Index: trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h	(revision 91288)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h	(revision 91289)
@@ -575,7 +575,7 @@
          * Copy the MSR permission bitmap into the cache.
          */
-        Assert(pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap));
-        rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap), GCPhysMsrBitmap,
-                                     SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
+        AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap) == SVM_MSRPM_PAGES * X86_PAGE_4K_SIZE);
+        rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, GCPhysMsrBitmap,
+                                     sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap));
         if (RT_FAILURE(rc))
         {
@@ -1050,7 +1050,5 @@
          * Check if the bit is set, if so, trigger a #VMEXIT.
          */
-        uint8_t *pbMsrpm = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap);
-        pbMsrpm += offMsrpm;
-        if (*pbMsrpm & RT_BIT(uMsrpmBit))
+        if (pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit))
         {
             IEM_SVM_UPDATE_NRIP(pVCpu);
Index: trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 91288)
+++ trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 91289)
@@ -945,7 +945,5 @@
         {
             /* Only clear the bit if the nested-guest is also not intercepting the MSR read.*/
-            uint8_t const *pbNstGstMsrBitmap = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap);
-            pbNstGstMsrBitmap += offMsrpm;
-            if (!(*pbNstGstMsrBitmap & RT_BIT(uMsrpmBit)))
+            if (!(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit)))
                 *pbMsrBitmap &= ~RT_BIT(uMsrpmBit);
             else
@@ -965,7 +963,5 @@
         {
             /* Only clear the bit if the nested-guest is also not intercepting the MSR write.*/
-            uint8_t const *pbNstGstMsrBitmap = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap);
-            pbNstGstMsrBitmap += offMsrpm;
-            if (!(*pbNstGstMsrBitmap & RT_BIT(uMsrpmBit + 1)))
+            if (!(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm] & RT_BIT(uMsrpmBit + 1)))
                 *pbMsrBitmap &= ~RT_BIT(uMsrpmBit + 1);
             else
@@ -2510,5 +2506,5 @@
 {
     uint64_t const *pu64GstMsrpm    = (uint64_t const *)pVCpu->hmr0.s.svm.pvMsrBitmap;
-    uint64_t const *pu64NstGstMsrpm = (uint64_t const *)pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap);
+    uint64_t const *pu64NstGstMsrpm = (uint64_t const *)&pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[0];
     uint64_t       *pu64DstMsrpm    = (uint64_t *)pHostCpu->n.svm.pvNstGstMsrpm;
 
@@ -4939,6 +4935,5 @@
                     Assert(offMsrpm < SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
 
-                    uint8_t const *pbMsrBitmap = (uint8_t const *)pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvMsrBitmap);
-                    pbMsrBitmap               += offMsrpm;
+                    uint8_t const * const pbMsrBitmap = &pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap[offMsrpm];
                     bool const fInterceptRead  = RT_BOOL(*pbMsrBitmap & RT_BIT(uMsrpmBit));
                     bool const fInterceptWrite = RT_BOOL(*pbMsrBitmap & RT_BIT(uMsrpmBit + 1));
Index: trunk/src/VBox/VMM/VMMR3/CPUM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/CPUM.cpp	(revision 91288)
+++ trunk/src/VBox/VMM/VMMR3/CPUM.cpp	(revision 91289)
@@ -1022,10 +1022,4 @@
         PVMCPU pVCpu = pVM->apCpusR3[i];
 
-        if (pVCpu->cpum.s.Guest.hwvirt.svm.pvMsrBitmapR3)
-        {
-            SUPR3PageFreeEx(pVCpu->cpum.s.Guest.hwvirt.svm.pvMsrBitmapR3, SVM_MSRPM_PAGES);
-            pVCpu->cpum.s.Guest.hwvirt.svm.pvMsrBitmapR3 = NULL;
-        }
-
         if (pVCpu->cpum.s.Guest.hwvirt.svm.pvIoBitmapR3)
         {
@@ -1055,23 +1049,6 @@
         pVCpu->cpum.s.Guest.hwvirt.enmHwvirt = CPUMHWVIRT_SVM;
 
-        AssertCompile(SVM_VMCB_PAGES * PAGE_SIZE == sizeof(pVCpu->cpum.s.Guest.hwvirt.svm.Vmcb));
-
-        /*
-         * Allocate the MSRPM (MSR Permission bitmap).
-         *
-         * This need not be physically contiguous pages because we use the one from
-         * HMPHYSCPU while executing the nested-guest using hardware-assisted SVM.
-         * This one is just used for caching the bitmap from guest physical memory.
-         */
-        Assert(!pVCpu->cpum.s.Guest.hwvirt.svm.pvMsrBitmapR3);
-        rc = SUPR3PageAllocEx(SVM_MSRPM_PAGES, 0 /* fFlags */, &pVCpu->cpum.s.Guest.hwvirt.svm.pvMsrBitmapR3,
-                              &pVCpu->cpum.s.Guest.hwvirt.svm.pvMsrBitmapR0, NULL /* paPages */);
-        if (RT_FAILURE(rc))
-        {
-            Assert(!pVCpu->cpum.s.Guest.hwvirt.svm.pvMsrBitmapR3);
-            LogRel(("CPUM%u: Failed to alloc %u pages for the nested-guest's MSR permission bitmap\n", pVCpu->idCpu,
-                    SVM_MSRPM_PAGES));
-            break;
-        }
+        AssertCompile(SVM_VMCB_PAGES * X86_PAGE_SIZE == sizeof(pVCpu->cpum.s.Guest.hwvirt.svm.Vmcb));
+        AssertCompile(SVM_MSRPM_PAGES * X86_PAGE_SIZE == sizeof(pVCpu->cpum.s.Guest.hwvirt.svm.abMsrBitmap));
 
         /*
@@ -2652,6 +2629,6 @@
             SSMR3PutStructEx(pSSM, &pGstCtx->hwvirt.svm.HostState, sizeof(pGstCtx->hwvirt.svm.HostState), 0 /* fFlags */,
                              g_aSvmHwvirtHostState, NULL /* pvUser */);
-            SSMR3PutMem(pSSM,   &pGstCtx->hwvirt.svm.Vmcb,          sizeof(pGstCtx->hwvirt.svm.Vmcb));
-            SSMR3PutMem(pSSM,    pGstCtx->hwvirt.svm.pvMsrBitmapR3, SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
+            SSMR3PutMem(pSSM,   &pGstCtx->hwvirt.svm.Vmcb,           sizeof(pGstCtx->hwvirt.svm.Vmcb));
+            SSMR3PutMem(pSSM,   &pGstCtx->hwvirt.svm.abMsrBitmap[0], sizeof(pGstCtx->hwvirt.svm.abMsrBitmap));
             SSMR3PutMem(pSSM,    pGstCtx->hwvirt.svm.pvIoBitmapR3,  SVM_IOPM_PAGES  << X86_PAGE_4K_SHIFT);
             SSMR3PutU32(pSSM,    pGstCtx->hwvirt.fLocalForcedActions);
@@ -2939,5 +2916,5 @@
                                          0 /* fFlags */, g_aSvmHwvirtHostState, NULL /* pvUser */);
                         SSMR3GetMem(pSSM,      &pGstCtx->hwvirt.svm.Vmcb,          sizeof(pGstCtx->hwvirt.svm.Vmcb));
-                        SSMR3GetMem(pSSM,       pGstCtx->hwvirt.svm.pvMsrBitmapR3, SVM_MSRPM_PAGES << X86_PAGE_4K_SHIFT);
+                        SSMR3GetMem(pSSM,      &pGstCtx->hwvirt.svm.abMsrBitmap[0], sizeof(pGstCtx->hwvirt.svm.abMsrBitmap));
                         SSMR3GetMem(pSSM,       pGstCtx->hwvirt.svm.pvIoBitmapR3,  SVM_IOPM_PAGES  << X86_PAGE_4K_SHIFT);
                         SSMR3GetU32(pSSM,      &pGstCtx->hwvirt.fLocalForcedActions);
@@ -4157,6 +4134,4 @@
         pHlp->pfnPrintf(pHlp, "  cPauseFilterThreshold      = %RU32\n",     pCtx->hwvirt.svm.cPauseFilterThreshold);
         pHlp->pfnPrintf(pHlp, "  fInterceptEvents           = %u\n",        pCtx->hwvirt.svm.fInterceptEvents);
-        pHlp->pfnPrintf(pHlp, "  pvMsrBitmapR3              = %p\n",        pCtx->hwvirt.svm.pvMsrBitmapR3);
-        pHlp->pfnPrintf(pHlp, "  pvMsrBitmapR0              = %RKv\n",      pCtx->hwvirt.svm.pvMsrBitmapR0);
         pHlp->pfnPrintf(pHlp, "  pvIoBitmapR3               = %p\n",        pCtx->hwvirt.svm.pvIoBitmapR3);
         pHlp->pfnPrintf(pHlp, "  pvIoBitmapR0               = %RKv\n",      pCtx->hwvirt.svm.pvIoBitmapR0);
Index: trunk/src/VBox/VMM/include/CPUMInternal.mac
===================================================================
--- trunk/src/VBox/VMM/include/CPUMInternal.mac	(revision 91288)
+++ trunk/src/VBox/VMM/include/CPUMInternal.mac	(revision 91289)
@@ -231,5 +231,6 @@
 
     alignb 4096
-    .Guest.hwvirt.svm.Vmcb                  resb            4096
+    .Guest.hwvirt.svm.Vmcb                  resb        4096
+    .Guest.hwvirt.svm.abMsrBitmap           resb        8192
     .Guest.hwvirt.svm.uMsrHSavePa            resq         1
     .Guest.hwvirt.svm.GCPhysVmcb             resq         1
@@ -240,8 +241,4 @@
     .Guest.hwvirt.svm.cPauseFilterThreshold  resw         1
     .Guest.hwvirt.svm.fInterceptEvents       resb         1
-    alignb 8
-    .Guest.hwvirt.svm.pvMsrBitmapR0          RTR0PTR_RES  1
-    alignb 8
-    .Guest.hwvirt.svm.pvMsrBitmapR3          RTR3PTR_RES  1
     alignb 8
     .Guest.hwvirt.svm.pvIoBitmapR0           RTR0PTR_RES  1
Index: trunk/src/VBox/VMM/testcase/tstVMStruct.h
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStruct.h	(revision 91288)
+++ trunk/src/VBox/VMM/testcase/tstVMStruct.h	(revision 91289)
@@ -129,4 +129,5 @@
     GEN_CHECK_OFF(CPUMCTX, hwvirt);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.Vmcb);
+    GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.abMsrBitmap);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.uMsrHSavePa);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.GCPhysVmcb);
@@ -136,6 +137,4 @@
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.cPauseFilterThreshold);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.fInterceptEvents);
-    GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.pvMsrBitmapR0);
-    GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.pvMsrBitmapR3);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.pvIoBitmapR0);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.pvIoBitmapR3);
