Index: trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h	(revision 91290)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllCImplSvmInstr.cpp.h	(revision 91291)
@@ -563,7 +563,7 @@
          * Copy the IO permission bitmap into the cache.
          */
-        Assert(pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap));
-        rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap), GCPhysIOBitmap,
-                                     SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
+        AssertCompile(sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap) == SVM_IOPM_PAGES * X86_PAGE_4K_SIZE);
+        rc = PGMPhysSimpleReadGCPhys(pVM, pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, GCPhysIOBitmap,
+                                     sizeof(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap));
         if (RT_FAILURE(rc))
         {
@@ -989,7 +989,6 @@
 
     SVMIOIOEXITINFO IoExitInfo;
-    void *pvIoBitmap = pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap);
-    bool const fIntercept = CPUMIsSvmIoInterceptSet(pvIoBitmap, u16Port, enmIoType, cbReg, cAddrSizeBits, iEffSeg, fRep,
-                                                    fStrIo, &IoExitInfo);
+    bool const fIntercept = CPUMIsSvmIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abMsrBitmap, u16Port, enmIoType, cbReg,
+                                                    cAddrSizeBits, iEffSeg, fRep, fStrIo, &IoExitInfo);
     if (fIntercept)
     {
Index: trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 91290)
+++ trunk/src/VBox/VMM/VMMR0/HMSVMR0.cpp	(revision 91291)
@@ -4962,8 +4962,7 @@
             if (CPUMIsGuestSvmCtrlInterceptSet(pVCpu, pCtx, SVM_CTRL_INTERCEPT_IOIO_PROT))
             {
-                void *pvIoBitmap = pVCpu->cpum.GstCtx.hwvirt.svm.CTX_SUFF(pvIoBitmap);
                 SVMIOIOEXITINFO IoExitInfo;
                 IoExitInfo.u = pVmcbNstGst->ctrl.u64ExitInfo1;
-                bool const fIntercept = hmR0SvmIsIoInterceptSet(pvIoBitmap, &IoExitInfo);
+                bool const fIntercept = hmR0SvmIsIoInterceptSet(pVCpu->cpum.GstCtx.hwvirt.svm.abIoBitmap, &IoExitInfo);
                 if (fIntercept)
                     NST_GST_VMEXIT_CALL_RET(pVCpu, uExitCode, uExitInfo1, uExitInfo2);
Index: trunk/src/VBox/VMM/VMMR3/CPUM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/CPUM.cpp	(revision 91290)
+++ trunk/src/VBox/VMM/VMMR3/CPUM.cpp	(revision 91291)
@@ -1018,14 +1018,5 @@
 {
     Assert(pVM->cpum.s.GuestFeatures.fSvm);
-    for (VMCPUID i = 0; i < pVM->cCpus; i++)
-    {
-        PVMCPU pVCpu = pVM->apCpusR3[i];
-
-        if (pVCpu->cpum.s.Guest.hwvirt.svm.pvIoBitmapR3)
-        {
-            SUPR3PageFreeEx(pVCpu->cpum.s.Guest.hwvirt.svm.pvIoBitmapR3, SVM_IOPM_PAGES);
-            pVCpu->cpum.s.Guest.hwvirt.svm.pvIoBitmapR3 = NULL;
-        }
-    }
+    RT_NOREF(pVM);
 }
 
@@ -1051,25 +1042,5 @@
         AssertCompile(SVM_VMCB_PAGES * X86_PAGE_SIZE == sizeof(pVCpu->cpum.s.Guest.hwvirt.svm.Vmcb));
         AssertCompile(SVM_MSRPM_PAGES * X86_PAGE_SIZE == sizeof(pVCpu->cpum.s.Guest.hwvirt.svm.abMsrBitmap));
-
-        /*
-         * Allocate the IOPM (IO Permission bitmap).
-         *
-         * This need not be physically contiguous pages because we re-use the ring-0
-         * allocated IOPM while executing the nested-guest using hardware-assisted SVM
-         * because it's identical (we trap all IO accesses).
-         *
-         * This one is just used for caching the IOPM from guest physical memory in
-         * case the guest hypervisor allows direct access to some IO ports.
-         */
-        Assert(!pVCpu->cpum.s.Guest.hwvirt.svm.pvIoBitmapR3);
-        rc = SUPR3PageAllocEx(SVM_IOPM_PAGES, 0 /* fFlags */, &pVCpu->cpum.s.Guest.hwvirt.svm.pvIoBitmapR3,
-                              &pVCpu->cpum.s.Guest.hwvirt.svm.pvIoBitmapR0, NULL /* paPages */);
-        if (RT_FAILURE(rc))
-        {
-            Assert(!pVCpu->cpum.s.Guest.hwvirt.svm.pvIoBitmapR3);
-            LogRel(("CPUM%u: Failed to alloc %u pages for the nested-guest's IO permission bitmap\n", pVCpu->idCpu,
-                    SVM_IOPM_PAGES));
-            break;
-        }
+        AssertCompile(SVM_IOPM_PAGES * X86_PAGE_SIZE == sizeof(pVCpu->cpum.s.Guest.hwvirt.svm.abIoBitmap));
     }
 
@@ -2631,5 +2602,5 @@
             SSMR3PutMem(pSSM,   &pGstCtx->hwvirt.svm.Vmcb,           sizeof(pGstCtx->hwvirt.svm.Vmcb));
             SSMR3PutMem(pSSM,   &pGstCtx->hwvirt.svm.abMsrBitmap[0], sizeof(pGstCtx->hwvirt.svm.abMsrBitmap));
-            SSMR3PutMem(pSSM,    pGstCtx->hwvirt.svm.pvIoBitmapR3,  SVM_IOPM_PAGES  << X86_PAGE_4K_SHIFT);
+            SSMR3PutMem(pSSM,   &pGstCtx->hwvirt.svm.abIoBitmap[0],  sizeof(pGstCtx->hwvirt.svm.abIoBitmap));
             SSMR3PutU32(pSSM,    pGstCtx->hwvirt.fLocalForcedActions);
             SSMR3PutBool(pSSM,   pGstCtx->hwvirt.fGif);
@@ -2915,7 +2886,7 @@
                         SSMR3GetStructEx(pSSM, &pGstCtx->hwvirt.svm.HostState, sizeof(pGstCtx->hwvirt.svm.HostState),
                                          0 /* fFlags */, g_aSvmHwvirtHostState, NULL /* pvUser */);
-                        SSMR3GetMem(pSSM,      &pGstCtx->hwvirt.svm.Vmcb,          sizeof(pGstCtx->hwvirt.svm.Vmcb));
+                        SSMR3GetMem(pSSM,      &pGstCtx->hwvirt.svm.Vmcb,           sizeof(pGstCtx->hwvirt.svm.Vmcb));
                         SSMR3GetMem(pSSM,      &pGstCtx->hwvirt.svm.abMsrBitmap[0], sizeof(pGstCtx->hwvirt.svm.abMsrBitmap));
-                        SSMR3GetMem(pSSM,       pGstCtx->hwvirt.svm.pvIoBitmapR3,  SVM_IOPM_PAGES  << X86_PAGE_4K_SHIFT);
+                        SSMR3GetMem(pSSM,      &pGstCtx->hwvirt.svm.abIoBitmap[0],  sizeof(pGstCtx->hwvirt.svm.abIoBitmap));
                         SSMR3GetU32(pSSM,      &pGstCtx->hwvirt.fLocalForcedActions);
                         SSMR3GetBool(pSSM,     &pGstCtx->hwvirt.fGif);
@@ -4134,6 +4105,4 @@
         pHlp->pfnPrintf(pHlp, "  cPauseFilterThreshold      = %RU32\n",     pCtx->hwvirt.svm.cPauseFilterThreshold);
         pHlp->pfnPrintf(pHlp, "  fInterceptEvents           = %u\n",        pCtx->hwvirt.svm.fInterceptEvents);
-        pHlp->pfnPrintf(pHlp, "  pvIoBitmapR3               = %p\n",        pCtx->hwvirt.svm.pvIoBitmapR3);
-        pHlp->pfnPrintf(pHlp, "  pvIoBitmapR0               = %RKv\n",      pCtx->hwvirt.svm.pvIoBitmapR0);
     }
     else if (fVmx)
Index: trunk/src/VBox/VMM/include/CPUMInternal.mac
===================================================================
--- trunk/src/VBox/VMM/include/CPUMInternal.mac	(revision 91290)
+++ trunk/src/VBox/VMM/include/CPUMInternal.mac	(revision 91291)
@@ -233,4 +233,5 @@
     .Guest.hwvirt.svm.Vmcb                  resb        4096
     .Guest.hwvirt.svm.abMsrBitmap           resb        8192
+    .Guest.hwvirt.svm.abIoBitmap            resb        12288
     .Guest.hwvirt.svm.uMsrHSavePa            resq         1
     .Guest.hwvirt.svm.GCPhysVmcb             resq         1
@@ -241,8 +242,4 @@
     .Guest.hwvirt.svm.cPauseFilterThreshold  resw         1
     .Guest.hwvirt.svm.fInterceptEvents       resb         1
-    alignb 8
-    .Guest.hwvirt.svm.pvIoBitmapR0           RTR0PTR_RES  1
-    alignb 8
-    .Guest.hwvirt.svm.pvIoBitmapR3           RTR3PTR_RES  1
 
     ;.unnamed_padding.1 resb 0
Index: trunk/src/VBox/VMM/testcase/tstVMStruct.h
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStruct.h	(revision 91290)
+++ trunk/src/VBox/VMM/testcase/tstVMStruct.h	(revision 91291)
@@ -130,4 +130,5 @@
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.Vmcb);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.abMsrBitmap);
+    GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.abIoBitmap);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.uMsrHSavePa);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.GCPhysVmcb);
@@ -137,6 +138,4 @@
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.cPauseFilterThreshold);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.fInterceptEvents);
-    GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.pvIoBitmapR0);
-    GEN_CHECK_OFF(CPUMCTX, hwvirt.svm.pvIoBitmapR3);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.GCPhysVmxon);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.GCPhysVmcs);
Index: trunk/src/VBox/VMM/testcase/tstVMStructSize.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStructSize.cpp	(revision 91290)
+++ trunk/src/VBox/VMM/testcase/tstVMStructSize.cpp	(revision 91291)
@@ -251,4 +251,5 @@
     CHECK_MEMBER_ALIGNMENT(VMCPU, cpum.s.Guest.hwvirt.svm.Vmcb, 4096);
     CHECK_MEMBER_ALIGNMENT(VMCPU, cpum.s.Guest.hwvirt.svm.abMsrBitmap, 4096);
+    CHECK_MEMBER_ALIGNMENT(VMCPU, cpum.s.Guest.hwvirt.svm.abIoBitmap, 4096);
 
     PVM pVM = NULL; NOREF(pVM);
