Index: trunk/src/VBox/VMM/HWACCM.cpp
===================================================================
--- trunk/src/VBox/VMM/HWACCM.cpp	(revision 9025)
+++ trunk/src/VBox/VMM/HWACCM.cpp	(revision 9026)
@@ -215,4 +215,10 @@
     /* Disable the switcher */
     VMMR3DisableSwitcher(pVM);
+
+    if (pVM->hwaccm.s.fNestedPaging)
+    {
+        /* Reinit the paging mode to force the new shadow mode. */
+        PGMR3ChangeMode(pVM, PGMMODE_REAL);
+    }
 }
 
Index: trunk/src/VBox/VMM/PGM.cpp
===================================================================
--- trunk/src/VBox/VMM/PGM.cpp	(revision 9025)
+++ trunk/src/VBox/VMM/PGM.cpp	(revision 9026)
@@ -621,5 +621,5 @@
 static int               pgmR3ModeDataInit(PVM pVM, bool fResolveGCAndR0);
 static void              pgmR3ModeDataSwitch(PVM pVM, PGMMODE enmShw, PGMMODE enmGst);
-static PGMMODE           pgmR3CalcShadowMode(PGMMODE enmGuestMode, SUPPAGINGMODE enmHostMode, PGMMODE enmShadowMode, VMMSWITCHER *penmSwitcher);
+static PGMMODE           pgmR3CalcShadowMode(PVM pVM, PGMMODE enmGuestMode, SUPPAGINGMODE enmHostMode, PGMMODE enmShadowMode, VMMSWITCHER *penmSwitcher);
 
 #ifdef VBOX_WITH_STATISTICS
@@ -1340,5 +1340,5 @@
     rc = pgmR3ModeDataInit(pVM, false /* don't resolve GC and R0 syms yet */);
     if (VBOX_SUCCESS(rc))
-        rc = pgmR3ChangeMode(pVM, PGMMODE_REAL);
+        rc = PGMR3ChangeMode(pVM, PGMMODE_REAL);
     if (VBOX_SUCCESS(rc))
     {
@@ -1905,5 +1905,5 @@
              * Switch mode back to real mode.
              */
-            rc = pgmR3ChangeMode(pVM, PGMMODE_REAL);
+            rc = PGMR3ChangeMode(pVM, PGMMODE_REAL);
             STAM_REL_COUNTER_RESET(&pVM->pgm.s.cGuestModeChanges);
         }
@@ -2279,5 +2279,5 @@
      * Change the paging mode.
      */
-    return pgmR3ChangeMode(pVM, pPGM->enmGuestMode);
+    return PGMR3ChangeMode(pVM, pPGM->enmGuestMode);
 }
 
@@ -2725,4 +2725,5 @@
  *
  * @returns The shadow paging mode.
+ * @param   pVM             VM handle.
  * @param   enmGuestMode    The guest mode.
  * @param   enmHostMode     The host mode.
@@ -2731,5 +2732,5 @@
  *                          VMMSWITCHER_INVALID means no change.
  */
-static PGMMODE pgmR3CalcShadowMode(PGMMODE enmGuestMode, SUPPAGINGMODE enmHostMode, PGMMODE enmShadowMode, VMMSWITCHER *penmSwitcher)
+static PGMMODE pgmR3CalcShadowMode(PVM pVM, PGMMODE enmGuestMode, SUPPAGINGMODE enmHostMode, PGMMODE enmShadowMode, VMMSWITCHER *penmSwitcher)
 {
     VMMSWITCHER enmSwitcher = VMMSWITCHER_INVALID;
@@ -2884,4 +2885,7 @@
             return PGMMODE_INVALID;
     }
+    /* Override the shadow mode is nested paging is active. */
+    if (HWACCMIsNestedPagingActive(pVM))
+        enmShadowMode = PGMMODE_NESTED;
 
     *penmSwitcher = enmSwitcher;
@@ -2899,7 +2903,7 @@
  *                          the current mode.
  */
-int pgmR3ChangeMode(PVM pVM, PGMMODE enmGuestMode)
-{
-    LogFlow(("pgmR3ChangeMode: Guest mode: %d -> %d\n", pVM->pgm.s.enmGuestMode, enmGuestMode));
+PGMR3DECL(int) PGMR3ChangeMode(PVM pVM, PGMMODE enmGuestMode)
+{
+    LogFlow(("PGMR3ChangeMode: Guest mode: %d -> %d\n", pVM->pgm.s.enmGuestMode, enmGuestMode));
     STAM_REL_COUNTER_INC(&pVM->pgm.s.cGuestModeChanges);
 
@@ -2908,5 +2912,5 @@
      */
     VMMSWITCHER enmSwitcher;
-    PGMMODE     enmShadowMode = pgmR3CalcShadowMode(enmGuestMode, pVM->pgm.s.enmHostMode, pVM->pgm.s.enmShadowMode, &enmSwitcher);
+    PGMMODE     enmShadowMode = pgmR3CalcShadowMode(pVM, enmGuestMode, pVM->pgm.s.enmHostMode, pVM->pgm.s.enmShadowMode, &enmSwitcher);
     if (enmSwitcher != VMMSWITCHER_INVALID)
     {
@@ -2928,5 +2932,5 @@
     if (enmShadowMode != pVM->pgm.s.enmShadowMode)
     {
-        LogFlow(("pgmR3ChangeMode: Shadow mode: %d -> %d\n",  pVM->pgm.s.enmShadowMode, enmShadowMode));
+        LogFlow(("PGMR3ChangeMode: Shadow mode: %d -> %d\n",  pVM->pgm.s.enmShadowMode, enmShadowMode));
         if (PGM_SHW_PFN(Exit, pVM))
         {
Index: trunk/src/VBox/VMM/PGMInternal.h
===================================================================
--- trunk/src/VBox/VMM/PGMInternal.h	(revision 9025)
+++ trunk/src/VBox/VMM/PGMInternal.h	(revision 9026)
@@ -2579,5 +2579,4 @@
 PGMGCDECL(int)  pgmGCGuestPDWriteHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, void *pvFault, RTGCPHYS GCPhysFault, void *pvUser);
 PGMDECL(int)    pgmPhysRomWriteHandler(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame, void *pvFault, RTGCPHYS GCPhysFault, void *pvUser);
-int             pgmR3ChangeMode(PVM pVM, PGMMODE enmGuestMode);
 
 int             pgmR3SyncPTResolveConflict(PVM pVM, PPGMMAPPING pMapping, PX86PD pPDSrc, RTGCPTR GCPtrOldMapping);
Index: trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 9025)
+++ trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 9026)
@@ -908,5 +908,6 @@
 PGMDECL(uint32_t) PGMGetHyperCR3(PVM pVM)
 {
-    switch (pVM->pgm.s.enmShadowMode)
+    PGMMODE enmShadowMode = pVM->pgm.s.enmShadowMode;
+    switch (enmShadowMode)
     {
         case PGMMODE_32_BIT:
@@ -922,5 +923,31 @@
 
         default:
-            AssertMsgFailed(("enmShadowMode=%d\n", pVM->pgm.s.enmShadowMode));
+            AssertMsgFailed(("enmShadowMode=%d\n", enmShadowMode));
+            return ~0;
+    }
+}
+
+/**
+ * Gets the current CR3 register value for the nested memory context.
+ * @returns CR3 value.
+ * @param   pVM         The VM handle.
+ */
+PGMDECL(uint32_t) PGMGetNestedCR3(PVM pVM, PGMMODE enmShadowMode)
+{
+    switch (enmShadowMode)
+    {
+        case PGMMODE_32_BIT:
+            return pVM->pgm.s.HCPhys32BitPD;
+
+        case PGMMODE_PAE:
+        case PGMMODE_PAE_NX:
+            return pVM->pgm.s.HCPhysPaePDPT;
+
+        case PGMMODE_AMD64:
+        case PGMMODE_AMD64_NX:
+            return pVM->pgm.s.HCPhysPaePML4;
+
+        default:
+            AssertMsgFailed(("enmShadowMode=%d\n", enmShadowMode));
             return ~0;
     }
@@ -1245,5 +1272,5 @@
         return VINF_SUCCESS;
 #ifdef IN_RING3
-    return pgmR3ChangeMode(pVM, enmGuestMode);
+    return PGMR3ChangeMode(pVM, enmGuestMode);
 #else
     Log(("PGMChangeMode: returns VINF_PGM_CHANGE_MODE.\n"));
Index: trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 9025)
+++ trunk/src/VBox/VMM/VMMR0/HWSVMR0.cpp	(revision 9026)
@@ -610,5 +610,5 @@
         if (pVM->hwaccm.s.fNestedPaging)
         {
-            pVMCB->ctrl.u64NestedPagingCR3  = PGMGetHyperCR3(pVM);
+            pVMCB->ctrl.u64NestedPagingCR3  = PGMGetNestedCR3(pVM, PGMGetHostMode(pVM));
             pVMCB->guest.u64CR3             = pCtx->cr3;
         }
@@ -1292,5 +1292,5 @@
 
         /* Handle the pagefault trap for the nested shadow table. */
-        rc = PGMR0Trap0eHandlerNestedPaging(pVM, PGMGetShadowMode(pVM), errCode, CPUMCTX2CORE(pCtx), uFaultAddress);
+        rc = PGMR0Trap0eHandlerNestedPaging(pVM, PGMGetHostMode(pVM), errCode, CPUMCTX2CORE(pCtx), uFaultAddress);
         Log2(("PGMR0Trap0eHandlerNestedPaging %VGv returned %Vrc\n", pCtx->eip, rc));
         if (rc == VINF_SUCCESS)
