Index: /trunk/src/VBox/VMM/PGMBth.h
===================================================================
--- /trunk/src/VBox/VMM/PGMBth.h	(revision 20124)
+++ /trunk/src/VBox/VMM/PGMBth.h	(revision 20125)
@@ -167,5 +167,5 @@
 
     /* contruct a fake address. */
-    GCPhysCR3 = RT_BIT_64(63);
+    GCPhysCR3 = PGMPOOL_PHYS_NON_PAGED;
     pVCpu->pgm.s.iShwUser      = SHW_POOL_ROOT_IDX;
     pVCpu->pgm.s.iShwUserTable = GCPhysCR3 >> PAGE_SHIFT;
Index: /trunk/src/VBox/VMM/PGMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/PGMInternal.h	(revision 20124)
+++ /trunk/src/VBox/VMM/PGMInternal.h	(revision 20125)
@@ -186,4 +186,13 @@
 #endif
 
+/** @} */
+
+/** @name PGM pool physical address flags
+ *
+ * These are bit markers for PGM pool physical addresses.
+ * @{ */
+#define PGMPOOL_PHYS_NON_PAGED          RT_BIT_64(63)
+#define PGMPOOL_PHYS_ACCESS_USER        RT_BIT_64(62)       /* set = user, cleared = supervisor */
+#define PGMPOOL_PHYS_ACCESS_RW          RT_BIT_64(61)       /* set = read/write, cleared = read-only. */
 /** @} */
 
Index: /trunk/src/VBox/VMM/PGMPhys.cpp
===================================================================
--- /trunk/src/VBox/VMM/PGMPhys.cpp	(revision 20124)
+++ /trunk/src/VBox/VMM/PGMPhys.cpp	(revision 20125)
@@ -3233,6 +3233,6 @@
             else
             {
-                /* Temporariliy disabled phycial handler(s), since the recompiler
-                   doesn't get notified when it's reset we'll have to pretend its
+                /* Temporarily disabled physical handler(s), since the recompiler
+                   doesn't get notified when it's reset we'll have to pretend it's
                    operating normally. */
                 if (pgmHandlerPhysicalIsAll(pVM, GCPhys))
@@ -3266,5 +3266,5 @@
             *ppv = (void *)((uintptr_t)pTlbe->pv | (GCPhys & PAGE_OFFSET_MASK));
             /** @todo mapping/locking hell; this isn't horribly efficient since
-             *        pgmPhysPageLoadIntoTlb will repeate the lookup we've done here. */
+             *        pgmPhysPageLoadIntoTlb will repeat the lookup we've done here. */
 
             Log6(("PGMR3PhysTlbGCPhys2Ptr: GCPhys=%RGp rc=%Rrc pPage=%R[pgmpage] *ppv=%p\n", GCPhys, rc, pPage, *ppv));
Index: /trunk/src/VBox/VMM/PGMShw.h
===================================================================
--- /trunk/src/VBox/VMM/PGMShw.h	(revision 20124)
+++ /trunk/src/VBox/VMM/PGMShw.h	(revision 20125)
@@ -180,5 +180,5 @@
 {
 #if PGM_SHW_TYPE == PGM_TYPE_NESTED || PGM_SHW_TYPE == PGM_TYPE_EPT
-    RTGCPHYS     GCPhysCR3 = RT_BIT_64(63);
+    RTGCPHYS     GCPhysCR3 = PGMPOOL_PHYS_NON_PAGED;
     PPGMPOOLPAGE pNewShwPageCR3;
     PVM          pVM       = pVCpu->pVMR3;
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 20124)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 20125)
@@ -2585,4 +2585,10 @@
             GCPhys |= (iPDDst & 1) * (PAGE_SIZE / 2);
 # endif
+            /* Modify the physical address to distinguish between different access types to prevent incorrect reuse of cached entries. */
+            if (PdeSrc.n.u1Write)
+                GCPhys |= PGMPOOL_PHYS_ACCESS_RW;
+            if (PdeSrc.n.u1User)
+                GCPhys |= PGMPOOL_PHYS_ACCESS_USER;
+
             rc = pgmPoolAlloc(pVM, GCPhys, BTH_PGMPOOLKIND_PT_FOR_PT, pShwPde->idx,      iPDDst, &pShwPage);
         }