Index: /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 92546)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 92547)
@@ -1858,4 +1858,6 @@
                               PPGMPTWALKGST pGstWalk)
 {
+    AssertPtr(pWalk);
+    AssertPtr(pGstWalk);
     switch (enmSlatMode)
     {
@@ -2400,7 +2402,23 @@
      * Remap the CR3 content and adjust the monitoring if CR3 was actually changed.
      */
+    RTGCPHYS const GCPhysOldCR3 = pVCpu->pgm.s.GCPhysCR3;
+    RTGCPHYS       GCPhysCR3    = pgmGetGuestMaskedCr3(pVCpu, cr3);
+#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
+    if (   !fPdpesMapped
+        && CPUMIsGuestVmxEptPagingEnabled(pVCpu))
+    {
+        PGMPTWALK    Walk;
+        PGMPTWALKGST GstWalk;
+        int const rc = pgmGstSlatWalkPhys(pVCpu, PGMSLAT_EPT, GCPhysCR3, &Walk, &GstWalk);
+        if (RT_SUCCESS(rc))
+            GCPhysCR3 = Walk.GCPhys;
+        else
+        {
+            AssertMsgFailed(("Failed to load CR3 at %#RX64. rc=%Rrc\n", GCPhysCR3, rc));
+            return rc;
+        }
+    }
+#endif
     int rc = VINF_SUCCESS;
-    RTGCPHYS const GCPhysOldCR3 = pVCpu->pgm.s.GCPhysCR3;
-    RTGCPHYS const GCPhysCR3    = pgmGetGuestMaskedCr3(pVCpu, cr3);
     if (GCPhysOldCR3 != GCPhysCR3)
     {
@@ -2484,6 +2502,22 @@
      * Remap the CR3 content and adjust the monitoring if CR3 was actually changed.
      */
+    RTGCPHYS GCPhysCR3 = pgmGetGuestMaskedCr3(pVCpu, cr3);
+#ifdef VBOX_WITH_NESTED_HWVIRT_VMX_EPT
+    if (   !fPdpesMapped
+        && CPUMIsGuestVmxEptPagingEnabled(pVCpu))
+    {
+        PGMPTWALK    Walk;
+        PGMPTWALKGST GstWalk;
+        int const rc = pgmGstSlatWalkPhys(pVCpu, PGMSLAT_EPT, GCPhysCR3, &Walk, &GstWalk);
+        if (RT_SUCCESS(rc))
+            GCPhysCR3 = Walk.GCPhys;
+        else
+        {
+            AssertMsgFailed(("Failed to load CR3 at %#RX64. rc=%Rrc\n", GCPhysCR3, rc));
+            return VERR_PGM_PAE_PDPE_RSVD;
+        }
+    }
+#endif
     int rc = VINF_SUCCESS;
-    RTGCPHYS const GCPhysCR3 = pgmGetGuestMaskedCr3(pVCpu, cr3);
     if (pVCpu->pgm.s.GCPhysCR3 != GCPhysCR3)
     {
@@ -2723,6 +2757,6 @@
         else
         {
-            /** @todo Raise EPT violation VM-exit. */
-            return VERR_NOT_IMPLEMENTED;
+            AssertMsgFailed(("Failed to load CR3 at %#RX64. rc=%Rrc\n", GCPhysCR3, rc));
+            return rc;
         }
     }