Index: trunk/src/VBox/VMM/PGMInternal.h
===================================================================
--- trunk/src/VBox/VMM/PGMInternal.h	(revision 10024)
+++ trunk/src/VBox/VMM/PGMInternal.h	(revision 10026)
@@ -1369,9 +1369,15 @@
     /** Shw: 64-bit page directory pointer table;   Gst: 64-bit page directory pointer table. */
     PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT,
+    /** Shw: 64-bit page directory pointer table; Gst: no paging  */
+    PGMPOOLKIND_64BIT_PDPT_FOR_PHYS,
     /** Shw: 64-bit page directory table;   Gst: 64-bit page directory table. */
     PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD,
+    /** Shw: 64-bit page directory table; Gst: no paging  */
+    PGMPOOLKIND_64BIT_PD_FOR_PHYS,
 
     /** Shw: 64-bit PML4;   Gst: 64-bit PML4. */
     PGMPOOLKIND_64BIT_PML4_FOR_64BIT_PML4,
+    /** Shw: 64-bit PML4; Gst: no paging  */
+    PGMPOOLKIND_64BIT_PML4_FOR_PHYS,
 
     /** Shw: Root 32-bit page directory. */
Index: trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 10024)
+++ trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 10026)
@@ -823,6 +823,18 @@
     PPGMPOOLPAGE   pShwPage;
     int            rc;
-
-    AssertReturn(pVM->pgm.s.pHCPaePML4, VERR_INTERNAL_ERROR);
+    PGMPOOLKIND    enmPdpt, enmPd;
+
+    AssertReturn(pVM->pgm.s.pHCPaePML4 && pVM->pgm.s.pHCShwAmd64CR3, VERR_INTERNAL_ERROR);
+
+    if (HWACCMIsNestedPagingActive(pVM))
+    {
+        enmPdpt = PGMPOOLKIND_64BIT_PDPT_FOR_PHYS;
+        enmPd   = PGMPOOLKIND_64BIT_PD_FOR_PHYS;
+    }
+    else
+    {
+        enmPdpt = PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT;
+        enmPd   = PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD;
+    }
 
     Assert(pVM->pgm.s.pHCPaePML4);
@@ -835,5 +847,5 @@
 
         Assert(!(pPml4e->u & X86_PML4E_PG_MASK));
-        rc = pgmPoolAlloc(pVM, pPml4eGst->u & X86_PML4E_PG_MASK, PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT, pVM->pgm.s.pHCShwAmd64CR3->idx, iPml4e, &pShwPage);
+        rc = pgmPoolAlloc(pVM, pPml4eGst->u & X86_PML4E_PG_MASK, enmPdpt, pVM->pgm.s.pHCShwAmd64CR3->idx, iPml4e, &pShwPage);
         if (rc == VERR_PGM_POOL_FLUSHED)
             return VINF_PGM_SYNC_CR3;
@@ -865,5 +877,5 @@
         Assert(!(pPdpe->u & X86_PDPE_PG_MASK));
         /* Create a reference back to the PDPT by using the index in its shadow page. */
-        rc = pgmPoolAlloc(pVM, pPdptGst->a[iPdPt].u & X86_PDPE_PG_MASK, PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD, pShwPage->idx, iPdPt, &pShwPage);
+        rc = pgmPoolAlloc(pVM, pPdptGst->a[iPdPt].u & X86_PDPE_PG_MASK, enmPd, pShwPage->idx, iPdPt, &pShwPage);
         if (rc == VERR_PGM_POOL_FLUSHED)
             return VINF_PGM_SYNC_CR3;
Index: trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 10024)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 10026)
@@ -1054,4 +1054,7 @@
         case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
         case PGMPOOLKIND_PAE_PT_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PML4_FOR_PHYS:
             return true;
 
@@ -1074,4 +1077,7 @@
                 case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
                 case PGMPOOLKIND_PAE_PT_FOR_PHYS:
+                case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
+                case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
+                case PGMPOOLKIND_64BIT_PML4_FOR_PHYS:
                     return true;
                 default:
@@ -1097,4 +1103,7 @@
                 case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
                 case PGMPOOLKIND_PAE_PT_FOR_PHYS:
+                case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
+                case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
+                case PGMPOOLKIND_64BIT_PML4_FOR_PHYS:
                     return true;
                 default:
@@ -1318,4 +1327,7 @@
                 case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
                 case PGMPOOLKIND_PAE_PT_FOR_PHYS:
+                case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
+                case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
+                case PGMPOOLKIND_64BIT_PML4_FOR_PHYS:
                     break;
                 default:
@@ -1364,4 +1376,7 @@
         case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
         case PGMPOOLKIND_PAE_PT_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PML4_FOR_PHYS:
             /* Nothing to monitor here. */
             return VINF_SUCCESS;
@@ -1446,4 +1461,7 @@
         case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
         case PGMPOOLKIND_PAE_PT_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PML4_FOR_PHYS:
             /* Nothing to monitor here. */
             return VINF_SUCCESS;
@@ -2134,4 +2152,7 @@
         case PGMPOOLKIND_ROOT_PAE_PD:
         case PGMPOOLKIND_ROOT_PDPT:
+        case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PML4_FOR_PHYS:
             return 8;
 
@@ -2175,5 +2196,9 @@
         case PGMPOOLKIND_32BIT_PT_FOR_PHYS:
         case PGMPOOLKIND_PAE_PT_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
+        case PGMPOOLKIND_64BIT_PML4_FOR_PHYS:
             /** @todo can we return 0? (nobody is calling this...) */
+            AssertFailed();
             return 0;
 
@@ -3164,7 +3189,9 @@
         case PGMPOOLKIND_PAE_PD_FOR_PAE_PD:
         case PGMPOOLKIND_64BIT_PD_FOR_64BIT_PD:
+        case PGMPOOLKIND_64BIT_PD_FOR_PHYS:
             pgmPoolTrackDerefPDPae(pPool, pPage, (PX86PDPAE)pvShw);
             break;
 
+        case PGMPOOLKIND_64BIT_PDPT_FOR_PHYS:
         case PGMPOOLKIND_64BIT_PDPT_FOR_64BIT_PDPT:
             pgmPoolTrackDerefPDPT64Bit(pPool, pPage, (PX86PDPT)pvShw);
@@ -3172,4 +3199,5 @@
 
         case PGMPOOLKIND_64BIT_PML4_FOR_64BIT_PML4:
+        case PGMPOOLKIND_64BIT_PML4_FOR_PHYS:
             pgmPoolTrackDerefPML464Bit(pPool, pPage, (PX86PML4)pvShw);
             break;
