Index: /trunk/src/VBox/VMM/VMMGC/EMGCA.asm
===================================================================
--- /trunk/src/VBox/VMM/VMMGC/EMGCA.asm	(revision 7293)
+++ /trunk/src/VBox/VMM/VMMGC/EMGCA.asm	(revision 7294)
@@ -179,46 +179,42 @@
 align 16
 BEGINPROC   EMGCEmulateLockXAdd
-    push    ebx
-    mov     ecx, [esp + 04h + 4]        ; ecx = first parameter
-    mov     ebx, [esp + 08h + 4]        ; ebx = 2nd parameter
-    mov     eax, [esp + 0ch + 4]        ; eax = size of parameters
-
-    cmp     al, 4
-    je short .do_dword                  ; 4 bytes variant
-    cmp     al, 2
-    je short .do_word                   ; 2 byte variant
-    cmp     al, 1
-    je short .do_byte                   ; 1 bytes variant
-    int3
-
-.do_dword:
-    ; load 2nd parameter's value
-    mov     eax, dword [ebx]
+    mov     ecx, [esp + 04h + 0]        ; ecx = first parameter
+    mov     edx, [esp + 08h + 0]        ; edx = 2nd parameter
+    mov     eax, [esp + 0ch + 0]        ; eax = size of parameters
+
+    cmp     al, 4
+    je short .do_dword                  ; 4 bytes variant
+    cmp     al, 2
+    je short .do_word                   ; 2 byte variant
+    cmp     al, 1
+    je short .do_byte                   ; 1 bytes variant
+    int3
+
+.do_dword:
+    ; load 2nd parameter's value
+    mov     eax, dword [edx]
     lock xadd dword [ecx], eax              ; do 4 bytes XADD
-    mov     dword [ebx], eax
-    jmp     short .done
-
-.do_word:
-    ; load 2nd parameter's value
-    mov     eax, dword [ebx]
+    mov     dword [edx], eax
+    jmp     short .done
+
+.do_word:
+    ; load 2nd parameter's value
+    mov     eax, dword [edx]
     lock xadd word [ecx], ax                ; do 2 bytes XADD
-    mov     word [ebx], ax
-    jmp     short .done
-
-.do_byte:
-    ; load 2nd parameter's value
-    mov     eax, dword [ebx]
+    mov     word [edx], ax
+    jmp     short .done
+
+.do_byte:
+    ; load 2nd parameter's value
+    mov     eax, dword [edx]
     lock xadd byte [ecx], al                ; do 1 bytes XADD
-    mov     byte [ebx], al
-
-.done:
-    ; collect flags and return.
-    pushf
-    pop     eax
-
-    mov     edx, [esp + 10h + 4]            ; eflags pointer
-    mov     dword [edx], eax
-
-    pop     ebx
+    mov     byte [edx], al
+
+.done:
+    ; collect flags and return.
+    mov     edx, [esp + 10h + 0]            ; eflags pointer
+    pushf
+    pop     dword [edx]
+
     mov     eax, VINF_SUCCESS
     retn
@@ -226,5 +222,4 @@
 ; Read error - we will be here after our page fault handler.
 GLOBALNAME EMGCEmulateLockXAdd_Error
-    pop     ebx
     mov     eax, VERR_ACCESS_DENIED
     ret
@@ -245,46 +240,42 @@
 align 16
 BEGINPROC   EMGCEmulateXAdd
-    push    ebx
-    mov     ecx, [esp + 04h + 4]        ; ecx = first parameter
-    mov     ebx, [esp + 08h + 4]        ; ebx = 2nd parameter (eax)
-    mov     eax, [esp + 0ch + 4]        ; eax = size of parameters
-
-    cmp     al, 4
-    je short .do_dword                  ; 4 bytes variant
-    cmp     al, 2
-    je short .do_word                   ; 2 byte variant
-    cmp     al, 1
-    je short .do_byte                   ; 1 bytes variant
-    int3
-
-.do_dword:
-    ; load 2nd parameter's value
-    mov     eax, dword [ebx]
+    mov     ecx, [esp + 04h + 0]        ; ecx = first parameter
+    mov     edx, [esp + 08h + 0]        ; edx = 2nd parameter (eax)
+    mov     eax, [esp + 0ch + 0]        ; eax = size of parameters
+
+    cmp     al, 4
+    je short .do_dword                  ; 4 bytes variant
+    cmp     al, 2
+    je short .do_word                   ; 2 byte variant
+    cmp     al, 1
+    je short .do_byte                   ; 1 bytes variant
+    int3
+
+.do_dword:
+    ; load 2nd parameter's value
+    mov     eax, dword [edx]
     xadd    dword [ecx], eax            ; do 4 bytes XADD
-    mov     dword [ebx], eax
-    jmp     short .done
-
-.do_word:
-    ; load 2nd parameter's value
-    mov     eax, dword [ebx]
+    mov     dword [edx], eax
+    jmp     short .done
+
+.do_word:
+    ; load 2nd parameter's value
+    mov     eax, dword [edx]
     xadd    word [ecx], ax              ; do 2 bytes XADD
-    mov     word [ebx], ax
-    jmp     short .done
-
-.do_byte:
-    ; load 2nd parameter's value
-    mov     eax, dword [ebx]
+    mov     word [edx], ax
+    jmp     short .done
+
+.do_byte:
+    ; load 2nd parameter's value
+    mov     eax, dword [edx]
     xadd    byte [ecx], al              ; do 1 bytes XADD
-    mov     byte [ebx], al
-
-.done:
-    ; collect flags and return.
-    pushf
-    pop     eax
-
-    mov     edx, [esp + 10h + 4]        ; eflags pointer
-    mov     dword [edx], eax
-
-    pop     ebx
+    mov     byte [edx], al
+
+.done:
+    ; collect flags and return.
+    mov     edx, [esp + 10h + 0]        ; eflags pointer
+    pushf
+    pop     dword [edx]
+
     mov     eax, VINF_SUCCESS
     retn
@@ -292,5 +283,4 @@
 ; Read error - we will be here after our page fault handler.
 GLOBALNAME EMGCEmulateXAdd_Error
-    pop     ebx
     mov     eax, VERR_ACCESS_DENIED
     ret
