Index: trunk/src/VBox/VMM/VMMAll/IOMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IOMAll.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/IOMAll.cpp	(revision 90346)
@@ -108,5 +108,5 @@
          * Call the device.
          */
-        VBOXSTRICTRC rcStrict = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_IOPORT_READ);
+        VBOXSTRICTRC rcStrict = PDMCritSectEnter(pVM, pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_IOPORT_READ);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -114,5 +114,5 @@
             rcStrict = pfnInCallback(pDevIns, pvUser, fFlags & IOM_IOPORT_F_ABS ? Port : offPort, pu32Value, (unsigned)cbValue);
             STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfIn), a);
-            PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
+            PDMCritSectLeave(pVM, pDevIns->CTX_SUFF(pCritSectRo));
 
 #ifndef IN_RING3
@@ -236,5 +236,5 @@
          * Call the device.
          */
-        VBOXSTRICTRC rcStrict = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_IOPORT_READ);
+        VBOXSTRICTRC rcStrict = PDMCritSectEnter(pVM, pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_IOPORT_READ);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -282,5 +282,5 @@
                          && rcStrict == VINF_SUCCESS);
             }
-            PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
+            PDMCritSectLeave(pVM, pDevIns->CTX_SUFF(pCritSectRo));
 
 #ifdef VBOX_WITH_STATISTICS
@@ -408,5 +408,5 @@
          * Call the device.
          */
-        VBOXSTRICTRC rcStrict = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_IOPORT_WRITE);
+        VBOXSTRICTRC rcStrict = PDMCritSectEnter(pVM, pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_IOPORT_WRITE);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -415,5 +415,5 @@
             STAM_PROFILE_STOP(&pStats->CTX_SUFF_Z(ProfOut), a);
 
-            PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
+            PDMCritSectLeave(pVM, pDevIns->CTX_SUFF(pCritSectRo));
 
 #ifdef VBOX_WITH_STATISTICS
@@ -522,5 +522,5 @@
          * Call the device.
          */
-        VBOXSTRICTRC rcStrict = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_IOPORT_WRITE);
+        VBOXSTRICTRC rcStrict = PDMCritSectEnter(pVM, pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_IOPORT_WRITE);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -562,5 +562,5 @@
             }
 
-            PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
+            PDMCritSectLeave(pVM, pDevIns->CTX_SUFF(pCritSectRo));
 
 #ifdef VBOX_WITH_STATISTICS
Index: trunk/src/VBox/VMM/VMMAll/IOMAllMmioNew.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IOMAllMmioNew.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/IOMAllMmioNew.cpp	(revision 90346)
@@ -368,5 +368,5 @@
 # endif
     PPDMDEVINS const         pDevIns = pRegEntry->pDevIns;
-    int rc = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VERR_IGNORED);
+    int rc = PDMCritSectEnter(pVM, pDevIns->CTX_SUFF(pCritSectRo), VERR_IGNORED);
     AssertRCReturn(rc, rc);
 
@@ -375,5 +375,5 @@
                                            IOM_MMIO_STATS_COMMA_ARG);
 
-    PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
+    PDMCritSectLeave(pVM, pDevIns->CTX_SUFF(pCritSectRo));
     STAM_PROFILE_STOP(&pStats->ProfWriteR3, Prf);
     return rcStrict;
@@ -670,5 +670,5 @@
          * Note! Perhaps not a good move?
          */
-        rcStrict = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_MMIO_READ_WRITE);
+        rcStrict = PDMCritSectEnter(pVM, pDevIns->CTX_SUFF(pCritSectRo), VINF_IOM_R3_MMIO_READ_WRITE);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -681,5 +681,5 @@
 
 #ifndef IN_RING3
-            PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
+            PDMCritSectLeave(pVM, pDevIns->CTX_SUFF(pCritSectRo));
 #endif
             if (RT_SUCCESS(rcStrict))
@@ -910,5 +910,5 @@
      *       NULL.  This is supposed to be an unlikely case, so not optimized yet.
      */
-    VBOXSTRICTRC rcStrict = PDMCritSectEnter(pDevIns->CTX_SUFF(pCritSectRo), rcToRing3);
+    VBOXSTRICTRC rcStrict = PDMCritSectEnter(pVM, pDevIns->CTX_SUFF(pCritSectRo), rcToRing3);
     if (rcStrict == VINF_SUCCESS)
     {
@@ -920,5 +920,5 @@
             rcStrict = iomMmioDoRead(pVM, pRegEntry, GCPhysFault, offRegion, pvBuf, (uint32_t)cbBuf IOM_MMIO_STATS_COMMA_ARG);
 
-            PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
+            PDMCritSectLeave(pVM, pDevIns->CTX_SUFF(pCritSectRo));
 #ifndef IN_RING3
             if (rcStrict == VINF_IOM_R3_MMIO_READ)
@@ -938,5 +938,5 @@
              */
             rcStrict = iomMmioDoWrite(pVM, pVCpu, pRegEntry, GCPhysFault, offRegion, pvBuf, (uint32_t)cbBuf IOM_MMIO_STATS_COMMA_ARG);
-            PDMCritSectLeave(pDevIns->CTX_SUFF(pCritSectRo));
+            PDMCritSectLeave(pVM, pDevIns->CTX_SUFF(pCritSectRo));
 #ifndef IN_RING3
             if (rcStrict == VINF_IOM_R3_MMIO_WRITE)
Index: trunk/src/VBox/VMM/VMMAll/MMAllHyper.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/MMAllHyper.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/MMAllHyper.cpp	(revision 90346)
@@ -166,5 +166,5 @@
     Assert(PDMCritSectIsInitialized(&pHeap->Lock));
 #endif
-    int rc = PDMCritSectEnter(&pHeap->Lock, VERR_SEM_BUSY);
+    int rc = PDMCritSectEnter(pVM, &pHeap->Lock, VERR_SEM_BUSY);
 #ifdef IN_RING0
     if (rc == VERR_SEM_BUSY)
@@ -181,5 +181,5 @@
  * @param   pVM     The cross context VM structure.
  */
-static void mmHyperUnlock(PVM pVM)
+static void mmHyperUnlock(PVMCC pVM)
 {
     PMMHYPERHEAP pHeap = pVM->mm.s.CTX_SUFF(pHyperHeap);
@@ -190,5 +190,5 @@
 #endif
     Assert(PDMCritSectIsInitialized(&pHeap->Lock));
-    PDMCritSectLeave(&pHeap->Lock);
+    PDMCritSectLeave(pVM, &pHeap->Lock);
 }
 
Index: trunk/src/VBox/VMM/VMMAll/PDMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PDMAll.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/PDMAll.cpp	(revision 90346)
@@ -307,7 +307,7 @@
 {
 #ifdef IN_RING3
-    int rc = PDMCritSectEnter(&pVM->pdm.s.CritSect, VERR_IGNORED);
+    int rc = PDMCritSectEnter(pVM, &pVM->pdm.s.CritSect, VERR_IGNORED);
 #else
-    int rc = PDMCritSectEnter(&pVM->pdm.s.CritSect, VERR_GENERAL_FAILURE);
+    int rc = PDMCritSectEnter(pVM, &pVM->pdm.s.CritSect, VERR_GENERAL_FAILURE);
     if (rc == VERR_GENERAL_FAILURE)
         rc = VMMRZCallRing3NoCpu(pVM, VMMCALLRING3_PDM_LOCK, 0);
@@ -327,5 +327,5 @@
 int pdmLockEx(PVMCC pVM, int rc)
 {
-    return PDMCritSectEnter(&pVM->pdm.s.CritSect, rc);
+    return PDMCritSectEnter(pVM, &pVM->pdm.s.CritSect, rc);
 }
 
@@ -338,5 +338,5 @@
 void pdmUnlock(PVMCC pVM)
 {
-    PDMCritSectLeave(&pVM->pdm.s.CritSect);
+    PDMCritSectLeave(pVM, &pVM->pdm.s.CritSect);
 }
 
@@ -348,7 +348,7 @@
  * @param   pVM     The cross context VM structure.
  */
-bool pdmLockIsOwner(PCVMCC pVM)
-{
-    return PDMCritSectIsOwner(&pVM->pdm.s.CritSect);
+bool pdmLockIsOwner(PVMCC pVM)
+{
+    return PDMCritSectIsOwner(pVM, &pVM->pdm.s.CritSect);
 }
 
Index: trunk/src/VBox/VMM/VMMAll/PDMAllCritSect.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PDMAllCritSect.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/PDMAllCritSect.cpp	(revision 90346)
@@ -67,17 +67,17 @@
  *
  * @returns native thread handle (ring-3).
- * @param   pCritSect           The critical section. This is used in R0 and RC.
- */
-DECL_FORCE_INLINE(RTNATIVETHREAD) pdmCritSectGetNativeSelf(PCPDMCRITSECT pCritSect)
+ * @param   pVM         The cross context VM structure.
+ * @param   pCritSect   The critical section. This is used in R0 and RC.
+ */
+DECL_FORCE_INLINE(RTNATIVETHREAD) pdmCritSectGetNativeSelf(PVMCC pVM, PCPDMCRITSECT pCritSect)
 {
 #ifdef IN_RING3
-    NOREF(pCritSect);
+    RT_NOREF(pVM, pCritSect);
     RTNATIVETHREAD  hNativeSelf = RTThreadNativeSelf();
 #else
     AssertMsgReturn(pCritSect->s.Core.u32Magic == RTCRITSECT_MAGIC, ("%RX32\n", pCritSect->s.Core.u32Magic),
                     NIL_RTNATIVETHREAD);
-    PVMCC           pVM         = pCritSect->s.CTX_SUFF(pVM); AssertPtr(pVM);
-    PVMCPUCC        pVCpu       = VMMGetCpu(pVM);             AssertPtr(pVCpu);
-    RTNATIVETHREAD  hNativeSelf = pVCpu->hNativeThread;       Assert(hNativeSelf != NIL_RTNATIVETHREAD);
+    PVMCPUCC        pVCpu       = VMMGetCpu(pVM);                                       AssertPtr(pVCpu);
+    RTNATIVETHREAD  hNativeSelf = pVCpu ? pVCpu->hNativeThread : NIL_RTNATIVETHREAD;    Assert(hNativeSelf != NIL_RTNATIVETHREAD);
 #endif
     return hNativeSelf;
@@ -125,9 +125,10 @@
  * @retval  VERR_SEM_DESTROYED if destroyed.
  *
+ * @param   pVM                 The cross context VM structure.
  * @param   pCritSect           The critsect.
  * @param   hNativeSelf         The native thread handle.
  * @param   pSrcPos             The source position of the lock operation.
  */
-static int pdmR3R0CritSectEnterContended(PPDMCRITSECT pCritSect, RTNATIVETHREAD hNativeSelf, PCRTLOCKVALSRCPOS pSrcPos)
+static int pdmR3R0CritSectEnterContended(PVMCC pVM, PPDMCRITSECT pCritSect, RTNATIVETHREAD hNativeSelf, PCRTLOCKVALSRCPOS pSrcPos)
 {
     /*
@@ -201,8 +202,9 @@
                  it without creating a race with PDMCritSectLeave, resulting in
                  spurious wakeups. */
-        PVMCC     pVM   = pCritSect->s.CTX_SUFF(pVM); AssertPtr(pVM);
-        PVMCPUCC  pVCpu = VMMGetCpu(pVM);             AssertPtr(pVCpu);
+        PVMCPUCC pVCpu = VMMGetCpu(pVM); AssertPtr(pVCpu);
         rc = VMMRZCallRing3(pVM, pVCpu, VMMCALLRING3_VM_R0_PREEMPT, NULL);
         AssertRC(rc);
+# else
+        RT_NOREF(pVM);
 # endif
     }
@@ -220,9 +222,10 @@
  *          during the operation.
  *
+ * @param   pVM                 The cross context VM structure.
  * @param   pCritSect           The PDM critical section to enter.
  * @param   rcBusy              The status code to return when we're in GC or R0
  * @param   pSrcPos             The source position of the lock operation.
  */
-DECL_FORCE_INLINE(int) pdmCritSectEnter(PPDMCRITSECT pCritSect, int rcBusy, PCRTLOCKVALSRCPOS pSrcPos)
+DECL_FORCE_INLINE(int) pdmCritSectEnter(PVMCC pVM, PPDMCRITSECT pCritSect, int rcBusy, PCRTLOCKVALSRCPOS pSrcPos)
 {
     Assert(pCritSect->s.Core.cNestings < 8);  /* useful to catch incorrect locking */
@@ -245,5 +248,6 @@
         return VINF_SUCCESS;
 
-    RTNATIVETHREAD hNativeSelf = pdmCritSectGetNativeSelf(pCritSect);
+    Assert(pCritSect->s.CTX_SUFF(pVM) == pVM); RT_NOREF(pVM);
+    RTNATIVETHREAD hNativeSelf = pdmCritSectGetNativeSelf(pVM, pCritSect);
     /* ... not owned ... */
     if (ASMAtomicCmpXchgS32(&pCritSect->s.Core.cLockers, 0, -1))
@@ -286,5 +290,5 @@
      */
     NOREF(rcBusy);
-    return pdmR3R0CritSectEnterContended(pCritSect, hNativeSelf, pSrcPos);
+    return pdmR3R0CritSectEnterContended(pVM, pCritSect, hNativeSelf, pSrcPos);
 
 #else
@@ -320,5 +324,5 @@
         {
             STAM_REL_COUNTER_ADD(&pCritSect->s.StatContentionRZLock,    1000000);
-            rc = pdmR3R0CritSectEnterContended(pCritSect, hNativeSelf, pSrcPos);
+            rc = pdmR3R0CritSectEnterContended(pVM, pCritSect, hNativeSelf, pSrcPos);
         }
         else
@@ -330,5 +334,5 @@
             RTThreadPreemptRestore(NIL_RTTHREAD, XXX);
 
-            rc = pdmR3R0CritSectEnterContended(pCritSect, hNativeSelf, pSrcPos);
+            rc = pdmR3R0CritSectEnterContended(pVM, pCritSect, hNativeSelf, pSrcPos);
 
             RTThreadPreemptDisable(NIL_RTTHREAD, XXX);
@@ -343,5 +347,5 @@
     if (   RTThreadPreemptIsEnabled(NIL_RTTHREAD)
         && ASMIntAreEnabled())
-        return pdmR3R0CritSectEnterContended(pCritSect, hNativeSelf, pSrcPos);
+        return pdmR3R0CritSectEnterContended(pVM, pCritSect, hNativeSelf, pSrcPos);
 #  endif
 # endif /* IN_RING0 */
@@ -354,6 +358,6 @@
     if (rcBusy == VINF_SUCCESS)
     {
-        PVMCC     pVM   = pCritSect->s.CTX_SUFF(pVM); AssertPtr(pVM);
-        PVMCPUCC  pVCpu = VMMGetCpu(pVM);             AssertPtr(pVCpu);
+        PVMCPUCC pVCpu = VMMGetCpu(pVM);
+        AssertReturn(pVCpu, VERR_PDM_CRITSECT_IPE);
         return VMMRZCallRing3(pVM, pVCpu, VMMCALLRING3_PDM_CRIT_SECT_ENTER, MMHyperCCToR3(pVM, pCritSect));
     }
@@ -376,4 +380,5 @@
  *          during the operation.
  *
+ * @param   pVM                 The cross context VM structure.
  * @param   pCritSect           The PDM critical section to enter.
  * @param   rcBusy              The status code to return when we're in RC or R0
@@ -382,11 +387,11 @@
  *                              call if necessary.
  */
-VMMDECL(int) PDMCritSectEnter(PPDMCRITSECT pCritSect, int rcBusy)
+VMMDECL(int) PDMCritSectEnter(PVMCC pVM, PPDMCRITSECT pCritSect, int rcBusy)
 {
 #ifndef PDMCRITSECT_STRICT
-    return pdmCritSectEnter(pCritSect, rcBusy, NULL);
+    return pdmCritSectEnter(pVM, pCritSect, rcBusy, NULL);
 #else
     RTLOCKVALSRCPOS SrcPos = RTLOCKVALSRCPOS_INIT_NORMAL_API();
-    return pdmCritSectEnter(pCritSect, rcBusy, &SrcPos);
+    return pdmCritSectEnter(pVM, pCritSect, rcBusy, &SrcPos);
 #endif
 }
@@ -401,4 +406,5 @@
  *          during the operation.
  *
+ * @param   pVM                 The cross context VM structure.
  * @param   pCritSect           The PDM critical section to enter.
  * @param   rcBusy              The status code to return when we're in RC or R0
@@ -411,12 +417,12 @@
  *                              acquired from.  Optional.
  */
-VMMDECL(int) PDMCritSectEnterDebug(PPDMCRITSECT pCritSect, int rcBusy, RTHCUINTPTR uId, RT_SRC_POS_DECL)
+VMMDECL(int) PDMCritSectEnterDebug(PVMCC pVM, PPDMCRITSECT pCritSect, int rcBusy, RTHCUINTPTR uId, RT_SRC_POS_DECL)
 {
 #ifdef PDMCRITSECT_STRICT
     RTLOCKVALSRCPOS SrcPos = RTLOCKVALSRCPOS_INIT_DEBUG_API();
-    return pdmCritSectEnter(pCritSect, rcBusy, &SrcPos);
+    return pdmCritSectEnter(pVM, pCritSect, rcBusy, &SrcPos);
 #else
     NOREF(uId); RT_SRC_POS_NOREF();
-    return pdmCritSectEnter(pCritSect, rcBusy, NULL);
+    return pdmCritSectEnter(pVM, pCritSect, rcBusy, NULL);
 #endif
 }
@@ -432,8 +438,9 @@
  *          during the operation.
  *
+ * @param   pVM         The cross context VM structure.
  * @param   pCritSect   The critical section.
  * @param   pSrcPos     The source position of the lock operation.
  */
-static int pdmCritSectTryEnter(PPDMCRITSECT pCritSect, PCRTLOCKVALSRCPOS pSrcPos)
+static int pdmCritSectTryEnter(PVMCC pVM, PPDMCRITSECT pCritSect, PCRTLOCKVALSRCPOS pSrcPos)
 {
     /*
@@ -453,5 +460,6 @@
         return VINF_SUCCESS;
 
-    RTNATIVETHREAD hNativeSelf = pdmCritSectGetNativeSelf(pCritSect);
+    Assert(pCritSect->s.CTX_SUFF(pVM) == pVM);
+    RTNATIVETHREAD hNativeSelf = pdmCritSectGetNativeSelf(pVM, pCritSect);
     /* ... not owned ... */
     if (ASMAtomicCmpXchgS32(&pCritSect->s.Core.cLockers, 0, -1))
@@ -495,13 +503,14 @@
  *          during the operation.
  *
+ * @param   pVM         The cross context VM structure.
  * @param   pCritSect   The critical section.
  */
-VMMDECL(int) PDMCritSectTryEnter(PPDMCRITSECT pCritSect)
+VMMDECL(int) PDMCritSectTryEnter(PVMCC pVM, PPDMCRITSECT pCritSect)
 {
 #ifndef PDMCRITSECT_STRICT
-    return pdmCritSectTryEnter(pCritSect, NULL);
+    return pdmCritSectTryEnter(pVM, pCritSect, NULL);
 #else
     RTLOCKVALSRCPOS SrcPos = RTLOCKVALSRCPOS_INIT_NORMAL_API();
-    return pdmCritSectTryEnter(pCritSect, &SrcPos);
+    return pdmCritSectTryEnter(pVM, pCritSect, &SrcPos);
 #endif
 }
@@ -517,4 +526,5 @@
  *          during the operation.
  *
+ * @param   pVM                 The cross context VM structure.
  * @param   pCritSect           The critical section.
  * @param   uId                 Some kind of locking location ID.  Typically a
@@ -523,12 +533,12 @@
  *                              acquired from.  Optional.
  */
-VMMDECL(int) PDMCritSectTryEnterDebug(PPDMCRITSECT pCritSect, RTHCUINTPTR uId, RT_SRC_POS_DECL)
+VMMDECL(int) PDMCritSectTryEnterDebug(PVMCC pVM, PPDMCRITSECT pCritSect, RTHCUINTPTR uId, RT_SRC_POS_DECL)
 {
 #ifdef PDMCRITSECT_STRICT
     RTLOCKVALSRCPOS SrcPos = RTLOCKVALSRCPOS_INIT_DEBUG_API();
-    return pdmCritSectTryEnter(pCritSect, &SrcPos);
+    return pdmCritSectTryEnter(pVM, pCritSect, &SrcPos);
 #else
     NOREF(uId); RT_SRC_POS_NOREF();
-    return pdmCritSectTryEnter(pCritSect, NULL);
+    return pdmCritSectTryEnter(pVM, pCritSect, NULL);
 #endif
 }
@@ -544,10 +554,11 @@
  *          during the operation.
  *
+ * @param   pVM                 The cross context VM structure.
  * @param   pCritSect           The PDM critical section to enter.
  * @param   fCallRing3          Whether this is a VMMRZCallRing3()request.
  */
-VMMR3DECL(int) PDMR3CritSectEnterEx(PPDMCRITSECT pCritSect, bool fCallRing3)
-{
-    int rc = PDMCritSectEnter(pCritSect, VERR_IGNORED);
+VMMR3DECL(int) PDMR3CritSectEnterEx(PVM pVM, PPDMCRITSECT pCritSect, bool fCallRing3)
+{
+    int rc = PDMCritSectEnter(pVM, pCritSect, VERR_IGNORED);
     if (    rc == VINF_SUCCESS
         &&  fCallRing3
@@ -568,7 +579,8 @@
  * @retval  VERR_NOT_OWNER if you somehow ignore release assertions.
  *
- * @param   pCritSect           The PDM critical section to leave.
- */
-VMMDECL(int) PDMCritSectLeave(PPDMCRITSECT pCritSect)
+ * @param   pVM         The cross context VM structure.
+ * @param   pCritSect   The PDM critical section to leave.
+ */
+VMMDECL(int) PDMCritSectLeave(PVMCC pVM, PPDMCRITSECT pCritSect)
 {
     AssertMsg(pCritSect->s.Core.u32Magic == RTCRITSECT_MAGIC, ("%p %RX32\n", pCritSect, pCritSect->s.Core.u32Magic));
@@ -584,5 +596,6 @@
      * Always check that the caller is the owner (screw performance).
      */
-    RTNATIVETHREAD const hNativeSelf = pdmCritSectGetNativeSelf(pCritSect);
+    Assert(pCritSect->s.CTX_SUFF(pVM) == pVM); RT_NOREF(pVM);
+    RTNATIVETHREAD const hNativeSelf = pdmCritSectGetNativeSelf(pVM, pCritSect);
     AssertReleaseMsgReturn(pCritSect->s.Core.NativeThreadOwner == hNativeSelf,
                            ("%p %s: %p != %p; cLockers=%d cNestings=%d\n", pCritSect, R3STRING(pCritSect->s.pszName),
@@ -648,5 +661,5 @@
             /* Someone is waiting, wake up one of them. */
             SUPSEMEVENT     hEvent   = (SUPSEMEVENT)pCritSect->s.Core.EventSem;
-            PSUPDRVSESSION  pSession = pCritSect->s.CTX_SUFF(pVM)->pSession;
+            PSUPDRVSESSION  pSession = pVM->pSession;
             int rc = SUPSemEventSignal(pSession, hEvent);
             AssertRC(rc);
@@ -659,5 +672,5 @@
         {
             Log8(("Signalling %#p\n", hEventToSignal));
-            int rc = SUPSemEventSignal(pCritSect->s.CTX_SUFF(pVM)->pSession, hEventToSignal);
+            int rc = SUPSemEventSignal(pVM->pSession, hEventToSignal);
             AssertRC(rc);
         }
@@ -707,5 +720,4 @@
          * Queue the request.
          */
-        PVMCC       pVM   = pCritSect->s.CTX_SUFF(pVM);     AssertPtr(pVM);
         PVMCPUCC    pVCpu = VMMGetCpu(pVM);                 AssertPtr(pVCpu);
         uint32_t    i     = pVCpu->pdm.s.cQueuedCritSectLeaves++;
@@ -762,14 +774,16 @@
  * @returns true if owner.
  * @returns false if not owner.
+ * @param   pVM         The cross context VM structure.
  * @param   pCritSect   The critical section.
  */
-VMMDECL(bool) PDMCritSectIsOwner(PCPDMCRITSECT pCritSect)
+VMMDECL(bool) PDMCritSectIsOwner(PVMCC pVM, PCPDMCRITSECT pCritSect)
 {
 #ifdef IN_RING3
+    RT_NOREF(pVM);
     return RTCritSectIsOwner(&pCritSect->s.Core);
 #else
-    PVMCC     pVM   = pCritSect->s.CTX_SUFF(pVM); AssertPtr(pVM);
-    PVMCPUCC  pVCpu = VMMGetCpu(pVM);             AssertPtr(pVCpu);
-    if (pCritSect->s.Core.NativeThreadOwner != pVCpu->hNativeThread)
+    PVMCPUCC pVCpu = VMMGetCpu(pVM);
+    if (   !pVCpu
+        || pCritSect->s.Core.NativeThreadOwner != pVCpu->hNativeThread)
         return false;
     return (pCritSect->s.Core.fFlags & PDMCRITSECT_FLAGS_PENDING_UNLOCK) == 0
@@ -784,8 +798,8 @@
  * @returns true if owner.
  * @returns false if not owner.
+ * @param   pVCpu       The cross context virtual CPU structure.
  * @param   pCritSect   The critical section.
- * @param   pVCpu       The cross context virtual CPU structure.
- */
-VMMDECL(bool) PDMCritSectIsOwnerEx(PCPDMCRITSECT pCritSect, PVMCPUCC pVCpu)
+ */
+VMMDECL(bool) PDMCritSectIsOwnerEx(PVMCPUCC pVCpu, PCPDMCRITSECT pCritSect)
 {
 #ifdef IN_RING3
@@ -807,10 +821,11 @@
  * @returns true if someone is waiting.
  * @returns false if no one is waiting.
+ * @param   pVM         The cross context VM structure.
  * @param   pCritSect   The critical section.
  */
-VMMDECL(bool) PDMCritSectHasWaiters(PCPDMCRITSECT pCritSect)
+VMMDECL(bool) PDMCritSectHasWaiters(PVMCC pVM, PCPDMCRITSECT pCritSect)
 {
     AssertReturn(pCritSect->s.Core.u32Magic == RTCRITSECT_MAGIC, false);
-    Assert(pCritSect->s.Core.NativeThreadOwner == pdmCritSectGetNativeSelf(pCritSect));
+    Assert(pCritSect->s.Core.NativeThreadOwner == pdmCritSectGetNativeSelf(pVM, pCritSect)); RT_NOREF(pVM);
     return pCritSect->s.Core.cLockers >= pCritSect->s.Core.cNestings;
 }
Index: trunk/src/VBox/VMM/VMMAll/PDMAllCritSectBoth.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PDMAllCritSectBoth.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/PDMAllCritSectBoth.cpp	(revision 90346)
@@ -36,7 +36,8 @@
  * Process the critical sections (both types) queued for ring-3 'leave'.
  *
+ * @param   pVM           The cross context VM structure.
  * @param   pVCpu         The cross context virtual CPU structure.
  */
-VMM_INT_DECL(void) PDMCritSectBothFF(PVMCPUCC pVCpu)
+VMM_INT_DECL(void) PDMCritSectBothFF(PVMCC pVM, PVMCPUCC pVCpu)
 {
     uint32_t i;
@@ -88,5 +89,5 @@
 # endif
 
-        PDMCritSectLeave(pCritSect);
+        PDMCritSectLeave(pVM, pCritSect);
         LogFlow(("PDMR3CritSectFF: %p\n", pCritSect));
     }
Index: trunk/src/VBox/VMM/VMMAll/PDMAllNetShaper.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PDMAllNetShaper.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/PDMAllNetShaper.cpp	(revision 90346)
@@ -36,5 +36,5 @@
  * @param   cbTransfer      Number of bytes to allocate.
  */
-VMMDECL(bool) PDMNsAllocateBandwidth(PPDMNSFILTER pFilter, size_t cbTransfer)
+VMM_INT_DECL(bool) PDMNetShaperAllocateBandwidth(PVMCC pVM, PPDMNSFILTER pFilter, size_t cbTransfer)
 {
     AssertPtrReturn(pFilter, true);
@@ -43,5 +43,5 @@
 
     PPDMNSBWGROUP pBwGroup = ASMAtomicReadPtrT(&pFilter->CTX_SUFF(pBwGroup), PPDMNSBWGROUP);
-    int rc = PDMCritSectEnter(&pBwGroup->Lock, VERR_SEM_BUSY); AssertRC(rc);
+    int rc = PDMCritSectEnter(pVM, &pBwGroup->Lock, VERR_SEM_BUSY); AssertRC(rc);
     if (RT_UNLIKELY(rc == VERR_SEM_BUSY))
         return true;
@@ -72,5 +72,5 @@
               pBwGroup, R3STRING(pBwGroup->pszNameR3), fAllowed));
 
-    rc = PDMCritSectLeave(&pBwGroup->Lock); AssertRC(rc);
+    rc = PDMCritSectLeave(pVM, &pBwGroup->Lock); AssertRC(rc);
     return fAllowed;
 }
Index: trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 90346)
@@ -889,5 +889,5 @@
 VMMDECL(int) PGMTrap0eHandler(PVMCPUCC pVCpu, RTGCUINT uErr, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault)
 {
-    PVM pVM = pVCpu->CTX_SUFF(pVM);
+    PVMCC pVM = pVCpu->CTX_SUFF(pVM);
 
     Log(("PGMTrap0eHandler: uErr=%RGx pvFault=%RGv eip=%04x:%RGv cr3=%RGp\n", uErr, pvFault, pRegFrame->cs.Sel, (RTGCPTR)pRegFrame->rip, (RTGCPHYS)CPUMGetGuestCR3(pVCpu)));
@@ -1540,5 +1540,5 @@
 DECLINLINE(int) pgmShwGetPaePoolPagePD(PVMCPUCC pVCpu, RTGCPTR GCPtr, PPGMPOOLPAGE *ppShwPde)
 {
-    PVM pVM   = pVCpu->CTX_SUFF(pVM);
+    PVMCC pVM   = pVCpu->CTX_SUFF(pVM);
     PGM_LOCK_ASSERT_OWNER(pVM);
 
@@ -1710,5 +1710,5 @@
 DECLINLINE(int) pgmShwGetLongModePDPtr(PVMCPUCC pVCpu, RTGCPTR64 GCPtr, PX86PML4E *ppPml4e, PX86PDPT *ppPdpt, PX86PDPAE *ppPD)
 {
-    PVM pVM = pVCpu->CTX_SUFF(pVM);
+    PVMCC pVM = pVCpu->CTX_SUFF(pVM);
     PGM_LOCK_ASSERT_OWNER(pVM);
 
@@ -3490,7 +3490,7 @@
  * @param   pVM         The cross context VM structure.
  */
-VMMDECL(bool) PGMIsLockOwner(PVM pVM)
-{
-    return PDMCritSectIsOwner(&pVM->pgm.s.CritSectX);
+VMMDECL(bool) PGMIsLockOwner(PVMCC pVM)
+{
+    return PDMCritSectIsOwner(pVM, &pVM->pgm.s.CritSectX);
 }
 
@@ -3526,7 +3526,7 @@
 {
 #if defined(VBOX_STRICT) && defined(IN_RING3)
-    int rc = PDMCritSectEnterDebug(&pVM->pgm.s.CritSectX, VERR_SEM_BUSY, (uintptr_t)ASMReturnAddress(), RT_SRC_POS_ARGS);
+    int rc = PDMCritSectEnterDebug(pVM, &pVM->pgm.s.CritSectX, VERR_SEM_BUSY, (uintptr_t)ASMReturnAddress(), RT_SRC_POS_ARGS);
 #else
-    int rc = PDMCritSectEnter(&pVM->pgm.s.CritSectX, VERR_SEM_BUSY);
+    int rc = PDMCritSectEnter(pVM, &pVM->pgm.s.CritSectX, VERR_SEM_BUSY);
 #endif
 #ifdef IN_RING0
@@ -3545,9 +3545,9 @@
  * @param   pVM         The cross context VM structure.
  */
-void pgmUnlock(PVM pVM)
+void pgmUnlock(PVMCC pVM)
 {
     uint32_t cDeprecatedPageLocks = pVM->pgm.s.cDeprecatedPageLocks;
     pVM->pgm.s.cDeprecatedPageLocks = 0;
-    int rc = PDMCritSectLeave(&pVM->pgm.s.CritSectX);
+    int rc = PDMCritSectLeave(pVM, &pVM->pgm.s.CritSectX);
     if (rc == VINF_SEM_NESTED)
         pVM->pgm.s.cDeprecatedPageLocks = cDeprecatedPageLocks;
Index: trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 90346)
@@ -1682,5 +1682,5 @@
  * @param   pVM     The cross context VM structure.
  */
-VMMDECL(unsigned) PGMAssertHandlerAndFlagsInSync(PVM pVM)
+VMMDECL(unsigned) PGMAssertHandlerAndFlagsInSync(PVMCC pVM)
 {
     PPGM        pPGM = &pVM->pgm.s;
Index: trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllPhys.cpp	(revision 90346)
@@ -598,5 +598,5 @@
  * @param   GCPhys  GCPhys entry to flush
  */
-void pgmPhysInvalidatePageMapTLBEntry(PVM pVM, RTGCPHYS GCPhys)
+void pgmPhysInvalidatePageMapTLBEntry(PVMCC pVM, RTGCPHYS GCPhys)
 {
     PGM_LOCK_ASSERT_OWNER(pVM);
Index: trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 90346)
@@ -59,7 +59,7 @@
 
 int             pgmPoolTrackFlushGCPhysPTsSlow(PVMCC pVM, PPGMPAGE pPhysPage);
-PPGMPOOLPHYSEXT pgmPoolTrackPhysExtAlloc(PVM pVM, uint16_t *piPhysExt);
-void            pgmPoolTrackPhysExtFree(PVM pVM, uint16_t iPhysExt);
-void            pgmPoolTrackPhysExtFreeList(PVM pVM, uint16_t iPhysExt);
+PPGMPOOLPHYSEXT pgmPoolTrackPhysExtAlloc(PVMCC pVM, uint16_t *piPhysExt);
+void            pgmPoolTrackPhysExtFree(PVMCC pVM, uint16_t iPhysExt);
+void            pgmPoolTrackPhysExtFreeList(PVMCC pVM, uint16_t iPhysExt);
 
 RT_C_DECLS_END
@@ -1793,5 +1793,5 @@
  * @param   GCPhys          Guest physical address
  */
-bool pgmPoolIsDirtyPageSlow(PVM pVM, RTGCPHYS GCPhys)
+bool pgmPoolIsDirtyPageSlow(PVMCC pVM, RTGCPHYS GCPhys)
 {
     PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
@@ -1861,5 +1861,5 @@
  * @param   GCPtrPage       Guest page to invalidate
  */
-void pgmPoolResetDirtyPage(PVM pVM, RTGCPTR GCPtrPage)
+void pgmPoolResetDirtyPage(PVMCC pVM, RTGCPTR GCPtrPage)
 {
     PPGMPOOL pPool = pVM->pgm.s.CTX_SUFF(pPool);
@@ -3392,5 +3392,5 @@
  * @param   iPhysExt    The physical cross reference extent list to flush.
  */
-static void pgmPoolTrackFlushGCPhysPTs(PVM pVM, PPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iPhysExt)
+static void pgmPoolTrackFlushGCPhysPTs(PVMCC pVM, PPGMPAGE pPhysPage, bool fFlushPTEs, uint16_t iPhysExt)
 {
     PGM_LOCK_ASSERT_OWNER(pVM);
@@ -3868,5 +3868,5 @@
  * @param   piPhysExt   Where to store the phys ext index.
  */
-PPGMPOOLPHYSEXT pgmPoolTrackPhysExtAlloc(PVM pVM, uint16_t *piPhysExt)
+PPGMPOOLPHYSEXT pgmPoolTrackPhysExtAlloc(PVMCC pVM, uint16_t *piPhysExt)
 {
     PGM_LOCK_ASSERT_OWNER(pVM);
@@ -3892,5 +3892,5 @@
  * @param   iPhysExt    The extent to free.
  */
-void pgmPoolTrackPhysExtFree(PVM pVM, uint16_t iPhysExt)
+void pgmPoolTrackPhysExtFree(PVMCC pVM, uint16_t iPhysExt)
 {
     PGM_LOCK_ASSERT_OWNER(pVM);
@@ -3914,5 +3914,5 @@
  * @param   iPhysExt    The extent to free.
  */
-void pgmPoolTrackPhysExtFreeList(PVM pVM, uint16_t iPhysExt)
+void pgmPoolTrackPhysExtFreeList(PVMCC pVM, uint16_t iPhysExt)
 {
     PGM_LOCK_ASSERT_OWNER(pVM);
@@ -3951,5 +3951,5 @@
  *
  */
-static uint16_t pgmPoolTrackPhysExtInsert(PVM pVM, uint16_t iPhysExt, uint16_t iShwPT, uint16_t iPte)
+static uint16_t pgmPoolTrackPhysExtInsert(PVMCC pVM, uint16_t iPhysExt, uint16_t iShwPT, uint16_t iPte)
 {
     PGM_LOCK_ASSERT_OWNER(pVM);
Index: trunk/src/VBox/VMM/VMMAll/PGMAllShw.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllShw.h	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllShw.h	(revision 90346)
@@ -317,5 +317,5 @@
 
 #else  /* PGM_SHW_TYPE != PGM_TYPE_NONE */
-    PVM pVM = pVCpu->CTX_SUFF(pVM);
+    PVMCC pVM = pVCpu->CTX_SUFF(pVM);
 
     PGM_LOCK_ASSERT_OWNER(pVM);
Index: trunk/src/VBox/VMM/VMMAll/TMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/TMAll.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/TMAll.cpp	(revision 90346)
@@ -74,5 +74,5 @@
             PPDMCRITSECT pCritSect = TMTIMER_GET_CRITSECT(a_pVM, a_pTimer); \
             AssertMsg(   pCritSect \
-                      && (   PDMCritSectIsOwner(pCritSect) \
+                      && (   PDMCritSectIsOwner((a_pVM), pCritSect) \
                           || (enmState = (a_pVM)->enmVMState) == VMSTATE_CREATING \
                           || enmState == VMSTATE_RESETTING \
@@ -107,6 +107,6 @@
             PPDMCRITSECT pCritSect = TMTIMER_GET_CRITSECT(pVM, pTimer); \
             AssertMsg(   pCritSect \
-                      && (   !PDMCritSectIsOwner(pCritSect) \
-                          || PDMCritSectIsOwner(&pVM->tm.s.VirtualSyncLock) \
+                      && (   !PDMCritSectIsOwner((pVM), pCritSect) \
+                          || PDMCritSectIsOwner((pVM), &(pVM)->tm.s.VirtualSyncLock) \
                           || (enmState = (pVM)->enmVMState) == VMSTATE_CREATING \
                           || enmState == VMSTATE_RESETTING \
@@ -363,5 +363,5 @@
 DECLINLINE(void) tmSchedule(PVMCC pVM, PTMTIMERQUEUECC pQueueCC, PTMTIMERQUEUE pQueue, PTMTIMER pTimer)
 {
-    int rc = PDMCritSectTryEnter(&pQueue->TimerLock);
+    int rc = PDMCritSectTryEnter(pVM, &pQueue->TimerLock);
     if (RT_SUCCESS_NP(rc))
     {
@@ -373,5 +373,5 @@
 #endif
         STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatScheduleOne), a);
-        PDMCritSectLeave(&pQueue->TimerLock);
+        PDMCritSectLeave(pVM, &pQueue->TimerLock);
         return;
     }
@@ -621,5 +621,5 @@
 void tmTimerQueueSchedule(PVMCC pVM, PTMTIMERQUEUECC pQueueCC, PTMTIMERQUEUE pQueue)
 {
-    Assert(PDMCritSectIsOwner(&pQueue->TimerLock));
+    Assert(PDMCritSectIsOwner(pVM, &pQueue->TimerLock));
 
     /*
@@ -666,9 +666,9 @@
         Assert(pQueue->enmClock == (TMCLOCK)idxQueue);
 
-        int rc = PDMCritSectTryEnter(&pQueue->TimerLock);
+        int rc = PDMCritSectTryEnter(pVM, &pQueue->TimerLock);
         if (RT_SUCCESS(rc))
         {
             if (   pQueue->enmClock != TMCLOCK_VIRTUAL_SYNC
-                || PDMCritSectTryEnter(&pVM->tm.s.VirtualSyncLock) == VINF_SUCCESS)
+                || PDMCritSectTryEnter(pVM, &pVM->tm.s.VirtualSyncLock) == VINF_SUCCESS)
             {
                 /* Check the linking of the active lists. */
@@ -769,7 +769,7 @@
 
                 if (pQueue->enmClock == TMCLOCK_VIRTUAL_SYNC)
-                    PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+                    PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
             }
-            PDMCritSectLeave(&pQueue->TimerLock);
+            PDMCritSectLeave(pVM, &pQueue->TimerLock);
         }
     }
@@ -1147,5 +1147,5 @@
     TMTIMER_HANDLE_TO_VARS_RETURN(pVM, hTimer); /* => pTimer, pQueueCC, pQueue, idxTimer, idxQueue */
     AssertReturn(idxQueue == TMCLOCK_VIRTUAL_SYNC, VERR_NOT_SUPPORTED);
-    return PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, rcBusy);
+    return PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, rcBusy);
 }
 
@@ -1161,5 +1161,5 @@
     TMTIMER_HANDLE_TO_VARS_RETURN_VOID(pVM, hTimer); /* => pTimer, pQueueCC, pQueue, idxTimer, idxQueue */
     AssertReturnVoid(idxQueue == TMCLOCK_VIRTUAL_SYNC);
-    PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+    PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
 }
 
@@ -1176,5 +1176,5 @@
     TMTIMER_HANDLE_TO_VARS_RETURN_EX(pVM, hTimer, false); /* => pTimer, pQueueCC, pQueue, idxTimer, idxQueue */
     AssertReturn(idxQueue == TMCLOCK_VIRTUAL_SYNC, false);
-    return PDMCritSectIsOwner(&pVM->tm.s.VirtualSyncLock);
+    return PDMCritSectIsOwner(pVM, &pVM->tm.s.VirtualSyncLock);
 }
 
@@ -1236,5 +1236,5 @@
     VM_ASSERT_EMT(pVM);
     TMTIMER_ASSERT_SYNC_CRITSECT_ORDER(pVM, pTimer);
-    int rc = PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VINF_SUCCESS);
+    int rc = PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VINF_SUCCESS);
     AssertRCReturn(rc, rc);
 
@@ -1287,5 +1287,5 @@
 
     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSetVs), a);
-    PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+    PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
     return rc;
 }
@@ -1344,5 +1344,5 @@
     {
         /* Try take the TM lock and check the state again. */
-        int rc = PDMCritSectTryEnter(&pQueue->TimerLock);
+        int rc = PDMCritSectTryEnter(pVM, &pQueue->TimerLock);
         if (RT_SUCCESS_NP(rc))
         {
@@ -1351,8 +1351,8 @@
                 tmTimerSetOptimizedStart(pVM, pTimer, u64Expire, pQueue, idxQueue);
                 STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSet), a);
-                PDMCritSectLeave(&pQueue->TimerLock);
+                PDMCritSectLeave(pVM, &pQueue->TimerLock);
                 return VINF_SUCCESS;
             }
-            PDMCritSectLeave(&pQueue->TimerLock);
+            PDMCritSectLeave(pVM, &pQueue->TimerLock);
         }
     }
@@ -1543,5 +1543,5 @@
     VM_ASSERT_EMT(pVM);
     TMTIMER_ASSERT_SYNC_CRITSECT_ORDER(pVM, pTimer);
-    int rc = PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VINF_SUCCESS);
+    int rc = PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VINF_SUCCESS);
     AssertRCReturn(rc, rc);
 
@@ -1598,5 +1598,5 @@
 
     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSetRelativeVs), a);
-    PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+    PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
     return rc;
 }
@@ -1662,5 +1662,5 @@
      *       get the innermost locks.
      */
-    bool fOwnTMLock = RT_SUCCESS_NP(PDMCritSectTryEnter(&pQueue->TimerLock));
+    bool fOwnTMLock = RT_SUCCESS_NP(PDMCritSectTryEnter(pVM, &pQueue->TimerLock));
 #if 1
     if (    fOwnTMLock
@@ -1674,5 +1674,5 @@
             tmTimerSetRelativeOptimizedStart(pVM, pTimer, cTicksToNext, pu64Now, pQueueCC, pQueue);
             STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSetRelative), a);
-            PDMCritSectLeave(&pQueue->TimerLock);
+            PDMCritSectLeave(pVM, &pQueue->TimerLock);
             return VINF_SUCCESS;
         }
@@ -1814,5 +1814,5 @@
          */
         if (!fOwnTMLock)
-            fOwnTMLock = RT_SUCCESS_NP(PDMCritSectTryEnter(&pQueue->TimerLock));
+            fOwnTMLock = RT_SUCCESS_NP(PDMCritSectTryEnter(pVM, &pQueue->TimerLock));
 
     } /* for (;;) */
@@ -1822,5 +1822,5 @@
      */
     if (fOwnTMLock)
-        PDMCritSectLeave(&pQueue->TimerLock);
+        PDMCritSectLeave(pVM, &pQueue->TimerLock);
 
     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSetRelative), a);
@@ -1893,5 +1893,5 @@
     VM_ASSERT_EMT(pVM);
     TMTIMER_ASSERT_SYNC_CRITSECT_ORDER(pVM, pTimer);
-    int rc = PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VINF_SUCCESS);
+    int rc = PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VINF_SUCCESS);
     AssertRCReturn(rc, rc);
 
@@ -1947,5 +1947,5 @@
 
     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerStopVs), a);
-    PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+    PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
     return rc;
 }
@@ -2617,5 +2617,5 @@
         uint32_t uMaxHzHintQueue;
         if (  !(ASMAtomicUoReadU64(&pVM->tm.s.HzHint.u64Combined) & (RT_BIT_32(idxQueue) | RT_BIT_32(idxQueue + 16)))
-            || RT_FAILURE_NP(PDMCritSectTryEnter(&pQueue->TimerLock)))
+            || RT_FAILURE_NP(PDMCritSectTryEnter(pVM, &pQueue->TimerLock)))
             uMaxHzHintQueue = ASMAtomicReadU32(&pQueue->uMaxHzHint);
         else
@@ -2667,5 +2667,5 @@
                 uMaxHzHintQueue = ASMAtomicUoReadU32(&pQueue->uMaxHzHint);
 
-            PDMCritSectLeave(&pQueue->TimerLock);
+            PDMCritSectLeave(pVM, &pQueue->TimerLock);
         }
 
Index: trunk/src/VBox/VMM/VMMAll/TMAllVirtual.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/TMAllVirtual.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMAll/TMAllVirtual.cpp	(revision 90346)
@@ -437,5 +437,5 @@
             *pcNsToDeadline = tmVirtualVirtToNsDeadline(pVM, cNsToDeadline);
         }
-        PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+        PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
     }
     else
@@ -450,5 +450,5 @@
         Log5(("TMAllVirtual(%u): FF: %d -> 1\n", __LINE__, VMCPU_FF_IS_SET(pVCpuDst, VMCPU_FF_TIMER)));
         Log4(("TM: %'RU64/-%'8RU64: exp tmr=>ff [vsghcul]\n", u64, pVM->tm.s.offVirtualSync - pVM->tm.s.offVirtualSyncGivenUp));
-        PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+        PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
 
         if (pcNsToDeadline)
@@ -488,5 +488,5 @@
     {
         u64 = ASMAtomicUoReadU64(&pVM->tm.s.u64VirtualSync);
-        PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+        PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
         if (pcNsToDeadline)
             *pcNsToDeadline = 0;
@@ -526,5 +526,5 @@
     {
         ASMAtomicWriteU64(&pVM->tm.s.u64VirtualSync, u64);
-        PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+        PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
         if (pcNsToDeadline)
             *pcNsToDeadline = tmVirtualVirtToNsDeadline(pVM, u64Expire - u64);
@@ -541,5 +541,5 @@
         Log5(("TMAllVirtual(%u): FF: %d -> 1\n", __LINE__, VMCPU_FF_IS_SET(pVCpuDst, VMCPU_FF_TIMER)));
         Log4(("TM: %'RU64/-%'8RU64: exp tmr=>ff [vsgl]\n", u64, pVM->tm.s.offVirtualSync - pVM->tm.s.offVirtualSyncGivenUp));
-        PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+        PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
 
 #ifdef IN_RING3
@@ -617,5 +617,5 @@
     /** @todo switch this around, have the tmVirtualSyncGetLocked code inlined
      *        here and the remainder of this function in a static worker. */
-    if (PDMCritSectTryEnter(&pVM->tm.s.VirtualSyncLock) == VINF_SUCCESS)
+    if (PDMCritSectTryEnter(pVM, &pVM->tm.s.VirtualSyncLock) == VINF_SUCCESS)
         return tmVirtualSyncGetLocked(pVM, u64, pcNsToDeadline, pnsAbsDeadline);
 
@@ -689,5 +689,5 @@
     {
         /* Try grab the lock, things get simpler when owning the lock. */
-        int rcLock = PDMCritSectTryEnter(&pVM->tm.s.VirtualSyncLock);
+        int rcLock = PDMCritSectTryEnter(pVM, &pVM->tm.s.VirtualSyncLock);
         if (RT_SUCCESS_NP(rcLock))
             return tmVirtualSyncGetLocked(pVM, u64, pcNsToDeadline, pnsAbsDeadline);
Index: trunk/src/VBox/VMM/VMMR0/PDMR0DevHlp.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/PDMR0DevHlp.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR0/PDMR0DevHlp.cpp	(revision 90346)
@@ -497,12 +497,13 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    VBOXSTRICTRC rc = TMTimerLock(pDevIns->Internal.s.pGVM, hTimer, rcBusy);
+    PGVM const pGVM = pDevIns->Internal.s.pGVM;
+    VBOXSTRICTRC rc = TMTimerLock(pGVM, hTimer, rcBusy);
     if (rc == VINF_SUCCESS)
     {
-        rc = PDMCritSectEnter(pCritSect, rcBusy);
+        rc = PDMCritSectEnter(pGVM, pCritSect, rcBusy);
         if (rc == VINF_SUCCESS)
             return rc;
         AssertRC(VBOXSTRICTRC_VAL(rc));
-        TMTimerUnlock(pDevIns->Internal.s.pGVM, hTimer);
+        TMTimerUnlock(pGVM, hTimer);
     }
     else
@@ -580,6 +581,7 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    TMTimerUnlock(pDevIns->Internal.s.pGVM, hTimer);
-    int rc = PDMCritSectLeave(pCritSect);
+    PGVM const pGVM = pDevIns->Internal.s.pGVM;
+    TMTimerUnlock(pGVM, hTimer);
+    int rc = PDMCritSectLeave(pGVM, pCritSect);
     AssertRC(rc);
 }
@@ -863,6 +865,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pGVM to the crit sect code.   */
-    return PDMCritSectEnter(pCritSect, rcBusy);
+    return PDMCritSectEnter(pDevIns->Internal.s.pGVM, pCritSect, rcBusy);
 }
 
@@ -872,6 +873,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pGVM to the crit sect code.   */
-    return PDMCritSectEnterDebug(pCritSect, rcBusy, uId, RT_SRC_POS_ARGS);
+    return PDMCritSectEnterDebug(pDevIns->Internal.s.pGVM, pCritSect, rcBusy, uId, RT_SRC_POS_ARGS);
 }
 
@@ -881,6 +881,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pGVM to the crit sect code.   */
-    return PDMCritSectTryEnter(pCritSect);
+    return PDMCritSectTryEnter(pDevIns->Internal.s.pGVM, pCritSect);
 }
 
@@ -890,6 +889,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pGVM to the crit sect code.   */
-    return PDMCritSectTryEnterDebug(pCritSect, uId, RT_SRC_POS_ARGS);
+    return PDMCritSectTryEnterDebug(pDevIns->Internal.s.pGVM, pCritSect, uId, RT_SRC_POS_ARGS);
 }
 
@@ -899,6 +897,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pGVM to the crit sect code.   */
-    return PDMCritSectLeave(pCritSect);
+    return PDMCritSectLeave(pDevIns->Internal.s.pGVM, pCritSect);
 }
 
@@ -908,6 +905,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pGVM to the crit sect code.   */
-    return PDMCritSectIsOwner(pCritSect);
+    return PDMCritSectIsOwner(pDevIns->Internal.s.pGVM, pCritSect);
 }
 
@@ -926,6 +922,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns);
-    return PDMCritSectHasWaiters(pCritSect);
+    return PDMCritSectHasWaiters(pDevIns->Internal.s.pGVM, pCritSect);
 }
 
Index: trunk/src/VBox/VMM/VMMR0/PDMR0Driver.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/PDMR0Driver.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR0/PDMR0Driver.cpp	(revision 90346)
@@ -117,6 +117,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    NOREF(pDrvIns);
-    return PDMCritSectEnter(pCritSect, rcBusy);
+    return PDMCritSectEnter(pDrvIns->Internal.s.pVMR0, pCritSect, rcBusy);
 }
 
@@ -127,6 +126,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    NOREF(pDrvIns);
-    return PDMCritSectEnterDebug(pCritSect, rcBusy, uId, RT_SRC_POS_ARGS);
+    return PDMCritSectEnterDebug(pDrvIns->Internal.s.pVMR0, pCritSect, rcBusy, uId, RT_SRC_POS_ARGS);
 }
 
@@ -136,6 +134,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    NOREF(pDrvIns);
-    return PDMCritSectTryEnter(pCritSect);
+    return PDMCritSectTryEnter(pDrvIns->Internal.s.pVMR0, pCritSect);
 }
 
@@ -146,6 +143,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    NOREF(pDrvIns);
-    return PDMCritSectTryEnterDebug(pCritSect, uId, RT_SRC_POS_ARGS);
+    return PDMCritSectTryEnterDebug(pDrvIns->Internal.s.pVMR0, pCritSect, uId, RT_SRC_POS_ARGS);
 }
 
@@ -155,6 +151,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    NOREF(pDrvIns);
-    return PDMCritSectLeave(pCritSect);
+    return PDMCritSectLeave(pDrvIns->Internal.s.pVMR0, pCritSect);
 }
 
@@ -164,6 +159,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    NOREF(pDrvIns);
-    return PDMCritSectIsOwner(pCritSect);
+    return PDMCritSectIsOwner(pDrvIns->Internal.s.pVMR0, pCritSect);
 }
 
@@ -182,6 +176,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    NOREF(pDrvIns);
-    return PDMCritSectHasWaiters(pCritSect);
+    return PDMCritSectHasWaiters(pDrvIns->Internal.s.pVMR0, pCritSect);
 }
 
@@ -206,5 +199,21 @@
 
 
-/** @interface_method_impl{PDMDRVHLPR0,pfn} */
+/** @interface_method_impl{PDMDRVHLPR0,pfnNetShaperAllocateBandwidth} */
+static DECLCALLBACK(bool) pdmR0DrvHlp_NetShaperAllocateBandwidth(PPDMDRVINS pDrvIns, PPDMNSFILTER pFilter, size_t cbTransfer)
+{
+#ifdef VBOX_WITH_NETSHAPER
+    PDMDRV_ASSERT_DRVINS(pDrvIns);
+    LogFlow(("pdmR0DrvHlp_NetShaperDetach: caller='%s'/%d: pFilter=%p cbTransfer=%#zx\n",
+             pDrvIns->pReg->szName, pDrvIns->iInstance, pFilter, cbTransfer));
+
+    bool const fRc = PDMNetShaperAllocateBandwidth(pDrvIns->Internal.s.pVMR0, pFilter, cbTransfer);
+
+    LogFlow(("pdmR0DrvHlp_NetShaperDetach: caller='%s'/%d: returns %RTbool\n", pDrvIns->pReg->szName, pDrvIns->iInstance, fRc));
+    return fRc;
+#else
+    RT_NOREF(pDrvIns, pFilter, cbTransfer);
+    return true;
+#endif
+}
 
 
@@ -231,4 +240,5 @@
     pdmR0DrvHlp_CritSectGetRecursion,
     pdmR0DrvHlp_CritSectScheduleExitEvent,
+    pdmR0DrvHlp_NetShaperAllocateBandwidth,
     PDM_DRVHLPRC_VERSION
 };
Index: trunk/src/VBox/VMM/VMMR0/VMMR0.def
===================================================================
--- trunk/src/VBox/VMM/VMMR0/VMMR0.def	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR0/VMMR0.def	(revision 90346)
@@ -21,11 +21,4 @@
     ; code
     GIMGetMmio2Regions
-    PDMCritSectEnter
-    PDMCritSectEnterDebug
-    PDMCritSectIsOwner
-    PDMCritSectLeave
-    PDMHCCritSectScheduleExitEvent
-    PDMCritSectTryEnter
-    PDMCritSectTryEnterDebug
     PDMQueueAlloc
     PDMQueueInsert
@@ -85,7 +78,4 @@
     IntNetR0IfWait
 
-    ; Network Shaper
-    PDMNsAllocateBandwidth
-
     ; runtime
     RTAssertMsg1Weak
Index: trunk/src/VBox/VMM/VMMR3/EM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/EM.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/EM.cpp	(revision 90346)
@@ -1484,5 +1484,5 @@
 
     if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PDM_CRITSECT))
-        PDMCritSectBothFF(pVCpu);
+        PDMCritSectBothFF(pVM, pVCpu);
 
     /* Update CR3 (Nested Paging case for HM). */
Index: trunk/src/VBox/VMM/VMMR3/MMHyper.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/MMHyper.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/MMHyper.cpp	(revision 90346)
@@ -424,5 +424,5 @@
     PMMHYPERHEAP pHeap = pVM->mm.s.CTX_SUFF(pHyperHeap);
 
-    int rc = PDMR3CritSectEnterEx(&pHeap->Lock, true /* fHostCall */);
+    int rc = PDMR3CritSectEnterEx(pVM, &pHeap->Lock, true /* fHostCall */);
     AssertRC(rc);
     return rc;
Index: trunk/src/VBox/VMM/VMMR3/PDM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/PDM.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/PDM.cpp	(revision 90346)
@@ -1307,7 +1307,8 @@
  *
  * @returns VBox status code.
- * @param   pDevIns             The device instance.
- */
-DECLINLINE(int) pdmR3PowerOnDev(PPDMDEVINS pDevIns)
+ * @param   pVM     The cross context VM structure.
+ * @param   pDevIns The device instance.
+ */
+DECLINLINE(int) pdmR3PowerOnDev(PVM pVM, PPDMDEVINS pDevIns)
 {
     Assert(pDevIns->Internal.s.fIntFlags & PDMDEVINSINT_FLAGS_SUSPENDED);
@@ -1315,7 +1316,7 @@
     {
         LogFlow(("PDMR3PowerOn: Notifying - device '%s'/%d\n", pDevIns->pReg->szName, pDevIns->iInstance));
-        PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+        PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
         int rc = VINF_SUCCESS; pDevIns->pReg->pfnPowerOn(pDevIns);
-        PDMCritSectLeave(pDevIns->pCritSectRoR3);
+        PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
         if (RT_FAILURE(rc))
         {
@@ -1350,5 +1351,5 @@
                 rc = pdmR3PowerOnDrv(pDrvIns, pDevIns->pReg->szName, pDevIns->iInstance, pLun->iLun);
         if (RT_SUCCESS(rc))
-            rc = pdmR3PowerOnDev(pDevIns);
+            rc = pdmR3PowerOnDev(pVM, pDevIns);
     }
 
@@ -1592,9 +1593,9 @@
  * Worker for PDMR3Reset that deals with one device instance.
  *
- * @param   pDevIns             The device instance.
- * @param   pAsync              The structure for recording asynchronous
- *                              notification tasks.
- */
-DECLINLINE(void) pdmR3ResetDev(PPDMDEVINS pDevIns, PPDMNOTIFYASYNCSTATS pAsync)
+ * @param   pVM     The cross context VM structure.
+ * @param   pDevIns The device instance.
+ * @param   pAsync  The structure for recording asynchronous notification tasks.
+ */
+DECLINLINE(void) pdmR3ResetDev(PVM pVM, PPDMDEVINS pDevIns, PPDMNOTIFYASYNCSTATS pAsync)
 {
     if (!(pDevIns->Internal.s.fIntFlags & PDMDEVINSINT_FLAGS_RESET))
@@ -1604,5 +1605,5 @@
         {
             uint64_t cNsElapsed = RTTimeNanoTS();
-            PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+            PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
 
             if (!pDevIns->Internal.s.pfnAsyncNotify)
@@ -1624,5 +1625,5 @@
             }
 
-            PDMCritSectLeave(pDevIns->pCritSectRoR3);
+            PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
             cNsElapsed = RTTimeNanoTS() - cNsElapsed;
             if (cNsElapsed >= PDMSUSPEND_WARN_AT_NS)
@@ -1698,5 +1699,5 @@
 
             if (pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_FIRST_RESET_NOTIFICATION)
-                pdmR3ResetDev(pDevIns, &Async);
+                pdmR3ResetDev(pVM, pDevIns, &Async);
 
             if (Async.cAsync == cAsyncStart)
@@ -1708,5 +1709,5 @@
             if (   Async.cAsync == cAsyncStart
                 && !(pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_FIRST_RESET_NOTIFICATION))
-                pdmR3ResetDev(pDevIns, &Async);
+                pdmR3ResetDev(pVM, pDevIns, &Async);
         }
 
@@ -1761,7 +1762,7 @@
         if (pDevIns->pReg->pfnMemSetup)
         {
-            PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+            PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
             pDevIns->pReg->pfnMemSetup(pDevIns, enmCtx);
-            PDMCritSectLeave(pDevIns->pCritSectRoR3);
+            PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
         }
 
@@ -1839,7 +1840,7 @@
         if (pDevIns->pReg->pfnSoftReset)
         {
-            PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+            PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
             pDevIns->pReg->pfnSoftReset(pDevIns, fResetFlags);
-            PDMCritSectLeave(pDevIns->pCritSectRoR3);
+            PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
         }
 
@@ -1947,9 +1948,9 @@
  * Worker for PDMR3Suspend that deals with one device instance.
  *
- * @param   pDevIns             The device instance.
- * @param   pAsync              The structure for recording asynchronous
- *                              notification tasks.
- */
-DECLINLINE(void) pdmR3SuspendDev(PPDMDEVINS pDevIns, PPDMNOTIFYASYNCSTATS pAsync)
+ * @param   pVM     The cross context VM structure.
+ * @param   pDevIns The device instance.
+ * @param   pAsync  The structure for recording asynchronous notification tasks.
+ */
+DECLINLINE(void) pdmR3SuspendDev(PVM pVM, PPDMDEVINS pDevIns, PPDMNOTIFYASYNCSTATS pAsync)
 {
     if (!(pDevIns->Internal.s.fIntFlags & PDMDEVINSINT_FLAGS_SUSPENDED))
@@ -1959,5 +1960,5 @@
         {
             uint64_t cNsElapsed = RTTimeNanoTS();
-            PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+            PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
 
             if (!pDevIns->Internal.s.pfnAsyncNotify)
@@ -1979,5 +1980,5 @@
             }
 
-            PDMCritSectLeave(pDevIns->pCritSectRoR3);
+            PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
             cNsElapsed = RTTimeNanoTS() - cNsElapsed;
             if (cNsElapsed >= PDMSUSPEND_WARN_AT_NS)
@@ -2030,5 +2031,5 @@
 
             if (pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_FIRST_SUSPEND_NOTIFICATION)
-                pdmR3SuspendDev(pDevIns, &Async);
+                pdmR3SuspendDev(pVM, pDevIns, &Async);
 
             if (Async.cAsync == cAsyncStart)
@@ -2040,5 +2041,5 @@
             if (    Async.cAsync == cAsyncStart
                 && !(pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_FIRST_SUSPEND_NOTIFICATION))
-                pdmR3SuspendDev(pDevIns, &Async);
+                pdmR3SuspendDev(pVM, pDevIns, &Async);
         }
 
@@ -2129,7 +2130,8 @@
  *
  * @returns VBox status code.
- * @param   pDevIns             The device instance.
- */
-DECLINLINE(int) pdmR3ResumeDev(PPDMDEVINS pDevIns)
+ * @param   pVM     The cross context VM structure.
+ * @param   pDevIns The device instance.
+ */
+DECLINLINE(int) pdmR3ResumeDev(PVM pVM, PPDMDEVINS pDevIns)
 {
     Assert(pDevIns->Internal.s.fIntFlags & PDMDEVINSINT_FLAGS_SUSPENDED);
@@ -2137,7 +2139,7 @@
     {
         LogFlow(("PDMR3Resume: Notifying - device '%s'/%d\n", pDevIns->pReg->szName, pDevIns->iInstance));
-        PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+        PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
         int rc = VINF_SUCCESS; pDevIns->pReg->pfnResume(pDevIns);
-        PDMCritSectLeave(pDevIns->pCritSectRoR3);
+        PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
         if (RT_FAILURE(rc))
         {
@@ -2172,5 +2174,5 @@
                 rc = pdmR3ResumeDrv(pDrvIns, pDevIns->pReg->szName, pDevIns->iInstance, pLun->iLun);
         if (RT_SUCCESS(rc))
-            rc = pdmR3ResumeDev(pDevIns);
+            rc = pdmR3ResumeDev(pVM, pDevIns);
     }
 
@@ -2310,9 +2312,9 @@
  * Worker for PDMR3PowerOff that deals with one device instance.
  *
- * @param   pDevIns             The device instance.
- * @param   pAsync              The structure for recording asynchronous
- *                              notification tasks.
- */
-DECLINLINE(void) pdmR3PowerOffDev(PPDMDEVINS pDevIns, PPDMNOTIFYASYNCSTATS pAsync)
+ * @param   pVM     The cross context VM structure.
+ * @param   pDevIns The device instance.
+ * @param   pAsync  The structure for recording asynchronous notification tasks.
+ */
+DECLINLINE(void) pdmR3PowerOffDev(PVM pVM, PPDMDEVINS pDevIns, PPDMNOTIFYASYNCSTATS pAsync)
 {
     if (!(pDevIns->Internal.s.fIntFlags & PDMDEVINSINT_FLAGS_SUSPENDED))
@@ -2322,5 +2324,5 @@
         {
             uint64_t cNsElapsed = RTTimeNanoTS();
-            PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+            PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
 
             if (!pDevIns->Internal.s.pfnAsyncNotify)
@@ -2342,5 +2344,5 @@
             }
 
-            PDMCritSectLeave(pDevIns->pCritSectRoR3);
+            PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
             cNsElapsed = RTTimeNanoTS() - cNsElapsed;
             if (cNsElapsed >= PDMPOWEROFF_WARN_AT_NS)
@@ -2411,5 +2413,5 @@
 
             if (pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_FIRST_POWEROFF_NOTIFICATION)
-                pdmR3PowerOffDev(pDevIns, &Async);
+                pdmR3PowerOffDev(pVM, pDevIns, &Async);
 
             if (Async.cAsync == cAsyncStart)
@@ -2421,5 +2423,5 @@
             if (    Async.cAsync == cAsyncStart
                 && !(pDevIns->pReg->fFlags & PDM_DEVREG_FLAGS_FIRST_POWEROFF_NOTIFICATION))
-                pdmR3PowerOffDev(pDevIns, &Async);
+                pdmR3PowerOffDev(pVM, pDevIns, &Async);
         }
 
@@ -2672,5 +2674,5 @@
 VMMR3_INT_DECL(int) PDMR3LockCall(PVM pVM)
 {
-    return PDMR3CritSectEnterEx(&pVM->pdm.s.CritSect, true /* fHostCall */);
+    return PDMR3CritSectEnterEx(pVM, &pVM->pdm.s.CritSect, true /* fHostCall */);
 }
 
Index: trunk/src/VBox/VMM/VMMR3/PDMCritSect.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/PDMCritSect.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/PDMCritSect.cpp	(revision 90346)
@@ -867,5 +867,5 @@
     RTLOCKVALSRCPOS const SrcPos = pCritSect->s.Core.pValidatorRec->SrcPos;
 #endif
-    PDMCritSectLeave(pCritSect);
+    PDMCritSectLeave(pVM, pCritSect);
 
     /*
@@ -889,8 +889,8 @@
 
 #ifdef PDMCRITSECT_STRICT
-    int rc = PDMCritSectEnterDebug(pCritSect, VERR_IGNORED,
+    int rc = PDMCritSectEnterDebug(pVM, pCritSect, VERR_IGNORED,
                                    SrcPos.uId, SrcPos.pszFile, SrcPos.uLine, SrcPos.pszFunction);
 #else
-    int rc = PDMCritSectEnter(pCritSect, VERR_IGNORED);
+    int rc = PDMCritSectEnter(pVM, pCritSect, VERR_IGNORED);
 #endif
     AssertLogRelRC(rc);
@@ -1036,5 +1036,5 @@
         while (     pCur->Core.NativeThreadOwner == hNativeSelf
                &&   pCur->Core.cNestings > 0)
-            PDMCritSectLeave((PPDMCRITSECT)pCur);
+            PDMCritSectLeave(pVM, (PPDMCRITSECT)pCur);
     }
     RTCritSectLeave(&pUVM->pdm.s.ListCritSect);
Index: trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/PDMDevHlp.cpp	(revision 90346)
@@ -524,12 +524,13 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    VBOXSTRICTRC rc = TMTimerLock(pDevIns->Internal.s.pVMR3, hTimer, rcBusy);
+    PVM const pVM = pDevIns->Internal.s.pVMR3;
+    VBOXSTRICTRC rc = TMTimerLock(pVM, hTimer, rcBusy);
     if (rc == VINF_SUCCESS)
     {
-        rc = PDMCritSectEnter(pCritSect, rcBusy);
+        rc = PDMCritSectEnter(pVM, pCritSect, rcBusy);
         if (rc == VINF_SUCCESS)
             return rc;
         AssertRC(VBOXSTRICTRC_VAL(rc));
-        TMTimerUnlock(pDevIns->Internal.s.pVMR3, hTimer);
+        TMTimerUnlock(pVM, hTimer);
     }
     else
@@ -607,6 +608,7 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    TMTimerUnlock(pDevIns->Internal.s.pVMR3, hTimer);
-    int rc = PDMCritSectLeave(pCritSect);
+    PVM const pVM = pDevIns->Internal.s.pVMR3;
+    TMTimerUnlock(pVM, hTimer);
+    int rc = PDMCritSectLeave(pVM, pCritSect);
     AssertRC(rc);
 }
@@ -2786,6 +2788,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pVMR3 to the crit sect code.   */
-    return PDMCritSectEnter(pCritSect, rcBusy);
+    return PDMCritSectEnter(pDevIns->Internal.s.pVMR3, pCritSect, rcBusy);
 }
 
@@ -2795,6 +2796,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pVMR3 to the crit sect code.   */
-    return PDMCritSectEnterDebug(pCritSect, rcBusy, uId, RT_SRC_POS_ARGS);
+    return PDMCritSectEnterDebug(pDevIns->Internal.s.pVMR3, pCritSect, rcBusy, uId, RT_SRC_POS_ARGS);
 }
 
@@ -2804,6 +2804,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pVMR3 to the crit sect code.   */
-    return PDMCritSectTryEnter(pCritSect);
+    return PDMCritSectTryEnter(pDevIns->Internal.s.pVMR3, pCritSect);
 }
 
@@ -2813,6 +2812,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pVMR3 to the crit sect code.   */
-    return PDMCritSectTryEnterDebug(pCritSect, uId, RT_SRC_POS_ARGS);
+    return PDMCritSectTryEnterDebug(pDevIns->Internal.s.pVMR3, pCritSect, uId, RT_SRC_POS_ARGS);
 }
 
@@ -2822,6 +2820,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pVMR3 to the crit sect code.   */
-    return PDMCritSectLeave(pCritSect);
+    return PDMCritSectLeave(pDevIns->Internal.s.pVMR3, pCritSect);
 }
 
@@ -2831,6 +2828,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns); /** @todo pass pDevIns->Internal.s.pVMR3 to the crit sect code.   */
-    return PDMCritSectIsOwner(pCritSect);
+    return PDMCritSectIsOwner(pDevIns->Internal.s.pVMR3, pCritSect);
 }
 
@@ -2849,6 +2845,5 @@
 {
     PDMDEV_ASSERT_DEVINS(pDevIns);
-    RT_NOREF(pDevIns);
-    return PDMCritSectHasWaiters(pCritSect);
+    return PDMCritSectHasWaiters(pDevIns->Internal.s.pVMR3, pCritSect);
 }
 
@@ -3170,9 +3165,9 @@
     {
         PPDMDEVINS pDevInsRtc = pVM->pdm.s.pRtc->pDevIns;
-        rc = PDMCritSectEnter(pDevInsRtc->pCritSectRoR3, VERR_IGNORED);
+        rc = PDMCritSectEnter(pVM, pDevInsRtc->pCritSectRoR3, VERR_IGNORED);
         if (RT_SUCCESS(rc))
         {
             rc = pVM->pdm.s.pRtc->Reg.pfnWrite(pDevInsRtc, iReg, u8Value);
-            PDMCritSectLeave(pDevInsRtc->pCritSectRoR3);
+            PDMCritSectLeave(pVM, pDevInsRtc->pCritSectRoR3);
         }
     }
@@ -3199,9 +3194,9 @@
     {
         PPDMDEVINS pDevInsRtc = pVM->pdm.s.pRtc->pDevIns;
-        rc = PDMCritSectEnter(pDevInsRtc->pCritSectRoR3, VERR_IGNORED);
+        rc = PDMCritSectEnter(pVM, pDevInsRtc->pCritSectRoR3, VERR_IGNORED);
         if (RT_SUCCESS(rc))
         {
             rc = pVM->pdm.s.pRtc->Reg.pfnRead(pDevInsRtc, iReg, pu8Value);
-            PDMCritSectLeave(pDevInsRtc->pCritSectRoR3);
+            PDMCritSectLeave(pVM, pDevInsRtc->pCritSectRoR3);
         }
     }
Index: trunk/src/VBox/VMM/VMMR3/PDMDevice.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/PDMDevice.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/PDMDevice.cpp	(revision 90346)
@@ -595,7 +595,7 @@
         if (pDevIns->pReg->pfnInitComplete)
         {
-            PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+            PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
             rc = pDevIns->pReg->pfnInitComplete(pDevIns);
-            PDMCritSectLeave(pDevIns->pCritSectRoR3);
+            PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
             if (RT_FAILURE(rc))
             {
@@ -1004,7 +1004,7 @@
             if (!pLun->pTop)
             {
-                PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+                PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
                 rc = pDevIns->pReg->pfnAttach(pDevIns, iLun, fFlags);
-                PDMCritSectLeave(pDevIns->pCritSectRoR3);
+                PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
             }
             else
@@ -1117,9 +1117,9 @@
             if (pDevIns->pReg->pfnAttach)
             {
-                PDMCritSectEnter(pDevIns->pCritSectRoR3, VERR_IGNORED);
+                PDMCritSectEnter(pVM, pDevIns->pCritSectRoR3, VERR_IGNORED);
                 rc = pDevIns->pReg->pfnAttach(pDevIns, iLun, fFlags);
                 if (RT_SUCCESS(rc) && ppBase)
                     *ppBase = pLun->pTop ? &pLun->pTop->IBase : NULL;
-                PDMCritSectLeave(pDevIns->pCritSectRoR3);
+                PDMCritSectLeave(pVM, pDevIns->pCritSectRoR3);
             }
             else
Index: trunk/src/VBox/VMM/VMMR3/PDMDriver.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/PDMDriver.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/PDMDriver.cpp	(revision 90346)
@@ -934,7 +934,7 @@
                     if (pLun->pDevIns->pReg->pfnDetach)
                     {
-                        PDMCritSectEnter(pLun->pDevIns->pCritSectRoR3, VERR_IGNORED);
+                        PDMCritSectEnter(pVM, pLun->pDevIns->pCritSectRoR3, VERR_IGNORED);
                         pLun->pDevIns->pReg->pfnDetach(pLun->pDevIns, pLun->iLun, fFlags);
-                        PDMCritSectLeave(pLun->pDevIns->pCritSectRoR3);
+                        PDMCritSectLeave(pVM, pLun->pDevIns->pCritSectRoR3);
                     }
                 }
@@ -1658,8 +1658,8 @@
 
 
-#ifdef VBOX_WITH_NETSHAPER
 /** @interface_method_impl{PDMDRVHLPR3,pfnNetShaperAttach} */
 static DECLCALLBACK(int) pdmR3DrvHlp_NetShaperAttach(PPDMDRVINS pDrvIns, const char *pszBwGroup, PPDMNSFILTER pFilter)
 {
+#ifdef VBOX_WITH_NETSHAPER
     PDMDRV_ASSERT_DRVINS(pDrvIns);
     LogFlow(("pdmR3DrvHlp_NetShaperAttach: caller='%s'/%d: pFilter=%p pszBwGroup=%p:{%s}\n",
@@ -1671,4 +1671,8 @@
              pDrvIns->iInstance, rc));
     return rc;
+#else
+    RT_NOREF(pDrvIns, pszBwGroup, pFilter);
+    return VERR_NOT_IMPLEMENTED;
+#endif
 }
 
@@ -1677,4 +1681,5 @@
 static DECLCALLBACK(int) pdmR3DrvHlp_NetShaperDetach(PPDMDRVINS pDrvIns, PPDMNSFILTER pFilter)
 {
+#ifdef VBOX_WITH_NETSHAPER
     PDMDRV_ASSERT_DRVINS(pDrvIns);
     LogFlow(("pdmR3DrvHlp_NetShaperDetach: caller='%s'/%d: pFilter=%p\n",
@@ -1686,6 +1691,28 @@
              pDrvIns->iInstance, rc));
     return rc;
-}
-#endif /* VBOX_WITH_NETSHAPER */
+#else
+    RT_NOREF(pDrvIns, pFilter);
+    return VERR_NOT_IMPLEMENTED;
+#endif
+}
+
+
+/** @interface_method_impl{PDMDRVHLPR3,pfnNetShaperAllocateBandwidth} */
+static DECLCALLBACK(bool) pdmR3DrvHlp_NetShaperAllocateBandwidth(PPDMDRVINS pDrvIns, PPDMNSFILTER pFilter, size_t cbTransfer)
+{
+#ifdef VBOX_WITH_NETSHAPER
+    PDMDRV_ASSERT_DRVINS(pDrvIns);
+    LogFlow(("pdmR3DrvHlp_NetShaperDetach: caller='%s'/%d: pFilter=%p cbTransfer=%#zx\n",
+             pDrvIns->pReg->szName, pDrvIns->iInstance, pFilter, cbTransfer));
+
+    bool const fRc = PDMNetShaperAllocateBandwidth(pDrvIns->Internal.s.pVMR3, pFilter, cbTransfer);
+
+    LogFlow(("pdmR3DrvHlp_NetShaperDetach: caller='%s'/%d: returns %RTbool\n", pDrvIns->pReg->szName, pDrvIns->iInstance, fRc));
+    return fRc;
+#else
+    RT_NOREF(pDrvIns, pFilter, cbTransfer);
+    return true;
+#endif
+}
 
 
@@ -1796,6 +1823,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    RT_NOREF(pDrvIns);
-    return PDMCritSectEnter(pCritSect, rcBusy);
+    return PDMCritSectEnter(pDrvIns->Internal.s.pVMR3, pCritSect, rcBusy);
 }
 
@@ -1806,6 +1832,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    RT_NOREF(pDrvIns);
-    return PDMCritSectEnterDebug(pCritSect, rcBusy, uId, RT_SRC_POS_ARGS);
+    return PDMCritSectEnterDebug(pDrvIns->Internal.s.pVMR3, pCritSect, rcBusy, uId, RT_SRC_POS_ARGS);
 }
 
@@ -1815,6 +1840,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    RT_NOREF(pDrvIns);
-    return PDMCritSectTryEnter(pCritSect);
+    return PDMCritSectTryEnter(pDrvIns->Internal.s.pVMR3, pCritSect);
 }
 
@@ -1825,6 +1849,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    RT_NOREF(pDrvIns);
-    return PDMCritSectTryEnterDebug(pCritSect, uId, RT_SRC_POS_ARGS);
+    return PDMCritSectTryEnterDebug(pDrvIns->Internal.s.pVMR3, pCritSect, uId, RT_SRC_POS_ARGS);
 }
 
@@ -1834,6 +1857,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    RT_NOREF(pDrvIns);
-    return PDMCritSectLeave(pCritSect);
+    return PDMCritSectLeave(pDrvIns->Internal.s.pVMR3, pCritSect);
 }
 
@@ -1843,6 +1865,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    RT_NOREF(pDrvIns);
-    return PDMCritSectIsOwner(pCritSect);
+    return PDMCritSectIsOwner(pDrvIns->Internal.s.pVMR3, pCritSect);
 }
 
@@ -1861,6 +1882,5 @@
 {
     PDMDRV_ASSERT_DRVINS(pDrvIns);
-    RT_NOREF(pDrvIns);
-    return PDMCritSectHasWaiters(pCritSect);
+    return PDMCritSectHasWaiters(pDrvIns->Internal.s.pVMR3, pCritSect);
 }
 
@@ -2044,8 +2064,7 @@
     pdmR3DrvHlp_ThreadCreate,
     pdmR3DrvHlp_AsyncCompletionTemplateCreate,
-#ifdef VBOX_WITH_NETSHAPER
     pdmR3DrvHlp_NetShaperAttach,
     pdmR3DrvHlp_NetShaperDetach,
-#endif /* VBOX_WITH_NETSHAPER */
+    pdmR3DrvHlp_NetShaperAllocateBandwidth,
     pdmR3DrvHlp_LdrGetRCInterfaceSymbols,
     pdmR3DrvHlp_LdrGetR0InterfaceSymbols,
Index: trunk/src/VBox/VMM/VMMR3/PDMNetShaper.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/PDMNetShaper.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/PDMNetShaper.cpp	(revision 90346)
@@ -249,10 +249,11 @@
 {
     PPDMNSBWGROUP pBwGroup = pFilter->pBwGroupR3;
-    int rc = PDMCritSectEnter(&pBwGroup->Lock, VERR_SEM_BUSY); AssertRC(rc);
+    PVM const     pVM      = pBwGroup->pShaperR3->pVM;
+    int rc = PDMCritSectEnter(pVM, &pBwGroup->Lock, VERR_SEM_BUSY); AssertRC(rc);
 
     pFilter->pNextR3 = pBwGroup->pFiltersHeadR3;
     pBwGroup->pFiltersHeadR3 = pFilter;
 
-    rc = PDMCritSectLeave(&pBwGroup->Lock); AssertRC(rc);
+    rc = PDMCritSectLeave(pVM, &pBwGroup->Lock); AssertRC(rc);
 }
 
@@ -269,5 +270,6 @@
     AssertPtr(pBwGroup->pShaperR3);
     Assert(RTCritSectIsOwner(&pBwGroup->pShaperR3->Lock));
-    int rc = PDMCritSectEnter(&pBwGroup->Lock, VERR_SEM_BUSY); AssertRC(rc);
+    PVM const pVM = pBwGroup->pShaperR3->pVM;
+    int rc = PDMCritSectEnter(pVM, &pBwGroup->Lock, VERR_SEM_BUSY); AssertRC(rc);
 
     if (pFilter == pBwGroup->pFiltersHeadR3)
@@ -284,5 +286,5 @@
     }
 
-    rc = PDMCritSectLeave(&pBwGroup->Lock); AssertRC(rc);
+    rc = PDMCritSectLeave(pVM, &pBwGroup->Lock); AssertRC(rc);
 }
 
@@ -383,5 +385,5 @@
     if (pBwGroup)
     {
-        rc = PDMCritSectEnter(&pBwGroup->Lock, VERR_SEM_BUSY); AssertRC(rc);
+        rc = PDMCritSectEnter(pUVM->pVM, &pBwGroup->Lock, VERR_SEM_BUSY); AssertRC(rc);
         if (RT_SUCCESS(rc))
         {
@@ -392,5 +394,5 @@
                 pBwGroup->cbTokensLast = pBwGroup->cbBucket;
 
-            int rc2 = PDMCritSectLeave(&pBwGroup->Lock); AssertRC(rc2);
+            int rc2 = PDMCritSectLeave(pUVM->pVM, &pBwGroup->Lock); AssertRC(rc2);
         }
     }
Index: trunk/src/VBox/VMM/VMMR3/PDMUsb.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/PDMUsb.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/PDMUsb.cpp	(revision 90346)
@@ -1919,12 +1919,13 @@
 {
     PDMUSB_ASSERT_USBINS(pUsbIns);
-    int rc = TMTimerLock(pUsbIns->Internal.s.pVM, hTimer, VERR_IGNORED);
+    PVM const pVM = pUsbIns->Internal.s.pVM;
+    int rc = TMTimerLock(pVM, hTimer, VERR_IGNORED);
     if (rc == VINF_SUCCESS)
     {
-        rc = PDMCritSectEnter(pCritSect, VERR_IGNORED);
+        rc = PDMCritSectEnter(pVM, pCritSect, VERR_IGNORED);
         if (rc == VINF_SUCCESS)
             return rc;
         AssertRC(rc);
-        TMTimerUnlock(pUsbIns->Internal.s.pVM, hTimer);
+        TMTimerUnlock(pVM, hTimer);
     }
     else
@@ -2002,6 +2003,7 @@
 {
     PDMUSB_ASSERT_USBINS(pUsbIns);
-    TMTimerUnlock(pUsbIns->Internal.s.pVM, hTimer);
-    int rc = PDMCritSectLeave(pCritSect);
+    PVM const pVM = pUsbIns->Internal.s.pVM;
+    TMTimerUnlock(pVM, hTimer);
+    int rc = PDMCritSectLeave(pVM, pCritSect);
     AssertRC(rc);
 }
Index: trunk/src/VBox/VMM/VMMR3/PGM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/PGM.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/PGM.cpp	(revision 90346)
@@ -2373,5 +2373,5 @@
 VMMR3DECL(int) PGMR3LockCall(PVM pVM)
 {
-    int rc = PDMR3CritSectEnterEx(&pVM->pgm.s.CritSectX, true /* fHostCall */);
+    int rc = PDMR3CritSectEnterEx(pVM, &pVM->pgm.s.CritSectX, true /* fHostCall */);
     AssertRC(rc);
     return rc;
Index: trunk/src/VBox/VMM/VMMR3/SSM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/SSM.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/SSM.cpp	(revision 90346)
@@ -4479,12 +4479,13 @@
  * Enters the critical session (optionally) associated with the unit.
  *
+ * @param   pVM                 The cross context VM structure.
  * @param   pUnit               The unit.
  */
-DECLINLINE(void) ssmR3UnitCritSectEnter(PSSMUNIT pUnit)
+DECLINLINE(void) ssmR3UnitCritSectEnter(PVM pVM, PSSMUNIT pUnit)
 {
     PPDMCRITSECT pCritSect = pUnit->pCritSect;
     if (pCritSect)
     {
-        int rc = PDMCritSectEnter(pCritSect, VERR_IGNORED);
+        int rc = PDMCritSectEnter(pVM, pCritSect, VERR_IGNORED);
         AssertRC(rc);
     }
@@ -4495,12 +4496,13 @@
  * Leaves the critical session (optionally) associated with the unit.
  *
+ * @param   pVM                 The cross context VM structure.
  * @param   pUnit               The unit.
  */
-DECLINLINE(void) ssmR3UnitCritSectLeave(PSSMUNIT pUnit)
+DECLINLINE(void) ssmR3UnitCritSectLeave(PVM pVM, PSSMUNIT pUnit)
 {
     PPDMCRITSECT pCritSect = pUnit->pCritSect;
     if (pCritSect)
     {
-        int rc = PDMCritSectLeave(pCritSect);
+        int rc = PDMCritSectLeave(pVM, pCritSect);
         AssertRC(rc);
     }
@@ -4531,5 +4533,5 @@
             int rcOld = pSSM->rc;
             int rc;
-            ssmR3UnitCritSectEnter(pUnit);
+            ssmR3UnitCritSectEnter(pVM, pUnit);
             switch (pUnit->enmType)
             {
@@ -4553,5 +4555,5 @@
                     break;
             }
-            ssmR3UnitCritSectLeave(pUnit);
+            ssmR3UnitCritSectLeave(pVM, pUnit);
             if (RT_SUCCESS(rc) && pSSM->rc != rcOld)
                 rc = pSSM->rc;
@@ -4883,5 +4885,5 @@
          */
         ssmR3DataWriteBegin(pSSM);
-        ssmR3UnitCritSectEnter(pUnit);
+        ssmR3UnitCritSectEnter(pVM, pUnit);
         switch (pUnit->enmType)
         {
@@ -4906,5 +4908,5 @@
                 break;
         }
-        ssmR3UnitCritSectLeave(pUnit);
+        ssmR3UnitCritSectLeave(pVM, pUnit);
         pUnit->fCalled = true;
         if (RT_FAILURE(rc) && RT_SUCCESS_NP(pSSM->rc))
@@ -4976,5 +4978,5 @@
         {
             int rc;
-            ssmR3UnitCritSectEnter(pUnit);
+            ssmR3UnitCritSectEnter(pVM, pUnit);
             switch (pUnit->enmType)
             {
@@ -4998,5 +5000,5 @@
                     break;
             }
-            ssmR3UnitCritSectLeave(pUnit);
+            ssmR3UnitCritSectLeave(pVM, pUnit);
             pUnit->fCalled = true;
             if (RT_FAILURE(rc) && RT_SUCCESS_NP(pSSM->rc))
@@ -5322,5 +5324,5 @@
         {
             int rc;
-            ssmR3UnitCritSectEnter(pUnit);
+            ssmR3UnitCritSectEnter(pVM, pUnit);
             switch (pUnit->enmType)
             {
@@ -5344,5 +5346,5 @@
                     break;
             }
-            ssmR3UnitCritSectLeave(pUnit);
+            ssmR3UnitCritSectLeave(pVM, pUnit);
             pUnit->fCalled = true;
             Assert(pSSM->rc == VINF_SUCCESS);
@@ -5465,5 +5467,5 @@
          */
         ssmR3DataWriteBegin(pSSM);
-        ssmR3UnitCritSectEnter(pUnit);
+        ssmR3UnitCritSectEnter(pVM, pUnit);
         switch (pUnit->enmType)
         {
@@ -5487,5 +5489,5 @@
                 break;
         }
-        ssmR3UnitCritSectLeave(pUnit);
+        ssmR3UnitCritSectLeave(pVM, pUnit);
         pUnit->fCalled = true;
         if (RT_FAILURE(rc) && RT_SUCCESS_NP(pSSM->rc))
@@ -5627,5 +5629,5 @@
         {
             int rc;
-            ssmR3UnitCritSectEnter(pUnit);
+            ssmR3UnitCritSectEnter(pVM, pUnit);
             switch (pUnit->enmType)
             {
@@ -5649,5 +5651,5 @@
                     break;
             }
-            ssmR3UnitCritSectLeave(pUnit);
+            ssmR3UnitCritSectLeave(pVM, pUnit);
             pUnit->fCalled = true;
             if (RT_FAILURE(rc) && RT_SUCCESS_NP(pSSM->rc))
@@ -8607,5 +8609,5 @@
                             break;
                         }
-                        ssmR3UnitCritSectEnter(pUnit);
+                        ssmR3UnitCritSectEnter(pVM, pUnit);
                         switch (pUnit->enmType)
                         {
@@ -8629,5 +8631,5 @@
                                 break;
                         }
-                        ssmR3UnitCritSectLeave(pUnit);
+                        ssmR3UnitCritSectLeave(pVM, pUnit);
                         pUnit->fCalled = true;
                         if (RT_FAILURE(rc) && RT_SUCCESS_NP(pSSM->rc))
@@ -8875,5 +8877,5 @@
             pSSM->u.Read.pCurUnit     = pUnit;
             ssmR3DataReadBeginV2(pSSM);
-            ssmR3UnitCritSectEnter(pUnit);
+            ssmR3UnitCritSectEnter(pVM, pUnit);
             switch (pUnit->enmType)
             {
@@ -8897,5 +8899,5 @@
                     break;
             }
-            ssmR3UnitCritSectLeave(pUnit);
+            ssmR3UnitCritSectLeave(pVM, pUnit);
             pUnit->fCalled = true;
             if (RT_FAILURE(rc) && RT_SUCCESS_NP(pSSM->rc))
@@ -9059,5 +9061,5 @@
                 Handle.u.Read.pCurUnit = pUnit;
                 pUnit->fCalled = true;
-                ssmR3UnitCritSectEnter(pUnit);
+                ssmR3UnitCritSectEnter(pVM, pUnit);
                 switch (pUnit->enmType)
                 {
@@ -9081,5 +9083,5 @@
                         break;
                 }
-                ssmR3UnitCritSectLeave(pUnit);
+                ssmR3UnitCritSectLeave(pVM, pUnit);
                 Handle.u.Read.pCurUnit = NULL;
                 if (RT_FAILURE(rc) && RT_SUCCESS_NP(Handle.rc))
@@ -9135,5 +9137,5 @@
                 int const rcOld = Handle.rc;
                 rc = VINF_SUCCESS;
-                ssmR3UnitCritSectEnter(pUnit);
+                ssmR3UnitCritSectEnter(pVM, pUnit);
                 switch (pUnit->enmType)
                 {
@@ -9157,5 +9159,5 @@
                         break;
                 }
-                ssmR3UnitCritSectLeave(pUnit);
+                ssmR3UnitCritSectLeave(pVM, pUnit);
                 Handle.u.Read.pCurUnit = NULL;
                 if (RT_SUCCESS(rc) && Handle.rc != rcOld)
Index: trunk/src/VBox/VMM/VMMR3/TM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/TM.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/TM.cpp	(revision 90346)
@@ -1246,7 +1246,7 @@
     {
         PTMTIMERQUEUE pQueue = &pVM->tm.s.aTimerQueues[idxQueue];
-        PDMCritSectEnter(&pQueue->TimerLock, VERR_IGNORED);
+        PDMCritSectEnter(pVM, &pQueue->TimerLock, VERR_IGNORED);
         tmTimerQueueSchedule(pVM, pQueue, pQueue);
-        PDMCritSectLeave(&pQueue->TimerLock);
+        PDMCritSectLeave(pVM, &pQueue->TimerLock);
     }
 #ifdef VBOX_STRICT
@@ -1879,5 +1879,5 @@
     AssertMsg(   !pTimer->pCritSect
               || VMR3GetState(pVM) != VMSTATE_RUNNING
-              || PDMCritSectIsOwner(pTimer->pCritSect), ("%s\n", pTimer->szName));
+              || PDMCritSectIsOwner(pVM, pTimer->pCritSect), ("%s\n", pTimer->szName));
 
     /*
@@ -1886,5 +1886,5 @@
      */
     PDMCritSectRwEnterExcl(&pQueue->AllocLock, VERR_IGNORED);
-    PDMCritSectEnter(&pQueue->TimerLock, VERR_IGNORED);
+    PDMCritSectEnter(pVM, &pQueue->TimerLock, VERR_IGNORED);
 
     for (int cRetries = 1000;; cRetries--)
@@ -1924,5 +1924,5 @@
             case TMTIMERSTATE_PENDING_RESCHEDULE_SET_EXPIRE:
                 AssertMsgFailed(("%p:.enmState=%s %s\n", pTimer, tmTimerState(enmState), pTimer->szName));
-                PDMCritSectLeave(&pQueue->TimerLock);
+                PDMCritSectLeave(pVM, &pQueue->TimerLock);
                 PDMCritSectRwLeaveExcl(&pQueue->AllocLock);
 
@@ -1933,5 +1933,5 @@
 
                 PDMCritSectRwEnterExcl(&pQueue->AllocLock, VERR_IGNORED);
-                PDMCritSectEnter(&pQueue->TimerLock, VERR_IGNORED);
+                PDMCritSectEnter(pVM, &pQueue->TimerLock, VERR_IGNORED);
                 continue;
 
@@ -1941,5 +1941,5 @@
             case TMTIMERSTATE_FREE:
             case TMTIMERSTATE_DESTROY:
-                PDMCritSectLeave(&pQueue->TimerLock);
+                PDMCritSectLeave(pVM, &pQueue->TimerLock);
                 PDMCritSectRwLeaveExcl(&pQueue->AllocLock);
                 AssertLogRelMsgFailedReturn(("pTimer=%p %s\n", pTimer, tmTimerState(enmState)), VERR_TM_INVALID_STATE);
@@ -1947,5 +1947,5 @@
             default:
                 AssertMsgFailed(("Unknown timer state %d (%s)\n", enmState, pTimer->szName));
-                PDMCritSectLeave(&pQueue->TimerLock);
+                PDMCritSectLeave(pVM, &pQueue->TimerLock);
                 PDMCritSectRwLeaveExcl(&pQueue->AllocLock);
                 return VERR_TM_UNKNOWN_STATE;
@@ -1961,5 +1961,5 @@
             break;
         AssertMsgFailed(("%p:.enmState=%s %s\n", pTimer, tmTimerState(enmState), pTimer->szName));
-        PDMCritSectLeave(&pQueue->TimerLock);
+        PDMCritSectLeave(pVM, &pQueue->TimerLock);
         PDMCritSectRwLeaveExcl(&pQueue->AllocLock);
 
@@ -1968,5 +1968,5 @@
 
         PDMCritSectRwEnterExcl(&pQueue->AllocLock, VERR_IGNORED);
-        PDMCritSectEnter(&pQueue->TimerLock, VERR_IGNORED);
+        PDMCritSectEnter(pVM, &pQueue->TimerLock, VERR_IGNORED);
     }
 
@@ -2025,5 +2025,5 @@
     tmTimerQueuesSanityChecks(pVM, "TMR3TimerDestroy");
 #endif
-    PDMCritSectLeave(&pQueue->TimerLock);
+    PDMCritSectLeave(pVM, &pQueue->TimerLock);
     PDMCritSectRwLeaveExcl(&pQueue->AllocLock);
     return VINF_SUCCESS;
@@ -2319,5 +2319,5 @@
         {
             STAM_PROFILE_START(&pTimer->StatCritSectEnter, Locking);
-            PDMCritSectEnter(pCritSect, VERR_IGNORED);
+            PDMCritSectEnter(pVM, pCritSect, VERR_IGNORED);
             STAM_PROFILE_STOP(&pTimer->StatCritSectEnter, Locking);
         }
@@ -2364,5 +2364,5 @@
         }
         if (pCritSect)
-            PDMCritSectLeave(pCritSect);
+            PDMCritSectLeave(pVM, pCritSect);
 
         /* Advance? */
@@ -2390,5 +2390,5 @@
     {
         STAM_PROFILE_START(&pQueue->StatDo, s);
-        PDMCritSectEnter(&pQueue->TimerLock, VERR_IGNORED);
+        PDMCritSectEnter(pVM, &pQueue->TimerLock, VERR_IGNORED);
 
         if (pQueue->idxSchedule != UINT32_MAX)
@@ -2399,5 +2399,5 @@
             tmR3TimerQueueRun(pVM, pQueue, pHead);
 
-        PDMCritSectLeave(&pQueue->TimerLock);
+        PDMCritSectLeave(pVM, &pQueue->TimerLock);
         STAM_PROFILE_STOP(&pQueue->StatDo, s);
         ASMAtomicWriteBool(&pQueue->fBeingProcessed, false);
@@ -2423,5 +2423,5 @@
     PTMTIMERQUEUE const pQueue = &pVM->tm.s.aTimerQueues[TMCLOCK_VIRTUAL_SYNC];
     VM_ASSERT_EMT(pVM);
-    Assert(PDMCritSectIsOwner(&pVM->tm.s.VirtualSyncLock));
+    Assert(PDMCritSectIsOwner(pVM, &pVM->tm.s.VirtualSyncLock));
 
     /*
@@ -2548,5 +2548,5 @@
         {
             STAM_PROFILE_START(&pTimer->StatCritSectEnter, Locking);
-            PDMCritSectEnter(pCritSect, VERR_IGNORED);
+            PDMCritSectEnter(pVM, pCritSect, VERR_IGNORED);
             STAM_PROFILE_STOP(&pTimer->StatCritSectEnter, Locking);
         }
@@ -2594,5 +2594,5 @@
         /* Leave the associated lock. */
         if (pCritSect)
-            PDMCritSectLeave(pCritSect);
+            PDMCritSectLeave(pVM, pCritSect);
     } /* run loop */
 
@@ -2751,18 +2751,18 @@
 /** @todo Optimize for SMP   */
         STAM_PROFILE_START(&pVM->tm.s.StatVirtualSyncFF, a);
-        PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VERR_IGNORED);
+        PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VERR_IGNORED);
         if (pVM->tm.s.fVirtualSyncTicking)
         {
             STAM_PROFILE_STOP(&pVM->tm.s.StatVirtualSyncFF, a); /* before the unlock! */
-            PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+            PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
             Log2(("TMR3VirtualSyncFF: ticking\n"));
         }
         else
         {
-            PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+            PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
 
             /* try run it. */
-            PDMCritSectEnter(&pVM->tm.s.aTimerQueues[TMCLOCK_VIRTUAL].TimerLock, VERR_IGNORED);
-            PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VERR_IGNORED);
+            PDMCritSectEnter(pVM, &pVM->tm.s.aTimerQueues[TMCLOCK_VIRTUAL].TimerLock, VERR_IGNORED);
+            PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VERR_IGNORED);
             if (pVM->tm.s.fVirtualSyncTicking)
                 Log2(("TMR3VirtualSyncFF: ticking (2)\n"));
@@ -2779,7 +2779,7 @@
                 ASMAtomicWriteBool(&pVM->tm.s.fRunningVirtualSyncQueue, false);
             }
-            PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+            PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
             STAM_PROFILE_STOP(&pVM->tm.s.StatVirtualSyncFF, a); /* before the unlock! */
-            PDMCritSectLeave(&pVM->tm.s.aTimerQueues[TMCLOCK_VIRTUAL].TimerLock);
+            PDMCritSectLeave(pVM, &pVM->tm.s.aTimerQueues[TMCLOCK_VIRTUAL].TimerLock);
         }
     }
@@ -2790,5 +2790,5 @@
  * Service the special virtual sync timer queue.
  *
- * @param   pVM     The cross context VM structure.
+ * @param   pVM         The cross context VM structure.
  * @param   pVCpuDst    The destination VCpu.
  */
@@ -2799,6 +2799,6 @@
     {
         STAM_PROFILE_START(&pQueue->StatDo, s1);
-        PDMCritSectEnter(&pQueue->TimerLock, VERR_IGNORED);
-        PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VERR_IGNORED);
+        PDMCritSectEnter(pVM, &pQueue->TimerLock, VERR_IGNORED);
+        PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VERR_IGNORED);
         ASMAtomicWriteBool(&pVM->tm.s.fRunningVirtualSyncQueue, true);
         VMCPU_FF_CLEAR(pVCpuDst, VMCPU_FF_TIMER);   /* Clear the FF once we started working for real. */
@@ -2810,6 +2810,6 @@
 
         ASMAtomicWriteBool(&pVM->tm.s.fRunningVirtualSyncQueue, false);
-        PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
-        PDMCritSectLeave(&pQueue->TimerLock);
+        PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
+        PDMCritSectLeave(pVM, &pQueue->TimerLock);
         STAM_PROFILE_STOP(&pQueue->StatDo, s1);
         ASMAtomicWriteBool(&pQueue->fBeingProcessed, false);
@@ -2974,8 +2974,8 @@
     /* Enter the critical sections to make TMTimerSet/Stop happy. */
     if (pQueue->enmClock == TMCLOCK_VIRTUAL_SYNC)
-        PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VERR_IGNORED);
+        PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VERR_IGNORED);
     PPDMCRITSECT pCritSect = pTimer->pCritSect;
     if (pCritSect)
-        PDMCritSectEnter(pCritSect, VERR_IGNORED);
+        PDMCritSectEnter(pVM, pCritSect, VERR_IGNORED);
 
     if (u8State == TMTIMERSTATE_SAVED_PENDING_SCHEDULE)
@@ -3005,7 +3005,7 @@
 
     if (pCritSect)
-        PDMCritSectLeave(pCritSect);
+        PDMCritSectLeave(pVM, pCritSect);
     if (pQueue->enmClock == TMCLOCK_VIRTUAL_SYNC)
-        PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+        PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
 
     /*
@@ -3183,5 +3183,5 @@
 {
     VMCPU_ASSERT_EMT(pVCpu);
-    PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VERR_IGNORED); /* Paranoia: Exploiting the virtual sync lock here. */
+    PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VERR_IGNORED); /* Paranoia: Exploiting the virtual sync lock here. */
 
     /*
@@ -3189,5 +3189,5 @@
      */
     int rc = tmVirtualPauseLocked(pVM);
-    AssertRCReturnStmt(rc, PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock), rc);
+    AssertRCReturnStmt(rc, PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock), rc);
 
     /*
@@ -3198,5 +3198,5 @@
     {
         rc = tmCpuTickPauseLocked(pVM, pVCpu);
-        AssertRCReturnStmt(rc, PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock), rc);
+        AssertRCReturnStmt(rc, PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock), rc);
     }
 
@@ -3224,5 +3224,5 @@
 #endif
 
-    PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+    PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
     return VINF_SUCCESS;
 }
@@ -3240,5 +3240,5 @@
 {
     VMCPU_ASSERT_EMT(pVCpu);
-    PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VERR_IGNORED); /* Paranoia: Exploiting the virtual sync lock here. */
+    PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VERR_IGNORED); /* Paranoia: Exploiting the virtual sync lock here. */
 
 #ifndef VBOX_WITHOUT_NS_ACCOUNTING
@@ -3261,5 +3261,5 @@
     {
         int rc = tmCpuTickResumeLocked(pVM, pVCpu);
-        AssertRCReturnStmt(rc, PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock), rc);
+        AssertRCReturnStmt(rc, PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock), rc);
     }
 
@@ -3269,5 +3269,5 @@
     int rc = tmVirtualResumeLocked(pVM);
 
-    PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+    PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
     return rc;
 }
@@ -3311,5 +3311,5 @@
  * TM level and make it affect TMR3UTCNow as well! */
 
-    PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VERR_IGNORED); /* Paranoia: Exploiting the virtual sync lock here. */
+    PDMCritSectEnter(pVM, &pVM->tm.s.VirtualSyncLock, VERR_IGNORED); /* Paranoia: Exploiting the virtual sync lock here. */
 
     /*
@@ -3330,5 +3330,5 @@
         TMR3NotifyResume(pVM, pVCpu);
 
-    PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
+    PDMCritSectLeave(pVM, &pVM->tm.s.VirtualSyncLock);
     return VINF_SUCCESS;
 }
@@ -3934,5 +3934,5 @@
         const char * const  pszClock = tmR3Get5CharClockName(pQueue->enmClock);
         PDMCritSectRwEnterShared(&pQueue->AllocLock, VERR_IGNORED);
-        PDMCritSectEnter(&pQueue->TimerLock, VERR_IGNORED);
+        PDMCritSectEnter(pVM, &pQueue->TimerLock, VERR_IGNORED);
 
         for (PTMTIMERR3 pTimer = tmTimerQueueGetHead(pQueue, pQueue);
@@ -3954,5 +3954,5 @@
         }
 
-        PDMCritSectLeave(&pQueue->TimerLock);
+        PDMCritSectLeave(pVM, &pQueue->TimerLock);
         PDMCritSectRwLeaveShared(&pQueue->AllocLock);
     }
Index: trunk/src/VBox/VMM/VMMR3/VMM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/VMM.cpp	(revision 90329)
+++ trunk/src/VBox/VMM/VMMR3/VMM.cpp	(revision 90346)
@@ -2371,5 +2371,5 @@
      */
     if (VMCPU_FF_IS_SET(pVCpu, VMCPU_FF_PDM_CRITSECT))
-        PDMCritSectBothFF(pVCpu);
+        PDMCritSectBothFF(pVM, pVCpu);
 
     switch (pVCpu->vmm.s.enmCallRing3Operation)
@@ -2380,5 +2380,5 @@
         case VMMCALLRING3_PDM_CRIT_SECT_ENTER:
         {
-            pVCpu->vmm.s.rcCallRing3 = PDMR3CritSectEnterEx((PPDMCRITSECT)(uintptr_t)pVCpu->vmm.s.u64CallRing3Arg,
+            pVCpu->vmm.s.rcCallRing3 = PDMR3CritSectEnterEx(pVM, (PPDMCRITSECT)(uintptr_t)pVCpu->vmm.s.u64CallRing3Arg,
                                                             true /*fCallRing3*/);
             break;
Index: trunk/src/VBox/VMM/include/IOMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/IOMInternal.h	(revision 90329)
+++ trunk/src/VBox/VMM/include/IOMInternal.h	(revision 90346)
@@ -584,10 +584,10 @@
 # define IOM_IS_EXCL_LOCK_OWNER(a_pVM)          PDMCritSectRwIsWriteOwner(&(a_pVM)->iom.s.CritSect)
 #else
-# define IOM_LOCK_EXCL(a_pVM)                   PDMCritSectEnter(&(a_pVM)->iom.s.CritSect, VERR_SEM_BUSY)
-# define IOM_UNLOCK_EXCL(a_pVM)                 do { PDMCritSectLeave(&(a_pVM)->iom.s.CritSect); } while (0)
-# define IOM_LOCK_SHARED_EX(a_pVM, a_rcBusy)    PDMCritSectEnter(&(a_pVM)->iom.s.CritSect, (a_rcBusy))
-# define IOM_UNLOCK_SHARED(a_pVM)               do { PDMCritSectLeave(&(a_pVM)->iom.s.CritSect); } while (0)
-# define IOM_IS_SHARED_LOCK_OWNER(a_pVM)        PDMCritSectIsOwner(&(a_pVM)->iom.s.CritSect)
-# define IOM_IS_EXCL_LOCK_OWNER(a_pVM)          PDMCritSectIsOwner(&(a_pVM)->iom.s.CritSect)
+# define IOM_LOCK_EXCL(a_pVM)                   PDMCritSectEnter((a_pVM), &(a_pVM)->iom.s.CritSect, VERR_SEM_BUSY)
+# define IOM_UNLOCK_EXCL(a_pVM)                 do { PDMCritSectLeave((a_pVM), &(a_pVM)->iom.s.CritSect); } while (0)
+# define IOM_LOCK_SHARED_EX(a_pVM, a_rcBusy)    PDMCritSectEnter((a_pVM), &(a_pVM)->iom.s.CritSect, (a_rcBusy))
+# define IOM_UNLOCK_SHARED(a_pVM)               do { PDMCritSectLeave((a_pVM), &(a_pVM)->iom.s.CritSect); } while (0)
+# define IOM_IS_SHARED_LOCK_OWNER(a_pVM)        PDMCritSectIsOwner((a_pVM), &(a_pVM)->iom.s.CritSect)
+# define IOM_IS_EXCL_LOCK_OWNER(a_pVM)          PDMCritSectIsOwner((a_pVM), &(a_pVM)->iom.s.CritSect)
 #endif
 #define IOM_LOCK_SHARED(a_pVM)                  IOM_LOCK_SHARED_EX(a_pVM, VERR_SEM_BUSY)
Index: trunk/src/VBox/VMM/include/PDMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/PDMInternal.h	(revision 90329)
+++ trunk/src/VBox/VMM/include/PDMInternal.h	(revision 90346)
@@ -1700,5 +1700,5 @@
 int         pdmLockEx(PVMCC pVM, int rc);
 void        pdmUnlock(PVMCC pVM);
-bool        pdmLockIsOwner(PCVMCC pVM);
+bool        pdmLockIsOwner(PVMCC pVM);
 
 #if defined(VBOX_WITH_IOMMU_AMD) || defined(VBOX_WITH_IOMMU_INTEL)
Index: trunk/src/VBox/VMM/include/PGMInternal.h
===================================================================
--- trunk/src/VBox/VMM/include/PGMInternal.h	(revision 90329)
+++ trunk/src/VBox/VMM/include/PGMInternal.h	(revision 90346)
@@ -3903,5 +3903,5 @@
 int             pgmLock(PVMCC pVM);
 #endif
-void            pgmUnlock(PVM pVM);
+void            pgmUnlock(PVMCC pVM);
 /**
  * Asserts that the caller owns the PDM lock.
@@ -3909,5 +3909,5 @@
  * @param   a_pVM           Pointer to the VM.
  */
-#define PGM_LOCK_ASSERT_OWNER(a_pVM)    Assert(PDMCritSectIsOwner(&(a_pVM)->pgm.s.CritSectX))
+#define PGM_LOCK_ASSERT_OWNER(a_pVM)    Assert(PDMCritSectIsOwner((a_pVM), &(a_pVM)->pgm.s.CritSectX))
 /**
  * Asserts that the caller owns the PDM lock.
@@ -3916,5 +3916,5 @@
  * @param   a_pVCpu         The current CPU handle.
  */
-#define PGM_LOCK_ASSERT_OWNER_EX(a_pVM, a_pVCpu)  Assert(PDMCritSectIsOwnerEx(&(a_pVM)->pgm.s.CritSectX, a_pVCpu))
+#define PGM_LOCK_ASSERT_OWNER_EX(a_pVM, a_pVCpu)  Assert(PDMCritSectIsOwnerEx((a_pVCpu), &(a_pVM)->pgm.s.CritSectX))
 
 #ifndef PGM_WITHOUT_MAPPINGS
@@ -3966,5 +3966,5 @@
 void            pgmPhysInvalidRamRangeTlbs(PVMCC pVM);
 void            pgmPhysInvalidatePageMapTLB(PVMCC pVM);
-void            pgmPhysInvalidatePageMapTLBEntry(PVM pVM, RTGCPHYS GCPhys);
+void            pgmPhysInvalidatePageMapTLBEntry(PVMCC pVM, RTGCPHYS GCPhys);
 PPGMRAMRANGE    pgmPhysGetRangeSlow(PVM pVM, RTGCPHYS GCPhys);
 PPGMRAMRANGE    pgmPhysGetRangeAtOrAboveSlow(PVM pVM, RTGCPHYS GCPhys);
@@ -4003,5 +4003,5 @@
 int             pgmPoolHCPhys2Ptr(PVM pVM, RTHCPHYS HCPhys, void **ppv);
 int             pgmPoolSyncCR3(PVMCPUCC pVCpu);
-bool            pgmPoolIsDirtyPageSlow(PVM pVM, RTGCPHYS GCPhys);
+bool            pgmPoolIsDirtyPageSlow(PVMCC pVM, RTGCPHYS GCPhys);
 void            pgmPoolInvalidateDirtyPage(PVMCC pVM, RTGCPHYS GCPhysPT);
 int             pgmPoolTrackUpdateGCPhys(PVMCC pVM, RTGCPHYS GCPhysPage, PPGMPAGE pPhysPage, bool fFlushPTEs, bool *pfFlushTLBs);
@@ -4018,5 +4018,5 @@
 void            pgmPoolAddDirtyPage(PVMCC pVM, PPGMPOOL pPool, PPGMPOOLPAGE pPage);
 void            pgmPoolResetDirtyPages(PVMCC pVM);
-void            pgmPoolResetDirtyPage(PVM pVM, RTGCPTR GCPtrPage);
+void            pgmPoolResetDirtyPage(PVMCC pVM, RTGCPTR GCPtrPage);
 
 int             pgmR3ExitShadowModeBeforePoolFlush(PVMCPU pVCpu);
