Index: /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 48239)
+++ /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 48240)
@@ -4059,5 +4059,11 @@
 #if HC_ARCH_BITS == 32 && !defined(VBOX_WITH_HYBRID_32BIT_KERNEL)
         /* 32-bit host. We need to switch to 64-bit before running the 64-bit guest. */
-        pVCpu->hm.s.vmx.pfnStartVM = VMXR0SwitcherStartVM64;
+        if (pVCpu->hm.s.vmx.pfnStartVM != VMXR0SwitcherStartVM64)
+        {
+            pVCpu->hm.s.vmx.pfnStartVM = VMXR0SwitcherStartVM64;
+            /** @todo this isn't necessary, but I'm still seeing tripple faults. */
+            VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
+            pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_VMX_EXIT_CTLS;
+        }
 #else
         /* 64-bit host or hybrid host. */
@@ -4078,4 +4084,5 @@
              *        between 16/32-bit and long mode frequently at times. */
             VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
+            pVCpu->hm.s.fContextUseFlags |= HM_CHANGED_VMX_EXIT_CTLS;
         }
 #else
@@ -7273,15 +7280,16 @@
  * recompiler. We must be cautious what we do here regarding committing
  * guest-state information into the VMCS assuming we assuredly execute the
- * guest in VT-x. If we fall back to the recompiler after updating the VMCS and
- * clearing the common-state (TRPM/forceflags), we must undo those changes so
- * that the recompiler can (and should) use them when it resumes guest
+ * guest in VT-x mode. If we fall back to the recompiler after updating the VMCS
+ * and clearing the common-state (TRPM/forceflags), we must undo those changes
+ * so that the recompiler can (and should) use them when it resumes guest
  * execution. Otherwise such operations must be done when we can no longer
  * exit to ring-3.
  *
- * @returns VBox status code (informational status codes included).
- * @retval VINF_SUCCESS if we can proceed with running the guest.
- * @retval VINF_EM_RESET if a triple-fault occurs while injecting a double-fault
- *         into the guest.
- * @retval VINF_* scheduling changes, we have to go back to ring-3.
+ * @returns Strict VBox status code.
+ * @retval  VINF_SUCCESS if we can proceed with running the guest, interrupts
+ *          have been disabled.
+ * @retval  VINF_EM_RESET if a triple-fault occurs while injecting a
+ *          double-fault into the guest.
+ * @retval  VINF_* scheduling changes, we have to go back to ring-3.
  *
  * @param   pVM             Pointer to the VM.
@@ -7292,5 +7300,6 @@
  * @param   pVmxTransient   Pointer to the VMX transient structure.
  *
- * @remarks Called with preemption disabled.
+ * @remarks Called with preemption disabled. In the VINF_SUCCESS return case
+ *          interrupts will be disabled.
  */
 static int hmR0VmxPreRunGuest(PVM pVM, PVMCPU pVCpu, PCPUMCTX pMixedCtx, PVMXTRANSIENT pVmxTransient)
@@ -7501,5 +7510,6 @@
  * @param   rcVMRun         Return code of VMLAUNCH/VMRESUME.
  *
- * @remarks Called with interrupts disabled.
+ * @remarks Called with interrupts disabled, and returns with interrups enabled!
+ *
  * @remarks No-long-jump zone!!! This function will however re-enable longjmps
  *          unconditionally when it is safe to do so.
@@ -7602,5 +7612,6 @@
         HMVMX_ASSERT_CPU_SAFE();
 
-        /* Preparatory work for running guest code, this may return to ring-3 for some last minute updates. */
+        /* Preparatory work for running guest code, this may force us to return
+           to ring-3.  This bugger disables interrupts on VINF_SUCCESS! */
         STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
         rc = hmR0VmxPreRunGuest(pVM, pVCpu, pCtx, &VmxTransient);
@@ -7612,5 +7623,6 @@
         /* The guest-CPU context is now outdated, 'pCtx' is to be treated as 'pMixedCtx' from this point on!!! */
 
-        /* Restore any residual host-state and save any bits shared between host and guest into the guest-CPU state. */
+        /* Restore any residual host-state and save any bits shared between host
+           and guest into the guest-CPU state.  Re-enables interrupts! */
         hmR0VmxPostRunGuest(pVM, pVCpu, pCtx, &VmxTransient, rc);
 
@@ -7674,5 +7686,6 @@
         HMVMX_ASSERT_CPU_SAFE();
 
-        /* Preparatory work for running guest code, this may return to ring-3 for some last minute updates. */
+        /* Preparatory work for running guest code, this may force us to return
+           to ring-3.  This bugger disables interrupts on VINF_SUCCESS! */
         STAM_PROFILE_ADV_START(&pVCpu->hm.s.StatEntry, x);
         rc = hmR0VmxPreRunGuest(pVM, pVCpu, pCtx, &VmxTransient);
@@ -7684,5 +7697,6 @@
         /* The guest-CPU context is now outdated, 'pCtx' is to be treated as 'pMixedCtx' from this point on!!! */
 
-        /* Restore any residual host-state and save any bits shared between host and guest into the guest-CPU state. */
+        /* Restore any residual host-state and save any bits shared between host
+           and guest into the guest-CPU state.  Re-enables interrupts! */
         hmR0VmxPostRunGuest(pVM, pVCpu, pCtx, &VmxTransient, rc);