Index: /trunk/src/VBox/VMM/VMMAll/TMAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/TMAll.cpp	(revision 87770)
+++ /trunk/src/VBox/VMM/VMMAll/TMAll.cpp	(revision 87771)
@@ -57,7 +57,7 @@
  * @todo needs reworking later as it uses PDMDEVINSR0::pDevInsR0RemoveMe.  */
 # ifdef IN_RING3
-#  define TMTIMER_GET_CRITSECT(pTimer) ((pTimer)->pCritSect)
+#  define TMTIMER_GET_CRITSECT(a_pVM, a_pTimer) ((a_pTimer)->pCritSect)
 # else
-#  define TMTIMER_GET_CRITSECT(pTimer) tmRZTimerGetCritSect(pTimer)
+#  define TMTIMER_GET_CRITSECT(a_pVM, a_pTimer) tmRZTimerGetCritSect(a_pVM, a_pTimer)
 # endif
 #endif
@@ -67,21 +67,21 @@
  * the timer. */
 #ifdef VBOX_STRICT
-# define TMTIMER_ASSERT_CRITSECT(pTimer) \
+# define TMTIMER_ASSERT_CRITSECT(a_pVM, a_pTimer) \
     do { \
-        if ((pTimer)->pCritSect) \
+        if ((a_pTimer)->pCritSect) \
         { \
             VMSTATE      enmState; \
-            PPDMCRITSECT pCritSect = TMTIMER_GET_CRITSECT(pTimer); \
+            PPDMCRITSECT pCritSect = TMTIMER_GET_CRITSECT(a_pVM, a_pTimer); \
             AssertMsg(   pCritSect \
                       && (   PDMCritSectIsOwner(pCritSect) \
-                          || (enmState = (pTimer)->CTX_SUFF(pVM)->enmVMState) == VMSTATE_CREATING \
+                          || (enmState = (a_pVM)->enmVMState) == VMSTATE_CREATING \
                           || enmState == VMSTATE_RESETTING \
                           || enmState == VMSTATE_RESETTING_LS ),\
-                      ("pTimer=%p (%s) pCritSect=%p (%s)\n", pTimer, R3STRING(pTimer->pszDesc), \
-                       (pTimer)->pCritSect, R3STRING(PDMR3CritSectName((pTimer)->pCritSect)) )); \
+                      ("pTimer=%p (%s) pCritSect=%p (%s)\n", a_pTimer, R3STRING(a_pTimer->pszDesc), \
+                       (a_pTimer)->pCritSect, R3STRING(PDMR3CritSectName((a_pTimer)->pCritSect)) )); \
         } \
     } while (0)
 #else
-# define TMTIMER_ASSERT_CRITSECT(pTimer) do { } while (0)
+# define TMTIMER_ASSERT_CRITSECT(pVM, pTimer) do { } while (0)
 #endif
 
@@ -105,5 +105,5 @@
         { \
             VMSTATE      enmState; \
-            PPDMCRITSECT pCritSect = TMTIMER_GET_CRITSECT(pTimer); \
+            PPDMCRITSECT pCritSect = TMTIMER_GET_CRITSECT(pVM, pTimer); \
             AssertMsg(   pCritSect \
                       && (   !PDMCritSectIsOwner(pCritSect) \
@@ -126,5 +126,5 @@
  * @todo This needs a redo!
  */
-DECLINLINE(PPDMCRITSECT) tmRZTimerGetCritSect(PTMTIMER pTimer)
+DECLINLINE(PPDMCRITSECT) tmRZTimerGetCritSect(PVMCC pVM, PTMTIMER pTimer)
 {
     if (pTimer->enmType == TMTIMERTYPE_DEV)
@@ -140,5 +140,5 @@
             return (PPDMCRITSECT)((uintptr_t)pDevInsR0->pvInstanceDataR0 + offCritSect);
     }
-    return (PPDMCRITSECT)MMHyperR3ToCC((pTimer)->CTX_SUFF(pVM), pTimer->pCritSect);
+    return (PPDMCRITSECT)MMHyperR3ToCC(pVM, pTimer->pCritSect);
 }
 #endif /* VBOX_STRICT && IN_RING0 */
@@ -358,7 +358,6 @@
  * Schedule the queue which was changed.
  */
-DECLINLINE(void) tmSchedule(PTMTIMER pTimer)
-{
-    PVMCC pVM = pTimer->CTX_SUFF(pVM);
+DECLINLINE(void) tmSchedule(PVMCC pVM, PTMTIMER pTimer)
+{
     if (    VM_IS_EMT(pVM)
         &&  RT_SUCCESS(TM_TRY_LOCK_TIMERS(pVM)))
@@ -432,13 +431,14 @@
  *
  * @returns Success indicator.
+ * @param   pVM             The cross context VM structure.
  * @param   pTimer          Timer in question.
  * @param   enmStateNew     The new timer state.
  * @param   enmStateOld     The old timer state.
  */
-DECLINLINE(bool) tmTimerTryWithLink(PTMTIMER pTimer, TMTIMERSTATE enmStateNew, TMTIMERSTATE enmStateOld)
+DECLINLINE(bool) tmTimerTryWithLink(PVMCC pVM, PTMTIMER pTimer, TMTIMERSTATE enmStateNew, TMTIMERSTATE enmStateOld)
 {
     if (tmTimerTry(pTimer, enmStateNew, enmStateOld))
     {
-        tmTimerLinkSchedule(&pTimer->CTX_SUFF(pVM)->tm.s.CTX_SUFF(paTimerQueues)[pTimer->enmClock], pTimer);
+        tmTimerLinkSchedule(&pVM->tm.s.CTX_SUFF(paTimerQueues)[pTimer->enmClock], pTimer);
         return true;
     }
@@ -505,4 +505,5 @@
  * Schedules the given timer on the given queue.
  *
+ * @param   pVM         The cross context VM structure.
  * @param   pQueue      The timer queue.
  * @param   pTimer      The timer that needs scheduling.
@@ -510,7 +511,8 @@
  * @remarks Called while owning the lock.
  */
-DECLINLINE(void) tmTimerQueueScheduleOne(PTMTIMERQUEUE pQueue, PTMTIMER pTimer)
+DECLINLINE(void) tmTimerQueueScheduleOne(PVMCC pVM, PTMTIMERQUEUE pQueue, PTMTIMER pTimer)
 {
     Assert(pQueue->enmClock != TMCLOCK_VIRTUAL_SYNC);
+    RT_NOREF(pVM);
 
     /*
@@ -573,5 +575,5 @@
             case TMTIMERSTATE_PENDING_SCHEDULE_SET_EXPIRE:
                 tmTimerLinkSchedule(pQueue, pTimer);
-                STAM_COUNTER_INC(&pTimer->CTX_SUFF(pVM)->tm.s.CTX_SUFF_Z(StatPostponed));
+                STAM_COUNTER_INC(&pVM->tm.s.CTX_SUFF_Z(StatPostponed));
                 return;
 
@@ -601,5 +603,5 @@
  * @remarks Called while owning the lock.
  */
-void tmTimerQueueSchedule(PVM pVM, PTMTIMERQUEUE pQueue)
+void tmTimerQueueSchedule(PVMCC pVM, PTMTIMERQUEUE pQueue)
 {
     TM_ASSERT_TIMER_LOCK_OWNERSHIP(pVM);
@@ -628,5 +630,5 @@
         Log2(("tmTimerQueueSchedule: %p:{.enmState=%s, .enmClock=%d, .enmType=%d, .pszDesc=%s}\n",
               pTimer, tmTimerState(pTimer->enmState), pTimer->enmClock, pTimer->enmType, R3STRING(pTimer->pszDesc)));
-        tmTimerQueueScheduleOne(pQueue, pTimer);
+        tmTimerQueueScheduleOne(pVM, pQueue, pTimer);
         Log2(("tmTimerQueueSchedule: %p: new %s\n", pTimer, tmTimerState(pTimer->enmState)));
     } /* foreach timer in current schedule batch. */
@@ -1287,5 +1289,5 @@
 
     STAM_PROFILE_START(&pVM->tm.s.CTX_SUFF_Z(StatTimerSet), a);
-    TMTIMER_ASSERT_CRITSECT(pTimer);
+    TMTIMER_ASSERT_CRITSECT(pVM, pTimer);
 
     DBGFTRACE_U64_TAG2(pVM, u64Expire, "TMTimerSet", R3STRING(pTimer->pszDesc));
@@ -1350,5 +1352,5 @@
             case TMTIMERSTATE_EXPIRED_DELIVER:
             case TMTIMERSTATE_STOPPED:
-                if (tmTimerTryWithLink(pTimer, TMTIMERSTATE_PENDING_SCHEDULE_SET_EXPIRE, enmState))
+                if (tmTimerTryWithLink(pVM, pTimer, TMTIMERSTATE_PENDING_SCHEDULE_SET_EXPIRE, enmState))
                 {
                     Assert(!pTimer->offPrev);
@@ -1356,5 +1358,5 @@
                     pTimer->u64Expire = u64Expire;
                     TM_SET_STATE(pTimer, TMTIMERSTATE_PENDING_SCHEDULE);
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSet), a);
                     return VINF_SUCCESS;
@@ -1368,5 +1370,5 @@
                     pTimer->u64Expire = u64Expire;
                     TM_SET_STATE(pTimer, TMTIMERSTATE_PENDING_SCHEDULE);
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSet), a);
                     return VINF_SUCCESS;
@@ -1376,9 +1378,9 @@
 
             case TMTIMERSTATE_ACTIVE:
-                if (tmTimerTryWithLink(pTimer, TMTIMERSTATE_PENDING_RESCHEDULE_SET_EXPIRE, enmState))
+                if (tmTimerTryWithLink(pVM, pTimer, TMTIMERSTATE_PENDING_RESCHEDULE_SET_EXPIRE, enmState))
                 {
                     pTimer->u64Expire = u64Expire;
                     TM_SET_STATE(pTimer, TMTIMERSTATE_PENDING_RESCHEDULE);
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSet), a);
                     return VINF_SUCCESS;
@@ -1392,5 +1394,5 @@
                     pTimer->u64Expire = u64Expire;
                     TM_SET_STATE(pTimer, TMTIMERSTATE_PENDING_RESCHEDULE);
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSet), a);
                     return VINF_SUCCESS;
@@ -1594,5 +1596,5 @@
 
     STAM_PROFILE_START(&pVM->tm.s.CTX_SUFF_Z(StatTimerSetRelative), a);
-    TMTIMER_ASSERT_CRITSECT(pTimer);
+    TMTIMER_ASSERT_CRITSECT(pVM, pTimer);
 
     DBGFTRACE_U64_TAG2(pVM, cTicksToNext, "TMTimerSetRelative", R3STRING(pTimer->pszDesc));
@@ -1641,5 +1643,5 @@
         {
             tmTimerSetRelativeOptimizedStart(pVM, pTimer, cTicksToNext, pu64Now);
-            STAM_PROFILE_STOP(&pTimer->CTX_SUFF(pVM)->tm.s.CTX_SUFF_Z(StatTimerSetRelative), a);
+            STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSetRelative), a);
             return VINF_SUCCESS;
         }
@@ -1673,5 +1675,5 @@
                 RT_FALL_THRU();
             case TMTIMERSTATE_EXPIRED_DELIVER:
-                if (tmTimerTryWithLink(pTimer, TMTIMERSTATE_PENDING_SCHEDULE_SET_EXPIRE, enmState))
+                if (tmTimerTryWithLink(pVM, pTimer, TMTIMERSTATE_PENDING_SCHEDULE_SET_EXPIRE, enmState))
                 {
                     Assert(!pTimer->offPrev);
@@ -1681,5 +1683,5 @@
                           pTimer, tmTimerState(enmState), R3STRING(pTimer->pszDesc), pTimer->u64Expire, cRetries));
                     TM_SET_STATE(pTimer, TMTIMERSTATE_PENDING_SCHEDULE);
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     rc = VINF_SUCCESS;
                     break;
@@ -1696,5 +1698,5 @@
                           pTimer, tmTimerState(enmState), R3STRING(pTimer->pszDesc), pTimer->u64Expire, cRetries));
                     TM_SET_STATE(pTimer, TMTIMERSTATE_PENDING_SCHEDULE);
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     rc = VINF_SUCCESS;
                     break;
@@ -1705,5 +1707,5 @@
 
             case TMTIMERSTATE_ACTIVE:
-                if (tmTimerTryWithLink(pTimer, TMTIMERSTATE_PENDING_RESCHEDULE_SET_EXPIRE, enmState))
+                if (tmTimerTryWithLink(pVM, pTimer, TMTIMERSTATE_PENDING_RESCHEDULE_SET_EXPIRE, enmState))
                 {
                     pTimer->u64Expire = cTicksToNext + tmTimerSetRelativeNowWorker(pVM, enmClock, pu64Now);
@@ -1711,5 +1713,5 @@
                           pTimer, tmTimerState(enmState), R3STRING(pTimer->pszDesc), pTimer->u64Expire, cRetries));
                     TM_SET_STATE(pTimer, TMTIMERSTATE_PENDING_RESCHEDULE);
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     rc = VINF_SUCCESS;
                     break;
@@ -1726,5 +1728,5 @@
                           pTimer, tmTimerState(enmState), R3STRING(pTimer->pszDesc), pTimer->u64Expire, cRetries));
                     TM_SET_STATE(pTimer, TMTIMERSTATE_PENDING_RESCHEDULE);
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     rc = VINF_SUCCESS;
                     break;
@@ -1792,5 +1794,5 @@
         TM_UNLOCK_TIMERS(pVM);
 
-    STAM_PROFILE_STOP(&pTimer->CTX_SUFF(pVM)->tm.s.CTX_SUFF_Z(StatTimerSetRelative), a);
+    STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerSetRelative), a);
     return rc;
 }
@@ -1834,5 +1836,5 @@
     PTMTIMER pTimer;
     TMTIMER_HANDLE_TO_PTR_RETURN(pVM, hTimer, pTimer);
-    TMTIMER_ASSERT_CRITSECT(pTimer);
+    TMTIMER_ASSERT_CRITSECT(pVM, pTimer);
 
     uint32_t const uHzOldHint = pTimer->uHzHint;
@@ -1938,5 +1940,5 @@
 
     STAM_PROFILE_START(&pVM->tm.s.CTX_SUFF_Z(StatTimerStop), a);
-    TMTIMER_ASSERT_CRITSECT(pTimer);
+    TMTIMER_ASSERT_CRITSECT(pVM, pTimer);
 
     /*
@@ -1975,5 +1977,5 @@
                 if (tmTimerTry(pTimer, TMTIMERSTATE_PENDING_STOP_SCHEDULE, enmState))
                 {
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerStop), a);
                     return VINF_SUCCESS;
@@ -1984,5 +1986,5 @@
                 if (tmTimerTry(pTimer, TMTIMERSTATE_PENDING_STOP, enmState))
                 {
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerStop), a);
                     return VINF_SUCCESS;
@@ -1991,7 +1993,7 @@
 
             case TMTIMERSTATE_ACTIVE:
-                if (tmTimerTryWithLink(pTimer, TMTIMERSTATE_PENDING_STOP, enmState))
+                if (tmTimerTryWithLink(pVM, pTimer, TMTIMERSTATE_PENDING_STOP, enmState))
                 {
-                    tmSchedule(pTimer);
+                    tmSchedule(pVM, pTimer);
                     STAM_PROFILE_STOP(&pVM->tm.s.CTX_SUFF_Z(StatTimerStop), a);
                     return VINF_SUCCESS;
@@ -2104,5 +2106,5 @@
     PTMTIMER pTimer;
     TMTIMER_HANDLE_TO_PTR_RETURN_EX(pVM, hTimer, UINT64_MAX, pTimer);
-    TMTIMER_ASSERT_CRITSECT(pTimer);
+    TMTIMER_ASSERT_CRITSECT(pVM, pTimer);
     int cRetries = 1000;
     do
Index: /trunk/src/VBox/VMM/VMMR3/TM.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMR3/TM.cpp	(revision 87770)
+++ /trunk/src/VBox/VMM/VMMR3/TM.cpp	(revision 87771)
@@ -1139,13 +1139,4 @@
         pVM->tm.s.pfnVirtualGetRawRC                 += offDelta;
     }
-
-    /*
-     * Iterate the timers updating the pVMRC pointers.
-     */
-    for (PTMTIMER pTimer = pVM->tm.s.pCreated; pTimer; pTimer = pTimer->pBigNext)
-    {
-        pTimer->pVMRC = pVM->pVMRC;
-        pTimer->pVMR0 = pVM->pVMR0ForCall; /** @todo fix properly */
-    }
 }
 
@@ -1543,15 +1534,13 @@
     pTimer->enmClock        = enmClock;
     pTimer->hSelf           = (TMTIMERHANDLE)pTimer;
-    pTimer->pVMR3           = pVM;
-    pTimer->pVMR0           = pVM->pVMR0ForCall; /** @todo fix properly */
-    pTimer->pVMRC           = pVM->pVMRC;
     pTimer->enmState        = TMTIMERSTATE_STOPPED;
     pTimer->offScheduleNext = 0;
     pTimer->offNext         = 0;
     pTimer->offPrev         = 0;
+    pTimer->fFlags          = fFlags;
+    pTimer->uHzHint         = 0;
     pTimer->pvUser          = NULL;
     pTimer->pCritSect       = NULL;
     pTimer->pszDesc         = pszDesc;
-    pTimer->fFlags          = fFlags;
 
     /* insert into the list of created timers. */
@@ -2796,5 +2785,5 @@
     /* Enter the critical sections to make TMTimerSet/Stop happy. */
     if (pTimer->enmClock == TMCLOCK_VIRTUAL_SYNC)
-        PDMCritSectEnter(&pTimer->pVMR3->tm.s.VirtualSyncLock, VERR_IGNORED);
+        PDMCritSectEnter(&pVM->tm.s.VirtualSyncLock, VERR_IGNORED);
     PPDMCRITSECT pCritSect = pTimer->pCritSect;
     if (pCritSect)
@@ -2829,5 +2818,5 @@
         PDMCritSectLeave(pCritSect);
     if (pTimer->enmClock == TMCLOCK_VIRTUAL_SYNC)
-        PDMCritSectLeave(&pTimer->pVMR3->tm.s.VirtualSyncLock);
+        PDMCritSectLeave(&pVM->tm.s.VirtualSyncLock);
 
     /*
Index: /trunk/src/VBox/VMM/include/TMInternal.h
===================================================================
--- /trunk/src/VBox/VMM/include/TMInternal.h	(revision 87770)
+++ /trunk/src/VBox/VMM/include/TMInternal.h	(revision 87771)
@@ -176,10 +176,6 @@
     /** It's own handle value. */
     TMTIMERHANDLE           hSelf;
-    /** Pointer to the VM the timer belongs to - R3 Ptr. */
-    PVMR3                   pVMR3;
-    /** Pointer to the VM the timer belongs to - R0 Ptr. */
-    R0PTRTYPE(PVMCC)        pVMR0;
-    /** Pointer to the VM the timer belongs to - RC Ptr. */
-    PVMRC                   pVMRC;
+    /** TMTIMER_FLAGS_XXX.   */
+    uint32_t                fFlags;
     /** The timer frequency hint.  This is 0 if not hint was given. */
     uint32_t volatile       uHzHint;
@@ -194,4 +190,6 @@
     /** Pointer to the previous timer in the list of all created timers. (TM::pTimers) */
     PTMTIMERR3              pBigPrev;
+//    /** The timer name. */
+//    char                    szName[32]
     /** Pointer to the timer description. */
     R3PTRTYPE(const char *) pszDesc;
@@ -199,8 +197,4 @@
     uint32_t                padding0; /**< pad structure to multiple of 8 bytes. */
 #endif
-
-    /** TMTIMER_FLAGS_XXX.   */
-    uint32_t                fFlags;
-    uint32_t                u32Padding;
 
 #ifdef VBOX_WITH_STATISTICS
@@ -808,5 +802,5 @@
 
 const char             *tmTimerState(TMTIMERSTATE enmState);
-void                    tmTimerQueueSchedule(PVM pVM, PTMTIMERQUEUE pQueue);
+void                    tmTimerQueueSchedule(PVMCC pVM, PTMTIMERQUEUE pQueue);
 #ifdef VBOX_STRICT
 void                    tmTimerQueuesSanityChecks(PVM pVM, const char *pszWhere);
