Index: /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 13166)
+++ /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 13167)
@@ -2279,31 +2279,14 @@
         Assert(pVM->hwaccm.s.fNestedPaging);
 
-        if ((exitQualification & (VMX_EXIT_QUALIFICATION_EPT_GUEST_ADDR_VALID | VMX_EXIT_QUALIFICATION_EPT_TRANSLATED_ACCESS)) 
-             ==                  (VMX_EXIT_QUALIFICATION_EPT_GUEST_ADDR_VALID | VMX_EXIT_QUALIFICATION_EPT_TRANSLATED_ACCESS))
-        {
-            /* Read the fault address. */
-            rc = VMXReadVMCS(VMX_VMCS_EXIT_GUEST_LINEAR_ADDR, &val);
-            AssertRC(rc);
-            GCPhys = val;
-        }
-        else
-        {
-            Assert(!(pCtx->cr0 & X86_CR0_PG) || (pCtx->cr4 & X86_CR4_PAE));
-
-            /* If not set, then the violation occurred when loading the PDPTEs as part of a mov cr3 instruction
-             * or while accessing our real & protected mode without paging page directory.
-             */
-            if (!(pCtx->cr0 & X86_CR0_PG))
-            {
-                /* We convert it here every time as pci regions could be reconfigured. */
-                rc = PDMVMMDevHeapR3ToGCPhys(pVM, pVM->hwaccm.s.vmx.pRealModeEPTPageTable, &GCPhys);
-                AssertRC(rc);
-            }
-            else
-            {
-                /* It applies to the guest's CR3. */
-                GCPhys = pCtx->cr3;
-            }
-        }
+#if HC_ARCH_BITS == 64
+        rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &GCPhys);
+        AssertRC(rc);
+#else
+        rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_FULL, &val);
+        AssertRC(rc);
+        GCPhys = val;
+        rc = VMXReadVMCS(VMX_VMCS_EXIT_PHYS_ADDR_HIGH, &val);
+        GCPhys |= (val << 32ULL);      
+#endif
 
         /* Determine the kind of violation. */