diff -r fd6d12935b56 xen/arch/x86/hvm/vmx/vmx.c
--- a/xen/arch/x86/hvm/vmx/vmx.c	Mon Jul 03 16:07:20 2006 +0100
+++ b/xen/arch/x86/hvm/vmx/vmx.c	Wed Jul 05 15:31:40 2006 +0800
@@ -857,10 +857,14 @@ static void vmx_vmexit_do_cpuid(struct c
 #else
             if ( v->domain->arch.ops->guest_paging_levels == PAGING_L2 )
             {
-                if ( !v->domain->arch.hvm_domain.pae_enabled )
+                if ( v->domain->arch.hvm_domain.pae_enabled )
+                    clear_bit(X86_FEATURE_PSE36, &edx);
+                else
+                {
                     clear_bit(X86_FEATURE_PAE, &edx);
-                clear_bit(X86_FEATURE_PSE, &edx);
-                clear_bit(X86_FEATURE_PSE36, &edx);
+                    clear_bit(X86_FEATURE_PSE, &edx);
+                    clear_bit(X86_FEATURE_PSE36, &edx);
+                }
             }
 #endif
 
diff -r fd6d12935b56 xen/arch/x86/shadow.c
--- a/xen/arch/x86/shadow.c	Mon Jul 03 16:07:20 2006 +0100
+++ b/xen/arch/x86/shadow.c	Wed Jul 05 15:31:40 2006 +0800
@@ -3724,7 +3724,13 @@ static inline int guest_page_fault(
     }
 
     if ( guest_l2e_get_flags(*gpl2e) & _PAGE_PSE )
+    {
+        printk("None-PAE HVM guests can NOT use PSE, "
+               "because we don't support 4MBytes PSE pages.\n");
+        printk("remove pae=1 from your config file.\n");
+        domain_crash_synchronous();
         return 0;
+    }
 
     __guest_get_l1e(v, va, gpl1e);