Index: /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 79801)
+++ /trunk/src/VBox/VMM/VMMR0/HMVMXR0.cpp	(revision 79802)
@@ -10821,5 +10821,5 @@
      * The virtual-APIC page has already been allocated (by CPUM during VM startup) and cached
      * from guest memory as part of VMLAUNCH/VMRESUME instruction emulation. The host physical
-     * address has also been updated in the nested-guest VMCS.
+     * address has also been updated in the nested-guest VMCS object during allocation.
      */
     PVMXVMCSINFO pVmcsInfoNstGst = &pVCpu->hm.s.vmx.VmcsInfoNstGst;
@@ -10828,4 +10828,5 @@
     if (u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
     {
+        Assert(pVM->hm.s.vmx.Msrs.ProcCtls.n.allowed1 & VMX_PROC_CTLS_USE_TPR_SHADOW);
         HCPhysVirtApic  = pVmcsInfoNstGst->HCPhysVirtApic;
         u32TprThreshold = pVmcsNstGst->u32TprThreshold;
@@ -10882,6 +10883,9 @@
         rc |= VMXWriteVmcs32(VMX_VMCS32_CTRL_PLE_WINDOW, cPleWindowTicks);
     }
-    rc |= VMXWriteVmcs32(VMX_VMCS32_CTRL_TPR_THRESHOLD, u32TprThreshold);
-    rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_VIRT_APIC_PAGEADDR_FULL, pVmcsInfoNstGst->HCPhysVirtApic);
+    if (u32ProcCtls & VMX_PROC_CTLS_USE_TPR_SHADOW)
+    {
+        rc |= VMXWriteVmcs32(VMX_VMCS32_CTRL_TPR_THRESHOLD, u32TprThreshold);
+        rc |= VMXWriteVmcs64(VMX_VMCS64_CTRL_VIRT_APIC_PAGEADDR_FULL, pVmcsInfoNstGst->HCPhysVirtApic);
+    }
     AssertRCReturn(rc, rc);
 
@@ -14696,4 +14700,5 @@
             }
         }
+        /* else: inject pending event before resuming guest execution. */
     }
     else if (rcStrict == VINF_HM_DOUBLE_FAULT)
@@ -17509,7 +17514,5 @@
     HMVMX_VALIDATE_NESTED_EXIT_HANDLER_PARAMS(pVCpu, pVmxTransient);
 
-    int rc  = hmR0VmxReadExitIntInfoVmcs(pVmxTransient);
-    rc     |= hmR0VmxReadExitIntErrorCodeVmcs(pVmxTransient);
-    rc     |= hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
+    int rc  = hmR0VmxReadExitInstrLenVmcs(pVmxTransient);
     rc     |= hmR0VmxReadIdtVectoringInfoVmcs(pVmxTransient);
     rc     |= hmR0VmxReadIdtVectoringErrorCodeVmcs(pVmxTransient);