Index: /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 45500)
+++ /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 45501)
@@ -50,5 +50,9 @@
 #endif
 
-#define VMX_SEL_UNUSABLE            RT_BIT(16)
+#define VMX_SEL_UNUSABLE                       RT_BIT(16)
+#define VMX_FLUSH_TAGGED_TLB_EPT_VPID          0
+#define VMX_FLUSH_TAGGED_TLB_EPT               1
+#define VMX_FLUSH_TAGGED_TLB_VPID              2
+#define VMX_FLUSH_TAGGED_TLB_NONE              3
 
 /**
@@ -1424,4 +1428,25 @@
 
 /**
+ * Flushes the guest TLB entry based on CPU capabilities.
+ *
+ * @param pVCpu     Pointer to the VMCPU.
+ */
+DECLINLINE(void) hmR0VmxFlushTaggedTlb(PVMCPU pVCpu)
+{
+    PVM pVM = pVCpu->CTX_SUFF(pVM);
+    switch (pVM->hm.s.vmx.uFlushTaggedTlb)
+    {
+        case VMX_FLUSH_TAGGED_TLB_EPT_VPID: hmR0VmxFlushTaggedTlbBoth(pVM, pVCpu); break;
+        case VMX_FLUSH_TAGGED_TLB_EPT:      hmR0VmxFlushTaggedTlbEpt(pVM, pVCpu);  break;
+        case VMX_FLUSH_TAGGED_TLB_VPID:     hmR0VmxFlushTaggedTlbVpid(pVM, pVCpu); break;
+        case VMX_FLUSH_TAGGED_TLB_NONE:     hmR0VmxFlushTaggedTlbNone(pVM, pVCpu); break;
+        default:
+            AssertMsgFailed(("Invalid flush-tag function identifier\n"));
+            break;
+    }
+}
+
+
+/**
  * Sets up the appropriate tagged TLB-flush level and handler for flushing guest
  * TLB entries from the host TLB before VM-entry.
@@ -1503,11 +1528,11 @@
      */
     if (pVM->hm.s.fNestedPaging && pVM->hm.s.vmx.fVpid)
-        pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxFlushTaggedTlbBoth;
+        pVM->hm.s.vmx.uFlushTaggedTlb = VMX_FLUSH_TAGGED_TLB_EPT_VPID;
     else if (pVM->hm.s.fNestedPaging)
-        pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxFlushTaggedTlbEpt;
+        pVM->hm.s.vmx.uFlushTaggedTlb = VMX_FLUSH_TAGGED_TLB_EPT;
     else if (pVM->hm.s.vmx.fVpid)
-        pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxFlushTaggedTlbVpid;
+        pVM->hm.s.vmx.uFlushTaggedTlb = VMX_FLUSH_TAGGED_TLB_VPID;
     else
-        pVM->hm.s.vmx.pfnFlushTaggedTlb = hmR0VmxFlushTaggedTlbNone;
+        pVM->hm.s.vmx.uFlushTaggedTlb = VMX_FLUSH_TAGGED_TLB_NONE;
     return VINF_SUCCESS;
 }
@@ -5549,5 +5574,5 @@
     }
 
-    /* Clear the VT-x state bits to prevent any stale injection. */
+    /* Clear the VT-x state bits to prevent any stale injection. This can happen when InjectEventVmcs() */
     int rc2 = VMXWriteVmcs32(VMX_VMCS32_CTRL_ENTRY_INTERRUPTION_INFO, 0);
     AssertRC(rc2);
@@ -6457,7 +6482,6 @@
         pVmxTransient->u8GuestTpr = pVCpu->hm.s.vmx.pbVirtApic[0x80];
 
-    Assert(pVM->hm.s.vmx.pfnFlushTaggedTlb);
     ASMAtomicWriteBool(&pVCpu->hm.s.fCheckedTLBFlush, true);    /* Used for TLB-shootdowns, set this across the world switch. */
-    pVM->hm.s.vmx.pfnFlushTaggedTlb(pVM, pVCpu);                /* Flush the TLB of guest entries as necessary. */
+    hmR0VmxFlushTaggedTlb(pVCpu);                               /* Invalidate the appropriate guest entries from the TLB. */
 
     /* Setup TSC-offsetting or intercept RDTSC(P)s and update the preemption timer. */
Index: /trunk/src/VBox/VMM/include/HMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/HMInternal.h	(revision 45500)
+++ /trunk/src/VBox/VMM/include/HMInternal.h	(revision 45501)
@@ -383,6 +383,11 @@
         R0PTRTYPE(uint8_t *)        pbScratch;
 #endif
+
+#ifndef VBOX_WITH_OLD_VTX_CODE
+        unsigned                    uFlushTaggedTlb;
+#else
         /** Ring 0 handlers for VT-x. */
         DECLR0CALLBACKMEMBER(void, pfnFlushTaggedTlb, (PVM pVM, PVMCPU pVCpu));
+#endif
 
 #if HC_ARCH_BITS == 32 && defined(VBOX_ENABLE_64_BITS_GUESTS)
@@ -453,5 +458,5 @@
     AVLOU32TREE                     PatchTree;
     uint32_t                        cPatches;
-    HMTPRPATCH                  aPatches[64];
+    HMTPRPATCH                      aPatches[64];
 
     struct