Index: /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 45516)
+++ /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 45517)
@@ -997,9 +997,9 @@
 
     uint64_t descriptor[2];
-    descriptor[0] = pVCpu->hm.s.vmx.GCPhysEPTP;
+    descriptor[0] = pVCpu->hm.s.vmx.HCPhysEPTP;
     descriptor[1] = 0;                           /* MBZ. Intel spec. 33.3 "VMX Instructions" */
 
     int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
-    AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvEPT %#x %RGv failed with %Rrc\n", enmFlush, pVCpu->hm.s.vmx.GCPhysEPTP, rc));
+    AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvEPT %#x %RGv failed with %Rrc\n", enmFlush, pVCpu->hm.s.vmx.HCPhysEPTP, rc));
     STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushNestedPaging);
 }
@@ -2813,23 +2813,23 @@
         if (pVM->hm.s.fNestedPaging)
         {
-            pVCpu->hm.s.vmx.GCPhysEPTP = PGMGetHyperCR3(pVCpu);
+            pVCpu->hm.s.vmx.HCPhysEPTP = PGMGetHyperCR3(pVCpu);
 
             /* Validate. See Intel spec. 28.2.2 "EPT Translation Mechanism" and 24.6.11 "Extended-Page-Table Pointer (EPTP)" */
-            Assert(pVCpu->hm.s.vmx.GCPhysEPTP);
-            Assert(!(pVCpu->hm.s.vmx.GCPhysEPTP & 0xfff0000000000000ULL));
-            Assert(!(pVCpu->hm.s.vmx.GCPhysEPTP & 0xfff));
+            Assert(pVCpu->hm.s.vmx.HCPhysEPTP);
+            Assert(!(pVCpu->hm.s.vmx.HCPhysEPTP & 0xfff0000000000000ULL));
+            Assert(!(pVCpu->hm.s.vmx.HCPhysEPTP & 0xfff));
 
             /* VMX_EPT_MEMTYPE_WB support is already checked in hmR0VmxSetupTaggedTlb(). */
-            pVCpu->hm.s.vmx.GCPhysEPTP |=  VMX_EPT_MEMTYPE_WB
+            pVCpu->hm.s.vmx.HCPhysEPTP |=  VMX_EPT_MEMTYPE_WB
                                          | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
 
             /* Validate. See Intel spec. 26.2.1 "Checks on VMX Controls" */
-            AssertMsg(   ((pVCpu->hm.s.vmx.GCPhysEPTP >> 3) & 0x07) == 3      /* Bits 3:5 (EPT page walk length - 1) must be 3. */
-                      && ((pVCpu->hm.s.vmx.GCPhysEPTP >> 6) & 0x3f) == 0,     /* Bits 6:11 MBZ. */
-                         ("EPTP %#RX64\n", pVCpu->hm.s.vmx.GCPhysEPTP));
-
-            rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.GCPhysEPTP);
+            AssertMsg(   ((pVCpu->hm.s.vmx.HCPhysEPTP >> 3) & 0x07) == 3      /* Bits 3:5 (EPT page walk length - 1) must be 3. */
+                      && ((pVCpu->hm.s.vmx.HCPhysEPTP >> 6) & 0x3f) == 0,     /* Bits 6:11 MBZ. */
+                         ("EPTP %#RX64\n", pVCpu->hm.s.vmx.HCPhysEPTP));
+
+            rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.HCPhysEPTP);
             AssertRCReturn(rc, rc);
-            Log(("VMX_VMCS64_CTRL_EPTP_FULL=%#RX64\n", pVCpu->hm.s.vmx.GCPhysEPTP));
+            Log(("VMX_VMCS64_CTRL_EPTP_FULL=%#RX64\n", pVCpu->hm.s.vmx.HCPhysEPTP));
 
             if (   pVM->hm.s.vmx.fUnrestrictedGuest
@@ -7660,4 +7660,5 @@
 {
     VMX_VALIDATE_EXIT_HANDLER_PARAMS();
+    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitMovCRx, y2);
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
     AssertRCReturn(rc, rc);
@@ -7766,10 +7767,11 @@
         {
             AssertMsgFailed(("Invalid access-type in Mov CRx exit qualification %#x\n", uAccessType));
-            return VERR_VMX_UNEXPECTED_EXCEPTION;
+            rc = VERR_VMX_UNEXPECTED_EXCEPTION;
         }
     }
 
     /* Validate possible error codes. */
-    Assert(rc == VINF_SUCCESS || rc == VINF_PGM_CHANGE_MODE || rc == VERR_EM_INTERPRETER || rc == VINF_PGM_SYNC_CR3);
+    Assert(rc == VINF_SUCCESS || rc == VINF_PGM_CHANGE_MODE || rc == VERR_EM_INTERPRETER || rc == VINF_PGM_SYNC_CR3
+           || rc == VERR_VMX_UNEXPECTED_EXCEPTION);
     if (RT_SUCCESS(rc))
     {
@@ -7778,4 +7780,5 @@
     }
 
+    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitMovCRx, y2);
     return rc;
 }
@@ -7789,4 +7792,5 @@
 {
     VMX_VALIDATE_EXIT_HANDLER_PARAMS();
+    STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitIO, y1);
 
     int rc = hmR0VmxReadExitQualificationVmcs(pVCpu, pVmxTransient);
@@ -7948,4 +7952,5 @@
 #endif
 
+    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
     return rc;
 }
Index: /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 45516)
+++ /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 45517)
@@ -2216,12 +2216,12 @@
         {
             Assert(PGMGetHyperCR3(pVCpu));
-            pVCpu->hm.s.vmx.GCPhysEPTP = PGMGetHyperCR3(pVCpu);
-
-            Assert(!(pVCpu->hm.s.vmx.GCPhysEPTP & 0xfff));
+            pVCpu->hm.s.vmx.HCPhysEPTP = PGMGetHyperCR3(pVCpu);
+
+            Assert(!(pVCpu->hm.s.vmx.HCPhysEPTP & 0xfff));
             /** @todo Check the IA32_VMX_EPT_VPID_CAP MSR for other supported memory types. */
-            pVCpu->hm.s.vmx.GCPhysEPTP |=   VMX_EPT_MEMTYPE_WB
+            pVCpu->hm.s.vmx.HCPhysEPTP |=   VMX_EPT_MEMTYPE_WB
                                              | (VMX_EPT_PAGE_WALK_LENGTH_DEFAULT << VMX_EPT_PAGE_WALK_LENGTH_SHIFT);
 
-            rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.GCPhysEPTP);
+            rc = VMXWriteVmcs64(VMX_VMCS64_CTRL_EPTP_FULL, pVCpu->hm.s.vmx.HCPhysEPTP);
             AssertRC(rc);
 
@@ -3531,5 +3531,5 @@
             break;
         }
-        STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExit2Sub3, y3);
+        STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitXcptNmi, y3);
         switch (VMX_EXIT_INTERRUPTION_INFO_TYPE(intInfo))
         {
@@ -3567,5 +3567,5 @@
                     pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_GUEST_CR0;
 
-                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                     goto ResumeExecution;
                 }
@@ -3576,5 +3576,5 @@
                                          cbInstr, 0);
                 AssertRC(rc2);
-                STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                 goto ResumeExecution;
             }
@@ -3601,5 +3601,5 @@
                     AssertRC(rc2);
 
-                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                     goto ResumeExecution;
                 }
@@ -3674,5 +3674,5 @@
 
                     TRPMResetTrap(pVCpu);
-                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                     goto ResumeExecution;
                 }
@@ -3696,5 +3696,5 @@
                     AssertRC(rc2);
 
-                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                     goto ResumeExecution;
                 }
@@ -3727,5 +3727,5 @@
                 AssertRC(rc2);
 
-                STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                 goto ResumeExecution;
             }
@@ -3779,5 +3779,5 @@
                     AssertRC(rc2);
 
-                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                     goto ResumeExecution;
                 }
@@ -3797,10 +3797,10 @@
                                              cbInstr, errCode);
                     AssertRC(rc2);
-                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                     goto ResumeExecution;
                 }
                 if (rc == VINF_SUCCESS)
                 {
-                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                     goto ResumeExecution;
                 }
@@ -3823,5 +3823,5 @@
                                              cbInstr, errCode);
                     AssertRC(rc2);
-                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                     goto ResumeExecution;
                 }
@@ -4055,5 +4055,5 @@
 
                         /* Only resume if successful. */
-                        STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                        STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                         goto ResumeExecution;
                     }
@@ -4088,5 +4088,5 @@
                 AssertRC(rc2);
 
-                STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                 goto ResumeExecution;
             }
@@ -4109,5 +4109,5 @@
                     }
 
-                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+                    STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
                     goto ResumeExecution;
                 }
@@ -4125,5 +4125,5 @@
         }
 
-        STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub3, y3);
+        STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitXcptNmi, y3);
         break;
     }
@@ -4416,5 +4416,5 @@
     case VMX_EXIT_MOV_CRX:             /* 28 Control-register accesses. */
     {
-        STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExit2Sub2, y2);
+        STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitMovCRx, y2);
 
         switch (VMX_EXIT_QUALIFICATION_CRX_ACCESS(exitQualification))
@@ -4499,9 +4499,9 @@
         {
             /* Only resume if successful. */
-            STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub2, y2);
+            STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitMovCRx, y2);
             goto ResumeExecution;
         }
         Assert(rc == VERR_EM_INTERPRETER || rc == VINF_PGM_CHANGE_MODE || rc == VINF_PGM_SYNC_CR3);
-        STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub2, y2);
+        STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitMovCRx, y2);
         break;
     }
@@ -4579,5 +4579,5 @@
     case VMX_EXIT_IO_INSTR:              /* 30 I/O instruction. */
     {
-        STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExit2Sub1, y1);
+        STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatExitIO, y1);
         uint32_t uPort;
         uint32_t uIOWidth = VMX_EXIT_QUALIFICATION_IO_WIDTH(exitQualification);
@@ -4593,5 +4593,5 @@
         {
             rc = fIOWrite ? VINF_IOM_R3_IOPORT_WRITE : VINF_IOM_R3_IOPORT_READ;
-            STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
+            STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
             break;
         }
@@ -4720,13 +4720,13 @@
                             AssertRC(rc2);
 
-                            STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
+                            STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
                             goto ResumeExecution;
                         }
                     }
                 }
-                STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
+                STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
                 goto ResumeExecution;
             }
-            STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
+            STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
             break;
         }
@@ -4745,5 +4745,5 @@
         }
 #endif
-        STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExit2Sub1, y1);
+        STAM_PROFILE_ADV_STOP(&pVCpu->hm.s.StatExitIO, y1);
         break;
     }
@@ -5152,8 +5152,8 @@
     LogFlow(("hmR0VmxFlushEPT %d\n", enmFlush));
     Assert(pVM->hm.s.fNestedPaging);
-    descriptor[0] = pVCpu->hm.s.vmx.GCPhysEPTP;
+    descriptor[0] = pVCpu->hm.s.vmx.HCPhysEPTP;
     descriptor[1] = 0; /* MBZ. Intel spec. 33.3 VMX Instructions */
     int rc = VMXR0InvEPT(enmFlush, &descriptor[0]);
-    AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvEPT %x %RGv failed with %d\n", enmFlush, pVCpu->hm.s.vmx.GCPhysEPTP, rc));
+    AssertMsg(rc == VINF_SUCCESS, ("VMXR0InvEPT %x %RGv failed with %d\n", enmFlush, pVCpu->hm.s.vmx.HCPhysEPTP, rc));
 #ifdef VBOX_WITH_STATISTICS
     STAM_COUNTER_INC(&pVCpu->hm.s.StatFlushNestedPaging);
Index: /trunk/src/VBox/VMM/VMMR3/HM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/HM.cpp	(revision 45516)
+++ /trunk/src/VBox/VMM/VMMR3/HM.cpp	(revision 45517)
@@ -495,19 +495,18 @@
                              "/PROF/CPU%d/HM/SwitchFromGC_2", i);
         AssertRC(rc);
-# ifdef VBOX_WITH_OLD_VTX_CODE
-        /* temporary for tracking down darwin holdup. */
-        rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExit2Sub1, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
-                             "Temporary - I/O",
-                             "/PROF/CPU%d/HM/SwitchFromGC_2/Sub1", i);
+
+        rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitIO, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
+                             "I/O",
+                             "/PROF/CPU%d/HM/SwitchFromGC_2/IO", i);
         AssertRC(rc);
-        rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExit2Sub2, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
-                             "Temporary - CRx RWs",
-                             "/PROF/CPU%d/HM/SwitchFromGC_2/Sub2", i);
+        rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitMovCRx, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
+                             "MOV CRx",
+                             "/PROF/CPU%d/HM/SwitchFromGC_2/MovCRx", i);
         AssertRC(rc);
-        rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExit2Sub3, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
-                             "Temporary - Exceptions",
-                             "/PROF/CPU%d/HM/SwitchFromGC_2/Sub3", i);
+        rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatExitXcptNmi, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
+                             "Exceptions, NMIs",
+                             "/PROF/CPU%d/HM/SwitchFromGC_2/XcptNmi", i);
         AssertRC(rc);
-# endif
+
         rc = STAMR3RegisterF(pVM, &pVCpu->hm.s.StatLoadGuestState, STAMTYPE_PROFILE, STAMVISIBILITY_USED, STAMUNIT_TICKS_PER_CALL,
                              "Profiling of VMXR0LoadGuestState",
Index: /trunk/src/VBox/VMM/include/HMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/HMInternal.h	(revision 45516)
+++ /trunk/src/VBox/VMM/include/HMInternal.h	(revision 45517)
@@ -628,5 +628,5 @@
         uint32_t                    fUpdatedGuestState;
         /** Current EPTP. */
-        RTHCPHYS                    GCPhysEPTP;
+        RTHCPHYS                    HCPhysEPTP;
 
         /** Physical address of the MSR bitmap. */
@@ -793,9 +793,7 @@
     STAMPROFILEADV          StatExit1;
     STAMPROFILEADV          StatExit2;
-#ifdef VBOX_WITH_OLD_VTX_CODE /* "temporary" for tracking down darwin issues. */
-    STAMPROFILEADV          StatExit2Sub1;
-    STAMPROFILEADV          StatExit2Sub2;
-    STAMPROFILEADV          StatExit2Sub3;
-#endif
+    STAMPROFILEADV          StatExitIO;
+    STAMPROFILEADV          StatExitMovCRx;
+    STAMPROFILEADV          StatExitXcptNmi;
     STAMPROFILEADV          StatLoadGuestState;
     STAMPROFILEADV          StatInGC;
