EPT extension defines a base register that points to level 4 page table of the hypervisor (host physical address).When a TLB miss occurs, the page table walker takes 20 memory accesses to translate a guest virtual address into host physical address and update the TLB, plus 4 more memory accesses to store/load data/instruction. Therefore, the CR3 register, which normally contains the guest physical address of level 4 page table of the guest process, is interpreted as a virtual address by EPT and is used as per 9 bits index into the four levels of the hypervisor page tables to get the host physical address of level 4 page table of the guest process. Indexed by the leftmost 9 bits of the guest virtual address, EPT retrieves the guest physical address of level 3 page table of the guest process, and so fourth.
My question: is the above explanation exact/correct? Especially the part that considers the content of CR3 register as a virtual address?