Index: /trunk/include/VBox/vmm/hm_svm.h
===================================================================
--- /trunk/include/VBox/vmm/hm_svm.h	(revision 68432)
+++ /trunk/include/VBox/vmm/hm_svm.h	(revision 68433)
@@ -996,12 +996,14 @@
     /** Cache of the TLB control. */
     SVMTLBCTRL          TLBCtrl;
-    /** Cache of V_INTR_MASKING bit. */
-    bool                fVIntrMasking;
+    /** @} */
+
+    /** @name Nested-guest VMCB guest state.
+     * @{ */
+    /** Cache of CR3. */
+    uint64_t            u64CR3;
     /** @} */
 
     /** @name Other miscellaneous state.
      * @{ */
-    /** Whether the fields above are updated or not. */
-    bool                fValid;
     /** Whether a VMRUN was just emulated in R0 and the VMCB is up to date. */
     bool                fVmrunEmulatedInR0;
@@ -1009,4 +1011,8 @@
      *  processing. */
     bool                fExitCodeAndInfoUpdated;
+    /** Cache of V_INTR_MASKING bit. */
+    bool                fVIntrMasking;
+    /** Whether the fields above are updated or not. */
+    bool                fValid;
     /** Alignment. */
     bool                afPadding0[4];
@@ -1019,5 +1025,4 @@
 typedef const SVMNESTEDVMCBCACHE *PCSVMNESTEDVMCBCACHE;
 /** @} */
-AssertCompileMemberAlignment(SVMNESTEDVMCBCACHE, fVIntrMasking, 8);
 AssertCompileSizeAlignment(SVMNESTEDVMCBCACHE, 8);
 
Index: /trunk/src/VBox/VMM/VMMAll/HMSVMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/HMSVMAll.cpp	(revision 68432)
+++ /trunk/src/VBox/VMM/VMMAll/HMSVMAll.cpp	(revision 68433)
@@ -349,5 +349,6 @@
     if (pNstGstVmcbCache->fValid)
     {
-        PSVMVMCBCTRL pVmcbNstGstCtrl = &pVmcbNstGst->ctrl;
+        PSVMVMCBCTRL      pVmcbNstGstCtrl  = &pVmcbNstGst->ctrl;
+        PSVMVMCBSTATESAVE pVmcbNstGstState =&pVmcbNstGst->guest;
         pVmcbNstGstCtrl->u16InterceptRdCRx        = pNstGstVmcbCache->u16InterceptRdCRx;
         pVmcbNstGstCtrl->u16InterceptWrCRx        = pNstGstVmcbCache->u16InterceptWrCRx;
@@ -356,4 +357,5 @@
         pVmcbNstGstCtrl->u32InterceptXcpt         = pNstGstVmcbCache->u32InterceptXcpt;
         pVmcbNstGstCtrl->u64InterceptCtrl         = pNstGstVmcbCache->u64InterceptCtrl;
+        pVmcbNstGstState->u64CR3                  = pNstGstVmcbCache->u64CR3;
         pVmcbNstGstCtrl->u64VmcbCleanBits         = pNstGstVmcbCache->u64VmcbCleanBits;
         pVmcbNstGstCtrl->u64IOPMPhysAddr          = pNstGstVmcbCache->u64IOPMPhysAddr;
Index: /trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 68432)
+++ /trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 68433)
@@ -1371,5 +1371,6 @@
     {
         Assert(!pVCpu->CTX_SUFF(pVM)->cpum.ro.GuestFeatures.fSvmNestedPaging);
-        pVmcbNstGst->guest.u64CR3 = pCtx->cr3;
+        int rc = PGMPhysGCPhys2HCPhys(pVCpu->CTX_SUFF(pVM), pCtx->cr3, &pVmcbNstGst->guest.u64CR3);
+        AssertRC(rc);
         pVmcbNstGst->ctrl.u64VmcbCleanBits &= ~HMSVM_VMCB_CLEAN_CRX_EFER;
         HMCPU_CF_CLEAR(pVCpu, HM_CHANGED_GUEST_CR3);
@@ -2039,4 +2040,5 @@
     PSVMVMCB            pVmcbNstGst      = pCtx->hwvirt.svm.CTX_SUFF(pVmcb);
     PSVMVMCBCTRL        pVmcbNstGstCtrl  = &pVmcbNstGst->ctrl;
+    PSVMVMCBSTATESAVE   pVmcbNstGstState = &pVmcbNstGst->guest;
     PSVMNESTEDVMCBCACHE pNstGstVmcbCache = &pVCpu->hm.s.svm.NstGstVmcbCache;
 
@@ -2047,4 +2049,5 @@
     pNstGstVmcbCache->u32InterceptXcpt  = pVmcbNstGstCtrl->u32InterceptXcpt;
     pNstGstVmcbCache->u64InterceptCtrl  = pVmcbNstGstCtrl->u64InterceptCtrl;
+    pNstGstVmcbCache->u64CR3            = pVmcbNstGstState->u64CR3;
     pNstGstVmcbCache->u64IOPMPhysAddr   = pVmcbNstGstCtrl->u64IOPMPhysAddr;
     pNstGstVmcbCache->u64MSRPMPhysAddr  = pVmcbNstGstCtrl->u64MSRPMPhysAddr;
@@ -2128,5 +2131,7 @@
     if (!pVCpu->hm.s.svm.NstGstVmcbCache.fVmrunEmulatedInR0)
     {
+        /* hmR0SvmLoadGuestVmcbNested needs to be called first which caches the VMCB fields and adjusts others. */
         hmR0SvmLoadGuestVmcbNested(pVCpu, pCtx);
+
         hmR0SvmLoadGuestControlRegsNested(pVCpu, pVmcbNstGst, pCtx);
         hmR0SvmLoadGuestSegmentRegs(pVCpu, pVmcbNstGst, pCtx);