Index: /trunk/include/VBox/pci.h
===================================================================
--- /trunk/include/VBox/pci.h	(revision 20153)
+++ /trunk/include/VBox/pci.h	(revision 20154)
@@ -280,4 +280,15 @@
 
 /**
+ * Gets the command config register.
+ * @returns The command register value.
+ * @param   pPciDev         The PCI device.
+ */
+DECLINLINE(uint16_t) PCIDevGetCommand(PPCIDEVICE pPciDev)
+{
+    return RT_LE2H_U16(RT_MAKE_U16(pPciDev->config[VBOX_PCI_COMMAND], pPciDev->config[VBOX_PCI_COMMAND + 1]));
+}
+
+
+/**
  * Sets the status config register.
  *
Index: /trunk/src/VBox/Devices/Bus/DevPCI.cpp
===================================================================
--- /trunk/src/VBox/Devices/Bus/DevPCI.cpp	(revision 20153)
+++ /trunk/src/VBox/Devices/Bus/DevPCI.cpp	(revision 20154)
@@ -1265,5 +1265,5 @@
  * @param   pSSMHandle  The handle to save the state to.
  */
-static DECLCALLBACK(int) pciSaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle)
+static DECLCALLBACK(int) pciR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle)
 {
     uint32_t    i;
@@ -1291,5 +1291,5 @@
 
     /*
-     * Iterate all the devices.
+     * Iterate thru all the devices.
      */
     for (i = 0; i < RT_ELEMENTS(pBus->devices); i++)
@@ -1312,4 +1312,48 @@
 
 /**
+ * Disables all PCI devices prior to state loading.
+ *
+ * @returns VINF_SUCCESS.
+ * @param   pBus                The PCI bus instance.
+ */
+static int pciR3CommonLoadPrep(PPCIBUS pBus)
+{
+    /*
+     * Iterate thru all the devices and write 0 to the COMMAND register.
+     * The register value is restored afterwards so we can do proper
+     * LogRels in pciR3CommonRestoreConfig.
+     */
+    for (uint32_t i = 0; i < RT_ELEMENTS(pBus->devices); i++)
+    {
+        PPCIDEVICE pDev = pBus->devices[i];
+        if (pDev)
+        {
+            uint16_t u16 = PCIDevGetCommand(pDev);
+            pDev->Int.s.pfnConfigWrite(pDev, VBOX_PCI_COMMAND, 0, 2);
+            PCIDevSetCommand(pDev, u16);
+            Assert(PCIDevGetCommand(pDev) == u16);
+        }
+    }
+    return VINF_SUCCESS;
+}
+
+
+/**
+ * Prepares a state load.
+ *
+ * This will disable all the device so that the I/O regions gets unmapped.
+ *
+ * @returns VINF_SUCCESS
+ * @param   pDevIns             The device instance.
+ * @param   pSSMHandle          The saved state handle.
+ */
+static DECLCALLBACK(int) pciR3LoadPrep(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle)
+{
+    PPCIGLOBALS pThis = PDMINS_2_DATA(pDevIns, PPCIGLOBALS);
+    return pciR3CommonLoadPrep(&pThis->PciBus);
+}
+
+
+/**
  * Common routine for restoring the config registers of a PCI device.
  *
@@ -1321,5 +1365,5 @@
 {
     /* This table defines the fields for normal devices and bridge devices, and
-       the order in which they need to be restored (nothing special there atm). */
+       the order in which they need to be restored. */
     static const struct PciField
     {
@@ -1334,5 +1378,4 @@
         { 0x00, 2, 0, 3, "VENDOR_ID" },
         { 0x02, 2, 0, 3, "DEVICE_ID" },
-        { 0x04, 2, 1, 3, "COMMAND" },
         { 0x06, 2, 1, 3, "STATUS" },
         { 0x08, 1, 0, 3, "REVISION_ID" },
@@ -1376,4 +1419,8 @@
         { 0x3e, 1, 1, 2, "BRIDGE_CONTROL" },    // fWritable = !? cb=!?
         { 0x3f, 1, 1, 3, "MAX_LAT" },           // fWritable = !? fBridge=!?
+        /* The COMMAND register must come last as it requires the *ADDRESS*
+           registers to be restored before we pretent to change it from 0 to
+           whatever value the guest assigned it. */
+        { 0x04, 2, 1, 3, "COMMAND" },
     };
 
@@ -1406,12 +1453,18 @@
             }
 
-            if (u32Src != u32Dst)
+            if (    u32Src != u32Dst
+                ||  off == VBOX_PCI_COMMAND)
             {
-                if (!s_aFields[i].fWritable)
-                    LogRel(("PCI: %8s/%u: %2u-bit field %s: %x -> %x - !READ ONLY!\n",
-                            pDev->name, pDev->pDevIns->iInstance, cb*8, s_aFields[i].pszName, u32Dst, u32Src));
-                else
-                    LogRel(("PCI: %8s/%u: %2u-bit field %s: %x -> %x\n",
-                            pDev->name, pDev->pDevIns->iInstance, cb*8, s_aFields[i].pszName, u32Dst, u32Src));
+                if (u32Src != u32Dst)
+                {
+                    if (!s_aFields[i].fWritable)
+                        LogRel(("PCI: %8s/%u: %2u-bit field %s: %x -> %x - !READ ONLY!\n",
+                                pDev->name, pDev->pDevIns->iInstance, cb*8, s_aFields[i].pszName, u32Dst, u32Src));
+                    else
+                        LogRel(("PCI: %8s/%u: %2u-bit field %s: %x -> %x\n",
+                                pDev->name, pDev->pDevIns->iInstance, cb*8, s_aFields[i].pszName, u32Dst, u32Src));
+                }
+                if (off == VBOX_PCI_COMMAND)
+                    PCIDevSetCommand(pDev, 0); /* For remapping, see pciR3CommonLoadPrep. */
                 pDev->Int.s.pfnConfigWrite(pDev, off, u32Src, cb);
             }
@@ -1428,5 +1481,5 @@
  * @param   u32Version  The data unit version number.
  */
-static DECLCALLBACK(int) pciLoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle, uint32_t u32Version)
+static DECLCALLBACK(int) pciR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle, uint32_t u32Version)
 {
     PPCIGLOBALS pThis = PDMINS_2_DATA(pDevIns, PPCIGLOBALS);
@@ -2012,5 +2065,5 @@
 
     rc = SSMR3RegisterDevice(PDMDevHlpGetVM(pDevIns), pDevIns, "pci", iInstance, VBOX_PCI_SAVED_STATE_VERSION, sizeof(*pBus) + 16*128, "pgm",
-                             NULL, pciSaveExec, NULL, NULL, pciLoadExec, NULL);
+                             NULL, pciR3SaveExec, NULL, pciR3LoadPrep, pciR3LoadExec, NULL);
     if (RT_FAILURE(rc))
         return rc;
@@ -2180,6 +2233,7 @@
  * @param   pSSMHandle  The handle to save the state to.
  */
-static DECLCALLBACK(int) pcibridgeSaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle)
-{
+static DECLCALLBACK(int) pcibridgeR3SaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle)
+{
+/** @todo make common with pciR3SaveExec! */
     uint32_t    i;
     PPCIBUS pThis = PDMINS_2_DATA(pDevIns, PPCIBUS);
@@ -2204,4 +2258,21 @@
     return SSMR3PutU32(pSSMHandle, ~0); /* terminator */
 }
+
+
+/**
+ * Prepares a state load.
+ *
+ * This will disable all the device so that the I/O regions gets unmapped.
+ *
+ * @returns VINF_SUCCESS
+ * @param   pDevIns             The device instance.
+ * @param   pSSMHandle          The saved state handle.
+ */
+static DECLCALLBACK(int) pcibridgeR3LoadPrep(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle)
+{
+    PPCIBUS pThis = PDMINS_2_DATA(pDevIns, PPCIBUS);
+    return pciR3CommonLoadPrep(pThis);
+}
+
 
 /**
@@ -2213,5 +2284,5 @@
  * @param   u32Version  The data unit version number.
  */
-static DECLCALLBACK(int) pcibridgeLoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle, uint32_t u32Version)
+static DECLCALLBACK(int) pcibridgeR3LoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle, uint32_t u32Version)
 {
     PPCIBUS     pBus  = PDMINS_2_DATA(pDevIns, PPCIBUS);
@@ -2220,5 +2291,5 @@
     int         rc;
 
-/** @todo r=bird: this is a copy of pciLoadExec. combine the two!  */
+/** @todo r=bird: this is a copy of pciR3LoadExec. combine the two!  */
 
     /*
@@ -2479,5 +2550,5 @@
      */
     rc = SSMR3RegisterDevice(PDMDevHlpGetVM(pDevIns), pDevIns, "pcibridge", iInstance, VBOX_PCI_SAVED_STATE_VERSION, sizeof(*pBus) + 16*128, "pgm",
-                             NULL, pcibridgeSaveExec, NULL, NULL, pcibridgeLoadExec, NULL);
+                             NULL, pcibridgeR3SaveExec, NULL, pcibridgeR3LoadPrep, pcibridgeR3LoadExec, NULL);
     if (RT_FAILURE(rc))
         return rc;