diff --git a/reactos/ntoskrnl/include/internal/mm.h b/reactos/ntoskrnl/include/internal/mm.h
index 2a95790838a..d28b64a543b 100644
--- a/reactos/ntoskrnl/include/internal/mm.h
+++ b/reactos/ntoskrnl/include/internal/mm.h
@@ -219,7 +219,6 @@ typedef struct _MEMORY_AREA
     ULONG Type;
     ULONG Protect;
     ULONG Flags;
-    ULONG LockCount;
     BOOLEAN DeleteInProgress;
     ULONG PageOpCount;
     union
@@ -242,7 +241,6 @@ typedef struct _MEMORY_AREA
 typedef struct _MADDRESS_SPACE
 {
     PMEMORY_AREA MemoryAreaRoot;
-    FAST_MUTEX Lock;
     PVOID LowestAddress;
     struct _ROS_EPROCESS* Process;
     PUSHORT PageTableRefCountTable;
diff --git a/reactos/ntoskrnl/include/internal/ps.h b/reactos/ntoskrnl/include/internal/ps.h
index c9203771f19..2503a75846e 100644
--- a/reactos/ntoskrnl/include/internal/ps.h
+++ b/reactos/ntoskrnl/include/internal/ps.h
@@ -45,7 +45,7 @@ typedef struct _ROS_EPROCESS
     EX_PUSH_LOCK AddressCreationLock;
     PETHREAD RotateInProgress;
 #else
-    KGUARDED_MUTEX AddressCreationLock;
+    FAST_MUTEX AddressCreationLock; // FIXME: FAST_MUTEX for XP, KGUARDED_MUTEX for 2K3
     KSPIN_LOCK HyperSpaceLock;
 #endif
     PETHREAD ForkInProgress;
@@ -200,7 +200,6 @@ typedef struct _ROS_EPROCESS
     UCHAR PriorityClass;
     MM_AVL_TABLE VadRoot;
     ULONG Cookie;
-    MADDRESS_SPACE AddressSpace;
 } ROS_EPROCESS, *PROS_EPROCESS;
 #include <poppack.h>
 
diff --git a/reactos/ntoskrnl/ke/bug.c b/reactos/ntoskrnl/ke/bug.c
index 839198598f3..d471ca40773 100644
--- a/reactos/ntoskrnl/ke/bug.c
+++ b/reactos/ntoskrnl/ke/bug.c
@@ -27,6 +27,8 @@ HalReleaseDisplayOwnership(
     VOID
 );
 
+extern FAST_MUTEX KernelAddressSpaceLock;
+
 /* GLOBALS ******************************************************************/
 
 static LIST_ENTRY BugcheckCallbackListHead = {NULL,NULL};
@@ -341,7 +343,7 @@ KeBugCheckWithTf(ULONG BugCheckCode,
     KeRaiseIrql(HIGH_LEVEL, &OldIrql);
 
     /* Unload the Kernel Adress Space if we own it */
-    if (MmGetKernelAddressSpace()->Lock.Owner == KeGetCurrentThread())
+    if (KernelAddressSpaceLock.Owner == KeGetCurrentThread())
         MmUnlockAddressSpace(MmGetKernelAddressSpace());
 
     /* FIXMEs: Use inbv to clear, fill and write to screen. */
diff --git a/reactos/ntoskrnl/mm/anonmem.c b/reactos/ntoskrnl/mm/anonmem.c
index 548ff4a9bbd..d3a1f0de953 100644
--- a/reactos/ntoskrnl/mm/anonmem.c
+++ b/reactos/ntoskrnl/mm/anonmem.c
@@ -679,7 +679,7 @@ NtAllocateVirtualMemory(IN HANDLE ProcessHandle,
    Type = (AllocationType & MEM_COMMIT) ? MEM_COMMIT : MEM_RESERVE;
    DPRINT("Type %x\n", Type);
 
-   AddressSpace = &Process->AddressSpace;
+   AddressSpace = (PMADDRESS_SPACE)&Process->VadRoot;
    MmLockAddressSpace(AddressSpace);
 
    if (PBaseAddress != 0)
@@ -833,7 +833,7 @@ MmFreeVirtualMemory(PROS_EPROCESS Process,
          if (PageOp != NULL)
          {
             NTSTATUS Status;
-            MmUnlockAddressSpace(&Process->AddressSpace);
+            MmUnlockAddressSpace((PMADDRESS_SPACE)&Process->VadRoot);
             Status = KeWaitForSingleObject(&PageOp->CompletionEvent,
                                            0,
                                            KernelMode,
@@ -844,7 +844,7 @@ MmFreeVirtualMemory(PROS_EPROCESS Process,
                DPRINT1("Failed to wait for page op\n");
                KEBUGCHECK(0);
             }
-            MmLockAddressSpace(&Process->AddressSpace);
+            MmLockAddressSpace((PMADDRESS_SPACE)&Process->VadRoot);
             MmReleasePageOp(PageOp);
          }
       }
@@ -860,7 +860,7 @@ MmFreeVirtualMemory(PROS_EPROCESS Process,
    }
 
    /* Actually free the memory area. */
-   MmFreeMemoryArea(&Process->AddressSpace,
+   MmFreeMemoryArea((PMADDRESS_SPACE)&Process->VadRoot,
                     MemoryArea,
                     MmFreeVirtualMemoryPage,
                     (PVOID)Process);
@@ -913,7 +913,7 @@ NtFreeVirtualMemory(IN HANDLE ProcessHandle,
       return(Status);
    }
 
-   AddressSpace = &Process->AddressSpace;
+   AddressSpace = (PMADDRESS_SPACE)&Process->VadRoot;
 
    MmLockAddressSpace(AddressSpace);
    MemoryArea = MmLocateMemoryAreaByAddress(AddressSpace, BaseAddress);
diff --git a/reactos/ntoskrnl/mm/aspace.c b/reactos/ntoskrnl/mm/aspace.c
index 72d0b040b04..fec3d66276d 100644
--- a/reactos/ntoskrnl/mm/aspace.c
+++ b/reactos/ntoskrnl/mm/aspace.c
@@ -20,7 +20,8 @@
 
 /* GLOBALS ******************************************************************/
 
-STATIC MADDRESS_SPACE KernelAddressSpace;
+static MADDRESS_SPACE KernelAddressSpace;
+FAST_MUTEX KernelAddressSpaceLock;
 
 /* FUNCTIONS *****************************************************************/
 
@@ -35,7 +36,15 @@ MmLockAddressSpace(PMADDRESS_SPACE AddressSpace)
    {
       return;
    }
-   ExEnterCriticalRegionAndAcquireFastMutexUnsafe(&AddressSpace->Lock);
+
+   if (AddressSpace->Process)
+   {
+       ExEnterCriticalRegionAndAcquireFastMutexUnsafe(&AddressSpace->Process->AddressCreationLock);
+   }
+   else
+   {
+       ExEnterCriticalRegionAndAcquireFastMutexUnsafe(&KernelAddressSpaceLock);
+   }
 }
 
 VOID
@@ -49,7 +58,14 @@ MmUnlockAddressSpace(PMADDRESS_SPACE AddressSpace)
    {
       return;
    }
-   ExReleaseFastMutexUnsafeAndLeaveCriticalRegion(&AddressSpace->Lock);
+   if (AddressSpace->Process)
+   {
+        ExReleaseFastMutexUnsafeAndLeaveCriticalRegion(&AddressSpace->Process->AddressCreationLock);
+   }
+   else
+   {
+        ExReleaseFastMutexUnsafeAndLeaveCriticalRegion(&KernelAddressSpaceLock);
+   }
 }
 
 VOID
@@ -64,7 +80,7 @@ PMADDRESS_SPACE
 NTAPI
 MmGetCurrentAddressSpace(VOID)
 {
-   return(&((PROS_EPROCESS)PsGetCurrentProcess())->AddressSpace);
+   return((PMADDRESS_SPACE)&((PROS_EPROCESS)PsGetCurrentProcess())->VadRoot);
 }
 
 PMADDRESS_SPACE
@@ -80,7 +96,14 @@ MmInitializeAddressSpace(PROS_EPROCESS Process,
                          PMADDRESS_SPACE AddressSpace)
 {
    AddressSpace->MemoryAreaRoot = NULL;
-   ExInitializeFastMutex(&AddressSpace->Lock);
+   if (Process)
+   {
+       ExInitializeFastMutex(&Process->AddressCreationLock);
+   }
+   else
+   {
+        ExInitializeFastMutex(&KernelAddressSpaceLock);
+   }
    if (Process != NULL)
    {
       AddressSpace->LowestAddress = MM_LOWEST_USER_ADDRESS;
diff --git a/reactos/ntoskrnl/mm/i386/page.c b/reactos/ntoskrnl/mm/i386/page.c
index abac0734e37..1983b963205 100644
--- a/reactos/ntoskrnl/mm/i386/page.c
+++ b/reactos/ntoskrnl/mm/i386/page.c
@@ -243,7 +243,7 @@ Mmi386ReleaseMmInfo(PROS_EPROCESS Process)
                   DPRINT1("ProcessId %d, Pde for %08x - %08x is not freed, RefCount %d\n",
 		          Process->UniqueProcessId,
 	                  (i * 512 + j) * 512 * PAGE_SIZE, (i * 512 + j + 1) * 512 * PAGE_SIZE - 1,
-		          Process->AddressSpace.PageTableRefCountTable[i*512 + j]);
+		          ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable[i*512 + j]);
                   Pde = MmCreateHyperspaceMapping(PAE_PTE_TO_PFN(PageDir[j]));
 	          for (k = 0; k < 512; k++)
 	          {
@@ -288,7 +288,7 @@ Mmi386ReleaseMmInfo(PROS_EPROCESS Process)
          {
             DPRINT1("Pde for %08x - %08x is not freed, RefCount %d\n",
 	            i * 4 * 1024 * 1024, (i + 1) * 4 * 1024 * 1024 - 1,
-		    Process->AddressSpace.PageTableRefCountTable[i]);
+		    ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable[i]);
 	    Pde = MmCreateHyperspaceMapping(PTE_TO_PFN(PageDir[i]));
 	    for (j = 0; j < 1024; j++)
 	    {
@@ -1041,13 +1041,13 @@ MmDeleteVirtualMapping(PROS_EPROCESS Process, PVOID Address, BOOLEAN FreePage,
     * Decrement the reference count for this page table.
     */
    if (Process != NULL && WasValid &&
-       Process->AddressSpace.PageTableRefCountTable != NULL &&
+       ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable != NULL &&
        Address < MmSystemRangeStart)
    {
       PUSHORT Ptrc;
       ULONG Idx;
 
-      Ptrc = Process->AddressSpace.PageTableRefCountTable;
+      Ptrc = ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable;
       Idx = Ke386Pae ? PAE_ADDR_TO_PAGE_TABLE(Address) : ADDR_TO_PAGE_TABLE(Address);
 
       Ptrc[Idx]--;
@@ -1090,12 +1090,12 @@ MmDeletePageFileMapping(PROS_EPROCESS Process, PVOID Address,
        * Decrement the reference count for this page table.
        */
       if (Process != NULL && Pte &&
-          Process->AddressSpace.PageTableRefCountTable != NULL &&
+          ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable != NULL &&
           Address < MmSystemRangeStart)
       {
          PUSHORT Ptrc;
 
-         Ptrc = Process->AddressSpace.PageTableRefCountTable;
+         Ptrc = ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable;
 
          Ptrc[PAE_ADDR_TO_PAGE_TABLE(Address)]--;
          if (Ptrc[PAE_ADDR_TO_PAGE_TABLE(Address)] == 0)
@@ -1134,12 +1134,12 @@ MmDeletePageFileMapping(PROS_EPROCESS Process, PVOID Address,
        * Decrement the reference count for this page table.
        */
       if (Process != NULL && Pte &&
-          Process->AddressSpace.PageTableRefCountTable != NULL &&
+          ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable != NULL &&
           Address < MmSystemRangeStart)
       {
          PUSHORT Ptrc;
 
-         Ptrc = Process->AddressSpace.PageTableRefCountTable;
+         Ptrc = ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable;
 
          Ptrc[ADDR_TO_PAGE_TABLE(Address)]--;
          if (Ptrc[ADDR_TO_PAGE_TABLE(Address)] == 0)
@@ -1694,13 +1694,13 @@ MmCreatePageFileMapping(PROS_EPROCESS Process,
       }
    }
    if (Process != NULL &&
-       Process->AddressSpace.PageTableRefCountTable != NULL &&
+       ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable != NULL &&
        Address < MmSystemRangeStart)
    {
      PUSHORT Ptrc;
      ULONG Idx;
 
-     Ptrc = Process->AddressSpace.PageTableRefCountTable;
+     Ptrc = ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable;
      Idx = Ke386Pae ? PAE_ADDR_TO_PAGE_TABLE(Address) : ADDR_TO_PAGE_TABLE(Address);
      Ptrc[Idx]++;
    }
@@ -1823,12 +1823,12 @@ MmCreateVirtualMappingUnsafe(PROS_EPROCESS Process,
             MmMarkPageUnmapped(PAE_PTE_TO_PFN((Pte)));
          }
          if (Address < MmSystemRangeStart &&
-	     Process->AddressSpace.PageTableRefCountTable != NULL &&
+	     ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable != NULL &&
              Attributes & PA_PRESENT)
          {
             PUSHORT Ptrc;
 
-            Ptrc = Process->AddressSpace.PageTableRefCountTable;
+            Ptrc = ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable;
 
             Ptrc[PAE_ADDR_TO_PAGE_TABLE(Addr)]++;
          }
@@ -1888,12 +1888,12 @@ MmCreateVirtualMappingUnsafe(PROS_EPROCESS Process,
          }
 	 (void)InterlockedExchangeUL(Pt, PFN_TO_PTE(Pages[i]) | Attributes);
          if (Address < MmSystemRangeStart &&
-	     Process->AddressSpace.PageTableRefCountTable != NULL &&
+	     ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable != NULL &&
              Attributes & PA_PRESENT)
          {
             PUSHORT Ptrc;
 
-            Ptrc = Process->AddressSpace.PageTableRefCountTable;
+            Ptrc = ((PMADDRESS_SPACE)&Process->VadRoot)->PageTableRefCountTable;
 
             Ptrc[ADDR_TO_PAGE_TABLE(Addr)]++;
          }
diff --git a/reactos/ntoskrnl/mm/marea.c b/reactos/ntoskrnl/mm/marea.c
index a031f649825..eaa92062fa0 100644
--- a/reactos/ntoskrnl/mm/marea.c
+++ b/reactos/ntoskrnl/mm/marea.c
@@ -1011,7 +1011,7 @@ MmCreateMemoryArea(PMADDRESS_SPACE AddressSpace,
    MemoryArea->EndingAddress = (PVOID)((ULONG_PTR)*BaseAddress + tmpLength);
    MemoryArea->Protect = Protect;
    MemoryArea->Flags = AllocationFlags;
-   MemoryArea->LockCount = 0;
+   //MemoryArea->LockCount = 0;
    MemoryArea->PageOpCount = 0;
    MemoryArea->DeleteInProgress = FALSE;
 
diff --git a/reactos/ntoskrnl/mm/mdl.c b/reactos/ntoskrnl/mm/mdl.c
index 8d07720d56e..cc1d9f39d1e 100644
--- a/reactos/ntoskrnl/mm/mdl.c
+++ b/reactos/ntoskrnl/mm/mdl.c
@@ -273,14 +273,14 @@ MmUnmapLockedPages(PVOID BaseAddress, PMDL Mdl)
 
       ASSERT(Mdl->Process == PsGetCurrentProcess());
 
-      Marea = MmLocateMemoryAreaByAddress( &((PROS_EPROCESS)Mdl->Process)->AddressSpace, BaseAddress );
+      Marea = MmLocateMemoryAreaByAddress( (PMADDRESS_SPACE)&((PROS_EPROCESS)Mdl->Process)->VadRoot, BaseAddress );
       if (Marea == NULL)
       {
          DPRINT1( "Couldn't open memory area when unmapping user-space pages!\n" );
          KEBUGCHECK(0);
       }
 
-      MmFreeMemoryArea( &((PROS_EPROCESS)Mdl->Process)->AddressSpace, Marea, NULL, NULL );
+      MmFreeMemoryArea( (PMADDRESS_SPACE)&((PROS_EPROCESS)Mdl->Process)->VadRoot, Marea, NULL, NULL );
 
       Mdl->Process = NULL;
    }
@@ -411,7 +411,7 @@ VOID STDCALL MmProbeAndLockPages (PMDL Mdl,
       /* FIXME: why isn't AccessMode used? */
       Mode = UserMode;
       Mdl->Process = CurrentProcess;
-      AddressSpace = &((PROS_EPROCESS)CurrentProcess)->AddressSpace;
+      AddressSpace = (PMADDRESS_SPACE)&((PROS_EPROCESS)CurrentProcess)->VadRoot;
    }
 
 
@@ -805,8 +805,8 @@ MmMapLockedPagesSpecifyCache ( IN PMDL Mdl,
 
       CurrentProcess = (PROS_EPROCESS)PsGetCurrentProcess();
 
-      MmLockAddressSpace(&CurrentProcess->AddressSpace);
-      Status = MmCreateMemoryArea(&CurrentProcess->AddressSpace,
+      MmLockAddressSpace((PMADDRESS_SPACE)&CurrentProcess->VadRoot);
+      Status = MmCreateMemoryArea((PMADDRESS_SPACE)&CurrentProcess->VadRoot,
                                   MEMORY_AREA_MDL_MAPPING,
                                   &Base,
                                   PageCount * PAGE_SIZE,
@@ -815,7 +815,7 @@ MmMapLockedPagesSpecifyCache ( IN PMDL Mdl,
                                   (Base != NULL),
                                   0,
                                   BoundaryAddressMultiple);
-      MmUnlockAddressSpace(&CurrentProcess->AddressSpace);
+      MmUnlockAddressSpace((PMADDRESS_SPACE)&CurrentProcess->VadRoot);
       if (!NT_SUCCESS(Status))
       {
          if (Mdl->MdlFlags & MDL_MAPPING_CAN_FAIL)
diff --git a/reactos/ntoskrnl/mm/mm.c b/reactos/ntoskrnl/mm/mm.c
index 95642b3e873..bff9cee9626 100644
--- a/reactos/ntoskrnl/mm/mm.c
+++ b/reactos/ntoskrnl/mm/mm.c
@@ -38,17 +38,17 @@ MmReleaseMmInfo(PROS_EPROCESS Process)
    DPRINT("MmReleaseMmInfo(Process %x (%s))\n", Process,
           Process->ImageFileName);
 
-   MmLockAddressSpace(&Process->AddressSpace);
+   MmLockAddressSpace((PMADDRESS_SPACE)&Process->VadRoot);
 
-   while ((MemoryArea = Process->AddressSpace.MemoryAreaRoot) != NULL)
+   while ((MemoryArea = ((PMADDRESS_SPACE)&Process->VadRoot)->MemoryAreaRoot) != NULL)
    {
       switch (MemoryArea->Type)
       {
          case MEMORY_AREA_SECTION_VIEW:
              Address = (PVOID)MemoryArea->StartingAddress;
-             MmUnlockAddressSpace(&Process->AddressSpace);
+             MmUnlockAddressSpace((PMADDRESS_SPACE)&Process->VadRoot);
              MmUnmapViewOfSection((PEPROCESS)Process, Address);
-             MmLockAddressSpace(&Process->AddressSpace);
+             MmLockAddressSpace((PMADDRESS_SPACE)&Process->VadRoot);
              break;
 
          case MEMORY_AREA_VIRTUAL_MEMORY:
@@ -58,7 +58,7 @@ MmReleaseMmInfo(PROS_EPROCESS Process)
 
          case MEMORY_AREA_SHARED_DATA:
          case MEMORY_AREA_NO_ACCESS:
-             MmFreeMemoryArea(&Process->AddressSpace,
+             MmFreeMemoryArea((PMADDRESS_SPACE)&Process->VadRoot,
                               MemoryArea,
                               NULL,
                               NULL);
@@ -75,8 +75,8 @@ MmReleaseMmInfo(PROS_EPROCESS Process)
 
    Mmi386ReleaseMmInfo(Process);
 
-   MmUnlockAddressSpace(&Process->AddressSpace);
-   MmDestroyAddressSpace(&Process->AddressSpace);
+   MmUnlockAddressSpace((PMADDRESS_SPACE)&Process->VadRoot);
+   MmDestroyAddressSpace((PMADDRESS_SPACE)&Process->VadRoot);
 
    DPRINT("Finished MmReleaseMmInfo()\n");
    return(STATUS_SUCCESS);
@@ -114,7 +114,7 @@ BOOLEAN STDCALL MmIsAddressValid(PVOID VirtualAddress)
    }
    else
    {
-      AddressSpace = &((PROS_EPROCESS)PsGetCurrentProcess())->AddressSpace;
+      AddressSpace = (PMADDRESS_SPACE)&((PROS_EPROCESS)PsGetCurrentProcess())->VadRoot;
    }
 
    MmLockAddressSpace(AddressSpace);
@@ -171,7 +171,7 @@ MmAccessFault(KPROCESSOR_MODE Mode,
    }
    else
    {
-      AddressSpace = &((PROS_EPROCESS)PsGetCurrentProcess())->AddressSpace;
+      AddressSpace = (PMADDRESS_SPACE)&((PROS_EPROCESS)PsGetCurrentProcess())->VadRoot;
    }
 
    if (!FromMdl)
@@ -304,7 +304,7 @@ MmNotPresentFault(KPROCESSOR_MODE Mode,
    }
    else
    {
-      AddressSpace = &((PROS_EPROCESS)PsGetCurrentProcess())->AddressSpace;
+      AddressSpace = (PMADDRESS_SPACE)&((PROS_EPROCESS)PsGetCurrentProcess())->VadRoot;
    }
 
    if (!FromMdl)
diff --git a/reactos/ntoskrnl/mm/process.c b/reactos/ntoskrnl/mm/process.c
index 524b15335be..2e0aae14559 100644
--- a/reactos/ntoskrnl/mm/process.c
+++ b/reactos/ntoskrnl/mm/process.c
@@ -29,7 +29,7 @@ MiCreatePebOrTeb(PROS_EPROCESS Process,
                  PVOID BaseAddress)
 {
     NTSTATUS Status;
-    PMADDRESS_SPACE ProcessAddressSpace = &Process->AddressSpace;
+    PMADDRESS_SPACE ProcessAddressSpace = (PMADDRESS_SPACE)&Process->VadRoot;
     PMEMORY_AREA MemoryArea;
     PHYSICAL_ADDRESS BoundaryAddressMultiple;
     PVOID AllocatedBase = BaseAddress;
@@ -110,7 +110,7 @@ STDCALL
 MmDeleteTeb(PROS_EPROCESS Process,
             PTEB Teb)
 {
-    PMADDRESS_SPACE ProcessAddressSpace = &Process->AddressSpace;
+    PMADDRESS_SPACE ProcessAddressSpace = (PMADDRESS_SPACE)&Process->VadRoot;
     PMEMORY_AREA MemoryArea;
 
     /* Lock the Address Space */
@@ -424,7 +424,7 @@ MmCreateProcessAddressSpace(IN PROS_EPROCESS Process,
                             IN PROS_SECTION_OBJECT Section OPTIONAL)
 {
     NTSTATUS Status;
-    PMADDRESS_SPACE ProcessAddressSpace = &Process->AddressSpace;
+    PMADDRESS_SPACE ProcessAddressSpace = (PMADDRESS_SPACE)&Process->VadRoot;
     PVOID BaseAddress;
     PMEMORY_AREA MemoryArea;
     PHYSICAL_ADDRESS BoundaryAddressMultiple;
diff --git a/reactos/ntoskrnl/mm/rmap.c b/reactos/ntoskrnl/mm/rmap.c
index 6c89ee820c8..7ba4c5e0b56 100644
--- a/reactos/ntoskrnl/mm/rmap.c
+++ b/reactos/ntoskrnl/mm/rmap.c
@@ -92,7 +92,7 @@ MmWritePagePhysicalAddress(PFN_TYPE Page)
       {
          return Status;
       }
-      AddressSpace = &Process->AddressSpace;
+      AddressSpace = (PMADDRESS_SPACE)&Process->VadRoot;
    }
    else
    {
@@ -223,7 +223,7 @@ MmPageOutPhysicalAddress(PFN_TYPE Page)
       {
          return Status;
       }
-      AddressSpace = &Process->AddressSpace;
+      AddressSpace = (PMADDRESS_SPACE)&Process->VadRoot;
    }
    else
    {
diff --git a/reactos/ntoskrnl/mm/section.c b/reactos/ntoskrnl/mm/section.c
index 6786566a3a0..4e1a660d1e8 100644
--- a/reactos/ntoskrnl/mm/section.c
+++ b/reactos/ntoskrnl/mm/section.c
@@ -1338,7 +1338,7 @@ MmPageOutDeleteMapping(PVOID Context, PROS_EPROCESS Process, PVOID Address)
    PageOutContext = (MM_SECTION_PAGEOUT_CONTEXT*)Context;
    if (Process)
    {
-      MmLockAddressSpace(&Process->AddressSpace);
+      MmLockAddressSpace((PMADDRESS_SPACE)&Process->VadRoot);
    }
 
    MmDeleteVirtualMapping(Process,
@@ -1362,7 +1362,7 @@ MmPageOutDeleteMapping(PVOID Context, PROS_EPROCESS Process, PVOID Address)
    }
    if (Process)
    {
-      MmUnlockAddressSpace(&Process->AddressSpace);
+      MmUnlockAddressSpace((PMADDRESS_SPACE)&Process->VadRoot);
    }
    
    if (PageOutContext->Private)
@@ -3676,7 +3676,7 @@ NtMapViewOfSection(IN HANDLE SectionHandle,
       return(Status);
    }
 
-   AddressSpace = &Process->AddressSpace;
+   AddressSpace = (PMADDRESS_SPACE)&Process->VadRoot;
 
    Status = ObReferenceObjectByHandle(SectionHandle,
                                       SECTION_MAP_READ,
@@ -3911,7 +3911,7 @@ MmUnmapViewOfSection(PEPROCESS Process,
 
    ASSERT(Process);
 
-   AddressSpace = &((PROS_EPROCESS)Process)->AddressSpace;
+   AddressSpace = (PMADDRESS_SPACE)&((PROS_EPROCESS)Process)->VadRoot;
    
    MmLockAddressSpace(AddressSpace);
    MemoryArea = MmLocateMemoryAreaByAddress(AddressSpace,
@@ -4432,7 +4432,7 @@ MmMapViewOfSection(IN PVOID SectionObject,
 
 
    Section = (PROS_SECTION_OBJECT)SectionObject;
-   AddressSpace = &((PROS_EPROCESS)Process)->AddressSpace;
+   AddressSpace = (PMADDRESS_SPACE)&((PROS_EPROCESS)Process)->VadRoot;
 
    AllocationType |= (Section->AllocationAttributes & SEC_NO_CHANGE);
 
diff --git a/reactos/ntoskrnl/mm/virtual.c b/reactos/ntoskrnl/mm/virtual.c
index ab413ab8202..59369bb91f9 100644
--- a/reactos/ntoskrnl/mm/virtual.c
+++ b/reactos/ntoskrnl/mm/virtual.c
@@ -137,7 +137,7 @@ MiQueryVirtualMemory (IN HANDLE ProcessHandle,
          DPRINT("NtQueryVirtualMemory() = %x\n",Status);
          return(Status);
       }
-      AddressSpace = &Process->AddressSpace;
+      AddressSpace = (PMADDRESS_SPACE)&Process->VadRoot;
    }
    else
    {
@@ -393,7 +393,7 @@ MiProtectVirtualMemory(IN PEPROCESS Process,
       PAGE_ROUND_DOWN(*BaseAddress);
    *BaseAddress = (PVOID)PAGE_ROUND_DOWN(*BaseAddress);
 
-   AddressSpace = &((PROS_EPROCESS)Process)->AddressSpace;
+   AddressSpace = (PMADDRESS_SPACE)&((PROS_EPROCESS)Process)->VadRoot;
 
    MmLockAddressSpace(AddressSpace);
    MemoryArea = MmLocateMemoryAreaByAddress(AddressSpace, *BaseAddress);
diff --git a/reactos/ntoskrnl/ps/psmgr.c b/reactos/ntoskrnl/ps/psmgr.c
index afca4259e4e..d856f0dd8cc 100644
--- a/reactos/ntoskrnl/ps/psmgr.c
+++ b/reactos/ntoskrnl/ps/psmgr.c
@@ -255,7 +255,7 @@ PsInitProcessManagment(VOID)
    PspInheritQuota(PsInitialSystemProcess, NULL);
 
    MmInitializeAddressSpace((PROS_EPROCESS)PsInitialSystemProcess,
-			    &((PROS_EPROCESS)PsInitialSystemProcess)->AddressSpace);
+			    (PMADDRESS_SPACE)&((PROS_EPROCESS)PsInitialSystemProcess)->VadRoot);
 
    ((PROS_EPROCESS)PsInitialSystemProcess)->LockEvent = 
        ExAllocatePoolWithTag(PagedPool, sizeof(KEVENT), TAG('P', 's', 'L', 'k'));