Index: /trunk/src/VBox/VMM/VMMSwitcher/LegacyandAMD64.mac
===================================================================
--- /trunk/src/VBox/VMM/VMMSwitcher/LegacyandAMD64.mac	(revision 34990)
+++ /trunk/src/VBox/VMM/VMMSwitcher/LegacyandAMD64.mac	(revision 34991)
@@ -57,10 +57,10 @@
 ;
 BEGINPROC vmmR0HostToGuest
- %ifdef DEBUG_STUFF
+%ifdef DEBUG_STUFF
     COM32_S_NEWLINE
     COM32_S_CHAR '^'
- %endif
-
- %ifdef VBOX_WITH_STATISTICS
+%endif
+
+%ifdef VBOX_WITH_STATISTICS
     ;
     ; Switcher stats.
@@ -69,5 +69,5 @@
     mov     edx, 0ffffffffh
     STAM_PROFILE_ADV_START edx
- %endif
+%endif
 
     push    ebp
@@ -85,4 +85,27 @@
     push    cs                          ; allow for far return and restore cs correctly.
     call    NAME(vmmR0HostToGuestAsm)
+
+%ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
+    CPUM_FROM_CPUMCPU(edx)
+    ; Restore blocked Local APIC NMI vectors
+    mov     ecx, [edx + CPUM.fApicDisVectors]
+    mov     edx, [edx + CPUM.pvApicBase]
+    shr     ecx, 1
+    jnc     gth_nolint0
+    and     dword [edx + APIC_REG_LVT_LINT0], ~APIC_REG_LVT_MASKED
+gth_nolint0:
+    shr     ecx, 1
+    jnc     gth_nolint1
+    and     dword [edx + APIC_REG_LVT_LINT1], ~APIC_REG_LVT_MASKED
+gth_nolint1:
+    shr     ecx, 1
+    jnc     gth_nopc
+    and     dword [edx + APIC_REG_LVT_PC], ~APIC_REG_LVT_MASKED
+gth_nopc:
+    shr     ecx, 1
+    jnc     gth_notherm
+    and     dword [edx + APIC_REG_LVT_THMR], ~APIC_REG_LVT_MASKED
+gth_notherm:
+%endif
 
     ; restore original flags
@@ -626,28 +649,4 @@
     ;mov     cr2, ecx
 
-%ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
-    ; Restore blocked Local APIC NMI vectors
-    CPUM_FROM_CPUMCPU_WITH_OFFSET edx, ebp
-    mov     ebx, [edx + CPUM.pvApicBase]
-    mov     ecx, [edx + CPUM.fApicDisVectors]
-    CPUMCPU_FROM_CPUM_WITH_OFFSET edx, ebp
-    shr     ecx, 1
-    jnc     gth_nolint0
-    and     dword [ebx + APIC_REG_LVT_LINT0], ~APIC_REG_LVT_MASKED
-gth_nolint0:
-    shr     ecx, 1
-    jnc     gth_nolint1
-    and     dword [ebx + APIC_REG_LVT_LINT1], ~APIC_REG_LVT_MASKED
-gth_nolint1:
-    shr     ecx, 1
-    jnc     gth_nopc
-    and     dword [ebx + APIC_REG_LVT_PC], ~APIC_REG_LVT_MASKED
-gth_nopc:
-    shr     ecx, 1
-    jnc     gth_notherm
-    and     dword [ebx + APIC_REG_LVT_THMR], ~APIC_REG_LVT_MASKED
-gth_notherm:
-%endif
-
     ; restore general registers.
     mov     edi, [edx + CPUMCPU.Host.edi]
Index: /trunk/src/VBox/VMM/VMMSwitcher/PAEand32Bit.mac
===================================================================
--- /trunk/src/VBox/VMM/VMMSwitcher/PAEand32Bit.mac	(revision 34990)
+++ /trunk/src/VBox/VMM/VMMSwitcher/PAEand32Bit.mac	(revision 34991)
@@ -80,4 +80,28 @@
     push    cs                          ; allow for far return and restore cs correctly.
     call    NAME(vmmR0HostToGuestAsm)
+
+%ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
+    CPUM_FROM_CPUMCPU(edx)
+    ; Restore blocked Local APIC NMI vectors
+    ; Do this here to ensure the host CS is already restored
+    mov     ecx, [edx + CPUM.fApicDisVectors]
+    mov     edx, [edx + CPUM.pvApicBase]
+    shr     ecx, 1
+    jnc     gth_nolint0
+    and     dword [edx + APIC_REG_LVT_LINT0], ~APIC_REG_LVT_MASKED
+gth_nolint0:
+    shr     ecx, 1
+    jnc     gth_nolint1
+    and     dword [edx + APIC_REG_LVT_LINT1], ~APIC_REG_LVT_MASKED
+gth_nolint1:
+    shr     ecx, 1
+    jnc     gth_nopc
+    and     dword [edx + APIC_REG_LVT_PC], ~APIC_REG_LVT_MASKED
+gth_nopc:
+    shr     ecx, 1
+    jnc     gth_notherm
+    and     dword [edx + APIC_REG_LVT_THMR], ~APIC_REG_LVT_MASKED
+gth_notherm:
+%endif
 
 %ifdef VBOX_WITH_STATISTICS
@@ -994,29 +1018,4 @@
 gth_debug_regs_no:
 
-%ifdef VBOX_WITH_VMMR0_DISABLE_LAPIC_NMI
-    mov     esi, edx
-    CPUM_FROM_CPUMCPU(edx)
-    ; Restore blocked Local APIC NMI vectors
-    mov     ebx, [edx + CPUM.pvApicBase]
-    mov     ecx, [edx + CPUM.fApicDisVectors]
-    mov     edx, esi
-    shr     ecx, 1
-    jnc     gth_nolint0
-    and     dword [ebx + APIC_REG_LVT_LINT0], ~APIC_REG_LVT_MASKED
-gth_nolint0:
-    shr     ecx, 1
-    jnc     gth_nolint1
-    and     dword [ebx + APIC_REG_LVT_LINT1], ~APIC_REG_LVT_MASKED
-gth_nolint1:
-    shr     ecx, 1
-    jnc     gth_nopc
-    and     dword [ebx + APIC_REG_LVT_PC], ~APIC_REG_LVT_MASKED
-gth_nopc:
-    shr     ecx, 1
-    jnc     gth_notherm
-    and     dword [ebx + APIC_REG_LVT_THMR], ~APIC_REG_LVT_MASKED
-gth_notherm:
-%endif
-
     ; restore general registers.
     mov     eax, edi                    ; restore return code. eax = return code !!