Index: /trunk/include/VBox/vmm/cpum.h
===================================================================
--- /trunk/include/VBox/vmm/cpum.h	(revision 92540)
+++ /trunk/include/VBox/vmm/cpum.h	(revision 92541)
@@ -1598,4 +1598,5 @@
 VMM_INT_DECL(uint32_t)  CPUMGetVmxMsrPermission(void const *pvMsrBitmap, uint32_t idMsr);
 VMM_INT_DECL(bool)      CPUMIsGuestVmxEptPagingEnabled(PCVMCPUCC pVCpu);
+VMM_INT_DECL(bool)      CPUMIsGuestVmxEptPaePagingEnabled(PCVMCPUCC pVCpu);
 /** @} */
 
Index: /trunk/include/VBox/vmm/pgm.h
===================================================================
--- /trunk/include/VBox/vmm/pgm.h	(revision 92540)
+++ /trunk/include/VBox/vmm/pgm.h	(revision 92541)
@@ -603,5 +603,5 @@
 VMMDECL(int)        PGMSyncCR3(PVMCPUCC pVCpu, uint64_t cr0, uint64_t cr3, uint64_t cr4, bool fGlobal);
 VMMDECL(int)        PGMUpdateCR3(PVMCPUCC pVCpu, uint64_t cr3, bool fPdpesMapped);
-VMMDECL(int)        PGMChangeMode(PVMCPUCC pVCpu, uint64_t cr0, uint64_t cr4, uint64_t efer);
+VMMDECL(int)        PGMChangeMode(PVMCPUCC pVCpu, uint64_t cr0, uint64_t cr4, uint64_t efer, bool fForce);
 VMM_INT_DECL(int)   PGMHCChangeMode(PVMCC pVM, PVMCPUCC pVCpu, PGMMODE enmGuestMode);
 VMMDECL(void)       PGMCr0WpEnabled(PVMCPUCC pVCpu);
Index: /trunk/src/VBox/VMM/VMMAll/CPUMAllRegs.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/CPUMAllRegs.cpp	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMAll/CPUMAllRegs.cpp	(revision 92541)
@@ -3045,2 +3045,16 @@
 }
 
+
+/**
+ * Checks whether the guest is in VMX non-root mode and using EPT paging and the
+ * nested-guest is in PAE mode.
+ *
+ * @returns @c true if in VMX non-root operation with EPT, @c false otherwise.
+ * @param   pVCpu   The cross context virtual CPU structure.
+ */
+VMM_INT_DECL(bool) CPUMIsGuestVmxEptPaePagingEnabled(PCVMCPUCC pVCpu)
+{
+    return    CPUMIsGuestVmxEptPagingEnabledEx(&pVCpu->cpum.s.Guest)
+           && CPUMIsGuestInPAEModeEx(&pVCpu->cpum.s.Guest);
+}
+
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImpl.cpp.h	(revision 92541)
@@ -3922,5 +3922,6 @@
         /* ignore informational status codes */
     }
-    rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
+    rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
+                             false /* fForce */);
 
     /* TR selector is at offset 0x16. */
@@ -5894,5 +5895,6 @@
             Assert(pVCpu->cpum.GstCtx.cr0 == uNewCrX);
 
-            rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
+            rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
+                                     false /* fForce */);
             break;
         }
@@ -6097,5 +6099,6 @@
             Assert(pVCpu->cpum.GstCtx.cr4 == uNewCrX);
 
-            rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
+            rcStrict = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
+                                     false /* fForce */);
             break;
         }
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h	(revision 92541)
@@ -92,5 +92,6 @@
      * see comment in iemMemPageTranslateAndCheckAccess().
      */
-    int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
+    int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
+                           true /* fForce */);
     AssertRCReturn(rc, rc);
 
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 92541)
@@ -1226,5 +1226,6 @@
      * see comment in iemMemPageTranslateAndCheckAccess().
      */
-    int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
+    int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0 | X86_CR0_PE, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
+                           true /* fForce */);
     AssertRCReturn(rc, rc);
 
Index: /trunk/src/VBox/VMM/VMMAll/NEMAllNativeTemplate-win.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/NEMAllNativeTemplate-win.cpp.h	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMAll/NEMAllNativeTemplate-win.cpp.h	(revision 92541)
@@ -1110,5 +1110,6 @@
     if (fMaybeChangedMode)
     {
-        int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
+        int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
+                               false /* fForce */);
         AssertMsgReturn(rc == VINF_SUCCESS, ("rc=%Rrc\n", rc), RT_FAILURE_NP(rc) ? rc : VERR_NEM_IPE_1);
     }
Index: /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 92541)
@@ -1822,4 +1822,5 @@
                           PPGMPTWALK pWalk, PPGMPTWALKGST pGstWalk)
 {
+    /* SLAT mode must be valid at this point as this should only be used -after- we have determined SLAT mode. */
     Assert(   pVCpu->pgm.s.enmGuestSlatMode != PGMSLAT_DIRECT
            && pVCpu->pgm.s.enmGuestSlatMode != PGMSLAT_INVALID);
@@ -2713,6 +2714,5 @@
 
 #ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
-    if (   CPUMIsGuestVmxEptPagingEnabled(pVCpu)
-        && CPUMIsGuestInPAEMode(pVCpu))
+    if (CPUMIsGuestVmxEptPaePagingEnabled(pVCpu))
     {
         PGMPTWALK    Walk;
@@ -2787,6 +2787,7 @@
  * @param   cr4         The new cr4.
  * @param   efer        The new extended feature enable register.
- */
-VMMDECL(int) PGMChangeMode(PVMCPUCC pVCpu, uint64_t cr0, uint64_t cr4, uint64_t efer)
+ * @param   fForce      Whether to force a mode change.
+ */
+VMMDECL(int) PGMChangeMode(PVMCPUCC pVCpu, uint64_t cr0, uint64_t cr4, uint64_t efer, bool fForce)
 {
     VMCPU_ASSERT_EMT(pVCpu);
@@ -2832,5 +2833,6 @@
      * Did it change?
      */
-    if (pVCpu->pgm.s.enmGuestMode == enmGuestMode)
+    if (   !fForce
+        && pVCpu->pgm.s.enmGuestMode == enmGuestMode)
         return VINF_SUCCESS;
 
@@ -3753,10 +3755,5 @@
     PVMCC pVM = pVCpu->CTX_SUFF(pVM);
     PGM_LOCK_VOID(pVM);
-    if (pVCpu->pgm.s.uEptPtr != uEptPtr)
-    {
-        pVCpu->pgm.s.uEptPtr = uEptPtr;
-        pVCpu->pgm.s.pGstEptPml4R0 = NIL_RTR0PTR;
-        pVCpu->pgm.s.pGstEptPml4R3 = NIL_RTR3PTR;
-    }
+    pVCpu->pgm.s.uEptPtr = uEptPtr;
     PGM_UNLOCK(pVM);
 }
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 92541)
@@ -4152,4 +4152,7 @@
 #endif
     {
+        /** @todo Nested VMX: convert GCPhysCR3 from nested-guest physical to guest-physical
+         *        by calling SLAT phys walk. */
+
         /*
          * Map the page CR3 points at.
@@ -4306,4 +4309,12 @@
 
     /*
+     * Update second-level address translation info.
+     */
+#ifdef VBOX_WITH_NESTED_HWVIRT_VMX
+    pVCpu->pgm.s.pGstEptPml4R3 = 0;
+    pVCpu->pgm.s.pGstEptPml4R0 = 0;
+#endif
+
+    /*
      * Update shadow paging info.
      */
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllGstSlatEpt.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllGstSlatEpt.cpp.h	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllGstSlatEpt.cpp.h	(revision 92541)
@@ -97,5 +97,5 @@
      *     See Intel spec. Table 26-7 "Exit Qualification for EPT Violations".
      *
-     *   - X_USER is Cumulative but relevant only when mode-based execute control for EPT
+     *   - X_USER is cumulative but relevant only when mode-based execute control for EPT
      *     which we currently don't support it (asserted below).
      *
Index: /trunk/src/VBox/VMM/VMMR0/NEMR0Native-win.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/NEMR0Native-win.cpp	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMR0/NEMR0Native-win.cpp	(revision 92541)
@@ -2772,5 +2772,5 @@
     if (fMaybeChangedMode)
     {
-        rc = PGMChangeMode(pGVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER);
+        rc = PGMChangeMode(pGVCpu, pCtx->cr0, pCtx->cr4, pCtx->msrEFER, false /* fForce */);
         AssertMsgReturn(rc == VINF_SUCCESS, ("rc=%Rrc\n", rc), RT_FAILURE_NP(rc) ? rc : VERR_NEM_IPE_1);
     }
Index: /trunk/src/VBox/VMM/VMMR3/NEMR3Native-darwin.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/NEMR3Native-darwin.cpp	(revision 92540)
+++ /trunk/src/VBox/VMM/VMMR3/NEMR3Native-darwin.cpp	(revision 92541)
@@ -1114,5 +1114,6 @@
     if (fMaybeChangedMode)
     {
-        int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER);
+        int rc = PGMChangeMode(pVCpu, pVCpu->cpum.GstCtx.cr0, pVCpu->cpum.GstCtx.cr4, pVCpu->cpum.GstCtx.msrEFER,
+                               false /* fForce */);
         AssertMsgReturn(rc == VINF_SUCCESS, ("rc=%Rrc\n", rc), RT_FAILURE_NP(rc) ? rc : VERR_NEM_IPE_1);
     }