Index: trunk/src/VBox/VMM/VMMAll/CPUMAllRegs.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMAll/CPUMAllRegs.cpp	(revision 91304)
+++ trunk/src/VBox/VMM/VMMAll/CPUMAllRegs.cpp	(revision 91305)
@@ -2478,9 +2478,9 @@
  *
  * @returns @c true if the I/O port access must cause a VM-exit, @c false otherwise.
- * @param   pvIoBitmap  Pointer to I/O bitmap.
+ * @param   pbIoBitmap  Pointer to I/O bitmap.
  * @param   uPort       The I/O port being accessed.
  * @param   cbAccess    e size of the I/O access in bytes (1, 2 or 4 bytes).
  */
-static bool cpumGetVmxIoBitmapPermission(void const *pvIoBitmap, uint16_t uPort, uint8_t cbAccess)
+static bool cpumGetVmxIoBitmapPermission(uint8_t const *pbIoBitmap, uint16_t uPort, uint8_t cbAccess)
 {
     Assert(cbAccess == 1 || cbAccess == 2 || cbAccess == 4);
@@ -2504,5 +2504,4 @@
      * If any bit corresponding to the I/O access is set, we must cause a VM-exit.
      */
-    uint8_t const *pbIoBitmap = (uint8_t const *)pvIoBitmap;
     uint16_t const offPerm    = uPort >> 3;                         /* Byte offset of the port. */
     uint16_t const idxPermBit = uPort - (offPerm << 3);             /* Bit offset within byte. */
@@ -2513,7 +2512,7 @@
     /* Fetch 8 or 16-bits depending on whether the access spans 8-bit boundary. */
     RTUINT16U uPerm;
-    uPerm.s.Lo = *(pbIoBitmap + offPerm);
+    uPerm.s.Lo = pbIoBitmap[offPerm];
     if (idxPermBit + cbAccess > 8)
-        uPerm.s.Hi = *(pbIoBitmap + 1 + offPerm);
+        uPerm.s.Hi = pbIoBitmap[offPerm + 1];
     else
         uPerm.s.Hi = 0;
@@ -2802,9 +2801,5 @@
 
     if (CPUMIsGuestVmxProcCtlsSet(pCtx, VMX_PROC_CTLS_USE_IO_BITMAPS))
-    {
-        uint8_t const *pbIoBitmap = (uint8_t const *)pCtx->hwvirt.vmx.CTX_SUFF(pvIoBitmap);
-        Assert(pbIoBitmap);
-        return cpumGetVmxIoBitmapPermission(pbIoBitmap, u16Port, cbAccess);
-    }
+        return cpumGetVmxIoBitmapPermission(pCtx->hwvirt.vmx.abIoBitmap, u16Port, cbAccess);
 
     return false;
Index: trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h
===================================================================
--- trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 91304)
+++ trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 91305)
@@ -6663,6 +6663,5 @@
         /* Read the IO bitmap A. */
         RTGCPHYS const GCPhysIoBitmapA = pVmcs->u64AddrIoBitmapA.u;
-        Assert(pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvIoBitmap));
-        int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvIoBitmap),
+        int rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abIoBitmap[0],
                                          GCPhysIoBitmapA, VMX_V_IO_BITMAP_A_SIZE);
         if (RT_SUCCESS(rc))
@@ -6673,6 +6672,6 @@
         /* Read the IO bitmap B. */
         RTGCPHYS const GCPhysIoBitmapB = pVmcs->u64AddrIoBitmapB.u;
-        uint8_t *pbIoBitmapB = (uint8_t *)pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pvIoBitmap) + VMX_V_IO_BITMAP_A_SIZE;
-        rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), pbIoBitmapB, GCPhysIoBitmapB, VMX_V_IO_BITMAP_B_SIZE);
+        rc = PGMPhysSimpleReadGCPhys(pVCpu->CTX_SUFF(pVM), &pVCpu->cpum.GstCtx.hwvirt.vmx.abIoBitmap[VMX_V_IO_BITMAP_A_SIZE],
+                                     GCPhysIoBitmapB, VMX_V_IO_BITMAP_B_SIZE);
         if (RT_SUCCESS(rc))
         { /* likely */ }
Index: trunk/src/VBox/VMM/VMMR3/CPUM.cpp
===================================================================
--- trunk/src/VBox/VMM/VMMR3/CPUM.cpp	(revision 91304)
+++ trunk/src/VBox/VMM/VMMR3/CPUM.cpp	(revision 91305)
@@ -1067,9 +1067,4 @@
             pCtx->hwvirt.vmx.pvVirtApicPageR3 = NULL;
         }
-        if (pCtx->hwvirt.vmx.pvIoBitmapR3)
-        {
-            SUPR3ContFree(pCtx->hwvirt.vmx.pvIoBitmapR3, VMX_V_IO_BITMAP_A_PAGES + VMX_V_IO_BITMAP_B_PAGES);
-            pCtx->hwvirt.vmx.pvIoBitmapR3 = NULL;
-        }
     }
 }
@@ -1115,4 +1110,6 @@
         AssertCompile(sizeof(pCtx->hwvirt.vmx.abMsrBitmap) == VMX_V_MSR_BITMAP_PAGES * X86_PAGE_SIZE);
         AssertCompile(sizeof(pCtx->hwvirt.vmx.abMsrBitmap) == VMX_V_MSR_BITMAP_SIZE);
+        AssertCompile(sizeof(pCtx->hwvirt.vmx.abIoBitmap) == (VMX_V_IO_BITMAP_A_PAGES + VMX_V_IO_BITMAP_B_PAGES) * X86_PAGE_SIZE);
+        AssertCompile(sizeof(pCtx->hwvirt.vmx.abIoBitmap) == VMX_V_IO_BITMAP_A_SIZE + VMX_V_IO_BITMAP_B_SIZE);
 
         /*
@@ -1132,21 +1129,7 @@
 
         /*
-         * Allocate the I/O bitmaps (A and B).
-         */
-        pCtx->hwvirt.vmx.pvIoBitmapR3 = SUPR3ContAlloc(VMX_V_IO_BITMAP_A_PAGES + VMX_V_IO_BITMAP_B_PAGES,
-                                                       &pCtx->hwvirt.vmx.pvIoBitmapR0, NULL);
-        if (pCtx->hwvirt.vmx.pvIoBitmapR3)
-        { /* likely */ }
-        else
-        {
-            LogRel(("CPUM%u: Failed to alloc %u pages for the nested-guest's I/O bitmaps\n", pVCpu->idCpu,
-                    VMX_V_IO_BITMAP_A_PAGES + VMX_V_IO_BITMAP_B_PAGES));
-            break;
-        }
-
-        /*
          * Zero out all allocated pages (should compress well for saved-state).
          */
-        /** @todo this is and always was unnecessary - they are already zeroed. */
+        /** @todo r=bird: this is and always was unnecessary - they are already zeroed. */
         RT_ZERO(pCtx->hwvirt.vmx.Vmcs);
         RT_ZERO(pCtx->hwvirt.vmx.ShadowVmcs);
@@ -1157,5 +1140,5 @@
         RT_ZERO(pCtx->hwvirt.vmx.aExitMsrLoadArea);
         RT_ZERO(pCtx->hwvirt.vmx.abMsrBitmap);
-        memset(pCtx->hwvirt.vmx.CTX_SUFF(pvIoBitmap),          0, VMX_V_IO_BITMAP_A_SIZE + VMX_V_IO_BITMAP_B_SIZE);
+        RT_ZERO(pCtx->hwvirt.vmx.abIoBitmap);
         memset(pCtx->hwvirt.vmx.CTX_SUFF(pvVirtApicPage),      0, VMX_V_VIRT_APIC_SIZE);
     }
@@ -2471,5 +2454,5 @@
             SSMR3PutMem(pSSM,     &pGstCtx->hwvirt.vmx.aExitMsrLoadArea[0],  sizeof(pGstCtx->hwvirt.vmx.aExitMsrLoadArea));
             SSMR3PutMem(pSSM,     &pGstCtx->hwvirt.vmx.abMsrBitmap[0],       sizeof(pGstCtx->hwvirt.vmx.abMsrBitmap));
-            SSMR3PutMem(pSSM,      pGstCtx->hwvirt.vmx.pvIoBitmapR3, VMX_V_IO_BITMAP_A_SIZE + VMX_V_IO_BITMAP_B_SIZE);
+            SSMR3PutMem(pSSM,     &pGstCtx->hwvirt.vmx.abIoBitmap[0],        sizeof(pGstCtx->hwvirt.vmx.abIoBitmap));
             SSMR3PutU64(pSSM,      pGstCtx->hwvirt.vmx.uFirstPauseLoopTick);
             SSMR3PutU64(pSSM,      pGstCtx->hwvirt.vmx.uPrevPauseTick);
@@ -2761,5 +2744,5 @@
                         SSMR3GetMem(pSSM,      &pGstCtx->hwvirt.vmx.aExitMsrLoadArea[0],  sizeof(pGstCtx->hwvirt.vmx.aExitMsrLoadArea));
                         SSMR3GetMem(pSSM,      &pGstCtx->hwvirt.vmx.abMsrBitmap[0],       sizeof(pGstCtx->hwvirt.vmx.abMsrBitmap));
-                        SSMR3GetMem(pSSM,       pGstCtx->hwvirt.vmx.pvIoBitmapR3, VMX_V_IO_BITMAP_A_SIZE + VMX_V_IO_BITMAP_B_SIZE);
+                        SSMR3GetMem(pSSM,      &pGstCtx->hwvirt.vmx.abIoBitmap[0],        sizeof(pGstCtx->hwvirt.vmx.abIoBitmap));
                         SSMR3GetU64(pSSM,      &pGstCtx->hwvirt.vmx.uFirstPauseLoopTick);
                         SSMR3GetU64(pSSM,      &pGstCtx->hwvirt.vmx.uPrevPauseTick);
Index: trunk/src/VBox/VMM/include/CPUMInternal.mac
===================================================================
--- trunk/src/VBox/VMM/include/CPUMInternal.mac	(revision 91304)
+++ trunk/src/VBox/VMM/include/CPUMInternal.mac	(revision 91305)
@@ -256,4 +256,5 @@
     .Guest.hwvirt.vmx.aExitMsrLoadArea      resb        0x2000
     .Guest.hwvirt.vmx.abMsrBitmap           resb        0x1000
+    .Guest.hwvirt.vmx.abIoBitmap            resb        0x1000+0x1000
     alignb 8
     .Guest.hwvirt.vmx.GCPhysVmxon           resq        1
@@ -270,6 +271,4 @@
     .Guest.hwvirt.vmx.pvVirtApicPageR0      resq        1
     .Guest.hwvirt.vmx.pvVirtApicPageR3      resq        1
-    .Guest.hwvirt.vmx.pvIoBitmapR0          resq        1
-    .Guest.hwvirt.vmx.pvIoBitmapR3          resq        1
     .Guest.hwvirt.vmx.uFirstPauseLoopTick   resq        1
     .Guest.hwvirt.vmx.uPrevPauseTick        resq        1
Index: trunk/src/VBox/VMM/testcase/tstVMStruct.h
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStruct.h	(revision 91304)
+++ trunk/src/VBox/VMM/testcase/tstVMStruct.h	(revision 91305)
@@ -150,6 +150,4 @@
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.pvVirtApicPageR0);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.pvVirtApicPageR3);
-    GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.pvIoBitmapR0);
-    GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.pvIoBitmapR3);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.uFirstPauseLoopTick);
     GEN_CHECK_OFF(CPUMCTX, hwvirt.vmx.uPrevPauseTick);
Index: trunk/src/VBox/VMM/testcase/tstVMStructSize.cpp
===================================================================
--- trunk/src/VBox/VMM/testcase/tstVMStructSize.cpp	(revision 91304)
+++ trunk/src/VBox/VMM/testcase/tstVMStructSize.cpp	(revision 91305)
@@ -260,4 +260,5 @@
     CHECK_MEMBER_ALIGNMENT(VMCPU, cpum.s.Guest.hwvirt.vmx.aExitMsrLoadArea, 4096);
     CHECK_MEMBER_ALIGNMENT(VMCPU, cpum.s.Guest.hwvirt.vmx.abMsrBitmap, 4096);
+    CHECK_MEMBER_ALIGNMENT(VMCPU, cpum.s.Guest.hwvirt.vmx.abIoBitmap, 4096);
 
     PVM pVM = NULL; NOREF(pVM);
