Index: /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 20067)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 20068)
@@ -790,5 +790,8 @@
 VMMDECL(int) PGMShwGetPage(PVMCPU pVCpu, RTGCPTR GCPtr, uint64_t *pfFlags, PRTHCPHYS pHCPhys)
 {
-    return PGM_SHW_PFN(GetPage, pVCpu)(pVCpu, GCPtr, pfFlags, pHCPhys);
+    pgmLock(pVCpu->CTX_SUFF(pVM));
+    int rc = PGM_SHW_PFN(GetPage, pVCpu)(pVCpu, GCPtr, pfFlags, pHCPhys);
+    pgmUnlock(pVCpu->CTX_SUFF(pVM));
+    return rc;
 }
 
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 20067)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 20068)
@@ -800,5 +800,8 @@
                     pgmLock(pVM);
                     rc = PGM_BTH_NAME(SyncPage)(pVCpu, PdeSrc, pvFault, 1, uErr);
+#   ifndef VBOX_STRICT
+                    /* Keep it locked in VBOX_STRICT mode so the next checks won't trigger without reason with guest SMP. */
                     pgmUnlock(pVM);
+#   endif
                     if (RT_SUCCESS(rc))
                     {
@@ -815,5 +818,6 @@
                         uint64_t fPageShw;
                         rc = PGMShwGetPage(pVCpu, pvFault, &fPageShw, NULL);
-                        AssertMsg((pVM->cCPUs > 1 && rc == VERR_PAGE_NOT_PRESENT) || (RT_SUCCESS(rc) && (fPageShw & X86_PTE_RW)), ("rc=%Rrc fPageShw=%RX64\n", rc, fPageShw));
+                        AssertMsg((RT_SUCCESS(rc) && (fPageShw & X86_PTE_RW)), ("rc=%Rrc fPageShw=%RX64\n", rc, fPageShw));
+                        pgmUnlock(pVM);
 #   endif /* VBOX_STRICT */
                         STAM_PROFILE_STOP(&pVCpu->pgm.s.StatRZTrap0eTimeOutOfSync, c);
@@ -821,4 +825,7 @@
                         return VINF_SUCCESS;
                     }
+#   ifdef VBOX_STRICT
+                    pgmUnlock(pVM);
+#   endif
 
                     /* Check to see if we need to emulate the instruction as X86_CR0_WP has been cleared. */
Index: /trunk/src/VBox/VMM/VMMAll/PGMAllShw.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/PGMAllShw.h	(revision 20067)
+++ /trunk/src/VBox/VMM/VMMAll/PGMAllShw.h	(revision 20068)
@@ -146,4 +146,6 @@
     PVM pVM = pVCpu->CTX_SUFF(pVM);
 
+    Assert(PGMIsLockOwner(pVM));
+
     /*
      * Get the PDE.