Index: /trunk/include/VBox/vmm/hm.h
===================================================================
--- /trunk/include/VBox/vmm/hm.h	(revision 74694)
+++ /trunk/include/VBox/vmm/hm.h	(revision 74695)
@@ -152,5 +152,6 @@
 VMM_INT_DECL(int)               HMVmxGetMsrPermission(void const *pvMsrBitmap, uint32_t idMsr, PVMXMSREXITREAD penmRead,
                                                       PVMXMSREXITWRITE penmWrite);
-VMM_INT_DECL(bool)              HMVmxGetIoBitmapPermission(void const *pvIoBitmapA, void const *pvIoBitmapB, uint16_t uPort);
+VMM_INT_DECL(bool)              HMVmxGetIoBitmapPermission(void const *pvIoBitmapA, void const *pvIoBitmapB, uint16_t uPort,
+                                                           uint8_t cbAccess);
 /** @} */
 
Index: /trunk/src/VBox/VMM/VMMAll/HMVMXAll.cpp
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/HMVMXAll.cpp	(revision 74694)
+++ /trunk/src/VBox/VMM/VMMAll/HMVMXAll.cpp	(revision 74695)
@@ -963,10 +963,21 @@
  * @param   pvIoBitmapB     Pointer to I/O bitmap B.
  * @param   uPort           The I/O port being accessed.
- */
-VMM_INT_DECL(bool) HMVmxGetIoBitmapPermission(void const *pvIoBitmapA, void const *pvIoBitmapB, uint16_t uPort)
-{
-    /* If the port is 0 or ffff ("wrap around"), we cause a VM-exit. */
-    if (   uPort == 0x0000
-        || uPort == 0xffff)
+ * @param   cbAccess        The size of the I/O access in bytes (1, 2 or 4 bytes).
+ */
+VMM_INT_DECL(bool) HMVmxGetIoBitmapPermission(void const *pvIoBitmapA, void const *pvIoBitmapB, uint16_t uPort, uint8_t cbAccess)
+{
+    Assert(cbAccess == 1 || cbAccess == 2 || cbAccess == 4);
+
+    /*
+     * If the I/O port accecss wraps around the 16-bit port I/O space,
+     * we must cause a VM-exit.
+     *
+     * See Intel spec. 25.1.3 "Instructions That Cause VM Exits Conditionally".
+     */
+    /** @todo r=ramshankar: Reading 1, 2, 4 bytes at ports 0xffff, 0xfffe and 0xfffc
+     *        respectively are valid and do not constitute a wrap around from what I
+     *        understand. Verify this later. */
+    uint32_t const uPortLast = uPort + cbAccess;
+    if (uPortLast > 0x10000)
         return true;
 
Index: /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h
===================================================================
--- /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 74694)
+++ /trunk/src/VBox/VMM/VMMAll/IEMAllCImplVmxInstr.cpp.h	(revision 74695)
@@ -2863,8 +2863,9 @@
  *
  * @returns @c true if the instruction is intercepted, @c false otherwise.
- * @param   pVCpu           The cross context virtual CPU structure.
- * @param   u16Port         The I/O port being accessed by the instruction.
- */
-IEM_STATIC bool iemVmxIsIoInterceptSet(PVMCPU pVCpu, uint16_t u16Port)
+ * @param   pVCpu       The cross context virtual CPU structure.
+ * @param   u16Port     The I/O port being accessed by the instruction.
+ * @param   cbAccess    The size of the I/O access in bytes (1, 2 or 4 bytes).
+ */
+IEM_STATIC bool iemVmxIsIoInterceptSet(PVMCPU pVCpu, uint16_t u16Port, uint8_t cbAccess)
 {
     PCVMXVVMCS pVmcs = pVCpu->cpum.GstCtx.hwvirt.vmx.CTX_SUFF(pVmcs);
@@ -2884,5 +2885,5 @@
         Assert(pbIoBitmapA);
         Assert(pbIoBitmapB);
-        return HMVmxGetIoBitmapPermission(pbIoBitmapA, pbIoBitmapB, u16Port);
+        return HMVmxGetIoBitmapPermission(pbIoBitmapA, pbIoBitmapB, u16Port, cbAccess);
     }
 
@@ -3349,5 +3350,5 @@
     Assert(cbAccess == 1 || cbAccess == 2 || cbAccess == 4);
 
-    bool const fIntercept = iemVmxIsIoInterceptSet(pVCpu, u16Port);
+    bool const fIntercept = iemVmxIsIoInterceptSet(pVCpu, u16Port, cbAccess);
     if (fIntercept)
     {
@@ -3391,5 +3392,5 @@
     Assert(uInstrId != VMXINSTRID_IO_INS || ExitInstrInfo.StrIo.iSegReg == X86_SREG_ES);
 
-    bool const fIntercept = iemVmxIsIoInterceptSet(pVCpu, u16Port);
+    bool const fIntercept = iemVmxIsIoInterceptSet(pVCpu, u16Port, cbAccess);
     if (fIntercept)
     {