Changeset 81625 in vbox for trunk

Timestamp:

Nov 1, 2019 8:47:17 PM (5 years ago)

Author:

vboxsync

Message:

VMMDev: Converted to the new PDM device style. bugref:9218

Location:

trunk/src/VBox/Devices/VMMDev

Files:

• VMMDev.cpp (modified) (216 diffs)
• VMMDevHGCM.cpp (modified) (111 diffs)
• VMMDevHGCM.h (modified) (1 diff)
• VMMDevState.h (modified) (10 diffs)
• VMMDevTesting.cpp (modified) (28 diffs)

trunk/src/VBox/Devices/VMMDev/VMMDev.cpp

@@ -105 +105 @@
 #ifndef IN_RC
 # include <iprt/mem.h>
+# include <iprt/memsafer.h>
 #endif
 #ifdef IN_RING3
@@ -233 +234 @@
  * Sets the IRQ (raise it or lower it) for 1.03 additions.
  *
- * @param   pThis       The VMMDev state.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @thread  Any.
  * @remarks Must be called owning the critical section.
  */
-static void vmmdevSetIRQ_Legacy(PVMMDEV pThis)
+static void vmmdevSetIRQ_Legacy(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC)
 {
     if (pThis->fu32AdditionsOk)
     {
         /* Filter unsupported events */
-        uint32_t fEvents = pThis->fHostEventFlags & pThis->CTX_SUFF(pVMMDevRAM)->V.V1_03.u32GuestEventMask;
+        uint32_t fEvents = pThis->fHostEventFlags & pThisCC->CTX_SUFF(pVMMDevRAM)->V.V1_03.u32GuestEventMask;
 
         Log(("vmmdevSetIRQ: fEvents=%#010x, fHostEventFlags=%#010x, u32GuestEventMask=%#010x.\n",
-             fEvents, pThis->fHostEventFlags, pThis->CTX_SUFF(pVMMDevRAM)->V.V1_03.u32GuestEventMask));
+             fEvents, pThis->fHostEventFlags, pThisCC->CTX_SUFF(pVMMDevRAM)->V.V1_03.u32GuestEventMask));
 
         /* Move event flags to VMMDev RAM */
-        pThis->CTX_SUFF(pVMMDevRAM)->V.V1_03.u32HostEvents = fEvents;
+        pThisCC->CTX_SUFF(pVMMDevRAM)->V.V1_03.u32HostEvents = fEvents;
 
         uint32_t uIRQLevel = 0;
@@ -261 +264 @@
         /* Set IRQ level for pin 0 (see NoWait comment in vmmdevMaybeSetIRQ). */
         /** @todo make IRQ pin configurable, at least a symbolic constant */
-        PDMDevHlpPCISetIrqNoWait(pThis->CTX_SUFF(pDevIns), 0, uIRQLevel);
+        PDMDevHlpPCISetIrqNoWait(pDevIns, 0, uIRQLevel);
         Log(("vmmdevSetIRQ: IRQ set %d\n", uIRQLevel));
     }
@@ -272 +275 @@
  * Sets the IRQ if there are events to be delivered.
  *
- * @param   pThis       The VMMDev state.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @thread  Any.
  * @remarks Must be called owning the critical section.
  */
-static void vmmdevMaybeSetIRQ(PVMMDEV pThis)
+static void vmmdevMaybeSetIRQ(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC)
 {
     Log3(("vmmdevMaybeSetIRQ: fHostEventFlags=%#010x, fGuestFilterMask=%#010x.\n",
@@ -288 +293 @@
          *       which has already happened.
          */
-        pThis->pVMMDevRAMR3->V.V1_04.fHaveEvents = true;
-        PDMDevHlpPCISetIrqNoWait(pThis->pDevInsR3, 0, 1);
+        pThisCC->pVMMDevRAMR3->V.V1_04.fHaveEvents = true;
+        PDMDevHlpPCISetIrqNoWait(pDevIns, 0, 1);
         Log3(("vmmdevMaybeSetIRQ: IRQ set.\n"));
     }
@@ -297 +302 @@
  * Notifies the guest about new events (@a fAddEvents).
  *
- * @param   pThis           The VMMDev state.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   fAddEvents      New events to add.
  * @thread  Any.
  * @remarks Must be called owning the critical section.
  */
-static void vmmdevNotifyGuestWorker(PVMMDEV pThis, uint32_t fAddEvents)
+static void vmmdevNotifyGuestWorker(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, uint32_t fAddEvents)
 {
     Log3(("vmmdevNotifyGuestWorker: fAddEvents=%#010x.\n", fAddEvents));
@@ -321 +328 @@
 
             if (!fHadEvents)
-                vmmdevMaybeSetIRQ(pThis);
+                vmmdevMaybeSetIRQ(pDevIns, pThis, pThisCC);
         }
         else
@@ -334 +341 @@
 
         pThis->fHostEventFlags |= fAddEvents;
-        vmmdevSetIRQ_Legacy(pThis);
+        vmmdevSetIRQ_Legacy(pDevIns, pThis, pThisCC);
     }
 }
@@ -347 +354 @@
  * This is used by VMMDev.cpp as well as VMMDevHGCM.cpp.
  *
- * @param   pThis           The VMMDev state.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   fAddEvents      New events to add.
  * @thread  Any.
  */
-void VMMDevNotifyGuest(PVMMDEV pThis, uint32_t fAddEvents)
+void VMMDevNotifyGuest(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, uint32_t fAddEvents)
 {
     Log3(("VMMDevNotifyGuest: fAddEvents=%#010x\n", fAddEvents));
@@ -358 +367 @@
      * Only notify the VM when it's running.
      */
-    VMSTATE enmVMState = PDMDevHlpVMState(pThis->pDevInsR3);
+    VMSTATE enmVMState = PDMDevHlpVMState(pDevIns);
     if (   enmVMState == VMSTATE_RUNNING
         || enmVMState == VMSTATE_RUNNING_LS
@@ -370 +379 @@
        )
     {
-        PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
-        vmmdevNotifyGuestWorker(pThis, fAddEvents);
-        PDMCritSectLeave(&pThis->CritSect);
+        PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+        vmmdevNotifyGuestWorker(pDevIns, pThis, pThisCC, fAddEvents);
+        PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     }
     else
@@ -382 +391 @@
  * events the guest are interested in.
  *
- * @param   pThis           The VMMDev state.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   fOrMask         Events to add (VMMDEV_EVENT_XXX). Pass 0 for no
  *                          change.
@@ -392 +403 @@
  *          controlled by the guest.
  */
-void VMMDevCtlSetGuestFilterMask(PVMMDEV pThis, uint32_t fOrMask, uint32_t fNotMask)
-{
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+void VMMDevCtlSetGuestFilterMask(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, uint32_t fOrMask, uint32_t fNotMask)
+{
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     const bool fHadEvents = (pThis->fHostEventFlags & pThis->fGuestFilterMask) != 0;
@@ -412 +423 @@
         pThis->fGuestFilterMask |= fOrMask;
         pThis->fGuestFilterMask &= ~fNotMask;
-        vmmdevMaybeSetIRQ(pThis);
-    }
-
-    PDMCritSectLeave(&pThis->CritSect);
+        vmmdevMaybeSetIRQ(pDevIns, pThis, pThisCC);
+    }
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
 }
 
@@ -426 +437 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pRequestHeader  The header of the request to handle.
  */
-static int vmmdevReqHandler_ReportGuestInfo(PVMMDEV pThis, VMMDevRequestHeader *pRequestHeader)
+static int vmmdevReqHandler_ReportGuestInfo(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
+                                            VMMDevRequestHeader *pRequestHeader)
 {
     AssertMsgReturn(pRequestHeader->size == sizeof(VMMDevReportGuestInfo), ("%u\n", pRequestHeader->size), VERR_INVALID_PARAMETER);
@@ -444 +458 @@
         vmmdevLogGuestOsInfo(&pThis->guestInfo);
 
-        if (pThis->pDrv && pThis->pDrv->pfnUpdateGuestInfo)
-            pThis->pDrv->pfnUpdateGuestInfo(pThis->pDrv, &pThis->guestInfo);
+        if (pThisCC->pDrv && pThisCC->pDrv->pfnUpdateGuestInfo)
+            pThisCC->pDrv->pfnUpdateGuestInfo(pThisCC->pDrv, &pThis->guestInfo);
     }
 
@@ -452 +466 @@
 
     /* Clear our IRQ in case it was high for whatever reason. */
-    PDMDevHlpPCISetIrqNoWait(pThis->pDevInsR3, 0, 0);
+    PDMDevHlpPCISetIrqNoWait(pDevIns, 0, 0);
 
     return VINF_SUCCESS;
@@ -462 +476 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis    The VMMDev instance data.
- */
-static int vmmDevReqHandler_GuestHeartbeat(PVMMDEV pThis)
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ */
+static int vmmDevReqHandler_GuestHeartbeat(PPDMDEVINS pDevIns, PVMMDEV pThis)
 {
     int rc;
     if (pThis->fHeartbeatActive)
     {
-        uint64_t const nsNowTS = TMTimerGetNano(pThis->pFlatlinedTimer);
+        uint64_t const nsNowTS = PDMDevHlpTimerGetNano(pDevIns, pThis->hFlatlinedTimer);
         if (!pThis->fFlatlined)
         { /* likely */ }
@@ -480 +495 @@
 
         /* Postpone (or restart if we missed a beat) the timeout timer. */
-        rc = TMTimerSetNano(pThis->pFlatlinedTimer, pThis->cNsHeartbeatTimeout);
+        rc = PDMDevHlpTimerSetNano(pDevIns, pThis->hFlatlinedTimer, pThis->cNsHeartbeatTimeout);
     }
     else
@@ -495 +510 @@
 static DECLCALLBACK(void) vmmDevHeartbeatFlatlinedTimer(PPDMDEVINS pDevIns, PTMTIMER pTimer, void *pvUser)
 {
-    RT_NOREF1(pDevIns);
+    RT_NOREF(pDevIns);
     PVMMDEV pThis = (PVMMDEV)pvUser;
     if (pThis->fHeartbeatActive)
@@ -515 +530 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis     The VMMDev instance data.
+ * @param   pDevIns   The device instance.
+ * @param   pThis     The VMMDev shared instance data.
  * @param   pReqHdr   The header of the request to handle.
  */
-static int vmmDevReqHandler_HeartbeatConfigure(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmDevReqHandler_HeartbeatConfigure(PPDMDEVINS pDevIns, PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
 {
     AssertMsgReturn(pReqHdr->size == sizeof(VMMDevReqHeartbeat), ("%u\n", pReqHdr->size), VERR_INVALID_PARAMETER);
@@ -534 +550 @@
              * Activate the heartbeat monitor.
              */
-            pThis->nsLastHeartbeatTS = TMTimerGetNano(pThis->pFlatlinedTimer);
-            rc = TMTimerSetNano(pThis->pFlatlinedTimer, pThis->cNsHeartbeatTimeout);
+            pThis->nsLastHeartbeatTS = PDMDevHlpTimerGetNano(pDevIns, pThis->hFlatlinedTimer);
+            rc = PDMDevHlpTimerSetNano(pDevIns, pThis->hFlatlinedTimer, pThis->cNsHeartbeatTimeout);
             if (RT_SUCCESS(rc))
                 LogRel(("VMMDev: Heartbeat flatline timer set to trigger after %'RU64 ns\n", pThis->cNsHeartbeatTimeout));
@@ -546 +562 @@
              * Deactivate the heartbeat monitor.
              */
-            rc = TMTimerStop(pThis->pFlatlinedTimer);
+            rc = PDMDevHlpTimerStop(pDevIns, pThis->hFlatlinedTimer);
             LogRel(("VMMDev: Heartbeat checking timer has been stopped (rc=%Rrc)\n", rc));
         }
@@ -564 +580 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis     The VMMDev instance data.
+ * @param   pDevIns   The device instance.
  * @param   pReqHdr   The header of the request to handle.
  */
-static int vmmDevReqHandler_NtBugCheck(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmDevReqHandler_NtBugCheck(PPDMDEVINS pDevIns, VMMDevRequestHeader *pReqHdr)
 {
     if (pReqHdr->size == sizeof(VMMDevReqNtBugCheck))
     {
         VMMDevReqNtBugCheck const *pReq = (VMMDevReqNtBugCheck const *)pReqHdr;
-        DBGFR3ReportBugCheck(PDMDevHlpGetVM(pThis->pDevInsR3), PDMDevHlpGetVMCPU(pThis->pDevInsR3), DBGFEVENT_BSOD_VMMDEV,
+        DBGFR3ReportBugCheck(PDMDevHlpGetVM(pDevIns), PDMDevHlpGetVMCPU(pDevIns), DBGFEVENT_BSOD_VMMDEV,
                              pReq->uBugCheck, pReq->auParameters[0], pReq->auParameters[1],
                              pReq->auParameters[2], pReq->auParameters[3]);
@@ -579 +595 @@
     {
         LogRel(("VMMDev: NT BugCheck w/o data.\n"));
-        DBGFR3ReportBugCheck(PDMDevHlpGetVM(pThis->pDevInsR3), PDMDevHlpGetVMCPU(pThis->pDevInsR3), DBGFEVENT_BSOD_VMMDEV,
+        DBGFR3ReportBugCheck(PDMDevHlpGetVM(pDevIns), PDMDevHlpGetVMCPU(pDevIns), DBGFEVENT_BSOD_VMMDEV,
                              0, 0, 0, 0, 0);
     }
@@ -640 +656 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_ReportGuestInfo2(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_ReportGuestInfo2(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     AssertMsgReturn(pReqHdr->size == sizeof(VMMDevReportGuestInfo2), ("%u\n", pReqHdr->size), VERR_INVALID_PARAMETER);
@@ -729 +747 @@
     strcpy(pThis->guestInfo2.szName, pszName);
 
-    if (pThis->pDrv && pThis->pDrv->pfnUpdateGuestInfo2)
-        pThis->pDrv->pfnUpdateGuestInfo2(pThis->pDrv, uFullVersion, pszName, pInfo2->additionsRevision, pInfo2->additionsFeatures);
+    if (pThisCC->pDrv && pThisCC->pDrv->pfnUpdateGuestInfo2)
+        pThisCC->pDrv->pfnUpdateGuestInfo2(pThisCC->pDrv, uFullVersion, pszName, pInfo2->additionsRevision,
+                                           pInfo2->additionsFeatures);
 
     /* Clear our IRQ in case it was high for whatever reason. */
-    PDMDevHlpPCISetIrqNoWait(pThis->pDevInsR3, 0, 0);
+    PDMDevHlpPCISetIrqNoWait(pDevIns, 0, 0);
 
     return VINF_SUCCESS;
@@ -744 +763 @@
  * @returns Pointer to a facility status entry on success, NULL on failure
  *          (table full).
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   enmFacility     The facility type code.
  * @param   fFixed          This is set when allocating the standard entries
@@ -812 +831 @@
  * @returns Pointer to a facility status entry on success, NULL on failure
  *          (table full).
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   enmFacility     The facility type code.
  */
@@ -834 +853 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_ReportGuestStatus(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_ReportGuestStatus(PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     /*
@@ -881 +901 @@
     }
 
-    if (pThis->pDrv && pThis->pDrv->pfnUpdateGuestStatus)
-        pThis->pDrv->pfnUpdateGuestStatus(pThis->pDrv, pStatus->facility, pStatus->status, pStatus->flags, &Now);
+    if (pThisCC->pDrv && pThisCC->pDrv->pfnUpdateGuestStatus)
+        pThisCC->pDrv->pfnUpdateGuestStatus(pThisCC->pDrv, pStatus->facility, pStatus->status, pStatus->flags, &Now);
 
     return VINF_SUCCESS;
@@ -892 +912 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_ReportGuestUserState(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_ReportGuestUserState(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     /*
@@ -903 +923 @@
     AssertMsgReturn(pReq->header.size >= sizeof(*pReq), ("%u\n", pReqHdr->size), VERR_INVALID_PARAMETER);
 
-    if (   pThis->pDrv
-        && pThis->pDrv->pfnUpdateGuestUserState)
+    if (   pThisCC->pDrv
+        && pThisCC->pDrv->pfnUpdateGuestUserState)
     {
         /* Play safe. */
@@ -950 +970 @@
             pbDetails = pbDynamic;
 
-        pThis->pDrv->pfnUpdateGuestUserState(pThis->pDrv, pszUser, pszDomain, (uint32_t)pReq->status.state,
-                                             pbDetails, pReq->status.cbDetails);
+        pThisCC->pDrv->pfnUpdateGuestUserState(pThisCC->pDrv, pszUser, pszDomain, (uint32_t)pReq->status.state,
+                                               pbDetails, pReq->status.cbDetails);
     }
 
@@ -962 +982 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_ReportGuestCapabilities(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_ReportGuestCapabilities(PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqGuestCapabilities *pReq = (VMMDevReqGuestCapabilities *)pReqHdr;
@@ -985 +1006 @@
                 fu32Caps & VMMDEV_GUEST_SUPPORTS_GUEST_HOST_WINDOW_MAPPING ? "yes" : "no"));
 
-        if (pThis->pDrv && pThis->pDrv->pfnUpdateGuestCapabilities)
-            pThis->pDrv->pfnUpdateGuestCapabilities(pThis->pDrv, fu32Caps);
+        if (pThisCC->pDrv && pThisCC->pDrv->pfnUpdateGuestCapabilities)
+            pThisCC->pDrv->pfnUpdateGuestCapabilities(pThisCC->pDrv, fu32Caps);
     }
     return VINF_SUCCESS;
@@ -996 +1017 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_SetGuestCapabilities(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_SetGuestCapabilities(PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqGuestCapabilities2 *pReq = (VMMDevReqGuestCapabilities2 *)pReqHdr;
@@ -1016 +1038 @@
     pThis->fGuestCaps = fu32Caps;
 
-    if (pThis->pDrv && pThis->pDrv->pfnUpdateGuestCapabilities)
-        pThis->pDrv->pfnUpdateGuestCapabilities(pThis->pDrv, fu32Caps);
+    if (pThisCC->pDrv && pThisCC->pDrv->pfnUpdateGuestCapabilities)
+        pThisCC->pDrv->pfnUpdateGuestCapabilities(pThisCC->pDrv, fu32Caps);
 
     return VINF_SUCCESS;
@@ -1027 +1049 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
@@ -1049 +1071 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_SetMouseStatus(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_SetMouseStatus(PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqMouseStatus *pReq = (VMMDevReqMouseStatus *)pReqHdr;
@@ -1076 +1099 @@
     {
         LogRelFlow(("VMMDev: vmmdevReqHandler_SetMouseStatus: Notifying connector\n"));
-        pThis->pDrv->pfnUpdateMouseCapabilities(pThis->pDrv, pThis->fMouseCapabilities);
+        pThisCC->pDrv->pfnUpdateMouseCapabilities(pThisCC->pDrv, pThis->fMouseCapabilities);
     }
 
@@ -1100 +1123 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_SetPointerShape(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_SetPointerShape(PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqMousePointer *pReq = (VMMDevReqMousePointer *)pReqHdr;
@@ -1134 +1158 @@
             return rc;
 
-        pThis->pDrv->pfnUpdatePointerShape(pThis->pDrv,
-                                           fVisible,
-                                           fAlpha,
-                                           pReq->xHot, pReq->yHot,
-                                           pReq->width, pReq->height,
-                                           pReq->pointerData);
+        pThisCC->pDrv->pfnUpdatePointerShape(pThisCC->pDrv,
+                                             fVisible,
+                                             fAlpha,
+                                             pReq->xHot, pReq->yHot,
+                                             pReq->width, pReq->height,
+                                             pReq->pointerData);
     }
     else
     {
-        pThis->pDrv->pfnUpdatePointerShape(pThis->pDrv,
-                                           fVisible,
-                                           0,
-                                           0, 0,
-                                           0, 0,
-                                           NULL);
+        pThisCC->pDrv->pfnUpdatePointerShape(pThisCC->pDrv,
+                                             fVisible,
+                                             0,
+                                             0, 0,
+                                             0, 0,
+                                             NULL);
     }
 
@@ -1160 +1184 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_GetHostTime(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_GetHostTime(PPDMDEVINS pDevIns, PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqHostTime *pReq = (VMMDevReqHostTime *)pReqHdr;
@@ -1171 +1196 @@
     {
         RTTIMESPEC now;
-        pReq->time = RTTimeSpecGetMilli(PDMDevHlpTMUtcNow(pThis->pDevInsR3, &now));
+        pReq->time = RTTimeSpecGetMilli(PDMDevHlpTMUtcNow(pDevIns, &now));
         return VINF_SUCCESS;
     }
@@ -1182 +1207 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_GetHypervisorInfo(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_GetHypervisorInfo(PPDMDEVINS pDevIns, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqHypervisorInfo *pReq = (VMMDevReqHypervisorInfo *)pReqHdr;
     AssertMsgReturn(pReq->header.size == sizeof(*pReq), ("%u\n", pReq->header.size), VERR_INVALID_PARAMETER);
 
-    return PGMR3MappingsSize(PDMDevHlpGetVM(pThis->pDevInsR3), &pReq->hypervisorSize);
+    return PGMR3MappingsSize(PDMDevHlpGetVM(pDevIns), &pReq->hypervisorSize);
 }
 
@@ -1198 +1223 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_SetHypervisorInfo(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_SetHypervisorInfo(PPDMDEVINS pDevIns, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqHypervisorInfo *pReq = (VMMDevReqHypervisorInfo *)pReqHdr;
@@ -1207 +1233 @@
 
     int rc;
-    PVM pVM = PDMDevHlpGetVM(pThis->pDevInsR3);
+    PVM pVM = PDMDevHlpGetVM(pDevIns);
     if (pReq->hypervisorStart == 0)
         rc = PGMR3MappingsUnfix(pVM);
@@ -1233 +1259 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_RegisterPatchMemory(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_RegisterPatchMemory(PPDMDEVINS pDevIns, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqPatchMemory *pReq = (VMMDevReqPatchMemory *)pReqHdr;
     AssertMsgReturn(pReq->header.size == sizeof(*pReq), ("%u\n", pReq->header.size), VERR_INVALID_PARAMETER);
 
-    return VMMR3RegisterPatchMemory(PDMDevHlpGetVM(pThis->pDevInsR3), pReq->pPatchMem, pReq->cbPatchMem);
+    return VMMR3RegisterPatchMemory(PDMDevHlpGetVM(pDevIns), pReq->pPatchMem, pReq->cbPatchMem);
 }
 
@@ -1249 +1275 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_DeregisterPatchMemory(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_DeregisterPatchMemory(PPDMDEVINS pDevIns, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqPatchMemory *pReq = (VMMDevReqPatchMemory *)pReqHdr;
     AssertMsgReturn(pReq->header.size == sizeof(*pReq), ("%u\n", pReq->header.size), VERR_INVALID_PARAMETER);
 
-    return VMMR3DeregisterPatchMemory(PDMDevHlpGetVM(pThis->pDevInsR3), pReq->pPatchMem, pReq->cbPatchMem);
+    return VMMR3DeregisterPatchMemory(PDMDevHlpGetVM(pDevIns), pReq->pPatchMem, pReq->cbPatchMem);
 }
 
@@ -1265 +1291 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_SetPowerStatus(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_SetPowerStatus(PPDMDEVINS pDevIns, PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevPowerStateRequest *pReq = (VMMDevPowerStateRequest *)pReqHdr;
@@ -1278 +1305 @@
         {
             LogRel(("VMMDev: Guest requests the VM to be suspended (paused)\n"));
-            return PDMDevHlpVMSuspend(pThis->pDevInsR3);
+            return PDMDevHlpVMSuspend(pDevIns);
         }
 
@@ -1284 +1311 @@
         {
             LogRel(("VMMDev: Guest requests the VM to be turned off\n"));
-            return PDMDevHlpVMPowerOff(pThis->pDevInsR3);
+            return PDMDevHlpVMPowerOff(pDevIns);
         }
 
         case VMMDevPowerState_SaveState:
         {
-            if (true /*pThis->fAllowGuestToSaveState*/)
+            if (pThis->fAllowGuestToSaveState)
             {
                 LogRel(("VMMDev: Guest requests the VM to be saved and powered off\n"));
-                return PDMDevHlpVMSuspendSaveAndPowerOff(pThis->pDevInsR3);
+                return PDMDevHlpVMSuspendSaveAndPowerOff(pDevIns);
             }
             LogRel(("VMMDev: Guest requests the VM to be saved and powered off, declined\n"));
@@ -1309 +1336 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  * @remarks Deprecated.
@@ -1351 +1378 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_GetDisplayChangeRequest2(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_GetDisplayChangeRequest2(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
+                                                     VMMDevRequestHeader *pReqHdr)
 {
     VMMDevDisplayChangeRequest2 *pReq = (VMMDevDisplayChangeRequest2 *)pReqHdr;
@@ -1383 +1413 @@
             if (pThis->displayChangeData.aRequests[i].fPending)
             {
-                VMMDevNotifyGuest(pThis, VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST);
+                VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST);
                 Log3(("VMMDev: another pending at %u\n", i));
                 break;
@@ -1433 +1463 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_GetDisplayChangeRequestEx(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_GetDisplayChangeRequestEx(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
+                                                      VMMDevRequestHeader *pReqHdr)
 {
     VMMDevDisplayChangeRequestEx *pReq = (VMMDevDisplayChangeRequestEx *)pReqHdr;
@@ -1466 +1499 @@
             if (pThis->displayChangeData.aRequests[i].fPending)
             {
-                VMMDevNotifyGuest(pThis, VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST);
+                VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST);
                 Log3(("VMMDev: another pending at %d\n",
                       i));
@@ -1522 +1555 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
@@ -1595 +1628 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_VideoModeSupported(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_VideoModeSupported(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevVideoModeSupportedRequest *pReq = (VMMDevVideoModeSupportedRequest *)pReqHdr;
@@ -1604 +1637 @@
 
     /* forward the call */
-    return pThis->pDrv->pfnVideoModeSupported(pThis->pDrv,
-                                              0, /* primary screen. */
-                                              pReq->width,
-                                              pReq->height,
-                                              pReq->bpp,
-                                              &pReq->fSupported);
+    return pThisCC->pDrv->pfnVideoModeSupported(pThisCC->pDrv,
+                                                0, /* primary screen. */
+                                                pReq->width,
+                                                pReq->height,
+                                                pReq->bpp,
+                                                &pReq->fSupported);
 }
 
@@ -1619 +1652 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_VideoModeSupported2(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_VideoModeSupported2(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevVideoModeSupportedRequest2 *pReq = (VMMDevVideoModeSupportedRequest2 *)pReqHdr;
@@ -1628 +1661 @@
 
     /* forward the call */
-    return pThis->pDrv->pfnVideoModeSupported(pThis->pDrv,
-                                              pReq->display,
-                                              pReq->width,
-                                              pReq->height,
-                                              pReq->bpp,
-                                              &pReq->fSupported);
+    return pThisCC->pDrv->pfnVideoModeSupported(pThisCC->pDrv,
+                                                pReq->display,
+                                                pReq->width,
+                                                pReq->height,
+                                                pReq->bpp,
+                                                &pReq->fSupported);
 }
 
@@ -1642 +1675 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_GetHeightReduction(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_GetHeightReduction(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevGetHeightReductionRequest *pReq = (VMMDevGetHeightReductionRequest *)pReqHdr;
@@ -1651 +1684 @@
 
     /* forward the call */
-    return pThis->pDrv->pfnGetHeightReduction(pThis->pDrv, &pReq->heightReduction);
+    return pThisCC->pDrv->pfnGetHeightReduction(pThisCC->pDrv, &pReq->heightReduction);
 }
 
@@ -1659 +1692 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_AcknowledgeEvents(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_AcknowledgeEvents(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevEvents *pReq = (VMMDevEvents *)pReqHdr;
@@ -1682 +1717 @@
 
         pThis->fHostEventFlags &= ~pThis->fGuestFilterMask;
-        pThis->CTX_SUFF(pVMMDevRAM)->V.V1_04.fHaveEvents = false;
-
-        PDMDevHlpPCISetIrqNoWait(pThis->CTX_SUFF(pDevIns), 0, 0);
+        pThisCC->CTX_SUFF(pVMMDevRAM)->V.V1_04.fHaveEvents = false;
+
+        PDMDevHlpPCISetIrqNoWait(pDevIns, 0, 0);
     }
     else
-        vmmdevSetIRQ_Legacy(pThis);
+        vmmdevSetIRQ_Legacy(pDevIns, pThis, pThisCC);
     return VINF_SUCCESS;
 }
@@ -1696 +1731 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_CtlGuestFilterMask(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_CtlGuestFilterMask(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevCtlGuestFilterMask *pReq = (VMMDevCtlGuestFilterMask *)pReqHdr;
@@ -1709 +1746 @@
      * automatically when any HGCM command is issued.  The guest
      * cannot disable these notifications. */
-    VMMDevCtlSetGuestFilterMask(pThis, pReq->u32OrMask, pReq->u32NotMask & ~VMMDEV_EVENT_HGCM);
+    VMMDevCtlSetGuestFilterMask(pDevIns, pThis, pThisCC, pReq->u32OrMask, pReq->u32NotMask & ~VMMDEV_EVENT_HGCM);
     return VINF_SUCCESS;
 }
@@ -1719 +1756 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  * @param   GCPhysReqHdr    The guest physical address of the request header.
  */
-static int vmmdevReqHandler_HGCMConnect(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr, RTGCPHYS GCPhysReqHdr)
+static int vmmdevReqHandler_HGCMConnect(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
+                                        VMMDevRequestHeader *pReqHdr, RTGCPHYS GCPhysReqHdr)
 {
     VMMDevHGCMConnect *pReq = (VMMDevHGCMConnect *)pReqHdr;
     AssertMsgReturn(pReq->header.header.size >= sizeof(*pReq), ("%u\n", pReq->header.header.size), VERR_INVALID_PARAMETER); /** @todo Not sure why this is >= ... */
 
-    if (pThis->pHGCMDrv)
+    if (pThisCC->pHGCMDrv)
     {
         Log(("VMMDevReq_HGCMConnect\n"));
-        return vmmdevHGCMConnect(pThis, pReq, GCPhysReqHdr);
+        return vmmdevR3HgcmConnect(pDevIns, pThis, pThisCC, pReq, GCPhysReqHdr);
     }
 
@@ -1743 +1783 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  * @param   GCPhysReqHdr    The guest physical address of the request header.
  */
-static int vmmdevReqHandler_HGCMDisconnect(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr, RTGCPHYS GCPhysReqHdr)
+static int vmmdevReqHandler_HGCMDisconnect(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
+                                           VMMDevRequestHeader *pReqHdr, RTGCPHYS GCPhysReqHdr)
 {
     VMMDevHGCMDisconnect *pReq = (VMMDevHGCMDisconnect *)pReqHdr;
     AssertMsgReturn(pReq->header.header.size >= sizeof(*pReq), ("%u\n", pReq->header.header.size), VERR_INVALID_PARAMETER);  /** @todo Not sure why this >= ... */
 
-    if (pThis->pHGCMDrv)
+    if (pThisCC->pHGCMDrv)
     {
         Log(("VMMDevReq_VMMDevHGCMDisconnect\n"));
-        return vmmdevHGCMDisconnect(pThis, pReq, GCPhysReqHdr);
+        return vmmdevR3HgcmDisconnect(pDevIns, pThis, pThisCC, pReq, GCPhysReqHdr);
     }
 
@@ -1767 +1810 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  * @param   GCPhysReqHdr    The guest physical address of the request header.
@@ -1774 +1819 @@
  *                          NULL).  Set to NULL if HGCM takes lock ownership.
  */
-static int vmmdevReqHandler_HGCMCall(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr, RTGCPHYS GCPhysReqHdr,
-                                     uint64_t tsArrival, PVMMDEVREQLOCK *ppLock)
+static int vmmdevReqHandler_HGCMCall(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr,
+                                     RTGCPHYS GCPhysReqHdr, uint64_t tsArrival, PVMMDEVREQLOCK *ppLock)
 {
     VMMDevHGCMCall *pReq = (VMMDevHGCMCall *)pReqHdr;
     AssertMsgReturn(pReq->header.header.size >= sizeof(*pReq), ("%u\n", pReq->header.header.size), VERR_INVALID_PARAMETER);
 
-    if (pThis->pHGCMDrv)
+    if (pThisCC->pHGCMDrv)
     {
         Log2(("VMMDevReq_HGCMCall: sizeof(VMMDevHGCMRequest) = %04X\n", sizeof(VMMDevHGCMCall)));
         Log2(("%.*Rhxd\n", pReq->header.header.size, pReq));
 
-        return vmmdevHGCMCall(pThis, pReq, pReq->header.header.size, GCPhysReqHdr, pReq->header.header.requestType,
-                              tsArrival, ppLock);
+        return vmmdevR3HgcmCall(pDevIns, pThis, pThisCC, pReq, pReq->header.header.size, GCPhysReqHdr,
+                                pReq->header.header.requestType, tsArrival, ppLock);
     }
 
@@ -1797 +1842 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  * @param   GCPhysReqHdr    The guest physical address of the request header.
  */
-static int vmmdevReqHandler_HGCMCancel(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr, RTGCPHYS GCPhysReqHdr)
+static int vmmdevReqHandler_HGCMCancel(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr, RTGCPHYS GCPhysReqHdr)
 {
     VMMDevHGCMCancel *pReq = (VMMDevHGCMCancel *)pReqHdr;
     AssertMsgReturn(pReq->header.header.size >= sizeof(*pReq), ("%u\n", pReq->header.header.size), VERR_INVALID_PARAMETER);  /** @todo Not sure why this >= ... */
 
-    if (pThis->pHGCMDrv)
+    if (pThisCC->pHGCMDrv)
     {
         Log(("VMMDevReq_VMMDevHGCMCancel\n"));
-        return vmmdevHGCMCancel(pThis, pReq, GCPhysReqHdr);
+        return vmmdevR3HgcmCancel(pThisCC, pReq, GCPhysReqHdr);
     }
 
@@ -1821 +1866 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_HGCMCancel2(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_HGCMCancel2(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevHGCMCancel2 *pReq = (VMMDevHGCMCancel2 *)pReqHdr;
     AssertMsgReturn(pReq->header.size >= sizeof(*pReq), ("%u\n", pReq->header.size), VERR_INVALID_PARAMETER);  /** @todo Not sure why this >= ... */
 
-    if (pThis->pHGCMDrv)
+    if (pThisCC->pHGCMDrv)
     {
         Log(("VMMDevReq_HGCMCancel2\n"));
-        return vmmdevHGCMCancel2(pThis, pReq->physReqToCancel);
+        return vmmdevR3HgcmCancel2(pThisCC, pReq->physReqToCancel);
     }
 
@@ -1846 +1891 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_VideoAccelEnable(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_VideoAccelEnable(PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevVideoAccelEnable *pReq = (VMMDevVideoAccelEnable *)pReqHdr;
     AssertMsgReturn(pReq->header.size >= sizeof(*pReq), ("%u\n", pReq->header.size), VERR_INVALID_PARAMETER);  /** @todo Not sure why this >= ... */
 
-    if (!pThis->pDrv)
+    if (!pThisCC->pDrv)
     {
         Log(("VMMDevReq_VideoAccelEnable Connector is NULL!!\n"));
@@ -1873 +1919 @@
 
     int rc = pReq->u32Enable
-           ? pThis->pDrv->pfnVideoAccelEnable(pThis->pDrv, true, &pThis->pVMMDevRAMR3->vbvaMemory)
-           : pThis->pDrv->pfnVideoAccelEnable(pThis->pDrv, false, NULL);
+           ? pThisCC->pDrv->pfnVideoAccelEnable(pThisCC->pDrv, true, &pThisCC->pVMMDevRAMR3->vbvaMemory)
+           : pThisCC->pDrv->pfnVideoAccelEnable(pThisCC->pDrv, false, NULL);
 
     if (   pReq->u32Enable
@@ -1899 +1945 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_VideoAccelFlush(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_VideoAccelFlush(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevVideoAccelFlush *pReq = (VMMDevVideoAccelFlush *)pReqHdr;
     AssertMsgReturn(pReq->header.size >= sizeof(*pReq), ("%u\n", pReq->header.size), VERR_INVALID_PARAMETER);  /** @todo Not sure why this >= ... */
 
-    if (!pThis->pDrv)
+    if (!pThisCC->pDrv)
     {
         Log(("VMMDevReq_VideoAccelFlush: Connector is NULL!!!\n"));
@@ -1913 +1959 @@
     }
 
-    pThis->pDrv->pfnVideoAccelFlush(pThis->pDrv);
+    pThisCC->pDrv->pfnVideoAccelFlush(pThisCC->pDrv);
     return VINF_SUCCESS;
 }
@@ -1922 +1968 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_VideoSetVisibleRegion(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_VideoSetVisibleRegion(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevVideoSetVisibleRegion *pReq = (VMMDevVideoSetVisibleRegion *)pReqHdr;
     AssertMsgReturn(pReq->header.size + sizeof(RTRECT) >= sizeof(*pReq), ("%u\n", pReq->header.size), VERR_INVALID_PARAMETER);
 
-    if (!pThis->pDrv)
+    if (!pThisCC->pDrv)
     {
         Log(("VMMDevReq_VideoSetVisibleRegion: Connector is NULL!!!\n"));
@@ -1946 +1992 @@
     Log(("VMMDevReq_VideoSetVisibleRegion %d rectangles\n", pReq->cRect));
     /* forward the call */
-    return pThis->pDrv->pfnSetVisibleRegion(pThis->pDrv, pReq->cRect, &pReq->Rect);
+    return pThisCC->pDrv->pfnSetVisibleRegion(pThisCC->pDrv, pReq->cRect, &pReq->Rect);
 }
 
@@ -1954 +2000 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
@@ -1983 +2029 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
@@ -2005 +2051 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
@@ -2032 +2078 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_ChangeMemBalloon(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_ChangeMemBalloon(PPDMDEVINS pDevIns, PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevChangeMemBalloon *pReq = (VMMDevChangeMemBalloon *)pReqHdr;
@@ -2044 +2091 @@
 
     Log(("VMMDevReq_ChangeMemBalloon\n"));
-    int rc = PGMR3PhysChangeMemBalloon(PDMDevHlpGetVM(pThis->pDevInsR3), !!pReq->fInflate, pReq->cPages, pReq->aPhysPage);
+    int rc = PGMR3PhysChangeMemBalloon(PDMDevHlpGetVM(pDevIns), !!pReq->fInflate, pReq->cPages, pReq->aPhysPage);
     if (pReq->fInflate)
         STAM_REL_U32_INC(&pThis->StatMemBalloonChunks);
@@ -2057 +2104 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
@@ -2084 +2131 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_ReportGuestStats(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_ReportGuestStats(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReportGuestStats *pReq = (VMMDevReportGuestStats *)pReqHdr;
@@ -2152 +2199 @@
 
     /* forward the call */
-    return pThis->pDrv->pfnReportStatistics(pThis->pDrv, &pReq->guestStats);
+    return pThisCC->pDrv->pfnReportStatistics(pThisCC->pDrv, &pReq->guestStats);
 }
 
@@ -2160 +2207 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_QueryCredentials(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_QueryCredentials(PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevCredentials *pReq = (VMMDevCredentials *)pReqHdr;
     AssertMsgReturn(pReq->header.size == sizeof(*pReq), ("%u\n", pReq->header.size), VERR_INVALID_PARAMETER);
+    VMMDEVCREDS *pCredentials = pThisCC->pCredentials;
+    AssertPtrReturn(pCredentials, VERR_NOT_SUPPORTED);
 
     /* let's start by nulling out the data */
-    memset(pReq->szUserName, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-    memset(pReq->szPassword, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-    memset(pReq->szDomain, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
+    RT_ZERO(pReq->szUserName);
+    RT_ZERO(pReq->szPassword);
+    RT_ZERO(pReq->szDomain);
 
     /* should we return whether we got credentials for a logon? */
     if (pReq->u32Flags & VMMDEV_CREDENTIALS_QUERYPRESENCE)
     {
-        if (   pThis->pCredentials->Logon.szUserName[0]
-            || pThis->pCredentials->Logon.szPassword[0]
-            || pThis->pCredentials->Logon.szDomain[0])
+        if (   pCredentials->Logon.szUserName[0]
+            || pCredentials->Logon.szPassword[0]
+            || pCredentials->Logon.szDomain[0])
             pReq->u32Flags |= VMMDEV_CREDENTIALS_PRESENT;
         else
@@ -2187 +2237 @@
     if (pReq->u32Flags & VMMDEV_CREDENTIALS_READ)
     {
-        if (pThis->pCredentials->Logon.szUserName[0])
-            strcpy(pReq->szUserName, pThis->pCredentials->Logon.szUserName);
-        if (pThis->pCredentials->Logon.szPassword[0])
-            strcpy(pReq->szPassword, pThis->pCredentials->Logon.szPassword);
-        if (pThis->pCredentials->Logon.szDomain[0])
-            strcpy(pReq->szDomain, pThis->pCredentials->Logon.szDomain);
-        if (!pThis->pCredentials->Logon.fAllowInteractiveLogon)
+        if (pCredentials->Logon.szUserName[0])
+            RTStrCopy(pReq->szUserName, sizeof(pReq->szUserName), pCredentials->Logon.szUserName);
+        if (pCredentials->Logon.szPassword[0])
+            RTStrCopy(pReq->szPassword, sizeof(pReq->szPassword), pCredentials->Logon.szPassword);
+        if (pCredentials->Logon.szDomain[0])
+            RTStrCopy(pReq->szDomain, sizeof(pReq->szDomain), pCredentials->Logon.szDomain);
+        if (!pCredentials->Logon.fAllowInteractiveLogon)
             pReq->u32Flags |= VMMDEV_CREDENTIALS_NOLOCALLOGON;
         else
@@ -2204 +2254 @@
         if (pReq->u32Flags & VMMDEV_CREDENTIALS_CLEAR)
         {
-            memset(pThis->pCredentials->Logon.szUserName, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-            memset(pThis->pCredentials->Logon.szPassword, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-            memset(pThis->pCredentials->Logon.szDomain, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
+            RT_ZERO(pCredentials->Logon.szUserName);
+            RT_ZERO(pCredentials->Logon.szPassword);
+            RT_ZERO(pCredentials->Logon.szDomain);
         }
     }
@@ -2213 +2263 @@
     if (pReq->u32Flags & VMMDEV_CREDENTIALS_READJUDGE)
     {
-        if (pThis->pCredentials->Judge.szUserName[0])
-            strcpy(pReq->szUserName, pThis->pCredentials->Judge.szUserName);
-        if (pThis->pCredentials->Judge.szPassword[0])
-            strcpy(pReq->szPassword, pThis->pCredentials->Judge.szPassword);
-        if (pThis->pCredentials->Judge.szDomain[0])
-            strcpy(pReq->szDomain, pThis->pCredentials->Judge.szDomain);
+        if (pCredentials->Judge.szUserName[0])
+            RTStrCopy(pReq->szUserName, sizeof(pReq->szUserName), pCredentials->Judge.szUserName);
+        if (pCredentials->Judge.szPassword[0])
+            RTStrCopy(pReq->szPassword, sizeof(pReq->szPassword), pCredentials->Judge.szPassword);
+        if (pCredentials->Judge.szDomain[0])
+            RTStrCopy(pReq->szDomain, sizeof(pReq->szDomain), pCredentials->Judge.szDomain);
     }
 
@@ -2224 +2274 @@
     if (pReq->u32Flags & VMMDEV_CREDENTIALS_CLEARJUDGE)
     {
-        memset(pThis->pCredentials->Judge.szUserName, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-        memset(pThis->pCredentials->Judge.szPassword, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-        memset(pThis->pCredentials->Judge.szDomain, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
+        RT_ZERO(pCredentials->Judge.szUserName);
+        RT_ZERO(pCredentials->Judge.szPassword);
+        RT_ZERO(pCredentials->Judge.szDomain);
     }
 
@@ -2237 +2287 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_ReportCredentialsJudgement(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_ReportCredentialsJudgement(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevCredentials *pReq = (VMMDevCredentials *)pReqHdr;
@@ -2247 +2297 @@
     /* what does the guest think about the credentials? (note: the order is important here!) */
     if (pReq->u32Flags & VMMDEV_CREDENTIALS_JUDGE_DENY)
-        pThis->pDrv->pfnSetCredentialsJudgementResult(pThis->pDrv, VMMDEV_CREDENTIALS_JUDGE_DENY);
+        pThisCC->pDrv->pfnSetCredentialsJudgementResult(pThisCC->pDrv, VMMDEV_CREDENTIALS_JUDGE_DENY);
     else if (pReq->u32Flags & VMMDEV_CREDENTIALS_JUDGE_NOJUDGEMENT)
-        pThis->pDrv->pfnSetCredentialsJudgementResult(pThis->pDrv, VMMDEV_CREDENTIALS_JUDGE_NOJUDGEMENT);
+        pThisCC->pDrv->pfnSetCredentialsJudgementResult(pThisCC->pDrv, VMMDEV_CREDENTIALS_JUDGE_NOJUDGEMENT);
     else if (pReq->u32Flags & VMMDEV_CREDENTIALS_JUDGE_OK)
-        pThis->pDrv->pfnSetCredentialsJudgementResult(pThis->pDrv, VMMDEV_CREDENTIALS_JUDGE_OK);
+        pThisCC->pDrv->pfnSetCredentialsJudgementResult(pThisCC->pDrv, VMMDEV_CREDENTIALS_JUDGE_OK);
     else
     {
@@ -2293 +2343 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
@@ -2318 +2368 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
@@ -2363 +2413 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
@@ -2382 +2432 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_RegisterSharedModule(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_RegisterSharedModule(PPDMDEVINS pDevIns, VMMDevRequestHeader *pReqHdr)
 {
     /*
@@ -2406 +2456 @@
      * Forward the request to the VMM.
      */
-    return PGMR3SharedModuleRegister(PDMDevHlpGetVM(pThis->pDevInsR3), pReq->enmGuestOS, pReq->szName, pReq->szVersion,
+    return PGMR3SharedModuleRegister(PDMDevHlpGetVM(pDevIns), pReq->enmGuestOS, pReq->szName, pReq->szVersion,
                                      pReq->GCBaseAddr, pReq->cbModule, pReq->cRegions, pReq->aRegions);
 }
@@ -2414 +2464 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_UnregisterSharedModule(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_UnregisterSharedModule(PPDMDEVINS pDevIns, VMMDevRequestHeader *pReqHdr)
 {
     /*
@@ -2436 +2486 @@
      * Forward the request to the VMM.
      */
-    return PGMR3SharedModuleUnregister(PDMDevHlpGetVM(pThis->pDevInsR3), pReq->szName, pReq->szVersion,
+    return PGMR3SharedModuleUnregister(PDMDevHlpGetVM(pDevIns), pReq->szName, pReq->szVersion,
                                        pReq->GCBaseAddr, pReq->cbModule);
 }
@@ -2444 +2494 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_CheckSharedModules(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_CheckSharedModules(PPDMDEVINS pDevIns, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevSharedModuleCheckRequest *pReq = (VMMDevSharedModuleCheckRequest *)pReqHdr;
     AssertMsgReturn(pReq->header.size == sizeof(VMMDevSharedModuleCheckRequest),
                     ("%u\n", pReq->header.size), VERR_INVALID_PARAMETER);
-    return PGMR3SharedModuleCheckAll(PDMDevHlpGetVM(pThis->pDevInsR3));
+    return PGMR3SharedModuleCheckAll(PDMDevHlpGetVM(pDevIns));
 }
 
@@ -2459 +2509 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_GetPageSharingStatus(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_GetPageSharingStatus(PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevPageSharingStatusRequest *pReq = (VMMDevPageSharingStatusRequest *)pReqHdr;
@@ -2469 +2519 @@
 
     pReq->fEnabled = false;
-    int rc = pThis->pDrv->pfnIsPageFusionEnabled(pThis->pDrv, &pReq->fEnabled);
+    int rc = pThisCC->pDrv->pfnIsPageFusionEnabled(pThisCC->pDrv, &pReq->fEnabled);
     if (RT_FAILURE(rc))
         pReq->fEnabled = false;
@@ -2480 +2530 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
  * @param   pReqHdr         The header of the request to handle.
  */
-static int vmmdevReqHandler_DebugIsPageShared(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_DebugIsPageShared(PPDMDEVINS pDevIns, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevPageIsSharedRequest *pReq = (VMMDevPageIsSharedRequest *)pReqHdr;
@@ -2490 +2540 @@
 
 # ifdef DEBUG
-    return PGMR3SharedModuleGetPageState(PDMDevHlpGetVM(pThis->pDevInsR3), pReq->GCPtrPage, &pReq->fShared, &pReq->uPageFlags);
+    return PGMR3SharedModuleGetPageState(PDMDevHlpGetVM(pDevIns), pReq->GCPtrPage, &pReq->fShared, &pReq->uPageFlags);
 # else
-    RT_NOREF1(pThis);
+    RT_NOREF(pThis);
     return VERR_NOT_IMPLEMENTED;
 # endif
@@ -2504 +2554 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
  * @param   pReqHdr         Pointer to the request header.
  */
-static int vmmdevReqHandler_WriteCoreDump(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
+static int vmmdevReqHandler_WriteCoreDump(PPDMDEVINS pDevIns, PVMMDEV pThis, VMMDevRequestHeader *pReqHdr)
 {
     VMMDevReqWriteCoreDump *pReq = (VMMDevReqWriteCoreDump *)pReqHdr;
@@ -2550 +2601 @@
      * Write the core file.
      */
-    PUVM pUVM = PDMDevHlpGetUVM(pThis->pDevInsR3);
+    PUVM pUVM = PDMDevHlpGetUVM(pDevIns);
     return DBGFR3CoreWrite(pUVM, szCorePath, true /*fReplaceFile*/);
 }
@@ -2558 +2609 @@
  * Sets request status to VINF_HGCM_ASYNC_EXECUTE.
  *
+ * @param   pDevIns         The device instance.
  * @param   pThis           The VMM device instance data.
  * @param   GCPhysReqHdr    The guest physical address of the request.
@@ -2563 +2615 @@
  *                          locked.
  */
-DECLINLINE(void) vmmdevReqHdrSetHgcmAsyncExecute(PVMMDEV pThis, RTGCPHYS GCPhysReqHdr, PVMMDEVREQLOCK pLock)
+DECLINLINE(void) vmmdevReqHdrSetHgcmAsyncExecute(PPDMDEVINS pDevIns, RTGCPHYS GCPhysReqHdr, PVMMDEVREQLOCK pLock)
 {
     if (pLock)
@@ -2570 +2622 @@
     {
         int32_t rcReq = VINF_HGCM_ASYNC_EXECUTE;
-        PDMDevHlpPhysWrite(pThis->pDevInsR3, GCPhysReqHdr + RT_UOFFSETOF(VMMDevRequestHeader, rc), &rcReq, sizeof(rcReq));
+        PDMDevHlpPhysWrite(pDevIns, GCPhysReqHdr + RT_UOFFSETOF(VMMDevRequestHeader, rc), &rcReq, sizeof(rcReq));
     }
 }
@@ -2585 +2637 @@
  *
  * @returns Port I/O handler exit code.
- * @param   pThis           The VMM device instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pReqHdr         The request header (cached in host memory).
  * @param   GCPhysReqHdr    The guest physical address of the request (for
@@ -2594 +2648 @@
  *                          NULL).  Set to NULL if HGCM takes lock ownership.
  */
-static int vmmdevReqDispatcher(PVMMDEV pThis, VMMDevRequestHeader *pReqHdr, RTGCPHYS GCPhysReqHdr,
-                               uint64_t tsArrival, uint32_t *pfPostOptimize, PVMMDEVREQLOCK *ppLock)
+static VBOXSTRICTRC vmmdevReqDispatcher(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, VMMDevRequestHeader *pReqHdr,
+                                        RTGCPHYS GCPhysReqHdr, uint64_t tsArrival, uint32_t *pfPostOptimize,
+                                        PVMMDEVREQLOCK *ppLock)
 {
     int rcRet = VINF_SUCCESS;
@@ -2603 +2658 @@
     {
         case VMMDevReq_ReportGuestInfo:
-            pReqHdr->rc = vmmdevReqHandler_ReportGuestInfo(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_ReportGuestInfo(pDevIns, pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_ReportGuestInfo2:
-            pReqHdr->rc = vmmdevReqHandler_ReportGuestInfo2(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_ReportGuestInfo2(pDevIns, pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_ReportGuestStatus:
-            pReqHdr->rc = vmmdevReqHandler_ReportGuestStatus(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_ReportGuestStatus(pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_ReportGuestUserState:
-            pReqHdr->rc = vmmdevReqHandler_ReportGuestUserState(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_ReportGuestUserState(pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_ReportGuestCapabilities:
-            pReqHdr->rc = vmmdevReqHandler_ReportGuestCapabilities(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_ReportGuestCapabilities(pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_SetGuestCapabilities:
-            pReqHdr->rc = vmmdevReqHandler_SetGuestCapabilities(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_SetGuestCapabilities(pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_WriteCoreDump:
-            pReqHdr->rc = vmmdevReqHandler_WriteCoreDump(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_WriteCoreDump(pDevIns, pThis, pReqHdr);
             break;
 
@@ -2635 +2690 @@
 
         case VMMDevReq_SetMouseStatus:
-            pReqHdr->rc = vmmdevReqHandler_SetMouseStatus(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_SetMouseStatus(pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_SetPointerShape:
-            pReqHdr->rc = vmmdevReqHandler_SetPointerShape(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_SetPointerShape(pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_GetHostTime:
-            pReqHdr->rc = vmmdevReqHandler_GetHostTime(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_GetHostTime(pDevIns, pThis, pReqHdr);
             break;
 
         case VMMDevReq_GetHypervisorInfo:
-            pReqHdr->rc = vmmdevReqHandler_GetHypervisorInfo(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_GetHypervisorInfo(pDevIns, pReqHdr);
             break;
 
         case VMMDevReq_SetHypervisorInfo:
-            pReqHdr->rc = vmmdevReqHandler_SetHypervisorInfo(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_SetHypervisorInfo(pDevIns, pReqHdr);
             break;
 
         case VMMDevReq_RegisterPatchMemory:
-            pReqHdr->rc = vmmdevReqHandler_RegisterPatchMemory(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_RegisterPatchMemory(pDevIns, pReqHdr);
             break;
 
         case VMMDevReq_DeregisterPatchMemory:
-            pReqHdr->rc = vmmdevReqHandler_DeregisterPatchMemory(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_DeregisterPatchMemory(pDevIns, pReqHdr);
             break;
 
         case VMMDevReq_SetPowerStatus:
         {
-            int rc = pReqHdr->rc = vmmdevReqHandler_SetPowerStatus(pThis, pReqHdr);
+            int rc = pReqHdr->rc = vmmdevReqHandler_SetPowerStatus(pDevIns, pThis, pReqHdr);
             if (rc != VINF_SUCCESS && RT_SUCCESS(rc))
                 rcRet = rc;
@@ -2675 +2730 @@
 
         case VMMDevReq_GetDisplayChangeRequest2:
-            pReqHdr->rc = vmmdevReqHandler_GetDisplayChangeRequest2(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_GetDisplayChangeRequest2(pDevIns, pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_GetDisplayChangeRequestEx:
-            pReqHdr->rc = vmmdevReqHandler_GetDisplayChangeRequestEx(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_GetDisplayChangeRequestEx(pDevIns, pThis, pThisCC, pReqHdr);
             break;
 
@@ -2687 +2742 @@
 
         case VMMDevReq_VideoModeSupported:
-            pReqHdr->rc = vmmdevReqHandler_VideoModeSupported(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_VideoModeSupported(pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_VideoModeSupported2:
-            pReqHdr->rc = vmmdevReqHandler_VideoModeSupported2(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_VideoModeSupported2(pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_GetHeightReduction:
-            pReqHdr->rc = vmmdevReqHandler_GetHeightReduction(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_GetHeightReduction(pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_AcknowledgeEvents:
-            pReqHdr->rc = vmmdevReqHandler_AcknowledgeEvents(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_AcknowledgeEvents(pDevIns, pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_CtlGuestFilterMask:
-            pReqHdr->rc = vmmdevReqHandler_CtlGuestFilterMask(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_CtlGuestFilterMask(pDevIns, pThis, pThisCC, pReqHdr);
             break;
 
 #ifdef VBOX_WITH_HGCM
         case VMMDevReq_HGCMConnect:
-            vmmdevReqHdrSetHgcmAsyncExecute(pThis, GCPhysReqHdr, *ppLock);
-            pReqHdr->rc = vmmdevReqHandler_HGCMConnect(pThis, pReqHdr, GCPhysReqHdr);
+            vmmdevReqHdrSetHgcmAsyncExecute(pDevIns, GCPhysReqHdr, *ppLock);
+            pReqHdr->rc = vmmdevReqHandler_HGCMConnect(pDevIns, pThis, pThisCC, pReqHdr, GCPhysReqHdr);
             Assert(pReqHdr->rc == VINF_HGCM_ASYNC_EXECUTE || RT_FAILURE_NP(pReqHdr->rc));
             if (RT_SUCCESS(pReqHdr->rc))
@@ -2716 +2771 @@
 
         case VMMDevReq_HGCMDisconnect:
-            vmmdevReqHdrSetHgcmAsyncExecute(pThis, GCPhysReqHdr, *ppLock);
-            pReqHdr->rc = vmmdevReqHandler_HGCMDisconnect(pThis, pReqHdr, GCPhysReqHdr);
+            vmmdevReqHdrSetHgcmAsyncExecute(pDevIns, GCPhysReqHdr, *ppLock);
+            pReqHdr->rc = vmmdevReqHandler_HGCMDisconnect(pDevIns, pThis, pThisCC, pReqHdr, GCPhysReqHdr);
             Assert(pReqHdr->rc == VINF_HGCM_ASYNC_EXECUTE || RT_FAILURE_NP(pReqHdr->rc));
             if (RT_SUCCESS(pReqHdr->rc))
@@ -2727 +2782 @@
 # endif
         case VMMDevReq_HGCMCall32:
-            vmmdevReqHdrSetHgcmAsyncExecute(pThis, GCPhysReqHdr, *ppLock);
-            pReqHdr->rc = vmmdevReqHandler_HGCMCall(pThis, pReqHdr, GCPhysReqHdr, tsArrival, ppLock);
+            vmmdevReqHdrSetHgcmAsyncExecute(pDevIns, GCPhysReqHdr, *ppLock);
+            pReqHdr->rc = vmmdevReqHandler_HGCMCall(pDevIns, pThis, pThisCC, pReqHdr, GCPhysReqHdr, tsArrival, ppLock);
             Assert(pReqHdr->rc == VINF_HGCM_ASYNC_EXECUTE || RT_FAILURE_NP(pReqHdr->rc));
             if (RT_SUCCESS(pReqHdr->rc))
@@ -2735 +2790 @@
 
         case VMMDevReq_HGCMCancel:
-            pReqHdr->rc = vmmdevReqHandler_HGCMCancel(pThis, pReqHdr, GCPhysReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_HGCMCancel(pThisCC, pReqHdr, GCPhysReqHdr);
             break;
 
         case VMMDevReq_HGCMCancel2:
-            pReqHdr->rc = vmmdevReqHandler_HGCMCancel2(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_HGCMCancel2(pThisCC, pReqHdr);
             break;
 #endif /* VBOX_WITH_HGCM */
 
         case VMMDevReq_VideoAccelEnable:
-            pReqHdr->rc = vmmdevReqHandler_VideoAccelEnable(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_VideoAccelEnable(pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_VideoAccelFlush:
-            pReqHdr->rc = vmmdevReqHandler_VideoAccelFlush(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_VideoAccelFlush(pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_VideoSetVisibleRegion:
-            pReqHdr->rc = vmmdevReqHandler_VideoSetVisibleRegion(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_VideoSetVisibleRegion(pThisCC, pReqHdr);
             break;
 
@@ -2768 +2823 @@
 
         case VMMDevReq_ChangeMemBalloon:
-            pReqHdr->rc = vmmdevReqHandler_ChangeMemBalloon(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_ChangeMemBalloon(pDevIns, pThis, pReqHdr);
             break;
 
@@ -2776 +2831 @@
 
         case VMMDevReq_ReportGuestStats:
-            pReqHdr->rc = vmmdevReqHandler_ReportGuestStats(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_ReportGuestStats(pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_QueryCredentials:
-            pReqHdr->rc = vmmdevReqHandler_QueryCredentials(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_QueryCredentials(pThis, pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_ReportCredentialsJudgement:
-            pReqHdr->rc = vmmdevReqHandler_ReportCredentialsJudgement(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_ReportCredentialsJudgement(pThisCC, pReqHdr);
             break;
 
@@ -2801 +2856 @@
 #ifdef VBOX_WITH_PAGE_SHARING
         case VMMDevReq_RegisterSharedModule:
-            pReqHdr->rc = vmmdevReqHandler_RegisterSharedModule(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_RegisterSharedModule(pDevIns, pReqHdr);
             break;
 
         case VMMDevReq_UnregisterSharedModule:
-            pReqHdr->rc = vmmdevReqHandler_UnregisterSharedModule(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_UnregisterSharedModule(pDevIns, pReqHdr);
             break;
 
         case VMMDevReq_CheckSharedModules:
-            pReqHdr->rc = vmmdevReqHandler_CheckSharedModules(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_CheckSharedModules(pDevIns, pReqHdr);
             break;
 
         case VMMDevReq_GetPageSharingStatus:
-            pReqHdr->rc = vmmdevReqHandler_GetPageSharingStatus(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_GetPageSharingStatus(pThisCC, pReqHdr);
             break;
 
         case VMMDevReq_DebugIsPageShared:
-            pReqHdr->rc = vmmdevReqHandler_DebugIsPageShared(pThis, pReqHdr);
+            pReqHdr->rc = vmmdevReqHandler_DebugIsPageShared(pDevIns, pReqHdr);
             break;
 
@@ -2845 +2900 @@
 
         case VMMDevReq_GuestHeartbeat:
-            pReqHdr->rc = vmmDevReqHandler_GuestHeartbeat(pThis);
+            pReqHdr->rc = vmmDevReqHandler_GuestHeartbeat(pDevIns, pThis);
             break;
 
         case VMMDevReq_HeartbeatConfigure:
-            pReqHdr->rc = vmmDevReqHandler_HeartbeatConfigure(pThis, pReqHdr);
+            pReqHdr->rc = vmmDevReqHandler_HeartbeatConfigure(pDevIns, pThis, pReqHdr);
             break;
 
         case VMMDevReq_NtBugCheck:
-            pReqHdr->rc = vmmDevReqHandler_NtBugCheck(pThis, pReqHdr);
+            pReqHdr->rc = vmmDevReqHandler_NtBugCheck(pDevIns, pReqHdr);
             break;
 
@@ -2868 +2923 @@
 
 /**
- * @callback_method_impl{FNIOMIOPORTOUT,
+ * @callback_method_impl{FNIOMIOPORTNEWOUT,
  * Port I/O write andler for the generic request interface.}
  */
-static DECLCALLBACK(int) vmmdevRequestHandler(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb)
+static DECLCALLBACK(VBOXSTRICTRC)
+vmmdevRequestHandler(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
 {
     uint64_t tsArrival;
     STAM_GET_TS(tsArrival);
 
-    RT_NOREF2(Port, cb);
-    PVMMDEV pThis = (PVMMDEV)pvUser;
+    RT_NOREF(offPort, cb, pvUser);
 
     /*
@@ -2904 +2959 @@
     Log2(("VMMDev request issued: %d\n", requestHeader.requestType));
 
-    int rcRet = VINF_SUCCESS;
+    VBOXSTRICTRC rcRet = VINF_SUCCESS;
     /* Check that is doesn't exceed the max packet size. */
     if (requestHeader.size <= VMMDEV_MAX_VMMDEVREQ_SIZE)
     {
+        PVMMDEV   pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+        PVMMDEVCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+
         /*
          * We require the GAs to report it's information before we let it have
@@ -2933 +2991 @@
             VMMDevRequestHeader *pRequestHeader     = NULL;
             if (   requestHeader.size <= _4K
-                && iCpu < RT_ELEMENTS(pThis->apReqBufs))
+                && iCpu < RT_ELEMENTS(pThisCC->apReqBufs))
             {
-                pRequestHeader = pThis->apReqBufs[iCpu];
+                pRequestHeader = pThisCC->apReqBufs[iCpu];
                 if (pRequestHeader)
                 { /* likely */ }
                 else
-                    pThis->apReqBufs[iCpu] = pRequestHeader = (VMMDevRequestHeader *)RTMemPageAlloc(_4K);
+                    pThisCC->apReqBufs[iCpu] = pRequestHeader = (VMMDevRequestHeader *)RTMemPageAlloc(_4K);
             }
             else
             {
                 Assert(iCpu != NIL_VMCPUID);
-                STAM_REL_COUNTER_INC(&pThis->StatReqBufAllocs);
+                STAM_REL_COUNTER_INC(&pThisCC->StatReqBufAllocs);
                 pRequestHeaderFree = pRequestHeader = (VMMDevRequestHeader *)RTMemAlloc(RT_MAX(requestHeader.size, 512));
             }
@@ -2978 +3036 @@
                  */
                 uint32_t fPostOptimize = 0;
-                PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
-                rcRet = vmmdevReqDispatcher(pThis, pRequestHeader, u32, tsArrival, &fPostOptimize, &pLock);
-                PDMCritSectLeave(&pThis->CritSect);
+                PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
+                rcRet = vmmdevReqDispatcher(pDevIns, pThis, pThisCC, pRequestHeader, u32, tsArrival, &fPostOptimize, &pLock);
+                PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
 
                 /*
@@ -3031 +3089 @@
  * that can be handled w/o going to ring-3.}
  */
-PDMBOTHCBDECL(int) vmmdevFastRequestHandler(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb)
+static DECLCALLBACK(VBOXSTRICTRC)
+vmmdevFastRequestHandler(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
 {
 #ifndef IN_RING3
 # if 0 /* This functionality is offered through reading the port (vmmdevFastRequestIrqAck). Leaving it here for later. */
-    PVMMDEV pThis = (PVMMDEV)pvUser;
-    Assert(PDMINS_2_DATA(pDevIns, PVMMDEV) == pThis);
-    RT_NOREF2(Port, cb);
+    PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    RT_NOREF(pvUser, Port, cb);
 
     /*
@@ -3067 +3125 @@
                     && uReq.Hdr.size        == sizeof(uReq.Ack)
                     && cbToRead             == sizeof(uReq.Ack)
-                    && pThis->CTX_SUFF(pVMMDevRAM) != NULL)
+                    && pThisCC->CTX_SUFF(pVMMDevRAM) != NULL)
                )
             {
@@ -3075 +3133 @@
                  * Try grab the critical section.
                  */
-                int rc2 = PDMCritSectEnter(&pThis->CritSect, VINF_IOM_R3_IOPORT_WRITE);
+                int rc2 = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VINF_IOM_R3_IOPORT_WRITE);
                 if (rc2 == VINF_SUCCESS)
                 {
@@ -3084 +3142 @@
 
                     rcStrict = PDMDevHlpPhysWrite(pDevIns, u32, &uReq, uReq.Hdr.size);
-                    PDMCritSectLeave(&pThis->CritSect);
+                    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
                     if (rcStrict == VINF_SUCCESS)
                     { /* likely */ }
@@ -3100 +3158 @@
             {
                 Log(("vmmdevFastRequestHandler: size=%#x version=%#x requestType=%d (pVMMDevRAM=%p) -> R3\n",
-                     uReq.Hdr.size, uReq.Hdr.version, uReq.Hdr.requestType, pThis->CTX_SUFF(pVMMDevRAM) ));
+                     uReq.Hdr.size, uReq.Hdr.version, uReq.Hdr.requestType, pThisCC->CTX_SUFF(pVMMDevRAM) ));
                 rcStrict = VINF_IOM_R3_IOPORT_WRITE;
             }
@@ -3115 +3173 @@
     return VBOXSTRICTRC_VAL(rcStrict);
 # else
-    RT_NOREF(pDevIns, pvUser, Port, u32, cb);
+    RT_NOREF(pDevIns, pvUser, offPort, u32, cb);
     return VINF_IOM_R3_IOPORT_WRITE;
 # endif
 
 #else  /* IN_RING3 */
-    return vmmdevRequestHandler(pDevIns, pvUser, Port, u32, cb);
+    return vmmdevRequestHandler(pDevIns, pvUser, offPort, u32, cb);
 #endif /* IN_RING3 */
 }
@@ -3126 +3184 @@
 
 /**
- * @callback_method_impl{FNIOMIOPORTIN,
+ * @callback_method_impl{FNIOMIOPORTNEWIN,
  * Port I/O read handler for IRQ acknowledging and getting pending events (same
  * as VMMDevReq_AcknowledgeEvents - just faster).}
  */
-PDMBOTHCBDECL(int) vmmdevFastRequestIrqAck(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t *pu32, unsigned cb)
-{
-    PVMMDEV pThis = (PVMMDEV)pvUser;
-    Assert(PDMINS_2_DATA(pDevIns, PVMMDEV) == pThis);
-    RT_NOREF(Port);
+static DECLCALLBACK(VBOXSTRICTRC)
+vmmdevFastRequestIrqAck(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t *pu32, unsigned cb)
+{
+    PVMMDEV   pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEVCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+    Assert(PDMDEVINS_2_DATA(pDevIns, PVMMDEV) == pThis);
+    RT_NOREF(pvUser, offPort);
 
     /* Only 32-bit accesses. */
@@ -3142 +3202 @@
     VBOXSTRICTRC rcStrict;
 #ifndef IN_RING3
-    if (pThis->CTX_SUFF(pVMMDevRAM) != NULL)
+    if (pThisCC->CTX_SUFF(pVMMDevRAM) != NULL)
 #endif
     {
         /* Enter critical section and check that the additions has been properly
            initialized and that we're not in legacy v1.3 device mode. */
-        rcStrict = PDMCritSectEnter(&pThis->CritSect, VINF_IOM_R3_IOPORT_READ);
+        rcStrict = PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VINF_IOM_R3_IOPORT_READ);
         if (rcStrict == VINF_SUCCESS)
         {
@@ -3169 +3229 @@
 
                 pThis->fHostEventFlags &= ~pThis->fGuestFilterMask;
-                pThis->CTX_SUFF(pVMMDevRAM)->V.V1_04.fHaveEvents = false;
+                pThisCC->CTX_SUFF(pVMMDevRAM)->V.V1_04.fHaveEvents = false;
 
                 PDMDevHlpPCISetIrqNoWait(pDevIns, 0, 0);
@@ -3180 +3240 @@
             }
 
-            PDMCritSectLeave(&pThis->CritSect);
+            PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
         }
     }
@@ -3187 +3247 @@
         rcStrict = VINF_IOM_R3_IOPORT_READ;
 #endif
-    return VBOXSTRICTRC_VAL(rcStrict);
+    return rcStrict;
 }
 
@@ -3195 +3255 @@
 
 /* -=-=-=-=-=- PCI Device -=-=-=-=-=- */
-
-
-/**
- * @callback_method_impl{FNPCIIOREGIONMAP,MMIO/MMIO2 regions}
- */
-static DECLCALLBACK(int) vmmdevIORAMRegionMap(PPDMDEVINS pDevIns, PPDMPCIDEV pPciDev, uint32_t iRegion,
-                                              RTGCPHYS GCPhysAddress, RTGCPHYS cb, PCIADDRESSSPACE enmType)
-{
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
-    LogFlow(("vmmdevR3IORAMRegionMap: iRegion=%d GCPhysAddress=%RGp cb=%RGp enmType=%d\n", iRegion, GCPhysAddress, cb, enmType));
-    Assert(pPciDev == pDevIns->apPciDevs[0]);
-    RT_NOREF(cb, pPciDev);
-
-    int rc;
-
-    if (iRegion == 1)
-    {
-        AssertReturn(enmType == PCI_ADDRESS_SPACE_MEM, VERR_INTERNAL_ERROR);
-        Assert(pThis->pVMMDevRAMR3 != NULL);
-        if (GCPhysAddress != NIL_RTGCPHYS)
-        {
-            /*
-             * Map the MMIO2 memory.
-             */
-            pThis->GCPhysVMMDevRAM = GCPhysAddress;
-            Assert(pThis->GCPhysVMMDevRAM == GCPhysAddress);
-            rc = PDMDevHlpMMIOExMap(pDevIns, pPciDev, iRegion, GCPhysAddress);
-        }
-        else
-        {
-            /*
-             * It is about to be unmapped, just clean up.
-             */
-            pThis->GCPhysVMMDevRAM = NIL_RTGCPHYS32;
-            rc = VINF_SUCCESS;
-        }
-    }
-    else if (iRegion == 2)
-    {
-        AssertReturn(enmType == PCI_ADDRESS_SPACE_MEM_PREFETCH, VERR_INTERNAL_ERROR);
-        Assert(pThis->pVMMDevHeapR3 != NULL);
-        if (GCPhysAddress != NIL_RTGCPHYS)
-        {
-            /*
-             * Map the MMIO2 memory.
-             */
-            pThis->GCPhysVMMDevHeap = GCPhysAddress;
-            Assert(pThis->GCPhysVMMDevHeap == GCPhysAddress);
-            rc = PDMDevHlpMMIOExMap(pDevIns, pPciDev, iRegion, GCPhysAddress);
-            if (RT_SUCCESS(rc))
-                rc = PDMDevHlpRegisterVMMDevHeap(pDevIns, GCPhysAddress, pThis->pVMMDevHeapR3, VMMDEV_HEAP_SIZE);
-        }
-        else
-        {
-            /*
-             * It is about to be unmapped, just clean up.
-             */
-            PDMDevHlpRegisterVMMDevHeap(pDevIns, NIL_RTGCPHYS, pThis->pVMMDevHeapR3, VMMDEV_HEAP_SIZE);
-            pThis->GCPhysVMMDevHeap = NIL_RTGCPHYS32;
-            rc = VINF_SUCCESS;
-        }
-    }
-    else
-    {
-        AssertMsgFailed(("%d\n", iRegion));
-        rc = VERR_INVALID_PARAMETER;
-    }
-
-    return rc;
-}
-
 
 /**
@@ -3273 +3262 @@
                                                RTGCPHYS GCPhysAddress, RTGCPHYS cb, PCIADDRESSSPACE enmType)
 {
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
     LogFlow(("vmmdevIOPortRegionMap: iRegion=%d GCPhysAddress=%RGp cb=%RGp enmType=%d\n", iRegion, GCPhysAddress, cb, enmType));
     RT_NOREF(pPciDev, iRegion, cb, enmType);
@@ -3282 +3271 @@
     AssertMsg(RT_ALIGN(GCPhysAddress, 8) == GCPhysAddress, ("Expected 8 byte alignment. GCPhysAddress=%#x\n", GCPhysAddress));
 
-    /*
-     * Register our port IO handlers.
-     */
-    int rc = PDMDevHlpIOPortRegister(pDevIns, (RTIOPORT)GCPhysAddress + VMMDEV_PORT_OFF_REQUEST, 1,
-                                     pThis, vmmdevRequestHandler, NULL, NULL, NULL, "VMMDev Request Handler");
-    AssertLogRelRCReturn(rc, rc);
-
-    /* The fast one: */
-    rc = PDMDevHlpIOPortRegister(pDevIns, (RTIOPORT)GCPhysAddress + VMMDEV_PORT_OFF_REQUEST_FAST, 1,
-                                 pThis, vmmdevFastRequestHandler, vmmdevFastRequestIrqAck, NULL, NULL, "VMMDev Fast R0/RC Requests");
-    AssertLogRelRCReturn(rc, rc);
-    if (pThis->fRZEnabled)
-    {
-        rc = PDMDevHlpIOPortRegisterR0(pDevIns, (RTIOPORT)GCPhysAddress + VMMDEV_PORT_OFF_REQUEST_FAST, 1,
-                                       PDMINS_2_DATA_R0PTR(pDevIns), "vmmdevFastRequestHandler", "vmmdevFastRequestIrqAck",
-                                       NULL, NULL, "VMMDev Fast R0/RC Requests");
+
+    int rc;
+    if (GCPhysAddress != NIL_RTGCPHYS)
+    {
+        AssertMsg(RT_ALIGN(GCPhysAddress, 8) == GCPhysAddress, ("Expected 8 byte alignment. GCPhysAddress=%#x\n", GCPhysAddress));
+
+        rc = PDMDevHlpIoPortMap(pDevIns, pThis->hIoPortReq, (RTIOPORT)GCPhysAddress + VMMDEV_PORT_OFF_REQUEST);
         AssertLogRelRCReturn(rc, rc);
-        rc = PDMDevHlpIOPortRegisterRC(pDevIns, (RTIOPORT)GCPhysAddress + VMMDEV_PORT_OFF_REQUEST_FAST, 1,
-                                       PDMINS_2_DATA_RCPTR(pDevIns), "vmmdevFastRequestHandler", "vmmdevFastRequestIrqAck",
-                                       NULL, NULL, "VMMDev Fast R0/RC Requests");
+
+        rc = PDMDevHlpIoPortMap(pDevIns, pThis->hIoPortFast, (RTIOPORT)GCPhysAddress + VMMDEV_PORT_OFF_REQUEST_FAST);
         AssertLogRelRCReturn(rc, rc);
     }
-
+    else
+    {
+        rc = PDMDevHlpIoPortUnmap(pDevIns, pThis->hIoPortReq);
+        AssertLogRelRCReturn(rc, rc);
+
+        rc = PDMDevHlpIoPortUnmap(pDevIns, pThis->hIoPortFast);
+        AssertLogRelRCReturn(rc, rc);
+    }
     return rc;
 }
 
 
+/**
+ * @callback_method_impl{FNPCIIOREGIONMAP,VMMDev heap (MMIO2)}
+ */
+static DECLCALLBACK(int) vmmdevMmio2HeapRegionMap(PPDMDEVINS pDevIns, PPDMPCIDEV pPciDev, uint32_t iRegion,
+                                                  RTGCPHYS GCPhysAddress, RTGCPHYS cb, PCIADDRESSSPACE enmType)
+{
+    PVMMDEVCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+    LogFlow(("vmmdevR3IORAMRegionMap: iRegion=%d GCPhysAddress=%RGp cb=%RGp enmType=%d\n", iRegion, GCPhysAddress, cb, enmType));
+    RT_NOREF(cb, pPciDev);
+
+    Assert(pPciDev == pDevIns->apPciDevs[0]);
+    AssertReturn(iRegion == 2, VERR_INTERNAL_ERROR_2);
+    AssertReturn(enmType == PCI_ADDRESS_SPACE_MEM_PREFETCH, VERR_INTERNAL_ERROR_3);
+    Assert(pThisCC->pVMMDevHeapR3 != NULL);
+
+    int rc;
+    if (GCPhysAddress != NIL_RTGCPHYS)
+    {
+        rc = PDMDevHlpRegisterVMMDevHeap(pDevIns, GCPhysAddress, pThisCC->pVMMDevHeapR3, VMMDEV_HEAP_SIZE);
+        AssertRC(rc);
+    }
+    else
+    {
+        rc = PDMDevHlpRegisterVMMDevHeap(pDevIns, NIL_RTGCPHYS, pThisCC->pVMMDevHeapR3, VMMDEV_HEAP_SIZE);
+        AssertRCStmt(rc, rc = VINF_SUCCESS);
+    }
+
+    return rc;
+}
+
 
 /* -=-=-=-=-=- Backdoor Logging and Time Sync. -=-=-=-=-=- */
 
 /**
- * @callback_method_impl{FNIOMIOPORTOUT, Backdoor Logging.}
- */
-static DECLCALLBACK(int) vmmdevBackdoorLog(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb)
-{
-    RT_NOREF1(pvUser);
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
-
-    if (!pThis->fBackdoorLogDisabled && cb == 1 && Port == RTLOG_DEBUG_PORT)
+ * @callback_method_impl{FNIOMIOPORTNEWOUT, Backdoor Logging.}
+ */
+static DECLCALLBACK(VBOXSTRICTRC)
+vmmdevBackdoorLog(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
+{
+    PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    RT_NOREF(pvUser, offPort);
+    Assert(offPort == 0);
+
+    if (!pThis->fBackdoorLogDisabled && cb == 1)
     {
 
@@ -3361 +3379 @@
 
 /**
- * @callback_method_impl{FNIOMIOPORTOUT, Alternative time synchronization.}
- */
-static DECLCALLBACK(int) vmmdevAltTimeSyncWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t u32, unsigned cb)
-{
-    RT_NOREF2(pvUser, Port);
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+ * @callback_method_impl{FNIOMIOPORTNEWOUT, Alternative time synchronization.}
+ */
+static DECLCALLBACK(VBOXSTRICTRC)
+vmmdevAltTimeSyncWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
+{
+    RT_NOREF(pvUser, offPort);
+    PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
     if (cb == 4)
     {
@@ -3391 +3410 @@
  * @callback_method_impl{FNIOMIOPORTOUT, Alternative time synchronization.}
  */
-static DECLCALLBACK(int) vmmdevAltTimeSyncRead(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT Port, uint32_t *pu32, unsigned cb)
-{
-    RT_NOREF2(pvUser, Port);
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
-    int     rc;
+static DECLCALLBACK(VBOXSTRICTRC)
+vmmdevAltTimeSyncRead(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t *pu32, unsigned cb)
+{
+    RT_NOREF(pvUser, offPort);
+    PVMMDEV      pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    VBOXSTRICTRC rc;
     if (cb == 4)
     {
@@ -3427 +3447 @@
 static DECLCALLBACK(void *) vmmdevPortQueryInterface(PPDMIBASE pInterface, const char *pszIID)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IBase);
-
-    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThis->IBase);
-    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIVMMDEVPORT, &pThis->IPort);
+    PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IBase);
+
+    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIBASE, &pThisCC->IBase);
+    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIVMMDEVPORT, &pThisCC->IPort);
 #ifdef VBOX_WITH_HGCM
-    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIHGCMPORT, &pThis->IHGCMPort);
+    PDMIBASE_RETURN_INTERFACE(pszIID, PDMIHGCMPORT, &pThisCC->IHGCMPort);
 #endif
     /* Currently only for shared folders. */
-    PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThis->SharedFolders.ILeds);
+    PDMIBASE_RETURN_INTERFACE(pszIID, PDMILEDPORTS, &pThisCC->SharedFolders.ILeds);
     return NULL;
 }
@@ -3452 +3472 @@
 static DECLCALLBACK(int) vmmdevQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, SharedFolders.ILeds);
+    PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, SharedFolders.ILeds);
     if (iLUN == 0) /* LUN 0 is shared folders */
     {
-        *ppLed = &pThis->SharedFolders.Led;
+        *ppLed = &pThisCC->SharedFolders.Led;
         return VINF_SUCCESS;
     }
@@ -3469 +3489 @@
 static DECLCALLBACK(int) vmmdevIPort_QueryAbsoluteMouse(PPDMIVMMDEVPORT pInterface, int32_t *pxAbs, int32_t *pyAbs)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
+    PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PVMMDEV   pThis   = PDMDEVINS_2_DATA(pThisCC->pDevIns, PVMMDEV);
 
     /** @todo at the first sign of trouble in this area, just enter the critsect.
@@ -3488 +3509 @@
 static DECLCALLBACK(int) vmmdevIPort_SetAbsoluteMouse(PPDMIVMMDEVPORT pInterface, int32_t xAbs, int32_t yAbs)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PVMMDEVCC  pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS pDevIns = pThisCC->pDevIns;
+    PVMMDEV    pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     if (   pThis->xMouseAbs != xAbs
@@ -3497 +3520 @@
         pThis->xMouseAbs = xAbs;
         pThis->yMouseAbs = yAbs;
-        VMMDevNotifyGuest(pThis, VMMDEV_EVENT_MOUSE_POSITION_CHANGED);
-    }
-
-    PDMCritSectLeave(&pThis->CritSect);
+        VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_MOUSE_POSITION_CHANGED);
+    }
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return VINF_SUCCESS;
 }
@@ -3509 +3532 @@
 static DECLCALLBACK(int) vmmdevIPort_QueryMouseCapabilities(PPDMIVMMDEVPORT pInterface, uint32_t *pfCapabilities)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
+    PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PVMMDEV   pThis   = PDMDEVINS_2_DATA(pThisCC->pDevIns, PVMMDEV);
     AssertPtrReturn(pfCapabilities, VERR_INVALID_PARAMETER);
 
@@ -3522 +3546 @@
 vmmdevIPort_UpdateMouseCapabilities(PPDMIVMMDEVPORT pInterface, uint32_t fCapsAdded, uint32_t fCapsRemoved)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PVMMDEVCC  pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS pDevIns = pThisCC->pDevIns;
+    PVMMDEV    pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     uint32_t fOldCaps = pThis->fMouseCapabilities;
@@ -3535 +3561 @@
 
     if (fNotify)
-        VMMDevNotifyGuest(pThis, VMMDEV_EVENT_MOUSE_CAPABILITIES_CHANGED);
-
-    PDMCritSectLeave(&pThis->CritSect);
+        VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_MOUSE_CAPABILITIES_CHANGED);
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return VINF_SUCCESS;
 }
@@ -3577 +3603 @@
 vmmdevIPort_RequestDisplayChange(PPDMIVMMDEVPORT pInterface, uint32_t cDisplays, VMMDevDisplayDef const *paDisplays, bool fForce, bool fMayNotify)
 {
-    int rc = VINF_SUCCESS;
-
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
-    bool fNotifyGuest = false;
-
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PVMMDEVCC   pThisCC      = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS  pDevIns      = pThisCC->pDevIns;
+    PVMMDEV     pThis        = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    int         rc           = VINF_SUCCESS;
+    bool        fNotifyGuest = false;
+
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     uint32_t i;
@@ -3632 +3659 @@
 
             /* IRQ so the guest knows what's going on */
-            VMMDevNotifyGuest(pThis, VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST);
+            VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_DISPLAY_CHANGE_REQUEST);
         }
     }
 
-    PDMCritSectLeave(&pThis->CritSect);
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return rc;
 }
@@ -3645 +3672 @@
 static DECLCALLBACK(int) vmmdevIPort_RequestSeamlessChange(PPDMIVMMDEVPORT pInterface, bool fEnabled)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PVMMDEVCC  pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS pDevIns = pThisCC->pDevIns;
+    PVMMDEV    pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     /* Verify that the new resolution is different and that guest does not yet know about it. */
@@ -3659 +3688 @@
 
         /* IRQ so the guest knows what's going on */
-        VMMDevNotifyGuest(pThis, VMMDEV_EVENT_SEAMLESS_MODE_CHANGE_REQUEST);
-    }
-
-    PDMCritSectLeave(&pThis->CritSect);
+        VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_SEAMLESS_MODE_CHANGE_REQUEST);
+    }
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return VINF_SUCCESS;
 }
@@ -3671 +3700 @@
 static DECLCALLBACK(int) vmmdevIPort_SetMemoryBalloon(PPDMIVMMDEVPORT pInterface, uint32_t cMbBalloon)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PVMMDEVCC  pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS pDevIns = pThisCC->pDevIns;
+    PVMMDEV    pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     /* Verify that the new resolution is different and that guest does not yet know about it. */
@@ -3682 +3713 @@
 
         /* IRQ so the guest knows what's going on */
-        VMMDevNotifyGuest(pThis, VMMDEV_EVENT_BALLOON_CHANGE_REQUEST);
-    }
-
-    PDMCritSectLeave(&pThis->CritSect);
+        VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_BALLOON_CHANGE_REQUEST);
+    }
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return VINF_SUCCESS;
 }
@@ -3694 +3725 @@
 static DECLCALLBACK(int) vmmdevIPort_VRDPChange(PPDMIVMMDEVPORT pInterface, bool fVRDPEnabled, uint32_t uVRDPExperienceLevel)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PVMMDEVCC  pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS pDevIns = pThisCC->pDevIns;
+    PVMMDEV    pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     bool fSame = (pThis->fVRDPEnabled == fVRDPEnabled);
@@ -3706 +3739 @@
         pThis->uVRDPExperienceLevel = uVRDPExperienceLevel;
 
-        VMMDevNotifyGuest(pThis, VMMDEV_EVENT_VRDP);
-    }
-
-    PDMCritSectLeave(&pThis->CritSect);
+        VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_VRDP);
+    }
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return VINF_SUCCESS;
 }
@@ -3718 +3751 @@
 static DECLCALLBACK(int) vmmdevIPort_SetStatisticsInterval(PPDMIVMMDEVPORT pInterface, uint32_t cSecsStatInterval)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PVMMDEVCC  pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS pDevIns = pThisCC->pDevIns;
+    PVMMDEV    pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     /* Verify that the new resolution is different and that guest does not yet know about it. */
@@ -3732 +3767 @@
 
         /* IRQ so the guest knows what's going on */
-        VMMDevNotifyGuest(pThis, VMMDEV_EVENT_STATISTICS_INTERVAL_CHANGE_REQUEST);
-    }
-
-    PDMCritSectLeave(&pThis->CritSect);
+        VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_STATISTICS_INTERVAL_CHANGE_REQUEST);
+    }
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return VINF_SUCCESS;
 }
@@ -3745 +3780 @@
                                                     const char *pszPassword, const char *pszDomain, uint32_t fFlags)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
+    PVMMDEVCC  pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS pDevIns = pThisCC->pDevIns;
+    PVMMDEV    pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+
     AssertReturn(fFlags & (VMMDEV_SETCREDENTIALS_GUESTLOGON | VMMDEV_SETCREDENTIALS_JUDGE), VERR_INVALID_PARAMETER);
     size_t const cchUsername = strlen(pszUsername);
@@ -3754 +3792 @@
     AssertReturn(cchDomain < VMMDEV_CREDENTIALS_SZ_SIZE, VERR_BUFFER_OVERFLOW);
 
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    VMMDEVCREDS *pCredentials = pThisCC->pCredentials;
+    AssertPtrReturn(pCredentials, VERR_NOT_SUPPORTED);
+
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     /*
@@ -3762 +3803 @@
     {
         /* memorize the data */
-        memcpy(pThis->pCredentials->Logon.szUserName, pszUsername, cchUsername);
-        pThis->pCredentials->Logon.szUserName[cchUsername] = '\0';
-        memcpy(pThis->pCredentials->Logon.szPassword, pszPassword, cchPassword);
-        pThis->pCredentials->Logon.szPassword[cchPassword] = '\0';
-        memcpy(pThis->pCredentials->Logon.szDomain,   pszDomain, cchDomain);
-        pThis->pCredentials->Logon.szDomain[cchDomain]     = '\0';
-        pThis->pCredentials->Logon.fAllowInteractiveLogon = !(fFlags & VMMDEV_SETCREDENTIALS_NOLOCALLOGON);
+        memcpy(pCredentials->Logon.szUserName, pszUsername, cchUsername);
+        pThisCC->pCredentials->Logon.szUserName[cchUsername] = '\0';
+        memcpy(pCredentials->Logon.szPassword, pszPassword, cchPassword);
+        pCredentials->Logon.szPassword[cchPassword] = '\0';
+        memcpy(pCredentials->Logon.szDomain,   pszDomain, cchDomain);
+        pCredentials->Logon.szDomain[cchDomain]     = '\0';
+        pCredentials->Logon.fAllowInteractiveLogon = !(fFlags & VMMDEV_SETCREDENTIALS_NOLOCALLOGON);
     }
     /*
@@ -3776 +3817 @@
     {
         /* memorize the data */
-        memcpy(pThis->pCredentials->Judge.szUserName, pszUsername, cchUsername);
-        pThis->pCredentials->Judge.szUserName[cchUsername] = '\0';
-        memcpy(pThis->pCredentials->Judge.szPassword, pszPassword, cchPassword);
-        pThis->pCredentials->Judge.szPassword[cchPassword] = '\0';
-        memcpy(pThis->pCredentials->Judge.szDomain,   pszDomain,   cchDomain);
-        pThis->pCredentials->Judge.szDomain[cchDomain]     = '\0';
-
-        VMMDevNotifyGuest(pThis, VMMDEV_EVENT_JUDGE_CREDENTIALS);
-    }
-
-    PDMCritSectLeave(&pThis->CritSect);
+        memcpy(pCredentials->Judge.szUserName, pszUsername, cchUsername);
+        pCredentials->Judge.szUserName[cchUsername] = '\0';
+        memcpy(pCredentials->Judge.szPassword, pszPassword, cchPassword);
+        pCredentials->Judge.szPassword[cchPassword] = '\0';
+        memcpy(pCredentials->Judge.szDomain,   pszDomain,   cchDomain);
+        pCredentials->Judge.szDomain[cchDomain]     = '\0';
+
+        VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_JUDGE_CREDENTIALS);
+    }
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return VINF_SUCCESS;
 }
@@ -3798 +3839 @@
 static DECLCALLBACK(void) vmmdevIPort_VBVAChange(PPDMIVMMDEVPORT pInterface, bool fEnabled)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
+    PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PVMMDEV   pThis   = PDMDEVINS_2_DATA(pThisCC->pDevIns, PVMMDEV);
     Log(("vmmdevIPort_VBVAChange: fEnabled = %d\n", fEnabled));
 
@@ -3810 +3852 @@
 static DECLCALLBACK(int) vmmdevIPort_CpuHotUnplug(PPDMIVMMDEVPORT pInterface, uint32_t idCpuCore, uint32_t idCpuPackage)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
-    int     rc    = VINF_SUCCESS;
+    PVMMDEVCC   pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS  pDevIns = pThisCC->pDevIns;
+    PVMMDEV     pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    int         rc      = VINF_SUCCESS;
 
     Log(("vmmdevIPort_CpuHotUnplug: idCpuCore=%u idCpuPackage=%u\n", idCpuCore, idCpuPackage));
 
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     if (pThis->fCpuHotPlugEventsEnabled)
@@ -3822 +3866 @@
         pThis->idCpuCore          = idCpuCore;
         pThis->idCpuPackage       = idCpuPackage;
-        VMMDevNotifyGuest(pThis, VMMDEV_EVENT_CPU_HOTPLUG);
+        VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_CPU_HOTPLUG);
     }
     else
         rc = VERR_VMMDEV_CPU_HOTPLUG_NOT_MONITORED_BY_GUEST;
 
-    PDMCritSectLeave(&pThis->CritSect);
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return rc;
 }
@@ -3836 +3880 @@
 static DECLCALLBACK(int) vmmdevIPort_CpuHotPlug(PPDMIVMMDEVPORT pInterface, uint32_t idCpuCore, uint32_t idCpuPackage)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IPort);
-    int     rc    = VINF_SUCCESS;
+    PVMMDEVCC   pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IPort);
+    PPDMDEVINS  pDevIns = pThisCC->pDevIns;
+    PVMMDEV     pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    int         rc      = VINF_SUCCESS;
 
     Log(("vmmdevCpuPlug: idCpuCore=%u idCpuPackage=%u\n", idCpuCore, idCpuPackage));
 
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     if (pThis->fCpuHotPlugEventsEnabled)
@@ -3848 +3894 @@
         pThis->idCpuCore          = idCpuCore;
         pThis->idCpuPackage       = idCpuPackage;
-        VMMDevNotifyGuest(pThis, VMMDEV_EVENT_CPU_HOTPLUG);
+        VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_CPU_HOTPLUG);
     }
     else
         rc = VERR_VMMDEV_CPU_HOTPLUG_NOT_MONITORED_BY_GUEST;
 
-    PDMCritSectLeave(&pThis->CritSect);
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return rc;
 }
@@ -3865 +3911 @@
 static DECLCALLBACK(int) vmmdevLiveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uPass)
 {
-    RT_NOREF1(uPass);
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+    RT_NOREF(uPass);
+    PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
 
     SSMR3PutBool(pSSM, pThis->fGetHostTimeDisabled);
@@ -3882 +3928 @@
 static DECLCALLBACK(int) vmmdevSaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
 {
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PVMMDEV         pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEVCC       pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+    PCPDMDEVHLPR3   pHlp    = pDevIns->pHlpR3;
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     vmmdevLiveExec(pDevIns, pSSM, SSM_PASS_FINAL);
 
-    SSMR3PutU32(pSSM, 0 /*was pThis->hypervisorSize, which was always zero*/);
-    SSMR3PutU32(pSSM, pThis->fMouseCapabilities);
-    SSMR3PutS32(pSSM, pThis->xMouseAbs);
-    SSMR3PutS32(pSSM, pThis->yMouseAbs);
-
-    SSMR3PutBool(pSSM, pThis->fNewGuestFilterMaskValid);
-    SSMR3PutU32(pSSM, pThis->fNewGuestFilterMask);
-    SSMR3PutU32(pSSM, pThis->fGuestFilterMask);
-    SSMR3PutU32(pSSM, pThis->fHostEventFlags);
+    pHlp->pfnSSMPutU32(pSSM, 0 /*was pThis->hypervisorSize, which was always zero*/);
+    pHlp->pfnSSMPutU32(pSSM, pThis->fMouseCapabilities);
+    pHlp->pfnSSMPutS32(pSSM, pThis->xMouseAbs);
+    pHlp->pfnSSMPutS32(pSSM, pThis->yMouseAbs);
+
+    pHlp->pfnSSMPutBool(pSSM, pThis->fNewGuestFilterMaskValid);
+    pHlp->pfnSSMPutU32(pSSM, pThis->fNewGuestFilterMask);
+    pHlp->pfnSSMPutU32(pSSM, pThis->fGuestFilterMask);
+    pHlp->pfnSSMPutU32(pSSM, pThis->fHostEventFlags);
     /* The following is not strictly necessary as PGM restores MMIO2, keeping it for historical reasons. */
-    SSMR3PutMem(pSSM, &pThis->pVMMDevRAMR3->V, sizeof(pThis->pVMMDevRAMR3->V));
-
-    SSMR3PutMem(pSSM, &pThis->guestInfo, sizeof(pThis->guestInfo));
-    SSMR3PutU32(pSSM, pThis->fu32AdditionsOk);
-    SSMR3PutU32(pSSM, pThis->u32VideoAccelEnabled);
-    SSMR3PutBool(pSSM, pThis->displayChangeData.fGuestSentChangeEventAck);
-
-    SSMR3PutU32(pSSM, pThis->fGuestCaps);
+    pHlp->pfnSSMPutMem(pSSM, &pThisCC->pVMMDevRAMR3->V, sizeof(pThisCC->pVMMDevRAMR3->V));
+
+    pHlp->pfnSSMPutMem(pSSM, &pThis->guestInfo, sizeof(pThis->guestInfo));
+    pHlp->pfnSSMPutU32(pSSM, pThis->fu32AdditionsOk);
+    pHlp->pfnSSMPutU32(pSSM, pThis->u32VideoAccelEnabled);
+    pHlp->pfnSSMPutBool(pSSM, pThis->displayChangeData.fGuestSentChangeEventAck);
+
+    pHlp->pfnSSMPutU32(pSSM, pThis->fGuestCaps);
 
 #ifdef VBOX_WITH_HGCM
-    vmmdevHGCMSaveState(pThis, pSSM);
+    vmmdevR3HgcmSaveState(pThisCC, pSSM);
 #endif /* VBOX_WITH_HGCM */
 
-    SSMR3PutU32(pSSM, pThis->fHostCursorRequested);
-
-    SSMR3PutU32(pSSM, pThis->guestInfo2.uFullVersion);
-    SSMR3PutU32(pSSM, pThis->guestInfo2.uRevision);
-    SSMR3PutU32(pSSM, pThis->guestInfo2.fFeatures);
-    SSMR3PutStrZ(pSSM, pThis->guestInfo2.szName);
-    SSMR3PutU32(pSSM, pThis->cFacilityStatuses);
+    pHlp->pfnSSMPutU32(pSSM, pThis->fHostCursorRequested);
+
+    pHlp->pfnSSMPutU32(pSSM, pThis->guestInfo2.uFullVersion);
+    pHlp->pfnSSMPutU32(pSSM, pThis->guestInfo2.uRevision);
+    pHlp->pfnSSMPutU32(pSSM, pThis->guestInfo2.fFeatures);
+    pHlp->pfnSSMPutStrZ(pSSM, pThis->guestInfo2.szName);
+    pHlp->pfnSSMPutU32(pSSM, pThis->cFacilityStatuses);
     for (uint32_t i = 0; i < pThis->cFacilityStatuses; i++)
     {
-        SSMR3PutU32(pSSM, pThis->aFacilityStatuses[i].enmFacility);
-        SSMR3PutU32(pSSM, pThis->aFacilityStatuses[i].fFlags);
-        SSMR3PutU16(pSSM, (uint16_t)pThis->aFacilityStatuses[i].enmStatus);
-        SSMR3PutS64(pSSM, RTTimeSpecGetNano(&pThis->aFacilityStatuses[i].TimeSpecTS));
+        pHlp->pfnSSMPutU32(pSSM, pThis->aFacilityStatuses[i].enmFacility);
+        pHlp->pfnSSMPutU32(pSSM, pThis->aFacilityStatuses[i].fFlags);
+        pHlp->pfnSSMPutU16(pSSM, (uint16_t)pThis->aFacilityStatuses[i].enmStatus);
+        pHlp->pfnSSMPutS64(pSSM, RTTimeSpecGetNano(&pThis->aFacilityStatuses[i].TimeSpecTS));
     }
 
     /* Heartbeat: */
-    SSMR3PutBool(pSSM, pThis->fHeartbeatActive);
-    SSMR3PutBool(pSSM, pThis->fFlatlined);
-    SSMR3PutU64(pSSM, pThis->nsLastHeartbeatTS);
-    TMR3TimerSave(pThis->pFlatlinedTimer, pSSM);
-
-    PDMCritSectLeave(&pThis->CritSect);
+    pHlp->pfnSSMPutBool(pSSM, pThis->fHeartbeatActive);
+    pHlp->pfnSSMPutBool(pSSM, pThis->fFlatlined);
+    pHlp->pfnSSMPutU64(pSSM, pThis->nsLastHeartbeatTS);
+    PDMDevHlpTimerSave(pDevIns, pThis->hFlatlinedTimer, pSSM);
+
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
     return VINF_SUCCESS;
 }
@@ -3940 +3988 @@
 static DECLCALLBACK(int) vmmdevLoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSM, uint32_t uVersion, uint32_t uPass)
 {
-    /** @todo The code load code is assuming we're always loaded into a freshly
-     *        constructed VM. */
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
-    int     rc;
+    PVMMDEV         pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEVCC       pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+    PCPDMDEVHLPR3   pHlp    = pDevIns->pHlpR3;
+    int             rc;
 
     if (   uVersion > VMMDEV_SAVED_STATE_VERSION
@@ -3953 +4001 @@
     {
         bool f;
-        rc = SSMR3GetBool(pSSM, &f); AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetBool(pSSM, &f); AssertRCReturn(rc, rc);
         if (pThis->fGetHostTimeDisabled != f)
             LogRel(("VMMDev: Config mismatch - fGetHostTimeDisabled: config=%RTbool saved=%RTbool\n", pThis->fGetHostTimeDisabled, f));
 
-        rc = SSMR3GetBool(pSSM, &f); AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetBool(pSSM, &f); AssertRCReturn(rc, rc);
         if (pThis->fBackdoorLogDisabled != f)
             LogRel(("VMMDev: Config mismatch - fBackdoorLogDisabled: config=%RTbool saved=%RTbool\n", pThis->fBackdoorLogDisabled, f));
 
-        rc = SSMR3GetBool(pSSM, &f); AssertRCReturn(rc, rc);
+        rc = pHlp->pfnSSMGetBool(pSSM, &f); AssertRCReturn(rc, rc);
         if (pThis->fKeepCredentials != f)
-            return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("Config mismatch - fKeepCredentials: config=%RTbool saved=%RTbool"),
-                                     pThis->fKeepCredentials, f);
-        rc = SSMR3GetBool(pSSM, &f); AssertRCReturn(rc, rc);
+            return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS, N_("Config mismatch - fKeepCredentials: config=%RTbool saved=%RTbool"),
+                                           pThis->fKeepCredentials, f);
+        rc = pHlp->pfnSSMGetBool(pSSM, &f); AssertRCReturn(rc, rc);
         if (pThis->fHeapEnabled != f)
-            return SSMR3SetCfgError(pSSM, RT_SRC_POS, N_("Config mismatch - fHeapEnabled: config=%RTbool saved=%RTbool"),
-                                    pThis->fHeapEnabled, f);
+            return pHlp->pfnSSMSetCfgError(pSSM, RT_SRC_POS, N_("Config mismatch - fHeapEnabled: config=%RTbool saved=%RTbool"),
+                                           pThis->fHeapEnabled, f);
     }
 
@@ -3976 +4024 @@
     /* state */
     uint32_t uIgn;
-    SSMR3GetU32(pSSM, &uIgn);
-    SSMR3GetU32(pSSM, &pThis->fMouseCapabilities);
-    SSMR3GetS32(pSSM, &pThis->xMouseAbs);
-    SSMR3GetS32(pSSM, &pThis->yMouseAbs);
-
-    SSMR3GetBool(pSSM, &pThis->fNewGuestFilterMaskValid);
-    SSMR3GetU32(pSSM, &pThis->fNewGuestFilterMask);
-    SSMR3GetU32(pSSM, &pThis->fGuestFilterMask);
-    SSMR3GetU32(pSSM, &pThis->fHostEventFlags);
-
-    //SSMR3GetBool(pSSM, &pThis->pVMMDevRAMR3->fHaveEvents);
+    pHlp->pfnSSMGetU32(pSSM, &uIgn);
+    pHlp->pfnSSMGetU32(pSSM, &pThis->fMouseCapabilities);
+    pHlp->pfnSSMGetS32(pSSM, &pThis->xMouseAbs);
+    pHlp->pfnSSMGetS32(pSSM, &pThis->yMouseAbs);
+
+    pHlp->pfnSSMGetBool(pSSM, &pThis->fNewGuestFilterMaskValid);
+    pHlp->pfnSSMGetU32(pSSM, &pThis->fNewGuestFilterMask);
+    pHlp->pfnSSMGetU32(pSSM, &pThis->fGuestFilterMask);
+    pHlp->pfnSSMGetU32(pSSM, &pThis->fHostEventFlags);
+
+    //pHlp->pfnSSMGetBool(pSSM, &pThis->pVMMDevRAMR3->fHaveEvents);
     // here be dragons (probably)
-    SSMR3GetMem(pSSM, &pThis->pVMMDevRAMR3->V, sizeof (pThis->pVMMDevRAMR3->V));
-
-    SSMR3GetMem(pSSM, &pThis->guestInfo, sizeof (pThis->guestInfo));
-    SSMR3GetU32(pSSM, &pThis->fu32AdditionsOk);
-    SSMR3GetU32(pSSM, &pThis->u32VideoAccelEnabled);
+    pHlp->pfnSSMGetMem(pSSM, &pThisCC->pVMMDevRAMR3->V, sizeof(pThisCC->pVMMDevRAMR3->V));
+
+    pHlp->pfnSSMGetMem(pSSM, &pThis->guestInfo, sizeof(pThis->guestInfo));
+    pHlp->pfnSSMGetU32(pSSM, &pThis->fu32AdditionsOk);
+    pHlp->pfnSSMGetU32(pSSM, &pThis->u32VideoAccelEnabled);
     if (uVersion > 10)
-        SSMR3GetBool(pSSM, &pThis->displayChangeData.fGuestSentChangeEventAck);
-
-    rc = SSMR3GetU32(pSSM, &pThis->fGuestCaps);
+        pHlp->pfnSSMGetBool(pSSM, &pThis->displayChangeData.fGuestSentChangeEventAck);
+
+    rc = pHlp->pfnSSMGetU32(pSSM, &pThis->fGuestCaps);
 
     /* Attributes which were temporarily introduced in r30072 */
@@ -4002 +4050 @@
     {
         uint32_t temp;
-        SSMR3GetU32(pSSM, &temp);
-        rc = SSMR3GetU32(pSSM, &temp);
+        pHlp->pfnSSMGetU32(pSSM, &temp);
+        rc = pHlp->pfnSSMGetU32(pSSM, &temp);
     }
     AssertRCReturn(rc, rc);
 
 #ifdef VBOX_WITH_HGCM
-    rc = vmmdevHGCMLoadState(pThis, pSSM, uVersion);
+    rc = vmmdevR3HgcmLoadState(pDevIns, pThis, pThisCC, pSSM, uVersion);
     AssertRCReturn(rc, rc);
 #endif /* VBOX_WITH_HGCM */
 
     if (uVersion >= 10)
-        rc = SSMR3GetU32(pSSM, &pThis->fHostCursorRequested);
+        rc = pHlp->pfnSSMGetU32(pSSM, &pThis->fHostCursorRequested);
     AssertRCReturn(rc, rc);
 
     if (uVersion > VMMDEV_SAVED_STATE_VERSION_MISSING_GUEST_INFO_2)
     {
-        SSMR3GetU32(pSSM, &pThis->guestInfo2.uFullVersion);
-        SSMR3GetU32(pSSM, &pThis->guestInfo2.uRevision);
-        SSMR3GetU32(pSSM, &pThis->guestInfo2.fFeatures);
-        rc = SSMR3GetStrZ(pSSM, &pThis->guestInfo2.szName[0], sizeof(pThis->guestInfo2.szName));
+        pHlp->pfnSSMGetU32(pSSM, &pThis->guestInfo2.uFullVersion);
+        pHlp->pfnSSMGetU32(pSSM, &pThis->guestInfo2.uRevision);
+        pHlp->pfnSSMGetU32(pSSM, &pThis->guestInfo2.fFeatures);
+        rc = pHlp->pfnSSMGetStrZ(pSSM, &pThis->guestInfo2.szName[0], sizeof(pThis->guestInfo2.szName));
         AssertRCReturn(rc, rc);
     }
@@ -4028 +4076 @@
     {
         uint32_t cFacilityStatuses;
-        rc = SSMR3GetU32(pSSM, &cFacilityStatuses);
+        rc = pHlp->pfnSSMGetU32(pSSM, &cFacilityStatuses);
         AssertRCReturn(rc, rc);
 
@@ -4037 +4085 @@
             int64_t  iTimeStampNano;
 
-            SSMR3GetU32(pSSM, &uFacility);
-            SSMR3GetU32(pSSM, &fFlags);
-            SSMR3GetU16(pSSM, &uStatus);
-            rc = SSMR3GetS64(pSSM, &iTimeStampNano);
+            pHlp->pfnSSMGetU32(pSSM, &uFacility);
+            pHlp->pfnSSMGetU32(pSSM, &fFlags);
+            pHlp->pfnSSMGetU16(pSSM, &uStatus);
+            rc = pHlp->pfnSSMGetS64(pSSM, &iTimeStampNano);
             AssertRCReturn(rc, rc);
 
@@ -4058 +4106 @@
     if (uVersion >= VMMDEV_SAVED_STATE_VERSION_HEARTBEAT)
     {
-        SSMR3GetBool(pSSM, (bool *)&pThis->fHeartbeatActive);
-        SSMR3GetBool(pSSM, (bool *)&pThis->fFlatlined);
-        SSMR3GetU64(pSSM, (uint64_t *)&pThis->nsLastHeartbeatTS);
-        rc = TMR3TimerLoad(pThis->pFlatlinedTimer, pSSM);
+        pHlp->pfnSSMGetBool(pSSM, (bool *)&pThis->fHeartbeatActive);
+        pHlp->pfnSSMGetBool(pSSM, (bool *)&pThis->fFlatlined);
+        pHlp->pfnSSMGetU64(pSSM, (uint64_t *)&pThis->nsLastHeartbeatTS);
+        rc = PDMDevHlpTimerLoad(pDevIns, pThis->hFlatlinedTimer, pSSM);
         AssertRCReturn(rc, rc);
         if (pThis->fFlatlined)
             LogRel(("vmmdevLoadState: Guest has flatlined. Last heartbeat %'RU64 ns before state was saved.\n",
-                    TMTimerGetNano(pThis->pFlatlinedTimer) - pThis->nsLastHeartbeatTS));
+                    PDMDevHlpTimerGetNano(pDevIns, pThis->hFlatlinedTimer) - pThis->nsLastHeartbeatTS));
     }
 
@@ -4073 +4121 @@
      */
     Log(("vmmdevLoadState: capabilities changed (%x), informing connector\n", pThis->fMouseCapabilities));
-    if (pThis->pDrv)
-    {
-        pThis->pDrv->pfnUpdateMouseCapabilities(pThis->pDrv, pThis->fMouseCapabilities);
+    if (pThisCC->pDrv)
+    {
+        pThisCC->pDrv->pfnUpdateMouseCapabilities(pThisCC->pDrv, pThis->fMouseCapabilities);
         if (uVersion >= 10)
-            pThis->pDrv->pfnUpdatePointerShape(pThis->pDrv,
+            pThisCC->pDrv->pfnUpdatePointerShape(pThisCC->pDrv,
                                                /*fVisible=*/!!pThis->fHostCursorRequested,
                                                /*fAlpha=*/false,
@@ -4088 +4136 @@
     {
         vmmdevLogGuestOsInfo(&pThis->guestInfo);
-        if (pThis->pDrv)
+        if (pThisCC->pDrv)
         {
-            if (pThis->guestInfo2.uFullVersion && pThis->pDrv->pfnUpdateGuestInfo2)
-                pThis->pDrv->pfnUpdateGuestInfo2(pThis->pDrv, pThis->guestInfo2.uFullVersion, pThis->guestInfo2.szName,
+            if (pThis->guestInfo2.uFullVersion && pThisCC->pDrv->pfnUpdateGuestInfo2)
+                pThisCC->pDrv->pfnUpdateGuestInfo2(pThisCC->pDrv, pThis->guestInfo2.uFullVersion, pThis->guestInfo2.szName,
                                                  pThis->guestInfo2.uRevision, pThis->guestInfo2.fFeatures);
-            if (pThis->pDrv->pfnUpdateGuestInfo)
-                pThis->pDrv->pfnUpdateGuestInfo(pThis->pDrv, &pThis->guestInfo);
-
-            if (pThis->pDrv->pfnUpdateGuestStatus)
+            if (pThisCC->pDrv->pfnUpdateGuestInfo)
+                pThisCC->pDrv->pfnUpdateGuestInfo(pThisCC->pDrv, &pThis->guestInfo);
+
+            if (pThisCC->pDrv->pfnUpdateGuestStatus)
             {
                 for (uint32_t i = 0; i < pThis->cFacilityStatuses; i++) /* ascending order! */
                     if (   pThis->aFacilityStatuses[i].enmStatus != VBoxGuestFacilityStatus_Inactive
                         || !pThis->aFacilityStatuses[i].fFixed)
-                        pThis->pDrv->pfnUpdateGuestStatus(pThis->pDrv,
+                        pThisCC->pDrv->pfnUpdateGuestStatus(pThisCC->pDrv,
                                                           pThis->aFacilityStatuses[i].enmFacility,
                                                           (uint16_t)pThis->aFacilityStatuses[i].enmStatus,
@@ -4109 +4157 @@
         }
     }
-    if (pThis->pDrv && pThis->pDrv->pfnUpdateGuestCapabilities)
-        pThis->pDrv->pfnUpdateGuestCapabilities(pThis->pDrv, pThis->fGuestCaps);
+    if (pThisCC->pDrv && pThisCC->pDrv->pfnUpdateGuestCapabilities)
+        pThisCC->pDrv->pfnUpdateGuestCapabilities(pThisCC->pDrv, pThis->fGuestCaps);
 
     return VINF_SUCCESS;
@@ -4124 +4172 @@
 static DECLCALLBACK(int) vmmdevLoadStateDone(PPDMDEVINS pDevIns, PSSMHANDLE pSSM)
 {
-    RT_NOREF1(pSSM);
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEV   pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEVCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+    RT_NOREF(pSSM);
 
 #ifdef VBOX_WITH_HGCM
-    int rc = vmmdevHGCMLoadStateDone(pThis);
+    int rc = vmmdevR3HgcmLoadStateDone(pDevIns, pThis, pThisCC);
     AssertLogRelRCReturn(rc, rc);
 #endif /* VBOX_WITH_HGCM */
@@ -4134 +4183 @@
     /* Reestablish the acceleration status. */
     if (    pThis->u32VideoAccelEnabled
-        &&  pThis->pDrv)
-    {
-        pThis->pDrv->pfnVideoAccelEnable(pThis->pDrv, !!pThis->u32VideoAccelEnabled, &pThis->pVMMDevRAMR3->vbvaMemory);
-    }
-
-    VMMDevNotifyGuest(pThis, VMMDEV_EVENT_RESTORED);
+        &&  pThisCC->pDrv)
+        pThisCC->pDrv->pfnVideoAccelEnable(pThisCC->pDrv, !!pThis->u32VideoAccelEnabled, &pThisCC->pVMMDevRAMR3->vbvaMemory);
+
+    VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_RESTORED);
 
     return VINF_SUCCESS;
@@ -4150 +4197 @@
  * (Re-)initializes the MMIO2 data.
  *
- * @param   pThis           Pointer to the VMMDev instance data.
- */
-static void vmmdevInitRam(PVMMDEV pThis)
-{
-    memset(pThis->pVMMDevRAMR3, 0, sizeof(VMMDevMemory));
-    pThis->pVMMDevRAMR3->u32Size = sizeof(VMMDevMemory);
-    pThis->pVMMDevRAMR3->u32Version = VMMDEV_MEMORY_VERSION;
+ * @param   pThisCC         The VMMDev ring-3 instance data.
+ */
+static void vmmdevInitRam(PVMMDEVCC pThisCC)
+{
+    memset(pThisCC->pVMMDevRAMR3, 0, sizeof(VMMDevMemory));
+    pThisCC->pVMMDevRAMR3->u32Size    = sizeof(VMMDevMemory);
+    pThisCC->pVMMDevRAMR3->u32Version = VMMDEV_MEMORY_VERSION;
 }
 
@@ -4165 +4212 @@
 static DECLCALLBACK(void) vmmdevReset(PPDMDEVINS pDevIns)
 {
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
-    PDMCritSectEnter(&pThis->CritSect, VERR_IGNORED);
+    PVMMDEV   pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEVCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+    PDMDevHlpCritSectEnter(pDevIns, &pThis->CritSect, VERR_IGNORED);
 
     /*
@@ -4176 +4224 @@
         /* notify the connector */
         Log(("vmmdevReset: capabilities changed (%x), informing connector\n", pThis->fMouseCapabilities));
-        pThis->pDrv->pfnUpdateMouseCapabilities(pThis->pDrv, pThis->fMouseCapabilities);
+        pThisCC->pDrv->pfnUpdateMouseCapabilities(pThisCC->pDrv, pThis->fMouseCapabilities);
     }
     pThis->fHostCursorRequested = false;
 
     /* re-initialize the VMMDev memory */
-    if (pThis->pVMMDevRAMR3)
-        vmmdevInitRam(pThis);
+    if (pThisCC->pVMMDevRAMR3)
+        vmmdevInitRam(pThisCC);
 
     /* credentials have to go away (by default) */
-    if (!pThis->fKeepCredentials)
-    {
-        memset(pThis->pCredentials->Logon.szUserName, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-        memset(pThis->pCredentials->Logon.szPassword, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-        memset(pThis->pCredentials->Logon.szDomain, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-    }
-    memset(pThis->pCredentials->Judge.szUserName, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-    memset(pThis->pCredentials->Judge.szPassword, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
-    memset(pThis->pCredentials->Judge.szDomain, '\0', VMMDEV_CREDENTIALS_SZ_SIZE);
+    VMMDEVCREDS *pCredentials = pThisCC->pCredentials;
+    if (pCredentials)
+    {
+        if (!pThis->fKeepCredentials)
+        {
+            RT_ZERO(pCredentials->Logon.szUserName);
+            RT_ZERO(pCredentials->Logon.szPassword);
+            RT_ZERO(pCredentials->Logon.szDomain);
+        }
+        RT_ZERO(pCredentials->Judge.szUserName);
+        RT_ZERO(pCredentials->Judge.szPassword);
+        RT_ZERO(pCredentials->Judge.szDomain);
+    }
 
     /* Reset means that additions will report again. */
@@ -4239 +4291 @@
 #ifdef VBOX_WITH_HGCM
     /* Clear the "HGCM event enabled" flag so the event can be automatically reenabled.  */
-    pThis->u32HGCMEnabled = 0;
+    pThisCC->u32HGCMEnabled = 0;
 #endif
 
@@ -4247 +4299 @@
     if (pThis->fHeartbeatActive)
     {
-        TMTimerStop(pThis->pFlatlinedTimer);
+        PDMDevHlpTimerStop(pDevIns, pThis->hFlatlinedTimer);
         pThis->fFlatlined       = false;
         pThis->fHeartbeatActive = true;
@@ -4268 +4320 @@
      * Call the update functions as required.
      */
-    if (fVersionChanged && pThis->pDrv && pThis->pDrv->pfnUpdateGuestInfo)
-        pThis->pDrv->pfnUpdateGuestInfo(pThis->pDrv, &pThis->guestInfo);
-    if (fCapsChanged && pThis->pDrv && pThis->pDrv->pfnUpdateGuestCapabilities)
-        pThis->pDrv->pfnUpdateGuestCapabilities(pThis->pDrv, pThis->fGuestCaps);
+    if (fVersionChanged && pThisCC->pDrv && pThisCC->pDrv->pfnUpdateGuestInfo)
+        pThisCC->pDrv->pfnUpdateGuestInfo(pThisCC->pDrv, &pThis->guestInfo);
+    if (fCapsChanged && pThisCC->pDrv && pThisCC->pDrv->pfnUpdateGuestCapabilities)
+        pThisCC->pDrv->pfnUpdateGuestCapabilities(pThisCC->pDrv, pThis->fGuestCaps);
 
     /*
@@ -4279 +4331 @@
     pThis->idSession = ASMReadTSC();
 
-    PDMCritSectLeave(&pThis->CritSect);
+    PDMDevHlpCritSectLeave(pDevIns, &pThis->CritSect);
 }
 
@@ -4291 +4343 @@
     if (offDelta)
     {
-        PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+        PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
         LogFlow(("vmmdevRelocate: offDelta=%RGv\n", offDelta));
 
@@ -4307 +4359 @@
 static DECLCALLBACK(int) vmmdevDestruct(PPDMDEVINS pDevIns)
 {
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
     PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
+    PVMMDEVCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
 
     /*
      * Wipe and free the credentials.
      */
-    if (pThis->pCredentials)
-    {
-        RTMemWipeThoroughly(pThis->pCredentials, sizeof(*pThis->pCredentials), 10);
-        RTMemFree(pThis->pCredentials);
-        pThis->pCredentials = NULL;
+    VMMDEVCREDS *pCredentials = pThisCC->pCredentials;
+    pThisCC->pCredentials = NULL;
+    if (pCredentials)
+    {
+        if (pThisCC->fSaferCredentials)
+            RTMemSaferFree(pCredentials, sizeof(*pCredentials));
+        else
+        {
+            RTMemWipeThoroughly(pCredentials, sizeof(*pCredentials), 10);
+            RTMemFree(pCredentials);
+        }
     }
 
@@ -4324 +4382 @@
      * Everything HGCM.
      */
-    vmmdevHGCMDestroy(pThis);
+    vmmdevR3HgcmDestroy(pDevIns, pThisCC);
 #endif
 
@@ -4330 +4388 @@
      * Free the request buffers.
      */
-    for (uint32_t iCpu = 0; iCpu < RT_ELEMENTS(pThis->apReqBufs); iCpu++)
-    {
-        pThis->apReqBufs[iCpu] = NULL;
-        RTMemPageFree(pThis->apReqBufs[iCpu], _4K);
+    for (uint32_t iCpu = 0; iCpu < RT_ELEMENTS(pThisCC->apReqBufs); iCpu++)
+    {
+        RTMemPageFree(pThisCC->apReqBufs[iCpu], _4K);
+        pThisCC->apReqBufs[iCpu] = NULL;
     }
 
@@ -4352 +4410 @@
 static DECLCALLBACK(int) vmmdevConstruct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfg)
 {
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
-    int rc;
+    PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
+    PVMMDEVCC       pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+    PVMMDEV         pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PCPDMDEVHLPR3   pHlp    = pDevIns->pHlpR3;
+    int             rc;
 
     Assert(iInstance == 0);
-    PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
+    RT_NOREF(iInstance);
 
     /*
      * Initialize data (most of it anyway).
      */
-    /* Save PDM device instance data for future reference. */
-    pThis->pDevInsR3 = pDevIns;
-    pThis->pDevInsR0 = PDMDEVINS_2_R0PTR(pDevIns);
-#ifdef VBOX_WITH_RAW_MODE_KEEP
-    pThis->pDevInsRC = PDMDEVINS_2_RCPTR(pDevIns);
+    pThisCC->pDevIns = pDevIns;
+
+    pThis->hFlatlinedTimer      = NIL_TMTIMERHANDLE;
+    pThis->hIoPortBackdoorLog   = NIL_IOMIOPORTHANDLE;
+    pThis->hIoPortAltTimesync   = NIL_IOMIOPORTHANDLE;
+    pThis->hIoPortReq           = NIL_IOMIOPORTHANDLE;
+    pThis->hIoPortFast          = NIL_IOMIOPORTHANDLE;
+    pThis->hMmio2VMMDevRAM      = NIL_PGMMMIO2HANDLE;
+    pThis->hMmio2Heap           = NIL_PGMMMIO2HANDLE;
+#ifndef VBOX_WITHOUT_TESTING_FEATURES
+    pThis->hIoPortTesting       = NIL_IOMIOPORTHANDLE;
+    pThis->hMmioTesting         = NIL_IOMMMIOHANDLE;
 #endif
 
@@ -4397 +4465 @@
      */
     /* IBase */
-    pThis->IBase.pfnQueryInterface          = vmmdevPortQueryInterface;
+    pThisCC->IBase.pfnQueryInterface          = vmmdevPortQueryInterface;
 
     /* VMMDev port */
-    pThis->IPort.pfnQueryAbsoluteMouse      = vmmdevIPort_QueryAbsoluteMouse;
-    pThis->IPort.pfnSetAbsoluteMouse        = vmmdevIPort_SetAbsoluteMouse ;
-    pThis->IPort.pfnQueryMouseCapabilities  = vmmdevIPort_QueryMouseCapabilities;
-    pThis->IPort.pfnUpdateMouseCapabilities = vmmdevIPort_UpdateMouseCapabilities;
-    pThis->IPort.pfnRequestDisplayChange    = vmmdevIPort_RequestDisplayChange;
-    pThis->IPort.pfnSetCredentials          = vmmdevIPort_SetCredentials;
-    pThis->IPort.pfnVBVAChange              = vmmdevIPort_VBVAChange;
-    pThis->IPort.pfnRequestSeamlessChange   = vmmdevIPort_RequestSeamlessChange;
-    pThis->IPort.pfnSetMemoryBalloon        = vmmdevIPort_SetMemoryBalloon;
-    pThis->IPort.pfnSetStatisticsInterval   = vmmdevIPort_SetStatisticsInterval;
-    pThis->IPort.pfnVRDPChange              = vmmdevIPort_VRDPChange;
-    pThis->IPort.pfnCpuHotUnplug            = vmmdevIPort_CpuHotUnplug;
-    pThis->IPort.pfnCpuHotPlug              = vmmdevIPort_CpuHotPlug;
+    pThisCC->IPort.pfnQueryAbsoluteMouse      = vmmdevIPort_QueryAbsoluteMouse;
+    pThisCC->IPort.pfnSetAbsoluteMouse        = vmmdevIPort_SetAbsoluteMouse ;
+    pThisCC->IPort.pfnQueryMouseCapabilities  = vmmdevIPort_QueryMouseCapabilities;
+    pThisCC->IPort.pfnUpdateMouseCapabilities = vmmdevIPort_UpdateMouseCapabilities;
+    pThisCC->IPort.pfnRequestDisplayChange    = vmmdevIPort_RequestDisplayChange;
+    pThisCC->IPort.pfnSetCredentials          = vmmdevIPort_SetCredentials;
+    pThisCC->IPort.pfnVBVAChange              = vmmdevIPort_VBVAChange;
+    pThisCC->IPort.pfnRequestSeamlessChange   = vmmdevIPort_RequestSeamlessChange;
+    pThisCC->IPort.pfnSetMemoryBalloon        = vmmdevIPort_SetMemoryBalloon;
+    pThisCC->IPort.pfnSetStatisticsInterval   = vmmdevIPort_SetStatisticsInterval;
+    pThisCC->IPort.pfnVRDPChange              = vmmdevIPort_VRDPChange;
+    pThisCC->IPort.pfnCpuHotUnplug            = vmmdevIPort_CpuHotUnplug;
+    pThisCC->IPort.pfnCpuHotPlug              = vmmdevIPort_CpuHotPlug;
 
     /* Shared folder LED */
-    pThis->SharedFolders.Led.u32Magic       = PDMLED_MAGIC;
-    pThis->SharedFolders.ILeds.pfnQueryStatusLed = vmmdevQueryStatusLed;
+    pThisCC->SharedFolders.Led.u32Magic       = PDMLED_MAGIC;
+    pThisCC->SharedFolders.ILeds.pfnQueryStatusLed = vmmdevQueryStatusLed;
 
 #ifdef VBOX_WITH_HGCM
     /* HGCM port */
-    pThis->IHGCMPort.pfnCompleted           = hgcmCompleted;
-    pThis->IHGCMPort.pfnIsCmdRestored       = hgcmIsCmdRestored;
-    pThis->IHGCMPort.pfnIsCmdCancelled      = hgcmIsCmdCancelled;
-    pThis->IHGCMPort.pfnGetRequestor        = hgcmGetRequestor;
-    pThis->IHGCMPort.pfnGetVMMDevSessionId  = hgcmGetVMMDevSessionId;
+    pThisCC->IHGCMPort.pfnCompleted           = hgcmR3Completed;
+    pThisCC->IHGCMPort.pfnIsCmdRestored       = hgcmR3IsCmdRestored;
+    pThisCC->IHGCMPort.pfnIsCmdCancelled      = hgcmR3IsCmdCancelled;
+    pThisCC->IHGCMPort.pfnGetRequestor        = hgcmR3GetRequestor;
+    pThisCC->IHGCMPort.pfnGetVMMDevSessionId  = hgcmR3GetVMMDevSessionId;
 #endif
 
-    pThis->pCredentials = (VMMDEVCREDS *)RTMemAllocZ(sizeof(*pThis->pCredentials));
-    if (!pThis->pCredentials)
-        return VERR_NO_MEMORY;
+    pThisCC->pCredentials = (VMMDEVCREDS *)RTMemSaferAllocZ(sizeof(*pThisCC->pCredentials));
+    if (pThisCC->pCredentials)
+        pThisCC->fSaferCredentials = true;
+    else
+    {
+        pThisCC->pCredentials = (VMMDEVCREDS *)RTMemAllocZ(sizeof(*pThisCC->pCredentials));
+        AssertReturn(pThisCC->pCredentials, VERR_NO_MEMORY);
+    }
 
 
@@ -4436 +4509 @@
      */
     PDMDEV_VALIDATE_CONFIG_RETURN(pDevIns,
+                                  "AllowGuestToSaveState|"
                                   "GetHostTimeDisabled|"
                                   "BackdoorLogDisabled|"
                                   "KeepCredentials|"
                                   "HeapEnabled|"
-                                  "RZEnabled|"
                                   "GuestCoreDumpEnabled|"
                                   "GuestCoreDumpDir|"
@@ -4452 +4525 @@
                                   "");
 
-    rc = CFGMR3QueryBoolDef(pCfg, "GetHostTimeDisabled", &pThis->fGetHostTimeDisabled, false);
+    rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "AllowGuestToSaveState", &pThis->fAllowGuestToSaveState, true);
+    if (RT_FAILURE(rc))
+        return PDMDEV_SET_ERROR(pDevIns, rc,
+                                N_("Configuration error: Failed querying \"AllowGuestToSaveState\" as a boolean"));
+
+    rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "GetHostTimeDisabled", &pThis->fGetHostTimeDisabled, false);
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc,
                                 N_("Configuration error: Failed querying \"GetHostTimeDisabled\" as a boolean"));
 
-    rc = CFGMR3QueryBoolDef(pCfg, "BackdoorLogDisabled", &pThis->fBackdoorLogDisabled, false);
+    rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "BackdoorLogDisabled", &pThis->fBackdoorLogDisabled, false);
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc,
                                 N_("Configuration error: Failed querying \"BackdoorLogDisabled\" as a boolean"));
 
-    rc = CFGMR3QueryBoolDef(pCfg, "KeepCredentials", &pThis->fKeepCredentials, false);
+    rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "KeepCredentials", &pThis->fKeepCredentials, false);
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc,
                                 N_("Configuration error: Failed querying \"KeepCredentials\" as a boolean"));
 
-    rc = CFGMR3QueryBoolDef(pCfg, "HeapEnabled", &pThis->fHeapEnabled, true);
+    rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "HeapEnabled", &pThis->fHeapEnabled, true);
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc,
                                 N_("Configuration error: Failed querying \"HeapEnabled\" as a boolean"));
 
-    rc = CFGMR3QueryBoolDef(pCfg, "RZEnabled", &pThis->fRZEnabled, true);
+    rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "GuestCoreDumpEnabled", &pThis->fGuestCoreDumpEnabled, false);
     if (RT_FAILURE(rc))
-        return PDMDEV_SET_ERROR(pDevIns, rc,
-                                N_("Configuration error: Failed querying \"RZEnabled\" as a boolean"));
-
-    rc = CFGMR3QueryBoolDef(pCfg, "GuestCoreDumpEnabled", &pThis->fGuestCoreDumpEnabled, false);
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("Configuration error: Failed querying \"GuestCoreDumpEnabled\" as a boolean"));
+
+    char *pszGuestCoreDumpDir = NULL;
+    rc = pHlp->pfnCFGMQueryStringAllocDef(pCfg, "GuestCoreDumpDir", &pszGuestCoreDumpDir, "");
     if (RT_FAILURE(rc))
-        return PDMDEV_SET_ERROR(pDevIns, rc,
-                                N_("Configuration error: Failed querying \"GuestCoreDumpEnabled\" as a boolean"));
-
-    char *pszGuestCoreDumpDir = NULL;
-    rc = CFGMR3QueryStringAllocDef(pCfg, "GuestCoreDumpDir", &pszGuestCoreDumpDir, "");
-    if (RT_FAILURE(rc))
-        return PDMDEV_SET_ERROR(pDevIns, rc,
-                                N_("Configuration error: Failed querying \"GuestCoreDumpDir\" as a string"));
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("Configuration error: Failed querying \"GuestCoreDumpDir\" as a string"));
 
     RTStrCopy(pThis->szGuestCoreDumpDir, sizeof(pThis->szGuestCoreDumpDir), pszGuestCoreDumpDir);
     MMR3HeapFree(pszGuestCoreDumpDir);
 
-    rc = CFGMR3QueryU32Def(pCfg, "GuestCoreDumpCount", &pThis->cGuestCoreDumps, 3);
+    rc = pHlp->pfnCFGMQueryU32Def(pCfg, "GuestCoreDumpCount", &pThis->cGuestCoreDumps, 3);
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc,
                                 N_("Configuration error: Failed querying \"GuestCoreDumpCount\" as a 32-bit unsigned integer"));
 
-    rc = CFGMR3QueryU64Def(pCfg, "HeartbeatInterval", &pThis->cNsHeartbeatInterval, VMMDEV_HEARTBEAT_DEFAULT_INTERVAL);
+    rc = pHlp->pfnCFGMQueryU64Def(pCfg, "HeartbeatInterval", &pThis->cNsHeartbeatInterval, VMMDEV_HEARTBEAT_DEFAULT_INTERVAL);
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc,
@@ -4504 +4575 @@
                                 N_("Configuration error: Heartbeat interval \"HeartbeatInterval\" too small"));
 
-    rc = CFGMR3QueryU64Def(pCfg, "HeartbeatTimeout", &pThis->cNsHeartbeatTimeout, pThis->cNsHeartbeatInterval * 2);
+    rc = pHlp->pfnCFGMQueryU64Def(pCfg, "HeartbeatTimeout", &pThis->cNsHeartbeatTimeout, pThis->cNsHeartbeatInterval * 2);
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc,
                                 N_("Configuration error: Failed querying \"HeartbeatTimeout\" as a 64-bit unsigned integer"));
     if (pThis->cNsHeartbeatTimeout < RT_NS_100MS)
-        return PDMDEV_SET_ERROR(pDevIns, rc,
-                                N_("Configuration error: Heartbeat timeout \"HeartbeatTimeout\" too small"));
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("Configuration error: Heartbeat timeout \"HeartbeatTimeout\" too small"));
     if (pThis->cNsHeartbeatTimeout <= pThis->cNsHeartbeatInterval + RT_NS_10MS)
         return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
@@ -4517 +4587 @@
 
 #ifndef VBOX_WITHOUT_TESTING_FEATURES
-    rc = CFGMR3QueryBoolDef(pCfg, "TestingEnabled", &pThis->fTestingEnabled, false);
+    rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "TestingEnabled", &pThis->fTestingEnabled, false);
     if (RT_FAILURE(rc))
-        return PDMDEV_SET_ERROR(pDevIns, rc,
-                                N_("Configuration error: Failed querying \"TestingEnabled\" as a boolean"));
-    rc = CFGMR3QueryBoolDef(pCfg, "TestingMMIO", &pThis->fTestingMMIO, false);
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("Configuration error: Failed querying \"TestingEnabled\" as a boolean"));
+    rc = pHlp->pfnCFGMQueryBoolDef(pCfg, "TestingMMIO", &pThis->fTestingMMIO, false);
     if (RT_FAILURE(rc))
-        return PDMDEV_SET_ERROR(pDevIns, rc,
-                                N_("Configuration error: Failed querying \"TestingMMIO\" as a boolean"));
-    rc = CFGMR3QueryStringAllocDef(pCfg, "TestintXmlOutputFile", &pThis->pszTestingXmlOutput, NULL);
+        return PDMDEV_SET_ERROR(pDevIns, rc, N_("Configuration error: Failed querying \"TestingMMIO\" as a boolean"));
+    rc = pHlp->pfnCFGMQueryStringAllocDef(pCfg, "TestintXmlOutputFile", &pThisCC->pszTestingXmlOutput, NULL);
     if (RT_FAILURE(rc))
         return PDMDEV_SET_ERROR(pDevIns, rc, N_("Configuration error: Failed querying \"TestintXmlOutputFile\" as a string"));
@@ -4546 +4614 @@
      * Register the backdoor logging port
      */
-    rc = PDMDevHlpIOPortRegister(pDevIns, RTLOG_DEBUG_PORT, 1, NULL, vmmdevBackdoorLog,
-                                 NULL, NULL, NULL, "VMMDev backdoor logging");
+    rc = PDMDevHlpIoPortCreateAndMap(pDevIns, RTLOG_DEBUG_PORT, 1, vmmdevBackdoorLog, NULL /*pfnIn*/,
+                                     "VMMDev backdoor logging", NULL, &pThis->hIoPortBackdoorLog);
     AssertRCReturn(rc, rc);
 
@@ -4558 +4626 @@
      * first.  We keep it in case it comes in handy.
      */
-    rc = PDMDevHlpIOPortRegister(pDevIns, 0x505, 1, NULL,
-                                 vmmdevAltTimeSyncWrite, vmmdevAltTimeSyncRead,
-                                 NULL, NULL, "VMMDev timesync backdoor");
+    rc = PDMDevHlpIoPortCreateAndMap(pDevIns, 0x505, 1, vmmdevAltTimeSyncWrite, vmmdevAltTimeSyncRead,
+                                     "VMMDev timesync backdoor", NULL /*paExtDescs*/, &pThis->hIoPortAltTimesync);
     AssertRCReturn(rc, rc);
 #endif
@@ -4572 +4639 @@
     if (pPciDev->uDevFn != 32 || iInstance != 0)
         Log(("!!WARNING!!: pThis->PciDev.uDevFn=%d (ignore if testcase or no started by Main)\n", pPciDev->uDevFn));
-    rc = PDMDevHlpPCIIORegionRegister(pDevIns, 0, 0x20, PCI_ADDRESS_SPACE_IO, vmmdevIOPortRegionMap);
-    if (RT_FAILURE(rc))
-        return rc;
-    rc = PDMDevHlpPCIIORegionRegister(pDevIns, 1, VMMDEV_RAM_SIZE, PCI_ADDRESS_SPACE_MEM, vmmdevIORAMRegionMap);
-    if (RT_FAILURE(rc))
-        return rc;
-    if (pThis->fHeapEnabled)
-    {
-        rc = PDMDevHlpPCIIORegionRegister(pDevIns, 2, VMMDEV_HEAP_SIZE, PCI_ADDRESS_SPACE_MEM_PREFETCH, vmmdevIORAMRegionMap);
-        if (RT_FAILURE(rc))
-            return rc;
-    }
 
     /*
-     * Allocate and initialize the MMIO2 memory.
-     *
-     * We map the first page into raw-mode and kernel contexts so we can handle
-     * interrupt acknowledge requests more timely.
-     */
-    rc = PDMDevHlpMMIO2Register(pDevIns, pPciDev, 1 /*iRegion*/, VMMDEV_RAM_SIZE, 0 /*fFlags*/,
-                                (void **)&pThis->pVMMDevRAMR3, "VMMDev");
+     * The I/O ports, PCI region #0.  This has two separate I/O port mappings in it,
+     * so we have to do it via the mapper callback.
+     */
+    rc = PDMDevHlpIoPortCreate(pDevIns, 1 /*cPorts*/, pPciDev, RT_MAKE_U32(0, 0), vmmdevRequestHandler, NULL /*pfnIn*/,
+                               NULL /*pvUser*/, "VMMDev Request Handler",  NULL, &pThis->hIoPortReq);
+    AssertRCReturn(rc, rc);
+
+    rc = PDMDevHlpIoPortCreate(pDevIns, 1 /*cPorts*/, pPciDev, RT_MAKE_U32(1, 0),  vmmdevFastRequestHandler,
+                               vmmdevFastRequestIrqAck, NULL, "VMMDev Fast R0/RC Requests", NULL /*pvUser*/, &pThis->hIoPortFast);
+    AssertRCReturn(rc, rc);
+
+    rc = PDMDevHlpPCIIORegionRegisterIoCustom(pDevIns, 0, 0x20, vmmdevIOPortRegionMap);
+    AssertRCReturn(rc, rc);
+
+    /*
+     * Allocate and initialize the MMIO2 memory, PCI region #1.
+     */
+    rc = PDMDevHlpPCIIORegionCreateMmio2(pDevIns, 1 /*iPciRegion*/, VMMDEV_RAM_SIZE, PCI_ADDRESS_SPACE_MEM, "VMMDev",
+                                         (void **)&pThisCC->pVMMDevRAMR3, &pThis->hMmio2VMMDevRAM);
     if (RT_FAILURE(rc))
         return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
-                                   N_("Failed to allocate %u bytes of memory for the VMM device"), VMMDEV_RAM_SIZE);
-    vmmdevInitRam(pThis);
-    if (pThis->fRZEnabled)
-    {
-        rc = PDMDevHlpMMIO2MapKernel(pDevIns, pPciDev, 1 /*iRegion*/, 0 /*off*/, PAGE_SIZE, "VMMDev", &pThis->pVMMDevRAMR0);
+                                   N_("Failed to create the %u (%#x) byte MMIO2 region for the VMM device"),
+                                   VMMDEV_RAM_SIZE, VMMDEV_RAM_SIZE);
+    vmmdevInitRam(pThisCC);
+
+    /*
+     * The MMIO2 heap (used for real-mode VT-x trickery), PCI region #2.
+     */
+    if (pThis->fHeapEnabled)
+    {
+        rc = PDMDevHlpPCIIORegionCreateMmio2Ex(pDevIns, 2 /*iPciRegion*/, VMMDEV_HEAP_SIZE, PCI_ADDRESS_SPACE_MEM_PREFETCH,
+                                               0 /*fFlags*/, vmmdevMmio2HeapRegionMap, "VMMDev Heap",
+                                               (void **)&pThisCC->pVMMDevHeapR3, &pThis->hMmio2Heap);
         if (RT_FAILURE(rc))
             return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
-                                       N_("Failed to map first page of the VMMDev ram into kernel space: %Rrc"), rc);
-
-#ifdef VBOX_WITH_RAW_MODE_KEEP
-        rc = PDMDevHlpMMHyperMapMMIO2(pDevIns, pPciDev, 1 /*iRegion*/, 0 /*off*/, PAGE_SIZE, "VMMDev", &pThis->pVMMDevRAMRC);
-        if (RT_FAILURE(rc))
-            return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
-                                       N_("Failed to map first page of the VMMDev ram into raw-mode context: %Rrc"), rc);
-#endif
-    }
-
-    /*
-     * Allocate and initialize the MMIO2 heap.
-     */
-    if (pThis->fHeapEnabled)
-    {
-        rc = PDMDevHlpMMIO2Register(pDevIns, pPciDev, 2 /*iRegion*/, VMMDEV_HEAP_SIZE, 0 /*fFlags*/,
-                                    (void **)&pThis->pVMMDevHeapR3, "VMMDev Heap");
-        if (RT_FAILURE(rc))
-            return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS,
-                                       N_("Failed to allocate %u bytes of memory for the VMM device heap"), PAGE_SIZE);
+                                       N_("Failed to create the %u (%#x) bytes MMIO2 heap region for the VMM device"),
+                                       VMMDEV_HEAP_SIZE, VMMDEV_HEAP_SIZE);
 
         /* Register the memory area with PDM so HM can access it before it's mapped. */
-        rc = PDMDevHlpRegisterVMMDevHeap(pDevIns, NIL_RTGCPHYS, pThis->pVMMDevHeapR3, VMMDEV_HEAP_SIZE);
+        rc = PDMDevHlpRegisterVMMDevHeap(pDevIns, NIL_RTGCPHYS, pThisCC->pVMMDevHeapR3, VMMDEV_HEAP_SIZE);
         AssertLogRelRCReturn(rc, rc);
     }
@@ -4640 +4696 @@
      * Get the corresponding connector interface
      */
-    rc = PDMDevHlpDriverAttach(pDevIns, 0, &pThis->IBase, &pThis->pDrvBase, "VMM Driver Port");
+    rc = PDMDevHlpDriverAttach(pDevIns, 0, &pThisCC->IBase, &pThisCC->pDrvBase, "VMM Driver Port");
     if (RT_SUCCESS(rc))
     {
-        pThis->pDrv = PDMIBASE_QUERY_INTERFACE(pThis->pDrvBase, PDMIVMMDEVCONNECTOR);
-        AssertMsgReturn(pThis->pDrv, ("LUN #0 doesn't have a VMMDev connector interface!\n"), VERR_PDM_MISSING_INTERFACE);
+        pThisCC->pDrv = PDMIBASE_QUERY_INTERFACE(pThisCC->pDrvBase, PDMIVMMDEVCONNECTOR);
+        AssertMsgReturn(pThisCC->pDrv, ("LUN #0 doesn't have a VMMDev connector interface!\n"), VERR_PDM_MISSING_INTERFACE);
 #ifdef VBOX_WITH_HGCM
-        pThis->pHGCMDrv = PDMIBASE_QUERY_INTERFACE(pThis->pDrvBase, PDMIHGCMCONNECTOR);
-        if (!pThis->pHGCMDrv)
+        pThisCC->pHGCMDrv = PDMIBASE_QUERY_INTERFACE(pThisCC->pDrvBase, PDMIHGCMCONNECTOR);
+        if (!pThisCC->pHGCMDrv)
         {
             Log(("LUN #0 doesn't have a HGCM connector interface, HGCM is not supported. rc=%Rrc\n", rc));
@@ -4654 +4710 @@
 #endif
         /* Query the initial balloon size. */
-        AssertPtr(pThis->pDrv->pfnQueryBalloonSize);
-        rc = pThis->pDrv->pfnQueryBalloonSize(pThis->pDrv, &pThis->cMbMemoryBalloon);
+        AssertPtr(pThisCC->pDrv->pfnQueryBalloonSize);
+        rc = pThisCC->pDrv->pfnQueryBalloonSize(pThisCC->pDrv, &pThis->cMbMemoryBalloon);
         AssertRC(rc);
 
@@ -4672 +4728 @@
      */
     PPDMIBASE pBase;
-    rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThis->IBase, &pBase, "Status Port");
+    rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pThisCC->IBase, &pBase, "Status Port");
     if (RT_SUCCESS(rc))
-        pThis->SharedFolders.pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
+        pThisCC->SharedFolders.pLedsConnector = PDMIBASE_QUERY_INTERFACE(pBase, PDMILEDCONNECTORS);
     else if (rc != VERR_PDM_NO_ATTACHED_DRIVER)
     {
@@ -4693 +4749 @@
      * Create heartbeat checking timer.
      */
-    rc = PDMDevHlpTMTimerCreate(pDevIns, TMCLOCK_VIRTUAL, vmmDevHeartbeatFlatlinedTimer, pThis,
-                                TMTIMER_FLAGS_NO_CRIT_SECT, "Heartbeat flatlined", &pThis->pFlatlinedTimer);
+    rc = PDMDevHlpTimerCreate(pDevIns, TMCLOCK_VIRTUAL, vmmDevHeartbeatFlatlinedTimer, pThis,
+                              TMTIMER_FLAGS_NO_CRIT_SECT, "Heartbeat flatlined", &pThis->hFlatlinedTimer);
     AssertRCReturn(rc, rc);
 
 #ifdef VBOX_WITH_HGCM
-    rc = vmmdevHGCMInit(pThis);
+    rc = vmmdevR3HgcmInit(pThisCC);
     AssertRCReturn(rc, rc);
 #endif
@@ -4711 +4767 @@
      * Statistics.
      */
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatMemBalloonChunks, STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatMemBalloonChunks,    STAMTYPE_U32, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
                            "Memory balloon size",                           "/Devices/VMMDev/BalloonChunks");
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatFastIrqAckR3,      STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatFastIrqAckR3,        STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
                            "Fast IRQ acknowledgments handled in ring-3.",   "/Devices/VMMDev/FastIrqAckR3");
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatFastIrqAckRZ,      STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatFastIrqAckRZ,        STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
                            "Fast IRQ acknowledgments handled in ring-0 or raw-mode.", "/Devices/VMMDev/FastIrqAckRZ");
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatSlowIrqAck,        STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatSlowIrqAck,          STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
                            "Slow IRQ acknowledgments (old style).",         "/Devices/VMMDev/SlowIrqAck");
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatReqBufAllocs,      STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThisCC->StatReqBufAllocs,      STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
                            "Times a larger request buffer was required.",   "/Devices/VMMDev/LargeReqBufAllocs");
 #ifdef VBOX_WITH_HGCM
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatHgcmCmdArrival,    STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThisCC->StatHgcmCmdArrival,    STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
                            "Profiling HGCM call arrival processing",        "/HGCM/MsgArrival");
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatHgcmCmdCompletion, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThisCC->StatHgcmCmdCompletion, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
                            "Profiling HGCM call completion processing",     "/HGCM/MsgCompletion");
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatHgcmCmdTotal,      STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThisCC->StatHgcmCmdTotal,      STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL,
                            "Profiling whole HGCM call.",                    "/HGCM/MsgTotal");
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatHgcmLargeCmdAllocs,STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThisCC->StatHgcmLargeCmdAllocs,STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
                            "Times the allocation cache could not be used.", "/HGCM/LargeCmdAllocs");
-    PDMDevHlpSTAMRegisterF(pDevIns, &pThis->StatHgcmFailedPageListLocking,STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
+    PDMDevHlpSTAMRegisterF(pDevIns, &pThisCC->StatHgcmFailedPageListLocking,STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_COUNT,
                            "Times no-bounce page list locking failed.", "/HGCM/FailedPageListLocking");
 #endif
@@ -4743 +4799 @@
 }
 
-#endif /* IN_RING3 */
+#else  /* !IN_RING3 */
+
+/**
+ * @callback_method_impl{PDMDEVREGR0,pfnConstruct}
+ */
+static DECLCALLBACK(int) vmmdevRZConstruct(PPDMDEVINS pDevIns)
+{
+    PDMDEV_CHECK_VERSIONS_RETURN(pDevIns);
+    PVMMDEV   pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEVCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+
+    int rc = PDMDevHlpSetDeviceCritSect(pDevIns, PDMDevHlpCritSectGetNop(pDevIns));
+    AssertRCReturn(rc, rc);
+
+#if 0
+    rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortBackdoorLog, vmmdevBackdoorLog, NULL /*pfnIn*/, NULL /*pvUser*/);
+    AssertRCReturn(rc, rc);
+#endif
+#if 0 && defined(VMMDEV_WITH_ALT_TIMESYNC)
+    rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortAltTimesync, vmmdevAltTimeSyncWrite, vmmdevAltTimeSyncRead, NULL);
+    AssertRCReturn(rc, rc);
+#endif
+
+    /*
+     * We map the first page of the VMMDevRAM into raw-mode and kernel contexts so we
+     * can handle interrupt acknowledge requests more timely (vmmdevFastRequestIrqAck).
+     */
+    rc = PDMDevHlpMmio2SetUpContext(pDevIns, pThis->hMmio2VMMDevRAM, 0, PAGE_SIZE, (void **)&pThisCC->CTX_SUFF(pVMMDevRAM));
+    AssertRCReturn(rc, rc);
+
+    rc = PDMDevHlpIoPortSetUpContext(pDevIns, pThis->hIoPortFast, vmmdevFastRequestHandler, vmmdevFastRequestIrqAck, NULL);
+    AssertRCReturn(rc, rc);
+
+    return VINF_SUCCESS;
+}
+
+#endif /* !IN_RING3 */
 
 /**
@@ -4758 +4850 @@
     /* .uSharedVersion = */         42,
     /* .cbInstanceShared = */       sizeof(VMMDEV),
-    /* .cbInstanceCC = */           0,
-    /* .cbInstanceRC = */           0,
+    /* .cbInstanceCC = */           sizeof(VMMDEVCC),
+    /* .cbInstanceRC = */           sizeof(VMMDEVRC),
     /* .cMaxPciDevices = */         1,
     /* .cMaxMsixVectors = */        0,
@@ -4794 +4886 @@
 #elif defined(IN_RING0)
     /* .pfnEarlyConstruct = */      NULL,
-    /* .pfnConstruct = */           NULL,
+    /* .pfnConstruct = */           vmmdevRZConstruct,
     /* .pfnDestruct = */            NULL,
     /* .pfnFinalDestruct = */       NULL,
@@ -4807 +4899 @@
     /* .pfnReserved7 = */           NULL,
 #elif defined(IN_RC)
-    /* .pfnConstruct = */           NULL,
+    /* .pfnConstruct = */           vmmdevRZConstruct,
     /* .pfnReserved0 = */           NULL,
     /* .pfnReserved1 = */           NULL,

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.cpp

@@ -184 +184 @@
     /** The STAM_GET_TS() value when the request arrived. */
     uint64_t            tsArrival;
-    /** The STAM_GET_TS() value when the hgcmCompleted() is called. */
+    /** The STAM_GET_TS() value when the hgcmR3Completed() is called. */
     uint64_t            tsComplete;
 
@@ -242 +242 @@
 
 
-static int vmmdevHGCMCmdListLock(PVMMDEV pThis)
-{
-    int rc = RTCritSectEnter(&pThis->critsectHGCMCmdList);
+DECLINLINE(int) vmmdevR3HgcmCmdListLock(PVMMDEVCC pThisCC)
+{
+    int rc = RTCritSectEnter(&pThisCC->critsectHGCMCmdList);
     AssertRC(rc);
     return rc;
 }
 
-static void vmmdevHGCMCmdListUnlock(PVMMDEV pThis)
-{
-    int rc = RTCritSectLeave(&pThis->critsectHGCMCmdList);
+DECLINLINE(void) vmmdevR3HgcmCmdListUnlock(PVMMDEVCC pThisCC)
+{
+    int rc = RTCritSectLeave(&pThisCC->critsectHGCMCmdList);
     AssertRC(rc);
 }
@@ -258 +258 @@
  *
  * @returns Pointer to the command on success, NULL otherwise.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   enmCmdType      Type of the command.
  * @param   GCPhys          The guest physical address of the HGCM request.
@@ -265 +265 @@
  * @param   fRequestor      The VMMDevRequestHeader::fRequestor value.
  */
-static PVBOXHGCMCMD vmmdevHGCMCmdAlloc(PVMMDEV pThis, VBOXHGCMCMDTYPE enmCmdType, RTGCPHYS GCPhys,
-                                       uint32_t cbRequest, uint32_t cParms, uint32_t fRequestor)
+static PVBOXHGCMCMD vmmdevR3HgcmCmdAlloc(PVMMDEVCC pThisCC, VBOXHGCMCMDTYPE enmCmdType, RTGCPHYS GCPhys,
+                                         uint32_t cbRequest, uint32_t cParms, uint32_t fRequestor)
 {
 #if 1
@@ -276 +276 @@
     if (cParms <= RT_ELEMENTS(pCmdCached->aGuestParms))
     {
-        int rc = RTMemCacheAllocEx(pThis->hHgcmCmdCache, (void **)&pCmdCached);
+        int rc = RTMemCacheAllocEx(pThisCC->hHgcmCmdCache, (void **)&pCmdCached);
         if (RT_SUCCESS(rc))
         {
@@ -298 +298 @@
         return NULL;
     }
-    STAM_REL_COUNTER_INC(&pThis->StatHgcmLargeCmdAllocs);
+    STAM_REL_COUNTER_INC(&pThisCC->StatHgcmLargeCmdAllocs);
 
 #else
-    RT_NOREF(pThis);
+    RT_NOREF(pThisCC);
 #endif
 
@@ -335 +335 @@
 /** Deallocate VBOXHGCMCMD memory.
  *
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pCmd            Command to deallocate.
  */
-static void vmmdevHGCMCmdFree(PVMMDEV pThis, PVBOXHGCMCMD pCmd)
+static void vmmdevR3HgcmCmdFree(PPDMDEVINS pDevIns, PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd)
 {
     if (pCmd)
@@ -367 +368 @@
                     {
                         if (pGuestParm->u.Pages.fLocked)
-                            PDMDevHlpPhysBulkReleasePageMappingLocks(pThis->pDevInsR3, pGuestParm->u.Pages.cPages,
+                            PDMDevHlpPhysBulkReleasePageMappingLocks(pDevIns, pGuestParm->u.Pages.cPages,
                                                                      pGuestParm->u.Pages.paPgLocks);
                         RTMemFree(pGuestParm->u.Pages.paPgLocks);
@@ -378 +379 @@
         if (pCmd->pvReqLocked)
         {
-            PDMDevHlpPhysReleasePageMappingLock(pThis->pDevInsR3, &pCmd->ReqMapLock);
+            PDMDevHlpPhysReleasePageMappingLock(pDevIns, &pCmd->ReqMapLock);
             pCmd->pvReqLocked = NULL;
         }
@@ -384 +385 @@
 #if 1
         if (pCmd->fMemCache)
-            RTMemCacheFree(pThis->hHgcmCmdCache, pCmd);
+            RTMemCacheFree(pThisCC->hHgcmCmdCache, pCmd);
         else
 #endif
@@ -394 +395 @@
  *
  * @returns VBox status code.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pCmd            Command to add.
  */
-static int vmmdevHGCMAddCommand(PVMMDEV pThis, PVBOXHGCMCMD pCmd)
-{
-    int rc = vmmdevHGCMCmdListLock(pThis);
+static int vmmdevR3HgcmAddCommand(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd)
+{
+    int rc = vmmdevR3HgcmCmdListLock(pThisCC);
     AssertRCReturn(rc, rc);
 
     LogFlowFunc(("%p type %d\n", pCmd, pCmd->enmCmdType));
 
-    RTListPrepend(&pThis->listHGCMCmd, &pCmd->node);
+    RTListPrepend(&pThisCC->listHGCMCmd, &pCmd->node);
 
     /* Automatically enable HGCM events, if there are HGCM commands. */
@@ -411 +414 @@
         || pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL)
     {
-        LogFunc(("u32HGCMEnabled = %d\n", pThis->u32HGCMEnabled));
-        if (ASMAtomicCmpXchgU32(&pThis->u32HGCMEnabled, 1, 0))
-             VMMDevCtlSetGuestFilterMask(pThis, VMMDEV_EVENT_HGCM, 0);
-    }
-
-    vmmdevHGCMCmdListUnlock(pThis);
+        LogFunc(("u32HGCMEnabled = %d\n", pThisCC->u32HGCMEnabled));
+        if (ASMAtomicCmpXchgU32(&pThisCC->u32HGCMEnabled, 1, 0))
+             VMMDevCtlSetGuestFilterMask(pDevIns, pThis, pThisCC, VMMDEV_EVENT_HGCM, 0);
+    }
+
+    vmmdevR3HgcmCmdListUnlock(pThisCC);
     return rc;
 }
@@ -423 +426 @@
  *
  * @returns VBox status code.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pCmd            Command to remove.
  */
-static int vmmdevHGCMRemoveCommand(PVMMDEV pThis, PVBOXHGCMCMD pCmd)
-{
-    int rc = vmmdevHGCMCmdListLock(pThis);
+static int vmmdevR3HgcmRemoveCommand(PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd)
+{
+    int rc = vmmdevR3HgcmCmdListLock(pThisCC);
     AssertRCReturn(rc, rc);
 
@@ -435 +438 @@
     RTListNodeRemove(&pCmd->node);
 
-    vmmdevHGCMCmdListUnlock(pThis);
+    vmmdevR3HgcmCmdListUnlock(pThisCC);
     return rc;
 }
@@ -449 +452 @@
  * @param   GCPhys          The physical address of the command we're looking for.
  */
-DECLINLINE(PVBOXHGCMCMD) vmmdevHGCMFindCommandLocked(PVMMDEV pThis, RTGCPHYS GCPhys)
+DECLINLINE(PVBOXHGCMCMD) vmmdevR3HgcmFindCommandLocked(PVMMDEVCC pThisCC, RTGCPHYS GCPhys)
 {
     PVBOXHGCMCMD pCmd;
-    RTListForEach(&pThis->listHGCMCmd, pCmd, VBOXHGCMCMD, node)
+    RTListForEach(&pThisCC->listHGCMCmd, pCmd, VBOXHGCMCMD, node)
     {
         if (pCmd->GCPhys == GCPhys)
@@ -465 +468 @@
  * @param   pCmd            Destination command.
  */
-static void vmmdevHGCMConnectFetch(const VMMDevHGCMConnect *pHGCMConnect, PVBOXHGCMCMD pCmd)
+static void vmmdevR3HgcmConnectFetch(const VMMDevHGCMConnect *pHGCMConnect, PVBOXHGCMCMD pCmd)
 {
     pCmd->enmRequestType        = pHGCMConnect->header.header.requestType;
@@ -474 +477 @@
 /** Handle VMMDevHGCMConnect request.
  *
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pHGCMConnect    The guest request (cached in host memory).
  * @param   GCPhys          The physical address of the request.
  */
-int vmmdevHGCMConnect(PVMMDEV pThis, const VMMDevHGCMConnect *pHGCMConnect, RTGCPHYS GCPhys)
-{
-    int rc = VINF_SUCCESS;
-
-    PVBOXHGCMCMD pCmd = vmmdevHGCMCmdAlloc(pThis, VBOXHGCMCMDTYPE_CONNECT, GCPhys, pHGCMConnect->header.header.size, 0,
-                                           pHGCMConnect->header.header.fRequestor);
+int vmmdevR3HgcmConnect(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
+                        const VMMDevHGCMConnect *pHGCMConnect, RTGCPHYS GCPhys)
+{
+    int rc;
+    PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_CONNECT, GCPhys, pHGCMConnect->header.header.size, 0,
+                                             pHGCMConnect->header.header.fRequestor);
     if (pCmd)
     {
-        vmmdevHGCMConnectFetch(pHGCMConnect, pCmd);
+        vmmdevR3HgcmConnectFetch(pHGCMConnect, pCmd);
 
         /* Only allow the guest to use existing services! */
@@ -492 +497 @@
         pCmd->u.connect.pLoc->type = VMMDevHGCMLoc_LocalHost_Existing;
 
-        vmmdevHGCMAddCommand(pThis, pCmd);
-        rc = pThis->pHGCMDrv->pfnConnect(pThis->pHGCMDrv, pCmd, pCmd->u.connect.pLoc, &pCmd->u.connect.u32ClientID);
+        vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
+        rc = pThisCC->pHGCMDrv->pfnConnect(pThisCC->pHGCMDrv, pCmd, pCmd->u.connect.pLoc, &pCmd->u.connect.u32ClientID);
         if (RT_FAILURE(rc))
-            vmmdevHGCMRemoveCommand(pThis, pCmd);
+            vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
     }
     else
-    {
         rc = VERR_NO_MEMORY;
-    }
 
     return rc;
@@ -510 +513 @@
  * @param   pCmd            Destination command.
  */
-static void vmmdevHGCMDisconnectFetch(const VMMDevHGCMDisconnect *pHGCMDisconnect, PVBOXHGCMCMD pCmd)
+static void vmmdevR3HgcmDisconnectFetch(const VMMDevHGCMDisconnect *pHGCMDisconnect, PVBOXHGCMCMD pCmd)
 {
     pCmd->enmRequestType = pHGCMDisconnect->header.header.requestType;
@@ -518 +521 @@
 /** Handle VMMDevHGCMDisconnect request.
  *
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pHGCMDisconnect The guest request (cached in host memory).
  * @param   GCPhys          The physical address of the request.
  */
-int vmmdevHGCMDisconnect(PVMMDEV pThis, const VMMDevHGCMDisconnect *pHGCMDisconnect, RTGCPHYS GCPhys)
-{
-    int rc = VINF_SUCCESS;
-
-    PVBOXHGCMCMD pCmd = vmmdevHGCMCmdAlloc(pThis, VBOXHGCMCMDTYPE_DISCONNECT, GCPhys, pHGCMDisconnect->header.header.size, 0,
-                                           pHGCMDisconnect->header.header.fRequestor);
+int vmmdevR3HgcmDisconnect(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
+                           const VMMDevHGCMDisconnect *pHGCMDisconnect, RTGCPHYS GCPhys)
+{
+    int rc;
+    PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_DISCONNECT, GCPhys, pHGCMDisconnect->header.header.size, 0,
+                                             pHGCMDisconnect->header.header.fRequestor);
     if (pCmd)
     {
-        vmmdevHGCMDisconnectFetch(pHGCMDisconnect, pCmd);
-
-        vmmdevHGCMAddCommand(pThis, pCmd);
-        rc = pThis->pHGCMDrv->pfnDisconnect (pThis->pHGCMDrv, pCmd, pCmd->u.disconnect.u32ClientID);
+        vmmdevR3HgcmDisconnectFetch(pHGCMDisconnect, pCmd);
+
+        vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
+        rc = pThisCC->pHGCMDrv->pfnDisconnect(pThisCC->pHGCMDrv, pCmd, pCmd->u.disconnect.u32ClientID);
         if (RT_FAILURE(rc))
-            vmmdevHGCMRemoveCommand(pThis, pCmd);
+            vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
     }
     else
@@ -548 +553 @@
  * @param   enmType         Type of the LinAddr parameter.
  */
-static uint32_t vmmdevHGCMParmTypeToDirection(HGCMFunctionParameterType enmType)
+static uint32_t vmmdevR3HgcmParmTypeToDirection(HGCMFunctionParameterType enmType)
 {
     if (enmType == VMMDevHGCMParmType_LinAddr_In)  return VBOX_HGCM_F_PARM_DIRECTION_TO_HOST;
@@ -560 +565 @@
  * @param   pPtr            Information about a pointer HGCM parameter.
  */
-DECLINLINE(bool) vmmdevHGCMGuestBufferIsContiguous(const VBOXHGCMPARMPTR *pPtr)
+DECLINLINE(bool) vmmdevR3HgcmGuestBufferIsContiguous(const VBOXHGCMPARMPTR *pPtr)
 {
     if (pPtr->cPages == 1)
@@ -589 +594 @@
  * @param   pPtr            Description of the source HGCM pointer parameter.
  */
-static int vmmdevHGCMGuestBufferRead(PPDMDEVINSR3 pDevIns, void *pvDst, uint32_t cbDst,
-                                     const VBOXHGCMPARMPTR *pPtr)
+static int vmmdevR3HgcmGuestBufferRead(PPDMDEVINSR3 pDevIns, void *pvDst, uint32_t cbDst, const VBOXHGCMPARMPTR *pPtr)
 {
     /*
@@ -596 +600 @@
      */
     /** @todo We need a flag for indicating this. */
-    if (vmmdevHGCMGuestBufferIsContiguous(pPtr))
+    if (vmmdevR3HgcmGuestBufferIsContiguous(pPtr))
         return PDMDevHlpPhysRead(pDevIns, pPtr->paPages[0] | pPtr->offFirstPage, pvDst, cbDst);
 
@@ -636 +640 @@
  * @param   cbSrc           Size of the source host buffer.
  */
-static int vmmdevHGCMGuestBufferWrite(PPDMDEVINSR3 pDevIns, const VBOXHGCMPARMPTR *pPtr,
-                                      const void *pvSrc,  uint32_t cbSrc)
+static int vmmdevR3HgcmGuestBufferWrite(PPDMDEVINSR3 pDevIns, const VBOXHGCMPARMPTR *pPtr, const void *pvSrc,  uint32_t cbSrc)
 {
     int rc = VINF_SUCCESS;
@@ -672 +675 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
  * @param   pCmd            Command structure where host parameters needs initialization.
  * @param   pbReq           The request buffer.
  */
-static int vmmdevHGCMInitHostParameters(PVMMDEV pThis, PVBOXHGCMCMD pCmd, uint8_t const *pbReq)
+static int vmmdevR3HgcmInitHostParameters(PPDMDEVINS pDevIns, PVBOXHGCMCMD pCmd, uint8_t const *pbReq)
 {
     AssertReturn(pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL, VERR_INTERNAL_ERROR);
@@ -729 +732 @@
                             if (pGuestParm->enmType != VMMDevHGCMParmType_ContiguousPageList)
                             {
-                                int rc = vmmdevHGCMGuestBufferRead(pThis->pDevInsR3, pv, cbData, &pGuestParm->u.ptr);
+                                int rc = vmmdevR3HgcmGuestBufferRead(pDevIns, pv, cbData, &pGuestParm->u.ptr);
                                 ASSERT_GUEST_RETURN(RT_SUCCESS(rc), rc);
                                 RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
@@ -735 +738 @@
                             else
                             {
-                                int rc = PDMDevHlpPhysRead(pThis->pDevInsR3,
+                                int rc = PDMDevHlpPhysRead(pDevIns,
                                                            pGuestParm->u.ptr.paPages[0] | pGuestParm->u.ptr.offFirstPage,
                                                            pv, cbData);
@@ -779 +782 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pHGCMCall       The HGCMCall request (cached in host memory).
  * @param   cbHGCMCall      Size of the request.
@@ -787 +790 @@
  * @param   pcbHGCMParmStruct Where to store size of used HGCM parameter structure.
  */
-static int vmmdevHGCMCallAlloc(PVMMDEV pThis, const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall, RTGCPHYS GCPhys,
-                               VMMDevRequestType enmRequestType, PVBOXHGCMCMD *ppCmd, uint32_t *pcbHGCMParmStruct)
+static int vmmdevR3HgcmCallAlloc(PVMMDEVCC pThisCC, const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall, RTGCPHYS GCPhys,
+                                 VMMDevRequestType enmRequestType, PVBOXHGCMCMD *ppCmd, uint32_t *pcbHGCMParmStruct)
 {
 #ifdef VBOX_WITH_64_BITS_GUESTS
@@ -807 +810 @@
     RT_UNTRUSTED_VALIDATED_FENCE();
 
-    PVBOXHGCMCMD pCmd = vmmdevHGCMCmdAlloc(pThis, VBOXHGCMCMDTYPE_CALL, GCPhys, cbHGCMCall, cParms,
-                                           pHGCMCall->header.header.fRequestor);
+    PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_CALL, GCPhys, cbHGCMCall, cParms,
+                                             pHGCMCall->header.header.fRequestor);
     if (pCmd == NULL)
         return VERR_NO_MEMORY;
@@ -825 +828 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pCmd            The destination command.
  * @param   pHGCMCall       The HGCMCall request (cached in host memory).
@@ -832 +836 @@
  * @param   cbHGCMParmStruct Size of used HGCM parameter structure.
  */
-static int vmmdevHGCMCallFetchGuestParms(PVMMDEV pThis, PVBOXHGCMCMD pCmd,
-                                         const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall,
-                                         VMMDevRequestType enmRequestType, uint32_t cbHGCMParmStruct)
+static int vmmdevR3HgcmCallFetchGuestParms(PPDMDEVINS pDevIns, PVMMDEVCC pThisCC, PVBOXHGCMCMD pCmd,
+                                           const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall,
+                                           VMMDevRequestType enmRequestType, uint32_t cbHGCMParmStruct)
 {
     /*
@@ -926 +930 @@
                 pGuestParm->u.ptr.offFirstPage  = offFirstPage;
                 pGuestParm->u.ptr.cPages        = cPages;
-                pGuestParm->u.ptr.fu32Direction = vmmdevHGCMParmTypeToDirection(pGuestParm->enmType);
+                pGuestParm->u.ptr.fu32Direction = vmmdevR3HgcmParmTypeToDirection(pGuestParm->enmType);
 
                 if (cbData > 0)
@@ -948 +952 @@
                          */
                         RTGCPHYS GCPhys;
-                        int rc2 = PDMDevHlpPhysGCPtr2GCPhys(pThis->pDevInsR3, GCPtr, &GCPhys);
+                        int rc2 = PDMDevHlpPhysGCPtr2GCPhys(pDevIns, GCPtr, &GCPhys);
                         if (RT_FAILURE(rc2))
                             GCPhys = NIL_RTGCPHYS;
@@ -1046 +1050 @@
                     void **papvPages = (void **)&pGuestParm->u.Pages.paPgLocks[cPages];
                     if (pPageListInfo->flags & VBOX_HGCM_F_PARM_DIRECTION_FROM_HOST)
-                        rc = PDMDevHlpPhysBulkGCPhys2CCPtr(pThis->pDevInsR3, cPages, pPageListInfo->aPages, 0 /*fFlags*/,
+                        rc = PDMDevHlpPhysBulkGCPhys2CCPtr(pDevIns, cPages, pPageListInfo->aPages, 0 /*fFlags*/,
                                                            papvPages, pGuestParm->u.Pages.paPgLocks);
                     else
-                        rc = PDMDevHlpPhysBulkGCPhys2CCPtrReadOnly(pThis->pDevInsR3, cPages, pPageListInfo->aPages, 0 /*fFlags*/,
+                        rc = PDMDevHlpPhysBulkGCPhys2CCPtrReadOnly(pDevIns, cPages, pPageListInfo->aPages, 0 /*fFlags*/,
                                                                    (void const **)papvPages, pGuestParm->u.Pages.paPgLocks);
                     if (RT_SUCCESS(rc))
@@ -1061 +1065 @@
                     RTMemFree(pGuestParm->u.Pages.paPgLocks);
                     pGuestParm->u.Pages.paPgLocks = NULL;
-                    STAM_REL_COUNTER_INC(&pThis->StatHgcmFailedPageListLocking);
+                    STAM_REL_COUNTER_INC(&pThisCC->StatHgcmFailedPageListLocking);
                     ASSERT_GUEST_MSG_RETURN(rc == VERR_PGM_PHYS_PAGE_RESERVED, ("cPages=%u %Rrc\n", cPages, rc), rc);
                     pGuestParm->enmType = VMMDevHGCMParmType_PageList;
@@ -1137 +1141 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pHGCMCall       The request to handle (cached in host memory).
  * @param   cbHGCMCall      Size of the entire request (including HGCM parameters).
@@ -1146 +1152 @@
  *                          NULL).  Set to NULL if HGCM takes lock ownership.
  */
-int vmmdevHGCMCall(PVMMDEV pThis, const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall, RTGCPHYS GCPhys,
-                   VMMDevRequestType enmRequestType, uint64_t tsArrival, PVMMDEVREQLOCK *ppLock)
+int vmmdevR3HgcmCall(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall,
+                     RTGCPHYS GCPhys, VMMDevRequestType enmRequestType, uint64_t tsArrival, PVMMDEVREQLOCK *ppLock)
 {
     LogFunc(("client id = %d, function = %d, cParms = %d, enmRequestType = %d, fRequestor = %#x\n", pHGCMCall->u32ClientID,
@@ -1169 +1175 @@
     PVBOXHGCMCMD pCmd;
     uint32_t cbHGCMParmStruct;
-    int rc = vmmdevHGCMCallAlloc(pThis, pHGCMCall, cbHGCMCall, GCPhys, enmRequestType, &pCmd, &cbHGCMParmStruct);
+    int rc = vmmdevR3HgcmCallAlloc(pThisCC, pHGCMCall, cbHGCMCall, GCPhys, enmRequestType, &pCmd, &cbHGCMParmStruct);
     if (RT_SUCCESS(rc))
     {
@@ -1181 +1187 @@
         }
 
-        rc = vmmdevHGCMCallFetchGuestParms(pThis, pCmd, pHGCMCall, cbHGCMCall, enmRequestType, cbHGCMParmStruct);
+        rc = vmmdevR3HgcmCallFetchGuestParms(pDevIns, pThisCC, pCmd, pHGCMCall, cbHGCMCall, enmRequestType, cbHGCMParmStruct);
         if (RT_SUCCESS(rc))
         {
             /* Copy guest data to host parameters, so HGCM services can use the data. */
-            rc = vmmdevHGCMInitHostParameters(pThis, pCmd, (uint8_t const *)pHGCMCall);
+            rc = vmmdevR3HgcmInitHostParameters(pDevIns, pCmd, (uint8_t const *)pHGCMCall);
             if (RT_SUCCESS(rc))
             {
@@ -1191 +1197 @@
                  * Pass the function call to HGCM connector for actual processing
                  */
-                vmmdevHGCMAddCommand(pThis, pCmd);
+                vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
 
 #if 0 /* DONT ENABLE - for performance hacking. */
@@ -1197 +1203 @@
                     &&  pCmd->u.call.cParms      == 5)
                 {
-                    vmmdevHGCMRemoveCommand(pThis, pCmd);
+                    vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
 
                     if (pCmd->pvReqLocked)
@@ -1212 +1218 @@
                         pHeader->result    = VINF_SUCCESS;
                         pHeader->fu32Flags |= VBOX_HGCM_REQ_DONE;
-                        PDMDevHlpPhysWrite(pThis->pDevInsR3, GCPhys, pHeader,  sizeof(*pHeader));
+                        PDMDevHlpPhysWrite(pDevIns, GCPhys, pHeader,  sizeof(*pHeader));
                     }
-                    vmmdevHGCMCmdFree(pThis, pCmd);
+                    vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
                     return VINF_HGCM_ASYNC_EXECUTE; /* ignored, but avoids assertions. */
                 }
 #endif
 
-                rc = pThis->pHGCMDrv->pfnCall(pThis->pHGCMDrv, pCmd,
-                                              pCmd->u.call.u32ClientID, pCmd->u.call.u32Function,
-                                              pCmd->u.call.cParms, pCmd->u.call.paHostParms, tsArrival);
+                rc = pThisCC->pHGCMDrv->pfnCall(pThisCC->pHGCMDrv, pCmd,
+                                                pCmd->u.call.u32ClientID, pCmd->u.call.u32Function,
+                                                pCmd->u.call.cParms, pCmd->u.call.paHostParms, tsArrival);
 
                 if (rc == VINF_HGCM_ASYNC_EXECUTE)
@@ -1231 +1237 @@
                     uint64_t tsNow;
                     STAM_GET_TS(tsNow);
-                    STAM_REL_PROFILE_ADD_PERIOD(&pThis->StatHgcmCmdArrival, tsNow - tsArrival);
+                    STAM_REL_PROFILE_ADD_PERIOD(&pThisCC->StatHgcmCmdArrival, tsNow - tsArrival);
 #endif
                     return rc;
@@ -1240 +1246 @@
                  */
                 LogFunc(("pfnCall rc = %Rrc\n", rc));
-                vmmdevHGCMRemoveCommand(pThis, pCmd);
+                vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
             }
         }
-        vmmdevHGCMCmdFree(pThis, pCmd);
+        vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
     }
     return rc;
@@ -1252 +1258 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pHGCMCancel     The request to handle (cached in host memory).
  * @param   GCPhys          The address of the request.
@@ -1258 +1264 @@
  * @thread EMT
  */
-int vmmdevHGCMCancel(PVMMDEV pThis, const VMMDevHGCMCancel *pHGCMCancel, RTGCPHYS GCPhys)
+int vmmdevR3HgcmCancel(PVMMDEVCC pThisCC, const VMMDevHGCMCancel *pHGCMCancel, RTGCPHYS GCPhys)
 {
     NOREF(pHGCMCancel);
-    int rc = vmmdevHGCMCancel2(pThis, GCPhys);
+    int rc = vmmdevR3HgcmCancel2(pThisCC, GCPhys);
     return rc == VERR_NOT_FOUND ? VERR_INVALID_PARAMETER : rc;
 }
@@ -1272 +1278 @@
  * @retval  VERR_INVALID_PARAMETER if the request address is invalid.
  *
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   GCPhys          The address of the request that should be cancelled.
  *
  * @thread EMT
  */
-int vmmdevHGCMCancel2(PVMMDEV pThis, RTGCPHYS GCPhys)
+int vmmdevR3HgcmCancel2(PVMMDEVCC pThisCC, RTGCPHYS GCPhys)
 {
     if (    GCPhys == 0
@@ -1283 +1289 @@
         ||  GCPhys == NIL_RTGCPHYS32)
     {
-        Log(("vmmdevHGCMCancel2: GCPhys=%#x\n", GCPhys));
+        Log(("vmmdevR3HgcmCancel2: GCPhys=%#x\n", GCPhys));
         return VERR_INVALID_PARAMETER;
     }
@@ -1291 +1297 @@
      * the lock. hgcmCompletedWorker makes assumptions about this.
      */
-    int rc = vmmdevHGCMCmdListLock(pThis);
+    int rc = vmmdevR3HgcmCmdListLock(pThisCC);
     AssertRCReturn(rc, rc);
 
-    PVBOXHGCMCMD pCmd = vmmdevHGCMFindCommandLocked(pThis, GCPhys);
+    PVBOXHGCMCMD pCmd = vmmdevR3HgcmFindCommandLocked(pThisCC, GCPhys);
     if (pCmd)
     {
         pCmd->fCancelled = true;
 
-        Log(("vmmdevHGCMCancel2: Cancelled pCmd=%p / GCPhys=%#x\n", pCmd, GCPhys));
-        if (pThis->pHGCMDrv)
-            pThis->pHGCMDrv->pfnCancelled(pThis->pHGCMDrv, pCmd,
-                                          pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL ? pCmd->u.call.u32ClientID
-                                          : pCmd->enmCmdType == VBOXHGCMCMDTYPE_CONNECT ? pCmd->u.connect.u32ClientID
-                                          : pCmd->enmCmdType == VBOXHGCMCMDTYPE_DISCONNECT ? pCmd->u.disconnect.u32ClientID
-                                          : 0);
+        Log(("vmmdevR3HgcmCancel2: Cancelled pCmd=%p / GCPhys=%#x\n", pCmd, GCPhys));
+        if (pThisCC->pHGCMDrv)
+            pThisCC->pHGCMDrv->pfnCancelled(pThisCC->pHGCMDrv, pCmd,
+                                            pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL ? pCmd->u.call.u32ClientID
+                                            : pCmd->enmCmdType == VBOXHGCMCMDTYPE_CONNECT ? pCmd->u.connect.u32ClientID
+                                            : pCmd->enmCmdType == VBOXHGCMCMDTYPE_DISCONNECT ? pCmd->u.disconnect.u32ClientID
+                                            : 0);
     }
     else
         rc = VERR_NOT_FOUND;
 
-    vmmdevHGCMCmdListUnlock(pThis);
+    vmmdevR3HgcmCmdListUnlock(pThisCC);
     return rc;
 }
@@ -1317 +1323 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
  * @param   pCmd            Completed call command.
  * @param   pHGCMCall       The guestrequest which needs updating (cached in the host memory).
@@ -1323 +1329 @@
  *                          embedded buffers.
  */
-static int vmmdevHGCMCompleteCallRequest(PVMMDEV pThis, PVBOXHGCMCMD pCmd, VMMDevHGCMCall *pHGCMCall, uint8_t *pbReq)
+static int vmmdevR3HgcmCompleteCallRequest(PPDMDEVINS pDevIns, PVBOXHGCMCMD pCmd, VMMDevHGCMCall *pHGCMCall, uint8_t *pbReq)
 {
     AssertReturn(pCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL, VERR_INTERNAL_ERROR);
@@ -1376 +1382 @@
                     const void *pvSrc = pHostParm->u.pointer.addr;
                     uint32_t cbSrc = pHostParm->u.pointer.size;
-                    int rc = vmmdevHGCMGuestBufferWrite(pThis->pDevInsR3, pPtr, pvSrc, cbSrc);
+                    int rc = vmmdevR3HgcmGuestBufferWrite(pDevIns, pPtr, pvSrc, cbSrc);
                     if (RT_FAILURE(rc))
                         break;
@@ -1422 +1428 @@
                     uint32_t    cbSrc    = pHostParm->u.pointer.size;
                     uint32_t    cbToCopy = RT_MIN(cbSrc, pPtr->cbData);
-                    int rc = PDMDevHlpPhysWrite(pThis->pDevInsR3, pGuestParm->u.ptr.paPages[0] | pGuestParm->u.ptr.offFirstPage,
+                    int rc = PDMDevHlpPhysWrite(pDevIns, pGuestParm->u.ptr.paPages[0] | pGuestParm->u.ptr.offFirstPage,
                                                 pvSrc, cbToCopy);
                     if (RT_FAILURE(rc))
@@ -1441 +1447 @@
                 if (pGuestParm->u.Pages.fLocked)
                 {
-                    PDMDevHlpPhysBulkReleasePageMappingLocks(pThis->pDevInsR3, pGuestParm->u.Pages.cPages,
+                    PDMDevHlpPhysBulkReleasePageMappingLocks(pDevIns, pGuestParm->u.Pages.cPages,
                                                              pGuestParm->u.Pages.paPgLocks);
                     pGuestParm->u.Pages.fLocked = false;
@@ -1467 +1473 @@
 static int hgcmCompletedWorker(PPDMIHGCMPORT pInterface, int32_t result, PVBOXHGCMCMD pCmd)
 {
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IHGCMPort);
+    PVMMDEVCC  pThisCC    = RT_FROM_MEMBER(pInterface, VMMDEVCC, IHGCMPort);
+    PPDMDEVINS pDevIns    = pThisCC->pDevIns;
+    PVMMDEV    pThis      = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
 #ifdef VBOX_WITH_DTRACE
-    uint32_t idFunction = 0;
-    uint32_t idClient   = 0;
+    uint32_t   idFunction = 0;
+    uint32_t   idClient   = 0;
 #endif
 
@@ -1481 +1489 @@
          * It it assumed that VMMDev saves state after the HGCM services (VMMDev driver
          * attached by constructor before it registers its SSM state), and, therefore,
-         * VBOXHGCMCMD structures are not removed by vmmdevHGCMSaveState from the list,
+         * VBOXHGCMCMD structures are not removed by vmmdevR3HgcmSaveState from the list,
          * while HGCM uses them.
          */
@@ -1497 +1505 @@
      * back to guest memory.
      */
-    vmmdevHGCMRemoveCommand(pThis, pCmd);
+    vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
 
     if (RT_LIKELY(!pCmd->fCancelled))
@@ -1513 +1521 @@
                  * The request data is not be used for anything but checking the request type.
                  */
-                PDMDevHlpPhysRead(pThis->pDevInsR3, pCmd->GCPhys, pHeader, pCmd->cbRequest);
+                PDMDevHlpPhysRead(pDevIns, pCmd->GCPhys, pHeader, pCmd->cbRequest);
                 RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
 
@@ -1534 +1542 @@
                         {
                             VMMDevHGCMCall *pHGCMCall = (VMMDevHGCMCall *)pHeader;
-                            rc = vmmdevHGCMCompleteCallRequest(pThis, pCmd, pHGCMCall, (uint8_t *)pHeader);
+                            rc = vmmdevR3HgcmCompleteCallRequest(pDevIns, pCmd, pHGCMCall, (uint8_t *)pHeader);
 #ifdef VBOX_WITH_DTRACE
                             idFunction = pCmd->u.call.u32Function;
@@ -1571 +1579 @@
 
                 /* First write back the request. */
-                PDMDevHlpPhysWrite(pThis->pDevInsR3, pCmd->GCPhys, pHeader, pCmd->cbRequest);
+                PDMDevHlpPhysWrite(pDevIns, pCmd->GCPhys, pHeader, pCmd->cbRequest);
 
                 /* Mark request as processed. */
@@ -1577 +1585 @@
 
                 /* Second write the flags to mark the request as processed. */
-                PDMDevHlpPhysWrite(pThis->pDevInsR3, pCmd->GCPhys + RT_UOFFSETOF(VMMDevHGCMRequestHeader, fu32Flags),
+                PDMDevHlpPhysWrite(pDevIns, pCmd->GCPhys + RT_UOFFSETOF(VMMDevHGCMRequestHeader, fu32Flags),
                                    &pHeader->fu32Flags, sizeof(pHeader->fu32Flags));
 
                 /* Now, when the command was removed from the internal list, notify the guest. */
-                VMMDevNotifyGuest(pThis, VMMDEV_EVENT_HGCM);
+                VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_HGCM);
 
                 RTMemFree(pHeader);
@@ -1615 +1623 @@
                     {
                         VMMDevHGCMCall *pHGCMCall = (VMMDevHGCMCall *)pHeader;
-                        rc = vmmdevHGCMCompleteCallRequest(pThis, pCmd, pHGCMCall, (uint8_t *)pHeader);
+                        rc = vmmdevR3HgcmCompleteCallRequest(pDevIns, pCmd, pHGCMCall, (uint8_t *)pHeader);
 #ifdef VBOX_WITH_DTRACE
                         idFunction = pCmd->u.call.u32Function;
@@ -1655 +1663 @@
 
             /* Now, when the command was removed from the internal list, notify the guest. */
-            VMMDevNotifyGuest(pThis, VMMDEV_EVENT_HGCM);
+            VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_HGCM);
         }
 
         /* Set the status to success for now, though we might consider passing
-           along the vmmdevHGCMCompleteCallRequest errors... */
+           along the vmmdevR3HgcmCompleteCallRequest errors... */
         rc = VINF_SUCCESS;
     }
@@ -1676 +1684 @@
     /* Deallocate the command memory. */
     VBOXDD_HGCMCALL_COMPLETED_DONE(pCmd, idFunction, idClient, result);
-    vmmdevHGCMCmdFree(pThis, pCmd);
+    vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
 
 #ifndef VBOX_WITHOUT_RELEASE_STATISTICS
@@ -1682 +1690 @@
     uint64_t tsNow;
     STAM_GET_TS(tsNow);
-    STAM_REL_PROFILE_ADD_PERIOD(&pThis->StatHgcmCmdCompletion, tsNow - tsComplete);
+    STAM_REL_PROFILE_ADD_PERIOD(&pThisCC->StatHgcmCmdCompletion, tsNow - tsComplete);
     if (tsArrival != 0)
-        STAM_REL_PROFILE_ADD_PERIOD(&pThis->StatHgcmCmdTotal,  tsNow - tsArrival);
+        STAM_REL_PROFILE_ADD_PERIOD(&pThisCC->StatHgcmCmdTotal,  tsNow - tsArrival);
 #endif
 
@@ -1698 +1706 @@
  * @param   pCmd            Completed command, which contains updated host parameters.
  */
-DECLCALLBACK(int) hgcmCompleted(PPDMIHGCMPORT pInterface, int32_t result, PVBOXHGCMCMD pCmd)
+DECLCALLBACK(int) hgcmR3Completed(PPDMIHGCMPORT pInterface, int32_t result, PVBOXHGCMCMD pCmd)
 {
 #if 0 /* This seems to be significantly slower.  Half of MsgTotal time seems to be spend here. */
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDevState, IHGCMPort);
+    PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IHGCMPort);
     STAM_GET_TS(pCmd->tsComplete);
 
@@ -1709 +1717 @@
  *        efficient...? */
     /* Not safe to execute asynchronously; forward to EMT */
-    int rc = VMR3ReqCallVoidNoWait(PDMDevHlpGetVM(pThis->pDevInsR3), VMCPUID_ANY,
+    int rc = VMR3ReqCallVoidNoWait(PDMDevHlpGetVM(pDevIns), VMCPUID_ANY,
                                    (PFNRT)hgcmCompletedWorker, 3, pInterface, result, pCmd);
     AssertRC(rc);
@@ -1723 +1731 @@
  * @interface_method_impl{PDMIHGCMPORT,pfnIsCmdRestored}
  */
-DECLCALLBACK(bool) hgcmIsCmdRestored(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd)
+DECLCALLBACK(bool) hgcmR3IsCmdRestored(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd)
 {
     RT_NOREF(pInterface);
@@ -1732 +1740 @@
  * @interface_method_impl{PDMIHGCMPORT,pfnIsCmdCancelled}
  */
-DECLCALLBACK(bool) hgcmIsCmdCancelled(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd)
+DECLCALLBACK(bool) hgcmR3IsCmdCancelled(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd)
 {
     RT_NOREF(pInterface);
@@ -1741 +1749 @@
  * @interface_method_impl{PDMIHGCMPORT,pfnGetRequestor}
  */
-DECLCALLBACK(uint32_t) hgcmGetRequestor(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd)
-{
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IHGCMPort);
+DECLCALLBACK(uint32_t) hgcmR3GetRequestor(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd)
+{
+    PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IHGCMPort);
+    PVMMDEV   pThis   = PDMDEVINS_2_DATA(pThisCC->pDevIns, PVMMDEV);
     AssertPtrReturn(pCmd, VMMDEV_REQUESTOR_LOWEST);
     if (pThis->guestInfo2.fFeatures & VBOXGSTINFO2_F_REQUESTOR_INFO)
@@ -1753 +1762 @@
  * @interface_method_impl{PDMIHGCMPORT,pfnGetVMMDevSessionId}
  */
-DECLCALLBACK(uint64_t) hgcmGetVMMDevSessionId(PPDMIHGCMPORT pInterface)
-{
-    PVMMDEV pThis = RT_FROM_MEMBER(pInterface, VMMDEV, IHGCMPort);
+DECLCALLBACK(uint64_t) hgcmR3GetVMMDevSessionId(PPDMIHGCMPORT pInterface)
+{
+    PVMMDEVCC pThisCC = RT_FROM_MEMBER(pInterface, VMMDEVCC, IHGCMPort);
+    PVMMDEV   pThis   = PDMDEVINS_2_DATA(pThisCC->pDevIns, PVMMDEV);
     return pThis->idSession;
 }
 
-/** Save information about pending HGCM requests from pThis->listHGCMCmd.
+/** Save information about pending HGCM requests from pThisCC->listHGCMCmd.
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pSSM            SSM handle for SSM functions.
  *
  * @thread EMT
  */
-int vmmdevHGCMSaveState(PVMMDEV pThis, PSSMHANDLE pSSM)
+int vmmdevR3HgcmSaveState(PVMMDEVCC pThisCC, PSSMHANDLE pSSM)
 {
     LogFlowFunc(("\n"));
@@ -1774 +1784 @@
     uint32_t cCmds = 0;
     PVBOXHGCMCMD pCmd;
-    RTListForEach(&pThis->listHGCMCmd, pCmd, VBOXHGCMCMD, node)
+    RTListForEach(&pThisCC->listHGCMCmd, pCmd, VBOXHGCMCMD, node)
     {
         LogFlowFunc(("pCmd %p\n", pCmd));
@@ -1787 +1797 @@
     if (cCmds > 0)
     {
-        RTListForEach(&pThis->listHGCMCmd, pCmd, VBOXHGCMCMD, node)
+        RTListForEach(&pThisCC->listHGCMCmd, pCmd, VBOXHGCMCMD, node)
         {
             LogFlowFunc(("Saving %RGp, size %d\n", pCmd->GCPhys, pCmd->cbRequest));
@@ -1884 +1894 @@
 /** Load information about pending HGCM requests.
  *
- * Allocate VBOXHGCMCMD commands and add them to pThis->listHGCMCmd temporarily.
- * vmmdevHGCMLoadStateDone will process the temporary list.  This includes
- * loading the correct fRequestor fields.
+ * Allocate VBOXHGCMCMD commands and add them to pThisCC->listHGCMCmd
+ * temporarily. vmmdevR3HgcmLoadStateDone will process the temporary list.  This
+ * includes loading the correct fRequestor fields.
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  * @param   pSSM            SSM handle for SSM functions.
  * @param   uVersion        Saved state version.
@@ -1895 +1907 @@
  * @thread EMT
  */
-int vmmdevHGCMLoadState(PVMMDEV pThis, PSSMHANDLE pSSM, uint32_t uVersion)
+int vmmdevR3HgcmLoadState(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, PSSMHANDLE pSSM, uint32_t uVersion)
 {
     LogFlowFunc(("\n"));
 
-    pThis->u32SSMVersion = uVersion; /* For vmmdevHGCMLoadStateDone */
+    pThisCC->uSavedStateVersion = uVersion; /* For vmmdevR3HgcmLoadStateDone */
 
     /* Read how many commands were pending. */
@@ -1934 +1946 @@
             AssertRCReturn(rc, rc);
 
-            PVBOXHGCMCMD pCmd = vmmdevHGCMCmdAlloc(pThis, enmCmdType, GCPhys, cbRequest, cParms, 0 /*fRequestor*/);
+            PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, enmCmdType, GCPhys, cbRequest, cParms, 0 /*fRequestor*/);
             AssertReturn(pCmd, VERR_NO_MEMORY);
 
@@ -2041 +2053 @@
             /* See current version above. */
             if (!fCancelled)
-                vmmdevHGCMAddCommand(pThis, pCmd);
+                vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
             else
             {
-                Log(("vmmdevHGCMLoadState: Skipping cancelled request: enmCmdType=%d GCPhys=%#RX32 LB %#x\n",
+                Log(("vmmdevR3HgcmLoadState: Skipping cancelled request: enmCmdType=%d GCPhys=%#RX32 LB %#x\n",
                      enmCmdType, GCPhys, cbRequest));
-                vmmdevHGCMCmdFree(pThis, pCmd);
+                vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
             }
         }
@@ -2075 +2087 @@
 
             /* For uVersion <= 12, this was the size of entire command.
-             * Now the command is reconstructed in vmmdevHGCMLoadStateDone.
+             * Now the command is reconstructed in vmmdevR3HgcmLoadStateDone.
              */
             if (uVersion <= 12)
@@ -2087 +2099 @@
             AssertRCReturn(rc, rc);
 
-            PVBOXHGCMCMD pCmd = vmmdevHGCMCmdAlloc(pThis, enmCmdType, GCPhys, cbRequest, cLinAddrs, 0 /*fRequestor*/);
+            PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, enmCmdType, GCPhys, cbRequest, cLinAddrs, 0 /*fRequestor*/);
             AssertReturn(pCmd, VERR_NO_MEMORY);
 
@@ -2125 +2137 @@
             /* See current version above. */
             if (!fCancelled)
-                vmmdevHGCMAddCommand(pThis, pCmd);
+                vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
             else
             {
-                Log(("vmmdevHGCMLoadState: Skipping cancelled request: enmCmdType=%d GCPhys=%#RX32 LB %#x\n",
+                Log(("vmmdevR3HgcmLoadState: Skipping cancelled request: enmCmdType=%d GCPhys=%#RX32 LB %#x\n",
                      enmCmdType, GCPhys, cbRequest));
-                vmmdevHGCMCmdFree(pThis, pCmd);
+                vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
             }
         }
@@ -2153 +2165 @@
             LogFlowFunc(("Restoring %RGp size %x bytes\n", GCPhys, cbRequest));
 
-            PVBOXHGCMCMD pCmd = vmmdevHGCMCmdAlloc(pThis, VBOXHGCMCMDTYPE_LOADSTATE, GCPhys, cbRequest, 0, 0 /*fRequestor*/);
+            PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_LOADSTATE, GCPhys, cbRequest, 0, 0 /*fRequestor*/);
             AssertReturn(pCmd, VERR_NO_MEMORY);
 
-            vmmdevHGCMAddCommand(pThis, pCmd);
+            vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
         }
     }
@@ -2166 +2178 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
- * @param   u32SSMVersion   The saved state version the command has been loaded from.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
+ * @param   uSavedStateVersion   The saved state version the command has been loaded from.
  * @param   pLoadedCmd      Command loaded from saved state, it is imcomplete and needs restoration.
  * @param   pReq            The guest request (cached in host memory).
@@ -2174 +2186 @@
  * @param   ppRestoredCmd   Where to store pointer to newly allocated restored command.
  */
-static int vmmdevHGCMRestoreConnect(PVMMDEV pThis, uint32_t u32SSMVersion, const VBOXHGCMCMD *pLoadedCmd,
-                                    VMMDevHGCMConnect *pReq, uint32_t cbReq, VMMDevRequestType enmRequestType,
-                                    VBOXHGCMCMD **ppRestoredCmd)
-{
-    RT_NOREF(pThis);
-
-    int rc = VINF_SUCCESS;
-
+static int vmmdevR3HgcmRestoreConnect(PVMMDEVCC pThisCC, uint32_t uSavedStateVersion, const VBOXHGCMCMD *pLoadedCmd,
+                                      VMMDevHGCMConnect *pReq, uint32_t cbReq, VMMDevRequestType enmRequestType,
+                                      VBOXHGCMCMD **ppRestoredCmd)
+{
     /* Verify the request.  */
     ASSERT_GUEST_RETURN(cbReq >= sizeof(*pReq), VERR_MISMATCH);
-    if (u32SSMVersion >= 9)
+    if (uSavedStateVersion >= 9)
         ASSERT_GUEST_RETURN(pLoadedCmd->enmCmdType == VBOXHGCMCMDTYPE_CONNECT, VERR_MISMATCH);
 
-    PVBOXHGCMCMD pCmd = vmmdevHGCMCmdAlloc(pThis, VBOXHGCMCMDTYPE_CONNECT, pLoadedCmd->GCPhys, cbReq, 0,
-                                           pReq->header.header.fRequestor);
+    PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_CONNECT, pLoadedCmd->GCPhys, cbReq, 0,
+                                             pReq->header.header.fRequestor);
     AssertReturn(pCmd, VERR_NO_MEMORY);
 
@@ -2196 +2204 @@
     pCmd->enmRequestType = enmRequestType;
 
-    vmmdevHGCMConnectFetch(pReq, pCmd);
-
-    if (RT_SUCCESS(rc))
-        *ppRestoredCmd = pCmd;
-
-    return rc;
+    vmmdevR3HgcmConnectFetch(pReq, pCmd);
+
+    *ppRestoredCmd = pCmd;
+    return VINF_SUCCESS;
 }
 
@@ -2207 +2213 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
- * @param   u32SSMVersion   The saved state version the command has been loaded from.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
+ * @param   uSavedStateVersion   The saved state version the command has been loaded from.
  * @param   pLoadedCmd      Command loaded from saved state, it is imcomplete and needs restoration.
  * @param   pReq            The guest request (cached in host memory).
@@ -2215 +2221 @@
  * @param   ppRestoredCmd   Where to store pointer to newly allocated restored command.
  */
-static int vmmdevHGCMRestoreDisconnect(PVMMDEV pThis, uint32_t u32SSMVersion, const VBOXHGCMCMD *pLoadedCmd,
-                                       VMMDevHGCMDisconnect *pReq, uint32_t cbReq, VMMDevRequestType enmRequestType,
-                                       VBOXHGCMCMD **ppRestoredCmd)
-{
-    RT_NOREF(pThis);
-
-    int rc = VINF_SUCCESS;
-
+static int vmmdevR3HgcmRestoreDisconnect(PVMMDEVCC pThisCC, uint32_t uSavedStateVersion, const VBOXHGCMCMD *pLoadedCmd,
+                                         VMMDevHGCMDisconnect *pReq, uint32_t cbReq, VMMDevRequestType enmRequestType,
+                                         VBOXHGCMCMD **ppRestoredCmd)
+{
     /* Verify the request.  */
     ASSERT_GUEST_RETURN(cbReq >= sizeof(*pReq), VERR_MISMATCH);
-    if (u32SSMVersion >= 9)
+    if (uSavedStateVersion >= 9)
         ASSERT_GUEST_RETURN(pLoadedCmd->enmCmdType == VBOXHGCMCMDTYPE_DISCONNECT, VERR_MISMATCH);
 
-    PVBOXHGCMCMD pCmd = vmmdevHGCMCmdAlloc(pThis, VBOXHGCMCMDTYPE_DISCONNECT, pLoadedCmd->GCPhys, cbReq, 0,
-                                           pReq->header.header.fRequestor);
+    PVBOXHGCMCMD pCmd = vmmdevR3HgcmCmdAlloc(pThisCC, VBOXHGCMCMDTYPE_DISCONNECT, pLoadedCmd->GCPhys, cbReq, 0,
+                                             pReq->header.header.fRequestor);
     AssertReturn(pCmd, VERR_NO_MEMORY);
 
@@ -2237 +2239 @@
     pCmd->enmRequestType = enmRequestType;
 
-    vmmdevHGCMDisconnectFetch(pReq, pCmd);
-
-    if (RT_SUCCESS(rc))
-        *ppRestoredCmd = pCmd;
-
-    return rc;
+    vmmdevR3HgcmDisconnectFetch(pReq, pCmd);
+
+    *ppRestoredCmd = pCmd;
+    return VINF_SUCCESS;
 }
 
@@ -2248 +2248 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
- * @param   u32SSMVersion   The saved state version the command has been loaded from.
+ * @param   pDevIns         The device instance.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
+ * @param   uSavedStateVersion   The saved state version the command has been loaded from.
  * @param   pLoadedCmd      Command loaded from saved state, it is imcomplete and needs restoration.
  * @param   pReq            The guest request (cached in host memory).
@@ -2256 +2257 @@
  * @param   ppRestoredCmd   Where to store pointer to newly allocated restored command.
  */
-static int vmmdevHGCMRestoreCall(PVMMDEV pThis, uint32_t u32SSMVersion, const VBOXHGCMCMD *pLoadedCmd,
-                                 VMMDevHGCMCall *pReq, uint32_t cbReq, VMMDevRequestType enmRequestType,
-                                 VBOXHGCMCMD **ppRestoredCmd)
-{
-    int rc = VINF_SUCCESS;
-
+static int vmmdevR3HgcmRestoreCall(PPDMDEVINS pDevIns, PVMMDEVCC pThisCC, uint32_t uSavedStateVersion, const VBOXHGCMCMD *pLoadedCmd,
+                                   VMMDevHGCMCall *pReq, uint32_t cbReq, VMMDevRequestType enmRequestType,
+                                   VBOXHGCMCMD **ppRestoredCmd)
+{
     /* Verify the request.  */
     ASSERT_GUEST_RETURN(cbReq >= sizeof(*pReq), VERR_MISMATCH);
-    if (u32SSMVersion >= 9)
+    if (uSavedStateVersion >= 9)
     {
         ASSERT_GUEST_RETURN(pLoadedCmd->enmCmdType == VBOXHGCMCMDTYPE_CALL, VERR_MISMATCH);
@@ -2272 +2271 @@
     PVBOXHGCMCMD pCmd;
     uint32_t cbHGCMParmStruct;
-    rc = vmmdevHGCMCallAlloc(pThis, pReq, cbReq, pLoadedCmd->GCPhys, enmRequestType, &pCmd, &cbHGCMParmStruct);
+    int rc = vmmdevR3HgcmCallAlloc(pThisCC, pReq, cbReq, pLoadedCmd->GCPhys, enmRequestType, &pCmd, &cbHGCMParmStruct);
     if (RT_FAILURE(rc))
         return rc;
@@ -2281 +2280 @@
     pCmd->enmRequestType = enmRequestType;
 
-    rc = vmmdevHGCMCallFetchGuestParms(pThis, pCmd, pReq, cbReq, enmRequestType, cbHGCMParmStruct);
+    rc = vmmdevR3HgcmCallFetchGuestParms(pDevIns, pThisCC, pCmd, pReq, cbReq, enmRequestType, cbHGCMParmStruct);
     if (RT_SUCCESS(rc))
     {
         /* Update LinAddr parameters from pLoadedCmd.
-         * pLoadedCmd->u.call.cParms is actually the number of LinAddrs, see vmmdevHGCMLoadState.
+         * pLoadedCmd->u.call.cParms is actually the number of LinAddrs, see vmmdevR3HgcmLoadState.
          */
         uint32_t iLinAddr;
@@ -2291 +2290 @@
         {
             VBOXHGCMGUESTPARM * const pLoadedParm = &pLoadedCmd->u.call.paGuestParms[iLinAddr];
-            /* pLoadedParm->cbData is actually index of the LinAddr parameter, see vmmdevHGCMLoadState. */
+            /* pLoadedParm->cbData is actually index of the LinAddr parameter, see vmmdevR3HgcmLoadState. */
             const uint32_t iParm = pLoadedParm->u.ptr.cbData;
             ASSERT_GUEST_STMT_BREAK(iParm < pCmd->u.call.cParms, rc = VERR_MISMATCH);
@@ -2310 +2309 @@
         *ppRestoredCmd = pCmd;
     else
-        vmmdevHGCMCmdFree(pThis, pCmd);
+        vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
 
     return rc;
@@ -2319 +2318 @@
  *
  * @returns VBox status code that the guest should see.
- * @param   pThis           The VMMDev instance data.
- * @param   u32SSMVersion   Saved state version.
+ * @param   pDevIns         The device instance.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
+ * @param   uSavedStateVersion   Saved state version.
  * @param   pLoadedCmd      HGCM command which needs restoration.
  * @param   pReqHdr         The request (cached in host memory).
@@ -2326 +2326 @@
  * @param   ppRestoredCmd   Where to store pointer to restored command.
  */
-static int vmmdevHGCMRestoreCommand(PVMMDEV pThis, uint32_t u32SSMVersion, const VBOXHGCMCMD *pLoadedCmd,
-                                    const VMMDevHGCMRequestHeader *pReqHdr, uint32_t cbReq,
-                                    VBOXHGCMCMD **ppRestoredCmd)
-{
-    int rc = VINF_SUCCESS;
+static int vmmdevR3HgcmRestoreCommand(PPDMDEVINS pDevIns, PVMMDEVCC pThisCC, uint32_t uSavedStateVersion,
+                                      const VBOXHGCMCMD *pLoadedCmd, const VMMDevHGCMRequestHeader *pReqHdr, uint32_t cbReq,
+                                      VBOXHGCMCMD **ppRestoredCmd)
+{
+    int rc;
 
     /* Verify the request.  */
@@ -2342 +2342 @@
         {
             VMMDevHGCMConnect *pReq = (VMMDevHGCMConnect *)pReqHdr;
-            rc = vmmdevHGCMRestoreConnect(pThis, u32SSMVersion, pLoadedCmd, pReq, cbReq, enmRequestType,
-                                          ppRestoredCmd);
+            rc = vmmdevR3HgcmRestoreConnect(pThisCC, uSavedStateVersion, pLoadedCmd, pReq, cbReq, enmRequestType, ppRestoredCmd);
             break;
         }
@@ -2350 +2349 @@
         {
             VMMDevHGCMDisconnect *pReq = (VMMDevHGCMDisconnect *)pReqHdr;
-            rc = vmmdevHGCMRestoreDisconnect(pThis, u32SSMVersion, pLoadedCmd, pReq, cbReq, enmRequestType,
-                                             ppRestoredCmd);
+            rc = vmmdevR3HgcmRestoreDisconnect(pThisCC, uSavedStateVersion, pLoadedCmd, pReq, cbReq, enmRequestType, ppRestoredCmd);
             break;
         }
@@ -2361 +2359 @@
         {
             VMMDevHGCMCall *pReq = (VMMDevHGCMCall *)pReqHdr;
-            rc = vmmdevHGCMRestoreCall(pThis, u32SSMVersion, pLoadedCmd, pReq, cbReq, enmRequestType,
-                                       ppRestoredCmd);
+            rc = vmmdevR3HgcmRestoreCall(pDevIns, pThisCC, uSavedStateVersion, pLoadedCmd, pReq, cbReq, enmRequestType, ppRestoredCmd);
             break;
         }
@@ -2376 +2373 @@
  *
  * @returns VBox status code.
- * @param   pThis           The VMMDev instance data.
+ * @param   pDevIns         The device instance.
+ * @param   pThis           The VMMDev shared instance data.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
  *
  * @thread EMT
  */
-int vmmdevHGCMLoadStateDone(PVMMDEV pThis)
+int vmmdevR3HgcmLoadStateDone(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC)
 {
     /*
      * Resubmit pending HGCM commands to services.
      *
-     * pThis->pHGCMCmdList contains commands loaded by vmmdevHGCMLoadState.
+     * pThisCC->pHGCMCmdList contains commands loaded by vmmdevR3HgcmLoadState.
      *
      * Legacy saved states (pre VMMDEV_SAVED_STATE_VERSION_HGCM_PARAMS)
@@ -2403 +2402 @@
     /* Get local copy of the list of loaded commands. */
     RTLISTANCHOR listLoadedCommands;
-    RTListMove(&listLoadedCommands, &pThis->listHGCMCmd);
+    RTListMove(&listLoadedCommands, &pThisCC->listHGCMCmd);
 
     /* Resubmit commands. */
@@ -2420 +2419 @@
          */
         VMMDevHGCMRequestHeader *pReqHdr = (VMMDevHGCMRequestHeader *)RTMemAlloc(pCmd->cbRequest);
-        AssertBreakStmt(pReqHdr, vmmdevHGCMCmdFree(pThis, pCmd); rcFunc = VERR_NO_MEMORY);
-
-        PDMDevHlpPhysRead(pThis->pDevInsR3, pCmd->GCPhys, pReqHdr, pCmd->cbRequest);
+        AssertBreakStmt(pReqHdr, vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd); rcFunc = VERR_NO_MEMORY);
+
+        PDMDevHlpPhysRead(pDevIns, pCmd->GCPhys, pReqHdr, pCmd->cbRequest);
         RT_UNTRUSTED_NONVOLATILE_COPY_FENCE();
 
-        if (pThis->pHGCMDrv)
+        if (pThisCC->pHGCMDrv)
         {
             /*
              * Reconstruct legacy commands.
              */
-            if (RT_LIKELY(   pThis->u32SSMVersion >= VMMDEV_SAVED_STATE_VERSION_HGCM_PARAMS
+            if (RT_LIKELY(   pThisCC->uSavedStateVersion >= VMMDEV_SAVED_STATE_VERSION_HGCM_PARAMS
                           && !pCmd->fRestoreFromGuestMem))
             { /* likely */ }
@@ -2436 +2435 @@
             {
                 PVBOXHGCMCMD pRestoredCmd = NULL;
-                rcCmd = vmmdevHGCMRestoreCommand(pThis, pThis->u32SSMVersion, pCmd,
-                                                 pReqHdr, pCmd->cbRequest, &pRestoredCmd);
+                rcCmd = vmmdevR3HgcmRestoreCommand(pDevIns, pThisCC, pThisCC->uSavedStateVersion, pCmd,
+                                                   pReqHdr, pCmd->cbRequest, &pRestoredCmd);
                 if (RT_SUCCESS(rcCmd))
                 {
-                    Assert(pCmd != pRestoredCmd); /* vmmdevHGCMRestoreCommand must allocate restored command. */
-                    vmmdevHGCMCmdFree(pThis, pCmd);
+                    Assert(pCmd != pRestoredCmd); /* vmmdevR3HgcmRestoreCommand must allocate restored command. */
+                    vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
                     pCmd = pRestoredCmd;
                 }
@@ -2453 +2452 @@
                     case VBOXHGCMCMDTYPE_CONNECT:
                     {
-                        vmmdevHGCMAddCommand(pThis, pCmd);
-                        rcCmd = pThis->pHGCMDrv->pfnConnect(pThis->pHGCMDrv, pCmd, pCmd->u.connect.pLoc,
-                                                            &pCmd->u.connect.u32ClientID);
+                        vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
+                        rcCmd = pThisCC->pHGCMDrv->pfnConnect(pThisCC->pHGCMDrv, pCmd, pCmd->u.connect.pLoc,
+                                                              &pCmd->u.connect.u32ClientID);
                         if (RT_FAILURE(rcCmd))
-                            vmmdevHGCMRemoveCommand(pThis, pCmd);
+                            vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
                         break;
                     }
@@ -2463 +2462 @@
                     case VBOXHGCMCMDTYPE_DISCONNECT:
                     {
-                        vmmdevHGCMAddCommand(pThis, pCmd);
-                        rcCmd = pThis->pHGCMDrv->pfnDisconnect(pThis->pHGCMDrv, pCmd, pCmd->u.disconnect.u32ClientID);
+                        vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
+                        rcCmd = pThisCC->pHGCMDrv->pfnDisconnect(pThisCC->pHGCMDrv, pCmd, pCmd->u.disconnect.u32ClientID);
                         if (RT_FAILURE(rcCmd))
-                            vmmdevHGCMRemoveCommand(pThis, pCmd);
+                            vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
                         break;
                     }
@@ -2472 +2471 @@
                     case VBOXHGCMCMDTYPE_CALL:
                     {
-                        rcCmd = vmmdevHGCMInitHostParameters(pThis, pCmd, (uint8_t const *)pReqHdr);
+                        rcCmd = vmmdevR3HgcmInitHostParameters(pDevIns, pCmd, (uint8_t const *)pReqHdr);
                         if (RT_SUCCESS(rcCmd))
                         {
-                            vmmdevHGCMAddCommand(pThis, pCmd);
+                            vmmdevR3HgcmAddCommand(pDevIns, pThis, pThisCC, pCmd);
 
                             /* Pass the function call to HGCM connector for actual processing */
                             uint64_t tsNow;
                             STAM_GET_TS(tsNow);
-                            rcCmd = pThis->pHGCMDrv->pfnCall(pThis->pHGCMDrv, pCmd,
-                                                             pCmd->u.call.u32ClientID, pCmd->u.call.u32Function,
-                                                             pCmd->u.call.cParms, pCmd->u.call.paHostParms, tsNow);
+                            rcCmd = pThisCC->pHGCMDrv->pfnCall(pThisCC->pHGCMDrv, pCmd,
+                                                               pCmd->u.call.u32ClientID, pCmd->u.call.u32Function,
+                                                               pCmd->u.call.cParms, pCmd->u.call.paHostParms, tsNow);
                             if (RT_FAILURE(rcCmd))
                             {
                                 LogFunc(("pfnCall rc = %Rrc\n", rcCmd));
-                                vmmdevHGCMRemoveCommand(pThis, pCmd);
+                                vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
                             }
                         }
@@ -2510 +2509 @@
 
             /* Write back only the header. */
-            PDMDevHlpPhysWrite(pThis->pDevInsR3, pCmd->GCPhys, pReqHdr, sizeof(*pReqHdr));
-
-            VMMDevNotifyGuest(pThis, VMMDEV_EVENT_HGCM);
+            PDMDevHlpPhysWrite(pDevIns, pCmd->GCPhys, pReqHdr, sizeof(*pReqHdr));
+
+            VMMDevNotifyGuest(pDevIns, pThis, pThisCC, VMMDEV_EVENT_HGCM);
 
             /* Deallocate the command memory. */
-            vmmdevHGCMCmdFree(pThis, pCmd);
+            vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
         }
 
@@ -2526 +2525 @@
         {
             RTListNodeRemove(&pCmd->node);
-            vmmdevHGCMCmdFree(pThis, pCmd);
+            vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
         }
     }
@@ -2535 +2534 @@
 
 /**
- * Counterpart to vmmdevHGCMInit().
- *
- * @param   pThis           The VMMDev instance data.
- */
-void vmmdevHGCMDestroy(PVMMDEV pThis)
+ * Counterpart to vmmdevR3HgcmInit().
+ *
+ * @param   pDevIns         The device instance.
+ * @param   pThisCC         The VMMDev ring-3 instance data.
+ */
+void vmmdevR3HgcmDestroy(PPDMDEVINS pDevIns, PVMMDEVCC pThisCC)
 {
     LogFlowFunc(("\n"));
 
-    if (RTCritSectIsInitialized(&pThis->critsectHGCMCmdList))
+    if (RTCritSectIsInitialized(&pThisCC->critsectHGCMCmdList))
     {
         PVBOXHGCMCMD pCmd, pNext;
-        RTListForEachSafe(&pThis->listHGCMCmd, pCmd, pNext, VBOXHGCMCMD, node)
-        {
-            vmmdevHGCMRemoveCommand(pThis, pCmd);
-            vmmdevHGCMCmdFree(pThis, pCmd);
+        RTListForEachSafe(&pThisCC->listHGCMCmd, pCmd, pNext, VBOXHGCMCMD, node)
+        {
+            vmmdevR3HgcmRemoveCommand(pThisCC, pCmd);
+            vmmdevR3HgcmCmdFree(pDevIns, pThisCC, pCmd);
         }
 
-        RTCritSectDelete(&pThis->critsectHGCMCmdList);
+        RTCritSectDelete(&pThisCC->critsectHGCMCmdList);
     }
 
     AssertCompile(NIL_RTMEMCACHE == (RTMEMCACHE)0);
-    if (pThis->hHgcmCmdCache != NIL_RTMEMCACHE)
-    {
-        RTMemCacheDestroy(pThis->hHgcmCmdCache);
-        pThis->hHgcmCmdCache = NIL_RTMEMCACHE;
+    if (pThisCC->hHgcmCmdCache != NIL_RTMEMCACHE)
+    {
+        RTMemCacheDestroy(pThisCC->hHgcmCmdCache);
+        pThisCC->hHgcmCmdCache = NIL_RTMEMCACHE;
     }
 }
@@ -2570 +2570 @@
  *
  * @returns VBox status code.
- * @param   pThis           The VMMDev instance data.
- */
-int vmmdevHGCMInit(PVMMDEV pThis)
+ * @param   pThisCC         The VMMDev ring-3 instance data.
+ */
+int vmmdevR3HgcmInit(PVMMDEVCC pThisCC)
 {
     LogFlowFunc(("\n"));
 
-    RTListInit(&pThis->listHGCMCmd);
-
-    int rc = RTCritSectInit(&pThis->critsectHGCMCmdList);
+    RTListInit(&pThisCC->listHGCMCmd);
+
+    int rc = RTCritSectInit(&pThisCC->critsectHGCMCmdList);
     AssertLogRelRCReturn(rc, rc);
 
-    rc = RTMemCacheCreate(&pThis->hHgcmCmdCache, sizeof(VBOXHGCMCMDCACHED), 64, _1M, NULL, NULL, NULL, 0);
+    rc = RTMemCacheCreate(&pThisCC->hHgcmCmdCache, sizeof(VBOXHGCMCMDCACHED), 64, _1M, NULL, NULL, NULL, 0);
     AssertLogRelRCReturn(rc, rc);
 
-    pThis->u32HGCMEnabled = 0;
+    pThisCC->u32HGCMEnabled = 0;
 
     return VINF_SUCCESS;

trunk/src/VBox/Devices/VMMDev/VMMDevHGCM.h

@@ -25 +25 @@
 
 RT_C_DECLS_BEGIN
-int vmmdevHGCMConnect(PVMMDEV pVMMDevState, const VMMDevHGCMConnect *pHGCMConnect, RTGCPHYS GCPtr);
-int vmmdevHGCMDisconnect(PVMMDEV pVMMDevState, const VMMDevHGCMDisconnect *pHGCMDisconnect, RTGCPHYS GCPtr);
-int vmmdevHGCMCall(PVMMDEV pVMMDevState, const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall, RTGCPHYS GCPtr,
-                   VMMDevRequestType enmRequestType, uint64_t tsArrival, PVMMDEVREQLOCK *ppLock);
-int vmmdevHGCMCancel(PVMMDEV pVMMDevState, const VMMDevHGCMCancel *pHGCMCancel, RTGCPHYS GCPtr);
-int vmmdevHGCMCancel2(PVMMDEV pVMMDevState, RTGCPHYS GCPtr);
+int  vmmdevR3HgcmConnect(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
+                         const VMMDevHGCMConnect *pHGCMConnect, RTGCPHYS GCPhys);
+int  vmmdevR3HgcmDisconnect(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC,
+                            const VMMDevHGCMDisconnect *pHGCMDisconnect, RTGCPHYS GCPhys);
+int  vmmdevR3HgcmCall(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, const VMMDevHGCMCall *pHGCMCall, uint32_t cbHGCMCall,
+                      RTGCPHYS GCPhys, VMMDevRequestType enmRequestType, uint64_t tsArrival, PVMMDEVREQLOCK *ppLock);
 
-DECLCALLBACK(int)  hgcmCompleted(PPDMIHGCMPORT pInterface, int32_t result, PVBOXHGCMCMD pCmdPtr);
-DECLCALLBACK(bool) hgcmIsCmdRestored(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd);
-DECLCALLBACK(bool) hgcmIsCmdCancelled(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd);
-DECLCALLBACK(uint32_t) hgcmGetRequestor(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd);
-DECLCALLBACK(uint64_t) hgcmGetVMMDevSessionId(PPDMIHGCMPORT pInterface);
+int  vmmdevR3HgcmCancel(PVMMDEVCC pThisCC, const VMMDevHGCMCancel *pHGCMCancel, RTGCPHYS GCPhys);
+int  vmmdevR3HgcmCancel2(PVMMDEVCC pThisCC, RTGCPHYS GCPhys);
 
-int vmmdevHGCMSaveState(PVMMDEV pVMMDevState, PSSMHANDLE pSSM);
-int vmmdevHGCMLoadState(PVMMDEV pVMMDevState, PSSMHANDLE pSSM, uint32_t u32Version);
-int vmmdevHGCMLoadStateDone(PVMMDEV pVMMDevState);
+DECLCALLBACK(int)  hgcmR3Completed(PPDMIHGCMPORT pInterface, int32_t result, PVBOXHGCMCMD pCmdPtr);
+DECLCALLBACK(bool) hgcmR3IsCmdRestored(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd);
+DECLCALLBACK(bool) hgcmR3IsCmdCancelled(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd);
+DECLCALLBACK(uint32_t) hgcmR3GetRequestor(PPDMIHGCMPORT pInterface, PVBOXHGCMCMD pCmd);
+DECLCALLBACK(uint64_t) hgcmR3GetVMMDevSessionId(PPDMIHGCMPORT pInterface);
 
-void vmmdevHGCMDestroy(PVMMDEV pThis);
-int  vmmdevHGCMInit(PVMMDEV pThis);
+int  vmmdevR3HgcmSaveState(PVMMDEVCC pThisCC, PSSMHANDLE pSSM);
+int  vmmdevR3HgcmLoadState(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, PSSMHANDLE pSSM, uint32_t uVersion);
+int  vmmdevR3HgcmLoadStateDone(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC);
+
+void vmmdevR3HgcmDestroy(PPDMDEVINS pDevIns, PVMMDEVCC pThisCC);
+int  vmmdevR3HgcmInit(PVMMDEVCC pThisCC);
 RT_C_DECLS_END
 

trunk/src/VBox/Devices/VMMDev/VMMDevState.h

@@ -137 +137 @@
     uint32_t            fHostCursorRequested;
 
-    /** Pointer to device instance - R3 poitner. */
-    PPDMDEVINSR3        pDevInsR3;
-    /** Pointer to device instance - R0 pointer. */
-    PPDMDEVINSR0        pDevInsR0;
-
-    /** LUN\#0 + Status: VMMDev port base interface. */
-    PDMIBASE            IBase;
-    /** LUN\#0: VMMDev port interface. */
-    PDMIVMMDEVPORT      IPort;
-#ifdef VBOX_WITH_HGCM
-    /** LUN\#0: HGCM port interface. */
-    PDMIHGCMPORT        IHGCMPort;
-//# if HC_ARCH_BITS == 32
-//    RTR3PTR      R3PtrAlignment1;
-//# endif
-#endif
-    /** Pointer to base interface of the driver. */
-    R3PTRTYPE(PPDMIBASE) pDrvBase;
-    /** VMMDev connector interface */
-    R3PTRTYPE(PPDMIVMMDEVCONNECTOR) pDrv;
-#ifdef VBOX_WITH_HGCM
-    /** HGCM connector interface */
-    R3PTRTYPE(PPDMIHGCMCONNECTOR) pHGCMDrv;
-#endif
     /** message buffer for backdoor logging. */
     char                szMsg[512];
@@ -185 +161 @@
     bool                fNewGuestFilterMaskValid;
     /** Alignment padding. */
-    bool                afAlignment3[7];
-
-    /** GC physical address of VMMDev RAM area */
-    RTGCPHYS32                  GCPhysVMMDevRAM;
-    /** R3 pointer to VMMDev RAM area */
-    R3PTRTYPE(VMMDevMemory *)   pVMMDevRAMR3;
-    /** R0 pointer to VMMDev RAM area - first page only, could be NULL! */
-    R0PTRTYPE(VMMDevMemory *)   pVMMDevRAMR0;
-#ifdef VBOX_WITH_RAW_MODE_KEEP
-    /** R0 pointer to VMMDev RAM area - first page only, could be NULL! */
-    RCPTRTYPE(VMMDevMemory *)   pVMMDevRAMRC;
-    RTRCPTR                     RCPtrAlignment3b;
-#endif
-
-    /** R3 pointer to VMMDev Heap RAM area. */
-    R3PTRTYPE(VMMDevMemory *) pVMMDevHeapR3;
-    /** GC physical address of VMMDev Heap RAM area */
-    RTGCPHYS32          GCPhysVMMDevHeap;
+    bool                afAlignment3[3];
 
     /** Information reported by guest via VMMDevReportGuestInfo generic request.
@@ -236 +195 @@
     DISPLAYCHANGEDATA   displayChangeData;
 
-    /** Pointer to the credentials. */
-    R3PTRTYPE(VMMDEVCREDS *) pCredentials;
-
-#if HC_ARCH_BITS == 32
-    uint32_t            uAlignment4;
-#endif
-
     /** memory balloon change request */
     uint32_t            cMbMemoryBalloon;
@@ -271 +223 @@
     uint64_t            msLatchedHostTime;
     bool                fTimesyncBackdoorLo;
+    bool                afAlignment6[1];
+#else
     bool                afAlignment6[2];
-#else
-    bool                afAlignment6[1+2];
-#endif
-
+#endif
+
+    /** Set if guest should be allowed to trigger state save and power off.  */
+    bool                fAllowGuestToSaveState;
     /** Set if GetHostTime should fail.
      * Loaded from the GetHostTimeDisabled configuration value. */
@@ -292 +246 @@
     /** Number of additional cores to keep around. */
     uint32_t            cGuestCoreDumps;
-
-#ifdef VBOX_WITH_HGCM
-    /** List of pending HGCM requests (VBOXHGCMCMD). */
-    RTLISTANCHORR3      listHGCMCmd;
-    /** Critical section to protect the list. */
-    RTCRITSECT          critsectHGCMCmdList;
-    /** Whether the HGCM events are already automatically enabled. */
-    uint32_t            u32HGCMEnabled;
-    /** Saved state version of restored commands. */
-    uint32_t            u32SSMVersion;
-    RTMEMCACHE          hHgcmCmdCache;
-    STAMPROFILE         StatHgcmCmdArrival;
-    STAMPROFILE         StatHgcmCmdCompletion;
-    STAMPROFILE         StatHgcmCmdTotal;
-    STAMCOUNTER         StatHgcmLargeCmdAllocs;
-    STAMCOUNTER         StatHgcmFailedPageListLocking;
-#endif /* VBOX_WITH_HGCM */
-    STAMCOUNTER         StatReqBufAllocs;
-
-    /** Per CPU request 4K sized buffers, allocated as needed. */
-    R3PTRTYPE(VMMDevRequestHeader *) apReqBufs[VMM_MAX_CPU_COUNT];
-
-    /** Status LUN: Shared folders LED */
-    struct
-    {
-        /** The LED. */
-        PDMLED                          Led;
-        /** The LED ports. */
-        PDMILEDPORTS                    ILeds;
-        /** Partner of ILeds. */
-        R3PTRTYPE(PPDMILEDCONNECTORS)   pLedsConnector;
-    } SharedFolders;
 
     /** FLag whether CPU hotplug events are monitored */
@@ -338 +260 @@
     uint32_t            StatMemBalloonChunks;
 
-    /** Set if RC/R0 is enabled. */
-    bool                fRZEnabled;
     /** Set if testing is enabled. */
     bool                fTestingEnabled;
@@ -345 +265 @@
     bool                fTestingMMIO;
     /** Alignment padding. */
-    bool                afPadding9[HC_ARCH_BITS == 32 ? 1 : 5];
+    bool                afPadding9[HC_ARCH_BITS == 32 ? 2 : 6];
 #ifndef VBOX_WITHOUT_TESTING_FEATURES
     /** The high timestamp value. */
@@ -383 +303 @@
         uint8_t         abReadBack[VMMDEV_TESTING_READBACK_SIZE];
     } TestingData;
-    /** The XML output file name (can be a named pipe, doesn't matter to us). */
-    R3PTRTYPE(char *)   pszTestingXmlOutput;
-    /** Testing instance for dealing with the output. */
-    RTTEST              hTestingTest;
+
+    /** Handle for the I/O ports used by the testing component. */
+    IOMIOPORTHANDLE     hIoPortTesting;
+    /** Handle for the MMIO region used by the testing component. */
+    IOMMMIOHANDLE       hMmioTesting;
 #endif /* !VBOX_WITHOUT_TESTING_FEATURES */
 
@@ -406 +327 @@
     uint64_t            cNsHeartbeatTimeout;
     /** Timer for signalling a flatlined guest. */
-    PTMTIMERR3          pFlatlinedTimer;
+    TMTIMERHANDLE       hFlatlinedTimer;
     /** @} */
+
+    /** Handle for the backdoor logging I/O port. */
+    IOMIOPORTHANDLE     hIoPortBackdoorLog;
+    /** Handle for the alternative timesync I/O port. */
+    IOMIOPORTHANDLE     hIoPortAltTimesync;
+    /** Handle for the VMM request I/O port (PCI region \#0). */
+    IOMIOPORTHANDLE     hIoPortReq;
+    /** Handle for the fast VMM request I/O port (PCI region \#0). */
+    IOMIOPORTHANDLE     hIoPortFast;
+    /** Handle for the VMMDev RAM (PCI region \#1). */
+    PGMMMIO2HANDLE      hMmio2VMMDevRAM;
+    /** Handle for the VMMDev Heap (PCI region \#2). */
+    PGMMMIO2HANDLE      hMmio2Heap;
 } VMMDEV;
-/** Pointer to the VMM device state. */
+/** Pointer to the shared VMM device state. */
 typedef VMMDEV *PVMMDEV;
 AssertCompileMemberAlignment(VMMDEV, CritSect, 8);
@@ -421 +355 @@
 
 
-void VMMDevNotifyGuest(VMMDEV *pVMMDevState, uint32_t u32EventMask);
-void VMMDevCtlSetGuestFilterMask(VMMDEV *pVMMDevState, uint32_t u32OrMask, uint32_t u32NotMask);
+/**
+ * State structure for the VMM device, ring-3 edition.
+ */
+typedef struct VMMDEVR3
+{
+    /** LUN\#0 + Status: VMMDev port base interface. */
+    PDMIBASE                        IBase;
+    /** LUN\#0: VMMDev port interface. */
+    PDMIVMMDEVPORT                  IPort;
+#ifdef VBOX_WITH_HGCM
+    /** LUN\#0: HGCM port interface. */
+    PDMIHGCMPORT                    IHGCMPort;
+    /** HGCM connector interface */
+    R3PTRTYPE(PPDMIHGCMCONNECTOR)   pHGCMDrv;
+#endif
+    /** Pointer to base interface of the driver. */
+    R3PTRTYPE(PPDMIBASE)            pDrvBase;
+    /** VMMDev connector interface */
+    R3PTRTYPE(PPDMIVMMDEVCONNECTOR) pDrv;
+    /** Pointer to the device instance.
+     * @note Only for interface methods to get their bearings. */
+    PPDMDEVINSR3                    pDevIns;
+
+    /** R3 pointer to VMMDev RAM area */
+    R3PTRTYPE(VMMDevMemory *)       pVMMDevRAMR3;
+
+    /** R3 pointer to VMMDev Heap RAM area. */
+    R3PTRTYPE(VMMDevMemory *)       pVMMDevHeapR3;
+
+    /** Pointer to the credentials. */
+    R3PTRTYPE(VMMDEVCREDS *)        pCredentials;
+    /** Set if pCredentials is using the RTMemSafer allocator, clear if heap. */
+    bool                            fSaferCredentials;
+    bool                            afAlignment[7];
+
+#ifdef VBOX_WITH_HGCM
+    /** Critical section to protect the list. */
+    RTCRITSECT                      critsectHGCMCmdList;
+    /** List of pending HGCM requests (VBOXHGCMCMD). */
+    RTLISTANCHORR3                  listHGCMCmd;
+    /** Whether the HGCM events are already automatically enabled. */
+    uint32_t                        u32HGCMEnabled;
+    /** Saved state version of restored commands. */
+    uint32_t                        uSavedStateVersion;
+    RTMEMCACHE                      hHgcmCmdCache;
+    STAMPROFILE                     StatHgcmCmdArrival;
+    STAMPROFILE                     StatHgcmCmdCompletion;
+    STAMPROFILE                     StatHgcmCmdTotal;
+    STAMCOUNTER                     StatHgcmLargeCmdAllocs;
+    STAMCOUNTER                     StatHgcmFailedPageListLocking;
+#endif /* VBOX_WITH_HGCM */
+    STAMCOUNTER                     StatReqBufAllocs;
+    /** Per CPU request 4K sized buffers, allocated as needed. */
+    R3PTRTYPE(VMMDevRequestHeader *) apReqBufs[VMM_MAX_CPU_COUNT];
+
+    /** Status LUN: Shared folders LED */
+    struct
+    {
+        /** The LED. */
+        PDMLED                          Led;
+        /** The LED ports. */
+        PDMILEDPORTS                    ILeds;
+        /** Partner of ILeds. */
+        R3PTRTYPE(PPDMILEDCONNECTORS)   pLedsConnector;
+    } SharedFolders;
+
+#ifndef VBOX_WITHOUT_TESTING_FEATURES
+    /** The XML output file name (can be a named pipe, doesn't matter to us). */
+    R3PTRTYPE(char *)               pszTestingXmlOutput;
+    /** Testing instance for dealing with the output. */
+    RTTEST                          hTestingTest;
+#endif
+} VMMDEVR3;
+/** Pointer to the ring-3 VMM device state. */
+typedef VMMDEVR3 *PVMMDEVR3;
+
+
+/**
+ * State structure for the VMM device, ring-0 edition.
+ */
+typedef struct VMMDEVR0
+{
+    /** R0 pointer to VMMDev RAM area - first page only, could be NULL! */
+    R0PTRTYPE(VMMDevMemory *)   pVMMDevRAMR0;
+} VMMDEVR0;
+/** Pointer to the ring-0 VMM device state. */
+typedef VMMDEVR0 *PVMMDEVR0;
+
+
+/**
+ * State structure for the VMM device, raw-mode edition.
+ */
+typedef struct VMMDEVRC
+{
+    /** R0 pointer to VMMDev RAM area - first page only, could be NULL! */
+    RCPTRTYPE(VMMDevMemory *)   pVMMDevRAMRC;
+} VMMDEVRC;
+/** Pointer to the raw-mode VMM device state. */
+typedef VMMDEVRC *PVMMDEVRC;
+
+
+/** @typedef VMMDEVCC
+ * The VMMDEV device data for the current context. */
+typedef CTX_SUFF(VMMDEV) VMMDEVCC;
+/** @typedef PVMMDEVCC
+ * Pointer to the VMMDEV device for the current context. */
+typedef CTX_SUFF(PVMMDEV) PVMMDEVCC;
+
+
+void VMMDevNotifyGuest(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, uint32_t fAddEvents);
+void VMMDevCtlSetGuestFilterMask(PPDMDEVINS pDevIns, PVMMDEV pThis, PVMMDEVCC pThisCC, uint32_t fOrMask, uint32_t fNotMask);
 
 

trunk/src/VBox/Devices/VMMDev/VMMDevTesting.cpp

@@ -48 +48 @@
 
 /**
- * @callback_method_impl{FNIOMMMIOWRITE}
- */
-PDMBOTHCBDECL(int) vmmdevTestingMmioWrite(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS GCPhysAddr, void const *pv, unsigned cb)
+ * @callback_method_impl{FNIOMMMIONEWWRITE}
+ */
+static DECLCALLBACK(VBOXSTRICTRC) vmmdevTestingMmioWrite(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS off, void const *pv, unsigned cb)
 {
     RT_NOREF_PV(pvUser);
 
-    switch (GCPhysAddr)
+    switch (off)
     {
-        case VMMDEV_TESTING_MMIO_NOP_R3:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3:
 #ifndef IN_RING3
             return VINF_IOM_R3_MMIO_WRITE;
 #endif
-        case VMMDEV_TESTING_MMIO_NOP:
+        case VMMDEV_TESTING_MMIO_OFF_NOP:
             return VINF_SUCCESS;
 
@@ -68 +68 @@
              * Readback register (64 bytes wide).
              */
-            uint32_t off = GCPhysAddr - VMMDEV_TESTING_MMIO_BASE;
             if (   (   off      >= VMMDEV_TESTING_MMIO_OFF_READBACK
                     && off + cb <= VMMDEV_TESTING_MMIO_OFF_READBACK + VMMDEV_TESTING_READBACK_SIZE)
@@ -77 +76 @@
                     )
             {
-                PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+                PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
                 off &= VMMDEV_TESTING_READBACK_SIZE - 1;
                 switch (cb)
@@ -101 +100 @@
          * Odd NOP accesses.
          */
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 1:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 2:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 3:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 4:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 5:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 6:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 7:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 1:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 2:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 3:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 4:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 5:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 6:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 7:
 #ifndef IN_RING3
             return VINF_IOM_R3_MMIO_WRITE;
 #endif
-        case VMMDEV_TESTING_MMIO_NOP    + 1:
-        case VMMDEV_TESTING_MMIO_NOP    + 2:
-        case VMMDEV_TESTING_MMIO_NOP    + 3:
-        case VMMDEV_TESTING_MMIO_NOP    + 4:
-        case VMMDEV_TESTING_MMIO_NOP    + 5:
-        case VMMDEV_TESTING_MMIO_NOP    + 6:
-        case VMMDEV_TESTING_MMIO_NOP    + 7:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 1:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 2:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 3:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 4:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 5:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 6:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 7:
             return VINF_SUCCESS;
     }
@@ -125 +124 @@
 
 /**
- * @callback_method_impl{FNIOMMMIOREAD}
- */
-PDMBOTHCBDECL(int) vmmdevTestingMmioRead(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS GCPhysAddr, void *pv, unsigned cb)
+ * @callback_method_impl{FNIOMMMIONEWREAD}
+ */
+static DECLCALLBACK(VBOXSTRICTRC) vmmdevTestingMmioRead(PPDMDEVINS pDevIns, void *pvUser, RTGCPHYS off, void *pv, unsigned cb)
 {
     RT_NOREF_PV(pvUser);
 
-    switch (GCPhysAddr)
+    switch (off)
     {
-        case VMMDEV_TESTING_MMIO_NOP_R3:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3:
 #ifndef IN_RING3
             return VINF_IOM_R3_MMIO_READ;
 #endif
             /* fall thru. */
-        case VMMDEV_TESTING_MMIO_NOP:
+        case VMMDEV_TESTING_MMIO_OFF_NOP:
             switch (cb)
             {
@@ -165 +164 @@
              * Readback register (64 bytes wide).
              */
-            uint32_t off = GCPhysAddr - VMMDEV_TESTING_MMIO_BASE;
             if (   (   off      >= VMMDEV_TESTING_MMIO_OFF_READBACK
                     && off + cb <= VMMDEV_TESTING_MMIO_OFF_READBACK + 64)
@@ -174 +172 @@
                     )
             {
-                PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+                PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
                 off &= 0x3f;
                 switch (cb)
@@ -197 +195 @@
          * Odd NOP accesses (for 16-bit code mainly).
          */
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 1:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 2:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 3:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 4:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 5:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 6:
-        case VMMDEV_TESTING_MMIO_NOP_R3 + 7:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 1:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 2:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 3:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 4:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 5:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 6:
+        case VMMDEV_TESTING_MMIO_OFF_NOP_R3 + 7:
 #ifndef IN_RING3
             return VINF_IOM_R3_MMIO_READ;
 #endif
-        case VMMDEV_TESTING_MMIO_NOP    + 1:
-        case VMMDEV_TESTING_MMIO_NOP    + 2:
-        case VMMDEV_TESTING_MMIO_NOP    + 3:
-        case VMMDEV_TESTING_MMIO_NOP    + 4:
-        case VMMDEV_TESTING_MMIO_NOP    + 5:
-        case VMMDEV_TESTING_MMIO_NOP    + 6:
-        case VMMDEV_TESTING_MMIO_NOP    + 7:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 1:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 2:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 3:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 4:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 5:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 6:
+        case VMMDEV_TESTING_MMIO_OFF_NOP    + 7:
         {
             static uint8_t const s_abNopValue[8] =
@@ -228 +226 @@
 
             memset(pv, 0xff, cb);
-            memcpy(pv, &s_abNopValue[GCPhysAddr & 7], RT_MIN(8 - (GCPhysAddr & 7), cb));
+            memcpy(pv, &s_abNopValue[off & 7], RT_MIN(8 - (off & 7), cb));
             return VINF_SUCCESS;
         }
@@ -291 +289 @@
 
 /**
- * @callback_method_impl{FNIOMIOPORTOUT}
- */
-PDMBOTHCBDECL(int) vmmdevTestingIoWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT uPort, uint32_t u32, unsigned cb)
+ * @callback_method_impl{FNIOMIOPORTNEWOUT}
+ */
+static DECLCALLBACK(VBOXSTRICTRC)
+vmmdevTestingIoWrite(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t u32, unsigned cb)
 {
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+#ifdef IN_RING3
+    PVMMDEVCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+#endif
     RT_NOREF_PV(pvUser);
 
-    switch (uPort)
+    switch (offPort)
     {
         /*
          * The NOP I/O ports are used for performance measurements.
          */
-        case VMMDEV_TESTING_IOPORT_NOP:
+        case VMMDEV_TESTING_IOPORT_NOP - VMMDEV_TESTING_IOPORT_BASE:
             switch (cb)
             {
@@ -316 +318 @@
             return VINF_SUCCESS;
 
-        case VMMDEV_TESTING_IOPORT_NOP_R3:
+        case VMMDEV_TESTING_IOPORT_NOP_R3 - VMMDEV_TESTING_IOPORT_BASE:
             switch (cb)
             {
@@ -333 +335 @@
 
         /* The timestamp I/O ports are read-only. */
-        case VMMDEV_TESTING_IOPORT_TS_LOW:
-        case VMMDEV_TESTING_IOPORT_TS_HIGH:
+        case VMMDEV_TESTING_IOPORT_TS_LOW   - VMMDEV_TESTING_IOPORT_BASE:
+        case VMMDEV_TESTING_IOPORT_TS_HIGH  - VMMDEV_TESTING_IOPORT_BASE:
             break;
 
@@ -341 +343 @@
          * (We have to allow WORD writes for 286, 186 and 8086 execution modes.)
          */
-        case VMMDEV_TESTING_IOPORT_CMD:
+        case VMMDEV_TESTING_IOPORT_CMD - VMMDEV_TESTING_IOPORT_BASE:
             if (cb == 2)
             {
@@ -359 +361 @@
          * The data port.  Used of providing data for a command.
          */
-        case VMMDEV_TESTING_IOPORT_DATA:
+        case VMMDEV_TESTING_IOPORT_DATA - VMMDEV_TESTING_IOPORT_BASE:
         {
             uint32_t uCmd = pThis->u32TestingCmd;
@@ -386 +388 @@
                                 case VMMDEV_TESTING_CMD_INIT:
                                     VMMDEV_TESTING_OUTPUT(("testing: INIT '%s'\n", pThis->TestingData.String.sz));
-                                    if (pThis->hTestingTest != NIL_RTTEST)
+                                    if (pThisCC->hTestingTest != NIL_RTTEST)
                                     {
-                                        RTTestChangeName(pThis->hTestingTest, pThis->TestingData.String.sz);
-                                        RTTestBanner(pThis->hTestingTest);
+                                        RTTestChangeName(pThisCC->hTestingTest, pThis->TestingData.String.sz);
+                                        RTTestBanner(pThisCC->hTestingTest);
                                     }
                                     break;
                                 case VMMDEV_TESTING_CMD_SUB_NEW:
                                     VMMDEV_TESTING_OUTPUT(("testing: SUB_NEW  '%s'\n", pThis->TestingData.String.sz));
-                                    if (pThis->hTestingTest != NIL_RTTEST)
-                                        RTTestSub(pThis->hTestingTest, pThis->TestingData.String.sz);
+                                    if (pThisCC->hTestingTest != NIL_RTTEST)
+                                        RTTestSub(pThisCC->hTestingTest, pThis->TestingData.String.sz);
                                     break;
                                 case VMMDEV_TESTING_CMD_FAILED:
-                                    if (pThis->hTestingTest != NIL_RTTEST)
-                                        RTTestFailed(pThis->hTestingTest, "%s", pThis->TestingData.String.sz);
+                                    if (pThisCC->hTestingTest != NIL_RTTEST)
+                                        RTTestFailed(pThisCC->hTestingTest, "%s", pThis->TestingData.String.sz);
                                     VMMDEV_TESTING_OUTPUT(("testing: FAILED '%s'\n", pThis->TestingData.String.sz));
                                     break;
                                 case VMMDEV_TESTING_CMD_SKIPPED:
-                                    if (pThis->hTestingTest != NIL_RTTEST)
+                                    if (pThisCC->hTestingTest != NIL_RTTEST)
                                     {
                                         if (off)
-                                            RTTestSkipped(pThis->hTestingTest, "%s", pThis->TestingData.String.sz);
+                                            RTTestSkipped(pThisCC->hTestingTest, "%s", pThis->TestingData.String.sz);
                                         else
-                                            RTTestSkipped(pThis->hTestingTest, NULL);
+                                            RTTestSkipped(pThisCC->hTestingTest, NULL);
                                     }
                                     VMMDEV_TESTING_OUTPUT(("testing: SKIPPED '%s'\n", pThis->TestingData.String.sz));
                                     break;
                                 case VMMDEV_TESTING_CMD_PRINT:
-                                    if (pThis->hTestingTest != NIL_RTTEST && off)
-                                        RTTestPrintf(pThis->hTestingTest, RTTESTLVL_ALWAYS, "%s", pThis->TestingData.String.sz);
+                                    if (pThisCC->hTestingTest != NIL_RTTEST && off)
+                                        RTTestPrintf(pThisCC->hTestingTest, RTTESTLVL_ALWAYS, "%s", pThis->TestingData.String.sz);
                                     VMMDEV_TESTING_OUTPUT(("testing: '%s'\n", pThis->TestingData.String.sz));
                                     break;
@@ -454 +456 @@
                         if (uCmd == VMMDEV_TESTING_CMD_TERM)
                         {
-                            if (pThis->hTestingTest != NIL_RTTEST)
+                            if (pThisCC->hTestingTest != NIL_RTTEST)
                             {
-                                while (RTTestErrorCount(pThis->hTestingTest) < u32)
-                                    RTTestErrorInc(pThis->hTestingTest); /* A bit stupid, but does the trick. */
-                                RTTestSubDone(pThis->hTestingTest);
-                                RTTestSummaryAndDestroy(pThis->hTestingTest);
-                                pThis->hTestingTest = NIL_RTTEST;
+                                while (RTTestErrorCount(pThisCC->hTestingTest) < u32)
+                                    RTTestErrorInc(pThisCC->hTestingTest); /* A bit stupid, but does the trick. */
+                                RTTestSubDone(pThisCC->hTestingTest);
+                                RTTestSummaryAndDestroy(pThisCC->hTestingTest);
+                                pThisCC->hTestingTest = NIL_RTTEST;
                             }
                             VMMDEV_TESTING_OUTPUT(("testing: TERM - %u errors\n", u32));
@@ -466 +468 @@
                         else
                         {
-                            if (pThis->hTestingTest != NIL_RTTEST)
+                            if (pThisCC->hTestingTest != NIL_RTTEST)
                             {
-                                while (RTTestSubErrorCount(pThis->hTestingTest) < u32)
-                                    RTTestErrorInc(pThis->hTestingTest); /* A bit stupid, but does the trick. */
-                                RTTestSubDone(pThis->hTestingTest);
+                                while (RTTestSubErrorCount(pThisCC->hTestingTest) < u32)
+                                    RTTestErrorInc(pThisCC->hTestingTest); /* A bit stupid, but does the trick. */
+                                RTTestSubDone(pThisCC->hTestingTest);
                             }
                             VMMDEV_TESTING_OUTPUT(("testing: SUB_DONE - %u errors\n", u32));
@@ -535 +537 @@
                                 enmUnit = RTTESTUNIT_NONE;
                             }
-                            if (pThis->hTestingTest != NIL_RTTEST)
-                                RTTestValue(pThis->hTestingTest, pThis->TestingData.Value.szName,
+                            if (pThisCC->hTestingTest != NIL_RTTEST)
+                                RTTestValue(pThisCC->hTestingTest, pThis->TestingData.Value.szName,
                                             pThis->TestingData.Value.u64Value.u, enmUnit);
 
@@ -591 +593 @@
 
 /**
- * @callback_method_impl{FNIOMIOPORTIN}
- */
-PDMBOTHCBDECL(int) vmmdevTestingIoRead(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT uPort, uint32_t *pu32, unsigned cb)
+ * @callback_method_impl{FNIOMIOPORTNEWIN}
+ */
+static DECLCALLBACK(VBOXSTRICTRC)
+vmmdevTestingIoRead(PPDMDEVINS pDevIns, void *pvUser, RTIOPORT offPort, uint32_t *pu32, unsigned cb)
 {
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEV pThis = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
     RT_NOREF_PV(pvUser);
 
-    switch (uPort)
+    switch (offPort)
     {
         /*
          * The NOP I/O ports are used for performance measurements.
          */
-        case VMMDEV_TESTING_IOPORT_NOP:
+        case VMMDEV_TESTING_IOPORT_NOP - VMMDEV_TESTING_IOPORT_BASE:
             switch (cb)
             {
@@ -617 +620 @@
             return VINF_SUCCESS;
 
-        case VMMDEV_TESTING_IOPORT_NOP_R3:
+        case VMMDEV_TESTING_IOPORT_NOP_R3 - VMMDEV_TESTING_IOPORT_BASE:
             switch (cb)
             {
@@ -641 +644 @@
          * gives you a 64-bit timestamp value.
          */
-        case VMMDEV_TESTING_IOPORT_TS_LOW:
+        case VMMDEV_TESTING_IOPORT_TS_LOW - VMMDEV_TESTING_IOPORT_BASE:
             if (cb == 4)
             {
@@ -651 +654 @@
             break;
 
-        case VMMDEV_TESTING_IOPORT_TS_HIGH:
+        case VMMDEV_TESTING_IOPORT_TS_HIGH - VMMDEV_TESTING_IOPORT_BASE:
             if (cb == 4)
             {
@@ -662 +665 @@
          * The command and data registers are write-only.
          */
-        case VMMDEV_TESTING_IOPORT_CMD:
-        case VMMDEV_TESTING_IOPORT_DATA:
+        case VMMDEV_TESTING_IOPORT_CMD  - VMMDEV_TESTING_IOPORT_BASE:
+        case VMMDEV_TESTING_IOPORT_DATA - VMMDEV_TESTING_IOPORT_BASE:
             break;
 
@@ -684 +687 @@
 void vmmdevTestingTerminate(PPDMDEVINS pDevIns)
 {
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEV   pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEVCC pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
     if (!pThis->fTestingEnabled)
         return;
 
-    if (pThis->hTestingTest != NIL_RTTEST)
+    if (pThisCC->hTestingTest != NIL_RTTEST)
     {
-        RTTestFailed(pThis->hTestingTest, "Still open at vmmdev destruction.");
-        RTTestSummaryAndDestroy(pThis->hTestingTest);
-        pThis->hTestingTest = NIL_RTTEST;
+        RTTestFailed(pThisCC->hTestingTest, "Still open at vmmdev destruction.");
+        RTTestSummaryAndDestroy(pThisCC->hTestingTest);
+        pThisCC->hTestingTest = NIL_RTTEST;
     }
 }
@@ -705 +709 @@
 int vmmdevTestingInitialize(PPDMDEVINS pDevIns)
 {
-    PVMMDEV pThis = PDMINS_2_DATA(pDevIns, PVMMDEV);
-    int     rc;
+    PVMMDEV     pThis   = PDMDEVINS_2_DATA(pDevIns, PVMMDEV);
+    PVMMDEVCC   pThisCC = PDMDEVINS_2_DATA_CC(pDevIns, PVMMDEVCC);
+    int         rc;
 
     if (!pThis->fTestingEnabled)
@@ -717 +722 @@
          * tests interfaces.  Optional, needs to be explicitly enabled.
          */
-        rc = PDMDevHlpMMIORegister(pDevIns, VMMDEV_TESTING_MMIO_BASE, VMMDEV_TESTING_MMIO_SIZE, NULL /*pvUser*/,
-                                   IOMMMIO_FLAGS_READ_PASSTHRU | IOMMMIO_FLAGS_WRITE_PASSTHRU,
-                                   vmmdevTestingMmioWrite, vmmdevTestingMmioRead, "VMMDev Testing");
+        rc = PDMDevHlpMmioCreateAndMap(pDevIns, VMMDEV_TESTING_MMIO_BASE, VMMDEV_TESTING_MMIO_SIZE,
+                                       vmmdevTestingMmioWrite, vmmdevTestingMmioRead,
+                                       IOMMMIO_FLAGS_READ_PASSTHRU | IOMMMIO_FLAGS_WRITE_PASSTHRU,
+                                       "VMMDev Testing", &pThis->hMmioTesting);
         AssertRCReturn(rc, rc);
-        if (pThis->fRZEnabled)
-        {
-            rc = PDMDevHlpMMIORegisterR0(pDevIns, VMMDEV_TESTING_MMIO_BASE, VMMDEV_TESTING_MMIO_SIZE, NIL_RTR0PTR /*pvUser*/,
-                                         "vmmdevTestingMmioWrite", "vmmdevTestingMmioRead");
-            AssertRCReturn(rc, rc);
-            rc = PDMDevHlpMMIORegisterRC(pDevIns, VMMDEV_TESTING_MMIO_BASE, VMMDEV_TESTING_MMIO_SIZE, NIL_RTRCPTR /*pvUser*/,
-                                         "vmmdevTestingMmioWrite", "vmmdevTestingMmioRead");
-            AssertRCReturn(rc, rc);
-        }
     }
 
@@ -736 +733 @@
      * Register the I/O ports used for testing.
      */
-    rc = PDMDevHlpIOPortRegister(pDevIns, VMMDEV_TESTING_IOPORT_BASE, VMMDEV_TESTING_IOPORT_COUNT, NULL,
-                                 vmmdevTestingIoWrite,
-                                 vmmdevTestingIoRead,
-                                 NULL /*pfnOutStr*/,
-                                 NULL /*pfnInStr*/,
-                                 "VMMDev Testing");
+    rc = PDMDevHlpIoPortCreateAndMap(pDevIns, VMMDEV_TESTING_IOPORT_BASE, VMMDEV_TESTING_IOPORT_COUNT,
+                                     vmmdevTestingIoWrite, vmmdevTestingIoRead, "VMMDev Testing", NULL /*paExtDescs*/,
+                                     &pThis->hIoPortTesting);
     AssertRCReturn(rc, rc);
-    if (pThis->fRZEnabled)
-    {
-        rc = PDMDevHlpIOPortRegisterR0(pDevIns, VMMDEV_TESTING_IOPORT_BASE, VMMDEV_TESTING_IOPORT_COUNT, NIL_RTR0PTR /*pvUser*/,
-                                       "vmmdevTestingIoWrite",
-                                       "vmmdevTestingIoRead",
-                                       NULL /*pszOutStr*/,
-                                       NULL /*pszInStr*/,
-                                       "VMMDev Testing");
-        AssertRCReturn(rc, rc);
-        rc = PDMDevHlpIOPortRegisterRC(pDevIns, VMMDEV_TESTING_IOPORT_BASE, VMMDEV_TESTING_IOPORT_COUNT, NIL_RTRCPTR /*pvUser*/,
-                                       "vmmdevTestingIoWrite",
-                                       "vmmdevTestingIoRead",
-                                       NULL /*pszOutStr*/,
-                                       NULL /*pszInStr*/,
-                                       "VMMDev Testing");
-        AssertRCReturn(rc, rc);
-    }
 
     /*
@@ -765 +742 @@
      */
     rc = RTTestCreateEx("VMMDevTesting", RTTEST_C_USE_ENV | RTTEST_C_NO_TLS | RTTEST_C_XML_DELAY_TOP_TEST,
-                        RTTESTLVL_INVALID, -1 /*iNativeTestPipe*/, pThis->pszTestingXmlOutput, &pThis->hTestingTest);
+                        RTTESTLVL_INVALID, -1 /*iNativeTestPipe*/, pThisCC->pszTestingXmlOutput, &pThisCC->hTestingTest);
     if (RT_FAILURE(rc))
         return PDMDevHlpVMSetError(pDevIns, rc, RT_SRC_POS, "Error creating testing instance");