Index: /trunk/src/VBox/VMM/PDMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/PDMInternal.h	(revision 19783)
+++ /trunk/src/VBox/VMM/PDMInternal.h	(revision 19784)
@@ -613,6 +613,8 @@
 typedef enum PDMQUEUETYPE
 {
+    /** Uninitialized. */
+    PDMQUEUETYPE_UNINIT = 0,
     /** Device consumer. */
-    PDMQUEUETYPE_DEV = 1,
+    PDMQUEUETYPE_DEV,
     /** Driver consumer. */
     PDMQUEUETYPE_DRV,
@@ -1020,5 +1022,5 @@
 int         pdmLockEx(PVM pVM, int rc);
 void        pdmUnlock(PVM pVM);
-
+bool        pdmIsLockOwner(PVM pVM);
 /** @} */
 
Index: /trunk/src/VBox/VMM/PDMQueue.cpp
===================================================================
--- /trunk/src/VBox/VMM/PDMQueue.cpp	(revision 19783)
+++ /trunk/src/VBox/VMM/PDMQueue.cpp	(revision 19784)
@@ -92,11 +92,12 @@
      * Initialize the data fields.
      */
-    pQueue->pVMR3 = pVM;
-    pQueue->pVMR0 = fRZEnabled ? pVM->pVMR0 : NIL_RTR0PTR;
-    pQueue->pVMRC = fRZEnabled ? pVM->pVMRC : NIL_RTRCPTR;
+    pQueue->pVMR3   = pVM;
+    pQueue->pVMR0   = fRZEnabled ? pVM->pVMR0 : NIL_RTR0PTR;
+    pQueue->pVMRC   = fRZEnabled ? pVM->pVMRC : NIL_RTRCPTR;
+    pQueue->enmType = PDMQUEUETYPE_UNINIT;
     pQueue->cMilliesInterval = cMilliesInterval;
     //pQueue->pTimer = NULL;
-    pQueue->cbItem = cbItem;
-    pQueue->cItems = cItems;
+    pQueue->cbItem  = cbItem;
+    pQueue->cItems  = cItems;
     //pQueue->pPendingR3 = NULL;
     //pQueue->pPendingR0 = NULL;
@@ -144,6 +145,8 @@
          * Insert into the queue list for timer driven queues.
          */
+        pdmLock(pVM);
         pQueue->pNext = pVM->pdm.s.pQueuesTimer;
         pVM->pdm.s.pQueuesTimer = pQueue;
+        pdmUnlock(pVM);
     }
     else
@@ -159,4 +162,5 @@
          *   problem any longer. The priority might be a nice feature for later though.
          */
+        pdmLock(pVM);
         if (!pVM->pdm.s.pQueuesForced)
             pVM->pdm.s.pQueuesForced = pQueue;
@@ -168,4 +172,5 @@
             pPrev->pNext = pQueue;
         }
+        pdmUnlock(pVM);
     }
 
@@ -392,4 +397,5 @@
      * Unlink it.
      */
+    pdmLock(pVM);
     if (pQueue->pTimer)
     {
@@ -432,4 +438,5 @@
     pQueue->pNext = NULL;
     pQueue->pVMR3 = NULL;
+    pdmUnlock(pVM);
 
     /*
@@ -476,4 +483,5 @@
      * Unlink it.
      */
+    pdmLock(pVM);
     PPDMQUEUE pQueueNext = pVM->pdm.s.pQueuesTimer;
     PPDMQUEUE pQueue = pVM->pdm.s.pQueuesForced;
@@ -499,4 +507,6 @@
     } while (pQueue);
 
+    pdmUnlock(pVM);
+
     return VINF_SUCCESS;
 }
@@ -525,4 +535,5 @@
      * Unlink it.
      */
+    pdmLock(pVM);
     PPDMQUEUE pQueueNext = pVM->pdm.s.pQueuesTimer;
     PPDMQUEUE pQueue = pVM->pdm.s.pQueuesForced;
@@ -547,4 +558,5 @@
         pQueueNext = NULL;
     } while (pQueue);
+    pdmUnlock(pVM);
 
     return VINF_SUCCESS;
@@ -563,4 +575,5 @@
      * Process the queues.
      */
+    pdmLock(pVM);
     PPDMQUEUE pQueueNext = pVM->pdm.s.pQueuesTimer;
     PPDMQUEUE pQueue = pVM->pdm.s.pQueuesForced;
@@ -602,4 +615,5 @@
         pQueueNext = NULL;
     } while (pQueue);
+    pdmUnlock(pVM);
 }
 
@@ -617,7 +631,9 @@
     LogFlow(("PDMR3QueuesFlush:\n"));
 
+    Assert(!pdmIsLockOwner(pVM));
     /* Use atomic test and clear to prevent useless checks; pdmR3QueueFlush is SMP safe. */
     if (VM_FF_TESTANDCLEAR(pVM, VM_FF_PDM_QUEUES_BIT))
     {
+        pdmLock(pVM);
         for (PPDMQUEUE pCur = pVM->pdm.s.pQueuesForced; pCur; pCur = pCur->pNext)
         {
@@ -632,4 +648,5 @@
             }
         }
+        pdmUnlock(pVM);
     }
 }
@@ -653,5 +670,5 @@
 
     AssertMsg(pItems || pItemsRC || pItemsR0, ("ERROR: can't all be NULL now!\n"));
-
+    Assert(pdmIsLockOwner(pQueue->pVMR3));
 
     /*
@@ -801,4 +818,5 @@
     VM_ASSERT_EMT(pVM);
 
+    pdmLock(pVM);
     /*
      * Flush the queue.
@@ -832,4 +850,5 @@
             }
     }
+    pdmUnlock(pVM);
 }
 
@@ -840,4 +859,6 @@
  * @param   pQueue  The queue.
  * @param   pItem   The item.
+ *
+ * Note: SMP safe
  */
 DECLINLINE(void) pdmR3QueueFree(PPDMQUEUE pQueue, PPDMQUEUEITEMCORE pItem)
@@ -872,9 +893,14 @@
     PPDMQUEUE pQueue = (PPDMQUEUE)pvUser;
     Assert(pTimer == pQueue->pTimer); NOREF(pTimer);
+    Assert(!pdmIsLockOwner(pVM));
 
     if (    pQueue->pPendingR3
         ||  pQueue->pPendingR0
         ||  pQueue->pPendingRC)
+    {
+        pdmLock(pVM);
         pdmR3QueueFlush(pQueue);
+        pdmUnlock(pVM);
+    }
     int rc = TMTimerSetMillies(pQueue->pTimer, pQueue->cMilliesInterval);
     AssertRC(rc);
Index: /trunk/src/VBox/VMM/VMMAll/PDMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PDMAll.cpp	(revision 19783)
+++ /trunk/src/VBox/VMM/VMMAll/PDMAll.cpp	(revision 19784)
@@ -349,4 +349,15 @@
 }
 
+/**
+ * Check if this VCPU currently owns the PDM lock.
+ *
+ * @returns bool owner/not owner
+ * @param   pVM         The VM to operate on.
+ */
+bool pdmIsLockOwner(PVM pVM)
+{
+    return PDMCritSectIsOwner(&pVM->pdm.s.CritSect);
+}
+
 
 /**
Index: /trunk/src/VBox/VMM/VMMAll/PDMAllQueue.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PDMAllQueue.cpp	(revision 19783)
+++ /trunk/src/VBox/VMM/VMMAll/PDMAllQueue.cpp	(revision 19784)
@@ -47,4 +47,6 @@
  * @param   pQueue      The queue handle.
  * @thread  Any thread.
+ *
+ * Note: SMP safe
  */
 VMMDECL(PPDMQUEUEITEMCORE) PDMQueueAlloc(PPDMQUEUE pQueue)
@@ -74,4 +76,6 @@
  * @param   pItem       The item to insert.
  * @thread  Any thread.
+ *
+ * Note: SMP safe
  */
 VMMDECL(void) PDMQueueInsert(PPDMQUEUE pQueue, PPDMQUEUEITEMCORE pItem)
@@ -192,4 +196,5 @@
 #else /* IN_RING3: */
     PVMREQ pReq;
+    Assert(!pdmIsLockOwner(pVM));
     VMR3ReqCall(pVM, VMCPUID_ANY, &pReq, RT_INDEFINITE_WAIT, (PFNRT)PDMR3QueueFlushWorker, 2, pVM, pQueue);
     VMR3ReqFree(pReq);
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 19783)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 19784)
@@ -421,5 +421,7 @@
                                 && !(uErr & X86_TRAP_PF_P))
                             {
+                                pgmLock(pVM);
                                 rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                                pgmUnlock(pVM);
                                 if (    RT_FAILURE(rc)
                                     || !(uErr & X86_TRAP_PF_RW)
@@ -467,5 +469,7 @@
                             && !(uErr & X86_TRAP_PF_P))
                         {
+                            pgmLock(pVM);
                             rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                            pgmUnlock(pVM);
                             if (    RT_FAILURE(rc)
                                 ||  rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
@@ -561,5 +565,7 @@
                         &&  !(uErr & X86_TRAP_PF_P))
                     {
+                        pgmLock(pVM);
                         rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                        pgmUnlock(pVM);
                         if (    RT_FAILURE(rc)
                             ||  rc == VINF_PGM_SYNCPAGE_MODIFIED_PDE
@@ -695,5 +701,7 @@
                                  */
                                 LogFlow(("CSAM ring 3 job\n"));
+                                pgmLock(pVM);
                                 int rc2 = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, 1, uErr);
+                                pgmUnlock(pVM);
                                 AssertRC(rc2);
 
@@ -743,5 +751,7 @@
                 }
 #   endif /* PGM_WITH_PAGING(PGM_GST_TYPE, PGM_SHW_TYPE) && !defined(IN_RING0) */
+                pgmLock(pVM);
                 rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, PGM_SYNC_NR_PAGES, uErr);
+                pgmUnlock(pVM);
                 if (RT_SUCCESS(rc))
                 {
@@ -788,5 +798,7 @@
                      *       page is not present, which is not true in this case.
                      */
+                    pgmLock(pVM);
                     rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, 1, uErr);
+                    pgmUnlock(pVM);
                     if (RT_SUCCESS(rc))
                     {
@@ -1221,8 +1233,10 @@
                     PGM_BTH_NAME(SyncPageWorkerTrackDeref)(pShwPage, pPT->a[iPTEDst].u & SHW_PTE_PG_MASK);
 #  endif
-                    pPT->a[iPTEDst].u = 0;
+                    ASMAtomicWriteSize(&pPT->a[iPTEDst], 0);
                 }
 # else /* Syncing it here isn't 100% safe and it's probably not worth spending time syncing it. */
+                pgmLock(pVM);
                 rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, GCPtrPage, 1, 0);
+                pgmUnlock(pVM);
                 if (RT_SUCCESS(rc))
                     rc = VINF_SUCCESS;
@@ -1610,4 +1624,5 @@
     LogFlow(("SyncPage: GCPtrPage=%RGv cPages=%u uErr=%#x\n", GCPtrPage, cPages, uErr));
 
+    Assert(PGMIsLockOwner(pVM));
 #if    (   PGM_GST_TYPE == PGM_TYPE_32BIT  \
         || PGM_GST_TYPE == PGM_TYPE_PAE    \