Index: /trunk/include/VBox/cpum.h
===================================================================
--- /trunk/include/VBox/cpum.h	(revision 13173)
+++ /trunk/include/VBox/cpum.h	(revision 13174)
@@ -744,4 +744,15 @@
 
 /**
+ * Tests if the guest is running in paged protected or not.
+ *
+ * @returns true if in paged protected mode, otherwise false.
+ * @param   pVM     The VM handle.
+ */
+DECLINLINE(bool) CPUMIsGuestInPagedProtectedModeEx(PCPUMCTX pCtx)
+{
+    return (pCtx->cr0 & (X86_CR0_PE | X86_CR0_PG)) == (X86_CR0_PE | X86_CR0_PG);
+}
+
+/**
  * Tests if the guest is running in long mode or not.
  *
Index: /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 13173)
+++ /trunk/src/VBox/VMM/VMMR0/HWVMXR0.cpp	(revision 13174)
@@ -1076,15 +1076,15 @@
         if (pVM->hwaccm.s.fNestedPaging)
         {
-            if (!(pCtx->cr0 & X86_CR0_PG))
+            if (CPUMIsGuestInPagedProtectedModeEx(pCtx))
+            {
+                /* Disable cr3 read/write monitoring as we don't need it for EPT. */
+                pVM->hwaccm.s.vmx.proc_ctls &=  ~(  VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT 
+                                                  | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
+            }
+            else
             {
                 /* Reenable cr3 read/write monitoring as our identity mapped page table is active. */
                 pVM->hwaccm.s.vmx.proc_ctls |=   VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT 
                                                | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT;
-            }
-            else
-            {
-                /* Disable cr3 read/write monitoring as we don't need it for EPT. */
-                pVM->hwaccm.s.vmx.proc_ctls &=  ~(  VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_LOAD_EXIT 
-                                                  | VMX_VMCS_CTRL_PROC_EXEC_CONTROLS_CR3_STORE_EXIT);
             }
             rc = VMXWriteVMCS(VMX_VMCS_CTRL_PROC_EXEC_CONTROLS, pVM->hwaccm.s.vmx.proc_ctls);
@@ -1207,5 +1207,5 @@
             AssertRC(rc);
 
-            if (!(pCtx->cr0 & X86_CR0_PG))
+            if (!CPUMIsGuestInPagedProtectedModeEx(pCtx))
             {
                 RTGCPHYS GCPhys;
@@ -2446,5 +2446,5 @@
                 break;
             case 3:
-                Assert(!pVM->hwaccm.s.fNestedPaging || !(pCtx->cr0 & X86_CR0_PG));
+                Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx));
                 pVM->hwaccm.s.fContextUseFlags |= HWACCM_CHANGED_GUEST_CR3;
                 break;
@@ -2474,5 +2474,5 @@
             STAM_COUNTER_INC(&pVM->hwaccm.s.StatExitCRxRead);
 
-            Assert(!pVM->hwaccm.s.fNestedPaging || !(pCtx->cr0 & X86_CR0_PG) || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != USE_REG_CR3);
+            Assert(!pVM->hwaccm.s.fNestedPaging || !CPUMIsGuestInPagedProtectedModeEx(pCtx) || VMX_EXIT_QUALIFICATION_CRX_REGISTER(exitQualification) != USE_REG_CR3);
 
             /* CR8 reads only cause an exit when the TPR shadow feature isn't present. */