Index: trunk/src/VBox/VMM/IOM.cpp
===================================================================
--- trunk/src/VBox/VMM/IOM.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/IOM.cpp	(revision 2270)
@@ -1190,5 +1190,5 @@
         int rc = PGMR3HandlerPhysicalRegister(pVM, PGMPHYSHANDLERTYPE_MMIO, GCPhysStart, GCPhysStart + (cbRange - 1),
                                               /*IOMR3MMIOHandler*/ NULL, pRange,
-                                              NULL, "IOMMMIOHandler", pRange,
+                                              NULL, "IOMMMIOHandler", MMHyperR3ToR0(pVM, pRange),
                                               NULL, "IOMMMIOHandler", MMHyperHC2GC(pVM, pRange), pszDesc);
         if (VBOX_SUCCESS(rc))
Index: trunk/src/VBox/VMM/IOMInternal.h
===================================================================
--- trunk/src/VBox/VMM/IOMInternal.h	(revision 2267)
+++ trunk/src/VBox/VMM/IOMInternal.h	(revision 2270)
@@ -52,23 +52,45 @@
     RTUINT                      cbSize;
     /** Pointer to user argument. */
-    RTHCPTR                     pvUser;
+    RTR3PTR                     pvUser;
     /** Pointer to device instance. */
-    HCPTRTYPE(PPDMDEVINS)       pDevIns;
+    R3PTRTYPE(PPDMDEVINS)       pDevIns;
     /** Pointer to write callback function. */
-    HCPTRTYPE(PFNIOMMMIOWRITE)  pfnWriteCallback;
+    R3PTRTYPE(PFNIOMMMIOWRITE)  pfnWriteCallback;
     /** Pointer to read callback function. */
-    HCPTRTYPE(PFNIOMMMIOREAD)   pfnReadCallback;
+    R3PTRTYPE(PFNIOMMMIOREAD)   pfnReadCallback;
     /** Pointer to fill (memset) callback function. */
-    HCPTRTYPE(PFNIOMMMIOFILL)   pfnFillCallback;
+    R3PTRTYPE(PFNIOMMMIOFILL)   pfnFillCallback;
     /** Description / Name. For easing debugging. */
-    HCPTRTYPE(const char *)     pszDesc;
+    R3PTRTYPE(const char *)     pszDesc;
 } IOMMMIORANGER3;
 /** Pointer to a MMIO range descriptor, R3 version. */
 typedef struct IOMMMIORANGER3 *PIOMMMIORANGER3;
 
-/** MMIO range descriptor, R0 version. */
-typedef IOMMMIORANGER3  IOMMMIORANGER0;
+/**
+ * MMIO range descriptor, R0 version.
+ */
+typedef struct IOMMMIORANGER0
+{
+    /** Avl node core with GCPhys as Key and GCPhys + cbSize - 1 as KeyLast. */
+    AVLROGCPHYSNODECORE         Core;
+    /** Start physical address. */
+    RTGCPHYS                    GCPhys;
+    /** Size of the range. */
+    RTUINT                      cbSize;
+    /** Pointer to user argument. */
+    RTR0PTR                     pvUser;
+    /** Pointer to device instance. */
+    R0PTRTYPE(PPDMDEVINS)       pDevIns;
+    /** Pointer to write callback function. */
+    R0PTRTYPE(PFNIOMMMIOWRITE)  pfnWriteCallback;
+    /** Pointer to read callback function. */
+    R0PTRTYPE(PFNIOMMMIOREAD)   pfnReadCallback;
+    /** Pointer to fill (memset) callback function. */
+    R0PTRTYPE(PFNIOMMMIOFILL)   pfnFillCallback;
+    /** Description / Name. For easing debugging. */
+    R3PTRTYPE(const char *)     pszDesc;
+} IOMMMIORANGER0;
 /** Pointer to a MMIO range descriptor, R0 version. */
-typedef PIOMMMIORANGER3 PIOMMMIORANGER0;
+typedef struct IOMMMIORANGER0 *PIOMMMIORANGER0;
 
 /**
@@ -159,25 +181,49 @@
     uint16_t                    cPorts;
     /** Pointer to user argument. */
-    RTHCPTR                     pvUser;
+    RTR3PTR                     pvUser;
     /** Pointer to the associated device instance. */
-    HCPTRTYPE(PPDMDEVINS)       pDevIns;
+    R3PTRTYPE(PPDMDEVINS)       pDevIns;
     /** Pointer to OUT callback function. */
-    HCPTRTYPE(PFNIOMIOPORTOUT)  pfnOutCallback;
+    R3PTRTYPE(PFNIOMIOPORTOUT)  pfnOutCallback;
     /** Pointer to IN callback function. */
-    HCPTRTYPE(PFNIOMIOPORTIN)   pfnInCallback;
+    R3PTRTYPE(PFNIOMIOPORTIN)   pfnInCallback;
     /** Pointer to string OUT callback function. */
-    HCPTRTYPE(PFNIOMIOPORTOUTSTRING) pfnOutStrCallback;
+    R3PTRTYPE(PFNIOMIOPORTOUTSTRING) pfnOutStrCallback;
     /** Pointer to string IN callback function. */
-    HCPTRTYPE(PFNIOMIOPORTINSTRING) pfnInStrCallback;
+    R3PTRTYPE(PFNIOMIOPORTINSTRING) pfnInStrCallback;
     /** Description / Name. For easing debugging. */
-    HCPTRTYPE(const char *)     pszDesc;
+    R3PTRTYPE(const char *)     pszDesc;
 } IOMIOPORTRANGER3;
 /** Pointer to I/O port range descriptor, R3 version. */
 typedef IOMIOPORTRANGER3 *PIOMIOPORTRANGER3;
 
-/** I/O port range descriptor, R0 version. */
-typedef IOMIOPORTRANGER3  IOMIOPORTRANGER0;
+/**
+ * I/O port range descriptor, R0 version.
+ */
+typedef struct IOMIOPORTRANGER0
+{
+    /** Avl node core with Port as Key and Port + cPorts - 1 as KeyLast. */
+    AVLROIOPORTNODECORE         Core;
+    /** Start I/O port address. */
+    RTIOPORT                    Port;
+    /** Size of the range. */
+    uint16_t                    cPorts;
+    /** Pointer to user argument. */
+    RTR0PTR                     pvUser;
+    /** Pointer to the associated device instance. */
+    R0PTRTYPE(PPDMDEVINS)       pDevIns;
+    /** Pointer to OUT callback function. */
+    R0PTRTYPE(PFNIOMIOPORTOUT)  pfnOutCallback;
+    /** Pointer to IN callback function. */
+    R0PTRTYPE(PFNIOMIOPORTIN)   pfnInCallback;
+    /** Pointer to string OUT callback function. */
+    R0PTRTYPE(PFNIOMIOPORTOUTSTRING) pfnOutStrCallback;
+    /** Pointer to string IN callback function. */
+    R0PTRTYPE(PFNIOMIOPORTINSTRING) pfnInStrCallback;
+    /** Description / Name. For easing debugging. */
+    R3PTRTYPE(const char *)     pszDesc;
+} IOMIOPORTRANGER0;
 /** Pointer to I/O port range descriptor, R0 version. */
-typedef PIOMIOPORTRANGER3 PIOMIOPORTRANGER0;
+typedef IOMIOPORTRANGER0 *PIOMIOPORTRANGER0;
 
 /**
Index: trunk/src/VBox/VMM/PDM.cpp
===================================================================
--- trunk/src/VBox/VMM/PDM.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/PDM.cpp	(revision 2270)
@@ -293,5 +293,6 @@
         {
             pDevIns->pDevHlpGC = pDevHlpGC;
-            pDevIns->pvInstanceDataGC = MMHyperHC2GC(pVM, pDevIns->pvInstanceDataHC);
+            pDevIns->pvInstanceDataGC = MMHyperHC2GC(pVM, pDevIns->pvInstanceDataR3);
+            pDevIns->pvInstanceDataR0 = MMHyperR3ToR0(pVM, pDevIns->pvInstanceDataR3);
             pDevIns->Internal.s.pVMGC = pVM->pVMGC;
             if (pDevIns->Internal.s.pPciBusHC)
Index: trunk/src/VBox/VMM/PDMDevice.cpp
===================================================================
--- trunk/src/VBox/VMM/PDMDevice.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/PDMDevice.cpp	(revision 2270)
@@ -88,5 +88,5 @@
 static DECLCALLBACK(int) pdmR3DevHlp_IOPortRegister(PPDMDEVINS pDevIns, RTIOPORT Port, RTUINT cPorts, RTHCPTR pvUser, PFNIOMIOPORTOUT pfnOut, PFNIOMIOPORTIN pfnIn, PFNIOMIOPORTOUTSTRING pfnOutStr, PFNIOMIOPORTINSTRING pfnInStr, const char *pszDesc);
 static DECLCALLBACK(int) pdmR3DevHlp_IOPortRegisterGC(PPDMDEVINS pDevIns, RTIOPORT Port, RTUINT cPorts, RTGCPTR pvUser, const char *pszOut, const char *pszIn, const char *pszOutStr, const char *pszInStr, const char *pszDesc);
-static DECLCALLBACK(int) pdmR3DevHlp_IOPortRegisterR0(PPDMDEVINS pDevIns, RTIOPORT Port, RTUINT cPorts, RTHCPTR pvUser, const char *pszOut, const char *pszIn, const char *pszOutStr, const char *pszInStr, const char *pszDesc);
+static DECLCALLBACK(int) pdmR3DevHlp_IOPortRegisterR0(PPDMDEVINS pDevIns, RTIOPORT Port, RTUINT cPorts, RTR0PTR pvUser, const char *pszOut, const char *pszIn, const char *pszOutStr, const char *pszInStr, const char *pszDesc);
 static DECLCALLBACK(int) pdmR3DevHlp_IOPortDeregister(PPDMDEVINS pDevIns, RTIOPORT Port, RTUINT cPorts);
 static DECLCALLBACK(int) pdmR3DevHlp_MMIORegister(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTUINT cbRange, RTHCPTR pvUser,
@@ -96,5 +96,5 @@
                                            const char *pszWrite, const char *pszRead, const char *pszFill,
                                            const char *pszDesc);
-static DECLCALLBACK(int) pdmR3DevHlp_MMIORegisterR0(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTUINT cbRange, RTHCPTR pvUser,
+static DECLCALLBACK(int) pdmR3DevHlp_MMIORegisterR0(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTUINT cbRange, RTR0PTR pvUser,
                                            const char *pszWrite, const char *pszRead, const char *pszFill,
                                            const char *pszDesc);
@@ -252,5 +252,5 @@
  */
 #ifdef VBOX_STRICT
-# define PDMDEV_ASSERT_DEVINS(pDevIns)   do { Assert(pDevIns); Assert(pDevIns->u32Version == PDM_DEVINS_VERSION); Assert(pDevIns->pvInstanceDataHC == (void *)&pDevIns->achInstanceData[0]); } while (0)
+# define PDMDEV_ASSERT_DEVINS(pDevIns)   do { Assert(pDevIns); Assert(pDevIns->u32Version == PDM_DEVINS_VERSION); Assert(pDevIns->pvInstanceDataR3 == (void *)&pDevIns->achInstanceData[0]); } while (0)
 #else
 # define PDMDEV_ASSERT_DEVINS(pDevIns)   do { } while (0)
@@ -825,7 +825,9 @@
         pDevIns->pCfgHandle                     = pConfigNode;
         pDevIns->iInstance                      = paDevs[i].iInstance;
-        pDevIns->pvInstanceDataHC               = &pDevIns->achInstanceData[0];
+        pDevIns->pvInstanceDataR3               = &pDevIns->achInstanceData[0];
         pDevIns->pvInstanceDataGC               =  pDevIns->pDevReg->fFlags & PDM_DEVREG_FLAGS_GC
-                                                   ? MMHyperHC2GC(pVM, pDevIns->pvInstanceDataHC) : 0;
+                                                   ? MMHyperHC2GC(pVM, pDevIns->pvInstanceDataR3) : 0;
+        pDevIns->pvInstanceDataR0               =  pDevIns->pDevReg->fFlags & PDM_DEVREG_FLAGS_R0
+                                                   ? MMHyperR3ToR0(pVM, pDevIns->pvInstanceDataR3) : 0;
 
         /*
@@ -1206,5 +1208,5 @@
 
 /** @copydoc PDMDEVHLP::pfnIOPortRegisterR0 */
-static DECLCALLBACK(int) pdmR3DevHlp_IOPortRegisterR0(PPDMDEVINS pDevIns, RTIOPORT Port, RTUINT cPorts, RTHCPTR pvUser,
+static DECLCALLBACK(int) pdmR3DevHlp_IOPortRegisterR0(PPDMDEVINS pDevIns, RTIOPORT Port, RTUINT cPorts, RTR0PTR pvUser,
                                                       const char *pszOut, const char *pszIn,
                                                       const char *pszOutStr, const char *pszInStr, const char *pszDesc)
@@ -1225,5 +1227,5 @@
         &&  (pDevIns->pDevReg->fFlags & PDM_DEVREG_FLAGS_R0))
     {
-        PFNIOMIOPORTIN pfnR0PtrIn = 0;
+        R0PTRTYPE(PFNIOMIOPORTIN) pfnR0PtrIn = 0;
         if (pszIn)
         {
@@ -1231,5 +1233,5 @@
             AssertMsgRC(rc, ("Failed to resolve %s.%s (pszIn)\n", pDevIns->pDevReg->szR0Mod, pszIn));
         }
-        PFNIOMIOPORTOUT pfnR0PtrOut = 0;
+        R0PTRTYPE(PFNIOMIOPORTOUT) pfnR0PtrOut = 0;
         if (pszOut && VBOX_SUCCESS(rc))
         {
@@ -1237,5 +1239,5 @@
             AssertMsgRC(rc, ("Failed to resolve %s.%s (pszOut)\n", pDevIns->pDevReg->szR0Mod, pszOut));
         }
-        PFNIOMIOPORTINSTRING pfnR0PtrInStr = 0;
+        R0PTRTYPE(PFNIOMIOPORTINSTRING) pfnR0PtrInStr = 0;
         if (pszInStr && VBOX_SUCCESS(rc))
         {
@@ -1243,5 +1245,5 @@
             AssertMsgRC(rc, ("Failed to resolve %s.%s (pszInStr)\n", pDevIns->pDevReg->szR0Mod, pszInStr));
         }
-        PFNIOMIOPORTOUTSTRING pfnR0PtrOutStr = 0;
+        R0PTRTYPE(PFNIOMIOPORTOUTSTRING) pfnR0PtrOutStr = 0;
         if (pszOutStr && VBOX_SUCCESS(rc))
         {
@@ -1349,5 +1351,5 @@
 
 /** @copydoc PDMDEVHLP::pfnMMIORegisterR0 */
-static DECLCALLBACK(int) pdmR3DevHlp_MMIORegisterR0(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTUINT cbRange, RTHCPTR pvUser,
+static DECLCALLBACK(int) pdmR3DevHlp_MMIORegisterR0(PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTUINT cbRange, RTR0PTR pvUser,
                                                     const char *pszWrite, const char *pszRead, const char *pszFill,
                                                     const char *pszDesc)
@@ -1369,12 +1371,12 @@
         &&  (pDevIns->pDevReg->fFlags & PDM_DEVREG_FLAGS_R0))
     {
-        PFNIOMMMIOWRITE pfnR0PtrWrite = 0;
+        R0PTRTYPE(PFNIOMMMIOWRITE) pfnR0PtrWrite = 0;
         if (pszWrite)
             rc = PDMR3GetSymbolR0Lazy(pDevIns->Internal.s.pVMHC, pDevIns->pDevReg->szR0Mod, pszWrite, (void **)&pfnR0PtrWrite);
-        PFNIOMMMIOREAD pfnR0PtrRead = 0;
+        R0PTRTYPE(PFNIOMMMIOREAD) pfnR0PtrRead = 0;
         int rc2 = VINF_SUCCESS;
         if (pszRead)
             rc2 = PDMR3GetSymbolR0Lazy(pDevIns->Internal.s.pVMHC, pDevIns->pDevReg->szR0Mod, pszRead, (void **)&pfnR0PtrRead);
-        PFNIOMMMIOFILL pfnR0PtrFill = 0;
+        R0PTRTYPE(PFNIOMMMIOFILL) pfnR0PtrFill = 0;
         int rc3 = VINF_SUCCESS;
         if (pszFill)
Index: trunk/src/VBox/VMM/PGM.cpp
===================================================================
--- trunk/src/VBox/VMM/PGM.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/PGM.cpp	(revision 2270)
@@ -1086,6 +1086,6 @@
     const unsigned iPT = off >> X86_PD_SHIFT;
     const unsigned iPG = (off >> X86_PT_SHIFT) & X86_PT_MASK;
-    pVM->pgm.s.paDynPageMap32BitPTEsGC = pMapping->aPTs[iPT].pPTGC      + iPG * sizeof(pMapping->aPTs[0].pPTHC->a[0]);
-    pVM->pgm.s.paDynPageMapPaePTEsGC   = pMapping->aPTs[iPT].paPaePTsGC + iPG * sizeof(pMapping->aPTs[0].paPaePTsHC->a[0]);
+    pVM->pgm.s.paDynPageMap32BitPTEsGC = pMapping->aPTs[iPT].pPTGC      + iPG * sizeof(pMapping->aPTs[0].pPTR3->a[0]);
+    pVM->pgm.s.paDynPageMapPaePTEsGC   = pMapping->aPTs[iPT].paPaePTsGC + iPG * sizeof(pMapping->aPTs[0].paPaePTsR3->a[0]);
 
     /* init cache */
@@ -1159,15 +1159,15 @@
      * (One or more of them have changed, that's why we're here.)
      */
-    pVM->pgm.s.pMappingsGC = MMHyperHC2GC(pVM, pVM->pgm.s.pMappingsHC);
-    for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsHC; pCur->pNextHC; pCur = pCur->pNextHC)
-        pCur->pNextGC = MMHyperHC2GC(pVM, pCur->pNextHC);
+    pVM->pgm.s.pMappingsGC = MMHyperHC2GC(pVM, pVM->pgm.s.pMappingsR3);
+    for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3; pCur->pNextR3; pCur = pCur->pNextR3)
+        pCur->pNextGC = MMHyperHC2GC(pVM, pCur->pNextR3);
 
     /* Relocate GC addresses of Page Tables. */
-    for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsHC; pCur; pCur = pCur->pNextHC)
+    for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3; pCur; pCur = pCur->pNextR3)
     {
         for (RTHCUINT i = 0; i < pCur->cPTs; i++)
         {
-            pCur->aPTs[i].pPTGC = MMHyperHC2GC(pVM, pCur->aPTs[i].pPTHC);
-            pCur->aPTs[i].paPaePTsGC = MMHyperHC2GC(pVM, pCur->aPTs[i].paPaePTsHC);
+            pCur->aPTs[i].pPTGC = MMHyperHC2GC(pVM, pCur->aPTs[i].pPTR3);
+            pCur->aPTs[i].paPaePTsGC = MMHyperHC2GC(pVM, pCur->aPTs[i].paPaePTsR3);
         }
     }
@@ -1349,5 +1349,5 @@
      */
     uint32_t i = 0;
-    for (PPGMMAPPING pMapping = pPGM->pMappingsHC; pMapping; pMapping = pMapping->pNextHC, i++)
+    for (PPGMMAPPING pMapping = pPGM->pMappingsR3; pMapping; pMapping = pMapping->pNextR3, i++)
     {
         SSMR3PutU32(pSSM, i);
@@ -1501,5 +1501,5 @@
         /* find matching range. */
         PPGMMAPPING pMapping;
-        for (pMapping = pPGM->pMappingsHC; pMapping; pMapping = pMapping->pNextHC)
+        for (pMapping = pPGM->pMappingsR3; pMapping; pMapping = pMapping->pNextR3)
             if (    pMapping->cPTs == cPTs
                 &&  !strcmp(pMapping->pszDesc, szDesc))
@@ -2577,5 +2577,5 @@
                     else
                     {
-                        for (PPGMMAPPING pMap = pVM->pgm.s.pMappingsHC; pMap; pMap = pMap->pNextHC)
+                        for (PPGMMAPPING pMap = pVM->pgm.s.pMappingsR3; pMap; pMap = pMap->pNextR3)
                         {
                             uint64_t off = u64AddressPT - pMap->GCPtr;
@@ -2588,5 +2588,5 @@
                                                     fLongMode ? 16 : 8, u64AddressPT, iPDE,
                                                     iSub ? pMap->aPTs[iPDE].HCPhysPaePT1 : pMap->aPTs[iPDE].HCPhysPaePT0, HCPhysPT);
-                                pPT = &pMap->aPTs[iPDE].paPaePTsHC[iSub];
+                                pPT = &pMap->aPTs[iPDE].paPaePTsR3[iSub];
                             }
                         }
@@ -2843,5 +2843,5 @@
                     else
                     {
-                        for (PPGMMAPPING pMap = pVM->pgm.s.pMappingsHC; pMap; pMap = pMap->pNextHC)
+                        for (PPGMMAPPING pMap = pVM->pgm.s.pMappingsR3; pMap; pMap = pMap->pNextR3)
                             if (u32Address - pMap->GCPtr < pMap->cb)
                             {
@@ -2850,5 +2850,5 @@
                                     pHlp->pfnPrintf(pHlp, "%08x error! Mapping error! PT %d has HCPhysPT=%VHp not %VHp is in the PD.\n",
                                                     u32Address, iPDE, pMap->aPTs[iPDE].HCPhysPT, HCPhys);
-                                pPT = pMap->aPTs[iPDE].pPTHC;
+                                pPT = pMap->aPTs[iPDE].pPTR3;
                             }
                     }
@@ -3128,5 +3128,5 @@
     if (!pVM)
         return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "error: The command requires VM to be selected.\n");
-    if (!pVM->pgm.s.pMappingsHC)
+    if (!pVM->pgm.s.pMappingsR3)
         return pCmdHlp->pfnPrintf(pCmdHlp, NULL, "Sorry, no mappings are registered.\n");
 
@@ -3142,5 +3142,5 @@
      */
     PPGMMAPPING pCur;
-    for (pCur = pVM->pgm.s.pMappingsHC; pCur; pCur = pCur->pNextHC)
+    for (pCur = pVM->pgm.s.pMappingsR3; pCur; pCur = pCur->pNextR3)
     {
         rc = pCmdHlp->pfnPrintf(pCmdHlp, NULL,
Index: trunk/src/VBox/VMM/PGMHandler.cpp
===================================================================
--- trunk/src/VBox/VMM/PGMHandler.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/PGMHandler.cpp	(revision 2270)
@@ -86,5 +86,5 @@
 PGMR3DECL(int) PGMR3HandlerPhysicalRegister(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast,
                                             PFNPGMR3PHYSHANDLER pfnHandlerR3, void *pvUserR3,
-                                            const char *pszModR0, const char *pszHandlerR0, RTHCPTR pvUserR0,
+                                            const char *pszModR0, const char *pszHandlerR0, RTR0PTR pvUserR0,
                                             const char *pszModGC, const char *pszHandlerGC, RTGCPTR pvUserGC, const char *pszDesc)
 {
Index: trunk/src/VBox/VMM/PGMInternal.h
===================================================================
--- trunk/src/VBox/VMM/PGMInternal.h	(revision 2267)
+++ trunk/src/VBox/VMM/PGMInternal.h	(revision 2270)
@@ -304,7 +304,9 @@
 {
     /** Pointer to next entry. */
-    HCPTRTYPE(struct PGMMAPPING *)  pNextHC;
+    R3PTRTYPE(struct PGMMAPPING *)  pNextR3;
     /** Pointer to next entry. */
     GCPTRTYPE(struct PGMMAPPING *)  pNextGC;
+    /** Pointer to next entry. */
+    R0PTRTYPE(struct PGMMAPPING *)  pNextR0;
     /** Start Virtual address. */
     RTGCUINTPTR                     GCPtr;
@@ -314,9 +316,9 @@
     RTGCUINTPTR                     cb;
     /** Pointer to relocation callback function. */
-    HCPTRTYPE(PFNPGMRELOCATE)       pfnRelocate;
+    R3PTRTYPE(PFNPGMRELOCATE)       pfnRelocate;
     /** User argument to the callback. */
-    HCPTRTYPE(void *)               pvUser;
+    R3PTRTYPE(void *)               pvUser;
     /** Mapping description / name. For easing debugging. */
-    HCPTRTYPE(const char *)         pszDesc;
+    R3PTRTYPE(const char *)         pszDesc;
     /** Number of page tables. */
     RTUINT                          cPTs;
@@ -337,11 +339,15 @@
         RTHCPHYS                HCPhysPaePT1;
         /** The HC virtual address of the 32-bit page table. */
-        HCPTRTYPE(PVBOXPT)      pPTHC;
+        R3PTRTYPE(PVBOXPT)      pPTR3;
         /** The HC virtual address of the two PAE page table. (i.e 1024 entries instead of 512) */
-        HCPTRTYPE(PX86PTPAE)    paPaePTsHC;
+        R3PTRTYPE(PX86PTPAE)    paPaePTsR3;
         /** The GC virtual address of the 32-bit page table. */
         GCPTRTYPE(PVBOXPT)      pPTGC;
         /** The GC virtual address of the two PAE page table. */
         GCPTRTYPE(PX86PTPAE)    paPaePTsGC;
+        /** The GC virtual address of the 32-bit page table. */
+        R0PTRTYPE(PVBOXPT)      pPTR0;
+        /** The GC virtual address of the two PAE page table. */
+        R0PTRTYPE(PX86PTPAE)    paPaePTsR0;
     } aPTs[1];
 } PGMMAPPING;
@@ -366,11 +372,11 @@
     uint32_t                            cPages;
     /** Pointer to R3 callback function. */
-    HCPTRTYPE(PFNPGMR3PHYSHANDLER)      pfnHandlerR3;
+    R3PTRTYPE(PFNPGMR3PHYSHANDLER)      pfnHandlerR3;
     /** User argument for R3 handlers. */
-    HCPTRTYPE(void *)                   pvUserR3;
+    R3PTRTYPE(void *)                   pvUserR3;
     /** Pointer to R0 callback function. */
     R0PTRTYPE(PFNPGMR0PHYSHANDLER)      pfnHandlerR0;
     /** User argument for R0 handlers. */
-    HCPTRTYPE(void *)                   pvUserR0;
+    R0PTRTYPE(void *)                   pvUserR0;
     /** Pointer to GC callback function. */
     GCPTRTYPE(PFNPGMGCPHYSHANDLER)      pfnHandlerGC;
@@ -378,5 +384,5 @@
     GCPTRTYPE(void *)                   pvUserGC;
     /** Description / Name. For easing debugging. */
-    HCPTRTYPE(const char *)             pszDesc;
+    R3PTRTYPE(const char *)             pszDesc;
 #ifdef VBOX_WITH_STATISTICS
     /** Profiling of this handler. */
@@ -517,5 +523,5 @@
 {
     /** HC pointer to physical page */
-    HCPTRTYPE(uint8_t *)            pbHC;
+    R3PTRTYPE(uint8_t *)            pbHC;
     /** GC Physical address for cache entry */
     RTGCPHYS                        GCPhys;
@@ -787,7 +793,7 @@
     R0PTRTYPE(PFNPGMR0PHYSHANDLER)  pfnAccessHandlerR0;
     /** Access handler, R3. */
-    HCPTRTYPE(PFNPGMR3PHYSHANDLER)  pfnAccessHandlerR3;
+    R3PTRTYPE(PFNPGMR3PHYSHANDLER)  pfnAccessHandlerR3;
     /** The access handler description (HC ptr). */
-    HCPTRTYPE(const char *)         pszAccessHandler;
+    R3PTRTYPE(const char *)         pszAccessHandler;
 #endif /* PGMPOOL_WITH_MONITORING */
     /** The number of pages currently in use. */
@@ -1368,5 +1374,9 @@
      * The list is sorted ascending on address.
      */
-    HCPTRTYPE(PPGMMAPPING)          pMappingsHC;
+    R3PTRTYPE(PPGMMAPPING)          pMappingsR3;
+    /** Linked list of GC mappings - for R0.
+     * The list is sorted ascending on address.
+     */
+    R0PTRTYPE(PPGMMAPPING)          pMappingsR0;
 
     /** If set no conflict checks are required.  (boolean) */
Index: trunk/src/VBox/VMM/PGMMap.cpp
===================================================================
--- trunk/src/VBox/VMM/PGMMap.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/PGMMap.cpp	(revision 2270)
@@ -94,5 +94,5 @@
      */
     PPGMMAPPING pPrev = NULL;
-    PPGMMAPPING pCur = pVM->pgm.s.pMappingsHC;
+    PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3;
     while (pCur)
     {
@@ -108,5 +108,5 @@
             break;
         pPrev = pCur;
-        pCur = pCur->pNextHC;
+        pCur = pCur->pNextR3;
     }
 
@@ -164,10 +164,11 @@
          * 32-bit.
          */
-        pNew->aPTs[i].pPTHC    = (PVBOXPT)pbPTs;
-        pNew->aPTs[i].pPTGC    = MMHyperHC2GC(pVM, pNew->aPTs[i].pPTHC);
-        pNew->aPTs[i].HCPhysPT = MMR3HyperHCVirt2HCPhys(pVM, pNew->aPTs[i].pPTHC);
+        pNew->aPTs[i].pPTR3    = (PVBOXPT)pbPTs;
+        pNew->aPTs[i].pPTGC    = MMHyperR3ToGC(pVM, pNew->aPTs[i].pPTR3);
+        pNew->aPTs[i].pPTR0    = MMHyperR3ToR0(pVM, pNew->aPTs[i].pPTR3);
+        pNew->aPTs[i].HCPhysPT = MMR3HyperHCVirt2HCPhys(pVM, pNew->aPTs[i].pPTR3);
         pbPTs += PAGE_SIZE;
         Log4(("PGMR3MapPT: i=%d: pPTHC=%p pPTGC=%p HCPhysPT=%RHp\n",
-              i, pNew->aPTs[i].pPTHC, pNew->aPTs[i].pPTGC, pNew->aPTs[i].HCPhysPT));
+              i, pNew->aPTs[i].pPTR3, pNew->aPTs[i].pPTGC, pNew->aPTs[i].HCPhysPT));
 
         /*
@@ -176,9 +177,10 @@
         pNew->aPTs[i].HCPhysPaePT0 = MMR3HyperHCVirt2HCPhys(pVM, pbPTs);
         pNew->aPTs[i].HCPhysPaePT1 = MMR3HyperHCVirt2HCPhys(pVM, pbPTs + PAGE_SIZE);
-        pNew->aPTs[i].paPaePTsHC = (PX86PTPAE)pbPTs;
-        pNew->aPTs[i].paPaePTsGC = MMHyperHC2GC(pVM, pbPTs);
+        pNew->aPTs[i].paPaePTsR3 = (PX86PTPAE)pbPTs;
+        pNew->aPTs[i].paPaePTsGC = MMHyperR3ToGC(pVM, pbPTs);
+        pNew->aPTs[i].paPaePTsR0 = MMHyperR3ToR0(pVM, pbPTs);
         pbPTs += PAGE_SIZE * 2;
         Log4(("PGMR3MapPT: i=%d: paPaePTsHC=%p paPaePTsGC=%p HCPhysPaePT0=%RHp HCPhysPaePT1=%RHp\n",
-              i, pNew->aPTs[i].paPaePTsHC, pNew->aPTs[i].paPaePTsGC, pNew->aPTs[i].HCPhysPaePT0, pNew->aPTs[i].HCPhysPaePT1));
+              i, pNew->aPTs[i].paPaePTsR3, pNew->aPTs[i].paPaePTsGC, pNew->aPTs[i].HCPhysPaePT0, pNew->aPTs[i].HCPhysPaePT1));
     }
     pgmR3MapSetPDEs(pVM, pNew, iPageDir);
@@ -187,15 +189,18 @@
      * Insert the new mapping.
      */
-    pNew->pNextHC = pCur;
-    pNew->pNextGC = pCur ? MMHyperHC2GC(pVM, pCur) : 0;
+    pNew->pNextR3 = pCur;
+    pNew->pNextGC = pCur ? MMHyperR3ToGC(pVM, pCur) : 0;
+    pNew->pNextR0 = pCur ? MMHyperR3ToR0(pVM, pCur) : 0;
     if (pPrev)
     {
-        pPrev->pNextHC = pNew;
-        pPrev->pNextGC = MMHyperHC2GC(pVM, pNew);
+        pPrev->pNextR3 = pNew;
+        pPrev->pNextGC = MMHyperR3ToGC(pVM, pNew);
+        pPrev->pNextR0 = MMHyperR3ToR0(pVM, pNew);
     }
     else
     {
-        pVM->pgm.s.pMappingsHC = pNew;
-        pVM->pgm.s.pMappingsGC = MMHyperHC2GC(pVM, pNew);
+        pVM->pgm.s.pMappingsR3 = pNew;
+        pVM->pgm.s.pMappingsGC = MMHyperR3ToGC(pVM, pNew);
+        pVM->pgm.s.pMappingsR0 = MMHyperR3ToR0(pVM, pNew);
     }
 
@@ -220,5 +225,5 @@
      */
     PPGMMAPPING pPrev = NULL;
-    PPGMMAPPING pCur = pVM->pgm.s.pMappingsHC;
+    PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3;
     while (pCur)
     {
@@ -230,11 +235,13 @@
             if (pPrev)
             {
-                pPrev->pNextHC = pCur->pNextHC;
+                pPrev->pNextR3 = pCur->pNextR3;
                 pPrev->pNextGC = pCur->pNextGC;
+                pPrev->pNextR0 = pCur->pNextR0;
             }
             else
             {
-                pVM->pgm.s.pMappingsHC = pCur->pNextHC;
+                pVM->pgm.s.pMappingsR3 = pCur->pNextR3;
                 pVM->pgm.s.pMappingsGC = pCur->pNextGC;
+                pVM->pgm.s.pMappingsR0 = pCur->pNextR0;
             }
 
@@ -243,5 +250,5 @@
              * and free the page tables and node memory.
              */
-            MMHyperFree(pVM, pCur->aPTs[0].pPTHC);
+            MMHyperFree(pVM, pCur->aPTs[0].pPTR3);
             pgmR3MapClearPDEs(&pVM->pgm.s, pCur, pCur->GCPtr >> PGDIR_SHIFT);
             MMHyperFree(pVM, pCur);
@@ -257,5 +264,5 @@
         /* next */
         pPrev = pCur;
-        pCur = pCur->pNextHC;
+        pCur = pCur->pNextR3;
     }
 
@@ -276,5 +283,5 @@
 {
     size_t cb = 0;
-    for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsHC; pCur; pCur = pCur->pNextHC)
+    for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3; pCur; pCur = pCur->pNextR3)
         cb += pCur->cb;
 
@@ -327,10 +334,10 @@
         {
             /* Check that it's not one or our mappings. */
-            PPGMMAPPING pCur = pVM->pgm.s.pMappingsHC;
+            PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3;
             while (pCur)
             {
                 if (iPDNew + i - (pCur->GCPtr >> PGDIR_SHIFT) < (pCur->cb >> PGDIR_SHIFT))
                     break;
-                pCur = pCur->pNextHC;
+                pCur = pCur->pNextR3;
             }
             if (!pCur)
@@ -347,5 +354,5 @@
      */
     RTGCPTR     GCPtrCur = GCPtrBase;
-    PPGMMAPPING pCur = pVM->pgm.s.pMappingsHC;
+    PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3;
     while (pCur)
     {
@@ -357,5 +364,5 @@
         /* next */
         GCPtrCur += pCur->cb;
-        pCur = pCur->pNextHC;
+        pCur = pCur->pNextR3;
     }
     if (GCPtrCur > GCPtrBase + cb)
@@ -370,5 +377,5 @@
      */
     GCPtrCur = GCPtrBase;
-    pCur = pVM->pgm.s.pMappingsHC;
+    pCur = pVM->pgm.s.pMappingsR3;
     while (pCur)
     {
@@ -397,5 +404,5 @@
          */
         GCPtrCur += pCur->cb;
-        pCur = pCur->pNextHC;
+        pCur = pCur->pNextR3;
     }
 
@@ -798,10 +805,10 @@
     /* Find previous mapping for pMapping, put result into pPrevMap. */
     PPGMMAPPING pPrevMap = NULL;
-    PPGMMAPPING pCur = pVM->pgm.s.pMappingsHC;
+    PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3;
     while (pCur && pCur != pMapping)
     {
         /* next */
         pPrevMap = pCur;
-        pCur = pCur->pNextHC;
+        pCur = pCur->pNextR3;
     }
     Assert(pCur);
@@ -810,10 +817,10 @@
     RTGCPTR     GCPtrNew = iPDNew << PGDIR_SHIFT;
     PPGMMAPPING pPrev = NULL;
-    pCur = pVM->pgm.s.pMappingsHC;
+    pCur = pVM->pgm.s.pMappingsR3;
     while (pCur && pCur->GCPtr < GCPtrNew)
     {
         /* next */
         pPrev = pCur;
-        pCur = pCur->pNextHC;
+        pCur = pCur->pNextR3;
     }
 
@@ -825,11 +832,13 @@
         if (pPrevMap)
         {
-            pPrevMap->pNextHC = pMapping->pNextHC;
+            pPrevMap->pNextR3 = pMapping->pNextR3;
             pPrevMap->pNextGC = pMapping->pNextGC;
+            pPrevMap->pNextR0 = pMapping->pNextR0;
         }
         else
         {
-            pVM->pgm.s.pMappingsHC = pMapping->pNextHC;
+            pVM->pgm.s.pMappingsR3 = pMapping->pNextR3;
             pVM->pgm.s.pMappingsGC = pMapping->pNextGC;
+            pVM->pgm.s.pMappingsR0 = pMapping->pNextR0;
         }
 
@@ -837,16 +846,20 @@
          * Link
          */
-        pMapping->pNextHC = pCur;
+        pMapping->pNextR3 = pCur;
         if (pPrev)
         {
             pMapping->pNextGC = pPrev->pNextGC;
-            pPrev->pNextHC = pMapping;
-            pPrev->pNextGC = MMHyperHC2GC(pVM, pMapping);
+            pMapping->pNextR0 = pPrev->pNextR0;
+            pPrev->pNextR3 = pMapping;
+            pPrev->pNextGC = MMHyperR3ToGC(pVM, pMapping);
+            pPrev->pNextR0 = MMHyperR3ToR0(pVM, pMapping);
         }
         else
         {
             pMapping->pNextGC = pVM->pgm.s.pMappingsGC;
-            pVM->pgm.s.pMappingsHC = pMapping;
-            pVM->pgm.s.pMappingsGC = MMHyperHC2GC(pVM, pMapping);
+            pMapping->pNextR0 = pVM->pgm.s.pMappingsR0;
+            pVM->pgm.s.pMappingsR3 = pMapping;
+            pVM->pgm.s.pMappingsGC = MMHyperR3ToGC(pVM, pMapping);
+            pVM->pgm.s.pMappingsR0 = MMHyperR3ToR0(pVM, pMapping);
         }
     }
@@ -957,5 +970,5 @@
      * Iterate mappings.
      */
-    for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsHC; pCur; pCur = pCur->pNextHC)
+    for (PPGMMAPPING pCur = pVM->pgm.s.pMappingsR3; pCur; pCur = pCur->pNextR3)
     {
         unsigned iPDE = pCur->GCPtr >> PGDIR_SHIFT;
@@ -1026,5 +1039,5 @@
      * Find the mapping.
      */
-    PPGMMAPPING pCur = CTXSUFF(pVM->pgm.s.pMappings);
+    PPGMMAPPING pCur = CTXALLSUFF(pVM->pgm.s.pMappings);
     while (pCur)
     {
@@ -1041,9 +1054,9 @@
             unsigned iPT  = off >> PGDIR_SHIFT;
             unsigned iPTE = (off >> PAGE_SHIFT) & PTE_MASK;
-            while (cb > 0 && iPTE < ELEMENTS(CTXSUFF(pCur->aPTs[iPT].pPT)->a))
+            while (cb > 0 && iPTE < ELEMENTS(CTXALLSUFF(pCur->aPTs[iPT].pPT)->a))
             {
-                if (!CTXSUFF(pCur->aPTs[iPT].paPaePTs)[iPTE / 512].a[iPTE % 512].n.u1Present)
+                if (!CTXALLSUFF(pCur->aPTs[iPT].paPaePTs)[iPTE / 512].a[iPTE % 512].n.u1Present)
                     return VERR_PAGE_NOT_PRESENT;
-                RTHCPHYS HCPhys = CTXSUFF(pCur->aPTs[iPT].paPaePTs)[iPTE / 512].a[iPTE % 512].u & X86_PTE_PAE_PG_MASK;
+                RTHCPHYS HCPhys = CTXALLSUFF(pCur->aPTs[iPT].paPaePTs)[iPTE / 512].a[iPTE % 512].u & X86_PTE_PAE_PG_MASK;
 
                 /*
@@ -1061,5 +1074,5 @@
 
         /* next */
-        pCur = CTXSUFF(pCur->pNext);
+        pCur = CTXALLSUFF(pCur->pNext);
     }
 
@@ -1118,5 +1131,5 @@
 
     PPGMMAPPING pCur;
-    for (pCur = pVM->pgm.s.pMappingsHC; pCur; pCur = pCur->pNextHC)
+    for (pCur = pVM->pgm.s.pMappingsR3; pCur; pCur = pCur->pNextR3)
         RTLogPrintf("%VGv - %VGv  %s\n", pCur->GCPtr, pCur->GCPtrLast, pCur->pszDesc);
 
Index: trunk/src/VBox/VMM/VMMAll/IOMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IOMAll.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/VMMAll/IOMAll.cpp	(revision 2270)
@@ -435,11 +435,11 @@
         pRange->pfnWriteCallback= pfnWriteCallback;
         pRange->pfnFillCallback = pfnFillCallback;
-        #ifdef IN_GC
+#ifdef IN_GC
         pRange->pDevIns         = pDevIns;
         pRange->pszDesc         = MMHyperGC2HC(pVM, (void *)pszDesc);
-        #else
+#else
         pRange->pDevIns         = MMHyperHC2GC(pVM, pDevIns);
         pRange->pszDesc         = pszDesc;
-        #endif
+#endif
 
         /*
@@ -478,7 +478,7 @@
  * @param   pszDesc             Pointer to description string. This must not be freed.
  */
-IOMDECL(int)  IOMIOPortRegisterR0(PVM pVM, PPDMDEVINS pDevIns, RTIOPORT PortStart, RTUINT cPorts, RTHCPTR pvUser,
-                                  HCPTRTYPE(PFNIOMIOPORTOUT) pfnOutCallback, HCPTRTYPE(PFNIOMIOPORTIN) pfnInCallback,
-                                  HCPTRTYPE(PFNIOMIOPORTOUTSTRING) pfnOutStrCallback, HCPTRTYPE(PFNIOMIOPORTINSTRING) pfnInStrCallback,
+IOMDECL(int)  IOMIOPortRegisterR0(PVM pVM, PPDMDEVINS pDevIns, RTIOPORT PortStart, RTUINT cPorts, RTR0PTR pvUser,
+                                  R0PTRTYPE(PFNIOMIOPORTOUT) pfnOutCallback, R0PTRTYPE(PFNIOMIOPORTIN) pfnInCallback,
+                                  R0PTRTYPE(PFNIOMIOPORTOUTSTRING) pfnOutStrCallback, R0PTRTYPE(PFNIOMIOPORTINSTRING) pfnInStrCallback,
                                   const char *pszDesc)
 {
@@ -548,9 +548,12 @@
         pRange->pfnInStrCallback = pfnInStrCallback;
 #ifdef IN_GC
-        pRange->pDevIns         = MMHyperGC2HC(pVM, pDevIns);
-        pRange->pszDesc         = MMHyperGC2HC(pVM, (void *)pszDesc);
+        pRange->pDevIns         = MMHyperGCToR0(pVM, pDevIns);
+        pRange->pszDesc         = MMHyperGCToR3(pVM, (void *)pszDesc);
+#elif defined(IN_RING3)
+        pRange->pDevIns         = MMHyperR3ToR0(pVM, pDevIns);
+        pRange->pszDesc         = pszDesc;
 #else
         pRange->pDevIns         = pDevIns;
-        pRange->pszDesc         = pszDesc;
+        pRange->pszDesc         = MMHyperR0ToR3(pVM, (RTR0PTR)pszDesc);
 #endif
 
@@ -590,7 +593,7 @@
  * @param   pszDesc             Pointer to description string. This must not be freed.
  */
-IOMDECL(int)  IOMMMIORegisterR0(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTUINT cbRange, RTHCPTR pvUser,
-                                HCPTRTYPE(PFNIOMMMIOWRITE) pfnWriteCallback, HCPTRTYPE(PFNIOMMMIOREAD) pfnReadCallback,
-                                HCPTRTYPE(PFNIOMMMIOFILL) pfnFillCallback, const char *pszDesc)
+IOMDECL(int)  IOMMMIORegisterR0(PVM pVM, PPDMDEVINS pDevIns, RTGCPHYS GCPhysStart, RTUINT cbRange, RTR0PTR pvUser,
+                                R0PTRTYPE(PFNIOMMMIOWRITE) pfnWriteCallback, R0PTRTYPE(PFNIOMMMIOREAD) pfnReadCallback,
+                                R0PTRTYPE(PFNIOMMMIOFILL) pfnFillCallback, const char *pszDesc)
 {
     LogFlow(("IOMMMIORegisterR0: pDevIns=%p GCPhysStart=%#x cbRange=%#x pvUser=%VHv pfnWriteCallback=%#x pfnReadCallback=%#x pfnFillCallback=%#x pszDesc=%s\n",
@@ -658,9 +661,12 @@
         pRange->pfnFillCallback = pfnFillCallback;
 #ifdef IN_GC
-        pRange->pDevIns         = MMHyperGC2HC(pVM, pDevIns);
-        pRange->pszDesc         = MMHyperGC2HC(pVM, (void *)pszDesc);
+        pRange->pDevIns         = MMHyperGCToR0(pVM, pDevIns);
+        pRange->pszDesc         = MMHyperGCToR3(pVM, (void *)pszDesc);
+#elif defined(IN_RING3)
+        pRange->pDevIns         = MMHyperR3ToR0(pVM, pDevIns);
+        pRange->pszDesc         = pszDesc;
 #else
         pRange->pDevIns         = pDevIns;
-        pRange->pszDesc         = pszDesc;
+        pRange->pszDesc         = MMHyperR0ToR3(pVM, (RTR0PTR)pszDesc);
 #endif
 
Index: trunk/src/VBox/VMM/VMMAll/MMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/MMAll.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/VMMAll/MMAll.cpp	(revision 2270)
@@ -336,4 +336,5 @@
     if (pLookup)
         return mmHyperLookupCalcR0(pLookup, off);
+    AssertMsgFailed(("R3Ptr=%p is not inside the hypervisor memory area!\n", R3Ptr));
     return NIL_RTR0PTR;
 }
@@ -355,4 +356,5 @@
     if (pLookup)
         return mmHyperLookupCalcGC(pVM, pLookup, off);
+    AssertMsgFailed(("R3Ptr=%p is not inside the hypervisor memory area!\n", R3Ptr));
     return NIL_RTGCPTR;
 }
@@ -630,4 +632,4 @@
     return MMHyperHC2GC(pVM, (RTHCPTR)Ptr);
 }
+
 #endif /* !IN_GC */
-
Index: trunk/src/VBox/VMM/VMMAll/PGMAll.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/VMMAll/PGMAll.cpp	(revision 2270)
@@ -343,5 +343,5 @@
 PPGMMAPPING pgmGetMapping(PVM pVM, RTGCPTR GCPtr)
 {
-    PPGMMAPPING pMapping = CTXSUFF(pVM->pgm.s.pMappings);
+    PPGMMAPPING pMapping = CTXALLSUFF(pVM->pgm.s.pMappings);
     while (pMapping)
     {
@@ -353,5 +353,5 @@
             return pMapping;
         }
-        pMapping = CTXSUFF(pMapping->pNext);
+        pMapping = CTXALLSUFF(pMapping->pNext);
     }
     return NULL;
@@ -1652,7 +1652,7 @@
      * Check for mapping conflicts.
      */
-    for (PPGMMAPPING pMapping = CTXSUFF(pVM->pgm.s.pMappings);
+    for (PPGMMAPPING pMapping = CTXALLSUFF(pVM->pgm.s.pMappings);
          pMapping;
-         pMapping = CTXSUFF(pMapping->pNext))
+         pMapping = CTXALLSUFF(pMapping->pNext))
     {
         /** @todo This is slow and should be optimized, but since it's just assertions I don't care now. */
Index: trunk/src/VBox/VMM/VMMAll/PGMAllBth.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 2267)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllBth.h	(revision 2270)
@@ -169,6 +169,6 @@
     {
         STAM_PROFILE_START(&pVM->pgm.s.StatMapping, a);
-        PPGMMAPPING pMapping = CTXSUFF(pVM->pgm.s.pMappings);
-        for ( ; pMapping; pMapping = CTXSUFF(pMapping->pNext))
+        PPGMMAPPING pMapping = CTXALLSUFF(pVM->pgm.s.pMappings);
+        for ( ; pMapping; pMapping = CTXALLSUFF(pMapping->pNext))
         {
             if ((RTGCUINTPTR)pvFault < (RTGCUINTPTR)pMapping->GCPtr)
@@ -2613,5 +2613,5 @@
     if (pgmMapAreMappingsEnabled(&pVM->pgm.s))
     {
-        pMapping      = pVM->pgm.s.CTXSUFF(pMappings);
+        pMapping      = pVM->pgm.s.CTXALLSUFF(pMappings);
         iPdNoMapping  = (pMapping) ? pMapping->GCPtr >> PGDIR_SHIFT : ~0U;
     }
@@ -2644,5 +2644,5 @@
                     iPD += cPTs - 1;
                     pPDEDst += cPTs + (PGM_SHW_TYPE != PGM_TYPE_32BIT) * cPTs;
-                    pMapping = pMapping->CTXSUFF(pNext);
+                    pMapping = pMapping->CTXALLSUFF(pNext);
                     iPdNoMapping = pMapping ? pMapping->GCPtr >> PGDIR_SHIFT : ~0U;
                     continue;
@@ -2657,7 +2657,7 @@
                  * Update iPdNoMapping and pMapping.
                  */
-                pMapping = pVM->pgm.s.pMappingsHC;
+                pMapping = pVM->pgm.s.pMappingsR3;
                 while (pMapping && pMapping->GCPtr < (iPD << PGDIR_SHIFT))
-                    pMapping = pMapping->pNextHC;
+                    pMapping = pMapping->pNextR3;
                 iPdNoMapping = pMapping ? pMapping->GCPtr >> PGDIR_SHIFT : ~0U;
 #else
@@ -2777,5 +2777,5 @@
             {
                 /* It's fixed, just skip the mapping. */
-                pMapping = pMapping->CTXSUFF(pNext);
+                pMapping = pMapping->CTXALLSUFF(pNext);
                 iPdNoMapping = pMapping ? pMapping->GCPtr >> PGDIR_SHIFT : ~0U;
             }
@@ -2801,7 +2801,7 @@
                          * Update iPdNoMapping and pMapping.
                          */
-                        pMapping = pVM->pgm.s.CTXSUFF(pMappings);
+                        pMapping = pVM->pgm.s.CTXALLSUFF(pMappings);
                         while (pMapping && pMapping->GCPtr < (iPD << PGDIR_SHIFT))
-                            pMapping = pMapping->CTXSUFF(pNext);
+                            pMapping = pMapping->CTXALLSUFF(pNext);
                         iPdNoMapping = pMapping ? pMapping->GCPtr >> PGDIR_SHIFT : ~0U;
                         break;
@@ -2814,5 +2814,5 @@
                 if (iPdNoMapping == ~0U && pMapping)
                 {
-                    pMapping = pMapping->CTXSUFF(pNext);
+                    pMapping = pMapping->CTXALLSUFF(pNext);
                     if (pMapping)
                         iPdNoMapping = pMapping->GCPtr >> PGDIR_SHIFT;
Index: trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllHandler.cpp	(revision 2270)
@@ -81,8 +81,8 @@
  */
 PGMDECL(int) PGMHandlerPhysicalRegisterEx(PVM pVM, PGMPHYSHANDLERTYPE enmType, RTGCPHYS GCPhys, RTGCPHYS GCPhysLast,
-                                          HCPTRTYPE(PFNPGMR3PHYSHANDLER) pfnHandlerR3, RTHCPTR pvUserR3,
-                                          R0PTRTYPE(PFNPGMR0PHYSHANDLER) pfnHandlerR0, RTHCPTR pvUserR0,
+                                          R3PTRTYPE(PFNPGMR3PHYSHANDLER) pfnHandlerR3, RTR3PTR pvUserR3,
+                                          R0PTRTYPE(PFNPGMR0PHYSHANDLER) pfnHandlerR0, RTR0PTR pvUserR0,
                                           GCPTRTYPE(PFNPGMGCPHYSHANDLER) pfnHandlerGC, RTGCPTR pvUserGC,
-                                          HCPTRTYPE(const char *) pszDesc)
+                                          R3PTRTYPE(const char *) pszDesc)
 {
     Log(("PGMHandlerPhysicalRegisterEx: enmType=%d GCPhys=%VGp GCPhysLast=%VGp pfnHandlerR3=%VHv pvUserR3=%VHv pfnHandlerR0=%VHv pvUserR0=%VHv pfnHandlerGC=%VGv pvUserGC=%VGv pszDesc=%s\n",
@@ -601,8 +601,8 @@
  */
 PGMDECL(int) PGMHandlerPhysicalChangeCallbacks(PVM pVM, RTGCPHYS GCPhys,
-                                               HCPTRTYPE(PFNPGMR3PHYSHANDLER) pfnHandlerR3, RTHCPTR pvUserR3,
-                                               R0PTRTYPE(PFNPGMR0PHYSHANDLER) pfnHandlerR0, RTHCPTR pvUserR0,
+                                               R3PTRTYPE(PFNPGMR3PHYSHANDLER) pfnHandlerR3, RTR3PTR pvUserR3,
+                                               R0PTRTYPE(PFNPGMR0PHYSHANDLER) pfnHandlerR0, RTR0PTR pvUserR0,
                                                GCPTRTYPE(PFNPGMGCPHYSHANDLER) pfnHandlerGC, RTGCPTR pvUserGC,
-                                               HCPTRTYPE(const char *) pszDesc)
+                                               R3PTRTYPE(const char *) pszDesc)
 {
     /*
Index: trunk/src/VBox/VMM/VMMAll/PGMAllMap.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllMap.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllMap.cpp	(revision 2270)
@@ -64,5 +64,5 @@
      * Find the mapping.
      */
-    PPGMMAPPING pCur = CTXSUFF(pVM->pgm.s.pMappings);
+    PPGMMAPPING pCur = CTXALLSUFF(pVM->pgm.s.pMappings);
     while (pCur)
     {
@@ -91,8 +91,8 @@
 
                 /* 32-bit */
-                CTXSUFF(pCur->aPTs[iPT].pPT)->a[iPageNo].u = (uint32_t)Pte.u;      /* ASSUMES HCPhys < 4GB and/or that we're never gonna do 32-bit on a PAE host! */
+                CTXALLSUFF(pCur->aPTs[iPT].pPT)->a[iPageNo].u = (uint32_t)Pte.u;      /* ASSUMES HCPhys < 4GB and/or that we're never gonna do 32-bit on a PAE host! */
 
                 /* pae */
-                CTXSUFF(pCur->aPTs[iPT].paPaePTs)[iPageNo / 512].a[iPageNo % 512].u = Pte.u;
+                CTXALLSUFF(pCur->aPTs[iPT].paPaePTs)[iPageNo / 512].a[iPageNo % 512].u = Pte.u;
 
                 /* next */
@@ -108,5 +108,5 @@
 
         /* next */
-        pCur = CTXSUFF(pCur->pNext);
+        pCur = CTXALLSUFF(pCur->pNext);
     }
 
@@ -169,5 +169,5 @@
      * Find the mapping.
      */
-    PPGMMAPPING pCur = CTXSUFF(pVM->pgm.s.pMappings);
+    PPGMMAPPING pCur = CTXALLSUFF(pVM->pgm.s.pMappings);
     while (pCur)
     {
@@ -189,13 +189,13 @@
                 unsigned iPT  = off >> PGDIR_SHIFT;
                 unsigned iPTE = (off >> PAGE_SHIFT) & PTE_MASK;
-                while (cb > 0 && iPTE < ELEMENTS(CTXSUFF(pCur->aPTs[iPT].pPT)->a))
+                while (cb > 0 && iPTE < ELEMENTS(CTXALLSUFF(pCur->aPTs[iPT].pPT)->a))
                 {
                     /* 32-Bit */
-                    CTXSUFF(pCur->aPTs[iPT].pPT)->a[iPTE].u &= fMask | X86_PTE_PG_MASK;
-                    CTXSUFF(pCur->aPTs[iPT].pPT)->a[iPTE].u |= fFlags & ~X86_PTE_PG_MASK;
+                    CTXALLSUFF(pCur->aPTs[iPT].pPT)->a[iPTE].u &= fMask | X86_PTE_PG_MASK;
+                    CTXALLSUFF(pCur->aPTs[iPT].pPT)->a[iPTE].u |= fFlags & ~X86_PTE_PG_MASK;
 
                     /* PAE */
-                    CTXSUFF(pCur->aPTs[iPT].paPaePTs)[iPTE / 512].a[iPTE % 512].u &= fMask | X86_PTE_PAE_PG_MASK;
-                    CTXSUFF(pCur->aPTs[iPT].paPaePTs)[iPTE / 512].a[iPTE % 512].u |= fFlags & ~X86_PTE_PAE_PG_MASK;
+                    CTXALLSUFF(pCur->aPTs[iPT].paPaePTs)[iPTE / 512].a[iPTE % 512].u &= fMask | X86_PTE_PAE_PG_MASK;
+                    CTXALLSUFF(pCur->aPTs[iPT].paPaePTs)[iPTE / 512].a[iPTE % 512].u |= fFlags & ~X86_PTE_PAE_PG_MASK;
 
                     /* invalidate tls */
@@ -212,5 +212,5 @@
         }
         /* next */
-        pCur = CTXSUFF(pCur->pNext);
+        pCur = CTXALLSUFF(pCur->pNext);
     }
 
Index: trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllPool.cpp	(revision 2270)
@@ -1205,7 +1205,7 @@
         rc = PGMHandlerPhysicalRegisterEx(pVM, PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
                                           GCPhysPage, GCPhysPage + (PAGE_SIZE - 1),
-                                          pPool->pfnAccessHandlerR3, MMHyper2HC(pVM, (uintptr_t)pPage),
-                                          pPool->pfnAccessHandlerR0, MMHyper2HC(pVM, (uintptr_t)pPage),
-                                          pPool->pfnAccessHandlerGC, MMHyper2GC(pVM, (uintptr_t)pPage),
+                                          pPool->pfnAccessHandlerR3, MMHyperCCToR3(pVM, pPage),
+                                          pPool->pfnAccessHandlerR0, MMHyperCCToR0(pVM, pPage),
+                                          pPool->pfnAccessHandlerGC, MMHyperCCToGC(pVM, pPage),
                                           pPool->pszAccessHandler);
         /** @todo we should probably deal with out-of-memory conditions here, but for now increasing
@@ -1277,7 +1277,7 @@
             pNewHead->fCR3Mix = pPage->fCR3Mix;
             rc = PGMHandlerPhysicalChangeCallbacks(pVM, pPage->GCPhys & ~(RTGCPHYS)(PAGE_SIZE - 1),
-                                                   pPool->pfnAccessHandlerR3, MMHyper2HC(pVM, (uintptr_t)pNewHead),
-                                                   pPool->pfnAccessHandlerR0, MMHyper2HC(pVM, (uintptr_t)pNewHead),
-                                                   pPool->pfnAccessHandlerGC, MMHyper2GC(pVM, (uintptr_t)pNewHead),
+                                                   pPool->pfnAccessHandlerR3, MMHyperCCToR3(pVM, pNewHead),
+                                                   pPool->pfnAccessHandlerR0, MMHyperCCToR0(pVM, pNewHead),
+                                                   pPool->pfnAccessHandlerGC, MMHyperCCToGC(pVM, pNewHead),
                                                    pPool->pszAccessHandler);
             AssertFatalRCSuccess(rc);
@@ -3149,7 +3149,7 @@
             PVM pVM = pPool->CTXSUFF(pVM);
             int rc = PGMHandlerPhysicalChangeCallbacks(pVM, pPage->GCPhys & ~(RTGCPHYS)(PAGE_SIZE - 1),
-                                                       pPool->pfnAccessHandlerR3, MMHyper2HC(pVM, (uintptr_t)pPage),
-                                                       pPool->pfnAccessHandlerR0, MMHyper2HC(pVM, (uintptr_t)pPage),
-                                                       pPool->pfnAccessHandlerGC, MMHyper2GC(pVM, (uintptr_t)pPage),
+                                                       pPool->pfnAccessHandlerR3, MMHyperCCToR3(pVM, pPage),
+                                                       pPool->pfnAccessHandlerR0, MMHyperCCToR0(pVM, pPage),
+                                                       pPool->pfnAccessHandlerGC, MMHyperCCToGC(pVM, pPage),
                                                        pPool->pszAccessHandler);
             AssertFatalRCSuccess(rc);
Index: trunk/src/VBox/VMM/VMMAll/PGMAllShw.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/PGMAllShw.h	(revision 2267)
+++ trunk/src/VBox/VMM/VMMAll/PGMAllShw.h	(revision 2270)
@@ -189,7 +189,7 @@
         AssertMsgReturn(pMap, ("GCPtr=%VGv\n", GCPtr), VERR_INTERNAL_ERROR);
 #if PGM_SHW_TYPE == PGM_TYPE_32BIT
-        pPT = pMap->aPTs[(GCPtr - pMap->GCPtr) >> PGDIR_SHIFT].CTXSUFF(pPT);
+        pPT = pMap->aPTs[(GCPtr - pMap->GCPtr) >> PGDIR_SHIFT].CTXALLSUFF(pPT);
 #else /* PAE and AMD64: */
-        pPT = pMap->aPTs[(GCPtr - pMap->GCPtr) >> PGDIR_SHIFT].CTXSUFF(paPaePTs);
+        pPT = pMap->aPTs[(GCPtr - pMap->GCPtr) >> PGDIR_SHIFT].CTXALLSUFF(paPaePTs);
 #endif
     }
Index: trunk/src/VBox/VMM/VMMR0/PDMR0Device.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/PDMR0Device.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/VMMR0/PDMR0Device.cpp	(revision 2270)
@@ -48,5 +48,5 @@
 # define PDMDEV_ASSERT_DEVINS(pDevIns)   do { Assert(VALID_PTR(pDevIns)); \
                                               Assert(pDevIns->u32Version == PDM_DEVINS_VERSION); \
-                                              Assert(pDevIns->pvInstanceDataHC == (void *)&pDevIns->achInstanceData[0]); \
+                                              Assert(pDevIns->pvInstanceDataR0 == (void *)&pDevIns->achInstanceData[0]); \
                                          } while (0)
 #else
Index: trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 2267)
+++ trunk/src/VBox/VMM/testcase/tstVMStructGC.cpp	(revision 2270)
@@ -378,6 +378,7 @@
     GEN_CHECK_OFF(PGM, pTreesHC);
     GEN_CHECK_OFF(PGM, pTreesGC);
-    GEN_CHECK_OFF(PGM, pMappingsHC);
+    GEN_CHECK_OFF(PGM, pMappingsR3);
     GEN_CHECK_OFF(PGM, pMappingsGC);
+    GEN_CHECK_OFF(PGM, pMappingsR0);
     GEN_CHECK_OFF(PGM, fMappingsFixed);
     GEN_CHECK_OFF(PGM, GCPtrMappingFixed);
@@ -406,6 +407,7 @@
     GEN_CHECK_OFF(PGM, pgmphyswritecache);
     GEN_CHECK_SIZE(PGMMAPPING);
-    GEN_CHECK_OFF(PGMMAPPING, pNextHC);
+    GEN_CHECK_OFF(PGMMAPPING, pNextR3);
     GEN_CHECK_OFF(PGMMAPPING, pNextGC);
+    GEN_CHECK_OFF(PGMMAPPING, pNextR0);
     GEN_CHECK_OFF(PGMMAPPING, GCPtr);
     GEN_CHECK_OFF(PGMMAPPING, GCPtrLast);
@@ -416,10 +418,12 @@
     GEN_CHECK_OFF(PGMMAPPING, cPTs);
     GEN_CHECK_OFF(PGMMAPPING, aPTs[1].HCPhysPT);
-    GEN_CHECK_OFF(PGMMAPPING, aPTs[1].pPTHC);
+    GEN_CHECK_OFF(PGMMAPPING, aPTs[1].pPTR3);
+    GEN_CHECK_OFF(PGMMAPPING, aPTs[1].pPTR0);
     GEN_CHECK_OFF(PGMMAPPING, aPTs[1].pPTGC);
     GEN_CHECK_OFF(PGMMAPPING, aPTs[1].HCPhysPaePT0);
     GEN_CHECK_OFF(PGMMAPPING, aPTs[1].HCPhysPaePT1);
-    GEN_CHECK_OFF(PGMMAPPING, aPTs[1].paPaePTsHC);
+    GEN_CHECK_OFF(PGMMAPPING, aPTs[1].paPaePTsR3);
     GEN_CHECK_OFF(PGMMAPPING, aPTs[1].paPaePTsGC);
+    GEN_CHECK_OFF(PGMMAPPING, aPTs[1].paPaePTsR0);
     GEN_CHECK_SIZE(PGMPHYSHANDLER);
     GEN_CHECK_OFF(PGMPHYSHANDLER, Core);
