);
 
     /* Refer Intel spec. 27-5. "Exit Qualifications for I/O Instructions" for the format. */
-    uint32_t uIOPort      = VMX_EXIT_QUALIFICATION_IO_PORT(pVmxTransient->uExitQualification);
-    uint8_t  uIOWidth     = VMX_EXIT_QUALIFICATION_IO_WIDTH(pVmxTransient->uExitQualification);
-    bool     fIOWrite     = (   VMX_EXIT_QUALIFICATION_IO_DIRECTION(pVmxTransient->uExitQualification)
-                             == VMX_EXIT_QUALIFICATION_IO_DIRECTION_OUT);
-    bool     fIOString    = VMX_EXIT_QUALIFICATION_IO_IS_STRING(pVmxTransient->uExitQualification);
+    uint32_t uIOPort      = VMX_EXIT_QUAL_IO_PORT(pVmxTransient->uExitQualification);
+    uint8_t  uIOWidth     = VMX_EXIT_QUAL_IO_WIDTH(pVmxTransient->uExitQualification);
+    bool     fIOWrite     = (   VMX_EXIT_QUAL_IO_DIRECTION(pVmxTransient->uExitQualification)
+                             == VMX_EXIT_QUAL_IO_DIRECTION_OUT);
+    bool     fIOString    = VMX_EXIT_QUAL_IO_IS_STRING(pVmxTransient->uExitQualification);
     bool     fGstStepping = RT_BOOL(pMixedCtx->eflags.Bits.u1TF);
     bool     fDbgStepping = pVCpu->hm.s.fSingleInstruction;
@@ -13242 +12127 @@
     {
         /* I/O operation lookup arrays. */
-        static uint32_t const s_aIOSizes[4] = { 1, 2, 0, 4 };                   /* Size of the I/O accesses. */
-        static uint32_t const s_aIOOpAnd[4] = { 0xff, 0xffff, 0, 0xffffffff };  /* AND masks for saving the result (in AL/AX/EAX). */
-
+        static uint32_t const s_aIOSizes[4] = { 1, 2, 0, 4 };                    /* Size of the I/O accesses. */
+        static uint32_t const s_aIOOpAnd[4] = { 0xff, 0xffff, 0, 0xffffffff };   /* AND masks for saving result in AL/AX/EAX. */
         uint32_t const cbValue  = s_aIOSizes[uIOWidth];
         uint32_t const cbInstr  = pVmxTransient->cbInstr;
@@ -13263 +12147 @@
             {
                 int rc2  = hmR0VmxReadExitInstrInfoVmcs(pVmxTransient);
-                /** @todo optimize this, IEM should request the additional state if it needs it (GP, PF, ++). */
-                rc2 |= hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
                 AssertRCReturn(rc2, rc2);
                 AssertReturn(pVmxTransient->ExitInstrInfo.StrIo.u3AddrSize <= 2, VERR_VMX_IPE_3);
                 AssertCompile(IEMMODE_16BIT == 0 && IEMMODE_32BIT == 1 && IEMMODE_64BIT == 2);
-                IEMMODE enmAddrMode = (IEMMODE)pVmxTransient->ExitInstrInfo.StrIo.u3AddrSize;
-                bool    fRep        = VMX_EXIT_QUALIFICATION_IO_IS_REP(pVmxTransient->uExitQualification);
+                IEMMODE const enmAddrMode = (IEMMODE)pVmxTransient->ExitInstrInfo.StrIo.u3AddrSize;
+                bool const fRep           = VMX_EXIT_QUAL_IO_IS_REP(pVmxTransient->uExitQualification);
                 if (fIOWrite)
                     rcStrict = IEMExecStringIoWrite(pVCpu, cbValue, enmAddrMode, fRep, cbInstr,
@@ -13285 +12167 @@
             }
             else
-            {
-                /** @todo optimize this, IEM should request the additional state if it needs it (GP, PF, ++). */
-                int rc2 = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
-                AssertRCReturn(rc2, rc2);
                 rcStrict = IEMExecOne(pVCpu);
-            }
-            /** @todo IEM needs to be setting these flags somehow. */
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RIP);
+
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_RIP);
             fUpdateRipAlready = true;
         }
@@ -13300 +12177 @@
              * IN/OUT - I/O instruction.
              */
-            Log4(("CS:RIP=%04x:%08RX64 %#06x/%u %c\n", pMixedCtx->cs.Sel, pMixedCtx->rip, uIOPort, cbValue, fIOWrite ? 'w' : 'r'));
+            Log4(("CS:RIP=%04x:%08RX64 %#06x/%u %c\n", pMixedCtx->cs.Sel, pMixedCtx->rip, uIOPort, cbValue,
+                  fIOWrite ? 'w' : 'r'));
             uint32_t const uAndVal = s_aIOOpAnd[uIOWidth];
-            Assert(!VMX_EXIT_QUALIFICATION_IO_IS_REP(pVmxTransient->uExitQualification));
+            Assert(!VMX_EXIT_QUAL_IO_IS_REP(pVmxTransient->uExitQualification));
             if (fIOWrite)
             {
@@ -13328 +12206 @@
             {
                 hmR0VmxAdvanceGuestRipBy(pVCpu, pMixedCtx, cbInstr);
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RIP);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_RIP);
             }
 
             /*
-             * INS/OUTS with REP prefix updates RFLAGS, can be observed with triple-fault guru while booting Fedora 17 64-bit guest.
+             * INS/OUTS with REP prefix updates RFLAGS, can be observed with triple-fault guru
+             * while booting Fedora 17 64-bit guest.
+             *
              * See Intel Instruction reference for REP/REPE/REPZ/REPNE/REPNZ.
              */
@@ -13338 +12218 @@
             {
                 /** @todo Single-step for INS/OUTS with REP prefix? */
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RFLAGS);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_RFLAGS);
             }
             else if (  !fDbgStepping
                      && fGstStepping)
             {
-                hmR0VmxSetPendingDebugXcptVmcs(pVCpu);
+                rc = hmR0VmxSetPendingDebugXcptVmcs(pVCpu, pMixedCtx);
+                AssertRCReturn(rc, rc);
             }
 
@@ -13351 +12232 @@
              * Note that the I/O breakpoint type is undefined if CR4.DE is 0.
              */
-            int rc2 = hmR0VmxSaveGuestDR7(pVCpu, pMixedCtx);
-            AssertRCReturn(rc2, rc2);
+            rc = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_DR7);
+            AssertRCReturn(rc, rc);
 
             /** @todo Optimize away the DBGFBpIsHwIoArmed call by having DBGF tell the
@@ -13377 +12258 @@
                         ASMSetDR6(pMixedCtx->dr[6]);
                     if (pMixedCtx->dr[7] != uDr7)
-                        HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_DEBUG);
+                        pVCpu->hm.s.fCtxChanged |= HM_CHANGED_GUEST_DR7;
 
                     hmR0VmxSetPendingXcptDB(pVCpu, pMixedCtx);
@@ -13420 +12301 @@
          * Frequent exit or something needing probing.  Get state and call EMHistoryExec.
          */
-        int rc2 = hmR0VmxSaveGuestRegsForIemInterpreting(pVCpu);
+        int rc2 = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
         AssertRCReturn(rc2, rc2);
         STAM_COUNTER_INC(!fIOString ? fIOWrite ? &pVCpu->hm.s.StatExitIOWrite : &pVCpu->hm.s.StatExitIORead
@@ -13426 +12307 @@
         Log4(("IOExit/%u: %04x:%08RX64: %s%s%s %#x LB %u -> EMHistoryExec\n",
               pVCpu->idCpu, pVCpu->cpum.GstCtx.cs.Sel, pVCpu->cpum.GstCtx.rip,
-              VMX_EXIT_QUALIFICATION_IO_IS_REP(pVmxTransient->uExitQualification) ? "REP " : "",
+              VMX_EXIT_QUAL_IO_IS_REP(pVmxTransient->uExitQualification) ? "REP " : "",
               fIOWrite ? "OUT" : "IN", fIOString ? "S" : "", uIOPort, uIOWidth));
 
         rcStrict = EMHistoryExec(pVCpu, pExitRec, 0);
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
 
         Log4(("IOExit/%u: %04x:%08RX64: EMHistoryExec -> %Rrc + %04x:%08RX64\n",
@@ -13451 +12332 @@
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
     AssertRCReturn(rc, rc);
-    if (VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE(pVmxTransient->uExitQualification) == VMX_EXIT_QUALIFICATION_TASK_SWITCH_TYPE_IDT)
+    if (VMX_EXIT_QUAL_TASK_SWITCH_TYPE(pVmxTransient->uExitQualification) == VMX_EXIT_QUAL_TASK_SWITCH_TYPE_IDT)
     {
         rc = hmR0VmxReadIdtVectoringInfoVmcs(pVmxTransient);
@@ -13534 +12415 @@
     }
 
-#if 0
-    /** @todo Investigate if IOMMMIOPhysHandler() requires a lot of state, for now
-     *   just sync the whole thing. */
-    int rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
-#else
-    /* Aggressive state sync. for now. */
-    int rc  = hmR0VmxSaveGuestRipRspRflags(pVCpu, pMixedCtx);
-    rc     |= hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
-    rc     |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
-#endif
+    /* IOMMIOPhysHandler() below may call into IEM, save the necessary state. */
+    int rc  = hmR0VmxImportGuestState(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
     rc     |= hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
     AssertRCReturn(rc, rc);
 
     /* See Intel spec. 27-6 "Exit Qualifications for APIC-access VM-exits from Linear Accesses & Guest-Phyiscal Addresses" */
-    uint32_t uAccessType = VMX_EXIT_QUALIFICATION_APIC_ACCESS_TYPE(pVmxTransient->uExitQualification);
+    uint32_t uAccessType = VMX_EXIT_QUAL_APIC_ACCESS_TYPE(pVmxTransient->uExitQualification);
     VBOXSTRICTRC rcStrict2;
     switch (uAccessType)
@@ -13556 +12429 @@
         {
             AssertMsg(   !(pVCpu->hm.s.vmx.u32ProcCtls & VMX_VMCS_CTRL_PROC_EXEC_USE_TPR_SHADOW)
-                      || VMX_EXIT_QUALIFICATION_APIC_ACCESS_OFFSET(pVmxTransient->uExitQualification) != XAPIC_OFF_TPR,
+                      || VMX_EXIT_QUAL_APIC_ACCESS_OFFSET(pVmxTransient->uExitQualification) != XAPIC_OFF_TPR,
                       ("hmR0VmxExitApicAccess: can't access TPR offset while using TPR shadowing.\n"));
 
             RTGCPHYS GCPhys = pVCpu->hm.s.vmx.u64MsrApicBase;   /* Always up-to-date, u64MsrApicBase is not part of the VMCS. */
             GCPhys &= PAGE_BASE_GC_MASK;
-            GCPhys += VMX_EXIT_QUALIFICATION_APIC_ACCESS_OFFSET(pVmxTransient->uExitQualification);
+            GCPhys += VMX_EXIT_QUAL_APIC_ACCESS_OFFSET(pVmxTransient->uExitQualification);
             PVM pVM = pVCpu->CTX_SUFF(pVM);
-            Log4(("ApicAccess uAccessType=%#x GCPhys=%#RGp Off=%#x\n", uAccessType, GCPhys,
-                 VMX_EXIT_QUALIFICATION_APIC_ACCESS_OFFSET(pVmxTransient->uExitQualification)));
+            Log4Func(("Linear access uAccessType=%#x GCPhys=%#RGp Off=%#x\n", uAccessType, GCPhys,
+                 VMX_EXIT_QUAL_APIC_ACCESS_OFFSET(pVmxTransient->uExitQualification)));
 
             rcStrict2 = IOMMMIOPhysHandler(pVM, pVCpu,
                                            uAccessType == VMX_APIC_ACCESS_TYPE_LINEAR_READ ? 0 : X86_TRAP_PF_RW,
                                            CPUMCTX2CORE(pMixedCtx), GCPhys);
-            Log4(("ApicAccess rcStrict2=%d\n", VBOXSTRICTRC_VAL(rcStrict2)));
+            Log4Func(("IOMMMIOPhysHandler returned %Rrc\n", VBOXSTRICTRC_VAL(rcStrict2)));
             if (   rcStrict2 == VINF_SUCCESS
                 || rcStrict2 == VERR_PAGE_TABLE_NOT_PRESENT
                 || rcStrict2 == VERR_PAGE_NOT_PRESENT)
             {
-                HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_RIP
-                                    | HM_CHANGED_GUEST_RSP
-                                    | HM_CHANGED_GUEST_RFLAGS
-                                    | HM_CHANGED_GUEST_APIC_STATE);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_RIP
+                                                           | HM_CHANGED_GUEST_RSP
+                                                           | HM_CHANGED_GUEST_RFLAGS
+                                                           | HM_CHANGED_GUEST_APIC_TPR);
                 rcStrict2 = VINF_SUCCESS;
             }
@@ -13584 +12457 @@
 
         default:
-            Log4(("ApicAccess uAccessType=%#x\n", uAccessType));
+            Log4Func(("uAccessType=%#x\n", uAccessType));
             rcStrict2 = VINF_EM_RAW_EMULATE_INSTR;
             break;
@@ -13635 +12508 @@
         rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
         AssertRCReturn(rc, rc);
-        if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(pVmxTransient->uExitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
+        if (VMX_EXIT_QUAL_DRX_DIRECTION(pVmxTransient->uExitQualification) == VMX_EXIT_QUAL_DRX_DIRECTION_WRITE)
             STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
         else
@@ -13649 +12522 @@
      */
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
-    rc    |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
-    rc    |= hmR0VmxSaveGuestDR7(pVCpu, pMixedCtx);
+    rc    |= hmR0VmxImportGuestState(pVCpu,   CPUMCTX_EXTRN_SREG_MASK
+                                            | CPUMCTX_EXTRN_DR7);
     AssertRCReturn(rc, rc);
-    Log4(("CS:RIP=%04x:%08RX64\n", pMixedCtx->cs.Sel, pMixedCtx->rip));
+    Log4Func(("CS:RIP=%04x:%08RX64\n", pMixedCtx->cs.Sel, pMixedCtx->rip));
 
     PVM pVM = pVCpu->CTX_SUFF(pVM);
-    if (VMX_EXIT_QUALIFICATION_DRX_DIRECTION(pVmxTransient->uExitQualification) == VMX_EXIT_QUALIFICATION_DRX_DIRECTION_WRITE)
+    if (VMX_EXIT_QUAL_DRX_DIRECTION(pVmxTransient->uExitQualification) == VMX_EXIT_QUAL_DRX_DIRECTION_WRITE)
     {
         rc = EMInterpretDRxWrite(pVM, pVCpu, CPUMCTX2CORE(pMixedCtx),
-                                 VMX_EXIT_QUALIFICATION_DRX_REGISTER(pVmxTransient->uExitQualification),
-                                 VMX_EXIT_QUALIFICATION_DRX_GENREG(pVmxTransient->uExitQualification));
+                                 VMX_EXIT_QUAL_DRX_REGISTER(pVmxTransient->uExitQualification),
+                                 VMX_EXIT_QUAL_DRX_GENREG(pVmxTransient->uExitQualification));
         if (RT_SUCCESS(rc))
-            HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_DEBUG);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_DR7);
         STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxWrite);
     }
@@ -13667 +12540 @@
     {
         rc = EMInterpretDRxRead(pVM, pVCpu, CPUMCTX2CORE(pMixedCtx),
-                                VMX_EXIT_QUALIFICATION_DRX_GENREG(pVmxTransient->uExitQualification),
-                                VMX_EXIT_QUALIFICATION_DRX_REGISTER(pVmxTransient->uExitQualification));
+                                VMX_EXIT_QUAL_DRX_GENREG(pVmxTransient->uExitQualification),
+                                VMX_EXIT_QUAL_DRX_REGISTER(pVmxTransient->uExitQualification));
         STAM_COUNTER_INC(&pVCpu->hm.s.StatExitDRxRead);
     }
@@ -13714 +12587 @@
      * Get sufficent state and update the exit history entry.
      */
-    RTGCPHYS GCPhys = 0;
+    RTGCPHYS GCPhys;
     int rc = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
-
-#if 0
-    rc |= hmR0VmxSaveGuestState(pVCpu, pMixedCtx);     /** @todo Can we do better?  */
-#else
-    /* Aggressive state sync. for now. */
-    rc |= hmR0VmxSaveGuestRipRspRflags(pVCpu, pMixedCtx);
-    rc |= hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
-    rc |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
-#endif
+    rc    |= hmR0VmxImportGuestState(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
     AssertRCReturn(rc, rc);
 
@@ -13748 +12613 @@
         {
             /* Successfully handled MMIO operation. */
-            HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_RIP
-                                | HM_CHANGED_GUEST_RSP
-                                | HM_CHANGED_GUEST_RFLAGS
-                                | HM_CHANGED_GUEST_APIC_STATE);
+            ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_RIP
+                                                       | HM_CHANGED_GUEST_RSP
+                                                       | HM_CHANGED_GUEST_RFLAGS
+                                                       | HM_CHANGED_GUEST_APIC_TPR);
             rcStrict = VINF_SUCCESS;
         }
@@ -13761 +12626 @@
          */
         Assert(pMixedCtx == &pVCpu->cpum.GstCtx);
-        int rc2 = hmR0VmxSaveGuestRegsForIemInterpreting(pVCpu);
+        int rc2 = hmR0VmxImportGuestState(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
         AssertRCReturn(rc2, rc2);
 
@@ -13768 +12633 @@
 
         rcStrict = EMHistoryExec(pVCpu, pExitRec, 0);
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
 
         Log4(("EptMisscfgExit/%u: %04x:%08RX64: EMHistoryExec -> %Rrc + %04x:%08RX64\n",
@@ -13793 +12658 @@
         /* In the unlikely case that the EPT violation happened as a result of delivering an event, log it. */
         if (RT_UNLIKELY(pVCpu->hm.s.Event.fPending))
-            Log4(("EPT violation with an event pending u64IntInfo=%#RX64\n", pVCpu->hm.s.Event.u64IntInfo));
+            Log4Func(("EPT violation with an event pending u64IntInfo=%#RX64\n", pVCpu->hm.s.Event.u64IntInfo));
     }
     else
@@ -13802 +12667 @@
     }
 
-    RTGCPHYS GCPhys = 0;
+    RTGCPHYS GCPhys;
     int rc  = VMXReadVmcs64(VMX_VMCS64_EXIT_GUEST_PHYS_ADDR_FULL, &GCPhys);
-    rc |= hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
-#if 0
-    rc |= hmR0VmxSaveGuestState(pVCpu, pMixedCtx);     /** @todo Can we do better?  */
-#else
-    /* Aggressive state sync. for now. */
-    rc |= hmR0VmxSaveGuestRipRspRflags(pVCpu, pMixedCtx);
-    rc |= hmR0VmxSaveGuestControlRegs(pVCpu, pMixedCtx);
-    rc |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
-#endif
+    rc     |= hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
+    rc     |= hmR0VmxImportGuestState(pVCpu, IEM_CPUMCTX_EXTRN_MUST_MASK);
     AssertRCReturn(rc, rc);
 
@@ -13819 +12677 @@
 
     RTGCUINT uErrorCode = 0;
-    if (pVmxTransient->uExitQualification & VMX_EXIT_QUALIFICATION_EPT_INSTR_FETCH)
+    if (pVmxTransient->uExitQualification & VMX_EXIT_QUAL_EPT_INSTR_FETCH)
         uErrorCode |= X86_TRAP_PF_ID;
-    if (pVmxTransient->uExitQualification & VMX_EXIT_QUALIFICATION_EPT_DATA_WRITE)
+    if (pVmxTransient->uExitQualification & VMX_EXIT_QUAL_EPT_DATA_WRITE)
         uErrorCode |= X86_TRAP_PF_RW;
-    if (pVmxTransient->uExitQualification & VMX_EXIT_QUALIFICATION_EPT_ENTRY_PRESENT)
+    if (pVmxTransient->uExitQualification & VMX_EXIT_QUAL_EPT_ENTRY_PRESENT)
         uErrorCode |= X86_TRAP_PF_P;
 
     TRPMAssertXcptPF(pVCpu, GCPhys, uErrorCode);
 
-    Log4(("EPT violation %#x at %#RX64 ErrorCode %#x CS:RIP=%04x:%08RX64\n", pVmxTransient->uExitQualification, GCPhys,
-          uErrorCode, pMixedCtx->cs.Sel, pMixedCtx->rip));
+    Log4Func(("EPT violation %#x at %#RX64 ErrorCode %#x CS:RIP=%04x:%08RX64\n", pVmxTransient->uExitQualification, GCPhys,
+              uErrorCode, pMixedCtx->cs.Sel, pMixedCtx->rip));
 
     /* Handle the pagefault trap for the nested shadow table. */
@@ -13843 +12701 @@
         /* Successfully synced our nested page tables. */
         STAM_COUNTER_INC(&pVCpu->hm.s.StatExitReasonNpf);
-        HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_RIP
-                            | HM_CHANGED_GUEST_RSP
-                            | HM_CHANGED_GUEST_RFLAGS);
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_RIP
+                                                   | HM_CHANGED_GUEST_RSP
+                                                   | HM_CHANGED_GUEST_RFLAGS);
         return VINF_SUCCESS;
     }
 
-    Log4(("EPT return to ring-3 rcStrict2=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict2)));
+    Log4Func(("EPT return to ring-3 rcStrict2=%Rrc\n", VBOXSTRICTRC_VAL(rcStrict2)));
     return rcStrict2;
 }
@@ -13871 +12729 @@
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestMF);
 
-    int rc = hmR0VmxSaveGuestCR0(pVCpu, pMixedCtx);
+    int rc = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_CR0);
     AssertRCReturn(rc, rc);
 
@@ -13901 +12759 @@
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestBP);
 
-    /** @todo Try optimize this by not saving the entire guest state unless
-     *        really needed. */
-    int rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
+    int rc = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
     AssertRCReturn(rc, rc);
 
-    PVM pVM = pVCpu->CTX_SUFF(pVM);
-    rc = DBGFRZTrap03Handler(pVM, pVCpu, CPUMCTX2CORE(pMixedCtx));
+    rc = DBGFRZTrap03Handler(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pMixedCtx));
     if (rc == VINF_EM_RAW_GUEST_TRAP)
     {
@@ -13938 +12793 @@
     rc    |= hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
     AssertRCReturn(rc, rc);
-    Assert(pVmxTransient->fVmcsFieldsRead & HMVMX_UPDATED_TRANSIENT_EXIT_INTERRUPTION_INFO);
+    Assert(ASMAtomicUoReadU32(&pVmxTransient->fVmcsFieldsRead) & HMVMX_READ_EXIT_INTERRUPTION_INFO);
 
     hmR0VmxSetPendingEvent(pVCpu, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(pVmxTransient->uExitIntInfo),
@@ -13953 +12808 @@
     HMVMX_VALIDATE_EXIT_XCPT_HANDLER_PARAMS();
     STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestDB);
-    Log6(("XcptDB\n"));
 
     /*
@@ -13960 +12814 @@
      */
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
-    AssertRCReturn(rc, rc);
 
     /* Refer Intel spec. Table 27-1. "Exit Qualifications for debug exceptions" for the format. */
@@ -13968 +12821 @@
 
     rc = DBGFRZTrap01Handler(pVCpu->CTX_SUFF(pVM), pVCpu, CPUMCTX2CORE(pMixedCtx), uDR6, pVCpu->hm.s.fSingleInstruction);
+    Log6Func(("rc=%Rrc\n", rc));
     if (rc == VINF_EM_RAW_GUEST_TRAP)
     {
@@ -13986 +12840 @@
         VMMRZCallRing3Enable(pVCpu);
 
-        rc = hmR0VmxSaveGuestDR7(pVCpu, pMixedCtx);
+        rc = hmR0VmxImportGuestState(pVCpu, CPUMCTX_EXTRN_DR7);
         AssertRCReturn(rc, rc);
 
@@ -14002 +12856 @@
          * Raise #DB in the guest.
          *
-         * It is important to reflect what the VM-exit gave us (preserving the interruption-type) rather than use
-         * hmR0VmxSetPendingXcptDB() as the #DB could've been raised while executing ICEBP (INT1) and not the
-         * regular #DB. Thus it -may- trigger different handling in the CPU (like skipped DPL checks), see @bugref{6398}.
+         * It is important to reflect exactly what the VM-exit gave us (preserving the
+         * interruption-type) rather than use hmR0VmxSetPendingXcptDB() as the #DB could've
+         * been raised while executing ICEBP (INT1) and not the regular #DB. Thus it may
+         * trigger different handling in the CPU (like skipping DPL checks), see @bugref{6398}.
          *
-         * Intel re-documented ICEBP/INT1 on May 2018 previously documented as part of Intel 386,
-         * see Intel spec. 24.8.3 "VM-Entry Controls for Event Injection".
+         * Intel re-documented ICEBP/INT1 on May 2018 previously documented as part of
+         * Intel 386, see Intel spec. 24.8.3 "VM-Entry Controls for Event Injection".
          */
         rc  = hmR0VmxReadExitIntInfoVmcs(pVmxTransient);
@@ -14051 +12906 @@
         rc |= hmR0VmxReadExitIntErrorCodeVmcs(pVmxTransient);
         rc |= hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
-        rc |= hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
+        rc |= hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
         AssertRCReturn(rc, rc);
-        Log4(("#GP Gst: CS:RIP %04x:%08RX64 ErrorCode=%#x CR0=%#RX64 CPL=%u TR=%#04x\n", pMixedCtx->cs.Sel, pMixedCtx->rip,
-              pVmxTransient->uExitIntErrorCode, pMixedCtx->cr0, CPUMGetGuestCPL(pVCpu), pMixedCtx->tr.Sel));
+        Log4Func(("Gst: CS:RIP %04x:%08RX64 ErrorCode=%#x CR0=%#RX64 CPL=%u TR=%#04x\n", pMixedCtx->cs.Sel, pMixedCtx->rip,
+                  pVmxTransient->uExitIntErrorCode, pMixedCtx->cr0, CPUMGetGuestCPL(pVCpu), pMixedCtx->tr.Sel));
         hmR0VmxSetPendingEvent(pVCpu, VMX_VMCS_CTRL_ENTRY_IRQ_INFO_FROM_EXIT_INT_INFO(pVmxTransient->uExitIntInfo),
                                pVmxTransient->cbInstr, pVmxTransient->uExitIntErrorCode, 0 /* GCPtrFaultAddress */);
@@ -14064 +12919 @@
 
     /* EMInterpretDisasCurrent() requires a lot of the state, save the entire state. */
-    rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
+    rc = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
     AssertRCReturn(rc, rc);
 
@@ -14076 +12931 @@
         rc = VINF_SUCCESS;
         Assert(cbOp == pDis->cbInstr);
-        Log4(("#GP Disas OpCode=%u CS:EIP %04x:%04RX64\n", pDis->pCurInstr->uOpcode, pMixedCtx->cs.Sel, pMixedCtx->rip));
+        Log4Func(("Disas OpCode=%u CS:EIP %04x:%04RX64\n", pDis->pCurInstr->uOpcode, pMixedCtx->cs.Sel, pMixedCtx->rip));
         switch (pDis->pCurInstr->uOpcode)
         {
@@ -14084 +12939 @@
                 pMixedCtx->eflags.Bits.u1RF = 0;
                 pMixedCtx->rip += pDis->cbInstr;
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS);
                 if (   !fDbgStepping
                     && pMixedCtx->eflags.Bits.u1TF)
-                    hmR0VmxSetPendingDebugXcptVmcs(pVCpu);
+                {
+                    rc = hmR0VmxSetPendingDebugXcptVmcs(pVCpu, pMixedCtx);
+                    AssertRCReturn(rc, rc);
+                }
                 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitCli);
                 break;
@@ -14103 +12961 @@
                     Assert(VMCPU_FF_IS_PENDING(pVCpu, VMCPU_FF_INHIBIT_INTERRUPTS));
                 }
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS);
                 if (   !fDbgStepping
                     && pMixedCtx->eflags.Bits.u1TF)
-                    hmR0VmxSetPendingDebugXcptVmcs(pVCpu);
+                {
+                    rc = hmR0VmxSetPendingDebugXcptVmcs(pVCpu, pMixedCtx);
+                    AssertRCReturn(rc, rc);
+                }
                 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitSti);
                 break;
@@ -14116 +12977 @@
                 pMixedCtx->rip += pDis->cbInstr;
                 pMixedCtx->eflags.Bits.u1RF = 0;
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_RIP | HM_CHANGED_GUEST_RFLAGS);
                 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitHlt);
                 break;
@@ -14123 +12984 @@
             case OP_POPF:
             {
-                Log4(("POPF CS:EIP %04x:%04RX64\n", pMixedCtx->cs.Sel, pMixedCtx->rip));
+                Log4Func(("POPF CS:EIP %04x:%04RX64\n", pMixedCtx->cs.Sel, pMixedCtx->rip));
                 uint32_t cbParm;
                 uint32_t uMask;
@@ -14155 +13016 @@
                     break;
                 }
-                Log4(("POPF %#x -> %#RX64 mask=%#x RIP=%#RX64\n", Eflags.u, pMixedCtx->rsp, uMask, pMixedCtx->rip));
+                Log4Func(("POPF %#x -> %#RX64 mask=%#x RIP=%#RX64\n", Eflags.u, pMixedCtx->rsp, uMask, pMixedCtx->rip));
                 pMixedCtx->eflags.u32 = (pMixedCtx->eflags.u32 & ~((X86_EFL_POPF_BITS & uMask) | X86_EFL_RF))
                                       | (Eflags.u32 & X86_EFL_POPF_BITS & uMask);
-                pMixedCtx->esp              += cbParm;
-                pMixedCtx->esp              &= uMask;
-                pMixedCtx->rip              += pDis->cbInstr;
-                HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_RIP
-                                    | HM_CHANGED_GUEST_RSP
-                                    | HM_CHANGED_GUEST_RFLAGS);
+                pMixedCtx->esp += cbParm;
+                pMixedCtx->esp &= uMask;
+                pMixedCtx->rip += pDis->cbInstr;
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_RIP
+                                                           | HM_CHANGED_GUEST_RSP
+                                                           | HM_CHANGED_GUEST_RFLAGS);
                 /* Generate a pending-debug exception when the guest stepping over POPF regardless of how
                    POPF restores EFLAGS.TF. */
                 if (  !fDbgStepping
                     && fGstStepping)
-                    hmR0VmxSetPendingDebugXcptVmcs(pVCpu);
+                {
+                    rc = hmR0VmxSetPendingDebugXcptVmcs(pVCpu, pMixedCtx);
+                    AssertRCReturn(rc, rc);
+                }
                 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPopf);
                 break;
@@ -14209 +13073 @@
                     break;
                 }
-                Log4(("PUSHF %#x -> %#RGv\n", Eflags.u, GCPtrStack));
-                pMixedCtx->esp               -= cbParm;
-                pMixedCtx->esp               &= uMask;
-                pMixedCtx->rip               += pDis->cbInstr;
-                pMixedCtx->eflags.Bits.u1RF   = 0;
-                HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_RIP
-                                    | HM_CHANGED_GUEST_RSP
-                                    | HM_CHANGED_GUEST_RFLAGS);
+                Log4Func(("PUSHF %#x -> %#RGv\n", Eflags.u, GCPtrStack));
+                pMixedCtx->esp -= cbParm;
+                pMixedCtx->esp &= uMask;
+                pMixedCtx->rip += pDis->cbInstr;
+                pMixedCtx->eflags.Bits.u1RF = 0;
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_RIP
+                                                           | HM_CHANGED_GUEST_RSP
+                                                           | HM_CHANGED_GUEST_RFLAGS);
                 if (  !fDbgStepping
                     && pMixedCtx->eflags.Bits.u1TF)
-                    hmR0VmxSetPendingDebugXcptVmcs(pVCpu);
+                {
+                    rc = hmR0VmxSetPendingDebugXcptVmcs(pVCpu, pMixedCtx);
+                    AssertRCReturn(rc, rc);
+                }
                 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitPushf);
                 break;
@@ -14258 +13125 @@
                                               | (aIretFrame[2] & X86_EFL_POPF_BITS & uMask);
                 pMixedCtx->sp                += sizeof(aIretFrame);
-                HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_RIP
-                                    | HM_CHANGED_GUEST_SEGMENT_REGS
-                                    | HM_CHANGED_GUEST_RSP
-                                    | HM_CHANGED_GUEST_RFLAGS);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged,   HM_CHANGED_GUEST_RIP
+                                                           | HM_CHANGED_GUEST_CS
+                                                           | HM_CHANGED_GUEST_RSP
+                                                           | HM_CHANGED_GUEST_RFLAGS);
                 /* Generate a pending-debug exception when stepping over IRET regardless of how IRET modifies EFLAGS.TF. */
                 if (   !fDbgStepping
                     && fGstStepping)
-                    hmR0VmxSetPendingDebugXcptVmcs(pVCpu);
-                Log4(("IRET %#RX32 to %04x:%04x\n", GCPtrStack, pMixedCtx->cs.Sel, pMixedCtx->ip));
+                {
+                    rc = hmR0VmxSetPendingDebugXcptVmcs(pVCpu, pMixedCtx);
+                    AssertRCReturn(rc, rc);
+                }
+                Log4Func(("IRET %#RX32 to %04x:%04x\n", GCPtrStack, pMixedCtx->cs.Sel, pMixedCtx->ip));
                 STAM_COUNTER_INC(&pVCpu->hm.s.StatExitIret);
                 break;
@@ -14291 +13161 @@
                 {
                     pMixedCtx->eflags.Bits.u1RF = 0;
-                    HMCPU_CF_SET(pVCpu, HM_CHANGED_GUEST_RFLAGS);
+                    ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_GUEST_RFLAGS);
                 }
                 break;
@@ -14302 +13172 @@
                                                                     EMCODETYPE_SUPERVISOR);
                 rc = VBOXSTRICTRC_VAL(rc2);
-                HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
+                ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
                 /** @todo We have to set pending-debug exceptions here when the guest is
                  *        single-stepping depending on the instruction that was interpreted. */
-                Log4(("#GP rc=%Rrc\n", rc));
+                Log4Func(("#GP rc=%Rrc\n", rc));
                 break;
             }
@@ -14332 +13202 @@
 #ifndef HMVMX_ALWAYS_TRAP_ALL_XCPTS
     AssertMsg(pVCpu->hm.s.fUsingDebugLoop || pVCpu->hm.s.vmx.RealMode.fRealOnV86Active,
-              ("uVector=%#04x u32XcptBitmap=%#010RX32\n",
+              ("uVector=%#x u32XcptBitmap=%#X32\n",
                VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVmxTransient->uExitIntInfo), pVCpu->hm.s.vmx.u32XcptBitmap));
 #endif
@@ -14341 +13211 @@
     rc    |= hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
     AssertRCReturn(rc, rc);
-    Assert(pVmxTransient->fVmcsFieldsRead & HMVMX_UPDATED_TRANSIENT_EXIT_INTERRUPTION_INFO);
+    Assert(ASMAtomicUoReadU32(&pVmxTransient->fVmcsFieldsRead) & HMVMX_READ_EXIT_INTERRUPTION_INFO);
 
 #ifdef DEBUG_ramshankar
-    rc |= hmR0VmxSaveGuestSegmentRegs(pVCpu, pMixedCtx);
+    rc |= hmR0VmxImportGuestState(pVCpu,  CPUMCTX_EXTRN_CS
+                                        | CPUMCTX_EXTRN_RIP);
     uint8_t uVector = VMX_EXIT_INTERRUPTION_INFO_VECTOR(pVmxTransient->uExitIntInfo);
     Log(("hmR0VmxExitXcptGeneric: Reinjecting Xcpt. uVector=%#x cs:rip=%#04x:%#RX64\n", uVector, pCtx->cs.Sel, pCtx->rip));
@@ -14384 +13255 @@
             /* A guest page-fault occurred during delivery of a page-fault. Inject #DF. */
             hmR0VmxSetPendingXcptDF(pVCpu, pMixedCtx);
-            Log4(("Pending #DF due to vectoring #PF. NP\n"));
+            Log4Func(("Pending #DF due to vectoring #PF w/ NestedPaging\n"));
         }
         STAM_COUNTER_INC(&pVCpu->hm.s.StatExitGuestPF);
@@ -14398 +13269 @@
     }
 
-    rc = hmR0VmxSaveGuestState(pVCpu, pMixedCtx);
+    rc = hmR0VmxImportGuestState(pVCpu, HMVMX_CPUMCTX_EXTRN_ALL);
     AssertRCReturn(rc, rc);
 
-    Log4(("#PF: cr2=%#RX64 cs:rip=%#04x:%#RX64 uErrCode %#RX32 cr3=%#RX64\n", pVmxTransient->uExitQualification,
-          pMixedCtx->cs.Sel, pMixedCtx->rip, pVmxTransient->uExitIntErrorCode, pMixedCtx->cr3));
+    Log4Func(("#PF: cr2=%#RX64 cs:rip=%#04x:%#RX64 uErrCode %#RX32 cr3=%#RX64\n", pVmxTransient->uExitQualification,
+              pMixedCtx->cs.Sel, pMixedCtx->rip, pVmxTransient->uExitIntErrorCode, pMixedCtx->cr3));
 
     TRPMAssertXcptPF(pVCpu, pVmxTransient->uExitQualification, (RTGCUINT)pVmxTransient->uExitIntErrorCode);
@@ -14408 +13279 @@
                           (RTGCPTR)pVmxTransient->uExitQualification);
 
-    Log4(("#PF: rc=%Rrc\n", rc));
+    Log4Func(("#PF: rc=%Rrc\n", rc));
     if (rc == VINF_SUCCESS)
     {
-#if 0
-        /* Successfully synced shadow pages tables or emulated an MMIO instruction. */
-        /** @todo this isn't quite right, what if guest does lgdt with some MMIO
-         *        memory? We don't update the whole state here... */
-        HMCPU_CF_SET(pVCpu,   HM_CHANGED_GUEST_RIP
-                            | HM_CHANGED_GUEST_RSP
-                            | HM_CHANGED_GUEST_RFLAGS
-                            | HM_CHANGED_GUEST_APIC_STATE);
-#else
         /*
          * This is typically a shadow page table sync or a MMIO instruction. But we may have
          * emulated something like LTR or a far jump. Any part of the CPU context may have changed.
          */
-        /** @todo take advantage of CPUM changed flags instead of brute forcing. */
-        HMCPU_CF_SET(pVCpu, HM_CHANGED_ALL_GUEST);
-#endif
+        ASMAtomicUoOrU64(&pVCpu->hm.s.fCtxChanged, HM_CHANGED_ALL_GUEST);
         TRPMResetTrap(pVCpu);
         STAM_COUNTER_INC(&pVCpu->hm.s.StatExitShadowPF);
@@ -14449 +13309 @@
             pVCpu->hm.s.Event.fPending = false;     /* Clear pending #PF to replace it with #DF. */
             hmR0VmxSetPendingXcptDF(pVCpu, pMixedCtx);
-            Log4(("#PF: Pending #DF due to vectoring #PF\n"));
+            Log4Func(("#PF: Pending #DF due to vectoring #PF\n"));
         }
 

trunk/src/VBox/VMM/VMMR0/HMVMXR0.h

@@ -39 +39 @@
 VMMR0DECL(int)          VMXR0TermVM(PVM pVM);
 VMMR0DECL(int)          VMXR0SetupVM(PVM pVM);
-VMMR0DECL(int)          VMXR0SaveHostState(PVM pVM, PVMCPU pVCpu);
+VMMR0DECL(int)          VMXR0ExportHostState(PVMCPU pVCpu);
 VMMR0DECL(int)          VMXR0InvalidatePage(PVM pVM, PVMCPU pVCpu, RTGCPTR GCVirt);
-VMMR0DECL(int)          VMXR0ImportStateOnDemand(PVMCPU pVCpu, PCPUMCTX pCtx, uint64_t fWhat);
+VMMR0DECL(int)          VMXR0ImportStateOnDemand(PVMCPU pVCpu, uint64_t fWhat);
 VMMR0DECL(VBOXSTRICTRC) VMXR0RunGuestCode(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx);
 DECLASM(int)            VMXR0StartVM32(RTHCUINT fResume, PCPUMCTX pCtx, PVMCSCACHE pCache, PVM pVM, PVMCPU pVCpu);
@@ -48 +48 @@
 # if HC_ARCH_BITS == 32 && defined(VBOX_WITH_64_BITS_GUESTS)
 DECLASM(int)            VMXR0SwitcherStartVM64(RTHCUINT fResume, PCPUMCTX pCtx, PVMCSCACHE pCache, PVM pVM, PVMCPU pVCpu);
-VMMR0DECL(int)          VMXR0Execute64BitsHandler(PVM pVM, PVMCPU pVCpu, PCPUMCTX pCtx, HM64ON32OP enmOp, uint32_t cbParam,
-                                                  uint32_t *paParam);
+VMMR0DECL(int)          VMXR0Execute64BitsHandler(PVMCPU pVCpu, HM64ON32OP enmOp, uint32_t cbParam, uint32_t *paParam);
 # endif