shadow_addr = vcpu->mmu.root_hpa;
        level = vcpu->mmu.shadow_root_level;
+       if (level == PT32E_ROOT_LEVEL) {
+               shadow_addr = vcpu->mmu.pae_root[(addr >> 30) & 3];
+               shadow_addr &= PT64_BASE_ADDR_MASK;
+               --level;
+       }
 
        for (; ; level--) {
                u32 index = SHADOW_PT_INDEX(addr, level);
                shadow_addr = kvm_mmu_alloc_page(vcpu, shadow_ent);
                if (!VALID_PAGE(shadow_addr))
                        return ERR_PTR(-ENOMEM);
-               shadow_pte = shadow_addr | PT_PRESENT_MASK;
-               if (vcpu->mmu.root_level > 3 || level != 3)
-                       shadow_pte |= PT_ACCESSED_MASK
-                               | PT_WRITABLE_MASK | PT_USER_MASK;
+               shadow_pte = shadow_addr | PT_PRESENT_MASK | PT_ACCESSED_MASK
+                       | PT_WRITABLE_MASK | PT_USER_MASK;
                *shadow_ent = shadow_pte;
                prev_shadow_ent = shadow_ent;
        }