1. In a computing system comprised of a processor and virtualization software including a guest operating system (OS) that utilizes a guest domain access control register (DACR) containing domain access information and guest page tables including first level page tables (L1 page tables) and second level page tables (L2 page tables), which guest page tables contain (a) domain identifiers used to obtain domain access information from the guest DACR and (b) access permission information, wherein the domain access information and the access permission information are combined to provide an effective guest access permission; the virtualization software providing a shadow page table, wherein: (a) domain identifiers in the shadow page table are used to identify domain access information in the processor DACR that are mapped from the domain access information in the guest DACR; and (b) access permissions in the shadow page table that are mapped from the effective access permission information in the guest page tables and guest DACR; a memory management unit (MMU) in the processor traverses the shadow page table, accesses the processor DACR, and combines the mapped domain access information in the processor with the mapped access permission in the shadow page table to reflect the guest intended effective access permissions while isolating the guest from the virtualization software; the shadow page table comprises a shadow privilege page table that is traversed by the MMU when the guest operates in privileged mode and a shadow user page table that is traversed by the MMU when the guest operates in user mode; wherein: the shadow page table comprises shadow L1 page tables and shadow L2 page tables; and each L2 page table is identified by the following tuple: guest L1 descriptor value*{User, Privileged}*{Client, Manager} wherein: (a) the guest L1 descriptor value identifies a guest section the shadow L2 page table may back (referred to as L2-guest-L1); (b) {User, Privileged} (referred to as L2-us-pr) indicates whether the shadow L2 descriptor may be referenced by a shadow L1 descriptor used when the guest is executing in user mode or a shadow L1 descriptor used when the guest is executing in privileged mode; and (c) {Client, Manager} (referred to as L2-dom) matches the domain access value implied by any referencing shadow L1 descriptor in the current shadow page table with the current guest DACR a method for providing shadow page tables and processor DACR settings that virtualize processor memory protection, which method comprises: the virtualization software maintaining: two shadow L2 page tables for each section of guest address space covered by a shadow L1 descriptor, wherein one shadow L2 page table is used when the domain access value for the section in the guest DACR is Client access, and the other shadow L2 page table is used when the domain access value for the section in the guest DACR is Manager access; and a mapping (referred to as φ) from guest domain identifier to a set of shadow L2 page tables that back guest L1 sections marked with the domain identifier; and, with each such shadow L2 page table, a set of back-pointers to “potentially referencing” shadow L1 descriptors, where potentially referencing shadow L1 descriptors include: (a) shadow L1 descriptors that in the current state reference the shadow L2 page table; and (b) valid shadow L1 descriptors corresponding to guest L1 descriptors with value L2-guest-L1 and where the privilege level of the shadow L1 page table matches L2-us-pr.