Index: trunk/src/VBox/VMM/DBGFMem.cpp
===================================================================
--- trunk/src/VBox/VMM/DBGFMem.cpp	(revision 19572)
+++ trunk/src/VBox/VMM/DBGFMem.cpp	(revision 19575)
@@ -205,13 +205,19 @@
 {
     AssertReturn(idCpu < pVM->cCPUs, VERR_INVALID_PARAMETER);
-
-    PVMREQ pReq;
-    int rc = VMR3ReqCallU(pVM->pUVM, idCpu, &pReq, RT_INDEFINITE_WAIT, 0,
-                          (PFNRT)dbgfR3MemRead, 5, pVM, idCpu, pAddress, pvBuf, cbRead);
-    if (RT_SUCCESS(rc))
-        rc = pReq->iStatus;
-    VMR3ReqFree(pReq);
-
-    return rc;
+    if ((pAddress->fFlags & DBGFADDRESS_FLAGS_TYPE_MASK) == DBGFADDRESS_FLAGS_RING0)
+    {
+        AssertCompile(sizeof(RTHCUINTPTR) == sizeof(pAddress->FlatPtr));
+        return VMMR3ReadR0Stack(pVM, idCpu, (RTHCUINTPTR)pAddress->FlatPtr, pvBuf, cbRead);
+    }
+    else
+    {
+        PVMREQ pReq;
+        int rc = VMR3ReqCallU(pVM->pUVM, idCpu, &pReq, RT_INDEFINITE_WAIT, 0,
+                              (PFNRT)dbgfR3MemRead, 5, pVM, idCpu, pAddress, pvBuf, cbRead);
+        if (RT_SUCCESS(rc))
+            rc = pReq->iStatus;
+        VMR3ReqFree(pReq);
+        return rc;
+    }
 }
 
Index: trunk/src/VBox/VMM/DBGFStack.cpp
===================================================================
--- trunk/src/VBox/VMM/DBGFStack.cpp	(revision 19572)
+++ trunk/src/VBox/VMM/DBGFStack.cpp	(revision 19575)
@@ -100,4 +100,5 @@
         case DBGFADDRESS_FLAGS_FAR32: cbStackItem = 4; break;
         case DBGFADDRESS_FLAGS_FAR64: cbStackItem = 8; break;
+        case DBGFADDRESS_FLAGS_RING0: cbStackItem = sizeof(RTHCUINTPTR); break;
         default:                      cbStackItem = 4; break; /// @todo 64-bit guests.
     }
@@ -281,4 +282,5 @@
                 case DBGFADDRESS_FLAGS_FAR32: pCur->enmReturnType = DBGFRETURNTYPE_NEAR32; break;
                 case DBGFADDRESS_FLAGS_FAR64: pCur->enmReturnType = DBGFRETURNTYPE_NEAR64; break;
+                case DBGFADDRESS_FLAGS_RING0: pCur->enmReturnType = (HC_ARCH_BITS == 64) ? DBGFRETURNTYPE_NEAR64 : DBGFRETURNTYPE_NEAR32; break;
                 default:                      pCur->enmReturnType = DBGFRETURNTYPE_NEAR32; break; /// @todo 64-bit guests
             }
@@ -405,8 +407,18 @@
      * Get the CPUM context pointer and pass it on the specified EMT.
      */
-    PCCPUMCTXCORE   pCtxCore = (enmCodeType == DBGFCODETYPE_GUEST)
-                             ? CPUMGetGuestCtxCore(VMMGetCpuById(pVM, idCpu))
-                             : CPUMGetHyperCtxCore(VMMGetCpuById(pVM, idCpu));
-    PVMREQ          pReq;
+    PCCPUMCTXCORE   pCtxCore;
+    switch (enmCodeType)
+    {
+    case DBGFCODETYPE_GUEST:
+        pCtxCore = CPUMGetGuestCtxCore(VMMGetCpuById(pVM, idCpu));
+        break;
+    case DBGFCODETYPE_HYPER:
+        pCtxCore = CPUMGetHyperCtxCore(VMMGetCpuById(pVM, idCpu));
+        break;
+    case DBGFCODETYPE_RING0:
+        pCtxCore = NULL;    /* No valid context present. */
+        break;
+    }
+    PVMREQ pReq;
     int rc = VMR3ReqCall(pVM, idCpu, &pReq, RT_INDEFINITE_WAIT,
                          (PFNRT)dbgfR3StackWalkCtxFull, 9,
@@ -441,12 +453,12 @@
  * @param   ppFirstFrame    Where to return the pointer to the first info frame.
  */
-VMMR3DECL(int) DBGFR3StackWalkBegintEx(PVM pVM,
-                                       VMCPUID idCpu,
-                                       DBGFCODETYPE enmCodeType,
-                                       PCDBGFADDRESS pAddrFrame,
-                                       PCDBGFADDRESS pAddrStack,
-                                       PCDBGFADDRESS pAddrPC,
-                                       DBGFRETURNTYPE enmReturnType,
-                                       PCDBGFSTACKFRAME *ppFirstFrame)
+VMMR3DECL(int) DBGFR3StackWalkBeginEx(PVM pVM,
+                                      VMCPUID idCpu,
+                                      DBGFCODETYPE enmCodeType,
+                                      PCDBGFADDRESS pAddrFrame,
+                                      PCDBGFADDRESS pAddrStack,
+                                      PCDBGFADDRESS pAddrPC,
+                                      DBGFRETURNTYPE enmReturnType,
+                                      PCDBGFSTACKFRAME *ppFirstFrame)
 {
     return dbgfR3StackWalkBeginCommon(pVM, idCpu, enmCodeType, pAddrFrame, pAddrStack, pAddrPC, enmReturnType, ppFirstFrame);
Index: trunk/src/VBox/VMM/VMM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMM.cpp	(revision 19572)
+++ trunk/src/VBox/VMM/VMM.cpp	(revision 19575)
@@ -1282,4 +1282,29 @@
 
 /**
+ * Read from the ring 0 jump buffer stack
+ *
+ * @returns VBox status code.
+ *
+ * @param   pVM             Pointer to the shared VM structure.
+ * @param   idCpu           The ID of the source CPU context (for the address).
+ * @param   pAddress        Where to start reading.
+ * @param   pvBuf           Where to store the data we've read.
+ * @param   cbRead          The number of bytes to read.
+ */
+VMMR3DECL(int) VMMR3ReadR0Stack(PVM pVM, VMCPUID idCpu, RTHCUINTPTR pAddress, void *pvBuf, size_t cbRead)
+{
+    PVMCPU  pVCpu   = VMMGetCpuById(pVM, idCpu);
+    AssertReturn(pVCpu, VERR_INVALID_PARAMETER);
+
+    RTHCUINTPTR offset = pAddress - pVCpu->vmm.s.CallHostR0JmpBuf.SpCheck;
+    if (offset >= pVCpu->vmm.s.CallHostR0JmpBuf.cbSavedStack)
+        return VERR_INVALID_POINTER;
+
+    memcpy(pvBuf, pVCpu->vmm.s.pbEMTStackR3 + offset, cbRead);
+    return VINF_SUCCESS;
+}
+
+
+/**
  * Calls a RC function.
  *
Index: trunk/src/VBox/VMM/VMMGuruMeditation.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMGuruMeditation.cpp	(revision 19572)
+++ trunk/src/VBox/VMM/VMMGuruMeditation.cpp	(revision 19575)
@@ -291,5 +291,19 @@
                 /* Callstack. */
                 PCDBGFSTACKFRAME pFirstFrame;
-                rc2 = DBGFR3StackWalkBegin(pVM, pVCpu->idCpu, DBGFCODETYPE_RING0, &pFirstFrame);
+                DBGFADDRESS eip, ebp, esp;
+
+                eip.fFlags   = DBGFADDRESS_FLAGS_RING0;
+#if HC_ARCH_BITS == 64
+                eip.FlatPtr = pVCpu->vmm.s.CallHostR0JmpBuf.rip;
+#else
+                eip.FlatPtr = pVCpu->vmm.s.CallHostR0JmpBuf.eip;
+#endif
+                ebp.fFlags   = DBGFADDRESS_FLAGS_RING0;
+                ebp.FlatPtr = pVCpu->vmm.s.CallHostR0JmpBuf.SavedEbp;
+                esp.fFlags   = DBGFADDRESS_FLAGS_RING0;
+                esp.FlatPtr = pVCpu->vmm.s.CallHostR0JmpBuf.SavedEsp;
+
+                rc2 = DBGFR3StackWalkBeginEx(pVM, pVCpu->idCpu, DBGFCODETYPE_RING0, &ebp, &esp, &eip,
+                                             DBGFRETURNTYPE_INVALID, &pFirstFrame);
                 if (RT_SUCCESS(rc2))
                 {
Index: trunk/src/VBox/VMM/VMMInternal.h
===================================================================
--- trunk/src/VBox/VMM/VMMInternal.h	(revision 19572)
+++ trunk/src/VBox/VMM/VMMInternal.h	(revision 19575)
@@ -157,4 +157,8 @@
     /** The esp we should resume execution with after the restore. */
     RTHCUINTREG                 SpResume;
+    /** ESP/RSP at the time of the jump to ring 3. */
+    RTHCUINTREG                 SavedEsp;
+    /** EBP/RBP at the time of the jump to ring 3. */
+    RTHCUINTREG                 SavedEbp;
 } VMMR0JMPBUF;
 /** Pointer to a ring-0 jump buffer. */
Index: trunk/src/VBox/VMM/VMMInternal.mac
===================================================================
--- trunk/src/VBox/VMM/VMMInternal.mac	(revision 19572)
+++ trunk/src/VBox/VMM/VMMInternal.mac	(revision 19575)
@@ -61,4 +61,6 @@
     .SpCheck        resq 1
     .SpResume       resq 1
+    .SavedEsp       resq 1
+    .SavedEbp       resq 1
 %endif
 endstruc
Index: trunk/src/VBox/VMM/VMMR0/VMMR0A.asm
===================================================================
--- trunk/src/VBox/VMM/VMMR0/VMMR0A.asm	(revision 19572)
+++ trunk/src/VBox/VMM/VMMR0/VMMR0A.asm	(revision 19575)
@@ -408,4 +408,10 @@
 %endif ; !VMM_R0_SWITCH_STACK
 
+    ; Save ESP & EBP to enable stack dumps
+    mov     ecx, ebp
+    mov     [edx + VMMR0JMPBUF.SavedEbp], ecx
+    sub     ecx, 4
+    mov     [edx + VMMR0JMPBUF.SavedEsp], ecx
+
     ; store the last pieces of info.
     mov     ecx, [edx + VMMR0JMPBUF.esp]
@@ -506,4 +512,10 @@
  %endif ; !VMM_R0_SWITCH_STACK
 
+    ; Save RSP & RBP to enable stack dumps
+    mov     rcx, rbp
+    mov     [rdx + VMMR0JMPBUF.SavedEbp], rcx
+    sub     rcx, 8
+    mov     [rdx + VMMR0JMPBUF.SavedEsp], rcx
+
     ; store the last pieces of info.
     mov     rcx, [rdx + VMMR0JMPBUF.rsp]
