Index: trunk/include/VBox/pdmcritsect.h
===================================================================
--- trunk/include/VBox/pdmcritsect.h	(revision 19592)
+++ trunk/include/VBox/pdmcritsect.h	(revision 19593)
@@ -72,5 +72,5 @@
 VMMR3DECL(int)  PDMR3CritSectDelete(PPDMCRITSECT pCritSect);
 VMMDECL(int)    PDMR3CritSectTerm(PVM pVM);
-VMMR3DECL(void) PDMR3CritSectFF(PVM pVM);
+VMMR3DECL(void) PDMR3CritSectFF(PVMCPU pVCpu);
 VMMR3DECL(uint32_t) PDMR3CritSectCountOwned(PVM pVM, char *pszNames, size_t cbNames);
 
Index: trunk/include/VBox/vm.h
===================================================================
--- trunk/include/VBox/vm.h	(revision 19592)
+++ trunk/include/VBox/vm.h	(revision 19593)
@@ -181,4 +181,13 @@
         char                padding[256];       /* multiple of 64 */
     } vmm;
+
+    /** PDM part. */
+    union
+    {
+#ifdef ___PDMInternal_h
+        struct PDMCPU       s;
+#endif
+        char                padding[128];       /* multiple of 64 */
+    } pdm;
 
     /** DBGF part.
@@ -240,6 +249,4 @@
 #define VM_FF_PDM_DMA_BIT                   4
 #define VM_FF_PDM_DMA                       RT_BIT_32(VM_FF_PDM_DMA_BIT)
-/** PDM critical section unlocking is pending, process promptly upon return to R3. */
-#define VM_FF_PDM_CRITSECT                  RT_BIT_32(5)
 /** This action forces the VM to call DBGF so DBGF can service debugger
  * requests in the emulation thread.
@@ -273,4 +280,6 @@
 /** This action forces the VM to schedule and run pending timer (TM). (bogus for now; needed for PATM backwards compatibility) */
 #define VMCPU_FF_TIMER                      RT_BIT_32(2)
+/** PDM critical section unlocking is pending, process promptly upon return to R3. */
+#define VMCPU_FF_PDM_CRITSECT               RT_BIT_32(5)
 /** This action forces the VM to service pending requests from other
  * thread or requests which must be executed in another context. */
@@ -325,7 +334,7 @@
 
 /** High priority post-execution actions. */
-#define VM_FF_HIGH_PRIORITY_POST_MASK           (VM_FF_PDM_CRITSECT | VM_FF_PGM_NO_MEMORY)
+#define VM_FF_HIGH_PRIORITY_POST_MASK           (VM_FF_PGM_NO_MEMORY)
 /** High priority post-execution actions. */
-#define VMCPU_FF_HIGH_PRIORITY_POST_MASK        (VMCPU_FF_CSAM_PENDING_ACTION)
+#define VMCPU_FF_HIGH_PRIORITY_POST_MASK        (VMCPU_FF_PDM_CRITSECT|VMCPU_FF_CSAM_PENDING_ACTION)
 
 /** Normal priority VM post-execution actions. */
@@ -353,7 +362,7 @@
 
 /** All the forced VM flags. */
-#define VM_FF_ALL_BUT_RAW_MASK                  (~(VM_FF_HIGH_PRIORITY_PRE_RAW_MASK | VM_FF_PDM_CRITSECT) | VM_FF_PGM_NO_MEMORY)
+#define VM_FF_ALL_BUT_RAW_MASK                  (~(VM_FF_HIGH_PRIORITY_PRE_RAW_MASK) | VM_FF_PGM_NO_MEMORY)
 /** All the forced VMCPU flags. */
-#define VMCPU_FF_ALL_BUT_RAW_MASK               (~(VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK | VMCPU_FF_CSAM_PENDING_ACTION))
+#define VMCPU_FF_ALL_BUT_RAW_MASK               (~(VMCPU_FF_HIGH_PRIORITY_PRE_RAW_MASK | VMCPU_FF_CSAM_PENDING_ACTION | VMCPU_FF_PDM_CRITSECT))
 
 /** @} */
Index: trunk/src/VBox/VMM/EM.cpp
===================================================================
--- trunk/src/VBox/VMM/EM.cpp	(revision 19592)
+++ trunk/src/VBox/VMM/EM.cpp	(revision 19593)
@@ -3256,6 +3256,6 @@
 static int emR3HighPriorityPostForcedActions(PVM pVM, PVMCPU pVCpu, int rc)
 {
-    if (VM_FF_ISPENDING(pVM, VM_FF_PDM_CRITSECT))
-        PDMR3CritSectFF(pVM);
+    if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_PDM_CRITSECT))
+        PDMR3CritSectFF(pVCpu);
 
     if (VMCPU_FF_ISPENDING(pVCpu, VMCPU_FF_CSAM_PENDING_ACTION))
Index: trunk/src/VBox/VMM/PDMCritSect.cpp
===================================================================
--- trunk/src/VBox/VMM/PDMCritSect.cpp	(revision 19592)
+++ trunk/src/VBox/VMM/PDMCritSect.cpp	(revision 19593)
@@ -295,14 +295,14 @@
  * Process the critical sections queued for ring-3 'leave'.
  *
- * @param   pVM         The VM handle.
- */
-VMMR3DECL(void) PDMR3CritSectFF(PVM pVM)
-{
-    Assert(pVM->pdm.s.cQueuedCritSectLeaves > 0);
-
-    const RTUINT c = pVM->pdm.s.cQueuedCritSectLeaves;
+ * @param   pVCpu         The VMCPU handle.
+ */
+VMMR3DECL(void) PDMR3CritSectFF(PVMCPU pVCpu)
+{
+    Assert(pVCpu->pdm.s.cQueuedCritSectLeaves > 0);
+
+    const RTUINT c = pVCpu->pdm.s.cQueuedCritSectLeaves;
     for (RTUINT i = 0; i < c; i++)
     {
-        PPDMCRITSECT pCritSect = pVM->pdm.s.apQueuedCritSectsLeaves[i];
+        PPDMCRITSECT pCritSect = pVCpu->pdm.s.apQueuedCritSectsLeaves[i];
         int rc = RTCritSectLeave(&pCritSect->s.Core);
         LogFlow(("PDMR3CritSectFF: %p - %Rrc\n", pCritSect, rc));
@@ -310,6 +310,6 @@
     }
 
-    pVM->pdm.s.cQueuedCritSectLeaves = 0;
-    VM_FF_CLEAR(pVM, VM_FF_PDM_CRITSECT);
+    pVCpu->pdm.s.cQueuedCritSectLeaves = 0;
+    VMCPU_FF_CLEAR(pVCpu, VMCPU_FF_PDM_CRITSECT);
 }
 
Index: trunk/src/VBox/VMM/PDMInternal.h
===================================================================
--- trunk/src/VBox/VMM/PDMInternal.h	(revision 19592)
+++ trunk/src/VBox/VMM/PDMInternal.h	(revision 19593)
@@ -797,4 +797,19 @@
 typedef struct PDMASYNCCOMPLETIONMANAGER *PPDMASYNCCOMPLETIONMANAGER;
 
+
+/**
+ * PDM VMCPU Instance data.
+ * Changes to this must checked against the padding of the cfgm union in VMCPU!
+ */
+typedef struct PDMCPU
+{
+    /** The number of entries in the apQueuedCritSectsLeaves table that's currnetly in use. */
+    RTUINT                          cQueuedCritSectLeaves;
+    RTUINT                          uPadding0; /**< Alignment padding.*/
+    /** Critical sections queued in RC/R0 because of contention preventing leave to complete. (R3 Ptrs)
+     * We will return to Ring-3 ASAP, so this queue doesn't have to be very long. */
+    R3PTRTYPE(PPDMCRITSECT)         apQueuedCritSectsLeaves[8];
+} PDMCPU;
+
 /**
  * Converts a PDM pointer into a VM pointer.
@@ -850,9 +865,5 @@
     RCPTRTYPE(PPDMQUEUE)            pDevHlpQueueRC;
 
-    /** The number of entries in the apQueuedCritSectsLeaves table that's currnetly in use. */
-    RTUINT                          cQueuedCritSectLeaves;
-    /** Critical sections queued in RC/R0 because of contention preventing leave to complete. (R3 Ptrs)
-     * We will return to Ring-3 ASAP, so this queue doesn't have to be very long. */
-    R3PTRTYPE(PPDMCRITSECT)         apQueuedCritSectsLeaves[8];
+    RTUINT                          uPadding1; /**< Alignment padding. */
 
     /** Linked list of timer driven PDM queues. */
@@ -867,5 +878,5 @@
     RCPTRTYPE(struct PDMQUEUE *)    pQueueFlushRC;
 #if HC_ARCH_BITS == 64
-    RTRCPTR                         padding0;
+    RTRCPTR                         uPadding2;
 #endif
 
Index: trunk/src/VBox/VMM/VMM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMM.cpp	(revision 19592)
+++ trunk/src/VBox/VMM/VMM.cpp	(revision 19593)
@@ -1687,5 +1687,4 @@
     PRINT_FLAG(VM_FF_,PDM_QUEUES);
     PRINT_FLAG(VM_FF_,PDM_DMA);
-    PRINT_FLAG(VM_FF_,PDM_CRITSECT);
     PRINT_FLAG(VM_FF_,DBGF);
     PRINT_FLAG(VM_FF_,REQUEST);
@@ -1728,4 +1727,5 @@
         PRINT_FLAG(VMCPU_FF_,INTERRUPT_APIC);
         PRINT_FLAG(VMCPU_FF_,INTERRUPT_PIC);
+        PRINT_FLAG(VMCPU_FF_,PDM_CRITSECT);
         PRINT_FLAG(VMCPU_FF_,PGM_SYNC_CR3);
         PRINT_FLAG(VMCPU_FF_,PGM_SYNC_CR3_NON_GLOBAL);
Index: trunk/src/VBox/VMM/VMMAll/PDMAllCritSect.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PDMAllCritSect.cpp	(revision 19592)
+++ trunk/src/VBox/VMM/VMMAll/PDMAllCritSect.cpp	(revision 19593)
@@ -253,9 +253,9 @@
      * Queue the request.
      */
-    RTUINT i = pVM->pdm.s.cQueuedCritSectLeaves++;
+    RTUINT i = pVCpu->pdm.s.cQueuedCritSectLeaves++;
     LogFlow(("PDMCritSectLeave: [%d]=%p => R3\n", i, pCritSect));
-    AssertFatal(i < RT_ELEMENTS(pVM->pdm.s.apQueuedCritSectsLeaves));
-    pVM->pdm.s.apQueuedCritSectsLeaves[i] = MMHyperCCToR3(pVM, pCritSect);
-    VM_FF_SET(pVM, VM_FF_PDM_CRITSECT);
+    AssertFatal(i < RT_ELEMENTS(pVCpu->pdm.s.apQueuedCritSectsLeaves));
+    pVCpu->pdm.s.apQueuedCritSectsLeaves[i] = MMHyperCCToR3(pVM, pCritSect);
+    VMCPU_FF_SET(pVCpu, VMCPU_FF_PDM_CRITSECT);
     VMCPU_FF_SET(pVCpu, VMCPU_FF_TO_R3);
     STAM_REL_COUNTER_INC(&pVM->pdm.s.StatQueuedCritSectLeaves);
Index: trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 19592)
+++ trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 19593)
@@ -332,6 +332,6 @@
     GEN_CHECK_OFF(PDM, pDevHlpQueueR0);
     GEN_CHECK_OFF(PDM, pDevHlpQueueRC);
-    GEN_CHECK_OFF(PDM, cQueuedCritSectLeaves);
-    GEN_CHECK_OFF(PDM, apQueuedCritSectsLeaves);
+    GEN_CHECK_OFF(PDMCPU, cQueuedCritSectLeaves);
+    GEN_CHECK_OFF(PDMCPU, apQueuedCritSectsLeaves);
     GEN_CHECK_OFF(PDM, pQueuesTimer);
     GEN_CHECK_OFF(PDM, pQueuesForced);
