Index: /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 42183)
+++ /trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 42184)
@@ -1178,4 +1178,5 @@
     unsigned    cResume     = 0;
     uint8_t     u8LastTPR   = 0; /* Initialized for potentially stupid compilers. */
+    uint32_t    u32HostExtFeatures = 0;
     PHMGLOBLCPUINFO pCpu    = 0;
     RTCCUINTREG uOldEFlags  = ~(RTCCUINTREG)0;
@@ -1396,18 +1397,8 @@
 #ifdef LOG_ENABLED
     pCpu = HWACCMR0GetCurrentCpu();
-    if (    pVCpu->hwaccm.s.idLastCpu   != pCpu->idCpu
-        ||  pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
-    {
-        if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
-        {
-            LogFlow(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu,
-                     pCpu->idCpu));
-        }
-        else
-        {
-            LogFlow(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes,
-                     pCpu->cTLBFlushes));
-        }
-    }
+    if (pVCpu->hwaccm.s.idLastCpu != pCpu->idCpu)
+        LogFlow(("Force TLB flush due to rescheduling to a different cpu (%d vs %d)\n", pVCpu->hwaccm.s.idLastCpu, pCpu->idCpu));
+    else if (pVCpu->hwaccm.s.cTLBFlushes != pCpu->cTLBFlushes)
+        LogFlow(("Force TLB flush due to changed TLB flush count (%x vs %x)\n", pVCpu->hwaccm.s.cTLBFlushes, pCpu->cTLBFlushes));
     else if (VMCPU_FF_ISSET(pVCpu, VMCPU_FF_TLB_FLUSH))
         LogFlow(("Manual TLB flush\n"));
@@ -1460,4 +1451,20 @@
 #endif
     TMNotifyStartOfExecution(pVCpu);
+
+    /*
+     * Save the current Host TSC_AUX and write the guest TSC_AUX to the host, so that
+     * RDTSCPs (that don't cause exits) reads the guest MSR. See @bugref{3324}.
+     */
+    u32HostExtFeatures = ASMCpuId_EDX(0x80000001);  /** @todo Move this elsewhere, not needed on every world switch */
+    if (    (u32HostExtFeatures & X86_CPUID_EXT_FEATURE_EDX_RDTSCP)
+        && !(pVMCB->ctrl.u32InterceptCtrl2 & SVM_CTRL2_INTERCEPT_RDTSCP))
+    {
+        pVCpu->hwaccm.s.u64HostTSCAux = ASMRdMsr(MSR_K8_TSC_AUX);
+        uint64_t u64GuestTSCAux = 0;
+        rc2 = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &u64GuestTSCAux);
+        AssertRC(rc2);
+        ASMWrMsr(MSR_K8_TSC_AUX, u64GuestTSCAux);
+    }
+
 #ifdef VBOX_WITH_KERNEL_USING_XMM
     hwaccmR0SVMRunWrapXMM(pVCpu->hwaccm.s.svm.pVMCBHostPhys, pVCpu->hwaccm.s.svm.pVMCBPhys, pCtx, pVM, pVCpu,
@@ -1471,4 +1478,8 @@
     if (!(pVMCB->ctrl.u32InterceptCtrl1 & SVM_CTRL1_INTERCEPT_RDTSC))
     {
+        /* Restore host's TSC_AUX. */
+        if (u32HostExtFeatures & X86_CPUID_EXT_FEATURE_EDX_RDTSCP)
+            ASMWrMsr(MSR_K8_TSC_AUX, pVCpu->hwaccm.s.u64HostTSCAux);
+
         TMCpuTickSetLastSeen(pVCpu, ASMReadTSC() +
                              pVMCB->ctrl.u64TSCOffset - 0x400 /* guestimate of world switch overhead in clock ticks */);
Index: /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 42183)
+++ /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 42184)
@@ -1372,6 +1372,5 @@
 # endif
 
-        if (   (u32HostExtFeatures & X86_CPUID_EXT_FEATURE_EDX_RDTSCP)
-            && pVCpu->hwaccm.s.vmx.proc_ctls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
+        if (pVCpu->hwaccm.s.vmx.proc_ctls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
         {
             pMsr->u32IndexMSR = MSR_K8_TSC_AUX;
@@ -3178,5 +3177,5 @@
         && !(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
     {
-        pVCpu->hwaccm.s.vmx.u64HostTSCAux = ASMRdMsr(MSR_K8_TSC_AUX);
+        pVCpu->hwaccm.s.u64HostTSCAux = ASMRdMsr(MSR_K8_TSC_AUX);
         uint64_t u64GuestTSCAux = 0;
         rc2 = CPUMQueryGuestMsr(pVCpu, MSR_K8_TSC_AUX, &u64GuestTSCAux);
@@ -3194,18 +3193,13 @@
     ASMAtomicIncU32(&pVCpu->hwaccm.s.cWorldSwitchExits);
 
-#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
-    /*
-     * Restore host's TSC_AUX.
-     */
-    if (    (pVCpu->hwaccm.s.vmx.proc_ctls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
-        && !(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
-    {
-        ASMWrMsr(MSR_K8_TSC_AUX, pVCpu->hwaccm.s.vmx.u64HostTSCAux);
-    }
-#endif
-
     /* Possibly the last TSC value seen by the guest (too high) (only when we're in TSC offset mode). */
     if (!(pVCpu->hwaccm.s.vmx.proc_ctls & VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_RDTSC_EXIT))
     {
+#ifndef VBOX_WITH_AUTO_MSR_LOAD_RESTORE
+        /* Restore host's TSC_AUX. */
+        if (pVCpu->hwaccm.s.vmx.proc_ctls2 & VMX_VMCS_CTRL_PROC_EXEC2_RDTSCP)
+            ASMWrMsr(MSR_K8_TSC_AUX, pVCpu->hwaccm.s.u64HostTSCAux);
+#endif
+
         TMCpuTickSetLastSeen(pVCpu,
                              ASMReadTSC() + pVCpu->hwaccm.s.vmx.u64TSCOffset - 0x400 /* guestimate of world switch overhead in clock ticks */);
Index: /trunk/src/VBox/VMM/include/HWACCMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/HWACCMInternal.h	(revision 42183)
+++ /trunk/src/VBox/VMM/include/HWACCMInternal.h	(revision 42184)
@@ -566,4 +566,7 @@
     uint32_t                    u32Alignment;
 
+    /* Host's TSC_AUX MSR (used when RDTSCP doesn't cause VM-exits). */
+    uint64_t                    u64HostTSCAux;
+
     struct
     {
@@ -629,7 +632,4 @@
         uint32_t                    uAlignement;
 #endif /* VBOX_WITH_AUTO_MSR_LOAD_RESTORE */
-
-        /* Host's IA32_TSC_AUX MSR (for RDTSCP in VMX non-root). */
-        uint64_t                    u64HostTSCAux;
 
         /* Last use TSC offset value. (cached) */